Table of Contents

• Changelog for 8.2.2

Changes in 8.2.2

Summary

• Security - Bump vulnerable dependencies: #13080
• Security - Bump vulnerable web dependencies: #13210
• Bugfix - Fix AuthApp and basic auth requests with custom PROXY_USER_OIDC_CLAIM: #13078
• Bugfix - Fix the LDAP master-ID filter when the base filter is empty: #13096
• Bugfix - Keep /me working when the preferred language lookup fails: #13188
• Enhancement - Allow ownCloud Marketplace in ocis_multi CSP: #13090

Details

• Security - Bump vulnerable dependencies: #13080

  Bumped bump vue to 3.5.43

  #13080

• Security - Bump vulnerable web dependencies: #13210

  Bumped vite to 7.3.7, markdown-it to 14.3.3 and follow-redirects to 1.16.1 to
  address CVE-2026-112942, CVE-2026-111758, CVE-2026-111759, CVE-2026-111755 and
  CVE-2026-111756.

  #13210

• Bugfix - Fix AuthApp and basic auth requests with custom PROXY_USER_OIDC_CLAIM: #13078

  We fixed AuthApp (app password) and HTTP basic auth requests returning an
  internal server error whenever PROXY_USER_OIDC_CLAIM was set to anything other
  than its default value. Both authenticators put the already authenticated user
  directly into the request context instead of faking incomplete claims for the
  account resolver to re-resolve. We also made sure a user who only ever
  authenticates this way still gets a default role assigned, and that these
  requests keep getting rejected on deployments with multiple instances enabled,
  since neither carries tenant-membership information.

  #13078

• Bugfix - Fix the LDAP master-ID filter when the base filter is empty: #13096

  The function EnhanceFilterWithMasterID in ocis-pkg/ldap/filter.go adds a
  master-ID clause to an LDAP filter with OR. An empty filter means "no
  restriction". Before this fix, the function replaced an empty filter with a
  master-ID-only filter. This action restricted an unrestricted search to
  master-ID users only.

  The bug broke the search for a user on another instance in multi-instance
  deployments. This search uses the Graph API endpoint /graph/v1.0/users.
  Multi-instance deployments use this search to find a user to share a resource
  with.

  Now the function keeps an empty filter unchanged. The function still adds a
  master-ID clause to a filter that is not empty.

  The graph, auth-basic, users, and groups services also use this function
  to compute their default LDAP user filter when OCIS_MULTI_INSTANCE_MASTER_ID
  is set. An empty user filter now means these services resolve or authenticate
  every user in the shared LDAP directory, not only master-ID users. Each of these
  services now rejects startup when OCIS_MULTI_INSTANCE_MASTER_ID is set and its
  own user filter is empty. Set an explicit OCIS_LDAP_USER_FILTER for every
  multi-instance deployment.

  #13096

• Bugfix - Keep /me working when the preferred language lookup fails: #13188

  The graph service returned HTTP 500 for the whole GET /graph/v1.0/me response
  whenever the settings lookup for the user's preferred language failed, including
  on a transient timeout. Since /me is the first request the Web UI makes after
  login, that locked affected users out of oCIS entirely. The lookup failure is
  now logged at warn level and preferredLanguage falls back to
  OCIS_DEFAULT_LANGUAGE.

  #13188

• Enhancement - Allow ownCloud Marketplace in ocis_multi CSP: #13090

  The ocis_multi deployment example's default Content-Security-Policy
  configuration was updated to allow connections to the new ownCloud Marketplace
  domain, matching the change already applied to the other deployment examples.

  #13090