5.0.2

5.0.2 - 2026-02-05

Security

⚠️ Update immediately: CVE-2026-23989, a security issue in public links is resolved in v5.0.2.

We recommend all deployments running previous versions to update to one of these releases immediately.

❤️ Thanks to all contributors! ❤️

@AlexAndBear, @ScharfViktor, @flimmy, @individual-it, @rhafer, @saw-jan

🐛 Bug Fixes

• [full-ci] reva-bump-2.42.3 [#2276]

✅ Tests

• adapt test for #514 [#2255]
• api-test: upload-rename-download file with back slash [#2239]
• [full-ci][tests-only] test: add hook failures to the test failures list [#2041]

📚 Documentation

• docs(proxy): Clarify PROXY_OIDC_USERINFO_CACHE_TTL value [#2256]

📦️ Dependencies

• [full-ci] reva-bump-2.42.2 [#2270]
• build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.5 to 2.27.6 [#2238]

5.0.2-rc.1

v5.0.2-rc.1

Release 5.0.2 RC 1

4.0.3

4.0.3 - 2026-02-05

Security

⚠️ Update immediately: CVE-2026-23989, a security issue in public links is resolved in v4.0.3.

We recommend all deployments running previous versions to update to one of these releases immediately.

❤️ Thanks to all contributors! ❤️

@ScharfViktor, @aduffeck, @fschade, @kulmann, @micbar, @prashant-gurung899, @saw-jan

🐛 Bug Fixes

• Bump reva 2.40.3 [#2275]

✅ Tests

• [tests-only] port tests to stable #2087 #2039 [#2185]
• [full-ci][tests-only] port test fixes [#2017]
• [stable-4.0] Port #2011 [#2018]

📦️ Dependencies

• Bump reva [#2274]

Reva

• fix(authscope): Fix parent check [#522]

4.0.3-beta.1

v4.0.3-beta.1

Release 4.0.3 Beta 1

4.0.2

4.0.2 - 2026-02-05

❤️ Thanks to all contributors! ❤️

@ScharfViktor, @aduffeck, @fschade, @kulmann, @micbar, @prashant-gurung899, @saw-jan, @rhafer

Opencloud

✅ Tests

• [tests-only] port tests to stable #2087 #2039 [#2185]
• [full-ci][tests-only] port test fixes [#2017]
• [stable-4.0] Port #2011 [#2018]

📦️ Dependencies

• Bump reva [#2274]

Reva

🔒 Security

• Public scope fix [#519]

4.0.2-rc.1

Merge pull request #2274 from aduffeck/bump-reva-v2.40.2

Bump reva

5.0.1

5.0.1 - 2026-01-28

❤️ Thanks to all contributors! ❤️

@ScharfViktor, @aduffeck, @saw-jan

Opencloud

🐛 Bug Fixes

• Do not ever set a TTL for the ID cache. It's not supposed to expire. [#2223]

✅ Tests

• test(api): wait for web-office readiness by checking discovery endpoint [#2217]

📦️ Dependencies

• reva-bump-2.42.1 [#2225]

Reva

🐛 Bug Fixes

• Apply changed TTL settings to existing buckets [#509]

5.0.0

Note

This is a rolling release. Learn here about the release types and lifecycle.

Releasenotes OpenCloud 5.0.0

This release includes moving the ocdav handler back into the frontend, along with a set of changes that enable the registration of editor apps on folders.

⚠️ This release introduces breaking changes affecting both the Go microservice and frontend behavior. In accordance with Semantic Versioning, we have incremented the major version number.

