[stable33] 33.0.3 RC1

[nextcloud-bot]

Nextcloud 33.0.3

server

• [stable33] fix: show configuration options for external storage backends #58696
• [stable33] fix(sharing): Align userid config key in UserPlugin with Manager #58989
• [stable33] chore(deps-dev): Bump rector/rector from 2.3.8 to 2.3.9 in /vendor-bin/rector #59122
• [stable33] chore(deps-dev): Bump msw from 2.12.10 to 2.12.14 #59124
• [stable33] chore(deps-dev): Bump cypress-split from 1.24.28 to 1.24.31 #59125
• [stable33] chore(deps): Bump core-js from 3.48.0 to 3.49.0 in /build/frontend-legacy #59126
• [stable33] chore(deps-dev): Bump babel-plugin-module-resolver from 5.0.2 to 5.0.3 in /build/frontend-legacy #59127
• [stable33] chore(deps): Bump moment-timezone from 0.6.0 to 0.6.1 in /build/frontend-legacy #59128
• [stable33] chore(deps-dev): Bump msw from 2.12.10 to 2.12.14 in /build/frontend-legacy #59129
• [stable33] chore(deps): Bump @nextcloud/password-confirmation from 6.0.3 to 6.1.0 in /build/frontend-legacy #59131
• [stable33] fix(oauth2): Do not store the code in throttle metadata #59155
• [stable33] fix(ICalendar): allow to search for event URI #59161
• [stable33] feat(settings): Log AI config changes to audit log #59221
• [stable33] perf(preview): bulk process preview regeneration #59234
• [stable33] fix: Fix user in Tags class, do not depend upon session #59236
• [stable33] chore(deps-dev): Bump the vitest group across 2 directories with 3 updates #59281
• [stable33] chore(deps-dev): Bump stylelint from 17.4.0 to 17.6.0 #59283
• [stable33] chore(deps): Bump handlebars from 4.7.8 to 4.7.9 in /build/frontend-legacy #59285
• [stable33] fix(chunkedUploads): Ensure max parallel count is at least 1 #59302
• [stable33] fix: use unjailed source path when moving jailed files #59310
• [stable33] fix: cache validation of system keys #59314
• [stable33] fix(weather_status): add all missing met.no symbol codes to weatherOptions #59346
• [stable33] fix(filesDrop): drag-and-drop folder upload #59368
• [stable33] chore: Remove incorrect resource typing in ILDAPProvider #59381
• [stable33] fix(zip): Fix warning when downloading Zip file #59383
• [stable33] fix: update email button text to 'Open shared item' #59396
• [stable33] fix(files_external): properly set default values for backend options #59397
• [stable33] fix(settings): Don't register invalid routes #59399
• [stable33] fix(lib): templates core path detection #59401
• [stable33] docs(webhook_listeners): adapt codeowners #59404
• [stable33] fix(file-search): use default limit to search query if not provided on request body #59409
• [stable33] fix: duplicate dashboard widget #59412
• [stable33] fix(user_ldap): fix lastLogin reading wrong appid and configkey #59421
• [stable33] chore(deps-dev): Bump sass from 1.98.0 to 1.99.0 #59438
• [stable33] chore(deps-dev): Bump @zip.js/zip.js from 2.8.23 to 2.8.26 #59439
• [stable33] chore(deps): Bump vue from 3.5.30 to 3.5.32 #59440
• [stable33] chore(deps): Bump libphonenumber-js from 1.12.40 to 1.12.41 in /build/frontend-legacy #59442
• [stable33] chore(deps): Bump lodash from 4.17.23 to 4.18.1 in /build/frontend-legacy #59443
• [stable33] chore(deps-dev): Bump sass from 1.98.0 to 1.99.0 in /build/frontend-legacy #59444
• [stable33] feat(talk): Allow to create conversations that are meetings #59479
• [stable33] fix(zip): suppress sabre/dav response only if stream was actually sent #59482
• [stable33] fix(systemtags): only render inline list of tags if there are some #59488
• [stable33] fix(settings): hide list of webauthn devices if empty #59491
• [stable33] fix(dashboard): remove status list if there are none #59492
• [stable33] fix(files): properly handle dropped files on subfolders #59510
• [stable33] fix(trashbin): keep cache and db consistent #59512
• [stable33] fix(updater): Make "maintenance mode kept active" more obvious #59524
• [stable33] build(deps): bump phpseclib/phpseclib from 2.0.47 to 2.0.52 #59528
• [stable33] fix(settings): do not show admin section container if empty #59534
• [stable33] fix: profile page on small screens #59538
• [stable33] fix(sharing): show common confirmation on password reset #59545
