Register thread pool tasks with the active-task watcher without a fair lock FCV-294: Update Gotenberg to 8.40.0 to fix CVE-2026-111497 ASB-453: Consider only a Content-ID as reference for inline images ASB-453: List inline images that are neither woven into the text nor referenceable ASB-439: Make the session-bound mail cache thread-safe, so that a unified inbox accessing many accounts in parallel no longer corrupts it ASB-284: Data export clean-up no longer deletes files of exports that start during its run or live in an unreadable schema ASB-434: Copy a user's files without spooling each one to the upload directory first Send IMAP search text in UTF-8 once UTF8=ACCEPT is enabled (core#120) ASB-279: Write non-ASCII attachment file names per RFC 2231 like Thunderbird, keeping the encoded-word in Content-Type ASB-279: Always B-encode non-ASCII file names, iOS Mail cannot decode mostly-ASCII ones Q-encoded either ASB-383: Serialize concurrent moves out of a mail folder and still move the messages left when some were removed meanwhile ASB-390: Search the "My attachments" Mail Drive folders by file name, size and date SCR-1719: Process at most 10 accounts of a Unified Mail operation at once, configurable via com.openexchange.unifiedinbox.maxConcurrentAccounts SCR-2130: Bound concurrent Argon2 key derivations ASB-342: Apply the rollout strategy of a core-mw StatefulSet as spec.updateStrategy ASB-334: Let the SOAP operation grantMultiple of OXDeputyPermissionsService accept a list of deputy permissions SCR-2050: Encrypt with AES/GCM in the key-based crypto methods instead of AES/CBC with a fixed IV Open redirects, ReDoS and unbounded RMI deserialization from SAST triage ASB-279: B-encode mostly non-ASCII file names so iOS Mail can decode them SCR-1793: Harden Redis connection lifecycle against stale/orphaned connected clients ASB-275: Close Redis connections that get established only after the connect timeout elapsed Recover from read-only replica after Redis Sentinel fail-over (support#1482) ASB-251: Scan downloads through share links ASB-251: Never hand session cookies, credentials or the request's own Content-Length to the anti-virus service ASB-252: Copying a user fails for attachments that reference an external URI instead of a stored file Resolve image URLs independent of the configured dispatcher prefix ASB-162: Parse mail filter rule metadata for non-IPv4 update sources and heal polluted rule names Default to UTC when delivering a nested message as JSON (support#1598) Take a snippet's identity from the database instead of stale file-storage headers (support#1329) Honor the timezone parameter when converting a single mail outside the get action (support#1598) Do not report a failed IMAP quota look-up as exceeded quota (support#1636) Keep writing a datamining report when a database schema is unreachable (support#1618) IMAP command injection through user flags and the headers request parameter Redirect reads to the master while a read replica reports broken or excessive replication lag (#4) Restore replica staleness check by tracking the replication monitor counter process-locally (support#1599) Redirect reads to the master while a read replica reports broken or excessive replication lag (#4) Restore replica staleness check by tracking the replication monitor counter process-locally (support#1599) Validate HTTP header names against RFC 9110 token rules in the Grizzly 2.4 codec (support#1603) Always provide the mail's display date, also for nested messages (support#1598) Report exact attachment sizes for composition space drafts (support#1585) Repoint openapi plugins to gitlab.com registry and bump to latest Validate From ownership on mail bounce (support#1531) action=bounce re-sent a stored message via ComposeType.NEW without checking that the From belongs to the authenticated user, allowing sender spoofing. BounceAction now runs the same ownership check as action=new through MimeMessageFiller.resolveSender2Account(checkSender=true) before transport, so a foreign From is rejected with INVALID_SENDER (MSG-0056). CP-572: Stop session removal from escalating to a full key-space scan when user/context has no sessions IOL-2841: Reconnect mail access when attachment handling takes too long On 8.35 the schedule/scheduleAtFixedRate/scheduleWithFixedDelay millisecond convenience overloads are abstract on TimerService, whereas on main they are default methods. The cherry-picked MailStorageReconnectTest.FakeTimerService stub only overrode the TimeUnit variants, so compileTestJava failed. Implement the three millisecond overloads so the stub compiles on the stable branch. Avoid writing periodic save-points (by default) to avoid possible access problems (core#486) Ignore possible "file not found" error when moving