- Release the IMAP debug logger on every path that gives up an IMAP session (#5)
- Correct the HTTP engine switch runbook for the access log switch, packaging and configuration file (#532)
- Report the statistics of whichever HTTP engine is running in showruntimestats (#532)
- End-to-end regression test for a decorating javax filter on the Jetty engine
- Run the bundle class path check in the artifact-producing build path
- Stop advertising the Jetty package as an HTTP service alternative (#532)
- Answer only GET and HEAD on the Jetty liveness listener
- Correct the Jetty access log documentation and the bundle stop rationale
- Answer what javax cannot express from the original request when re-bridging
- Correct the Jetty connector's forwarded header trust, shut-down grace period and header compliance
- Evaluate repeated forwarded-for field lines and sanitize the tracking identifier
- Keep the jakarta wrapper identity when re-bridging a foreign servlet request wrapper
- Release the in-flight gate even when the asynchronous hand-off fails
- Strip control characters from client-supplied log properties in every case
- Register whiteboard servlet patterns as sub-tree aliases like the Grizzly engine (#532)
- Accept only http and https from the forwarded protocol header and cap the patient stop timeout
- Await every alias and asynchronous cycle before a Jetty servlet or filter is destroyed
- Keep foreign servlet wrappers in the path when crossing the servlet bridge
- Sanitize the user agent and Unicode line separators before they reach the log context
- Unregister the aliases of a shared whiteboard servlet collectively
- IMAP command injection through user flags and the headers request parameter
- Redirect reads to the master while a read replica reports broken or excessive replication lag (#4)
- Restore replica staleness check by tracking the replication monitor counter process-locally (support#1599)
- Advertise cross-context mail grantees as type user in extended permissions
- Promote guest recipients only on enabled cross-context surfaces
- PBSR-1717: Cross-Context Sharing, Deputy and Collaboration
- SCR-1730: Added New Bundles for Cross-Context Sharing
- SCR-1731: Added the "xctx_liaisons" Cross-Context Liaison Registry Table and Create-Table Update Task
- SCR-1732: Added a Permission-Context Column to the Folder-Permission Tables
- SCR-1733: Restructured the Folder-Permission Primary Key to Include the Context Column
- SCR-1734: Deputy Storage Table Qualifies the Deputy Entity With Its Context
- SCR-1735: New Configuration Options for Cross-Context Sharing
- SCR-1736: Folder Permissions Accept and Return Cross-Context Principal Identifiers
- SCR-1737: New Read-Only Contact Field Exposing the Cross-Context Qualified Identifier
- SCR-1738: Cross-Context Deputy via Qualified Identifiers (Deputy HTTP API)
- SCR-1739: Cross-Context Principal Representation Over WebDAV / CalDAV / CardDAV
- SCR-1740: New Administrative REST Endpoints for Cross-Context Liaison Audit and Purge
- SCR-1741: Cross-Context Deputy in the Admin RMI Provisioning API
- SCR-1742: Cross-Context Deputy in the Admin SOAP Provisioning API
- SCR-1743: Cross-Context Sharing Access-Control Behavior
- SCR-1758: New Command-Line Tool claimfolderadmin to Claim/Elevate a Folder Administrator on Public Folders
- SCR-1776: HTTP API for proxy servlet - PUT /proxy?action=getUris
- SCR-1781: Micrometer metrics and access-log rotation for the Jetty HTTP engine
- SCR-1782: Optional cleartext HTTP/2 (h2c) for the Jetty HTTP engine
- SCR-1787: Apache HttpClient 5 platform bundles and HttpClient-5-based managed HTTP client service
- SCR-1797: Configurable additional parameters for OAuth token exchange (scheduled + snoozed mail)
- SCR-1798: List built-in spam handler names in secondary account CLI help
- SCR-1801: New Administrative REST Servlet for Querying Free/Busy Data
- Set personal folder owner for folders below personal Infostore folder (core#527)
