App Suite Middleware

8.35.184 - 2026-08-26

Fixed

• ASB-162: Parse mail filter rule metadata for non-IPv4 update sources and heal polluted rule names

8.35.183 - 2026-08-25

Fixed

• Default to UTC when delivering a nested message as JSON (support#1598)

8.35.181 - 2026-08-19

Fixed

• Take a snippet's identity from the database instead of stale file-storage headers (support#1329)

8.35.180 - 2026-08-18

Fixed

• Honor the timezone parameter when converting a single mail outside the get action (support#1598)
• Do not report a failed IMAP quota look-up as exceeded quota (support#1636)

8.35.178 - 2026-08-06

Fixed

• Keep writing a datamining report when a database schema is unreachable (support#1618)

8.35.175 - 2026-08-04

Fixed

• IMAP command injection through user flags and the headers request parameter

8.35.174 - 2026-07-31

Added

• Redirect reads to the master while a read replica reports broken or excessive replication lag (#4)

Fixed

• Restore replica staleness check by tracking the replication monitor counter process-locally (support#1599)

8.35.173 - 2026-07-30

Added

• Redirect reads to the master while a read replica reports broken or excessive replication lag (#4)

Fixed

• Restore replica staleness check by tracking the replication monitor counter process-locally (support#1599)
• Validate HTTP header names against RFC 9110 token rules in the Grizzly 2.4 codec (support#1603)

8.35.172 - 2026-07-29

Fixed

• Always provide the mail's display date, also for nested messages (support#1598)

8.35.166 - 2026-07-24

Fixed

• Report exact attachment sizes for composition space drafts (support#1585)

8.35.165 - 2026-07-23

Fixed

• Repoint openapi plugins to gitlab.com registry and bump to latest
• Validate From ownership on mail bounce (support#1531)
  • action=bounce re-sent a stored message via ComposeType.NEW without checking that the From belongs to the authenticated user, allowing sender spoofing. BounceAction now runs the same ownership check as action=new through MimeMessageFiller.resolveSender2Account(checkSender=true) before transport, so a foreign From is rejected with INVALID_SENDER (MSG-0056).

8.35.163 - 2026-06-05

Fixed

• CP-572: Stop session removal from escalating to a full key-space scan when user/context has no sessions
• IOL-2841: Reconnect mail access when attachment handling takes too long
  • On 8.35 the schedule/scheduleAtFixedRate/scheduleWithFixedDelay millisecond convenience overloads are abstract on TimerService, whereas on main they are default methods. The cherry-picked MailStorageReconnectTest.FakeTimerService stub only overrode the TimeUnit variants, so compileTestJava failed. Implement the three millisecond overloads so the stub compiles on the stable branch.

8.35.162 - 2026-04-21

Fixed

• Avoid writing periodic save-points (by default) to avoid possible access problems (core#486)

8.35.161 - 2026-03-20

Fixed

• Ignore possible "file not found" error when moving entity-associated files due to deletion of that entity (e.g. user deletion) (core#481)

8.35.160 - 2026-03-11

Fixed

• Keep user-specified setting for a config-cascade setting originating from non-user scope (core#356)

8.35.156 - 2026-03-03

Fixed

• Docker image missing stable-8.x tag when pushing release image

8.35.155 - 2026-03-03

Fixed

• Docker image missing stable-8.x tag when pushing release image
  • The git version tag was created after buildahPushAllImages ran, so
  • releaseTags() could not resolve the version and omitted the stable-8.x
  • tag. Move the local tag re-creation before the push task.

8.35.154 - 2026-03-03

Fixed

• Avoid too many recursive calls when compiling IMAP SEARCH expression from a search term instance (support#1099)

8.35.153 - 2026-02-27

Fixed

• Avoid too many recursive calls when compiling IMAP SEARCH expression from a search term instance (support#1099)
• Added config option to Redis-based session storage to control execution of timer tasks (support#1276)

8.35.149 - 2026-02-25

Added

• INF-581: Always apply default HTTP headers in WebDAV responses, including new 'X-Powered-By' header

8.35.147 - 2026-02-23

Fixed

• IOL-2841: Periodically touch composition space cache during file upload to ensure it does not vanish from cache
• GDPR data export does not show errors from api (support#1158)
  • translation updates

8.35.145 - 2026-02-16

Changed

• Include the hint on successful data export that some modules might not have exported (support#1158)

8.35.144 - 2026-02-03

Fixed

• Orderly invalidate mail account even though connection in transaction state might be passed (core#452)

8.35.143 - 2026-01-30

Fixed

• Only check against configured values for "com.openexchange.mail.signature.maxImageLimit" greater than 0 (zero) (core#451)
• Orderly invalidate mail account even though connection in transaction state might be passed (core#452)

