ASB-370: Attributes for the anti-abuse 'report' request
SCR-2189: New configuration option for the post-auth allow request of the Weakforced connector
SCR-2190: Weakforced connector sends session attributes with report requests and the requested host name with every request
PBSR-1467: OIDC - Scheduled Mail Support
SCR-2191: New Properties to Let Users Allow Background Mail Access for Scheduled and Snoozed Mail Through Their OpenID Connect Login
SCR-2192: New End-Point offline_grant and Error Code MCRED-0014 for Background Mail Access
PBSR-1690: Calendar Trash folder with soft delete, previewed restore and undo
SCR-1871: New Configuration Properties for the Calendar Trash Folder
SCR-1872: New Trash Marker Columns in the Calendar Tables
SCR-1873: New Restore Action and Soft-Delete Parameters in the Chronos Module
SCR-1988: Calendar Folders of a Shared Account Report Their Own Folder Type
SCR-2183: Changed Handling of Dropped Delete Exception Dates and Repeated Occurrence Deletes
PBSR-1792: Cross-Context Address Books
Generalize the calendar/contacts (PIM) provider stacks — Phases A-H (core-gitlab-com#54)
SCR-2059: Added the Bundle com.openexchange.contact.provider.crosscontext
SCR-2060: New Property com.openexchange.contact.crosscontext.enabled
SCR-2061: Address Books Can Be Shared Across Context Boundaries
SCR-2062: Qualified Folder Identifiers in the Attachment Module
PBSR-1799: Client Access to the Permission Holders of a Shared Account
SCR-2043: New request sharedaccount?action=permissions and capability listPermissions for the holders of a shared account
PBSR-1877: Log In to Shared Accounts via SASL PLAIN With the Acting User's Credentials
SCR-2151: New Properties to Log In to Secondary and Shared Accounts via SASL PLAIN With the Acting User's Password
PBSR-1885: Deputies Can Send E-Mails as the Granting User Instead of on Their Behalf
SCR-2143: New property com.openexchange.deputy.sendAsEnabled and capability deputy_send_as
SCR-2144: New field sendAs in the deputy permission of the HTTP API
SCR-2145: New element sendAs in the deputy permissions of the OXDeputyPermissionsService
SCR-2146: New field sendAs in the deputy permission data objects of the RMI and gRPC interfaces
SCR-2147: New attribute sendAs in the SCIM resource Deputies
SCR-2148: New column sendAs in table deputy
PBSR-1904: Administrative data export of a user, e.g. for an authority, with mail via master authentication
SCR-2177: DataExportRMIService requires credentials for read operations and offers administrative data exports
SCR-2178: listdataexports and dataexportconsistency check the administrator credentials; new tools submitdataexport and downloaddataexport
SCR-2179: Provisioning HTTP gateway exposes DataExportService by default; new properties com.openexchange.gdpr.dataexport.administrative.maxTimeToLive and com.openexchange.mail.admin.masterUserSeparator
SCR-2181: New columns for administrative data exports in dataExportTask and dataExportFilestoreLocation
SCR-1946: REST-like alternative for the accesstoken HTTP API on the collection accesstokens
SCR-1995: Empty a folder, mark all its messages read and read the mail quota on the Mobile API
SCR-2020: Name the folders a Mobile API search by account passes over in unavailableFolders
SCR-2086: Keep idle mail credential tokens alive, repair rejected refresh tokens and survive a change of the session encryption key
SCR-2087: New column refresh_due in table mail_credential
SCR-2088: Mail credential vault keeps idle OAuth tokens alive and repairs rejected ones
SCR-2093: Keep personal access token and exchanged mail credentials alive, count vault metrics and accept a previous session encryption key
SCR-2094: Index refresh_due of table mail_credential now starts with caller_key
SCR-2095: Mail credential vault keeps more OAuth tokens alive and reports metrics
SCR-2098: Administer kept mail credentials through the provisioning API, keep short-lived refreshed tokens, exchange for refresh tokens and tell snoozed mail owners
SCR-2099: New option to ask for a refresh token in the token exchange of the mail credential vault
SCR-2100: Mail credential vault keeps short-lived refreshed tokens, tells snoozed mail owners and reports more metrics