Changelog

5.0.0 - 2026-01-26

❤️ Thanks to all contributors! ❤️

@ScharfViktor, @butonic, @dragonchaser, @flimmy, @fschade, @micbar, @rhafer, @saw-jan, @JammingBen, @kulmann, @michaelstingl, @tammi-23, @aduffeck

Opencloud:

💥 Breaking changes

• merge ocdav into frontend [#1958]

✅ Tests

• [test-only] replace exception to assertions [#2196]
• test(api): auto-generate test virus files before test run [#2191]
• test(api): remove accountsHashDifficulty test suite [#2190]
• test(api): update without-remotephp expected-failures list [#2184]
• [full-ci] test: use single command to run the containers and the API tests [#2169]
• [tests-only] test: setup for running wopi API tests locally [#2139]
• fix flaky #2145 [#2161]
• Run wopi validator tests localy [#2151]
• ci: fix unwanted workflow skip in the cron pipelines [#2117]
• [POC] ci: skip previously passed workflows on pipeline restart [#2099]
• [tests-only] test: wait post-processing to finish for MKCOL requests [#2092]
• [tests-only] test: fix API tests [#2087]
• [full-ci] use graph api in the enforcePasswordPublicLink.feature [#2050]
• [full-ci][tests-only] test: check last email content with retries as emails can be delayed [#2038]
• skip collaborativePosix tests in CI [#2039]

📚 Documentation

• Update release template [#2182]
• Clarify what the two requests are used for [#2179]
• fix: markdown links formatting [#2143]

🐛 Bug Fixes

• fix: Show username in unprivileged search results [#2104]
• fix(thumbnailer): missing font panic [#2097]
• Remove sub-service binary entrypoints and fix antivirus only server cmd [#2043]
• fix(thumbnailer): respect image boundaries and text wrappings [#2062]
• fix: cobra viper flags and env [#2047]
• fix service name in suture logs [#2052]

📈 Enhancement

• benchmark client enhancements [#1856]
• allow http2 connections to proxy [#2040]
• migrate from urfave/cli to spf13/cobra [#1954]

📦️ Dependencies

• reva-bump-2.42.0 [#2215]
• build(deps): bump github.com/olekukonko/tablewriter from 1.1.2 to 1.1.3 [#2186]
• build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.4 to 2.27.5 [#2204]
• build(deps): bump github.com/go-resty/resty/v2 from 2.7.0 to 2.17.1 [#2197]
• build(deps): bump github.com/open-policy-agent/opa from 1.11.1 to 1.12.3 [#2166]
• build(deps): bump github.com/kovidgoyal/imaging from 1.8.18 to 1.8.19 [#2167]
• build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.3 to 2.27.4 [#2164]
• build(deps): bump github.com/sirupsen/logrus from 1.9.4-0.20230606125235-dd1b4c2e81af to 1.9.4 [#2163]
• build(deps): bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.4 [#2162]
• build(deps): bump go.opentelemetry.io/contrib/zpages from 0.63.0 to 0.64.0 [#2158]
• build(deps): bump github.com/blevesearch/bleve/v2 from 2.5.5 to 2.5.7 [#2157]
• build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.38.0 to 1.39.0 [#2154]
• build(deps): bump golang.org/x/image from 0.34.0 to 0.35.0 [#2153]
• build(deps): bump github.com/nats-io/nats.go from 1.47.0 to 1.48.0 [#2147]
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.27.2 to 2.27.5 [#2148]
• build(deps): bump github.com/olekukonko/tablewriter from 1.1.1 to 1.1.2 [#2144]
• build(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 [#2141]
• build(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 [#2140]
• build(deps): bump github.com/onsi/gomega from 1.38.2 to 1.39.0 [#2133]
• build(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 [#2132]
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.63.0 to 0.64.0 [#2109]
• build(deps): bump github.com/kovidgoyal/imaging from 1.8.17 to 1.8.18 [#2107]
• build(deps): bump google.golang.org/grpc from 1.77.0 to 1.78.0 [#2106]
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 [#2069]
• build(deps): bump github.com/opensearch-project/opensearch-go/v4 from 4.5.0 to 4.6.0 [#2068]
• build(deps): bump github.com/testcontainers/testcontainers-go/modules/opensearch from 0.39.0 to 0.40.0 [#1967]
• build(deps): bump golang.org/x/net from 0.47.0 to 0.48.0 [#2061]
• build(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.11.0 [#1930]

