Hi everyone 
Fresh patch releases just landed: 35.0.3, 34.0.6 and 33.0.11 are out! 
Get them
What changed
35.0.3
server
- Fix(sharing): hide external sharing section when link sharing disabled (server#64335)
- Fix(files_sharing): limit the share token input to the maximum token length (server#64710)
- Fix(settings): prevent user list crash when password changes are disabled (server#64912)
- Fix(globalscale): ignore lookupserver if empty config (server#65185)
- Fix(backupcodes): Dismiss notification on disabled provider (server#65318)
- Fix(admin-audit): Log when BFP was bypassed (server#65327)
- Fix(files_sharing): preserve share expiration time (server#65403)
- Fix: add files_metadata_index to the filecache partition (server#65414)
- Fix(settings): add select event to AppNavigationGroupList and clear s… (server#65418)
- Chore: Add `testing:prepare-ci` command (server#65421)
- Improve performance of snowflake ids in cron jobs (server#65425)
- Fix(mail): embed image logo only when using useTemplate (server#65428)
- Fix: Remove unused $allStorages array in files_external (server#65440)
- Fix/objectstore fopen basename ext (server#65441)
- Chore: Skip transaction when no preview exists (server#65446)
- Perf(files): cache the mimetype table (server#65448)
- Perf(app): cache the parsed app info as array (server#65449)
- Perf: Improve preview cold generation (server#65451)
- Fix(encryption): use the block size of the file encoding when fixing sizes (server#65460)
- Perf: Partition preview migration job (server#65464)
- Fix(files_reminders): keep folder preload for folders over 512 entries (server#65476)
- Perf(preview): only autorotate with Imaginary when needed (server#65485)
- Fix(dav): handle 4-byte text consistently in calendar indexes (server#65488)
- Fix(appstore): only ask once for password confirmation (server#65496)
- Fix(user_ldap): Use proper function builder instead of hardcoded COUNT (server#65501)
- Fix(migration): check if deleted_by column exists before trying to add it to files_trash table (server#65518)
- Fix(dav): adjust password session check on legacy dav auth (server#65541)
- Ci: run the guests integration tests against guests stable-4.10 (server#65554)
- Fix(files_sharing): show the owner avatar for received shares (server#65560)
- Fix(files): normalize Unicode in node paths (server#65566)
- Fix(DefaultShareProvider): Set missing attributes when user manually accepts or rejects a share (server#65572)
- Fix(sharebymail): Send readable password by mail instead of hash (server#65578)
- Fix(dav): resolve users before intersecting shares (server#65584)
- Chore: Update setup-php to 2.40.0 (server#65661)
- Fix: Playwright concurrency (server#65673)
- Fix: don’t try to load keys for empty path for groupfolder versions (server#65676)
- Fix(ui): Consider typing and scrolling as activity for auto logout (server#65691)
- Fix(dav): remove CalDAV availability when all working-hour slots are cleared (server#65695)
- Fix(encryption): Remember the recalculated unencrypted size as int (server#65701)
- Fix: Remove auto increment migration on share_external (server#65711)
- Fix(user_ldap): remove leftover debug log in getUserFromCustomAttribute (server#65713)
- Fix: move column drop in to separate migration (server#65719)
- Fix(DisableSystemAddressBook): Fix notification by providing an object id (server#65734)
- Fix(dav): compare sync token retention against an absolute cutoff (server#65757)
- Perf(sharing): skip resolving group shares when there are none (server#65786)
- Hash validate legacy (server#65787)
- Feat: allow passing a cache entry to getMetadataForNode (server#65803)
- Fix(ci): clone vendored test apps from the matching stable branch (server#65875)
- Fix(files): skip quota check when opening files for reading (server#65880)
- Chore: flake update (server#65908)
- Fix(files_sharing): public share popover jumps on options toggle (server#65913)
- Feat(Sharing): Allow remote owners and initiators (server#65915)
- Fix(since): Ensure provided since version is from the current branch (server#65924)
- Fix(files): upload files with empty mime type (server#65927)
- Fix(provisioning_api): filter users by enabled state on the server (server#65929)
- Fix: move/rename of part file in masked dir/storage (server#65934)
- Fix: Remove avatar and credentials only after user removal (server#65948)
- Fix(core): use %n in the integrity check plural to avoid a crash in L10N (server#65958)
