v2.5.1 #275

⭐ Highlights

• Improved service availability and automatic recovery
  Sync-in now monitors MySQL, cache, and Redis WebSocket availability. When a required dependency becomes unavailable, affected API requests return HTTP 503 while the server remains running and retries the connection. Service resumes automatically after recovery.
• Outage-aware scheduled jobs
  Cron jobs and pending scheduled timeouts are suspended during database or cache outages. Previously running cron jobs restart once both dependencies recover and continue from their next scheduled execution; missed executions are not replayed.
• Built-in health checks
  New /healthz/live and /healthz/ready endpoints provide liveness and readiness information. The readiness endpoint returns HTTP 503 while a registered dependency is unavailable. Both endpoints are unauthenticated, non-cacheable, and expose no dependency details.
• Stronger authentication protection
  Sensitive authentication, 2FA, synchronization, WebDAV, and public-link routes now use cache-backed rate limits shared across all clustered server workers. Ten failed password, application-password, TOTP, or recovery-code attempts trigger a self-expiring 15-minute account lock.
• More reliable online-editor integration
  When server.publicUrl is configured, Sync-in uses it for the endpoints passed to OnlyOffice, EuroOffice and Collabora, fixing document access behind reverse proxies and non-standard ports. For backward compatibility, the incoming request origin remains the fallback. Administrators are encouraged to configure server.publicUrl now, as it will become required in the next major release to ensure editor endpoints are generated from a trusted, administrator-controlled origin rather than request headers.
• Smaller Docker image
  Production source maps and unnecessary build dependencies are no longer included in the final Docker image, reducing its size by approximately 30–40 MB. Container startup also avoids an unnecessary shell process.

⬆️ Recommended Upgrade

• Refresh the Docker and Nginx configuration files
  Existing configurations remain usable, but updating or merging the files distributed with 2.5.1 is recommended.

  The updated Docker Compose configuration waits for MariaDB and InnoDB to become ready before starting Sync-in. The official image also uses /healthz/ready for its container health check.

  The Nginx configuration now preserves non-standard public ports in the Host and X-Forwarded-Host headers and adds the /sdkjs/ proxy route required by EuroOffice.

  Administrators should also verify that persistent storage is mounted at /app/data, which is now the fixed data directory used by the official Sync-in image.

🐞 Bug Fixes

• More resilient database operations
  Sync-in now waits for MySQL during startup, monitors the connection afterward, and recovers from retryable outages without requiring an application restart. Runtime connections and migrations consistently use UTC and InnoDB session settings.
• More reliable database utilities
  Database checks now close their connections cleanly, migration failures are reported correctly, and user-creation failures return a non-zero process exit status.
• Consistent Redis and MySQL cache behavior
  Multi-key reads preserve the requested key order and represent missing entries consistently. Empty key lists, wildcard escaping, deletion results, expiration behavior, and write failures are also handled consistently across both cache backends.
• Reliable file operations across filesystems
  Move and trash operations now detect EXDEV rename failures and fall back to an abortable copy. The source is removed only after the destination has been published successfully, and partial destinations are cleaned up after failures.
• Correct reverse-proxy behavior for online editors
  The bundled Nginx configuration now forwards the complete public host and port to Sync-in, OnlyOffice, and EuroOffice. EuroOffice SDK assets are also served correctly through the reverse proxy.
• Cleaner account-state handling
  Administratively disabled accounts no longer receive misleading lock notifications. Reactivating a user or public link resets its previous failed-password counter.

⚠️ Security

• Atomic enforcement of public-link limits
  Fixed vulnerability GHSA-phhw-76pc-crgg.
  The access-limit check and counter increment are now performed by a single conditional database update. Concurrent requests can no longer consume the same remaining access slot, and Sync-in fails closed before issuing a session or starting a direct download.

        Special thanks to @ry2811 who responsibly reported this issue.

• Explicit limits for sensitive routes
  Sensitive authentication and public endpoints now apply shared per-route and per-client rate limits across clustered server workers. Requests exceeding these limits are temporarily blocked with an HTTP 429 response. Dedicated policies are applied to WebDAV and direct public-link downloads.
• Safer credential handling
  Local credentials supplied through URL query parameters are rejected, and empty passwords are refused before opening an LDAP connection. Redis passwords embedded in connection URLs are now redacted from cache and WebSocket logs.
• Shorter and non-cacheable authentication sessions
  The default access-token lifetime has been reduced from 30 to 15 minutes. Token, 2FA, synchronization, and public-link authentication responses now use Cache-Control: no-store.

Contributors: @q16marvin @Stephan-P @zippoking @jimmy-ncc @iacchi