[nextcloud-bot]

Nextcloud 35.0.3

server

• [stable35] fix(sharing): hide external sharing section when link sharing disabled #64335
• [stable35] fix(files_sharing): limit the share token input to the maximum token length #64710
• [stable35] fix(settings): prevent user list crash when password changes are disabled #64912
• [stable35] fix(globalscale): ignore lookupserver if empty config #65185
• [stable35] fix(backupcodes): Dismiss notification on disabled provider #65318
• [stable35] fix(admin-audit): Log when BFP was bypassed #65327
• [stable35] chore(deps-dev): bump @zip.js/zip.js from 2.18.2 to 2.23.0 #65361
• [stable35] chore(deps-dev): bump sass from 1.105.0 to 1.105.1 #65362
• [stable35] chore(deps-dev): bump eslint from 10.11.0 to 10.12.0 #65363
• [stable35] chore(deps-dev): bump jsdom from 30.1.1 to 30.1.2 #65364
• chore(deps-dev): bump axe-core from 4.13.0 to 4.14.0 #65366
• [stable35] chore(deps): bump moment-timezone from 0.6.4 to 0.6.5 in /build/frontend-legacy #65368
• [stable35] chore(deps): bump focus-trap from 8.2.2 to 8.2.3 in /build/frontend-legacy #65369
• [stable35] chore(deps-dev): bump sass from 1.105.0 to 1.105.1 in /build/frontend-legacy #65370
• [stable35] fix(files_sharing): preserve share expiration time #65403
• [stable35] fix: add files_metadata_index to the filecache partition #65414
• [stable35] fix(settings): add select event to AppNavigationGroupList and clear s… #65418
• [stable35] chore: Add testing:prepare-ci command #65421
• [stable35] Improve performance of snowflake ids in cron jobs #65425
• [stable35] fix(mail): embed image logo only when using useTemplate #65428
• [stable35] fix: Remove unused $allStorages array in files_external #65440
• [stable35] Fix/objectstore fopen basename ext #65441
• [stable35] chore: Skip transaction when no preview exists #65446
• [stable35] perf(files): cache the mimetype table #65448
• [stable35] perf(app): cache the parsed app info as array #65449
• [stable35] perf: Improve preview cold generation #65451
• [stable35] fix(encryption): use the block size of the file encoding when fixing sizes #65460
• [stable35] perf: Partition preview migration job #65464
• [stable35] perf(preview): only autorotate with Imaginary when needed #65485
• [stable35] fix(dav): handle 4-byte text consistently in calendar indexes #65488
• [stable35] fix(appstore): only ask once for password confirmation #65496
• [stable35] fix(user_ldap): Use proper function builder instead of hardcoded COUNT #65501
• [stable35] fix(migration): check if deleted_by column exists before trying to add it to files_trash table #65518
• [stable35] fix(dav): adjust password session check on legacy dav auth #65541
• [stable35] ci: run the guests integration tests against guests stable-4.10 #65554
• [stable35] fix(files_sharing): show the owner avatar for received shares #65560
• [stable35] fix(files): normalize Unicode in node paths #65566
• [stable35] fix(DefaultShareProvider): Set missing attributes when user manually accepts or rejects a share #65572
• [stable35] fix(sharebymail): Send readable password by mail instead of hash #65578
• [stable35] fix(dav): resolve users before intersecting shares #65584
• [stable35] chore(deps-dev): bump phpunit/phpunit from 11.5.56 to 11.5.57 in /vendor-bin/behat #65611
• [stable35] chore(deps): bump phpunit/phpunit from 11.5.56 to 11.5.57 in /vendor-bin/phpunit #65612
• [stable35] chore(deps-dev): bump the vite group across 2 directories with 1 update #65613
• chore(deps): bump p-queue from 9.3.3 to 9.3.5 #65614
• [stable35] chore(deps): bump @nextcloud/password-confirmation from 6.1.0 to 6.2.0 #65615
• [stable35] chore(deps-dev): bump @playwright/test from 1.63.0 to 1.64.0 #65616
• [stable35] chore(deps): bump marked from 18.0.14 to 18.1.1 #65617
• [stable35] chore(deps-dev): bump @types/dockerode from 4.0.1 to 4.0.2 #65618
• [stable35] chore(deps-dev): bump concurrently from 10.0.5 to 10.0.6 #65619
• [stable35] chore(deps): bump vue-router from 5.3.1 to 5.4.0 #65620
• [stable35] chore(deps-dev): bump mime from 4.1.0 to 4.1.1 in /build/frontend-legacy #65621
• [stable35] chore(deps): bump libphonenumber-js from 1.13.14 to 1.13.15 in /build/frontend-legacy #65622
• [stable35] chore(deps): bump @nextcloud/password-confirmation from 6.1.0 to 6.2.0 in /build/frontend-legacy #65623
• [stable35] chore(deps): bump p-queue from 9.3.3 to 9.3.5 in /build/frontend-legacy #65624
• [stable35] chore(deps): bump marked from 18.0.14 to 18.1.1 in /build/frontend-legacy #65625
