5.2.0

Note

This is a rolling release. Learn here about the release types and lifecycle.

Releasenotes OpenCloud 5.2.0

➕ Floating Action Button for “Create or Upload”

The “Create or Upload” button in the Files app is now a Floating Action Button (FAB). Available actions open as a dropdown or bottom drawer. The button is disabled or hidden if the user lacks write permissions.

New default format: Open formats like ODT are now the default format when creating new documents via the “New” button. This can be changed via the configuration file [here]

Changelog

5.2.0 - 2026-03-09

❤️ Thanks to all contributors! ❤️

@AlexAndBear, @JammingBen, @MahdiBaghbani, @ScharfViktor, @aduffeck, @butonic, @dragonchaser, @dragotin, @fschade, @pat-s, @rhafer, @dschmidt, @flimmy, @kulmann, @saw-jan, @micbar

Opencloud

📚 Documentation

• update links and references in CONTRIBUTING.md [#2411]
• adr(webfinger): Align example config with implementation [#2353]

📈 Enhancement

• feat(graph/education): Add support of 'eq' filters on users [#2421]
• feat(web): change surface colors to more modern ones [#2377]
• Add openCloudEducationExternalId to user [#2357]
• feat: app-registry adjust default mime-types [#2354]
• feat: support desktop and mobile specific client_id and scopes [#2072]

🐛 Bug Fixes

• [SKIP CI] Fix simple install script, use admin-password switch [#2413]
• resolve logout token subject:sessions for the idp backchannel logout [#2328]
• fix(oidc_auth): Fix userinfo cache expiration logic [#2360]

📦️ Dependencies

• build(deps): bump github.com/open-policy-agent/opa from 1.13.2 to 1.14.0 [#2427]
• build(deps): bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 [#2425]
• build(deps): bump github.com/davidbyttow/govips/v2 from 2.16.0 to 2.17.0 [#2420]
• build(deps): bump github.com/nats-io/nats.go from 1.48.0 to 1.49.0 [#2390]
• build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 [#2412]
• build(deps): bump github.com/kovidgoyal/imaging from 1.8.19 to 1.8.20 [#2391]
• build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.7 to 2.28.0 [#2375]
• build(deps): bump github.com/open-policy-agent/opa from 1.13.1 to 1.13.2 [#2374]
• build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.1 [#2362]
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.28.0 to 2.28.1 [#2366]
• build(deps): bump go.opentelemetry.io/contrib/zpages from 0.64.0 to 0.65.0 [#2363]
• build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0 [#2356]
• build(deps): bump github.com/go-resty/resty/v2 from 2.17.1 to 2.17.2 [#2355]
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.64.0 to 0.65.0 [#2321]
• build(deps): bump github.com/open-policy-agent/opa from 1.12.3 to 1.13.1 [#2350]

Web

💥 Breaking changes

• feat!: remove deprecations for v6.0.0 [#2093]
• refactor!: floating UI [#1998]
• refactor!: port vue-portal to teleport or extension system [#2015]
• refactor!: mobile nav to web-pkg [#2007]

🔒 Security

• chore(deps): fix current security alerts [#2040]

📈 Enhancement

• feat: use proper size-5 class for medium sized icons [#2066]
• feat: increase topbar height [#2070]
• Improve empty state icons [#2094]
• feat: ease use of floating action button extension [#2090]
• feat: add polished icons for no content message [#2033]
• feat: add fab to admin settings and spaces overview [#2025]
• feat(ocm): implement WAYF page and enhance invitation workflow [#1486]
• feat: modernize surface colors [#2023]
• feat: create or upload floating action button [#1997]
• feat: eleminate collapsed state of left side bar [#1993]
• feat: unifiy create and upload button [#1989]

🐛 Bug Fixes

• fix: don't show 'new' button in secret file drop [#2086]
• Fix broken link to web docs [#2080]
• fix: admin settings layout [#2062]
• fix: backchannel logout react to sid [#1969]
• fix: broken AvatarImage usages [#2042]
• fix(files): prevent selection reset during keyboard navigation [#2044]
• fix: visual active state in preview app (photo roll) [#2029]
• fix: prevent 'New'-button flicker when navigating [#2026]
• fix(web-runtime): cache embed query params across config reloads [#1977]
• fix(web-pkg): guard against missing routes in getEditorRoute [#1975]

