Table of Contents

• Changelog for 8.0.10

Changes in 8.0.10

Summary

• Security - Mask secret values in the proxy debug output: #13220
• Security - Bump go-jose and ignore CVE-2026-116587 for go-jose/v3: #13342
• Security - Bump idp frontend dependencies: #13345
• Bugfix - Skip a not-ready node before reusing a cached grpc client: #13147
• Bugfix - Disable the persistence of the gateway provider cache: #13220
• Enhancement - Bump Reva version: #13152
• Enhancement - Add NATS JWT authentication with a .creds file: #13220

Details

• Security - Mask secret values in the proxy debug output: #13220

  The debug server of the proxy service did not mask all secret configuration
  values. The proxy now masks these values. A new test checks that every secret
  value of the proxy configuration stays masked.

  #13220

• Security - Bump go-jose and ignore CVE-2026-116587 for go-jose/v3: #13342

  We've bumped go-jose/v4 to v4.1.6 to fix CVE-2026-116587, a denial of service
  when parsing JWKs that contain RSA keys.

  The indirect dependency go-jose/v3 has no fix for CVE-2026-116587. It comes from
  libregraph/lico. Lico reads JWKs only from local files and from configured OIDC
  authorities. We've fixed go-jose/v4 and we ignore the go-jose/v3 finding in the
  Trivy scan.

  #13342

• Security - Bump idp frontend dependencies: #13345

  We've refreshed the idp frontend lockfile to pick up fixes for two transitive
  dependencies. follow-redirects moves to 1.16.2, which fixes CVE-2026-111755,
  CVE-2026-111756 and CVE-2026-116689, three information disclosures via
  cross-origin redirects. decode-uri-component moves to 0.5.1 through
  query-string 9.5.1, which fixes CVE-2026-118664, a denial of service via
  malformed percent-encoded input.

  Both fixes were already allowed by the version ranges the idp declares, so no
  dependency was bumped across a major version.

  #13345

• Bugfix - Skip a not-ready node before reusing a cached grpc client: #13147

  The grpc client selector cached one client per resolved node address. It
  returned that client without a health check. When a node died, every caller kept
  reusing the same cached client. Every call against that node waited for grpc's
  default connect timeout before it failed.

  pkg/rgrpc/todo/pool/selector.go now stores the connection together with the
  client. The selector shuffles the known node addresses on each lookup. This way,
  load still spreads across nodes. The selector then walks the addresses and skips
  any cached connection in the TransientFailure, Connecting, or Shutdown
  state. It returns the first node that is ready, or dials a node it has not tried
  yet. If no known node is ready, the selector reuses the first node it found. The
  caller then gets a fast, real error instead of a long stall.

  #13147
  owncloud/reva#766

• Bugfix - Disable the persistence of the gateway provider cache: #13220

  The gateway service sent the wrong config key to reva for the provider cache.
  Reva reads the key cache_disable_persistence, but the gateway sent
  disable_persistence. Thus the variables OCIS_CACHE_DISABLE_PERSISTENCE and
  GATEWAY_PROVIDER_CACHE_DISABLE_PERSISTENCE had no effect on the provider
  cache. The provider cache always used persistence.

  The gateway now sends the correct key. Check your configuration before you
  upgrade. If OCIS_CACHE_DISABLE_PERSISTENCE=true is set, the provider cache now
  stops the persistence. This is the documented behavior.

  #13220

• Enhancement - Bump Reva version: #13152

  Bumped reva version

  #13152

• Enhancement - Add NATS JWT authentication with a .creds file: #13220

  A NATS server in operator (JWT) mode authenticates a client with a user JWT and
  an NKey seed. Before this change, oCIS could connect to NATS only with a
  username and a password. Thus oCIS could not use a shared NATS cluster with one
  NATS account for each instance.

  OCIS now accepts JWT credentials for all NATS connections: the events, the
  caches, the persistent stores, the service registry, and the health checks. You
  can give the path of a NATS .creds file or the content of such a file:

  • OCIS_NATS_CREDS_FILE: the path of a .creds file. oCIS reads the file again
    on each reconnect, so a rotated JWT works without a restart. -
    OCIS_NATS_CREDS: the content of a .creds file. Use it when you cannot mount
    a file.

  Each service also has its own variables, for example PROXY_EVENTS_CREDS_FILE
  and GRAPH_CACHE_CREDS. The service registry reads
  MICRO_REGISTRY_AUTH_CREDS_FILE and MICRO_REGISTRY_AUTH_CREDS. If they are
  empty, the registry uses the OCIS_NATS_* variables. The registry reads only
  environment variables, not the ocis.yaml file.

  A service-specific variable takes precedence over a global variable. In the same
  scope, the content takes precedence over the file.

  When JWT credentials are set, oCIS does not send the username and the password.
  This rule also uses the scope. Example: OCIS_NATS_CREDS_FILE is set, and
  GRAPH_CACHE_AUTH_USERNAME and GRAPH_CACHE_AUTH_PASSWORD are set. Then the
  graph cache uses the username and the password. A username or a password alone
  does not replace the JWT credentials. The same applies to
  MICRO_REGISTRY_AUTH_USERNAME and MICRO_REGISTRY_AUTH_PASSWORD for the
  service registry.

  OCIS checks the credentials at startup and gives a clear error for an invalid
  value. oCIS checks the credentials of a store or a cache only when its type is
  nats-js or nats-js-kv. Other types do not use the credentials.

  The embedded nats service does not support JWT mode. To use JWT authentication,
  run an external NATS cluster in operator mode and do not start the embedded nats
  service, for example with OCIS_EXCLUDE_RUN_SERVICES=nats.

  The NATS health checks of the services now use the same authentication and TLS
  settings as the service connections. Before this change, the health checks
  connected without credentials and without TLS. The proxy health check also used
  the events cluster ID as the NATS address. It now uses the events endpoint. Each
  health check skips the check when the NATS address is empty. Each health check
  keeps one NATS connection and uses it again for each probe. Each probe sends a
  PING to the NATS server, so the check finds a lost server at once. A slow NATS
  server does not block the other probes. The health check of a store succeeds
  when one node of the store is reachable, like the store connection.

  The userlog service had no default node for its store. With
  OCIS_PERSISTENT_STORE=nats-js-kv it could not connect to NATS. It now uses
  127.0.0.1:9233 like the other services.

  The create home cache of the gateway service did not get the TLS settings. It
  now has the variables GATEWAY_CREATE_HOME_CACHE_ENABLE_TLS,
  GATEWAY_CREATE_HOME_CACHE_TLS_INSECURE, and
  GATEWAY_CREATE_HOME_CACHE_TLS_ROOT_CA_CERTIFICATE, and it uses the global
  OCIS_CACHE_* TLS variables.

  #13220