SCR-2103: Repair the mail credential of a personal access token when the token is presented, and revoke exchanged tokens without an ID token
SCR-2104: Mail credential vault repairs personal access token credentials on use and revokes exchanged tokens
SCR-2106: Repair or refresh a kept mail credential on an administrator's request, and report the vault's gauges cluster-wide
SCR-2107: New OXMailCredentialInterface methods to repair or refresh a kept mail credential
SCR-2108: Mail credential vault gauges report the cluster-wide count on every node
SCR-2114: Let a notification carry optional structured data for the client to act on
SCR-2115: Added column data to table notificationQueue
SCR-2121: Push notifications added to the notification queue to the user's clients via SSE and Web Push (topic ox:notification:new)
SCR-2122: Added action webpushkey and Web Push subscriptions for the App Suite UI
SCR-2123: Push notifications for notifications removed from the notification queue to the user's clients via SSE and Web Push (topic ox:notification:deleted)
SCR-2132: Count refreshes of kept OAuth tokens that the configuration does not allow
SCR-2137: Keep uploaded files in an upload directory shared by all nodes, so that they outlive the node that received them
SCR-2141: Search a context's kept mail credentials by state
SCR-2142: New OXMailCredentialInterface method to search a context's kept mail credentials
SCR-2153: Adaptive idle time and metrics for the IMAP store cache
SCR-2156: Hand out the mail's identity as mail_identity and accept it as mailIdentity on inline mail image URLs
SCR-2167: Provisioning Tests for Omitted and Empty Module Permission Levels of Shared Accounts
SCR-2180: Delete left-over shared attachment folders after clearing a folder, and cut allocation on heavy mail paths
SCR-2185: New Mail and Mail Filter Authentication Properties for Shared Accounts
SCR-2205: End-to-End Tests for the OIDC Login Restart
SCR-2206: Keep the Sieve capabilities of a user for a configurable idle time
SCR-2210: Let the features of a user share the mail credential they keep from the same login
SCR-2211: New column pool in table mail_credential for pooled mail credentials
Documentation for Enforcing the Permission Level of Shared Accounts on the Mail Server
Documentation for Keeping the Shared Account Lookups of a Lua Master Passdb Short and Cached
External authentication
SCR-2063: New bundles for external authentication, the no-op session store and session obfuscation
SCR-2064: New properties to enable external authentication and the OIDC handoff
SCR-2065: New and changed REST end-points under /authentication/v1 for the external authentication service
SCR-2066: Middleware keeps no sessions of its own when external authentication is enabled
SCR-2067: Step-up response for restricted actions and no session identifier under external authentication
External authentication support in the OAuth provider
SCR-2066: Middleware keeps no sessions of its own when external authentication is enabled
External authentication support in the OX Guard client
SCR-2069: New properties for the OX Guard client's token storage under external authentication
SCR-2085: New Configuration Property to Use Pushed Authorization Requests in the OpenID Connect Authorization Code Flow
MW-1674: Preconfigured iCal Subscriptions
SCR-2036: New Configuration for Preconfigured iCal Subscriptions
No-op session store for external authentication
SCR-2063: New bundles for external authentication, the no-op session store and session obfuscation
SCR-2066: Middleware keeps no sessions of its own when external authentication is enabled
Self-service account recovery in the middleware
SCR-2193: New package open-xchange-account-recovery for self-service password reset
SCR-2194: New properties com.openexchange.accountrecovery.* configure self-service account recovery
SCR-2195: New properties com.openexchange.passwordchange.admin.* for administrative password changes by database or webhook
SCR-2196: New tables user_recovery_details and user_recovery_email_index for account recovery
SCR-2197: New REST API /account-recovery for password reset and administrative recovery details
SCR-2198: New HTTP API module accountrecovery, JSlob entries and capability account_recovery
