⭐ Highlights

• Improved service availability and automatic recovery
  Sync-in now monitors MySQL, cache, and Redis WebSocket availability. When a required dependency becomes unavailable, affected API requests return HTTP 503 while the server remains running and retries the connection. Service resumes automatically after recovery.
• Outage-aware scheduled jobs
  Cron jobs and pending scheduled timeouts are suspended during database or cache outages. Previously running cron jobs restart once both dependencies recover and continue from their next scheduled execution; missed executions are not replayed.
• Built-in health checks
  New /healthz/live and /healthz/ready endpoints provide liveness and readiness information. The readiness endpoint returns HTTP 503 while a registered dependency is unavailable. Both endpoints are unauthenticated, non-cacheable, and expose no dependency details.
• Stronger authentication protection
  Sensitive authentication, 2FA, synchronization, WebDAV, and public-link routes now use cache-backed rate limits shared across all clustered server workers. Ten failed password, application-password, TOTP, or recovery-code attempts trigger a self-expiring 15-minute account lock.
• More reliable online-editor integration
  When server.publicUrl is configured, Sync-in uses it for the endpoints passed to OnlyOffice, EuroOffice and Collabora, fixing document access behind reverse proxies and non-standard ports. For backward compatibility, the incoming request origin remains the fallback. Administrators are encouraged to configure server.publicUrl now, as it will become required in the next major release to ensure editor endpoints are generated from a trusted, administrator-controlled origin rather than request headers.
• Smaller Docker image
  Production source maps and unnecessary build dependencies are no longer included in the final Docker image, reducing its size by approximately 30–40 MB. Container startup also avoids an unnecessary shell process.

⬆️ Recommended Upgrade

• Refresh the Docker and Nginx configuration files
  Existing configurations remain usable, but updating or merging the files distributed with 2.5.1 is recommended.

  The updated Docker Compose configuration waits for MariaDB and InnoDB to become ready before starting Sync-in. The official image also uses /healthz/ready for its container health check.

  The Nginx configuration now preserves non-standard public ports in the Host and X-Forwarded-Host headers and adds the /sdkjs/ proxy route required by EuroOffice.

  Administrators should also verify that persistent storage is mounted at /app/data, which is now the fixed data directory used by the official Sync-in image.

🐞 Bug Fixes

• More resilient database operations
  Sync-in now waits for MySQL during startup, monitors the connection afterward, and recovers from retryable outages without requiring an application restart. Runtime connections and migrations consistently use UTC and InnoDB session settings.
• More reliable database utilities
  Database checks now close their connections cleanly, migration failures are reported correctly, and user-creation failures return a non-zero process exit status.
• Consistent Redis and MySQL cache behavior
  Multi-key reads preserve the requested key order and represent missing entries consistently. Empty key lists, wildcard escaping, deletion results, expiration behavior, and write failures are also handled consistently across both cache backends.
• Reliable file operations across filesystems
  Move and trash operations now detect EXDEV rename failures and fall back to an abortable copy. The source is removed only after the destination has been published successfully, and partial destinations are cleaned up after failures.
• Correct reverse-proxy behavior for online editors
  The bundled Nginx configuration now forwards the complete public host and port to Sync-in, OnlyOffice, and EuroOffice. EuroOffice SDK assets are also served correctly through the reverse proxy.
• Cleaner account-state handling
  Administratively disabled accounts no longer receive misleading lock notifications. Reactivating a user or public link resets its previous failed-password counter.

⚠️ Security

• Atomic enforcement of public-link limits
  Fixed vulnerability GHSA-phhw-76pc-crgg.
  The access-limit check and counter increment are now performed by a single conditional database update. Concurrent requests can no longer consume the same remaining access slot, and Sync-in fails closed before issuing a session or starting a direct download.

        Special thanks to @ry2811 who responsibly reported this issue.

• Explicit limits for sensitive routes
  Sensitive authentication and public endpoints now apply shared per-route and per-client rate limits across clustered server workers. Requests exceeding these limits are temporarily blocked with an HTTP 429 response. Dedicated policies are applied to WebDAV and direct public-link downloads.
• Safer credential handling
  Local credentials supplied through URL query parameters are rejected, and empty passwords are refused before opening an LDAP connection. Redis passwords embedded in connection URLs are now redacted from cache and WebSocket logs.
• Shorter and non-cacheable authentication sessions
  The default access-token lifetime has been reduced from 30 to 15 minutes. Token, 2FA, synchronization, and public-link authentication responses now use Cache-Control: no-store.

