v3.13.0

Changelog for reva 3.13.0 (2026-10-06)

The following sections list the changes in reva 3.13.0 relevant to
reva users. The changes are ordered by importance.

Summary

• Sec #5839: Enforce transport TLS floor and scheme policy
• Sec #5836: Guard inbound share discovery against SSRF
• Sec #5838: Guard remaining OCM discovery inputs
• Sec #5837: Guard receiver OCM and WebDAV connections
• Sec #5834: Bound peer-controlled OCM JSON
• Fix #5825: Init admin connection instead of mounting
• Fix #5858: Set ceph user thread groups per thread
• Fix #5840: A grpc or http block with no services is no longer rejected
• Fix #5861: The lightweight scope for updating ocm shares
• Fix #5804: Rjobs timeouts + registry issues
• Fix #5816: Incorrect name for labelsprovider
• Fix #5791: Fixes for the EOSC Node
• Fix #5811: Report folder size in public links
• Fix #5817: Reconnect the service registry when publishing fails
• Fix #5849: Seperate the eos user and userid cache
• Fix #5813: Make service names unique per transport
• Enh #5826: Add embedded processing failure mode
• Enh #5692: Add the Reva Admin API
• Enh #5815: Discover app providers through the service registry
• Enh #5644: Implement LoginFlow (apptokens)
• Enh #5843: Create a home for lightweight accounts on login
• Enh #5814: Allow LW accounts to use modern paths
• Enh #5860: Log the resource id on the access line
• Enh #5859: Log who accessed a resource and who owns it
• Enh #5768: Small cleanup of notification system
• Enh #5833: Add shared OCM HTTP transport package
• Enh #5741: Add periodic job to check orphaned shares
• Enh #5771: Replace backup_job_id with backup_name in projects table
• Enh #5841: Fail over to another node when a peer cannot be reached
• Enh #5665: Add a service registry for service discovery
• Enh #5746: Implement shallow reconcile job
• Enh #5780: Add a takeout service to export a user's home directory
• Enh #5801: Cache for app passwords used by sync client

Details

• Security #5839: Enforce transport TLS floor and scheme policy

  The shared OCM HTTP transport now requires TLS 1.2 or newer on every client (including trusted
  and insecure modes), rejects plain HTTP on public-only clients except an explicit
  literal-loopback opt-in, and rejects HTTPS-to-HTTP redirects on public-only HTTP clients.
  The address classifier also closes bounded gaps for the IANA special-purpose ranges
  (0.0.0.0/8, 198.18.0.0/15, 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24,
  240.0.0.0/4, 64:ff9b:1::/48, 2001:db8::/32), keeping the PCP and TURN anycast exceptions
  (RFC 7723/8155) and the well-known NAT64 unwrap.

  Explicit federation CIDR ranges do not relax that scheme policy, the TLS minimum, or redirect
  enforcement. A configured private address is still HTTPS-only, and a redirect is checked
  against the same address policy as the dial.

  #5839

• Security #5836: Guard inbound share discovery against SSRF

  Unauthenticated inbound /shares discovery now uses a public-only HTTP client built once at
  handler init and reused per request, closing the SSRF where a sender-derived server could
  steer the inbound service at private networks. Loopback is allowed only behind an explicit
  allow_loopback_federation flag for the local two-provider integration topology; both
  local integration fixtures declare the exception. The discovery timeout is now configurable
  via ocm_client_timeout (seconds, default 10, preserving the existing inbound-discovery
  timeout). Operators can opt the inbound public-only client into honoring HTTP_PROXY,
  HTTPS_PROXY, and NO_PROXY via ocm_client_use_env_proxy (off by default; the
  public-only client stays direct unless explicitly enabled).

  Controlled federation deployments with private RFC 1918 / IPv6 ULA destinations can opt the
  inbound public-only discovery client into a narrow address exception via
  allowed_federation_cidrs (off by default; each entry must be a canonical CIDR wholly
  inside 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or fc00::/7). An invalid
  element fails service startup before any discovery runs: no partially accepted list is
  installed and the router is not served. Ordinary public destinations remain permitted,
  loopback stays gated behind allow_loopback_federation, and unrelated private ranges
  remain denied.

