Table of Contents

• Changelog for 8.2.0

Changes in 8.2.0

Summary

• Security - Do not leak internal error details in webdav error responses: #12398
• Security - Make OIDC group sync opt-in: #12490
• Security - Block password and account changes via PATCH /graph/v1.0/me: #12493
• Bugfix - Always set an audit action for share updates: #7661
• Bugfix - Fix the proxy readiness check for NATS: #10661
• Bugfix - Honor $select=actions on the drive item permissions endpoint: #10816
• Bugfix - Keep group memberships when the OIDC groups claim is absent: #11435
• Bugfix - Pass the space ID when purging revision blobs: #11644
• Bugfix - Return 404 when deleting a non-existing link share on a space: #12266
• Bugfix - Fix PostgreSQL container restart loop in Keycloak deployments: #12359
• Bugfix - Prevent panic in presigned URL auth when signing key is missing: #12384
• Bugfix - Fix double HTML-escaping of notification emails for multiple recipients: #12413
• Bugfix - Re-verify access tokens with an expired userinfo cache entry: #12414
• Bugfix - Keep shares visible in sharedWithMe when a resource cannot be statted: #12430
• Bugfix - Ensure the redirect URI for the IDP is valid: #12444
• Bugfix - The auth-app will create the user’s home if needed: #12457
• Bugfix - Fix the empty mount ID for reva config: #12492
• Bugfix - Rate-limit the exportPersonalData endpoint: #12516
• Bugfix - Apply the role allowlist on permission updates: #12540
• Bugfix - Restore hover feedback in high-contrast and dark themes: #12613
• Bugfix - Preserve accessibility focus in the file versions sidebar: #12630
• Bugfix - Fix low-contrast form controls in dark and vault themes: #12639
• Bugfix - Stop breadcrumb items from being announced twice: #12643
• Bugfix - Remove unneeded keyboard focus stops: #12645
• Bugfix - Fix keyboard navigation in “New” and “Upload” dropdown menus: #12646
• Bugfix - Announce IDP sign-in errors and fix keyboard use: #12649
• Bugfix - Show vault-shared mountpoints in the vault drive list: #12656
• Bugfix - Prevent deleting your own account in the user management: #12661
• Bugfix - Log unmapped thumbnail errors and always report a sabredav exception: #12667
• Bugfix - Fix concurrent map access when listing shares: #12673
• Bugfix - Keep bind config in sync when resetting a service user password: #12716
• Bugfix - Allow renaming, moving and editing files with the editor-lite role: #12721
• Bugfix - Fix invisible group icon in share collaborator list: #12722
• Bugfix - Return correct issuerAssignedId on /me: #12727
• Bugfix - Vault navigation labels not updating on switch: #12729
• Bugfix - Do not collide vault and non-vault share mountpoints: #12730
• Bugfix - Remove keyboard focus from open file name in top bar: #12752
• Enhancement - Replace embedded IDP React SPA with server-rendered login page: #12086
• Enhancement - Add ocis shares clean-corrupt-public-shares maintenance command: #12494
• Enhancement - Harden OCM create share: #12496
• Enhancement - Clean up the deployment examples: #12521
• Enhancement - Allow disabling the last sign-in timestamp update: #12522
• Enhancement - Add configurable software license and help page links: #12528
• Enhancement - Configurable logo click-through URL: #12529
• Enhancement - Add option to disable public link sharing: #12542
• Enhancement - Add option to disable direct (user/group) sharing: #12542
• Enhancement - Add audience restriction for OIDC access tokens: #12581
• Enhancement - Eliminate redundant LDAP read-after-write on create and update: #12618
• Enhancement - Improve page structure on several pages: #12637
• Enhancement - Show the select-all checkbox label in tile view: #12640
• Enhancement - Retry LDAP operations against a lagging replica: #12672
• Enhancement - Add an opt-in bounded LDAP connection pool: #12688
• Enhancement - Bump dependencies: #12766

Details

• Security - Do not leak internal error details in webdav error responses: #12398

  The webdav service returned raw internal error messages to the client when a server-side error occurred. For example, a thumbnail request with a null byte in the filename and ?preview=1 could trigger a 500 Internal Server Error whose body exposed the internal storage filesystem path (information disclosure).