• [stable35] Fix npm audit #65656
• [stable35] chore: Update setup-php to 2.40.0 #65661
• [stable35] fix: Playwright concurrency #65673
• [stable35] fix: don't try to load keys for empty path for groupfolder versions #65676
• [stable35] chore(deps): bump @nextcloud/password-confirmation from 6.2.0 to 6.2.1 #65678
• [stable35] chore(deps): bump pinia from 4.0.3 to 4.1.0 #65679
• [stable35] chore(deps): bump vue from 3.5.43 to 3.5.44 #65680
• [stable35] chore(deps-dev): bump jsdom from 30.1.2 to 30.1.3 #65681
• [stable35] chore(deps-dev): bump @playwright/test from 1.64.0 to 1.64.1 #65682
• [stable35] chore(deps): bump dompurify from 3.4.16 to 3.4.17 in /build/frontend-legacy #65683
• [stable35] chore(deps): bump vue-material-design-icons from 5.3.1 to 5.4.0 in /build/frontend-legacy #65684
• [stable35] chore(deps-dev): bump @nextcloud/webpack-vue-config from 7.0.4 to 7.1.0 in /build/frontend-legacy #65685
• [stable35] chore(deps): bump @nextcloud/password-confirmation from 6.2.0 to 6.2.1 in /build/frontend-legacy #65686
• [stable35] chore(deps-dev): bump @testing-library/user-event from 14.6.7 to 14.6.8 in /build/frontend-legacy #65687
• [stable35] fix(ui): Consider typing and scrolling as activity for auto logout #65691
• [stable35] fix(dav): remove CalDAV availability when all working-hour slots are cleared #65695
• [stable35] fix(encryption): Remember the recalculated unencrypted size as int #65701
• [stable35] fix: Remove auto increment migration on share_external #65711
• [stable35] fix(user_ldap): remove leftover debug log in getUserFromCustomAttribute #65713
• [stable35] fix: move column drop in to separate migration #65719
• [stable35] fix(DisableSystemAddressBook): Fix notification by providing an object id #65734
• [stable35] fix(security): Update CA certificate bundle #65744
• [stable35] fix(dav): compare sync token retention against an absolute cutoff #65757
• [stable35] perf(sharing): skip resolving group shares when there are none #65786
• [stable35] Hash validate legacy #65787
• [stable35] feat: allow passing a cache entry to getMetadataForNode #65803
• [stable35] chore(deps-dev): bump sass from 1.105.1 to 1.105.2 #65836
• [stable35] chore(deps-dev): bump @zip.js/zip.js from 2.23.0 to 2.24.0 #65837
• [stable35] chore(deps-dev): bump eslint from 10.12.0 to 10.13.0 #65838
• [stable35] chore(deps-dev): bump webpack from 5.111.1 to 5.112.0 in /build/frontend-legacy #65839
• [stable35] chore(deps): bump core-js from 3.50.0 to 3.51.0 in /build/frontend-legacy #65840
• [stable35] chore(deps-dev): bump sass from 1.105.1 to 1.105.2 in /build/frontend-legacy #65841
• [stable35] fix(ci): clone vendored test apps from the matching stable branch #65875
• [stable35] fix(files): skip quota check when opening files for reading #65880
• [stable35] Fix npm audit #65892
• [stable35] chore(deps-dev): bump sass from 1.105.2 to 1.106.0 #65897
• [stable35] chore(deps-dev): bump sass from 1.105.2 to 1.106.0 in /build/frontend-legacy #65901
• [stable35] chore: flake update #65908
• [stable35] fix(files_sharing): public share popover jumps on options toggle #65913
• [stable35] feat(Sharing): Allow remote owners and initiators #65915
• [stable35] fix(since): Ensure provided since version is from the current branch #65924
• [stable35] fix(files): upload files with empty mime type #65927
• [stable35] fix(provisioning_api): filter users by enabled state on the server #65929
• [stable35] fix: move/rename of part file in masked dir/storage #65934
• [stable35] fix: Remove avatar and credentials only after user removal #65948
• [stable35] fix(core): use %n in the integrity check plural to avoid a crash in L10N #65958
• [stable35] ci: sync workflows with .github #65961
• [stable35] refactor: store state enums in unified sharing as ints #65966
• [stable35] ci: bump dorny/paths-filter to v4.0.3 #65967
• [stable35] Fix npm audit #65976
• [stable35] fix(files_sharing): Make sure mount events are dispatched for share recipients #65988
• [stable35] fix(appstore): do not wrap app store screenshots in the proxy twice #65991
• [stable35] fix(versions): empty array for external shares #66005
• [stable35] fix(dav): detect truncated CardDAV sync results on all databases #66012
• [stable35] fix(dav): pair changed iTip instances by UID/RECURRENCE-ID instead of… #66015
• [stable35] test(avatar): Check the guest avatar independent of the font renderer #66017
• [stable35] build(deps): bump the symfony group across 1 directory with 10 updates #66030