• [stable33] fix(workflowengine): remove non existing script loading #59547
• [stable33] Only mask the permissions for the users home directory for public shares #59552
• [stable33] build(deps): bump aws/aws-sdk-php to 3.376 #59559
• [stable33] docs(workflowengine): Remove reference of removed method #59568
• [stable33] fix(user_ldap): Do not require credentials in wizard #59570
• [stable33] fix(testing): Fix fake provider reverting strings with emojis #59571
• [stable33] chore(deps-dev): Bump the vite group across 2 directories with 1 update #59576
• [stable33] chore(deps-dev): Bump the vitest group across 2 directories with 3 updates #59577
• [stable33] chore(deps-dev): Bump msw from 2.12.10 to 2.13.2 #59578
• [stable33] chore(deps-dev): Bump cypress from 15.12.0 to 15.13.1 #59579
• [stable33] chore(deps-dev): Bump msw from 2.12.10 to 2.13.2 in /build/frontend-legacy #59580
• chore(deps): Bump p-queue from 9.1.0 to 9.1.2 in /build/frontend-legacy #59581
• [stable33] chore(deps): Bump marked from 17.0.4 to 17.0.6 in /build/frontend-legacy #59582
• [stable33] test: Add integration test to confirm a user can not add themselves t… #59604
• [stable33] fix(apppasswords): Require password also on delete and update #59608
• [stable33] fix(sharing): Don't give a reason when share from disabled user is no… #59612
• [stable33] fix(notifications): Require absolute links for support of desktop and mobile clients #59615
• [stable33] chore: update haze to 2.2.1 #59622
• [stable33] feat(user_ldap): Add config for partial search prefix wildcard use #59634
• [stable33] test(integration): Add integration test for accept share #59638
• [stable33] fix(Util): getScripts also need to reorder core translations #59643
• [stable33] perf: don't fetch child mounts when getting node parent #59645
• [stable33] fix: fix LazyUserFolder::getMountPoint #59655
• [stable33] fix(files): remove error message when closing the "Open locally" dialog #59657
• [stable33] feat(recent-files): allow configuring image grouping #59667
• [stable33] fix(files): add missing table header for actions column #59674
• [stable33] Restore missing apps on upgrade #59686
• [stable33] build(deps): bump phpseclib/phpseclib to 2.0.53 #59688
• [stable33] chore(deps-dev): Bump msw from 2.13.3 to 2.13.4 #59698
• chore(deps): Bump @nextcloud/auth from 2.5.3 to 2.6.0 #59699
• [stable33] chore(deps-dev): Bump @nextcloud/eslint-config from 9.0.0-rc.8 to 9.0.0-rc.9 #59700
• [stable33] chore(deps): Bump @nextcloud/auth from 2.5.3 to 2.6.0 in /build/frontend-legacy #59701
• [stable33] chore(deps): Bump dompurify from 3.3.3 to 3.4.0 in /build/frontend-legacy #59702
• [stable33] chore(deps): Bump browserslist-useragent-regexp from 4.1.3 to 4.1.4 in /build/frontend-legacy #59703
• [stable33] chore(deps-dev): Bump webpack from 5.105.4 to 5.106.2 in /build/frontend-legacy #59704
• [stable33] fix(DB): Ignore intentionally missing fs_storage_path_prefix index on PostgreSQL #59725
• [stable33] fix(federation): Also sign requests with NCU providers #59726
• [stable33] fix(ocm): Correctly track OCM requests #59727
• [stable33] fix(profile): normalize profile visibility #59734
• [stable33] fix(files): only disable template creation when both skeleton directories are empty #59749
• [stable33] Fix app name not translated in the title of public pages #59756
• [stable33] test(integration): add tests for calendar delegation #59763
• [stable33] fix(oauth2): Add missing urlencode for failure redirection #59772
• [stable33] fix: Reduce the mixups between apptokens and session ids #59775
• [stable33] fix: Add missing PasswordConfirmationRequired attributes #59789
• [stable33] hide share token if share has more permissions than the current user #59793
• [stable33] fix(security): Update code signing revocation list #59818
• [stable33] fix(ImipService): Refactor IMipService to improve performance #59847
• [stable33] fix(dav): unify content disposition header escaping #59852
• [stable33] fix(dav): do not list intermediate files #59854
• [stable33] Mounts index swap path root 33 #59855
• [stable33] fix(files): do not show convert-file action in view-only shares #59865