  Server-side error handlers now return a generic, user-relevant message to the client, while the detailed error is only logged server-side.

  https://github.com/owncloud/ocis/pull/12398

• Security - Make OIDC group sync opt-in: #12490

  What changed. PROXY_AUTOPROVISION_CLAIM_GROUPS now defaults to "", which disables OIDC group membership sync (and, with it, creation of local groups from claim values). It previously defaulted to groups. Setting it to a non-empty claim name restores the previous behaviour unchanged: memberships are synced and groups named in the claim are created if they do not exist locally.

  Why. With PROXY_AUTOPROVISION_ACCOUNTS=true and the previous groups default, the proxy synced group memberships from the OIDC groups claim on every authenticated request out of the box, creating local groups for any claim value that did not already exist. In identity providers that let ordinary users create groups with arbitrary names, this allowed an unprivileged user to inject group names into oCIS. Defaulting the claim to empty makes group sync an explicit opt-in.

  Upgrade note. Deployments that set PROXY_AUTOPROVISION_CLAIM_GROUPS explicitly are unaffected. Deployments that relied on the previous groups default without setting it will stop syncing group memberships after upgrade; set PROXY_AUTOPROVISION_CLAIM_GROUPS=groups to restore the previous behaviour.

  Note: matching claim values to existing local groups is still done by display name. Hardening that matching is tracked separately and is not part of this change.

  https://github.com/owncloud/ocis/pull/12490

• Security - Block password and account changes via PATCH /graph/v1.0/me: #12493

  PATCH /graph/v1.0/me no longer accepts passwordProfile, accountEnabled, or onPremisesSamAccountName. Use POST /graph/v1.0/me/changePassword to change your password.

  https://github.com/owncloud/ocis/pull/12493

• Bugfix - Always set an audit action for share updates: #7661

  Share-update audit events were written with an empty action and a message of updated field '', because the conversion read the deprecated ShareUpdated.Updated field, which reva no longer populates (it now sets UpdateMask). Received-share declines were also not audited correctly because the conversion matched SHARE_STATE_DECLINED, which is not a CS3 share state (the enum value is SHARE_STATE_REJECTED), again producing an empty action and message.

  The conversion now derives the updated field and action from UpdateMask (falling back to the deprecated field), maps SHARE_STATE_REJECTED to the declined action, and uses a generic, non-empty action for any unrecognized update field or share state, so every audit entry carries a meaningful, countable action.

  https://github.com/owncloud/ocis/issues/7661 https://github.com/owncloud/ocis/pull/12423

• Bugfix - Fix the proxy readiness check for NATS: #10661

  The proxy readiness check passed the events cluster ID instead of the events endpoint to the NATS reachability check. NATS then tried to resolve the cluster ID (e.g. ocis-cluster) as a host name, which always failed, so the proxy /readyz endpoint reported the service as not ready even when NATS was reachable. The check now uses the events endpoint, consistent with every other service.

  https://github.com/owncloud/ocis/issues/10661 https://github.com/owncloud/ocis/pull/12421

• Bugfix - Honor $select=actions on the drive item permissions endpoint: #10816

  Listing the permissions of a drive item with $select=@libre.graph.permissions.actions.allowedValues still returned the roles allowedValues as well. The handler only had a projection for the roles selection (@libre.graph.permissions.roles.allowedValues), which drops the actions, but no symmetric handling for an actions-only selection, so the roles were always included. The actions selection now drops the roles allowedValues (and, like the roles selection, skips the share lookup since only the allowed values are requested).

  https://github.com/owncloud/ocis/issues/10816 https://github.com/owncloud/ocis/pull/12419

• Bugfix - Keep group memberships when the OIDC groups claim is absent: #11435

  When auto-provisioning group memberships from an OIDC claim, the proxy reconciled the user’s groups against the groups claim and removed them from any group not present in the claim. If a token carried no groups claim at all — for example a token issued for an OIDC client that has no groups mapper configured, such as a dedicated desktop-client registration — the parsed group set was empty and the user was removed from all of their groups.

  The sync is now skipped when the groups claim is absent or null in the token. A present-but-empty claim is still treated as a legitimate “no groups” and reconciled as before. This mirrors the guard the role-assignment path already has for a missing roles claim.

  https://github.com/owncloud/ocis/issues/11435 https://github.com/owncloud/ocis/pull/12420

• Bugfix - Pass the space ID when purging revision blobs: #11644

  The revisions purge command removed a revision’s metadata but did not delete its blob, because it called the blobstore without the space ID. The blobstore builds the blob path from the space ID and blob ID, so an empty space ID targeted the wrong path: the deletion was a no-op (S3) or missed the file (POSIX), leaving the blob orphaned while the revision was already removed. The space ID parsed from the revision path is now passed to the blobstore.