Contributors: @q16marvin @Stephan-P @zippoking @jimmy-ncc @iacchi

Features

• auth: add cache-backed rate limiting (#272) (829df9e)
• backend:admin: include instance URL in update check requests (2c9b4c2)
• backend:availability: expose health endpoints and add Docker health checks (9526812)
• backend:availability: monitor dependencies and handle service outages (f54f182)
• backend:scheduler: handle database and cache outages (68fbb44)

Bug Fixes

• backend:auth: make password-attempt locks temporary (413dd45)
• backend:auth: prevent lock emails for already disabled accounts (cee35be)
• backend:auth: reject empty passwords before LDAP bind (7e7845e)
• backend:auth: reject local credentials in query parameters (462f32c)
• backend:auth: update token expiration and enforce no-store Cache-Control headers (b94ac0e)
• backend:cache: align Redis and MySQL adapter behavior (5c5f01c)
• backend:database: align migration session settings and fix user creation exit code (33e3047)
• backend:database: enforce InnoDB storage engine and improve connection handling (7981ab9)
• backend:editors: use configured public URL for editor endpoints (fe3345d)
• backend:files: handle EXDEV fallbacks for task moves (0b0d10a)
• backend:files: preserve external-root paths in trash (48b5118)
• backend:links: atomically enforce public link access limits (f1895c8)
• backend:redis: improve password redaction in connection logs (#268) (12eb6b5)
• backend:server: prevent IPC errors during cluster shutdown (8619471)
• backend:shares: reset password attempts when reactivating a link (d40de85)
• backend:websocket: allow cluster workers to exit gracefully (90de776)
• docker:nginx: preserve public port in forwarded host headers (c2bb1d7)
• docker: force application data path to /app/data (8e9233e)
• docker: update EuroOffice and proxy its SDK assets (3e2d938)
• frontend:files: align shared loc...

⭐ Highlights

• Favorites
  Files in the personal space, collaborative spaces, and shares can now be added to Favorites and accessed from a dedicated view. The view provides
  filtering, sorting, location details, and list or gallery layouts.
• Selection management
  Selection mode can now be activated by clicking a file or folder icon. The new Selection panel lists selected items, calculates their total size,
  including folder contents, and provides direct access to the available actions.
• Unified recent activity
  Recent files and comments are now brought together in a single timeline, grouped by period and filterable by activity type.
• Improved copy, move, and upload workflows
  The copy and move sidebar has been redesigned to make navigation between spaces easier. When conflicts occur, affected files can now be skipped
  during copy, move, or upload operations.
• Improved full-text search results
  Compound terms such as dates, email addresses, and hyphenated names are now handled more reliably. Invalid trailing operators are normalized, and
  result snippets provide more accurate highlighting for accented and other Unicode characters, as well as prefix matches.
• Automatic first-login destination
  On their first sign-in, users are automatically redirected to the first file location available to them: their personal space, a collaborative space, or a share.
• Improved interface and accessibility
  The interface has been refined for a more consistent and accessible experience on desktop and mobile. Breadcrumbs and file locations now use the
  configured names of spaces and shares. File sidebars, list and gallery view controls, context menus, and copy or move destinations are also clearer.
  Space navigation remains available during searches.

⚠️ Minor Breaking Changes

• WebDAV app passwords with 2FA: enabling Sync-in 2FA now disables WebDAV authentication with the user’s main account password. WebDAV clients must use a generated application password assigned to the webdav application
• Verified OIDC emails are now required by default: auth.oidc.security.requireVerifiedEmail now defaults to true. OIDC providers must return email_verified: true for authentication to succeed. Administrators using a provider that does not expose a reliable verified-email claim must explicitly set this option to false after assessing the associated account-binding risk
• Explicit deployment secrets required: distributed configuration templates no longer provide default values for access-token, refresh-token or enabled online-editor secrets. These secrets must be configured before the server starts

