Release dates: 1 July 2026 (4.8.2) and 21 July 2026 (4.8.3) · Repository: owncloud/android · GitHub releases: v4.8.2 · v4.8.3
Two quick patches on the 4.8.x Android line, three weeks apart. 4.8.2 carries the more substantive changes: a security fix that redacts cookie headers from HTTP logs, a UI rendering fix, and cleanup of a debug artefact that shouldn’t have shipped in production. 4.8.3 is a one-line fix for a broken in-app Help URL, released promptly rather than held back for a bigger bundle.
Neither release adds features. Both continue the pattern the 4.8.x line has settled into since 4.8.0 in May (space member management, scoped public links, emoji space images): hardening, cleanup, and quick response to issues surfaced through crash reporting and code review.
Summary
- Security in 4.8.2: Cookie headers are now redacted from HTTP logs. Any deployment using cookie-based session handling (ownCloud Server, or a reverse proxy that sets auth cookies) should update.
- Two UI and build bugfixes in 4.8.2: An „infinite edges“ rendering issue in list views is fixed, and a debug-only manifest file that had been packaged into release builds is gone.
- One in-app link fix in 4.8.3: The Help URL now points where it should.
Both releases are drop-in updates. No data migration. No configuration changes.
4.8.2 (1 July 2026)
Cookie headers redacted from HTTP logs (PR #4897)
The headline fix. When the Android app logged outgoing HTTP requests for debugging, the full value of the Cookie header could be included in log output. Cookie headers often carry session tokens and authentication credentials, especially when connecting to ownCloud Server or any backend that uses cookie-based session management. The fix replaces the Cookie header value with a redacted placeholder before any logging occurs.
The practical risk depends on who has access to device logs. On Android, app-level log output is not generally accessible to other apps without specific permissions, and logcat data is cleared when the device restarts. But in enterprise environments where devices are managed by MDM software that collects diagnostic logs, or where users have granted developer tools access to logcat, sensitive values in log output become a real exposure path.
Administrators running ownCloud Server with cookie-based session handling, or those using reverse proxies that set authentication cookies, should update the Android app in their fleet. Users on personal devices with their own accounts are at lower risk but should still update.
„Infinite edges“ rendering issue fixed (Issue #4576)
A layout condition where certain UI element borders or list item separators were drawn continuously or improperly in specific layout configurations. The visual artefact affected file list views or action sheets under certain screen sizes or display densities. The fix corrects the layout constraint logic that caused it.
Debug manifest file removed from release builds (PR #4901)
A debug-only manifest file that had no runtime purpose was being packaged into the release APK. This is a housekeeping fix with no user-visible impact, but it matters from a security hygiene perspective: shipping debug artefacts in production builds can expose build-time metadata that has no business being in a released app. APK size drops marginally too.
4.8.3 (21 July 2026)
In-app Help URL corrected (PR #4931)
The link users tap from Settings or a support prompt when they need documentation was pointing to the wrong place. This is the entire changelog for 4.8.3.
Broken static links like this are easy regressions to introduce (a renamed doc path upstream, a typo in a resource string, a URL that quietly stopped resolving) and easy to miss in testing, since nobody exhaustively clicks every static link before cutting a release. It’s also the kind of bug that generates support tickets out of proportion to its actual severity: a user who can’t reach help documentation from inside the app is more likely to open a ticket than to search for the answer themselves. Shipping this fix on its own rather than bundling it into a future release keeps friction low for anyone who tapped Help and hit the wrong page.
Upgrade
Both releases are drop-in updates for any 4.8.x installation. No data migration. No configuration changes.
- Google Play Store: the update propagates automatically for users on auto-updates (link to download page).
- Direct APK downloads: available on the GitHub releases page (8.2, v4.8.3).
- MDM-managed fleets: the cookie redaction fix in 4.8.2 is the reason to prioritise this update, especially if diagnostic logs are collected centrally. Push 4.8.3 as soon as 4.8.2 is validated in your environment.
- If you’re on 4.8.0 or earlier, review the 4.8.1 release notes too before jumping to 4.8.3. That release tightened SSL certificate verification and trusted-host handling (PR #4861) and bumped the target SDK to 36, alongside a batch of crash fixes surfaced through Google Play Console reporting.
Context: where the 4.8.x line is heading
4.8.0 in May was where the recent feature work landed. Since then the 4.8.x line has iterated on hardening and cleanup rather than new surface area:
- 8.1: SSL certificate verification and trusted-host handling (PR #4861), crash fixes from Google Play Console reporting, target SDK 36.
- 8.2: cookie redaction, „infinite edges“ fix, debug manifest cleanup.
- 8.3: Help URL fix.
Three fixes released after a month or so of iteration on a stable feature set. That’s the pattern of a client mature enough to prioritise trust and reliability over shipping new surface area. It’s also the kind of cadence that only works if the maintainers stay close to crash reports, security findings, and issue triage. Credit to the whole Android team and to community reporters whose bug reports keep this loop working.
Full source at github.com/owncloud/android (GPLv2).