SCR-2199: Recovery details in the RMI and SOAP provisioning API
SCR-2200: New options --recoveryemail, --recoveryphone and --recoverypin for createuser and changeuser
SCR-2201: New Java interfaces for account recovery and administrative password changes
Tests for Enforcing the Permission Level of Shared Accounts on the Mail Server
Translation updates 8.54
Search one mail account on the Mobile API with scope.accountId (core-gitlab-com#57)
SCR-2020: New Mobile API endpoints for message lists, conversations and search
Mobile API folders with a state per folder (core-gitlab-com#61)
SCR-2012: New Mobile API endpoints for mail folders
Mobile API message changes of a folder (core-gitlab-com#62)
SCR-2013: New Mobile API endpoint for the message changes of a mail folder
SCR-2020: New Mobile API endpoints for message lists, conversations and search
SCR-2018: New Mobile API endpoints to read a message, its body, source, attachments and attachment previews
Change many messages at once through the Mobile API (core-gitlab-com#63)
SCR-2017: New Mobile API endpoint to change many messages at once
Live events and batch requests for the Mobile API (core-gitlab-com#66)
SCR-2014: New Mobile API operations for live events and batch requests
SCR-1978: New configuration options for live change events
Folders actions home, public, sharedWithMe and virtual folder drive://0 (core-gitlab-com#68)
SCR-2186: New folders actions home, public and sharedWithMe, and the virtual folder drive://0/
SCR-2161: New properties com.openexchange.file.storage.opencloud|nextcloud.identityProvider.* for the storage account of the identity the user logged in with
SCR-2157: New property com.openexchange.file.storage.default selects the default file storage of a user
SCR-2158: External recipients of a share are granted access by the file storage or rejected up front
SCR-2159: Drive Mail stores its attachments in the default file storage and applies auto-delete only where the storage deletes on its own
SCR-2160: New property com.openexchange.gdpr.dataexport.provider.infostore.includeExternalDefaultFileStorage
Scheduled sending in the Mobile API (core-gitlab-com#72)
Folder changes since a state in the Mobile API (core-gitlab-com#73)
Option to keep the mail login inside the context (off by default), plus two fixes for parallel provisioning (core-gitlab-com#75)
SCR-2034: New configuration options for keeping the mail login inside the context
SCR-2035: Added index on the targeted shared account
MCP calendar write tools with preview, confirmation, write switch and write limit (core-gitlab-com#80)
SCR-2054: MCP server tools that change calendar appointments and reminders, and confirming writes with the user
SCR-2055: New configuration options for MCP tools that change data
SCR-2056: Changed default of com.openexchange.mcp.instructions
SCR-2070: MCP server tools that change tasks and contacts
SCR-2073: MCP server tools that change mail, the vacation notice and mail filter rules, and output schemas for all tools
SCR-2074: MCP tool results link into App Suite
SCR-2076: MCP briefing tool and daily briefing prompt
SCR-2077: New action accesstoken?action=activity
SCR-2078: New configuration options for the MCP activity log
SCR-2079: New table mcp_activity
SCR-2082: Folder restriction for personal access tokens
SCR-2083: New column folders in table access_token
SCR-2084: New MCP server tools to read a conversation, find a meeting time and report what changed
SCR-2091: MCP server returns the text of PDF and office documents
SCR-2092: New configuration option to read the text of PDF files through MCP
Built-in OAuth authorization server for the MCP server (core-gitlab-com#81)
SCR-2071: Built-in OAuth authorization server for the MCP server
SCR-2072: New configuration options for the built-in OAuth authorization server of the MCP server
Filter MCP tasks_search by due date (core-gitlab-com#83)
Rotate the token of the Mobile API, sliding its lifetime (core-gitlab-com#93)
SCR-2010: New Mobile API endpoints for sign-in, account data and recipient suggestions
SCR-2165: New columns for the rotation of personal access tokens in table access_token
