ocis (8.2.0-1) unstable

• Security - Do not leak internal error details in webdav error responses:
  #12398
• Security - Make OIDC group sync opt-in: #12490
• Security - Block password and account changes via PATCH /graph/v1.0/me: #12493
• Bugfix - Always set an audit action for share updates: #7661
• Bugfix - Fix the proxy readiness check for NATS: #10661
• Bugfix - Honor $select=actions on the drive item permissions endpoint: #10816
• Bugfix - Keep group memberships when the OIDC groups claim is absent: #11435
• Bugfix - Pass the space ID when purging revision blobs: #11644
• Bugfix - Return 404 when deleting a non-existing link share on a space: #12266
• Bugfix - Fix PostgreSQL container restart loop in Keycloak deployments: #12359
• Bugfix - Prevent panic in presigned URL auth when signing key is missing:
  #12384
• Bugfix - Fix double HTML-escaping of notification emails for multiple
  recipients: #12413
• Bugfix - Re-verify access tokens with an expired userinfo cache entry: #12414
• Bugfix - Keep shares visible in sharedWithMe when a resource cannot be
  statted: #12430
• Bugfix - Ensure the redirect URI for the IDP is valid: #12444
• Bugfix - The auth-app will create the user's home if needed: #12457
• Bugfix - Fix the empty mount ID for reva config: #12492
• Bugfix - Rate-limit the exportPersonalData endpoint: #12516
• Bugfix - Apply the role allowlist on permission updates: #12540
• Bugfix - Restore hover feedback in high-contrast and dark themes: #12613
• Bugfix - Preserve accessibility focus in the file versions sidebar: #12630
• Bugfix - Fix low-contrast form controls in dark and vault themes: #12639
• Bugfix - Stop breadcrumb items from being announced twice: #12643
• Bugfix - Remove unneeded keyboard focus stops: #12645
• Bugfix - Fix keyboard navigation in "New" and "Upload" dropdown menus: #12646
• Bugfix - Announce IDP sign-in errors and fix keyboard use: #12649
• Bugfix - Show vault-shared mountpoints in the vault drive list: #12656
• Bugfix - Prevent deleting your own account in the user management: #12661
• Bugfix - Log unmapped thumbnail errors and always report a sabredav exception:
  #12667
• Bugfix - Fix concurrent map access when listing shares: #12673
• Bugfix - Keep bind config in sync when resetting a service user password:
  #12716
• Bugfix - Allow renaming, moving and editing files with the editor-lite role:
  #12721
• Bugfix - Fix invisible group icon in share collaborator list: #12722
• Bugfix - Return correct issuerAssignedId on /me: #12727
• Bugfix - Vault navigation labels not updating on switch: #12729
• Bugfix - Do not collide vault and non-vault share mountpoints: #12730
• Bugfix - Remove keyboard focus from open file name in top bar: #12752
• Enhancement - Replace embedded IDP React SPA with server-rendered login page:
  #12086
• Enhancement - Add ocis shares clean-corrupt-public-shares maintenance command:
  #12494
• Enhancement - Harden OCM create share: #12496
• Enhancement - Clean up the deployment examples: #12521
• Enhancement - Allow disabling the last sign-in timestamp update: #12522
• Enhancement - Add configurable software license and help page links: #12528
• Enhancement - Configurable logo click-through URL: #12529
• Enhancement - Add option to disable public link sharing: #12542
• Enhancement - Add option to disable direct (user/group) sharing: #12542
• Enhancement - Add audience restriction for OIDC access tokens: #12581
• Enhancement - Eliminate redundant LDAP read-after-write on create and update:
  #12618
• Enhancement - Improve page structure on several pages: #12637
• Enhancement - Show the select-all checkbox label in tile view: #12640
• Enhancement - Retry LDAP operations against a lagging replica: #12672
• Enhancement - Add an opt-in bounded LDAP connection pool: #12688
• Enhancement - Bump dependencies: #12766

ocis (8.0.7-1) unstable

• Bugfix - Return correct issuerAssignedId on /me: #12635
• Bugfix - Log unmapped thumbnail errors and always report a sabredav exception:
  #12663
• Enhancement - Eliminate redundant LDAP read-after-write on create and update:
  #12618
• Enhancement - Add an opt-in bounded LDAP connection pool: #12660
• Enhancement - Retry LDAP operations against a lagging replica: #12672

