App Suite Middleware

8.48.118

General

SCR-1793

Summary: Redis connector: per-node client name, max. connection lifetime, deterministic shutdown

Hardening of the Redis connector against stale / orphaned connected clients.

New configuration option:

com.openexchange.redis.connection.pool.maxLifetimeSeconds Maximum lifetime in seconds of a pooled Redis connection. Once a connection exceeds this age it is proactively recycled by the connection-pool cleaner as soon as it becomes idle, regardless of usage; this applies to both the shared and the dedicated pool. Acts as defense-in-depth against slowly accumulating or long-lived stale connections that TCP keepalive cannot reap (a live-but-idle connection is never detected as dead). A value of 0 (zero) disables max. lifetime recycling. Default 3600 (one hour). Not reloadable, not config.cascade aware. Package: open-xchange-core.

Behavioral changes (no configuration):

Client name: the announced Redis client name now includes the local host / pod name (e.g. Open-Xchange-Redis-Connector-v8.53.0-<host>), so connections become attributable per node via Redis CLIENT LIST. This is what lets operators tell restart orphans (dead pod addresses) apart from live-node connections.
Deterministic shutdown: the shared connection pool now closes its connections synchronously on shutdown, so Redis reclaims the clients immediately on a graceful (rolling) restart instead of leaving them as ghosts.

8.48.102

Database

SCR-1709

Summary: Enlarge the "meta" column from BLOB to MEDIUMBLOB for the "oxfolder_tree" and "del_oxfolder_tree" tables

Added new update task com.openexchange.groupware.update.tasks.EnlargeMetaForOXFolderTablesTask enlarging the "meta" column from BLOB to MEDIUMBLOB for the "oxfolder_tree" and "del_oxfolder_tree" tables

8.48.80

CLT

SCR-1691

Summary: Added command-line tools for mail signatures

Added the following command-line tools for mail signatures

usage: listsignatures -c <contextId> -u <userId> -A <masterAdmin | contextAdmin> -P <masterAdminPassword |
                      contextAdminPassword> [-p <RMI-Port>] [-s <RMI-Server] [--responsetimeout <responseTimeout>] |
                      [-h]
 -A,--adminuser <adminUser>       Admin username
 -c,--context <contextId>         The context identifier
 -h,--help                        Prints this help text
 -p,--port <rmiPort>              The optional RMI port (default:1099)
 -P,--adminpass <adminPassword>   Admin password
    --responsetimeout <timeout>   The optional response timeout in seconds when reading data from server (default: 0s;
                                  infinite)
 -s,--server <rmiHost>            The optional RMI server (default: localhost)
 -u,--user <userId>               The user identifier


Command-line tool for listing signatures of a certain user.

usage: deletesignature -c <contextId> -u <userId> -s <signatureId> -A <masterAdmin | contextAdmin> -P
                       <masterAdminPassword | contextAdminPassword> [-p <RMI-Port>] [-s <RMI-Server] [--responsetimeout
                       <responseTimeout>] | [-h]
 -A,--adminuser <adminUser>       Admin username
 -c,--context <contextId>         The context identifier
 -h,--help                        Prints this help text
 -i,--identifier <signatureId>    The signature identifier
 -p,--port <rmiPort>              The optional RMI port (default:1099)
 -P,--adminpass <adminPassword>   Admin password
    --responsetimeout <timeout>   The optional response timeout in seconds when reading data from server (default: 0s;
                                  infinite)
 -s,--server <rmiHost>            The optional RMI server (default: localhost)
 -u,--user <userId>               The user identifier


Command line tool to delete a certain signatures of a user.

