v8.0.7

Table of Contents

• Changelog for 8.0.7

Changes in 8.0.7

Summary

• Bugfix - Return correct issuerAssignedId on /me: #12635
• Bugfix - Log unmapped thumbnail errors and always report a sabredav exception: #12663
• Enhancement - Eliminate redundant LDAP read-after-write on create and update: #12618
• Enhancement - Add an opt-in bounded LDAP connection pool: #12660
• Enhancement - Retry LDAP operations against a lagging replica: #12672

Details

• Bugfix - Return correct issuerAssignedId on /me: #12635

  The /graph/v1.0/me endpoint reported the internal user UUID as
  identities[].issuerAssignedId instead of the issuer-assigned identity (the
  OIDC sub). The endpoint took a fast path that built the user model from the
  CS3 user in the request context, which does not carry the external identity, so
  it fell back to the internal UUID. /me now always resolves the user through
  the identity backend, which reads the stored external identity and returns the
  correct value. Group memberships are still only expanded when $expand=memberOf
  is requested.

  #12635

• Bugfix - Log unmapped thumbnail errors and always report a sabredav exception: #12663

  The webdav service logged failures of the thumbnails service at debug level
  only. Errors which are not a property of the requested file, such as the
  thumbnails service being unreachable, were therefore invisible at production log
  levels: a complete preview outage produced HTTP 500 responses without a single
  log line explaining them. Unmapped errors are now logged at error level, while
  expected per-file outcomes such as an unsupported file type or a file still
  being processed stay at debug level. Two of the four thumbnail handlers also
  logged without the request context, so their messages carried no request id.

  In addition, codesEnum only mapped four status codes, so error responses for
  all other codes were rendered with an empty <s:exception></s:exception>
  element. The missing entries for 403, 425 and 429 have been added and any
  remaining unmapped code now falls back to a generic exception name, so clients
  always receive a usable exception.

  #12663

• Enhancement - Eliminate redundant LDAP read-after-write on create and update: #12618

  The graph LDAP backend no longer re-reads an entry immediately after writing it
  just to recover the entry ID for the response. When oCIS generates the ID itself
  (GRAPH_LDAP_SERVER_UUID disabled), the create response is now synthesized from
  the data already sent to the directory, and update responses are built by
  folding the applied modifications onto the entry that was read before the write.
  This avoids a round-trip that, against a replicated directory reached through a
  proxy, could hit a lagging replica and fail or return stale data.

  When the directory assigns the ID (GRAPH_LDAP_SERVER_UUID enabled), creates keep
  the existing read-back, since the generated ID cannot otherwise be recovered.

  #12618

• Enhancement - Add an opt-in bounded LDAP connection pool: #12660

  The auth-basic, users, groups and graph services can now be switched from a
  single long-lived reconnecting LDAP connection to a bounded pool of connections,
  so concurrent requests no longer serialize on one socket. Connections are dialed
  and bound lazily on checkout, unhealthy connections are discarded and lazily
  re-dialed rather than eagerly reconnected, and checkout blocks with a
  configurable timeout once the pool is exhausted.

  Pooling is off by default and fully backwards compatible. Enable it per service
  via 'OCIS_LDAP_POOL_ENABLED' (or the service-specific
  '_LDAP_POOL_ENABLED' override), and tune it with 'OCIS_LDAP_POOL_SIZE'
  (default 5) and 'OCIS_LDAP_POOL_CHECKOUT_TIMEOUT' (default 30s).

  The graph service's identity backend now shares the same LDAP client
  implementation used by the reva auth/user/group managers instead of maintaining
  its own separate reconnecting client.

  #12660

• Enhancement - Retry LDAP operations against a lagging replica: #12672

  The graph LDAP backend can now retry operations against a replicated directory
  where a write to the primary is followed by a read that lands on a replica which
  has not yet caught up. This covers the read-back that recovers a
  directory-assigned ID after a create (GRAPH_LDAP_SERVER_UUID enabled), which is
  retried until the entry becomes visible. The retry count and backoff are tunable
  through GRAPH_LDAP_RETRY_MAX_COUNT, GRAPH_LDAP_RETRY_BASE_DELAY and
  GRAPH_LDAP_RETRY_MAX_DELAY; the defaults keep the previous behaviour (a single
  immediate retry with no delay), so existing deployments are unaffected.

