Back to Catalog
ownCloud Infinite Scale logo

ownCloud Infinite Scale

The new cloud-native file sync and share platform from ownCloud

app

Alternative to: dropbox, google drive, box

Repository Docs
About Versions (100)
Back to Versions

v8.0.5

2026-06-19

Table of Contents

Changes in 8.0.5

Summary

  • Security - Bump Go to 1.25.11: #12446
  • Security - Upgrade libvips to 8.18.3: #12446
  • Bugfix - Education user delete no longer 404s and leaves the LDAP entry behind: #12395
  • Bugfix - Recover from permanently-closed NATS connections in the nats-js-kv store: #12401

Details

  • Security - Bump Go to 1.25.11: #12446

    Fixes CVE-2026-42504, a stdlib MIME header decoding vulnerability flagged by the release image scan.

    https://github.com/owncloud/ocis/pull/12446

  • Security - Upgrade libvips to 8.18.3: #12446

    Bumped libvips to 8.18.3 in all Docker images. The previous pin (8.18.2-r0) was dropped from the Alpine edge/community repository, which broke the image build.

    https://github.com/owncloud/ocis/pull/12446

  • Bugfix - Education user delete no longer 404s and leaves the LDAP entry behind: #12395

    DELETE /graph/v1.0/education/users/{id} previously returned a 404 without removing the user. The education user delete handler used user.GetExternalID() for the backend DELETE, while the regular /users handler and the pre-v8.0 code path used user.GetId(). With the default RequireExternalID=false, the LDAP backend looked up the user by name-or-UUID, so the externalID never matched, the LDAP entry was never removed, and the response was a 404. This is now fixed.

    https://github.com/owncloud/ocis/pull/12395

  • Bugfix - Recover from permanently-closed NATS connections in the nats-js-kv store: #12401

    The nats-js-kv go-micro store plugin’s hasConn() only checked whether the connection object was non-nil, not whether it was still alive. Once the underlying NATS client exhausted its reconnect attempts (e.g. a NATS pod restart longer than the client’s reconnect window), the connection stayed non-nil but permanently closed. Because connection initialization is gated on !hasConn(), it never re-ran, so every subsequent KV operation failed with nats: connection closed until the affected pod was restarted.

    This surfaced as several user-visible failures backed by the NATS KV cache, e.g. all spaces becoming invisible (storage-users ListStorageSpaces) and download failures from missing signing keys (ocs).

    The store plugin now treats a closed connection as no connection, so the next operation transparently re-initializes it.

    https://github.com/owncloud/ocis/pull/12401

Changelog on GitHub →