8.2.2 - 2026-11-11
❤️ Thanks to all contributors! ❤️
@AlexAndBear, @JammingBen, @andrewyager, @butonic, @kulmann, @saw-jan, @tammi-23, @v-scharf
🔒 Security
- [main] fix: port security fixes from web-internal [#4433]
- fix: render svg previews as images instead of inlining them [#4298]
- fix: only accept delegated tokens from the embedding host [#4297]
- fix: verify the sender of postMessage events in picker modals and external apps [#4289]
🐛 Bug Fixes
- fix: show topbar logo on account page for public links and guests [#4417]
- fix: remove the slash when the editor block menu is dismissed [#4334]
- fix: only cancel the embedded picker on Escape without a selection [#4399]
- fix: count down the rate limit wait on the guest link renew page [#4387]
- fix: support card wrap buttons when they exceed the card [#4415]
- fix: pick the target folder when saving or exporting from Collabora [#4374]
- fix: don't render a revoked space image url after the image changed [#4404]
- fix: pick up external file updates in a guest's open editor [#4385]
- fix: keep positioned content inside the sidebar panel body [#4401]
- fix: only show the office settings to users who can manage fonts [#4398]
- fix: escape link and image targets and titles when saving markdown [#4316]
- fix: use object-cover for space overview images [#4413]
- fix: don't select a row when its link starts a navigation [#4408]
- fix: wrap long values in share access details [#4382]
- fix: set remoteItemId on shortcuts and files created in a share [#4384]
- fix: don't query an empty toggle selector when opening a mobile drop [#4400]
- fix: fit rotated preview images into the stage [#4405]
- fix: normalize guest addresses like the server stores them [#4403]
- fix: grammar [#4409]
- fix: keep unlocked vaults in sync when moving their parent folder [#4383]
- fix: show an error when the search fails and search again on resubmit [#4365]
- fix: don't treat text after a dot as file extension when it contains spaces [#4369]
- fix: don't select the whole text field value on click [#4362]
- fix: don't offer creating or copying into a view-only space root [#4360]
- feat: make the support card stand out in the sidebar [#4346]
- fix: wrap long resource names when truncation is disabled [#4381]
- fix: show an error message when loading a folder or list fails [#4356]
- fix: handle name clashes inside a move or copy batch and cancel on closing the conflict dialog [#4355]
- fix: keep deleted files up to date and don't restore items restored elsewhere [#4283]
- fix: show hidden shares when a link points to a hidden share [#4349]
- fix: remove just added tags in the shares views [#4347]
- fix: title the not found page for inaccessible project spaces [#4337]
- fix: hide sponsor link and version in the sidebar in embed mode [#4370]
- fix: don't return to redirect-only routes when cancelling a vault unlock [#4294]
- fix: use the shared sorting and pagination in the spaces and trash overviews [#4270]
- fix: resolve links into another user's personal space via the file id [#4315]
- fix: don't throw when the list refresh after a failed upload fails [#4336]
- fix: enforce the password policy when setting a vault password on the unlock page [#4335]
- fix: skip the access revoked message when access to a share remains [#4313]
- fix: fall back to shared with me when a share's mount point is gone [#4345]
- fix: keep an open app in place when the folder of its file gets renamed [#4292]
- fix: don't load shares of disabled project spaces [#4338]
- fix: list a partially duplicated space and tell the user it's incomplete [#4290]
- fix: scroll to the current search match when the search term changes [#4314]
- fix: keep a space when access remains after a member removal [#4312]
- fix: keep image embeds in markdown when saving [#4340]
- fix: copy only the selected content in the markdown editor [#4271]
- fix: keep moved items in favorites and search results [#4282]
- fix: keep upload batch out of uppy until it is prepared [#4327]
- fix: show the load error for video and audio files that can't be played [#4251]
- fix: ignore update-token messages without an access token in delegated embed mode [#4215]
- fix: report a created space when only some files could not be copied [#4252]
- fix: keep the list filters when stepping through files in the preview [#4246]
- fix: show the server's upload error on servers without TUS [#4243]
- fix: restore notification preference checkboxes when saving fails [#4244]