🐞 Bug Fixes

• Destination-aware staging files: staging files are no longer created in the user’s personal space. They are now placed directly in the temporary location associated with the operation’s destination, whether it is personal files, a space, an anchored root or a share
• Consistent nested shares and file locations: nested external shares now use the correct storage scope for paths, quotas, comments and recent activity. Personal-space labels no longer appear in nested share paths
• Improved editor and metadata reliability: file size and modification metadata are refreshed after closing OnlyOffice or Collabora, file-location and collaboration indicators are displayed more consistently, and inactive text viewers no longer react to keyboard events
• Unified maximum upload size enforcement: the maxUploadSize limit is now enforced consistently across HTTP uploads, WebDAV, synchronization, remote downloads and editor callbacks. No received file can exceed the configured maximum size
• Password and 2FA management from OIDC sessions: users authenticated through OIDC can now set their local password, manage application passwords and enable, reset or disable Sync-in 2FA from their profile
• More predictable authentication edge cases: OIDC login-name collisions are handled automatically, stale pending 2FA activation state is cleared correctly and guest-link accounts are excluded from regular authentication lookups
• TLS certificate verification for online editors: Sync-in now validates OnlyOffice and Euro-Office TLS certificates according to the configured verifySSL option
• Clearer configuration validation: configuration errors now include the exact property path that requires attention
• WebSocket session stability: WebSocket disconnections no longer trigger recursive Angular updates

⚠️ Security

• OIDC binding based on verified identity
  Fixed vulnerability GHSA-v745-9jvf-pj46.
  OIDC accounts are now linked using the validated sub claim in the ID token. Email address changes at the identity provider no longer break an existing link, while a compatibility mechanism remains available for legacy accounts that have not yet been linked.

• Safer OnlyOffice callbacks
  Fixed vulnerability GHSA-4rg7-mqpm-cgf2.
  Only server-generated temporary file paths are now accepted. Filename and checksum parameters supplied by callbacks can no longer point outside the temporary directory.

• Isolated SVG thumbnails
  Fixed vulnerability GHSA-g732-49pc-5rh3.
  SVG thumbnails can no longer load files referenced from the uploaded image's directory.

• Streaming WebDAV quota enforcement
  Fixed vulnerability GHSA-fgr8-f8r9-qh38.
  The size of WebDAV uploads without a Content-Length header is now checked as data is received, preventing storage quotas and maximum upload limits from being bypassed.

• Trusted links in notification emails
  Fixed vulnerability GHSA-w4p5-q27v-2vgr.
  Action links in notification emails are generated exclusively from the configured server.publicUrl. Untrusted Origin or Host headers can no longer alter these links. When server.publicUrl is not configured, notifications are sent without action links.

• Atomic authentication-secret updates
  Fixed vulnerability GHSA-2p67-5v3m-gv27.
  Application password revocations and 2FA state changes are now recorded atomically, preventing concurrent updates from restoring revoked or outdated secrets.

• Secured queries for descendant paths
  Fixed vulnerability GHSA-mgqw-2fm5-3v4x.
  Paths used to look up descendant files and folders are now passed to the database as parameters instead of being embedded directly in SQL queries. A maliciously crafted path can therefore no longer alter the executed query.

• Safe rendering of space information
  Fixed vulnerability GHSA-7vcx-jx6f-g5pp.
  Space names and descriptions are now rendered safely, preventing malicious HTML injection and stored cross-site scripting attacks.

• External sharing permission check
  Fixed vulnerability GHSA-vpmh-xvx9-385r.
  When a share was created from a file in a space, Sync-in already limited member and link permissions to those the user actually held for the space and its root. However, it did not verify the dedicated SHARE_OUTSIDE permission ("Share outside"), which is required to share content outside the space. This check is now performed before the share is created.

• Strict names, aliases, and storage paths
  Fixed vulnerability GHSA-r8c3-2pf9-xprv.
  Space and share names and aliases are now strictly validated, and storage paths are restricted to their intended roots. Malformed aliases can no longer target data belonging to another space.

Special thanks to @pcornelissen who responsibly reported these issues.

Contributors: @7185 @Leniwcowaty @slfhstr @Zaryu @rchan96

➡️ Read the release announcement

Features

• backend:files: improve full-text search (7ff6a8b)
• favorites: show persisted file detail badges (a785d56)
• files: add file favorites across repositories (d3724ec)
• frontend:auth: route users to their default files location (b6b3b7d)
• frontend:files: enhance multi-selection (#252) (3f5b0c1)
• frontend:files: redesign copy and move sidebar (294060d)
• frontend:files: redesign the display mode selector (d0643c6)
• frontend:files: refine copy-move navigation and tree roots (7f20da3)
• frontend:files: share file summary between selection and clipboard ([165bc13](165bc13...

