This page contains detailed information about software changes.

8.52.240

Behavioral Changes

SCR-1826

Summary: New metrics for the Redis circuit breakers and bulkhead

Effective: 8.52.240 and later

The Redis connector now reports Micrometer meters for its resilience policies: appsuite_redis_breaker_state (0 closed, 1 half-open, 2 open, -1 disabled; the breaker tag tells the two breakers apart - common guards against failing operations, connect against an unreachable end-point), appsuite_redis_breaker_rejected and appsuite_redis_bulkhead_rejected, counting the operations shed by the respective policy. The connection pool additionally reports appsuite_redis_connections_num_multiplexed, the number of operations currently using a connection. In the default shared pool mode operations are multiplexed onto a fixed number of connections, so appsuite_redis_connections_num_active is bounded by the configured pool size and borrowing never blocks - appsuite_redis_connections_num_waiters and the borrow wait times are always zero there. Saturation therefore shows as appsuite_redis_bulkhead_rejected rising and appsuite_redis_breaker_state leaving zero, not through the pool gauges; alerts built on the pool gauges should be revisited. No new configuration.

Configuration

SCR-1827

Summary: New configuration options for the Redis connector start-up behavior

Effective: 8.52.240 and later

Two configuration options control how the Redis connector behaves while its bundle starts.

• com.openexchange.redis.awaitEndPointOnStartup Whether bundle start-up awaits reachability of the Redis end-point. With the default the connector blocks until the end-point answers. Setting it to false moves the wait off the start-up path: the end-point is awaited in the background, with a growing but capped interval between attempts, so a pod starts and can be terminated cleanly even while Redis is unavailable. In either mode the RedisConnectorService is registered only once the end-point answered, so consumer bundles never start against an unreachable Redis; until then the node is up but not serviceable - a login attempt in that window fails. A condition that cannot resolve without a configuration change - rejected credentials above all - ends the background wait; the node then has no Redis functionality until it is restarted with a corrected configuration. This property applies to the regular Redis instance only; dedicated cache instances and remote sites always start without awaiting their end-point. Default true. Not reloadable, not config-cascade aware. File: redis.properties.

• com.openexchange.redis.awaitEndPointBudgetMillis How long start-up awaits the Redis end-point before giving up, in milliseconds. Only relevant while com.openexchange.redis.awaitEndPointOnStartup is true. The default waits indefinitely, which is what a Redis that is merely slow to become available needs: loading a large dataset after a restart can take considerably longer than a few minutes, and every node of the installation is waiting for the same end-point. Set a value only where a bounded start-up is preferred over waiting it out; start-up then fails with an error instead of continuing to retry. A condition that cannot resolve without a configuration change - rejected credentials above all - is reported immediately regardless of this setting. A value less than or equal to 0 (zero) means no limit. Default 0. Not reloadable, not config-cascade aware. File: redis.properties.

8.52.239

Configuration

SCR-1825

Summary: New configuration option for Redis Sentinel authentication

Effective: 8.52.239 and later

In order to connect to a password-protected Redis Sentinel, a new configuration option has been added.

• com.openexchange.redis.sentinel.password Specifies the password used to authenticate against the Redis Sentinel nodes. Only effective if com.openexchange.redis.mode is set to sentinel. Sentinel authentication is separate from the credentials for the Redis nodes themselves, which remain configured through com.openexchange.redis.username and com.openexchange.redis.password. An empty value means the Sentinel nodes require no authentication. Set it only if the Sentinel nodes actually require authentication; otherwise they reject the AUTH command and the topology look-up fails. For a special Redis instance the option is available as com.openexchange.redis.[instanceId].sentinel.password, with [instanceId] being cache or the identifier of a remote site. Default empty. Not reloadable, not config-cascade aware. File: redis.properties.

8.52.237

General

SCR-1822

Summary: Added command-line tool threaddump that covers virtual threads

Effective: 8.52.235 and later

The new command-line tool threaddump writes a thread dump of the middleware that includes virtual threads. The middleware runs its HTTP work on virtual threads, which neither jstack nor the Thread.print diagnostic command lists. It therefore uses Thread.dump_to_file through JMX, which needs no jcmd binary - the runtime image ships none. The middleware writes the file itself, so the path given via -f is resolved on the middleware's host. That dump performs no deadlock analysis, hence --print-classic prints the classic dump as a second, separate dump on the terminal. Further options are --format (plain or json, where json carries no lock information) and --overwrite.

$ threaddump -f /tmp/threads.txt
Thread dump successfully written to file /tmp/threads.txt on the middleware's host

$ head /tmp/threads.txt
7
2026-08-14T06:54:19.525073364Z
25.0.4+-wolfi-r0

#3 "main" RUNNABLE 2026-08-14T06:54:19.525200Z
    at ...

#28 "OXWorker-0007" virtual BLOCKED 2026-08-14T06:54:19.525300Z
    at ...
    - waiting to lock <java.lang.Object@2df9b86>

8.52.226

Behavioral Changes

SCR-1814

Summary: Reseller ownership and restrictions are now enforced when copying a user

Effective: 8.52.226 and later

With open-xchange-admin-reseller installed, the usercopy provisioning call now behaves like user creation: the calling administrator has to own both the source and the destination context, or be the parent of their owners, and a copied user counts against the restrictions of the destination context (Context.MaxUser, Subadmin.MaxOverallUser and their module access variants). Previously neither was checked, so any subadmin could copy any user between arbitrary contexts and copied users counted against no limit.

The restrictions are evaluated before the copy as a fast fail and again afterwards, which is the binding decision. Evaluating after the write is what keeps a limit from being exceeded when copies run in parallel, and it is the order user creation already uses. A rejected copy is removed again; copies issued in parallel against a context close to its limit may therefore all be rejected.

Copies performed by a subadmin require MASTER_ACCOUNT_OVERRIDE=true in AdminDaemon.properties, as every other user provisioning call performed by a subadmin does.

The check whether an administrator owns a set of contexts was corrected as well: it correlated database rows with the given contexts by position instead of by context identifier, and treated a context without an owner as owned. Such contexts remain reserved for the master administrator now.

Deployments without the reseller extension are not affected.

8.52.216

Behavioral Changes

SCR-1723

Summary: Java 25: virtual-thread HTTP worker pool and opt-in generational ZGC

Effective: applies to the 8.52 release line

The middleware now runs on Java 25. Grizzly HTTP workers use virtual threads by default (com.openexchange.http.grizzly.virtualThreadsEnabled=true) and Compact Object Headers are on. No admin action required: G1 stays the default garbage collector, so existing memory sizing still fits. Generational ZGC is opt-in via the Helm value javaOpts.zgc - faster in the load test (mean 38 vs 56 ms, p99 213 vs 796 ms, +47% throughput), but it needs sizing: 4G heap on a 6G limit with MALLOC_ARENA_MAX=2 and enough CPU. Too little memory surfaces as failing IMAP/SMTP connections rather than as an OOM. Changed worker-pool defaults: com.openexchange.threadpool.maximumPoolSize 2000 (was unbounded), workQueue linked (was synchronous), virtual.maxConcurrency auto (was 20000). Details: https://documentation.open-xchange.com/8/middleware/administration/garbage_collection_and_memory_sizing.html

8.52.197

Configuration

SCR-1803

Summary: New properties for the replication monitor's replica status check

Effective: 8.52.197 and later

The replication monitor now probes read replicas' replication status (SHOW SLAVE STATUS) and redirects reads to the master while a replica reports broken replication or excessive lag. This closes the gap that a re-seeded or inconsistently restored replica could serve incomplete data undetected (middleware/core#4, follow-up to the incident behind appsuite/support#1599). Four new lean configuration properties control the behavior:

• com.openexchange.database.replicationMonitor.checkReplicaStatus (default: true) - Whether to watch read replicas for broken or excessively lagging replication and redirect reads to the master meanwhile. Works out of the box: where the REPLICA MONITOR (MariaDB) or REPLICATION CLIENT (MySQL) privilege is available, the replication status statement provides fast, precise detection; without it the check falls back to a privilege-free heartbeat, a time stamp periodically written through the replication channel into the replicationMonitor table (reserved row cid=4294967295), needing only the regular INSERT/UPDATE/SELECT permissions. REPLICA MONITOR (MariaDB) or REPLICATION CLIENT (MySQL) privilege; both are global privileges, so one grant per database host covers all existing and future schemas, and initconfigdb -a now grants them automatically. Without the privilege the check suspends itself for the affected pool. Only effective if the replication monitor is active. Default: true. Reloadable: false. Config-cascade aware: false.
• com.openexchange.database.replicationMonitor.maxReplicaLag - Maximum tolerated replication lag in seconds before reads are redirected to the master. Default: 300. Reloadable: false. Config-cascade aware: false.
• com.openexchange.database.replicationMonitor.replicaStatusCheckInterval - Minimum number of seconds between two replication status probes per read pool. Default: 10. Reloadable: false. Config-cascade aware: false.
• com.openexchange.database.replicationMonitor.requireReplication - Whether a read host that does not act as a replica at all (empty SHOW SLAVE STATUS) is considered unhealthy. Keep false for Galera or multi-primary setups; set to true where read pools are always asynchronous replicas. Default: false. Reloadable: false. Config-cascade aware: false.

All four properties are read once at middleware start-up; changing them requires a restart. They are server-scoped (no config-cascade evaluation) and documented in documentation-generic/config/ConfigDB.yml. Defaults are safe for every topology: without the privilege or without asynchronous replication the check fails open and behavior is unchanged.

8.52.190

3rd Party Libraries/License Change

SCR-1796

Summary: Updated Netty libraries from v4.2.15 to v4.2.16 in bundle io.netty

Effective: 8.52.190 and later

Updated Netty libraries from v4.2.15.Final to v4.2.16.Final (patch version update) in bundle io.netty. Drop-in replacement of all 22 netty-* artifacts (binary and source JARs). No artifacts were added or removed and there are no exported-package changes relative to 4.2.15.

Updated artifacts (4.2.15.Final → 4.2.16.Final):

• netty-buffer-4.2.16.Final.jar
• netty-codec-base-4.2.16.Final.jar
• netty-codec-compression-4.2.16.Final.jar
• netty-codec-dns-4.2.16.Final.jar
• netty-codec-http-4.2.16.Final.jar
• netty-codec-http2-4.2.16.Final.jar
• netty-codec-marshalling-4.2.16.Final.jar
• netty-codec-protobuf-4.2.16.Final.jar
• netty-codec-socks-4.2.16.Final.jar
• netty-codec-xml-4.2.16.Final.jar
• netty-common-4.2.16.Final.jar
• netty-handler-4.2.16.Final.jar
• netty-handler-proxy-4.2.16.Final.jar
• netty-resolver-4.2.16.Final.jar
• netty-resolver-dns-4.2.16.Final.jar
• netty-transport-4.2.16.Final.jar
• netty-transport-native-unix-common-4.2.16.Final.jar
• netty-transport-classes-epoll-4.2.16.Final.jar
• netty-transport-native-epoll-4.2.16.Final.jar
• netty-transport-classes-io_uring-4.2.16.Final.jar
• netty-transport-classes-kqueue-4.2.16.Final.jar
• netty-transport-native-kqueue-4.2.16.Final.jar

Unchanged: netty-tcnative-classes-2.0.80.Final.jar (already current). No configuration or behavior changes within the 4.2.x line. Consumers use OSGi Import-Package version ranges, so no dependent-bundle adjustments are needed. Lettuce (bundle io.lettuce) is unaffected and remains at v7.6.0.RELEASE (already the latest release).

SCR-1795

Summary: Jakarta EE 11: upgrade target platform to Jersey 4.0.2 / jakarta.ws.rs 4.0 / HK2 4.0.1

Effective: 8.52.190 and later

Upgrades the shared target platform (com.openexchange.bundles) to the Jakarta EE 11 RESTful services stack.

• Jersey 3.1.3 -> 4.0.2 (container-servlet-core merged upstream; unused apache-connector dropped)
• jakarta.ws.rs-api 3.1.0 -> 4.0.0; jakarta.annotation-api 2.1.1 -> 3.0.0; jakarta.validation-api 3.0.2 -> 3.1.0
• HK2 3.0.5 -> 4.0.1 (GA); aopalliance-repackaged -> 4.0.1; osgi-resource-locator 1.0.3 -> 3.0.0
• jackson-jakarta-rs providers (2.22.0): ws.rs import range widened in place to [3.0.0,5.0.0) so they resolve against ws.rs 4.0 (no released version supports ws.rs 4.0 yet; the MessageBodyReader/Writer contract is unchanged)
• MicroProfile Health kept at 3.0: version 4.0.1 imports jakarta.enterprise.util [3.0,4.0), incompatible with the EE 11 CDI package version 4.0, so it cannot resolve against an EE 11 CDI stack. Legacy javax cdi-api 2.0.SP1 and javax.inject provider retained.

Package import ranges for jakarta.ws.rs and org.glassfish.jersey widened [3.1,4) -> [4,5) in the affected core bundles. No configuration, HTTP API or behavior change. Dependent repositories pinning jakarta.ws.rs [3.1,4) (custom, comcast, cloud-plugins, exchange-interop, plugins, usm, kpn) must widen their ranges in lockstep.

SCR-1794

Summary: Upgrade Box SDK to generated Box Java SDK 10.15.1 (com.box.sdkgen)

Effective: 8.52.190 and later

The Box.com file storage bundle com.openexchange.file.storage.boxcom is migrated from the retired classic Box Java SDK (com.box:box-java-sdk 4.16.4, package com.box.sdk) to the current generated Box Java SDK (com.box:box-java-sdk 10.15.1, package com.box.sdkgen). The generated SDK replaces the object-graph API of BoxFolder/BoxFile handles with a manager and DTO API - a BoxClient exposing FoldersManager, FilesManager, UploadsManager, DownloadsManager, SearchManager and UsersManager that return schema DTOs - so the whole resource access layer of the bundle is rewritten. The classic BoxAPIConnection is replaced by a BoxClient backed by a small App-Suite-owned Authentication implementation whose access token is refreshed externally by App Suite's OAuth service, leaving the token life-cycle unchanged, and com.box.sdk.BoxAPIException is replaced by com.box.sdkgen.box.errors.BoxAPIError / BoxSDKError. The embedded third-party libraries change accordingly: box-java-sdk 10.15.1 and jose4j 0.9.6 are embedded, minimal-json and zstd-jni are dropped, and jackson, okhttp/okio, bouncycastle and slf4j are consumed from the platform bundles. There is no configuration, HTTP API or externally visible behavior change; the migration is internal to the bundle and no dependent bundle consumes the Box SDK packages. Since there is no Box OAuth setup in the development environment, the bundle was verified to compile and to link and run against the live Box API via a standalone smoke test on JDK 25; full end-to-end verification against a real Box account is pending as a QA step before release.

SCR-1792

Summary: Upgrade Cassandra driver to Apache Cassandra java-driver 4.19.3

Effective: 8.52.190 and later

The Cassandra driver embedded in com.openexchange.nosql.cassandra is upgraded from the end-of-life DataStax cassandra-driver 3.11.5 to Apache Cassandra java-driver 4.19.3. The bundle keeps exposing the driver API to depending packages, but the exported packages move from com.datastax.driver.* to com.datastax.oss.driver.api.*. All properties keep their keys; their semantics follow the 4.x driver model of fixed-size connection pools and unified load balancing. New is com.openexchange.nosql.cassandra.localDatacenter (default empty), the datacenter considered local by the load balancing policy - if empty it is inferred from the contact points, which is only reliable for single-datacenter clusters, so multi-datacenter deployments should set it explicitly. Removed without a 4.x equivalent are minimumLocalConnectionsPerNode and minimumRemoteConnectionsPerNode (pools now have a fixed size configured via the existing maximum properties), idleConnectionTrashTimeout (connections are no longer trashed), acquisitionQueueMaxSize (the queue no longer exists) and maximumRequestsPerRemoteConnection (maximumRequestsPerLocalConnection now applies to all connections). Changed semantics: loadBalancingPolicy still accepts the legacy values RoundRobin, DCAwareRoundRobin and DCTokenAwareRoundRobin but all map to the token-aware datacenter-local round-robin the driver ships, with the default changed to DCTokenAwareRoundRobin; poolingHeartbeat can no longer be disabled with 0, which falls back to the driver default of 30 seconds; readTimeout now maps to the driver's overall request timeout rather than the per-read socket timeout; and enableQueryLogger now logs slow and failed statements instead of all statements. The JMX MBeans below com.openexchange.nosql.cassandra are kept - attributes without a 4.x equivalent were removed and aborted-request counters were added.

SCR-1787

Summary: Introduced Apache HttpClient 5 platform bundles and HttpClient-5-based managed HTTP client service

Effective: 8.52.190 and later

First step of the HttpClient 4.x (EOL) to 5.x migration (core#544):

• Added httpclient5 5.6.2, httpcore5 5.4.3 and httpcore5-h2 5.4.3 as target platform bundles (com.openexchange.bundles). The upstream jars ship without OSGi metadata, so OSGi manifests are re-added (versioned exports; optional imports for conscrypt/brotli4j/zstd/commons-compress). Provided additively next to the existing 4.x bundles.
• Added an HttpClient-5-based twin of the managed HTTP client machinery as com.openexchange.rest.client.httpclient.v5 (service, managed client with hard connect/read timeout watchers, pooling connection manager with monitoring metrics, cookie stores and lenient cookie spec, security route planners and redirect strategies, configuration SPI). The twin service is registered in parallel to the 4.x service so that consuming bundles can migrate individually.
• Migrated com.openexchange.conference.webhook as the first consumer (blueprint).

The 4.x based service and platform bundles remain untouched until all consumers (incl. dependent repositories) are migrated.

SCR-1786

Summary: Upgraded Apache PDFBox from 2.0.x to 3.0.7

Effective: 8.52.190 and later

Upgraded the PDF stack used for mail export (com.openexchange.mail.exportpdf.impl) and the target platform:

• pdfbox/fontbox/xmpbox upgraded from 2.0.27 to 3.0.7 (new companion artifact pdfbox-io)
• Unused pdfbox-tools and preflight embeds removed (never referenced by code)

• pdfbox2-layout 1.0.1 has no PDFBox 3 compatible release; its MIT-licensed sources are vendored into the bundle (rst.pdfbox.layout.*) and ported to the PDFBox 3 API

• Target platform pdfbox/fontbox 2.0.30 upgraded to 3.0.7 (+ pdfbox-io); consumed by openexchange-test (ExportPDFTest)

• Code migrated to the PDFBox 3 API: Loader.loadPDF instead of PDDocument.load, Standard14Fonts.FontName based font construction, MemoryUsageSetting.streamCache, PDPageContentStream.AppendMode, xmpbox createAndAddPDFAIdentificationSchema

SCR-1785

Summary: Upgraded OpenSAML from 3.4.5 to 5.2.3

Effective: 8.52.190 and later

Upgraded the SAML stack in com.openexchange.saml from the EOL OpenSAML 3.4.5 to the supported OpenSAML 5.2.3:

• All opensaml-* artifacts upgraded from 3.4.5 to 5.2.3 (opensaml-core is split into opensaml-core-api/opensaml-core-impl upstream)

• net.shibboleth.utilities:java-support 7.5.1 replaced by the modular net.shibboleth shared libraries 9.2.3 (shib-support/shib-security/shib-networking/shib-velocity); exported packages move from net.shibboleth.utilities.java.support.* to net.shibboleth.shared.*

• xmlsec upgraded from 2.3.4 to 3.0.6, metrics-core from 3.1.2 to 4.2.39

• New embedded transitives httpclient5 5.3.1/httpcore5 5.2.5 (required by the OpenSAML 5 initialization service)

• Obsolete joda-time usage migrated to java.time.Instant; obsolete Apache Xerces Import-Package entries removed (OpenSAML 5 configures JDK XML parser limits that Xerces does not understand)

• OpenSAML >= 4.1 is not published to Maven Central; the Shibboleth releases repository is added to the build with content filtering for org.opensaml/net.shibboleth

SCR-1784

Summary: Upgraded Google API/HTTP/OAuth client stack and Firebase Admin SDK

Effective: 8.52.190 and later

Upgraded the Google client stack (com.google.api.client) and Firebase Admin SDK (com.google.firebase):

• google-http-client (+ apache-v2/appengine/gson/jackson2/protobuf/xml modules) upgraded from 1.43.3/1.42.3 to 2.1.1
• google-api-client (+ appengine/gson/jackson2/protobuf/servlet/xml modules) upgraded from 2.2.0 to 2.9.0
• google-oauth-client (+ appengine/java6 modules) upgraded from 1.34.1 to 1.39.0
• google-api-services calendar/drive/gmail/people upgraded to current revisions (rev20260614/rev20260624/rev20260525/rev20251117); oauth2 unchanged upstream
• api-common upgraded from 2.15.0 to 2.65.0
• grpc-context upgraded from 1.27.2 to 1.70.0 (new companion grpc-api 1.70.0)
• New embedded transitive: google-auth-library-credentials/google-auth-library-oauth2-http 1.47.0
• firebase-admin upgraded from 9.2.0 to 9.10.0; its default HTTP transport (ApacheHttp2Transport) requires embedding httpclient5 5.3.1, httpcore5 5.2.4 and httpcore5-h2 5.2.4; nimbus-jose-jwt is consumed from the platform bundle (com.nimbus)

Merged to main via core!5065 (commit c2415d6f1dd).

SCR-1780

Summary: Upgraded Apache CXF to 4.2.2 and Metro JAX-WS runtime to 4.0.5

Effective: 8.52.190 and later

Upgraded the SOAP stack embedded in the com.openexchange.soap.common bundle:

• 11 cxf-* libraries upgraded from 4.0.7 to 4.2.2

• jakarta.xml.ws-api-3.0.1.jar upgraded to jakarta.xml.ws-api-4.0.3.jar

• jaxws-rt-3.0.2.jar (Metro) upgraded to jaxws-rt-4.0.5.jar

• saaj-impl-2.0.1.jar upgraded to saaj-impl-3.0.6.jar

• neethi-3.2.1.jar upgraded to neethi-3.2.2.jar, xmlschema-core-2.3.1.jar to xmlschema-core-2.3.2.jar, gmbal-api-only-4.0.3.jar to gmbal-api-only-4.1.2.jar, mimepull-1.9.15.jar to mimepull-1.11.0.jar, streambuffer-2.0.2.jar to streambuffer-2.1.0.jar

The legacy javax.xml.ws compatibility libraries stay unchanged.

SCR-1775

Summary: Upgraded Spring Framework to 7.0.8 and jOOX to 2.0.1

Effective: 8.52.190 and later

Upgraded third-party libraries embedded in the com.openexchange.xml bundle:

• spring-core-6.2.15.jar upgraded to spring-core-7.0.8.jar
• spring-beans-6.2.15.jar upgraded to spring-beans-7.0.8.jar
• spring-jcl-6.2.15.jar removed (merged into spring-core in Spring Framework 7)
• joox-1.5.0.jar upgraded to joox-2.0.1.jar

SCR-1774

Summary: Upgraded Hazelcast library to 5.7.0

Effective: 8.52.190 and later

Upgraded third-party library embedded in the com.hazelcast bundle:

• hazelcast-5.3.8.jar upgraded to hazelcast-5.7.0.jar

Note for operators: Hazelcast Open Source does not support rolling upgrades across minor versions. During a deployment upgrade, middleware nodes running 5.7.0 will form a separate cluster from remaining 5.3.8 nodes until the rollout completes; cluster-wide volatile data (e.g. sessions held in Hazelcast maps) follows the usual full-cluster-upgrade semantics.

SCR-1773

Summary: Upgraded OWASP ESAPI library to 2.7.0.0

Effective: 8.52.190 and later

Upgraded third-party library embedded in the com.openexchange.common bundle:

• esapi-2.0.1.jar upgraded to esapi-2.7.0.0.jar

Only the org.owasp.esapi.codecs package is consumed by the middleware (HTML entity decoding in com.openexchange.html); the new transitive dependency tree of the unused ESAPI reference implementation (antisamy, batik, httpclient) is excluded from the bundle.

SCR-1772

Summary: Upgraded Box Java SDK to 4.16.4

Effective: 8.52.190 and later

Upgraded third-party libraries embedded in the com.openexchange.file.storage.boxcom bundle:

• box-java-sdk-2.54.0.jar upgraded to box-java-sdk-4.16.4.jar (latest release of the classic com.box.sdk API line; the 10.x line is a different, generated SDK with a new API)
• jose4j-0.5.5.jar upgraded to jose4j-0.9.4.jar
• zstd-jni-1.5.7-2.jar newly embedded (response decompression support of the SDK)

The SDK now performs HTTP via OkHttp, which is consumed from the com.squareup.okhttp3 platform bundle; that bundle additionally exports the kotlin base package. File thumbnails are retrieved through the file representations endpoint, as the SDK removed the legacy thumbnail API.

SCR-1771

Summary: Upgraded Dropbox Core SDK to 8.0.1

Effective: 8.52.190 and later

Upgraded third-party library embedded in the com.openexchange.oauth.dropbox bundle:

• dropbox-core-sdk-3.1.5.jar upgraded to dropbox-core-sdk-8.0.1.jar

SCR-1770

Summary: Upgraded Apache XML-RPC libraries to 6.1.0

Effective: 8.52.190 and later

Upgraded third-party libraries embedded in middleware bundles:

• com.openexchange.parallels: xmlrpc-client-5.0.0.jar, xmlrpc-common-5.0.0.jar, xmlrpc-server-5.0.0.jar upgraded to 6.1.0; ws-commons-util-1.0.2.jar upgraded to ws-commons-util-1.1.0.jar
• com.openexchange.eas.provisioning.action.sms: xmlrpc-client-5.0.0.jar, xmlrpc-common-5.0.0.jar upgraded to 6.1.0; ws-commons-util-1.0.2.jar upgraded to ws-commons-util-1.1.0.jar

SCR-1769

Summary: Upgraded lib-recur library to 0.17.1

Effective: 8.52.190 and later

Upgraded third-party library embedded in the com.openexchange.chronos.common bundle:

• lib-recur-0.10.jar upgraded to lib-recur-0.17.1.jar
• jems2-2.23.1.jar newly embedded (required by lib-recur 0.17)

The recurrence rule expansion engine (org.dmfs.rfc5545.recur) is updated to the latest upstream release. The legacy recurrence-set helper classes that upstream removed in favor of a redesigned API are retained as sources in the bundle, so the iteration behavior of the calendar recurrence service is unchanged (verified by the full recurrence test suite, 50000+ tests).

SCR-1768

Summary: Upgraded ez-vcard library to 0.12.2

Effective: 8.52.190 and later

Upgraded third-party library embedded in the com.openexchange.contact.vcard.impl bundle:

• ez-vcard-0.10.6.jar upgraded to ez-vcard-0.12.2.jar

The vCard date mappings were adopted to the library's new java.time-based API. Date properties (BDAY, ANNIVERSARY) are now handled as LocalDate without the former local-timezone adjustment workarounds; the serialized vCard output is unchanged.

SCR-1767

Summary: Upgraded ROME, jaudiotagger, Caffeine, MaxMind GeoIP2 and libphonenumber libraries

Effective: 8.52.190 and later

Upgraded third-party libraries embedded in middleware bundles:

• com.openexchange.rss: rome-1.19.0.jar upgraded to rome-2.1.0.jar, rome-utils-1.19.0.jar upgraded to rome-utils-2.1.0.jar (rome-fetcher stays at 1.19.0, no 2.x release exists)
• com.openexchange.server: jaudiotagger-2.2.5.jar upgraded to jaudiotagger-3.0.1.jar
• com.openexchange.oauth.provider.impl: caffeine-2.8.5.jar upgraded to caffeine-3.2.4.jar
• com.openexchange.geolocation.maxmind.binary: geoip2-2.17.0.jar upgraded to geoip2-5.1.0.jar, maxmind-db-2.1.0.jar upgraded to maxmind-db-4.1.0.jar
• com.openexchange.sms: libphonenumber-8.13.1.jar upgraded to libphonenumber-9.0.34.jar

SCR-1766

Summary: Upgraded webauthn-server-core, reactor-core and zero-allocation-hashing libraries

Effective: 8.52.190 and later

Upgraded third-party libraries embedded in middleware bundles:

• com.openexchange.webauthn: webauthn-server-core-2.5.3.jar upgraded to webauthn-server-core-2.9.0.jar, yubico-util-2.5.3.jar upgraded to yubico-util-2.9.0.jar
• io.lettuce: reactor-core-3.6.6.jar upgraded to reactor-core-3.8.6.jar
• net.openhft.hashing: zero-allocation-hashing-0.16.jar upgraded to zero-allocation-hashing-2026.0.jar

SCR-1765

Summary: Upgraded BouncyCastle libraries to 1.84 in target platform

Effective: 8.52.190 and later

Upgraded BouncyCastle libraries in target platform (com.openexchange.bundles):

• bcmail-jdk18on-1.79.jar upgraded to bcmail-jdk18on-1.84.jar
• bcpg-jdk18on-1.79.jar upgraded to bcpg-jdk18on-1.84.jar
• bcpkix-jdk18on-1.79.jar upgraded to bcpkix-jdk18on-1.84.jar
• bcprov-jdk18on-1.79.jar upgraded to bcprov-jdk18on-1.84.jar
• bcutil-jdk18on-1.79.jar upgraded to bcutil-jdk18on-1.84.jar

BouncyCastle 1.84 removed the legacy post-quantum algorithm packages org.bouncycastle.pqc.crypto.rainbow, org.bouncycastle.pqc.jcajce.provider.gmss and org.bouncycastle.pqc.jcajce.provider.mceliece; stale (unused) imports of these packages were removed from the com.openexchange.saml bundle manifest. The OpenPGP API change of PGPKeyEncryptionMethodGenerator.generate(...) was adopted in com.openexchange.pgp.core (wire format of generated PKESK packets is unchanged).

SCR-1763

Summary: Upgraded OkHttp to v5.4.0 in com.squareup.okhttp3

Effective: 8.52.190 and later

Upgrades OkHttp in the encapsulated bundle com.squareup.okhttp3 to the 5.x line, a deliberate major migration since the 4.x line ended with 4.12.0 in November 2023: okhttp 4.12.0 becomes okhttp-jvm 5.4.0 (the Kotlin-Multiplatform jvm artifact), okhttp-sse and logging-interceptor move to 5.4.0, okio-jvm to 3.17.0 and kotlin-stdlib to 2.1.21, while the obsolete okio umbrella jar and kotlin-stdlib-common/-jdk8 are removed. The stale Bundle-Version is corrected from 4.11.0 to 5.4.0 and Import-Package is reduced to the jdeps-verified set actually referenced. The only middleware consumer is com.openexchange.jmap, which compiles and passes its unit tests against 5.4.0; the openexchange-test harness was adapted as well, since okhttp3.JavaNetCookieJar moved to the package okhttp3.java.net.cookiejar in 5.x.

SCR-1762

Summary: Upgraded Liquibase to v5.0.3

Effective: 8.52.190 and later

Upgraded the embedded database migration engine in the encapsulated liquibase.core wrapper bundle:

• liquibase-core-4.33.0.jar upgraded to liquibase-core-5.0.3.jar
• opencsv-5.11.2.jar upgraded to opencsv-5.12.0.jar

Liquibase 5.0.x is a major release, but the exported package set and external dependency surface are identical to 4.33.0, so Export-Package/Import-Package stay structurally unchanged. The in-house Liquibase extensions in com.openexchange.database.migration (custom ChangeLogHistoryService, XML changelog parser, preconditions, SLF4J logging) compile and pass their tests against the 5.0.3 SPIs without source changes.

Checksum stability was verified end-to-end against MariaDB: a DATABASECHANGELOG populated with legacy checksums is recognized as already-applied and left untouched (no changeset re-execution), preserving rollback compatibility.

SCR-1755

Summary: Updated Kubernetes Java Client (fabric8) from v7.5.2 to v7.8.0

Effective: 8.52.190 and later

Updated fabric8 Kubernetes Java Client from v7.5.2 to v7.8.0 (minor version migration) in bundle io.fabric8.kubernetes:

• kubernetes-client-7.8.0.jar
• kubernetes-client-api-7.8.0.jar
• kubernetes-httpclient-jdk-7.8.0.jar
• kubernetes-model-admissionregistration-7.8.0.jar
• kubernetes-model-apiextensions-7.8.0.jar
• kubernetes-model-apps-7.8.0.jar
• kubernetes-model-autoscaling-7.8.0.jar
• kubernetes-model-batch-7.8.0.jar
• kubernetes-model-certificates-7.8.0.jar
• kubernetes-model-common-7.8.0.jar
• kubernetes-model-coordination-7.8.0.jar
• kubernetes-model-core-7.8.0.jar
• kubernetes-model-discovery-7.8.0.jar
• kubernetes-model-events-7.8.0.jar
• kubernetes-model-extensions-7.8.0.jar
• kubernetes-model-flowcontrol-7.8.0.jar
• kubernetes-model-gatewayapi-7.8.0.jar
• kubernetes-model-metrics-7.8.0.jar
• kubernetes-model-networking-7.8.0.jar
• kubernetes-model-node-7.8.0.jar
• kubernetes-model-policy-7.8.0.jar
• kubernetes-model-rbac-7.8.0.jar
• kubernetes-model-resource-7.8.0.jar
• kubernetes-model-scheduling-7.8.0.jar
• kubernetes-model-storageclass-7.8.0.jar
• zjsonpatch-7.8.0.jar
• snakeyaml-engine-3.0.1.jar (upgraded from v2.10)

The generex-1.0.2.jar and automaton-1.11-8.jar libraries were dropped; they are no longer referenced by the Kubernetes client since v7.7.0.

Exported packages follow upstream model changes: io.fabric8.kubernetes.api.model.clusterapi.v1beta1 was replaced by io.fabric8.kubernetes.api.model.clusterapi.core.v1beta1, io.fabric8.kubernetes.api.model.storagemigration.v1alpha1 by io.fabric8.kubernetes.api.model.storagemigration.v1beta1; new exports io.fabric8.kubernetes.api.model.scheduling.v1alpha2 and io.fabric8.kubernetes.api.model.resource.v1.

The bundle now additionally imports org.apache.commons.compress.archivers, org.apache.commons.compress.archivers.tar and org.apache.commons.compress.utils (required by pod upload/copy code paths). Stale imports of okhttp3/okio and SnakeYAML 1.x packages were removed; no code path references them.

SCR-1754

Summary: Migrated S3 file storage to AWS SDK for Java v2

Effective: 8.52.190 and later

Migrates the S3 file storage (com.openexchange.filestore.s3) from the AWS SDK for Java v1, which reached end of support on 2025-12-31, to the AWS SDK for Java v2. The encapsulating bundle com.amazonaws is removed from the target platform and from the open-xchange-filestore-s3 packaging and replaced by the new bundle software.amazon.awssdk (SDK v2 2.46.20), embedding the s3, sts, kms, apache-client and netty-nio-client modules plus amazon-s3-encryption-client-java 3.6.1, reactive-streams 1.0.4 and saaj-impl 2.0.1; Netty packages are imported from the existing io.netty target platform bundle. The SDK v2 signs all requests with AWS signature version 4, so the configured S3 end-point must support SigV4 and the properties com.openexchange.filestore.s3client.[clientID].signerOverride and com.openexchange.filestore.s3.[filestoreID].signerOverride are deprecated and have no effect anymore. Objects written by the SDK v1 encryption client, including the legacy "EncryptionOnly" format, remain readable; newly written objects use authenticated AES-GCM content encryption with an RSA-OAEP key wrap and can no longer be read by previous App Suite versions, so there is no rollback for newly written encrypted objects. Implicit CRC checksums are disabled (WHEN_REQUIRED) so uploads keep sending plain Content-MD5. The Prometheus metrics keep their names and tags, but the request timer's type tag now carries SDK v2 operation names, the byte throughput counter is derived from Content-Length headers, and the SDK v1 per-request latency logging no longer exists.

SCR-1752

Summary: Upgraded Micrometer to 1.17.0 and migrated Prometheus registry to prometheus-metrics (client_java 1.x)

Effective: 8.52.190 and later

Upgrades the encapsulated Micrometer libraries in the com.openexchange.metrics.micrometer PDE bundle to 1.17.0 and migrates the Prometheus registry from the end-of-life Prometheus Java simpleclient to prometheus-metrics (client_java 1.7.0); HdrHistogram moves to 2.2.2 and LatencyUtils is dropped. The Micrometer Prometheus registry moved from package io.micrometer.prometheus to io.micrometer.prometheusmetrics and the bundle export changed accordingly, so any OSGi bundle importing the old package must switch (in this repository only com.openexchange.redis was affected). The /metrics scrape servlet is now io.prometheus.metrics.exporter.servlet.jakarta.PrometheusMetricsServlet; bind point and BasicAuth handling are unchanged. The 1.x text exposition differs in details: label sets no longer carry a trailing comma, sample values are rendered canonically, and all data points of a metric family must share the same type. Because of the last constraint, tag-scoped histogram and SLO filters now force the classic histogram type for the whole metric family and expose a single sentinel bucket for tag combinations with the histogram disabled - without this guard the whole scrape would fail with HTTP 500. Name-scoped filters behave as before.

SCR-1750

Summary: Updated Netty libraries from v4.1.132 to v4.2.15 and Lettuce from v6.8.2 to v7.6.0

Effective: 8.52.190 and later

Updated Netty libraries from v4.1.132 to v4.2.15 (minor version migration) in bundle io.netty:

• netty-buffer-4.2.15.Final.jar
• netty-codec-base-4.2.15.Final.jar (new; codec split in Netty 4.2)
• netty-codec-compression-4.2.15.Final.jar (new)
• netty-codec-dns-4.2.15.Final.jar
• netty-codec-http2-4.2.15.Final.jar
• netty-codec-http-4.2.15.Final.jar
• netty-codec-marshalling-4.2.15.Final.jar (new)
• netty-codec-protobuf-4.2.15.Final.jar (new)
• netty-codec-socks-4.2.15.Final.jar
• netty-codec-xml-4.2.15.Final.jar (new)
• netty-common-4.2.15.Final.jar
• netty-handler-4.2.15.Final.jar
• netty-handler-proxy-4.2.15.Final.jar
• netty-resolver-4.2.15.Final.jar
• netty-resolver-dns-4.2.15.Final.jar
• netty-transport-4.2.15.Final.jar
• netty-transport-native-unix-common-4.2.15.Final.jar
• netty-transport-classes-epoll-4.2.15.Final.jar
• netty-transport-native-epoll-4.2.15.Final.jar
• netty-transport-classes-io_uring-4.2.15.Final.jar (new native transport classes)
• netty-transport-classes-kqueue-4.2.15.Final.jar
• netty-transport-native-kqueue-4.2.15.Final.jar
• netty-tcnative-classes-2.0.80.Final.jar

The netty-codec jar was dropped (empty aggregator in 4.2). Exported package io.netty.handler.ssl.ocsp no longer exists in Netty 4.2; new exports: io.netty.channel.uring plus shaded jctools sub-packages.

Note: Netty 4.2 changes the default ByteBuf allocator from pooled to adaptive. The previous behavior can be restored via system property -Dio.netty.allocator.type=pooled.

Updated Lettuce Redis client from v6.8.2 to v7.6.0 (major version upgrade, requires Netty 4.2) in bundle io.lettuce:

• lettuce-core-7.6.0.RELEASE.jar
• redis-authx-core-0.1.1-beta2.jar (new mandatory dependency, MIT license)

Bundle now additionally imports org.slf4j (hard dependency of Lettuce 7.x). Embedded reactor-core-3.6.6.jar and reactive-streams-1.0.4.jar remain unchanged.

SCR-1749

Summary: Upgraded Grizzly to 5.0.2

Effective: 8.52.190 and later

Upgrades the encapsulated Grizzly libraries in the com.openexchange.http.grizzly PDE bundle from 5.0.1 to 5.0.2 (grizzly-http-all plus the three monitoring artifacts), with the transitive shifts gmbal 4.1.2 and pfl 5.1.1. Grizzly 5.0.2 replaces the HttpResponsePacket acknowledgement API with an interim-response model, so CustomHttpCodecFilter now sets the interim status and lets the codec serialize the status line instead of hand-building the bytes; the wire format of HTTP/1.1 100 Continue is unchanged. Grizzly 5.0.2 also enables strict RFC 9110 validation of HTTP header names and values by default, so requests carrying malformed headers are now rejected with 400 Bad Request during parsing, hardening against request smuggling. The switches are exposed as the lean properties com.openexchange.http.grizzly.strictHeaderNameValidation and com.openexchange.http.grizzly.strictHeaderValueValidation (both default true, read on server start); setting one to false restores the former lenient parsing for legacy clients. The OX properties are authoritative and take precedence over the corresponding Grizzly JVM system properties.