3rdparty

• [stable33] build(deps): bump phpseclib/phpseclib from 2.0.47 to 2.0.52 3rdparty#2363
• [stable33] build(deps): bump aws/aws-sdk-php to 3.376 3rdparty#2370
• [stable33] build(deps): bump phpseclib/phpseclib to 2.0.53 3rdparty#2384

activity

• [stable33] Fix npm audit activity#2456
• [stable33] Update nextcloud/ocp dependency activity#2476
• [stable33] Update nextcloud/ocp dependency activity#2504
• [stable33] Fix npm audit activity#2508
• [stable33] feat: add download counter to activity sidebar activity#2511
• [stable33] Update nextcloud/ocp dependency activity#2517
• [stable33] Update nextcloud/ocp dependency activity#2525
• [stable33] Fix npm audit activity#2530

bruteforcesettings

• [stable33] Fix npm audit bruteforcesettings#1019
• Chore(deps-dev): Bump @nextcloud/eslint-config from 9.0.0-rc.8 to 9.0.0-rc.9 bruteforcesettings#1051
• [stable33] Update nextcloud/ocp dependency bruteforcesettings#1055
• Chore(deps-dev): Bump @vitejs/plugin-vue from 6.0.5 to 6.0.6 bruteforcesettings#1060
• [stable33] Update nextcloud/ocp dependency bruteforcesettings#1063

circles

• [stable33] fix: secondary owncloud custom group admin permissions not migrated circles#2427
• [stable33] fix(mail): send internal link circles#2442

files_pdfviewer

• [stable33] Fix handling of "enableScripting" data attribute files_pdfviewer#1398
• [stable33] Allow PDF Forms calculations files_pdfviewer#1409
• chore(deps-dev): Bump adm-zip from 0.5.16 to 0.5.17 files_pdfviewer#1417
• chore(deps-dev): Bump @nextcloud/eslint-config from 9.0.0-rc.8 to 9.0.0-rc.9 files_pdfviewer#1424

logreader

• [stable33] Update nextcloud/ocp dependency logreader#1964
• [stable33] Fix npm audit logreader#1965
• [stable33] Update nextcloud/ocp dependency logreader#1987
• [stable33] Fix npm audit logreader#1990
• [stable33] Fix npm audit logreader#1999

nextcloud_announcements

• [stable33] Update nextcloud/ocp dependency nextcloud_announcements#600
• [stable33] ci(actions): Update workflow templates from organization template repository nextcloud_announcements#604
• [stable33] Update nextcloud/ocp dependency nextcloud_announcements#608
• [stable33] ci(actions): Update workflow templates from organization template repository nextcloud_announcements#612

