App Suite Middleware

8.35.166 - 2026-07-24

Fixed

  • Report exact attachment sizes for composition space drafts (support#1585)

8.35.165 - 2026-07-23

Fixed

  • Repoint openapi plugins to gitlab.com registry and bump to latest
  • Validate From ownership on mail bounce (support#1531)
    • action=bounce re-sent a stored message via ComposeType.NEW without checking that the From belongs to the authenticated user, allowing sender spoofing. BounceAction now runs the same ownership check as action=new through MimeMessageFiller.resolveSender2Account(checkSender=true) before transport, so a foreign From is rejected with INVALID_SENDER (MSG-0056).

8.35.163 - 2026-06-05

Fixed

  • CP-572: Stop session removal from escalating to a full key-space scan when user/context has no sessions
  • IOL-2841: Reconnect mail access when attachment handling takes too long
    • On 8.35 the schedule/scheduleAtFixedRate/scheduleWithFixedDelay millisecond convenience overloads are abstract on TimerService, whereas on main they are default methods. The cherry-picked MailStorageReconnectTest.FakeTimerService stub only overrode the TimeUnit variants, so compileTestJava failed. Implement the three millisecond overloads so the stub compiles on the stable branch.

8.35.162 - 2026-04-21

Fixed

  • Avoid writing periodic save-points (by default) to avoid possible access problems (core#486)

8.35.161 - 2026-03-20

Fixed

  • Ignore possible "file not found" error when moving entity-associated files due to deletion of that entity (e.g. user deletion) (core#481)

8.35.160 - 2026-03-11

Fixed

  • Keep user-specified setting for a config-cascade setting originating from non-user scope (core#356)

8.35.156 - 2026-03-03

Fixed

  • Docker image missing stable-8.x tag when pushing release image

8.35.155 - 2026-03-03

Fixed

  • Docker image missing stable-8.x tag when pushing release image
    • The git version tag was created after buildahPushAllImages ran, so
    • releaseTags() could not resolve the version and omitted the stable-8.x
    • tag. Move the local tag re-creation before the push task.

8.35.154 - 2026-03-03

Fixed

  • Avoid too many recursive calls when compiling IMAP SEARCH expression from a search term instance (support#1099)

8.35.153 - 2026-02-27

Fixed

  • Avoid too many recursive calls when compiling IMAP SEARCH expression from a search term instance (support#1099)
  • Added config option to Redis-based session storage to control execution of timer tasks (support#1276)

8.35.149 - 2026-02-25

Added

  • INF-581: Always apply default HTTP headers in WebDAV responses, including new 'X-Powered-By' header
    • Added: INF-581: Always apply default HTTP headers in WebDAV responses,

8.35.147 - 2026-02-23

Fixed

  • IOL-2841: Periodically touch composition space cache during file upload to ensure it does not vanish from cache
  • GDPR data export does not show errors from api (support#1158)
    • translation updates

8.35.145 - 2026-02-16

Changed

  • Include the hint on successful data export that some modules might not have exported - /appsuite/support#1158 (support#1158)

8.35.144 - 2026-02-03

Fixed

  • Orderly invalidate mail account even though connection in transaction state might be passed - /appsuite/platform/core#452 (core#452)

8.35.143 - 2026-01-30

Fixed

  • Only check against configured values for "com.openexchange.mail.signature.maxImageLimit" greater than 0 (zero) - /appsuite/platform/core#451 (core#451)
  • Orderly invalidate mail account even though connection in transaction state might be passed - /appsuite/platform/core#452 (core#452)

8.35.142 - 2026-01-13

Fixed

  • Detect & drop harmful content in CDATA section - /appsuite/platform/core#438 (core#438)

8.35.140 - 2025-12-10

Fixed

  • Added backticks around otherwise interpreted input - /appsuite/platform/core#422 (core#422)

8.35.139 - 2025-11-04

Changed

  • PBSR-1496: Prepare code to set value for future db column type for user/del_user tables