SCR-1747

Summary: Migrated JAX-RS from Jersey 2.17 to Jersey 3.1.x (jakarta.ws.rs)

Effective: 8.52.190 and later

Migrates the middleware JAX-RS stack from Jersey 2.17 (javax.ws.rs) to Jersey 3.1.3 (jakarta.ws.rs) as part of the Jakarta EE / Servlet 6 migration. The target platform drops Jersey 2.17, HK2 2.4 and the eclipsesource OSGi JAX-RS connector and gains Jersey 3.1.3, HK2 3.0.5, osgi-resource-locator 1.0.3 and the Jakarta APIs (ws.rs 3.1.0, inject 2.0.1, annotation 2.1.1, validation 3.0.2); javax.ws.rs-api 2.0.1 is retained so external and legacy consumers such as Guard still resolve the old API at runtime. Resources and providers are no longer published via the eclipsesource connector but by a new in-house publisher in com.openexchange.rest.services that tracks @Path/@Provider OSGi services and mounts them on a central Jersey ServletContainer. All in-house consumers and the downstream repositories (guard, usm, cloud-plugins, plugins, exchange-interop, customer bundles) were migrated in lockstep. REST endpoint paths and request/response contracts are unchanged; no configuration changes.

SCR-1746

Summary: Upgraded third-party libraries

Effective: 8.52.190 and later

Upgrades third-party OSGi bundles in the target platform (com.openexchange.bundles), among them angus-activation 2.0.3, Apache Mime4j 0.8.14, commons-validator 1.10.1, dnsjava 3.6.5, jakarta.activation-api 2.1.4, jakarta.json-api 2.1.3, jakarta.xml.bind-api 4.0.5, jaxb-osgi 4.0.9, jctools-core 4.0.6, jsoup 1.22.2, openjson 1.0.13, slf4j and its bridges 2.0.18, logback 1.5.37, equinox.console 1.4.1100, ASM 9.10.1, Jackson 2.22.x, commons-codec 1.22.0, commons-io 2.22.0, commons-net 3.13.0, gson 2.14.0, javassist 3.32.0-GA, joda-time 2.14.2, mysql-connector-j 9.7.0, protobuf-java 4.35.1 and stax2-api 4.3.0. The encapsulated libraries of the PDE bundles are upgraded as well: com.google.guava (Guava 33.6.0-jre, Caffeine 3.2.4), com.amazonaws (AWS SDK for Java v1 1.12.797, its last release), com.hazelcast (5.3.8), com.nimbus (oauth2-oidc-sdk 11.37.2), com.eatthepath.pushy (0.15.6) plus a same-major patch/minor batch across further library-enclosing bundles (unboundid-ldapsdk, u2flib, cbor/lombok, zxing, minimal-json, jcodec, woodstox-core, metadata-extractor, ipaddress, dropwizard metrics, opencsv, jgettext, junidecode, swagger-annotations, cassandra-driver, cryptacular/velocity). No new or removed embedded dependencies. Excluded as not drop-in and tracked separately: BouncyCastle 1.79 to 1.84, Grizzly 5.0.1 to 5.0.2 and Micrometer 1.10/1.5 to 1.17.

API - HTTP-API

SCR-1776

Summary: New HTTP API endpoint "PUT /proxy?action=getUris"

Effective: 8.52.190 and later

A new bundle com.openexchange.proxy.json adds an HTTP API for the proxy servlet: the module "proxy" with the single action "getUris". PUT /proxy?action=getUris takes a request body of the form {"urls": ["url1", "url2", ...]} and returns, under the standard data envelope, a hash mapping each supplied URL to its generated proxy URI. The proxy URIs are generated via the ProxyRegistry, routing external-resource access through com.openexchange.proxy.servlet. URLs are resolved via com.openexchange.java.URIs.toUriIfAbsoluteAndSupported and must therefore be absolute with a supported scheme, as for the existing ProxyRegistry callers. The generated registrations carry the NoAuthForRemoteRestriction, so neither basic authentication nor internal addresses are permitted. The action requires a session; the OAuth scope is read_proxy.

SCR-1748

Summary: New HTTP-API mail actions get_ref / get_ref_attachment to load mails referenced from PIM attachments or Infostore files

Effective: 8.52.190 and later

Two new HTTP-API actions on the mail module load and render a mail that does not reside in a mailbox but is referenced from another module - as an attachment of a PIM object (calendar event, contact, task) or as an Infostore file. PUT|GET /mail?action=get_ref loads the referenced mail and returns it like action=get, PUT|GET /mail?action=get_ref_attachment streams a binary sub-part selected via sequenceId, analogous to action=attachment. The reference is a JSON object with the slots type (calendar, contacts, tasks or infostore), folder, object, attachment and version, supplied either as the request body (PUT) or as a single URL-encoded ref query parameter (GET), so it can never collide with the mail module's reserved parameters; calendar, contacts and tasks use folder plus object plus attachment, infostore uses object plus an optional version. A new interface bundle com.openexchange.mail.stream.provider introduces MailStreamProvider, contributed per module via the OSGi service registry and returning a MailStream whose RFC822 content is parsed centrally by the mail module; providers ship for tasks, contacts and Infostore in com.openexchange.server and for calendar in com.openexchange.chronos.json. The change is purely additive - existing actions and their contracts are unchanged, access checks stay with the underlying module storage, and a referenced item that is not a valid RFC822 message yields a NOT_A_MAIL error.

SCR-1739

Summary: Cross-Context Principal Representation Over WebDAV / CalDAV / CardDAV

Effective: 8.52.190 and later

A foreign-context principal is addressable over the DAV protocols by a qualified principal path; foreign grants are handled consistently in DAV ACL/sharing. Additive (host-context principals unchanged).

• Qualified principal URLs /principals/users/<id>@<contextId> (resp. groups), via Entity.toFormattedString() (com.openexchange.dav.mixins.PrincipalURL). UserPrincipalCollection / GroupPrincipalCollection parse the qualified leaf and resolve a foreign principal only if the cross-context authority permits a liaison from the session user to the target context (CrossContextAuthorityProvider.isLiaisonPermitted); a disallowed context is reported as 404 (invisible, never confirmed). The foreign principal resource carries a reduced property set — identity + addressing for a user (display name, e-mail, calendar-user-address, resource id), identity only for a group — dropping the context-local navigational properties (calendar / addressbook home sets, group membership) as not meaningful across the context boundary.
• Folder-sharing invite property: the CalDAV calendar invite (<CS:invite>, com.openexchange.caldav.mixins.Invite) includes foreign-context sharees — each as a context-qualified principal href (/principals/users/<id>@<contextId>) with a display name from the permission's EntityInfo (host-context user/group lookup can't resolve a foreign principal). The base WebDAV folder invite (<D:sharee>, com.openexchange.dav.mixins.Invite) instead omits foreign-context grants — it emits only id-only local principal paths, which can't address a foreign principal (public folders emit no sharees at all).
• CalDAV: a foreign-context calendar owner/organizer is surfaced via its mail URI only (no bare entity); context is compared alongside the id when matching the acting user.

See the feature documentation for further details.

SCR-1738

Summary: Cross-Context Deputy via Qualified Identifiers (Deputy HTTP API)

Effective: 8.52.190 and later

The deputy HTTP API can appoint and represent a deputy or grantor in another context. Additive.

• DeputyPermission.identifier (request) — <id>@<contextId> or mailto:<email>; supersedes userId when present.
• GrantedDeputyPermission (response) — identifier (deputy) and grantorIdentifier (grantor) as <userId>@<contextId>; the bare userId/grantorId are not meaningful for a foreign entity.
• GrantedDeputyPermission.entityInfo (response) — pre-resolved entity information (display name, e-mail, ...) for the deputy entity, so a client can render a (possibly foreign-context) deputy it cannot resolve on its own; mirrors the shared-account entityInfo block. Absent for a group deputy; for a foreign entity the numeric entity is omitted and only the qualified identifier is carried.
• GrantedDeputyPermission.grantorEntityInfo (response; action=reverse) — the counterpart of entityInfo for the granting user, so the deputy can render a (possibly foreign-context) grantor.
• Available-deputy-modules action: new optional extended=true returns objects with a crossContext flag per module (true only for mail/calendar when the user is in a trust zone and the feature is enabled); the default array form is unchanged.

See the HTTP API documentation and the Deputy permissions documentation for further details.

SCR-1737

Summary: New Read-Only Contact Field Exposing the Cross-Context Qualified Identifier

Effective: 8.52.190 and later

New read-only contact field surfacing a contact's internal user as a qualified principal identifier, for direct use as a permission identifier.

• Column 625 (Contact.USER_IDENTIFIER); JSON field user_identifier (ContactFields.USER_IDENTIFIER).
• Value: <userId>@<contextId> (opaque, round-tripped verbatim). Virtual / read-only, not persisted (no DB change); emitted only when the column is requested and both ids are present. For a foreign entity the numeric INTERNAL_USERID (524) is masked.

See the HTTP API documentation for further details.

SCR-1736

Summary: Folder Permissions Accept and Return Cross-Context Principal Identifiers

Effective: 8.52.190 and later

A folder permission may address a foreign-context recipient via the long-standing identifier field instead of the numeric entity. Additive.

• Write: identifier = <id>@<contextId> (e.g. 3@1337) or mailto:<email> (resolved via a PrincipalUriResolver). A foreign principal is admitted only if the cross-context authority permits, else FLD-1053 (PERMISSION_DENIED_CROSS_CONTEXT).
• Read: identifier is always present (qualified form); the numeric entity is written only for local principals (masked for foreign). Extended folder/file permissions surface a foreign principal via identifier/EntityInfo and do not anonymize it under a guest session.
• The same identifier semantics are documented on the Drive folder-permission schemas (Drive is not itself a cross-context target).

{ "entity": 42, "bits": 4 }                                // internal (unchanged)
{ "identifier": "3@1337", "bits": 4 }                      // cross-context, by qualified id
{ "identifier": "mailto:bob@partner.example", "bits": 4 }  // by email

See the HTTP API documentation and the feature documentation for further details.

API - REST

SCR-1801

Summary: New Administrative REST Servlet for Querying Free/Busy Data

Effective: 8.52.190 and later

New administrative REST service for querying the free/busy data of a context's users, without acting on behalf of a session user. Base /preliminary/chronos/v1/freebusy; HTTP Basic auth (admin); preliminary. OpenAPI: http-api/rest_api/paths/chronos/v1/freebusy/.

Serves consumers that need to know when a user is busy, but must not learn why - the events behind a busy period are never serialized, not even in their anonymized form. Intended for service-to-service queries within a deployment, e.g. a booking service performing a calendar conflict check while deriving bookable slots.

• GET /freebusy/{context} - free/busy periods of any number of users at once, each referenced either by its numerical internal user identifier or by one of its email addresses (including aliases); yields one result per requested user, in request order. Resources and rooms can be queried alongside the users by passing their email address.
• GET /freebusy/{context}/{user} - convenience variant for a single user referenced by its identifier, yielding the free/busy result directly instead of wrapping it into an array.

Both accept the time range as UTC timestamp in milliseconds, as ISO-8601 date or date/time, or in the iCalendar notation also used by the HTTP API, and merge overlapping periods by default (merge=false yields one period per appointment). The JSON model matches the one of the client-facing chronos?action=freebusy request, minus the event details.

The lookup is performed per user, so a user that cannot be served is reported with a warning instead of its periods rather than failing the whole request. The effective freeBusyVisibility of the queried users is honored, i.e. users that restricted their free/busy data to their own context or hid it entirely are reported without any periods.

Unlike the internet free/busy servlet at /servlet/webdav.freebusy - the other session-less way to obtain free/busy data - this service answers in JSON instead of iCalendar, accepts a batch of users per request, and is protected by HTTP Basic Authentication instead of relying on not being reachable from the outside. It also does not require com.openexchange.calendar.enableInternetFreeBusy / com.openexchange.calendar.publishInternetFreeBusy to be set.

See the general documentation, as well as the REST API documentation for further details.

SCR-1740

Summary: New Administrative REST Endpoints for Cross-Context Liaison Audit and Purge

Effective: 8.52.190 and later

New administrative REST service for cross-context liaison audit + on-demand purge. Base /preliminary/crosscontext/v1; HTTP Basic auth (admin); preliminary. OpenAPI: http-api/rest_api/paths/crosscontext/v1/.

• GET /inbound/{context} and GET /inbound/{context}/{user} — what a principal received (per-module liaisons, trust zones, mail-share owners).
• DELETE /inbound/{context}/{user} — purge received access; filters from / owner / module; unconditional operator override (does not consult the authority).
• GET /outbound/{context}/{user} and DELETE /outbound/{context}/{user} — what a principal granted out, and purge it; filters to / module.

See the REST API documentation and the feature documentation (inbound/outbound audit and on-demand purge) for further details.

API - RMI

SCR-1741

Summary: Cross-Context Deputy in the Admin RMI Provisioning API

Effective: 8.52.190 and later

The admin deputy provisioning over RMI (com.openexchange.admin.rmi; impl com.openexchange.admin.rmi.impl.OXDeputyPermissions) can appoint/represent a deputy in another context. Additive; an absent / 0 context = same context. A cross-context deputy is admitted only if the authority permits.

Data objects (com.openexchange.admin.rmi.dataobjects):

• DeputyPermission — qualified Entity entity (id + context).
• DeputyPermissionDescription — entityContextId (with setEntityContextId / removeEntityContextId / isEntityContextSet flag accessors).
• Granter — qualified Entity entity; equals / compareTo consider the context.

On top of RMI, the gRPC provisioning layer carries the same cross-context support — generated stubs (com.openexchange.grpc.generated, consumed as a binary artifact) plus DeputyPermissionConverter (com.openexchange.provisioning.grpc.common). In deputy.proto: additive scalar context fields DeputyPermission.entity_context_id, Granter.context_id, DeputyPermissionDescription.entityContextId + EntityContextIdSet (0 = same context); plus the GrantedDeputyPermissions.granted map key retyped map<int32, …> -> map<string, …> (qualified <id>@<contextId>) — the one wire-breaking change (ListReverseDeputyPermissions response). The DeputyPermissionConverter carries the entity context across the boundary; the gRPC server and client implementations delegate to it.

See the Deputy permissions documentation for further details.

API - SOAP

SCR-1798

Summary: Provision per-account spam handler for secondary accounts (functional mailboxes)

Effective: 8.52.190 and later

For non-primary accounts - secondary "functional" mailboxes and external accounts - the spam handler used by "Mark as Spam" is now resolved from the account's own configured spam handler name instead of being unconditionally disabled. It falls back to the NoSpamHandler when no handler name (or the fallback one) is set, so spam handling for such accounts is opt-in and enabled via provisioning; the primary account behavior is unchanged. To make this usable, secondary account provisioning was extended to carry the spam handler: a new field on the RMI AccountData data object, on the SOAP AccountData, AccountDataOnCreate, AccountDataUpdate and Account objects and their mappings, INSERT/UPDATE in the MySQL storage, the new CLI option --spam-handler for createsecondaryaccount and updatesecondaryaccount, and a spam-handler column in the listsecondaryaccount output. Without an explicitly provisioned spam handler the default stays NoSpamHandler, so there is no behavior change. Related: /appsuite/support#1552.

SCR-1742

Summary: Cross-Context Deputy in the Admin SOAP Provisioning API

Effective: 8.52.190 and later

The admin deputy provisioning over SOAP (com.openexchange.admin.soap.deputy; OXDeputyPermissionsServicePortTypeImpl) can appoint/represent a deputy in another context. Additive; context fields default to same-context. A cross-context deputy is admitted only if the authority permits.

Data objects (com.openexchange.admin.soap.deputy.dataobjects):

• DeputyPermission — contextId (the deputy entity's context).
• ActiveDeputyPermission / GrantedDeputyPermission — entityContextId, contextId, granterContextId.

See the Deputy permissions documentation (cross-context SOAP grant example) for further details.

Behavioral Changes

SCR-1759

Summary: Seal proxy registration URLs via ObfuscatorService instead of static DES key

Effective: 8.52.190 and later

The stateless proxy registration URLs produced for external image proxying (com.openexchange.proxy.servlet) carry the full registration - target URI plus restrictions - and were encrypted with a static DES key derived from the string "ox-proxy", which is present in the public AGPL source. Any authenticated user could therefore forge valid proxy URLs, for instance stripping restrictions to turn the middleware into a generic fetch proxy or aiming at internal endpoints (SSRF surface). Full-registration content is now sealed via the ObfuscatorService, using a per-installation secret and authenticated AES/GCM, so only the server can produce valid proxy URLs. A new wire-level encoding mode "sealed" (mode byte 2) is emitted; the legacy static-DES "object" format (mode byte 1) is still accepted on decoding for the rolling-upgrade transition and can be dropped in a later release. No configuration change - the com.openexchange.proxy.encoding semantics are unchanged and only the internal sealing of the full-registration payload changed - but ObfuscatorService is now a required service of the bundle. This is hardening; session enforcement and response restrictions already gated the endpoint.

SCR-1743

Summary: Cross-Context Sharing Access-Control Behavior

Effective: 8.52.190 and later

A user in one context can grant a user in another context access to a folder, mail folder, or deputy role within one deployment.

• Deny-by-default trust zones — admitted only if the sharing user's and target context's com.openexchange.crosscontext.trustZones tags intersect; opt-in per deployment (global = legacy anyone-with-anyone).
• Hard-deny at grant resolution — a foreign identifier resolving to another context is admitted only if the authority permits, else FLD-1053; enforced centrally (folder resolver, deputy service, admin RMI). Same-context / no-authority-registered unaffected.
• Public read-only — a foreign grantee may receive up to author on a personal/shared calendar folder, but only read-only on a public folder.
• Admission-only — checked at grant time, never re-checked on read; an admitted grant survives a later zone change until explicitly revoked. No operator switch (com.openexchange.crosscontext.reenforceOnRead removed; CrossContextAuthorityProvider.isReadReenforcementEnabled hard-wired false; dormant code retained).
• Mail same-server — requires com.openexchange.mail.crossContextPermissions (default false) and, when com.openexchange.mail.crossContextRequireSameServer (default true), the same mail server; an explicit revoke removes the IMAP ACL via best-effort doveadm.
• Deputy — a revoke/purge revokes the foreign reverse permission (cascading to projected calendar/mail shares; deputy liaisons purged first).

See the feature documentation for further details.

CLT

SCR-1758

Summary: New Command-Line Tool claimfolderadmin to Claim/Elevate a Folder Administrator on Public Folders

Effective: 8.52.190 and later

New command-line tool claimfolderadmin that grants or elevates a specific user to folder administrator on public folders - the only folder type that permits more than one administrator (FolderObject.PUBLIC; private and shared folders are restricted to a single owner-admin). It targets the case where a deleted user's data was reassigned to a user that cannot log in (e.g. the context administrator): another user can then take over administration of the affected public folders. The operation is additive - existing administrators are kept.

The tool is invoked as follows:

claimfolderadmin -c <contextId> -u <userId>
                 (-f <folderId> | --from-user <sourceUserId>)
                 -A <admin> -P <password>
                 [-p <RMI-Port>] [-s <RMI-Server>]

• -c/--context - the target context
• -u/--user - the user that shall become folder administrator
• -f/--folder - a single public folder to claim
• --from-user - bulk mode: claim every public folder currently administered by this source user (mutually exclusive with -f)

Authenticates with the context administrator credentials (-A/-P).

The claim operation behaves as follows:

• Grants full administrative rights plus the folder-admin flag; an existing permission of the user is elevated in place (no duplicate entry). Additive - existing administrators are retained.
• Only FolderObject.PUBLIC folders are accepted; private/shared folders are rejected (OXFolderExceptionCode.NOT_A_PUBLIC_FOLDER).
• Bulk mode (--from-user) is scoped to the public folder subtrees - below SYSTEM_PUBLIC_FOLDER_ID (public groupware folders) and SYSTEM_PUBLIC_INFOSTORE_FOLDER_ID (public InfoStore folders); the source user's personal InfoStore home folder and its subfolders are excluded.
• Idempotent; logs one INFO line per invocation listing the claimed folder identifiers and invalidates the affected folder caches.

Backed by a new RMI service ClaimFolderAdminRMIService registered by the groupware server. For active-active deployments it is site-aware (wrapper SiteAwareClaimFolderAdmin), routing a call to the write-active site owning the target context - plugging into the infrastructure of SCR-1697. Inter-site forwarding uses a new gRPC service ClaimFolderAdminService (client + server) defined in grpc-api/proto_jar/protos/claimfolderadmin.proto.

Documented in documentation/command_line_tools/miscellaneous/claimfolderadmin.md.

Configuration

SCR-1799

Summary: New property to run the Grizzly engine as WebSocket side-car alongside the Jetty engine

Effective: 8.52.190 and later

With the optional Jetty HTTP engine enabled (com.openexchange.http.jetty.enabled=true), the Grizzly engine can now be started in a WebSocket side-car mode: a single network listener on a dedicated port serves nothing but WebSocket upgrades for applications registered through the Grizzly-typed WebApplicationService, while Jetty serves regular HTTP(S). This allows deployments that still ship Grizzly-typed WebSocket applications to enable the Jetty engine without migrating them first. The mode is controlled by the new property com.openexchange.http.grizzly.websocketSidecarPort in grizzly.properties, default 0, neither reloadable nor config-cascade aware and evaluated once during server start-up. It is only effective while the Jetty engine is enabled; a value of zero or less disables the side-car and leaves the Grizzly engine fully passive, which is the previous behavior and therefore a no-op default for existing deployments. It requires com.openexchange.http.grizzly.hasWebSocketsEnabled=true, otherwise the side-car start-up is skipped with a warning, and the port is opened deferred once server start-up completed. The side-car provides no HttpService, no Comet and no liveness facilities - WebSocket upgrades only. Clients are unaffected and keep their WebSocket URLs; only the reverse proxy or ingress has to route the affected WebSocket context paths to the side-car port. Note that 8010 is the default HTTPS connector port, so pick a free port such as 8011. See the new administration article "Switching the HTTP Engine (Grizzly to Jetty)" for the complete runbook including routing examples.

SCR-1797

Summary: New config properties for OAuth token exchange additional parameters (scheduled/snoozed mail)

Effective: 8.52.190 and later

Two new lean configuration properties allow passing additional request parameters when performing the OAuth 2.0 Token Exchange (RFC 8693) used for background delivery of scheduled and snoozed mails: com.openexchange.mail.scheduled.oauth.tokenExchange.additionalParameters and com.openexchange.mail.snoozed.oauth.tokenExchange.additionalParameters, both defaulting to empty and both config-cascade aware and reloadable. The parameters are appended to the POST /token request; the primary use case is selecting the token exchange policy at the OAuth server, for instance the IONOS ID Server, via a usecase parameter that determines allowed scopes, allowed audiences and the issued-token lifetime. The format is a single key=value pair, with multiple pairs separated by &; a value-less flag is accepted and serialized as flag=. The properties are only effective when the corresponding ...oauth.tokenExchange property is enabled, and being empty by default they cause no behavior change for existing setups.

SCR-1793

Summary: Redis connector: per-node client name, max. connection lifetime, deterministic shutdown

Effective: 8.52.190 and later

Hardening of the Redis connector against stale / orphaned connected clients.

New configuration option:

• com.openexchange.redis.connection.pool.maxLifetimeSeconds Maximum lifetime in seconds of a pooled Redis connection. Once a connection exceeds this age it is proactively recycled by the connection-pool cleaner as soon as it becomes idle, regardless of usage; this applies to both the shared and the dedicated pool. Acts as defense-in-depth against slowly accumulating or long-lived stale connections that TCP keepalive cannot reap (a live-but-idle connection is never detected as dead). A value of 0 (zero) disables max. lifetime recycling. Default 3600 (one hour). Not reloadable, not config.cascade aware. Package: open-xchange-core.

Behavioral changes (no configuration):

• Client name: the announced Redis client name now includes the local host / pod name (e.g. Open-Xchange-Redis-Connector-v8.53.0-<host>), so connections become attributable per node via Redis CLIENT LIST. This is what lets operators tell restart orphans (dead pod addresses) apart from live-node connections.
• Deterministic shutdown: the shared connection pool now closes its connections synchronously on shutdown, so Redis reclaims the clients immediately on a graceful (rolling) restart instead of leaving them as ghosts.

SCR-1788

Summary: Increased defaults for the client-side prepared statement cache (prepStmtCacheSize, prepStmtCacheSqlLimit)

Effective: 8.52.190 and later

The defaults of the MySQL Connector/J client-side prepared statement cache are raised, both in dbconnector.yaml and in the built-in fallback: prepStmtCacheSize from 250 to 1024 and prepStmtCacheSqlLimit from 2048 to 8192. JFR profiles under load attributed roughly 2.5% of CPU to Connection.prepareStatement, dominated by Connector/J query re-parsing plus visible LRU eviction churn in the statement cache: the middleware's dynamically built statements with mapped column lists and IN clauses exceed the previous 2048-character limit and were silently never cached, and the statement variety overflows a 250-entry LRU per connection. The cache holds parsed client-side statement metadata per pooled connection, so the increase amounts to low single-digit MB per connection pool under full variety. There is no behavioral change - the cache keys on the SQL text only and stays valid across schema changes, and useServerPrepStmts remains false - and deployments overriding these keys in dbconnector.yaml keep their configured values.

SCR-1783

Summary: Removed properties "com.openexchange.push.dovecot.stateless" and "com.openexchange.push.dovecot.clusterLock"

Effective: 8.52.190 and later

The stateful Dovecot Push implementation, which kept per-node listener bookkeeping guarded by a cluster lock, has been removed. The stateless implementation - the default since 7.10.4, more robust and requiring no cluster-wide locking - is the only mode now. Consequently the lean configuration properties com.openexchange.push.dovecot.stateless (default true) and com.openexchange.push.dovecot.clusterLock (default hz, only effective with stateless=false) are no longer evaluated and have been removed. The middleware always behaves as if stateless=true was configured, so deployments still setting these properties can simply drop them; setting them has no effect anymore. All other Dovecot Push properties (enabled, preferDoveadmForMetadata, unregisterAfterDelete) are unchanged.

SCR-1782

Summary: New configuration property for cleartext HTTP/2 (h2c) on the Jetty HTTP engine

Effective: 8.52.190 and later

The optional Jetty-based HTTP engine introduced with SCR-1756 gains optional support for cleartext HTTP/2 (h2c) on the HTTP network listener, controlled by the new lean property com.openexchange.http.jetty.http2.enabled (Boolean, default false). It is a server-scope setting evaluated once during server start-up, neither config-cascade aware nor reloadable, and read from the Jetty namespace exclusively since the Grizzly engine does not support HTTP/2. When enabled, h2c is offered both via the HTTP/1.1 upgrade mechanism and via prior knowledge, while HTTP/1.1 requests keep being served on the same listener. The property defaults to disabled because HTTP/2-capable clients - for instance the JDK HTTP client used by SOAP and REST integrations - pro-actively send the Upgrade: h2c header and would actually switch, so it should be enabled deliberately once load-balancer h2c upstream support and client compatibility are verified. The HTTPS listener is unaffected: HTTP/2 over TLS (ALPN) is not offered, since in the standard deployment TLS terminates at the load balancer.

SCR-1781

Summary: New configuration properties for Jetty HTTP engine metrics and access-log rotation

Effective: 8.52.190 and later

The optional Jetty-based HTTP engine introduced with SCR-1756 gains Micrometer metrics and access-log rotation through three new lean properties, all of them server-scope settings evaluated once during server start-up and therefore neither config-cascade aware nor reloadable. com.openexchange.http.jetty.metrics.enabled (Boolean, default true, read from the Jetty namespace exclusively) registers the engine's metrics with the Micrometer registry under the appsuite.jetty.* name space: worker thread pool gauges, per-connector connection statistics tagged with the connector, and server-wide request statistics including responses tagged with the HTTP status class. com.openexchange.http.jetty.accesslog.rotate (default none, supported values none and daily, subject to the Grizzly-pendant fallback) rolls the access log over at local midnight and adds the yyyy_mm_dd place-holder required by Jetty unless the file name already contains one; a value of hourly is treated as daily. com.openexchange.http.jetty.accesslog.retainDays (default 31, Jetty namespace only) bounds how long rotated files are kept. With this change the Grizzly-only property accesslog.rotate listed in SCR-1756 gains a Jetty pendant, while .synchronous and .statusThreshold remain without one. There is no behavioral change for existing deployments.

SCR-1778

Summary: Mandatory 'objectid' mapping for LDAP contacts providers

Effective: 8.52.190 and later

The objectid entry in mapping sections of contacts-provider-ldap-mappings.yml is now treated as mandatory: LDAP contacts provider configurations referencing a set of mappings without it are rejected during initialization with a configuration error (the affected provider section is skipped and logged accordingly, other providers are not affected). Previously, a DN-based fallback was applied, which however only covered the conversion of search results - the resulting identifiers could not be resolved back to entries, so that retrieving single contacts failed with a misleading OX-0001 "Object not found. OBJECT_ID", and search filters on the object id are generally not expressible against entry DNs. Failing early with an actionable error replaces these runtime errors. Deployments relying on the fallback need to configure an objectid mapping, e.g. entryUUID (OpenLDAP) or objectGUID;guid (Active Directory), which are both stable across entry renames and moves; the shipped mapping template was updated accordingly.

See the LDAP contacts provider documentation for further details.

SCR-1761

Summary: New Helm value javaOpts.compactObjectHeaders in core-mw chart

Effective: 8.52.190 and later

New boolean Helm value javaOpts.compactObjectHeaders (default true) in the core-mw chart prepends -XX:+UseCompactObjectHeaders (JEP 519) to the JAVA_OPTS_OTHER environment variable independently of a custom javaOpts.other, whose default is now empty and which remains available for extra verbatim JVM options. Previously the flag lived in the default of javaOpts.other, and since Helm replaces scalar values instead of merging them, any installation overriding that value - for instance to inject a Java agent - silently lost the flag. Toggle-controlled flags are no longer appended twice: -XX:+UseCompactObjectHeaders, -XX:+UseZGC and -XX:ZUncommitDelay are skipped when javaOpts.other already mentions them, so an explicit -XX:-UseCompactObjectHeaders opt-out is left untouched. Installations overriding javaOpts.other now run with Compact Object Headers enabled after the upgrade; set javaOpts.compactObjectHeaders: false to keep the old behavior. Shipped with chart version 6.23.1.

SCR-1757

Summary: New property "com.openexchange.mail.wellFormedHtmlTruncateOnRaw"

Effective: 8.52.190 and later

The max_size parameter of the HTTP API's mail?action=get call is honored for view=raw by hard-truncating the emitted message content. The new lean property com.openexchange.mail.wellFormedHtmlTruncateOnRaw (default true; reloadable and config-cascade aware) controls the markup-aware truncation of HTML bodies that lets clients receive reasonably well-formed markup. If enabled, the truncation cut never splits a tag, comment or character entity, and elements left open by the cut are closed by appending their closing tags, so the returned markup may slightly exceed max_size by those closing tags. If disabled, HTML content is hard-truncated at exactly max_size characters.

SCR-1756

Summary: Configuration properties for the optional Jetty-based HTTP engine

Effective: 8.52.190 and later

The middleware gains an optional, alternative HTTP engine based on Eclipse Jetty 12.1 in the new bundle com.openexchange.http.jetty; the Grizzly-based engine remains the default. The engine is selected per deployment via the new lean property com.openexchange.http.jetty.enabled (Boolean, default false): when enabled, the Jetty engine serves HTTP(S) and the Grizzly engine does not start. Unless stated otherwise, every property below is a server-scope setting evaluated once during server start-up - not config-cascade aware and not reloadable. Engine-neutral properties keep applying unchanged to both engines with the same keys, defaults and semantics: com.openexchange.connector.* (networkListenerHost/-Port, networkSslListenerPort, livenessPort, awaitShutDownSeconds, maxRequestParameters), com.openexchange.server.* (considerXForwards, knownProxies, forHeader, protocolHeader, portHeader, checkTrackingIdInRequestParameters), com.openexchange.servlet.* (echoHeaderName, useRobotsMetaTag/robotsMetaTag, contentSecurityPolicy, maxInactiveInterval, maxFormPostSize, maxBodySize), com.openexchange.cookie.* (ttl, httpOnly, sameSiteValue), com.openexchange.forceHTTPS, com.openexchange.log.extensionHttpHeaders and com.openexchange.requestwatcher.isEnabled. Grizzly-specific properties received equally named com.openexchange.http.jetty.* pendants sharing the same defaults, which now live in code rather than in grizzly.properties: hasJMXEnabled, hasWebSocketsEnabled, wsTimeoutMillis, doAbsoluteRedirect, maxHttpHeaderSize, hasSSLEnabled, keystorePath/-Id/-Password, enabledCipherSuites, maxNumberOfConcurrentRequests, readTimeoutMillis, selectorRunnersCount, tcpNoDelay, sessionExpiryCheckInterval, virtualThreadsEnabled, livenessEnabled, addServerVersion, accesslog.file/.format, strictHeaderNameValidation and strictHeaderValueValidation. An unset Jetty key falls back to the equally named Grizzly pendant before applying the shared default, so an existing deployment keeps its tuning after merely enabling the Jetty engine; selectorRunnersCount is the only exception and is read from the Jetty namespace exclusively. Note that the Jetty engine exposes the standard jakarta.websocket.server.ServerContainer (JSR 356) instead of the Grizzly-typed WebApplicationService. Additionally new is the lean property com.openexchange.drive.events.asyncLongPolling.enabled (default true), which serves Drive event long polling through the standard servlet asynchronous API so suspended listen requests no longer consume a server thread; an installed Grizzly Comet handler still takes precedence. Grizzly-specific properties without a Jetty pendant keep working for Grizzly but have no effect under Jetty: hasCometEnabled, com.openexchange.connector.shutdownFast, maxQueryStringSize, writeTimeoutMillis, keepAlive, minWriteBufferSize, sessionUnjoinedThreshold, removeNonAuthenticatedSessions, supportHierachicalLookupOnNotFound and accesslog.synchronous/.statusThreshold/.timezone. A follow-up review of the engine, contained in 8.52.202 and later as well as in 8.53, adds the property com.openexchange.http.jetty.hasAccessLogEnabled (default true, with a Grizzly pendant) and changes existing semantics: strictHeaderNameValidation=false no longer relaxes anything and strictHeaderValueValidation=false no longer permits folded field values or field lines without a colon, since those are message framing and a request smuggling primitive; a non-positive com.openexchange.connector.awaitShutDownSeconds is now treated as a long but bounded grace period capped at one hour instead of disabling the graceful shut-down. In the same releases the liveness listener is confined to its probe end-point (/live answers 200 for GET and HEAD, every other path and method is refused), TRACE is answered with 405 before it reaches the servlets, a non-positive maxFormPostSize or maxRequestParameters means unlimited as documented, and com.openexchange.servlet.maxActiveSessions is enforced by the Jetty engine as well. Finally, the open-xchange-jetty package no longer declares Provides: open-xchange-httpservice - it is an add-on to be installed alongside open-xchange-grizzly, which keeps the rollback a configuration change instead of a package operation - and its settings belong in an administrator-created jetty.properties, since the bundle ships no configuration file of its own.

SCR-1735

Summary: New Configuration Options for Cross-Context Sharing

Effective: 8.52.190 and later

New properties; all reloadable and config.cascade aware.

• com.openexchange.crosscontext.trustZones — comma-separated trust-zone tags; a grant is admitted only if the sharing user's and target context's tag sets intersect. Source per-user, target per-context. Default empty (deny); global at server scope = legacy anyone-with-anyone.
• com.openexchange.crosscontext.tryPromoteGuests — promote an email-only guest permission to a cross-context permission when it resolves to an internal user in another context and the authority admits. Default true.
• com.openexchange.mail.crossContextRequireSameServer — reject a cross-context mail grant unless the grantee's mailbox is on the same mail server (fails open if indeterminate). Default true.
• com.openexchange.calendar.crosscontext.enabled — enable the cross-context calendar provider, which surfaces calendars shared from other contexts as ordinary calendar accounts (one account per foreign context, over the HTTP API and CalDAV). Default true.

(Mail master switch com.openexchange.mail.crossContextPermissions, default false, recorded under SCR-1574; also subject to the trust-zone gate.)

See the property documentation and the feature documentation for further details.

Database

SCR-1734

Summary: Deputy Storage Table Qualifies the Deputy Entity With Its Context

Effective: 8.52.190 and later

Update Task com.openexchange.deputy.impl.groupware.DeputyStorageAddEntityContextColumnTask

The deputy table gains entityCid (INT4 UNSIGNED NOT NULL DEFAULT 0; 0 = grantor's context) so a deputy may live in another context. Behavior-neutral for existing deputies.

Fresh schemas: com.openexchange.deputy.impl.groupware.DeputyStorageCreateTableService. Existing schemas: com.openexchange.deputy.impl.groupware.DeputyStorageAddEntityContextColumnTask (idempotent; depends on the deputy create-table task).

See the Deputy permissions documentation for further details.

SCR-1733

Summary: Restructured the Folder-Permission Primary Key to Include the Context Column

Effective: 8.52.190 and later

Update Task com.openexchange.groupware.update.tasks.RestructureFolderPermissionPrimaryKeyUpdateTask

Building on the new context column (previous SCR), the PK (and the principal index where present) is extended to include it, so cross-context and same-context permission rows coexist without collision.

• oxfolder_permissions / del_oxfolder_permissions: PK (cid, fuid, permission_cid, permission_id, system); index principal (cid, permission_cid, permission_id, fuid).
• virtualPermission / virtualBackupPermission: PK (cid, tree, user, folderId, entityCid, entity).

Each ALTER rewrites the InnoDB clustered index (slow on large tables). Existing schemas: com.openexchange.groupware.update.tasks.RestructureFolderPermissionPrimaryKeyUpdateTask (idempotent; depends on AddPermissionContextIdToFolderPermissionTableUpdateTask). Fresh schemas: the create-table services above.

See the feature documentation for further details.

SCR-1732

Summary: Added a Permission-Context Column to the Folder-Permission Tables

Effective: 8.52.190 and later

Update Task com.openexchange.groupware.update.tasks.AddPermissionContextIdToFolderPermissionTableUpdateTask

The folder-permission tables gain a context-qualifier column (INT4 UNSIGNED NOT NULL DEFAULT 0; 0 = the row's own context). Behavior-neutral for existing rows. (PK restructure is the next SCR.)

• oxfolder_permissions, del_oxfolder_permissions -> permission_cid
• virtualPermission, virtualBackupPermission -> entityCid

Fresh schemas: com.openexchange.admin.mysql.CreateOXFolderTables / CreateVirtualFolderTables. Existing schemas: com.openexchange.groupware.update.tasks.AddPermissionContextIdToFolderPermissionTableUpdateTask (idempotent, no deps).

See the feature documentation for further details.

SCR-1731

Summary: Added the "xctx_liaisons" Cross-Context Liaison Registry Table and Create-Table Update Task

Effective: 8.52.190 and later

Update Task com.openexchange.crosscontext.impl.storage.rdb.groupware.CrossContextLiaisonsCreateTableTask

New per-context table xctx_liaisons in the grantee (target) context's user schema (not configdb) — a pointer index, one small row per cross-context grant.

CREATE TABLE xctx_liaisons (
  `cid` INT4 UNSIGNED NOT NULL,
  `entity` INT4 UNSIGNED NOT NULL,
  `module` INT4 UNSIGNED NOT NULL,
  `sharing_cid` INT4 UNSIGNED NOT NULL,
  `owner_entity` INT4 UNSIGNED NOT NULL DEFAULT 0,
  `type` INT4 UNSIGNED NOT NULL DEFAULT 0,
  PRIMARY KEY (`cid`, `entity`, `module`, `sharing_cid`, `owner_entity`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

cid/entity = grantee context + principal; sharing_cid = owner context; owner_entity = owning entity (0 = owner-agnostic); type = LiaisonType (0=DB_FOLDER_SHARE, 1=DEPUTY, 2=MAIL_FOLDER_SHARE). Composite PK is the natural key; no secondary indexes.

• Fresh schemas: com.openexchange.crosscontext.impl.storage.rdb.groupware.CrossContextLiaisonsCreateTableService.
• Existing schemas: com.openexchange.crosscontext.impl.storage.rdb.groupware.CrossContextLiaisonsCreateTableTask (UpdateTaskAdapter, no deps, idempotent).
• Cleanup: CrossContextLiaisonsDeleteListener (context/user/group delete) + LiaisonsCleanUpExecution (DatabaseCleanUpService job, 1/day; prunes orphans, fail-safe).

See the feature documentation for further details.