• [stable35] fix(dav): align public request path handling #66038
• [stable35] fix: unique custom tokens for share links #66044
• [stable35] fix(Security\Hasher): Guard PASSWORD_ARGON2 constants with defined() check #66047
• [stable35] chore(deps-dev): bump sass from 1.106.0 to 1.106.1 #66067
• [stable35] chore(deps): bump marked from 18.1.1 to 18.1.2 #66068
• [stable35] chore(deps): bump @nextcloud/vue from 9.13.1 to 9.14.0 #66069
• [stable35] chore(deps): bump @nextcloud/files from 4.1.0 to 4.1.1 #66070
• [stable35] chore(deps): bump @nextcloud/dialogs from 7.5.0 to 7.6.0 #66071
• [stable35] chore(deps): bump @nextcloud/dialogs from 7.5.0 to 8.0.0 #66072
• [stable35] chore(deps): bump marked from 18.1.1 to 18.1.2 in /build/frontend-legacy #66073
• [stable35] chore(deps): bump @nextcloud/files from 4.1.0 to 4.1.1 in /build/frontend-legacy #66074
• [stable35] chore(deps-dev): bump sass from 1.106.0 to 1.106.1 in /build/frontend-legacy #66075
• [stable35] chore(deps-dev): bump webpack from 5.112.0 to 5.112.2 in /build/frontend-legacy #66076
• [stable35] chore(deps): bump @nextcloud/vue from 8.41.0 to 8.42.0 in /build/frontend-legacy #66077
• [stable35] chore(deps): bump focus-trap from 8.2.3 to 8.2.4 in /build/frontend-legacy #66078
• [stable35] build(deps): Bump Symfony packages #66133
• [stable35] refactor: map sharing instances to ints, and add instance to indices #66145
• [stable35] fix: properly handle webdav pagination headers #66156
• [stable35] fix(external-share): move ExternalShareScanJob creation deeper #66157
• [stable35] fix(avatar): add timeout and size limit when fetching remote avatars #66162
• [stable35] fix(files_external): reset EOF when seeking in SFTPReadStream #66166
• [stable35] fix(log): Avoid crashes when building exception trace with a ghost #66172
• [stable35] feat(files): expose forbidden filename capabilities publicly #66182
• [stable35] fix: improve live-photo handling #66190
• [stable35] fix(user_ldap): Fix variable name conflict for cache key #66196
• [stable35] fix(dav): bind public share session authentication to the password hash #66204
• [stable35] feat(LocalStorage): add config option to configure min_free_space #66205
• [stable35] fix(user_ldap): do not cache unknown names in the local mapping cache #66209
• [stable35] ci: drop cat of Imagick policy #66220
• [stable35] fix(systemtags): properly handle object ids #66229
• [stable35] fix(favorite): Limit tagging to favorite #66232
• [stable35] fix(dav): do not grant write-properties to read-only calendar delegates #66237
• [stable35] fix: Reject login with NUL bytes rather than converting #66242
• [stable35] fix(provisioning_api): group admins can't add all users to groups #66265
• [stable35] fix(share-folder): use it on federated share #66278
• [stable35] fix(dav): register missing app config keys in the config lexicon #66281
• [stable35] fix(encryption): Don't use ChunkingV2Plugin when server-side encryption is enabled #66290
• [stable35] fix(files): Continue scanning after StorageInvalidException #66291
• [stable35] fix(session): Prevent stale requests from replacing a regenerated session #66295
• [stable35] feat(federation): ignore remote contacts #66307
• [stable35] fix(theming): only accept canonical svg paths for themed icons #66310
• [stable35] fix(files): check that the source properly between storages #66315
• [stable35] fix(dav): allow moves within own share when sharing is disabled #66331
• [stable35] fix(quota): Calculate used quota for foreign users the correct way #66332
• [stable35] build(deps-dev): bump sass from 1.106.1 to 1.107.1 #66335
• [stable35] build(deps): bump @nextcloud/vue from 9.14.0 to 9.14.1 #66336
• [stable35] build(deps-dev): bump eslint from 10.13.0 to 10.14.0 #66337
• [stable35] build(deps-dev): bump mime from 4.1.1 to 4.1.2 in /build/frontend-legacy #66338
• [stable35] build(deps): bump moment-timezone from 0.6.5 to 0.6.6 in /build/frontend-legacy #66339
• [stable35] build(deps-dev): bump sass from 1.106.1 to 1.107.1 in /build/frontend-legacy #66340
• [stable35] fix(webhook_listeners): Change Exception type #66343
• [stable35] fix(tags): display selected tag in settings #66346
• [stable35] refactor(session): use ITimeFactory for superseded session markers #66350
• [stable35] ci(psalm): run taint analysis with all available threads #66356
• [stable35] fix(lostpassword): Avoid having a different error message between expired and invalid #66365
• [stable35] fix(federatedfilesharing): match reshares by node, not by name #66373