- Ci: sync workflows with .github (server#65961)
- Refactor: store state enums in unified sharing as ints (server#65966)
- Ci: bump dorny/paths-filter to v4.0.3 (server#65967)
- Fix(files_sharing): Make sure mount events are dispatched for share recipients (server#65988)
- Fix(appstore): do not wrap app store screenshots in the proxy twice (server#65991)
- Fix(versions): empty array for external shares (server#66005)
- Fix(dav): detect truncated CardDAV sync results on all databases (server#66012)
- Fix(dav): pair changed iTip instances by UID/RECURRENCE-ID instead of… (server#66015)
- Test(avatar): Check the guest avatar independent of the font renderer (server#66017)
- Build(deps): bump the symfony group across 1 directory with 10 updates (server#66030)
- Fix(dav): align public request path handling (server#66038)
- Fix: unique custom tokens for share links (server#66044)
- Fix(Security\Hasher): Guard PASSWORD_ARGON2 constants with defined() check (server#66047)
- Build(deps): Bump Symfony packages (server#66133)
- Refactor: map sharing instances to ints, and add instance to indices (server#66145)
- Fix: properly handle webdav pagination headers (server#66156)
- Fix(external-share): move ExternalShareScanJob creation deeper (server#66157)
- Fix(avatar): add timeout and size limit when fetching remote avatars (server#66162)
- Fix(files_external): reset EOF when seeking in SFTPReadStream (server#66166)
- Fix(log): Avoid crashes when building exception trace with a ghost (server#66172)
- Feat(files): expose forbidden filename capabilities publicly (server#66182)
- Fix: improve live-photo handling (server#66190)
- Fix(user_ldap): Fix variable name conflict for cache key (server#66196)
- Fix(dav): bind public share session authentication to the password hash (server#66204)
- Feat(LocalStorage): add config option to configure min_free_space (server#66205)
- Fix(user_ldap): do not cache unknown names in the local mapping cache (server#66209)
- Ci: drop cat of Imagick policy (server#66220)
- Fix(systemtags): properly handle object ids (server#66229)
- Fix(favorite): Limit tagging to favorite (server#66232)
- Fix(dav): do not grant write-properties to read-only calendar delegates (server#66237)
- Fix: Reject login with NUL bytes rather than converting (server#66242)
- Fix(provisioning_api): group admins can’t add all users to groups (server#66265)
- Fix(share-folder): use it on federated share (server#66278)
- Fix(dav): register missing app config keys in the config lexicon (server#66281)
- Fix(encryption): Don’t use ChunkingV2Plugin when server-side encryption is enabled (server#66290)
- Fix(files): Continue scanning after StorageInvalidException (server#66291)
- Fix(session): Prevent stale requests from replacing a regenerated session (server#66295)
- Feat(federation): ignore remote contacts (server#66307)
- Fix(theming): only accept canonical svg paths for themed icons (server#66310)
- Fix(files): check that the source properly between storages (server#66315)
- Fix(dav): allow moves within own share when sharing is disabled (server#66331)
- Fix(quota): Calculate used quota for foreign users the correct way (server#66332)
- Fix(webhook_listeners): Change Exception type (server#66343)
- Fix(tags): display selected tag in settings (server#66346)
- Refactor(session): use ITimeFactory for superseded session markers (server#66350)
- Ci(psalm): run taint analysis with all available threads (server#66356)
- Fix(lostpassword): Avoid having a different error message between expired and invalid (server#66365)
- Ci(dav): run CalDAVTester in a Python 2.7 container (server#66368)
- Fix(federatedfilesharing): match reshares by node, not by name (server#66373)
- Fix(sharing): Add names to new indexes (server#66386)
- Fix: sharing attribute resolution (server#66395)
- Fix(preview): send the whole JPEG to Imaginary (server#66400)
activity
- Correctly apply groupfolders acl (activity#3020)
- Perf(activity): reintroduce activity_object index (activity#3021)
- Fix(api): fall back to MIME icon when preview generation fails (activity#3070)
app_api
- Refactor(harp): compare the HaRP shared key with hash_equals (app_api#1118)
- Fix(deploy): round the memory and CPU limits to whole numbers (app_api#1122)
- Fix(docker): no PHP warning for a HaRP daemon without a key (app_api#1137)
- Fix(harp): send the route verb to HaRP (app_api#1142)
- Fix(proxy): match the route verb like HaRP (app_api#1145)