Web:

💥 Breaking changes

• feat!: remove deprecations [#1829]
• feat: folder editor apps [#1817]

🔒 Security

• fix(deps): update dependency lodash-es to v4.17.23 [security] #2 [#1859]
• chore(deps): bump preact to v10.28.2 [security] [#1814]

📈 Enhancement

• feat: clarify error text on 412 error in editor [#1850]
• Mail: Mail compose as Widget #1609 [#1687]
• feat: allow .readme.md filename for top level readme [#1769]

🐛 Bug Fixes

• fix: add missing low opacity for cut resources in tiles view [#1852]
• fix: delete action showing without any selected file in trash bin [#1853]
• fix: embed actions filename input and confirm button name [#1849]
• fix: prevent sort options in trash overview from disappearing [#1851]
• fix: break long resource names in right sidebar [#1836]
• fix: context menu for shares on search result page [#1835]
• fix: text editor app entry for light users [#1837]
• fix: resource delete action visibility [#1832]
• fix(calendar): use type="a" for external documentation link [#1801]
• fix(design-system): checkbox label vertical alignment [[#1773](https:/...

4.1.0

Note

This is a rolling release. Learn here about the release types and lifecycle.

Releasenotes OpenCloud 4.1.0

🖼️ Photo Roll in Preview App

The Preview App now includes a Photo Roll feature. Users can easily browse, scroll, and preview multiple images in a continuous view, making it faster and more intuitive to navigate through collections of photos. This enhancement improves the overall media handling experience within the file system.

🎬 MOV video file support (Preview)

OpenCloud now supports previewing MOV video files. You can store MOV files in your file system and preview them directly in the interface without converting them first. This extends format compatibility and makes it easier to work with videos from a wide range of devices and applications.

Changelog

4.1.0 - 2025-12-15

❤️ Thanks to all contributors! ❤️

@JammingBen, @ScharfViktor, @Svanvith, @butonic, @flimmy, @fschade, @individual-it, @kulmann, @micbar, @prashant-gurung899, @AlexAndBear, @dschmidt, @pascalwengerter, @tammi-23, @aduffeck, @anon-pradip, @butonic

#Changelog

Opencloud

📚 Documentation

• fix typo [#2024]
• [docs] update policies link [#1996]
• fix the link in quickstart script for itself [#1956]

✅ Tests

• [full-ci][tests-only] test: fix some test flakiness [#2003]
• [tests-only] Skip test related pipelines for ready-release-go PRs [#2011]
• [full-ci][tests-only] test: add test to check mismatch offset during TUS upload [#1993]
• [full-ci][tests-only] test: proper resource existence check [#1990]
• check propfing after renaming data in file system [#1809]
• fix-get-attribute-test [#1974]

📈 Enhancement

• Show edition in opencloud version command [#2019]

🐛 Bug Fixes

• fix: enforce trailing slash for server url [#1995]
• fix: enhance resource creation with detailed process information [#1978]

📦️ Dependencies

• chore: bump web to v4.3.0 [#2030]
• reva-bump-2.41.0 [#2032]
• build(deps): bump github.com/testcontainers/testcontainers-go from 0.39.0 to 0.40.0 [#1931]

Web

🔒 Security

• chore(deps): bump mdast-util-to-hast to 13.2.1 (security) [#1692]
• chore: bump sub-dependencies that cause vulnerability alerts [#1653]