MCP tools that send, move and delete mail, set the vacation notice, event reminders and mail filter rules (core-gitlab-com#95)
SCR-2073: MCP server tools that change mail, the vacation notice and mail filter rules, and output schemas for all tools
SCR-2054: MCP server tools that change calendar appointments and reminders, and confirming writes with the user
SCR-2055: New configuration options for MCP tools that change data
MCP tools that write to Drive, changes_since, and the OAuth scopes write_files and share_files (core-gitlab-com#96)
SCR-2176: MCP server tools that write to Drive, and the OAuth scopes write_files and share_files
SCR-2084: New MCP server tools to read a conversation, find a meeting time and report what changed
MCP write tools confirmed by the user through elicitation where the client supports it (core-gitlab-com#97)
SCR-2054: MCP server tools that change calendar appointments and reminders, and confirming writes with the user
MCP recall window, sending later, snoozing and output schemas of all tools (core-gitlab-com#98)
SCR-2073: MCP server tools that change mail, the vacation notice and mail filter rules, and output schemas for all tools
SCR-2055: New configuration options for MCP tools that change data
ASB-372: Let the multifactor provider with the highest service ranking own a provider name and hand it over on removal
PBSR-1689: Let an Event Be Handed Over Although a Soft-Deleted User Attends or Organizes It
Soft user delete: a leaver state between deactivated and deleted (core-gitlab-com#44)
PBSR-1690: Typed Views of an Event With One Field Overridden
PBSR-1792: Share the PIM Account and Folder Permission Model Between the Calendar and Contacts Stacks
Generalize the calendar/contacts (PIM) provider stacks — Phases A-H (core-gitlab-com#54)
SCR-2019: New Bundle com.openexchange.groupware.common.storage for the Shared Calendar and Contacts Account Storage
PBSR-1820: White-Listed Hosts Are Exempt From Host Name Verification
PBSR-1876: Document and Validate the Cached Fields of the LDAP Contacts Provider
PBSR-1899: Restrict Changing the IMAP Subscriptions of a Shared Account to Privileged Users
SCR-2166: Changing the IMAP Subscriptions of a Shared Account Requires the manageImapSubscriptions Capability
PBSR-1904: Require administrator credentials for the data export read operations and expose them over the provisioning gateway
SCR-2177: DataExportRMIService requires credentials for read operations and offers administrative data exports
SCR-2178: listdataexports and dataexportconsistency check the administrator credentials; new tools submitdataexport and downloaddataexport
SCR-2179: Provisioning HTTP gateway exposes DataExportService by default; new properties com.openexchange.gdpr.dataexport.administrative.maxTimeToLive and com.openexchange.mail.admin.masterUserSeparator
PBSR-1923: Enforce the Mail Permission Level of Shared Accounts on All Mail Operations
SCR-2212: Enforced the Mail Permission Set of Shared Accounts for All Mail Operations
SCR-2015: Move Contacts Deleted From Shared Folders Into the Owner's Trash
SCR-2028: Require the session secret for creating an OAuth account instead of accepting the token of the call-back URL
SCR-2037: Upgraded seven third-party libraries to their latest patch or minor release
SCR-2038: Upgraded eleven third-party libraries to their latest patch or minor release
SCR-2052: Upgraded Commons Lang, Tika, Guava and AWS SDK to their latest patch or minor release
SCR-2081: Upgraded Jersey and Joda-Time to their latest patch or minor release
SCR-2038: Upgraded eleven third-party libraries to their latest patch or minor release
SCR-2089: Upgraded the Yubico WebAuthn server library to 2.10.0
SCR-2052: Upgraded Commons Lang, Tika, Guava and AWS SDK to their latest patch or minor release
SCR-2119: Upgraded forty-two third-party libraries to their latest patch or minor release
SCR-2039: Upgraded the fabric8 Kubernetes client from 7.9.0 to 8.0.0
SCR-2041: Upgraded the Apache Kafka client from 4.0.0 to 4.0.2 to fix CVE-2026-35554 and CVE-2026-33558
SCR-2044: Removed the unused libraries eddsa, cose-java and nekohtml and replaced PBKDF2 with the JDK implementation
SCR-2045: Upgraded hk2 to 4.0.3, AWS SDK to 2.55.7 and woodstox to 7.3.0
