You are reading the documentation of FileRun 2026.4.0, which is not released yet. It is subject to change, so do not use it for planning. Go to the documentation of FileRun 2026.3.0

FileRun 2026.4.0🔗

The changes that come with FileRun 2026.4.0, grouped by subject: the new features, the changes of behaviour and the fixes, the security fixes included. The version brings 22 new features, 59 changes, 119 fixes and 18 security fixes.

Note

FileRun 2026.4.0 is not released yet. This page is written from the development notes of the version. The notes were last read on 2026-11-10 at 11:27 (UTC+1).

Important

Some changes need steps before or after the update. Read Updating to FileRun 2026.4 before updating.

Overview🔗

FileRun 2026.4.0 brings shared drives, an authentication setup with several identity providers at once, finer file permissions, and many fixes.

• Shared drives: folders that belong to the organization rather than to a user account, with members and roles instead of shares, administered from the control panel or by their managers.
• Authentication sources: any number of identity providers, several of the same kind, with the user accounts linked to their provider accounts. New authentication plugins for Pocket ID, Keycloak and Authelia.
• File permissions: the permission "User can make changes to files and folders" has been split into eight separate permissions.
• Copying and moving with overwrite: a copy or a move onto an existing item replaces the file or merges the folder, and the web interface asks about each item in the way.
• Guests: a download limit and an access period on a file shared with a guest, and an e-mail verification at sign-in.
• Languages: each account has a language, and the e-mail messages are written in the language of the recipient.
• Activity log: the outcome and the channel of each action, a JSON stream for log management systems, and the changes made to the settings.
• Thumbnails and previews move out of the folders of the users, into the installation folder.
• Deleted user accounts keep a record, so that their names stay visible in the activity log and in the trash.
• New file plugins for Excalidraw drawings and draw.io diagrams, and an image viewer reworked for touch screens.

Shared drives🔗

• Feature: Shared drives: folders that belong to the organization rather than to a user account, with members instead of shares. An administrator creates them in the new "Shared drives" section of the control panel (under "Files"), names their members, users and groups, with the roles of the sharing, and sets for each drive a quota, whether it is read-only, and whether its members may share its content with other users and with links. The superuser sets the folder the drives are made in under "Files" → "Settings" → "General", or gives a drive a folder of its own. The permission "User can manage shared drives" lets a regular administrator create drives and administer the ones that name them as admin.
  • A member finds the drives under "Shared drives" in the file manager, next to "My drive", and works in them with the rights of its role. A member with the role "Manager", which only the members of a drive can have, opens the settings of the drive from its context menu.
  • Every member of a drive sees the members of the drive under "Who has access", and in the share dialog of the drive and of every file and folder in it. A Manager adds members, changes their roles and removes them in the share dialog of the drive. A Manager can add only the users and the groups that it can interact with, and cannot change or remove another Manager. A guest cannot be a Manager.
  • When members are added in the share dialog of a drive, "Notify people" sends them an e-mail with a link to the drive and the message of the person who added them, as for a share. A guest always receives the e-mail, because it has no other way to find the drive.
  • A member with the "Manager", the "Content manager" or the "Distributor" role shares files and folders of a drive with other users, as the drive: the share outlives the member, and ends with the drive.
  • A guest is invited to a drive by its e-mail address, from the list of the members of the drive. A guest added to a drive, invited this way or chosen among the existing accounts, receives an e-mail with a link that signs it in and opens the drive.
  • The drives and their members are also administered through the API, under Drive/!admin/shared_drives. See Managing shared drives.
  • The files of the drives are indexed for the search and get their thumbnails by the same commands as the files of the home folders.
  • What a member deletes in a drive goes to the trash of the drive. A Manager of the drive finds the trash under the drive in the file manager, sees who deleted each item and from where, puts items back, deletes them for good and empties the trash. The permission of the Manager's own account to delete permanently and the read-only setting of the drive apply there as they apply inside the drive.
  • The drives are reachable over WebDAV, under @Drives beside @Home and @Shares, each drive listed as ({id}) {name}. The Nextcloud and ownCloud clients sync them with the rest of the tree.
  • With the setting "Automatic share e-mail notifications" on, a user added to a drive, directly or through a group, is subscribed to the notifications of the drive, as the receiver of a shared folder is subscribed to the folder.
  • A user with the permission "User can create shared drives", in the "Share" tab of the user form and of the role form, creates a drive in the file manager, from the context menu of "Shared drives" or from the toolbar of its listing, and becomes its first member, with the "Manager" role. The permission cannot be granted to an account or to a role that has a space quota. Such a drive has no admin: every administrator who can manage shared drives sees it in the "Shared drives" section of the control panel, and can take it, by naming themselves as its admin. When the admin of a drive is deleted, or can no longer manage shared drives, the drive is left without an admin in the same way.
  • A drive whose folder is no longer found on the disk, because a storage was unmounted for example, is disabled by the daily cleanup, and its members keep their memberships. The administrator enables the drive again from its settings once the folder is back.
  • The Shared drives section of the documentation describes the feature in full: the roles, the work of the members and of the Managers, the administration, and the special cases.

File permissions🔗

• Feature: The "User can make changes to files and folders" permission is split into eight separate permissions. The update gives every account and role all eight where it had the one, so nothing changes for existing accounts until an administrator edits them.
  • "User can edit existing files": also covers managing the previous versions of files.
  • "User can rename and move files and folders".
  • "User can delete files": also covers the trash (seeing it, restoring, deleting from it and emptying it) and writing over an existing file. The two permissions below require it.
  • "User can delete folders".
  • "User can delete files and folders permanently": deleting without the trash, deleting one item from the trash and emptying the trash. An account without it can only move items to the trash. The "Permanent deletion" checkbox of the delete prompt is shown only where the account, and the owner of the item, allow it.
  • "User can create and manage collections": photo albums are collections too.
  • "User can star files and folders".
  • "User can change tags, ratings and other metadata".
  • Locking a file requires the permission to edit files, to rename and move them, or to delete them; an account holding none of the three cannot lock.
• Feature: The Guest role can now be allowed to edit files, use collections and star files; renaming, moving, deleting and changing metadata stay impossible for guests. After the update the new options are off, so guests behave as before until an administrator ticks them; on a new installation the Guest role allows editing.
• Change: The API accepts and hands out the new permission names on the user and role endpoints, and Core/account/info lists them. changes is still accepted and sets the permissions to rename and move, to delete files, to delete folders and to delete permanently at once; readonly and readOnly are still handed out, saying read-only unless renaming and moving, deleting files and deleting folders are all granted. Clients are recommended to move to the new names: an edit through the user endpoints that still sends only changes leaves the other new permissions of the edited account off, since a permission left out of the request is turned off.
• Change: The permissions tab shown when editing user accounts and roles is reorganized.
• Fix: A guest account given the "editor" share role could not edit the shared file, an online editor opening it read-only without saying why, because guest accounts were forced read-only. Once the administrator allows editing on the Guest role, such a guest edits; until then the refusal says which permission is missing.