  https://github.com/owncloud/ocis/issues/11644 https://github.com/owncloud/ocis/pull/12422

• Bugfix - Return 404 when deleting a non-existing link share on a space: #12266

  Deleting an already-removed link share via DELETE /graph/v1beta1/drives/{driveID}/root/permissions/{permissionID} returned 400 Bad Request instead of 404 Not Found. The underlying reva RemovePublicShare and RemoveShare handlers now propagate not-found errors as CODE_NOT_FOUND rather than CODE_INTERNAL, ensuring the correct 404 HTTP response is returned.

  https://github.com/owncloud/ocis/issues/12266

• Bugfix - Fix PostgreSQL container restart loop in Keycloak deployments: #12359

  The PostgreSQL volume was mounted directly at /var/lib/postgresql/data. On ext4 storage backends, Docker creates a lost+found directory at the volume root, causing PostgreSQL’s initdb to fail because the data directory is not empty. This resulted in the container entering a restart loop.

  The volume mount path has been changed to /var/lib/postgresql so that PostgreSQL creates the data/ subdirectory itself, avoiding the conflict.

  https://github.com/owncloud/ocis/pull/12359

• Bugfix - Prevent panic in presigned URL auth when signing key is missing: #12384

  The presigned-URL authenticator read the per-user signing key from a store and indexed the first record without checking that the result was non-empty. When the store returns an empty result without an error — which the noop store does, and OCIS_CACHE_STORE=noop also switches the presigned-URL signing-key store to noop — every signed-URL request panicked with index out of range [0] with length 0 (recovered per request as an HTTP 502), so all signed-URL downloads failed. The authenticator now guards the lookup and returns a normal authentication error instead of panicking; it also no longer returns a nil error when the stored key is empty.

  https://github.com/owncloud/ocis/issues/12384 https://github.com/owncloud/ocis/pull/12418

• Bugfix - Fix double HTML-escaping of notification emails for multiple recipients: #12413

  The notifications service reuses the same template variables map for every recipient of an event (for example when a group is invited to a space). The helper that HTML-escapes those variables for the HTML email body escaped the map in place, so every recipient after the first received a plain-text body containing HTML entities and an HTML body with one additional layer of escaping per recipient (a space named R&D became R&D). The helper now returns a new map and leaves the shared variables untouched, so every recipient renders from the original values.

  https://github.com/owncloud/ocis/pull/12413

• Bugfix - Re-verify access tokens with an expired userinfo cache entry: #12414

  The proxy authenticated requests against a cached userinfo entry. When the cached entry’s expiry had passed, the request was rejected outright instead of re-verifying the access token. The cached expiry is not always the real token expiry — for opaque access tokens it falls back to the configured cache TTL — so a still-valid token could be rejected just because its cache entry aged out, causing spurious logouts (most noticeable under frequent PROPFIND requests). The proxy now treats an expired cache entry as a cache miss and re-verifies the access token, while a genuinely expired or invalid token is still rejected by the re-verification.

  https://github.com/owncloud/ocis/pull/12414

• Bugfix - Keep shares visible in sharedWithMe when a resource cannot be statted: #12430

  The graph sharedWithMe handler resolves each received share by fanning out a per-resource Stat call with a concurrency limit, all sharing the request context. When a Stat failed for any reason (slow or stuck downstream, deleted space, gateway error, deadline exceeded) the worker logged at debug and returned without emitting a drive item, so the share was silently omitted from the response and the handler still returned 200 OK with a partial, non-deterministic list. A single chronically-slow share could therefore make other, recently-accepted shares intermittently invisible, and repeated calls returned different subsets of the user’s shares.

  The handler now:

  • bounds each per-share Stat with its own timeout derived from the request context, so one slow resource can no longer consume the deadline shared by all the other shares. The bound is configurable via GRAPH_RECEIVED_SHARES_STAT_TIMEOUT (default 10s); - returns a degraded drive item built from the data already present in the share record (ids, permissions, grantees, timestamps, mountpoint name) when the resource cannot be statted due to a transient or indeterminate failure (timeout, slow or unavailable downstream), so the share stays visible instead of intermittently disappearing. A genuinely missing resource or revoked access (for example after the sharer was deleted) still drops the share, as before; - logs the dropped/degraded shares at warning level with a per-request count for operator visibility.