  Retries now distinguish reads from writes: a write is no longer retried on a
  network error, which can surface after the request was already sent and would
  otherwise apply the mutation twice.

  #12672

v8.0.6

Table of Contents

• Changelog for 8.0.6

Changes in 8.0.6

Summary

• Security - Upgrade libvips to 8.18.4: #12596
• Security - Upgrade Go to 1.25.12: #12602
• Enhancement - Allow disabling the last sign-in timestamp update: #12522

Details

• Security - Upgrade libvips to 8.18.4: #12596

  Bumped libvips to 8.18.4 in all Docker images. The previous pin (8.18.3-r0) was
  dropped from the Alpine edge/community repository, which broke the image build.

  #12596

• Security - Upgrade Go to 1.25.12: #12602

  Bumped the Go toolchain used to build the release binaries and Docker images
  from 1.25.11 to 1.25.12. Go 1.25.11 is affected by CVE-2026-39822 (os.Root
  symlink following allows directory traversal), which is fixed in 1.25.12 and was
  blocking the release image security scan.

  #12602

• Enhancement - Allow disabling the last sign-in timestamp update: #12522

  The graph service maintains the 'oCLastSignInTimestamp' LDAP attribute of a user
  on every sign-in (when the LDAP identity backend has write access). This can
  cause a significant amount of LDAP write load, especially when the proxy's OIDC
  userinfo cache has a short TTL and sign-in events are emitted frequently.

  A new setting 'OCIS_LDAP_UPDATE_LAST_SIGNIN_DATE' /
  'GRAPH_LDAP_UPDATE_LAST_SIGNIN_DATE' (default 'true') allows disabling the
  update of the last sign-in timestamp without having to disable all LDAP writes
  ('OCIS_LDAP_SERVER_WRITE_ENABLED') or the graph events consumer. When set to
  'false' the graph service no longer listens for 'UserSignedIn' events and does
  not write the 'oCLastSignInTimestamp' attribute.