  #5836

• Security #5838: Guard remaining OCM discovery inputs

  The open provider authorizer's GetInfoByDomain and the ScienceMesh directory-listed
  provider discovery now use the shared public-only OCM client. The operator-configured
  directory fetch stays on the trusted client; only provider URLs taken from the unsigned
  directory response (and request-supplied WAYF discovery) go through the public-only
  client. Loopback is disabled for open-authorizer discovery. Both untrusted paths bypass
  environment proxies. Blocked targets are rejected before any request reaches the server.

  Operators may now configure an explicit allowed_federation_cidrs exception list for the
  public-only OCM discovery clients (ScienceMesh WAYF and the open provider authorizer). The
  list is empty by default and admits only canonical RFC 1918 IPv4 or IPv6 ULA prefixes; invalid
  entries abort initialization before any directory fetch. Directory fetches stay trusted;
  listed providers and request-supplied discovery remain public-only with the configured
  exception only. TLS verification, loopback, and proxy controls stay independent.

  #5838

• Security #5837: Guard receiver OCM and WebDAV connections

  Inbound legacy WebDAV type probes, received-share OCM discovery and token exchange, and
  received-share WebDAV operations now all use the public-only transport from the shared OCM
  client package. One stored OCM client guards both discovery and token exchange; one driver
  helper builds every gowebdav client and always applies the guarded transport, including the
  retry and one-off upload paths. Loopback is allowed only behind an explicit
  allow_loopback_federation flag on the received-storage config; private targets stay
  denied. Enforcement is at dial time, not in URI syntax validation. Operators can opt the
  received public-only clients into honoring HTTP_PROXY, HTTPS_PROXY, and NO_PROXY
  via ocm_use_env_proxy on the received-storage config (off by default; the public-only
  clients stay direct unless explicitly enabled).

  Both received transports, the OCM discovery and token-exchange client and the WebDAV round
  tripper, share the explicit private ranges from allowed_federation_cidrs on the
  received-storage config.

  #5837

• Security #5834: Bound peer-controlled OCM JSON

  Every OCM control-plane response body and peer-controlled error snippet is now capped at a 1
  MiB default limit through readOCMBody and decodeOCMJSON helpers, which read the body
  once and return ErrResponseTooLarge for oversized input. This prevents
  decode-after-drain regressions in NewShare and InviteAccepted and bounds the existing
  unsigned directory JSON at the same limit.

  #5834

• Bugfix #5825: Init admin connection instead of mounting

  The ceph admin connection was mounted instead of initialized, which worked when the key had
  mounting permissions but it does not anymore

  #5825

• Bugfix #5858: Set ceph user thread groups per thread

  Syscall.Setgroups sets the groups for ALL threads of the process, which caused race
  conditions when multiple users were using the same process. Similarly, when a user thread
  finished, the original groups were restored on ALL threads.

  This is fixed by using unix.Setgroups, which only applies to the calling thread.

  #5858

• Bugfix #5840: A grpc or http block with no services is no longer rejected

  Declaring a block that carries only settings, such as a [grpc] with nothing but
  control_address, failed at startup with "grpc.services must be a map". The services key was
  read with a type assertion, which also fails when the key is simply absent. A process whose only
  grpc listener is its control channel can now start.

  #5840

• Bugfix #5861: The lightweight scope for updating ocm shares

  The lightweight scope for updating ocm shares was missing and lightweight users were unable to
  process embedded shares.

  #5861

• Bugfix #5804: Rjobs timeouts + registry issues

  • Jobs that are killed because of an overlap are no longer seen as a failure and are not retried *
    Daemons that cannot reach the gateway die * Failed resolutions are retried for a few times * The
    scheduler reads only its own schedule keys instead of listing the whole bucket, which timed out
    and stopped all periodic jobs

  #5804

• Bugfix #5816: Incorrect name for labelsprovider

  The labels provider was incorrectly named labels and this caused an issue where the other
  services could not find it via the service registry

  #5816

• Bugfix #5791: Fixes for the EOSC Node

  #5791

• Bugfix #5811: Report folder size in public links

  #5811

• Bugfix #5817: Reconnect the service registry when publishing fails

  A process whose NATS write failed marked its registry connection as lost and queued the write,
  but only the watch path ever reconnected. A process with a healthy watcher therefore never
  reconnected: it kept queueing its own heartbeats, silently, while its peers aged its nod...

v3.12.2

Changelog for reva 3.12.2 (2026-08-14)

The following sections list the changes in reva 3.12.2 relevant to
reva users. The changes are ordered by importance.