- fix: open public links with a path after the token [#4240]
- fix: show not found in apps for an unknown space or a route without a file [#4259]
- fix: improve focus management of the select after picking an option [#4262]
- fix: keep the text editor search and replace panel as a drop on mobile [#4309]
- fix: skip the rename request when the name is unchanged [#4237]
- fix: keep the open file unchanged when its store entry is renamed [#4303]
- fix: reload a filtered users list instead of adding a newly created user [#4239]
- fix: follow a rename of the file open in an app [#4300]
- fix: show errors when setting a space icon, image or description fails [#4211]
- fix: reload the user after a partially failed save in the edit user panel [#4212]
- fix: ignore items-per-page values below 1 [#4213]
- fix: keep failed recipients selected in the invite form [#4206]
- fix: don't preselect a quota for several items with different quotas [#4205]
- fix: report delete, paste and restore failures on network errors [#4192]
- fix: show the full value of truncated user content on hover [#4124]
- fix: revert the tags selection when a tag change fails [#4167]
- fix: remove removed resources from the selection [#4168]
- fix: wait for a running save before asking about unsaved changes on close [#4277]
- fix: keep folders with # in their name in the preview and drive redirect URLs [#4174]
- fix: trim embed-file-types values from the URL query [#4169]
- fix: refresh file list when all files of an uploaded folder fail [#4207]
- fix: ignore deferred panzoom transforms after the preview image is gone [#4216]
- fix: keep favorite state and tags on the received share root [#4208]
- fix: show an error for EPUB files that can't be opened [#4209]
- fix: show message for spaces skipped when duplicating [#4210]
- fix: stream vault content encryption block by block [#4125]
- fix: stop the shares panel loader when loading the shares fails [#4203]
- fix: let app tokens expire on the picked day [#4202]
- fix: show the current space size in the space details after uploads and deletions [#4204]
- fix: redirect /files/search to the search results page [#4214]
- fix: rename dot-files correctly when file extensions are hidden [#4157]
- fix: keep parent folder links and name tooltips usable for non-clickable resources [#4242]
- fix: refetch notifications when opening the bell or returning to the tab [#4166]
- fix: stay in folders with a # in their name when the scrollTo param is reset [#4165]
- fix: keep the guest session when unlocking a vault [#4264]
- fix: show an error when creating share links fails in embed mode [#4170]
- fix: save expiration date of shares with custom permissions [#4172]
- fix: use the full name as title for dot-files [#4173]
- fix: keep upload batch out of uppy while the conflict dialog is open [#4140]
- fix: don't return to a permanent link when cancelling a vault unlock [#4155]
- fix: prevent duplicate GDPR export requests on double click [#4156]
- fix: align shift-click range selection in admin lists and files table [#4236]
- fix: replace the selection when dragging an unselected file [#4153]
- fix: match embed file types case-insensitively [#4154]
- fix: stream archive downloads on password protected public links [#4115]
- fix: keep the guest session when a guest opens a route that needs a user [#4086]
- fix: list sharers with the same display name separately in the Shared By filter [#4152]
- fix: show the locked message when uploading onto a locked resource [#4109]
- fix: show restored files again after undoing a delete on the search results page [#4175]
- fix: keep the requested route when delegating authentication in embed mode [#4191]
- fix: leave the oidc callback page when the sign-in fails [#4218]
- fix: keep network errors when loading webdav files fails [#4171]
- fix: ignore cancelled loading when leaving admin users, groups and spaces [#4138]
- fix: escape double quotes in search queries [#4094]
- fix: show error message when refreshing the file after a version restore fails [#4137]
- fix: finish adding space members when the space refresh fails [#4126]
- fix: don't carry the query of other views into the search [#4128]
- fix: reload the folder README when README.md changes [#4114]
- fix: respect reduced motion for the EPUB reader progress shimmer [#4136]
- fix: reload after continuing with an unsupported browser [#4110]
- fix: find scrollTo targets on all pages of the file lists [#4118]
- fix: show error message when loading admin groups or spaces fails [#4127]
