v34.0.2

Nextcloud 34.0.2

server

• Fix(cypress): disable unsupported-browser redirect in test container (server#60807)
• Feat(UserManager): Add getters for avatar URLs (server#60811)
• Fix(core): public share download icon color and theme filter scope (server#61211)
• Fix: use card interface instead of object (server#61252)
• Docs(config): clarify metadata and conversion file size limits (server#61482)
• Fix: properly mark CleanupShareTarget as expensive (server#61498)
• Fix: update cached mounts when moving share in repair step (server#61500)
• Fix(files_trashbin): create folder if missing when expiring trash (server#61523)
• Fix(files_sharing): remove filename's leading slash on unshare toast (server#61528)
• Fix: stop calling DI container in SharedStorage (server#61529)
• Fix(preview): First cleanup from filecache and then from preview table (server#61531)
• Perf(View): don't sort twice the same array (server#61535)
• Perf: block more properties from using the custom properties backend (server#61540)
• Fix(settings): correct heading order in account management sidebar (server#61546)
• Fix: Make the IProvideUserSecretBackend usable (server#61550)
• Fix: track time spent in recursive markOrRun calls (server#61553)
• Perf(log): normalize log data only when logging (server#61557)
• Perf: avoid DIing IRootFolder at every shared storage init (server#61558)
• Fix(Collaborators): Fix matching emails to remote users if no remote results are present (server#61571)
• Fix(appstore): only show appstore entries if actual from appstore (server#61592)
• Fix(dav): Handle GenericFileException when reading default contact file (server#61596)
• Fix(a11y): label account QR code button (server#61601)
• Fix(files): Open the sidebar for the current folder, not a stale child (server#61606)
• Fix(maintenance): allow AppAPI to serve requests during maintenance mode (server#61613)
• Fix(user_status): stabilise the user_status (server#61617)
• Fix: Add plural form for translations (server#61626)
• Fix(core): use proper API routes for recommended apps (server#61633)
• Fix(dav): Load ProfilerPlugin only when profiler is enabled (server#61645)
• Fix(config): Decrypt sensitive appconfigs when requested (server#61662)
• Fix(updatenotification): use correct appstore route (server#61664)
• Fix(LoginForm): improve login throttle warning wording (server#61671)
• Fix(files_sharing): reject custom share tokens longer than the db column (server#61676)
• Fix(files_external): ignore deprecated backends (server#61691)
• Build(deps): Composer audit updates (server#61697)
• Perf: Only sort wrappers when adding them (server#61700)
• Fix(files_external): properly apply default mount options (server#61702)
• Fix(settings): in absence form avoid shifting dates to browsers timezone (server#61712)
• Fix(l10n): Fix plural (server#61734)
• Fix(settings): display birthday correctly regardless of browsers timezone (server#61737)
• Fix(dav): Always show example content section (server#61742)
• Fix(core): resolve some edge cases with recommended apps (server#61747)
• Fix(db): align preview migration annotations with created tables (server#61749)
• Fix(files_external): prevent dropdown entries from shrinking (server#61797)
• Chore(deps): Bump form-data from 4.0.5 to 4.0.6 (server#61802)
• Chore: run `npm audit` (server#61804)
• Chore(deps): Bump axios from 1.15.0 to 1.16.1 in /build/frontend-legacy (server#61805)
• Fix(Sharing): Don't break cache entry by setting path to null (server#61842)
• Perf: Don't fetch full group object in AuthorizedGroupMapper (server#61852)
• Fix the ScanFiles job to not trigger scans of root directory for every single user (server#61862)
• Feat(OCP): Add Interaction API (server#61867)
• Test: fix HEIC tests (server#61873)
• Fix(DeclarativeManager): Fix admin delegation (server#61876)
• Fix: adjust file picker for background image to allow folder navigation (server#61878)
• Fix(bruteforce): Don't throttle requests with failing CSRF (server#61886)
• Fix(core): Throttle lost-password reset form when link is disabled (server#61888)
• Fix(CalDav): Force trashbin deletion when re-creating item with same UID (server#61892)
• Fix: hide scroll bar in unified search when not needed (server#61909)
• Fix(appstore): use proper app icon or adjust color if needed (server#61918)
• Fix(files): distinguish between files and folders for validation messages (server#61919)
• Feat: Disable callable serialization in sabre/xml (server#61923)
• Fix(files): proper accessible row name and title for overflow (server#61930)
• Show group display name when the group object is not loaded yet (server#61932)
• Feat: Fetch groups in batch in getUserGroups (server#61936)
• Fix(files_sharing): Fail on sharing file with create or delete permission before failing on increased permissions (server#61939)
• Fix: webhook payload for system tag events (server#61943)
• Chore(jobs): write proper documentation for job:history (server#61945)
• Refactor(Interaction): Allow multiple resources and receivers in a single event (server#61956)
• Fix(systemtags): remove duplicates, cleanup existing tags (server#61965)
• Fix: Catch expected NotFoundException (server#61968)
• Feat(login): clean remember me tokens (server#61972)
• Fix(files_external): S3 folder mtime updated on every read-only access (server#61977)
• Master] fix(security): Update code signing revocation list (server#62040)
• Master] fix(security): Update code signing revocation list (server#62046)
• Perf(carddav): reduce disk usage of photocache (server#62054)
• Perf(workflow): Implement result cache for IP checks (server#62057)
• Ci: migrate from buildjet to cache action (server#62061)
• Fix(dav): return RFC 4791 no-uid-conflict on duplicate calendar UID (server#62069)
• Feat: KV cache based on predis (server#62070)
• Fix(caldav): url-encode owner/user in activity event links (server#62075)
• Fix(AppSearch): Always sort apps first for search (server#62085)
• Fix(UserPlugin): Don't search for displayname when restricted (server#62096)
• Fix(dav): Do not respond version/trashbin download requests with 404 due to ChunkingV2Plugin (server#62103)
• Fix(UserPlugin): Don't return mail matches on user id search (server#62109)
• Fix(UserPlugin): Don't return disabled users on user ID and mail match (server#62119)
• Fix(FilesWidget): allow to resize widget vertically (server#62125)
• Rate limiting for creating federated shares (server#62130)
• Feat(share): add public share-review API under OCP\Share\ShareReview (server#62132)
• Fix: Disable imagick preview providers (server#62147)
• Fix(files_sharing): Allow access to shares by disabled users if hide_disabled_user_shares is enabled (server#62150)
• Fix(ViewOnlyPlugin): Allow COPY and MOVE operations within the same storage (server#62160)
• Fix(preview): properly handle encoded content (server#62173)
• Fix(cache): make clear() redis cluster compatible (server#62177)
• Perf: Don't fetch all the trash items when deleting a single item (server#62180)
• Fix(s3): trim multiple spaces to single space in original path header (server#62183)
• Master] fix(security): Update code signing revocation list (server#62184)
• Feat(files_sharing): schedule external share scan job when accepted (server#62197)
• Fix: don't return cache entries with null paths (server#62199)
• Chore(deps-dev): bump websocket-driver from 0.7.4 to 0.7.5 in /build/frontend-legacy (server#62210)
• Fix(dav): release part-file lock when an upload fails (server#62216)
• Fix(files_sharing): preserve unmasked permissions as scan_permissions (server#62218)
• Perf(dav): Stream PROPFIND output (server#62224)
• Fix: don't die if we can't encode file metadata on upload (server#62226)
• Fix(CleanupLoginTokens): Specify the table (server#62409)
• Master] fix(security): Update CA certificate bundle (server#62437)
• Fix(onetime-qrcode): Fix onetime QR code with 2FA enable (server#62449)

