Sync-in/server v2.6.0

on GitHub

⭐ Highlights

• Draw.io support
  Draw.io diagrams can now be created and edited directly in Sync-in through either the provided Docker service or an external Draw.io instance. VSDX and Gliffy files can also be imported and saved as .drawio documents. Editing includes file locking, Save As support, and protection against closing documents with unsaved changes.

• Redesigned image viewer
  The image viewer has been completely redesigned for desktop and mobile. It now provides directory navigation, a thumbnail gallery, zooming and panning, pinch and swipe gestures, rotation, slideshow mode, fullscreen display, and image information such as dimensions.

• Persistent user preferences
  Interface preferences are now stored with each account and restored across sessions. Users can select an automatic, light, or dark theme, choose their preferred online office editor, control desktop system notifications, and decide whether hidden files should be displayed. In Quick Access, Recents and Favorites can be shown or hidden together or individually, then positioned within the menu to suit each user.

• Improved file creation and opening workflows
  The new file dialog now provides clearer document-type selection, including a compact selector on mobile. Newly created folders and supported documents can be opened immediately, with this option enabled by default. Opening a file without an available preview now displays a download prompt instead of starting an unexpected download.

• Improved online editor experience
  OnlyOffice and Collabora now follow theme changes dynamically. Editor toolbars are more responsive, active editing sessions refresh their file locks, and text, Markdown, and Draw.io editors share a consistent unsaved-changes confirmation.

• Redesigned public links
  The public-link dialog has been reorganized to make link identity, permissions, activation, expiration, access limits, and password protection easier to manage. Existing password protection can be preserved without entering a new password. Public pages also have an updated header and their own theme switch.

• Deletion-safe synchronization
  Each synchronization path can now be configured to ignore deletions, preventing removed files from being propagated between the client and server when this behavior is not desired.

• Improved keyboard and mobile navigation
  Selected files can now be opened with Enter, renamed with F2, and deleted with Delete. Mobile users gain reliable long-press context menus on iOS, a download shortcut, clearer tabs, and more stable breadcrumbs.

• Catalan language support
  Sync-in is now fully available in Catalan, including the interface, date formatting, authentication, file operations, administration, synchronization, editors, and notifications.

⚠️ Minor Breaking Changes

• Node.js 22.12 is now required: source-based installations must use Node.js 22.12.0 or newer. The backend now uses native ESM, so custom scripts or integrations importing server modules may require ESM-compatible imports.

• SMTP certificate verification is enabled by default: mail.rejectUnauthorized now defaults to true. Servers using self-signed or otherwise untrusted SMTP certificates must explicitly set it to false after assessing the security implications. The former mail.debug option has been removed; SMTP details are now controlled through mail.logger and the general logger.level.

• Hidden-file visibility is now a user preference: the global applications.files.showHiddenFiles setting has been removed. Hidden files are shown by default for accounts without an existing preference, and each user or guest can change this behavior from their account settings.

• Numeric trustProxy values are deprecated: numeric values are temporarily accepted but are converted to booleans: values greater than or equal to 1 become true, while lower values become false. Deployments should use an explicit boolean or a trusted proxy IP/CIDR list.

• External editor URLs are validated strictly: configured OnlyOffice, Euro-Office, Collabora, and Draw.io external servers must use valid absolute HTTP or HTTPS URLs. Malformed values that were previously accepted now fail configuration validation.

⚙️ Performance and Platform

• Lean loading of optional services
  Mail, Redis, authentication providers, and online editor modules are now loaded only when configured or enabled, reducing unnecessary startup work and dependencies while lowering memory usage by approximately 10%.

• More efficient database health checks
  Healthy database connections are no longer polled continuously.

• Stricter backend validation
  Request and configuration validation now use Zod with stricter typing, explicit user serialization, and more consistent error normalization.

• Updated server dependencies
  The backend has moved to NestJS 12, Redis 6, Nodemailer 10, Vitest 5, TypeScript 6, and native ESM.

🐞 Bug Fixes

• More reliable synchronization: temporary files receive their expected modification time before publication, synchronized-path and search matching are more precise, and completed desktop tasks no longer leave stale counters.

• More reliable previews and assets: image formats unsupported by Sharp are handled gracefully, PDF.js assets stay aligned with the installed dependency.

• Clearer uploads and file operations: multi-file uploads now produce a single localized summary covering successful, failed, and cancelled tasks. File-operation and trash errors also provide clearer translated messages.

• Improved spaces and breadcrumbs: space root levels are displayed in breadcrumbs, group-link paths are generated without unintended translation, and sidebar actions no longer overflow or shift mobile breadcrumbs.

• Improved interface consistency: editor toolbars, search controls, table rows, badges, dropdowns, dark-theme states, notifications, and mobile layouts have been refined. Tooltip hover areas and confirmation actions are also more reliable.

• Improved deployment and logging: Docker startup avoids redundant ownership changes for zero-padded user IDs, shutdown signals are logged, and backend, WebSocket, SMTP, and HTTP logging remain consistent with updated dependencies.

⚠️ Security

• Account-enumeration resistance and bounded password work
  Credentials are now verified before account state is disclosed, including with LDAP authentication. Local password checks are limited per submitted identifier, failures use consistent responses, and only successful WebDAV authentication results are cached.