Bug Fixes

• backend:database: prevent double decoding of JSON columns (37f9d80)

Features

• backend:sync: improve unicode path matching in NormalizedMap (c860ead)
• frontend:common: add reusable user avatar stack tooltip (160ec66)
• frontend:files: disable sidebar media autoplay and simplify controls (98a6346)
• frontend:space: group permissions in a single tooltip (dd8647e)
• frontend:space: show member counts in a translated tooltip (4b1f97c)

Bug Fixes

• backend:auth: improve OIDC response error logging (4c04c98)
• backend:cache: propagate method errors without retrying (6c07c42)
• backend:comments: filter recent comments by user permissions (48c6d7e)
• backend:database: support pre-parsed JSON results from mysql2 (98072f0)
• backend:files: filter recents by user permissions (406881f)
• backend:files: improve log clarity for full indexing requests (31f9beb)
• backend:files: synchronize recent files after editor updates and deletions (2b87607)
• backend:notifications: harden HTML email template escaping (b9909b3)
• backend:onlyoffice: validate document download origin (d0de778)
• backend:websocket: use Fastify cookie parser for authentication (38dbcea)
• files: downgrade PDF.js to v5.6.205 and allow viewer WASM in CSP (5a868df)
• frontend:auth: allow retrying OIDC login (003b307)
• frontend:auth: support desktop-handled auth flow (d683438)
• frontend:files: remove unused spacer in sidebar header (4ed55b3)
• frontend:spaces: handle optional error message in notification (fa1cd08)
• frontend:sync: adjust table column widths for better layout (06245b9)
• frontend: improve live relative time updates (ef40ab0)
• frontend: prevent Chromium caret loss during file rename (f99b313)

Contributors: @Stephan-P @pretubedongit

Bug Fixes

• backend:files: bound search result limit (4df1b8d)
• backend:files: escape search terms for Unicode regex (6b5a0c5)
• backend:files: make highlight context Unicode-aware (6e574c3)
• frontend: pin pdf.js viewer assets to v5.7.284 (e342d01)

Security

• backend:auth: centralize local password timing mitigation GHSA-29hq-23m2-2j47 (b80efe0)

Thanks to @456789TZ for reporting this. The mitigation against username enumeration via timing attacks has been completed.

Bug Fixes

• auth: require step-up for app password mutations (db19b3e)
• backend:auth: invalidate WebDAV cache on app password deletion (6dae284)
• backend:sync: await usersManager.updateAccesses in 2FA recovery code validation (8f55344)
• docker: add editors section in environment.yaml (1de3e09)
• docker: add Euro-Office config to nginx volumes (a864684)
• frontend:files: add support for dynamic editor naming in OnlyOffice components and error handling (98031da)

⭐ Highlights

• Euro-Office is now available as an online document editor alongside OnlyOffice and Collabora
• Cancellable file tasks: uploads, downloads, archive creation, extraction, copies, moves and deletions can now be canceled from the task panel
• Task queue management: file operations are now queued and limited per user to avoid too many heavy tasks running in parallel
• Detailed task progress: long-running operations can now show clearer progress instead of only a running state
• ZIP archive creation: Sync-in can now create ZIP archives, in addition to TAR and TGZ
• OIDC verified email control: administrators can require verified OIDC email addresses before account linking or profile synchronization
• Grouped editor configuration: editor settings are now centralized under applications.files.editors, with legacy OnlyOffice and Collabora settings deprecated

🐞 Bug Fixes

• More reliable URL downloads: compressed server responses are now handled correctly, preventing size errors and incomplete downloads
• CJK full-text search support: search now supports Chinese, Japanese, Korean and other languages without space-separated words
• Text and Markdown editor fixes: editors now preserve focus more reliably, detect changes correctly and refresh file size after saving
• Improved filtered selection: multi-selection remains more consistent when file lists are filtered
• More reliable server startup: MySQL connection errors are detected earlier, allowing a clean exit and automatic restart
• Safer configuration loading: quoted sensitive values such as secrets, database URLs and initial credentials are now loaded without keeping quote characters

⚠️ Security

• Stronger 2FA enforcement for API tokens
  Fixed vulnerability GHSA-92cr-jxw4-5wjg.
  API token creation now correctly requires the second factor when 2FA is enabled.