8.35.137 - 2025-10-19

Fixed

  • Restore RFC 1123 compliant formatting of {DAV:}creationdate and {DAV:}getlastmodified - /appsuite/platform/core#389 (core#389)
    • Fixed: Restore RFC 1123 compliant formatting of {DAV:}creationdate and

8.35.136 - 2025-10-07

Fixed

  • Orderly update folder's anonymous guest permission on follow-up mail transport attempt - /appsuite/platform/core#384 (core#384)

8.35.135 - 2025-10-07

Fixed

  • Detect harmful content in CSS fragment - /appsuite/platform/core386

8.35.134 - 2025-09-23

Fixed

  • Drop "@import" words from CSS content - /appsuite/platform/core#357 (core#357)
  • Orderly detect possibly harmful HTML content - /appsuite/platform/core#361 (core#361)

8.35.132 - 2025-09-19

Changed

  • Delete previously scheduled mail data along with associated message when re-editing as draft (core#358)

8.35.131 - 2025-09-16

Fixed

  • Also consider <iframe> tag when checking for possible HTML content - /appsuite/platform/core379

8.35.130 - 2025-09-15

Fixed

  • Pass proper parameters on cache key generation (core#273)
  • Orderly save scheduled mail as draft and re-schedule (core#358)
  • Improved handling for failed transport of scheduled mails (core#364)

8.35.129 - 2025-08-08

Fixed

  • Deny attribute values containing HTML fragments - appsuite/platform/core#336 (#336)

8.35.128 - 2025-08-07

Fixed

  • Explicitly drop existent scheduled mail on edit - /appsuite/platform/core#358 (#358)

8.35.127 - 2025-07-29

Changed

  • Use pagination when querying context identifiers - /appsuite/platform/core#349 (#349)
  • Use pagination when querying context identifiers - /appsuite/support#735 (#735)

8.35.126 - 2025-07-22

Fixed

  • Orderly throw exception if endpoint is not configured with TLS - /appsuite/platform/core#306 (#306)

8.35.124 - 2025-07-11

Fixed

  • Prevent amount quota deadlocks while creating events - /appsuite/platform/core#331 (#331)

8.35.123 - 2025-07-04

Fixed

  • Deal with possibly dying connection when probing for FILENAME SEARCH capability
  • Apply lowered read timeout when probing for file name search capability of an IMAP server - /appsuite/platform/core#327 (#327)

8.35.122 - 2025-06-30

Fixed

  • Aligned identifying fields when checking maximum size of returned event collections - /appsuite/platform/core#245 (#245)
    • Fixed: Aligned identifying fields when checking maximum size of returned

8.35.120 - 2025-06-17

Changed

  • Assume same mail back-end (user base) for primary and secondary accounts - /appsuite/support#545 (#545)

8.35.119 - 2025-06-17

Changed

  • Take client identifier from servlet path if possible - /appsuite/platform/core#318 (#318)
    • Changed: Take client identifier from servlet path if possible -

8.35.118 - 2025-05-23

Fixed

  • Use system proxies for APNs push if defined - /appsuite/platform/core#281 (#281)
    • Fixed: Use system proxies for APNs push if defined -

8.35.117 - 2025-05-23

Fixed

  • Only inject credential provider if proxy username is configured for mail autoconfig - /appsuite/platform/core#279 (#279)
    • Fixed: Only inject credential provider if proxy username is configured

8.35.115 - 2025-05-09

Fixed

  • Add watch permission for role to allow watching secrets

8.35.114 - 2025-04-23

Changed

  • Added 'dontResolveEntities' parameter also for 'POST' request method variants - /appsuite/platform/core#237 (#237)
    • Changed: Added 'dontResolveEntities' parameter also for 'POST' request

8.35.113 - 2025-04-23

Changed

  • SCR-1558: Introduced 'dontResolveEntities' parameter to support import of separate event copies - /appsuite/platform/core#237
    • Changed: Introduced 'dontResolveEntities' parameter to support import of
    • test polishing
    • extended documentation
    • more documentation