Packaging/Bundles

SCR-1730

Summary: Added New Bundles for Cross-Context Sharing

Effective: 8.52.190 and later

Three new OSGi bundles, shipped in open-xchange-core (already in open-xchange-core.psf; no install-list change). Bundle-Version 8, BREE JavaSE-25.

• com.openexchange.crosscontext — API/SPI bundle (liaison registry, authority provider, principal resolution, outbound-share + cleanup SPIs). No activator.
• com.openexchange.crosscontext.impl — implementation (RDB storage/registry, trust-zone authority, mailto: resolver, DoveAdm mail source/retractor, reconciler, admin REST). Activator com.openexchange.crosscontext.impl.osgi.CrossContextActivator.
• com.openexchange.chronos.provider.crosscontext — cross-context calendar provider (account reconciler, iTip conversion, incoming-scheduling listener). Activator com.openexchange.chronos.provider.crosscontext.osgi.CrossContextCalendarProviderActivator.

See the feature documentation for further details.

8.52.182

Behavioral Changes

SCR-1791

Summary: Guarded loads in Redis cache v2: cache re-inserts that raced an invalidation are rejected

Effective: 8.52.182 and later

Read-aside caching in cache.v2 had an inherent read-load-put race: a load that started before a data change could re-insert the pre-change state right after the invalidation following the change, poisoning the shared Redis cache until the next invalidation or expiration (core#545). Provisioning changes such as capability toggles could therefore remain ineffective on middleware nodes for an unbounded time. The lease/fencing-token pattern ("guarded loads") is now implemented centrally in the Redis-backed cache v2. Every invalidation of a guarded cache region rotates random guard tokens with a one-hour TTL before deleting the cache entries; each key is protected by a pair of guards - a per-key guard rotated by exact-key invalidations and a scope guard rotated by wild-card, group and mass invalidations that cannot enumerate every key they cover. The load path snapshots both guard tokens together with the value in a single Redis operation after a cache miss and before the loader runs, and the loaded value is only put into cache through an atomic Lua script while both tokens are still unchanged; otherwise the put is rejected - the value is still returned to the caller but kept out of the Redis, in-memory and thread-local layers. Values whose load raced a recent invalidation of their guard scope are cached with a capped expiration of 300 seconds, bounding the staleness of values loaded from a lagging read-only database connection. The manual mget-load-mput pattern is covered through per-thread guard token snapshots with batched, pipelined conditional puts. Guard keys share the value key's hash tag, so the scripts are Redis Cluster safe; keys lacking a common hash tag fall back to a non-atomic guard check. Cache hits still cost one round trip. Guarded loads are opt-in via CacheOptions.Builder#withGuardedLoads(boolean) or the new guarded-loads attribute of CoreModuleName, and are enabled for the provisioning-invalidated core regions alias, caps, fs, group, usr, usrIapLgi, usrLgi, permBits and usm; the key infix "guard" is reserved and must not be used as a cache module name. Rejected puts are counted via the new Micrometer metric appsuite.redis.cache.puts.rejected.total, tagged per cache module. Known limitation: region-wide invalidation patterns without a concrete key scope only place guard tokens for keys currently present in cache, so an in-flight load for a key not cached at that moment is not rejected; scoped invalidations do not have this limitation. The interim mitigation of a deferred second invalidation is removed again.

8.52.139

Configuration

SCR-1800

Summary: New property to obtain IMAP subscription state from separate LSUB when the \Subscribed attribute of LIST-EXTENDED responses is untrustworthy

Effective: 8.52.139 and later

On IMAP servers advertising the LIST-EXTENDED capability (RFC 5258) the middleware determines mailbox subscriptions from the single consolidated command LIST "" "" RETURN (SUBSCRIBED CHILDREN [SPECIAL-USE]). Certain proxy setups, for instance Dovecot with an imapc backend (see /appsuite/support#1543 and DOP-3897), answer the SUBSCRIBED return option inconsistently with LSUB: subscribed mailboxes in shared and user namespaces are listed without the \Subscribed attribute, so subscriptions to shared folders never become visible in App Suite. The new lean configuration property com.openexchange.imap.considerSubscribedInListExtended (default true, reloadable, server scope, no .properties file entry) controls this. With true the attribute is trusted and the subscription state comes from the single consolidated round-trip, which is the behavior as before. With false a hybrid mode applies: the consolidated command without SUBSCRIBED still provides hierarchy, children and special-use information while a separate LSUB "" "" provides the subscription state. With probe the middleware verifies once per IMAP server whether the attribute matches the LSUB output and caches the verdict per server, its lifetime governed by com.openexchange.imap.cache.commonImapServerCacheTimeToLive; a probe is only conclusive if it finds a mismatch or covers at least one subscribed mailbox inside a shared or user namespace, and it costs no additional IMAP round-trip compared to hybrid mode. The property only takes effect on servers advertising LIST-EXTENDED, since without that capability separate LIST and LSUB commands are issued anyway. No operator action is required by default; set the property to false or probe for installations whose IMAP server or proxy reports the \Subscribed attribute unreliably.

8.52.23

Configuration

SCR-1777

Summary: Enable client-side prepared statement caching by default (cachePrepStmts)

Effective: 8.52.23 and later

Enables MySQL Connector/J client-side prepared statement caching by default in the middleware database connector. The JDBC connection properties cachePrepStmts=true, prepStmtCacheSize=250 and prepStmtCacheSqlLimit=2048 are now set both as code default in Configuration.readJdbcProps and in the shipped com.openexchange.database/conf/dbconnector.yaml. JFR profiling under sustained load showed prepareStatement re-parsing the SQL text on every call, accounting for roughly 6% CPU, because client-side statement caching was never enabled; with useServerPrepStmts=false, which is the default, Connector/J caches the parsed client-side statement per connection once cachePrepStmts is set. The cache keys on the SQL text only and carries no metadata, so it stays valid across DDL, and the additional memory is bounded to prepStmtCacheSize entries per physical connection. Existing deployments with a customized dbconnector.yaml still get the new default via the code default, and everything remains overridable via dbconnector.yaml or the com.openexchange.database.jdbc.* properties.

8.52.14

Configuration

SCR-1760

Summary: Changed behavior of blocking thread pool task submission

Effective: 8.52.14 and later

The global thread pool executor was reworked to build upon the JDK's java.util.concurrent.ThreadPoolExecutor, which changes one operator-visible behavior for deployments that enable blocking task submission. With com.openexchange.threadpool.blocking=true, a saturated pool now creates additional worker threads up to com.openexchange.threadpool.maximumPoolSize before the submitting caller blocks waiting for queue space; previously the caller already blocked once com.openexchange.threadpool.corePoolSize threads existed, so the pool effectively never grew beyond the core size in blocking mode. While waiting for queue space, a submitting thread's interrupt is now preserved instead of being swallowed. Only non-default configurations are affected: blocking defaults to false, and with the shipped defaults (workQueue=linked and corePoolSize below maximumPoolSize) the property is not effective at all - the change is only observable when blocking=true is combined with workQueue=synchronous or a fixed-size pool. No configuration change is required, but deployments relying on the old implicit thread cap in blocking mode should review maximumPoolSize since the pool may now grow up to that limit under sustained load.

8.52.9

CLT

SCR-1753

Summary: New command-line tool reassignpersonalfolderowners

Effective: 8.52.9 and later

New command-line tool reassignpersonalfolderowners reassigns the owner of all folders located below a user's personal (default) Infostore folder to that user. Since the file storage quota is accounted to the folder owner, this lets everything below a user's personal folder count against that user's quota, aligning already existing folders with the behavior enabled through com.openexchange.infostore.setPersonalFolderOwnerBelowPersonalInfostore (see SCR-1751), which only affects newly created or moved folders. Usage: reassignpersonalfolderowners -c [-u ] [--dry-run] -A -P [-p ] [-s ], where -c processes one context (context admin credentials suffice), -u restricts to a single user, --all processes all contexts (master admin credentials required) and --dry-run only reports affected folders. The tool is idempotent, relocates files between file storages when the previous and the new owner use different ones, and is served via the new RMI service PersonalFolderOwnersRMIService; recalculatefilestoreusage should be run afterwards. The owner reassignment only serves the quota accounting: explicit folder permissions are left untouched, and the administrative access a folder's owner implicitly holds is preserved for the former owner as an explicit folder administrator permission (guest users excluded).

Configuration

SCR-1751

Summary: New property com.openexchange.infostore.setPersonalFolderOwnerBelowPersonalInfostore

Effective: 8.52.9 and later

New lean property com.openexchange.infostore.setPersonalFolderOwnerBelowPersonalInfostore (Boolean, default false; reloadable and config-cascade aware at context level). When enabled, a folder created below a user's personal (default) Infostore folder gets that personal folder's owner assigned regardless of who creates it, and folders moved into or out of such a subtree get their owner - including subfolders - adjusted accordingly, in analogy to the existing com.openexchange.infostore.setAdminAsCreatorForPublicDriveFolder behavior for the public Infostore subtree. Since the file storage quota is accounted to the folder owner, this lets everything below a user's personal folder count against that user's quota. Only newly created or moved folders are affected; existing data is left untouched. To enable the feature, set the property to true, run the new command-line tool reassignpersonalfolderowners once (see SCR-1753) and then recalculatefilestoreusage. The owner reassignment only serves the quota accounting: explicit folder permissions are left untouched, and the administrative access a folder's owner implicitly holds is preserved for the former owner as an explicit folder administrator permission (guest users excluded).

[8.52.0]

General

Middleware Image Migrated from Debian to Wolfi OS

Summary: The App Suite Middleware container image now builds on Wolfi OS instead of Debian Bookworm

The App Suite Middleware container image now builds on Wolfi OS instead of Debian Bookworm. The Middleware application itself is unchanged.

What's new

• Images are signed (cosign) with SLSA v0.2 provenance and ship an SPDX SBOM.
• CVE patches flow automatically via Renovate.
• Image is now slightly smaller than with Debian Bookworm.
• No package manager at runtime, moving closer to distroless.

Breaking Changes to Verify

1. /etc/ssl/certs/java/cacerts is now 0444 (read-only). Custom truststore hooks doing cp … && keytool -import … must add chmod 0644 between the two steps.
2. No apt-get / dpkg at runtime. Use kubectl debug or the appsuite-toolkit for in-pod investigation; installing packages live is no longer possible.
3. MariaDB client is pinned to 11.4 LTS (no Renovate auto-bump). It is wire-compatible with MySQL 5.5+ and MariaDB 10.x+ servers.
4. Implicit Debian tools are no longer present: which, diff, xz, wget, and the hostname binary. Customer scripts using these need POSIX alternatives (command -v for which, $HOSTNAME for hostname).
5. The Java vendor changes from Eclipse Temurin to Wolfi OpenJDK 25 (same upstream source, identical bytecode/API). Binaries like jmap, jstack, jcmd, jstat, jinfo, and jps are no longer bundled with the runtime image. For heap dumps, thread dumps, mysqldump, and other diagnostics against a running pod, use the appsuite-toolkit which provides these operations via command-line tools or ephemeral debug container attached alongside the target pod.
6. mysql is now a symlink to mariadb, which prints a one-time deprecation warning at invocation.

Action Items for Operators

• Smoke-test on a non-production cluster with your existing Helm values.
• Verify any custom hook scripts (truststore imports, CA bundles, custom CLTs) against the new image.

8.51.89

3rd Party Libraries/License Change

SCR-1724

Summary: Upgraded OSGi core library

Upgraded OSGi core library in target platform (com.openexchange.bundles):

• eclipse.osgi_3.24.0.v20251126-0427.jar upgraded to org.eclipse.osgi_3.24.200.v20260515-1403.jar

API - HTTP-API

SCR-1726

Summary: "sanitize_css" parameter for /mail?action=get

Adds an optional boolean query parameter sanitize_css to the /mail?action=get endpoint. It lets a client decide per request whether CSS content in HTML mail is sanitized against the white-list (in CleaningJsoupHandler and CssOnlyCleaningJsoupHandler), instead of always sanitizing.

If the parameter is absent or set to true, CSS content is sanitized against the white-list – unchanged behavior, so existing requests are unaffected. If set to false, CSS content is passed through unfiltered.

This affects CSS sanitizing only; HTML tag white-listing (the sanitize parameter) and external-image handling (the replace_external_images parameter) are independent. No configuration change and no API-breaking change.

API - REST

SCR-1714

Summary: New Administrative REST Servlet for Shared Accounts

Permissions and capabilities a particular user effectively has for a shared account are not persisted as such, but evaluated dynamically at runtime - based on the base configuration and all shared account permissions the user received, directly as well as indirectly through his group memberships. Since this calculated result can therefore not be deduced directly from the provisioned data, a dedicated administrative REST interface is available that answers the question: which effective permissions and capabilities does a certain user have for a shared account?

The endpoints are exposed below /preliminary/sharedaccounts/v1 and are protected via HTTP Basic Authentication, with the credentials configured through the properties com.openexchange.rest.services.basic-auth.login and com.openexchange.rest.services.basic-auth.password.

The user whose access is to be evaluated - and, where applicable, the targeted shared account - can be referenced in three alternative ways: by their explicit internal identifiers, by their email address, or by their mail login string.

See the general documentation, as well as the REST API documentation for further details.

Behavioral Changes

SCR-1717

Summary: Deny Write-Access for Guest Users in Public Calendar Folders

With MW-1473 write access for invited guest users was introduced. However, write access in a calendar folder also implies taking over the organizer role for scheduled appointments. This role cannot be hijacked for a foreign principal residing on an external calendaring and mail system a guest user originates from. Therefore, guest users may only receive write access for personal or shared calendar folders that are bound to a known internal calendar user they can act on behalf of, but not for public calendar folders.

See the documentation for further details.

SCR-1723

Summary: Java 25: virtual-thread HTTP worker pool and opt-in generational ZGC

Full admin guide: Garbage Collection and Memory Sizing

Change

The core middleware now runs on Java 25 (JDK 25 runtime). Operationally relevant defaults that change with this upgrade:

• Virtual-thread HTTP worker pool - the Grizzly request workers run on virtual threads by default (com.openexchange.http.grizzly.virtualThreadsEnabled=true), raising in-flight request concurrency.
• Compact Object Headers (-XX:+UseCompactObjectHeaders, JEP 519) are enabled via javaOpts.other, reducing live heap.

The garbage collector default is unchanged: G1 stays the default. Generational ZGC is available as an opt-in alternative via the Helm value javaOpts.zgc (default false); set to true it appends -XX:+UseZGC to the JVM options. (An earlier revision shipped ZGC as the default; it was reverted to opt-in before release - see "Why opt-in, not default" below.) ZGC is the only change with deployment-sizing impact, and only when enabled (see below). The worker-pool defaults that accompany the virtual-thread switch are listed at the end.

What an administrator must do

Nothing is required. G1 stays the default garbage collector, so existing memory sizing is unaffected by the JDK 25 upgrade as far as the collector is concerned.

Who should opt in to ZGC. With the MALLOC_ARENA_MAX=2 default, ZGC's former native-memory penalty is largely gone - its non-heap native sits at G1 level and the only remaining premium is the eager heap commit, which converges with G1 under a realistic live set. The load test (below) showed ZGC faster than G1 - better mean and tail latency and higher throughput - even at a modest 4G/6G pod, so ZGC is a sound choice for virtual-thread, latency-sensitive deployments generally, not just large installations. G1 remains the default and the better fit for throughput-/batch-bound workloads, very small heaps (where G1 is more CPU-efficient), and CPU-starved pods (ZGC's concurrent GC needs CPU headroom). Validate under your own load before tightening below 4G/6G - the benchmark had a small heap live set and under-exercised mail/attachment-heavy paths.

If you do opt in (javaOpts.zgc: true), size for ZGC's native-memory headroom. With MALLOC_ARENA_MAX=2 set (now a chart default - see "Why the headroom is large" below), the load-validated configuration is a 4G heap on a 6G container limit:

• javaOpts.memory.maxHeapSize: 4G (or javaOpts.memory.maxRAMPercentage: "50")
• resources.requests.memory: 6G and resources.limits.memory: 6G
• MALLOC_ARENA_MAX=2 on the container env (chart default) - without it the same workload needs an 8G limit.
• give the pod adequate CPU - concurrent GC needs headroom; do not run ZGC CPU-starved.

This was hard-validated under load (50 concurrent users, real Dovecot/Postfix): cgroup peak ~5.3G, 0 OOM, 0 restarts, no request errors. Without MALLOC_ARENA_MAX the peak is ~6.5G and a 6G limit fails (matching the earlier CI observation that 4G/6G failed). Too little memory does not surface as an OOM - it shows up as failures to open outbound IMAP/SMTP connections (mail-backend timeouts) under load, a downstream effect of the container exhausting native memory, not the mail sockets themselves. The test had a small heap live set and under-exercised mail/attachment-heavy paths, so treat the peak as a floor and keep margin - do not tighten below 6G without a heavier-mail re-test.

Why the headroom is large, and how to shrink it (load-tested 2026-06-29). Native-memory tracking under load overturns the original assumption that direct buffers dominate: direct/off-heap memory (NMT "Other") peaks at only ~0.3-0.5G and ZGC's own structures at ~80MB. The real driver of the excess is glibc malloc-arena retention (~1.2G) - the many-threaded virtual-thread middleware spawns many per-thread malloc arenas that hoard memory. Setting MALLOC_ARENA_MAX=2 (container env, now a chart default) caps this and cuts the cgroup peak from ~6.5G to ~5.3G at a 4G heap, letting ZGC fit a 6G limit. Crucially this brings ZGC's non-heap native memory down to the same level as G1 (~1.25G in both with the cap) - the only remaining difference is that ZGC eager-commits its heap while G1 right-sizes, and that gap converges under a realistic (larger) heap working set. -XX:MaxDirectMemorySize is not a useful sizing lever here (direct memory is small); it is only worth setting as an optional fast-fail cap.

(If core-mw is deployed as a subchart, the keys live under the core-mw: block.)

Returning idle memory (pay-per-used hosting). On hosting billed by actual memory use (RSS), ZGC hands idle heap back to the OS. Set javaOpts.zgcUncommitDelay (e.g. "60") to uncommit unused heap sooner than the 300s default (-XX:+ZUncommit is on by default). A 20-min soak confirmed ~2.2G returned to the OS within ~4 min of load dropping, while staying KO=0 under load. This returns heap only - glibc malloc arenas are bounded separately by MALLOC_ARENA_MAX. Trade-off: re-commit costs page faults when load returns; too short a delay churns under spiky load. If billed on the pod reservation rather than RSS, right-size the request instead. Do not throttle the heap with -XX:SoftMaxHeapSize to force a smaller footprint - a soak with SoftMaxHeapSize=2G at a 4G heap caused a severe tail regression (request timeouts, max 37.5s) by starving ZGC of allocation headroom; the idle give-back does not need it. (For very spiky, small-live-set workloads G1 reclaims even more aggressively, at a worse tail.)

Load-test results - performance and sizing

A full-stack load test (self-deployed core-mw-test umbrella chart with real Dovecot/Postfix/DB/Redis, in-cluster Gatling AppSuiteSimulation, 50 concurrent users; JDK 25, generational ZGC, 4G heap) measured ZGC against G1 at an identical 4G heap / 6G limit with MALLOC_ARENA_MAX=2, both error-free (KO=0):

• ZGC is faster, not slower: mean 38 vs 56 ms, p95 106 vs 130 ms, p99 213 vs 796 ms, max 1466 vs 6118 ms, and +47% throughput (1.03M vs 0.70M requests in the same window). ZGC's occasional allocation stalls cost far less than G1's multi-second stop-the-world pauses on this allocation-heavy, virtual-thread workload.
• Memory: ZGC cgroup peak ~5.3G vs G1 ~1.3G. The gap is not GC overhead - with MALLOC_ARENA_MAX=2 the non-heap native is ~1.25G for both. It is ZGC eager-committing the 4G heap (file-backed) while G1 right-sized to ~370M for this small test live set; G1 could not be forced to hold 4G (-Xms4G/AlwaysPreTouch spiked then uncommitted). Under a production-sized live set the two converge.
• Conclusion: with MALLOC_ARENA_MAX=2 the memory premium of ZGC shrinks to its eager heap commit (small in practice) while the latency/throughput win is clear. ZGC is therefore recommended for the virtual-thread worker pool (latency-sensitive deployments); G1 remains the safe default for tight or throughput-bound pods.

Why opt-in, not default

ZGC was initially made the default but reverted to opt-in before release. Defaulting it on would force a mandatory pod re-sizing onto every installation at upgrade time; an operator that did not re-size would silently hit the native-memory failure mode above (IMAP/SMTP connection failures, not an obvious OOM) - a poor default for large/cloud deployments. G1 has zero such sizing impact. The opt-in default is retained for conservatism (no forced re-sizing at upgrade time), but the latency/throughput benchmark has since been run (see "Load-test results" above) and favors ZGC: with MALLOC_ARENA_MAX=2 resolving most of the memory premium, ZGC is now the recommended collector for virtual-thread, latency-sensitive deployments, and a future release may reconsider it as the default.

Why ZGC, and why it fits the virtual-thread worker pool

The middleware request path now runs on a virtual-thread worker pool, which raises in-flight concurrency and the rate of short-lived, request-scoped allocations. G1's stop-the-world young/mixed collections scale with heap/live-set and pause all carrier threads at once, causing latency spikes across many virtual threads. Generational ZGC collects concurrently with sub-millisecond, heap-size-independent pauses, and its young generation suits exactly this short-lived-allocation pattern, giving stable tail latency under high concurrency. Compact Object Headers (also default) reduces live heap and further eases GC pressure. This synergy is why ZGC is offered as an opt-in for latency-sensitive, well-sized deployments.

Concerns / when to stay on G1

• Native-memory headroom (see above) - largely mitigated by the MALLOC_ARENA_MAX=2 chart default, which brings ZGC's non-heap native down to G1 level and lets it fit a 6G limit; still budget the headroom and validate under load for mail/attachment-heavy workloads.
• CPU: ZGC trades some throughput/CPU for low pauses. On CPU-starved pods its concurrent GC threads compete with the virtual-thread carriers and can raise latency. Ensure CPU headroom.
• Allocation stalls: if the allocation rate outpaces concurrent collection (heap or CPU too small), ZGC stalls threads until memory is freed - the failure mode to watch under load spikes (monitor for "Allocation Stall" GC log lines).
• Stay on G1 (the default) for very tight containers, throughput-/batch-bound workloads, or very small heaps where G1 is more CPU-efficient.
• Virtual-thread pinning is orthogonal - ZGC does not pin virtual threads.
• The latency/throughput benchmark has now been run (see "Load-test results" above) and favors ZGC; it used a small heap live set and under-exercised mail/attachment-heavy paths, so a heavier-mail load test is still advisable before flipping ZGC to the default in a future release.

About the virtual-thread worker pool

Virtual threads (JEP 444, stable since JDK 21) are lightweight JVM-managed threads multiplexed onto a small pool of OS "carrier" threads. A virtual thread blocked on I/O (IMAP/SMTP/DB) unmounts its carrier instead of holding an OS thread, so the server keeps far more requests in flight at roughly a stack's cost each rather than a full platform thread.

• Benefit: HTTP throughput under high concurrency is no longer capped by a bounded worker pool, while blocking I/O stays simple (no async rewrite).
• Behavioral changes: concurrency is no longer throttled by pool exhaustion - global back-pressure is now com.openexchange.threadpool.virtual.maxConcurrency (default auto); more in-flight requests mean higher peak heap/native use (hence the ZGC sizing above applies when ZGC is enabled); thread dumps show many short-lived virtual threads instead of a fixed named pool, and pool-saturation metrics no longer apply to HTTP work.
• Fallback: com.openexchange.http.grizzly.virtualThreadsEnabled=false reverts to the platform-thread worker pool.
• Virtual-thread pinning (a VT stuck to its carrier during synchronized/native sections) was audited - middleware code shows none; ZGC does not pin either.

Worker thread pool defaults (changed)

The shared worker thread pool ("OXWorker") previously shipped with an unbounded maximumPoolSize and a synchronous hand-off queue, allowing unbounded platform-thread creation under load. The Grizzly HTTP worker pool now runs on virtual threads by default (com.openexchange.http.grizzly.virtualThreadsEnabled=true) and is not governed by this pool; the bounded default guards non-HTTP work and the virtualThreadsEnabled=false fallback.

• com.openexchange.threadpool.maximumPoolSize Maximum number of platform threads in the shared worker pool. Shipped default changed 2147483647 -> 2000. Not reloadable, not config-cascade aware. File: threadpool.properties.

• com.openexchange.threadpool.workQueue Queue type for the shared worker pool. Shipped default changed synchronous -> linked. Combined with maximumPoolSize greater than corePoolSize this activates the ScalingQueue: threads scale up to maximumPoolSize, then excess tasks queue instead of spawning further threads. Not reloadable, not config-cascade aware. File: threadpool.properties.

• com.openexchange.threadpool.virtual.maxConcurrency The maximum number of tasks that may run concurrently on the shared virtual-thread executor. Acts as a global back-pressure limit: once reached, submission of further tasks blocks until a running task completes. This is a process-wide overload limit, not a per-caller setting; individual fan-out sites may apply their own, narrower concurrency bound on top of it. Accepts a positive integer or the special value auto (default). With auto the limit is derived best-effort at start-up from the maximum heap size (the dominant constraint on in-flight request memory) and the active garbage collector: it scales with the heap and is reduced slightly under ZGC, which needs more native-memory headroom. The derived value is clamped to [512, 20000] and logged with its inputs at start-up (roughly ~4000 at a 4G heap on G1, ~3300 on ZGC). An explicit positive integer overrides the automatic value; a non-positive or unparseable value falls back to auto. Default auto (previously the fixed value 20000). Not reloadable, not config-cascade aware. File: threadpool.properties. Note: this is a memory-OOM safeguard, not a concurrency tuning target - the useful concurrency of blocking virtual-thread fan-out is almost always bound by a downstream pool (database connections, mail access, etc.) below this ceiling, which enforces its own narrower limit. The auto estimate is tunable via com.openexchange.threadpool.virtual.maxConcurrency.auto.heapFraction and com.openexchange.threadpool.virtual.maxConcurrency.auto.perRequestKB (below).

• com.openexchange.threadpool.virtual.maxConcurrency.auto.heapFraction Fraction of the maximum heap budgeted for transient per-request state by the auto derivation of com.openexchange.threadpool.virtual.maxConcurrency; only consulted when that property is auto. Must be a decimal in (0, 1]; an absent, out-of-range or unparseable value falls back to 0.25. Not reloadable, not config-cascade aware. File: threadpool.properties.

• com.openexchange.threadpool.virtual.maxConcurrency.auto.perRequestKB Estimated transient heap (in KiB) per in-flight request used by the auto derivation of com.openexchange.threadpool.virtual.maxConcurrency; only consulted when that property is auto. Raise it for requests with large transient state (buffered attachments, large responses) to make the safeguard more conservative; lower it for lightweight workloads. Must be a positive integer; an absent, non-positive or unparseable value falls back to 256. Not reloadable, not config-cascade aware. File: threadpool.properties.

Configuration

SCR-1583

Summary: Per-user Filters for LDAP Contacts Provider

Besides the distinguishing attribute placeholder [value] for the folders, the filter template in mode dynamicAttributes may now also contain several user- or session-specific placeholders which are replaced dynamically from the requesting user's session prior passing the query to LDAP. Doing so, it is possible to model different 'views' on the data, in case the user base is also represented through the LDAP directory, in combination with multi-value LDAP attributes.

See the documentation for the new replacement options and further details.

Database

SCR-1718

Summary: Update Task to Downscope Unsupported Guest Permissions

Update Task com.openexchange.groupware.update.tasks.DownscopeGuestPublicCalendarPermissionsTask

The blocking database update task 'com.openexchange.groupware.update.tasks.DownscopeGuestPublicCalendarPermissionsTask' is introduced to downscope write permissions of guest users on public calendar folders to "read-only".

With MW-1473 write access for invited guest users was introduced. However, write access in a calendar folder also implies taking over the organizer role for scheduled appointments. This role cannot be hijacked for a foreign principal residing on an external calendaring and mail system a guest user originates from. Therefore, guest users may only receive write access for personal or shared calendar folders that are bound to a known internal calendar user they can act on behalf of, but not for public calendar folders.

This task aligns already existing permissions accordingly by stripping object-write, object-delete, sub-folder/create-object as well as administrative folder permissions from any guest user permission on a public calendar folder, leaving folder- and object-read permissions untouched.

8.50.112

API - HTTP-API

SCR-1711

Summary: Added new cluster-internal REST endpoint to validate Middleware sessions for the JMAP-IMAP proxy

Motivation

The HTTP/REST API previously had no entry point that lets the cluster-internal JMAP-IMAP proxy resolve a user's Middleware session into the IMAP backend coordinates and credentials it needs to forward JMAP calls. Standalone JMAP clients can authenticate against the proxy directly via HTTP Basic / OIDC -- the App Suite UI cannot, because it only carries a Middleware session cookie.

This SCR closes that gap with a dedicated cluster-internal REST endpoint, hardened against credential exposure.

New Endpoint

• Method + path: GET /preliminary/mail/v1/validate-session/<session>
• Bundle: com.openexchange.mail.rest (new), registered via open-xchange-core.psf
• Required path parameter: session -- the Middleware session identifier (length-capped to 128 chars)
• Required header: X-OX-Session-Secret -- the plain value of the user's open-xchange-secret-<hash> cookie, forwarded by the proxy from the originating client request (length-capped to 512 chars)
• HTTP Basic-Auth: gated by Role.BASIC_AUTHENTICATED (cluster-internal REST credentials com.openexchange.rest.services.basic-auth.*; identical to SessionRESTService)

The session is resolved in a touch-free manner via SessiondService.peekSession(String); repeated polling does not reset the session's idle expiration counter, so the proxy can poll at ~30 s without keeping otherwise idle sessions alive.

Response: AES-256-GCM Envelope

Because the response carries the user's plaintext mail password (LOGIN flow) / OAuth access token plus internal infrastructure details (IMAP host name, login, primary email), the entire success body is wrapped in an AES-256-GCM envelope.

Wire format on HTTP 200:

{
  "v": 1,
  "envelope": "v1:<base64-iv>:<base64-ct-with-tag>"
}

The ciphertext decodes to the inner payload:

{
  "identity": { "user", "context", "displayName", "primaryEmail" },
  "imap":     { "host", "port", "secure" },
  "auth":     { "type", "loginName", "secret", "secretExpiresInSeconds" },
  "session":  { "expiresInSeconds" }
}

auth.type ∈ `{LOGIN,XOAUTH2,OAUTHBEARER\}, mirroring the Middleware-internalAuthType` enum.

A fresh 12-byte random IV is generated per call. The caller's Basic-Auth identity (UTF-8 bytes) is additionally bound into the GCM authentication tag via Associated Authenticated Data, so an envelope captured from one caller cannot be successfully decrypted with a different caller's credentials. The proxy must pass the byte-identical AAD when decrypting; the wire format itself remains unchanged.

Error responses (401/403/429/503/500) are plaintext OX-error-JSON so the proxy can forward them to the originating client untouched.

Example request:

GET /preliminary/mail/v1/validate-session/abc123def456
Authorization: Basic <base64 of proxy credentials>
X-OX-Session-Secret: <secret cookie value>

Authentication

The endpoint enforces two independent authentication layers:

• Authorization Basic-Auth gates the caller (proves "you're the JMAP-IMAP proxy"). Cluster-internal credentials, same pool as other internal REST endpoints.
• X-OX-Session-Secret compared against session.getSecret() in constant time (via MessageDigest.isEqual) so the comparison's running time does not leak information about which bytes already matched. Prevents resolving arbitrary session identifiers -- the caller must have seen the user's actual cookies, otherwise the lookup fails.

After 5 consecutive secret-mismatch attempts on the same session identifier within a 10-minute window, the session itself is invalidated cluster-wide via SessiondService.removeSession(..., ADMIN_CLOSED). A legitimate proxy call never produces a mismatch, so the threshold cannot fire on real traffic.

Sessions whose OAuth access-token expiry (Session.PARAM_OAUTH_ACCESS_TOKEN_EXPIRY_DATE) is in the past are rejected upfront with SES-0203 rather than handed out as a dead token.

Error Handling

• HTTP 401 (Basic-Auth missing/invalid) -- handled by the REST stack before the resource method runs.
• HTTP 401 with OX error JSON (SES-0203 SESSION_EXPIRED) -- raised on unknown / expired sessions, missing / mismatching X-OX-Session-Secret, or expired OAuth tokens. The OXException chain matches SessionUtility.checkSecret byte-for-byte (OXEXCEPTION_PROPERTY_SESSION_EXPIRATION_REASON carries NO_SUCH_SESSION, NO_EXPECTED_SECRET_COOKIE or SECRET_MISMATCH), so the proxy can forward the resulting error JSON to the originating client untouched and the standard SES-0203 handling kicks in.
• HTTP 403 with OX error JSON (MAIL-0114 MAIL_ACCESS_DISABLED) -- raised when the user has no primary mail account or the primary account is disabled.
• HTTP 403 -- raised when TLS is required (com.openexchange.mail.rest.requireTls=true, default) and the request is not secure, or when the source IP is not contained in the configured allowlist (com.openexchange.mail.rest.allowedSourceIPs).
• HTTP 429 (empty body) -- raised when a Basic-Auth identity exceeds 6 000 requests per minute. The proxy should treat this as a load signal and back off exponentially; do not forward to the originating client.
• HTTP 503 with OX error JSON -- raised when the server-side AES-256 encryption key is missing or invalid. Fails closed: the endpoint never serves a plaintext fallback.

Operational Hardening

• Cache-Control: no-store, no-cache, must-revalidate + Pragma: no-cache on every response so no HTTP intermediary along the in-cluster path persists the (encrypted) body.
• Every call is audit-logged via AuditLogService with an outcome-specific event id (ox.mail.validateSession.success, ox.mail.validateSession.session-expired.<reason>, ox.mail.validateSession.mail-access-disabled, ox.mail.validateSession.error). Caller identity, session id and timestamp only; never the supplied secret value, never the user's password / token.

Configuration

The endpoint introduces a small set of properties, documented and tracked separately in SCR-1712:

• com.openexchange.mail.rest.encryption.key (required) -- the AES-256 key shared with the JMAP-IMAP proxy
• com.openexchange.mail.rest.requireTls (default true) -- toggle for TLS enforcement
• com.openexchange.mail.rest.allowedSourceIPs (default empty) -- optional source-IP allowlist

The endpoint additionally reuses:

• com.openexchange.rest.services.basic-auth.login / .password -- the cluster-internal REST credentials (shared with the other Role.BASIC_AUTHENTICATED endpoints)
• com.openexchange.sessiond.sessionDefaultLifeTime / sessionLongLifeTime -- session lifetime estimation

SCR-1695

Summary: New Action 'hasActive' in Module 'mailfilter/v2'

In order to get a quick information if there are currently specific mail filter rules active or not for an account, the new action hasActive is introduced in module mailfilter/v2 of the HTTP API.

See the API documentation for further details.

SCR-1692

Summary: Additional Field 'com.openexchange.imap.rootFolderStatus' for Mail Account Root Folders

The folder model (FolderResponseData) of the HTTP API is extended by the additional read-only field com.openexchange.imap.rootFolderStatus (column id 3053). It is only available for the special, virtual mail account root folders (e.g. with if default0 or default14), if supported by the underyling IMAP server.

It contains information about the data within the mail account as JSON object - which currently is a simple overall containsUnread flag that is true whenever there is an unseen message within any of the contained mail folders.

See the documentation for further details.

Configuration

SCR-1696

Summary: New Configuration Property 'com.openexchange.mail.filter.options.vacation.minimumInterval.seconds'

A new property com.openexchange.mail.filter.options.vacation.minimumInterval.seconds has been introduced to allow configuring the minimum interval for seconds-based vacation Sieve rules.

When set to -1 (default), the use of seconds-based vacation rules is disabled. Any positive value defines the minimum number of seconds that must elapse between automated vacation responses sent to the same sender.

This property only takes effect if the IMAP server advertises the vacation-seconds capability.

See the [property documentation](https://documentation.open-xchange.com/components/middleware/config/8/#mode=search&term=com.openexchange.mail.filter.secondary.) for further details.

8.49.91

3rd Party Libraries/License Change

SCR-1689

Summary: Updated Netty libraries from v4.1.130 to v4.1.132

Updated Netty libraries from v4.1.130 to v4.1.131 in bundle io.netty

• netty-buffer-4.1.132.Final.jar
• netty-codec-4.1.132.Final.jar
• netty-codec-dns-4.1.132.Final.jar
• netty-codec-http2-4.1.132.Final.jar
• netty-codec-http-4.1.132.Final.jar
• netty-codec-socks-4.1.132.Final.jar
• netty-common-4.1.132.Final.jar
• netty-handler-4.1.132.Final.jar
• netty-handler-proxy-4.1.132.Final.jar
• netty-resolver-4.1.132.Final.jar
• netty-resolver-dns-4.1.132.Final.jar
• netty-transport-4.1.132.Final.jar
• netty-transport-native-unix-common-4.1.132.Final.jar
• netty-transport-classes-epoll-4.1.132.Final.jar
• netty-transport-native-epoll-4.1.132.Final.jar
• netty-transport-classes-kqueue-4.1.132.Final.jar
• netty-transport-native-kqueue-4.1.132.Final.jar
• netty-tcnative-classes-2.0.72.Final

API - Java

SCR-1681

Summary: Added DAVX5 constant to BuiltInProvider enum and deprecated SYNC_APP

Extended enum com.openexchange.client.onboarding.BuiltInProvider with a new constant DAVX5("davx5") for the DAVx5 Select onboarding provider. The existing SYNC_APP("syncapp") constant has been deprecated in favor of DAVX5.

API - REST

SCR-1680

Summary: Introduced new REST endpoint for DAVx5 Select configuration

A new REST endpoint is introduced to serve DAVx5 Select configuration JSON:

GET /davx5/v1/config/{token}

The endpoint supports two modes:

Initial setup (no Authorization header): Redeems a one-time token, creates an app-specific password scoped to CalDAV/CardDAV, and returns the full configuration including DAV URLs, credentials, and UI customization. The user identity is derived from the session reservation bound to the token.

Response:
{
  "baseRoot": "https://dav.example.org/dav/",
  "caldavRoot": "https://dav.example.org/caldav/",
  "carddavRoot": "https://dav.example.org/carddav/",
  "basicAuth": {
    "username": "peter@example.org",
    "password": "app-specific-password-here"
  },
  "customization": {
    "productName": "Example Mail",
    "description": "Sync service brought to you by Example Corp",
    "logoImage": "data:image/png;base64,iVBOR...",
    "headerImage": "https://example.com/header.png"
  },
  "supportInfos": {
    "linkDestination": "https://example.com/support",
    "linkTitle": "Contact Support",
    "description": "In case of any problem, please visit our support page."
  }
}

Authenticated re-query (Basic Auth header): Returns customization-only JSON with Cache-Control and ETag headers for efficient polling. The user identity is derived from the validated credentials. The token path segment is ignored in this mode.

Error responses: 401 (invalid credentials), 403 (token invalid/expired/used), 429 (rate limit exceeded), 500 (internal error), 503 (auth service unavailable).

Behavioral Changes

SCR-1682

Summary: Replaced Sync App with DAVx5 Select in Android onboarding scenarios

The former syncappinstall onboarding scenario for Android devices has been replaced by two new scenarios:

• davx5install — A link to the DAVx5 Select app on the Google Play Store.
• davx5setup — A one-time configuration link using the davx5://setup?config=<url> URI scheme that the DAVx5 Select app handles to automatically provision DAV URLs, an app-specific password, and optional UI customization.

The default values for the following properties have changed:

• {}com.openexchange.client.onboarding.enabledScenarios: syncappinstall replaced by * davx5install, davx5setup

• {}com.openexchange.client.onboarding.android.phone.scenarios: syncappinstall replaced by davx5install, davx5setup

• {}com.openexchange.client.onboarding.android.tablet.scenarios: syncappinstall replaced by davx5install, davx5setup

A new davx5 capability is declared and awarded when both davx5install and davx5setup onboarding scenarios are enabled for a user.