3rdparty

• Build(deps): Composer audit updates (3rdparty#2498)
• Feat: Disable callable serialization in sabre/xml (3rdparty#2513)
• Feat: add predis as a dependency for Valkey cluster support (3rdparty#2518)

activity

• Feat: make amount of items sent on email configurable via occ (activity#2708)
• Fix(listener): Catch when trying to set up a settings that doesn't exists (activity#2793)

app_api

• Fix(maintenance-mode): keep only HaRP and ExApp survival routes available in maintenance mode (app_api#903)
• Chore(deps): Bump dompurify from 3.4.0 to 3.4.11 (app_api#912)
• Chore(deps-dev): Bump js-yaml from 4.1.1 to 4.2.0 (app_api#913)
• Feat: add release relay gh workflow (app_api#924)
• Chore(deps): Bump undici from 7.24.1 to 7.28.0 (app_api#925)
• Chore(deps-dev): Bump launch-editor from 2.12.0 to 2.14.1 (app_api#926)
• Ci: Add terser-webpack-plugin to the dev dependency definition (app_api#930)

circles

• Fix(permission): get permissions for user from inherited when not direct member (circles#2577)
• Chore(deps): bump fast-xml-parser and webdav (circles#2582)
• Chore(deps): bump dompurify from 3.3.1 to 3.4.11 (circles#2604)
• Chore(deps): bump qs from 6.14.2 to 6.15.2 (circles#2605)
• Chore(deps): bump picomatch from 2.3.1 to 2.3.2 (circles#2607)
• Chore(deps): bump bn.js (circles#2608)
• Chore(deps): bump rollup from 4.46.3 to 4.62.2 (circles#2609)
• Fix(workflow): switch from node.yml to npm-build.yml (circles#2610)
• Fix: refresh user mounts when removed from a group or circle that has associated team folders (circles#2634)