Authentication and single sign-on🔗

• Feature: Any number of authentication sources can be configured, several of the same kind: an OpenID Connect provider next to an LDAP directory, or two OpenID Connect providers. A source has its own settings, its own role for the accounts it creates, its own IP address limitation and group sync options, and its own button on the sign-in page, with an optional description and logo. The update turns the plugin that was enabled into an enabled source and every other plugin that had settings into a disabled one, so nothing typed is lost; the Authentication page of the control panel lists them. The sources are also managed through the API (Core/!super/auth_sources/list, add, edit and delete). The settings export no longer carries the authentication settings, which name sources the importing installation does not have.
  • The sign-in with a username and a password tries the sources in the order of their "Position" setting. The first source that knows the username decides: a wrong password, or a source that cannot be reached, ends the sign-in without trying the next source. A username that no source knows signs in with the local password, if "Allow local user accounts to log in" is on. An LDAP source can tell that it does not know a username only when it has a "Bind DN": with a "User DN template" alone, it decides for every username.
• Feature: The "Linked accounts" page of the account settings lists the identity providers an account can sign in through, and links or unlinks them. The user window of the control panel lists the links of an account, and lets an administrator remove one; the account links again at its next sign-in through the provider, when it has no password. See Your account settings.
• Feature: A Pocket ID sign-in, for the Pocket ID identity provider: the address of the Pocket ID server, the client ID and the client secret are all it needs. Its form shows the addresses to register on the OIDC client in Pocket ID: the callback URL, the logout callback URL and the back-channel logout URL. The Pocket ID groups named in its "Groups to import" list become local groups of the same names, and the group sync options of the source apply to them at every sign-in.
• Feature: A Keycloak sign-in, for the Keycloak identity provider: the address of the realm, the client ID and the client secret are all it needs. Its form shows the addresses to register on the client in Keycloak: the redirect URI, the post logout redirect URI and the backchannel logout URL. The Keycloak groups named in its "Groups to import" list become local groups of the same names, and the group sync options of the source apply to them at every sign-in. Keycloak sends the groups when the client has a "Group Membership" mapper.
• Feature: An Authelia sign-in, for the Authelia identity provider: the address of the Authelia server, the client ID and the client secret are all it needs. Its form shows the client to add to the configuration of Authelia, with the redirect URI of this server, and the command that makes the client secret. The Authelia groups named in its "Groups to import" list become local groups of the same names, and the group sync options of the source apply to them at every sign-in. Authelia has no sign-out for other applications, so signing out here does not sign the user out of Authelia.
• New: The superuser always signs in with the local password, whatever the authentication sources and the "Allow local user accounts to log in" option say, so a single sign-on setup cannot lock the superuser out. When the sign-in page hides the password fields, a "Sign in with a password" link brings them back.
• New: The Google and the Microsoft sign-ins link the user accounts to the provider accounts too, by the identifier of the provider account, so a change of the e-mail address or of the user principal name at the provider no longer changes which account signs in.
• New: The option "Link existing user accounts by username" of the Authentication page, off by default, links an existing account that has a password by its username at its first sign-in through an identity provider, for moving many accounts to a provider at once without each user linking from the account settings. While it is on, a user who can change their username at the provider can sign in as any such account, so it is meant to be turned off once the accounts are linked. The superuser is never linked by username.
• New: When the issuer URL of an OpenID Connect source changes, the window of the source offers to move the linked user accounts along, for a provider that moved to a new address. Without it, the accounts stay linked to the previous issuer URL, and the save says so.
• New: Each authentication plugin has a logo, shown on the sign-in button of its sources, on the "Linked accounts" page and in the control panel. The "Logo URL" of a source replaces it.
• New: The form of an OpenID Connect sign-in shows the post-logout redirect URL, the address to register at the provider so that it sends the users back after they sign out.
• Change: The JSONPath selectors of the user details mapping, in the settings of the "OAuth2" and "OpenID Connect" authentication, are now read by the rules of the JSONPath standard (RFC 9535). The usual forms give the same value as before: $.email, $.name.given_name, $['custom:claim'], $['https://example.com/claim'], $.emails[0].value, $.groups[*], $.emails[?(@.primary == true)].value. A selector that does not start with $., such as email or name.given_name, works as before too. A selector written in one of the forms below has to be changed. The corrected forms also work in the previous versions, so the settings can be changed before the update.
  • A name in brackets without quotes is refused: $[email] has to be $['email'].
  • A quoted name after a dot is refused: $.'custom:claim' has to be $['custom:claim'].
  • A position written after a dot finds nothing, and the field stays empty: $.emails.0.value has to be $.emails[0].value.
  • A filter that compares with =, ===, !==, =~, in or nin is refused. A filter compares with ==, !=, <, <=, > and >=, and checks a regular expression with the functions match() and search(), which are new: the previous versions do not know them.
  • .length and calculated positions such as [(@.length-1)] are no longer available. The last element is [-1].
  • A negative position that reaches before the start of a list, such as [-5] on a list of two, finds nothing. It found the first element.
• Change: The group that marks the accounts an authentication source creates is named after the source. The update names each source after its plugin, which was the name of that group, so existing accounts keep their group until the source is renamed.
• Change: The record kept of a deleted user account now also lists the identity provider accounts it was linked to.