CLT

SCR-1691

Summary: Added command-line tools for mail signatures

Added the following command-line tools for mail signatures

usage: listsignatures -c <contextId> -u <userId> -A <masterAdmin | contextAdmin> -P <masterAdminPassword |
                      contextAdminPassword> [-p <RMI-Port>] [-s <RMI-Server] [--responsetimeout <responseTimeout>] |
                      [-h]
 -A,--adminuser <adminUser>       Admin username
 -c,--context <contextId>         The context identifier
 -h,--help                        Prints this help text
 -p,--port <rmiPort>              The optional RMI port (default:1099)
 -P,--adminpass <adminPassword>   Admin password
    --responsetimeout <timeout>   The optional response timeout in seconds when reading data from server (default: 0s;
                                  infinite)
 -s,--server <rmiHost>            The optional RMI server (default: localhost)
 -u,--user <userId>               The user identifier


Command-line tool for listing signatures of a certain user.

usage: deletesignature -c <contextId> -u <userId> -s <signatureId> -A <masterAdmin | contextAdmin> -P
                       <masterAdminPassword | contextAdminPassword> [-p <RMI-Port>] [-s <RMI-Server] [--responsetimeout
                       <responseTimeout>] | [-h]
 -A,--adminuser <adminUser>       Admin username
 -c,--context <contextId>         The context identifier
 -h,--help                        Prints this help text
 -i,--identifier <signatureId>    The signature identifier
 -p,--port <rmiPort>              The optional RMI port (default:1099)
 -P,--adminpass <adminPassword>   Admin password
    --responsetimeout <timeout>   The optional response timeout in seconds when reading data from server (default: 0s;
                                  infinite)
 -s,--server <rmiHost>            The optional RMI server (default: localhost)
 -u,--user <userId>               The user identifier


Command line tool to delete a certain signatures of a user.

Configuration

SCR-1693

Summary: New Configuration Property 'com.openexchange.saml.validationClockSkew'

In order to configure a clock screw tolerance when validating assertions in SAML responses, the new lean configuration property com.openexchange.saml.validationClockSkew is introduced. It allows to configure a grace timespan in milliseconds which is considered when checking the NotOnOrAfter and NotBefore attributes for validity. It defaults to 0, and is neither reloadable, nor config-cascade-aware.

See the property documentation for further details.

SCR-1687

Summary: Renamed DAVx5 Select configuration properties

All DAVx5 Select configuration properties have been moved from the com.openexchange.davx5.\* prefix to com.openexchange.client.onboarding.davx5.\* as part of merging the com.openexchange.davx5.rest bundle into {}com.openexchange.client.onboarding.davx5. The three URL properties were additionally renamed for consistency with the existing onboarding naming convention. ||Old property||New property|| |com.openexchange.davx5.baseRoot|com.openexchange.client.onboarding.davx5.base.url| |com.openexchange.davx5.caldavRoot|com.openexchange.client.onboarding.davx5.caldav.url| |com.openexchange.davx5.carddavRoot|com.openexchange.client.onboarding.davx5.carddav.url| |com.openexchange.davx5.appPasswordType|com.openexchange.client.onboarding.davx5.appPasswordType| |com.openexchange.davx5.appPasswordName|com.openexchange.client.onboarding.davx5.appPasswordName| |com.openexchange.davx5.rateLimit.maxPerMinute|com.openexchange.client.onboarding.davx5.rateLimit.maxPerMinute| |com.openexchange.davx5.customization.productName|com.openexchange.client.onboarding.davx5.customization.productName| |com.openexchange.davx5.customization.description|com.openexchange.client.onboarding.davx5.customization.description| |com.openexchange.davx5.customization.logoImage|com.openexchange.client.onboarding.davx5.customization.logoImage| |com.openexchange.davx5.customization.headerImage|com.openexchange.client.onboarding.davx5.customization.headerImage| |com.openexchange.davx5.support.linkDestination|com.openexchange.client.onboarding.davx5.support.linkDestination| |com.openexchange.davx5.support.linkTitle|com.openexchange.client.onboarding.davx5.support.linkTitle| |com.openexchange.davx5.support.description|com.openexchange.client.onboarding.davx5.support.description|

The new URL properties ({}base.url, {}caldav.url, {}carddav.url) now fall back to the shared onboarding properties com.openexchange.client.onboarding.caldav.url and com.openexchange.client.onboarding.carddav.url when left empty, so deployments that already have CalDAV/CardDAV onboarding URLs configured may not need to set the DAVx5-specific URL properties at all.

SCR-1683

Summary: Added configuration properties for DAVx5 Select integration

Added the following new lean configuration properties:

DAV URL configuration (config-cascade aware):

• com.openexchange.davx5.baseRoot DAV base URL. Default: empty.

• com.openexchange.davx5.caldavRoot CalDAV root URL. Default: empty.

• com.openexchange.davx5.carddavRoot CardDAV root URL. Default: empty.

App password settings (config-cascade aware):

• com.openexchange.davx5.appPasswordType App password type. Must match an entry in app-password-apps.yml. Default: "calcarddav".

• com.openexchange.davx5.appPasswordName Display name for the app password. Default: "DAVx5 Select".

UI customization (config-cascade aware):

• com.openexchange.davx5.customization.productName Product name shown in DAVx5 Select. Default: "OX App Suite".

• com.openexchange.davx5.customization.description Product description. Default: "Sync your calendars and contacts".

• com.openexchange.davx5.customization.logoImage Logo image as data URI or HTTPS URL. Default: empty.

• com.openexchange.davx5.customization.headerImage Header/banner image as data URI or HTTPS URL. Default: empty.

Support information (config-cascade aware):

• com.openexchange.davx5.support.linkDestination Support link URL. Default: empty.

• com.openexchange.davx5.support.linkTitle Support link title. Default: empty.

• com.openexchange.davx5.support.description Support description. Default: empty.

Rate limiting (not config-cascade aware):

• com.openexchange.davx5.rateLimit.maxPerMinute Maximum requests per IP per minute for the configuration endpoint. Set to 0 to disable. Default: 10. Onboarding (config-cascade aware):

• com.openexchange.client.onboarding.davx5.tokenTimeoutSeconds Token timeout in seconds for the one-time configuration link. Default: 30.

Packaging/Bundles

SCR-1679

Summary: Removed Sync App onboarding bundle

Removed the former Sync App onboarding activator ({}SyncAppOnboardingActivator) and its configuration file client-onboarding-syncapp.properties from the com.openexchange.client.onboarding bundle.

The Sync App onboarding provider has been replaced by the DAVx5 Select onboarding provider

SCR-1678

Summary: Added new bundle com.openexchange.davx5.rest for DAVx5 Select integration

Added new bundle com.openexchange.davx5.rest to the open-xchange-dav package.

This bundle provides a JAX-RS REST endpoint for serving DAVx5 Select configuration JSON to Android devices during CalDAV/CardDAV onboarding.

8.48.66

3rd Party Libraries/License Change

SCR-1685

Summary: Updated & enhanced TwelveMonkeys ImageIO readers/writers

Updated & enhanced TwelveMonkeys ImageIO readers/writers

• Updated common-image-3.8.3.jar to common-image-3.13.1.jar
• Updated common-io--3.8.3.jar to common-io-3.13.1.jar
• Updated common-lang-3.8.3.jar to common-lang-3.13.1.jar
• Updated imageio-bmp-3.8.3.jar to imageio-bmp-3.13.1.jar
• Updated imageio-clippath-3.8.3.jar to imageio-clippath-3.13.1.jar
• Updated imageio-core-3.8.3.jar to imageio-core-3.13.1.jar
• Added imageio-dds-3.13.1.jar
• Updated imageio-hdr-3.8.3.jar to imageio-hdr-3.13.1.jar
• Updated imageio-icns-3.8.3.jar to imageio-icns-3.13.1.jar
• Updated imageio-iff-3.8.3.jar to imageio-iff-3.13.1.jar
• Updated imageio-jpeg-3.8.3.jar to imageio-jpeg-3.13.1.jar
• Updated imageio-metadata-3.8.3.jar to imageio-metadata-3.13.1.jar
• Updated imageio-pcx-3.8.3.jar to imageio-pcx-3.13.1.jar
• Updated imageio-pict-3.8.3.jar to imageio-pict-3.13.1.jar
• Updated imageio-pnm-3.8.3.jar to imageio-pnm-3.13.1.jar
• Updated imageio-psd-3.8.3.jar to imageio-psd-3.13.1.jar
• Updated imageio-sgi-3.8.3.jar to imageio-sgi-3.13.1.jar
• Updated imageio-tga-3.8.3.jar to imageio-tga-3.13.1.jar
• Updated imageio-thumbsdb-3.8.3.jar to imageio-thumbsdb-3.13.1.jar
• Updated imageio-tiff-3.8.3.jar to imageio-tiff-3.13.1.jar
• Added imageio-webp-3.13.1.jar
• Added imageio-xwd-3.13.1.jar

Configuration

SCR-1677

Summary: Added Helm chart support for PodDisruptionBudget

The core-mw Helm chart now supports the creation of a PodDisruptionBudget (PDB) per node type. A PDB limits the number of pods that can be voluntarily disrupted at any given time (e.g. during node drains or rolling updates), helping to maintain application availability.

The feature is disabled by default and can be enabled per type or globally via the pdb values section. Either pdb.minAvailable or pdb.maxUnavailable must be set when enabled.

Example configuration:

pdb:
  create: true
  minAvailable: 1

For more information, refer to the chart documentation.

SCR-1664

Summary: New Properties for Shared Accounts Configuration

For the new Shared Accounts feature, several lean configuration properties are introduced:

• com.openexchange.sharedaccount.enabled
• com.openexchange.sharedaccount.mail.defaultCapabilities
• com.openexchange.sharedaccount.calendar.defaultCapabilities
• com.openexchange.sharedaccount.mail.defaultPermissionSet
• com.openexchange.sharedaccount.calendar.defaultPermissionSet
• com.openexchange.sharedaccount.calendar.sentByPreference

See the property documentation, as well as the feature documentation for further details.

Database

SCR-1669

Summary: Update Tasks for Shared Account Tables

For the new Shared Accounts feature, new database tables sharedaccount_permissions and sharedaccount_usersettings are introduced through the blocking update tasks com.openexchange.sharedaccount.storage.rdb.groupware.SharedAccountStorageCreateTableTask.

The update- / create table task is located within package open-xchange-sharedaccount. See the feature documentation for further details.

SCR-1670

Summary: Update Task to add "type" column for Tables "user" and "del_user"

In order to differentiate between stored user records, the new column type is inserted for tables user and del_user through update task com.openexchange.groupware.update.tasks.UserAddTypeTask.

CLT

SCR-1668

Summary: New Commandline Utilities for Shared Accounts

To provision shared accounts and -permissions, new commandline utilities are introduced.

• createsharedaccount
• listsharedaccount
• updatesharedaccount
• deletesharedaccount
• createsharedaccountpermissions
• listsharedaccountpermissions
• deletesharedaccountpermissions

See the feature documentation as well as the commandline tool reference for further details and synopsis.

API - SOAP

SCR-1667

Summary: New SOAP Service for Shared Accounts

To provision shared accounts and -permissions, the new SOAP API "http://soap.admin.openexchange.com/OXSharedAccountService" is introduced, offering methods:

• change() - Changes shared account data within the given context.
• create() - Creates a new shared account within the given context.
• delete() - Deletes specified shared account(s) from given context.
• list() - Retrieve all shared accounts for a given context.
• listCaseInsensitive() - Retrieve all shared accounts for a given context.
• getData() - Retrieve user objects for a range of shared accounts by username or id.
• createSharedAccountPermissions() - Creates shared account permissions for a list of users and/or groups.
• deleteSharedAccountPermissions() - Deletes specified shared account(s) from given context.
• listSharedAccountPermissions() - Get all shared account permissions for the specified user.
• listSharedAccountPermissionsForSharedAccount() - Get all shared account permissions for the specified shared account.

See the feature documentation for further details and example requests.

Packaging/Bundles

SCR-1666

Summary: New Package 'open-xchange-sharedaccount'

For the new Shared Accounts feature, the package open-xchange-sharedaccount is introduced.

See the feature documentation for further details.

API - HTTP-API

SCR-1665

Summary: New Module 'sharedaccount' in HTTP API

To access the available shared accounts of a user, the HTTP API is extended by new module sharedaccount.

See the API documentation for further details, including all new endpoints.

SCR-1671

Summary: New Parameter 'sentBy' in Actions of Module 'chronos/itip' Module of HTTP API

All modifying actions of module chronos/itip are extended by a new, optional parameter sentBy.

This can be used to explicitly specify the calendar user that is acting on behalf of the calendar user for the scope of the current calendar operation. If set, it'll be picked up as originator for generated notification and scheduling mails (through MIME header Sender), and for the SENT-BY parameter in ORGANIZER or ATTENDEE properties within generated iTIP data.

If not set, the on behalf relationship is implicitly determined based on the actual folder view.

The value can either be supplied using the numerical user identifier, or by the calendar user address URI.

See the [API documentation)[https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Chronos] for further details.

8.47.52

General

SCR-1656

Summary: Updated Apache Commons CLI library from v1.9.0 to v1.11.0

Updated Apache Commons CLI library from v1.9.0 to v1.11.0 in target platform (com.openexchange.bundles)

SCR-1650

Summary: Updated Jackson libraries from v2.19.2 to v2.21.0 in target platform

Updated Jackson libraries from v2.19.2 to v2.21.0 in `}com.openexchange.bundles}

• jackson-annotations v2.19.2 to v2.21.0
• jackson-core v2.19.2 to v2.21.0
• jackson-databind v2.19.2 to v2.21.0
• jackson-dataformat-cbor v2.19.2 to v2.21.0
• jackson-dataformat-xml v2.19.2 to v2.21.0
• jackson-dataformat-yaml v2.19.2 to v2.21.0
• jackson-datatype-jsr310 v2.19.2 to v2.21.0
• jackson-datatype-jsr353 v2.19.2 to v2.21.0
• jackson-jakarta-rs-base v2.19.2 to v2.21.0
• jackson-jakarta-rs-json-provider v2.19.2 to v2.21.0
• jackson-jakarta-rs-xml-provider v2.19.2 to v2.21.0
• jackson-module-jakarta-xmlbind-annotations v2.19.2 to v2.21.0
• jackson-module-jaxb-annotations v2.19.2 to v2.21.0

3rd Party Libraries/License Change

SCR-1657

Summary: Updated Apache Commons Collections4 library from v4.4 to v4.5.0

Updated Apache Commons Collections4 library from v4.4 to v4.5.0 in target platform (com.openexchange.bundles)

SCR-1655

Summary: Update Apache Commons Codec

Updated Apache Commons Codec from v.1.17.2 to v1.21.0 in target platform (com.openexchange.bundles)

SCR-1654

Summary: Updated Apache Mime4j

Updated Apache Mime4j libraries in target platform (com.openexchange.bundles)

• apache-mime4j-core-0.8.10.jar -> apache-mime4j-core-0.8.13.jar
• apache-mime4j-dom-0.8.10jar -> apache-mime4j-dom-0.8.13.jar
• apache-mime4j-storage-0.8.10.jar -> apache-mime4j-storage-0.8.13.jar

SCR-1653

Summary: Upgraded JSoup library

Upgraded JSoup library from v1.21.1 to v1.22.1 in target platform (com.openexchange.bundles)

SCR-1652

Summary: Updated OSGi target platform bundles

Updated the following OSGi target platform bundles

• org.eclipse.osgi_3.23.200.v20250812-1847.jar updated to org.eclipse.osgi_3.24.0.v20251126-0427.jar

SCR-1649

Summary: Updated Fabric8 libraries from v7.4.0 to v7.5.2

Updated Fabric8 ibraries from v7.4.0 to v7.5.2 in bundle io.fabric8.kubernetes

• kubernetes-client-7.5.2.jar
• kubernetes-client-api-7.5.2.jar
• kubernetes-httpclient-jdk-7.5.2.jar
• kubernetes-model-admissionregistration-7.5.2.jar
• kubernetes-model-apiextensions-7.5.2.jar
• kubernetes-model-apps-7.5.2.jar
• kubernetes-model-autoscaling-7.5.2.jar
• kubernetes-model-batch-7.5.2.jar
• kubernetes-model-certificates-7.5.2.jar
• kubernetes-model-common-7.5.2.jar
• kubernetes-model-coordination-7.5.2.jar
• kubernetes-model-core-7.5.2.jar
• kubernetes-model-discovery-7.5.2.jar
• kubernetes-model-events-7.5.2.jar
• kubernetes-model-extensions-7.5.2.jar
• kubernetes-model-flowcontrol-7.5.2.jar
• kubernetes-model-gatewayapi-7.5.2.jar
• kubernetes-model-metrics-7.5.2.jar
• kubernetes-model-networking-7.5.2.jar
• kubernetes-model-node-7.5.2.jar
• kubernetes-model-policy-7.5.2.jar
• kubernetes-model-rbac-7.5.2.jar
• kubernetes-model-resource-7.5.2.jar
• kubernetes-model-scheduling-7.5.2.jar
• kubernetes-model-storageclass-7.5.2.jar
• zjsonpatch-7.5.2.jar

SCR-1648

Summary: Updated lettuce library from v6.5.5 to v6.8.2

Updated lettuce library from v6.5.5 to v6.8.2 in bundle io.lettuce

• lettuce-core-6.8.2.RELEASE.jar

SCR-1647

Summary: Updated Netty libraries

Updated Netty libraries from v4.1.124 to v4.1.130 in bundle io.netty

• netty-buffer-4.1.130.Final.jar
• netty-codec-4.1.130.Final.jar
• netty-codec-dns-4.1.130.Final.jar
• netty-codec-http2-4.1.130.Final.jar
• netty-codec-http-4.1.130.Final.jar
• netty-codec-socks-4.1.130.Final.jar
• netty-common-4.1.130.Final.jar
• netty-handler-4.1.130.Final.jar
• netty-handler-proxy-4.1.130.Final.jar
• netty-resolver-4.1.130.Final.jar
• netty-resolver-dns-4.1.130.Final.jar
• netty-transport-4.1.130.Final.jar
• netty-transport-native-unix-common-4.1.130.Final.jar
• netty-transport-classes-epoll-4.1.130.Final.jar
• netty-transport-native-epoll-4.1.130.Final.jar
• netty-transport-classes-kqueue-4.1.130.Final.jar
• netty-transport-native-kqueue-4.1.130.Final.jar
• netty-tcnative-classes-2.0.72.Final

SCR-1646

Summary: Updated OpenId Connect libraries

Updated OpenId Connect libraries in bundle com.nimbus:

• accessors-smart-2.4.11.jar updated to accessors-smart-2.5.2.jar
• asm-9.1.jar updated to asm-9.7.1.jar
• content-type-2.2.jar updated to content-type-2.3.jar
• json-smart-2.4.11.jar updated to json-smart-2.5.2.jar
• nimbus-jose-jwt-10.0.2.jar updated to nimbus-jose-jwt-10.6.jar
• oauth2-oidc-sdk-10.7.jar updated to oauth2-oidc-sdk-11.32.jar

SCR-1641

Summary: Added RE2/J - linear time regular expression matching in Java

Added Google Open Source library RE2/J "re2j-1.8.jar" as bundle to target platform "com.openexchange.bundles". RE2 is a regular expression engine that runs in time linear in the size of the input.

SCR-1638

Summary: Updated Spring Framework libraries

Updated Spring Framework libraries from v5.3.39 to v6.2.15 in bundle com.openexchange.xml

• com.openexchange.xml/lib/spring-beans-5.3.39.jar -> com.openexchange.xml/lib/spring-beans-6.2.15.jar
• com.openexchange.xml/lib/spring-core-5.3.39.jar -> com.openexchange.xml/lib/spring-core-6.2.15.jar
• com.openexchange.xml/lib/spring-jcl-5.3.39.jar -> com.openexchange.xml/lib/spring-jcl-6.2.15.jar

API - Java

SCR-1505

Summary: Added methods to the MultifactorLoginService

Extended the com.openexchange.login.multifactor.MultifactorLoginService interface by following methods:

    /**

     * Checks if multi-factor enforcement property is set and the enforceMfa flag is set for a given user.
     *
     * @param userId The user identifier
     * @param contextId The context identifier
     * @return <code>true<code> If multi-factor enforcement is enabled
     * @throws OXException
     */
    boolean checkEnforceMultiFactorAuthentication(int userId, int contextId)throws OXException;

    /**

     * Checks if multi-factor enforcement property is set for a given user.
     *
     * @param userId The user identifier
     * @param contextId The context identifier
     * @return <code>true<code> If multi-factor enforcement is enabled as dismissable; otherwise <code>false</code>
     * @throws OXException If something went wrong trying to access the database
     */
    boolean checkEnforceMultiFactorAuthenticationDismissable(int userId, int contextId);

    /**

     * Records the login attempt for a given user.
     *
     * @param userId The user identifier
     * @param contextId The context identifier
     * @throws OXException If something went wrong trying to access the database
     */
    void recordLoginAttempt(int id, int contextId) throws OXException;

    /**

     * Gets the login information record.
     *
     * @param userId The user identifier
     * @param contextId The context identifier
     * @return A MultifactorEnforcementInformation record holding the information
     * @throws OXException If something went wrong trying to access the database
     */
    MultifactorEnforcementInformation getLoginInformation(int id, int contextId) throws OXException;

    /**

     * Enhances JSON with multi-factor enforcement data.
     *
     * @param json The JSON content to enhance
     * @param userId The user identifier
     * @param contextId The context identifier
     */
    void enhanceLoginJson(JSONObject json, int userId, int contextId);

    /**

     * Resets the login information for an user.
     *
     * @param userId The user identifier
     * @param contextId The context identifier
     * @throws OXException If something went wrong trying to access the database
     */
    void resetLoginInformation(int userId, int contextId) throws OXException;

API - REST

SCR-1504

Summary: Introduced a new REST interface for multifactor enforcement

New REST endpoint is introduced in order to manage multifactor enforcement.

Retrieve login information for a certain user:

GET /admin/v1/contexts/\{context-id}/users/\{user-id}/multifactor/enforcement

Response:
{
  "enforceMfa": true,
  "loginCounter": 5,
  "firstLogin": "<time-stamp>"
}

Reset login information for a certain user:

DELETE /admin/v1/contexts/\{context-id}/users/\{user-id}/multifactor/enforcement

CLT

SCR-1503

Summary: Add CLT for multifactor enforcement

Command-line tool resetenforcemfa to allow a reset of the multi-factor enforcement informations

usage: resetenforcemfa -c <contextId> -i <userId> -A <masterAdmin | contextAdmin> -P <masterAdminPassword |
                       contextAdminPassword>
 -A,--adminuser <adminuser>       Admin username
    --api-host <arg>              URL for an alternative REST end-point host. Example: 'https://192.168.0.1:8443'.
                                  Default: 'http://localhost:8009'
    --api-root <arg>              URL to an alternative HTTP API endpoint. Example: 'https://192.168.0.1:8443/admin/v1/'
 -c,--contextid <arg>             A valid context identifier.
 -h,--help                        Prints this help text
 -i,--userid <arg>                A valid user identifier.
 -P,--adminpass <adminpassword>   Admin password


The command-line tool to reset the multifactor enforcement for an user.

Configuration

SCR-1645

Summary: Added various properties for proxy functionality

Added various lean properties for proxy functionality

• com.openexchange.proxy.path Specifies the path taken when replacing URIs and for registering proxy Servlet. Default value is "/servlet/proxy". It is reloadable, but not config-cascade aware.

• com.openexchange.proxy.servlet.enabled The switch to enable/disable Proxy Servlet. Default value is true. It is reloadable, but not config-cascade aware. If Proxy Servlet is enabled, com.openexchange.proxy.encoding is required being set to "object".

• com.openexchange.proxy.encoding The method how original URI and accompanying proxy registration is encoded. "plain": Only the original URI is base64-encoded. "object": The complete registration object is compressed and obfuscated within a base64 representation. Default value is "object". It is reloadable, but not config-cascade aware.

SCR-1501

Summary: Added new properties for MFA enforcement

Introduced new lean webauthn properties to use webauthn as a 2nd factor and as a preparation for webautn as a "full" authentication service * com.openexchange.multifactor.enabled Defines if MFA should be enforced.

• com.openexchange.multifactor.login_limit Configures the amount of login attempts a user can do before MFA is really enforced.

• com.openexchange.multifactor.period_limit Configures the period of time in days, starting from the first login, which defines when MFA is really enforced.

Database

SCR-1502

Summary: Add table for mfa enforcement

Update Task com.openexchange.multifactor.enforcement.storage.rdb.CreateMultifactorEnforcementTableTask

In order to implement the possibility to enforce multi-factor, a database table called multifactor_enforcement needs to be created to store the relevant informations.

CREATE TABLE `multifactor_enforcement`(
  `cid` int(10) unsigned NOT NULL,
  `id` int(10) unsigned NOT NULL,
  `enforceMfa` TINYINT(1) DEFAULT 0,
  `loginCounter` int(10) DEFAULT 0,
  `firstLogin` DATETIME DEFAULT NULL,
  PRIMARY KEY (`cid`, `id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci"

8.46.83

3rd Party Libraries/License Change

SCR-1637

Summary: Upgraded Apache Tika and Commons IO libraries

Updated Apache Tika library from v2.8.0 to v3.2.3 in bundle com.openexchange.tika.util, also updated Apache Commons IO library from v2.18.0 to v2.21.0 in bundle com.openexchange.bundles.

Behavioral Changes

SCR-1635

Summary: Changed Handling of TEL Preference in vCard Mapping

Up to now, the pref attribute has been used to indicate the first telephone number of the contact when writing to or reading from vCards, whenever an OX contact property has more than one telephone number of a certain type. In particular, this was considered for telephone_business1 / telephone_business2, telephone_home1 / telephone_home2 and cellular_telephone1 / cellular_telephone2.

For some clients, this handling led to ambiguities where an overall pref attribute is used to mark the preferred telephone number across all types.

Therefore, to not interfere with a client-defined preference, the mapping routine is adjusted so that the custom attribute x-1st will be used to differentiate between multiple candidates. See the documentation for further details.

8.45.48

General

SCR-1625

Summary: Updated Caffeine caching library and Google Guava

• Updated Caffeine caching library from v3.2.0 to v3.2.3 in bundle com.google.guava
• Updated Google Guava from v33.3.0 to v33.5.0 in bundle com.google.guava

3rd Party Libraries/License Change

SCR-1628

Summary: Updated several libraries

Updated several libraries in target platform and bundles

Target platform libraries (com.openexchange.bundles)

• jackson-annotations v2.19.0 to v2.19.2
• jackson-core v2.19.0 to v2.19.2
• jackson-databind v2.19.0 to v2.19.2
• jackson-dataformat-cbor v2.19.0 to v2.19.2
• jackson-dataformat-xml v2.19.0 to v2.19.2
• jackson-dataformat-yaml v2.19.0 to v2.19.2
• jackson-datatype-jsr310 v2.19.0 to v2.19.2
• jackson-datatype-jsr353 v2.19.0 to v2.19.2
• jackson-jakarta-rs-base v2.19.0 to v2.19.2
• jackson-jakarta-rs-json-provider v2.19.0 to v2.19.2
• jackson-jakarta-rs-xml-provider v2.19.0 to v2.19.2
• jackson-module-jakarta-xmlbind-annotations v2.19.0 to v2.19.2

• jackson-module-jaxb-annotations v2.19.0 to v2.19.2

• jcl-over-slf4j v2.0.16 to v2.0.17

• jul-to-slf4j v2.0.16 to v2.0.17

• log4j-over-slf4j v2.0.16 to v2.0.17

• logback-classic v1.5.16 to v1.5.21

• logback-core v1.5.16 to v1.5.21

• osgi-over-slf4j v2.0.16 to v2.0.17

• slf4j-api v2.0.16 to v2.0.17

Inlined libraries

com.ctc.wstx

• woodstox-core v7.1.0 to v7.1.1

io.fabric8.kubernetes

• kubernetes-client v6.13.4 to v7.4.0
• kubernetes-client-api v6.13.4 to v7.4.0
• kubernetes-httpclient-jdk v6.13.4 to v7.4.0
• kubernetes-model-admissionregistration v6.13.4 to v7.4.0
• kubernetes-model-apiextensions v6.13.4 to v7.4.0
• kubernetes-model-apps v6.13.4 to v7.4.0
• kubernetes-model-autoscaling v6.13.4 to v7.4.0
• kubernetes-model-batch v6.13.4 to v7.4.0
• kubernetes-model-certificates v6.13.4 to v7.4.0
• kubernetes-model-common v6.13.4 to v7.4.0
• kubernetes-model-coordination v6.13.4 to v7.4.0
• kubernetes-model-core v6.13.4 to v7.4.0
• kubernetes-model-discovery v6.13.4 to v7.4.0
• kubernetes-model-events v6.13.4 to v7.4.0
• kubernetes-model-extensions v6.13.4 to v7.4.0
• kubernetes-model-flowcontrol v6.13.4 to v7.4.0
• kubernetes-model-gatewayapi v6.13.4 to v7.4.0
• kubernetes-model-metrics v6.13.4 to v7.4.0
• kubernetes-model-networking v6.13.4 to v7.4.0
• kubernetes-model-node v6.13.4 to v7.4.0
• kubernetes-model-policy v6.13.4 to v7.4.0
• kubernetes-model-rbac v6.13.4 to v7.4.0
• kubernetes-model-resource v6.13.4 to v7.4.0
• kubernetes-model-scheduling v6.13.4 to v7.4.0
• kubernetes-model-storageclass v6.13.4 to v7.4.0
• snakeyaml-engine v2.7 to v2.10
• jsonpatch v0.3.0 to v7.4.0

SCR-1626

Summary: Added Eclipse Collections to target platform

Added Eclipse Collections to target platform (com.openexchange.bundles):

• eclipse-collections-api-13.0.0.jar
• eclipse-collections-13.0.0.jar

Eclipse Collections is a collections framework for Java with optimized data structures and a rich, functional and fluent API.

Behavioral Changes

SCR-1634

Summary: Changed Semantics for 'com.openexchange.carddav.addressbookMultigetLimit' and 'com.openexchange.caldav.calendarMultigetLimit'

For increased client compatibility, the semantics of the configuration properties com.openexchange.carddav.addressbookMultigetLimit and com.openexchange.caldav.calendarMultigetLimit are changed in way that the configured value now determines up to which number of elements a synchronous processing of the response is performed. If data from more elements was requested, the data will be outputted to the HTTP response chunk-wise, instead of filling up with HTTP/1.1 507 Insufficient Storage responses as before.

See the property documentation for further details.

Configuration

SCR-1627

Summary: Added possibility to specify max. days in future as limitation for the date to send of a scheduled mail

Added property com.openexchange.mail.scheduled.maxDaysInFuture to specify max. days in future as limitation for the date to send of a scheduled mail. That property specifies the max. number of days in future that is allowed for the date to send. A value of 0 (zero) or a negative value disables this limitation. Default value is 0. It is reloadable and config-cascade aware.

8.44.28

General

SCR-1613

Summary: Added new property specifying that server-associated capabilities should be cached on a per user basis

Added new lean property com.openexchange.imap.cache.serverCapabilitiesPerUser specifying that server-associated capabilities should be cached on a per user basis. This is useful for setups with some sort of IMAP proxy in front forwarding to heterogeneous IMAP back-ends. Default is false. It is reloadable as well as config-cascade aware.

API - SOAP

SCR-1619

Summary: New Element 'primaryAddress' in 'accountDataUpdate' for 'OXSecondaryAccountService'

In order to set a new primary email address for a secondary account, the accountDataUpdate element within the update SOAP body of OXSecondaryAccountService service port is extended with a new optional element primaryAddress.

While changing the address, the targeted account still needs to be supplied via parent element primaryAddress, afterwards, the secondary mail account is acceesible using the new primary address.

Example:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://soap.admin.openexchange.com" xmlns:xsd="http://dataobjects.soap.admin.openexchange.com/xsd" xmlns:xsd1="http://dataobjects.rmi.admin.openexchange.com/xsd">
   <soapenv:Header/>
   <soapenv:Body>
      <soap:update>
         <soap:primaryAddress>service@context1.ox.test</soap:primaryAddress>
         <soap:accountDataUpdate>
            <xsd:primaryAddress>service2@context1.ox.test</xsd:primaryAddress>
            <xsd:name>service2@context1.ox.test</xsd:name>
            <xsd:personal>Service 2 &lt;service2@context1.ox.test</xsd:personal>
            <xsd:login>service2@context1.ox.test</xsd:login>
         </soap:accountDataUpdate>
         [...]
      </soap:update>
   </soapenv:Body>
</soapenv:Envelope>

CLT

SCR-1620

Summary: New Option '--new-primary-address' for 'updatesecondaryaccount'

In order to set a new primary email address for a secondary account, the commandline utility updatesecondaryaccount is extended with a new optional argument --new-primary-address.

While changing the address, the targeted account still needs to be supplied via mandatory parameter primary-address, afterwards, the secondary mail account is accessible using the new primary address.

See the documentation for further details.

Configuration

SCR-1623

Summary: Added new property to specify preferred snippet service to use

Added new lean property "com.openexchange.snippet.preferredSnippetService" to specify preferred snippet service to use. Default value is empty (no preferred snippet service). It is reloadable and config-cascade aware.

Accepted values are:

• "database" for database-backed snippet service
• "filestore" for filestore-backed snippet service

SCR-1622

Summary: Added new property for read duration threshold

Added new lean property com.openexchange.mail.bodyPartReadThresholdMillis that specifies the threshold in milliseconds for the read duration of body parts from mail storage. If that threshold is exceeded a warn log message is generated. Default value is 3000 (3 seconds). It is reloadable, but not config-cascade aware. A value of less than/equal to 0 (zero) disables this threshold.

SCR-1621

Summary: New Property 'com.openexchange.calendar.allowChangeOfOrganizerWithExternals'

Changing the organizer in group-scheduled events is an out-of-band process that might not be compatible with iTIP clients. In order to allow changing the organizer for mettings with only context-internal participants, there's property com.openexchange.calendar.allowChangeOfOrganizer already available, which enables clients changing the organizer via HTTP API - however this only works if the new organizer and all attendees of the event are context-internal users.

Now to also allow this for events with external attendees, the new lean configuration property {}com.openexchange.calendar.allowChangeOfOrganizerWithExternals. It is reloadable and can be defined through the config-cascade. See the property documentation for further details.

SCR-1618

Summary: New Properties to Enable Custom Login Source for Drive Client Onboarding

In order to enable usage of a registered custom login source when preparing details for the driveappmanual and drivewindowsclientmanual onboarding scenarios, the following new lean configuration properties are introduced:

• com.openexchange.client.onboarding.drivewindowsclient.login.customsource
• com.openexchange.client.onboarding.driveapp.login.customsource

Both default to false, are reloadable and can be defined through the config cascade.

SCR-1617

Summary: New Scenarios for Manual Drive Client Onboarding Configuration

The available onboarding scenarios are extended with two new "manual" configuration options for the Drive App, with the following identifiers:

• driveappmanual
• drivewindowsclientmanual

Accompanying the corresponding link / installer scenarios, these new options can be enabled and configured within the scenario configuration file {}client-onboarding-scenarios.yml, and added to the respective enabled scenarios per platform in configuration file {}client-onboarding.properties.

See template file client-onboarding-scnearios-template.yml for further details.

8.43.52

3rd Party Libraries/License Change

SCR-1612

Summary: Updated Spring Framework libraries

Updated Spring Framework libraries from v5.3.32 to v5.3.39 in bundle com.openexchange.xml

• com.openexchange.xml/lib/spring-beans-5.3.32.jar -> com.openexchange.xml/lib/spring-beans-5.3.39.jar
• com.openexchange.xml/lib/spring-core-5.3.32.jar -> com.openexchange.xml/lib/spring-core-5.3.39.jar
• com.openexchange.xml/lib/spring-jcl-5.3.32.jar -> com.openexchange.xml/lib/spring-jcl-5.3.39.jar

SCR-1604

Summary: Updated OSGi target platform bundles

Updated the following OSGi target platform bundles

• org.eclipse.osgi_3.23.100.v20250514-1759.jar updated to org.eclipse.osgi_3.23.200.v20250812-1847.jar

Behavioral Changes

SCR-1610

Summary: Implicitly Delete Alarms when Declining a Task

Previously, when a participant in a task changed his conformation status to "declined", any previously stored personal reminders of this user for that task were persisted, but no longer exposed via API when requested in the range action.

Now, any previously stored personal reminders are purged directly when changing the user's confirmation status to "declined".

Configuration

SCR-1611

Summary: Added new option to enable round-robin on IP address selection

Added new lean property "com.openexchange.imap.useMultipleAddressesRoundRobin" to enable round-robin on IP address selection. Default is false. Reloadable and config-cascade aware.

Requires "com.openexchange.imap.useMultipleAddresses" to be set to true

SCR-1609

Summary: New Configuration Property 'com.openexchange.reminder.maxRemindersPerRequest'

To define the maximum number of reminders for tasks that are processed and returned to the client during the range action, the new the new lean configuration property com.openexchange.reminder.maxRemindersPerRequest is introduced. By default (value of {}-1), it remains unrestricted to not change semantics.

The property is reloadable and can be defined through the config-cascade. See the property documentation for further details.

SCR-1608

Summary: New Configuration Property 'com.openexchange.reminder.reminderLookbackDays'

In order to configure the maximum number of days how far reminders for tasks are fetched within the range action, the new lean configuration property com.openexchange.reminder.reminderLookbackDays is introduced. By default (value of -1), it remains unrestricted to not change semantics.

The property is reloadable and can be defined through the config-cascade. See the property documentation for further details.

SCR-1607

Summary: New property 'com.openexchange.calendar.lookupPeerAttendeesEnabled'

By default, the server tries to lookup data from the same event of other attendee copies automatically, so that a changed participation status becomes directly visible for other users without waiting for an updated iTIP message of the organizer. In order to disable this implicit peer attendee lookup, the new lean configuration property com.openexchange.calendar.lookupPeerAttendeesEnabled is introduced. It defaults to true, is reloadable, and can be configured through the config-cascade.

See also the documentation for further details.

SCR-1606

Summary: New property 'com.openexchange.caldav.calendarMultigetLimit'

The new lean configuration property com.openexchange.caldav.calendarMultigetLimit is introduced which allows to configure the maximum number of elements included in CAL:calendar-multiget responses to the client. If data from more elements was requested, HTTP/1.1 507 Insufficient Storage responses will get inserted.

A value of -1 disables the limit. It defaults to 1000, is reloadable and can be defined through the config-cascade.

SCR-1605

Summary: New property 'com.openexchange.calendar.maxAttendeesPerConflictCheck'

In order to prevent exhausting conflict checks while creating events with a huge number of attendees, the new lean configuration property com.openexchange.calendar.maxAttendeesPerConflictCheck is introduced. It defaults to 50, is reloadable and can be defined through the config-cascade.

SCR-1603

Summary: New Configurartion Properties for 'movecontextdatabase'

To tweak the behavior of the movecontextdatabase utility, especially when dealing with large amounts of data being transferred, the following lean configuration properties are introduced:

• com.openexchange.admin.context.move.intermediateCommits = false: Controls whether to perform intermediate database COMMITs after each batch during the context move operation.
• com.openexchange.admin.context.move.selectBatchSize = 250000: The maximum number of rows to select per batch from the source database tables. A value of -1 disables processing in batches while reading.
• com.openexchange.admin.context.move.insertBatchSize = 50000: The maximum number of rows to insert per batch into the destination database tables. A value of -1 disables processing in batches while writing.
• com.openexchange.admin.context.move.deleteBatchSize = 50000: The maximum number of rows to delete per batch from the source database tables after the data was copied, or when undoing the operation. A value of -1 disables processing in batches while deleting.

All properties are reloadable, and can be defined through the config-cascade up to context scope. See also the property documentation for further details.

SCR-1599

Summary: Rename Property "com.openexchange.mail.proxyExternalImagerUrls"

To avoid confusions, the name of the lean property com.openexchange.mail.proxyExternalImagerUrls is adjusted to com.openexchange.mail.proxyExternalImageUrls.

See the property documentation for further details.

