Table of Contents

• Changelog for 8.0.6

Changes in 8.0.6

Summary

• Security - Upgrade libvips to 8.18.4: #12596
• Security - Upgrade Go to 1.25.12: #12602
• Enhancement - Allow disabling the last sign-in timestamp update: #12522

Details

• Security - Upgrade libvips to 8.18.4: #12596

  Bumped libvips to 8.18.4 in all Docker images. The previous pin (8.18.3-r0) was dropped from the Alpine edge/community repository, which broke the image build.

  https://github.com/owncloud/ocis/pull/12596

• Security - Upgrade Go to 1.25.12: #12602

  Bumped the Go toolchain used to build the release binaries and Docker images from 1.25.11 to 1.25.12. Go 1.25.11 is affected by CVE-2026-39822 (os.Root symlink following allows directory traversal), which is fixed in 1.25.12 and was blocking the release image security scan.

  https://github.com/owncloud/ocis/pull/12602

• Enhancement - Allow disabling the last sign-in timestamp update: #12522

  The graph service maintains the ‘oCLastSignInTimestamp’ LDAP attribute of a user on every sign-in (when the LDAP identity backend has write access). This can cause a significant amount of LDAP write load, especially when the proxy’s OIDC userinfo cache has a short TTL and sign-in events are emitted frequently.

  A new setting ‘OCIS_LDAP_UPDATE_LAST_SIGNIN_DATE’ / ‘GRAPH_LDAP_UPDATE_LAST_SIGNIN_DATE’ (default ‘true’) allows disabling the update of the last sign-in timestamp without having to disable all LDAP writes (‘OCIS_LDAP_SERVER_WRITE_ENABLED’) or the graph events consumer. When set to ‘false’ the graph service no longer listens for ‘UserSignedIn’ events and does not write the ‘oCLastSignInTimestamp’ attribute.

  https://github.com/owncloud/ocis/issues/9942 https://github.com/owncloud/ocis/pull/12522