26.8.20260811

• SECURITY: this release fixes multiple high level security vulnerabilities, everyone is strongly adviced to update to it!
• Admin: fix TypeError in clearing openid access-tokens on password reset
• Auth: fix TypeError authenticating with OAuth Bearer token / id_token cookie
• Calendar: fix TypeError when importing iCal, one more date not being a DateTime
• Calendar: make sure notifications are in user timezone
• OpenID: diverse fixes / regressions after the update in the last release
• WebAuthN: fixed existing passkeys were not longer working due to missing proxy configuration

26.8.20260804

• SECURITY: this release fixes multiple high level security vulnerabilities, everyone is strongly adviced to update to it!
• Admin: really fix lost background image, if config from apps like calendar or addressbook is saved
• CalDAV/Calendar: fix EX/RDATE were exported wrong (timezone shifted) for server-timezones NOT UTC
• Customfields: fix multiline text and richtext CFs collapsing to almost nothing in Firefox
• Invoices: export exemption reason (code) to XML and automatic fill it for category-code "AE" with "Reverse charge" and "VATEX-EU-AE"
• OpenID: bump to current upstream (league v9, steverhoades v3, Slim 4, lcobucci/jwt 5)
• OpenIDConnect/Authentication: fix inverted email_verified check and config key mismatch
• Status/Jitsi: tolerate legacy too-short secrets, validate new ones in admin config
• WebAuthN: former EPL app allowing to use WebAuthN as 2nd factor either with passkeys, platform authenticators (e.g. Windows Hello) or hardware tokens like Yubikeys

23.1.20260804

• SECURITY: this release fixes multiple high level security vulnerabilities, everyone is strongly adviced to update to it!
• Admin: really fix lost background image, if config from apps like calendar or addressbook is saved
• IMPORTANT: security coverage for 23.1 will end August 15th 2026, update to 26.x to receive further security updates!

26.7.20260724

• SECURITY: this release fixes multiple security vulnerabilities, everyone is strongly adviced to update to it!
• Admin: fix lost background image, if config from apps like calendar or addressbook is saved
• Adressbook/other apps: fix merge-print with converting to PDF failed after last security release
• Auth/OpenIDConnect: only use unverified email, if explicitly enabled in configuration
• ImportExport: fix stalled installation caused by last security hardening
• ProjectManager: fix SQL error when searching in element list for 2 or more keywords

23.1.20260724

• SECURITY: this release fixes multiple security vulnerabilities, everyone is strongly adviced to update to it!
• Adressbook/other apps: fix merge-print with converting to PDF failed after last security release
• Auth/OpenIDConnect: only use unverified email, if explicitly enabled in configuration
• IMPORTANT: security coverage for 23.1 will end August 15th 2026, update to 26.x to receive further security updates!

26.7.20260710.3

• SECURITY: this release fixes two more security vulnerabilities just reported, everyone is strongly adviced to update to it!

26.7.20260710

• SECURITY: this release fixes multiple high level security vulnerabilities, everyone is strongly adviced to update to it!
• All apps: inserting a new custom-fields between or before existing ones removes most data from the existing fields
• Calendar/Mail: fix applying an external organizers update did loose the recurrence end-date
• Mail: display title no longer shows "mail-display" prefix
• Mail: fix access check in mail_hooks access method
• Invoices: OCR import now identifies document type (invoice, credit note, ...) and billing period

23.1.20260710.3

• SECURITY: this release fixes two more security vulnerabilities, everyone is strongly adviced to update to it!
• This is probably the last 23.1 security release, we recommend to update to 26.x rather sooner than later.

23.1.20260710

• SECURITY: this release fixes multiple high level security vulnerabilities, everyone is strongly adviced to update to it!
• This is probably the last 23.1 security release, we recommend to update to 26.x rather sooner than later.
• All apps: inserting a new custom-fields between or before existing ones removes most data from the existing fields
• Mail: fix access check in mail_hooks access method

26.7.20260702

• Calendar/CalDAV/REST: wrong etag returned in CalDAV REPORT/PROPFIND or REST PUT/PATCH causing event updates being rejected
• Calendar/CalDAV: fix deleting of recurrances/parsing EXDATE
• Calendar/CalDAV: fix broken sync-token causing all events being synced / high server load
• Calendar/ActiveSync: using now automatic conversation from DateTime objects from our own z-push 2.5.0.2
• Mail: do not try to load Preview if no mail is selected
• Mail: prevent attempt to delete when no mail is selected
• OpenID: fix error (Class "League\OAuth2\Server\RequestTypes\AuthorizationRequest" not found) when confirming scopes
• PHP: fix 3 more usages of PHP 8.4+ syntax while requiring only PHP 8.2 (we recommend PHP 8.5!)