8.48.79

Configuration

SCR-1687

Summary: Renamed DAVx5 Select configuration properties

All DAVx5 Select configuration properties have been moved from the com.openexchange.davx5.\* prefix to com.openexchange.client.onboarding.davx5.\* as part of merging the com.openexchange.davx5.rest bundle into {}com.openexchange.client.onboarding.davx5. The three URL properties were additionally renamed for consistency with the existing onboarding naming convention. ||Old property||New property|| |com.openexchange.davx5.baseRoot|com.openexchange.client.onboarding.davx5.base.url| |com.openexchange.davx5.caldavRoot|com.openexchange.client.onboarding.davx5.caldav.url| |com.openexchange.davx5.carddavRoot|com.openexchange.client.onboarding.davx5.carddav.url| |com.openexchange.davx5.appPasswordType|com.openexchange.client.onboarding.davx5.appPasswordType| |com.openexchange.davx5.appPasswordName|com.openexchange.client.onboarding.davx5.appPasswordName| |com.openexchange.davx5.rateLimit.maxPerMinute|com.openexchange.client.onboarding.davx5.rateLimit.maxPerMinute| |com.openexchange.davx5.customization.productName|com.openexchange.client.onboarding.davx5.customization.productName| |com.openexchange.davx5.customization.description|com.openexchange.client.onboarding.davx5.customization.description| |com.openexchange.davx5.customization.logoImage|com.openexchange.client.onboarding.davx5.customization.logoImage| |com.openexchange.davx5.customization.headerImage|com.openexchange.client.onboarding.davx5.customization.headerImage| |com.openexchange.davx5.support.linkDestination|com.openexchange.client.onboarding.davx5.support.linkDestination| |com.openexchange.davx5.support.linkTitle|com.openexchange.client.onboarding.davx5.support.linkTitle| |com.openexchange.davx5.support.description|com.openexchange.client.onboarding.davx5.support.description|

The new URL properties ({}base.url, {}caldav.url, {}carddav.url) now fall back to the shared onboarding properties com.openexchange.client.onboarding.caldav.url and com.openexchange.client.onboarding.carddav.url when left empty, so deployments that already have CalDAV/CardDAV onboarding URLs configured may not need to set the DAVx5-specific URL properties at all.

8.48.67

API - Java

SCR-1681

Summary: Added DAVX5 constant to BuiltInProvider enum and deprecated SYNC_APP

Extended enum com.openexchange.client.onboarding.BuiltInProvider with a new constant DAVX5("davx5") for the DAVx5 Select onboarding provider. The existing SYNC_APP("syncapp") constant has been deprecated in favor of DAVX5.

API - REST

SCR-1680

Summary: Introduced new REST endpoint for DAVx5 Select configuration

A new REST endpoint is introduced to serve DAVx5 Select configuration JSON:

GET /davx5/v1/config/{token}

The endpoint supports two modes:

Initial setup (no Authorization header): Redeems a one-time token, creates an app-specific password scoped to CalDAV/CardDAV, and returns the full configuration including DAV URLs, credentials, and UI customization. The user identity is derived from the session reservation bound to the token.

Response:
{
  "baseRoot": "https://dav.example.org/dav/",
  "caldavRoot": "https://dav.example.org/caldav/",
  "carddavRoot": "https://dav.example.org/carddav/",
  "basicAuth": {
    "username": "peter@example.org",
    "password": "app-specific-password-here"
  },
  "customization": {
    "productName": "Example Mail",
    "description": "Sync service brought to you by Example Corp",
    "logoImage": "data:image/png;base64,iVBOR...",
    "headerImage": "https://example.com/header.png"
  },
  "supportInfos": {
    "linkDestination": "https://example.com/support",
    "linkTitle": "Contact Support",
    "description": "In case of any problem, please visit our support page."
  }
}

Authenticated re-query (Basic Auth header): Returns customization-only JSON with Cache-Control and ETag headers for efficient polling. The user identity is derived from the validated credentials. The token path segment is ignored in this mode.

Error responses: 401 (invalid credentials), 403 (token invalid/expired/used), 429 (rate limit exceeded), 500 (internal error), 503 (auth service unavailable).

Behavioral Changes

SCR-1682

Summary: Replaced Sync App with DAVx5 Select in Android onboarding scenarios

The former syncappinstall onboarding scenario for Android devices has been replaced by two new scenarios:

davx5install — A link to the DAVx5 Select app on the Google Play Store.
davx5setup — A one-time configuration link using the davx5://setup?config=<url> URI scheme that the DAVx5 Select app handles to automatically provision DAV URLs, an app-specific password, and optional UI customization.

The default values for the following properties have changed:

{}com.openexchange.client.onboarding.enabledScenarios: syncappinstall replaced by * davx5install, davx5setup
{}com.openexchange.client.onboarding.android.phone.scenarios: syncappinstall replaced by davx5install, davx5setup
{}com.openexchange.client.onboarding.android.tablet.scenarios: syncappinstall replaced by davx5install, davx5setup

A new davx5 capability is declared and awarded when both davx5install and davx5setup onboarding scenarios are enabled for a user.