- fix: show "No favorites found" when a favorites filter matches nothing [#4129]
- fix: ignore cancelled resource loading when opening an app via fileId [#4130]
- fix: correct forbidden characters in space name error [#4108]
- fix: apply sse file events after running folder load [#4083]
- fix: wait for a running save instead of hanging in AppWrapper [#4131]
- fix: keep long values in the admin users and spaces tables in bounds [#4116]
- fix: prevent double profile picture upload on repeated set [#4107]
- fix: reset avatar file input after a rejected file [#4106]
- fix: trim group names when creating and renaming groups [#4105]
- fix: show error message when restoring a file version fails [#4102]
- fix: hide extension preferences with only one option [#4112]
- fix: focus the first input when opening text entry modals [#4089]
- Rework the EPUB reader [#3924]
- fix: hide guest invites when guest links are disabled [#4071]
- fix: pause toasts, fix pagination semantics and name upload states [#4069]
- fix: show all invite search results returned by the server [#4081]
- fix: restore parent folders before their children from the trash [#4076]
- fix: play flac files in chromium browsers [#4080]
- fix: raise contrast, target sizes and visibility of small UI parts [#4074]
- fix: copy action for the current folder [#4073]
- fix: versions for guest users [#4067]
- fix: prevent clipped descenders in resource names [#4072]
- fix: restore the cleartext name when undoing a deletion in a vault [#4024]
- fix(text-editor): allow inline code inside other marks in markdown [#4066]
- fix: keep upload info closable when folder creation fails [#4030]
- fix: resolve permanent links into unsynced shares [#4042]
- fix: only escape markdown text where it would be read as syntax [#4038]
- fix: more small a11y fixes from the audit [#4043]
- fix: truncate long sidebar nav item labels [#4056]
- fix: validate name length in vaults [#4054]
- fix(preview): keep the active file when the folder changes [#4051]
- fix: keep raw html and decode named entities in markdown files [#4025]
- fix: small a11y fixes from the third audit round [#4023]
✅ Tests
- test(e2e): fix yjs test scenario behavior [#4222]
📦️ Dependencies
- fix(deps): update dependency vue-router to v5.5.0 [#4424]
- chore(deps): update devdependencies (non-major) [#4406]
- fix(deps): update dependency @casl/ability to v7.1.2 [#4423]
- fix(deps): update dependency vue-inline-svg to v5 [#4326]
- chore(deps): update dependency eslint-plugin-vue to v10.12.1 [#4414]
- fix(deps): update dependency vitest-mock-extended to v6 [#4402]
- chore(deps): update typescript-eslint monorepo to v8.72.2 [#4411]
- chore(deps): update dependency axios to v1.21.1 [#4410]
- chore(deps): update dependency fast-xml-parser to v5.12.0 [#4253]
- chore(deps): update uppy monorepo [#4254]
- chore(deps): update dependency license-checker-rseidelsohn to v5 [#3386]
- chore(deps): update devdependencies (non-major) [#4351]
- chore(deps): update shumc/imagor docker tag to v1.10.1 [#4350]
- chore(deps): update axllent/mailpit docker tag to v1.33.1 [#4372]
- chore(deps): update pnpm to v11.28.11 [#4310]
- chore(deps): update devdependencies (non-major) [#4324]
- chore(deps): update dependency filesize to v11.0.30 [#4275]
- fix(deps): update dependency @casl/ability to v7.1.1 [#4092]
- chore(deps): update pnpm to v11.28.10 [#4090]
- chore(deps): update devdependencies (non-major) to v4.3.4 [#4225]
- chore(deps): update devdependencies (non-major) [#4079]
- chore(deps): update traefik docker tag to v3.7.17 [#4091]
- chore(deps): update axllent/mailpit docker tag to v1.33.0 [#4093]
- chore(deps): update apache/tika docker tag to v4.3.0 [#4078]
- chore(deps): update collabora/code docker tag to v26.04.5.2.1 [#4010]
- fix(deps): update dependency qs to v6.17.1 [#4070]
- chore(deps): update hocuspocus monorepo to v4.8.0 [#4064]
- fix(deps): update dependency @casl/ability to v7.1.0 [#4065]
- chore(deps): update dependency @casl/vue to v3.1.0 [#4063]
- chore(deps): update node.js to v24.22.2 [#4060]
- fix(deps): update dependency @casl/ability to v7.1.0 [#4062]
- chore(deps): update dependency axios to v1.21.0 [#4044]
- fix(deps): update dependency qs to v6.17.0 [#4045]
- chore(deps): update pnpm to v11.28.9 [#4040]
- [full-ci] chore: bump opencloud for tests to 9.0.0 [#4037]
- chore(deps): update dependency focus-trap to v8.2.4 [#4035]
- chore(deps): update dependency eslint-plugin-vue to v10.12.0 [#4027]
- chore(deps): update dependency postcss to v8.5.32 [#4034]