Guests🔗

• Feature: The user window of the control panel has, for a guest account, the option "Require e-mail verification at sign-in". A guest with the option types a code sent to their e-mail address after following the link of a share message, and at every sign-in, so a forwarded message no longer opens the share. An authenticator app or a passkey of the account counts instead of the code. The option exists on every account through the API (data[require_email_otp] of the user endpoints). The clients that connect with an app password are not affected.
• Feature: A file shared with a guest can have a download limit, as a shared link on a file can. In the share dialog of one file, the menu of each guest has the item "Set download limit", and the dialog shows how many downloads are left. When no downloads are left, the guest can no longer download the file, preview it, read its comments and its metadata, or edit it. A download spends one download. Opening the file in a viewer or in an editor, copying it and adding it to an archive also spend one. A thumbnail or a preview image spends nothing. Through the API, the download_limit parameter of the share endpoint sets the limit. A share with a group or with a user who is not a guest cannot have a limit.
• Feature: A file shared with a guest can have an access period: 1 hour, 2 hours, 4 hours, 8 hours, 1 day, 2 days or 1 week. The period starts the first time the guest opens the file: a download, a preview, or the opening in a viewer or in an editor. A thumbnail in the file list does not start it. When the period has ended, the guest can no longer download the file, preview it, read its comments and its metadata, or edit it. In the share dialog of one file, the menu of each guest has the item "Access period". The dialog shows the length of the period, and its end once it has started. A new length keeps the start of the period. A share can have an access period and a download limit together. Through the API, the access_period parameter of the share endpoint sets the length, in seconds. A share with a group or with a user who is not a guest cannot have an access period.
• Change: The link that signs a guest in, sent in the share messages and shown when editing a guest account, has a new address (index.php/app/Drive/auth/!public/guest_login?key=... in place of guest.php?key=...). The links in messages sent before the update no longer work: such a guest has to be sent a new share message, or signs in with the username and password. The setting page "Guest access" is unchanged.
• Fix: A user whose "Can interact with" permission lists only some users or groups can now share with a new guest, invited by an e-mail address. The share was refused after the guest account had been created, and the new account was left with nothing shared with it.
• Fix: A guest account whose last share was removed from the side of the account that shared with it, by deleting the shared file or folder, by changing the home folder of that account or by deleting that account, was kept until the guest signed in again or until the guest retention period removed it. It is now deleted at once, as it already was when the share was removed with "Unshare" or when the guest left the group it received the share through.

File plugins🔗

• Feature: Excalidraw drawings (.excalidraw files) can be created, opened and edited in the file manager, with the new "Excalidraw" file plugin. The editor is loaded from esm.sh by the browser, so it needs internet access.
• Feature: draw.io diagrams (.drawio files) can be created, opened and edited in the file manager, with the new "draw.io" file plugin. The editor is loaded from embed.diagrams.net by the browser, so it needs internet access; the address of a self-hosted draw.io server can be set in the settings of the plugin instead. A diagram shows a thumbnail of its content, which the editor makes each time the diagram is saved.
• Fix: The "CloudConvert" plugin could not convert any file on a server whose PHP runs with the setting opcache.save_comments turned off: after the file was sent, it failed with "The server encountered an error!". The plugin no longer depends on that setting.
• Fix: When a conversion failed at CloudConvert, the "CloudConvert" plugin kept asking for its status every five seconds without end, and showed "Input task has failed" in place of the reason. It now stops and shows the reason that CloudConvert gives.

File manager and user interface🔗

• New: The home folder is listed as "My drive" in the file manager, instead of "My files". The paths in the activity log and in the e-mail notifications use the new name too.
• New: The trash records which user account deleted each item. The trash listing has a "Deleted by" column, hidden by default, and the details panel shows it; the API trash listing returns trash_deleted_by (the account's public id) and trash_deleted_by_name. Items deleted before this version show no value.
• New: The "Activity" panel of the file manager loads more records as the list is scrolled towards its end, instead of paging. A line at the end of the list says when more records are being loaded and when there are no more.
• New: Each value of a field that holds several values, such as a recipient in the share dialog, has a button that removes it. With a mouse, the button shows when the pointer is over the value. On a touch screen, the button is always visible. Before, a value could be removed only with the keyboard or with its context menu. A value that is too long for the field now ends with "…", and a tooltip shows the whole value. Before, a long value wrapped onto several lines.
• Fix: Opening the "Activity" panel of a folder with a long history, and loading more of its records, was slow: a folder with tens of thousands of records read them all to show ten. The panel now opens as fast for a large folder as for a small one.
• Fix: The number on the "Activity" tab did not match the records the panel then listed: it left out the account's own actions, and counted what happened to a file before it was moved in the folder it went to. The number now counts the records that the panel lists.
• Fix: The "Calculate" button of the size field, in the details panel of the file manager, failed with "Internal Software Error" whenever the listing held nothing to add up: an empty folder, or a search that returned no results. It answers "Empty" now.
• Fix: The comments panel showed the button that removes a comment on comments that the user is not allowed to remove: the comments of other users on a file shared with the user, and all the comments of a file on which comments cannot be written, such as a locked file. The button now shows only on the comments that the user can remove.
• Fix: A click on a menu option that has a submenu closed the submenu when the click landed while the submenu was still appearing after the mouse had hovered over the option. A click on such an option now always leaves its submenu open.
• Fix: After an item is shared, or a share of the item is removed, the "Who has access" panel of the details now shows the change. Before, the panel kept the old list until another item was selected. The panel also shows the change after members are added to a shared drive or removed from it, in the share dialog of the drive.
• Fix: Several small fixes to the way the menus and the windows of the interface open and close.

