RC1s of 34.0.4, 33.0.9, 32.0.15

[skjnldsv]

The first release candidates for our next maintenance updates are here: Nextcloud 34.0.4, 33.0.9 and 32.0.15!

Your testing helps us catch issues before the final releases, so don’t hesitate to try them out!
If something doesn’t behave as expected, please let us know on the appropriate GitHub repository!

The final releases are planned for next week, on September 10, 2026.

Downloads

• Nextcloud Server 34.0.4 RC1 on GitHub
• Nextcloud Server 33.0.9 RC1 on GitHub
• Nextcloud Server 32.0.15 RC1 on GitHub

Changelog

Nextcloud 34.0.4rc1

server

• Fix(theming): mark background button text as English (server#62252)
• Fix(ocm): Move invite-accepted capability and implementation to contacts app (server#62486)
• Don’t fill the pagination cache if there are no extra items (server#63119)
• Feat(oauth2): Forward app tokens from primary to secondary in global scale (server#63155)
• Fix: make unified filter chip accessible (server#63224)
• Fix(preview): delete version metadata by preview ID (server#63290)
• Fix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63310)
• Fix(group): Set the display name on every backends that supports it (server#63321)
• Fix(jobs): don’t overwrite the --stop_after baseline in background-job:worker (server#63328)
• Test: remove double setup from share tests (server#63331)
• Fix(config): mask the Euro-Office jwt_secret as sensitive (server#63332)
• Fix(preview): order previews by ID during pagination (server#63345)
• Fix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63347)
• Master] fix(security): Update code signing revocation list (server#63358)
• Master] fix(security): Update code signing revocation list (server#63364)
• Master] fix(security): Update code signing revocation list (server#63370)
• Fix: Creating shares with multiple mount permissions (server#63372)
• Fix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63378)
• Fix: allow file request upload when `part_file_in_storage=false` (server#63379)
• Fix: Public link with multiple mounts (server#63384)
• Feat: Mark 32 bits support as removed for Nextcloud Hub 27 Winter (server#63387)
• Fix(preview): keep the local file when losing the insert race (server#63390)
• Fix(files_sharing): Use share password policy for password generation (server#63397)
• Test(carddav): refactor testSearch to use clearer assertions and unique UIDs (server#63402)
• Fix one core migration: Only add taskprocessing columns if they don’t exist (server#63404)
• Feat(dav): add IRoomMetadata::BUILDING_NAME (server#63419)
• Fix(files_reminder): passed reminder handling (server#63425)
• Fix: enhance name splitting to handle “Lastname, Firstname” format (server#63426)
• Ci(playwright): skip browser installation on CI an reuse action provided chrome (server#63431)
• Fix(files_external): set usePresignedUrl before first S3 connection (server#63456)
• Master] fix(security): Update code signing revocation list (server#63521)
• Fix(preview): execute PreviewMapper::deleteAll() (server#63523)
• Fix(LocalStorage): Clear realpath cache on fopen failure and re-try access (server#63530)
• Fix(dav): Handle correctly not found while streaming output (server#63533)
• Fix(provisioning_api): let sub-admins change group memberships (server#63534)
• Fix(files): hide download action in link shares for newly created folders (server#63552)
• Feat(updater): clear app_install_overwrite on major upgrades (server#63633)
• Test(db): cover migration version sorting (server#63638)
• Fix(appconfig): make type-conflict error self-explanatory (server#63643)
• Fix(dav): scope contact photo export to local address books (server#63645)
• Fix cancelling the customization of a share (server#63658)
• Fix(dav): correctly mask public v1 links for non-home storages (server#63668)
• Fix(dav): only derive the write size from a PUT Content-Length (server#63678)
• Fix(settings): Fix AI regex (server#63691)
• Fix: Check that password matches in occ user:auth-tokens:add (server#63697)
• Fix(contactsmenu): restore avatars for non-user contacts (server#63717)
• Fix: Check rememberme cookie previous session id matches uid (server#63719)
• Fix(2fa): Add missing BruteForceProtection attribute (server#63732)
• Fix: embed Nextcloud logo directly into SMTP notifications (server#63748)
• Fix(core): accept deprecated IANA timezone aliases (server#63758)
• Fix(cardDav): Only update user card on actual mapped propreties changes (server#63770)
• Trashbin truncate filename unicode (server#63811)
• Fix(ftp): handle empty port parameter and ensure strictly numeric ports (server#63816)
• Fix(files_external): guard optional S3 key in storage id computation (server#63819)
• Fix(webauthn): Throw on uid mismatch when updating registration (server#63832)
• Fix: Correctly filter users when the backend does not implement ISearchKnownUsersBackend (server#63841)
• Chore: Reusable workflow for phpunit and storage (server#63850)
• Fix: Ensure we don’t get share by empty name (server#63852)
• Fix(ObjectStorePreviewStorage): Close count stream wrapper (server#63863)
• Fix(core): make the app store link in the app menu configurable (server#63870)
• Fix(TaskProcessing): Harden task scheduling with webhooks (server#63873)
• Fix share by email expiration date in a different timezone (server#63879)
• Fix(federation): use share owner (server#63901)
• Fix(dav): Do not claim no plugin available when checksum algorithm is not supported (server#63907)
• Fix(settings): clean up regex / app config outliers (server#63911)
• Update node checks (server#63916)
• Fix(files_external): set size to -1 for root entry (server#63922)
• Test: replace addToAssertionCount checkbox tests in Hooks and DI (server#63926)
• Fix(sharing): properly frame block list (server#63934)