SCR-2046: Upgraded gson-fire to 1.9.0 in com.openexchange.opencloud and aligned the API client and test libraries
SCR-2047: SSL: fall back to the JVM's trust store instead of trusting every certificate if no trust managers are available or the trust level is invalid
SCR-2048: User feedback: pseudonymize users in exports with an HMAC keyed by a configurable secret instead of a plain MD5 hash
SCR-2049: New configuration options for user feedback pseudonyms
SCR-2050: Encrypt with AES/GCM in the key-based crypto methods instead of AES/CBC with a fixed IV
SCR-2052: Upgraded commons-lang3 to 3.21.0, Tika to 4.1.0, Guava to 33.7.2 and AWS SDK to 2.55.8
SCR-2097: Upgraded Grizzly to 5.0.3
SCR-2053: Upgraded kafka-clients to 4.3.1
SCR-2090: Check every address of a target host and connect to the one checked in the host-checking route planner
SCR-2109: Try further live sessions, the freshest first, when one cannot repair a kept mail credential
SCR-2110: Refresh a live session's own tokens before a repair of a mail credential takes them over
SCR-2111: Leave the OpenID Connect logout mapping to real sessions when the mail credential vault refreshes kept tokens
SCR-2112: Schedule kept tokens while the mail credential vault's keep-alive is switched off, so that switching it on takes them up
SCR-2113: Hand out no expired access token of a kept mail credential when its refresh fails for now
SCR-2116: Answer RMI callers of a context on another site with errors they can load
SCR-2117: Leave rows of the old format alone while their feature handles them, keep a credential whose rewrite outcome is unclear, and remember walks that take several runs
SCR-2118: Log out exchanged tokens only with the last exchanged mail credential of a user for their back-end
SCR-2119: Upgraded Jetty to 12.1.14, snappy-java to 1.1.10.11 and the GlassFish CORBA OMG API to 5.0.3
SCR-2124: Queue the logouts of deleted users' and contexts' exchanged tokens instead of tying up pool threads
SCR-2125: Answer an administrator's repair of a mail credential another node works on with deferred, and go on with the next session where a repair lost the credential
SCR-2126: Revoke no access token and refresh no kept credential while the session storage cannot be read, and revoke after a refused password without a comparing session only once a lockout is over
SCR-2127: New configuration option for revoking access tokens after a refused mail password
SCR-2128: Keep a mail credential that cannot be read on a password change, and tell a cipher that is not there for now apart from an unreadable one
SCR-2129: Keep refreshed tokens with the current ID token where the identity provider's signing keys cannot be fetched, instead of ending the session
SCR-2130: Reuse a per-node salt for the session obfuscation key and bound concurrent Argon2 key derivations
SCR-2132: Keep mail credentials that cannot be read or rewritten for now instead of taking them for unreadable or lost
SCR-2133: Leave the tokens a repair replaces with tokens of the same back-end to expire, as the repaired credential may share their client session
SCR-2134: Revoke access tokens only for mail password refusals that go on without a pause, and schedule credentials older nodes leave unscheduled while the keep-alive is off
SCR-2135: Keep refreshing kept OAuth tokens on use after a refresh without expires_in, and handle a refused client like an unusable credential
SCR-2136: Keep the pings of live change streams on time however slow Redis is, by checking each session once per interval in the background and writing stream presence in batches
SCR-2137: Let a stale lock of background update tasks expire after 60 seconds by default
SCR-2138: Sweep a user's contact trash at most hourly per node and read only the oldest contacts' identifiers and timestamps, a thousand at most
SCR-2149: The Go entrypoint forwards termination signals to the middleware, waits for it and exits with its exit code
SCR-2152: Enable SMTP pipelining and use DATA instead of BDAT by default
SCR-2162: Never match the SSL white-list against the address of an HTTP proxy tunneling the connection, only against the target host
SCR-2163: Limit concurrent POP3 syncs per user and their duration, and connect the primary mail storage only to store synced messages