  #9942
  #12522

v8.2.0-rc.1

Table of Contents

• Changelog for 8.2.0-rc.1

Changes in 8.2.0-rc.1

Summary

• Security - Add X-XSS-Protection header: #12092
• Security - Upgrade libvips to 8.18.2: #12301
• Security - Fix signing-key to public share guests: #12332
• Security - Do not leak internal error details in webdav error responses: #12398
• Security - Make OIDC group sync opt-in: #12490
• Security - Block password and account changes via PATCH /graph/v1.0/me: #12493
• Bugfix - Always set an audit action for share updates: #7661
• Bugfix - Fix the proxy readiness check for NATS: #10661
• Bugfix - Honor $select=actions on the drive item permissions endpoint: #10816
• Bugfix - Keep group memberships when the OIDC groups claim is absent: #11435
• Bugfix - Pass the space ID when purging revision blobs: #11644
• Bugfix - Fix postprocessing resume command --restart flag: #11692
• Bugfix - Don't use hardcoded groupOfNames in group creation: #11776
• Bugfix - Translation for some email notifications: #11979
• Bugfix - Rework monitoring in the ocis_full deployment example: #11995
• Bugfix - Extract metadata from oversized files and fix ISO field: #12000
• Bugfix - Make tag unassignment idempotent and handle publish failures: #12001
• Bugfix - Expose the signature-auth attribute: #12016
• Bugfix - Fix CSP blocking bundled KaTeX font: #12070
• Bugfix - Fix case-sensitive photo metadata search: #12078
• Bugfix - Prevent incomplete Tika extractions from permanently blocking re-index: #12095
• Bugfix - Use O(1) document lookup instead of full search during reindexing: #12096
• Bugfix - Fix IDP build on FreeBSD by disabling absolute Babel runtime: #12114
• Bugfix - Always descend into directories during space reindexing: #12119
• Bugfix - Don't index failed uploads: #12121
• Bugfix - Avoid superfluous GetPublicShare call when deleting space permissions: #12122
• Bugfix - Fix CreateHome cache: #12128
• Bugfix - Return 200 OK for WOPI Lock requests in read-only and view-only modes: #12257
• Bugfix - Fix typo in README: #12263
• Bugfix - Return 404 when deleting a non-existing link share on a space: #12266
• Bugfix - Fix space management middleware removing users from spaces on download: #12285
• Bugfix - Search no longer disabled when OCIS_DISABLE_PREVIEWS=true: #12303
• Bugfix - Stable order for user search attributes: #12337
• Bugfix - Cache compiled rego policies to avoid recompiling on every request: #12345
• Bugfix - SpaceEditorWithoutTrashbin roles now correctly allow file editing: #12346
• Bugfix - Skip indexing of files still in postprocessing: #12350
• Bugfix - Fix PostgreSQL container restart loop in Keycloak deployments: #12359
• Bugfix - Prevent panic in presigned URL auth when signing key is missing: #12384
• Bugfix - Mask configs that hold secrets: #12397
• Bugfix - Recover from permanently-closed NATS connections in the nats-js-kv store: #12404
• Bugfix - Education user DELETE no longer 404s while leaving LDAP entry behind: #12405
• Bugfix - Fix double HTML-escaping of notification emails for multiple recipients: #12413
• Bugfix - Re-verify access tokens with an expired userinfo cache entry: #12414
• Bugfix - Keep shares visible in sharedWithMe when a resource cannot be statted: #12430
• Bugfix - Ensure the redirect URI for the IDP is valid: #12444
• Bugfix - The auth-app will create the user's home if needed: #12457
• Bugfix - Do not disable personal space on inconclusive permission check: #12499
• Bugfix - Rate-limit the exportPersonalData endpoint: #12516
• Bugfix - Apply the role allowlist on permission updates: #12540
• Change - Deprecate the owncloudsql storage driver option: #12486
• Enhancement - Add web extensions deployment configuration: #11940
• Enhancement - Add AI-assisted development guide: #11941
• Enhancement - Bump Web to 12.3.1: #12015
• Enhancement - Add space ID to incoming shares: #12024
• Enhancement - Add spaceid to REPORT: #12028
• Enhancement - Bump Reva version: #12051
• Enhancement - Add ResourceID field to UploadReady event: #12060
• Enhancement - Replace embedded IDP React SPA with server-rendered login page: #12086
• Enhancement - Support numeric range queries in KQL: #12094
• Enhancement - Add blobstore CLI commands to storage-users service: #12102
• Enhancement - Optimize search index after bulk reindexing: #12104
• Enhancement - Add vault storage with MFA-protected access: #12108
• Enhancement - Retry and abort on repeated extraction failures during indexing: #12111
• Enhancement - Log effective data and config paths at startup: #12117
• Enhancement - Allow resetting IDM service user passwords: #12118
• Enhancement - Update images in the ocis_full deployment example: #12123
• Enhancement - Add ocis search optimize CLI command: #12136
• Enhancement - Add Keycloak to the ocis_full deployment example: #12139
• Enhancement - Allow multiple objectClasses on group creation: #12229
• Enhancement - Add SpaceEditorWithoutVersionsWithoutTrashbin space membership role: #12261
• Enhancement - Add vault capabilities to the OCS capabilities endpoint: #12283
• Enhancement - Disable public link sharing for vault resources: #12321
• Enhancement - Update web-extension images in ocis_fuill: #12324
• Enhancement - Bump dependencies: #12325
• Enhancement - Add VaultMode permission: #12328
• Enhancement - Add vault themes: #12329
• Enhancement - Add ocis shares clean-corrupt-public-shares maintenance command: #12494
• Enhancement - Harden OCM create share: #12496
• Enhancement - Clean up the deployment examples: #12521
• Enhancement - Allow disabling the last sign-in timestamp update: #12522
• Enhancement - Add configurable software license and help page links: #12528
• Enhancement - Configurable logo click-through URL: #12529
• Enhancement - Add option to disable public link sharing: #12542
• Enhancement - Add option to disable direct (user/group) sharing: #12542
• Enhancement - Bump Web to 12.3...

