[v-scharf]

🔒 Security

• [main] fix: port security fixes from web-internal [#4433]
• fix: render svg previews as images instead of inlining them [#4298]
• fix: only accept delegated tokens from the embedding host [#4297]
• fix: verify the sender of postMessage events in picker modals and external apps [#4289]

🐛 Bug Fixes

• fix: show topbar logo on account page for public links and guests [#4417]
• fix: remove the slash when the editor block menu is dismissed [#4334]
• fix: only cancel the embedded picker on Escape without a selection [#4399]
• fix: count down the rate limit wait on the guest link renew page [#4387]
• fix: support card wrap buttons when they exceed the card [#4415]
• fix: pick the target folder when saving or exporting from Collabora [#4374]
• fix: don't render a revoked space image url after the image changed [#4404]
• fix: pick up external file updates in a guest's open editor [#4385]
• fix: keep positioned content inside the sidebar panel body [#4401]
• fix: only show the office settings to users who can manage fonts [#4398]
• fix: escape link and image targets and titles when saving markdown [#4316]
• fix: use object-cover for space overview images [#4413]
• fix: don't select a row when its link starts a navigation [#4408]
• fix: wrap long values in share access details [#4382]
• fix: set remoteItemId on shortcuts and files created in a share [#4384]
• fix: don't query an empty toggle selector when opening a mobile drop [#4400]
• fix: fit rotated preview images into the stage [#4405]
• fix: normalize guest addresses like the server stores them [#4403]
• fix: grammar [#4409]
• fix: keep unlocked vaults in sync when moving their parent folder [#4383]
• fix: show an error when the search fails and search again on resubmit [#4365]
• fix: don't treat text after a dot as file extension when it contains spaces [#4369]
• fix: don't select the whole text field value on click [#4362]
• fix: don't offer creating or copying into a view-only space root [#4360]
• feat: make the support card stand out in the sidebar [#4346]
• fix: wrap long resource names when truncation is disabled [#4381]
• fix: show an error message when loading a folder or list fails [#4356]
• fix: handle name clashes inside a move or copy batch and cancel on closing the conflict dialog [#4355]
• fix: keep deleted files up to date and don't restore items restored elsewhere [#4283]
• fix: show hidden shares when a link points to a hidden share [#4349]
• fix: remove just added tags in the shares views [#4347]
• fix: title the not found page for inaccessible project spaces [#4337]
• fix: hide sponsor link and version in the sidebar in embed mode [#4370]
• fix: don't return to redirect-only routes when cancelling a vault unlock [#4294]
• fix: use the shared sorting and pagination in the spaces and trash overviews [#4270]
• fix: resolve links into another user's personal space via the file id [#4315]
• fix: don't throw when the list refresh after a failed upload fails [#4336]
• fix: enforce the password policy when setting a vault password on the unlock page [#4335]
• fix: skip the access revoked message when access to a share remains [#4313]
• fix: fall back to shared with me when a share's mount point is gone [#4345]
• fix: keep an open app in place when the folder of its file gets renamed [#4292]
• fix: don't load shares of disabled project spaces [#4338]
• fix: list a partially duplicated space and tell the user it's incomplete [#4290]
• fix: scroll to the current search match when the search term changes [#4314]
• fix: keep a space when access remains after a member removal [#4312]
• fix: keep image embeds in markdown when saving [#4340]
• fix: copy only the selected content in the markdown editor [#4271]
• fix: keep moved items in favorites and search results [#4282]
• fix: keep upload batch out of uppy until it is prepared [#4327]
• fix: show the load error for video and audio files that can't be played [#4251]
• fix: ignore update-token messages without an access token in delegated embed mode [#4215]
• fix: report a created space when only some files could not be copied [#4252]
• fix: keep the list filters when stepping through files in the preview [#4246]
• fix: show the server's upload error on servers without TUS [#4243]
• fix: restore notification preference checkboxes when saving fails [#4244]
• fix: open public links with a path after the token [#4240]
• fix: show not found in apps for an unknown space or a route without a file [#4259]
• fix: improve focus management of the select after picking an option [#4262]
• fix: keep the text editor search and replace panel as a drop on mobile [#4309]
• fix: skip the rename request when the name is unchanged [#4237]
• fix: keep the open file unchanged when its store entry is renamed [#4303]
• fix: reload a filtered users list instead of adding a newly created user [#4239]
• fix: follow a rename of the file open in an app [#4300]
• fix: show errors when setting a space icon, image or description fails [#4211]
• fix: reload the user after a partially failed save in the edit user panel [#4212]
• fix: ignore items-per-page values below 1 [#4213]
• fix: keep failed recipients selected in the invite form [#4206]
• fix: don't preselect a quota for several items with different quotas [#4205]
• fix: report delete, paste and restore failures on network errors [#4192]
• fix: show the full value of truncated user content on hover [#4124]
• fix: revert the tags selection when a tag change fails [#4167]