Summary

• Sec #5752: Harden OCM federation against SSRF, spoofed IPs and TLS downgrade
• Fix #5761: Report the recursive size of directories in cephmount
• Fix #5766: Skip fetching group members when creating a share
• Enh #5740: Cephmount now supports shares to external accounts
• Enh #5745: Ignore Range requests on empty files
• Enh #5764: Return lock info in propfind
• Enh #5769: Keep timestamp instead of bool for share orphan
• Enh #5736: Enable quota cache for projects
• Enh #5738: Return file name on PUT to upload-only public link
• Enh #5762: Move share permission checks to the gateway

Details

• Security #5752: Harden OCM federation against SSRF, spoofed IPs and TLS downgrade

  The unauthenticated ScienceMesh /discover endpoint no longer connects to loopback,
  private, link-local or cloud-metadata addresses. The OCM provider allow list no longer
  trusts a caller-supplied X-Forwarded-For header, and remote provider discovery now
  verifies TLS certificates by default.

  #5752

• Bugfix #5761: Report the recursive size of directories in cephmount

  Directories were reported with a size of 0, so a folder's size did not match the contents seen
  inside it. The size of the subtree is now taken from the CephFS ceph.dir.rbytes extended
  attribute.

  #5761

• Bugfix #5766: Skip fetching group members when creating a share

  #5766

• Enhancement #5740: Cephmount now supports shares to external accounts

  • Grants to external accounts are now stored in a user.reva.extshare.<account> xattr and
    are read back by ListGrants. * Operations on their behalf run as the service account configured
    with external_accounts_user_name/_uid/_gid, cboxexternal by default, the same
    account the EOS driver uses. * What they are allowed to do is decided by Reva from the stored grant
    rather than by the permissions of that account. * The ResourceInfo of a shared resource now also
    carries a name and an etag which now is recursive, meaning you changes in subtrees also get
    propgated.

  #5740

• Enhancement #5745: Ignore Range requests on empty files

  #5745

• Enhancement #5764: Return lock info in propfind

  #5764

• Enhancement #5769: Keep timestamp instead of bool for share orphan

  #5769

• Enhancement #5736: Enable quota cache for projects

  #5736

• Enhancement #5738: Return file name on PUT to upload-only public link

  #5738

• Enhancement #5762: Move share permission checks to the gateway

  #5762

v3.12.1

Changelog for reva 3.12.1 (2026-07-31)

The following sections list the changes in reva 3.12.1 relevant to
reva users. The changes are ordered by importance.

Summary

• Fix #5739: Expose the grantee type in share notifications

Details

• Bugfix #5739: Expose the grantee type in share notifications

  #5739

v3.12.0

Changelog for reva 3.12.0 (2026-07-30)

The following sections list the changes in reva 3.12.0 relevant to
reva users. The changes are ordered by importance.

Summary

• Fix #5722: make /dav/files// work again
• Fix #5733: Fix nilptr exception in ListUsers
• Fix #5698: Normalize user ids on incoming OCM shares
• Fix #5695: Normalize remote user ids in OCM to avoid malformed shareWith
• Fix #5696: Resolve single-file OCM shares correctly over WebDAV
• Fix #5724: Pass token owner in public link scope check
• Enh #5703: Apps: added temporary patch for Office apps
• Enh #5737: EOS driver now takes modbits into account
• Enh #5732: Implement feedback endpoint
• Enh #5726: Use uppercase URL encoding to calculate signatures for signed urls
• Enh #5705: Add endpoint for office mentions
• Enh #5727: Add resource_admins column to the projects table
• Enh #5708: Refactor notifications system
• Enh #5699: Store OCM shares after the remote accepts them

Details

• Bugfix #5722: make /dav/files// work again

  #5722

• Bugfix #5733: Fix nilptr exception in ListUsers

  Specifcally, when the OrderBy parameter was omitted

  #5733

• Bugfix #5698: Normalize user ids on incoming OCM shares

  This fixes cross-vendor OCM shares failing on the receiving side when Reva is the receiver and
  the peer is a non-conformant OCM server. It is the receiver-side counterpart to the
  sender-side normalization in #5695.

