Maintenance releases of 34.0.1, 33.0.6 and32.0.12 are coming next Thursday and first RCs for those are now available on download servers.
As always, help with testing is very much welcome!
We updated our servers, did our tests, and the release candidates seem pretty decent. Still, give it a whirl and report back here so we’re even more sure that it’s good to go! If you notice anything out of order, please report back on the appropriate GitHub repository! 
Downloads
- Nextcloud Server
34.0.1 RC1on GitHub - Nextcloud Server
33.0.6 RC1on GitHub - Nextcloud Server
32.0.12 RC1on GitHub
Changelog
Nextcloud 34.0.1rc1
server
- Fix: folder tree selection after any action in main content (server#60478)
- Test: replace checkbox assertions with DoesNotPerformAssertions (middleware) (server#60759)
- Test: replace checkbox assertions with real assertions or DoesNotPerformAssertions (server#60785)
- Fix(files): show proper information when a move will override the target (server#60963)
- Perf(user_ldap): chunk oracle queries for lower bind cost (server#60978)
- Fix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60983)
- Fix(theming): read cachebuster as int in manifest endpoint (server#61010)
- Fix(dav): finalize upload metadata before post-write hooks (server#61072)
- Fix(comments): load comments styles when the comments app is loaded (server#61076)
- Fix(dav): properly handle files metadata (server#61078)
- Fix(settings): Fix appstore icon color in settings menu (server#61093)
- Fix(comments): Use capped memory cache for comments (server#61097)
- Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61105)
- Fix(files): make sure nested changes are propagated to sidebar tabs (server#61106)
- Fix: Correctly detect appid for dist css files (server#61113)
- Fix: use correct permissions mask for non-home storage public links (server#61118)
- Fix(settings): Show loading spinner while searching accounts (server#61122)
- Build(deps): bump the symfony group across 1 directory with 9 updates (server#61129)
- Master] fix(security): Update code signing revocation list (server#61133)
- Feat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61157)
- Fix(core): keep app menu settings icon legible on light backgrounds (server#61161)
- Build(deps): bump phpseclib/phpseclib from 2.0.53 to 2.0.54 (server#61178)
- Fix(previews): ffprobe hangs (server#61182)
- Test(settings): reduce flakiness of authorized group integration assertions (server#61185)
- Fix(files_versions): guard null path in event listeners (server#61189)
- Fix(repair): restrict unserialize() in RemoveBrokenProperties (server#61203)
- Fix(appstore): bring back “update all” button (server#61212)
- Fix(settings): clear NcAppNavigation toggle overhang (server#61234)
- Master] fix(security): Update code signing revocation list (server#61239)
- Fix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61243)
- Job run history cleanup (server#61249)
- Fix: Fix PHP Warning foreach() argument must be of type array|object, null given (server#61258)
- Master] fix(security): Update code signing revocation list (server#61283)
- Fix(twofactor_backupcodes): Add a clean helper to set code as used (server#61296)
- Fix(theming): preserve uploaded favicon and touch icon (server#61302)
- Fix: Use token expiration for ephemeral sessions (server#61305)
- Feat(oauth2): Add commands for adding and deleting clients (server#61309)
- Fix(user_ldap): Escape filter part when searching for group members (server#61325)
- Chore: Reduce PHPUnit test matrix on stable34 and remove coverage (server#61331)
- Chore(ci): Remove code coverage from stable branches (server#61335)
- Add OCM Notification Received Event (server#61337)
- Fix: trim duplicate search results for external share (server#61340)
- Speedup tests execution (server#61341)
- Fix: Do not set last-password-confirm for apptoken sessions (server#61342)
- Fix(team-manager): ensure team resources are only retrived for members (server#61351)
- Fix(ocm-add-share): adjust domain validation (server#61357)
- Fix: ensure file names are string-typed (server#61361)