v8.1.0

Table of Contents

• Changelog for 8.1.0

Changes in 8.1.0

Summary

• Security - Add X-XSS-Protection header: #12092
• Security - Upgrade libvips to 8.18.2: #12301
• Security - Fix signing-key to public share guests: #12332
• Bugfix - Fix postprocessing resume command --restart flag: #11692
• Bugfix - Don't use hardcoded groupOfNames in group creation: #11776
• Bugfix - Translation for some email notifications: #11979
• Bugfix - Rework monitoring in the ocis_full deployment example: #11995
• Bugfix - Extract metadata from oversized files and fix ISO field: #12000
• Bugfix - Make tag unassignment idempotent and handle publish failures: #12001
• Bugfix - Expose the signature-auth attribute: #12016
• Bugfix - Fix CSP blocking bundled KaTeX font: #12070
• Bugfix - Fix case-sensitive photo metadata search: #12078
• Bugfix - Prevent incomplete Tika extractions from permanently blocking re-index: #12095
• Bugfix - Use O(1) document lookup instead of full search during reindexing: #12096
• Bugfix - Fix IDP build on FreeBSD by disabling absolute Babel runtime: #12114
• Bugfix - Always descend into directories during space reindexing: #12119
• Bugfix - Don't index failed uploads: #12121
• Bugfix - Avoid superfluous GetPublicShare call when deleting space permissions: #12122
• Bugfix - Fix CreateHome cache: #12128
• Bugfix - Return 200 OK for WOPI Lock requests in read-only and view-only modes: #12257
• Bugfix - Fix typo in README: #12263
• Bugfix - Fix space management middleware removing users from spaces on download: #12285
• Bugfix - Search no longer disabled when OCIS_DISABLE_PREVIEWS=true: #12303
• Bugfix - Stable order for user search attributes: #12337
• Bugfix - Cache compiled rego policies to avoid recompiling on every request: #12345
• Bugfix - SpaceEditorWithoutTrashbin roles now correctly allow file editing: #12346
• Bugfix - Skip indexing of files still in postprocessing: #12350
• Bugfix - Mask configs that hold secrets: #12397
• Bugfix - Education user DELETE no longer 404s while leaving LDAP entry behind: #12400
• Bugfix - Recover from permanently-closed NATS connections in the nats-js-kv store: #12402
• Bugfix - Return correct issuerAssignedId on /me: #12411
• Bugfix - Keep personal space when Drives.Create permission check is inconclusive: #12429
• Bugfix - Fix the empty mount ID for reva config: #12492
• Enhancement - Add web extensions deployment configuration: #11940
• Enhancement - Add AI-assisted development guide: #11941
• Enhancement - Bump Web to 12.3.1: #12015
• Enhancement - Add space ID to incoming shares: #12024
• Enhancement - Add spaceid to REPORT: #12028
• Enhancement - Bump Reva version: #12051
• Enhancement - Add ResourceID field to UploadReady event: #12060
• Enhancement - Support numeric range queries in KQL: #12094
• Enhancement - Add blobstore CLI commands to storage-users service: #12102
• Enhancement - Optimize search index after bulk reindexing: #12104
• Enhancement - Add vault storage with MFA-protected access: #12108
• Enhancement - Retry and abort on repeated extraction failures during indexing: #12111
• Enhancement - Log effective data and config paths at startup: #12117
• Enhancement - Allow resetting IDM service user passwords: #12118
• Enhancement - Update images in the ocis_full deployment example: #12123
• Enhancement - Add ocis search optimize CLI command: #12136
• Enhancement - Add Keycloak to the ocis_full deployment example: #12139
• Enhancement - Allow multiple objectClasses on group creation: #12229
• Enhancement - Add SpaceEditorWithoutVersionsWithoutTrashbin space membership role: #12261
• Enhancement - Add vault capabilities to the OCS capabilities endpoint: #12283
• Enhancement - Disable public link sharing for vault resources: #12321
• Enhancement - Update web-extension images in ocis_fuill: #12324
• Enhancement - Bump dependencies: #12325
• Enhancement - Add VaultMode permission: #12328
• Enhancement - Add vault themes: #12329
• Enhancement - Bump Web to 12.4.2: #12450
• Enhancement - Deprecate the owncloudsql storage driver option: #12486
• Enhancement - Bump Web to 12.3.3: #13705
• Enhancement - Bump Web to 12.4.0: #13809