activity

• Fix(CurrentUser): Properly get share token from non-legacy public webdav (activity#2878)
• Fix: Remove user memoization (activity#2895)

app_api

• Fix: make db migrations idempotent (app_api#988)

circles

• Fix(well-known): fallback on manual extraction of params (circles#2748)
• Fix(shares): expose share of TYPE_CIRCLE to the FilesList in groupfolders (circles#2755)
• Fix(federated-event-service): broadcast CircleDestroy event before executing it’s manage() method (circles#2791)
• Fix: enhance validation upon team creation (circles#2833)
• Fix: resolve share mount for remote circle members (circles#2837)
• Fix: enhance member level update validation (circles#2841)

files_pdfviewer

• Fix: Bust the cache of the static assets when Nextcloud is updated (files_pdfviewer#1525)
• Fix: Set version on stable34 to a stable one (files_pdfviewer#1526)

firstrunwizard

• Fix: use proper AppStore route (firstrunwizard#2211)

logreader

• Fix: make app header fully visible (logreader#2183)
• Fix(build): empty CSS output directory on build (logreader#2186)

notifications

• Fix(mail): Correctly skip disabled user email notifications again (notifications#3340)
• Fix(webpush): Fix “Undefined array key -… at lib/Push.php#297” (notifications#3347)

photos

• Chore(deps): Bump @nextcloud/dialogs from 6.4.2 to 7.4.0 (photos#3667)
• Fix(metadata): exif_read_data() supports JPEG/TIFF (photos#3668)
• Fix timestamp when looking at photos (photos#3730)
• Fix(album): avoid refetching empty album file lists (photos#3762)
• Fix(album): calculate date range end against latest date (photos#3763)
• Fix: properly handle trashed photos (photos#3768)
• Fix(routes): handle shared root path and remove duplicate folders route (photos#3769)

suspicious_login

• Fix: avoid double app password check (suspicious_login#1138)

text

• Fix(viewer): align content of old version in viewer version comparison (text#9033)
• Test(playwright): migrate propfind tests from Cypress to Playwright (text#9041)
• Fix(updateFromContent): destroy editor at end of setContent() (text#9075)
• Fix(FloatingButtons): hide btns until first mousemove (text#9101)
• Fix(attachments): emit event when creating an attachment (text#9147)
• Fix/no conflicts on sync (text#9158)

twofactor_nextcloud_notification

• Fix(routes): bind poll regex constraint to its actual URL placeholder… (twofactor_nextcloud_notification#1489)

viewer

• Fix(files): don’t expose WebDAV XML-attribute artifacts as DOM attributes (viewer#3290)
• Fix: urlencode file source based on resource url (viewer#3325)