8.35.112 - 2025-04-22

Fixed

  • Keep local IP address in generated session - /appsuite/platform/core#250 (#250)

8.35.104 - 2025-04-09

Fixed

  • Escape illegal characters in cache filter suffix portions - /appsuite/platform/core#239 (#239)
  • Retry reinitialization of users_per_filestore table with manual INSERTs in case CREATE TABLE AS SELECT statement is prohibited - /appsuite/platform/core#241 (#241)

8.35.97 - 2025-04-07

Fixed

  • Corrected parameter handling when storing snippets into database - /appsuite/platform/core#224 (#224)
  • Applied various improvements in communication with Redis - appsuite/support#527 (#527)

8.35.95 - 2025-04-01

Fixed

  • Only update attributes if there are actual changes - /appsuite/platform/core#193 (#193)

8.35.92 - 2025-03-24

Fixed

  • Removed superfluous call to hard-delete messages when moving messages from Unified Mail's folder to another Unified Mail's folder - /appsuite/support#499 (#499)

8.35.90 - 2025-03-19

Changed

  • Create gitlab release from core pipeline

8.35.89 - 2025-03-17

Added

  • Added folder mode to deputy permission feature - /appsuite/platform/core#173 (#173)

Changed

  • Added new lean properties to specify primary account's namespaces which are necessary when using Dovecot's DoveAdm API to manage deputy permissions - /appsuite/platform/core#188 (#188)

Fixed

  • Fixed no-class-def error javax/net/ssl/SSLSocketFactory

8.35.88 - 2025-03-12

Fixed

  • Fixed no-class-def error javax/net/ssl/SSLSocketFactory

8.35.86 - 2025-03-11

Fixed

  • Prefer a local cache for too frequently queried context data - /appsuite/platform/core#215 (4) (#215)

8.35.76 - 2025-03-06

Added

  • SCR-1528: Documentation for new "convert-guest" option (SCR-1528)

Changed

  • Convert guest to regular user - /appsuite/platform/core#119 (#119)

Fixed

  • Changed convertguest soap field to last position. Ref. [#207]
    • Basically training wheels for shitty soap clients.
  • Support an S3 connector without database access (for chunking) - /appsuite/guard#1 (#1)

8.35.66 - 2025-02-12

Added

  • SCR-1486: New property com.openexchange.carddav.addressbookMultigetLimit
  • Added async provisioning framework
  • Health Check for Redis Cache - /appsuite/platform/core#134 (#134)
  • Expose CardDAV URL for Address Book Folders - /appsuite/platform/core#137 (#137)
  • Warm-up Thread-local Cache when Handling Client Requests - /appsuite/platform/core#138 (#138)
  • Control Sharding for Redis Cluster - /appsuite/platform/core#139 (#139)
  • Fixed existing graphs and added new ones based on redis cache metrics - /appsuite/platform/core#144 (#144)