Thumbnails and previews🔗

• New: Excalidraw drawings show a thumbnail of their content, which the editor makes each time a drawing is saved; drawings saved before the update get theirs at their next save. The 3D model viewer has a "Set as thumbnail" button, which makes the current view the thumbnail of the model.
• Change: The thumbnails and the document previews are no longer kept next to the files, in .filerun.thumbnails and .filerun.cache folders, but under system/data/temp/file_variants. The folders of the users hold only their files: backups and synchronization tools no longer copy the caches, and showing a folder no longer writes into it. The option $config['Drive']['path']['file_variants'] places them elsewhere, on a larger disk for example. It replaces $config['path']['thumbnail_cache'] and $config['path']['preview_cache'], which are no longer read. The old cache folders stay where they are, hidden, until the command line route Drive/!cli/variants/migrate_legacy moves what is still valid of them and removes the rest; run it with --dry-run first. See Updating to FileRun 2026.4.
• Change: The images a browser shows itself (JPEG, PNG, GIF, WebP and AVIF) are reduced to thumbnails by whichever of Vips and ImageMagick is enabled, whether or not the file type is in the program's list on "Files > Settings > Thumbs and previews". The lists now only say which other formats each program converts; the five types are removed from the default lists, and an installation that saved the lists keeps them there, without effect. A GIF, WebP or AVIF file above the "Use as thumbnails photos smaller than" limit is now always reduced to a still frame when one of the two programs is enabled.
• Change: In the control panel, the settings of the programs that make thumbnails and previews (Vips, ImageMagick, FFmpeg and LibreOffice) moved from "Files > Settings > Thumbs and previews" to "Files > Settings > Advanced": whether each program is enabled, its path and the IMagick mode. The file types each program is used with and the second of a video that its thumbnail is made from (now labelled "Make video thumbnails from the frame at") stay on "Thumbs and previews", where they are shown only for the programs that are enabled.
• Change: The thumbnail of an STL 3D model is now cut to the shape of the model instead of being a square, and the file list and the details panel show it whole and centred. Thumbnails made before the update stay square until the thumbnail cache is cleared. All 3D models are now shown whole and centred in the thumbnails.
• Fix: Thumbnails and previews of office documents, made with LibreOffice, failed without an error message about half of the time when several were made at the same moment, such as when a folder with several office files is opened.
• Fix: With both Vips and ImageMagick configured for a file type, a file Vips could not read, or a Vips that could not be started, gave no thumbnail. ImageMagick is now tried next.
• Fix: A file replaced by another one of the same size kept the thumbnail of the replaced file.
• Fix: The thumbnails of a file deleted from the trash were never removed.
• Fix: With the "IMagick PHP Extension" mode of ImageMagick enabled, a picture smaller than the thumbnail size was enlarged to it, a mirrored or transposed EXIF orientation was not corrected, and an error while resizing ended the request with an error instead of trying the next program. The mode now makes the same thumbnails as the ImageMagick program.
• Fix: Two requests for the same thumbnail arriving at the same moment both ran the conversion program. The program now runs once.
• Fix: A thumbnail asked for through the API (Drive/files/thumbnail) without a width and a height was not reduced to the default thumbnail size.
• Fix: Videos shorter than the time set for video thumbnails (1 second by default) get a thumbnail, made from their last frame. The thumbnail of a longer video is the frame at exactly that time, and the setting accepts only a number of seconds. FFmpeg 4.2 or newer is required.
• Fix: The thumbnail of a PNG image smaller than the "Use as thumbnails photos smaller than" limit was the whole image, whatever its resolution, even with "Process even the small files, if their resolution is too high" enabled. Such a PNG is now reduced, as a JPEG is.
• Fix: A thumbnail made from a picture inside a file (the cover of a song or of an e-book, the preview of a Pages document, the first page of an office document) was sent with the wrong file type when the picture was small enough to be used as it is.
• Fix: A CSV file had no thumbnail when one of its column names is a number, such as a year, or when one of its first rows has fewer fields than the header. A CSV file with only a header line had an empty thumbnail, and now shows the header.
• Fix: The thumbnail of an earlier version of a picture was sent as a file to download, of an unknown type, when the picture was small enough to be its own thumbnail.

Viewers and editors🔗

• Feature: The image viewer is reworked for touch screens. The toolbars lie over the image with a translucent background, a tap on the image hides them and a tap brings them back, and a zoomed image shows through underneath them. The swipe to the next or previous file works anywhere on the viewer, not only on the image. The pinch zoom is fixed: it no longer resets when the fingers lift, closes the viewer, or throws the image off the screen; it zooms around the fingers or the mouse pointer, moving both fingers drags the zoomed image, the image stays on the screen, and zooming out below 110% snaps to the natural size. A rotated image zooms correctly and keeps its rotation. An image turned a quarter turn is taller than the screen, since it is fitted to the screen before the turn, and can now be zoomed out below its natural size until it fits, which brings back the swipe to the next file; a double tap fits it at once. Moving to the next or previous file with the arrows or the keyboard no longer slides the image in; only a swipe does.
• Change: The "Save as PNG" button of the 3D model viewer saves only the part of the view that holds the model, with a narrow transparent border, instead of the whole view.
• Fix: The document editors that connect through WOPI (ONLYOFFICE, Collabora Online, Office Online Server, Microsoft 365, LibreOffice Online) opened every file read-only, for every user, when the Visitor account was not allowed to make changes. The permissions of the Visitor account now limit only the shared links that users publish. The editors, the Zoho editor, the Office web viewer and the direct download links that the Nextcloud clients ask for use the permissions of the user who opened the file. An installation that allowed the Visitor account to make changes only for the editors can now turn that permission off again, so that links shared with the "Editor" role are no longer editable by anyone who has them.
• Fix: The "Message Viewer" could not open any e-mail message (.eml and .msg files): it failed with an internal error. The viewer is available only on servers where PHP has the mailparse extension.
• Fix: The Autodesk viewer could not open a file that was new or modified since it was last opened: sending the file to Autodesk failed with "Failed to upload file to Autodesk!".
• Fix: What is saved from a WOPI editor, such as ONLYOFFICE or Collabora, now counts against the disk quota of the owner of the file and the maximum upload size. These saves were not limited before, for any user.
• Fix: A Markdown file that starts with front matter (a block of settings between two --- lines) could not be opened in the Markdown viewer, which failed with an error. The front matter is now left out of the rendered page. Comments and shared link terms written the same way failed too.
• Fix: In the file viewer, the "Fullscreen" button showed an error in Safari on the iPhone, which cannot show a page in full screen. The button is now hidden in browsers that do not support full screen.
• Fix: The "Message Viewer" did not show an e-mail address written between angle brackets, as in Name <address>, in the "From" and "To" lines. In the subject, in the body of a message without an HTML part and in the names of the attachments, the characters <, > and & were read as HTML.

Copying, moving and writing over files🔗

• Feature: The copy and move actions accept an overwrite option (the overwrite parameter of the API move and copy endpoints). A copy or a move onto an existing file replaces it, and a moved file keeps its metadata, shares and links; a copy or a move onto an existing folder merges into it, replacing the files of the same names and keeping the rest, the folder at the destination keeping its own tags, comments, shares and links while a moved folder's end with it, those of the files inside moving along. Without the option, a copy and a move are refused where a name is taken, before anything is copied or moved, and the answer lists the items in the way under conflicts, each with the sentence naming it. Every other check a copy or a move makes, the permissions and the locks included, is made before the first item is touched as well, so a refused batch leaves nothing half done.
• Feature: When copying or moving onto items that already exist, the web interface asks about each: overwrite the file or merge the folder, skip the item, or cancel, with a checkbox to decide once for all of them. "Make a copy" still makes a "Copy of" name.
• New: Copying, zipping and extracting into a folder no longer require the permission to make changes; being allowed to download the source and to upload into the folder is enough. Accounts that could download and upload but not change files can now copy, zip and extract.
• New: Writing over a file that already exists, which an extraction does and a copy or a move does when asked to, requires that the file could be deleted and that the folder allows uploading. An editor saving a file, and an upload over an existing file, are not affected. The replaced content is kept as a version; where versioning is off, the replaced file is moved to the trash instead of being lost.
  • An account holding the "editor" share role without the permission to delete files could extract an archive over existing files before; it cannot any more, while a "manager" can.
• New: The API has a copy endpoint, Drive/files/copy, taking path, copyTo and overwrite and requiring the download and upload scopes. The answer carries the path of the copy under path. A taken name is refused unless overwrite is sent, and a target folder that does not allow uploading gives a refusal. See Copying files or folders.