Configuration

SCR-1683

Summary: Added configuration properties for DAVx5 Select integration

Added the following new lean configuration properties:

DAV URL configuration (config-cascade aware):

com.openexchange.davx5.baseRoot DAV base URL. Default: empty.
com.openexchange.davx5.caldavRoot CalDAV root URL. Default: empty.
com.openexchange.davx5.carddavRoot CardDAV root URL. Default: empty.

App password settings (config-cascade aware):

com.openexchange.davx5.appPasswordType App password type. Must match an entry in app-password-apps.yml. Default: "calcarddav".
com.openexchange.davx5.appPasswordName Display name for the app password. Default: "DAVx5 Select".

UI customization (config-cascade aware):

com.openexchange.davx5.customization.productName Product name shown in DAVx5 Select. Default: "OX App Suite".
com.openexchange.davx5.customization.description Product description. Default: "Sync your calendars and contacts".
com.openexchange.davx5.customization.logoImage Logo image as data URI or HTTPS URL. Default: empty.
com.openexchange.davx5.customization.headerImage Header/banner image as data URI or HTTPS URL. Default: empty.

Support information (config-cascade aware):

com.openexchange.davx5.support.linkDestination Support link URL. Default: empty.
com.openexchange.davx5.support.linkTitle Support link title. Default: empty.
com.openexchange.davx5.support.description Support description. Default: empty.

Rate limiting (not config-cascade aware):

com.openexchange.davx5.rateLimit.maxPerMinute Maximum requests per IP per minute for the configuration endpoint. Set to 0 to disable. Default: 10. Onboarding (config-cascade aware):
com.openexchange.client.onboarding.davx5.tokenTimeoutSeconds Token timeout in seconds for the one-time configuration link. Default: 30.

Packaging/Bundles

SCR-1679

Summary: Removed Sync App onboarding bundle

Removed the former Sync App onboarding activator ({}SyncAppOnboardingActivator) and its configuration file client-onboarding-syncapp.properties from the com.openexchange.client.onboarding bundle.

The Sync App onboarding provider has been replaced by the DAVx5 Select onboarding provider

SCR-1678

Summary: Added new bundle com.openexchange.davx5.rest for DAVx5 Select integration

Added new bundle com.openexchange.davx5.rest to the open-xchange-dav package.

This bundle provides a JAX-RS REST endpoint for serving DAVx5 Select configuration JSON to Android devices during CalDAV/CardDAV onboarding.

8.48.66

3rd Party Libraries/License Change

SCR-1685

Summary: Updated & enhanced TwelveMonkeys ImageIO readers/writers

Updated & enhanced TwelveMonkeys ImageIO readers/writers

Updated common-image-3.8.3.jar to common-image-3.13.1.jar
Updated common-io--3.8.3.jar to common-io-3.13.1.jar
Updated common-lang-3.8.3.jar to common-lang-3.13.1.jar
Updated imageio-bmp-3.8.3.jar to imageio-bmp-3.13.1.jar
Updated imageio-clippath-3.8.3.jar to imageio-clippath-3.13.1.jar
Updated imageio-core-3.8.3.jar to imageio-core-3.13.1.jar
Added imageio-dds-3.13.1.jar
Updated imageio-hdr-3.8.3.jar to imageio-hdr-3.13.1.jar
Updated imageio-icns-3.8.3.jar to imageio-icns-3.13.1.jar
Updated imageio-iff-3.8.3.jar to imageio-iff-3.13.1.jar
Updated imageio-jpeg-3.8.3.jar to imageio-jpeg-3.13.1.jar
Updated imageio-metadata-3.8.3.jar to imageio-metadata-3.13.1.jar
Updated imageio-pcx-3.8.3.jar to imageio-pcx-3.13.1.jar
Updated imageio-pict-3.8.3.jar to imageio-pict-3.13.1.jar
Updated imageio-pnm-3.8.3.jar to imageio-pnm-3.13.1.jar
Updated imageio-psd-3.8.3.jar to imageio-psd-3.13.1.jar
Updated imageio-sgi-3.8.3.jar to imageio-sgi-3.13.1.jar
Updated imageio-tga-3.8.3.jar to imageio-tga-3.13.1.jar
Updated imageio-thumbsdb-3.8.3.jar to imageio-thumbsdb-3.13.1.jar
Updated imageio-tiff-3.8.3.jar to imageio-tiff-3.13.1.jar
Added imageio-webp-3.13.1.jar
Added imageio-xwd-3.13.1.jar

Configuration

SCR-1677

Summary: Added Helm chart support for PodDisruptionBudget

The core-mw Helm chart now supports the creation of a PodDisruptionBudget (PDB) per node type. A PDB limits the number of pods that can be voluntarily disrupted at any given time (e.g. during node drains or rolling updates), helping to maintain application availability.