Details

• Security - Add X-XSS-Protection header: #12092

  Added the X-XSS-Protection header set to "0" to explicitly disable the
  deprecated browser XSS filter, which can introduce side-channel vulnerabilities.
  Modern XSS protection is provided through the Content-Security-Policy header.

  This change addresses security audit findings requiring explicit configuration
  of HTTP security headers per OWASP recommendations.

  #12092

• Security - Upgrade libvips to 8.18.2: #12301

  Bumped libvips to 8.18.2 in all Docker images to pick up the fix for a stack
  buffer overflow.

  #12301

• Security - Fix signing-key to public share guests: #12332

  The /ocs/v[12].php/cloud/user/signing-key endpoint was reachable through a
  public share session. The endpoint public-token is no longer allowed by the
  public-share resource scope in reva.

  #12332
  owncloud/reva#608

• Bugfix - Fix postprocessing resume command --restart flag: #11692

  The --restart / -r flag for ocis postprocessing resume was broken due to a
  flag name mismatch (retrigger vs restart) and silently did nothing. This has
  been fixed and the command now prints a confirmation message on success.

  #11692
  #12002

• Bugfix - Don't use hardcoded groupOfNames in group creation: #11776

  Formerly, when creating a group with a different objectClass, it will always use
  groupOfNames instead of the one provided in the config. Now, the server creates
  groups using the objectClass defined in the config.

  #11776

• Bugfix - Translation for some email notifications: #11979

  Some email notifications showed a wrong translated message that shouldn't
  appear. It's fixed so that message won't appear anymore.

  #11979

• Bugfix - Rework monitoring in the ocis_full deployment example: #11995

  The ocis_full deployment example has been basically reworked for how to provide
  monitoring.

  We now have: - a singe place for the definition of the tracing envvars for all
  ocis related container services - an easy and modular setup defining which
  sources should be inlcuded in monitoring via .env ...

v8.0.5

Table of Contents

• Changelog for 8.0.5

Changes in 8.0.5

Summary

• Security - Bump Go to 1.25.11: #12446
• Security - Upgrade libvips to 8.18.3: #12446
• Bugfix - Education user delete no longer 404s and leaves the LDAP entry behind: #12395
• Bugfix - Recover from permanently-closed NATS connections in the nats-js-kv store: #12401

Details

• Security - Bump Go to 1.25.11: #12446

  Fixes CVE-2026-42504, a stdlib MIME header decoding vulnerability flagged by the
  release image scan.

  #12446

• Security - Upgrade libvips to 8.18.3: #12446

  Bumped libvips to 8.18.3 in all Docker images. The previous pin (8.18.2-r0) was
  dropped from the Alpine edge/community repository, which broke the image build.

  #12446

• Bugfix - Education user delete no longer 404s and leaves the LDAP entry behind: #12395

  DELETE /graph/v1.0/education/users/{id} previously returned a 404 without
  removing the user. The education user delete handler used user.GetExternalID()
  for the backend DELETE, while the regular /users handler and the pre-v8.0 code
  path used user.GetId(). With the default RequireExternalID=false, the LDAP
  backend looked up the user by name-or-UUID, so the externalID never matched, the
  LDAP entry was never removed, and the response was a 404. This is now fixed.

  #12395

• Bugfix - Recover from permanently-closed NATS connections in the nats-js-kv store: #12401

  The nats-js-kv go-micro store plugin's hasConn() only checked whether the
  connection object was non-nil, not whether it was still alive. Once the
  underlying NATS client exhausted its reconnect attempts (e.g. a NATS pod restart
  longer than the client's reconnect window), the connection stayed non-nil but
  permanently closed. Because connection initialization is gated on !hasConn(),
  it never re-ran, so every subsequent KV operation failed with nats: connection closed until the affected pod was restarted.

