Maintenance releases of 33.0.4 and32.0.10 are coming next Thursday and first RCs for those are now available on download servers.
As always, help with testing is very much welcome!
We updated our servers, did our tests, and the release candidates seem pretty decent. Still, give it a whirl and report back here so we’re even more sure that it’s good to go! If you notice anything out of order, please report back on the appropriate GitHub repository! 
Downloads
Changelog
33.0.4 RC1
server
- Fix: allow renaming files with just update permissions (server#59241)
- Fix(encryption): limit oprhaned keys scan to one user (server#59808)
- Fix(s3): ignore prefixes with repeating delimiters (server#59829)
- Fix removed address book items not being synced between federated instances (server#59894)
- Fix(files): fix custom client-side error messages on move/copy actions (server#59954)
- Chore: Generate empty css entry points (server#59983)
- Feat: Better reporting if something is wrong with taskprocessing (server#59991)
- Fix: Harmonize login and passwordless login redirect behavior (server#60007)
- Fix(core): provide valid initial state also on public templates (server#60015)
- Test(cypress): clear state before user tests (server#60022)
- Fix(navigation): Fix default app icon (server#60133)
- Fix(files): escape html entities in dav search requests (server#60140)
- Fix(LocalPreviewStorage): Use correct regex to detect files in nested directory format (server#60143)
- Fix(comments): register event listener for typed comment events (server#60149)
- Fix(core): use btoa() instead of window.Buffer.from() for base64 encoding (server#60157)
- Fix: Dispatch old comment events (server#60168)
- Fix(comments): Add an action to comment notification that dismisses it (server#60175)
- Fix(core): prompt for password once when installing recommended apps (server#60184)
- Build: Remove testing app during packaging (server#60196)
- Feat(updatenotification): handle files_lock (server#60203)
- Chore: Increase page load timeout for oracle setup tests (server#60206)
- Fix(public.scss): increase footer width (server#60208)
- Fix: correct typo ‘occured’ to ‘occurred’ in SetupCheckManager (server#60210)
- Fix since checker (server#60219)
- Fix(settings): Fix admin delegation for hidden sections (server#60222)
- Fix: Fix permission issue when uploading a chunked file (server#60240)
- Feat(app-licenses): Add further compatible licenses for apps to use (server#60296)
- Fix(Setup): Ensure instanceid is generated during installation (server#60301)
- Test(cypress): Reduce flakiness (server#60302)
- Fix(http-client): detect brotli support via libcurl, not PHP extension (server#60309)
- Fix(s3): Add Content-MD5 header for DeleteObjects to fix AWS SDK v3.339.0+ compatibility (server#60322)
- Test(cypress): restore dashboard after app-limit test (server#60327)
- Fix(snowflake): fix wrong documentation about serverId (server#60328)
- Fix(files_sharing): apply link share password on first save (server#60329)
- Fix(UserConfig): cast getTypedValue() result to string in getValueBool() (server#60333)
- Perf(share): Remove useless order by id (server#60345)
- Remove unneeded sort when listing mail/federated shares (server#60356)
- Perf: remove unneeded sort in getFolderContentsById (server#60357)
- Fix(security): Update Expires time (server#60396)
- Fix(windmill): Fix baseUrl in background job (server#60468)
- Fix(workflowengine): use proper contrast colors for operations (server#60490)
- Fix(files_sharing): do not double escape special characters (server#60498)
- Fix error when creating mail shares if custom tokens are enabled (server#60509)
- Feat(users): Check assertion when enabling user (server#60516)
- Fix(files): only show template picker menu entries if possible (server#60522)
- Fix rendering custom columns in file lists (server#60526)
- Fix(OC_Helper): properly calculate quota of shared storages (server#60535)
- Fix(systemtags): Include leading slash in unified search tag link (server#60539)
- Don’t put hashed password in share api response (server#60549)
- Fix: only allow full admins to create ‘token needed’ webhooks (server#60555)
- Fix: improve check if external storage backend is local (server#60559)