  https://github.com/owncloud/ocis/pull/12430

• Bugfix - Ensure the redirect URI for the IDP is valid: #12444

  The URI sent as redirect URI for the IDP will be validated in oCIS. Invalid URIs will return a 500 error. Note that this should never happen under normal circumstances.

  https://github.com/owncloud/ocis/pull/12444 https://github.com/owncloud/ocis/pull/12479

• Bugfix - The auth-app will create the user’s home if needed: #12457

  When the user logs in, his home must be created. This happens automatically during login via OIDC (web access). Some recent changes in the code broke this behavior when the user logs in via auth-app. Now, this behavior is restored, and the user’s home will be created when the user logs in via auth-app.

  https://github.com/owncloud/ocis/pull/12457

• Bugfix - Fix the empty mount ID for reva config: #12492

  We fixed the empty mount ID for storage-users

  https://github.com/owncloud/ocis/pull/12492

• Bugfix - Rate-limit the exportPersonalData endpoint: #12516

  We’ve added a rate limit to the exportPersonalData endpoint to mitigate an authenticated application-level denial-of-service. Rate-limit per endpoint path carries the userID, so effectively per user. The endpoint is now limited to 5 requests per minute.

  https://github.com/owncloud/ocis/issues/12516

• Bugfix - Apply the role allowlist on permission updates: #12540

  The PATCH permission and space-root permission handlers now consult the administrator role allowlist when validating a request, consistent with the invite handler.

  https://github.com/owncloud/ocis/pull/12540

• Bugfix - Restore hover feedback in high-contrast and dark themes: #12613

  The Light and Dark High-Contrast themes set the background-highlight color token equal to the default page background, making hover backgrounds indistinguishable from the resting background wherever background-highlight was used for interactive feedback, such as the global search results dropdown. The non-high-contrast Dark theme had the same collision.

  Background-highlight now matches background-hover in the affected theme definitions, and the search results dropdown and create-shortcut context menu now use the background-hover color directly for their hover and active states, since background-highlight is otherwise used for static surfaces like cards, modals and form fields rather than interaction feedback.

  https://github.com/owncloud/ocis/pull/12613

• Bugfix - Preserve accessibility focus in the file versions sidebar: #12630

  Opening the file versions panel with a keyboard or screen reader could move focus to the main page, and restoring a version could briefly move focus to the main page before selecting the sidebar’s back button. The sidebar now manages focus throughout panel transitions and loading states, restores focus to the control that opened it when closed, and returns focus to the restored version’s Restore button after the operation completes. Version dates and action labels also provide clearer context for screen reader users without duplicate announcements or additional tab stops.

  https://github.com/owncloud/ocis/pull/12630

• Bugfix - Fix low-contrast form controls in dark and vault themes: #12639

  Several form controls were hard to see against dark and vault theme backgrounds. The view-options range slider had no visible track border and relied on an opacity dip on hover, making it barely visible at rest. The switch component’s off-state track and thumb, and its on-state thumb, used colors too close to their surrounding background to read as a toggle. The select combobox’s highlighted/selected option text used a color too close to the highlight background.

  The global search input’s text color was forced with !important, overriding the theme-specific search text color some themes set, which made typed text render in white on a white search input background in the vault “Dark Theme – High Contrast”. The search placeholder color also used an invalid CSS custom property fallback (a bare property name instead of a nested var()), silently breaking the placeholder color for any theme that didn’t define a search-specific placeholder token, and the vault “Dark Theme“‘s placeholder color was too close to its input’s text and border color to read as muted.

  The slider now has a visible border and no longer dims on rest, the switch and select now use colors with sufficient contrast against their backgrounds, the !important override blocking theme-specific search colors has been removed, the invalid placeholder fallback has been fixed, and the vault “Dark Theme” placeholder color has been changed to one with visible contrast against the input text.

  https://github.com/owncloud/ocis/pull/12639

• Bugfix - Stop breadcrumb items from being announced twice: #12643

  Each breadcrumb list item had tabindex="0", putting the item itself in the keyboard/screen reader focus order in addition to the link or button nested inside it. This caused every breadcrumb segment to be announced twice in a row. The list item is no longer a separate focus stop; only its inner link or button is, while the item remains focusable enough for existing drag-and-drop styling to keep working.

  https://github.com/owncloud/ocis/pull/12643

• Bugfix - Remove unneeded keyboard focus stops: #12645

  Some icons and date columns in tables (spaces list, file list) could unexpectedly receive keyboard focus even though they don’t trigger any action, adding unnecessary stops when tabbing through the page. The contextual helper icon also carried a label that duplicated the label already present on its surrounding button. These redundant focus stops and duplicate labels have been removed.