Changed

  • Add shared-read-only flag to snippet module to have shared snippets that may be seen, but must not be modified/deleted by other users
  • Batch-resolve resources when handling CARDDAV:addressbook-multiget request
  • INU-4548: Support configurable custom flag for mails
  • SCR-1496: Enhanced OAuthAuthorizationService#validateAccessToken with Header collection parameter - /appsuite/platform/core#74
  • SCR-1510: Changed defaults for Client-Onboarding YAML configuration file
  • SCR-1511: Update Apache Commons Codec from v.1.17.0 to v1.17.2
  • SCR-1512: Updated Apache Commons Codec library from v1.6.0 to v1.9.0
  • SCR-1513: Update Apache Commons CSV from v1.6 to v1.13.0
  • SCR-1514: Limit number of addressed keys per MGET operation (SCR-1514) - /appsuite/support#340
  • SCR-1522: Updated Snappy library from v1.1.10.5 to v1.1.10.7
  • SCR-1528: New Option "convert-guest" in "createuser" Commandline Tool
  • SCR-1529: New "convertguest" Element for "create" in "OXUserService"
  • Added appropriate OAuth scopes to mail compose actions
  • Allow to overwrite securityContext
  • Skip capability check and don't trigger preview generation if not needed
  • Updated collabora and gotenberg dependency
  • Changed copyright year to 2025
  • Removed db defaults from values
    • Removed the db defaults so that they can be overriden by global entries
    • Also adjusted the mysql secret to use those defaults in case nothing is configured
  • Gather subfolder ids for search from condition tree map - /appsuite/platform/core#62 (#62)
  • Convert guest to regular user - /appsuite/platform/core#119 (#119)
  • Disable Global Folder Cache by Default - /appsuite/platform/core#142 (#142)
  • Redirect to configured failure redirect location after erroneous token response - /appsuite/platform/core#156 (#156)
  • Updated to newest SLF4j and Logback libraries - appsuite/platform/core#163 (#163)
  • Update cxf-libraries to 3.5.10 (CVE-2025-23184) - appsuite/platform/core#169 (#169)
  • Added documentation article for database cleanup jobs - /appsuite/platform/core#171 (#171)
  • Subscribe/unsubscribe IMAP folder if deputy permission is granted/revoked - /appsuite/support#415 (#415)
  • Use more compact token format - /appsuite/web-apps/ui#697 (#697)

Fixed

  • Connect CLT param access-denied-portal to code [#189]
  • IIJMX-554: Don't use IMAP folder's sequence number when sorting by received date is performed in application
  • INU-4767: Improved handling of corrupt address list
  • Only check conflicts for added/updated attendees unless re-scheduled
  • PLG-450: Continue if visible folders cannot be collected for non-default contacts account
  • Fixed main by removing commons-cli-1.6.0 from target platform
  • Adjusted documentation for 'flags' parameter
  • Sorting of distribution list by first name [#159]
  • Allow deletion of user attributes via json null values
  • Cache invalidator instance to prevent excessive pub key requests
  • Changed docu links to oss repo
  • Enable test on borrow for redis connection pool
  • Fixed AbstractAdvertisementConfigServiceTest
  • Made flagging documentation more independent of the client
  • Properly store host parameter during login
  • Include system type when gathering subfolders for infostore search - /appsuite/platform/core#62 (#62)
  • Skip initial reachability check for remote redis connections - /appsuite/platform/core#130 (#130)
  • Fall back to storage access if accessing cache yields errors - appsuite/platform/core#135 (#135)
  • Corrected link in Contacts Provider LDAP documentation article - /appsuite/platform/core#140 (#140)
  • Use only one cache region for advertisment config - /appsuite/platform/core#141 (#141)
  • Handle empty JSON input as no available value is Redis cache - appsuite/platform/core#143 (#143)
  • Hard-delete mail(s) if located in trash folder - /appsuite/platform/core#147 (#147)
  • Don't attempt to invalidate caches if no group members are set - /appsuite/platform/core#155 (#155)
  • Explicitly use UTF-8 charset when writing vCards - /appsuite/platform/core#162 (#162)
  • Handle possibly absent password when checking subscribed mail account's status - /appsuite/platform/core#168 (#168)
  • Prevent from invalidating a remote node's JSlob entry if it has been stored after local node's entry - /appsuite/platform/core#170 (#170)
  • Pick proper mail from conversation when performing sort - /appsuite/platform/core#175 (#175)
  • Ignore unmappable ACLs when updating an IMAP folder's ACLs - /appsuite/platform/core#179 (#179)
  • More look-up attempts in case of missing draft - /appsuite/platform/core#180 (#180)
  • Fixed SQL 'INSERT INTO ... ON DUPLICATE KEY UPDATE' statement - /appsuite/platform/core#183 (#183)
  • Evaluate CARDDAV:limit in CARDDAV:addressbook-query Report - /appsuite/platform/core#185 (#185)
  • Consider all known 'devices' for CalDAV/CardDAV onboarding providers - /appsuite/platform/core#186 (#186)
  • Added config switch to keep own address when replying to self-sent message - /appsuite/platform/core#187 (#187)