✅ Tests

• keycloak tests [#2064]
• test(e2e): increase timeout for large file upload step [#2067]
• update keycloak version [#2051]
• [full-ci] test: fix ocm invite token parsing [#2049]

📦️ Dependencies

• chore(deps): update dependency eslint to v10 [#1945]
• chore(deps): update dependency md-editor-v3 to v6.4.0 [#2072]
• chore(deps): update devdependencies (non-major) [#2057]
• fix(deps): update dependency @sentry/vue to v10.42.0 - autoclosed [#2052]
• chore(deps): update dependency fast-xml-parser to v5.4.2 [#2059]
• chore(deps): update dependency @floating-ui/dom to v1.7.6 [#2065]
• chore(deps): update dependency dompurify to v3.3.2 [security] [#2095]
• chore(deps): update dependency ejs to v5 [#2096]
• chore(deps): update dependency @codemirror/view to v6.39.16 [#2050]
• chore(deps): update dependency globals to v17.4.0 [#2048]
• chore(deps): update dependency @cucumber/messages to v32.2.0 [#2047]
• fix(deps): update dependency axios to v1.13.6 [#2046]
• chore(deps): update dependency @cucumber/messages to v32.1.0 [#2043]
• chore(deps): update tiptap monorepo to v3.20.0 [#1999]
• chore(deps): update dependency simple-git to v3.32.3 [#2039]
• chore(deps): update devdependencies (non-major) [#2030]
• fix(deps): update dependency @sentry/vue to v10.40.0 [#2036]
• chore(deps): update dependency fast-xml-parser to v5.4.1 [#2037]
• chore(deps): update vue monorepo to v3.5.29 [#2034]
• chore(deps): update node.js to v24.14.0 [#2035]
• chore(deps): update typescript-eslint monorepo to v8.56.1 [#2031]
• chore(deps): update traefik docker tag to v...

5.1.0

Note

This is a rolling release. Learn here about the release types and lifecycle.

Releasenotes OpenCloud 5.1.0

🖼️ Preview App Performance

The Preview App has been optimized for significantly better performance when browsing large photo folders. Instead of requesting all images at full resolution, only the currently viewed image is loaded in high quality. Images in the Photo Roll are loaded as small thumbnails and only for items visible in the viewport. Additional images are loaded dynamically while scrolling, and pending image requests are cancelled when they are no longer needed, especially on slow or unstable connections.

Changelog

5.1.0 - 2026-02-16

❤️ Thanks to all contributors! ❤️

@ScharfViktor, @VicDeo, @aduffeck, @dragonchaser, @individual-it, @kulmann, @micbar, @rhafer, @schweigisito

🐛 Bug Fixes

• [full-ci] Bump reva v2.42.4 [#2348]
• fix: fix typo in variable description [#2333]
• fix: include sessionID in sse logout event [#2327]
• fix: fix typo in gateway service documentation [#2332]
• Sanitize web config only once [#2286]

📈 Enhancement

• external tenant id [#2258]

📚 Documentation

• fix: make file urls [#2304]

📦️ Dependencies

• build(deps): bump github.com/gabriel-vasile/mimetype from 1.4.12 to 1.4.13 [#2316]
• build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.39.0 to 1.40.0 [#2279]
• update reva after merge #514 [#2309]
• build(deps): bump github.com/go-chi/chi/v5 from 5.2.4 to 5.2.5 [#2278]

5.0.2

5.0.2 - 2026-02-05

Security

⚠️ Update immediately: CVE-2026-23989, a security issue in public links is resolved in v5.0.2.

We recommend all deployments running previous versions to update to one of these releases immediately.

❤️ Thanks to all contributors! ❤️

@AlexAndBear, @ScharfViktor, @flimmy, @individual-it, @rhafer, @saw-jan

🐛 Bug Fixes

• [full-ci] reva-bump-2.42.3 [#2276]

✅ Tests

• adapt test for #514 [#2255]
• api-test: upload-rename-download file with back slash [#2239]
• [full-ci][tests-only] test: add hook failures to the test failures list [#2041]

📚 Documentation

• docs(proxy): Clarify PROXY_OIDC_USERINFO_CACHE_TTL value [#2256]

📦️ Dependencies

• [full-ci] reva-bump-2.42.2 [#2270]
• build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.5 to 2.27.6 [#2238]

5.0.2-rc.1

v5.0.2-rc.1

Release 5.0.2 RC 1

4.0.3

4.0.3 - 2026-02-05

Security

⚠️ Update immediately: CVE-2026-23989, a security issue in public links is resolved in v4.0.3.