• fix: remove removed resources from the selection [#4168]
• fix: wait for a running save before asking about unsaved changes on close [#4277]
• fix: keep folders with # in their name in the preview and drive redirect URLs [#4174]
• fix: trim embed-file-types values from the URL query [#4169]
• fix: refresh file list when all files of an uploaded folder fail [#4207]
• fix: ignore deferred panzoom transforms after the preview image is gone [#4216]
• fix: keep favorite state and tags on the received share root [#4208]
• fix: show an error for EPUB files that can't be opened [#4209]
• fix: show message for spaces skipped when duplicating [#4210]
• fix: stream vault content encryption block by block [#4125]
• fix: stop the shares panel loader when loading the shares fails [#4203]
• fix: let app tokens expire on the picked day [#4202]
• fix: show the current space size in the space details after uploads and deletions [#4204]
• fix: redirect /files/search to the search results page [#4214]
• fix: rename dot-files correctly when file extensions are hidden [#4157]
• fix: keep parent folder links and name tooltips usable for non-clickable resources [#4242]
• fix: refetch notifications when opening the bell or returning to the tab [#4166]
• fix: stay in folders with a # in their name when the scrollTo param is reset [#4165]
• fix: keep the guest session when unlocking a vault [#4264]
• fix: show an error when creating share links fails in embed mode [#4170]
• fix: save expiration date of shares with custom permissions [#4172]
• fix: use the full name as title for dot-files [#4173]
• fix: keep upload batch out of uppy while the conflict dialog is open [#4140]
• fix: don't return to a permanent link when cancelling a vault unlock [#4155]
• fix: prevent duplicate GDPR export requests on double click [#4156]
• fix: align shift-click range selection in admin lists and files table [#4236]
• fix: replace the selection when dragging an unselected file [#4153]
• fix: match embed file types case-insensitively [#4154]
• fix: stream archive downloads on password protected public links [#4115]
• fix: keep the guest session when a guest opens a route that needs a user [#4086]
• fix: list sharers with the same display name separately in the Shared By filter [#4152]
• fix: show the locked message when uploading onto a locked resource [#4109]
• fix: show restored files again after undoing a delete on the search results page [#4175]
• fix: keep the requested route when delegating authentication in embed mode [#4191]
• fix: leave the oidc callback page when the sign-in fails [#4218]
• fix: keep network errors when loading webdav files fails [#4171]
• fix: ignore cancelled loading when leaving admin users, groups and spaces [#4138]
• fix: escape double quotes in search queries [#4094]
• fix: show error message when refreshing the file after a version restore fails [#4137]
• fix: finish adding space members when the space refresh fails [#4126]
• fix: don't carry the query of other views into the search [#4128]
• fix: reload the folder README when README.md changes [#4114]
• fix: respect reduced motion for the EPUB reader progress shimmer [#4136]
• fix: reload after continuing with an unsupported browser [#4110]
• fix: find scrollTo targets on all pages of the file lists [#4118]
• fix: show error message when loading admin groups or spaces fails [#4127]
• fix: show "No favorites found" when a favorites filter matches nothing [#4129]
• fix: ignore cancelled resource loading when opening an app via fileId [#4130]
• fix: correct forbidden characters in space name error [#4108]
• fix: apply sse file events after running folder load [#4083]
• fix: wait for a running save instead of hanging in AppWrapper [#4131]
• fix: keep long values in the admin users and spaces tables in bounds [#4116]
• fix: prevent double profile picture upload on repeated set [#4107]
• fix: reset avatar file input after a rejected file [#4106]
• fix: trim group names when creating and renaming groups [#4105]
• fix: show error message when restoring a file version fails [#4102]
• fix: hide extension preferences with only one option [#4112]
• fix: focus the first input when opening text entry modals [#4089]
• Rework the EPUB reader [#3924]
• fix: hide guest invites when guest links are disabled [#4071]
• fix: pause toasts, fix pagination semantics and name upload states [#4069]
• fix: show all invite search results returned by the server [#4081]
• fix: restore parent folders before their children from the trash [#4076]
• fix: play flac files in chromium browsers [#4080]
• fix: raise contrast, target sizes and visibility of small UI parts [#4074]
• fix: copy action for the current folder [#4073]
• fix: versions for guest users [#4067]
• fix: prevent clipped descenders in resource names [#4072]
• fix: restore the cleartext name when undoing a deletion in a vault [#4024]
• fix(text-editor): allow inline code inside other marks in markdown [#4066]
• fix: keep upload info closable when folder creation fails [#4030]
• fix: resolve permanent links into unsynced shares [#4042]
• fix: only escape markdown text where it would be read as syntax [#4038]
• fix: more small a11y fixes from the audit [#4043]
• fix: truncate long sidebar nav item labels [#4056]
• fix: validate name length in vaults [#4054]
• fix(preview): keep the active file when the folder changes [#4051]
• fix: keep raw html and decode named entities in markdown files [#4025]
• fix: small a11y fixes from the third audit round [#4023]