SCR-2167: A Module Omitted When Setting Shared Account Permissions Falls Back to the Default Permission Set
SCR-2175: Move DBPool to com.openexchange.server.database and the server's startup helpers out of com.openexchange.server.impl
SCR-2203: Index login2user by (cid, id) so that looking up a login by user identifier no longer reads all rows of the context
SCR-2204: Make the Lifetime of Pending OIDC Authentication Requests Configurable and Default It to 30 Minutes
SCR-2205: Restart the OIDC Login for a Callback With an Unknown or Expired State
SCR-2208: Patch re2j, so that compiling a case-insensitive pattern holding U+1C80 to U+1C88 returns
SCR-2209: Require master administrator credentials for the DB migration and lock status over RMI and send them along to remote sites
Adapt DAV, client onboarding and the API client to external authentication
SCR-2066: Middleware keeps no sessions of its own when external authentication is enabled
Adapt the test suite to external authentication
Assemble the OSGi Bundle List of the Middleware Start in Linear Time
Change the draft of a composition space without fetching the content of its larger attachments, which UID REPLACE with CATENATE takes from the server
Common Constant for the Subscribed Flag of Basic Calendar Accounts
Descriptions of the Configuration File Values of the core-mw Chart
Detect Browsers and Operating Systems Without the Outdated uadetector Library
Disable the personal access tokens under external authentication
SCR-2066: Middleware keeps no sessions of its own when external authentication is enabled
Eclipse code templates without the since tag and with the ox.io address, noted in CLAUDE.md
Helm Values for Preconfigured iCal Subscriptions in the Documentation
Helm Values for the LDAP Contacts Provider in the Documentation
Introduce ACR-based step-up and consolidate restricted scopes
SCR-2067: Step-up response for restricted actions and no session identifier under external authentication
SCR-2068: Replaced the scope flags of the RestrictedAction annotation by an ACR check
Keep Up to 600 OSGi Bundle Files Open to Speed Up the Middleware Start
Keep percent and plus signs that AJAXUtility marks URL-safe instead of re-encoding them
Keep the preStop sleep and the remaining shut-down within the pod's grace period instead of granting all of it to the request drain
Let clients keep the not found answer of a contact picture for an hour, like a found one
Let the Changed Permission Set Test Wait for the Auth Cache of the Mail Server
Log OAuth configuration hints at DEBUG instead WARN or INFO
Log a Data Export Clean-up Run Disabled per Configuration at DEBUG instead of WARN
Mobile API clients send Accept: application/problem+json and pick the Bearer challenge
Modernize the OpenID Connect SSO Documentation and Flow Diagrams
Move the session obfuscation into its own bundle
SCR-2063: New bundles for external authentication, the no-op session store and session obfuscation
Moved external auth multifactor code to own bundle
SCR-2182
Read the User Agent Database on First Use Instead of During the Middleware Start
Save the draft of a composition space by UID REPLACE with CATENATE, taking unchanged attachments from the replaced draft
Save the draft of a composition space by a single IMAP REPLACE where the server supports it
Skip the MCP and Mobile API tests under external authentication
Tag the core-test image with the whole component set
Took over Jakarta Mail/Angus Mail upstream changes into the JavaMail fork: XXE-safe text/xml handler, IDN domains, Part.getSizeLong()
Transport Shared Account Scheduling Mail Without Looking Up the Acting User's Session Again
Update Gotenberg to 8.38.1 and refresh the Gradle and wolfi-base image digests
Write the Master Password File Without Starting a JVM at Pod Start
Adjusted middleware for new step up check
Moved guard cassandra token storage to own package
SCR-2164
Harden the MCP endpoint after a full review (core-gitlab-com#45)
SCR-1944: New configuration options for the MCP server
SCR-1945: New MCP server endpoint for read-only access to mail, calendar, contacts, files and tasks
SCR-1974: New capabilities access_tokens and mcp