  The OCM spec expects an address as <bare-id>@<provider>, with the host kept separate from
  the user id. Some peers glue the host onto the id: oCIS sends id@host and OpenCloud sends
  id@https://host, and by the time it reaches the POST /ocm/shares handler the id is doubled
  up as id@host@host (with or without a scheme).

  GetUserIdFromOCMAddress only strips the final @host, so the parsed opaque id kept a
  leftover host suffix that broke user resolution, and the two vendors failed at two different
  points. For shareWith (the local recipient) the leftover host made the local user lookup
  miss and the request returned 404 user not found. For sender and owner (the remote sharer)
  it made the accepted-user lookup miss, because the accepted remote user is stored with a bare id
  during the invitation flow, and the request returned 401 unauthenticated.

  The incoming-share handler now parses these three addresses through a helper that also strips
  a redundant, self-referential provider suffix that matches the parsed provider domain.
  Identifiers that legitimately contain @ for a different host are left untouched, and
  spec-conformant peers such as CERNBox-to-CERNBox and Nextcloud are unaffected.

  #5698

• Bugfix #5695: Normalize remote user ids in OCM to avoid malformed shareWith

  This fixes cross-vendor OCM shares failing when Reva is the sender and the peer is a
  non-conformant OCM server. The OCM spec requires the invite userID to be the bare identifier
  of the user at their OCM Server, with the host carried separately in recipientProvider. Some
  peers instead send a fully-qualified userID such as id@host (oCIS) or id@https://host
  (OpenCloud).

  Reva stored that qualified string verbatim as the federated user's opaque id and later
  re-appended the provider domain when building shareWith, producing malformed recipients
  like id@host@host or id@https://host@host. Receivers could not resolve those to a local
  user, so the share silently never materialized even though the HTTP request returned 200 OK.

  Reva now normalizes remote user ids on ingress (invite acceptance and invite forwarding) by
  stripping a redundant, self-referential provider suffix that matches the known provider
  domain, and defensively formats outbound OCM Addresses so it never emits the id@host@host
  form. Identifiers that legitimately contain @ for a different host are left untouched, and
  spec-conformant peers are unaffected.

  #5695

• Bugfix #5696: Resolve single-file OCM shares correctly over WebDAV

  This fixes cross-vendor OCM shares failing to appear on the receiver when Reva is the sender and
  the shared resource is a single file. Remote receivers (oCIS, OpenCloud) mount an OCM share as a
  directory and address the shared file as <share>/<name>, so the incoming WebDAV request
  carries the file's own name as a relative path.

  The ocmoutcoming storage driver resolved the share token to the shared resource (the file
  itself) and then unconditionally joined the relative path onto it, producing a doubled path
  such as /home/einstein/report.txt/report.txt. That path does not exist, so the stat
  failed and the WebDAV PROPFIND returned HTTP 500. Receivers treat a failed stat as a missing
  share and silently drop it from their "shared with me" listing, so the file never became visible
  even though the share was created and accepted.

  The driver now resolves paths based on the shared resource type. Folder shares still nest the
  child beneath the container. For a single-file share, which has exactly one resource, both the
  share root and a single-segment child resolve to the file itself, so <file>/<file> is never
  built and receivers whose appended name differs from the storage path base are tolerated.
  Nested paths under a file share are rejected as malformed.

  #5696

• Bugfix #5724: Pass token owner in public link scope check

  #5724

• Enhancement #5703: Apps: added temporary patch for Office apps

  This PR adds the handling of language and theme input parameters, and returns an
  app_for_editing additional parameter in response if appropriate.

  #5703

• Enhancement #5737: EOS driver now takes modbits into account

  To make /app/open also take into account modbits (so you can open files in apps in the public
  folder)

  #5737

• Enhancement #5732: Implement feedback endpoint

  Implement an endpoint so users can send feedback, to be used for the CERNBox Office Pilot.

