[stable33] 33.0.6 RC1

[nextcloud-bot]

Nextcloud 33.0.6

server

• [stable33] chore(deps): Bump vue from 3.5.33 to 3.5.34 #60401
• [stable33] fix(caldav): grant sharee Acls to the delegate #60646
• [stable33] chore(deps-dev): Bump eslint from 10.3.0 to 10.4.1 #60694
• [stable33] chore(deps-dev): Bump cypress from 15.14.2 to 15.16.0 #60696
• [stable33] fix(http): avoid iconv for header ascii fallback #60722
• [stable33] fix(DB): Enforce foreign key constraints in SQLite #60792
• [stable33] fix(encryption): recovery keys should be shown when user keys are used #60799
• [stable33] fix(appconfig,userconfig): restore pre-migration fallback for ownCloud migration #60819
• [stable33] chore(deps-dev): Bump cypress-if from 1.13.2 to 1.16.1 #60868
• [stable33] chore(deps-dev): Bump stylelint from 17.11.0 to 17.12.0 #60869
• chore(deps-dev): Bump sass from 1.99.0 to 1.100.0 #60871
• [stable33] chore(deps-dev): Bump vitest from 4.1.6 to 4.1.7 #60872
• [stable33] chore(deps-dev): Bump @vitest/coverage-v8 from 4.1.6 to 4.1.7 #60873
• [stable33] fix(files): Chromium-based browsers drag-and-drop #60899
• [stable33] chore(deps): Update flake to NixOS 26.05 #60912
• [stable33] fix(MailPlugin): Stop applying the offset twice and the limit per wide/exact #60920
• [stable33] fix(sharing): set STATUS_ACCEPTED when creating USERGROUP subshare on… #60925
• [stable33] fix(Share): Add missing optional parameter to IManager::shareApiAllowLinks() #60928
• [stable33] fix(psalm): Update psalm baseline #60933
• [stable33] test(cache): avoid ordering assumptions in testExtended #60935
• [stable33] fix(Storage): use proxyexclude parameter in DAV client #60939
• [stable33] fix(files_sharing): clear the password after saving #60951
• [stable33] fix: access shared and delegated trashbin objects #60967
• [stable33] fix(TaskProcessing): restrict allowed_classes in Manager cache deserialization #60984
• [stable33] [master] fix(security): Update code signing revocation list #61002
• [stable33] chore(deps-dev): Bump @vitest/coverage-v8 from 4.1.7 to 4.1.8 #61038
• [stable33] chore(deps-dev): Bump vite from 7.3.3 to 7.3.5 #61040
• [stable33] chore(deps): Bump vue from 3.5.34 to 3.5.35 #61041
• [stable33] fix(dav): finalize upload metadata before post-write hooks #61070
• [stable33] fix(dav): properly handle files metadata #61079
• [stable33] fix(comments): Use capped memory cache for comments #61096
• [stable33] fix(security): don't propagate ValueError from Crypto::decrypt() fallback #61104
• [stable33] fix(files): make sure nested changes are propagated to sidebar tabs #61107
• [stable33] fix: Correctly detect appid for dist css files #61112
• [stable33] fix: use correct permissions mask for non-home storage public links #61117
• [stable33] fix(settings): Show loading spinner while searching accounts #61121
• [stable33] build(deps): bump the symfony group across 1 directory with 9 updates #61130
• [stable33] [master] fix(security): Update code signing revocation list #61134
• [stable33] feat(file-search): add property to SearchQuery and check select fields to decide wheter to join extended cache #61156
• [stable33] build(deps): bump phpseclib/phpseclib from 2.0.53 to 2.0.54 #61179
• [stable33] fix(previews): ffprobe hangs #61183
• [stable33] fix(files_versions): guard null path in event listeners #61188
• [stable33] fix(SetupChecks): maintenance window length is 4h (not 6h) #61192
• [stable33] fix(search-query): fix psalm type error #61196
• [stable33] [master] fix(security): Update code signing revocation list #61238
• [stable33] fix(encryption): Fix endpoint /ajax/userSetRecovery to support boolean #61242
• [stable33] fix: use card interface instead of object #61251
• [stable33] build(deps-dev): bump stylelint from 17.12.0 to 17.13.0 #61265
• [stable33] [master] fix(security): Update code signing revocation list #61284
• [stable33] fix(twofactor_backupcodes): Add a clean helper to set code as used #61297
• [stable33] fix(theming): preserve uploaded favicon and touch icon #61301
• [stable33] fix: Use token expiration for ephemeral sessions #61306
• [stable33] fix(user_ldap): Escape filter part when searching for group members #61326
• [stable33] chore: Reduce PHPUnit test matrix on stable34 and remove coverage #61336
• [stable33] fix: trim duplicate search results for external share #61339
• [stable33] fix: Do not set last-password-confirm for apptoken sessions #61343
• [stable33] fix(team-manager): ensure team resources are only retrived for members #61350
• [stable33] fix(ocm-add-share): adjust domain validation #61356
• [stable33] fix: ensure file names are string-typed #61360
• [stable33] feat(oauth2): Add commands for adding and deleting clients #61362
• [stable33] fix: prevent editing delegated admins #61370
• [stable33] fix(caldav): respect federation settings #61380
• [stable33] fix(files_sharing): Hide incompatible actions in shares #61387

