Skip to content

OxiCloud

v0.8.4 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 12d File Storage & Sync
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

cloud cloud-storage dropbox file-share file-sync file-upload
+13 more
nas nextcloud nextcloud-alternative onedrive own-your-data owncloud platform privacy rust rust-lang security self-hosted webdav

Affected surfaces

auth

ReleasePort's take

Moderate signal
editorial:auto 11d

The release enforces that OIDC cannot be bypassed in auth agents and fixes several OIDC‑related bugs in the Nextcloud integration.

Why it matters: Security: severity 90 mandates enforcing OIDC enforcement; bugfixes (severity 50) resolve critical login failures and drive picker issues.

Summary

AI summary

Broad release touches caldav+carddav, i18n, ko, and grant.

Changes in this release

Security Critical

Enforce OIDC never bypassed in auth agents

Enforce OIDC never bypassed in auth agents

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Add RFC 4331 quota‑available‑bytes and quota‑used‑bytes to WebDAV

Add RFC 4331 quota‑available‑bytes and quota‑used‑bytes to WebDAV

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Introduce domain allow list for user registration

Introduce domain allow list for user registration

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Allow upgrade of invited accounts to internal accounts

Allow upgrade of invited accounts to internal accounts

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Implement nextcloud chrooted drive support

Implement nextcloud chrooted drive support

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Add server‑side user preferences, dotfile filtering, and share type filtering

Add server‑side user preferences, dotfile filtering, and share type filtering

Source: llm_adapter@2026-07-15

Confidence: low

 —
Feature Low

Complete Korean (ko) locale for i18n

Complete Korean (ko) locale for i18n

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Clean up expired grants in grant system

Clean up expired grants in grant system

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Feature Low

Store user preferences server‑side, filter dotfiles, and filter shares by resource type

Store user preferences server‑side, filter dotfiles, and filter shares by resource type

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Bugfix Medium

Fix OIDC login and drive picker in nextcloud handler

Fix OIDC login and drive picker in nextcloud handler

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Improve error handling for CalDAV and CardDAV

Improve error handling for CalDAV and CardDAV

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Return correct error instead of 500 for CalDAV/​CardDAV issues

Return correct error instead of 500 for CalDAV/​CardDAV issues

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Auto‑create default calendar and address book for CalDAV/​CardDAV

Auto‑create default calendar and address book for CalDAV/​CardDAV

Source: llm_adapter@2026-07-15

Confidence: low

 —
Bugfix Medium

Unregister cache prior to version 0.8.0 in front layer

Unregister cache prior to version 0.8.0 in front layer

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Bugfix Medium

Fix recurrence handling in iCalendar (issue 528)

Fix recurrence handling in iCalendar (issue 528)

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Bugfix Medium

Correct tel URI handling in CardDAV

Correct tel URI handling in CardDAV

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Bugfix Medium

Fix timerange issues in iCalendar parsing

Fix timerange issues in iCalendar parsing

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Refactor Low

Implement dead properties for Nextcloud handler and fix frontend migration leftover

Implement dead properties for Nextcloud handler and fix frontend migration leftover

