8.55 deprecated

App Suite middleware 8.55.481 was released on October 29, 2026. It brings 59 new features, 101 improvements and 115 fixes (8.55.481 to 8.55.489), recorded in 194 software change requests.

This page covers the middleware only. Features that need a switch are marked ⚙: they stay off until an administrator enables a package, a capability or a property.

Highlights

Mobile API for native mail apps ⚙

Native mail apps get a complete REST interface at /mobile/v1: sign-in with a second factor, folders, message lists, conversations and search, reading and sending mail, drafts and uploads, changes of many messages at once, push subscriptions for APNs and FCM, live events as server-sent events, and up to 20 operations in one batch request. Metrics, dashboard panels and alerts cover the API and its push deliveries.

External authentication ⚙

A dedicated authentication service checks every sign-in. The middleware resolves each request from the JWT that service issues and keeps no sessions of its own: login, session management and share links are handled by the external service. Actions that need a recent sign-in answer with a step-up response based on the authentication context class (ACR), so clients can ask the user to authenticate again. Multifactor authentication moved into a bundle of its own, and the OX Guard client stores its tokens in Cassandra.

  • Availability Since 8.55
  • Enable com.openexchange.external.authentication.enabled; personal access tokens are switched off while it is enabled
  • Changes SCR-2063 to SCR-2069, SCR-2164, SCR-2182

Self-service account recovery ⚙

Users who forgot their password ask for a single-use reset link by mail or SMS, using their recovery address, primary address or an alias. The answer never reveals whether an address exists. Administrators maintain the recovery details through RMI, SOAP and the command-line tools, and can change passwords through the database or a webhook.

  • Availability Since 8.55
  • Enable Package open-xchange-account-recovery and com.openexchange.accountrecovery.enabled=true; the core-mw chart keeps it off by default
  • Read more Account recovery
  • Changes SCR-2193 to SCR-2201

Deputies who send as the granting user ⚙

A user can let a deputy send mail as them: the granting user is the sender, and the mail carries no Sender header. The new permission is available through the HTTP API, RMI, gRPC, SOAP and SCIM.

New features by area

Mail and shared accounts

  • Who holds a shared account. The holders of a shared account can see who else has access, through sharedaccount?action=permissions and the capability listPermissions. SCR-2043
  • Sign in to shared and secondary accounts with the acting user's credentials ⚙, also via SASL PLAIN, with separate settings for mail and mail filter. SCR-2131, SCR-2151, SCR-2185
  • Administrative mail access and mail filter administration ⚙. The provisioning service MailFilterAdminService manages a user's mail filter rules. SCR-2023 to SCR-2025
  • Background mail access for OpenID Connect users ⚙. Users allow it once; scheduled and snoozed mail then work without master authentication or a token exchange. SCR-2191, SCR-2192
  • Access tokens reach the user's other mail accounts with the scope mail_external. SCR-2101, SCR-2102
  • Mail identity of a fetched mail in the HTTP API. SCR-2156

  • POP3 synchronization is limited per user and in duration. SCR-2163

  • Availability Since 8.55

Calendar and contacts

  • Calendar trash ⚙. Deleted appointments go to a trash folder and can be restored. SCR-1871 to SCR-1873
  • Preconfigured iCal subscriptions ⚙. Public holidays or a canteen menu, defined once and provisioned to all users they are enabled for. Read more · SCR-2036
  • Default reminders for iCal attachments saved from a mail. SCR-2155
  • Address books shared across contexts ⚙, like calendars and mail folders, also over CardDAV. Read more · SCR-2059 to SCR-2061
  • Contacts deleted from shared folders go to the owner's trash. SCR-2015

  • LDAP contacts provider refreshes its cache in the background. SCR-2051

  • Availability Since 8.55

Drive and files

  • Default file storage ⚙. Administrators choose which storage a user's new files go to, for example OpenCloud. Drive Mail and saved attachments land there, and folders?action=home, public and sharedWithMe as well as the virtual folder drive://0/ show all storages side by side. Read more · SCR-2157 to SCR-2161, SCR-2186, SCR-2187

  • Availability Since 8.55

Notifications and push

  • Web Push for the App Suite UI. Notifications reach the browser through Web Push and server-sent events, also when they are removed again. SCR-2114, SCR-2115, SCR-2121 to SCR-2123

  • Availability Since 8.55

AI assistants (MCP) ⚙

  • Write tools for appointments, reminders, tasks, contacts, mail, the vacation notice, mail filter rules and Drive. Every change is previewed and written only after the user confirms it. SCR-2054, SCR-2055, SCR-2070, SCR-2073, SCR-2176

  • Built-in OAuth authorization server, an activity log, a daily briefing, links back into App Suite and the text of PDF and office documents. SCR-2071 to SCR-2079, SCR-2084, SCR-2091, SCR-2092

  • Availability Since 8.55; the read-only MCP server arrived in 8.54

  • Read more MCP server, MCP clients

Authentication and security

  • OpenID Connect: PKCE, pushed authorization requests, binding a login to the initiating browser, a configurable lifetime for pending logins, a restart for unknown or expired states, and token revocation without an ID token. SCR-2008, SCR-2009, SCR-2085, SCR-2103, SCR-2204, SCR-2205
  • Personal access tokens can be restricted to folders and are rotated. Read more · SCR-2082, SCR-2083, SCR-2165
  • Composition spaces in the database or file storage are encrypted with AES/GCM and a random IV. SCR-2050
  • Requests to user-supplied URLs check every address of the target host. SCR-2090
  • Session encryption key can be changed without losing sessions; Argon2 key derivations are bounded. SCR-2093, SCR-2130
  • SMS via sipgate with a personal access token. SCR-2139