- Fix(harp): require HaRP 0.4.8 in the version check (app_api#1150)
- Fix(proxy): refuse dot segments resolved after the route check (app_api#1164)
- Fix(proxy): refuse the ExApp lifecycle endpoints like HaRP (app_api#1169)
- Fix(proxy): check routes on each reading of the path like HaRP (app_api#1183)
bruteforcesettings
circles
- Feature/implement default quota for groups (circles#2907)
- Fix(teams): fix team folder ‘View in Files’ header link (circles#2943)
- Feat(command): add --delete option to circles:remote (circles#3045)
- Fix(notifications): dismiss join request notification once processed (circles#3048)
- Fix: only show shared resources that are still acessible (circles#3054)
- Fix(mount-provider): Pass the recipient to the federated share storage (circles#3073)
- Enh(performance): query memberships breadth first to reduce query count (circles#3080)
- Add title html attr to team card display names (circles#3100)
- Fix: Teams Pages editor doesn’t load (circles#3121)
- Fix(shares): keep circle context when share is resolved via circle (circles#3126)
- Fix(share): use setPasswordHash instead of setPassword when retrieving share (circles#3130)
- Fix(notification): Make relative action links absolute when preparing (circles#3135)
- Fix: use strict in_array (circles#3138)
files_downloadlimit
- Fix: disable props not supported with download limit (files_downloadlimit#1080)
- Ci: Add release relay job (files_downloadlimit#1086)
- Fix: count legacy share downloads only once (files_downloadlimit#1089)
files_lock
- Fix: allow force unlock without access of the lock owner (files_lock#1363)
- Fix(dav): extend the lock expiry on a WebDAV LOCK refresh (files_lock#1366)
- Feat(lock): remove locks of disabled or deleted users and on unshare (files_lock#1391)
- Fix(lock): only return string app names from getAppName (files_lock#1398)
logreader
- Feat(search): replace search popover with inline search field (logreader#2317)
- Perf(LogIterator): Read long lines in linear time (logreader#2328)
- Fix(LogTable): load entries until screen is filled (logreader#2363)
notifications
- Chore: Fix composer.lock hash (notifications#3463)
- Build(deps-dev): Bump behat/behat from 3.33.0 to 4.0.0 in /tests/Integration (notifications#3472)
- Feat: open the target when a background push notification is clicked (notifications#3480)
- Ci(performance): Update actions (notifications#3503)
- Fix(web-notifications): open notification link in a new tab (notifications#3538)
- Apply hardenings found by automated scanner (notifications#3541)
- Fix(web-push): improve fetching notifications with web-push (notifications#3550)
photos
- Fix(tags): read the tag id from the node instead of its attributes (photos#3871)
- Fix(viewer): forward live photo metadata (photos#4005)
- Chore(deps): combine pending dependency updates (photos#4029)
- Fix(faces): Fix assigning unassigned faces to a person (photos#4032)
- Honor EXIF OffsetTimeOriginal (photos#4039)
- Fix(filters): respect share download permission in filtered albums (photos#4040)
- Fix: proper component names (photos#4064)
privacy
recommendations
serverinfo
- Feat: Show all users who logged at least once (serverinfo#1250)
- Fix(database): drop the join-without-index rules (serverinfo#1258)
- Use subscription count when support app is enabled (serverinfo#1267)
text
- Fix(files): edited files marked locked in files list after close (text#9378)
- Tables: typescript and heading cell fixes (text#9384)
- Refactor version comparison (text#9386)
- Fix(attachments): rewrite attachment file ids when copying folders (text#9391)
- Fix(attachments): normalize attachment names to Unicode NFC (text#9396)
- Fix(migration): quote identifiers in oracle index creation (text#9397)
- Fix(math): import katex css from component (text#9401)
- Fix(notifications): notify mentioned users about mentions by guests (text#9402)
- Fix(table): paste copied table cells into target cells (text#9409)
- Test(comparison): destroy all editor views in decorations spec (text#9430)
- Fix(session): skip session lookup without session params (text#9443)
- Check permission (text#9445)
- Fix(migration): create text_steps index ascending on oracle (text#9472)
- Fix(menu): make component actions work from the remaining actions menu (text#9473)
- Fix misc flaky tests (text#9479)
- Fix(session): close null user (text#9510)
- Perf(cleanup): Optimize cleanup job (text#9515)
- Fix(editor): do not force save when clicking the save indicator (text#9528)