SCR-2027: New configuration option for the audience of JWTs accepted by the MCP server
Refuse live change streams under the dispatcher prefix with the problem codes of the Mobile API (core-gitlab-com#57)
SCR-2014: New Mobile API operations for live events and batch requests
Operators and clients know the primary storage as the default (core-gitlab-com#68)
SCR-2157: New property com.openexchange.file.storage.default selects the default file storage of a user
SCR-2161: New properties com.openexchange.file.storage.opencloud|nextcloud.identityProvider.* for the storage account of the identity the user logged in with
SCR-2187: The capability drive opens the Drive module to users without the infostore
SCR-2158: External recipients of a share are granted access by the file storage or rejected up front
No write scope by default for signed-in access tokens, the Mobile API keeps its own default scopes (core-gitlab-com#80)
List each grant of the MCP authorization server once among the access tokens (core-gitlab-com#81)
SCR-2075: Access token listing shows each grant of the MCP authorization server once
Let access tokens reach the user's other mail accounts with the scope mail_external (core-gitlab-com#82)
SCR-2101: Access tokens reach the user's other mail accounts with the scope mail_external
SCR-2102: New error code OAUTHMAIL-0002 for access tokens that cannot open an external mail account's password
Access tokens keep the password for secret resolution under master authentication and OAuth mail access (core-gitlab-com#86)
SCR-2105: Access tokens keep the password for secret resolution under master authentication and OAuth mail access
Explain a sipgate refusal and how to find the SMS extension (core-gitlab-com#87)
SCR-2139: New properties to send SMS via sipgate with a personal access token and a chosen SMS extension
SCR-2139: New properties to send SMS via sipgate with a personal access token and a chosen SMS extension
Consolidate the Handling of Personal PIM Folder Properties (core-gitlab-com#106)
ASB-65: Default Reminders for Appointments Are Not Applied When Adding Appointments via Email .ics Attachment
SCR-2155: New Optional Argument applyDefaultAlarms When Saving iCal Mail Attachments via the Conversion Request
ASB-205: Treat a push registration as owned only while permanent push is enabled
ASB-254: Delete contexts under MariaDB snapshot isolation by keeping delete listeners in the deletion's transaction
ASB-259: Inline Images Without File Name Missing for Raw Mail View
ASB-268: Show the signature size limit in a human-readable unit
ASB-273: Account-specific IMAP failures after login no longer mark the server as temporarily down
SCR-2096: IMAP temporary-down back-off no longer triggered by account-specific failures after login
ASB-275: Close Redis connections that get established only after the connect timeout elapsed
ASB-279: B-encode mostly non-ASCII file names so iOS Mail can decode them
ASB-282: Snooze and schedule mails where a mail authenticator brings its own credentials, e.g. a token issued per access
ASB-298: Fall back to formal German for texts missing in the informal translations and ship the informal translations
ASB-299: Reverse listing of one granting user's deputy permissions reports the deputy as the granting user
ASB-300: Deputy permission updates routed to another site through gRPC fail with DEPUTY-0007
SCR-2150: Deputy permission updates routed to another site through gRPC apply their fields
ASB-303: Leave scheduled mails unsent while the feature is disabled and tell about a failed transport attempt only once
ASB-305: Reject mail?action=transport with MSG-0129 instead of sending with a foreign From
ASB-306: Withhold deputy grants if the granting user's state cannot be determined
ASB-307: Skip a granting context whose deputy grants cannot be read instead of failing all cross-context grants
ASB-308: Give mail sent through the mobile API as a granting user of another context that user's display name in From
ASB-313: Participant and Resource Lists in Notification Mails Are Not Marked Up as Lists
ASB-320: Set user flags in the intended folder when the session has not yet probed the user flag support
