Important Changes

Middleware

Middleware Image Migrated from Debian to Wolfi OS

Summary: The App Suite Middleware container image now builds on Wolfi OS instead of Debian Bookworm

Middleware Image Migrated from Debian to Wolfi OS: The Middleware application itself is unchanged, but the runtime environment around it differs and existing deployments need verifying against it. /etc/ssl/certs/java/cacerts is now read-only, so custom truststore hooks that copy the file before importing into it need an added chmod 0644 between the two steps. There is no package manager at runtime, and neither the Debian utilities which, diff, xz, wget and hostname nor the JDK diagnostic tools (jmap, jstack, jcmd, …) are present any more. Custom scripts relying on them need POSIX alternatives, and in-pod investigation moves to kubectl debug or the appsuite-toolkit. Smoke-test on a non-production cluster with your existing Helm values before rolling this out.

App Suite UI

• Breaking change: Align custom core CSS utilities with Tailwind v4 (bizdev-208)
  • Rename spacing/sizing utilities: new suffix = old px / 4, e.g. mb-16 -> mb-4.
  • Switch mx-*/my-* to logical margin-inline/margin-block.
  • Rename zero-min-width -> Tailwind min-w-0.
  • Rename adjusted utilities, e.g. rounded -> rounded-md.
  • flex-col dropped display/!important: use flex flex-col (or flex-col! for !important).
  • Affected: m-*, p-*, gap-*, h-*, rounded*, flex-col/flex-row, min-w-0.
• Breaking change: Move settings dropdown into sidepanel fb8d95458
  • The settings (gear) menu now opens as a sidepanel instead of a popover
  • "Browse categories" moved from the settings dropdown to a sidepanel toolbar button
  • #topbar-settings-dropdown is now a <div class="panel-list"> instead of <ul class="dropdown-menu" role="menu">; custom CSS targeting .dropdown-menu/[role="menuitem"] inside the gear menu needs updating to the new .panel-list* classes
  • Bootstrap dropdown lifecycle events (show.bs.dropdown etc.) no longer fire on the gear trigger

OX Documents

SCR-1779

Summary: Hazelcast removed the CP Subsystem from the Community Edition, OX Documents switched to a different mechanism to manage distributed state

SCR-1779: OX Documents used the Hazelcast CP Subsystem to manage distributed state, which Hazelcast removed from the Community Edition with version 5.5.0. Running a single Hazelcast cluster during a rolling update, with old and new versions coexisting, is not possible with the replacement mechanism. If documents cannot be loaded after a rolling update, run a final rolling restart of the core-mw nodes to resolve it.

Database

SCR-1734

Summary: Deputy Storage Table Qualifies the Deputy Entity With Its Context

The deputy table gains entityCid (INT4 UNSIGNED NOT NULL DEFAULT 0; 0 = grantor's context) so a deputy may live in another context. Behavior-neutral for existing deputies.

Fresh schemas: com.openexchange.deputy.impl.groupware.DeputyStorageCreateTableService. Existing schemas: com.openexchange.deputy.impl.groupware.DeputyStorageAddEntityContextColumnTask (idempotent; depends on the deputy create-table task).

See the Deputy permissions documentation for further details.

SCR-1733

Summary: Restructured the Folder-Permission Primary Key to Include the Context Column

Building on the new context column (previous SCR), the PK (and the principal index where present) is extended to include it, so cross-context and same-context permission rows coexist without collision.

• oxfolder_permissions / del_oxfolder_permissions: PK (cid, fuid, permission_cid, permission_id, system); index principal (cid, permission_cid, permission_id, fuid).
• virtualPermission / virtualBackupPermission: PK (cid, tree, user, folderId, entityCid, entity).

Each ALTER rewrites the InnoDB clustered index (slow on large tables). Existing schemas: com.openexchange.groupware.update.tasks.RestructureFolderPermissionPrimaryKeyUpdateTask (idempotent; depends on AddPermissionContextIdToFolderPermissionTableUpdateTask). Fresh schemas: the create-table services above.

See the feature documentation for further details.

SCR-1732

Summary: Added a Permission-Context Column to the Folder-Permission Tables

The folder-permission tables gain a context-qualifier column (INT4 UNSIGNED NOT NULL DEFAULT 0; 0 = the row's own context). Behavior-neutral for existing rows. (PK restructure is the next SCR.)

• oxfolder_permissions, del_oxfolder_permissions -> permission_cid
• virtualPermission, virtualBackupPermission -> entityCid

Fresh schemas: com.openexchange.admin.mysql.CreateOXFolderTables / CreateVirtualFolderTables. Existing schemas: com.openexchange.groupware.update.tasks.AddPermissionContextIdToFolderPermissionTableUpdateTask (idempotent, no deps).

See the feature documentation for further details.

SCR-1731

Summary: Added the "xctx_liaisons" Cross-Context Liaison Registry Table and Create-Table Update Task

New per-context table xctx_liaisons in the grantee (target) context's user schema (not configdb) — a pointer index, one small row per cross-context grant.

CREATE TABLE xctx_liaisons (
  `cid` INT4 UNSIGNED NOT NULL,
  `entity` INT4 UNSIGNED NOT NULL,
  `module` INT4 UNSIGNED NOT NULL,
  `sharing_cid` INT4 UNSIGNED NOT NULL,
  `owner_entity` INT4 UNSIGNED NOT NULL DEFAULT 0,
  `type` INT4 UNSIGNED NOT NULL DEFAULT 0,
  PRIMARY KEY (`cid`, `entity`, `module`, `sharing_cid`, `owner_entity`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

cid/entity = grantee context + principal; sharing_cid = owner context; owner_entity = owning entity (0 = owner-agnostic); type = LiaisonType (0=DB_FOLDER_SHARE, 1=DEPUTY, 2=MAIL_FOLDER_SHARE). Composite PK is the natural key; no secondary indexes.

• Fresh schemas: com.openexchange.crosscontext.impl.storage.rdb.groupware.CrossContextLiaisonsCreateTableService.
• Existing schemas: com.openexchange.crosscontext.impl.storage.rdb.groupware.CrossContextLiaisonsCreateTableTask (UpdateTaskAdapter, no deps, idempotent).
• Cleanup: CrossContextLiaisonsDeleteListener (context/user/group delete) + LiaisonsCleanUpExecution (DatabaseCleanUpService job, 1/day; prunes orphans, fail-safe).

See the feature documentation for further details.