- Fix: handle NAT64 addresses in isLocalAddress (server#60565)
- Fix: don’t tell the remote their token is lower (server#60574)
- Fix(AppStore/Fetcher): catch GenericFileException when reading cache file in Fetcher (server#60595)
- Enh(occ): make it possible to add an arbitrary number of users to a g… (server#60601)
- Fix: add proper ACLs for trashbin proxys (server#60603)
- Fix(dav): Skip removal of classified activity when not generated anymore (server#60605)
- Fix(argon2): respect max value for hashingThreads (server#60608)
- Fix(Dav): make absenceform textarea not overlap (server#60614)
- Fix(files): use displayname rather than basename to use progress (server#60625)
- Feat(openmetrics): export more resilient if exception happens (server#60627)
- Fix: Increase limit for share/unshare requests per hour (server#60633)
- Chore(snowflake): add more randomness in server id fallback (server#60635)
- Fix: treat all WebKit iOS browseres the same (server#60638)
activity
- Fix(cypress): improve e2e test stability on stable33 (activity#2561)
- Refactor: replace magic batch-time seconds with named constants (activity#2575)
- Refactor: clarify fileCreate() condition by making the specific case explicit (activity#2576)
- Refactor: flatten nesting with early returns (activity#2579)
- Refactor: flatten nesting with early returns in FilesHooks and ViewInfoCache (activity#2581)
- Fix(notifications): mark activity notifications as read when viewing file activities (activity#2606)
- Fix(bulkReceive): honour admin email toggle and ISetting notification defaults (activity#2608)
- Fix(MailQueueHandler): check enable_email toggle before sending queued emails (activity#2611)
app_api
- Fix(filesplugin): file actions invisible on NC33+ (registry mismatch, stable33) (app_api#856)
- Refactor: simplify enabled-state check in validateExAppRequestToNC (app_api#861)
- Fix(proxy): validate request path before forwarding to ExApp (app_api#868)
- Fix: proxy route leading slash (app_api#876)
- Fix: normalize missing bruteforce_protection and headers_to_exclude on ExApp routes (app_api#883)
bruteforcesettings
circles
files_pdfviewer
Update pdf save to use correct dav path and credentials (files_pdfviewer#1440)logreader
notifications
photos
recommendations
serverinfo
- Fix(disk): ignore efivarfs pseudo-mount (serverinfo#985)
- Fix(php): include Zend extensions in loaded extensions list (serverinfo#987)
- Ci(deps-dev): bump psalm to 6.16.1 (serverinfo#989)
- Ci(actions): Update workflows (serverinfo#991)
text
- Perf(rich_workspace): only add property for parent (text#8498)
- Fix(workspace): reuse WorkspaceService file lookup in direct() (text#8508)
- Fix(LinkBubble): don’t display dismiss edit button when read-only (text#8519)
- Center inserted images (text#8529)
- Build: do not include playwright folder in packaging (text#8533)
- Chore(performance): use async components properly (text#8535)
- Fix(lists): allow to toggle between all types of lists (text#8567)
- Fix(TaskItem): use div instead of label element as task item wrapper (text#8572)
- Fix(code): fix regex to not eat preceding character (text#8575)
- Feat: add support for wiki-style link and image Markdown syntax (text#8576)
- Fix(links): allow to transform inline links to previews (text#8577)
- Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8580)
- Fix(links): allow to pass custom link handler into editor and use it (text#8581)
- Fix(orderdList): preserve non-1 start numbers (text#8589)
- Fix(code): don’t apply inline code CSS rules to code blocks (text#8613)
- Fix: allow dots in markdown link text (text#8621)
- Fix(folderDescription): fix max height in unfocused mode (text#8623)
- Fix: several table button design fixes (text#8630)
- Chore: remove codecov (text#8632)
twofactor_totp
viewer
32.0.10 RC1
server
- Feat(user_ldap): Add config for partial search compatibility with ActiveDirectory (server#58280)
- Fix: manually set modified time to SFTP files after editing (server#59499)
- Fix(files): only disable template creation when both skeleton directories are empty (server#59750)
- Fix(encryption): limit oprhaned keys scan to one user (server#59810)
- Fix removed address book items not being synced between federated instances (server#59893)