  This surfaced as several user-visible failures backed by the NATS KV cache, e.g.
  all spaces becoming invisible (storage-users ListStorageSpaces) and download
  failures from missing signing keys (ocs).

  The store plugin now treats a closed connection as no connection, so the next
  operation transparently re-initializes it.

  #12401

v8.1.0-rc.1

Table of Contents

• Changelog for 8.1.0-rc.1

Changes in 8.1.0-rc.1

Summary

• Security - Add X-XSS-Protection header: #12092
• Security - Upgrade libvips to 8.18.2: #12301
• Security - Fix signing-key to public share guests: #12332
• Bugfix - Fix postprocessing resume command --restart flag: #11692
• Bugfix - Don't use hardcoded groupOfNames in group creation: #11776
• Bugfix - Translation for some email notifications: #11979
• Bugfix - Rework monitoring in the ocis_full deployment example: #11995
• Bugfix - Extract metadata from oversized files and fix ISO field: #12000
• Bugfix - Make tag unassignment idempotent and handle publish failures: #12001
• Bugfix - Expose the signature-auth attribute: #12016
• Bugfix - Fix CSP blocking bundled KaTeX font: #12070
• Bugfix - Fix case-sensitive photo metadata search: #12078
• Bugfix - Prevent incomplete Tika extractions from permanently blocking re-index: #12095
• Bugfix - Use O(1) document lookup instead of full search during reindexing: #12096
• Bugfix - Fix IDP build on FreeBSD by disabling absolute Babel runtime: #12114
• Bugfix - Always descend into directories during space reindexing: #12119
• Bugfix - Don't index failed uploads: #12121
• Bugfix - Avoid superfluous GetPublicShare call when deleting space permissions: #12122
• Bugfix - Fix CreateHome cache: #12128
• Bugfix - Return 200 OK for WOPI Lock requests in read-only and view-only modes: #12257
• Bugfix - Fix typo in README: #12263
• Bugfix - Fix space management middleware removing users from spaces on download: #12285
• Bugfix - Search no longer disabled when OCIS_DISABLE_PREVIEWS=true: #12303
• Bugfix - Stable order for user search attributes: #12337
• Bugfix - Cache compiled rego policies to avoid recompiling on every request: #12345
• Bugfix - SpaceEditorWithoutTrashbin roles now correctly allow file editing: #12346
• Bugfix - Skip indexing of files still in postprocessing: #12350
• Enhancement - Add web extensions deployment configuration: #11940
• Enhancement - Add AI-assisted development guide: #11941
• Enhancement - Bump Web to 12.3.1: #12015
• Enhancement - Add space ID to incoming shares: #12024
• Enhancement - Add spaceid to REPORT: #12028
• Enhancement - Bump Reva version: #12051
• Enhancement - Add ResourceID field to UploadReady event: #12060
• Enhancement - Support numeric range queries in KQL: #12094
• Enhancement - Add blobstore CLI commands to storage-users service: #12102
• Enhancement - Optimize search index after bulk reindexing: #12104
• Enhancement - Add vault storage with MFA-protected access: #12108
• Enhancement - Retry and abort on repeated extraction failures during indexing: #12111
• Enhancement - Log effective data and config paths at startup: #12117
• Enhancement - Allow resetting IDM service user passwords: #12118
• Enhancement - Update images in the ocis_full deployment example: #12123
• Enhancement - Add ocis search optimize CLI command: #12136
• Enhancement - Add Keycloak to the ocis_full deployment example: #12139
• Enhancement - Allow multiple objectClasses on group creation: #12229
• Enhancement - Add SpaceEditorWithoutVersionsWithoutTrashbin space membership role: #12261
• Enhancement - Add vault capabilities to the OCS capabilities endpoint: #12283
• Enhancement - Disable public link sharing for vault resources: #12321
• Enhancement - Update web-extension images in ocis_fuill: #12324
• Enhancement - Bump dependencies: #12325
• Enhancement - Add VaultMode permission: #12328
• Enhancement - Add vault themes: #12329
• Enhancement - Bump Web to 12.3.3: #13705
• Enhancement - Bump Web to 12.4.0: #13809

Details

• Security - Add X-XSS-Protection header: #12092

  Added the X-XSS-Protection header set to "0" to explicitly disable the
  deprecated browser XSS filter, which can introduce side-channel vulnerabilities.
  Modern XSS protection is provided through the Content-Security-Policy header.

