ownCloud Server

Changelog for unreleased
Changelog for 10.16.6
Changelog for 10.16.5
Changelog for 10.3.2Changelog for ownCloud Core unreleased (UNRELEASED)
The following sections list the changes in ownCloud core unreleased relevant to
ownCloud admins and users.
Summary
Change - Update PHP dependencies: #41875
Details
Change - Update PHP dependencies: #41875
The following have been updated:
firebase/php-jwt (v7.2.0 to v7.2.1)
google/apiclient (v2.20.0 to v2.20.1)
google/apiclient-services (v0.460.0 to v0.461.0)
google/auth (v1.55.0 to v1.55.1)
monolog/monolog (3.12.0 to 3.12.1)
rhukster/dom-sanitizer (1.0.17 to 1.0.19)
symfony/polyfill-php80 (v1.37.0 to v1.43.0)
https://github.com/owncloud/core/pull/41875
(省略されました)

Changelog for 11.0.1
Changelog for 10.3.2Changelog for ownCloud Core 11.0.1 (2026-09-25)
The following sections list the changes in ownCloud core 11.0.1 relevant to
ownCloud admins and users.
Summary
Security - Reject SVG/script content before it reaches ImageMagick bitmap previews: #41827
Security - Pin the Imagick coder for each preview provider: #41834
Security - Prevent path traversal via appconfig public/remote keys: #41856
Bugfix - Reduce priority of checkPropFind event: #41676
Bugfix - Do not echo secrets when setting config values via occ: #41779
Bugfix - Restore index usage for filecache writes on Oracle: #41782
Bugfix - Show federated users in the share dialog when local users also match: #41807
Bugfix - Avoid a deprecation notice when hashing the file cache path on Oracle: #41808
Bugfix - Ship only the app payload in the release tarballs: #41824
Bugfix - Release the file handle when a bitmap preview cannot be decoded: #41835
Bugfix - Show a media type icon when a preview file cannot be opened: #41855
Bugfix - Restrict federated address book sync to the trusted server: #41869
Change - Update PHP dependencies: #41775
Change - Require rhukster/dom-sanitizer as a tagged release: #41785
(省略されました)

Changelog for 11.0.0
Changelog for 10.3.2Changelog for ownCloud Core 11.0.0 (2026-07-30)
The following sections list the changes in ownCloud core 11.0.0 relevant to

Marketplace is now live – oC Marketplace - extend ownCloud.
Changelog for 10.16.4
Security - Prevent params body from overriding validated occ command: #41577
Security - Remove plaintext federation auth token from error log: #41578
Security - Replace strcmp token oracle with hash-based comparison in federation: #41579
Security - Restrict unserialize() allowed classes in CommandJob: #41582
Security - Sanitize storage connection error messages returned to clients: #41585
Security - Prevent user enumeration via differential password reset UI: #41586
Security - Disable group-admin feature by default behind allow_subadmins: #41634
Security - Do not trust cached binary paths: #41732
Security - Enforce the read permission in the public share preview endpoint: #41751
Security - Confine backend provided user homes to the data directory: #41752
Security - Encode search highlights before they are returned as a DAV property: #41760
Bugfix - Point documentation help links at the latest server docs: #5132
Bugfix - Normalise trashbin original-location PROPFIND response: #39337
Bugfix - Add missing space to mail footer signature delimiter: #41364
Bugfix - Fix htaccess RewriteBase rules blocking API requests by file extension: #41418
Bugfix - Adjust code to avoid PHP8 messages: #41597
Bugfix - Support federation between systems in subdirectories: #41599
(省略されました)