3rdparty

• [stable35] build(deps): bump the symfony group across 1 directory with 10 updates 3rdparty#2645
• [stable35] build(deps): bump the symfony group across 1 directory with 7 updates 3rdparty#2680
• [stable35] ci(actions): Sync workflows from master 3rdparty#2683

activity

• [stable35] Correctly apply groupfolders acl activity#3020
• [stable35] perf(activity): reintroduce activity_object index activity#3021
• [stable35] Update nextcloud/ocp dependency activity#3028
• [stable35] Update nextcloud/ocp dependency activity#3054
• fix(deps): update dependency happy-dom to v21 (stable35) activity#3058
• [stable35] fix(api): fall back to MIME icon when preview generation fails activity#3070
• [stable35] Update nextcloud/ocp dependency activity#3080

app_api

• [stable35] refactor(harp): compare the HaRP shared key with hash_equals app_api#1118
• [stable35] fix(deploy): round the memory and CPU limits to whole numbers app_api#1122
• [stable35] fix(docker): no PHP warning for a HaRP daemon without a key app_api#1137
• [stable35] fix(harp): send the route verb to HaRP app_api#1142
• [stable35] fix(proxy): match the route verb like HaRP app_api#1145
• [stable35] fix(harp): require HaRP 0.4.8 in the version check app_api#1150
• [stable35] fix(proxy): refuse dot segments resolved after the route check app_api#1164
• [stable35] fix(proxy): refuse the ExApp lifecycle endpoints like HaRP app_api#1169
• [stable35] fix(proxy): check routes on each reading of the path like HaRP app_api#1183

bruteforcesettings

• [stable35] ci(actions): Update workflow templates from organization template repository bruteforcesettings#1329
• [stable35] Fix npm audit bruteforcesettings#1334
• [stable35] Update nextcloud/ocp dependency bruteforcesettings#1338
• Chore(deps): Bump vue from 3.5.43 to 3.5.44 bruteforcesettings#1348
• Chore(deps): Bump vue-material-design-icons from 5.3.1 to 5.3.2 bruteforcesettings#1349
• [stable35] Update nextcloud/ocp dependency bruteforcesettings#1356
• [stable35] Fix npm audit bruteforcesettings#1361
• [stable35] ci(actions): Update workflow templates from organization template repository bruteforcesettings#1363
• Chore(deps-dev): Bump @vitejs/plugin-vue from 6.0.9 to 6.0.10 bruteforcesettings#1373
• [stable35] Update nextcloud/ocp dependency bruteforcesettings#1375
• [stable35] Fix npm audit bruteforcesettings#1381
• [stable35] ci(actions): Update workflow templates from organization template repository bruteforcesettings#1384