  This change addresses security audit findings requiring explicit configuration
  of HTTP security headers per OWASP recommendations.

  #12092

• Security - Upgrade libvips to 8.18.2: #12301

  Bumped libvips to 8.18.2 in all Docker images to pick up the fix for a stack
  buffer overflow.

  #12301

• Security - Fix signing-key to public share guests: #12332

  The /ocs/v[12].php/cloud/user/signing-key endpoint was reachable through a
  public share session. The endpoint public-token is no longer allowed by the
  public-share resource scope in reva.

  #12332
  owncloud/reva#608

• Bugfix - Fix postprocessing resume command --restart flag: #11692

  The --restart / -r flag for ocis postprocessing resume was broken due to a
  flag name mismatch (retrigger vs restart) and silently did nothing. This has
  been fixed and the command now prints a confirmation message on success.

  #11692
  #12002

• Bugfix - Don't use hardcoded groupOfNames in group creation: #11776

  Formerly, when creating a group with a different objectClass, it will always use
  groupOfNames instead of the one provided in the config. Now, the server creates
  groups using the objectClass defined in the config.

  #11776

• Bugfix - Translation for some email notifications: #11979

  Some email notifications showed a wrong translated message that shouldn't
  appear. It's fixed so that message won't appear anymore.

  #11979

• Bugfix - Rework monitoring in the ocis_full deployment example: #11995

  The ocis_full deployment example has been basically reworked for how to provide
  monitoring.

  We now have: - a singe place for the definition of the tracing envvars for all
  ocis related container services - an easy and modular setup defining which
  sources should be inlcuded in monitoring via .env - comments describing the
  setup for the ease extending it - the monitoring definition in .env has been
  moved to the bottom and the compose_file assembly has monitoring as last entry
  now to guarantee nothing gets overwritten by accident

  #11995

• Bugfix - Extract metadata from oversized files and fix ISO field: #12000

  Two issues were found in the Tika content extractor:

  1. Files exceeding SEARCH_CONTENT_EXTRACTION_SIZE_LIMIT (default 20MB) were
     skipped entirely — no EXIF, no photo metadata, no image dimensions were
     extracted. This particularly affected Pixel Motion Photos (.MP.jpg) which
     embed an MP4 video making them 3-9MB. Since EXIF metadata lives in the JPEG
     header (first few KB), a truncated stream is sufficient. The extractor now wraps
     the download in io.LimitReader ...

v8.0.4

Table of Contents

• Changelog for 8.0.4

Changes in 8.0.4

Summary

• Security - Upgrade libvips to 8.18.2: #12301
• Security - Bump Go to 1.25.10: #12306
• Bugfix - SpaceEditorWithoutTrashbin roles now correctly allow file editing: #12346

Details

• Security - Upgrade libvips to 8.18.2: #12301

  Bumped libvips to 8.18.2 in all Docker images to pick up the fix for a stack
  buffer overflow.

  #12301

• Security - Bump Go to 1.25.10: #12306

  Fixes CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39836,
  CVE-2026-42499.

  #12306

• Bugfix - SpaceEditorWithoutTrashbin roles now correctly allow file editing: #12346

  Fixed a bug where the *WithoutTrashbin space editor roles were rendered as
  read-only in the Web frontend. The OCS PermissionWrite bit was not set for these
  roles because the RoleFromResourcePermissions round-trip required
  RestoreRecycleItem, which these roles intentionally omit.

  #12346

vv8.0.4-dev.2

Development release — no release notes yet. See unreleased changes.

vv8.0.4-dev.1

Development release — no release notes yet. See unreleased changes.

v8.0.3

Changes in 8.0.3

Summary

• Enhancement - Bump go to 1.25.10: #12306
• Enhancement - Bump libvips to 8.18.2: #12301