notifications

• [stable33] Fix npm audit notifications#2872
• [stable33] build(deps): Bump vue from 3.5.30 to 3.5.31 notifications#2880
• [stable33] ci(actions): Update workflow templates from organization template repository notifications#2883
• [stable33] build(deps): Bump vue from 3.5.31 to 3.5.32 notifications#2890
• [stable33] Fix npm audit notifications#2893
• [stable33] build(deps-dev): Bump @nextcloud/eslint-config from 9.0.0-rc.8 to 9.0.0-rc.9 notifications#2901
• [stable33] ci(actions): Update workflow templates from organization template repository notifications#2905
• [stable33] Fix npm audit notifications#2906
• [stable33] Update nextcloud/ocp dependency notifications#2911
• [stable33] Update nextcloud/ocp dependency notifications#2913
• [stable33] Update nextcloud/ocp dependency notifications#2917
• [stable33] Update nextcloud/ocp dependency notifications#2921
• [stable33] ci(actions): Update workflow templates from organization template repository notifications#2925
• [stable33] Fix npm audit notifications#2927
• [stable33] fix(mail): Only render links when they are absolute urls notifications#2932
• [stable33] fix(push): Limit user output notifications#2934

password_policy

• [stable33] fix: Check cookie logged in event password_policy#933

privacy

• Chore(deps): Bump @nextcloud/vue from 8.35.0 to 8.37.0 privacy#1285
• Chore(deps-dev): Bump phpunit/phpunit from 9.6.19 to 9.6.34 privacy#1309
• [stable33] ci(actions): Update workflow templates from organization template repository privacy#1312
• [stable33] ci(actions): Update workflow templates from organization template repository privacy#1317

serverinfo

• [stable33] Update nextcloud/ocp dependency serverinfo#963

survey_client

• [stable33] Update nextcloud/ocp dependency survey_client#385
• [stable33] [master] Update nextcloud/ocp dependency survey_client#397
• [stable33] ci(workflows): Update workflows and add couple of new standard ones survey_client#400
• Chore(deps-dev): Bump nextcloud/coding-standard from 1.3.2 to 1.4.0 survey_client#401
• [stable33] Update nextcloud/ocp dependency survey_client#403
• [stable33] ci(actions): Update workflow templates from organization template repository survey_client#406

suspicious_login

• [stable33] ci: fix profile workflow undefined server checkout ref suspicious_login#1103

text

• chore(deps): update dependency cypress-split to ^1.24.31 (stable33) text#8389
• fix(deps): update dependency katex to ^0.16.45 (stable33) text#8390
• fix(deps): update dependency markdown-it to ^14.1.1 (stable33) text#8391
• fix(deps): update dependency webdav to ^5.9.0 (stable33) text#8393
• [stable33] Update nextcloud/ocp dependency text#8395
• [stable33] Fix npm audit text#8400
• [stable33] fix(editorApi): use onMentionSearch callback if provided text#8422
• [stable33] fix(checklist): don't cross out checked list items text#8424
• fix(deps): update dependency @mdit/plugin-tex to ^0.24.2 (stable33) text#8434
• [stable33] Optimize cleanup job text#8443
• chore(deps): update dependency vite to ^7.3.2 (stable33) text#8454
• fix(deps): update dependency mermaid to ^11.14.0 (stable33) text#8455
• fix(deps): update tiptap to ^3.22.3 (stable33) text#8456
• [stable33] Update nextcloud/ocp dependency text#8463
• [stable33] Fix npm audit text#8466
• [stable33] fix(menubar): lower z-index: on top of document content, but below modals text#8471
• [stable33] fix(files): don't offer "folder description" in file drop folders text#8474
• fix(deps): update tiptap to ^3.22.4 (stable33) text#8485
• [stable33] Update nextcloud/ocp dependency text#8489
• [stable33] fix(deps): bump phpunit and php-cs-fixer text#8494
• [stable33] fix: always validate share token if provided text#8500