ASB-321: Look up a user by mail address or mail login exactly instead of treating *, ?, % and _ as wildcards
ASB-334: Let the SOAP operation grantMultiple of OXDeputyPermissionsService accept a list of deputy permissions
ASB-335: Keep a single-use Guard token unused when saving an encrypted draft
ASB-340: State the root and the grouping virtual folders of an OpenCloud account as read-only
ASB-342: Apply the rollout strategy of a core-mw StatefulSet as spec.updateStrategy
ASB-346: Don't lose an OpenCloud file or folder when moving it onto itself through another account
ASB-347: Apply a new file name when saving new contents of a file in a WebDAV-based storage like Nextcloud or OpenCloud
ASB-348: List namespace-aware update tasks as pending unless their namespace is actually excluded
ASB-349: Accept the context administrator for listexternalaccounts and deleteexternalaccounts and check credentials when listing
SCR-2184: ExternalAccountRMIService list methods require administrator credentials; listexternalaccounts and deleteexternalaccounts accept the context administrator
ASB-350: Signal truncated CalDAV sync-collection results also when post-processing drops events
ASB-353: Pick a free name when creating or moving a folder onto a taken name in an OpenCloud or Nextcloud storage
ASB-355: Keep an inline image's position between plain-text parts also for raw mail content
ASB-356: Don't batch mail updates combining several changes inside a multiple request
ASB-358: Guest share login page keeps the folder and user name of the first request's language after a language switch
ASB-359: Copying a shared file into another storage fails, as the shares of the source are copied along
ASB-362: Renaming the primary mail account fails without multiple_mail_accounts permission
ASB-364: Categories several users add to a shared account overwrite each other
SCR-2188: New version of shared account data in the JSlob API and error code JSNCON-0012
ASB-366: Let the root of an OpenCloud account be renamed again, which renames the account
ASB-367: State the Shared with me folder and the trash folders of an OpenCloud account as allowing no creation
ASB-368: Let Documents rename a file within an OpenCloud or Nextcloud account by stating persistent identifiers
ASB-373: Name the thumbnail of an external storage after its image type so Office files of Box.com and Google Drive get a preview
ASB-376: Report an OpenCloud file copied onto itself as an existing file
ASB-380: State the rights and the name of a file shared with the user when it is fetched on its own, and rename its mount within the OpenCloud shares space
ASB-391: Page a filtered context list, e.g. for a reseller admin, by context id instead of hash order
ASB-394: Start the heading numbers of documentation pages without a top-level heading at 1 instead of 0
ASB-399: Accept the aliases of a shared account as sending address
INU-5122: Keep the Event Sequence at Its Maximum Value Instead of Overflowing
PBSR-1690: An Appointment the Deleting User Cannot Read Is Deleted Permanently Instead of Binned
PBSR-1792: Reject Legacy Contacts and Calendar Folders Below Folders of a Provider
PBSR-1820: Connections Opened During Start-Up No Longer Trust Every Certificate With trustlevel=restricted
SCR-2040: White-Listed Hosts Are Exempt From Host Name Verification
PBSR-1877: Appsuite Shared Accounts with OAuth2 Break on Dovecot 2.4.5 and 3.1.6
SCR-2131: New Properties to Log In to Secondary and Shared Accounts With the Acting User's Credentials
Add the Second Alarm of the Shared Account Alarm Test Far Enough Ahead to Get a Trigger
Calendar Listing Failing for Cross-Context Shares of a Deleted Context
Change and Delete Exceptions Lost When a Series Is Moved Across a Daylight Saving Time Change
Changing the Used-in-Picker Setting of LDAP and Cross-Context Address Books Fails
Conditional Requests for Calendars Shared via iCal Link
Create change exceptions from the stored calendar user identities
Create the Top-Level Folder of the Author Test as a Mail Folder
Do Not Set Entries of Dovecot Global ACLs When Creating or Copying Mail Folders
Ended OpenID Connect Sessions Leave a New Session Behind Where OX Guard Is Deployed
GUARD-539: Keep the bare Guard token in a draft's security settings