ocis (8.0.6-1) unstable

• Security - Upgrade libvips to 8.18.4: #12596
• Security - Upgrade Go to 1.25.12: #12602
• Enhancement - Allow disabling the last sign-in timestamp update: #12522

ocis (8.1.0-1) unstable

• Security - Add X-XSS-Protection header: #12092
• Security - Upgrade libvips to 8.18.2: #12301
• Security - Fix signing-key to public share guests: #12332
• Bugfix - Fix postprocessing resume command --restart flag: #11692
• Bugfix - Don't use hardcoded groupOfNames in group creation: #11776
• Bugfix - Translation for some email notifications: #11979
• Bugfix - Rework monitoring in the ocis_full deployment example: #11995
• Bugfix - Extract metadata from oversized files and fix ISO field: #12000
• Bugfix - Make tag unassignment idempotent and handle publish failures: #12001
• Bugfix - Expose the signature-auth attribute: #12016
• Bugfix - Fix CSP blocking bundled KaTeX font: #12070
• Bugfix - Fix case-sensitive photo metadata search: #12078
• Bugfix - Prevent incomplete Tika extractions from permanently blocking
  re-index: #12095
• Bugfix - Use O(1) document lookup instead of full search during reindexing:
  #12096
• Bugfix - Fix IDP build on FreeBSD by disabling absolute Babel runtime: #12114
• Bugfix - Always descend into directories during space reindexing: #12119
• Bugfix - Don't index failed uploads: #12121
• Bugfix - Avoid superfluous GetPublicShare call when deleting space
  permissions: #12122
• Bugfix - Fix CreateHome cache: #12128
• Bugfix - Return 200 OK for WOPI Lock requests in read-only and view-only
  modes: #12257
• Bugfix - Fix typo in README: #12263
• Bugfix - Fix space management middleware removing users from spaces on
  download: #12285
• Bugfix - Search no longer disabled when OCIS_DISABLE_PREVIEWS=true: #12303
• Bugfix - Stable order for user search attributes: #12337
• Bugfix - Cache compiled rego policies to avoid recompiling on every request:
  #12345
• Bugfix - SpaceEditorWithoutTrashbin roles now correctly allow file editing:
  #12346
• Bugfix - Skip indexing of files still in postprocessing: #12350
• Bugfix - Mask configs that hold secrets: #12397
• Bugfix - Education user DELETE no longer 404s while leaving LDAP entry behind:
  #12400
• Bugfix - Recover from permanently-closed NATS connections in the nats-js-kv
  store: #12402
• Bugfix - Return correct issuerAssignedId on /me: #12411
• Bugfix - Keep personal space when Drives.Create permission check is
  inconclusive: #12429
• Bugfix - Fix the empty mount ID for reva config: #12492
• Enhancement - Add web extensions deployment configuration: #11940
• Enhancement - Add AI-assisted development guide: #11941
• Enhancement - Bump Web to 12.3.1: #12015
• Enhancement - Add space ID to incoming shares: #12024
• Enhancement - Add spaceid to REPORT: #12028
• Enhancement - Bump Reva version: #12051
• Enhancement - Add ResourceID field to UploadReady event: #12060
• Enhancement - Support numeric range queries in KQL: #12094
• Enhancement - Add blobstore CLI commands to storage-users service: #12102
• Enhancement - Optimize search index after bulk reindexing: #12104
• Enhancement - Add vault storage with MFA-protected access: #12108
• Enhancement - Retry and abort on repeated extraction failures during indexing:
  #12111
• Enhancement - Log effective data and config paths at startup: #12117
• Enhancement - Allow resetting IDM service user passwords: #12118
• Enhancement - Update images in the ocis_full deployment example: #12123
• Enhancement - Add ocis search optimize CLI command: #12136
• Enhancement - Add Keycloak to the ocis_full deployment example: #12139
• Enhancement - Allow multiple objectClasses on group creation: #12229
• Enhancement - Add SpaceEditorWithoutVersionsWithoutTrashbin space membership
  role: #12261
• Enhancement - Add vault capabilities to the OCS capabilities endpoint: #12283
• Enhancement - Disable public link sharing for vault resources: #12321
• Enhancement - Update web-extension images in ocis_fuill: #12324
• Enhancement - Bump dependencies: #12325
• Enhancement - Add VaultMode permission: #12328
• Enhancement - Add vault themes: #12329
• Enhancement - Bump Web to 12.4.2: #12450
• Enhancement - Deprecate the owncloudsql storage driver option: #12486
• Enhancement - Bump Web to 12.3.3: #13705
• Enhancement - Bump Web to 12.4.0: #13809