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Refactor Low

Convert ../ references in Vitepress docs to DioCrafts/OxiCloud links

Convert ../ references in Vitepress docs to DioCrafts/OxiCloud links

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Other Low

Document Nextcloud drive usage

Document Nextcloud drive usage

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Other Low

Correct WebDAV login documentation for app password usage

Correct WebDAV login documentation for app password usage

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Other Low

Update documentation to reflect recent changes

Update documentation to reflect recent changes

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Other Low

Add tests for CalDAV and CardDAV functionality

Add tests for CalDAV and CardDAV functionality

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Full changelog

What's Changed

  • i18n: complete Korean (ko) locale by @moduvoice in https://github.com/AtalayaLabs/OxiCloud/pull/567
  • feat(grant): clean up expired grants by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/569
  • implement dead properties for nextcloud handler and fixup frontend migration leftover by @swissiety in https://github.com/AtalayaLabs/OxiCloud/pull/538
  • fix(front): unregister cache prio to 0.8.0 by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/571
  • feat/nextcloud chrooted drive by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/572
  • fix(nc): login OIDC + drive picker by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/574
  • docs(drive): add drive doc by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/575
  • feat(registration): add a domain allow list by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/578
  • feat: users prefs server side + filter dotfiles + filter shares by resource type by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/577
  • feat(user upgrade): permit upgrade of in invited account into internal account by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/580
  • chore(vitepress): convert ../ references to DioCrafts/OxiCloud links by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/581
  • security(auth): specify to agents that OIDC should never be bypassed by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/582
  • doc(app password): correct doc: webdav login via app password by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/583
  • feat(webdav): RFC 4331 quota-available-bytes/quota-used-bytes by @swissiety in https://github.com/AtalayaLabs/OxiCloud/pull/570
  • doc: update doc to reflect recent changes by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/584
  • fix(caldav+carddav) error handling by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/586
  • feat(caldav+carddav): auto create default cal & card by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/585
  • fix(528): recurrence on ical by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/588
  • fix(caldav+carddav): return correct error rather 500 by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/589
  • test/caldav+carddav by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/590
  • fix(carddav): fix tel uri by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/592
  • fix(ical): fix timerange issue by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/591

New Contributors

  • @moduvoice made their first contribution in https://github.com/AtalayaLabs/OxiCloud/pull/567

Full Changelog: https://github.com/AtalayaLabs/OxiCloud/compare/v0.8.3...v0.8.4

What's Changed

  • i18n: complete Korean (ko) locale by @moduvoice in https://github.com/AtalayaLabs/OxiCloud/pull/567
  • feat(grant): clean up expired grants by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/569
  • implement dead properties for nextcloud handler and fixup frontend migration leftover by @swissiety in https://github.com/AtalayaLabs/OxiCloud/pull/538
  • fix(front): unregister cache prio to 0.8.0 by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/571
  • feat/nextcloud chrooted drive by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/572
  • fix(nc): login OIDC + drive picker by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/574
  • docs(drive): add drive doc by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/575
  • feat(registration): add a domain allow list by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/578
  • feat: users prefs server side + filter dotfiles + filter shares by resource type by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/577
  • feat(user upgrade): permit upgrade of in invited account into internal account by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/580
  • chore(vitepress): convert ../ references to DioCrafts/OxiCloud links by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/581
  • security(auth): specify to agents that OIDC should never be bypassed by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/582
  • doc(app password): correct doc: webdav login via app password by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/583
  • feat(webdav): RFC 4331 quota-available-bytes/quota-used-bytes by @swissiety in https://github.com/AtalayaLabs/OxiCloud/pull/570
  • doc: update doc to reflect recent changes by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/584
  • fix(caldav+carddav) error handling by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/586
  • feat(caldav+carddav): auto create default cal & card by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/585
  • fix(528): recurrence on ical by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/588
  • fix(caldav+carddav): return correct error rather 500 by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/589
  • test/caldav+carddav by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/590
  • fix(carddav): fix tel uri by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/592
  • fix(ical): fix timerange issue by @EdouardVanbelle in https://github.com/AtalayaLabs/OxiCloud/pull/591

New Contributors

  • @moduvoice made their first contribution in https://github.com/AtalayaLabs/OxiCloud/pull/567

Full Changelog: https://github.com/AtalayaLabs/OxiCloud/compare/v0.8.3...v0.8.4

Security Fixes

  • auth: enforce that OIDC must never be bypassed
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track OxiCloud

Get notified when new releases ship.

Sign up free

About OxiCloud

☁ Ultra-fast, secure & lightweight self-hosted cloud storage — your files, photos, calendars & contacts, all in one place. Built in Rust.

All releases →

Related context

Earlier breaking changes

  • v0.6.0 Server no longer reuses the listening port by default.

Beta — feedback welcome: [email protected]