  https://github.com/owncloud/ocis/pull/12645

• Bugfix - Fix keyboard navigation in “New” and “Upload” dropdown menus: #12646

  Opening the “New” or “Upload” dropdown menu in the Files app toolbar did not move focus into the menu, so pressing the arrow keys had no effect on the highlighted item, unlike the existing right-click context menu. Both dropdowns now focus their first item on open, restoring arrow key navigation.

  https://github.com/owncloud/ocis/pull/12646

• Bugfix - Announce IDP sign-in errors and fix keyboard use: #12649

  The login, consent, and account chooser pages did not announce error messages when they appeared, and invalid username/password fields gave no indication of their error state. The consent screen’s scope list also had no programmatic link between each entry and its checkbox, and the account chooser’s “continue as” and “use another account” entries could not be reached or activated with a keyboard. A visible focus outline on the login form’s input fields had also been removed with no replacement. All of these have been fixed.

  https://github.com/owncloud/ocis/pull/12649

• Bugfix - Show vault-shared mountpoints in the vault drive list: #12656

  Shares of vault resources are mountpoints hosted on the shares storage provider that grant into the vault storage provider. When listing spaces with the vault storage_id, the storage registry skipped the shares provider entirely, so the vault share mountpoint was missing from the vault drive list while still showing up in the regular drive list.

  The registry now also queries the shares provider when the vault storage id is requested and segregates share mountpoints by their grantStorageID, so a vault share only appears in the vault drive list and a regular share only in the regular one.

  https://github.com/owncloud/ocis/pull/12656 https://github.com/owncloud/reva/pull/670

• Bugfix - Prevent deleting your own account in the user management: #12661

  In the admin settings user management, the account you are currently logged in as could be selected and included in a delete action, even though the backend always rejects self-deletion. Deleting a selection that included your own account produced a “Failed to delete 1 user” error and made your own row temporarily disappear from the list until the page was refreshed.

  The delete action now excludes the current user from the request, so all other selected users are deleted while your own account is left untouched. When your own account is part of the selection, the delete confirmation dialog shows a hint that it will not be deleted.

  https://github.com/owncloud/ocis/issues/12582 https://github.com/owncloud/ocis/pull/12661

• Bugfix - Log unmapped thumbnail errors and always report a sabredav exception: #12667

  The webdav service logged failures of the thumbnails service at debug level only. Errors which are not a property of the requested file, such as the thumbnails service being unreachable, were therefore invisible at production log levels: a complete preview outage produced HTTP 500 responses without a single log line explaining them. Unmapped errors are now logged at error level, while expected per-file outcomes such as an unsupported file type or a file still being processed stay at debug level. Two of the four thumbnail handlers also logged without the request context, so their messages carried no request id.

  In addition, codesEnum only mapped four status codes, so error responses for all other codes were rendered with an empty <s:exception></s:exception> element. The missing entries for 403, 425 and 429 have been added and any remaining unmapped code now falls back to a generic exception name, so clients always receive a usable exception.

  https://github.com/owncloud/ocis/pull/12667

• Bugfix - Fix concurrent map access when listing shares: #12673

  Listing shares could abort the whole oCIS process with the Go runtime error “fatal error: concurrent map read and map write”. This is an unrecoverable runtime fault, so it could not be caught and recovered from, and it dropped all connections that were in flight at that moment.

  When converting CS3 shares into Graph DriveItems, the worker goroutines read from the shared driveItems map while the collecting loop was already writing results into the very same map. The results channel is buffered, so the workers never blocked when handing over an item and the collecting loop started writing while workers were still running. The results are now collected after all workers have finished, which removes the overlapping access.

  Note that lowering the maximum concurrency did not avoid this, as a single worker could still run concurrently with the collecting loop.

  https://github.com/owncloud/ocis/pull/12673

• Bugfix - Keep bind config in sync when resetting a service user password: #12716

  Resetting an IDM service user password with ocis idm resetpassword --user-type service only changed the entry in the IDM directory. Services such as auth-basic, users and groups still bound to LDAP as the reva service user using the old bind_password from their configuration, so after a restart those binds failed and regular admin login started returning 401 Unauthorized.