• Hardened LDAP direct-bind authentication
  LDAP bind identities are normalized and escaped. Users are resolved from the authenticated DN, and ambiguous, incomplete, truncated, or unverifiable fallback results are rejected.

• Protected WebDAV authentication cache
  WebDAV cache keys now use a domain-separated HMAC instead of an unkeyed password digest. Cache lifetimes follow the configured access-token lifetime, and cached authentication is invalidated after security-sensitive user, group, permission, password, 2FA, or application-password changes.

• Stricter collaborative-space role boundaries
  Only administrators and regular users can become space managers. Guests and public-link identities can no longer access collaborative-space trash, and the personal-space alias is reserved when new space aliases are generated.

• Dotfiles excluded from static assets
  Files whose names begin with a dot can no longer be served through the server’s static-assets handler.

Special thanks to @cuquet for the Catalan translation, @Stephan-P for the Dutch translation update, and @Davidowi2 for improving the Code of Conduct.

Contributors: @cuquet @Stephan-P @Davidowi2

Features

• backend:editors: enhance config validation for external server URLs with trimming and URL checks (eabca87)
• backend:sync: expose ignore-delete path setting (8fb800b)
• editors: introduce unified unsaved changes prompt component and improve toolbar responsiveness (c725cf5)
• editors: support dynamic UI theme for OnlyOffice and Collabora (18e49f9)
• files: add Draw.io diagram editing support (837132b)
• files: add user preference for showing hidden files (#295) (31ed436)
• files: support saving VSDX and Gliffy imports as draw.io (0b44510)
• frontend:admin: clarify user and group switch labels (900288d)
• frontend:files: add "Open after creation" option in file dialog (5acfad9)
• frontend:files: add a compact file type selector on mobile (c6c8c22)
• frontend:files: add download shortcut to mobile toolbar (e64876d)
• frontend:files: add keyboard shortcuts to open, rename and delete files (a3ba5c1)
• frontend:files: allow opening folders after creation (e340796)
• frontend:files: enable open after creation by default (7ffc5b8)
• frontend:files: group upload completion notifications with localized summaries (8662e7b)
• frontend:files: prompt before downloading files without a preview (161aa51)
• frontend:files: refresh editor locks during active sessions (d7f0be2)
• frontend:links: refresh shared link dialog design (999efa5)
• frontend:search: redesign result list and scope component styles (39079d5)
• frontend:style: unify selection panel spacing and row heights (8de91c4)
• frontend: add logout actions to sidebar and user account (68c2d2e)
• frontend: image viewer redesign (#290) (aa2e988)
• frontend: show root levels in space breadcrumbs (547fac1)
• frontend: update public link header (697ccb2)
• i18n: add localization strings for enhanced trash and file operation errors (d98e1d3)
• links: add theme switch to public link pages (6dcb748)
• users: add configurable quick access preferences (65f377a)
• users: persist desktop notification display preference (e07d339)
• users: persist theme and editor preferences (ac0045d)

Bug Fixes

• backend:auth: align WebDAV cache TTL and invalidate stale auth (e952350)
• backend:auth: harden WebDAV cache keys with HMAC (55ade5c)
• backend:auth: prevent account enumeration and limit password work (56ea729)
• backend:auth: update logging level to verbose for TLS CA check (2c16f59)
• backend:config: deprecate numeric trustProxy values and map them to booleans (1b922e1)
• backend:files: handle image formats unsupported by Sharp. (2b4c12b)
• backend:ldap: harden direct-bind identity resolution (7101296)
• backend:logger: adapt response logging to nestjs-pino v5 (0d56a0b)
• backend:logger: restore cyan prefixes with pino-pretty 13.2 (19cd35b)
• backend:mailer: migrate to Nodemailer 10, harden TLS and align SMTP logging (29062f7)
• backend:sync: apply mtime to temporary file before publication (43dbbd7)
• backend:websocket: align logger visibility with IoAdapter (bf5108c)
• backend: prevent serving dotfiles as static assets (8ab8d30)
• docker: avoid redundant chown for zero-padded IDs (9b09dd7)
• frontend:admin: disable group link translation in path generation (c9363c2)
• frontend:files: bind Enter key to trash confirmation (49f80a7)
• frontend:files: detect unsaved draw.io changes before closing (1fbc470)
• frontend:files: harmonize editor toolbars and search controls (8eff702)
• frontend:i18n: correct Catalan translations and pluralization (56da3a7)
• frontend:links: move MIME icon next to link name and clarify creation button label (2975f14)
• frontend:links: prevent copy link button flicker (0e61b4f)
• frontend:search: adjust class binding for loading icon in navbar search (293e04b)
• frontend:sync: clear stale desktop task counters on completion (bdb9a41)
• frontend:sync: harden search and synchronized path matching (874de6f)
• frontend:sync: rename transfers column from Sync to Name (46b2cd1)
• frontend:users: simplify quick access labels and translations for consistency (737bb47)
• frontend: add MIME icon alias for audio/x-mpegurl (dfa625d)
• frontend: align badge components and preserve tooltip hover areas (cacdd75)
• frontend: hide refresh buttons on small screens (974387f)
• frontend: hide tab labels on mobile and align tab heights (56de3ca)
• frontend: prevent sidebar title actions overflow and mobile breadcrumb shift (536364e)
• frontend: support long-press context menus on iOS (fe54723)
• spaces: enforce role capabilities and reserve personal aliases (3877fa0)