Update Alert – Update to oCIS Curie 8.0.3 now
Changelog for 10.16.3
Changelog for 10.3.2Changelog for ownCloud Core unreleased (UNRELEASED)
Change - Use configurable URL for internet connectivity check: #41506
google/apiclient (v2.19.0 to v2.19.3) - google/apiclient-services (v0.435.0 to
v0.441.1) - google/auth (v1.50.0 to v1.50.1) - guzzlehttp/psr7 (2.8.0 to 2.10.4)
guzzlehttp/guzzle (7.10.0 to 7.10.5) - guzzlehttp/promises (2.3.0 to 2.4.1) -
laravel/serializable-closure (v2.0.10 to v2.0.13) - phpseclib/phpseclib (3.0.49
to 3.0.50) - pimple/pimple (3.6.1 to 3.6.2) - symfony/deprecation-contracts
(v3.6.0 to v3.7.0) - symfony/mailer (v7.4.6 to v7.4.12)
https://github.com/owncloud/core/pull/41561
https://github.com/owncloud/core/pull/41564
https://github.com/owncloud/core/pull/41569
Change - Use configurable URL for internet connectivity check: #41506
Default URL is now configurable and the default is set to an independent
resource: https://detectportal.firefox.com/success.txt This also provides an
IPv6 compatible URL.
https://github.com/owncloud/core/issues/41465
https://github.com/owncloud/core/pull/41506
(省略されました)

Security Alert – Attention ownCloud Customers – Security Notice
Changelog for 10.16.2
Changelog for 10.3.2
Changelog for ownCloud Core unreleased (UNRELEASED)
Change - Update M$ Office icons: #41347
Change - Update PHP dependencies: #41450
Change - Removed legacy and deprecated code from ownCloud 11: #41455
Change - Update M$ Office icons: #41347
Icons have been updated according to the M$ cloud storage partner program
https://github.com/owncloud/core/pull/41347
Change - Update PHP dependencies: #41450
The following have been updated: - doctrine/dbal (2.13.9 to 3.10.4) -
google/auth (v1.50.0 to v1.50.1) - guzzlehttp/psr7 (2.8.0 to 2.9.0) -
phpseclib/phpseclib (3.0.49 to 3.0.50) - pimple/pimple (3.6.1 to 3.6.2)
https://github.com/owncloud/core/pull/41450
https://github.com/owncloud/core/pull/41477
https://github.com/owncloud/core/pull/41495
Change - Removed legacy and deprecated code from ownCloud 11: #41455
The following have been removed: - class OC_DB - class OC_DB_StatementWrapper -
(省略されました)

Info – Attention ownCloud Customers – Security Alert
Read More
Changelog for unreleased
Changelog for 10.16.1
Changelog for 10.3.2Changelog for ownCloud Core unreleased (UNRELEASED)
The following sections list the changes in ownCloud core unreleased relevant to
ownCloud admins and users.
Summary
Change - No longer store auto loader information in any memory cache: #41376
Change - Drop command db:convert-type: #41451
Details
Change - No longer store auto loader information in any memory cache: #41376
With composer managing auto loading for a long time this is no longer necessary.
https://github.com/owncloud/core/pull/41376
Change - Drop command db:convert-type: #41451
This experimental command is untested and unsupported and therefore removed.
https://github.com/owncloud/core/pull/41451
Changelog for ownCloud Core 10.16.1 (2026-02-18)
The following sections list the changes in ownCloud core 10.16.1 relevant to
(省略されました)

Changelog for 10.16.0
Changelog for 10.3.2Changelog for ownCloud Core 10.16.0 (2025-10-23)
The following sections list the changes in ownCloud core 10.16.0 relevant to
Bugfix - Subadmins won't add users to groups: #41405
Bugfix - The phar stream wrapper is disabled by default: #41406
Bugfix - Subadmins won't add users to groups: #41405
Subadmins won't be able to add user to groups, not even to groups they're
managing. Only admins will be able to.
https://github.com/owncloud/core/pull/41405
Bugfix - The phar stream wrapper is disabled by default: #41406
Previously, it was only disabled for non-cli access, but now it's disabled
globally.
https://github.com/owncloud/core/pull/41406
1.13.4) - pear/pear-core-minimal (v1.10.15 to v1.10.16) - pear/archive_tar
(1.5.0 to 1.6.0) - phpseclib/phpseclib (3.0.39 to 3.0.46) - sabre/dav (4.6.0 to
4.7.0) - sabre/event (5.1.4 to 5.1.7) - sabre/http (5.1.10 to 5.1.12) -
sabre/uri (2.3.3 t0 2.3.4) - sabre/vobject (4.5.4 to 4.5.7) - sabre/xml (2.2.7
to 2.2.11) - symfony/console (5.4.40 to 5.4.47) - symfony/deprecation-contracts
(2.5.3 to 2.5.4) - symfony/event-dispatcher (5.4.40 to 5.4.45) -
(省略されました)