8.42.48

3rd Party Libraries/License Change

SCR-1598

Summary: Updated UnboundID LDAP SDK from v5.1.4 to v7.0.3

Updated UnboundID LDAP SDK from v5.1.4 to v7.0.3 in bundle com.openexchange.ldap.common

SCR-1597

Summary: Updated Netty libraries from v4.1.121 to v4.1.124 in bundle io.netty

Updated Netty libraries from v4.1.121 to v4.1.124 in bundle io.netty

• netty-buffer-4.1.124.Final.jar
• netty-codec-4.1.124.Final.jar
• netty-codec-dns-4.1.124.Final.jar
• netty-codec-http2-4.1.124.Final.jar
• netty-codec-http-4.1.124.Final.jar
• netty-codec-socks-4.1.124.Final.jar
• netty-common-4.1.124.Final.jar
• netty-handler-4.1.124.Final.jar
• netty-handler-proxy-4.1.124.Final.jar
• netty-resolver-4.1.124.Final.jar
• netty-resolver-dns-4.1.124.Final.jar
• netty-transport-4.1.124.Final.jar
• netty-transport-native-unix-common-4.1.124.Final.jar
• netty-transport-classes-epoll-4.1.124.Final.jar
• netty-transport-native-epoll-4.1.124.Final.jar
• netty-transport-classes-kqueue-4.1.124.Final.jar
• netty-transport-native-kqueue-4.1.124.Final.jar
• netty-tcnative-classes-2.0.72.Final

SCR-1596

Summary: Updated Bouncy Castle libraries from v1.78.1 to v1.79

Bouncy Castle Libraries have been updated to v1.79

• bcmail-jdk18on-1.79.jar
• bcpg-jkd180n-1.79.jar
• pcpkix-jkd180n-1.79.jar
• bcprov-jkd180n-1.79.jar
• bcutil-jkd180n-1.79.jar

SCR-1593

Summary: Update Nimbus JOSE+JWT

Update Nimbus JOSE+JWT from v9.41.2 to v10.0.2 in bundle com.nimbus

SCR-1592

Summary: Update Apache CXF

Update Apache CXF libraries from v3.5.10 to v.3.5.11 in bundle com.openexchange.soap.common

SCR-1591

Summary: Update Apache Commons Lang

Update Apache Commons Lang from v3.14.0 to v3.18.0 in target platform (com.openexchange.bundles)

SCR-1590

Summary: Update Apache Commons FileUpload

Update Apache Commons FileUpload from v1.5 to v1.6.0 in target platform (com.openexchange.bundles)

SCR-1589

Summary: Update Apache Commons BeanUtils

Update Apache Commons BeanUtils from v1.9.4 to v1.11.0 in target platform (com.openexchange.bundles)

Configuration

SCR-1594

Summary: New Configuration Property 'com.openexchange.admin.user.convertguest.default'

To configure a default handling for the convertguest flag unless specified explicitly in the create user operation, the new lean configuration property com.openexchange.admin.user.convertguest.default is introduced.

If true, an existing guest user with the same primary email address is converted implicitly, if false (default), a conflict is raised.

Can be defined through the config-cascade up to the 'context' scope.

SCR-1588

Summary: Changed limitations for images in snippets (signatures)

• The new default value for existing "com.openexchange.mail.signature.maxImageSize" property is now set to 0 (zero). Thus effectively disabled per default.

• The new default value for existing "com.openexchange.mail.signature.maxImageLimit" property is now set to 0 (zero). Thus effectively disabled per default.

• Introduced new property "com.openexchange.mail.signature.maxTotalImageSize" having its default value set to 5 (5MB). It is reloadable and config-cascade aware.

Database

SCR-1595

Summary: Drop unused table "jsonCache"

Update Task com.openexchange.groupware.update.tasks.DropJsonCacheTableTask

Drop unused table "jsonCache" as well as referenced entries in "updatetask" table:

• "com.openexchange.json.cache.impl.osgi.JsonCacheEnsureLatin1AsDefault"
• "com.openexchange.json.cache.impl.osgi.JsonCacheAddOtherFieldsTask"
• "com.openexchange.json.cache.impl.osgi.JsonCacheMediumTextTask"
• "com.openexchange.json.cache.impl.osgi.JsonCacheAddInProgressFieldTask"
• "com.openexchange.json.cache.impl.osgi.JsonCacheCreateTableTask"

8.41.52

3rd Party Libraries/License Change

SCR-1582

Summary: Upgraded JSoup library

Upgraded JSoup library from v1.19.1 to v1.21.1 in target platform (com.openexchange.bundles)

SCR-1581

Summary: Updated bucket4j library

Updated bucket4j library (Java rate-limiting library based on token-bucket algorithm) from v8.7.0 to v8.10.1 in bundle com.openexchange.common

API - HTTP-API

SCR-1586

Summary: New Parameter 'user' for Action 'resolve' in Module 'chronos'

The resolve action in module chronos of the HTTP API is extended by the new optional parameter user, through which the identifier of the calendar user can be specified.

If an event is found, it'll be returned under the perspective of this user, i.e. having an appropriate parent folder identifier assigned. The current session user still needs to have appropriate access rights for the resolved event, though.

See the documentation for further details.

Behavioral Changes

SCR-1585

Summary: User copy improvements

The user copy feature got improved:

• App passwords
• Contact accounts
• (Secondary) mail accounts
• (Generic) use count
• Snippets

will now also be copied.

https://gitlab.open-xchange.com/appsuite/platform/core/-/issues/265

Configuration

SCR-1588

Summary: Changed limitations for images in snippets (signatures)

• The new default value for existing "com.openexchange.mail.signature.maxImageSize" property is now set to 0 (zero). Thus effectively disabled per default.

• The new default value for existing "com.openexchange.mail.signature.maxImageLimit" property is now set to 0 (zero). Thus effectively disabled per default.

• Introduced new property "com.openexchange.mail.signature.maxTotalImageSize" having its default value set to 5 (5MB). It is reloadable and config-cascade aware.

SCR-1584

Summary: New Property 'com.openexchange.calendar.includeCreatorInFreeBusy'

To control whether the entity that originally created a conflicting event is included in free/busy results, even if event details cannot be accessed by the requesting user, the lean configuration property com.openexchange.calendar.includeCreatorInFreeBusy is introduced. Possible values are:

• never - Never expose the created by information in foreign events of free/busy results.
• resources-only - Include the created by information in foreign events of free/busy results of resource attendees, only.
• always - Always expose the created by information in foreign events of free/busy results.

It defaults to always for backwards compatibility, is reloadable, and can be defined through the config-cascade.

Although there has already been a similar switch for App Suite UI io.ox/calendar//freeBusyStrict to show/hide these details from foreign events, this middleware property controls the exposure of the "created by" information at API level, so should be used in favor of the UI setting.

8.40.56

3rd Party Libraries/License Change

SCR-1577

Summary: Updated OSGi target platform bundles

Updated the following OSGi target platform bundles

• org.eclipse.osgi.util_3.7.300.v20231104-1118.jar updated to org.eclipse.osgi.util_3.7.400.v20250516-0916.jar
• org.eclipse.osgi_3.20.0.v20240509-1421.jar updated to org.eclipse.osgi_3.23.100.v20250514-1759.jar

Configuration

SCR-1576

Summary: New properties to control number of tombstone records

In order to control how many tombstone records are persisted per calendar account, the following new lean configuration properties are introduced, each applicable for the corresponding calendar provider and defaulting to a value of 2500 unless overridden:

com.openexchange.calendar.ical.maxEventTombstones = 2500

com.openexchange.calendar.google.maxEventTombstones = 2500

A value of -1 disables the limit. Both properties are reloadable and config-cascade aware.

See the property documentation for further details.

8.39.64

API - HTTP-API

SCR-1573

Summary: New option 'identifiers' for 'folders?action=notify'

In order to support arbitrary permissions beyond context-internal entities, the notify action in module folders is extended by the possibility to reference the targeted recipients also by their identifier, as used in the corresponding permissions.

Therefore, the request body accepts an additional string array named identifiers, where the identifiers of the users or groups that shall be notified can be specified.

See the HTTP API documentation for further details.

SCR-1571

Summary: Exposed parameter 'trackAttendeeUsage' for 'chronos?action=new' and 'chronos?action=update'

The new and update actions in module chronos will now evaluate the optional parameter trackAttendeeUsage.

It can be used to configure whether newly added attendees from creations and updates should be tracked automatically, which includes adding new entries in the collected contacts folder for new external calendar users (utilizing the contact collector service), as well as incrementing the use counts for already known internal and external entities (using the object use count service). Defaults to true, hence needs to be disabled explicitly.

See the HTTP API documentation for further details.

Configuration

SCR-1574

Summary: New property 'com.openexchange.mail.crossContextPermissions'

In order to enable cross-context folder permissions / mailbox ACLs, the new lean configuration property com.openexchange.mail.crossContextPermissions is introduced, defaulting to false. It can be defined through the config-cascade and is reloadable. It should only be enabled if all contexts of the deployment access the same mail server, and requires further preconditions like a configured mail login resolver service.

Clients are able to discover the actual value via JSlob path io.ox/mail//crossContextPermissions.

See the property documentation, as well as the feature documentation for further details.

SCR-1572

Summary: New parameter 'com.openexchange.calendar.storage.separateTransactionForSequenceIds'

In order to control whether a separate database transaction should be used for generating sequential identifiers, or if id generation should be performed within the surrounding transaction of the calendar storage operation, the new lean configuration property com.openexchange.calendar.storage.separateTransactionForSequenceIds is introduced.

Using a separate transaction can help to minimize the duration of the row lock in the sequence table, especially when many conflicting accesses for a single context are to be expeceted, e.g. during mass imports of calendar data. However, an additional database connection is used, and any already incremented counters won't be part of a potential rollback, then.

The property defaults to false, is reloadable, but not config-cascade aware.

See the property documentation for further details.

8.38.77

3rd Party Libraries/License Change

SCR-1570

Summary: Updated Netty libraries from v4.1.119 to v4.1.121

Updated Netty libraries from v4.1.119 to v4.1.121 in bundle io.netty

• netty-buffer-4.1.121.Final.jar
• netty-codec-4.1.121.Final.jar
• netty-codec-dns-4.1.121.Final.jar
• netty-codec-http2-4.1.121.Final.jar
• netty-codec-http-4.1.121.Final.jar
• netty-codec-socks-4.1.121.Final.jar
• netty-common-4.1.121.Final.jar
• netty-handler-4.1.121.Final.jar
• netty-handler-proxy-4.1.121.Final.jar
• netty-resolver-4.1.121.Final.jar
• netty-resolver-dns-4.1.121.Final.jar
• netty-transport-4.1.121.Final.jar
• netty-transport-native-unix-common-4.1.121.Final.jar
• netty-transport-classes-epoll-4.1.121.Final.jar = netty
• netty-transport-native-epoll-4.1.121.Final.jar = netty
• netty-transport-classes-kqueue-4.1.121.Final.jar = netty
• netty-transport-native-kqueue-4.1.121.Final.jar

SCR-1569

Summary: Updated lettuce library from v6.5.5 to v6.6.0

Updated lettuce library from v6.5.5 to v6.6.0 in bundle io.lettuce

SCR-1562

Summary: Updated Jackson libraries from v2.18.1 to v2.19.0 in target platfom

Updated several libraries to update Jackson libraries from v2.18.1 to v2.19.0

Target platform bundles (com.open-xchange.bundles)

• jackson-annotations-2.18.1.jar replaced with jackson-annotations-2.19.0.jar
• jackson-core-2.18.1.jar replaced with jackson-core-2.19.0.jar
• jackson-databind-2.18.1.jar replaced with jackson-databind-2.19.0.jar
• jackson-dataformat-cbor-2.18.1.jar replaced with jackson-dataformat-cbor-2.19.0.jar
• jackson-dataformat-xml-2.18.1.jar replaced with jackson-dataformat-xml-2.19.0.jar
• jackson-datatype-jsr310-2.18.1.jar replaced with jackson-datatype-jsr310-2.19.0.jar
• jackson-datatype-jsr310-2.18.1.jar replaced with jackson-datatype-jsr310-2.19.0.jar
• jackson-datatype-jsr353-2.18.1.jar replaced with jackson-datatype-jsr353-2.19.0.jar
• jackson-jakarta-rs-base-2.18.1.jar replaced with jackson-jakarta-rs-base-2.19.0.jar
• jackson-jakarta-rs-json-provider-2.18.1.jar replaced with jackson-jakarta-rs-json-provider-2.19.0.jar
• jackson-jakarta-rs-xml-provider-2.18.1.jar replaced with jackson-jakarta-rs-xml-provider-2.19.0.jar
• jackson-module-jakarta-xmlbind-annotations-2.18.1.jar replaced with jackson-module-jakarta-xmlbind-annotations-2.19.0.jar
• jackson-module-jaxb-annotations-2.18.1.jar replaced with jackson-module-jaxb-annotations-2.19.0.jar

Bundle com.ctc.wstx

• woodstox-core-7.0.0.jar replaced with woodstox-core-7.1.0.jar

Bundle org.yaml.snakeyaml

• snakeyaml-2.3.jar replaced with snakeyaml-2.4.jar

API - HTTP-API

SCR-1567

Summary: Option "notification" when Granting Deputy Permissions

The new action in module deputy of the HTTP API is extended with an optional notification object where the transport and optional message can be specified by the client, in the same way as when a folder is shared, e.g.:

{
    [...]
    "notification": {
        "transport": "mail",
        "message": "the message"
    }
}

If set, a notification mail is generated and sent to the deputy user.

See the documentation for details.

SCR-1561

Summary: Introduced 'move' action for contacts/addressbooks

Introduced addressbooks?action=move / contacts?action=move to move contacts

Gitlab issue https://gitlab.open-xchange.com/appsuite/platform/core/-/issues/234

SCR-1453

Summary: New parameter "sortByUseCount" for "search" action in module "resource"

The action search in module resource of the HTTP API is extended with an additional, optional parameter named {}sortByUseCount. If {}true, found resources are implicitly sorted based on the individual use count number of the requesting user, in descending order (most frequently resources first), e.g. when being used during auto-complete operations of resource participants while creating new appointments.

See also the API documentation for further details.

API - Java

SCR-1560

Summary: Interface changes for contact move

com.openexchange.contact.provider.folder.FolderReadWriteContactsAccess:

• new method List<Contact> moveContacts(String targetFolderId, String sourceFolderId, List<String> contactIds, long clientTimestamp) throws OXException;

com.openexchange.contact.provider.composition.IDBasedContactsAccess:

• changed method List<ContactID> restoreContacts(List<ContactID> contactsIds, long clientTimestamp) throws OXException;
• new method List<Contact> moveContacts(String targetFolderId, String sourceFolderId, List<String> contactIds, long clientTimestamp) throws OXException;

com.openexchange.contact.provider.composition.TrashFolderAwareContactsAccess:

• changed method List<ContactID> restoreContacts(List<ContactID> contactsIds, long clientTimestamp) throws OXException;

com.openexchange.contact.storage.ContactStorage:

• new method void move(Session session, String targetFolderId, String sourceFolderId, String id, Date lastRead, Date now) throws OXException;
• new method void move(Session session, String targetFolderId, String sourceFolderId, String[] ids, Date lastRead, Date now) throws OXException;

com.openexchange.contact.ContactService:

• new method List<Contact> moveContacts(Session session, String targetFolderId, String sourceFolderId, String[] contactIds, Date lastRead) throws OXException;
• new method Contact moveContact(Session session, String targetFolderId, String sourceFolder, String contactId, Date lastRead) throws OXException;

Gitlab issue https://gitlab.open-xchange.com/appsuite/platform/core/-/issues/234

API - SOAP

SCR-1568

Summary: New "notification" Element when Granting Deputy Permissions

The grant call of the SOAP API "http://soap.admin.openexchange.com/OXDeputyPermissionsService" for deputy permissions management is extended with an optional notification element where the transport and optional message can be specified, e.g.:

  <soap:grant>
     <soap:notification>
        <xsd:transport>mail</xsd:transport>
        <xsd:message>the message</xsd:message>
     </soap:notification>
     [...]
  </soap:grant>

If set, a notification mail is generated and sent to the deputy user.

Behavioral Changes

SCR-1565

Summary: Redis connector now uses a pool of shared connections

The Open-Xchange Redis Connector now supports two operation modes for the pool of connections to Redis end-point(s).

• com.openexchange.redis.connection.pool.mode Allows the values shared and dedicated. dedicated lets Redis Connector use a common connection pool for the "connection per thread" operation mode. An individual connection is only used by one thread at the same time. shared lets Redis Connector use a connection pool that manages shared connections. Thus, a single connection is concurrently used by multiple threads at the same time. This fully leverages the NIO and asynchronous capabilities of the underlying Lettuce client library, saves I/O overhead and gives better performance. Therefore, the default value for this property is shared. Not reloadable and not config-cascade aware.

• com.openexchange.redis.connection.pool.numSharedConnections Specifies the max. number of shared connections that are managed in the connection pool running with shared mode. The default value for this property is 8. Not reloadable and not config-cascade aware.

Configuration

SCR-1564

Summary: New Configuration Property 'com.openexchange.calendar.externalConflictChecksTimeout'

The new lean configuration property com.openexchange.calendar.externalConflictChecksTimeout is introduced.

It configures the maximum time (in milliseconds) to wait for conflict check results from external sources like iCalendar subscriptions. A value of 0 disables external conflict checks during appointment creation or update completely.

It is reloadable and config-cascade aware, and default to 10000 (10 seconds).

See the documentation for further details.

SCR-1559

Summary: Changed com.openexchange.contact.trashFolder.enabled default value

Changed com.openexchange.contact.trashFolder.enabled default value to true

Database

SCR-1566

Summary: Update Task to Clear Empty Categories for Contacts

Update Task com.openexchange.groupware.update.tasks.ContactClearEmptyCategoriesTask

In order to remove categories values that accidentally got stored as [] in the database, the blocking update task

com.openexchange.groupware.update.tasks.ContactClearEmptyCategoriesTask

is introduced.

SCR-1563

Summary: Introduced update task to reset pflag for contacts

Introduced the update task com.openexchange.groupware.update.tasks.ResetContactPflagUpdateTask to reset prior set pflags for folder with id 6 (system folder), 16 (guest folder) and for folder of type 2 (public). 

8.37.72

General

SCR-1556

Summary: Upgraded MySQL-Connector-J from v.8.3.0 to v9.2.0

Upgraded MySQL-Connector-J from v.8.3.0 to v9.2.0 in traget platform (com.openexchange.bundles)

3rd Party Libraries/License Change

SCR-1553

Summary: Upgraded JSoup library from v1.17.2 to v1.19.1

Upgraded JSoup library from v1.17.2 to v1.19.1 in target platform (com.openexchange.bundles)

SCR-1552

Summary: Upgraded GSON from v2.10.1 to v2.12.1

Upgraded the GSON library from v2.10.1 to v2.12.1 in target platform (com.openexchange.bundles)

SCR-1551

Summary: Added new Failsafe library to target platform

Added new Failsafe v3.3.2 library to target platform (com.openexchange.bundles). Failsafe is a lightweight, zero-dependency library for handling failures in Java,

• failsafe-3.3.2.jar

API - HTTP-API

SCR-1558

Summary: New parameter 'dontResolveEntities' for 'chronos?action=new'

The new action in module chronos is extended by a new, optional parameter {}dontResolveEntities{}.

Normally, all attendees in an event are resolved to internal entities by their calendar user address URI implicitly, and all resolved users will share the created organizer event copy automatically. Now if this new parameter is set to {}true{}, all entities besides the current calendar user are not resolved treated as external entities, i.e. these appointments will effectively only be created for and visible to the targeted folder's calendar user in App Suite.

See the documentation and HTTP API documentation for further details.

Behavioral Changes

SCR-1565

Summary: Redis connector now uses a pool of shared connections

The Open-Xchange Redis Connector now supports two operation modes for the pool of connections to Redis end-point(s).

• com.openexchange.redis.connection.pool.mode Allows the values shared and dedicated. dedicated lets Redis Connector use a common connection pool for the "connection per thread" operation mode. An individual connection is only used by one thread at the same time. shared lets Redis Connector use a connection pool that manages shared connections. Thus, a single connection is concurrently used by multiple threads at the same time. This fully leverages the NIO and asynchronous capabilities of the underlying Lettuce client library, saves I/O overhead and gives better performance. Therefore, the default value for this property is shared. Not reloadable and not config-cascade aware.

• com.openexchange.redis.connection.pool.numSharedConnections Specifies the max. number of shared connections that are managed in the connection pool running with shared mode. The default value for this property is 8. Not reloadable and not config-cascade aware.

Configuration

SCR-1534

Summary: Introduced 'autodelete_contacts' & 'autodelete_contacts_editable' capability and config-path / jslob

Introduced autodelete_contacts capability to indicate if contacts in contact trash folder are auto-deleted after a configurable retention period. The retention period is announced via configuration path modules/contacts/autodelete/retentiondays and jslob io.ox/contacts//autodelete/retentiondays.

Setting is editable by user if property com.openexchange.contact.autodelete.editable is set to true. This is announced by autodelete_contacts_editable capability, configuration path modules/contacts/autodelete/editable and jslob io.ox/contacts//autodelete/editable.

Related issue: [https://gitlab.open-xchange.com/appsuite/platform/core/-/issues/182]

SCR-1533

Summary: Added properties for contact auto-delete feature

Added reloadable and config-cascade-aware lean properties:

• {}com.openexchange.contact.autodelete.enabled{}, default {}true{}. Defines whether the contacts in contact trash folder are auto-deleted.
• {}com.openexchange.contact.autodelete.retentionDays{}, default {}30{}. Defines the retention days for the auto-delete feature.
• {}com.openexchange.contact.autodelete.editable{}, default {}true{}. Defines whether the auto-delete retention days interval is editable by the user.

Related issue: [https://gitlab.open-xchange.com/appsuite/platform/core/-/issues/182]

Database

SCR-1554

Summary: Rename contact trash folder to maintain consistency across the modules

Update Task com.openexchange.groupware.update.tasks.OXFolderTreeRenameContactTrashTask

Existing contact trash folder with preliminary name Deleted contacts are renamed to Trash to maintain consistency across the modules

com.openexchange.groupware.update.tasks.OXFolderTreeRenameContactTrashTask

Related issues:

• https://gitlab.open-xchange.com/appsuite/web-apps/ui/-/issues/949
• https://gitlab.open-xchange.com/appsuite/platform/core/-/issues/234

8.36.36

3rd Party Libraries/License Change

SCR-1537

Summary: Updated Netty libraries from v4.1.115 to v4.1.119

Updated Netty libraries from v4.1.115 to v4.1.119 in bundle io.netty

• netty-buffer-4.1.119.Final.jar
• netty-codec-4.1.119.Final.jar
• netty-codec-dns-4.1.119.Final.jar
• netty-codec-http2-4.1.119.Final.jar
• netty-codec-http-4.1.119.Final.jar
• netty-codec-socks-4.1.119.Final.jar
• netty-common-4.1.119.Final.jar
• netty-handler-4.1.119.Final.jar
• netty-handler-proxy-4.1.119.Final.jar
• netty-resolver-4.1.119.Final.jar
• netty-resolver-dns-4.1.119.Final.jar
• netty-transport-4.1.119.Final.jar
• netty-transport-native-unix-common-4.1.119.Final.jar

SCR-1536

Summary: Updated Caffeine caching library

Updated Caffeine caching library from v3.1.8 to v3.2.0 in bundle com.google.guava

API - HTTP-API

SCR-1520

Summary: New restore action for addressbook endpoint

Introduced new /addressbooks?action=restore to restore trashed contacts.

SCR-1516

Summary: Added hardDelete parameter to contacts delete

In order to avoid the trashing mechanism for contacts when activated, we added a hardDelete paramter to the contacts/addressbooks delete requests.

API - Java

SCR-1519

Summary: Added hardDelete to FolderReadWriteContactsAccess

In order to avoid the trashing mechanism for contacts when activated, we added boolean hardDelete paramter to the FolderReadWriteContactsAccess interface for deleteContact and deleteContacts.

SCR-1518

Summary: Added restoreContact to FolderReadWriteContactsAccess

In order to be able to restore a contact we added the following method to the FolderReadWriteContactsAccess interface:

void restoreContact(ContactID contactId, Contact contact, ServerSession session, long clientTimestamp)

SCR-1517

Summary: Added hardDelete to InternalContactsAccess Interface

In order to avoid the trashing mechanism for contacts when activated, we added boolean hardDelete paramter to the InternalContactsAccess interface.

CLT

SCR-1528

Summary: New Option "convert-guest" in "createuser" Commandline Tool

The command-line interface createuser is extended with an additional option to automatically pick up and convert an existing guest user in the context matching the otherwise conflicting primary email address of the user being created:

--convert-guest booleanvalue : The flag whether it desired to convert an existent guest user to a regular user in case there is already a guest user associated with given primary E-Mail address

See https://documentation.open-xchange.com/main/middleware/command_line_tools/user/createuser.html for further details.

Configuration

SCR-1532

Summary: Introduced 'contact_trash' capability and config-path / jslob

Introduced contact_trash capability to indicate if a trash folder for contacts is available for the user. The folder identifier is announced via configuration path modules/contacts/folder/trash and jslob io.ox/contacts//folder/trash

Related issue: https://gitlab.open-xchange.com/appsuite/platform/core/-/issues/154

SCR-1523

Summary: New property com.openexchange.contact.trashFolder.enabled

Introduced new lean boolean property:

• com.openexchange.contact.trashFolder.enabled If enabled, contacts deleted without the hardDelete parameter are moved to the trash folder instead of being deleted. Default value is {}false{}. Reloadable and config-cascade aware.

Database

SCR-1526

Summary: New origin column for prg_contacts and del_contacts

Update Task com.openexchange.groupware.update.tasks.ContactsAddOriginColumnTask

Add origin column to prg_contacts/del_contacts table to save information about the origin folder of a contact that has been moved to the trash:

origin VARCHAR(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL

8.35.66

3rd Party Libraries/License Change

SCR-1513

Summary: Update Apache Commons CSV from v1.6 to v1.13.0

• Update Apache Commons CSV from v1.6 to v1.13.0 in target platform (com.openexchange.bundles)
• Update Apache Commons IO from v1.16.1 to v1.18.0 in target platform (com.openexchange.bundles)

SCR-1512

Summary: Updated Apache Commons CLI library from v1.6.0 to v1.9.0

Updated Apache Commons CLI library from v1.6.0 to v1.9.0 in target platform (com.openexchange.bundles)

SCR-1511

Summary: Update Apache Commons Codec

Update Apache Commons Codec from v.1.17.0 to v1.17.2 in target platform (com.openexchange.bundles)

SCR-1507

Summary: Added Apache Aries SPI Fly to target platform

Added Apache Aries SPI Fly to target platform. SPI Fly is the Reference Implementation of the OSGi ServiceLoader Mediator specification. This is needed to due to update of logging-related libraries, in which SLF4J changed from static initialization to the usage of Java's java.util.ServiceLoader.

Added bundles to target platform:

• asm-9.6.jar
• asm-analysis-9.6.jar
• asm-commons-9.6.jar
• asm-tree-9.6.jar
• asm-util-9.6.jar
• org.apache.aries.spifly.dynamic.bundle-1.3.7.jar

SCR-1506

Summary: Updated logging-related libraries

Updated logging-related libraries in target platform - thereof SLF4J API and Logback as well as associated logging bridges

• Updated slf4j-api from v1.7.36 to v2.0.16
• Updated logback-core from v1.2.13 to v1.5.16
• Updated logback-classic from v1.2.13 to v1.5.16
• Updated jcl-over-slf4j from v1.7.36 to v2.0.16
• Updated jul-to-slf4jj from v1.7.36 to v2.0.16
• Updated log4j-over-slf4j from v1.7.36 to v2.0.16
• Updated osgi-over-slf4j from v1.7.36 to v2.0.16

API - HTTP-API

SCR-1525

Summary: Added field "sharedreadonly" to "snippet" module

Added field "sharedreadonly" to "snippet" module. It provides the information whether a shared snippet may be seen, but must not be modified/deleted by other users.

{
   "id":"3",
   "content":"...",
   "createdby":3,
   "displayname":"My signature",
   "misc":{
      "insertion":"below",
      "content-type":"text/html"
   },
   "module":"io.ox/mail",
   "type":"signature",
   "shared":false,
   "sharedreadonly":false
}

API - SOAP

SCR-1529

Summary: New "convertguest" Element for "create" in "OXUserService"

The create element within the SOAP body of OXUserService is extended with an additional element to automatically pick up and convert an existing guest user in the context matching the otherwise conflicting primary email address of the user being created:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://soap.admin.openexchange.com" xmlns:xsd="http://dataobjects.soap.admin.openexchange.com/xsd" xmlns:xsd1="http://dataobjects.rmi.admin.openexchange.com/xsd">
   <soapenv:Header/>
   <soapenv:Body>
      <soap:create>
     [...]
         <soap:convertguest>...</soap:convertguest>
      </soap:create>
   </soapenv:Body>
</soapenv:Envelope>

API - Java

SCR-1509

Summary: Update cxf-libraries to 3.5.10

Update cxf-libraries from v3.5.9 to v3.5.10:

• cxf-core
• cxf-rt-bindings-soap
• cxf-rt-bindings-xml
• cxf-rt-databinding-jaxb
• cxf-rt-features-logging
• cxf-rt-frontend-jaxws
• cxf-rt-frontend-simple
• cxf-rt-transports-http
• cxf-rt-ws-addr
• cxf-rt-wsdl
• cxf-rt-ws-policy

SCR-1496

Summary: Enhanced OAuthAuthorizationService#validateAccessToken with Header collection parameter

The method com.openexchange.oauth.provider.authorizationserver.spi.OAuthAuthorizationService#validateAccessToken is enhanced with the additional parameter com.openexchange.servlet.Headers holding the headers of the underlying HTTP servlet request that is used to trigger the authentication request.

A default implementation of the new method overload is added, which delegates to the existing method passing the extracted access tokens only.

CLT

SCR-1528

Summary: New Option "convert-guest" in "createuser" Commandline Tool

The command-line interface createuser is extended with an additional option to automatically pick up and convert an existing guest user in the context matching the otherwise conflicting primary email address of the user being created:

--convert-guest booleanvalue : The flag whether it desired to convert an existent guest user to a regular user in case there is already a guest user associated with given primary E-Mail address

See https://documentation.open-xchange.com/main/middleware/command_line_tools/user/createuser.html for further details.

Configuration

SCR-1521

Summary: Added config switch to keep own address when replying to self-sent message

Added new lean boolean property to configure whether to keep own address when replying to self-sent message

• com.openexchange.mail.keepOwnAddressWhenReplyingToSelfSentMail Define whether to keep own address when replying to self-sent message. Default value is "false". Reloadable and config-cascade aware.

SCR-1514

Summary: New property 'com.openexchange.cache.v2.redis.multiKeyLimit'

In order to limit the maximum number of addressed keys per MGET, MSET, MHGET or MHSET command, the lean configuration property

com.openexchange.cache.v2.redis.multiKeyLimit

is introduced. It defaults to 100, and is neither reloadable, nor config-cascade aware.

SCR-1510

Summary: Changed defaults for Client-Onboarding YAML configuration file

Changed defaults in client-onboarding-scenarios.yml YAML configuration file:

• Removed sections ** Removed section for identifier mailappinstall referencing discontinued OX Mail App
• Changed attribute enabled to true ** Changed attribute enabled to true for section driveappinstall (OX Drive App) ** Changed attribute enabled to true for section syncappinstall (Sync App) ** Changed attribute enabled to true for section davsync (CalDAV & CardDAV Sync) ** Changed attribute enabled to true for section davmanual (CalDAV & CardDAV Sync) ** Changed attribute enabled to true for section eassync (Exchange ActiveSync) ** Changed attribute enabled to true for section easmanual (Exchange ActiveSync) ** Changed attribute enabled to true for section mailsync (IMAP/SMTP) ** Changed attribute enabled to true for section mailmanual (IMAP/SMTP)

SCR-1499

Summary: Added new properties to configure the new async framework

The new async framework introduces a few new lean properties which control the behaviour of framework.

• com.openexchange.admin.ctx.async.enabled Enables asynchronous deletion of contexts. Default value is false and config-cascade aware.
• com.openexchange.admin.async.schedule The schedule to run async admin operations. No default value and not config-cascade aware.
• com.openexchange.admin.async.pool.size The size of the threadpool which is responsible to run async tasks. The greater the pool the more tasks can be executed in parallel. Default value is 10 and not config-cascade aware.
• com.openexchange.admin.async.refresh.interval The interval in minutes in which claims of running tasks are refreshed. This must always be lower than com.openexchange.admin.async.retry.interval. Default value is 5 and not config-cascade aware.
• com.openexchange.admin.async.retry.limit The amount of times a failed async task is tried to be repeated. Default value is 5 and not config-cascade aware.
• com.openexchange.admin.async.retry.interval Defines the interval in minutes after a task is considered stale. Or in other words a task is considered stale if: now > last update + interval. Default value is 15 and not config-cascade aware.
• com.openexchange.admin.async.refill.interval Defines the interval in minutes in which new tasks are added to the queue of available tasks. This happens only during the defined schedule (see com.openexchange.admin.async.schedule). Default value is 5 and not config-cascade aware.
• com.openexchange.admin.async.cleanup.retentionDays The maximum amount of days a task is stored. Default value is 730 and not config-cascade aware.
• com.openexchange.admin.async.cleanup.interval The interval between runs of the cleanup task. A value of 0 disables the task. Default value is 7 and not config-cascade aware.

SCR-1486

Summary: New property com.openexchange.carddav.addressbookMultigetLimit

The lean configuration property com.openexchange.carddav.addressbookMultigetLimit is introduced to configure the maximum number of elements included in CARDDAV:addressbook-multiget responses to the client.

If data from more elements was requested, HTTP/1.1 507 Insufficient Storage responses will get inserted. It defaults to 1000, a value of -1 disabled the limit. Property is reloadable and can be defined through the config-cascade.

Database

SCR-1524

Summary: Added column "shared_read_only" to "snippet" table

Update Task com.openexchange.snippet.mime.groupware.SnippetAddReadOnlyColumnUpdateTask

Added column "shared_read_only" to "snippet" table. It stores the information whether a shared snippet may be seen, but must not be modified/deleted by other users.

  `shared_read_only` tinyint(3) unsigned NOT NULL DEFAULT 0

Full table layout is now:

CREATE TABLE `snippet` (
  `cid` int(10) unsigned NOT NULL,
  `user` int(10) unsigned NOT NULL,
  `id` varchar(64) CHARACTER SET latin1 COLLATE latin1_swedish_ci NOT NULL,
  `accountId` int(10) unsigned DEFAULT NULL,
  `displayName` varchar(255) NOT NULL,
  `module` varchar(255) CHARACTER SET latin1 COLLATE latin1_swedish_ci NOT NULL,
  `type` varchar(255) CHARACTER SET latin1 COLLATE latin1_swedish_ci NOT NULL,
  `shared` tinyint(3) unsigned DEFAULT NULL,
  `refType` tinyint(3) unsigned NOT NULL,
  `refId` varchar(255) CHARACTER SET latin1 COLLATE latin1_swedish_ci NOT NULL,
  `lastModified` bigint(64) NOT NULL,
  `size` int(10) unsigned DEFAULT NULL,
  `shared_read_only` tinyint(3) unsigned NOT NULL DEFAULT 0,
  PRIMARY KEY (`cid`,`user`,`id`),
  KEY `indexShared` (`cid`,`shared`),
  KEY `indexRefType` (`cid`,`user`,`id`,`refType`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci

SCR-1497

Summary: Added a new table async_tasks to the configdb database

Update Task 8:addAsyncTasksTable

The new async framework introduces a new table async_tasks in the configdb which is responsible to store asynchronous tasks.

That table is created by the liquibase task 8:addAsyncTasksTable.

CREATE TABLE `async_tasks` (
  `id` int unsigned NOT NULL AUTO_INCREMENT,
  `entityId` varchar(100) NOT NULL,
  `type` varchar(100) NOT NULL,
  `args` text DEFAULT NULL,
  `state` varchar(100) NOT NULL,
  `lastUpdate` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  `claim` BINARY(16) DEFAULT NULL,
  `retryCount` int unsigned NOT NULL DEFAULT 0,
  `error` varchar(256) DEFAULT NULL,
  PRIMARY KEY (`id`),
  UNIQUE KEY `entity_type_unique` (`entityId`,`type`)
) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

Packaging/Bundles

SCR-1522

Summary: Updated Snappy library from v1.1.10.5 to v1.1.10.7

Updated Snappy library from v1.1.10.5 to v1.1.10.7 in Target Platform (com.openexchange.bundles)

SCR-1508

Summary: Added new SLF4J API fragment bundle

Added new SLF4J API fragment bundle org.slf4j.fragment to open-xchange-core package/bundle list.

Purpose of this bundle is to make package ch.qos.logback.classic.spi available to SLF4J API bundle in order to inject Logback's SLF4j service provider into initialization phase of the SLF4J logging runtime.

SCR-1498

Summary: Added the new bundle com.openexchange.admin.async

For the new async framework the new bundle "com.openexchange.admin.async" is added to the open-xchange-admin package

8.34

API - HTTP-API

SCR-1489

Summary: New additional folder field 'com.openexchange.carddav.url' (id 3221)

The "detailed folder data" model of the HTTP API is extended by the additional folder field com.openexchange.carddav.url with column id 3221. The read only field is available for address book folders that are synchronizable via CardDAV, and points to the actual collection's endpoint as used by CardDAV clients.

See the documentation for further details.

API - Java

SCR-1496

Summary: Enhanced OAuthAuthorizationService#validateAccessToken with Header collection parameter

The method com.openexchange.oauth.provider.authorizationserver.spi.OAuthAuthorizationService#validateAccessToken is enhanced with the additional parameter com.openexchange.servlet.Headers holding the headers of the underlying HTTP servlet request that is used to trigger the authentication request.

A default implementation of the new method overload is added, which delegates to the existing method passing the extracted access tokens only.

Behavioral Changes

SCR-1490

Summary: Change of Key Format used for Redis Cache

For the Redis instance dedicated to caching purposes, operation mode Cluster may be used to scale out the Redis service horizontally. Doing so, the keyspace of the stored data is distributed evenly among the available Redis nodes. Technically, every master node in the cluster is responsible for certain hash slots. These slots are the underlying unit of sharding and calculated dynamically from the targeted key(s). Based on that, a command is routed based on its key's hash slot to the corresponding Redis node. If more than one node is targeted by a single command (e.g. DEL or MGET), single commands are executed in a fork/join manner against the correct Redis nodes automatically.

In order to prevent commands targeting multiple keys being distributed among multiple nodes, most of the cache keys that are actually associated with a certain OX context are changed so that the context identifier becomes the designated part of the key where the hash slot is calculated for, by surrounding it with curly braces (\{ and \}). For example, a typical key used to cache user data changes from ox-cache:usr:v1:5:12 to ox-cache:usr:v1:\{5\}:12

Due to this change, existing cached values using the previous key format will no longer be used when a rolling upgrade is performed, and will evict eventually (after com.openexchange.cache.v2.defaultExpirationSeconds, one hour by default). During this period, an increased memory usage will be noticeable after the middleware containers were updated. Therefore it is important that Redis is configured with an appropriate max-memory policy, especially if there's not much headroom left regarding the available usage. Alternatively, one can also flush all cached data once after the upgrade (using the FLUSHALL or FLUSHDB command manually).

SCR-1487

Summary: Health Check extended by Redis Cache

The health check of core middleware is extended with an check named redis.cache for the Redis connector attached to the instance used for caching purposes. It automatically becomes enabled once a Redis cache instance is configured via com.openexchange.redis.cache.enabled=true, and performs an operational check via PING command when called.

Like other checks, it can explicitly be disabled by including redis.cache in the value of property com.openexchange.health.skip. Or, to enable it, but not account its status to the overall result, it can be added to com.openexchange.health.ignore.

See the documentation for further details.

Changed defaults

SCR-1495

Summary: Disable Global Folder Cache by Default

Whether the so called "global folder cache" is enabled or not can be controlled via property com.openexchange.folderstorage.cache.enableGlobalFolderCache.

To avoid redundancies with the low-level database folder cache, its default value will change from true to false.

The absence of the additional caching layer will lower the memory requirements, as well as reduce the number of issued commands towards the Redis cache pod(s). However, since raw folder data is now always post-processed dynamically, this may lead to a slightly increased load on the middleware pods depending on client access patterns.

Configuration

SCR-1488

Summary: New Property com.openexchange.carddav.url

In order to display the CardDAV endpoint of address book collections to users in App Suite, a new lean configuration property named com.openexchange.carddav.url is introduced. Through this property, a URL template can be specified using the variables [hostname] and [folderId].

The property can be defined through the config-cascade and is reloadable. It defaults to https://[hostname]/carddav/[folderId].

See the property documentation for further details.

SCR-1486

Summary: New property 'com.openexchange.carddav.addressbookMultigetLimit'

The lean configuration property com.openexchange.carddav.addressbookMultigetLimit is introduced to configure the maximum number of elements included in CARDDAV:addressbook-multiget responses to the client.

If data from more elements was requested, HTTP/1.1 507 Insufficient Storage responses will get inserted. It defaults to 1000, a value of -1 disabled the limit. Property is reloadable and can be defined through the config-cascade.

Database

SCR-1468

Summary: Add table for webauthn data

In order to implement webauthn for multifactor and authentication, a database table needs to be created to store the public key, signature count, and additional relevant data about the authenticator.