circles

• chore(deps): bump virtua from 0.49.2 to 0.49.3 circles#2816
• chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 circles#2820
• chore(deps): bump @nextcloud/dialogs from 7.4.0 to 7.4.1 circles#2821
• [stable35] Feature/implement default quota for groups circles#2907
• [stable35] fix(teams): fix team folder 'View in Files' header link circles#2943
• [stable35] feat(command): add --delete option to circles:remote circles#3045
• [stable35] fix(notifications): dismiss join request notification once processed circles#3048
• [stable35] fix: only show shared resources that are still acessible circles#3054
• chore(deps-dev): bump vite from 7.3.5 to 7.3.7 circles#3065
• [stable35] fix(mount-provider): Pass the recipient to the federated share storage circles#3073
• [stable35] enh(performance): query memberships breadth first to reduce query count circles#3080
• chore(deps): bump vue-material-design-icons from 5.3.1 to 5.3.2 circles#3083
• chore(deps-dev): bump vue-tsc from 3.3.9 to 3.3.13 circles#3084
• [stable35] add title html attr to team card display names circles#3100
• [stable35] fix: Teams Pages editor doesn't load circles#3121
• [stable35] fix(shares): keep circle context when share is resolved via circle circles#3126
• [stable35] fix(share): use setPasswordHash instead of setPassword when retrieving share circles#3130
• [stable35] fix(notification): Make relative action links absolute when preparing circles#3135

files_downloadlimit

• [stable35] chore(deps): Bump @nextcloud/vue from 9.13.0 to 9.13.1 files_downloadlimit#1037
• [stable35] Update nextcloud/ocp dependency files_downloadlimit#1042
• [stable35] chore(deps-dev): Bump vite from 7.3.6 to 7.3.7 files_downloadlimit#1053
• [stable35] chore(deps-dev): Bump eslint from 10.11.0 to 10.12.0 files_downloadlimit#1054
• [stable35] chore(deps): Bump vue from 3.5.43 to 3.5.44 files_downloadlimit#1066
• [stable35] Update nextcloud/ocp dependency files_downloadlimit#1075
• [stable35] fix: disable props not supported with download limit files_downloadlimit#1080
• [stable35] ci: Add release relay job files_downloadlimit#1086
• [stable35] fix: count legacy share downloads only once files_downloadlimit#1089
• [stable35] chore(deps-dev): Bump eslint from 10.12.0 to 10.13.0 files_downloadlimit#1094
• [stable35] Update nextcloud/ocp dependency files_downloadlimit#1098
• [stable35] Fix npm audit files_downloadlimit#1103
• [stable35] Fix npm audit files_downloadlimit#955

files_lock

• [stable35] Update nextcloud/ocp dependency files_lock#1358
• [stable35] fix: allow force unlock without access of the lock owner files_lock#1363
• [stable35] fix(dav): extend the lock expiry on a WebDAV LOCK refresh files_lock#1366
• [stable35] feat(lock): remove locks of disabled or deleted users and on unshare files_lock#1391
• [stable35] fix(lock): only return string app names from getAppName files_lock#1398

files_pdfviewer

• [stable35] ci(actions): Update workflow templates from organization template repository files_pdfviewer#1553
• [stable35] Fix npm audit files_pdfviewer#1557
• chore(deps-dev): Bump vitest from 5.0.1 to 5.0.5 files_pdfviewer#1602
• [stable35] Fix npm audit files_pdfviewer#1612