The feature is disabled by default and can be enabled per type or globally via the pdb values section. Either pdb.minAvailable or pdb.maxUnavailable must be set when enabled.

Example configuration:

pdb:
  create: true
  minAvailable: 1

For more information, refer to the chart documentation.

SCR-1664

Summary: New Properties for Shared Accounts Configuration

For the new Shared Accounts feature, several lean configuration properties are introduced:

com.openexchange.sharedaccount.enabled
com.openexchange.sharedaccount.mail.defaultCapabilities
com.openexchange.sharedaccount.calendar.defaultCapabilities
com.openexchange.sharedaccount.mail.defaultPermissionSet
com.openexchange.sharedaccount.calendar.defaultPermissionSet
com.openexchange.sharedaccount.calendar.sentByPreference

See the property documentation, as well as the feature documentation for further details.

Database

SCR-1669

Summary: Update Tasks for Shared Account Tables

For the new Shared Accounts feature, new database tables sharedaccount_permissions and sharedaccount_usersettings are introduced through the blocking update tasks com.openexchange.sharedaccount.storage.rdb.groupware.SharedAccountStorageCreateTableTask.

The update- / create table task is located within package open-xchange-sharedaccount. See the feature documentation for further details.

SCR-1670

Summary: Update Task to add "type" column for Tables "user" and "del_user"

In order to differentiate between stored user records, the new column type is inserted for tables user and del_user through update task com.openexchange.groupware.update.tasks.UserAddTypeTask.

CLT

SCR-1668

Summary: New Commandline Utilities for Shared Accounts

To provision shared accounts and -permissions, new commandline utilities are introduced.

createsharedaccount
listsharedaccount
updatesharedaccount
deletesharedaccount
createsharedaccountpermissions
listsharedaccountpermissions
deletesharedaccountpermissions

See the feature documentation as well as the commandline tool reference for further details and synopsis.

API - SOAP

SCR-1667

Summary: New SOAP Service for Shared Accounts

To provision shared accounts and -permissions, the new SOAP API "http://soap.admin.openexchange.com/OXSharedAccountService" is introduced, offering methods:

change() - Changes shared account data within the given context.
create() - Creates a new shared account within the given context.
delete() - Deletes specified shared account(s) from given context.
list() - Retrieve all shared accounts for a given context.
listCaseInsensitive() - Retrieve all shared accounts for a given context.
getData() - Retrieve user objects for a range of shared accounts by username or id.
createSharedAccountPermissions() - Creates shared account permissions for a list of users and/or groups.
deleteSharedAccountPermissions() - Deletes specified shared account(s) from given context.
listSharedAccountPermissions() - Get all shared account permissions for the specified user.
listSharedAccountPermissionsForSharedAccount() - Get all shared account permissions for the specified shared account.

See the feature documentation for further details and example requests.

Packaging/Bundles

SCR-1666

Summary: New Package 'open-xchange-sharedaccount'

For the new Shared Accounts feature, the package open-xchange-sharedaccount is introduced.

See the feature documentation for further details.

API - HTTP-API

SCR-1665

Summary: New Module 'sharedaccount' in HTTP API

To access the available shared accounts of a user, the HTTP API is extended by new module sharedaccount.

See the API documentation for further details, including all new endpoints.

SCR-1671

Summary: New Parameter 'sentBy' in Actions of Module 'chronos/itip' Module of HTTP API

All modifying actions of module chronos/itip are extended by a new, optional parameter sentBy.

This can be used to explicitly specify the calendar user that is acting on behalf of the calendar user for the scope of the current calendar operation. If set, it'll be picked up as originator for generated notification and scheduling mails (through MIME header Sender), and for the SENT-BY parameter in ORGANIZER or ATTENDEE properties within generated iTIP data.

If not set, the on behalf relationship is implicitly determined based on the actual folder view.

The value can either be supplied using the numerical user identifier, or by the calendar user address URI.

See the [API documentation)[https://documentation.open-xchange.com/components/middleware/http/8/index.html#!Chronos] for further details.