  #5732

• Enhancement #5726: Use uppercase URL encoding to calculate signatures for signed urls

  #5726

• Enhancement #5705: Add endpoint for office mentions

  This change adds a POST /app/mentions endpoint for Office integrations to trigger mention
  notifications.

  #5705

• Enhancement #5727: Add resource_admins column to the projects table

  The projects table now has a resource_admins column, holding the e-group ID of the resource
  administrators of a project.

  #5727

• Enhancement #5708: Refactor notifications system

  Following ADR general/0007-notifications-refactor

  We now use an event-based system, where handlers register to events, and a configurable
  rule-system determines how to handle these. Accumulation is coordinated between daemons.

  #5708

• Enhancement #5699: Store OCM shares after the remote accepts them

  This commit introduces a behaviour where the OCM shares are only stored locally if the remote
  system accepts them first, meaning we don't have any orphaned OCM shares locally

  #5699

v3.11.1

Changelog for reva 3.11.1 (2026-07-09)

The following sections list the changes in reva 3.11.1 relevant to
reva users. The changes are ordered by importance.

Summary

• Fix #5702: Preserve child ACLs when creating parent shares

Details

• Bugfix #5702: Preserve child ACLs when creating parent shares

  This change also adds unit tests for the share hierarchy to the gateway

  #5702

v3.11.0

Changelog for reva 3.11.0 (2026-07-07)

The following sections list the changes in reva 3.11.0 relevant to
reva users. The changes are ordered by importance.

Summary

• Fix #5693: Bugfix where descriptions are not propagated to web
• Fix #5694: Whitelisted more request types for the lightweight scope
• Chg #5671: Dropped support for Nextcloud as storage/user/auth provider
• Enh #5691: Refactor current ocm invite manager to GORM
• Enh #5688: Modernize Go Code
• Enh #5562: Share hierarchy checks
• Enh #5690: Store remote users on ocm share

Details

• Bugfix #5693: Bugfix where descriptions are not propagated to web

  This fixes a bug where the descriptions of the ocm invites are not propagated to the web.

  #5693

• Bugfix #5694: Whitelisted more request types for the lightweight scope

  This is required to enable OCM for external accounts

  #5694

• Change #5671: Dropped support for Nextcloud as storage/user/auth provider

  This PR removes the code to support Nextcloud as storage, user, and auth provider.

  This code was developed as part of the initial effort to put in place the ScienceMesh, where the
  deployment model was to run Reva at each site, including sites running Nextcloud where Reva
  would be responsible for the OCM-based federation layer and Nextcloud for all the rest.

  Over the years, and especially during 2025-26, Nextcloud has implemented all OCM-related
  capabilities natively, and this interface is getting obsoleted. We have kept it until the
  maintenance cost was negligible, but with the upcoming changes on the OCM implementation,
  this is not sustainable any longer.

  #5671

• Enhancement #5691: Refactor current ocm invite manager to GORM

  Refactor the ocm invite manager to user the GORM.

  #5691

• Enhancement #5688: Modernize Go Code

  #5688

• Enhancement #5562: Share hierarchy checks

  This PR adds a hierarchical checking algorithm for shares to the gateway, as defined in ADR
  general/0005-sharing. Concrectely, the new algorithm does the following:

  • Before applying any ACL, the gateway checks for parent and child shares in the database. *
    Based on their relationships and permission levels, the gateway decides whether to apply,
    reapply, or reject the operation. * ACL updates will be applied orderd by path-length (where
    the shortest comes first) to maintain consistent inheritance semantics (otherwise, you
    would overwrite child shares). * The algorithm applies equally to create, update, and delete
    operations.

  #5562

• Enhancement #5690: Store remote users on ocm share

  This commit adds the following functionality:

  • Functionality to add remote users even without the invitation flow when an OCM share is
    received. - This configuration option is a whitelist of hosts of which this functionality is
    enabled for. - A machine secret is added so that we can impersonate the user receiving the share
    since the ocm endpoint is unauthenticated.

  #5690

v3.10.4

Changelog for reva 3.10.4 (2026-07-01)

The following sections list the changes in reva 3.10.4 relevant to
reva users. The changes are ordered by importance.