- Perf(editor): only serialize markdown on update when it is read (text#9529)
- Fix: don’t silently drop outside changes (e.g. from external storage) (text#9530)
- Fix(FileContext): fix typo `computeChecksum()` → `computeCheckSum()` (text#9538)
- Fix(sync): improve situation around false conflicts (text#9547)
- Chore(dev-deps): pin rector to 2.8.1 and phpstan to 2.3.3 (text#9549)
- Fix: improve gap cursor usage (text#9554)
twofactor_nextcloud_notification
viewer
- Fix/noid/no drag cursor without zoom compiled (viewer#3361)
- Fix(viewer): register handlers not yet in the lookup table when opening a file (viewer#3423)
- Fix: only call the legacy files sidebar methods when they exist (viewer#3448)
- Fix(editor): save a JPEG with an uppercase extension as a JPEG (viewer#3450)
- Chore(deps): update stylelint to 17 (viewer#3454)
- Fix(viewer): skip duplicate handlers on init (viewer#3457)
- Fix(viewer): handle public shares on delete (viewer#3460)
- Fix(videos): use live photo metadata for poster (viewer#3461)
34.0.6
server
- Chore: Improve phpunit performance (server#63398)
- Fix(chunkingUpload): sliding expiration based on upload activity (server#64026)
- Fix(files_sharing): name the parent folder in inherited unshare actions (server#64350)
- Fix: Forward not found error in sabre (server#64940)
- Fix: Remove unused $allStorages array in files_external (server#64988)
- Fix(kerberos): Allow again to specify empty url (server#64989)
- Test: enable filecache partitioning for one mysql test (server#65129)
- Fix(globalscale): ignore lookupserver if empty config (server#65184)
- Fix(backupcodes): Dismiss notification on disabled provider (server#65317)
- Fix(admin-audit): Log when BFP was bypassed (server#65328)
- Fix(files_sharing): preserve share expiration time (server#65404)
- Fix: add files_metadata_index to the filecache partition (server#65413)
- Fix(settings): add select event to AppNavigationGroupList and clear s… (server#65417)
- Chore: Add `testing:prepare-ci` command (server#65420)
- Fix(mail): embed image logo only when using useTemplate (server#65427)
- Chore: Skip transaction when no preview exists (server#65445)
- Fix(encryption): use the block size of the file encoding when fixing sizes (server#65459)
- Perf: Partition preview migration job (server#65465)
- Perf(preview): only autorotate with Imaginary when needed (server#65486)
- Fix(appstore): only ask once for password confirmation (server#65495)
- Fix(user_ldap): Use proper function builder instead of hardcoded COUNT (server#65502)
- Fix(migration): check if deleted_by column exists before trying to add it to files_trash table (server#65517)
- Fix(dav): adjust password session check on legacy dav auth (server#65540)
- Fix: Store login name and not uid in session when login with webauthn (server#65548)
- Ci: run the guests integration tests against guests stable-4.10 (server#65553)
- Fix(files_sharing): show the owner avatar for received shares (server#65561)
- Fix(files): normalize Unicode in node paths (server#65565)
- Fix(DefaultShareProvider): Set missing attributes when user manually accepts or rejects a share (server#65571)
- Fix(dav): resolve users before intersecting shares (server#65583)
- Chore: Update setup-php to 2.40.0 (server#65664)
- Fix: Playwright concurrency (server#65672)
- Fix: don’t try to load keys for empty path for groupfolder versions (server#65675)
- Fix(ui): Consider typing and scrolling as activity for auto logout (server#65690)
- Fix(dav): remove CalDAV availability when all working-hour slots are cleared (server#65694)
- Fix(encryption): Remember the recalculated unencrypted size as int (server#65700)
- Fix: Remove auto increment migration on share_external (server#65710)
- Fix(user_ldap): remove leftover debug log in getUserFromCustomAttribute (server#65712)
- Fix: move column drop in to separate migration (server#65718)
- Fix(DisableSystemAddressBook): Fix notification by providing an object id (server#65733)
- Fix(ci): clone vendored test apps from the matching stable branch (server#65874)
- Fix(files): skip quota check when opening files for reading (server#65879)
- Chore: flake update (server#65907)
- Fix(files_sharing): public share popover jumps on options toggle (server#65912)
- Fix(security): Update CA certificate bundle (server#65916)
- Fix: move/rename of part file in masked dir/storage (server#65933)
- Fix(provisioning_api): filter users by enabled state on the server (server#65947)