twofactor_nextcloud_notification

• [stable33] Fix npm audit twofactor_nextcloud_notification#1254
• [stable33] Update nextcloud/ocp dependency twofactor_nextcloud_notification#1262
• [stable33] build(deps): Bump vue from 3.5.30 to 3.5.31 twofactor_nextcloud_notification#1268
• [stable33] ci(actions): Update workflow templates from organization template repository twofactor_nextcloud_notification#1272
• [stable33] build(deps): Bump vue from 3.5.31 to 3.5.32 twofactor_nextcloud_notification#1276
• [stable33] Update nextcloud/ocp dependency twofactor_nextcloud_notification#1277
• [stable33] Fix npm audit twofactor_nextcloud_notification#1279
• [stable33] Update nextcloud/ocp dependency twofactor_nextcloud_notification#1284
• [stable33] ci(actions): Update workflow templates from organization template repository twofactor_nextcloud_notification#1287
• [stable33] Fix npm audit twofactor_nextcloud_notification#1289

twofactor_totp

• [stable33] Fix npm audit twofactor_totp#1740

updater

• [stable33] fix: verify integrity with URL override but allow to disable if needed updater#724
• [stable33] fix: broken upgrade via --url flag updater#744
• [stable33] feat(signature): allow to provide custom signature updater#748

viewer

• [stable33] fix: Try fixing too late handler registration for file actions viewer#3129
• chore(deps): update dependency dompurify to v3.4.0 [security] (stable33) viewer#3142
• [stable33] ci(actions): Update workflow templates from organization template repository viewer#3146
• [stable33] refactor: use new @nextcloud/dialogs functions viewer#3148
• [stable33] fix(ImageEditor): urldecode source name viewer#3161

Pending PRs:

• @artonge
  • [stable33] authoritative share - revival #59177
• @DerDreschner
  • [stable33] fix(DnsPinning): Ensure to always lookup based on FQDN #59157 🔁
• @icewind1991
  • [stable33] fix: allow renaming files with just update permissions #59241 ✅
• @backportbot
  • [stable33] dav: Fix fatal error when ORGANIZER is missing in CalDAV schedule #59350 ✅
• @rikled
  • [stable33] fix: manually set modified time to SFTP files after editing #59351 ✅
• @hamza221
  • [stable33] fix(encryption): limit oprhaned keys scan to one user #59808 ✅
• @leftybournes
  • [stable33] fix(s3): ignore prefixes with repeating delimiters #59829 ✅
• @kesselb
  • [stable33] Avoid undefined array key sharing request #59834
• @benjaminfrueh
  • [stable33] chore: Improve SVG handling in link previews #59836 ✅
• @backportbot
  • [stable33] feat(files_external): convert to delegated settings #59870 ✅
• @CarlSchwan
  • [stable33] chore: Bump psalm version password_policy#934 ✅
• @backportbot
  • [stable33] chore(deps-dev): bump phpunit/phpunit from 10.5.25 to 10.5.62 related_resources#846
• @benjaminfrueh
  • [stable33] perf(rich_workspace): only add property for parent text#8498
• @salmart-dev
  • fix(files_reminders): reduce N+1 query issue for big folders #58288
• (generated)
  • [stable33] 33.0.3 RC1 #59729

---

• ⚠: conflicts detected
• ✅: approved
• 🔁: changes requested

[Altahrim]

Required PRs:

• [stable33] chore: Improve SVG handling in link previews #59836
• [stable33] fix: always validate share token if provided text#8500
• [stable33] fix(dav): unify content disposition header escaping #59852
• [stable33] authoritative share - revival #59177
• [stable33] Mounts index swap path root 33 #59855
• [stable33] Avoid undefined array key sharing request #59834
• fix(files_sharing): Restore password guard return for new public shares #59873
• fix(webhook-listeners): hour lifetime of tokens #59875
• [stable33] fix: update shares handling circles#2456

Nice to have PRs:

• [stable33] test(integration): add tests for calendar delegation #59763
• [stable33] fix(encryption): limit oprhaned keys scan to one user #59808