- Persisted-ACL end-to-end case to phantom mail folder share reproducer (core#547)
- Values-driven topologySpreadConstraints, PDB unhealthyPodEvictionPolicy and HPA support to core-mw chart (support#1568)
- Drop the legacy "folder" mapping from the shared-account mail JSlob
- Keep SQL exception identity across RMI-safe exception wrapping
- SCR-1746: Upgraded third-party libraries
- SCR-1747: Migrated JAX-RS from Jersey 2.17 to Jersey 3.1.x (jakarta.ws.rs)
- SCR-1748: Load mails referenced from PIM attachments or Infostore files
- SCR-1749: Upgraded Grizzly to 5.0.2
- SCR-1750: Upgraded Netty libraries to v4.2.15 and Lettuce to v7.6.0
- SCR-1752: Upgrade Micrometer to 1.17 (migrate Prometheus registry from simpleclient to prometheus-metrics)
- SCR-1754: Migrated S3 file storage to AWS SDK for Java v2
- SCR-1755: Upgraded Kubernetes Java Client (fabric8) to v7.8.0
- SCR-1756: Jetty-based HTTP engine as a switchable alternative to Grizzly
- SCR-1757: Markup-aware hard truncation of HTML content for "view=raw" with "max_size"
- SCR-1759: Seal proxy registration URLs via ObfuscatorService instead of static DES key
- SCR-1761: Apply Compact Object Headers JVM flag independently of custom javaOpts.other in core-mw chart
- SCR-1762: Upgraded Liquibase to v5.0.3 and OpenCSV to v5.12.0
- SCR-1763: Upgraded OkHttp to v5.4.0
- SCR-1765: Upgraded BouncyCastle to v1.84
- SCR-1766: Upgraded webauthn-server-core to v2.9.0, reactor-core to v3.8.6 and zero-allocation-hashing to v2026.0
- SCR-1767: Upgraded ROME to v2.1.0, jaudiotagger to v3.0.1, Caffeine to v3.2.4, GeoIP2 to v5.1.0 and libphonenumber to v9.0.34
- SCR-1768: Upgraded ez-vcard to v0.12.2
- SCR-1769: Upgraded lib-recur to v0.17.1
- SCR-1770: Upgraded Apache XML-RPC to v6.1.0
- SCR-1771: Upgraded Dropbox Core SDK to v8.0.1
- SCR-1772: Upgraded Box Java SDK to v4.16.4
- SCR-1773: Upgraded OWASP ESAPI to v2.7.0.0
- SCR-1774: Upgraded Hazelcast to v5.7.0
- SCR-1775: Upgraded jOOX to v2.0.1
- SCR-1778: Mandatory 'objectid' mapping for LDAP contacts providers
- SCR-1780: Upgraded Apache CXF to v4.2.2 and Metro JAX-WS runtime to v4.0.5
- SCR-1783: Removed the stateful Dovecot Push implementation
- SCR-1784: Upgraded Google client stack and Firebase Admin SDK
- SCR-1785: Upgraded OpenSAML to v5.2.3
- SCR-1786: Upgraded Apache PDFBox to v3.0.7
- SCR-1788: The client-side prepared statement cache defaults are raised
- SCR-1792: Upgrade Cassandra driver to Apache Cassandra java-driver 4.19.3
- SCR-1793: Harden Redis connection lifecycle against stale/orphaned connected clients
- SCR-1794: Upgrade Box SDK to generated Box Java SDK 10.15.1 (com.box.sdkgen)
- SCR-1795: Upgrade target platform to Jakarta EE 11 REST stack (Jersey 4.0.2 / jakarta.ws.rs 4.0 / HK2 4.0.1)
- SCR-1796: Upgrade io.netty to 4.2.16.Final
- SCR-1799: Optional Grizzly WebSocket side-car alongside the Jetty engine
- Stage on-demand gRPC jars via the eclipse/cleanEclipse IDE-prep tasks
- Transport shared-account scheduling mail via the shared mailbox
- Updated core-mw chart dependencies
- Updated Gotenberg image to v8.34.0
- Updated Gotenberg chart to v1.22.0
- Updated Collabora image to v26.04.2.3.1
- Updated Collabora chart to v1.3.0
- Aligned contacts account handling with its calendar counterpart
- Build gRPC provisioning jars on demand instead of committing them
- Provide details about stored event on out-of-sequence errors (core#463)
- Remove the time-based Entity2ACL look-up caches (core#546)
- Modernize CalDAV/CardDAV documentation and DAV routing diagrams (support#1561)
- CAL-5001: Run folder name checks before opening the create transaction
- Database folder cache lost stale-re-insert protection (unguarded region) and left in-memory replicas after group-member invalidation
- Flaky statisticsAreMaintained() rejected by the capacity-less SynchronousQueue under load
- Folder cache value codec overwrote a permission's numeric entity identifier with its entity info rendering such folders non-deserializable