Search🔗

• New: The name of the Elasticsearch index of the content search can be set in the control panel, under "Files > Searching", so that several installations can use the same Elasticsearch server, each with an index of its own. Existing installations keep the index they have, which is named files. A name that the server would read as several indices, such as one with a * or a ,, is refused.
• Fix: The command line script cron/reindex_files.php no longer fails on an Elasticsearch server of version 8 or later when it removes from the index the documents of files that no longer exist.
• Fix: A search inside the contents of files, with a keyword that the search server cannot read as a query (an "AND" with nothing after it, a quote that is not closed), failed with "The search server is misconfigured. Please contact the administrator.". The message now gives the reason of the search server, such as "Failed to parse query [report AND]". Through the API, such a search is answered with the status 400.

Account settings and sessions🔗

• New: The session cookie is named fr_session instead of Drive[token]. The square brackets are not allowed in a cookie name by the HTTP cookie standard, and some proxies and clients dropped the cookie because of them. A browser that signed in before the update stays signed in: its token is moved to the new name on its first request. The name can be changed with the configuration option $config['system']['session']['cookie_name']; changing it signs every browser out once.
• Change: The account settings menu has six pages. The "Two-factor authentication" page shows the passkeys, the authenticator app and the recovery codes together, and the e-mail address is changed from the "Profile" page. See Your account settings.
• Fix: A request that sent the session cookie with a browser identification (the User-Agent header) other than the one the session was created with ended the session, so the user was signed out in every tab. This happened after every browser update, and when Safari on iOS played a video or an audio file opened directly in a tab, where the playback also stopped after a second or two, because iOS fetches the media with the identification of its media component. The session now stays valid, and the activity log gets a "Session used with a different user agent" entry, one for each different user agent of a session.
• Fix: With "The last login will end all other active browser sessions" enabled, signing in again from a browser that was already signed in to the same account ended on the sign-in page again.
• Fix: Adding a passkey from the account settings, or from the two-step authentication setup page, failed with the error "Invalid 'sameOriginWithAncestors' value" while the Bitwarden browser extension was active.
• Fix: An account with only a password, without an e-mail address and without a second factor, was asked for its password again as soon as it opened an account-sensitive page, such as "Connected apps" or the password change, right after signing in. The sign-in now counts as that verification for five minutes, as a sign-in with a second factor already did.

Sign-up🔗

• Change: When the reCAPTCHA secret key of the sign-up settings is missing or wrong, the reason is written to the PHP error log, and the visitor gets the general error message. Before, a wrong key made every visitor see "Please solve the captcha challenge." with nothing in the logs. The captcha answer is checked through the HTTP proxy set in the configuration, if there is one.
• Fix: With "Enable reCAPTCHA" turned on in the sign-up settings, every sign-up failed with "The server encountered an error!", even with the captcha solved.
• Fix: A sign-up whose home folder could not be created answered "Your account has been created. However, errors were encountered" and left an account without a home folder. Such a sign-up is now refused and no account is made, so it can be tried again once the problem is solved. Editing a user account no longer creates the new home folder on the server when the edit is then refused for another reason.
• Fix: An account made through the sign-up page could not be activated when it took the last user account the license allows: its activation link answered that the registration is not open. The sign-up page now stays open when the limit is reached, and a sign-up over the limit is refused when the form is sent.

Deleted user accounts🔗

• Feature: The control panel has a "Deleted users" section, under "All users", where the superuser sees the kept records of the deleted accounts: who was deleted, when, by whom and why, with a search. An "Erase" action removes a record permanently, together with the account's profile picture; the account is then shown as "Deleted user" wherever it is referenced. The erasure is recorded in the activity log.
• Change: The record of a deleted user account is kept, without its password or any other credential, so that the account's name and picture stay visible in the activity log, on its comments, in the trash's "Deleted by" column and wherever else it is referenced; the name is shown with "(Deleted user)" after it. The account itself is removed as before: it cannot sign in, holds no license seat, is not listed anywhere and its login name is free again. Accounts deleted before this version show as "Deleted user", as before. The kept record holds the account's name, e-mail address and profile details.
• Fix: A lock taken by an account that was deleted since no longer keeps the file locked: the file is free for everybody. Before, the file stayed locked for everyone but its owner and the administrators, with the refusal naming the deleted account.
• Fix: Deleting a user account now also removes the folder notification rules the account had set, in its own folders and in the folders shared with it. They were left behind before.

Languages and translations🔗

• Feature: Each user account has a language. An administrator sets it in the user window of the control panel, or through the API (data[language] of the user endpoints), and the web interface sets it when the user works in a language other than the default one. An account without one gets the default language of the installation.
• Feature: E-mail messages are written in the language of the user they are sent to: the notification digest, the share messages, the verification codes, the password reset and the security notices.
• New: The language of a user account is chosen in the account settings, with the "Language" field of the "Profile" page. The e-mail messages to the account are written in that language, which no longer changes when the user opens the interface in another language, and an account can return to the default language.
• Change: The e-mail messages can no longer be customized by copying their templates under customizables/emails: copies placed there are ignored after the update. The text of a message can be changed with a translation file under customizables/translations instead, in the section of the message (Email/Signup, for example), English included. See E-mail notification system.
• Change: Some translation sections were renamed. If you keep your own translation files under customizables/translations, the files inside a Core or Drive folder of a language are no longer read and have to be moved one level up: for example customizables/translations/german/Core/Basic.php becomes customizables/translations/german/Basic.php. One file gets a new name instead: Drive/Notifications.php becomes Notifications/Triggers.php. The other files keep working as they are. See Translating FileRun.
• Fix: The name of a folder or of a user account is no longer translated when it is the same as a text of the interface. This affected the path above the file list, the account button of the file manager, and the account shown on the second step of the sign-in and on the pages where an application asks for access to the account.
• Fix: Some texts showed in English in a translated interface:
  • the names of the months and of the weekdays in the short dates of the file list, such as "Jan 5" or "Monday"
  • outside the file manager: the messages of a list that failed to load, of copying text to the clipboard and of choosing a profile picture, the "Reset to default" option of the column menu, and the hint of the upload drop zone
  • the "Activity logs" settings page of the control panel
  • the settings of a file handler whose name is translated
  • the messages about the home folder and the role when saving a user account
  • the message refusing to copy a folder over a file of the same name
• Fix: The form of the OpenID Connect sign-in, and the forms of the sign-ins based on it, such as Authentik OpenID Connect, were shown in English in every language.
• Fix: Saving the settings of a file plugin in the control panel answered in English ("Change saved", "No changes were made!"), whatever the language of the administrator.

