v2.6.0

[johaven]

⭐ Highlights

• Draw.io support
  Draw.io diagrams can now be created and edited directly in Sync-in through either the provided Docker service or an external Draw.io instance. VSDX and Gliffy files can also be imported and saved as .drawio documents. Editing includes file locking, Save As support, and protection against closing documents with unsaved changes.

• Redesigned image viewer
  The image viewer has been completely redesigned for desktop and mobile. It now provides directory navigation, a thumbnail gallery, zooming and panning, pinch and swipe gestures, rotation, slideshow mode, fullscreen display, and image information such as dimensions.

• Persistent user preferences
  Interface preferences are now stored with each account and restored across sessions. Users can select an automatic, light, or dark theme, choose their preferred online office editor, control desktop system notifications, and decide whether hidden files should be displayed. In Quick Access, Recents and Favorites can be shown or hidden together or individually, then positioned within the menu to suit each user.

• Improved file creation and opening workflows
  The new file dialog now provides clearer document-type selection, including a compact selector on mobile. Newly created folders and supported documents can be opened immediately, with this option enabled by default. Opening a file without an available preview now displays a download prompt instead of starting an unexpected download.

• Improved online editor experience
  OnlyOffice and Collabora now follow theme changes dynamically. Editor toolbars are more responsive, active editing sessions refresh their file locks, and text, Markdown, and Draw.io editors share a consistent unsaved-changes confirmation.

• Redesigned public links
  The public-link dialog has been reorganized to make link identity, permissions, activation, expiration, access limits, and password protection easier to manage. Existing password protection can be preserved without entering a new password. Public pages also have an updated header and their own theme switch.

• Deletion-safe synchronization
  Each synchronization path can now be configured to ignore deletions, preventing removed files from being propagated between the client and server when this behavior is not desired.

• Improved keyboard and mobile navigation
  Selected files can now be opened with Enter, renamed with F2, and deleted with Delete. Mobile users gain reliable long-press context menus on iOS, a download shortcut, clearer tabs, and more stable breadcrumbs.

• Catalan language support
  Sync-in is now fully available in Catalan, including the interface, date formatting, authentication, file operations, administration, synchronization, editors, and notifications.

⚠️ Minor Breaking Changes

• Node.js 22.12 is now required: source-based installations must use Node.js 22.12.0 or newer. The backend now uses native ESM, so custom scripts or integrations importing server modules may require ESM-compatible imports.

• SMTP certificate verification is enabled by default: mail.rejectUnauthorized now defaults to true. Servers using self-signed or otherwise untrusted SMTP certificates must explicitly set it to false after assessing the security implications. The former mail.debug option has been removed; SMTP details are now controlled through mail.logger and the general logger.level.

• Hidden-file visibility is now a user preference: the global applications.files.showHiddenFiles setting has been removed. Hidden files are shown by default for accounts without an existing preference, and each user or guest can change this behavior from their account settings.

• Numeric trustProxy values are deprecated: numeric values are temporarily accepted but are converted to booleans: values greater than or equal to 1 become true, while lower values become false. Deployments should use an explicit boolean or a trusted proxy IP/CIDR list.

• External editor URLs are validated strictly: configured OnlyOffice, Euro-Office, Collabora, and Draw.io external servers must use valid absolute HTTP or HTTPS URLs. Malformed values that were previously accepted now fail configuration validation.

⚙️ Performance and Platform

• Lean loading of optional services
  Mail, Redis, authentication providers, and online editor modules are now loaded only when configured or enabled, reducing unnecessary startup work and dependencies while lowering memory usage by approximately 10%.

• More efficient database health checks
  Healthy database connections are no longer polled continuously.

• Stricter backend validation
  Request and configuration validation now use Zod with stricter typing, explicit user serialization, and more consistent error normalization.

• Updated server dependencies
  The backend has moved to NestJS 12, Redis 6, Nodemailer 10, Vitest 5, TypeScript 6, and native ESM.

🐞 Bug Fixes

• More reliable synchronization: temporary files receive their expected modification time before publication, synchronized-path and search matching are more precise, and completed desktop tasks no longer leave stale counters.

• More reliable previews and assets: image formats unsupported by Sharp are handled gracefully, PDF.js assets stay aligned with the installed dependency.

• Clearer uploads and file operations: multi-file uploads now produce a single localized summary covering successful, failed, and cancelled tasks. File-operation and trash errors also provide clearer translated messages.

• Improved spaces and breadcrumbs: space root levels are displayed in breadcrumbs, group-link paths are generated without unintended translation, and sidebar actions no longer overflow or shift mobile breadcrumbs.

• Improved interface consistency: editor toolbars, search controls, table rows, badges, dropdowns, dark-theme states, notifications, and mobile layouts have been refined. Tooltip hover areas and confirmation actions are also more reliable.

• Improved deployment and logging: Docker startup avoids redundant ownership changes for zero-padded user IDs, shutdown signals are logged, and backend, WebSocket, SMTP, and HTTP logging remain consistent with updated dependencies.

⚠️ Security

• Account-enumeration resistance and bounded password work
  Credentials are now verified before account state is disclosed, including with LDAP authentication. Local password checks are limited per submitted identifier, failures use consistent responses, and only successful WebDAV authentication results are cached.

• Hardened LDAP direct-bind authentication
  LDAP bind identities are normalized and escaped. Users are resolved from the authenticated DN, and ambiguous, incomplete, truncated, or unverifiable fallback results are rejected.

• Protected WebDAV authentication cache
  WebDAV cache keys now use a domain-separated HMAC instead of an unkeyed password digest. Cache lifetimes follow the configured access-token lifetime, and cached authentication is invalidated after security-sensitive user, group, permission, password, 2FA, or application-password changes.

• Stricter collaborative-space role boundaries
  Only administrators and regular users can become space managers. Guests and public-link identities can no longer access collaborative-space trash, and the personal-space alias is reserved when new space aliases are generated.

• Dotfiles excluded from static assets
  Files whose names begin with a dot can no longer be served through the server’s static-assets handler.

Special thanks to @cuquet for the Catalan translation, @Stephan-P for the Dutch translation update, and @Davidowi2 for improving the Code of Conduct.

Contributors: @cuquet @Stephan-P @Davidowi2