Create a table within the oxdatabase shards:

CREATE TABLE web_authn
    `cid` int(11) DEFAULT NULL,
    `id` int(11) DEFAULT NULL,
    `deviceId` varchar(100) NOT NULL,
    `keyId` varchar(500) NOT NULL,
    `userId` varchar(100) DEFAULT NULL,
    `name` varchar(100) DEFAULT NULL,
    `login` varchar(100) DEFAULT NULL,
    `publicKey` varchar(1000) DEFAULT NULL,
    `attestation` varchar(10000) DEFAULT NULL,
    `clientData` varchar(2000) DEFAULT NULL,
    `counter` int(11) DEFAULT NULL,
    `compromised` bit(1) DEFAULT NULL,
    `isMultifactor` bit(1) DEFAULT NULL,
    `discoverable` bit(1) DEFAULT NULL,
    `lastUsed` datetime DEFAULT NULL,
    `enabled` bit(1) DEFAULT NULL,
    PRIMARY KEY (cid,id,deviceId),
    KEY `web_authn_id_IDX` (`cid`) USING BTREE
    ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

Packaging/Bundles

SCR-1491

Summary: Bundle to allow new MFA registrations using WebAuthn instead of U2F

Added new bundle com.openexchange.webauthn to allow new MFA registrations using WebAuthn instead of U2F. Also already providing code to implement webauthn as a "full" authentication service. The new bundle has been added to open-xchange-multifactor package.

8.33

General

SCR-1482

Summary: Added redis.tls chart value

Whether to use TLS to connect to the Redis endpoint can now be configured using redis.tls.enabled and redis.cache.tls.enabled.

SCR-1480

Summary: Updated lettuce library from v6.5.0 to v6.5.1

Updated lettuce library from v6.5.0 to v6.5.1 in bundle io.lettuce

• lettuce-core-6.5.1.RELEASE.jar

3rd Party Libraries/License Change

SCR-1481

Summary: Updated Fabric8 libraries from v6.10.0 to v6.13.4

Updated Fabric8 libraries from v6.10.0 to v6.13.4 in "io.fabric8.kubernetes" bundle

• kubernetes-client-6.13.4.jar
• kubernetes-client-api-6.13.4.jar
• kubernetes-httpclient-jdk-6.13.4.jar
• kubernetes-model-admissionregistration-6.13.4.jar
• kubernetes-model-apiextensions-6.13.4.jar
• kubernetes-model-apps-6.13.4.jar
• kubernetes-model-autoscaling-6.13.4.jar
• kubernetes-model-batch-6.13.4.jar
• kubernetes-model-certificates-6.13.4.jar
• kubernetes-model-common-6.13.4.jar
• kubernetes-model-coordination-6.13.4.jar
• kubernetes-model-core-6.13.4.jar
• kubernetes-model-discovery-6.13.4.jar
• kubernetes-model-events-6.13.4.jar
• kubernetes-model-extensions-6.13.4jar
• kubernetes-model-flowcontrol-6.13.4.jar
• kubernetes-model-gatewayapi-6.13.4.jar
• kubernetes-model-metrics-6.13.4.jar
• kubernetes-model-networking-6.13.4.jar
• kubernetes-model-node-6.13.4.jar
• kubernetes-model-policy-6.13.4.jar
• kubernetes-model-rbac-6.13.4.jar
• kubernetes-model-resource-6.13.4.jar
• kubernetes-model-scheduling-6.13.4.jar
• kubernetes-model-storageclass-6.13.4.jar

SCR-1479

Summary: Updated Netty libraries from v4.1.114 to v4.1.115

Updated Netty libraries from v4.1.114 to v4.1.115 in bundle io.netty

• netty-buffer-4.1.115.Final.jar
• netty-codec-4.1.115.Final.jar
• netty-codec-dns-4.1.115.Final.jar
• netty-codec-http2-4.1.115.Final.jar
• netty-codec-http-4.1.115.Final.jar
• netty-codec-socks-4.1.115.Final.jar
• netty-common-4.1.115.Final.jar
• netty-handler-4.1.115.Final.jar
• netty-handler-proxy-4.1.115.Final.jar
• netty-resolver-4.1.115.Final.jar
• netty-resolver-dns-4.1.115.Final.jar
• netty-transport-4.1.115.Final.jar
• netty-transport-native-unix-common-4.1.115.Final.jar

Configuration

SCR-1485

Summary: New options for Redis Connector

Added new lean options for the Redis connector

• com.openexchange.redis.connection.pool.newConnectionIfWaitExceeded Specifies whether to establish a new connection if waiting for an available connection in pool is exceeded. Default value is "true". Neither reloadable, nor config-cascade aware

• com.openexchange.redis.cluster.periodicTopologyRefreshMillis Defines the interval in milliseconds for periodic refreshing of the the cluster topology. Only effective if connecting against a Redis Cluster; e.g. "com.openexchange.redis.mode" is set to "cluster". Default value is "600000". Neither reloadable, nor config-cascade aware

SCR-1477

Summary: New property to select default collection for new contacts via iOS / CardDAV

In the Contacts App on iOS, it is not possible to pick a certain folder while creating a new contact within the CardDAV account. Instead, the iOS client creates new contacts in a somehow randomly chosen folder of the account, which could also be the "Global Address Book" or the "Collected Contacts" folder, or even folders that are shared from others. Therefore, as the user cannot influence the target folder, an implicit workaround is in place so that new contacts are always created within the user's default contacts folder on App Suite. Within the iOS client, this is reflected after the next synchronization cycle as well.

To influence the applied fallback logic, the following lean configuration property is introduced:

com.openexchange.carddav.iosFallbackToDefaultCollectionForNewResources 

Possibly settings are:

• always: New contacts are always created within the user's default contacts folder on App Suite
• disabled: Contacts are created within the folder targeted by the client, but rejected on insufficient permissions
• insufficientPermissions: Contacts are created within the folder targeted by the client, falling back to the user's default folder on insufficient permissions

It defaults to always so that contacts are created in the user's default contacts folder independently of which folder is targeted by the client.

The new property is reloadable and config-cascade-aware.

8.32

General

SCR-1473

Summary: Updated lettuce library from v6.4.0 to v6.5.0

Updated lettuce library from v6.4.0 to v6.5.0in bundle io.lettuce

• lettuce-core-6.5.0.RELEASE.jar

3rd Party Libraries/License Change

SCR-1476

Summary: Updated Jackson libraries from v2.16.1 to v2.18.1 in target platfom

Updated several libraries to update Jackson libraries from v2.16.1 to v2.18.1

Target platform bundles (com.open-xchange.bundles)

• stax2-api-4.2.1.jar replaced with stax2-api-4.2.2.jar
• jackson-annotations-2.16.1.jar replaced with jackson-annotations-2.18.1.jar
• jackson-core-2.16.1.jar replaced with jackson-core-2.18.1.jar
• jackson-databind-2.16.1.jar replaced with jackson-databind-2.18.1.jar
• jackson-dataformat-cbor-2.16.1.jar replaced with jackson-dataformat-cbor-2.18.1.jar
• jackson-dataformat-xml-2.16.1.jar replaced with jackson-dataformat-xml-2.18.1.jar
• jackson-datatype-jsr310-2.16.1.jar replaced with jackson-datatype-jsr310-2.18.1.jar
• jackson-datatype-jsr310-2.16.1.jar replaced with jackson-datatype-jsr310-2.18.1.jar
• jackson-datatype-jsr353-2.16.1.jar replaced with jackson-datatype-jsr353-2.18.1.jar
• jackson-jakarta-rs-base-2.16.1.jar replaced with jackson-jakarta-rs-base-2.18.1.jar
• jackson-jakarta-rs-json-provider-2.16.1.jar replaced with jackson-jakarta-rs-json-provider-2.18.1.jar
• jackson-jakarta-rs-xml-provider-2.16.1.jar replaced with jackson-jakarta-rs-xml-provider-2.18.1.jar
• jackson-module-jakarta-xmlbind-annotations-2.16.1.jar replaced with jackson-module-jakarta-xmlbind-annotations-2.18.1.jar
• jackson-module-jaxb-annotations-2.16.1.jar replaced with jackson-module-jaxb-annotations-2.18.1.jar

Bundle com.ctc.wstx

• woodstox-core-6.5.1.jar replaced with woodstox-core-7.0.0.jar

Bundle org.yaml.snakeyaml

• snakeyaml-2.2.jar replaced with snakeyaml-2.3.jar

SCR-1472

Summary: Updated Netty libraries from v4.1.112 to v4.1.114

Updated Netty libraries from v4.1.112 to v4.1.114 in bundle io.netty

• netty-buffer-4.1.112.Final.jar
• netty-codec-4.1.112.Final.jar
• netty-codec-dns-4.1.112.Final.jar
• netty-codec-http2-4.1.112.Final.jar
• netty-codec-http-4.1.112.Final.jar
• netty-codec-socks-4.1.112.Final.jar
• netty-common-4.1.112.Final.jar
• netty-handler-4.1.112.Final.jar
• netty-handler-proxy-4.1.112.Final.jar
• netty-resolver-4.1.112.Final.jar
• netty-resolver-dns-4.1.112.Final.jar
• netty-transport-4.1.112.Final.jar
• netty-transport-native-unix-common-4.1.112.Final.jar

Configuration

SCR-1475

Summary: New property to configure SSO Logout when OX Sessions are closed

In order to configure after which session removal events an OpenID Connect session is also closed on the provider side, the following lean configuration property is introduced:

com.openexchange.oidc.opLogoutOnSessionRemoval

It specifies an optional comma-separated list of certain session removal events for which the logout endpoint of the OP should be invoked as well to terminate the OIDC session. This does not affect regular/explicit, client-initiated logout flows where the OP is always included as per com.openexchange.oidc.ssoLogout. Also, sessions spawned using the Resource Owner Password Credentials Grant are not considered.

Configurable removal events include:

• expired - The session is removed after being idle/unused for a certain duration
• user_closed - Another session is removed explicitly by the user (usually via session management API)
• admin_closed - A session is removed explicitly via an administrative interface (e.g. close sessions commandline utility or REST API)

The property is empty by default, reloadable, and not config-cascade-aware. See also the documentation for further details.

SCR-1470

Summary: Added new lean property to control detection of inline images

Added new lean property com.openexchange.mail.detectInlineImageByDispositionOnly that controls whether to detect inline images solely by its value for "Content-Disposition" header (required to be "inline") and to ignore any file name information (e.g through "filename" parameter).

SCR-1462

Summary: Added new property to track Redis operation taking longer than a configured threshold

Added new lean property com.openexchange.redis.operationExecutionTimeThreshold to track Redis operation taking longer than a configured threshold. Default value is 0 (zero), therefore disabled by default. Not reloadable and not config-cascade aware.

8.31

Configuration

SCR-1462

Summary: Added new property to track Redis operation taking longer than a configured threshold

Added new lean property com.openexchange.redis.operationExecutionTimeThreshold to track Redis operation taking longer than a configured threshold. Default value is 0 (zero), therefore disabled by default. Not reloadable and not config-cascade aware.

8.31

API - Java

SCR-1460

Summary: Constructor change in com.openexchange.passwordchange.common.AbstractPasswordChangeService

With dropping legacy caching bundles com.openexchange.caching.*, the constructor in com.openexchange.passwordchange.common.AbstractPasswordChangeService changed as c.o.caching.CacheService is no longer available

CLT

SCR-1464

Summary: Dropped 'checkconfigconsistency' CLT

With removal of legacy com.openexchange.caching bundles, the checkconfigconsistency CLT is no longer needed

Configuration

SCR-1466

Summary: Allow specifying the name of the HTTP header that forwards the originating remote port

Introduced new lean property "com.openexchange.server.portHeader" specifying the name of the HTTP header that forwards the originating remote port. Default value is "X-Forwarded-Port". It is neither reloadable nor config-cascade aware.

SCR-1465

Summary: New configuration property com.openexchange.push.dovecot.unregisterAfterDelete

Depending on the setup, it may not be suitable to attempt a de-registration of active push listeners on the mail server during user- or context deletion. Therefore, a new lean configuration property is introduced:

com.openexchange.push.dovecot.unregisterAfterDelete

It defaults to true so that current semantics are not changed. The new configuration property is reloadable, yet not config-cascade aware.

SCR-1462

Summary: Added new property to track Redis operation taking longer than a configured threshold

Added new lean property com.openexchange.redis.operationExecutionTimeThreshold to track Redis operation taking longer than a configured threshold. Default value is 0 (zero), therefore disabled by default. Not reloadable and not config-cascade aware.

SCR-1461

Summary: Dropped legacy cache service properties

Dropped properties (referenced in open-xchange-core/debian/postinst):

• com.openexchange.caching.jcs.remoteInvalidationForPersonalFolders
• com.openexchange.caching.jcs.enabled
• jcs.region.*

Dropped from system.properties:

• UserConfigurationStorage
• Cache

Frontend

SCR-1469

Summary: New Setting for Preferred Calendar User Address

Introduced the JSLob entry io.ox/calendar/preferredAddress to let the end user control which email address is assigned to the corresponding attendee in calendar events, to e.g. avoid exposing of an unwanted email address. The value of the entry can always be set by the user, however is limited to the known aliases of the user.

Packaging/Bundles

SCR-1459

Summary: Dropped com.openexchange.caching.* bundles

As all caches are transformed to com.openexchange.cache.v2 implementation, the legacy cache implementation in com.openexchange.caching and com.openexchange.caching.events bundles is dropped

8.30

3rd Party Libraries/License Change

SCR-1452

Summary: Moved Java Data Objects (JDO) API to target platform

Moved the Java Data Objects (JDO) API formerly held in bundle com.openexchange.common to target platform bundles managed in com.openexchange.bundles.

Therefore, the target platform (com.openexchange.bundles) has been extended by the libraries:

• glassfish-corba-omgapi-4.2.4.jar
• jdo-api-3.2.1.jar

API - HTTP-API

SCR-1456

Summary: Removed "messaging"-related APIs

Removed HTTP-API paths

• messaging/account
• messaging/message
• messaging/service

API - Java

SCR-1458

Summary: Upgrade to Java 21

Middleware core will be upgraded to Java 21. This means that each bundle's required execution environment will now be JaveSE-21, and a compatible runtime JRE must be used.

Configuration

SCR-1457

Summary: Removed "messaging"-related properties

Removed "messaging"-related properties

• "com.openexchange.messaging.enabled"

SCR-1454

Summary: New configuration property "com.openexchange.cache.v2.redis.disableHashExpiration"

Breaking Change

A new lean configuration property com.openexchange.cache.v2.redis.disableHashExpiration is temporarily introduced for increased compatibility with older versions of Redis.

The property optionally disables field expiration of hash keys. If set to true, no HEXPIRE commands are invoked after setting values in hashes, resulting in persistent values that will only be removed explicitly by the application, or due to a general maxmemory eviction policy of Redis like allkeys-lru.

It should therefore only be enabled if a dedicated Redis instance for cache-purposes is used (see com.openexchange.redis.cache.enabled)!

The property is neither config-cascade aware nor reloadable. It is only available for a temporary grace period and will be removed again in a future version - therefore it should be considered as deprecated from the beginning.

SCR-1442

Summary: Removed 'hazelcast-data-holding' and 'hazelcast-lite-member' roles

Since the core middleware no longer depends on Hazelcast, the roles hazelcast-data-holding and hazelcast-lite-member defined in the core-mw Helm chart are no longer needed. As a result, they will be removed in version 6.0.0.

However, OX Documents, which is still included in the middleware image, relies on Hazelcast and requires a headless service. Therefore, the headless service from the hazelcast-data-holding role has been moved to a new role named documents.

Please note that custom node definitions (scaling.nodes) must include this new role. Otherwise, the headless service will not be deployed, and OX Documents bundles will fail to start.

For more information, refer to the chart documentation.

Packaging/Bundles

SCR-1455

Summary: Removed "messaging"-related functionality

Through removal of "messaging"-related functionality the following bundles and packages were dropped:

Bundles

• com.openexchange.messaging
• com.openexchange.messaging.generic
• com.openexchange.messaging.json
• com.openexchange.messaging.rss
• com.openexchange.messaging.sms

Packages

• open-xchange-messaging
• open-xchange-messaging-sms

SCR-1427

Summary: Removed "MsService" and Parent Bundle "com.openexchange.ms"

The service com.openexchange.ms.MsService as well as its parent bundle com.openexchange.ms are no longer used and had been deprecated along with SCR-1342. Now they're removed from middleware core.

8.29

3rd Party Libraries/License Change

SCR-1451

Summary: Updated Google Guava from v33.2.1 to v33.3.0

Updated Google Guava from v33.2.1 to v33.3.0 in bundle com.google.guava

SCR-1450

Summary: Removed org.eclipse.osgi.services helper bundle

Removed org.eclipse.osgi.services helper bundle in favor of individual org.osgi.service.X bundles

SCR-1448

Summary: Upgraded dnsjava (an implementation of DNS in Java)

Upgraded dnsjava from v3.5.3 to v3.6.1 in target platform (com.openexchange.bundles)

SCR-1440

Summary: Updated OSGi target platform bundles

Updated the following OSGi target platform bundles

• org.apache.felix.gogo.runtime_1.1.4.v20210111-1007.jar updated to org.apache.felix.gogo.runtime_1.1.6.jar
• org.eclipse.osgi.util_3.7.200.v20230103-1101.jar updated to org.eclipse.osgi.util_3.7.300.v20231104-1118.jar
• org.eclipse.osgi_3.18.400.v20230509-2241.jar updated to org.eclipse.osgi_3.20.0.v20240509-1421.jar

SCR-1433

Summary: Updated lettuce library from v6.3.2 to v6.4.0

Updated lettuce library from v6.3.2 to v6.4.0in bundle io.lettuce

• lettuce-core-6.4.0.RELEASE.jar

SCR-1432

Summary: Updated Netty libraries from v4.1.111 to v4.1.112

Updated Netty libraries from v4.1.111 to v4.1.112 in bundle io.netty

• netty-buffer-4.1.112.Final.jar
• netty-codec-4.1.112.Final.jar
• netty-codec-dns-4.1.112.Final.jar
• netty-codec-http2-4.1.112.Final.jar
• netty-codec-http-4.1.112.Final.jar
• netty-codec-socks-4.1.112.Final.jar
• netty-common-4.1.112.Final.jar
• netty-handler-4.1.112.Final.jar
• netty-handler-proxy-4.1.112.Final.jar
• netty-resolver-4.1.112.Final.jar
• netty-resolver-dns-4.1.112.Final.jar
• netty-transport-4.1.112.Final.jar
• netty-transport-native-unix-common-4.1.112.Final.jar

API - HTTP-API

SCR-1406

Summary: Added an client defined expiration time to /token?action=acquireToken

The parameter expiry was added to the request acquireToken. Thus, a client is able to define an individual expiry for a login token, see also /login?action=redeemToken. The expiry parameter will only be considered if the value is less the configured value through com.openexchange.tokenlogin.maxIdleTime

SCR-1405

Summary: Renamed parameter in '/login?action=redeemToken'

The parameter secret has been renamed to appId since it is more fitting to the nature of the parameter. secret can still be used, but is deprecated from now on. It will be removed in upcoming releases.

API - Java

SCR-1428

Summary: Deprecation of JCS-based "CacheService"

After a new caching implementation has been introduced with com.openexchange.cache.v2.CacheService, the previously used, JCS-based com.openexchange.caching.CacheService is now deprecated and is scheduled for removal in a later release. Until then, the interfaces are available and the service is basically still usable, however, without remote cache invalidation features.

SCR-1192

Summary: Removed com.openexchange.cluster.timer.ClusterTimerService

Removed com.openexchange.cluster.timer.ClusterTimerService

API - RMI

SCR-1430

Summary: Added new RMI API for deputy permissions management

Added new RMI API "com.openexchange.admin.rmi.OXDeputyPermissionsInterface" for deputy permissions management offering methods:

• grantDeputyPermission() Grants a new deputy permission

• updateDeputyPermission() Updates an existent deputy permission

• revokeDeputyPermission() Revokes/deletes an existent deputy permission

• getDeputyPermission() Retrieves a certain deputy permission

• listAll() Lists all deputy permissions for a given context

API - SOAP

SCR-1431

Summary: Added new SOAP API for deputy permissions management

Added new SOAP API "http://soap.admin.openexchange.com/OXDeputyPermissionsService" for deputy permissions management offering methods:

• grant() Grants a new deputy permission

• update() Updates an existent deputy permission

• revoke() Revokes/deletes an existent deputy permission

• get() Retrieves a certain deputy permission

• list() Lists all deputy permissions for a given context

Behavioral Changes

SCR-1425

Summary: Removed Replacement of "email 1" by "default sender address"

Previously, the middleware implicitly injected the configured "default sender address" into the "email 1" field of contacts representing internal users, in case com.openexchange.notification.fromSource was set to defaultSenderAddress. This handling goes back to a workaround that was introduced to make this mail address available in Outlook through the former OXtender integration.

This caused different issues in the past, e.g. unexpected values in the global address book, incorrect search results, multiple users with apparently the same mail addresses etc.

As the client for which the workaround has been introduced has passed away a long time ago, this implicit mail address replacement is now removed, as it is obviously no longer necessary. Consequently, the provisioned "email 1" address is now always exposed in user contact objects through all APIs, regardless of aforementioned configuration setting com.openexchange.notification.fromSource.

So for cases where a different default sender address has been set before in a user's mail settings, the behavioral change would be that this address will now no longer be displayed for the associated contact object, but the actually stored value for "email 1".

Configuration

SCR-1449

Summary: Added DNS configuration options for MX records look-up on ISPDB auto-config detection

Added new lean DNS configuration options for MX records look-up on ISPDB auto-config detection

• com.openexchange.mail.autoconfig.ispdb.dns.resolverHost The optional host name for the DNS server on MX record look-up. If not specified system's default DNS service is used.

• com.openexchange.mail.autoconfig.ispdb.dns.resolverPort The optional port number for the DNS server on MX record look-up. If not specified default port (53 UDP) is used.

SCR-1441

Summary: New Configuration Property "com.openexchange.oidc.staySignedIn"

If the default OIDC backend implementation is used, sessions created through OpenID Connect have the "stay signed in" marker set to false by default.

This can now be changed through configuration parameter com.openexchange.oidc.staySignedIn, and has an impact on the cookie- and OX session lifetime. If true, cookies will be decorated with the max. age as configured via com.openexchange.cookie.ttl. Also, the maximum idle time of OX sessions will be aligned to com.openexchange.sessiond.sessionLongLifeTime. If set to false, cookies will use session lifetime, and the maximum OX session idle time follows com.openexchange.sessiond.sessionDefaultLifeTime.

The lean property defaults to false, is reloadable, and not config-cascade aware.

SCR-1438

Summary: Removed all xing properties

The following xing properties have been removed:

• com.openexchange.oauth.xing
• com.openexchange.oauth.xing.apiKey
• com.openexchange.oauth.xing.apiSecret
• com.openexchange.oauth.xing.consumerKey
• com.openexchange.oauth.xing.consumerSecret
• com.openexchange.subscribe.socialplugin.xing
• com.openexchange.subscribe.socialplugin.xing.autorunInterval

SCR-1435

Summary: Removed option from Redis configuration

Removed option "com.openexchange.redis.resilientDatabase" from Redis configuration in favor of possibility to specify a dedicated Redis instance for volatile (cache) data; see SCR-1434.

Thus instead of specifying a dedicated database for resilient data (such as sessions), the administrator is supposed to deploy dedicated Redis instance for volatile (cache) data.

SCR-1434

Summary: Added option to Redis configuration to specify a separate instance

Added new lean option "com.openexchange.redis.cache.enabled" to Redis configuration to specify a separate instance dedicated for volatile (cache) data. This option is neither reloadable nor config-cascade aware.

With that option set to "true", the administrator may specify further Redis options for that special Redis instance through using the "cache" infix; e.g.

com.openexchange.redis.cache.enabled=true
com.openexchange.redis.cache.mode=standalone
com.openexchange.redis.cache.hosts=localhost:6379
 ...

SCR-1407

Summary: Replaced 'tokenlogin-secrets' file with lean configuration

Breaking Change The file tokelogin-secrets has been removed.

The file tokenlogin-secrets was used to define "secret" applications for which a token login was allowed. Such "secrets" could be enriched with parameters, controlling flows in the middleware. The file was not reloadable nor config cascade aware. Therefore, replaced the file with config cascade aware and reloadable properties. The properties are defined as followed:

• com.openexchange.tokenlogin.applications specifies the application identifiers to use, split by comma. These IDs were formerly knwon as "secrets". No default value is defined. The IDs are used to define application specific behaviour through the other properties
• com.openexchange.tokenlogin.[applicationId].accessPassword specifies whether or not the user's password is part of the response when redeeming the token. Default is false.
• com.openexchange.tokenlogin.[applicationId].copyParameters specifies whether or not to copy all session parameters into the cloned session, that is created during the token login action. Default is false
• com.openexchange.tokenlogin.[applicationId].announceId specifies whether or not to announce the application identifier to a client within the JSLob. Default is false.
• com.openexchange.tokenlogin.[applicationId].parameters specifies additional key-value pairs for the application, paired by equals, split by semicolon. Default is empty. Mainly kept for legacy reasons.

Database

SCR-1436

Summary: Introduced update task for removing xing accounts

Introduced the update task com.openexchange.oauth.impl.internal.groupware.RemoveXingAccountsUpdateTask for removing xing accounts.

Packaging/Bundles

SCR-1437

Summary: Removed xing bundles

Removed xing bundles:

• com.openexchange.xing
• com.openexchange.xing.access
• com.openexchange.xing.json
• com.openexchange.subscribe.xing
• com.openexchange.oauth.xing
• com.openexchange.halo.xing

Package definitions have been removed as well:

• open-xchange-xing-json

SCR-1429

Summary: Added new bundle for deputy permissions management via SOAP

Added new bundle "com.openexchange.admin.soap.deputy" for deputy permissions management via SOAP. That new bundle has been added to "open-xchange-admin-soap" package.

SCR-1426

Summary: Removed "FilteringObjectStreamFactory" Service and parent Bundle "com.openexchange.serialization"

The service com.openexchange.serialization.FilteringObjectStreamFactory as well as its parent bundle com.openexchange.serialization are no longer used and had been deprecated along with SCR-1421. Now they're removed from middleware core.

8.28

3rd Party Libraries/License Change

SCR-1420

Summary: Removed xmlbeans-2.6.0 library

The library xmlbeans-2.6.0 has known vulnerabilities. Since it is no longer used in the Middleware, the library is removed from target platform (com.openexchange.bundles)

SCR-1419

Summary: Upgraded ROME library for RSS and Atom feeds

Upgraded ROME library for RSS and Atom feeds from v1.0 to v1.19.0 in bundle com.openexchange.messaging.rss

SCR-1415

Summary: Updated Google Guava from v33.0.0 to v33.2.1

Updated Google Guava from v33.0.0 to v33.2.1 in bundle com.google.guava

API - Java

SCR-1421

Summary: Deprecation of "FilteringObjectStreamFactory" Service

The service com.openexchange.serialization.FilteringObjectStreamFactory has been introduced to secure serialization routines in the first version of the "Realtime" framework.

Therefore, it should now be considered as deprecated, and is scheduled to be removed along with its parent bundle com.openexchange.serialization in a future release.

Behavioral Changes

SCR-1390

Summary: Introduced an admin based rate limit for provisioning calls

Up until now the provisioning apis (soap, rmi, clt) were not rate limited which could lead to downtimes in case a client provisioned too fast. This is especially painful in case multiple customers are on the same platform and could influence each other.

To prevent such scenarios in the future we introduced a new rate limit which is applied per admin. It effects all provisioning apis and is checked during the authentication process.

The limit is applied in constant 1 minute timeframes and can be configured for all admins or a single ones in case one would like to introduce different limits for different admins.

For this the following lean properties were introduced as well:

com.openexchange.rmi.rate.limit.default=-1
com.openexchange.rmi.rate.limit.[admin] 

See https://gitlab.open-xchange.com/app-suite-platform-1/provisioning/-/issues/1 for details

Configuration

SCR-1422

Summary: Removed unused cache regions from cache.ccf file

Removed unused cache regions from cache.ccf file since according caches are now held in Redis storage or refactored to a local (Guava) cache.

Removed regions are:

• OXFolderCache
• OXFolderQueryCache
• GlobalFolderCache

SCR-1416

Summary: Changed default value for property "com.openexchange.net.ssl.protocols"

Changed default value for lean property "com.openexchange.net.ssl.protocols" from "TLSv1, TLSv1.1, TLSv1.2" to "TLSv1.2, TLSv1.3" following the recommendation to always use TLS 1.2 or higher

8.27

3rd Party Libraries/License Change

SCR-1409

Summary: Apache Commons Lang 2.6 removed from target platform

The library Apache Commons Lang 2.6 has been removed from the target platform. The code should be migrated to Apache Commons Lang 3.x.

All known dependencies have already been resolved in previous releases.

SCR-1404

Summary: Updated JCTools in target platform

Updated JCTools (Java Concurrency Tools for the JVM) from v4.0.3 to v4.0.5 in target platform

SCR-1394

Summary: Updated lettuce library from v6.3.1 to v6.3.2

Updated lettuce library from v6.3.1 to v6.3.2 in bundle io.lettuce

• lettuce-core-6.3.2.RELEASE.jar

SCR-1393

Summary: Updated Netty libraries from v4.1.106 to v4.1.111

Updated Netty libraries from v4.1.106 to v4.1.111 in bundle io.netty

• netty-buffer-4.1.111.Final.jar
• netty-codec-4.1.111.Final.jar
• netty-codec-dns-4.1.111.Final.jar
• netty-codec-http2-4.1.111.Final.jar
• netty-codec-http-4.1.111.Final.jar
• netty-codec-socks-4.1.111.Final.jar
• netty-common-4.1.111.Final.jar
• netty-handler-4.1.111.Final.jar
• netty-handler-proxy-4.1.111.Final.jar
• netty-resolver-4.1.111.Final.jar
• netty-resolver-dns-4.1.111.Final.jar
• netty-transport-4.1.111.Final.jar
• netty-transport-native-unix-common-4.1.111.Final.jar

SCR-1389

Summary: Removed jboss library

The library jboss-jms-api.jar is no longer needed. Therefore, it has been removed.

SCR-1212

Summary: Update BouncyCastle Libraries to Latest

Bouncy Castle Libraries have been updated to include several bug fixes.  Want to update Bouncy Libraries to version 1.78.1

• bcmail-jdk18on-1.78.1.jar
• bcpg-jkd180n-1.78.1.jar
• pcpkix-jkd180n-1.78.1.jar
• bcprov-ext REMOVED, use bcprov.  ext was extended support of old methods and no longer required
• bcprov-jkd180n-1.78.1.jar
• bcutil-jkd180n-1.78.1.jar

API - HTTP-API

SCR-1406

Summary: Added an client defined expiration time to /token?action=acquireToken

The parameter expiry was added to the request acquireToken. Thus, a client is able to define an individual expiry for a login token, see also /login?action=redeemToken. The expiry parameter will only be considered if the value is less the configured value through com.openexchange.tokenlogin.maxIdleTime

SCR-1405

Summary: Renamed parameter in '/login?action=redeemToken'

The parameter secret has been renamed to appId since it is more fitting to the nature of the parameter. secret can still be used, but is deprecated from now on. It will be removed in upcoming releases.

SCR-1403

Summary: New field 'priority' in Event model of HTTP API

The Event model of the HTTP API is extended by a new field named priority. Its value defines the relative priority of the calendar event with the following semantics (see RFC 5545, section 3.8.1.9 for further details):

This priority is specified as an integer in the range 0 to 9. A value of 0 specifies an undefined priority. A value of 1 is the highest priority. A value of 2 is the second highest priority. Subsequent numbers specify a decreasing ordinal priority. A value of 9 is the lowest priority.

SCR-1401

Summary: Removal of transport "websocket" from "pns" API

The transport "websocket" in "pns" API was marked as deprecated with SCR-1297. It is now removed with version 8.27.

Behavioral Changes

SCR-1412

Summary: Caches Transformed to Redis

In an iterative approach, more and more caches are being outsourced from middleware node-local caches (JCS), towards a centralized caching architecture using Redis.

Consequently, the memory requirements for the Redis pods are going to increase - with this, as well as in upcoming releases.

Therefore, it is recommended to increase the memory assigned to the Redis pods via Helm charts ({}resources.limits{} and/or {}resources.requests{}), and to monitor the memory consumption of the Redis pods closely, e.g. by utilizing the exposed metrics like {}redis_memory_used_dataset_bytes{}.

Configuration

SCR-1408

Summary: Added new config option controlling whether to use HTML on reply/forward if preferred

Added new lean config option: * com.openexchange.mail.useHtmlOnReplyForwardIfPreferred That boolean config option controls whether to use HTML on reply/forward to/of text-only E-Mails if HTML is chosen as preferred message format. Default value is false. That property is both - reloadable and config-cascade aware.

SCR-1383

Summary: New Property com.openexchange.redis.resilientDatabase

In order to configure an alternative database number for Redis/KeyDB, the following lean configuration property is introduced:

com.openexchange.redis.resilientDatabase

This property allows to configure an alternative database number to use for unrecoverable data like sessions that might be replayed to remote sites in sharded environments with multiple data centers ("Active/Active").

Especially, data stored there would be resilient when flushing the default database after recovering from failover situations.

Databases are only available for Redis stand-alone and Redis Master/Slave.

A negative number means no specific database.

The property defaults to -1, which means that no separate database number is used. It is neither reloadable, nor config-cascade-aware.

Database

SCR-1411

Summary: Added an account index to various calendar tables for improved look-up

Added an index for columns cid and account to following calendar tables for improved look-up:

• calendar_event
• calendar_event_tombstone
• calendar_attendee
• calendar_attendee_tombstone
• calendar_alarm
• calendar_alarm_trigger
• calendar_conference

SCR-1402

Summary: New Column 'priority' for Database Tables 'calendar_event' and 'calendar_event_tombstone'

Update Task com.openexchange.chronos.storage.rdb.groupware.CalendarEventAddPriorityColumnTask

The database tables calendar_event and calendar_event_tombstone are extended with a new column as follows:

`priority` INT4 UNSIGNED DEFAULT NULL

This is done through the following update task:

com.openexchange.chronos.storage.rdb.groupware.CalendarEventAddPriorityColumnTask

Packaging/Bundles

SCR-1388

Summary: Removed obsolete bundle 'com.google.gdata'

The bundle com.google.gdata is no longer in use and therefore is removed, along with its reference from package/feature {}open-xchange-oauth{}.

8.26

API - HTTP-API

SCR-1399

Summary: Deprecate messaging-related functionality and APIs

The middleware used to provide a generic messaging service for different use cases like SMS or data from RSS feeds. However, these are no longer in use by App Suite UI, or got replaced with an alternative solution in the meantime.

Therefore, corresponding functionality as well as the following modules of the HTTP API should be considered as deprecated, and will be removed in a future version:

• messaging/account
• messaging/message
• messaging/service

Configuration

SCR-1382

Summary: Added new lean property to specify SMTP chunk size

Added new lean property com.openexchange.smtp.chunksize (and com.openexchange.smtp.primary.chunksize respectively) to specify SMTP chunk size to use the SMTP extension for transmission of large messages; see RFC 3030. Default is 131072 (128KB). Reloadbale and config-cascade aware.

SCR-1386

Summary: Added new config options for webhook-based password change service

In order to configure the webhook-based password change service, the following properties have been introduced:

• com.openexchange.passwordchange.webhook.enabled

  Enables the webhook-based password change service (default: false)

• com.openexchange.passwordchange.webhook.endpoint

  The webhook endpoint

• com.openexchange.passwordchange.webhook.username

  The optional basic auth username for the webhook endpoint

• com.openexchange.passwordchange.webhook.password

  The optional basic auth password for the webhook endpoint

All properties are reloadable and config-cascade aware.

Database

SCR-1387

Summary: Introduced a new count table users_per_filestore for users using a certain file storage

Introduced users_per_context table in ConfigDB to have a direct access how many users use a certain file storage:

Table layout is:

CREATE TABLE `users_per_filestore` (
  `filestore_id` int(10) unsigned NOT NULL,
  `count` int(10) unsigned NOT NULL,
  PRIMARY KEY (`filestore_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci

SCR-1424

Summary: Changes for "infostore_document" and "infostore" that are required to support MySQL 8.4

Update task com.openexchange.groupware.update.tasks.InfostoreDocumentDropForeignKey drops the foreign key from "infostore_document" table due to missing unique key in the referenced table "infostore" and adds an appropriate index instead.

8.25

3rd Party Libraries/License Change

SCR-1373

Summary: Deprecation of Apache Commons Lang 2.6

The Apache Commons Lang in version 2.6 will be removed from the target platform with version 8.26! As version 3.x (currently 3.14.0) of Apache Commons Lang is already available within the target platform please make sure to migrate your code to this version until the release of App Suite 8.26!

API - HTTP-API

SCR-1375

Summary: Added sort_first_name field to DistributionListMember

Each member of a distribution list now contains an additional field sort_first_name which provides a name which can be used for sorting by first name. This field works similar to the sort_first_name field of the contact itself.

Additionally the members are also sorted according to this field.

SCR-1372

Summary: Added virtual contact field column 'sort_first_name'

Added virtual contact field column sort_first_name with the column identifier 623.

In analogy to the sort_name column (607), which sorts by surname, this column id can be used to sort the contacts in a contact request by the first name, taking into account the YOMI names.

Configuration

SCR-1380

Summary: Added new config option to control if user's local part should be assumed

Added new lean config option com.openexchange.imap.assumeUserLocalPartForSharedFolderPath to control if user's local part should be assumed when determining the path for a shared IMAP folder; e.g. assume "jane.doe" instead of "jane.doe@invalid.com". Default is false. Reloadable and config-cascade aware.

SCR-1378

Summary: Removal of Property com.openexchange.redis.enabled

After Redis becoming mandatory for core middleware services (SCR-1310, SCR-1330, SCR-1342 and furthers), the previously available switch com.openexchange.redis.enabled is no longer needed and therefore removed.

That means that the middleware will no longer start or work properly without configured Redis instance. By default, a standalone Redis instance on localhost:6379, is used. See property documentation for further details.

Consequently, in the "core-mw" Helm chart, the previously available enabled switch in the redis section is removed as well. That means that, unless configured differently via hosts, a fallback standalone Redis service is deployed by default.

Database

SCR-1319

Summary: Drop oauth-provider tables

Update tasks com.openexchange.groupware.update.tasks.DropOAuthGrantTableTask and com.openexchange.groupware.update.tasks.DropAuthCodeTableTask drop the tables oauth_grant and authCode from contextdb. The changesets 8.x:oauth_client:drop and 8.x:oauth_client_uri:drop drop the tables oauth_client and oauth_client_uri from globaldb.

8.24

3rd Party Libraries/License Change

SCR-1366

Summary: Updated Spring Framework

Updated Spring Framework from v5.3.21 to v6.1.4 in bundle com.openexchange.xml

• spring-beans-6.1.4.jar
• spring-core-6.1.4.jar
• spring-jcl-6.1.4.jar

API - Java

SCR-1367

Summary: Slightly incompatible update to BasicAuthenticatorPluginInterface

In order to gain more flexibility in case of multiple Plugins implementing BasicAuthenticatorPluginInterface and to introduce Context-Admin capability for regular users using the provisioning APIs, the return type of the three methods

• isOwnerOfContext()
• isMasterOfContext()
• isMasterOfContext()

will be changed from the primitive type boolean to Optional<Boolean> also supporting the third state empty to ignore the result and skip to the next plugin.

API - REST

SCR-1368

Summary: New REST API endpoint /admin/v1/contexts/pre-assemble to pre-assemble contexts

The concept of pre-assembled contexts consists of the asynchronous pre-creation of deactivated contexts that will be reused (and adapted to the provided settings) during the usual createcontext call. Pre-assembled contexts are characterized by being deactivated with reason_id equals 666 and their name beginning with the preassembled- prefix followed by an UUID.

In order to pick up pre-assembled contexts during regular provisioning operations, context skeletons need to be inserted into the database first. This can be achieved in two ways, by calling a REST API or via a background job. 

The REST API is located at http://oxhost:8009/admin/v1/contexts/pre-assemble. Pre-assembled contexts can be generated by a POST request using master authentication with a body containing a JSON object describing the schema name and how many context skeletons should be created. Optionally you can add the id of the filestore that should be used for the pre-assembled context by defining filestore_id parameter. 