E-mail sending🔗

• New: The messages about the security of an account (a recovery code used, a passkey recovery used, recovery codes generated) are placed in a queue and sent by the command line script cron/everyMinute.php, which has to run every minute. A message that the mail server refuses is tried again, up to five attempts. The superuser sees the queue in the control panel, under "E-mail > Notices", with a copy of each message sent, and can send a failed message again.
• Change: The library that sends the e-mail messages (PHPMailer) is updated to version 7. On a server that sends through PHP's mail() function (no SMTP server is set in the control panel) and whose sendmail_path PHP setting already names an envelope sender with -f, that sender is now used. Before, the application added the "From" address of the message as a second -f option.

E-mail notifications🔗

• Change: Two options of the e-mail notifications about files moved in customizables/config.php: $config['app']['email_notification']['basic_actions'] becomes $config['Drive']['email_notification']['basic_actions'], and $config['app']['email_notification']['folder_based']['limit_actions'] becomes $config['Drive']['email_notification']['folder_based']['limit_actions']. Their values stay the same: the names of the actions, without the application, such as receive_upload. An option left at the old place is ignored.
• Fix: On an installation where the e-mail notifications did not run for a longer time, the run could end with a PHP out of memory error before sending anything, and then failed the same way on every following run. An activity log entry that cannot be read is now skipped instead of being tried again on every run.
• Fix: The "Troubleshoot notifications" button of the activity log moved the point the e-mail notifications continue from to the entry being looked at. After looking at an old entry, the next run sent every notification since that entry again; after looking at a recent one, the notifications for the activity before it were never sent. The page no longer changes anything.
• Fix: The e-mail warning that a space quota is almost full is now sent. Before, it was never sent, although the "E-mail notifications" option of the user account listed it. A user with "E-mail notifications" on receives the warning about their own quota. The admin of a shared drive receives the warning about the quota of the drive, when the admin has "E-mail notifications" on. A shared drive without an admin warns nobody. The warning is sent at most once a week for each account, however often the scheduled task runs. The command line route Drive/!cli/space_quota_notifications takes the option --uid=, to check only one account.
• Fix: With "Automatic share e-mail notifications" on, sharing a folder on which you had set a notification rule yourself turned your rule into the receiver's, the first member's for a group, and left you without one. Your rule now stays yours, and each receiver gets one of its own.
• Fix: A user with the e-mail notifications turned on was told when somebody uploaded a new file into their folder, but not when somebody uploaded over an existing file or saved one from an editor. The default list of notified actions now includes the update of a file (receive_file_updated). An installation that sets its own list in the configuration ($config['Drive']['email_notification']['basic_actions']) is not affected.
• Fix: A user with the e-mail notifications turned on was not told when somebody copied a file into their folder: the default list of notified actions named two actions (receive_copy, receive_move) that are never recorded. The list now names the action that is recorded for a copy (receive_file_copy_created). An installation that sets its own list in the configuration ($config['Drive']['email_notification']['basic_actions']) is not affected, and should replace the two names there as well.
• Fix: A folder notification set on "new files and changes" did not tell about a file created inside the folder from the web interface, such as a new text document or the result of a PDF merge.
• Fix: The e-mail notification about a file uploaded over an existing file, or saved from an editor, said only "File updated", without the name of the user or the file. It now says who updated which file, with a link to the file and its size where it is known. The notifications about a file extracted from an archive, a file replaced by a copy and a newly created file had the same problem and now name the user and the file as well.
• Fix: The "E-mail notifications" option of the account settings page was hidden from an account without a home folder, although such an account is mailed about the files and folders shared with it just the same, so it could not turn those messages off. The option is now shown to every account that may edit its details, and its explanation lists every event the option covers.
• Fix: The e-mail of a control panel notification rule about a folder that another user moved, or made a copy of, said that the folder "has been received from" that user. It now says that the user moved the folder, or made a copy of it.
• Fix: A notification rule of the control panel on the action "User manual deactivation", "User automatic deactivation" or "User manual activation" now sends its e-mail. Before, such a rule sent nothing.

Activity log🔗

• Feature: Every activity log entry records whether the action succeeded, and the channel the request came through: the web interface, the API, the OAuth2 token endpoints, WebDAV, the mobile and desktop apps, or the command line. The control panel shows the channel in the entry's details, and an entry made through the API names the API client. Entries from before the update get their outcome from the action; their channel stays empty.
• Feature: The activity log can also be written as one line of JSON per entry, for log management systems (SIEM). Set $config['system']['activity_log_stream'] in customizables/config.php to a file path, or to php://stderr for the container output. See Activity log actions.
• Feature: Changes made to settings in the control panel are recorded in the activity log as "Settings changed", with the value of each changed setting before and after. This covers the settings pages, the settings of the file handlers, the theme reset and the settings import. The values of passwords, secrets and keys are not recorded.
• New: A refused sign-in with credentials sent through HTTP Basic authentication (WebDAV, the mobile and desktop apps) is recorded in the activity log as "Login failed", with the username that was tried. At most five such entries per IP address, and sixty in total, are recorded per minute.
• New: The CSV export of the activity log has three new columns: "Action key" (the action's name, the same in every language), "Successful" and "Channel".
• Change: The actions of the activity log are named together with the application they belong to, such as Core.login or Drive.upload. The update renames the entries of the activity log, of its archive and of the e-mail notification rules. A configuration that names actions has to be changed by hand to the new names: the option $config['system']['custom_event_scripts'] in customizables/config.php, and the event scripts in customizables/events, whose file names become Core.login.php, Drive.upload.php and so on. The catch-all event script receives the new name in $action. Activity log actions lists the names of the actions, by application.
• Fix: The activity log page of the control panel failed to load ("The server encountered an error!") when it held a "user added" or "user edited" entry of an account created or edited without a last name, as the CSV import does when no column is mapped to the last name, and as an API client does when it sends none.
• Fix: The search of the activity log ignored the actions of the API clients ("API client successfully added" and the others) when they were checked in the list of actions, and showed the entries of every action instead.
• Fix: The activity log showed an internal name, nextcloud_login, for an application connected through the Nextcloud login flow. It shows "App connected" now; the records made before the update keep the internal name.