- Fix: Remove avatar and credentials only after user removal (server#65952)
- Fix(core): use %n in the integrity check plural to avoid a crash in L10N (server#65957)
- Ci: sync workflows with .github (server#65963)
- Fix(files_sharing): Make sure mount events are dispatched for share recipients (server#65989)
- Fix(appstore): do not wrap app store screenshots in the proxy twice (server#65990)
- Fix(versions): empty array for external shares (server#66004)
- Fix(dav): detect truncated CardDAV sync results on all databases (server#66011)
- Fix(since): Ensure provided since version is from the current branch (server#66021)
- Build(deps): bump the symfony group across 1 directory with 9 updates (server#66031)
- Fix(dav): align public request path handling (server#66039)
- Fix: unique custom tokens for share links (server#66043)
- Build(deps): Bump Symfony packages (server#66134)
- Fix: properly handle webdav pagination headers (server#66155)
- Fix(external-share): move ExternalShareScanJob creation deeper. (server#66158)
- Fix(tags): display selected tag in settings (server#66163)
- Fix(log): Avoid crashes when building exception trace with a ghost (server#66173)
- Fix: improve live-photo handling (server#66189)
- Fix(CalDAV): extract data from occurance exemptions (server#66191)
- Fix: BearerAuth should not check for already loggedin user (server#66194)
- Fix(user_ldap): Fix variable name conflict for cache key (server#66197)
- Fix(dav): bind public share session authentication to the password hash (server#66203)
- Fix(user_ldap): do not cache unknown names in the local mapping cache (server#66208)
- Ci: drop cat of Imagick policy (server#66221)
- Fix(systemtags): properly handle object ids (server#66228)
- Fix(favorite): Limit tagging to favorite (server#66230)
- Fix(dav): do not grant write-properties to read-only calendar delegates (server#66236)
- Fix: Reject login with NUL bytes rather than converting (server#66241)
- Fix(provisioning_api): group admins can’t add all users to groups (server#66264)
- Fix(share-folder): use it on federated share (server#66279)
- Fix(dav): register missing app config keys in the config lexicon (server#66282)
- Fix(encryption): Don’t use ChunkingV2Plugin when server-side encryption is enabled (server#66289)
- Fix(files): Continue scanning after StorageInvalidException (server#66292)
- Fix: Use strict in_array in ApplicableHelper (server#66294)
- Feat(federation): ignore remote contacts (server#66306)
- Fix(theming): only accept canonical svg paths for themed icons (server#66311)
- Fix(files): check that the source properly between storages (server#66316)
- Fix(session): Prevent stale requests from replacing a regenerated session (server#66324)
- Fix(dav): allow moves within own share when sharing is disabled (server#66330)
- Fix(quota): Calculate used quota for foreign users the correct way (server#66333)
- Fix(webhook_listeners): Change Exception type (server#66342)
- Refactor(session): use ITimeFactory for superseded session markers (server#66351)
- Ci(psalm): run taint analysis with all available threads (server#66357)
- Fix(core): await enabling recommended apps before collecting results (server#66362)
- Fix(lostpassword): Avoid having a different error message between expired and invalid (server#66366)
- Ci(dav): run CalDAVTester in a Python 2.7 container (server#66369)
- Fix(federatedfilesharing): match reshares by node, not by name (server#66372)
activity
- Fix(activity): reset the current user and release the teams session (activity#2925)
- Perf(activity): reintroduce activity_object index (activity#3022)
- Fix(files): do not publish incompletely built activity events (activity#3062)
- Chore: Set specific PHP platform to fix psalm CI (activity#3064)
- Fix(tests): Remove broken toast closing & remove use of query method (activity#3065)
- Fix(api): fall back to MIME icon when preview generation fails (activity#3069)
app_api
- Refactor(harp): compare the HaRP shared key with hash_equals (app_api#1115)
- Fix(deploy): round the memory and CPU limits to whole numbers (app_api#1121)
- Fix(docker): no PHP warning for a HaRP daemon without a key (app_api#1136)
- Fix(harp): send the route verb to HaRP (app_api#1141)
- Fix(proxy): match the route verb like HaRP (app_api#1146)
- Fix(harp): require HaRP 0.4.8 in the version check (app_api#1151)
- Fix(proxy): refuse dot segments resolved after the route check (app_api#1165)