entity-associated files due to deletion of that entity (e.g. user deletion) (core#481) Keep user-specified setting for a config-cascade setting originating from non-user scope (core#356) Docker image missing stable-8.x tag when pushing release image Docker image missing stable-8.x tag when pushing release image The git version tag was created after buildahPushAllImages ran, so releaseTags() could not resolve the version and omitted the stable-8.x tag. Move the local tag re-creation before the push task. Avoid too many recursive calls when compiling IMAP SEARCH expression from a search term instance (support#1099) Avoid too many recursive calls when compiling IMAP SEARCH expression from a search term instance (support#1099) Added config option to Redis-based session storage to control execution of timer tasks (support#1276) INF-581: Always apply default HTTP headers in WebDAV responses, including new 'X-Powered-By' header IOL-2841: Periodically touch composition space cache during file upload to ensure it does not vanish from cache GDPR data export does not show errors from api (support#1158) Include the hint on successful data export that some modules might not have exported (support#1158) Orderly invalidate mail account even though connection in transaction state might be passed (core#452) Only check against configured values for "com.openexchange.mail.signature.maxImageLimit" greater than 0 (zero) (core#451) Orderly invalidate mail account even though connection in transaction state might be passed (core#452) Detect & drop harmful content in CDATA section (core#438) Added backticks around otherwise interpreted input (core#422) PBSR-1496: Prepare code to set value for future db column type for user/del_user tables Restore RFC 1123 compliant formatting of {DAV:}creationdate and {DAV:}getlastmodified (core#389) Orderly update folder's anonymous guest permission on follow-up mail transport attempt (core#384) Detect harmful content in CSS fragment (core#386) Drop "@import" words from CSS content (core#357) Orderly detect possibly harmful HTML content (core#361) Delete previously scheduled mail data along with associated message when re-editing as draft (core#358) Also consider <iframe> tag when checking for possible HTML content (core#379) Pass proper parameters on cache key generation (core#273) Orderly save scheduled mail as draft and re-schedule (core#358) Improved handling for failed transport of scheduled mails (core#364) Deny attribute values containing HTML fragments (core#336) Explicitly drop existent scheduled mail on edit (core#358) Use pagination when querying context identifiers (core#349) Use pagination when querying context identifiers (support#735) Orderly throw exception if endpoint is not configured with TLS (core#306) Prevent amount quota deadlocks while creating events (core#331) Deal with possibly dying connection when probing for FILENAME SEARCH capability Apply lowered read timeout when probing for file name search capability of an IMAP server (core#327) Aligned identifying fields when checking maximum size of returned event collections (core#245) Assume same mail back-end (user base) for primary and secondary accounts (support#545) Take client identifier from servlet path if possible (core#318) Use system proxies for APNs push if defined (core#281) Only inject credential provider if proxy username is configured for mail autoconfig (core#279) Add watch permission for role to allow watching secrets Added 'dontResolveEntities' parameter also for 'POST' request method variants (core#237) SCR-1558: Introduced 'dontResolveEntities' parameter to support import of separate event copies (core#237) test polishing extended documentation more documentation Keep local IP address in generated session (core#250) Escape illegal characters in cache filter suffix portions (core#239) Retry reinitialization of users_per_filestore table with manual INSERTs in case CREATE TABLE AS SELECT statement is prohibited (core#241) Corrected parameter handling when storing snippets into database (core#224) Applied various improvements in communication with Redis (support#527) Only update attributes if there are actual changes (core#193) Removed superfluous call to hard-delete messages when moving messages from Unified Mail's folder to another Unified Mail's folder (support#499) Create gitlab release from core pipeline Added folder mode to deputy permission feature (core#173) Added new lean properties to specify primary account's namespaces which are necessary when using Dovecot's DoveAdm API to manage deputy permissions (core#188) Fixed no-class-def error javax/net/ssl/SSLSocketFactory Fixed no-class-def error javax/net/ssl/SSLSocketFactory Prefer a local cache for too frequently queried context data (core#215) SCR-1528: Documentation for new "convert-guest" option Convert guest to regular user (core#119) Changed convertguest soap field to last position. Ref. #207 Basically training wheels for shitty soap clients. Support an S3 connector without database access (for chunking) (guard#1) SCR-1486: New property com.openexchange.carddav.addressbookMultigetLimit Added async provisioning framework Health Check for Redis Cache (core#134) Expose CardDAV URL for Address Book Folders (core#137) Warm-up Thread-local Cache when Handling Client Requests (core#138) Control Sharding for Redis Cluster (core#139) Fixed existing graphs and added new ones based on redis cache metrics (core#144) Add shared-read-only flag to snippet module to have shared snippets that may be seen, but must not be modified/deleted by other users Batch-resolve resources when handling CARDDAV:addressbook-multiget request INU-4548: Support configurable custom flag for mails SCR-1496: Enhanced OAuthAuthorizationService#validateAccessToken with Header collection parameter (core#74) SCR-1510: Changed defaults for Client-Onboarding YAML configuration file SCR-1511: Update Apache Commons Codec from v.1.17.0 to v1.17.2 SCR-1512: Updated Apache Commons Codec library from v1.6.0 to v1.9.0 SCR-1513: Update Apache Commons CSV from v1.6 to v1.13.0 SCR-1514: Limit number of addressed keys per MGET operation (support#340) SCR-1522: Updated Snappy library from v1.1.10.5 to v1.1.10.7 SCR-1528: New Option "convert-guest" in "createuser" Commandline Tool SCR-1529: New "convertguest" Element for "create" in "OXUserService" Added appropriate OAuth scopes to mail compose actions Allow to overwrite securityContext Skip capability check and don't trigger preview generation if not needed Updated collabora and gotenberg dependency Changed copyright year to 2025 Removed db defaults from values Removed the db defaults so that they can be overriden by global entries Also adjusted the mysql secret to use those defaults in case nothing is configured Gather subfolder ids for search from condition tree map (core#62) Convert guest to regular user (core#119) Disable Global Folder Cache by Default (core#142) Redirect to configured failure redirect location after erroneous token response (core#156) Updated to newest SLF4j and Logback libraries (core#163) Update cxf-libraries to 3.5.10 (CVE-2025-23184) (core#169) Added documentation article for database cleanup jobs (core#171) Subscribe/unsubscribe IMAP folder if deputy permission is granted/revoked (support#415) Use more compact token format (ui#697) Connect CLT param access-denied-portal to code #189 IIJMX-554: Don't use IMAP folder's sequence number when sorting by received date is performed in application INU-4767: Improved handling of corrupt address list Only check conflicts for added/updated attendees unless re-scheduled PLG-450: Continue if visible folders cannot be collected for non-default contacts account Fixed main by removing commons-cli-1.6.0 from target platform Adjusted documentation for 'flags' parameter Sorting of distribution list by first name #159 Allow deletion of user attributes via json null values Cache invalidator instance to prevent excessive pub key requests Changed docu links to oss repo Enable test on borrow for redis connection pool Fixed AbstractAdvertisementConfigServiceTest Made flagging documentation more independent of the client Properly store host parameter during login Include system type when gathering subfolders for infostore search (core#62) Skip initial reachability check for remote redis connections (core#130) Fall back to storage access if accessing cache yields errors (core#135) Corrected link in Contacts Provider LDAP documentation article (core#140) Use only one cache region for advertisment config (core#141) Handle empty JSON input as no available value is Redis cache (core#143) Hard-delete mail(s) if located in trash folder (core#147) Don't attempt to invalidate caches if no group members are set (core#155) Explicitly use UTF-8 charset when writing vCards (core#162) Handle possibly absent password when checking subscribed mail account's status (core#168) Prevent from invalidating a remote node's JSlob entry if it has been stored after local node's entry (core#170) Pick proper mail from conversation when performing sort (core#175) Ignore unmappable ACLs when updating an IMAP folder's ACLs (core#179) More look-up attempts in case of missing draft (core#180) Fixed SQL 'INSERT INTO ... ON DUPLICATE KEY UPDATE' statement (core#183) Evaluate CARDDAV:limit in CARDDAV:addressbook-query Report (core#185) Consider all known 'devices' for CalDAV/CardDAV onboarding providers (core#186) Added config switch to keep own address when replying to self-sent message (core#187)
App Suite UI
Next
Additional Components