We recommend all deployments running previous versions to update to one of these releases immediately.

❤️ Thanks to all contributors! ❤️

@ScharfViktor, @aduffeck, @fschade, @kulmann, @micbar, @prashant-gurung899, @saw-jan

🐛 Bug Fixes

• Bump reva 2.40.3 [#2275]

✅ Tests

• [tests-only] port tests to stable #2087 #2039 [#2185]
• [full-ci][tests-only] port test fixes [#2017]
• [stable-4.0] Port #2011 [#2018]

📦️ Dependencies

• Bump reva [#2274]

Reva

• fix(authscope): Fix parent check [#522]

4.0.3-beta.1

v4.0.3-beta.1

Release 4.0.3 Beta 1

4.0.2

4.0.2 - 2026-02-05

❤️ Thanks to all contributors! ❤️

@ScharfViktor, @aduffeck, @fschade, @kulmann, @micbar, @prashant-gurung899, @saw-jan, @rhafer

Opencloud

✅ Tests

• [tests-only] port tests to stable #2087 #2039 [#2185]
• [full-ci][tests-only] port test fixes [#2017]
• [stable-4.0] Port #2011 [#2018]

📦️ Dependencies

• Bump reva [#2274]

Reva

🔒 Security

• Public scope fix [#519]

4.0.2-rc.1

Merge pull request #2274 from aduffeck/bump-reva-v2.40.2

Bump reva

5.0.1

5.0.1 - 2026-01-28

❤️ Thanks to all contributors! ❤️

@ScharfViktor, @aduffeck, @saw-jan

Opencloud

🐛 Bug Fixes

• Do not ever set a TTL for the ID cache. It's not supposed to expire. [#2223]

✅ Tests

• test(api): wait for web-office readiness by checking discovery endpoint [#2217]

📦️ Dependencies

• reva-bump-2.42.1 [#2225]

Reva

🐛 Bug Fixes

• Apply changed TTL settings to existing buckets [#509]

5.0.0

Note

This is a rolling release. Learn here about the release types and lifecycle.

Releasenotes OpenCloud 5.0.0

This release includes moving the ocdav handler back into the frontend, along with a set of changes that enable the registration of editor apps on folders.

⚠️ This release introduces breaking changes affecting both the Go microservice and frontend behavior. In accordance with Semantic Versioning, we have incremented the major version number.

Changelog

5.0.0 - 2026-01-26

❤️ Thanks to all contributors! ❤️

@ScharfViktor, @butonic, @dragonchaser, @flimmy, @fschade, @micbar, @rhafer, @saw-jan, @JammingBen, @kulmann, @michaelstingl, @tammi-23, @aduffeck

Opencloud:

💥 Breaking changes

• merge ocdav into frontend [#1958]

✅ Tests

• [test-only] replace exception to assertions [#2196]
• test(api): auto-generate test virus files before test run [#2191]
• test(api): remove accountsHashDifficulty test suite [#2190]
• test(api): update without-remotephp expected-failures list [#2184]
• [full-ci] test: use single command to run the containers and the API tests [#2169]
• [tests-only] test: setup for running wopi API tests locally [#2139]
• fix flaky #2145 [#2161]
• Run wopi validator tests localy [#2151]
• ci: fix unwanted workflow skip in the cron pipelines [#2117]
• [POC] ci: skip previously passed workflows on pipeline restart [#2099]
• [tests-only] test: wait post-processing to finish for MKCOL requests [#2092]
• [tests-only] test: fix API tests [#2087]
• [full-ci] use graph api in the enforcePasswordPublicLink.feature [#2050]
• [full-ci][tests-only] test: check last email content with retries as emails can be delayed [#2038]
• skip collaborativePosix tests in CI [#2039]

📚 Documentation

• Update release template [#2182]
• Clarify what the two requests are used for [#2179]
• fix: markdown links formatting [#2143]