Nextcloud 33.0.9rc1

server

• Fix(ocm): Move invite-accepted capability and implementati… (server#62460)
• Fix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62713)
• Test(cypress): Improve stability of cypress test suite by fixing several issues (server#63097)
• Don’t fill the pagination cache if there are no extra items (server#63120)
• Feat(oauth2): Forward app tokens from primary to secondary in global scale (server#63156)
• Fix(CalDAV): iTipBroker message generation and testing (server#63187)
• Fix(preview): delete version metadata by preview ID (server#63289)
• Fix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63309)
• Fix: make unified filter chip accessible (server#63319)
• Test: remove double setup from share tests (server#63330)
• Fix(preview): qualify the ambiguous columns in PreviewMapper queries (server#63346)
• Master] fix(security): Update code signing revocation list (server#63357)
• Master] fix(security): Update code signing revocation list (server#63363)
• Master] fix(security): Update code signing revocation list (server#63369)
• Fix(user_ldap): restore OCS API functionality for configID = ‘’ (server#63377)
• Fix: allow file request upload when `part_file_in_storage=false` (server#63380)
• Fix: Public link with multiple mounts (server#63383)
• Fix(preview): keep the local file when losing the insert race (server#63391)
• Fix(files_sharing): Use share password policy for password generation (server#63396)
• Fix one core migration: Only add taskprocessing columns if they don’t exist (server#63405)
• Fix(files_reminder): passed reminder handling (server#63424)
• Fix(files_external): set usePresignedUrl before first S3 connection (server#63457)
• Master] fix(security): Update code signing revocation list (server#63520)
• Fix(preview): execute PreviewMapper::deleteAll() (server#63522)
• Fix(files): hide download action in link shares for newly created folders (server#63553)
• Test(db): cover migration version sorting (server#63637)
• Fix(appconfig): make type-conflict error self-explanatory (server#63642)
• Fix(dav): scope contact photo export to local address books (server#63644)
• Fix cancelling the customization of a share (server#63657)
• Fix(dav): correctly mask public v1 links for non-home storages (server#63667)
• Fix(dav): only derive the write size from a PUT Content-Length (server#63677)
• Fix(settings): Fix AI regex (server#63692)
• Fix: Check that password matches in occ user:auth-tokens:add (server#63696)
• Fix(contactsmenu): restore avatars for non-user contacts (server#63716)
• Fix: Check rememberme cookie previous session id matches uid (server#63720)
• Fix(2fa): Add missing BruteForceProtection attribute (server#63733)
• Fix(core): accept deprecated IANA timezone aliases (server#63757)
• Fix(group): pass previous display name in GroupChangedEvent (server#63780)
• Trashbin truncate filename unicode (server#63810)
• Fix(files_external): guard optional S3 key in storage id computation (server#63818)
• Fix(webauthn): Throw on uid mismatch when updating registration (server#63833)
• Fix: Correctly filter users when the backend does not implement ISearchKnownUsersBackend (server#63842)
• Fix: Ensure we don’t get share by empty name (server#63851)
• Fix(preview): First cleanup from filecache and then from preview table (server#63855)
• Fix(ObjectStorePreviewStorage): Close count stream wrapper (server#63862)
• Fix(TaskProcessing): Harden task scheduling with webhooks (server#63874)
• Fix share by email expiration date in a different timezone (server#63880)
• Fix(federation): use share owner (server#63900)
• Fix(dav): Do not claim no plugin available when checksum algorithm is not supported (server#63906)
• Fix(settings): clean up regex / app config outliers (server#63909)
• Update node checks (server#63915)
• Fix(files_external): set size to -1 for root entry (server#63921)
• Fix(sharing): properly frame block list (server#63933)

activity

• Fix(CurrentUser): Properly get share token from non-legacy public webdav (activity#2879)
• Fix: Remove user memoization (activity#2896)

app_api

• Fix: make db migrations idempotent (app_api#987)

circles

• Fix(well-known): fallback on manual extraction of params (circles#2747)
• Fix(shares): expose share of TYPE_CIRCLE to the FilesList in groupfolders (circles#2754)
• Fix(federated-event-service): broadcast CircleDestroy event before executing it’s manage() method (circles#2792)
• Fix: enhance validation upon team creation (circles#2834)
• Fix: enhance member level update validation (circles#2842)

files_pdfviewer

• Fix: Bust the cache of the static assets when Nextcloud is updated (files_pdfviewer#1523)

logreader

• Fix(build): empty CSS output directory on build (logreader#2187)

photos

• Fix: faces actions and add recognize e2e tests (photos#3578)
• Fix timestamp when looking at photos (photos#3731)
• Fix: properly handle trashed photos (photos#3767)
• Fix(routes): handle shared root path and remove duplicate folders route (photos#3770)