Summary

• Fix #5685: Add sciencemesh paths for external accounts
• Fix #5686: Do not fail list shares if only OCM shares fail to be retrieved
• Fix #5687: Set resource id properly in share creation

Details

• Bugfix #5685: Add sciencemesh paths for external accounts

  #5685

• Bugfix #5686: Do not fail list shares if only OCM shares fail to be retrieved

  #5686

• Bugfix #5687: Set resource id properly in share creation

  #5687

v3.10.3

Changelog for reva 3.10.3 (2026-06-30)

The following sections list the changes in reva 3.10.3 relevant to
reva users. The changes are ordered by importance.

Summary

• Fix #5683: Redact machine auth secret from log
• Fix #5684: Ignore basic auth if a signature is present
• Enh #5677: Cancel background jobs and trigger scheduled jobs on demand
• Enh #5672: Associate on-demand jobs with a user
• Enh #5682: Configure on-demand jobs from the config file

Details

• Bugfix #5683: Redact machine auth secret from log

  #5683

• Bugfix #5684: Ignore basic auth if a signature is present

  #5684

• Enhancement #5677: Cancel background jobs and trigger scheduled jobs on demand

  Added the ability to cancel a background job run, both on-demand and leader-scoped periodic,
  and to trigger a scheduled job to run immediately. Cancellation is cooperative through the
  job's context, durable so it reaches a run that is still queued or running on another process,
  and terminal so a cancelled run is not retried. Triggering enqueues an extra run without
  disturbing the schedule's regular cadence.

  #5677

• Enhancement #5672: Associate on-demand jobs with a user

  On-demand background jobs can now be attached to a user through a WithOwner enqueue option, so
  the jobs a user created can be listed back (e.g. for a UI) with ListByOwner; jobs enqueued
  without it stay internal. An opt-in Unique option was also added to keep at most one active run
  per owner and key, so a user cannot, for instance, start the same export twice.

  #5672

• Enhancement #5682: Configure on-demand jobs from the config file

  On-demand background jobs are now given their own configuration section from the config file,
  handed to the job constructor the same way the other services receive their configuration.
  Each job reads its settings from [serverless.services.jobs.on_demand.""], so it can
  load what it needs at startup instead of seeing only the per-run parameters.

  #5682

v3.10.2

Changelog for reva 3.10.2 (2026-06-29)

The following sections list the changes in reva 3.10.2 relevant to
reva users. The changes are ordered by importance.

Summary

• Fix #5650: Fix for cephmount lock & xattr bugs
• Fix #5649: Ceph: fix path resolution
• Fix #5648: Eosfs: fixed lock retrieval
• Fix #5673: Fix a nilptr in the HTTP server
• Fix #5662: Check for nil pointers
• Fix #5676: Fixed parsing of OCM discovery payload
• Fix #5681: Correctly identify OCM embedded payloads
• Fix #5653: Honor pidfile passed with the -p option
• Fix #5639: Bound the Prometheus HTTP handler label cardinality
• Enh #5651: Add a background jobs framework
• Enh #5663: Add immutable stubs & upgrade cs3apis
• Enh #5652: Add support for signed URLs of the archiver
• Enh #5645: Implement hiding for ocm shares
• Enh #5611: OCM: reworked discovery logic and payload
• Enh #5654: Enable external accounts to list received OCM shares
• Enh #5664: Implement the new OCM webapp protocol
• Enh #5674: Honor outbound proxy settings in the OCM client
• Enh #5643: Utilize the new transferring state in the cs3api

Details

• Bugfix #5650: Fix for cephmount lock & xattr bugs

  • ReadArbitraryMetadata - Returns stored user.* xattrs in GetMD instead of nothing. * Paths
    Unlock/SetLock open the full chroot path instead of the incorrect relative path. * Quality of
    life improvements for error handling & debug logs.

  #5650

• Bugfix #5649: Ceph: fix path resolution

  When performing a id-to-path lookup the path may not always be empty, as in the case for wopi,
  this case was not handled.

  #5649

• Bugfix #5648: Eosfs: fixed lock retrieval

  GetLock on a file with an empty lock now returns no lock as opposed to failing with a malformed
  lock exception

  #5648

• Bugfix #5673: Fix a nilptr in the HTTP server

  #5673

• Bugfix #5662: Check for nil pointers

  #5662

• Bugfix #5676: Fixed parsing of OCM discovery payload

  The principle is that we should not fail the JSON parsing on unsupported capabilities, but only
  on out of spec payloads. Therefore, ResourceType must be a generic string, to be validated
  afterwards.