Example:

POST /admin/v1/contexts/pre-assemble HTTP/1.1
Content-Type: application/json
Authorization: Basic amFuOmphbg==
User-Agent: PostmanRuntime/7.36.3
Accept: */*
Cache-Control: no-cache
Postman-Token: 3992936c-9d95-43c6-beb7-8b110e0088e2
Host: devenv.oxmw.io:8009
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 41

{
    "number":4,"schema": "oxuserdb_5"
}

HTTP/1.1 200 OK
Server: grizzly/2.4.4
X-Robots-Tag: none
Content-Type: application/json; charset=UTF-8
Content-Length: 52

{
    "contextIds": [
        11832,
        11833,
        11834,
        11835
    ],
    "errors": []
}

The response contains a JSON array of identifiers of the created pre-assembled contexts at field contextIds. Any errors that might have occurred when inserting the data are supplied in the errors array as well. In case of fatal errors, a response status different from  HTTP 200 will be returned depending on the error that occurred. Please have a look at the full REST API description of the endpoint for more details.

Configuration

SCR-1370

Summary: Added option to Redis configuration to specify a compression method

Added lean property to Redis configuration to specify a compression method

• com.openexchange.redis.compressionType The compression type to globally compress/decompress any data written to/read from Redis end-point according to specified type. Allowed type: snappy, gzip, deflate and none. Enabling or disabling compression is backward-compatible; meaning any previously written uncompressed data can still be decoded as well as any previously compressed data (provided that compression gets turned off later on). Default value is none. Neither config-cascade aware nor reloadable.

• com.openexchange.redis.minimumCompressionSize The minimum size for a data chunk in bytes for being considered for compression. Only effective if "com.openexchange.redis.compressionType" is set to not "none".

SCR-1360

Summary: New lean properties for background job to create pre-assembled contexts

New lean and non-reloadable properties to configure the background job that creates pre-assembled contexts:

• com.openexchange.admin.context.preassembly.job.enabled, defaults to false. Whether background job is active or not
• com.openexchange.admin.context.preassembly.job.schedule, defaults to Mon-Sun 0-4. The pattern specifying when to execute context the pre-assemble job. The default time zone of the Java virtual machine is assumed, which is typically the system's default time zone; unless the user.timezone property is set otherwise.
  
• com.openexchange.admin.context.preassembly.job.contextsPerSchema, defaults to 100. Configures the number of pre-assembled contexts that should exist per schema after the job was executed. This number will never be exceeded by using the background job. Of course it is possible to exceed this limit by using the REST API.

• com.openexchange.admin.context.preassembly.job.contextLimitFactor, defaults to 0.9. Configures the maximum filling level of schemas when adding pre-assembled contexts via periodic background job, as a factor of CONTEXTS_PER_SCHEMA. I. e. pre-assembly is only performed until the total number of contexts exceeds <factor> * <contexts_per_schema>.

• com.openexchange.admin.context.preassembly.job.frequency, defaults to 3600000 (1 hour). The frequency in milliseconds when to check for new job executions within configured schedule.

• com.openexchange.admin.context.preassembly.job.executionDelay, defaults to 86400000 (1 day). The (minimum) delay between repeated executions of the pre-assembly job in milliseconds.

SCR-1331

Summary: Added lean property 'com.openexchange.admin.context.preassembly.enabled'

Added lean property com.openexchange.admin.context.preassembly.enabled to enable using pre-assembled contexts instead of creating new contexts. Pre-assembled contexts must exist in database before enabling! Defaults to false.

SCR-1292

Summary: Dropped the 'com.openexchange.drive.events.gcm.key' property

Dropped the com.openexchange.drive.events.gcm.key property. Introduced the com.openexchange.drive.events.fcm.keyPath property as a replacement.

SCR-1290

Summary: Dropped the 'key' attribute in the 'pushClientConfig'

Dropped the key attribute in the pushClientConfig config file for the _type fcm. Introduced the keyPath attribute, which defines the full path of the FCM key file.

SCR-1289

Summary: Renamed .gcm. properties to .fcm.

Affected properties are:

• com.openexchange.drive.events.gcm.enabled
• com.openexchange.drive.events.gcm.clientId
• com.openexchange.pns.transport.gcm.enabled.*

The new properties are now available under a new qualified name:

• com.openexchange.drive.events.fcm.enabled
• com.openexchange.drive.events.fcm.clientId
• com.openexchange.pns.transport.fcm.enabled.*

Database

SCR-1288

Summary: Rename 'serviceId' and 'transport' values from GCM to FCM

Update Task com.openexchange.drive.events.fcm.groupware.RenameGCM2FCMUpdateTask com.openexchange.pns.transport.fcm.groupware.RenameGCM2FCMUpdateTask

Due to deprecation and end-of-life of GCM, we need to switch to FCM, hence the rename of the serviceId and transport values in the database.

Packaging/Bundles

SCR-1369

Summary: Removal of Kerberos Authentication

The Kerberos authentication integration that was available via supplementary package open-xchange-authentication-kerberos was removed.

See SCR-1315 for the deprecation with version 8.19.

SCR-1314

Summary: Introduced new FCM bundles

Added the following FCM-related bundles:

• com.google.firebase
• com.openexchange.drive.events.fcm
• com.openexchange.pns.transport.fcm

SCR-1313

Summary: Removed GCM bundles

Removed the following GCM-related bundles:

• com.google.android.gcm
• com.openexchange.drive.events.gcm
• com.openexchange.pns.transport.gcm

8.23

3rd Party Libraries/License Change

SCR-1362

Summary: Updated metadata-extractor

Updated 3rd party library metadata-extractor from v2.18.0 to v2.19.0 in bundle com.drew

SCR-1361

Summary: Updated Pushy library

Updated Pushy library from v0.15.2 to v0.15.4 in bundle com.eatthepath.pushy

SCR-1359

Summary: Updated a bunch of bundles in target platform

Updated the following bundles in target platform (com.openexchange.bundles):

Apache Mime4j

• apache-mime4j-core-0.8.7.jar -> apache-mime4j-core-0.8.10.jar
• apache-mime4j-dom-0.8.7.jar -> apache-mime4j-dom-0.8.10.jar
• apache-mime4j-storage-0.8.7.jar -> apache-mime4j-storage-0.8.10.jar

Apache Commons

• commons-net-3.9.0.jar -> commons-net-3.10.0.jar
• commons-pool2-2.11.1.jar -> commons-pool2-2.12.0.jar
• commons-text-1.10.0.jar -> commons-text-1.11.0.jar
• commons-validator-1.6.jar -> commons-validator-1.8.0.jar

Various/other

• dnsjava-3.5.2.jar -> dnsjava-3.5.3.jar
• expiringmap-0.5.11.jar
• fontbox-2.0.24.jar -> fontbox-2.0.30.jar
• jctools-core-4.0.1.jar -> jctools-core-4.0.3.jar
• joda-time-2.10.5.jar -> joda-time-2.12.7.jar
• jsoup-1.16.1.jar -> jsoup-1.17.2.jar
• pdfbox-2.0.24.jar -> pdfbox-2.0.30.jar
• snappy-java-1.1.10.3.jar -> snappy-java-1.1.10.5.jar

SCR-1358

Summary: Updated Apache Commons Lang3 library

Updated Apache Commons Lang3 library from v3.12.0 to v3.14.0 in target platform (com.openexchange.bundles)

SCR-1357

Summary: Updated Apache Commons IO library

Updated Apache Commons IO library from v2.11.0 to v2.15.1 in target platform (com.openexchange.bundles)

SCR-1356

Summary: Updated Apache Commons Exec library

Updated Apache Commons Exec library from v1.3 to v1.4.0 in target platform (com.openexchange.bundles)

SCR-1355

Summary: Updated Apache Commons CLI library

Updated Apache Commons Codec library from v1.5.0 to v1.6.0 in target platform (com.openexchange.bundles)

SCR-1354

Summary: Updated Apache Commons Codec library

Updated Apache Commons Codec library from v1.15 to v1.16.1 in target platform (com.openexchange.bundles)

SCR-1353

Summary: Updated Apache Commons Compress library

Updated Apache Commons Compress library from v1.21 to v1.26.0 in target platform (com.openexchange.bundles)

SCR-1349

Summary: Upgraded MaxMind GeoIP Libraries

The following 3rd party libraries in bundle com.openexchange.geolocation.maxmind.binary are upgraded:

• MaxMind GeoIP2 API from v2.12.0 to v2.17.0 (geoip2-2.12.0.jar)
• MaxMind DB Reader from v1.2.2 to v2.1.0 (maxmind-db-2.1.0.jar)

SCR-1348

Summary: Updated Amazon Java SDK

Updated Amazon Java SDK from v1.12.487 to v1.12.661 in bundle com.amazonaws

SCR-1345

Summary: Updated Google Guava from v32.1.3 to v33.0.0

Updated Google Guava from v32.1.3 to v33.0.0 in bundle com.google.guava

Configuration

SCR-1365

Summary: Support new property for Sproxyd connector to specify connection lease timeout

Support new property for Sproxyd connector to specify connection lease timeout:

• com.openexchange.filestore.sproxyd.connectionLeaseTimeout The connection lease timeout in milliseconds when waiting for a free connection in connection pool to become available. Default is 5 seconds (5000). Reloadable, but not config-cascade aware.

SCR-1351

Summary: New property com.openexchange.health.noServicesMissing.enabled

A new lean configuration property is introduced to activate an additional health check regarding internal service dependencies:

com.openexchange.health.noServicesMissing.enabled=false

It defaults to false for now hence needs to be enabled explicitly. Once enabled, the overall health check will only yield an UP result if all service/package dependencies are met. Therefore it is recommended to ensure that this is the case, i.e. the output of getmissingservices utility is empty.

The property is not config-cascade-aware, and not reloadable.

SCR-1350

Summary: Added possibility to have ZIP archive compiled for a certain module during a data export being spooled to a local disk

Added possibility to have ZIP archive compiled for a certain module being spooled to a local disk. Therefore, the following new lean properties were added:

• com.openexchange.gdpr.dataexport.spoolToFile Whether to spool collected data to a ZIP archive held on local disk or to append directly to destination file storage. Default value: false. Neither reloadable nor config-cascade aware

• com.openexchange.gdpr.dataexport.spoolDirectory The spool directory on disk to use for spooling. Requires that "com.openexchange.gdpr.dataexport.spoolToFile" is set to "true". if not set or specifies a non-existent, non-writable directory path, the default upload directory is used instead. Neither reloadable nor config-cascade aware

Packaging/Bundles

SCR-1347

Summary: Added new bundles for Redis-backed cache

Added new bundles (interface/API & implementation) for Redis-backed cache to open-xchange-core package:

• com.openexchange.cache.v2
• com.openexchange.cache.v2.redis

8.22

3rd Party Libraries/License Change

SCR-1344

Summary: Updated lettuce library from v6.2.6 to v6.3.1

Updated lettuce library from v6.2.6 to v6.3.1 in bundle io.lettuce

• lettuce-core-6.3.1.RELEASE.jar

SCR-1343

Summary: Updated Netty libraries from v4.1.97 to v4.1.106

Updated Netty libraries from v4.1.97 to v4.1.106 in bundle io.netty

• netty-buffer-4.1.106.Final.jar
• netty-codec-4.1.106.Final.jar
• netty-codec-dns-4.1.106.Final.jar
• netty-codec-http2-4.1.106.Final.jar
• netty-codec-http-4.1.106.Final.jar
• netty-codec-socks-4.1.106.Final.jar
• netty-common-4.1.106.Final.jar
• netty-handler-4.1.106.Final.jar
• netty-handler-proxy-4.1.106.Final.jar
• netty-resolver-4.1.106.Final.jar
• netty-resolver-dns-4.1.106.Final.jar
• netty-transport-4.1.106.Final.jar
• netty-transport-native-unix-common-4.1.106.Final.jar

SCR-1340

Summary: Updated Jackson & Fabric8 libraries

Updated Jackson libraries from v2.15.3 to v2.16.1 in target platfom

• jackson-annotations-2.16.1.jar
• jackson-core-2.16.1.jar
• jackson-databind-2.16.1.jar
• jackson-dataformat-cbor-2.16.1.jar
• jackson-dataformat-xml-2.16.1.jar
• jackson-dataformat-yaml-2.16.1.jar
• jackson-datatype-jsr310-2.16.1.jar
• jackson-datatype-jsr353-2.16.1.jar
• jackson-jakarta-rs-base-2.16.1.jar
• jackson-jakarta-rs-json-provider-2.16.1.jar
• jackson-jakarta-rs-xml-provider-2.16.1.jar
• jackson-module-jakarta-xmlbind-annotations-2.16.1.jar
• jackson-module-jaxb-annotations-2.16.1.jar

Updated Fabric8 ibraries from v6.9.0 to v6.10.0 in "io.fabric8.kubernetes" bundle

• kubernetes-client-6.10.0.jar
• kubernetes-client-api-6.10.0.jar
• kubernetes-httpclient-jdk-6.10.0.jar
• kubernetes-model-admissionregistration-6.10.0.jar
• kubernetes-model-apiextensions-6.10.0.jar
• kubernetes-model-apps-6.10.0.jar
• kubernetes-model-autoscaling-6.10.0.jar
• kubernetes-model-batch-6.10.0.jar
• kubernetes-model-certificates-6.10.0.jar
• kubernetes-model-common-6.10.0.jar
• kubernetes-model-coordination-6.10.0.jar
• kubernetes-model-core-6.10.0.jar
• kubernetes-model-discovery-6.10.0.jar
• kubernetes-model-events-6.10.0.jar
• kubernetes-model-extensions-6.10.0.jar
• kubernetes-model-flowcontrol-6.10.0.jar
• kubernetes-model-gatewayapi-6.10.0.jar
• kubernetes-model-metrics-6.10.0.jar
• kubernetes-model-networking-6.10.0.jar
• kubernetes-model-node-6.10.0.jar
• kubernetes-model-policy-6.10.0.jar
• kubernetes-model-rbac-6.10.0.jar
• kubernetes-model-resource-6.10.0.jar
• kubernetes-model-scheduling-6.10.0.jar
• kubernetes-model-storageclass-6.10.0.jar

SCR-1337

Summary: Updated bucket4j library

Updated bucket4j library (Java rate-limiting library based on token-bucket algorithm) from v7.0.0 to v8.7.0

API - HTTP-API

SCR-1305

Summary: Completely removed the ramp-up action

Completely removed the ramp-up action handling

API - Java

SCR-1339

Summary: Added methods in 'com.openexchange.admin.storage.interfaces.OXUserStorageInterface' for using pre-assembled contexts

Added methods

• com.openexchange.admin.storage.interfaces.OXUserStorageInterface.changeModuleAccess(Context, int[], UserModuleAccess, Connection) - use an already established connection to change module access (already implemented with MW-2229)
• com.openexchange.admin.storage.interfaces.OXUserStorageInterface.change(Context, User, Connection) - use an already established conntection to change user data (already implemented with MW-2229)
• com.openexchange.admin.storage.interfaces.OXUserStorageInterface.updatePreassembledLogin2UserData(Context, User, Connection) - update pre-assembled dummy data in login2user table (implemented with MWB-2470)

SCR-1306

Summary: Completely removed the ramp-up APIs and services

Completely removed the ramp-up APIs and services

Behavioral Changes

SCR-1342

Summary: Use Redis-based pub/sub functionality in favor over Hazelcast-based topics/queues

Using Redis-based pub/sub functionality in favor over Hazelcast-based topics/queues. API-wise the former com.openexchange.ms.MsService is marked as deprecated and developers should use new com.openexchange.pubsub.PubSubService instead.

SCR-1330

Summary: Redis becoming mandatory for cluster-wide functions

In our step-wise approach of integrating Redis-based services into the middleware, we already introduced the Redis-backed session storage. With completion of the story "Redis by Default: Configuration, Documentation" (MW-2144), Redis will be enabled by default.

With "Switch Hazelcast Map Usages to New Service" (MW-2145) Redis will now be mandatory for many advanced features that make use of distributed states, when multiple middleware nodes are used in the cluster.

CLT

SCR-1336

Summary: Dropped argument from oxinstaller command-line tool

Dropped argument "--jkroute" from oxinstaller command-line tool

Configuration

SCR-1341

Summary: Added new lean property to possibly add Open-Xchange server information to HTTP responses

Added new lean property "com.openexchange.http.grizzly.addServerVersion" to possibly add Open-Xchange server information as "X-Open-Xchange-Server" HTTP header to responses. Default is "false". Neither reloadable nor config-cascade aware.

SCR-1338

Summary: Added new configuration options for session look-ups at remote sites

Added new lean configuration options for session look-ups at remote sites

• com.openexchange.sessiond.redis.remote.ratelimit.overallMaxAccesses Specifies the max. number of overall remote site look-ups: not more than overallMaxAccesses per overallTimeWindowMillis. Default value is 60. Reloadable, but not config-cascade aware

• com.openexchange.sessiond.redis.remote.ratelimit.overallTimeWindowMillis Specifies the time window for overall remote site look-ups: not more than overallMaxAccesses per overallTimeWindowMillis. Default value is 60000. Reloadable, but not config-cascade aware

• com.openexchange.sessiond.redis.remote.ratelimit.maxRatePerClient Specifies the max. number of per-client remote site look-ups: not more than maxRatePerClient per timeWindowMillisPerClient. Default value is 10. Reloadable, but not config-cascade aware

• com.openexchange.sessiond.redis.remote.ratelimit.timeWindowMillisPerClient Specifies the time window for per-client remote site look-ups: not more than maxRatePerClient per timeWindowMillisPerClient. Default value is 60000. Reloadable, but not config-cascade aware

SCR-1335

Summary: Dropped legacy property com.openexchange.server.backendRoute

Dropped legacy property com.openexchange.server.backendRoute from file server.properties.

This was no lean property, thus that property needs to be removed the old way.

SCR-1331

Summary: Added lean property 'com.openexchange.admin.usePreAssembledContexts'

Added lean property com.openexchange.admin.usePreAssembledContexts to enable using pre-assembled contexts instead of creating new contexts. Pre-assembled contexts musts exist in database before enabling! Defaults to false.

Database

SCR-1332

Summary: Added table 'context_lock' to configdb

Update Task com.openexchange.database.internal.change.custom.ServerCreateContextLockTable

Added table context_lock to configdb, used for claiming/locking pre-assembled contexts.

CREATE TABLE `context_lock` (
    `cid` INT(10) UNSIGNED NOT NULL,
    `claim` BINARY(16) NOT NULL,
    `timestamp` BIGINT(20) UNSIGNED NOT NULL,
    PRIMARY KEY(`cid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci

Packaging/Bundles

SCR-1327

Summary: New soap request analyzer bundle

Introduced a new com.openexchange.admin.soap.request.analyzer bundle

8.21

3rd Party Libraries/License Change

SCR-1279

Summary: Upgraded javacc to 7.10.12

Upgraded the javacc library to version 7.10.12

API - HTTP-API

SCR-1333

Summary: Added action chronos/itip?action=decline_party_crasher

A new action, chronos/itip?action=decline_party_crasher, was added to the module chronos. The action enables the end user to decline the participation of an unknown calendar user (aka. "party crasher"), that responded to a certain event. The action triggers a CANCEL mail to the unknown calendar user. The CANCEL mail can be used by the unknown calendar user to (automatically) remove the appointment from her calendar. The action is defined as followed:

REQUEST:
PUT http://example.org/appsuite/api/chronos/itip?action=decline_party_crasher&session=1234xyz
{
  "com.openexchange.mail.conversion.fullname": "INBOX",
  "com.openexchange.mail.conversion.mailid": "1337",
  "com.openexchange.mail.conversion.sequenceid": "1.3"
}


RESPONSE:
{
    "data":
    {
        "recipient":
        {
            "uri": "mailto:partyCrasher@example.org",
            "cn": "Party Crasher",
            "email": "partyCrasher@example.org"
        },
        "status": "SENT"
    },
    "timestamp": 1704188470824
}

API - HTTP-REST

SCR-1295

Summary: Introduced a new REST interface for managing logging configuration

New REST endpoints are introduced in order to manage logging configuration via HTTP: The REST endpoints are registered under the /admin path and requires admin BASIC AUTH.

The new API routes are.

/admin/v1/logconf/system/loggers
/admin/v1/logconf/system/logger/
/admin/v1/logconf/session//loggers/
/admin/v1/logconf/session//logger/
/admin/v1/logconf/context//loggers/
/admin/v1/logconf/context//logger/
/admin/v1/logconf/context//user//loggers/
/admin/v1/logconf/context//user//logger/
/admin/v1/logconf/suppressed/exception-categories
/admin/v1/logconf/context//user//stacktrace/include-on-error

Configuration

SCR-1329

Summary: Added config option to avoid using IMAP entity's display name when listing shared folders

Added new lean config option com.openexchange.imap.useIMAPEntityDisplayNameIfPossible to control whether to use IMAP entity's display name when listing shared folders. Default is true

Packaging/Bundles

SCR-1293

Summary: New bundle com.openexchange.logging.rest

Introduced a new bundle com.openexchange.logging.rest, as part of the open-xchange-core package, which provides a RESTful API for configuring logging behavior.

8.20

General

SCR-1328

Summary: Removed CPU Resource Limit

Removed CPU resource limit since it's not best practice to have it set, see https://home.robusta.dev/blog/stop-using-cpu-limits

SCR-1227

Summary: Enhanced existent SOAP end-points by standard "Scheduled" folder

Enhanced existent SOAP end-points by standard "Scheduled" folder. The folder that holds such E-Mails that are scheduled for being sent at a later time.

To do so, the "User" data object contained in several SOAP end-points has been extended by "mail_folder_scheduled_full_name" element to output/specify the standard "Scheduled" folder.

3rd Party Libraries/License Change

SCR-1326

Summary: Updated Hazelcast from v3.5.1 to v3.5.6

Updated Hazelcast from v3.5.1 to v3.5.6 in bundle com.hazelcast

SCR-1325

Summary: Updated Google Guava from v32.1.1 to v32.1.3

Updated Google Guava from v32.1.1 to v32.1.3 in bundle com.google.guava

API - HTTP-API

SCR-1302

Summary: Added context_id field to TokenLogin json response

Added integer field context_id to tokenLogin JSON response, needed for successful request analyzing.

{
    "jsessionid": "<JSESSIONID>",
    "user":"<USER>",
    "user_id":10,
    "context_id":2,
    "url":"https://path/to/redirect"
} 

Behavioral Changes

SCR-1310

Summary: Enabled Redis-based session storage by default

Changed default value for properties

• The already introduced Redis-based session storage is now enabled by default with this behavioral change. Precisely, the former added property "com.openexchange.sessiond.redis.enabled" is now assumed to be "true" if not specified otherwise.

• Furthermore, the property "com.openexchange.sessionstorage.hazelcast.enabled" is now assumed to be "false" if not specified otherwise.

• Please follow the instructions given at this article in order to set further config options for having the Middleware being orderly connected against running Redis backend.

Deprecation of former implementations

Moreover, the implementing classes for interface com.openexchange.sessiond.SessiondService and com.openexchange.sessionstorage.SessionStorageService are marked as deprecated. This applies to:

• The in-memory based com.openexchange.sessiond.impl.SessiondServiceImpl as well as
• The Hazelcast-backed com.openexchange.sessionstorage.hazelcast.HazelcastSessionStorageService

Configuration

SCR-1317

Summary: Added configuration options to enable debugging/profiling SQL queries

Added new lean configuration options to trace queries and their execution/fetch times

• com.openexchange.database.profileSQL Enables to trace queries and their execution/fetch times. Default is false. Neither reloadable nor config-cascade aware.

• com.openexchange.database.logger The name of a class that implements 'com.mysql.cj.log.Log' that will be used to log messages to. Default is 'com.mysql.cj.log.Slf4JLogger'. Neither reloadable nor config-cascade aware.

SCR-1316

Summary: New Default Value for "com.openexchange.tools.images.transformations.maxSize"

To better support practical use cases, the default value for the configuration property com.openexchange.tools.images.transformations.maxSize is adjusted from 10485760 (10 MB) to 20971520 (20 MB).

SCR-1309

Summary: Added lean property com.openexchange.database.logWritesToNonLocalSegments

Added lean property com.openexchange.database.logWritesToNonLocalSegments configuring whether to log writeable database accesses from non-local sites. Defaults to false

SCR-1284

Summary: Add parameters to drive jump redirect for request analyzing

Added context_id and user_id parameters to drive jump redirect url com.openexchange.drive.jumpLink

New default value is [protocol]://[hostname]/[uiwebpath]#[app]&[folder]&[id]&[context]&[user]

SCR-1211

Summary: Added several configuration options for scheduled mails

Added several lean configuration options for scheduled mails

• com.openexchange.mail.scheduled.enabled Switch to enable or disable the scheduled mail feature. Default is true. Both - reloadable and config-cascade aware.

• com.openexchange.mail.scheduled.maxNumberOfScheduledMails The max. allowed number of scheduled mails per user. Default is 1000. Both - reloadable and config-cascade aware.

• com.openexchange.mail.scheduled.maxNumberOfScheduledMailsPerHour The max. allowed number of scheduled mails being sent per hour for a user. Default is 100. Both - reloadable and config-cascade aware.

• com.openexchange.mail.scheduled.checkFrequencyMinutes The frequency in minutes when to check for due scheduled mails. Default is 30. Reloadable, but not config-cascade aware.

• com.openexchange.mail.scheduled.lookAheadMinutes The look-ahead in minutes specifies the extra time added to current time when a scheduled mail is considered as due. Default is 35. Reloadable, but not config-cascade aware.

• com.openexchange.mail.scheduled.lockExpiryMinutes The time in minutes when the lock marking a scheduled mail as "in processing" is considered as expired and thus may be newly acquired by another process. Default is 5. Reloadable, but not config-cascade aware.

• com.openexchange.mail.scheduled.lockRefreshMinutes The time in minutes when the lock marking a scheduled mail as "in processing" is refreshed by lock-holding process. Default is 2. Reloadable, but not config-cascade aware.

Database

SCR-1225

Summary: Added new tables for scheduled mail feature

Added new tables in user database for scheduled mail feature

CREATE TABLE scheduledMail(
 uuid BINARY(16) NOT NULL,
 cid INT4 unsigned NOT NULL,
 user INT4 unsigned NOT NULL,
 dateToSend BIGINT(64) unsigned NOT NULL,
 mailPath TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
 processing BIGINT(64) unsigned NOT NULL DEFAULT 0,
 meta TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
 PRIMARY KEY (uuid),
 KEY id (cid, user, uuid)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci

CREATE TABLE scheduledMailLock(
 cid INT4 unsigned NOT NULL DEFAULT 0,
 user INT4 unsigned NOT NULL DEFAULT 0,
 name VARCHAR(16) CHARACTER SET latin1 COLLATE latin1_general_ci NOT NULL,
 stamp BIGINT(64) unsigned NOT NULL,
 PRIMARY KEY (cid, user, name)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci

Packaging/Bundles

SCR-1226

Summary: Added new bundles for scheduled mail feature

8.19

3rd Party Libraries/License Change

SCR-1308

Summary: Update vulnerable 3rd party libraries

Target platform: New libraries:

• jackson-core-2.15.3.jar
• jackson-annotations-2.15.3.jar
• jackson-dataformat-xml-2.15.3.jar
• jackson-databind-2.15.3.jar
• jackson-dataformat-cbor-2.15.3.jar
• jackson-dataformat-yaml-2.15.3.jar
• jackson-datatype-jsr310-2.15.3.jar
• jackson-datatype-jsr353-2.15.3.jar
• jackson-jakarta-rs-base-2.15.3.jar
• jackson-jakarta-rs-json-provider-2.15.3.jar
• jackson-jakarta-rs-xml-provider-2.15.3.jar
• jackson-module-jakarta-xmlbind-annotations-2.15.3.jar
• jackson-module-jaxb-annotations-2.15.3.jar
• jakarta.activation-api-2.1.2.jar
• jakarta.json-api-2.1.2.jar
• jackrabbit-webdav-2.21.19-custom.jar
• snappy-java-1.1.10.3.jar
• commons-fileupload-1.5.jar

Removed libraries:

• jackson-core-2.14.2.jar
• jackson-annotations-2.14.2.jar
• jackson-dataformat-xml-2.14.2.jar
• jackson-databind-2.14.2.jar
• jackson-dataformat-cbor-2.14.2.jar
• jackson-dataformat-yaml-2.14.2.jar
• jackson-datatype-jsr310-2.14.2.jar
• jackson-datatype-jsr353-2.14.2.jar
• jackson-jakarta-rs-base-2.14.2.jar
• jackson-jakarta-rs-json-provider-2.14.2.jar
• jackson-jakarta-rs-xml-provider-2.14.2.jar
• jackson-module-jakarta-xmlbind-annotations-2.14.2.jar
• jackson-module-jaxb-annotations-2.14.2.jar
• jakarta.activation-api-2.1.0.jar
• jakarta.activation-2.0.1.jar
• jackrabbit-webdav-2.19.1.jar
• sqlite-jdbc-3.19.3.jar
• commons-fileupload-1.4.jar

Bundle com.squareup.okhttp3: New libraries:

• kotlin-stdlib-common-1.9.10.jar
• kotlin-stdlib-1.9.10.jar
• okio-jvm-3.5.0.jar
• okio-3.5.0.jar
• okhttp-4.11.0.jar
• logging-interceptor-4.11.0.jar

Removed libraries:

• kotlin-stdlib-common-1.7.22.jar
• kotlin-stdlib-1.7.22.jar
• okio-jvm-2.8.0.jar
• okhttp-4.9.3.jar
• logging-interceptor-4.9.3.jar

Bundle com.ctc.wstx: New library:

• woodstox-core-6.5.1.jar

Removed library:

• woodstox-core-6.5.0.jar

Bundle org.yaml.snakeyaml: New library:

• snakeyaml-2.2.jar

Removed library:

• snakeyaml-1.33.jar

Bundle com.nimbus: New libraries:

• json-smart-2.4.11.jar
• accessors-smart-2.4.11.jar

Removed libraries:

• json-smart-2.4.8.jar
• accessors-smart-2.4.8.jar

SCR-1266

Summary: Upgraded gson from 2.9.0 to 2.10.1

Upgraded the gson library from 2.9.0 to 2.10.1

API - HTTP-API

SCR-1304

Summary: Dropped shard query parameter from SAML request

Dropped shard query paramter from SAML request

Configuration

SCR-1307

Summary: New property to configure allowed URI schemes for external calendar attachments

In order to prevent inaccessible attachment references getting stored for appointments imported to App Suite, a new lean configuration property is introduced.

Its value can be configured to a comma-separated list of URI schemes that are allowed be stored for externally linked attachments of appointments. Attachments with other URI schemes will be rejected/ignored during import:

com.openexchange.calendar.allowedAttachmentSchemes=http,https,ftp,ftps

The property is reloadable, and can be defined through the config cascade sown to level "context".

SCR-1303

Summary: Dropped sharding related property

Dropped property com.openexchange.server.shardName

SCR-1277

Summary: New properties for Segmenter Client Service

For accessing a segmenter service in a sharded environment with multiple data centers ("Active/Active"), a new configuration property is introduced where the base URI to the service can be defined (empty by default):

com.openexchange.segmenter.baseUrl=

Also, a new configuration property is introduced through which the identifier of the 'local' site can be defined, defaulting to the value default.

com.openexchange.segmenter.localSiteId=default

Both properties are reloadable. By default, if no segmenter service URI is defined, a non-sharded environment is assumed where all segments are served by the local site itself.

Packaging/Bundles

SCR-1315

Summary: Deprecation of Kerberos Authentication

The Kerberos authentication integration that was available via supplementary package open-xchange-authentication-kerberos is now deprecated and subject for removal in a future release.

SCR-1312

Summary: Removed obsolete bundle com.openexchange.message.timeline

As it is no longer used, bundle com.openexchange.message.timeline is removed, along with its reference in open-xchange-core package.

SCR-1311

Summary: Removed obsolete Rhino Scripting

As they're no longer used, the following bundles are removed, along with their references in open-xchange-halo package:

• com.openexchange.scripting.rhino
• com.openexchange.scripting.rhino.apiBridge

SCR-1241

Summary: Added new bundles for the request analyzer feature

The following new bundles are added to open-xchange-core in order to support request routing in sharded environments with multiple data centers ("Active/Active"):

• com.openexchange.request.analyzer
• com.openexchange.request.analyzer.rest
• com.openexchange.segmenter.client

8.18

3rd Party Libraries/License Change

SCR-1286

Summary: Updated lettuce library from v6.2.5 to v6.2.6

Updated lettuce library from v6.2.5 to v6.2.6 in bundle io.lettuce

SCR-1285

Summary: Updated Netty NIO libraries from v4.1.94 to v4.1.97

Updated Netty NIO libraries from v4.1.94 to v4.1.97 in bundle io.netty

API - HTTP-API

SCR-1300

Summary: Remove templating as valid format option

The publication and OXMF-based subscriptions features were removed with 7.10.2, see also MW-1089. Now, we remove a leftover within the API. The

&format=template

API parameter is no longer supported and will result in an error if used. 

SCR-1297

Summary: Deprecate transport "websocket" in "pns" API

To get rid of the stateful socket between Frontend and App Suite MW, Switchboard will be the only service that maintains a socket connection to clients. Instead of pushing directly from MW to the Client, MW will just use a HTTP webhook of Switchboard to announce new events. Switchboard will then push to the client.

Therefore the websocket transport identifier as used in actions subscribe and unsubscribe of the pns module in the HTTP API is now deprecated and will finally be removed in a future version.

Behavioral Changes

SCR-1272

Summary: Convert mail user flags to UTF-8

Mail user flags are persisted in UTF-7 on the mail server. However, web clients like the App Suite UI do use UTF-8 as default encoding for strings in communication with the Middleware.

Instead of using user flags as-is, the Middleware now converts incoming or outgoing user flags as need, so web clients can use UTF-8 based strings for mail user flags as usual.

Configuration

SCR-1301

Summary: Remove properties regarding user templating

With 7.10.2, we removed the publications and OXMF-based subscriptions features, see MW-1089. 

Now the last pieces of code belonging to those features were removed. Along the code, two properties that aren't needed anymore, have been removed:

com.openexchange.templating.trusted 
com.openexchange.templating.usertemplating

SCR-1278

Summary: Added configuration option to enable/disable encoding of IMAP user flags

Added configuration option controlling whether IMAP user flags are supposed to be encoded using RFC2060's UTF-7 encoding. Thus allowing non-ascii strings being stored as user flags.

Added support for properties:

• "com.openexchange.imap.useUTF7ForUserFlags" Enables (or disables) whether IMAP user flags are supposed to be encoded/decoded using RFC2060's UTF-7 encoding. Default value is "false". Config-cascade aware.

• "com.openexchange.imap.primary.useUTF7ForUserFlags" Enables (or disables) whether IMAP user flags are supposed to be encoded/decoded only for the primary IMAP account using RFC2060's UTF-7 encoding. Default value is "false". Config-cascade aware. This property effectively overwrites "com.openexchange.imap.encodeUserFlagsAsUTF7" for primary IMAP accounts

SCR-1229

Summary: Introduced new properties for Webhooks support

Introduced new lean properties for Webhooks support.

Webhook properties

• com.openexchange.webhooks.enabledIds Specifies a comma-separated list of Webhook identifiers that are considered as enabled. Reloadable and config-cascade aware.

Webhook PNS properties

• com.openexchange.pns.transport.webhooks.enabled Specifies whether the Webhook transport is enabled. Reloadable and config-cascade aware.

• com.openexchange.pns.transport.webhooks.httpsOnly Whether only HTTPS is accepted when communicating with a Webhook. Reloadable and config-cascade aware.

• com.openexchange.pns.transport.webhooks.allowTrustAll Whether SSL configuration for "trust all" is allowed. If set to "false" only valid certificates are accepted when communicating with a Webhook using a secure connection. Neither reloadable nor config-cascade aware.

• com.openexchange.pns.transport.webhooks.allowLocalWebhooks Whether Webhooks having end-point set to an internal address are allowed. Neither reloadable nor config-cascade aware.

Webhook PNS HTTP properties

• com.openexchange.pns.transport.webhooks.http.maxConnections The number of total connections held in HTTP connection pool for communicating with a certain Webhook end-point. Reloadable and config-cascade aware.

• com.openexchange.pns.transport.webhooks.http.maxConnectionsPerHost The number of connections per route held in HTTP connection pool for communicating with a certain Webhook end-point. Reloadable and config-cascade aware.

• com.openexchange.pns.transport.webhooks.http.connectionTimeout Specifies the timeout in milliseconds until a connection is established to a certain Webhook end-point. Reloadable and config-cascade aware.

• com.openexchange.pns.transport.webhooks.http.socketReadTimeout Specifies the socket timeout in milliseconds, which is the timeout for waiting for data when communicating with a certain Webhook end-point.. Reloadable and config-cascade aware.

Webhook configuration file

Added new configuration file webhooks.yml containing the static configurations for known Webhook end-points. That file is in YAML notation and expects the following structure

 <unique-identifier>:
     uri: <URI>
       String. The URI end-point of the Webhook. May be overridden during subscribe depending on "uriValidationMode".

     uriValidationMode: <uri-validation-mode>
       String. Specifies how the possible client-specified URI for a Webhook end-point is supposed to be validated against the URI
               from configured Webhook end-point. Possible values: `none`, `prefix`, and `exact`. For `none` no requirements given.
               Any client-specified URI is accepted. For `prefix` he client-specified and configured URI for a Webhook end-point are
               required to start with same prefix. For `exact` the client-specified and configured URI for a Webhook end-point are
               required to be exactly the same. `prefix` is default.

     webhookSecret: <webhook-secret>
       String. The value for the "Authorization" HTTP header to pass on calling Webhook's URI. May be overridden during subscribe.

     login: <login>
       String. The login part for HTTP Basic Authentication if no value for the "Authorization" HTTP header is specified. May be overridden during subscribe.

     password: <password>
       String. The password part for HTTP Basic Authentication if no value for the "Authorization" HTTP header is specified. May be overridden during subscribe.

     signatureSecret: <signature-secret>
       String. Specifies shared secret known by caller and Webhook host. Used for signing.

     version: <version>
       Integer. Specifies the version of the Webhook. Used for signing.

     signatureHeaderName: <signature-header-name>
       String. Specifies the name of the signature header that carries the signature.

     maxTimeToLiveMillis: <max-time-to-live>
       Number. The max. time to live in milliseconds for the Webhook before considered as expired. If absent Webhook "lives" forever.

     maxNumberOfSubscriptionsPerUser: <max-number-per-user>
       Number. The max. number of subscriptions for this Webhook allowed for a single user. Equal or less than 0 (zero) means infinite.

     allowSharedUri: <allow-shared-uri>
       Boolean. Whether the same URI can be used by multiple different users or not. Optional, defaults to `true`.

Example

webhooks.yml

mywebhook:
    uri: https://my.endpoint.com:8080/webhook/event
    webhookSecret: supersecret
    signatureSecret: da39a3ee5e6b4b
    version: 1
    signatureHeaderName: X-OX-Signature
    maxTimeToLiveMillis: 2678400000
    maxNumberOfSubscriptionsPerUser: 2
    uriValidationMode: prefix

Database

SCR-1296

Summary: Changed column 'propertyValue' of table 'subadmin_config_properties' to be of type TEXT

Modified Config-DB to have column 'propertyValue' of table 'subadmin_config_properties' to be of type TEXT

New table layout is therefore:

CREATE TABLE subadmin_config_properties (
    sid INT4 UNSIGNED NOT NULL,
    propertyKey VARCHAR(64) CHARACTER SET latin1 NOT NULL DEFAULT '',
    propertyValue TEXT CHARACTER SET latin1 NOT NULL DEFAULT '',
    PRIMARY KEY (sid, propertyKey)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
COLLATE=utf8mb4_unicode_ci;

This database change contains no update task since this is a modification of the Config-DB, which is performed through liquibase framework on node start-up

SCR-1258

Summary: Added column meta to table pns_subscription

Update Task com.openexchange.pns.subscription.storage.groupware.PnsSubscriptionsAddMetaColumTask

Added TEXT column meta to table pns_subscription:

meta TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL

Packaging/Bundles

SCR-1294

Summary: Added new bundle for Config-Cascade implementation

Added new bundle com.openexchange.config.cascade.impl containing Config-Cascade implementation. This separates the API classes from actual implementation and allows less dependencies. That new bundle is added to open-xchange-core package

SCR-1228

Summary: New bundles for Webhooks support

Introduced new bundles for Webhooks support

• com.openexchange.webhooks
• com.openexchange.pns.transport.webhooks

8.17

3rd Party Libraries/License Change

SCR-1275

Summary: Upgraded MySQL Connector for Java

Upgraded MySQL Connector for Java from v8.0.29 to v8.0.33 in OSGi target platform

SCR-1270

Summary: Updated Google Client API libraries

Updated Google Client API libraries

• google-api-client-1.35.1.jar to google-api-client-2.2.0.jar
• google-api-client-appengine-1.35.1.jar to google-api-client-appengine-2.2.0.jar
• google-api-client-gson-1.35.1.jar to google-api-client-gson-2.2.0.jar
• google-api-client-jackson2-1.35.1.jar to google-api-client-jackson2-2.2.0.jar
• google-api-client-protobuf-1.35.1.jar to google-api-client-protobuf-2.2.0.jar
• google-api-client-servlet-1.35.1.jar to google-api-client-servlet-2.2.0.jar

• google-api-client-xml-1.35.1.jar to google-api-client-xml-2.2.0.jar

• google-api-services-calendar-v3-rev20220520-1.32.1.jar to google-api-services-calendar-v3-rev20230602-2.0.0.jar

• google-api-services-drive-v3-rev20220508-1.32.1.jar to google-api-services-drive-v3-rev20230610-2.0.0.jar

• google-api-services-gmail-v1-rev20220404-1.32.1.jar to google-api-services-gmail-v1-rev20230612-2.0.0.jar

• google-api-services-oauth2-v2-rev20200213-1.32.1.jar to google-api-services-oauth2-v2-rev20200213-2.0.0.jar

• google-api-services-people-v1-rev20220531-1.32.1.jar to google-api-services-people-v1-rev20230103-2.0.0.jar

API - HTTP-API

SCR-1232

Summary: Extended updateAttendee call with tranps parameter

To allow per-attendee transparency for a certain event, the HTTP API call updateAttedee was extended by the optional parameter transp. Allowed values for the new parameter are:

TRANSPARENT
OPAQUE

If the transparency is set for a certain attendee, the event transparency for the corresponding event is adjusted implicitly, including all other chronos related calls.