3rdparty

• build(deps): bump phpseclib/phpseclib from 2.0.53 to 2.0.54 3rdparty#2418
• build(deps): bump the symfony group across 1 directory with 9 updates 3rdparty#2457

activity

• [stable33] Update nextcloud/ocp dependency activity#2619
• [stable33] perf(mailqueue): cover amq_latest_send in the affecteduser index activity#2637

bruteforcesettings

• [stable33] fix: fix toggle the allow list option bruteforcesettings#1105
• Chore(deps): Bump vue from 3.5.29 to 3.5.35 bruteforcesettings#1140
• Chore(deps-dev): Bump @vitest/coverage-v8 from 3.2.4 to 3.2.6 bruteforcesettings#1141
• [stable33] Update nextcloud/ocp dependency bruteforcesettings#1142
• Chore(deps): Bump @vue/test-utils from 2.4.6 to 2.4.11 bruteforcesettings#1147

circles

• build: add .nextcloudignore for release builds circles#2495
• [stable33] Feat: Add role-based filtering for circle member queries circles#2504
• [stable33] fix(local-controller): dont show full config int of circle for non-members circles#2527
• [stable33] fix(local-controller): validate params set on team creation circles#2533
• [stable33] adjust local controller to better handle permission checks circles#2537

logreader

• [stable33] Fix npm audit logreader#2042
• [stable33] Fix npm audit logreader#2063

nextcloud_announcements

• [stable33] ci(actions): Update workflow templates from organization template repository nextcloud_announcements#639
• [stable33] Update nextcloud/ocp dependency nextcloud_announcements#647
• [stable33] ci(actions): Update workflow templates from organization template repository nextcloud_announcements#648

notifications

• [stable33] Fix npm audit notifications#3047
• [stable33] build(deps): Bump ua-parser-js from 2.0.9 to 2.0.10 notifications#3062
• [stable33] ci(actions): Update workflow templates from organization template repository notifications#3065
• [stable33] ci(actions): Update workflow templates from organization template repository notifications#3073
• [stable33] chore: extend testing of encryptAndSign and make the methods discoverable by psalm notifications#3079
• [stable33] Update nextcloud/ocp dependency notifications#3086
• [stable33] build(deps): Bump vue from 3.5.34 to 3.5.35 notifications#3094
• [stable33] Update nextcloud/ocp dependency notifications#3098
• [stable33] ci(actions): Update workflow templates from organization template repository notifications#3106
• [stable33] Fix npm audit notifications#3109
• [stable33] fix(email): Correctly initialize next_send_time field notifications#3119