Control panel🔗

• Change: The "Export database" tool of the control panel hands the export to the browser as a download (a .sql.gz file). It is no longer saved inside the superuser's home folder, and no copy of it stays on the server.
• Change: In the control panel, the lists for picking users and groups are no longer limited by the "Can interact with" permission of the administrator who is signed in. An independent administrator still sees only the accounts it created.
• Regression fix: In the control panel, the tab opened for editing a deactivated user account showed HTML code around the username, and the tabs for editing roles, groups and API clients showed the "&" character and apostrophes in names as HTML codes, such as &.
• Fix: The lists that show one page at a time were slow on a large installation: a page of twenty rows took as long as the whole list. This covers the control panel lists (user accounts, groups, roles, shared links, notifications and the metadata settings among them), together with the search results and the media views of the file manager. On a large installation the lists now open much faster.
• Fix: The help text of the "Enable browser favicons" option, in the control panel, named a folder that software updates overwrite, so icons changed there were lost at the next update. It now names the folder customizables/images/favicons, which updates do not overwrite, and lists the three icon files the folder has to contain. See Favicons.

Settings export and import🔗

• New: The export of the settings from the control panel is recorded in the activity log ("Settings exported", with the file name and the number of settings; the values themselves are not logged). The exported file also names the software build and the database version.
• Change: The settings export file groups the settings by the application that owns them (Core, Drive, and the applications of the installed plugins). A file exported by an earlier version can still be imported.

WebDAV and the mobile and desktop apps🔗

• New: The control panel page "Files > Settings > Features" has two new options under "Access": "WebDAV", which turns off access through dav.php, and "Mobile and desktop apps", which turns off access by the mobile and desktop apps. Turning off one does not affect the other. Both are on after the update.
• New: Connecting an application through the Nextcloud login flow, which is how the Nextcloud desktop and mobile apps sign in, asks the person in the browser to verify their identity first, as the "Connected apps" page does. It is not asked right after a sign-in that already verified the same thing.
• Change: A WebDAV request for the whole tree below a folder in one listing (Depth: infinity on PROPFIND) is refused with the 403 Forbidden status and the propfind-finite-depth precondition the standard defines for it. Such a request used to be answered with one level only, which told the client it held the whole tree when it did not. A client that needs the tree reads it one level at a time. A listing carrying no depth, or a depth of 0 or 1, is unchanged.
• Fix: Moving or copying a file over an existing file through WebDAV, and a chunked upload through a Nextcloud client over an existing file (which is how the desktop client sends a changed large file), replaced the file by moving it to the trash and creating a new one, so the file lost its tags, comments, shares, links and previous versions. The file is now replaced the way the web interface replaces one: a file copied or uploaded over keeps its identity, a file moved over another keeps its own at the new path, and the replaced content is kept as a version (or in the trash, where versioning is off). A folder at the destination is still replaced whole, as WebDAV requires.
• Fix: A chunked upload through the Nextcloud desktop client into a folder shared with the "contributor" role failed at its last step, after the file had been written.
• Fix: Over WebDAV, a MOVE or a COPY of a file or a folder onto itself is refused, with the status 403, and the item is left alone, as the standard asks. It used to move the item to the trash, as the destination to be replaced, and then fail.
• Fix: A WebDAV client writing the Depth header as Infinity rather than infinity, which the standard allows, was not understood: copying a folder made an empty folder at the destination and reported success, and deleting a folder was refused with an error. Both spellings now mean the whole folder, with everything inside it.
• Fix: When the Nextcloud desktop client resumed an interrupted chunked upload, the upload could start over instead of resuming.
• Fix: A chunked upload through a Nextcloud client that does not declare the size of the file (the Android app) was checked against the upload size limit and the quota only once the whole file had been transferred. It is now refused at the piece that crosses the limit, with the pieces before it kept for a resume. A chunked upload whose pieces do not add up to the size the client declares is refused instead of being put together into a damaged file.
• Fix: A chunked upload through a Nextcloud client over a file that already exists was answered with an HTTP redirect (302) instead of the success status (204) at its last step, after the file had been written. A chunked upload of a new file was not affected.
• Fix: The "Connect app" option, in the user menu and in the account settings, was hidden while the API was disabled, although the credentials it creates are also used by WebDAV and by the mobile and desktop apps. It is now hidden only when the API, WebDAV and the mobile and desktop apps are all disabled.
• Fix: Over WebDAV, a MOVE of the home folder or of the root of a shared folder answers with the refusal instead of an internal error.
• Fix: Copying a folder without its contents through WebDAV (Depth: 0) reported the status of a newly created folder (201) even where it replaced a folder already at the destination, for which the standard requires the status of a replacement (204).

API and OAuth2🔗

The endpoints added and changed are listed on API changes in 2026.4.

• Change: The API endpoint Core/users/search is for administrators only, and needs the admin scope. Any other account finds the people it can share with through the new endpoint Drive/users/search, which needs the share scope and lists only the accounts that the "Can interact with" permission allows.
• Change: A write the quota refuses is answered with the 507 Insufficient Storage status instead of 403, on every endpoint. The Nextcloud desktop client understands it and stops sending files that do not fit, where it kept retrying on the 403. An API client that checked for the 403 has to accept the 507; the message in the answer is unchanged.
• Change: The API endpoint Core/!admin/users/info returns last_web_ui_access instead of last_access_date. The value is the same: the last time the account opened the web interface. The endpoint also returns last_seen: the time of the last activity of any kind, as a Unix timestamp.
• Change: The API names the home folder path template of a role drive_homefolder_template: the endpoint that reads a role (Core/!admin/roles/info) hands it out under that name, and the endpoints that create and edit a role (Core/!admin/roles/add and Core/!admin/roles/edit) accept it. The old name, homefolder, is still handed out and accepted, and will be removed in a future version.
• Change: An error answered by the OAuth2 token endpoint no longer has the message field, which repeated error_description. An API client that read message has to read error_description.
• Change: A refresh token that is expired, revoked or issued to another application is answered with the invalid_grant error and the 400 status, as the OAuth2 standard requires. It was answered with invalid_request and the 401 status. An authorization code that is expired or revoked is answered with invalid_grant too, where it was invalid_request.
• Change: The PHP API client library (apps/Drive/!classes/vendor/FileRun/API/Client) is no longer part of the installation package. The software itself does not use it.
• Change: The OAuth2 token endpoint refuses a password grant request with an empty username, with the invalid_request error.
• Fix: The hasThumb detail of the API listing endpoint (Drive/files/browse) answered the opposite of the truth: true for files which cannot have a thumbnail and false for the ones which can.
• Fix: The weblink-full detail of the API listing endpoint carried the password of the link under download_limit instead of the download limit.
• Fix: The OAuth2 authorization page failed with an error when an application asked for the metadata or the comments scope without asking for all of list, upload, download, modify and delete.
• Fix: An OAuth2 authorization request refused for a scope that does not exist is sent back to the application with the state it came with. The state was missing, so an application that checks it had to discard the answer.
• Fix: The API endpoint that deletes user accounts (Core/!admin/users/delete) answered a refused deletion with "Failed to delete user" and nothing more. The message of the refused account now holds the reason as well, the way the control panel shows it: for example that the superuser account cannot be deleted, or that the home folder cannot be deleted because other users have their home folders inside it.