- Fix(proxy): refuse the ExApp lifecycle endpoints like HaRP (app_api#1170)
- Fix(proxy): check routes on each reading of the path like HaRP (app_api#1184)
bruteforcesettings
circles
- Feat(command): add --delete option to circles:remote (circles#3044)
- Fix(notifications): dismiss join request notification once processed (circles#3047)
- Fix: only show shared resources that are still acessible (circles#3053)
- Fix(mount-provider): Pass the recipient to the federated share storage (circles#3074)
- Enh(performance): query memberships breadth first to reduce query count (circles#3081)
- Fix(shares): keep circle context when share is resolved via circle (circles#3127)
- Fix(notification): Make relative action links absolute when preparing (circles#3134)
- Fix: use strict in_array (circles#3137)
files_downloadlimit
- Fix: disable props not supported with download limit (files_downloadlimit#1079)
- Ci: Add release relay job (files_downloadlimit#1085)
- Fix: count legacy share downloads only once (files_downloadlimit#1088)
files_lock
- Fix: widen lock identifiers and durations to bigint (files_lock#1320)
- Fix: allow force unlock without access of the lock owner (files_lock#1364)
- Fix(lock): only return string app names from getAppName (files_lock#1396)
- Ci: Add release relay job (files_lock#1415)
files_pdfviewer
logreader
- Feat(search): replace search popover with inline search field (logreader#2316)
- Perf(LogIterator): Read long lines in linear time (logreader#2329)
- Fix(LogTable): load entries until screen is filled (logreader#2362)
notifications
- Build(deps-dev): Bump behat/behat from 3.33.0 to 4.0.0 in /tests/Integration (notifications#3471)
- Ci(performance): Update actions (notifications#3504)
- Fix(webpush): Correctly hide already read notifications from webpush (notifications#3545)
- Feat: open the target when a background push notification is clicked (notifications#3546)
- Fix(web-notifications): open notification link in a new tab (notifications#3547)
- Apply hardenings found by automated scanner (notifications#3548)
- Fix(web-push): improve fetching notifications with web-push (notifications#3551)
photos
- Fix(tags): read the tag id from the node instead of its attributes (photos#3873)
- Chore(deps): combine pending dependency updates (photos#4030)
- Fix(filters): respect share download permission in filtered albums (photos#4035)
- Honor EXIF OffsetTimeOriginal (photos#4038)
privacy
recommendations
- Ci: workflow templates and npm audit fix (recommendations#1199)
- Chore(deps): bump npm dependencies (recommendations#1203)
related_resources
serverinfo
text
- Fix(files): edited files marked locked in files list after close (text#9377)
- Fix(Table): return Tab and Shift-Tab handler results to mark the even… (text#9379)
- Fix(attachments): rewrite attachment file ids when copying folders (text#9390)
- Fix(attachments): normalize attachment names to Unicode NFC (text#9395)
- Fix(math): import katex css from component (text#9400)
- Fix(notifications): notify mentioned users about mentions by guests (text#9403)
- Fix(migration): quote identifiers in oracle index creation (text#9407)
- Fix(migration): create text_steps index ascending on oracle (text#9471)
- Fix(menu): make component actions work from the remaining actions menu (text#9474)
- Fix misc flaky tests (text#9480)
- Perf(cleanup): Optimize cleanup job (text#9516)
- Fix(sessions): only use share node matching the session document (text#9521)
- Fix(editor): do not force save when clicking the save indicator (text#9527)
- Fix: don’t silently drop outside changes (e.g. from external storage) (text#9539)
- Perf(editor): only serialize markdown on update when it is read (text#9543)
- Fix(sync): improve situation around false conflicts (text#9551)
- Fix: improve gap cursor usage (text#9553)
viewer
- Fix: properly handle e2ee support (viewer#3368)
- Fix(viewer): register handlers not yet in the lookup table when opening a file (viewer#3422)
- Chore(deps): update vite to 7 and stylelint to 17 (viewer#3453)
- Fix(viewer): skip duplicate handlers on init (viewer#3459)
33.0.11
server
- Use strict comparaison (server#64326)
- Fix(files_sharing): name the parent folder in inherited unshare actions (server#64351)
- Test: enable filecache partitioning for one mysql test (server#65130)
- Fix(backupcodes): Dismiss notification on disabled provider (server#65316)
- Fix(admin-audit): Log when BFP was bypassed (server#65329)
- Fix(files_sharing): preserve share expiration time (server#65405)