  • Weakforced connector sends session attributes and the requested host name. SCR-2189, SCR-2190

  • Availability Since 8.55

Provisioning and administration

  • Administrative data exports, e.g. for an authority, through RMI, the command-line tools submitdataexport and downloaddataexport, and the provisioning HTTP gateway. SCR-2177 to SCR-2181
  • Kept mail credentials can be searched, repaired, refreshed and pooled through MailCredentialAdminService and RMI. Read more · SCR-2098, SCR-2106, SCR-2107, SCR-2141, SCR-2142, SCR-2210, SCR-2211

  • Mail login kept inside the context ⚙. SCR-2034

  • Availability Since 8.55

Operations

  • Nodes that come and go, e.g. on Kubernetes: a shared upload directory, unfinished update tasks taken over by another node, slow clients kept connected while a node drains, and a Go entrypoint that forwards termination signals. Read more · SCR-2137, SCR-2149
  • Mail credential vault got more than 20 hardening changes: it keeps idle OAuth tokens alive, repairs rejected credentials, survives an unavailable session storage and reports cluster-wide metrics. SCR-2086 to SCR-2135

  • IMAP store cache with adaptive idle time and metrics; Sieve capabilities are kept for a configurable time. SCR-2153, SCR-2206

  • Availability Since 8.55

Before you upgrade

These changes need a look before or after the upgrade, because existing setups, scripts or clients may notice them.

Change What to do SCR
Users with the viewer or editor permission set of a shared account can no longer move, delete or archive its mails, expunge or clear its folders, or copy mails into it. Check the permission sets of your shared accounts. SCR-2212
Changing the IMAP subscriptions of a shared account requires the new capability manageImapSubscriptions. Grant it to the users who manage the visible folders. SCR-2166
An omitted module in setSharedAccountPermissions now falls back to the default permission set instead of removing the module. Review provisioning scripts that relied on omitting a module. SCR-2167
RMI methods that checked no credentials now require administrator credentials: the status methods of DBMigrationRMIService, the list methods of ExternalAccountRMIService and the read methods of DataExportRMIService. The tools listexternalaccounts, deleteexternalaccounts, listdataexports and dataexportconsistency check them as well. Pass valid credentials in scripts and RMI clients; context-level calls take the context administrator. SCR-2177, SCR-2178, SCR-2184, SCR-2209
CalDAV and CardDAV no longer accept * instead of @ in login names. Switch old clients to the regular login name. SCR-2154
An invalid com.openexchange.net.ssl.trustlevel falls back to restricted, and missing trust stores no longer mean trusting every certificate. The SSL white-list no longer exempts connections tunneled through a white-listed proxy, but now also skips host name verification for white-listed hosts. Check the SSL settings of Redis, S3, JMAP, Cassandra and proxied mail connections. SCR-2040, SCR-2047, SCR-2162
Composition spaces kept in the database or file storage with encryption enabled are written with AES/GCM. Nodes on 8.46 to 8.54 read the new format only from the patch release that contains this change. In mixed-version clusters, update older nodes to that patch release first. The default draft-based storage is not affected. SCR-2050
SMTP uses pipelining and plain DATA by default. Set com.openexchange.smtp.enablePipelining=false if a mail server misbehaves. SCR-2152
The default MCP instructions no longer call the server read-only. Review your own text before enabling MCP write tools. SCR-2056
Undo periods requested by clients are capped at five minutes. Raise com.openexchange.undo.maxTimeToLive if you need longer. SCR-2202
Drive Mail stores attachments in the user's default file storage; with OpenCloud or Nextcloud the storage's own sharing links are used. Check Drive Mail if you configure a non-default file storage. SCR-2159
The core-mw chart exposes the data export service on the provisioning HTTP gateway by default. Remove it from provisioningGateway.services if you do not want it. SCR-2179
A local time in the repeated hour at the end of daylight saving time now means its first occurrence, as RFC 5545 requires. None; affected appointments move by one hour. SCR-2207
Dropping a delete exception date of a series asks the attendees again for that date. None. SCR-2183
Plugins: DBPool moved to com.openexchange.server.database, and RestrictedAction uses an ACR check instead of scope flags. Adjust imports, Import-Package and custom restricted actions. SCR-2068, SCR-2175

Under the hood

Many improvements never show up as a feature. Measured locally before and after, under the same load:

  • Opening a mail with 150 parts takes 7 instead of 91 IMAP commands.
  • Moving a tree of 52 folders takes 94 instead of 152 IMAP commands and 313 instead of 521 ms.
  • Loading mail conversations needs 56 % less CPU per request; listing all appointments 22 % less memory and 14 % less CPU.
  • Moving and permanently deleting mail saves two round trips to the mail server each.
  • Drafts are saved with a single IMAP REPLACE, leaving unchanged attachments on the server.
  • The middleware starts faster: the bundle list is built in linear time and the user agent database loads on first use.
  • Mail HTML and MIME headers are scanned without regular expressions on hot paths, in linear time. SCR-2208
  • A new index on login2user stops reading every row of a context. SCR-2203

Libraries

Grizzly 5.0.3, Jetty 12.1.14, Apache Kafka 4.3.1, fabric8 Kubernetes client 8.0.0, Tika 4.1.0, Guava 33.7.2 and many patch and minor upgrades. The unused libraries eddsa, cose-java and nekohtml are gone.