🐛 Bug Fixes

• fix(design-system): filter chip margins [#1739]
• fix(design-system): remove tailwind reference in bundled css [#1728]
• fix: add missing drag styling in tiles view [#1645]
• fix: embed mode click behavior [#1641]
• fix: hide calendar when env var FRONTEND_DISABLE_RADICALE is set to true [#1660]
• fix: move folder replace [#1627]
• fix: editing and loading tags for received shares [#1650]
• fix: catching errors in sse events [#1654]
• fix: missing versions when closing and re-opening sidebar [#1602]
• fix: embed actions z-index [#1610]
• fix: version downloads and remove downloadUrl dav property default [#1559]
• fix: copying created links in Safari [#1594]
• fix: prevent undo delete multiple times for same file [#1587]
• fix: initial default favicon [#1584]
• fix: add missing file list update after undo delete in space [#1561]
• bug: hide addtional calendar data, if radicale is not set up [#1573]
• fix: lazy loading indicator in condensed resource table [#1572]
• fix: endless propfind requests when opening public links authenticated [#1534]
• fix: archive download on password protected links [#1523]
• bug: allow clipboard access to collabora [#1569]
• fix: translation string typos [#1564]
• fix: remove horizontal scrollbar when opening upload menu [#1562]
• fix: account preferences page, left sidebar won't be translated on language change [#1554]
• fix: avoid flicker on CalDAV check [#1538]
• fix: private link doesn't reliably open default app [#1527]
• fix: only render drop content when opened [#1498]
• fix: space batch actions not loading in spaces table [#1517]
• fix: bottom drawer 'New'-menus appearance [#1494]
• revert: "Update Font Metadata2 (#1488)" [#1507]
• fix: adjust headline sizes across the webui [#1504]

✅ Tests

• [tests-only] correct release PR condition to use build.sender [#1736]
• [tests-only] skip unit and e2e test pipelines on ready-release-go prs [#1714]
• e2e-tests. undo deleted resources [#1580]
• e2e-test. download folder on public link [#1531]
• check user avatar in the admin settings->users [#1510]

📈 Enhancement

• feat: add photo roll to preview app [#1699]
• feat: render readme.md file at the top of folder [#1708]
• feat: add inlineLabel and hasBorder props to OcTextInput and OCSelect [#1707]
• feat(preview): add support for mov video files [#1705]
• feat: add floating action button [#1688]
• feat: replace extension and gdpr icon in preference menu [#1683]
• feat: implement mail account switcher [#1677]
• feat: show empty trash bin icon at quick action if trash is empty [#1647]
• feat: share links and passwords in embed mode [#1613]
• Introduce mail app [#1382]

📦️ Dependencies

• chore(deps): update dependency @codemirror/view to v6.39.4 [#1732]
• fix(deps): update dependency vue-router to v4.6.4 [#1743]
• fix(deps): update dependency @sentry/vue to v10.30.0 [#1737]
• chore(deps): update node.js to v24.12.0 [#1734]
• chore(deps): update devdependencies (non-major) [#1742]
• chore(deps): update dependency @codemirror/view to v6.39.1 [#1730]
• chore(deps): update dependency dompurify to v3.3.1 [#1721]
• chore(deps): update typescript-eslint monorepo to v8.49.0 [#1724]
• chore(deps): update dependency md-editor-v3 to v6.2.1 [#1726]
• chore(deps): update dependency @codemirror/view to v6.39.1 [#1725]
• chore(deps): update devdependencies (non-major) [#1722]
• fix(deps): update uppy monorepo [#1729]
• chore(deps): update pnpm to v10.25.0 [#1723]
• chore(deps): update traefik docker tag to v3.6.4 [#1716]
• chore(deps): update devdependencies (non-major) [#1717]
• fix(deps): update dependency @sentry/vue to v10.29.0 [[#1712](https://github...

4.0.1

4.0.1 - 2025-12-15

❤️ Thanks to all contributors! ❤️

@ScharfViktor, @fschade, @kulmann, @micbar, @prashant-gurung899, @stavros-k

✅ Tests

• [stable-4.0] Port #2011 [#2018]

🐛 Bug Fixes

• [stable-4.0] fix: build time edition channels #2001 [#2010]
• [stable-4.0] fix: enforce trailing slash for server url [#2002]
• [stable-4.0] fix: enhance resource creation with detailed process information (#1978) [#2000]