Second RCs of 35.0.3, 34.0.6, 33.0.11

[blizzz]

The second release candidates for our next maintenance updates are here: Nextcloud 35.0.3, 34.0.6, and 33.0.11!

Your testing helps us catch issues before the final releases, so don’t hesitate to try them out!
If something doesn’t behave as expected, please let us know on the appropriate GitHub repository!

The final releases are planned for next week, on November 12, 2026.

Downloads

• Nextcloud Server 35.0.3 RC2 on GitHub
• Nextcloud Server 34.0.6 RC2 on GitHub
• Nextcloud Server 33.0.11 RC2 on GitHub

Changelog

Nextcloud 35.0.3rc2

server

• Fix(files_reminders): keep folder preload for folders over 512 entries (server#65476)
• Ci(dav): run CalDAVTester in a Python 2.7 container (server#66368)
• Fix(sharing): Add names to new indexes (server#66386)
• Fix: sharing attribute resolution (server#66395)
• Fix(preview): send the whole JPEG to Imaginary (server#66400)

bruteforcesettings

• Ci: Add release relay job (bruteforcesettings#1397)

circles

• Fix: use strict in_array (circles#3138)

Nextcloud 34.0.6rc2

server

• Ci(dav): run CalDAVTester in a Python 2.7 container (server#66369)

bruteforcesettings

• Ci: Add release relay job (bruteforcesettings#1396)

circles

• Fix: use strict in_array (circles#3137)

files_lock

• Ci: Add release relay job (files_lock#1415)

related_resources

• Ci: Add release relay job (related_resources#1178)

Nextcloud 33.0.11rc2

bruteforcesettings

• Ci: Add release relay job (bruteforcesettings#1395)

circles

• Fix: use strict in_array (circles#3141)

related_resources

• Ci: Add release relay job (related_resources#1177)

[jtr]

Nextcloud Server 35.0.3rc — combined release-candidate notes

These notes combine v35.0.3rc1 and v35.0.3rc2, grouped around changes most likely to matter to Server administrators and operators. CI, test-only, and routine dependency updates are omitted; related fixes are summarized.

AI generated. It is possible there are mistakes. References are included for all items to facilitate verification and deeper dives. Verify as deemed appropriate for your circumstances.

Sharing and federation

• Share expiration and link-token handling are more reliable, including unique tokens and validation of token length (server#65403, server#66044, server#64710).
• Fixes improve sharing attributes, federation reshares, and remote share owners and initiators (server#66395, server#66373, server#65915).
• Received shares now show the owner’s avatar, and mount events are dispatched for recipients (server#65560, server#65988). Group administrators can add users to groups more reliably (server#66265).
• Public-share authentication and DAV behavior received fixes, including moves within a user’s own share when sharing is disabled (server#66204, server#66331).
• Manually accepting or rejecting a share now preserves required attributes. Share-by-mail sends the readable password rather than its hash (server#65572, server#65578).
• Circles fixes address federated shares and ensure that only accessible shared resources are shown (circles#3026, circles#3054).

Files, storage, and previews

• Fixes cover Unicode file paths, uploads with an empty MIME type, quota checks when reading files, and file operations involving invalid or masked storage (server#65566, server#65927, server#65880, server#66291, server#65934).
• Preview generation received reliability and performance improvements, including for JPEGs processed by Imaginary. Live-photo handling was also improved (server#65451, server#66400, server#66190).
• Storage and file-cache migrations and indexing were adjusted, including handling a missing trash-table column and adding files_metadata_index to the file-cache partition (server#65414, server#65518).
• For installations using server-side encryption: file-size corrections now use the encoding’s block size, and ChunkingV2Plugin is no longer used when server-side encryption is enabled (server#65460, server#66290). A related fix avoids loading encryption keys for empty paths in group-folder versions (server#65676).

DAV, calendars, and contacts

• CalDAV/CardDAV fixes address sync-result truncation, sync-token retention, recurring-event matching, and calendar availability after working-hour slots are cleared (server#66012, server#65757, server#66015, server#65695).
• Read-only calendar delegates no longer receive write-property permissions; legacy DAV authentication also received a fix (server#66237, server#65541).
• WebDAV pagination headers are handled correctly, which can affect clients reading paginated file listings (server#66156).

Authentication and security hardening

• Logins containing NUL bytes are rejected instead of being silently converted, and stale requests can no longer replace a regenerated session (server#66242, server#66295).
• Public-share session authentication is tied to the password hash. Theming now accepts only canonical SVG paths, and remote avatar fetching has timeout and size limits (server#66204, server#66310, server#66162).
• A guard prevents errors on PHP builds where Argon2 password constants are unavailable (server#66047).
• For AppAPI/HaRP deployments: proxy routing checks were tightened to match HaRP behavior, including checks for path segments and lifecycle endpoints. The HaRP version check now requires 0.4.8. Resource limits are rounded to whole numbers, and a HaRP daemon without a key no longer produces a PHP warning (app_api#1118, app_api#1142, app_api#1145, app_api#1150, app_api#1164, app_api#1169, app_api#1183, app_api#1122, app_api#1137).

Administration and operations

• LDAP fixes address user lookup caching and query construction; provisioning API user filtering now respects whether accounts are enabled (server#65501, server#66196, server#66209, server#65929).
• Local storage gains a min_free_space configuration option (server#66205). Circles adds a default group quota and a --delete option to circles:remote (circles#2907, circles#3045).
• File locking now handles WebDAV lock refreshes, force unlocks, and locks belonging to disabled or deleted users (files_lock#1363, files_lock#1366, files_lock#1391).
• Serverinfo excludes /boot and /boot/efi from its disk list and can show users who have logged in at least once (serverinfo#1191, serverinfo#1250).
• Performance improvements include preview generation and migration work, activity indexing, and fewer membership queries in Circles (server#65464, activity#3021, circles#3080).

Included app fixes

• Activity correctly applies group-folder ACLs and falls back to a MIME icon when preview generation fails (activity#3020, activity#3070).
• Photos respects share-download permissions in filtered albums (photos#4040). The Download Limit app now counts legacy share downloads only once (files_downloadlimit#1089).
• Notifications improves fetching notifications through web push (notifications#3550). Text fixes false sync conflicts and avoids silently dropping outside file changes (text#9547, text#9530).

Sources: v35.0.3rc1 · v35.0.3rc2