8.35.142 - 2026-01-13

Fixed

• Detect & drop harmful content in CDATA section (core#438)

8.35.140 - 2025-12-10

Fixed

• Added backticks around otherwise interpreted input (core#422)

8.35.139 - 2025-11-04

Changed

• PBSR-1496: Prepare code to set value for future db column type for user/del_user tables

8.35.137 - 2025-10-19

Fixed

• Restore RFC 1123 compliant formatting of {DAV:}creationdate and {DAV:}getlastmodified (core#389)

8.35.136 - 2025-10-07

Fixed

• Orderly update folder's anonymous guest permission on follow-up mail transport attempt (core#384)

8.35.135 - 2025-10-07

Fixed

• Detect harmful content in CSS fragment (core#386)

8.35.134 - 2025-09-23

Fixed

• Drop "@import" words from CSS content (core#357)
• Orderly detect possibly harmful HTML content (core#361)

8.35.132 - 2025-09-19

Changed

• Delete previously scheduled mail data along with associated message when re-editing as draft (core#358)

8.35.131 - 2025-09-16

Fixed

• Also consider <iframe> tag when checking for possible HTML content (core#379)

8.35.130 - 2025-09-15

Fixed

• Pass proper parameters on cache key generation (core#273)
• Orderly save scheduled mail as draft and re-schedule (core#358)
• Improved handling for failed transport of scheduled mails (core#364)

8.35.129 - 2025-08-08

Fixed

• Deny attribute values containing HTML fragments (core#336)

8.35.128 - 2025-08-07

Fixed

• Explicitly drop existent scheduled mail on edit (core#358)

8.35.127 - 2025-07-29

Changed

• Use pagination when querying context identifiers (core#349)
• Use pagination when querying context identifiers (support#735)

8.35.126 - 2025-07-22

Fixed

• Orderly throw exception if endpoint is not configured with TLS (core#306)

8.35.124 - 2025-07-11

Fixed

• Prevent amount quota deadlocks while creating events (core#331)

8.35.123 - 2025-07-04

Fixed

• Deal with possibly dying connection when probing for FILENAME SEARCH capability
• Apply lowered read timeout when probing for file name search capability of an IMAP server (core#327)

8.35.122 - 2025-06-30

Fixed

• Aligned identifying fields when checking maximum size of returned event collections (core#245)

8.35.120 - 2025-06-17

Changed

• Assume same mail back-end (user base) for primary and secondary accounts (support#545)

8.35.119 - 2025-06-17

Changed

• Take client identifier from servlet path if possible (core#318)

8.35.118 - 2025-05-23

Fixed

• Use system proxies for APNs push if defined (core#281)

8.35.117 - 2025-05-23

Fixed

• Only inject credential provider if proxy username is configured for mail autoconfig (core#279)

8.35.115 - 2025-05-09

Fixed

• Add watch permission for role to allow watching secrets

8.35.114 - 2025-04-23

Changed

• Added 'dontResolveEntities' parameter also for 'POST' request method variants (core#237)

8.35.113 - 2025-04-23

Changed

• SCR-1558: Introduced 'dontResolveEntities' parameter to support import of separate event copies (core#237)
  • test polishing
  • extended documentation
  • more documentation

8.35.112 - 2025-04-22

Fixed

• Keep local IP address in generated session (core#250)

8.35.104 - 2025-04-09

Fixed

• Escape illegal characters in cache filter suffix portions (core#239)
• Retry reinitialization of users_per_filestore table with manual INSERTs in case CREATE TABLE AS SELECT statement is prohibited (core#241)

8.35.97 - 2025-04-07

Fixed

• Corrected parameter handling when storing snippets into database (core#224)
• Applied various improvements in communication with Redis (support#527)

8.35.95 - 2025-04-01

Fixed

• Only update attributes if there are actual changes (core#193)

8.35.92 - 2025-03-24

Fixed

• Removed superfluous call to hard-delete messages when moving messages from Unified Mail's folder to another Unified Mail's folder (support#499)

8.35.90 - 2025-03-19

Changed

• Create gitlab release from core pipeline

8.35.89 - 2025-03-17

Added

• Added folder mode to deputy permission feature (core#173)

Changed

• Added new lean properties to specify primary account's namespaces which are necessary when using Dovecot's DoveAdm API to manage deputy permissions (core#188)

Fixed

• Fixed no-class-def error javax/net/ssl/SSLSocketFactory

8.35.88 - 2025-03-12

Fixed

• Fixed no-class-def error javax/net/ssl/SSLSocketFactory

8.35.86 - 2025-03-11

Fixed

• Prefer a local cache for too frequently queried context data (core#215)

8.35.76 - 2025-03-06

Added

• SCR-1528: Documentation for new "convert-guest" option

Changed

• Convert guest to regular user (core#119)