logreader

• [stable35] Update nextcloud/ocp dependency logreader#2280
• [stable35] chore(deps-dev): bump vite from 7.3.6 to 7.3.7 logreader#2284
• [stable35] ci(actions): Update workflow templates from organization template repository logreader#2291
• chore(deps): bump @nextcloud/router from 3.1.0 to 3.2.0 logreader#2292
• [stable35] chore(deps-dev): bump happy-dom from 20.11.15 to 20.14.5 logreader#2293
• [stable35] chore(deps): bump @nextcloud/vue from 9.9.0 to 9.13.1 logreader#2298
• [stable35] chore(deps-dev): bump browserslist from 4.28.9 to 4.29.3 logreader#2302
• [stable35] chore(deps-dev): bump @vue/test-utils from 2.4.11 to 2.5.1 logreader#2304
• [stable35] feat(search): replace search popover with inline search field logreader#2317
• [stable35] Fix npm audit logreader#2320
• [stable35] ci(actions): Update workflow templates from organization template repository logreader#2326
• [stable35] perf(LogIterator): Read long lines in linear time logreader#2328
• [stable35] chore(deps): bump vue from 3.5.43 to 3.5.44 logreader#2344
• [stable35] chore(deps): bump vue-material-design-icons from 5.3.1 to 5.4.0 logreader#2345
• [stable35] chore(deps-dev): bump happy-dom from 20.14.5 to 20.14.6 logreader#2346
• [stable35] Update nextcloud/ocp dependency logreader#2352
• [stable35] Fix npm audit logreader#2355
• [stable35] ci(actions): Update workflow templates from organization template repository logreader#2358
• [stable35] fix(LogTable): load entries until screen is filled logreader#2363
• [stable35] chore(deps-dev): bump browserslist from 4.29.3 to 4.29.4 logreader#2373
• [stable35] chore(deps-dev): bump @pinia/testing from 2.0.1 to 2.0.2 logreader#2374
• [stable35] chore(deps): bump pinia from 4.0.3 to 4.1.0 logreader#2375
• [stable35] Update nextcloud/ocp dependency logreader#2380
• [stable35] Fix npm audit logreader#2383
• [stable35] ci(actions): Update workflow templates from organization template repository logreader#2389

nextcloud_announcements

• [stable35] Update nextcloud/ocp dependency nextcloud_announcements#735
• [stable35] ci(actions): Update workflow templates from organization template repository nextcloud_announcements#739
• [stable35] Update nextcloud/ocp dependency nextcloud_announcements#745
• [stable35] ci(actions): Update workflow templates from organization template repository nextcloud_announcements#746
• [stable35] Update nextcloud/ocp dependency nextcloud_announcements#751
• [stable35] ci(actions): Update workflow templates from organization template repository nextcloud_announcements#754

notifications

• [stable35] chore: Fix composer.lock hash notifications#3463
• [stable35] Update nextcloud/ocp dependency notifications#3466
• [stable35] build(deps-dev): Bump behat/behat from 3.33.0 to 4.0.0 in /tests/Integration notifications#3472
• [stable35] ci(actions): Update workflow templates from organization template repository notifications#3474
• [stable35] feat: open the target when a background push notification is clicked notifications#3480
• [stable35] ci(actions): Update workflow templates from organization template repository notifications#3487
• [stable35] ci(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 notifications#3495
• [stable35] ci(performance): Update actions notifications#3503
• [stable35] Update nextcloud/ocp dependency notifications#3507
• [stable35] Update nextcloud/ocp dependency notifications#3508
• [stable35] build(deps): Bump vue from 3.5.43 to 3.5.44 notifications#3523
• [stable35] build(deps): Bump vue-material-design-icons from 5.3.1 to 5.3.2 notifications#3524
• [stable35] Fix npm audit notifications#3530
• [stable35] fix(web-notifications): open notification link in a new tab notifications#3538
• [stable35] Apply hardenings found by automated scanner notifications#3541
• [stable35] Update nextcloud/ocp dependency notifications#3542
• [stable35] fix(web-push): improve fetching notifications with web-push notifications#3550
• [stable35] Update nextcloud/ocp dependency notifications#3553
• [stable35] build(deps): Bump guzzlehttp/psr7 from 2.13.1 to 2.13.2 notifications#3560
• [stable35] Fix npm audit notifications#3563
• [stable35] ci(actions): Update workflow templates from organization template repository notifications#3566

photos

• [stable35] fix(tags): read the tag id from the node instead of its attributes photos#3871
• [stable35] Update nextcloud/ocp dependency photos#3961
• [stable35] Fix npm audit photos#3965
• [stable35] Chore(deps-dev): Bump postcss from 8.5.28 to 8.5.29 photos#3982
• [stable35] Chore(deps-dev): Bump vite from 7.3.6 to 7.3.7 photos#3985
• [stable35] ci(actions): Update workflow templates from organization template repository photos#3997
• [stable35] Fix npm audit photos#3999
• [stable35] fix(viewer): forward live photo metadata photos#4005
• [stable35] Chore(deps-dev): Bump postcss from 8.5.29 to 8.5.30 photos#4014
• [stable35] Chore(deps): Bump vue-material-design-icons from 5.3.1 to 5.3.2 photos#4015
• [stable35] Update nextcloud/ocp dependency photos#4023
• [stable35] Fix npm audit photos#4024
• [stable35] chore(deps): combine pending dependency updates photos#4029
• [stable35] fix(faces): Fix assigning unassigned faces to a person photos#4032
• [stable35] Honor EXIF OffsetTimeOriginal photos#4039
• [stable35] fix(filters): respect share download permission in filtered albums photos#4040
• [stable35] Chore(deps-dev): Bump postcss from 8.5.30 to 8.5.31 photos#4049
• [stable35] Update nextcloud/ocp dependency photos#4052
• [stable35] Fix npm audit photos#4056
• [stable35] ci(actions): Update workflow templates from organization template repository photos#4062
• [stable35] fix: proper component names photos#4064

