Release date: July 13, 202 · Repository: owncloud/ocis · Release page: https://github.com/owncloud/ocis/releases/tag/v8.2.0-rc.1
This is a release candidate, not a general-availability release.
It is intended for testing ahead of the 8.2.0 final release and should not be deployed to production without your own validation.
Behavior described here can still change before 8.2.0 ships.
8.2.0 RC1 carries forward the security fixes shipped in 8.1.0 (#12092, #12301, #12332) and adds three new ones (#12398, #12490, #12493), 43 bugfix pull requests, and 36 enhancement pull requests. The largest single theme is a set of changes that reduce what unauthenticated or under-authenticated clients can do against the Graph and WebDAV surfaces.
Security (#12092, #12301, #12332, #12398, #12490, #12493)
- #12490 — OIDC group sync is now opt-in. Previously enabled by default, it now defaults to empty. This is a behaviour change on upgrade: if you rely on group assignment from OIDC claims, you’ll need to explicitly enable group sync after upgrading. The rationale is that a default-on sync from OIDC claims could produce unintended group membership if upstream claims weren’t tightly scoped, so admins now make that choice explicitly.
- #12493 — PATCH /graph/v1.0/me blocked from modifying password and account fields. The self-service profile endpoint could reach beyond profile metadata into password and account fields. Closed, so a user updating their own profile can no longer touch fields they shouldn’t.
- #12398 — WebDAV responses no longer leak internal error detail. Stack traces and internal state that could previously appear in error response bodies are now suppressed. Clients get generic error messages; the detail stays server-side.
- #12332 — Signing-key endpoint no longer reachable from public share sessions. Broken-access-control fix on a credential-adjacent endpoint. This fix also appeared in the 1.0 release; it’s carried forward here.
- #12301 — libvips upgraded to close a stack buffer overflow in the image library used for thumbnail and preview generation. Also carried forward from 8.1.0.
- #12092 — X-XSS-Protection: 0 header now set explicitly to turn off the deprecated browser XSS filter (which is known to introduce its own side-channel vulnerabilities in some browsers). Real XSS mitigation continues to come from the Content-Security-Policy Also carried forward from 8.1.0.
An X-XSS-Protection header was added to responses. libvips was upgraded to fix a buffer overflow, consistent with the same category of fix that shipped in 8.1.0. A signing key exposed through public share sessions was fixed by closing the exposure path. OIDC group sync, previously enabled by default, is now opt-in with an empty default; this matters because a default-on group sync from OIDC claims could result in unintended group assignment if claims were not tightly scoped upstream, and making it opt-in means admins now choose explicitly whether to sync groups at all. The PATCH /graph/v1.0/me endpoint is now blocked from modifying password and account fields, closing a path where a user’s own self-service profile update could touch fields beyond profile metadata. And WebDAV responses no longer leak internal error detail, so stack traces or internal state that may previously have appeared in error bodies are no longer returned to clients.
Bugfixes (43 pull requests)
Notable fixes include:
- search being disabled when previews are turned off,
- a NATS readiness check that was hitting the wrong endpoint,
- double HTML-escaping in emails sent to multiple recipients,
- personal spaces being wrongly disabled when a permission check was inconclusive rather than a clear denial,
- WOPI Lock requests in read-only mode returning an incorrect status code, audit logging gaps for share updates,
- OIDC group membership not being retained correctly, revision blob purging, and
- postprocessing command flag handling.
See the release page for the complete list.
Enhancements (36 pull requests)
- Vault storage, the MFA-gated storage type introduced in 8.1.0, continues to receive attention here with vault-specific capabilities and theming.
- The identity provider login flow moves from a React single-page app to server-rendered pages.
- Search gains numeric range KQL queries, matching the capability introduced in 8.1.0.
- New CLI commands support blobstore inspection and the search optimize
- Admins can now disable public sharing and direct sharing independently as configuration options.
- The SpaceEditorWithoutVersionsWithoutTrashbin role, also introduced in 8.1.0, is present in this line as well.
- Documentation gains a Keycloak deployment example.
- ownCloud Web is bumped, and the Reva dependency, Go modules, and npm dependencies all receive version and patch updates.
See the release page for the complete list.
Upgrade and migration notes
Because this is a release candidate, treat any upgrade as a test-environment activity first.
Behaviour change for admins to know about: OIDC group sync was default-on in previous releases and is now default-off with an empty default. If your deployment relies on group assignment from OIDC claims, add the explicit configuration to your upgrade plan.
The IDP login flow change (SPA to server-rendered) is worth testing against any custom login theming or embedded login flows before rolling forward.
No other breaking changes were called out in the release notes.
If you want features ahead of the 8.2.0 stable release, this RC is where you can start testing. Alongside the nightly download server, release candidates are the early-access path for admins and integrators willing to run against pre-stable code.
Full release notes with all 43 bugfixes and 36 enhancements: v8.2.0-rc.1. This RC is intended for test environments; review the release notes fully before finalizing your test plan.
This RC1 represents work from the engineering team across security, storage, identity, and Web frontend surfaces, plus community bug reports and code reviews that surfaced many of the fixes above. 85 PRs (6 security + 43 bugfix + 36 enhancement) rest on dozens of contributors, reviewers, and community bug reporters.
Credit to everyone that helped make this happen!