  The command now rewrites the matching bind_password and service_user_passwords keys in ocis.yaml when it is present, and always prints the environment variables that must carry the new password for env-var and distributed deployments it cannot rewrite.

  https://github.com/owncloud/ocis/issues/12569 https://github.com/owncloud/ocis/pull/12716

• Bugfix - Allow renaming, moving and editing files with the editor-lite role: #12721

  We’ve fixed the editor-lite role (“Can edit” in the web UI). Sharees can now rename a file inside a shared folder, move it and change its contents. Before, they could only upload new files, and the web UI offered neither the rename nor the overwrite action.

  The role has always granted Move, but the persisted ACE format had no flag of its own for it: Move shared the “w” flag with InitiateFileUpload and was only recovered on read by assuming a grant may move whenever it may write, download and delete. The editor-lite role has no delete, so its Move was dropped as soon as the grant was written to disk, Decomposedfs.Move then refused the rename and propfind reported the grant as a create-only uploader. Move is now persisted under its own “m” flag in pkg/storage/utils/ace/ace.go; grants written before that flag existed carry no “m” and keep using the old inference. On top of that, RoleFromResourcePermissions in pkg/conversions/role.go did not treat Move as write, so the WebDAV permissions string lacked “NV” (rename) and “W” (overwrite) even for a grant that had kept its Move. Move now implies write for grants that do not carry delete, which leaves the OCS permissions of the deletable roles unchanged.

  Note: the effective permission set of the editor-lite role changed. The CS3 resource permissions returned by NewEditorLiteRole are unchanged - Stat, GetPath, ListContainer, InitiateFileDownload, InitiateFileUpload, CreateContainer and Move, still no Delete and no ListFileVersions - but a grant created from it is now stored as “txrwma” instead of “txrwa”, reports the OCS permissions 6 (create + write) instead of 4 (create), and reports the WebDAV permissions “SNVW” on a shared file and “SNVCK” on a shared folder instead of “S” and “SCK”.

  The same “m” flag also restores Move for any other non-deletable grant that carries it. In particular the Uploader share role is affected: like editor-lite it is a create grant without delete, so its Move used to be dropped on write-back and is now preserved. This is why the previously expected-to-fail “sharee moves a file within a shared folder” scenarios for the Uploader role now pass, and the matching entries were removed from tests/acceptance/expected-failures-API-on-OCIS-storage.md.

  This fix DOES NOT include a migration of stored grants. Shares created with that role before this update keep their old grant on disk, which carries no “m” flag. For them, Move stays unset and the WebDAV permissions string stays unchanged, while the share record itself has always kept Move and therefore already reports the new OCS permissions. Only shares created with that role AFTER THE UPDATE get the new permission set. Re-creating an affected share, or updating its role, re-writes the grant and picks up the fix.

  https://github.com/owncloud/ocis/issues/11977 https://github.com/owncloud/ocis/pull/12721 https://github.com/owncloud/reva/pull/689

• Bugfix - Fix invisible group icon in share collaborator list: #12722

  The icon shown next to group entries in the share collaborator autocomplete list used a color variable that no longer resolved to a valid value, making the icon effectively invisible against the background. The icon now uses the correct default text color variable so it renders properly again.

  https://github.com/owncloud/ocis/pull/12722

• Bugfix - Return correct issuerAssignedId on /me: #12727

  The /graph/v1.0/me endpoint reported the internal user UUID as identities[].issuerAssignedId instead of the issuer-assigned identity (the OIDC sub). The endpoint took a fast path that built the user model from the CS3 user in the request context, which does not carry the external identity, so it fell back to the internal UUID. /me now always resolves the user through the identity backend, which reads the stored external identity and returns the correct value. Group memberships are still only expanded when $expand=memberOf is requested.

  https://github.com/owncloud/ocis/pull/12727 https://github.com/owncloud/ocis/pull/12431 https://github.com/owncloud/ocis/pull/12411

• Bugfix - Vault navigation labels not updating on switch: #12729

  The Files app navigation labels for the personal space and spaces list sometimes kept showing the regular names instead of the vault-specific ones after switching into the vault, and vice versa. This happened because the vault detection only looked at the plain URL path and missed cases such as hash-based routes or the redirect right after logging in.