files_downloadlimit

• Chore(CI): Adjust testing matrix for Nextcloud 34 on stable34 (files_downloadlimit#805)
• Chore: update Node version and align with stable34 (files_downloadlimit#849)

files_lock

• Ci(litmus): change server-version to stable34 (files_lock#1126)
• Ci(tools): Update dev dependencies (files_lock#1132)
• Chore(deps): Bump form-data from 4.0.5 to 4.0.6 (files_lock#1148)
• Chore(deps): Bump dompurify from 3.4.10 to 3.4.11 (files_lock#1149)
• Enh: allow file owner to unlock TYPE_TOKEN locks (files_lock#1169)
• Chore(release): bump version to 34.0.1 (files_lock#1178)

files_pdfviewer

• Chore(deps): Bump dompurify from 3.3.3 to 3.4.11 (files_pdfviewer#1465)
• Chore(deps): Bump form-data from 4.0.5 to 4.0.6 (files_pdfviewer#1468)

firstrunwizard

• Chore(deps-dev): Bump js-yaml from 4.1.1 to 4.3.0 (firstrunwizard#2139)
• Chore(deps): Bump dompurify from 3.4.2 to 3.4.11 (firstrunwizard#2140)
• Chore(deps): Bump form-data from 4.0.5 to 4.0.6 (firstrunwizard#2141)

logreader

• Chore: bump PHP version to 8.2 (logreader#2081)

notifications

• Test: Push notification payload (notifications#3145)
• Fix(Makefile): Add missing composer setup for dev-setups and building… (notifications#3181)
• Build(deps): Apply composer audit fixes (notifications#3182)

password_policy

• Feat: Add login output when password policy fails (password_policy#966)
• Chore(deps): Bump dompurify from 3.4.0 to 3.4.11 (password_policy#969)
• Chore(deps): Bump form-data from 4.0.5 to 4.0.6 (password_policy#970)
• Chore(deps-dev): Bump flatted from 3.3.3 to 3.4.2 (password_policy#971)
• Chore(deps-dev): Bump qs from 6.14.2 to 6.15.2 (password_policy#973)

photos

• Fix: faces actions and add recognize e2e tests (photos#3577)
• Build(deps): Unblock dependency updates by allowing to update vite again (photos#3587)

privacy

• Chore: Add `update-stable-titles` workflow (privacy#1383)

related_resources

• Chore(deps): bump dompurify from 3.2.6 to 3.4.11 (related_resources#1028)

serverinfo

• Use a parameterized translation for CPU thread count (serverinfo#1039)

suspicious_login

• Fix(autoload): load rubix free functions despite Composer files dedupe (suspicious_login#1129)

text

• Fix(autofocus): persist cursor positions in localStorage (text#8778)
• Fix(SessionService): sanitize displayName to utf8 encoding (text#8780)
• Fix(editor): preserve leading newlines in plain text editor (text#8788)
• Fix(ActionInsertLink): allow to get title from link picker (text#8791)
• Fix(markdown): preserve horizontal rule markup (text#8792)
• Preserve Markdown reference links (text#8811)
• Fix(ImageView): use `a` element for clickable items (text#8843)
• Ci(playwright): fix installing pinned NPM version (text#8845)
• Fix(links): scroll to anchor links directly (text#8861)
• Fix(FloatingButtons): in headings, leave space for the anchor icon (text#8863)
• Chore(playwright): use `list` reporter when run locally (text#8865)
• Fix(BulletList): remove `preserveWhitespace: true` parseHTML override (text#8866)
• Chore(deps): bump @nextcloud/vue to 8.40.0 (text#8872)
• Fix(Table): allow changing list indention inside tables (text#8878)
• Fix(share): detect if documentId is outside of share early (text#8880)

twofactor_totp

• Ci: update codecov action to v7 (twofactor_totp#1789)
• Ci: drop unused app publish workflow (twofactor_totp#1838)

viewer

• Fix(composer): Remove trailing comma breaking composer.json parsing (viewer#3228)
• Chore(deps): update dependency dompurify to v3.4.11 [security] (viewer#3268)
• Test: migrate e2e tests from Cypress to Playwright (viewer#3275)
• Chore: replace node.yml workflow with npm-build.yml (viewer#3282)