privacy

• [stable35] Chore(deps-dev): Bump phpunit/phpunit from 11.5.55 to 11.5.57 in /vendor-bin/phpunit privacy#1495
• [stable35] Chore(deps-dev): Bump vimeo/psalm from 6.18.0 to 6.20.0 in /vendor-bin/psalm privacy#1503
• [stable35] chore(deps): combine pending dependency updates privacy#1506
• [stable35] Chore(deps): Bump vue-material-design-icons from 5.3.1 to 5.4.0 privacy#1509
• [stable35] Chore(deps-dev): Bump vimeo/psalm from 6.20.0 to 6.20.1 in /vendor-bin/psalm privacy#1514
• [stable35] Fix npm audit privacy#1521

recommendations

• [stable35] Fix npm audit recommendations#1186
• [stable35] chore(deps): bump npm dependencies recommendations#1202
• [stable35] Fix npm audit recommendations#1215
• [stable35] ci(actions): Update workflow templates from organization template repository recommendations#1219

serverinfo

• [stable35] Fix npm audit serverinfo#1205
• [stable35] Fix npm audit serverinfo#1242
• [stable35] feat: Show all users who logged at least once serverinfo#1250
• [stable35] fix(database): drop the join-without-index rules serverinfo#1258
• [stable35] Fix npm audit serverinfo#1263
• [stable35] Use subscription count when support app is enabled serverinfo#1267

text

• chore(deps): update vite (stable35) text#9363
• chore(deps): update dependency vue-tsc to ^3.3.13 (stable35) text#9364
• fix(deps): update tiptap to ^3.31.4 (stable35) text#9365
• [stable35] Update nextcloud/ocp dependency text#9367
• [stable35] Fix npm audit text#9370
• [stable35] fix(files): edited files marked locked in files list after close text#9378
• [stable35] tables: typescript and heading cell fixes text#9384
• [stable35] Refactor version comparison text#9386
• [stable35] fix(attachments): rewrite attachment file ids when copying folders text#9391
• [stable35] fix(attachments): normalize attachment names to Unicode NFC text#9396
• [stable35] fix(migration): quote identifiers in oracle index creation text#9397
• [stable35] fix(math): import katex css from component text#9401
• [stable35] fix(notifications): notify mentioned users about mentions by guests text#9402
• [stable35] fix(table): paste copied table cells into target cells text#9409
• [stable35] Update nextcloud/ocp dependency text#9421
• fix(deps): update dependency uuid to ^14.0.3 (stable35) text#9427
• fix(deps): update dependency vue to ^3.5.44 (stable35) text#9429
• [stable35] test(comparison): destroy all editor views in decorations spec text#9430
• [stable35] fix(session): skip session lookup without session params text#9443
• [stable35] check permission text#9445
• chore(deps): update vitest monorepo to ^4.1.12 (stable35) text#9455
• fix(deps): update dependency markdown-it to ^14.3.3 (stable35) text#9456
• [stable35] Update nextcloud/ocp dependency text#9460
• [stable35] Fix npm audit text#9465
• [stable35] fix(migration): create text_steps index ascending on oracle text#9472
• [stable35] fix(menu): make component actions work from the remaining actions menu text#9473
• [stable35] Fix misc flaky tests text#9479
• fix(deps): update dependency prosemirror-markdown to ^1.13.9 (stable35) text#9491
• [stable35] Update nextcloud/ocp dependency text#9504
• [stable35] Fix npm audit text#9508
• [stable35] fix(session): close null user text#9510
• [stable35] perf(cleanup): Optimize cleanup job text#9515
• [stable35] fix(editor): do not force save when clicking the save indicator text#9528
• [stable35] perf(editor): only serialize markdown on update when it is read text#9529
• [stable35] fix: don't silently drop outside changes (e.g. from external storage) text#9530
• [stable35] fix(FileContext): fix typo computeChecksum() -> computeCheckSum() text#9538
• [stable35] fix(sync): improve situation around false conflicts text#9547
• [stable35] chore(dev-deps): pin rector to 2.8.1 and phpstan to 2.3.3 text#9549
• [stable35] fix: improve gap cursor usage text#9554