- Chore: Add `testing:prepare-ci` command (server#65419)
- Chore: Skip transaction when no preview exists (server#65447)
- Fix(encryption): use the block size of the file encoding when fixing sizes (server#65458)
- Perf: Partition preview migration job (server#65466)
- Perf(preview): only autorotate with Imaginary when needed (server#65487)
- Fix(migration): check if deleted_by column exists before trying to add it to files_trash table (server#65516)
- Fix(dav): adjust password session check on legacy dav auth (server#65539)
- Fix(files_sharing): show the owner avatar for received shares (server#65559)
- Fix(files): normalize Unicode in node paths (server#65564)
- Fix(DefaultShareProvider): Set missing attributes when user manually accepts or rejects a share (server#65570)
- Fix(dav): resolve users before intersecting shares (server#65582)
- Fix(chunkingUpload): sliding expiration based on upload activity (server#65655)
- chore: Update setup-php to 2.40.0 (server#65665)
- Fix: Playwright concurrency (server#65671)
- Fix: don’t try to load keys for empty path for groupfolder versions (server#65674)
- Fix(ui): Consider typing and scrolling as activity for auto logout (server#65689)
- Fix(dav): remove CalDAV availability when all working-hour slots are cleared (server#65693)
- Fix(encryption): Remember the recalculated unencrypted size as int (server#65699)
- Fix: Remove auto increment migration on share_external (server#65709)
- Fix(DisableSystemAddressBook): Fix notification by providing an object id (server#65732)
- Fix(ci): clone vendored test apps from the matching stable branch (server#65873)
- Fix(files): skip quota check when opening files for reading (server#65878)
- Chore: flake update (server#65906)
- Fix(files_sharing): public share popover jumps on options toggle (server#65911)
- Fix(security): Update CA certificate bundle (server#65917)
- Fix: move/rename of part file in masked dir/storage (server#65932)
- Fix(provisioning_api): filter users by enabled state on the server (server#65946)
- Ci: sync workflows with .github (server#65964)
- Fix(kerberos): Allow again to specify empty url (server#65980)
- Fix(appstore): do not wrap app store screenshots in the proxy twice (server#65992)
- Fix(dav): detect truncated CardDAV sync results on all databases (server#66010)
- Fix(versions): empty array for external shares (server#66027)
- Build(deps): bump the symfony group across 1 directory with 9 updates (server#66032)
- Fix(dav): align public request path handling (server#66040)
- Fix: unique custom tokens for share links (server#66042)
- Build(deps): Bump Symfony packages (server#66135)
- Fix: properly handle webdav pagination headers (server#66154)
- Fix(external-share): move ExternalShareScanJob creation deeper (server#66159)
- Fix: improve live-photo handling (server#66188)
- Fix(CalDAV): extract data from occurance exemptions (server#66192)
- Fix(user_ldap): Fix variable name conflict for cache key (server#66198)
- Fix(dav): bind public share session authentication to the password hash (server#66202)
- Fix(user_ldap): do not cache unknown names in the local mapping cache (server#66207)
- Ci: drop cat of Imagick policy (server#66222)
- Fix(systemtags): properly handle object ids (server#66227)
- Fix(favorite): Limit tagging to favorite (server#66231)
- Fix(dav): do not grant write-properties to read-only calendar delegates (server#66235)
- Fix: Reject login with NUL bytes rather than converting (server#66240)
- Fix: BearerAuth should not check for already loggedin user (server#66243)
- Fix(provisioning_api): group admins can’t add all users to groups (server#66263)
- Fix(share-folder): use it on federated share (server#66277)
- Fix(dav): register missing app config keys in the config lexicon (server#66283)
- Fix(encryption): Don’t use ChunkingV2Plugin when server-side encryption is enabled (server#66288)
- Fix(files): Continue scanning after StorageInvalidException (server#66293)
- Fix(theming): only accept canonical svg paths for themed icons (server#66312)
- Fix(files): check that the source properly between storages (server#66317)
- Fix(session): Prevent stale requests from replacing a regenerated session (server#66325)
- Fix(dav): allow moves within own share when sharing is disabled (server#66329)
- Fix(quota): Calculate used quota for foreign users the correct way (server#66334)
- Fix(webhook_listeners): Change Exception type (server#66341)