- Fix(files): internal drag and drop (server#59924)
- Fix reenabling system address book (server#59956)
- Feat: Better reporting if something is wrong with taskprocessing (server#59990)
- Fix: Harmonize login and passwordless login redirect behavior (server#60009)
- Fix(core): provide valid initial state also on public templates (server#60024)
- Fix(navigation): Fix default app icon (server#60132)
- Fix(files): escape html entities in dav search requests (server#60141)
- Fix(core): use btoa() instead of window.Buffer.from() for base64 encoding (server#60158)
- Fix(comments): Add an action to comment notification that dismisses it (server#60174)
- Fix(public.scss): increase footer width (server#60207)
- Fix(theming): fix broken custom images introduced by #58224 (server#60233)
- Fix(core): prompt for password once when installing recommended apps (server#60237)
- Fix: Fix permission issue when uploading a chunked file (server#60239)
- Feat(app-licenses): Add further compatible licenses for apps to use (server#60295)
- Fix(Setup): Ensure instanceid is generated during installation (server#60300)
- Test(cypress): Reduce flakiness (server#60303)
- Fix(s3): Add Content-MD5 header for DeleteObjects to fix AWS SDK v3.339.0+ compatibility (server#60321)
- Fix(files_sharing): apply link share password on first save (server#60330)
- Fix(settings): Fix missing import for strict mode of app password del… (server#60351)
- Fix(security): Update Expires time (server#60395)
- Fix error when creating mail shares if custom tokens are enabled (server#60510)
- Fix(files): only show template picker menu entries if possible (server#60521)
- Don’t put hashed password in share api response (server#60550)
- Fix: only allow full admins to create ‘token needed’ webhooks (server#60556)
- Fix: improve check if external storage backend is local (server#60560)
- Fix: handle NAT64 addresses in isLocalAddress (server#60566)
- Fix: don’t tell the remote their token is lower (server#60575)
- Fix(AppStore/Fetcher): catch GenericFileException when reading cache file in Fetcher (server#60594)
- Enh(occ): make it possible to add an arbitrary number of users to a g… (server#60600)
- Fix: add proper ACLs for trashbin proxys (server#60602)
- Fix(files): show proper information when a move will override the target (server#60615)
- Feat(users): Check assertion when enabling user (server#60618)
- Remove unneeded sort when listing mail/federated shares (server#60629)
- Fix: Increase limit for share/unshare requests per hour (server#60632)
activity
- Fix(cypress): improve e2e test stability on stable32 (activity#2560)
- Refactor: clarify fileCreate() condition by making the specific case explicit (activity#2577)
- Refactor: replace magic batch-time seconds with named constants (activity#2578)
- Refactor: flatten nesting with early returns (activity#2580)
- Fix(notifications): mark activity notifications as read when viewing file activities (activity#2605)
- Fix(MailQueueHandler): check enable_email toggle before sending queued emails (activity#2610)
app_api
- Refactor: simplify enabled-state check in validateExAppRequestToNC (app_api#862)
- Fix(proxy): validate request path before forwarding to ExApp (app_api#869)
- Fix: proxy route leading slash (app_api#877)
circles
files_pdfviewer
notifications
- Chore(deps): bump @nextcloud/browserlist-config to 3.1.2 (notifications#2984)
- Feat(push): Optionally use OAEP padding (notifications#2985)
- Chore(deps): npm run audit fix (notifications#2989)
photos
serverinfo
- Fix(disk): ignore efivarfs pseudo-mount (serverinfo#986)
- Fix(php): include Zend extensions in loaded extensions list (serverinfo#988)
text
- Fix(workspace): reuse WorkspaceService file lookup in direct() (text#8509)
- Fix(LinkBubble): don’t display dismiss edit button when read-only (text#8518)
- Center inserted images (text#8530)
- Build: do not include playwright folder in packaging (text#8532)
- Security: Unbounded `limit` parameter in user search can be abused for resource exhaustion (text#8579)
- Fix(code): don’t apply inline code CSS rules to code blocks (text#8612)
- Fix(folderDescription): fix max height in unfocused mode (text#8626)