  The vault detection has been centralized and now also recognizes hash-based vault routes and the post-login redirect target, so the navigation labels correctly reflect whether the user is in the vault.

  https://github.com/owncloud/ocis/pull/12729

• Bugfix - Do not collide vault and non-vault share mountpoints: #12730

  Received shares mounted from the Vault storage and received shares mounted from regular drives were treated as one flat namespace when computing a unique mountpoint name. Sharing a resource with the same name once from a regular drive and once from the Vault caused the second one to get a spurious (1) suffix, even though the two shares are rendered in completely separate, segregated lists and never actually collide. Mountpoint name collisions are now only checked against other shares within the same vault/non-vault group.

  https://github.com/owncloud/ocis/pull/12730

• Bugfix - Remove keyboard focus from open file name in top bar: #12752

  When opening a file such as a text or markdown document, the file name shown in the top bar could be reached via keyboard tabbing even though it was not clickable and triggered no action. This made keyboard navigation confusing.

  The file name is no longer part of the tab order, since it is a purely informational, non-interactive element.

  https://github.com/owncloud/ocis/pull/12752

• Enhancement - Replace embedded IDP React SPA with server-rendered login page: #12086

  Replaced the embedded IDP login’s React SPA (pnpm, 21k LOC) with server-rendered HTML keeping theming and localiation support. The login page now works with minimal JavaScript, loads faster, and has a much smaller dependecy vulnerability surface.

  https://github.com/owncloud/ocis/pull/12086

• Enhancement - Add ocis shares clean-corrupt-public-shares maintenance command: #12494

  A single public-share entry with a nil/empty resource_id makes the json public-share manager’s ListPublicShares panic with a nil-pointer dereference. Because the manager reads all entries and filters them in memory, that one bad entry poisons the endpoint for the whole tenant: every Members/permissions panel load and every password-protected link creation fails.

  The new ocis shares clean-corrupt-public-shares command detects and removes such corrupt entries. It reads the raw persistence (so it never triggers the panic itself) and writes back through the same metadata storage path the manager uses, recomputing blob size, mtime and etag automatically. It defaults to --dry-run and supports the jsoncs3 and json public-share drivers.

  https://github.com/owncloud/ocis/pull/12494

• Enhancement - Harden OCM create share: #12496

  CreateShare now validates the provider via GetInfoByDomain and verifies an accepted invite relationship via GetAcceptedUser before creating the share.

  https://github.com/owncloud/ocis/pull/12496

• Enhancement - Clean up the deployment examples: #12521

  Removed the legacy deployment example oc10_ocis_parallel and its documentation references. Removed coverage.out

  https://github.com/owncloud/ocis/pull/12521

• Enhancement - Allow disabling the last sign-in timestamp update: #12522

  The graph service maintains the ‘oCLastSignInTimestamp’ LDAP attribute of a user on every sign-in (when the LDAP identity backend has write access). This can cause a significant amount of LDAP write load, especially when the proxy’s OIDC userinfo cache has a short TTL and sign-in events are emitted frequently.

  A new setting ‘OCIS_LDAP_UPDATE_LAST_SIGNIN_DATE’ / ‘GRAPH_LDAP_UPDATE_LAST_SIGNIN_DATE’ (default ‘true’) allows disabling the update of the last sign-in timestamp without having to disable all LDAP writes (‘OCIS_LDAP_SERVER_WRITE_ENABLED’) or the graph events consumer. When set to ‘false’ the graph service no longer listens for ‘UserSignedIn’ events and does not write the ‘oCLastSignInTimestamp’ attribute.

  https://github.com/owncloud/ocis/issues/9942 https://github.com/owncloud/ocis/pull/12522

• Enhancement - Add configurable software license and help page links: #12528

  Themes can now set common.urls.softwareLicense and common.urls.helpPage to surface deployment-specific legal/help links in the web UI. When set, links appear in a new “Help” menu in the topbar and on the account page.

  https://github.com/owncloud/ocis/pull/12528

• Enhancement - Configurable logo click-through URL: #12529

  We’ve added an optional href field to the logo theme configuration. When set, clicking the topbar logo navigates to the configured URL instead of the default files navigation. When not set, the existing default behavior is unchanged.

  https://github.com/owncloud/ocis/pull/12529

• Enhancement - Add option to disable public link sharing: #12542

  Added an OCIS_ENABLE_PUBLIC_SHARING config option, read by the frontend and sharing services. It defaults to true. When set to false, creating new public links is rejected and the files_sharing.public.enabled capability reports false so clients hide the corresponding UI. Direct sharing with users and groups is not affected.

  https://github.com/owncloud/ocis/pull/12542

• Enhancement - Add option to disable direct (user/group) sharing: #12542

  Added an OCIS_ENABLE_USER_SHARING config option, read by the frontend, graph, sharing and ocm services. It defaults to true. When set to false, creating new user, group or federated shares is rejected, the legacy sharees search endpoint returns no results, and the files_sharing.user.enabled and files_sharing.user_enumeration.enabled capabilities report false so clients hide the corresponding UI. Public link sharing and space membership are not affected.