• Better protection against repeated TOTP attempts
  Fixed vulnerability GHSA-274f-6w77-8qm9.
  Failed TOTP attempts during desktop sync client registration are now counted correctly, including repeated or concurrent attempts.

• Safer synchronization filters
  Fixed vulnerability GHSA-jx63-h26r-8cph.
  Sync filters are now validated and limited before use to prevent malicious overload during synchronization.

• More reliable synchronization uploads
  Uploaded files are checked before replacing the destination file, preserving the existing file in case of size, quota or checksum errors.

• Sessions aligned with account state
  Browser and WebSocket sessions now better reflect role, permission and active/inactive account changes.

• OIDC and LDAP hardening
  New OIDC directives allow verified email enforcement and explicit private IP avatar downloads. Insecure OIDC/LDAP password authentication defaults are now disabled.

• Stricter external login validation
  Logins from external identity providers are now limited to valid names, preventing file-path interpretation.

• Safer archive extraction
  Archive extraction now blocks unexpected paths more reliably, cleans up interrupted extractions and applies storage quotas during extraction.

Contributors: @Stephan-P, @7185, @rchan96, @o2asdv,
Special thanks to @SakusenSec for responsibly reporting these security issues.

➡️ Read the release announcement

Features

• auth: refresh browser user state with token renewal (cad5f12)
• backend:auth: add OIDC verified email enforcement option (cd71b04)
• backend:cache: add atomic bounded counter increments (c172825)
• backend:files: add cancellable copy, move and delete tasks (e23151e)
• backend:files: add Euro-Office editor support (9fe93bd)
• backend:files: improve task progress tracking for copy and move operations (7939491)
• backend:files: queue and limit concurrent tasks per user (395f841)
• backend:files: track download, compression and extraction progress (caa6a92)
• config: group editor config under files.editors (bd50a29)
• files: add ZIP archive creation with optional compression (7c94d6a)
• files: batch active task polling (e36af62)
• files: expose task cancellation capability (14e5b9e)
• files: make downloads and (de)compression abortable (a43025e)
• frontend:files: add global task cancellation action (8a044bd)
• frontend:files: cancel uploads from tasks sidebar (b01dc90)
• frontend:files: limit concurrent uploads (81a95bc)
• frontend:files: track queued uploads and throttle progress updates (a0ff216)

Bug Fixes

• backend:auth: disable insecure OIDC requests by default (9e59a09)
• backend:auth: disable LDAP local password fallback by default (d57c42d)
• backend:auth: disable OIDC local password fallback by default (315fc75)
• backend:auth: enforce 2FA and isolate JWT token types (3ec74e2)
• backend:auth: harden OIDC avatar synchronization (5024afa)
• backend:auth: increment failed attempts for 2FA-enabled users (b13a4aa)
• backend:auth: prevent 2FA password attempt counter bypass (5f53f7f)
• backend:auth: tolerate OIDC avatar downloads using maxSize guard (597afbf)
• backend:auth: update failed login attempts atomically (285b870)
• backend:auth: validate current user state for active sessions (1022355)
• backend:config: make logger optional and quote sensitive YAML values (5390ba9)
• backend:config: normalize quoted admin credentials (5fea5b4)
• backend:config: support single-quoted environment values (715e761)
• backend:files: align HEAD and GET encoding for downloads (67667f6)
• backend:files: centralize path containment checks (e96c3f1)
• backend:files: clean orphan task files (0d4b306)
• backend:files: clean up task watchers on module shutdown (0ccf212)
• backend:files: enforce storage quota during archive extraction (8fffc17)
• backend:files: extend scheduler cleanup to stale user tmp files (c115ec2)
• backend:files: harden archive extraction and clean up partial output (9615ed0)
• backend:files: improve filtered file selection behavior (3ab86bc)
• backend:files: stage archive extraction in user temp directory (06f1425)
• backend:files: stage downloads and archives in user tmp paths bef...