- Groovy-interpolate registry/project/imageVersion in mirrorImage skopeo copy step
- Load-through re-fetch loop spun forever on a non-deserializable Redis cache entry instead of self-healing it
- Missing command-line tool scripts and inaccurate CLT documentation
- PBSR-1766: Indicate correct account prefix for folder ids in mail filter rules of non-primary accounts
- Re-align the Jetty Bundle-ClassPath with the 12.1.11 embedded JARs
- Register the globaldb utf8mb4 package in the Liquibase custom-change manifest header
- SCR-1798: Provision per-account spam handler so "Mark as Spam" works for secondary/functional mailboxes
- Set Jersey context class loader when building JAX-RS client
- Hardened the Jetty engine's servlet registry (core#532)
- Detect synthetic sessions by origin, not instanceof
- Reject corrupt ZIP/OLE2 documents before Collabora conversion in mail export previews
- Rename changesharedaccount CLI tool documentation and help text to updatesharedaccount
- Select chart release by prefix instead of trusting GitHub releases/latest
- Subscribe/unsubscribe for shared mail folders via share/management
- Superfluous quoting of FEATURE parameter values in CONFERENCE property
- Prevent message alarm reminders from getting stuck until node restart
- Never let a single broken push client configuration abort start-up of com.openexchange.push.clients (core#552)
- Skip the JDBC reserved-word probe on MariaDB (core#553)
- Pin the gRPC protobuf export and slim down the framework jar shading (core#555)
- Bind a task marker for HTTP requests dispatched on threads without one (core#556)
- Sort shared calendar folders contributed by multiple calendar accounts (core#557)
- Tolerate missing parent folder during IMAP default folder check (support#1129)
- Keep emitting user_id 0 for non-user contacts to preserve HTTP-API compatibility (support#1438)
- Reuse GETACL results across folder-tree rebuilds (support#1522)
- Apply healthCheckIntervalMillis to its own pool property instead of overwriting responseTimeoutMillis (support#1523)
- Never skip sender validation when transmitting via action=new (support#1531)
- Limit the number of orphaned cookies removed per HTTP response to stay below the engine's response header limit (support#1540)
- Populate internal user id consistently in results from LDAP contacts provider (support#1542)
- Preserved shared/deputy mailbox visibility with consolidated LIST-EXTENDED folder listing (support#1543)
- Exclude guest users from context user count for MaxUser restriction (support#1548)
- Restored xs:date/nillable for SOAP birthday and anniversary (support#1551)
- Reject central-training spam handlers for external mail accounts (support#1552)
- Bump About-box default copyright year to 2026 (support#1553)
- Re-add org.glassfish.jersey.client.spi import to imageconverter.client bundle (support#1554)
- Refuse applying incoming scheduling messages that collide with differently organized events (support#1555)
- Drop RFC 2965 $-prefixed framing cookies in servlet bridge (support#1560)
- Store DB-assignment and schema-update-state cache entries as plain per-context/per-schema keys instead of one global group hash (support#1562)
- Reference iMIP mail parts via "cid" URLs in analyzed event attachments (support#1564)
- Replace CREATE TABLE ... AS SELECT with plain DDL + INSERT ... SELECT (support#1567)
- Throw FOLDER_NOT_FOUND instead of NPE for missing calendar folder (support#1577)
- Guard composite LDAP filter construction against non-representable search term operands (support#1578)
- Single-pass, escaping URI token compression to keep proxy registrations round-trip safe (support#1582)
- Propagate affected folders in folder map invalidation messages so remote nodes drop them for every user (support#1584)
- Report exact attachment sizes for composition space drafts (support#1585)
- Run core-mw update job on dedicated ServiceAccount without API token automount (support#1592)
- Always provide the mail's display date, also for nested messages (support#1598)