v3.12.2

Changelog for reva 3.12.2 (2026-08-14)

The following sections list the changes in reva 3.12.2 relevant to
reva users. The changes are ordered by importance.

Summary

• Sec #5752: Harden OCM federation against SSRF, spoofed IPs and TLS downgrade
• Fix #5761: Report the recursive size of directories in cephmount
• Fix #5766: Skip fetching group members when creating a share
• Enh #5740: Cephmount now supports shares to external accounts
• Enh #5745: Ignore Range requests on empty files
• Enh #5764: Return lock info in propfind
• Enh #5769: Keep timestamp instead of bool for share orphan
• Enh #5736: Enable quota cache for projects
• Enh #5738: Return file name on PUT to upload-only public link
• Enh #5762: Move share permission checks to the gateway

Details

• Security #5752: Harden OCM federation against SSRF, spoofed IPs and TLS downgrade

  The unauthenticated ScienceMesh /discover endpoint no longer connects to loopback,
  private, link-local or cloud-metadata addresses. The OCM provider allow list no longer
  trusts a caller-supplied X-Forwarded-For header, and remote provider discovery now
  verifies TLS certificates by default.

  #5752

• Bugfix #5761: Report the recursive size of directories in cephmount

  Directories were reported with a size of 0, so a folder's size did not match the contents seen
  inside it. The size of the subtree is now taken from the CephFS ceph.dir.rbytes extended
  attribute.

  #5761

• Bugfix #5766: Skip fetching group members when creating a share

  #5766

• Enhancement #5740: Cephmount now supports shares to external accounts

  • Grants to external accounts are now stored in a user.reva.extshare.<account> xattr and
    are read back by ListGrants. * Operations on their behalf run as the service account configured
    with external_accounts_user_name/_uid/_gid, cboxexternal by default, the same
    account the EOS driver uses. * What they are allowed to do is decided by Reva from the stored grant
    rather than by the permissions of that account. * The ResourceInfo of a shared resource now also
    carries a name and an etag which now is recursive, meaning you changes in subtrees also get
    propgated.

  #5740

• Enhancement #5745: Ignore Range requests on empty files

  #5745

• Enhancement #5764: Return lock info in propfind

  #5764

• Enhancement #5769: Keep timestamp instead of bool for share orphan

  #5769

• Enhancement #5736: Enable quota cache for projects

  #5736

• Enhancement #5738: Return file name on PUT to upload-only public link

  #5738

• Enhancement #5762: Move share permission checks to the gateway

  #5762