  https://github.com/owncloud/ocis/pull/12542

• Enhancement - Add audience restriction for OIDC access tokens: #12581

  We added a new proxy configuration option PROXY_OIDC_ACCESS_TOKEN_VERIFY_AUD which lets operators restrict the JWT access tokens that are accepted to a list of allowed audiences. When set, a token is only accepted if one of the configured values is present in its aud (audience) claim or matches its azp (authorized party) claim. This is useful when the OIDC provider (IDP) is shared between multiple applications, so that tokens issued for another application are not accepted by ownCloud Infinite Scale.

  The check is disabled by default (empty list) to preserve the existing behavior.

  https://github.com/owncloud/ocis/pull/12581

• Enhancement - Eliminate redundant LDAP read-after-write on create and update: #12618

  The graph LDAP backend no longer re-reads an entry immediately after writing it just to recover the entry ID for the response. When oCIS generates the ID itself (GRAPH_LDAP_SERVER_UUID disabled), the create response is now synthesized from the data already sent to the directory, and update responses are built by folding the applied modifications onto the entry that was read before the write. This avoids a round-trip that, against a replicated directory reached through a proxy, could hit a lagging replica and fail or return stale data.

  When the directory assigns the ID (GRAPH_LDAP_SERVER_UUID enabled), creates keep the existing read-back, since the generated ID cannot otherwise be recovered.

  https://github.com/owncloud/ocis/pull/12618

• Enhancement - Improve page structure on several pages: #12637

  We’ve added missing main and footer regions to several pages (404, private link resolving, missing config, logout, access denied, public link resolving) for a more consistent page structure. We’ve also fixed the “Skip to main” link, which previously did nothing on pages using the plain layout (login, logout, public/private link pages) due to a missing target id and a stale cached DOM reference.

  https://github.com/owncloud/ocis/pull/12637

• Enhancement - Show the select-all checkbox label in tile view: #12640

  The label of the select-all checkbox in the resource tiles view is now visible, improving the user experience by making it clear what the checkbox is for.

  https://github.com/owncloud/ocis/pull/12640

• Enhancement - Retry LDAP operations against a lagging replica: #12672

  The graph LDAP backend can now retry operations against a replicated directory where a write to the primary is followed by a read that lands on a replica which has not yet caught up. This covers the read-back that recovers a directory-assigned ID after a create (GRAPH_LDAP_SERVER_UUID enabled), which is retried until the entry becomes visible. The retry count and backoff are tunable through GRAPH_LDAP_RETRY_MAX_COUNT, GRAPH_LDAP_RETRY_BASE_DELAY and GRAPH_LDAP_RETRY_MAX_DELAY; the defaults keep the previous behaviour (a single immediate retry with no delay), so existing deployments are unaffected.

  Retries now distinguish reads from writes: a write is no longer retried on a network error, which can surface after the request was already sent and would otherwise apply the mutation twice.

  https://github.com/owncloud/ocis/pull/12672

• Enhancement - Add an opt-in bounded LDAP connection pool: #12688

  The auth-basic, users, groups and graph services can now be switched from a single long-lived reconnecting LDAP connection to a bounded pool of connections, so concurrent requests no longer serialize on one socket. Connections are dialed and bound lazily on checkout, unhealthy connections are discarded and lazily re-dialed rather than eagerly reconnected, and checkout blocks with a configurable timeout once the pool is exhausted.

  Pooling is off by default and fully backwards compatible. Enable it per service via ‘OCIS_LDAP_POOL_ENABLED’ (or the service-specific ‘_LDAP_POOL_ENABLED’ override), and tune it with ‘OCIS_LDAP_POOL_SIZE’ (default 5) and ‘OCIS_LDAP_POOL_CHECKOUT_TIMEOUT’ (default 30s).

  The graph service’s identity backend now shares the same LDAP client implementation used by the reva auth/user/group managers instead of maintaining its own separate reconnecting client.

  https://github.com/owncloud/ocis/pull/12688

• Enhancement - Bump dependencies: #12766

  Bumped Go and npm dependencies to address security findings:

  • github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 (CVE-2026-71556) - nanoid 3.3.15 → 3.3.17 and 5.1.5 → 5.1.16 (npm, via pnpm overrides; CVE-2026-67213, CVE-2026-67214)

  https://github.com/owncloud/ocis/pull/12766