related_resources

• Fix(deps): declare terser-webpack-plugin explicitly (related_resources#1090)

suspicious_login

• Fix: avoid double app password check (suspicious_login#1137)

text

• Fix(viewer): align content of old version in viewer version comparison (text#9032)
• Test(playwright): migrate propfind tests from Cypress to Playwright (text#9073)
• Fixadd initial state for translation provider (text#9078)
• Fix(FloatingButtons): hide btns until first mousemove (text#9107)
• Fix(attachments): emit event when creating an attachment (text#9146)

twofactor_nextcloud_notification

• Fix(routes): bind poll regex constraint to its actual URL placeholder… (twofactor_nextcloud_notification#1488)

viewer

• Fix: urlencode file source based on resource url (viewer#3324)

Nextcloud 32.0.15rc1

server

• Fix(share): Set expiration time to end of day 59:59) (server#58709)
• Fix(Database): Use real idle-timer to prevent `lastInsertId` being reset on MariaDB/MySQL (server#62712)
• Fix(iMIP): Prevent mails from carrying an unrelated user’s name (server#63308)
• Test: remove double setup from share tests (server#63329)
• Master] fix(security): Update code signing revocation list (server#63356)
• Master] fix(security): Update code signing revocation list (server#63362)
• Master] fix(security): Update code signing revocation list (server#63368)
• Fix: allow file request upload when `part_file_in_storage=false` (server#63381)
• Fix: Public link with multiple mounts (server#63382)
• Fix(files_sharing): Use share password policy for password generation (server#63395)
• Test(cache): avoid ordering assumptions in testExtended (server#63401)
• Fix one core migration: Only add taskprocessing columns if they don’t exist (server#63406)
• Master] fix(security): Update code signing revocation list (server#63519)
• Fix(files): hide download action in link shares for newly created folders (server#63554)
• Fix(appconfig): make type-conflict error self-explanatory (server#63641)
• Fix cancelling the customization of a share (server#63656)
• Fix(dav): correctly mask public v1 links for non-home storages (server#63666)
• Fix(settings): Fix AI regex (server#63693)
• Improve logout url generation (server#63706)
• Fix: Check rememberme cookie previous session id matches uid (server#63721)
• Fix(2fa): Add missing BruteForceProtection attribute (server#63740)
• Fix(dav): only derive the write size from a PUT Content-Length (server#63765)
• Trashbin truncate filename unicode (server#63809)
• Fix(group): pass previous display name in GroupChangedEvent (server#63813)
• Fix(webauthn): Throw on uid mismatch when updating registration (server#63834)
• Fix: Correctly filter users when the backend does not implement ISearchKnownUsersBackend (server#63843)
• Fix: Ensure we don’t get share by empty name (server#63856)
• Fix(TaskProcessing): Harden task scheduling with webhooks (server#63875)
• Fix share by email expiration date in a different timezone (server#63881)
• Fix(dav): Do not claim no plugin available when checksum algorithm is not supported (server#63905)
• Update node checks (server#63914)
• Fix(sharing): properly frame block list (server#63932)
• Fix: don’t rely on constraint for filecache_extended “upsert” when in transaction (server#63983)
• Fix: filter system tag object IDs by user visibility (server#63993)

app_api

• Fix: make db migrations idempotent (app_api#986)

circles

• Avoid desync with memberships (circles#2364)
• Fix(shares): expose share of TYPE_CIRCLE to the FilesList in groupfolders (circles#2753)
• Fix(federated-event-service): broadcast CircleDestroy event before executing it’s manage() method (circles#2793)
• Fix: enhance validation upon team creation (circles#2835)
• Fix: enhance member level update validation (circles#2843)

files_pdfviewer

• Fix: Bust the cache of the static assets when Nextcloud is updated (files_pdfviewer#1524)

logreader

• Fix(build): empty CSS output directory on build (logreader#2188)

photos

• Feat(preview): Improve preview management (photos#3373)
• Fix: properly handle trashed photos (photos#3803)

suspicious_login

• Fix: avoid double app password check (suspicious_login#1136)

text

• Fix(FloatingButtons): hide btns until first mousemove (text#9106)

twofactor_nextcloud_notification

• Fix(routes): bind poll regex constraint to its actual URL placeholder… (twofactor_nextcloud_notification#1487)

viewer

• Fix: urlencode file source based on resource url (viewer#3326)