- Test: fix admin E2E selectors for Vue 3 NcSelect (server#61365)
- Fix(taskprocessing): claim tasks atomically so parallel workers don’t duplicate (server#61367)
- Fix: prevent editing delegated admins (server#61369)
- Fix Memcached CI job (server#61378)
- Fix(caldav): respect federation settings (server#61381)
- Fix(files_sharing): Hide incompatible actions in shares (server#61386)
- Fix(files_versions): avoid version snapshot races during cross-storage renames (server#61403)
- Fix: Fix alignment issues of app password form (server#61404)
- Fix(settings): show app menu current-app button on settings pages (server#61410)
activity
- Refactor(types): add native parameter and return types to UserSettings (activity#2614)
- Perf(mailqueue): cover `amq_latest_send` in the affecteduser index (activity#2636)
circles
- Fix(local-controller): dont show full config int of circle for non-members (circles#2528)
- Fix(local-controller): validate params set on team creation (circles#2534)
- Adjust local controller to better handle permission checks (circles#2538)
firstrunwizard
- Feat(deps): Add Nextcloud 35 support on master (firstrunwizard#2073)
- Feat(deps): Add Nextcloud 35 support on master (firstrunwizard#2074)
notifications
- Fix(webpush): recover gracefully from corrupted or mismatched VAPID keys (notifications#3070)
- Chore: extend testing of `encryptAndSign` and make the methods discoverable by psalm (notifications#3076)
- Docs(webpush): Document knowledge and trust models of webpush flow (notifications#3077)
- Build(deps): Bump guzzlehttp/psr7 from 2.8.0 to 2.11.0 (notifications#3087)
- Fix(webpush): Don’t reuse query object for second query (notifications#3089)
- Fix(email): Correctly initialize next_send_time field (notifications#3120)
recommendations
serverinfo
survey_client
suspicious_login
text
- Chore(github): update workflows (text#8714)
- Fix(math): fix lost content after math node (text#8722)
- Fix(editorApi): allow to disable image lazy-loading (text#8728)
- Fix permission change in text doc (text#8751)
- Fix: show Assistant icon if only translation provider available (text#8760)
- Performance: Only check permissions when changing content (text#8764)
twofactor_totp
viewer
- Fix(plyr): the speed settings button should not be cut (viewer#3199)
- Fix(plyr): add l10n to components (viewer#3203)
- Fix(plyr): the speed selection should not go out of the viewport (viewer#3206)
- Fix(plyr): add l10n to speed selections (viewer#3216)
Nextcloud 33.0.6rc1
server
- Dav: Fix fatal error when ORGANIZER is missing in CalDAV schedule (server#59350)
- Fix(files,files_sharing): swallow redirected navigation errors (server#59887)
- Fix(caldav): grant sharee Acls to the delegate (server#60646)
- Fix(http): avoid iconv for header ascii fallback (server#60722)
- Fix(DB): Enforce foreign key constraints in SQLite (server#60792)
- Fix(encryption): recovery keys should be shown when user keys are used (server#60799)
- Fix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration (server#60819)
- Fix(files): Chromium-based browsers drag-and-drop (server#60899)
- Fix: actually register listener for updating stored external storage credentials (server#60905)
- Chore(deps): Update flake to NixOS 26.05 (server#60912)
- Fix(MailPlugin): Stop applying the offset twice and the limit per wide/exact (server#60920)
- Fix(sharing): set STATUS_ACCEPTED when creating USERGROUP subshare on… (server#60925)
- Fix(Share): Add missing optional parameter to IManager::shareApiAllowLinks() (server#60928)
- Fix(psalm): Update psalm baseline (server#60933)
- Test(cache): avoid ordering assumptions in testExtended (server#60935)
- Fix(Storage): use `proxyexclude` parameter in DAV client (server#60939)
- Fix(files_sharing): clear the password after saving (server#60951)
- Fix(files): show proper information when a move will override the target (server#60962)
- Fix: access shared and delegated trashbin objects (server#60967)
- Fix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60984)