twofactor_nextcloud_notification

• [stable35] ci(actions): Update workflow templates from organization template repository twofactor_nextcloud_notification#1572
• [stable35] Fix npm audit twofactor_nextcloud_notification#1574
• [stable35] ci(reuse): Fix reuse twofactor_nextcloud_notification#1578
• [stable35] ci(actions): Update workflow templates from organization template repository twofactor_nextcloud_notification#1588
• [stable35] Fix npm audit twofactor_nextcloud_notification#1590
• [stable35] build(deps): Bump vue from 3.5.43 to 3.5.44 twofactor_nextcloud_notification#1598
• [stable35] Update nextcloud/ocp dependency twofactor_nextcloud_notification#1602
• [stable35] Fix npm audit twofactor_nextcloud_notification#1604
• [stable35] ci(actions): Update workflow templates from organization template repository twofactor_nextcloud_notification#1611
• [stable35] Update nextcloud/ocp dependency twofactor_nextcloud_notification#1619
• [stable35] Fix npm audit twofactor_nextcloud_notification#1621
• [stable35] ci(actions): Update workflow templates from organization template repository twofactor_nextcloud_notification#1625

viewer

• [stable35] Fix/noid/no drag cursor without zoom compiled viewer#3361
• fix(deps): update dependency react-konva to ^18.2.16 (stable35) viewer#3374
• [stable35] Update nextcloud/ocp dependency viewer#3403
• [stable35] Fix npm audit viewer#3413
• chore(deps): update dependency @playwright/test to ^1.64.1 (stable35) viewer#3417
• [stable35] fix(viewer): register handlers not yet in the lookup table when opening a file viewer#3423
• [stable35] fix: only call the legacy files sidebar methods when they exist viewer#3448
• [stable35] fix(editor): save a JPEG with an uppercase extension as a JPEG viewer#3450
• [stable35] chore(deps): update stylelint to 17 viewer#3454
• [stable35] fix(viewer): skip duplicate handlers on init viewer#3457
• [stable35] fix(viewer): handle public shares on delete viewer#3460
• [stable35] fix(videos): use live photo metadata for poster viewer#3461
• [stable35] build(deps-dev): Bump vite from 7.3.6 to 7.3.7 viewer#3464
• [stable35] build(deps): Bump vue-material-design-icons from 5.3.1 to 5.3.2 viewer#3468
• [stable35] build(deps-dev): Bump @nextcloud/e2e-test-server from 0.6.0 to 0.6.1 viewer#3471
• [stable35] Update nextcloud/ocp dependency viewer#3475
• [stable35] ci(actions): Update workflow templates from organization template repository viewer#3479
• [stable35] Fix npm audit viewer#3482
• [stable35] Update nextcloud/ocp dependency viewer#3483
• [stable35] ci(actions): Update workflow templates from organization template repository viewer#3486
• [stable35] Fix npm audit viewer#3489

Pending PRs:

• @skjnldsv
  • [stable35] fix(files_reminders): keep folder preload for folders over 512 entries #65476 🔁
  • [stable35] fix(files): keep the view when reloading a file opened outside the files view #65543 🔁
• @kristian-zendato
  • [stable35] fix: show filenames on tight space #65955
• @susnux
  • [stable35] ci(dav): run CalDAVTester in a Python 2.7 container #66368 ✅
• @CarlSchwan
  • [stable35] fix: use strict in_array circles#3138
• @backportbot
  • [stable35] fix: use container-aware load averages serverinfo#1207
• (generated)
  • [stable35] 35.0.3 RC1 #66320 ✅

---

• ⚠: conflicts detected
• ✅: approved
• 🔁: changes requested

[blizzz]

Required PRS

• backport of fix(quota): Calculate used quota for foreign users the correct way #64872
• [stable35] fix(files): Continue scanning after StorageInvalidException #66291
• [stable35] fix(encryption): Don't use ChunkingV2Plugin when server-side encryption is enabled #66290
• [stable35] fix(session): Prevent stale requests from replacing a regenerated session #66295
• backport of refactor(session): use ITimeFactory for superseded session markers #66323

Nice to have

• [stable35] fix(sync): improve situation around false conflicts text#9547
• Needs backports (fix(lostpassword): Avoid having a different error message between expired and invalid #66308)