serverinfo

• [stable33] chore: Require PHP 8.2 serverinfo#1021

suspicious_login

• [stable33] fix(notifier): Fix label length limited to 32 characters suspicious_login#1116

text

• [stable33] fix: disable open link button for unsafe link text#8684
• [stable33] fix(mediaHandler): strip relevant bidi chars in filenames text#8692
• [stable33] fix(Editor): emit modified fileNode size on save text#8695
• [stable33] Fix npm audit text#8708
• chore(deps): update vite to ^7.3.5 (stable33) text#8711
• chore(deps): update vitest monorepo to ^4.1.8 (stable33) text#8712
• [stable33] chore(github): update workflows text#8715
• [stable33] fix(math): fix lost content after math node text#8721
• [stable33] fix(editorApi): allow to disable image lazy-loading text#8727
• [stable33] Update nextcloud/ocp dependency text#8738
• [stable33] Fix npm audit text#8740
• [stable33] Fix permission change in text doc text#8750

twofactor_nextcloud_notification

• [stable33] Update nextcloud/ocp dependency twofactor_nextcloud_notification#1343
• [stable33] ci(actions): Update workflow templates from organization template repository twofactor_nextcloud_notification#1344
• [stable33] Fix npm audit twofactor_nextcloud_notification#1351
• [stable33] build(deps): Bump vue from 3.5.34 to 3.5.35 twofactor_nextcloud_notification#1363
• [stable33] Update nextcloud/ocp dependency twofactor_nextcloud_notification#1368
• [stable33] ci(actions): Update workflow templates from organization template repository twofactor_nextcloud_notification#1372
• [stable33] Fix npm audit twofactor_nextcloud_notification#1373

viewer

• [stable33] fix(plyr): the speed settings button should not be cut viewer#3198
• [stable33] fix(plyr): add l10n to components viewer#3202
• [stable33] fix(plyr): the speed selection should not go out of the viewport viewer#3208
• [stable33] fix(plyr): add l10n to speed selections viewer#3215

Pending PRs:

• @DerDreschner
  • [stable33] fix(DnsPinning): Ensure to always lookup based on FQDN #59157 🔁
• @backportbot
  • [stable33] dav: Fix fatal error when ORGANIZER is missing in CalDAV schedule #59350 ✅
• @nfebe
  • [stable33] fix(files_sharing): Drop trailing '?' from public download redirect URL #59885
• @solracsf
  • [stable33] fix(files,files_sharing): swallow redirected navigation errors #59887 ✅
• @icewind1991
  • [stable33] fix: actually register listener for updating stored external storage credentials #60905 ✅
• @backportbot
  • [stable33] fix(files): show proper information when a move will override the target #60962 ✅
  • [stable33] chore(deps-dev): bump phpunit/phpunit from 10.5.25 to 10.5.62 related_resources#846
• @janepie
  • [stable33] Fix: show Assistant icon if only translation provider available text#8759 ✅
• @come-nc
  • [stable33] fix: Fix explode calls for path parsing updater#762 ✅
• (generated)
  • [stable33] chore(deps): Bump @nextcloud/axios from 2.5.2 to 2.6.0 #60046 ✅
  • [stable33] chore(deps): Bump @nextcloud/axios from 2.5.2 to 2.6.0 in /build/frontend-legacy #60050 ✅
  • [stable33] chore(deps): Bump @vueuse/core from 14.2.1 to 14.3.0 #60265 ✅
  • [stable33] chore(deps): Bump @vueuse/integrations from 14.2.1 to 14.3.0 #60268 ✅
  • [stable33] chore(deps): Bump @nextcloud/vue from 9.6.0 to 9.8.0 #60446 ✅
  • chore(deps): Bump @nextcloud/dialogs from 7.3.0 to 7.4.0 #60875 ✅
  • [stable33] chore(deps): Bump @nextcloud/vue from 9.6.0 to 9.8.2 #61043 ✅

---

• ⚠: conflicts detected
• ✅: approved
• 🔁: changes requested