- Master] fix(security): Update code signing revocation list (server#61002)
- Fix(dav): finalize upload metadata before post-write hooks (server#61070)
- Fix(dav): properly handle files metadata (server#61079)
- Fix(comments): Use capped memory cache for comments (server#61096)
- Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61104)
- Fix(files): make sure nested changes are propagated to sidebar tabs (server#61107)
- Fix: Correctly detect appid for dist css files (server#61112)
- Fix: use correct permissions mask for non-home storage public links (server#61117)
- Fix(settings): Show loading spinner while searching accounts (server#61121)
- Build(deps): bump the symfony group across 1 directory with 9 updates (server#61130)
- Master] fix(security): Update code signing revocation list (server#61134)
- Feat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61156)
- Build(deps): bump phpseclib/phpseclib from 2.0.53 to 2.0.54 (server#61179)
- Fix(previews): ffprobe hangs (server#61183)
- Fix(files_versions): guard null path in event listeners (server#61188)
- Fix(SetupChecks): maintenance window length is 4h (not 6h) (server#61192)
- Fix(search-query): fix psalm type error (server#61196)
- Master] fix(security): Update code signing revocation list (server#61238)
- Fix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean (server#61242)
- Fix: use card interface instead of object (server#61251)
- Master] fix(security): Update code signing revocation list (server#61284)
- Fix(twofactor_backupcodes): Add a clean helper to set code as used (server#61297)
- Fix(theming): preserve uploaded favicon and touch icon (server#61301)
- Fix: Use token expiration for ephemeral sessions (server#61306)
- Fix(user_ldap): Escape filter part when searching for group members (server#61326)
- Chore: Reduce PHPUnit test matrix on stable34 and remove coverage (server#61336)
- Fix: trim duplicate search results for external share (server#61339)
- Fix: Do not set last-password-confirm for apptoken sessions (server#61343)
- Fix(team-manager): ensure team resources are only retrived for members (server#61350)
- Fix(ocm-add-share): adjust domain validation (server#61356)
- Fix: ensure file names are string-typed (server#61360)
- Feat(oauth2): Add commands for adding and deleting clients (server#61362)
- Fix: prevent editing delegated admins (server#61370)
- Fix(caldav): respect federation settings (server#61380)
- Fix(files_sharing): Hide incompatible actions in shares (server#61387)
- Fix(files_versions): avoid version snapshot races during cross-storage renames (server#61402)
- Fix: Fix alignment issues of app password form (server#61405)
activity
bruteforcesettings
circles
- Build: add .nextcloudignore for release builds (circles#2495)
- Feat: Add role-based filtering for circle member queries (circles#2504)
- Fix(local-controller): dont show full config int of circle for non-members (circles#2527)
- Fix(local-controller): validate params set on team creation (circles#2533)
- Adjust local controller to better handle permission checks (circles#2537)
notifications
- Chore: extend testing of `encryptAndSign` and make the methods discoverable by psalm (notifications#3079)
- Fix(email): Correctly initialize next_send_time field (notifications#3119)
serverinfo
survey_client
suspicious_login
text
- Fix: disable open link button for unsafe link (text#8684)
- Fix(mediaHandler): strip relevant bidi chars in filenames (text#8692)
- Fix(Editor): emit modified fileNode size on save (text#8695)
- Chore(github): update workflows (text#8715)
- Fix(math): fix lost content after math node (text#8721)
- Fix(editorApi): allow to disable image lazy-loading (text#8727)
- Fix permission change in text doc (text#8750)
- Fix: show Assistant icon if only translation provider available (text#8759)
- Performance: Only check permissions when changing content (text#8765)
viewer
- Fix(plyr): the speed settings button should not be cut (viewer#3198)
- Fix(plyr): add l10n to components (viewer#3202)
- Fix(plyr): the speed selection should not go out of the viewport (viewer#3208)
