Sync-in/server v2.6.2 on GitHub

⭐ Highlights

Configurable single-click navigation
Users can now choose to open items with a single click instead of a double click. The preference applies across file browsers, favorites, shares, links, search results, administration views, and synchronization pages, while touch gestures and context menus remain handled separately. User settings are also now grouped on a dedicated Preferences page. (#321)
Relative navigation between Markdown notes
Relative links can now open sibling or parent Markdown documents directly in the viewer. Paths containing spaces, URL-encoded characters, and heading fragments are supported, while destination permissions and repository boundaries remain enforced. Unsaved source edits are preserved during navigation. (#311)
Responsive breadcrumb navigation
Long or deeply nested paths now collapse into a compact dropdown when space is limited. Every parent level remains directly accessible, with interactions adapted for desktop, mobile, keyboard, and pointer navigation. (#319)
OnlyOffice plugin support
OnlyOffice sessions no longer disable the Document Server plugin interface, allowing installed plugins to be accessed directly from the editor. (#322)

🐞 Bug Fixes

Downloads no longer start unexpectedly
Files that cannot be previewed, contain binary data, or exceed the editor size limit now display a clear download prompt instead of downloading automatically.
Hidden files stay out of recent items
When hidden files are disabled in user preferences, hidden files and folders are no longer added to or returned by the recent-items view. Explicit hidden-file lookups used by Markdown navigation also leave recent items unchanged.
More reliable MariaDB connections
Idle database connections are now recycled before becoming stale, reducing failures after long periods of inactivity.
Complete MIME icons in npm packages
MIME icon symlink targets are now materialized during npm packaging, ensuring that all aliased icons—including modern Microsoft Office formats—are included in npm installations. (#318)
Cleaner responsive layouts
Permission controls and member rows remain usable on narrow screens. The Markdown toolbar adapts to smaller widths, long WebDAV addresses are truncated correctly, and dropdowns remain above surrounding content.
Improved translations

⚠️ Security

Public-link credentials bounded by link expiration
Access, refresh, WebSocket, and CSRF credentials issued for an expiring public link are now capped to its remaining lifetime. Refreshing credentials cannot extend them beyond that boundary, and access consumption atomically rejects links that have already expired. (#315)
Special thanks to @tynianov1 for contributing this security improvement.
API token isolation for public links
Public-link pseudo-users can no longer obtain or refresh bearer tokens through the API token endpoints. They remain restricted to the dedicated browser-cookie authentication flow.

Contributors: @BlaiseLebreton @lakemike @tynianov1

frontend:breadcrumb: add responsive compact navigation dropdown (d4f77e6)
frontend: breadcrumb overflow dropdown (#319) (b6304a1)
frontend: navigate relative markdown note links (#311) (bd8aa12)
navigation single click preference (#321) (43683d1)
onlyoffice: enable plugins (#322) (505219f)
users: move user preferences to a dedicated page (01e798e)

backend:auth: enforce link expiration on token refresh (#315) (c0148f0)
backend:auth: prevent link accounts from receiving API tokens (24e14b6)
backend:database: recycle idle pool connections before MariaDB timeout (2584b30)
backend:files: respect hidden-file preference in recents (e4144db)
build: include MIME symlink targets in npm package (#318) (b922b25)
frontend:breadcrumb: align compact dropdown across breakpoints (00b22a4)
frontend:files: prompt before downloading unpreviewable files (0cbffc7)
frontend:i18n: add missing document not found translations (e6c0038)
frontend: improve responsive permissions layout (d610696)
frontend: refine mobile toolbar layout and dropdown layering (bbbc4ea)