- Refactor(session): use ITimeFactory for superseded session markers (server#66352)
- Ci(psalm): run taint analysis with all available threads (server#66358)
- Fix(lostpassword): Avoid having a different error message between expired and invalid (server#66367)
- Fix(federatedfilesharing): match reshares by node, not by name (server#66371)
activity
- Fix(notifications): Require absolute links for support of desktop and mobile clients (activity#2829)
- Fix(activity): reset the current user and release the teams session (activity#2926)
- Perf(activity): reintroduce activity_object index (activity#3023)
- Fix(files): do not publish incompletely built activity events (activity#3063)
- Fix(tests): Remove broken toast closing & remove use of query method (activity#3066)
- Chore: Set specific PHP platform to fix psalm CI (activity#3067)
- Fix(api): fall back to MIME icon when preview generation fails (activity#3068)
app_api
- Refactor(harp): compare the HaRP shared key with hash_equals (app_api#1116)
- Fix(deploy): round the memory and CPU limits to whole numbers (app_api#1120)
- Fix(daemon): stop prefilling the daemon key in the templates (app_api#1131)
- Fix(docker): no PHP warning for a HaRP daemon without a key (app_api#1134)
- Fix(harp): send the route verb to HaRP (app_api#1139)
- Fix(proxy): match the route verb like HaRP (app_api#1147)
- Fix(harp): require HaRP 0.4.8 in the version check (app_api#1152)
- Fix(proxy): refuse dot segments resolved after the route check (app_api#1166)
- Fix(proxy): refuse the ExApp lifecycle endpoints like HaRP (app_api#1171)
- Fix(proxy): check routes on each reading of the path like HaRP (app_api#1185)
bruteforcesettings
circles
- Feat(command): add --delete option to circles:remote (circles#3043)
- Fix(notifications): dismiss join request notification once processed (circles#3046)
- Fix: only show shared resources that are still acessible (circles#3052)
- Fix: resolve share mount for remote circle members (circles#3098)
- Fix(shares): keep circle context when share is resolved via circle (circles#3128)
- Fix(notification): Make relative action links absolute when preparing (circles#3133)
- Fix: use strict in_array (circles#3141)
files_downloadlimit
- Fix: disable props not supported with download limit (files_downloadlimit#1078)
- Ci: Add release relay job (files_downloadlimit#1084)
logreader
- Feat(search): replace search popover with inline search field (logreader#2315)
- Perf(LogIterator): Read long lines in linear time (logreader#2330)
- Fix(LogTable): load entries until screen is filled (logreader#2361)
notifications
- Build(deps-dev): Bump behat/behat from 3.33.0 to 4.0.0 in /tests/Integration (notifications#3470)
- Ci(performance): Update actions (notifications#3505)
photos
- Fix(tags): read the tag id from the node instead of its attributes (photos#3872)
- Chore: Patch cypress workflow (photos#3987)
- Chore: workflow templates and psalm stub fix (photos#4031)
- Fix(filters): respect share download permission in filtered albums (photos#4036)
privacy
recommendations
- Ci: workflow templates and npm audit fix (recommendations#1200)
- Chore(deps): bump npm dependencies (recommendations#1204)
related_resources
serverinfo
text
- Fix(files): edited files marked locked in files list after close (text#9376)
- Fix(attachments): rewrite attachment file ids when copying folders (text#9389)
- Fix(attachments): normalize attachment names to Unicode NFC (text#9394)
- Fix(math): import katex css from component (text#9399)
- Fix(migration): quote identifiers in oracle index creation (text#9408)
- Fix(migration): create text_steps index ascending on oracle (text#9470)
- Fix(menu): make component actions work from the remaining actions menu (text#9475)
- Fix misc flaky tests (text#9481)
- Fix(cron): stop attachment cleanup from failing on every run (text#9517)
- Fix(sessions): only use share node matching the session document (text#9522)
- Fix(editor): do not force save when clicking the save indicator (text#9526)
- Perf(editor): only serialize markdown on update when it is read (text#9544)
viewer
- Fix(files): don’t expose WebDAV XML-attribute artifacts as DOM attributes (viewer#3289)
- Fix: properly handle e2ee support (viewer#3367)
- Fix(viewer): register handlers not yet in the lookup table when opening a file (viewer#3421)
- Test(e2e): skip the Ogg/Theora video specs on Chromium (viewer#3452)
- Fix(viewer): skip duplicate handlers on init (viewer#3458)
Happy updating! 