🐛 Bug Fixes

• fix: Show username in unprivileged search results [#2104]
• fix(thumbnailer): missing font panic [#2097]
• Remove sub-service binary entrypoints and fix antivirus only server cmd [#2043]
• fix(thumbnailer): respect image boundaries and text wrappings [#2062]
• fix: cobra viper flags and env [#2047]
• fix service name in suture logs [#2052]

📈 Enhancement

• benchmark client enhancements [#1856]
• allow http2 connections to proxy [#2040]
• migrate from urfave/cli to spf13/cobra [#1954]

📦️ Dependencies

• reva-bump-2.42.0 [#2215]
• build(deps): bump github.com/olekukonko/tablewriter from 1.1.2 to 1.1.3 [#2186]
• build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.4 to 2.27.5 [#2204]
• build(deps): bump github.com/go-resty/resty/v2 from 2.7.0 to 2.17.1 [#2197]
• build(deps): bump github.com/open-policy-agent/opa from 1.11.1 to 1.12.3 [#2166]
• build(deps): bump github.com/kovidgoyal/imaging from 1.8.18 to 1.8.19 [#2167]
• build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.27.3 to 2.27.4 [#2164]
• build(deps): bump github.com/sirupsen/logrus from 1.9.4-0.20230606125235-dd1b4c2e81af to 1.9.4 [#2163]
• build(deps): bump github.com/go-chi/chi/v5 from 5.2.3 to 5.2.4 [#2162]
• build(deps): bump go.opentelemetry.io/contrib/zpages from 0.63.0 to 0.64.0 [#2158]
• build(deps): bump github.com/blevesearch/bleve/v2 from 2.5.5 to 2.5.7 [#2157]
• build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.38.0 to 1.39.0 [#2154]
• build(deps): bump golang.org/x/image from 0.34.0 to 0.35.0 [#2153]
• build(deps): bump github.com/nats-io/nats.go from 1.47.0 to 1.48.0 [#2147]
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.27.2 to 2.27.5 [#2148]
• build(deps): bump github.com/olekukonko/tablewriter from 1.1.1 to 1.1.2 [#2144]
• build(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 [#2141]
• build(deps): bump golang.org/x/net from 0.48.0 to 0.49.0 [#2140]
• build(deps): bump github.com/onsi/gomega from 1.38.2 to 1.39.0 [#2133]
• build(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 [#2132]
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.63.0 to 0.64.0 [#2109]
• build(deps): bump github.com/kovidgoyal/imaging from 1.8.17 to 1.8.18 [#2107]
• build(deps): bump google.golang.org/grpc from 1.77.0 to 1.78.0 [#2106]
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 [#2069]
• build(deps): bump github.com/opensearch-project/opensearch-go/v4 from 4.5.0 to 4.6.0 [#2068]
• build(deps): bump github.com/testcontainers/testcontainers-go/modules/opensearch from 0.39.0 to 0.40.0 [#1967]
• build(deps): bump golang.org/x/net from 0.47.0 to 0.48.0 [#2061]
• build(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.11.0 [#1930]

Web:

💥 Breaking changes

• feat!: remove deprecations [#1829]
• feat: folder editor apps [#1817]

🔒 Security

• fix(deps): update dependency lodash-es to v4.17.23 [security] #2 [#1859]
• chore(deps): bump preact to v10.28.2 [security] [#1814]

📈 Enhancement

• feat: clarify error text on 412 error in editor [#1850]
• Mail: Mail compose as Widget #1609 [#1687]
• feat: allow .readme.md filename for top level readme [#1769]

🐛 Bug Fixes

• fix: add missing low opacity for cut resources in tiles view [#1852]
• fix: delete action showing without any selected file in trash bin [#1853]
• fix: embed actions filename input and confirm button name [#1849]
• fix: prevent sort options in trash overview from disappearing [#1851]
• fix: break long resource names in right sidebar [#1836]
• fix: context menu for shares on search result page [#1835]
• fix: text editor app entry for light users [#1837]
• fix: resource delete action visibility [#1832]
• fix(calendar): use type="a" for external documentation link [#1801]
• fix(design-system): checkbox label vertical alignment [[#1773](https:/...