⭐ Highlights

• Integrated Markdown editor: visual/source Markdown editing with tables, task lists, images, code blocks, file locking and unsaved-change protection
• Unified editor search: shared search UI for text and Markdown editors, with result count and previous/next navigation
• Configurable document creation: administrators can show or hide OpenDocument and Microsoft Office templates
• Optional trash retention: automatic cleanup can now be configured separately for user spaces and collaborative spaces
• Improved content indexing: more memory-efficient full-text indexing, batched metadata processing and safer cleanup
• OIDC/LDAP synchronization extended: OIDC avatar synchronization and storage quota synchronization through LDAP attributes or OIDC claims
• User visibility controls: users without a group can now be hidden from global visibility with showUngroupedUsers: false
• Text and Markdown editing improvements: better text file detection and increased edit size limit from 10 MB to 25 MB

🐞 Bug Fixes

• Guest link temporary paths: temporary paths for accounts associated with guest links are now created correctly
• File storage consistency: stronger uniqueness checks prevent rare duplicate file storage cases (@zjean)
• More reliable file unlocking: editable file locks are now released more reliably when editors or the browser are closed
• MIME type updates: MIME types are now recalculated after file rename, move or replacement
• Disabled space trash handling: trash for disabled spaces is now shown as disabled and can no longer be browsed
• Improved file selection: range selection works more reliably with filtering enabled
• Safer renaming: renaming now selects only the file name, without the extension
• Web interface polish: sidebar submenu visibility, table row height, dialog spacing and viewer tooltips were refined

⚠️ Security

• Trash immutability for spaces
  Files in the trash are now treated as read-only items. Modifying files in the trash and creating new files there are now blocked.

• More reliable uploads
  Failed uploads are no longer kept in the destination space. File replacements now use temporary files before replacing the destination.

• Better guest link isolation
  Accounts created from guest links now have restricted visibility over users and groups, limited to their managers and personal groups.

• Fixed a security vulnerability: CVE-2026-47684
  SSRF protection for URL downloads has been strengthened, notably against IPv4-mapped IPv6 bypasses, DNS rebinding, unsafe redirects, proxy bypasses and oversized data streams.
  Reported by @x0root

Contributors: @Stephan-P, @7185, @q16marvin, @zjean, @fyr77, @TheLouD1, @markussbk, @Maxmystere, @romainsady

➡️ Read the release announcement

Features

• backend:auth: allow trusted private IPs for OIDC avatar downloads (9c9b682)
• backend:auth: harden OIDC avatar sync and add avatar metadata tracking (22ac4f0)
• backend:auth: map configurable OIDC/LDAP storage quota to user profile (76b4b8c)
• backend:files: enable HTML-to-text conversion for all base elements (6352393)
• backend:files: optimize content indexing memory usage with batched metadata, run_id cleanup, and pending scheduler state (3d819cd)
• backend:files: prevent file mutations in trash repository (738402c)
• backend:files: split trash retention by repository type (1c490ee)
• backend:files: support trusted private IP downloads (44261ea)
• backend:files: trash retention support with indexing and cleanup (c990335)
• backend:users: add avatar synchronization for OIDC users (8790c19)
• backend:users: add showUngroupedUsers toggle for ungrouped account visibility (2fad377)
• backend:users: convert uploaded avatars to PNG during update (47af28b)
• backend:users: hide all users and groups for guest-link accounts (c5e1988)
• files: add a disabled indexing state and update scheduler/admin indexing workflows (f7fc4f1)
• files: add optional document types for frontend (7e8f64f)
• frontend:files: add binary probe for unknown text files (fea9e17)
• frontend:files: implement common file viewer search (ae3866e)
• frontend:files: improve markdown detection and viewer handling (3d2d871)
• frontend:files: refine file actions for trash and selection menus (666d661)
• frontend:files: refresh MIME metadata after move (bb85795)
• frontend:files: select filename without extension when renaming files (163b5c9)
• frontend:files: start implementing markdown viewer editor (f36a2bc)
• frontend:files: WIP markdown viewer editor (c2bf44f)