✅ Tests

• test(e2e): fix yjs test scenario behavior [#4222]

📦️ Dependencies

• fix(deps): update dependency vue-router to v5.5.0 [#4424]
• chore(deps): update devdependencies (non-major) [#4406]
• fix(deps): update dependency @casl/ability to v7.1.2 [#4423]
• fix(deps): update dependency vue-inline-svg to v5 [#4326]
• chore(deps): update dependency eslint-plugin-vue to v10.12.1 [#4414]
• fix(deps): update dependency vitest-mock-extended to v6 [#4402]
• chore(deps): update typescript-eslint monorepo to v8.72.2 [#4411]
• chore(deps): update dependency axios to v1.21.1 [#4410]
• chore(deps): update dependency fast-xml-parser to v5.12.0 [#4253]
• chore(deps): update uppy monorepo [#4254]
• chore(deps): update dependency license-checker-rseidelsohn to v5 [#3386]
• chore(deps): update devdependencies (non-major) [#4351]
• chore(deps): update shumc/imagor docker tag to v1.10.1 [#4350]
• chore(deps): update axllent/mailpit docker tag to v1.33.1 [#4372]
• chore(deps): update pnpm to v11.28.11 [#4310]
• chore(deps): update devdependencies (non-major) [#4324]
• chore(deps): update dependency filesize to v11.0.30 [#4275]
• fix(deps): update dependency @casl/ability to v7.1.1 [#4092]
• chore(deps): update pnpm to v11.28.10 [#4090]
• chore(deps): update devdependencies (non-major) to v4.3.4 [#4225]
• chore(deps): update devdependencies (non-major) [#4079]
• chore(deps): update traefik docker tag to v3.7.17 [#4091]
• chore(deps): update axllent/mailpit docker tag to v1.33.0 [#4093]
• chore(deps): update apache/tika docker tag to v4.3.0 [#4078]
• chore(deps): update collabora/code docker tag to v26.04.5.2.1 [#4010]
• fix(deps): update dependency qs to v6.17.1 [#4070]
• chore(deps): update hocuspocus monorepo to v4.8.0 [#4064]
• fix(deps): update dependency @casl/ability to v7.1.0 [#4065]
• chore(deps): update dependency @casl/vue to v3.1.0 [#4063]
• chore(deps): update node.js to v24.22.2 [#4060]
• fix(deps): update dependency @casl/ability to v7.1.0 [#4062]
• chore(deps): update dependency axios to v1.21.0 [#4044]
• fix(deps): update dependency qs to v6.17.0 [#4045]
• chore(deps): update pnpm to v11.28.9 [#4040]
• [full-ci] chore: bump opencloud for tests to 9.0.0 [#4037]
• chore(deps): update dependency focus-trap to v8.2.4 [#4035]
• chore(deps): update dependency eslint-plugin-vue to v10.12.0 [#4027]
• chore(deps): update dependency postcss to v8.5.32 [#4034]

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · -0.01% coverage variation

Metric	Results
Coverage variation	✅ -0.01% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (d7e5b97)	93654	26992	28.82%
Head commit (932dd5d)	93654 (+0)	26978 (-14)	28.81% (-0.01%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#3962)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}