ocis (8.0.5-1) unstable

• Security - Bump Go to 1.25.11: #12446
• Security - Upgrade libvips to 8.18.3: #12446
• Bugfix - Education user delete no longer 404s and leaves the LDAP entry
  behind: #12395
• Bugfix - Recover from permanently-closed NATS connections in the nats-js-kv
  store: #12401

ocis (8.0.4-1) unstable

• Security - Upgrade libvips to 8.18.2: #12301
• Security - Bump Go to 1.25.10: #12306
• Bugfix - SpaceEditorWithoutTrashbin roles now correctly allow file editing:
  #12346

ocis (8.0.3-1) unstable

• Enhancement - Bump go to 1.25.10: #12306
• Enhancement - Bump libvips to 8.18.2: #12301

ocis (8.0.2-1) unstable

• Bugfix - Fix OCM share permission change notification: #12190
• Bugfix - Fix the internal links: #12231
• Bugfix - Return 200 OK for WOPI Lock requests in read-only and view-only
  modes: #12257
• Bugfix - Fix space management middleware removing users from spaces on
  download: #12285
• Enhancement - Add spaceid to REPORT: #12241
• Enhancement - Allow multiple objectClasses on group creation: #12242
• Enhancement - Add SpaceEditorWithoutVersionsWithoutTrashbin space membership
  role: #12245
• Enhancement - Bump Web to 12.3.3: #13705

ocis (8.0.1-1) unstable

• Bugfix - Don't use hardcoded groupOfNames in group creation: #11776
• Bugfix - Expose the signature-auth attribute: #12052
• Bugfix - Don't write empty externalID to LDAP: #12085
• Enhancement - Bump Web to 12.3.2: #12074
• Enhancement - Bump reva: #12097

ocis (8.0.0-1) unstable

• Bugfix - Fix user light creation: #11765
• Bugfix - OCM Specification Compliance: #11773
• Bugfix - Remove leading dot before checking disabled extension: #11814
• Bugfix - Support pointer types in config environment variable decoding:
  #11815
• Bugfix - Replace obsolete docker image in the deployment example: #11828
• Bugfix - Fix error code when a user can't disable a space: #11845
• Bugfix - Fix Sharingroles: #11898
• Bugfix - Fix the error handling for empty name on space update: #11933
• Bugfix - Fix group creation in ocis-multi example: #12019
• Change - Remove deprecated OCIS_SHOW_USER_EMAIL_IN_RESULTS: #11942
• Enhancement - Bump Reva: #460
• Enhancement - Set Referrer-Policy to no-referrer: #11722
• Enhancement - Bump Reva: #11748
• Enhancement - Support disabling editors by extensions: #11750
• Enhancement - Add CLI to move stuck uploads: #11762
• Enhancement - Use externalID in Provisioning API: #11799
• Enhancement - Add CLI to clean orphned grants: #11804
• Enhancement - Bump Reva: #11808
• Enhancement - Bump Web to v12.2.0: #11834
• Enhancement - Introduce claims for multi-instance-ocis: #11848
• Enhancement - Update the ocis_full deployment example images: #11860
• Enhancement - Implement brute force protection for public links: #11864
• Enhancement - Update the ocis_full deployment example traefik image: #11867
• Enhancement - Added a graph endpoint alias: #11871
• Enhancement - Force Strict-Transport-Security: #11880
• Enhancement - Relocate Transifex resources: #11889
• Enhancement - Update the ocis_full deployment example images: #11890
• Enhancement - Allow sharing between instances: #11893
• Enhancement - Add photo EXIF metadata to search index and WebDAV results:
  #11912
• Enhancement - Update the traefik image for some deployment examples:
  #11915
• Enhancement - Add users instances: #11925
• Enhancement - Introduce external shares permission: #11931
• Enhancement - Update to go 1.25: #12004
• Enhancement - Bump Web to 12.3.1: #12016
• Enhancement - Bump Web to 12.3.0: #13519