Fixed

• Changed convertguest soap field to last position. Ref. #207
  • Basically training wheels for shitty soap clients.
• Support an S3 connector without database access (for chunking) (guard#1)

8.35.66 - 2025-02-12

Added

• SCR-1486: New property com.openexchange.carddav.addressbookMultigetLimit
• Added async provisioning framework
• Health Check for Redis Cache (core#134)
• Expose CardDAV URL for Address Book Folders (core#137)
• Warm-up Thread-local Cache when Handling Client Requests (core#138)
• Control Sharding for Redis Cluster (core#139)
• Fixed existing graphs and added new ones based on redis cache metrics (core#144)

Changed

• Add shared-read-only flag to snippet module to have shared snippets that may be seen, but must not be modified/deleted by other users
• Batch-resolve resources when handling CARDDAV:addressbook-multiget request
• INU-4548: Support configurable custom flag for mails
• SCR-1496: Enhanced OAuthAuthorizationService#validateAccessToken with Header collection parameter (core#74)
• SCR-1510: Changed defaults for Client-Onboarding YAML configuration file
• SCR-1511: Update Apache Commons Codec from v.1.17.0 to v1.17.2
• SCR-1512: Updated Apache Commons Codec library from v1.6.0 to v1.9.0
• SCR-1513: Update Apache Commons CSV from v1.6 to v1.13.0
• SCR-1514: Limit number of addressed keys per MGET operation (support#340)
• SCR-1522: Updated Snappy library from v1.1.10.5 to v1.1.10.7
• SCR-1528: New Option "convert-guest" in "createuser" Commandline Tool
• SCR-1529: New "convertguest" Element for "create" in "OXUserService"
• Added appropriate OAuth scopes to mail compose actions
• Allow to overwrite securityContext
• Skip capability check and don't trigger preview generation if not needed
• Updated collabora and gotenberg dependency
• Changed copyright year to 2025
• Removed db defaults from values
  • Removed the db defaults so that they can be overriden by global entries
  • Also adjusted the mysql secret to use those defaults in case nothing is configured
• Gather subfolder ids for search from condition tree map (core#62)
• Convert guest to regular user (core#119)
• Disable Global Folder Cache by Default (core#142)
• Redirect to configured failure redirect location after erroneous token response (core#156)
• Updated to newest SLF4j and Logback libraries (core#163)
• Update cxf-libraries to 3.5.10 (CVE-2025-23184) (core#169)
• Added documentation article for database cleanup jobs (core#171)
• Subscribe/unsubscribe IMAP folder if deputy permission is granted/revoked (support#415)
• Use more compact token format (ui#697)

Fixed

• Connect CLT param access-denied-portal to code #189
• IIJMX-554: Don't use IMAP folder's sequence number when sorting by received date is performed in application
• INU-4767: Improved handling of corrupt address list
• Only check conflicts for added/updated attendees unless re-scheduled
• PLG-450: Continue if visible folders cannot be collected for non-default contacts account
• Fixed main by removing commons-cli-1.6.0 from target platform
• Adjusted documentation for 'flags' parameter
• Sorting of distribution list by first name #159
• Allow deletion of user attributes via json null values
• Cache invalidator instance to prevent excessive pub key requests
• Changed docu links to oss repo
• Enable test on borrow for redis connection pool
• Fixed AbstractAdvertisementConfigServiceTest
• Made flagging documentation more independent of the client
• Properly store host parameter during login
• Include system type when gathering subfolders for infostore search (core#62)
• Skip initial reachability check for remote redis connections (core#130)
• Fall back to storage access if accessing cache yields errors (core#135)
• Corrected link in Contacts Provider LDAP documentation article (core#140)
• Use only one cache region for advertisment config (core#141)
• Handle empty JSON input as no available value is Redis cache (core#143)
• Hard-delete mail(s) if located in trash folder (core#147)
• Don't attempt to invalidate caches if no group members are set (core#155)
• Explicitly use UTF-8 charset when writing vCards (core#162)
• Handle possibly absent password when checking subscribed mail account's status (core#168)
• Prevent from invalidating a remote node's JSlob entry if it has been stored after local node's entry (core#170)
• Pick proper mail from conversation when performing sort (core#175)
• Ignore unmappable ACLs when updating an IMAP folder's ACLs (core#179)
• More look-up attempts in case of missing draft (core#180)
• Fixed SQL 'INSERT INTO ... ON DUPLICATE KEY UPDATE' statement (core#183)
• Evaluate CARDDAV:limit in CARDDAV:addressbook-query Report (core#185)
• Consider all known 'devices' for CalDAV/CardDAV onboarding providers (core#186)
• Added config switch to keep own address when replying to self-sent message (core#187)