- Fix(plyr): add l10n to speed selections (viewer#3215)
Nextcloud 32.0.12rc1
server
- Dav: Fix fatal error when ORGANIZER is missing in CalDAV schedule (server#59349)
- Feat(files_external): convert to delegated settings (server#59869)
- Fix: correct typo ‘occured’ to ‘occurred’ in SetupCheckManager (server#60209)
- Fix since checker (server#60242)
- Fix(caldav): grant sharee Acls to the delegate (server#60645)
- Fix(template): add import map for JS module entry points (server#60659)
- Fix(http): avoid iconv for header ascii fallback (server#60721)
- Fix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration (server#60818)
- Fix(files): Chromium-based browsers drag-and-drop (server#60901)
- Chore(deps): Update flake to NixOS 26.05 (server#60911)
- Fix(files_sharing): clear the password after saving (server#60950)
- Fix: access shared and delegated trashbin objects (server#60966)
- Fix(TaskProcessing): restrict allowed_classes in Manager cache deserialization (server#60985)
- Master] fix(security): Update code signing revocation list (server#61003)
- Fix(theming): read cachebuster as int in manifest endpoint (server#61009)
- Fix(dav): properly handle files metadata (server#61080)
- Fix(security): don’t propagate ValueError from Crypto::decrypt() fallback (server#61103)
- Fix: use correct permissions mask for non-home storage public links (server#61116)
- Build(deps): bump the symfony group across 1 directory with 9 updates (server#61131)
- Master] fix(security): Update code signing revocation list (server#61135)
- Feat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache (server#61155)
- Build(deps): bump phpseclib/phpseclib from 2.0.53 to 2.0.54 (server#61180)
- Fix(previews): ffprobe hangs (server#61184)
- Fix(files_versions): guard null path in event listeners (server#61187)
- Fix(search-query): fix psalm type error (server#61198)
- Master] fix(security): Update code signing revocation list (server#61237)
- Fix(theming): preserve uploaded favicon and touch icon (server#61255)
- Master] fix(security): Update code signing revocation list (server#61285)
- Fix(twofactor_backupcodes): Add a clean helper to set code as used (server#61298)
- Chore: Increase page load timeout for oracle setup tests (server#61304)
- Fix: Use token expiration for ephemeral sessions (server#61307)
- Fix(user_ldap): Escape filter part when searching for group members (server#61327)
- Fix: trim duplicate search results for external share (server#61338)
- Fix: Do not set last-password-confirm for apptoken sessions (server#61344)
- Fix(team-manager): ensure team resources are only retrived for members (server#61349)
- Fix(ocm-add-share): adjust domain validation (server#61355)
- Fix: ensure file names are string-typed (server#61359)
- Feat(oauth2): Add commands for adding and deleting clients (server#61363)
- Fix: prevent editing delegated admins (server#61371)
- Fix(caldav): respect federation settings (server#61379)
- Fix(files): drag n drop (server#61401)
activity
bruteforcesettings
circles
- Fix: secondary owncloud custom group admin permissions not migrated (circles#2426)
- Build: add .nextcloudignore for release builds (circles#2509)
- Fix(local-controller): dont show full config int of circle for non-members (circles#2526)
- Fix(local-controller): validate params set on team creation (circles#2532)
- Adjust local controller to better handle permission checks (circles#2536)
notifications
- Chore: extend testing of `encryptAndSign` and make the methods discoverable by psalm (notifications#3101)
- Fix(email): Correctly initialize next_send_time field (notifications#3118)
survey_client
suspicious_login
text
- Fix(mediaHandler): strip relevant bidi chars in filenames (text#8691)
- Fix(Editor): emit modified fileNode size on save (text#8694)
- Chore(github): update workflows (text#8716)
- Fix(editorApi): allow to disable image lazy-loading (text#8726)
- Fix(editor): pass missing noLazyImages props (text#8729)
- Fix permission change in text doc (text#8749)
- Performance: Only check permissions when changing content (text#8766)