Changelog for 10.15.3
The following have been updated: - doctrine/deprecations (1.1.3 to 1.1.5) -
google/apiclient (v2.16.0 to v2.16.1) - google/auth (v1.37.1 to v1.37.2) -
guzzlehttp/guzzle (7.8.1 to 7.9.3) - guzzlehttp/promises (2.0.3 to 2.2.0) -
guzzlehttp/psr7 (2.7.0 to 2.7.1) - icewind/smb (3.6.0 to 3.7.0) -
icewind/streams (0.7.7 to 0.7.8) - laravel/serializable-closure (1.3.3 to 1.3.7)
league/mime-type-detection (1.15.0 to 1.16.0) - mikey179/vfsstream (1.6.11 to
1.6.12) - monolog/monolog (2.9.3 to 2.10.0) - myclabs/deep-copy (1.12.1 to
1.13.1) - pear/pear-core-minimal (v1.10.15 to v1.10.16) - phpseclib/phpseclib
(3.0.39 to 3.0.46) - sabre/dav (4.6.0 to 4.7.0) - sabre/event (5.1.4 to 5.1.7) -
sabre/http (5.1.10 to 5.1.12) - sabre/uri (2.3.3 t0 2.3.4) - sabre/vobject
(4.5.4 to 4.5.7) - sabre/xml (2.2.7 to 2.2.11) - symfony/console (5.4.40 to
5.4.47) - symfony/deprecation-contracts (2.5.3 to 2.5.4) -
symfony/event-dispatcher (5.4.40 to 5.4.45) - symfony/event-dispatcher-contracts
(2.5.3 to 2.5.4) - symfony/polyfill-php80 (1.29.0 to 1.32.0) - symfony/process
(v5.4.40 to v5.4.47) - symfony/routing (5.4.40 to 5.4.48) -
symfony/service-contracts (2.5.3 to 2.5.4) - symfony/string (5.4.40 to 5.4.47) -
symfony/translation (5.4.40 to 5.4.45) - symfony/translation-contracts (2.5.3 to
2.5.4)
(省略されました)

Changelog for 10.15.2
Changelog for ownCloud Core 10.15.2 (2025-03-11)
The following sections list the changes in ownCloud core 10.15.2 relevant to
ownCloud admins and users.
Summary
Security - Disable phar stream wrapper: #41358
Details
Security - Disable phar stream wrapper: #41358
https://github.com/owncloud/core/pull/41358

Changelog for unreleased
Changelog for 10.15.1
Changelog for 10.3.2Changelog for ownCloud Core unreleased (UNRELEASED)
The following sections list the changes in ownCloud core unreleased relevant to
ownCloud admins and users.
Summary
Bugfix - Unavailable shares storage will not block folder listing: #41338
Change - Update PHP dependencies: #41287
Change - Add user hint in share dialog that password policy can apply: #41314
Enhancement - Improve global search experience for Chinese and Japanese input: #41328
Details
Bugfix - Unavailable shares storage will not block folder listing: #41338
In case a shared storage is not available in certain situations no folder
listing would be shown to the user.
https://github.com/owncloud/core/pull/41338
Change - Update PHP dependencies: #41287
The following have been updated: - doctrine/deprecations (1.1.3 to 1.1.4) -
guzzlehttp/guzzle (7.8.1 to 7.9.2) - guzzlehttp/promises (2.0.3 to 2.0.4) -
icewind/smb (3.6.0 to 3.7.0) - icewind/streams (0.7.7 to 0.7.8) -
(省略されました)