Database

SCR-1264

Summary: Update task to insert missing references into 'filestore2user' table

Update Task com.openexchange.groupware.update.tasks.Filestore2UserUpdateReferencesTask

To ensure the table filestore2user (in config-db) holds all references to users with individual filestores in a groupware schema , a new update task named com.openexchange.groupware.update.tasks.Filestore2UserUpdateReferencesTask is introduced.

API - SOAP

SCR-1280

Summary: Added possibility to manage user sessions through SOAP interface

Added the possibility to manage user sessions through the new OXSessionService SOAP interface

Packaging/Bundles

SCR-1281

Summary: Added new bundle/package to manage sessions via SOAP

Added new bundle com.openexchange.sessiond.soap to manage sessions via SOAP. That new bundle is contained in newly introduced package open-xchange-sessiond-soap

8.16

General

SCR-1252

Summary: Updated Netty NIO libraries

Updated Netty NIO libraries from v4.1.89 to v4.1.94 in bundle io.netty

3rd Party Libraries/License Change

SCR-1256

Summary: Upgraded Javassist Library

Library Javasisst is upgraded to v3.29.2-GA in target platform com.openexchange.bundles and bundle com.openexchange.test.

SCR-1255

Summary: Updated Apache Tika library

Updated Apache Tika library from v2.6.0 to v2.8.0 in bundle com.openexchange.tika.util

SCR-1253

Summary: Updated lettuce library

Updated lettuce library from v6.2.3 to v6.2.5 in bundle io.lettuce

SCR-1247

Summary: Updated pushy library from v0.15.1 to v0.15.2

Updated pushy library from v0.15.1 to v0.15.2 in bundle com.eatthepath.pushy

SCR-1245

Summary: Updated metadata-extractor from v2.17.0 to v2.18.0

Updated 3rd party library metadata-extractor from v2.17.0 to v2.18.0 in bundle com.drew

SCR-1244

Summary: Updated htmlcleaner from v2.22 to v2.29

Updated 3rd party library htmlcleaner from v2.22 to v2.29 in target platform

SCR-1243

Summary: Updated dnsjava from v3.5.1 to v3.5.2

Updated 3rd party library dnsjava from v3.5.1 to v3.5.2 in target platform

SCR-1242

Summary: Updated Apache HttpCore and HttpClient libraries

Updated Apache HttpCore and HttpClient libraries

• Updated HttpCore from v4.4.15 to v4.4.16
• Updated HttpClient from v4.5.13 to v4.5.14

SCR-1234

Summary: Updated Hazelcast Core Module

Updated Hazelcast Core Module from v5.2.1 to v5.3.1

SCR-1231

Summary: Updated OSGi target platform bundles

Updated OSGi target platform bundles

• org.eclipse.osgi.services_3.10.200.v20210723-0643.jar updated to org.eclipse.osgi.services_3.11.100.v20221006-1531.jar
• org.eclipse.osgi.util_3.6.100.v20210723-1119.jar updated to org.eclipse.osgi.util_3.7.200.v20230103-1101.jar
• org.eclipse.osgi_3.18.0.v20220516-2155.jar updated to org.eclipse.osgi_3.18.400.v20230509-2241.jar

Added new OSGi bundles to target platform

Since content of shipped org.eclipse.osgi.services bundle has been changed. Missing classes/interfaces are now contained in separate OSGi bundles.

• Added org.osgi.annotation.bundle_2.0.0.202202082230.jar
• Added org.osgi.annotation.versioning_1.1.2.202109301733.jar
• Added org.osgi.service.cm_1.6.1.202109301733.jar
• Added org.osgi.service.component_1.5.1.202212101352.jar
• Added org.osgi.service.component.annotations_1.5.1.202212101352.jar
• Added org.osgi.service.device_1.1.1.202109301733.jar
• Added org.osgi.service.event_1.4.1.202109301733.jar
• Added org.osgi.service.metatype_1.4.1.202109301733.jar
• Added org.osgi.service.metatype.annotations_1.4.1.202109301733.jar
• Added org.osgi.service.prefs_1.1.2.202109301733.jar
• Added org.osgi.service.provisioning_1.2.0.201505202024.jar
• Added org.osgi.service.repository_1.1.0.201505202024.jar
• Added org.osgi.service.upnp_1.2.1.202109301733.jar
• Added org.osgi.service.useradmin_1.1.1.202109301733.jar
• Added org.osgi.service.wireadmin_1.0.2.202109301733.jar
• Added org.osgi.util.function_1.2.0.202109301733.jar
• Added org.osgi.util.measurement_1.0.2.201802012109.jar
• Added org.osgi.util.position_1.0.1.201505202026.jar
• Added org.osgi.util.promise_1.3.0.202212101352.jar
• Added org.osgi.util.xml_1.0.2.202109301733.jar

API - HTTP-API

SCR-1235

Summary: Introduced a new action to the 'mail' module for exporting mails as PDFs

Introduced the action export_PDF to the mail module.

It is a PUT request and has the following URL parameters:

• folder: defines the mail folder which holds the mail that shall be exported
• id: defines the mail id

The request also accepts a mandatory JSON body with the following attributes:

• folder_id: Defines the drive folder in which the exported PDF/A document will be saved. This option is required.
• pageFormat: Defines the page format of the export document. It can either be a4 (which is the default behaviour) or letter. This option is not required. If absent, the page format will be derived from the user's locale setting (for us or ca the page format will be letter and for anything else a4).
• preferRichText: If this option is enabled then, if an e-mail message contains both text and HTML versions of the body, then the latter is preferred and converted to a PDF/A document before it is appended to the exported PDF/A document. If only the text version is available, and the option is enabled, then the text version is converted to a PDF/A document and appended to the exported PDF/A document. This option is not required and by default is set to true.
• includeExternalImages: If this option is enabled then, and the e-mail contains any external inline images, then those images will be fetched from their respective sources and included to the exported PDF/A document at their supposed positions. This option is not required and is by default false.
• appendAttachmentPreviews: If this option is enabled, then any previewable attachment (i.e., documents and pictures) is converted from their original format, e.g., from docx or tiff, to a PDF/A document and is appended as one or more pages to the exported PDF/A document. This option is not required and is false by default.
• embedAttachmentPreviews: If this option is enabled, then any previewable attachment is converted from their original format to a PDF/A document and is embedded as an attachment to the exported PDF/A document. This option is not required and is false by default.
• embedRawAttachments: If this option is enabled, then all attachments are embedded without further processing to the exported PDF/A document as attachments. This option is not required and is false by default.
• embedNonConvertibleAttachments: If this option is enabled, then all attachments (previewable and non-previewable, i.e., zips, mp4s, etc.) are embedded without further processing to the exported PDF/A document as attachments. This option is not required and is false by default.

Configuration

SCR-1240

Summary: Introduced a new capability to activate the PDF MailExportService

Introduced the capability mail_export_pdf to activate the PDF MailExportService.

SCR-1239

Summary: Introduced new properties for the CollaboraPDFAConverter

Introduced the following properties to configure the `CollaboraPDFAConverter`:

• com.openexchange.mail.exportpdf.pdfa.collabora.enabled: Defines whether the collabora online converter is enabled. Defaults to false
• com.openexchange.mail.exportpdf.pdfa.collabora.url: The Collabora URL to use: Allows to specify a dedicated Collabora service only for PDFA creation. By default is empty and uses the server configured via the property `com.openexchange.mail.exportpdf.collabora.url`.

SCR-1238

Summary: Introduced new properties for the GotenbergMailExportConverter

Introduced the following properties to configure the GotenbergMailExportConverter:

• com.openexchange.mail.exportpdf.gotenberg.enabled: Defines whether the gotenberg online converter is enabled. Defaults to false
• com.openexchange.mail.exportpdf.gotenberg.url: Defines the base URL of the Gotenberg Online server. Defaults to http://localhost:3000
• com.openexchange.mail.exportpdf.gotenberg.fileExtensions: Defines a comma separated list of file extensions that are handled by the gotenberg converter. Defaults to htm, html.
• com.openexchange.mail.exportpdf.gotenberg.pdfFormat: Specifies which PDF format to use. "PDF/A-1a", "PDF/A-2b" and "PDF/A-3b" are supported formats, or "PDF" for regular PDF. Defaults to "PDF"

SCR-1237

Summary: Introduced new properties for the CollaboraMailExportConverter

Introduced the following properties to configure the CollaboraMailExportConverter:

• com.openexchange.mail.exportpdf.collabora.enabled: Defines whether the collabora online converter is enabled. Defaults to false
• com.openexchange.mail.exportpdf.collabora.url: Defines the base URL of the Collabora Online server. Defaults to http://localhost:9980
• com.openexchange.mail.exportpdf.collabora.fileExtensions: Defines a comma separated list of file extensions that are handled by the collabora converter. Defaults to sxw, odt, fodt, sxc, ods, fods, sxi, odp, fodp, sxd, odg, fodg, odc, sxg, odm, stw, ott, otm, stc, ots, sti, otp std, otg, odb, oxt, doc, dot xls, ppt, docx, docm, dotx, dotm, xltx, xltm, xlsx, xlsb, xlsm, pptx, pptm, potx, potm, wpd, pdb, hwp, wps, wri, wk1, cgm, dxf, emf, wmf, cdr, vsd, pub, vss, lrf, gnumeric, mw, numbers, p65, pdf, jpg, jpeg, gif, png, dif, slk, csv, dbf, oth, rtf, txt, html, htm, xml.
• com.openexchange.mail.exportpdf.collabora.imageReplacementMode: Defines the mode on how to handle/replace inline images. Defaults to distributedFile.

SCR-1236

Summary: Introduced new properties for the MailExportService

Introduced the following properties to configure the MailExportService:

• com.openexchange.mail.exportpdf.concurrentExports: Defines the maximum concurrent mail exports that the server is allowed to process. If the limit is reached an error will be returned to the client, advising it to retry again in a while. Defaults to 10. 
• com.openexchange.mail.exportpdf.pageMarginTop: Defines the top margin (in millimeters) of the exported pages. Defaults to 12.7 millimeters (0.5 inches).
• com.openexchange.mail.exportpdf.pageMarginBottom: Defines the bottom margin (in millimeters) of the exported pages. Defaults to 12.7 millimeters (0.5 inches).
• com.openexchange.mail.exportpdf.pageMarginLeft: Defines the left margin (in millimeters) of the exported pages. Defaults to 12.7 millimeters (0.5 inches).
• com.openexchange.mail.exportpdf.pageMarginRight: Defines the right margin (in millimeters) of the exported pages. Defaults to 12.7 millimeters (0.5 inches).
• com.openexchange.mail.exportpdf.headerFontSize: Defines the font size of the exported mail's headers. Defaults to 12 points.
• com.openexchange.mail.exportpdf.bodyFontSize: Defines the font size of the exported mail's body. Defaults to 12 points.
• com.openexchange.mail.exportpdf.autoPageOrientation: Defines whether PDF pages will be auto-oriented in landscape mode whenever a full page appended image is in landscape mode. Defaults to false

Database

SCR-1233

Summary: Update encryption for passwords of anonymous guest users

Update Task com.openexchange.groupware.update.tasks.RecryptGuestUserPasswords

Update encryption for anonymous guest user passwords using newly introduced mechanisms with implicit salt

Table user altered, extend column userPassword from VARCHAR(128) to VARCHAR(512)

8.15

General

SCR-1227

Summary: Enhanced existent SOAP end-points by standard "Scheduled" folder

Enhanced existent SOAP end-points by standard "Scheduled" folder. The folder that holds such E-Mails that are scheduled for being sent at a later time.

To do so, the "User" data object contained in several SOAP end-points has been extended by "mail_folder_scheduled_full_name" element to output/specify the standard "Scheduled" folder.

SCR-1201

Summary: Added separate bundle offering HTTP liveness end-point

Added separate bundle com.openexchange.http.liveness part of open-xchange-core package list that offers the HTTP liveness end-point at configured HTTP host name (default "127.0.0.1") and liveness port (default 8016).

Configuration

SCR-1224

Summary: Add property com.openexchange.log.extensionHttpHeaders

com.openexchange.log.extensionHttpHeaders defines a comma separated list of HTTP headers that shall additionally be logged for incoming requests

Example com.openexchange.log.extensionHttpHeaders=X-custom-Header,X-host

The property is neither reloadable nor ConfigCascade-aware.

Database

SCR-1225

Summary: Added new tables for scheduled mail feature

Added new tables in user database for scheduled mail feature

CREATE TABLE scheduledMail(
 uuid BINARY(16) NOT NULL,
 cid INT4 unsigned NOT NULL,
 user INT4 unsigned NOT NULL,
 dateToSend BIGINT(64) unsigned NOT NULL,
 mailPath TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
 processing BIGINT(64) unsigned NOT NULL DEFAULT 0,
 meta TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
 PRIMARY KEY (uuid),
 KEY id (cid, user, uuid)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci

CREATE TABLE scheduledMailLock(
 cid INT4 unsigned NOT NULL DEFAULT 0,
 user INT4 unsigned NOT NULL DEFAULT 0,
 name VARCHAR(16) CHARACTER SET latin1 COLLATE latin1_general_ci NOT NULL,
 stamp BIGINT(64) unsigned NOT NULL,
 PRIMARY KEY (cid, user, name)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci

SCR-1223

Summary: Update task to add the "claim" column to "calendar_alarm_trigger" table

Update Task com.openexchange.chronos.storage.rdb.groupware.CalendarAlarmTriggerAddClaimColumnTask

Adds the "claim" column to "calendar_alarm_trigger" table

8.14

3rd Party Libraries/License Change

SCR-1219

Summary: Upgraded JSoup library

Upgraded JSoup library in target platform (con.openexchange.bundles) from v1.15.3 to v1.16.1

API - HTTP-API

SCR-1216

Summary: Accept parameter harddelete for composition space's delete end-point

Accept boolean parameter "harddelete" for composition space's delete end-point

DELETE /mailcompose/draft.xyz?harddelete=true

If set to "true" any associated draft message for the denoted composition space gets hard-deleted. That is no copy is created in standard trash folder.

SCR-1213

Summary: New Flag all_others_declined for Events

The "flags" enumeration for events in chronos module of the HTTP API is extended by the value all_others_declined. If set, all other individual attendees in the event have a participation status of declined, which could be used by clients to show a hint that one might be alone in a meeting.

See [https://documentation.open-xchange.com/latest/middleware/calendar/implementation_details.html#event-flags] for further details.

SCR-1198

Summary: New Settings for Free/Busy Visibility in JSlob

The io.ox/calendar JSlob entry is extended by the following item which indicates the free/busy visibility of the user:

{
  "id": "io.ox/calendar",
  "tree": {
    "chronos": {
      "freeBusyVisibility": "all",
    }
  },
  "meta": {
    "chronos": {
      "freeBusyVisibility": {
        "possibleValues": [
          "all",
          "internal-only",
          "none"
        ],
        "configurable": true
      }
    }
  }
}

Within the meta section, clients are able to derive the possible values - the enumeration will only yield the value internal-only if cross-context features are available. Also, the "configurable" flag will indicate whether the property is settable by the user or not.

Configuration

SCR-1220

Summary: Introduce new properties for DAV client matching

Once in a while, vendors like Apple decide to change the User Agents of their products in a way, we don't recognize the matching clients anymore. Thus, the Open Xchange server isn't able to apply special handling for those clients. This leads to subsequent problems and errors.

Until 8.14, the user agent matching was a static, programmatically pre-defined process. For every user agent's change, there needed to be a patch applied. Now, the mechanism is replaced by a more dynamically approach:

Administrators can define regular expressions for the known *DAV clients. In detail, the following properties are added for known *DAV clients:

com.openexchange.dav.useragent.mac_calendar
com.openexchange.dav.useragent.mac_contacts
com.openexchange.dav.useragent.ios
com.openexchange.dav.useragent.ios_reminders
com.openexchange.dav.useragent.thunderbird_lightning
com.openexchange.dav.useragent.thunderbird_cardbook
com.openexchange.dav.useragent.em_client
com.openexchange.dav.useragent.ox_sync
com.openexchange.dav.useragent.caldav_sync
com.openexchange.dav.useragent.carddav_sync
com.openexchange.dav.useragent.smooth_sync
com.openexchange.dav.useragent.davdroid
com.openexchange.dav.useragent.davx5
com.openexchange.dav.useragent.outlook_caldav_synchronizer
com.openexchange.dav.useragent.windows_phone
com.openexchange.dav.useragent.windwos

All properties have pre-defined default values and are reloadable.

SCR-1218

Summary: New config option for sanitizing CSV cell content on contact export

New lean config option "com.openexchange.export.csv.sanitize" for sanitizing CSV cell content on contact export. Default is false. Reloadable, but not config-cascade aware

SCR-1217

Summary: New property to limit number of considered filestore candidates

New lean property com.openexchange.admin.limitFilestoreCandidates to limit number of considered filestore candidates to a reasonable amount when determining the filestore to use for a new context/user. Neither reloadable, nor config-cascade aware. Default is 100.

SCR-1215

Summary: Accept specifying a max. running time that must not be exceeded by execution of an individual health check

Accept new lean property for specifying a max. running time that must not be exceeded by execution of an individual health check

• com.openexchange.health.maxRunningTimeSeconds The max. allowed running time in seconds for an individual health check. It a check's execution is canceled if it exceeds that running time. A value of equal to or less than zero 0 (zero) ignores this setting. Default is 5. Reloadbale, but not config-cascade aware.

SCR-1197

Summary: New Properties for Free/Busy Visibility

In order to define the default free/busy visibility setting of users, and to control whether it is changeable by end users, the following new lean configuration properties are introduced:

• com.openexchange.calendar.freeBusyVisibility.default=all: Defines the default free/busy visibility setting to assume unless overridden by the user. Possible values are:
  • none to not expose a user's availability to others at all
  • internal-only to make the free/busy data available to other users within the same context
  • all to expose availability data also beyond context boundaries (i.e. for cross-context- or other external access if configured)
• com.openexchange.calendar.freeBusyVisibility.protected=false: Configures if the default value that determines if public calendar folders from the default account are considered for synchronization may be overridden by the user or not.

More details are available at [https://documentation.open-xchange.com/components/middleware/config/latest/#mode=search&term=com.openexchange.calendar.freeBusyVisibility] .

8.13

General

SCR-1201

Summary: Added separate bundle offering HTTP liveness end-point

Added separate bundle com.openexchange.http.liveness part of open-xchange-core package list that offers the HTTP liveness end-point at configured HTTP host name (default "127.0.0.1") and liveness port (default 8016).

API - HTTP-API

SCR-1183

Summary: Deprecate delivery=view and content_disposition=inline options in HTTP API

The parameter options delivery=view and content_disposition=inline and the possibility to let the client define the content type of documents and attachments, can be used to inject executable scripts into data that is rendered in browsers. This lead to several bugs in the past. Therefore the usage of those options is deprecated and will be removed.

API - RMI

SCR-1207

Summary: Additional parameter 'auth' for data modification RMI services.

The following registered RMI services now require auth parameters for data modification interfaces. The parameter com.openexchange.auth.Credentials auth needs to be provided.

DBMigrationRMIService
OXContextGroup
RemoteAdvertisementService
ExternalAccountRMIService
RemoteCompositionSpaceService
SocketLoggerRMIService
LoginCounterRMIService
GABRestorerRMIService
SessiondRMIService
ChronosRMIService
ContactStorageRMIService
DataExportRMIService
ConsistencyRMIService
ContextRMIService
FileChecksumsRMIService
ResourceCacheRMIService
ShareRMIService
PushRMIService
UpdateTaskRMIService
LogbackConfigurationRMIService -> java.lang.String user, java.lang.String password

Behavioral Changes

SCR-1208

Summary: Deprecation of Internal OAuth Authorization Server

Certain APIs of the App Suite middleware can be accessed via OAuth 2.0. In this scenario, the middleware typically acts as resource server only, and the whole client- / grant management is done by an external IDM acting as authorization server. See [the documentation|https://documentation.open-xchange.com/latest/middleware/login_and_sessions/oauth_2.0_provider/01_operator_guide.html] for further details.

Mainly as demo/showcase, it has also been possible to configure the middleware to act as OAuth authorization server itself, with integrated client- and grant management. Since this never was or meant to be used in production, this part of the OAuth provider is now deprecated, and will be removed in an upcoming version.

In practical terms, this means that the setting auth_server for [com.openexchange.oauth.provider.mode|https://documentation.open-xchange.com/components/middleware/config/latest/#mode=search&term=com.openexchange.oauth.provider.mode] will no longer be available, along with dependent features and functionality.

Configuration

SCR-1203

Summary: New property com.openexchange.share.guestEmailCheckRegex

In order to prevent creation of guest users with certain email addresses, a new lean configuration property com.openexchange.share.guestEmailCheckRegex is introduced. The property is empty by default, reloadable and config-cascade aware.

It allows the definition of a regular expression pattern for email addresses of invited guest users. If defined, the email address of newly invited named guest users must additionally match the pattern (besides regular RFC 822 syntax checks, which are always performed), otherwise creation of the guest user is denied. The pattern is used in a case-insensitive manner.

This may be used to prevent specific email address domains for guests, e.g. by defining a pattern like

^((?!(?:@example\.com\s*$)|(?:@example\.org\s*$)).)*$

See https://documentation.open-xchange.com/components/middleware/config/latest/#mode=search&term=com.openexchange.share.guestEmailCheckRegex for further details.

SCR-1191

Summary: New property to control format of internal scheduling mails

In order to control whether scheduling-related notification mails to other internal entities are sent as regular iMIP message (including iCalendar attachment) or not, a new lean configuration property named com.openexchange.calendar.useIMipForInternalUsers is introduced. It defaults to false, is reloadable, and can be set through the config-cascade down to "context" level.

Since automatic scheduling takes place within a context, attendee and organizer copies of appointments are in sync implicitly, and updates don't need to be distributed via iMIP. However, still enabling iMIP mails (in favor of notification messages only) also for internal users may be useful if external client applications are in use, or to ease forwarding invitations to others.

SCR-1158

Summary: Disable mail push implementations by default, made existing properties reloadable

Changed default value for enabled properties for mail push features to false: * com.openexchange.push.dovecot.enabled * com.openexchange.push.imapidle.enabled * com.openexchange.push.mail.notify.enabled * com.openexchange.push.malpoll.enabled

Refactored mail push configuration, now all existing mail push related properties are lean and reloadable: * com.openexchange.push.dovecot.* * com.openexchange.push.imapidle.* * com.openexchange.push.mail.notify.* * com.openexchange.push.malpoll.*

Database

SCR-1186

Summary: New column uuid for table server in Config-DB

Update Task 8.12:server:addUuidColumn / com.openexchange.database.internal.change.custom.ServerAddUuidColumnCustomTaskChange

The table server in the config database will get extended by a new column named uuid with the following column definition:

`uuid` BINARY(16) NOT NULL

This will happen through the Liquibase change set with id "8.12:server:addUuidColumn", using the custom change implemented in class com.openexchange.database.internal.change.custom.ServerAddUuidColumnCustomTaskChange.

8.12

General

SCR-1195

Summary: New default value for com.openexchange.sessiond.maxSession property

With introduction of Redis-backed session storage the property com.openexchange.sessiond.maxSession specifying the max. allowed number of sessions becomes obsolete. That pretty old property's intention is to avoid memory problems on Middleware nodes hosting sessions node-local in memory. That is no more the case with Redis.

Hence, the old default value of "50000" for that property is changed to "0" (unlimited) in file /opt/open-xchange/etc/sessiond.properties.

API - HTTP-API

SCR-1200

Summary: Extended the mailfilter?action=config response to include blocked action commands for the apply action

To allow a client to disable the apply button for filter rules with blocked action commands, the response of the action=config call has been extended so that the options object now contains a 'blockedApplyActions' field which contains a string array of all the blocked actions.

Configuration

SCR-1199

Summary: Introduced the new lean property 'com.openexchange.mail.filter.options.apply.blockedActions' which allows to block certain mail filter actions from the apply action

Introduced the new lean property 'com.openexchange.mail.filter.options.apply.blockedActions' which defaults to "redirect". This property accepts a comma separated lists of mail filter actions which will be denied from the apply mail filter action. This helps, for example, to prevent that a message delivery system is overwhelmed by a lot of simultanous redirect actions.

SCR-1120

Summary: Allow enforcing 'STARTTLS' for IMAP, POP3, SMTP, sieve

Added a few lean properties to enforce usage of STARTTLS.

IMAP related properties: com.openexchange.imap.requireTls com.openexchange.imap.primary.requireTls

POP3 related properties com.openexchange.pop3.requireTls

SMTP related properties: com.openexchange.smtp.requireTls com.openexchange.smtp.primary.requireTls

Sieve related properties: com.openexchange.mail.filter.requireTls

All properties are reloadable and config-cascade aware. All properties default to true

8.11

API - Java

SCR-1145

Summary: Refactored CardDAV to use IDBasedContactsAccess

Interfaces changed due to refactoring CardDAV to use IDBasedContactsAccess

Added methods in com.openexchange.contact.provider.composition.IDBasedContactsAccess: Map<String, UpdatesResult<Contact>> getUpdatedContacts(List<String>, Date) - Gets lists of new and updated as well as deleted contacts since a specific timestamp in certain folders Map<String, SequenceResult> getSequenceNumbers(List<String>) - Gets the sequence numbers of certain contacts folders, which is the highest timestamp of all contained items String getCTag(String) - Retrieves the CTag (Collection Entity Tag) for a folder

Added methods in com.openexchange.contact.provider.folder.FolderSyncAware: Map<String, UpdatesResult<Contact>> getUpdatedContacts(List<String>, Date) - Gets lists of new and updated as well as deleted contacts since a specific timestamp in certain folders Map<String, SequenceResult> getSequenceNumbers(List<String>) - Gets the sequence numbers of certain contacts folders, which is the highest timestamp of all contained items

Behavioral Changes

SCR-1146

Summary: External contacts providers are now synced via CardDAV

External contacts providers are now synced via CardDAV after refactoring to use IDBasedContactsAccess

Configuration

SCR-1193

Summary: New Property "com.openexchange.admin.autoDeleteGuestsUsingFilestore"

In case a per-user filestore is associated to a guest user, and the "parent" user owning this filestore is deleted, the guest account is purged implicitly as well by default. In order to prevent that, a new lean, reloadable and config-cascade-aware property is introduced: com.openexchange.admin.autoDeleteGuestsUsingFilestore.

See https://documentation.open-xchange.com/components/middleware/config/latest/#mode=search&term=com.openexchange.admin.autoDeleteGuestsUsingFilestore for further details.

SCR-1190

Summary: Specify a timeout when reading responses from IMAP server after a command has been issued

Added new lean property "com.openexchange.imap.readResponsesTimeout" accepting to define a timeout in milliseconds when reading responses from IMAP server after a command has been issued. That timeout does only apply to subscribed (not provisioned) IMAP accounts; neither primary nor secondary ones.

Default value is 60000 (one minute). A value equal to zero is infinite timeout. Reloadable and config-cascade aware.

SCR-1189

Summary: Option to enable/disable usage of XCLIENT sieve extension

Added new lean configuration option "com.openexchange.mail.filter.allowXCLIENT" to explicitly enable (or disable) usage of the XCLIENT sieve extension. When a sieve server announces support for the XCLIENT command, a sieve client may send information that overrides one or more client-related session attributes.

Default is false (not enabled). Reloadable and config-cascade aware.

SCR-1188

Summary: Introduced a new lean property which allows to omit certain labels

Introduced the new lean property: com.openexchange.http.metrics.label.filter which allows to omit certain labels from http api metrics.

Packaging/Bundles

SCR-1184

Summary: Removed com.openexchange.hazelcast.upgrade* bundles

The following upgrade bundles are no longer needed in cloud environments after we introduced the new pre-upgrade framework (MW-1785): * com.openexchange.hazelcast.upgrade324 * com.openexchange.hazelcast.upgrade312 * com.openexchange.hazelcast.upgrade355 * com.openexchange.hazelcast.upgrade371 * com.openexchange.hazelcast.upgrade311 * com.openexchange.hazelcast.upgrade381 * com.openexchange.hazelcast.upgrade411 * com.openexchange.hazelcast.upgrade3100

Corresponding package definitions have been removed as well: * open-xchange-cluster-upgrade-from-76x * open-xchange-cluster-upgrade-from-780-782 * open-xchange-cluster-upgrade-from-783 * open-xchange-cluster-upgrade-from-784 * open-xchange-cluster-upgrade-from-7100-7101 * open-xchange-cluster-upgrade-from-7102 * open-xchange-cluster-upgrade-from-7103-7104 * open-xchange-cluster-upgrade-from-7105

8.10

3rd Party Libraries/License Change

SCR-1139

Summary: Upgraded Socket.IO server components

Upgraded Socket.IO server components in bundle "com.openexchange.socketio" to support Engine.IO v4 and Socket.IO v3

• engine.io-server-1.3.5.jar --> engine.io-server-6.1.0.jar
• socket.io-server-1.0.3.jar --> socket.io-server-4.0.1.jar

API - HTTP-API

SCR-1180

Summary: Allow adding attachments from other mails during mail composition

The addAttachment action from the module mailcompose of the HTTP API is extended with an additional "origin" within the existing JSON form field of the multipart/form-data payload.

By specifying "mail" as "origin" the client is allowed to add a file attachment from an existing mail message to the composition space

Example:

POST /mailcompose?action=addAttachment
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryyhuRsdTCa7hO6MJ4

------WebKitFormBoundaryyhuRsdTCa7hO6MJ4
Content-Disposition: form-data; name="contentDisposition"

ATTACHMENT
------WebKitFormBoundaryyhuRsdTCa7hO6MJ4
Content-Disposition: form-data; name="JSON"

{"origin":"mail", "id":"40", "folderId":"default0/INBOX", "attachmentId":"2"}
------WebKitFormBoundaryyhuRsdTCa7hO6MJ4--

SCR-1166

Summary: New action "getRecurrence" in Module "chronos"

In order to supply clients with information whether a change exception is considered as rescheduled or overridden, the new action getRecurrence is introduced in the chronos module of the HTTP API. Prior chosing whether the whole series or just the actual recurrence should be changed by an update operation, this action can be performed to get all necessary information.

Further details are available at https://documentation.open-xchange.com/components/middleware/http/latest/index.html#!Chronos/getRecurrence .

SCR-1162

Summary: New Parameter "includeDelegates" for Action "needsAction" in Module "chronos"

The needsAction action in the module chronos of the HTTP API is extended by the new URL parameter indludeDelegates.

If set to true, an enhanced response is returned which includes the events needing action of the session user itself, along with the data for other attendees the user has delegate scheduling permissions for. This includes both resource attendees where the user may act as booking delegate for, as well as other attendees where the user has a shared calendar with write access. If the parameter is set to false, only events for the current user are included in the response.

Whenever the parameter is set, an enhanced response in form of an array will be returned, where each element lists the attendee, together with the corresponding events needing action for that attendee. As before, for series events, overridden instances that are not considered as re-scheduled are hidden implicitly in the results. For backwards compatibility reasons, if the parameter includeDelegates is not set in the request, the previous, 'flat' response is returned to clients for the time being.

Further details are available at https://documentation.open-xchange.com/components/middleware/http/latest/index.html#!Chronos/getEventsNeedingAction .

SCR-1154

Summary: Extended resource model with scheduling privileges

In order to store scheduling privileges for resources of users and groups, the resource object of the HTTP API is extended with an array holding scheduling privileges per user names permissions. Each array element holds a scheduling privilege object which has the following properties: * entity, integer: Internal identifier of the user or group to which this permission applies. * group, boolean: Set true if entity refers to a group, false if it refers to a user * privilege, string: One of ** none - No privileges to book the resource ** ask_to_book - May submit a request to book the resource if it is available ** book_directly - May book the resource directly if it is available ** delegate - Act as delegate of the resource and manage bookings

Additionally, the read-only field own_privilege is introduced for resource objects, which indicates which effective privileges apply for the requesting user.

More details are available at https://documentation.open-xchange.com/components/middleware/http/latest/index.html#!Resources

API - Java

SCR-1170

Summary: Removed publication of TextXtractService and changed interface IMailMessageStorage

The use of Apache Tika within the Open-Xchange server was reduced to a possible minimum. 

As a result there is no need to keep the publication of 'TextXtractService'. All implementations and the interface will be removed. There was no need to adapt the usage as it just was used in obsolete code.

The last java related change was the removal of the following method from IMailMessageStorage: 

'public String[] getPrimaryContents(String folder, String[] mailIds) throws OXException;'

SCR-1167

Summary: New method "getRecurrenceInfo" within Chronos Stack

In order to drive the new action getRecurrence of the HTTP API, the Chronos stack is extended with a corresponding method with the following signature:

RecurrenceInfo getRecurrenceInfo(EventID eventID) throws OXException;

Implementations are available for the default internal, as well as the cross-context provider.

SCR-1163

Summary: Adjusted Signature of "getEventsNeedingAction" Method throughout Chronos Stack

The method #getEventsNeedingAction is adjusted throughout the calendar stack, which includes the compositing layer, as well as the interfaces of the implementing services. A new boolean method parameter named includeDelegates is introduced, and the method response type is now a Map associating Attendee s to their EventsResult s.

API - SOAP

SCR-1161

Summary: Extended SOAP provisioning interface for managed resources

The resource object for SOAP webservices OXResourceServicePortType and OXResellerResourceServicePortType have been extended for provisioning managed resources. The resource object has now additional permissions parameter:

<xsd:permissions>
   <xsd:entity>2</xsd:entity>
   <xsd:group>0</xsd:group>
   <xsd:privilege>book_directly</xsd:privilege>
</xsd:permissions>

-Also SOAP webservices OXResourceServicePortType and OXResellerResourceServicePortType got new operation removePermissions- Permissions are removed by not mentioning them in resource object

Behavioral Changes

SCR-1160

Summary: Removed direct link from notification mails

Within the internal notification mails for calendar events, there were direct links pointing to the appointment and (if those existed) for their attachments, for a quicker access.

Those direct links however are static and might be, shortly after the generation, out of date. For example, a user only had to move the appointment to a different calendar and the static link in the notification mail doesn't lead anywhere.

Further, the UI requests, renders and links the current event data on notification mails dynamically, efficiently solving the problem the direct links were created for much better. Thus, there is no need for the direct links anymore.

Configuration

SCR-1181

Summary: New Properties to Control 'used-for-sync" Behavior of Calendar Folders

In order to control whether public or shared calendar folders are considered for synchronization via CalDAV by default or not, the following new lean configuration properties are introduced with the indicated defaults:

# Configures if shared calendar folders from the default account are considered for 
# synchronization by default or not. May still be set individually by the end user 
# unless also marked as protected.
com.openexchange.calendar.usedForSync.shared.default=true

# Configures if the default value that determines if shared calendar folders from the 
# default account are considered for synchronization may be overridden by the user or not.
com.openexchange.calendar.usedForSync.shared.protected=false

# Configures if public calendar folders from the default account are considered for 
# synchronization by default or not. May still be set individually by the end user 
# unless also marked as protected.
com.openexchange.calendar.usedForSync.public.default=true

# Configures if the default value that determines if public calendar folders from the 
# default account are considered for synchronization may be overridden by the user or not. 
com.openexchange.calendar.usedForSync.public.protected=false

All properties are reloadable and can be configured through the config cascade. With the implicit defaults, no existing semantics are changed, i.e. all shared/public folders of the default account continue to be used for sync by default, overridable by end users.

More details are available at [https://documentation.open-xchange.com/components/middleware/config/latest/#mode=search&term=com.openexchange.calendar.usedForSync] .

SCR-1148

Summary: Allow using multiple services for password-change functionality

Since we now allow different PasswordChangeServices to be used in parallel, we must have some configuration that enables or disables certain services for certain context/users. Therefore, the following properties were introduced:

com.openexchange.passwordchange.script.enabled=false
com.openexchange.passwordchange.db.enabled=false

The database based password change is disabled by default, reflecting the status before the code changes. In older versions you had to actively install the packages.

SCR-1142

Summary: Helm: Configuration of sensitive mandatory properties

With MW-1814 we removed the default values for some sensitive properties. As some of those properties are still mandatory, we have updated the ox-common chart to generate secure random values, if no values have been specified (MW-1830). Those values are stored in a k8s secret called <RELEASE>-common-env and will be used by multiple charts/services (e.g. core-mw, core-imageconverter, ...).

The following properties are affected:

com.openexchange.cookie.hash.salt
com.openexchange.share.cryptKey
com.openexchange.sessiond.encryptionKey

From now on, administrators should set those properties in the global section of the deployment's values.yaml file.

Example:

global:
  core:
    cookieHashSalt: "KtLUTLKZrbXvCAOn"
    shareCryptKey: "lJZEFPzUYfapWbXL"
    sessiondEncryptionKey: "auw948cz,spdfgibcsp9e8ri+<#qawcghgifzign7c6gnrns9oysoeivn"

This will create the following k8s secret:

apiVersion: v1
kind: Secret
metadata:
  name: <RELEASE>-common-env
  namespace: <RELEASE>
  annotations:
    helm.sh/resource-policy: "keep"
  labels:
    helm.sh/chart: ox-common-1.0.22
data:
  COOKIE_HASH_SALT: cHlDN3p5RU1kZ0FmT3Znag==
  SHARE_CRYPT_KEY: Ujk5RFFVUGd4TWox
  SESSIOND_ENCRYPTION_KEY: eTY2cGk4azdXdFNpZ1BzTkJhVVIwWm9rN1lHM0M1YTZGVGZLenJkRWd5eVlwMGRuVjVtWjloSDFJUw==

Those environment variables will then be injected into the service containers and written into the relevant .properties files by the individual charts.

Packaging/Bundles

SCR-1182

Summary: Upgraded logback-extensions to 2.1.4

The logback-extensions library was upgraded to version 2.1.4 which includes some previously missing fields in the json logger.

SCR-1171

Summary: Removed bundles com.openexchange.textxtraction and org.apache.tika

The use of Apache Tika within the Open-Xchange server was reduced to a possible minimum. As a result the bundles org.apache.tika and com.openexchange.textxtraction will be removed.

SCR-1147

Summary: Allow multiple services for password-change functionality

With the new version 8.x of the Open Xchange App Suite we moved from package based installations to Docker/Kubernetes. For this, we need to be able to install all packages in parallel within the images we deliver. The different password change implementations however were conflicting. Therefore, we removed those packages and restructured the code.

Removed packages:

open-xchange-passwordchange-database
open-xchange-passwordchange-script

Removed bundles:

com.openexchange.passwordchange.database
com.openexchange.passwordchange.script

Added bundles:

com.openexchange.passwordchange
com.openexchange.passwordchange.common
com.openexchange.passwordchange.impl

The added bundles are now delivered within the open-xchange-core package

The property files change_pwd_script.properties and passwordchange.properties were moved to the bundle com.openexchange.passwordchange.impl alongside the restructuring.