Important Changes

Middleware

SCR-1723

Summary: Java 25 — virtual-thread HTTP worker pool and opt-in generational ZGC

SCR-1723: Java 25 — virtual-thread HTTP worker pool and opt-in generational ZGC — The middleware now runs on Java 25 with virtual-thread HTTP workers enabled by default. G1 remains the default garbage collector (no re-sizing required); generational ZGC is available as an opt-in via javaOpts.zgc, which needs additional native-memory headroom.

Database

SCR-1718

Summary: Update Task to Downscope Unsupported Guest Permissions

The blocking database update task 'com.openexchange.groupware.update.tasks.DownscopeGuestPublicCalendarPermissionsTask' is introduced to downscope write permissions of guest users on public calendar folders to "read-only".

With MW-1473 write access for invited guest users was introduced. However, write access in a calendar folder also implies taking over the organizer role for scheduled appointments. This role cannot be hijacked for a foreign principal residing on an external calendaring and mail system a guest user originates from. Therefore, guest users may only receive write access for personal or shared calendar folders that are bound to a known internal calendar user they can act on behalf of, but not for public calendar folders.

This task aligns already existing permissions accordingly by stripping object-write, object-delete, sub-folder/create-object as well as administrative folder permissions from any guest user permission on a public calendar folder, leaving folder- and object-read permissions untouched.