  #5676

• Bugfix #5681: Correctly identify OCM embedded payloads

  OCM "ro-crate" shares are to be mapped to (CS3) EMBEDDED resource types, where "embedded" is a
  generic term to signal that any JSON-represented payload can be mapped in this way.

  #5681

• Bugfix #5653: Honor pidfile passed with the -p option

  The pidfile was always generated at a random path in the OS temp dir on startup, ignoring the
  location passed with -p. As a result -s reload (and the other -s signals) could not find the
  running master to signal it. The -p path is now honored when starting revad.

  #5653

• Bugfix #5639: Bound the Prometheus HTTP handler label cardinality

  The HTTP metrics interceptor used the full request URL path as the value of the handler label
  on the http_request_duration_seconds histogram. Because Reva HTTP endpoints are
  user-bound, this produced unbounded label cardinality and caused excessive metrics
  storage. The label is now derived from the leading static path segment, keeping cardinality
  bounded to the number of route prefixes.

  #5639

• Enhancement #5651: Add a background jobs framework

  Introduce a framework to run background work in reva, both periodically (e.g. warming a cache
  or cleaning up expired state) and once on demand on a user request. Jobs are hosted by a new "jobs"
  serverless service backed by NATS JetStream, run status is tracked in a SQL store and can be
  queried by run id, and multiple jobs processes can run together without duplicating work.

  #5651

• Enhancement #5663: Add immutable stubs & upgrade cs3apis

  This upgrade is needed so we can move past this version to the cs3apis even though we don't use it
  currently.

  #5663

• Enhancement #5652: Add support for signed URLs of the archiver

  #5652

• Enhancement #5645: Implement hiding for ocm shares

  This commit introduces the functionailty required to hide ocm shares

  #5645

• Enhancement #5611: OCM: reworked discovery logic and payload

  This PR adapts the OCM Discovery endpoint to the latest standard and introduces better logic to
  discover remote endpoints' protocols.

  #5611

• Enhancement #5654: Enable external accounts to list received OCM shares

  External accounts cannot create shares but can be recipient of shares. This now applies to OCM
  shares as well.

  #5654

• Enhancement #5664: Implement the new OCM webapp protocol

  Following the OCM specifications, the webapp protocol and access method were reworked in the
  cs3apis: the view mode was replaced by share permissions (view, read, write, share on the
  wire), and the protocol now carries a shared secret, requirements (including
  must-exchange-token), targets (blank or iframe), and optional display metadata (appName,
  appIconHint, mediaTypes).

  • The OCM /shares endpoint now validates and parses webapp protocol payloads according to the
    new specification; legacy payloads carrying a viewMode are rejected - Outgoing webapp shares
    are serialized with the new wire fields, with the shared secret taken from the share token - The
    SQL share manager persists the new webapp fields - Roles for webapp-only shares are now derived
    from the share permissions instead of the view mode

  #5664

• Enhancement #5674: Honor outbound proxy settings in the OCM client

  ocmd.NewClient now honors the standard HTTP_PROXY, HTTPS_PROXY, and NO_PROXY
  environment variables for outbound OCM requests, while keeping the existing request timeout
  and insecure TLS behavior. This applies to discovery, outgoing shares, invite-accepted,
  token exchange, and directory-service fetches that go through the shared OCM client.

  #5674

• Enhancement #5643: Utilize the new transferring state in the cs3api

  • Puts the ocm share in a transferring state when doing the processing of an embedded share is
    ongoing - A callback is implemented that puts the share in the accepted state when the transfer
    is finished

  #5643

v3.10.1

Changelog for reva 3.10.1 (2026-06-05)

The following sections list the changes in reva 3.10.1 relevant to
reva users. The changes are ordered by importance.

Summary

• Enh #5641: Make addSpaceInfo more defensive
• Enh #5640: Remove useless, spammy log line

Details

• Enhancement #5641: Make addSpaceInfo more defensive

  #5641

• Enhancement #5640: Remove useless, spammy log line

  #5640