Bug Fixes

• backend:files: harden multipart upload replacement (c63f83c)
• backend:files: harden remote downloads against SSRF, redirects, proxy bypasses and oversized streams (22e773e)
• backend:files: make space file lookup resilient to stale kind (5f64673)
• backend:links: ensure tmp path is created after authentication for guest links (d782aaa)
• backend:spaces: invalidate spaces cache when space state changes (0c95836)
• backend:users: restrict usersWhitelist so guests only see shared-group or managed users (17fd9ba)
• backend:users: unify avatar rendering to 512px and tune dynamic font scaling (6ecd91d)
• files,comments: prevent duplicate file rows and handle undefined fileId (c04adef)
• frontend:admin: adjust group dialog spacing (c30b72d)
• frontend:admin: allow admins to see all users when selecting members in spaces and child shares (cba4eeb)
• frontend:auth: handle impersonation logout without token refresh retry and force fallback logout on error (ead2508)
• frontend:files: unlock extensionless text files on viewer close (9595153)
• frontend:files: fix range file selection when filtering is enabled (43125d5)
• frontend:files: hide PDF viewer toggle label on mobile (9d1154e)
• frontend:files: initialize file selection after dialog view init (9d0fe08)
• frontend:files: prevent stale save tooltip in viewers (70b3b98)
• frontend:files: release editable viewer lock on destroy (5fdc7b2)
• frontend:files: unlock text editors on page unload ([4f9025e](4f9025e...

Security

• deps: update Fastify to 5.8.5 to address CVE-2026-33806

Features

• admin: add indexing box to admin tools (8686147)
• backend:files: treat "_" as a term boundary in regex search (bcd3577)

Bug Fixes

• backend:files: add support for page rotation during OCR extraction (6837cc4)
• backend:files: handle axios content-length header as number-safe value (3599ccb)

⭐ Highlights

• Full-text search upgrade: PDF OCR indexing and Markdown content indexing
• Admin improvements: spaces can now be created/managed from the administration UI, with direct quota management
• New file event system: automatic storage usage recalculation and full-text reindexing
• Guest management enhancement: managers can now administer guests’ personal groups from profile settings
• LDAP support extended with tlsOptions (including ca, rejectUnauthorized, etc.)
• Better PDF experience: pdf.js is now the default viewer, with edit-mode fallback to OnlyOffice. Thanks @zjean
• Reliability : indexing scheduler concurrency fix, cache/WebDAV/URL fixes.

⚠️ Security

• Basic Auth security hardening
  The cache key is now based on a hash, eliminating case-related collisions and preventing the storage of decodable identifiers.
  Thanks @zalo-alex and @naif-alfardan

• Fixed a security vulnerability: CVE-2026-41161 GHSA-43fj-qp3h-hrh5
  A flaw allowed user account enumeration via the login endpoint through response time analysis, particularly in brute-force scenarios.
  Reported by @ppfeister, fixed by @7185

➡️ Read the release announcement

Features

• admin: allow managing spaces from the admin section (9822209)
• backend:auth: add tlsOptions support for ldap provider (2042ade)
• backend:files: add indexing support for markdown files (abf59e7)
• backend:files: add pdf ocr indexing (d37c531)
• backend:files: add support for configurable OCR language paths (48443aa)
• backend:files: align emitted FileEvent actions with real file mutations (e0c7175)
• backend:files: emit file event on document modification (e7ed38c)
• backend:files: extend indexing key generation for anchored roots (824bff8)
• backend:files: implement file event manager (c9951d7)
• backend:files: implement incremental indexing triggers for full-text search (468c1c3)
• backend:infrastructure: allow null or undefined args in cache key slug generation (9d661ea)
• backend:users: allow searching groups by description (434bd30)
• frontend:admin: show cumulative storage usage for users and spaces (5af4996)
• frontend: extend group parent model with description and adjust anchor file dialog layout (01bc72b)
• users: allow to manage personal groups from the guest profile dialog (c5d3c70)

Bug Fixes

• backend:auth: derive basic auth cache key from hashed credentials instead of Authorization header (be98def)
• backend:auth: prevent user enumeration via timing attacks (80eebf3)
• backend:files: ensure content indexing scheduling has no parallel executions (0bef5a6)
• backend:files: ensure storage quota is updated in cache (030b87e)
• backend:files: handle locks without scope in checkConflicts (f9bcbde)
• backend:files: handle optional chaining in indexing key generation (2b2c238)
• backend:users: ensure whitelist cache entries with parameters are properly cleared (5e21b8d)
• backend:users: handle guest login rename without space location rename (2627d2d)
• backend:users: sanitize group and app password names for safe route params (d1b21a8)
• backend:webdav: restore access to shares repository via WebDAV (bec04e1)
• files: encode special characters not handled by AuthInterceptor (d9e81f0)
• files: handle document-open error messages for HEAD requests (328d823)
• frontend:users: add button behavior inside groups (d13132a)
• users: ensure guests cannot be elected as group managers (24e0d57)