Software update and installer🔗

• New: A software update installed from the control panel now ends with a clear message saying that the update was installed, and whether the database update follows. The notes of the update for the administrator, such as warnings about the server and where the replaced files are kept, are shown apart from the update log, and the log is one button away. This applies to the updates installed from this version on.
• New: The requirements check page shows the free disk space of the installation folder, and warns when it is below the needed space.
• New: The installer accepts the name of the database account used with "Use root credentials". Before, it was always root, which did not work on database servers where the administrator account has a different name.
• Regression fix: Updating from a version older than 2024.1.0 (the 2023 versions) stopped at the database update, with an error saying that the table fr_drive_metadata_fieldsets doesn't exist. An installation on which the update stopped this way can run the update again with this version.
• Fix: The software updater refuses a package of a version older than the installed one.
• Fix: The requirements page of the installer checked whether the exec function is available. The check now correctly tests proc_open.

Docker and installations with several filesystems🔗

• New: On the official Docker image, the control panel notifies the superuser when the image is older than the one the installed version recommends, and the PHP info page shows the same warning next to the image version.
• Regression fix: The software update stopped at the first application folder and put the installation back to the version it had, on installations whose temporary folder sits on a different filesystem than the application files, such as a separate Docker volume mounted over system/data. The message was "rename(): The first argument to copy() function cannot be a directory". An installation where the update failed this way can apply the update again with this version.
• Fix: Added support for moving files between different filesystems, such as in the case of using different Docker volumes. The most commonly affected cases were using the software update system or the trash system while having the temp folder mounted on a different volume. Files left in the trash folder by the earlier failures have no record and are not shown. See Updating to FileRun 2026.4.
• Fix: Restoring a folder from the trash failed on installations whose trash folder is on a different filesystem than the user files, while moving the folder to the trash worked.

Server environment🔗

• Change: The library that makes the server's outgoing HTTP requests (Guzzle) is updated to version 8. It checks the types of the options set in $config['system']['http']['options'], and refuses cURL options that replace its own settings, such as the certificate check, the proxy or the timeout. HTTPS connections need TLS 1.2 or newer, a connection attempt waits at most 60 seconds (300 before), and only redirects with the status 301, 302, 303, 307 or 308 are followed.
• Fix: With the PHP setting opcache.validate_timestamps turned off, every request filled the OPcache memory a little more, until OPcache ran out of room and restarted, throwing away every compiled file of the installation.
• Fix: The connections to OpenID Connect providers, to the OAuth2 services (Google, Microsoft, Authentik, Box, Dropbox) and to the WOPI document editing servers did not use the CA certificates bundled with the application. On servers where cURL has no CA certificates of its own, typically on Windows, they failed with a certificate error (cURL error 60).

Fixes🔗

Sharing and shared links🔗

• Regression fix: Removing the expiration date of a shared link, by clearing the date in the link's options, failed with "Failed to update web link" on database servers running in strict mode, which is the default of MySQL and MariaDB. A Nextcloud client could not remove the expiration date of a link either, and one that sends the date followed by a time could not set it. Through the API, an expiry that is not a valid date is now refused with a message saying so, where it gave a database error.
• Fix: Deleting a shared folder, changing the home folder of a user, deleting a user account and deleting a shared drive now remove what the receivers of the ended shares kept in the folders, their links, their folder notification rules and their stars, as removing a share does, and a guest account that has nothing shared with it anymore goes with them. They were left behind before.
• Fix: The daily cleanup of the share records whose folder was removed outside the application now removes what the receivers kept in the folder as well, and a guest account that has nothing shared with it anymore. It also removes the folder notification rules of folders and of shares that no longer exist. The new command line route Drive/!cli/sharing_cleanup runs both by hand.
• Fix: With a download accelerator (such as X-Sendfile), a video played through a shared link with a download limit no longer spends one download for each request of the player. A request for a part of the file spends nothing when the same browser session spent a download of the link less than one hour ago, and the activity log does not hold that request. A request for the whole file always spends one download.
• Fix: Opening a file in a viewer or an editor on another server, through a shared link with a download limit, now counts as one download of the link. It did not count before, so the limit could be avoided this way.
• Fix: The preview of a file reached through a shared link with a download limit no longer spends one of the downloads of the link. A visitor who opened the preview page of a link with a limit of one download could not download the file afterwards.
• Fix: The temporary link created for viewing or editing files inside a shared link that a user created inside a shared folder now depends on the shared link it was opened through: it stops working when the shared link is removed, expires or starts requiring a sign-in, when its password or terms change, when the file is moved out of its folder or removed from its collection, and when the share or the permissions of the owner or of the user who shared the link no longer allow it.
• Fix: A file reached through a shared link that a user created inside a folder shared with them can be opened in the viewers and the editors that read it from another server, such as the Office Web Viewer. They got the error "This share is no longer accessible!".
• Fix: The configuration option $config['app']['weblinks']['forcePasswords'] set to false acted as if it were set to true, and a password was added to every web link created without one.
• Fix: For a user whose "Can interact with" permission allows no other user, the suggestions of the share dialog failed instead of being empty.
• Fix: In the "Link access" section of the share dialog, an item that cannot be shared with a link now shows the crossed-out link icon. The icon was missing.

Downloads🔗

• Fix: A download of a part of a file now follows the HTTP standard. Video players and download managers ask for such parts. A request for the last bytes of a file now receives those bytes. Before, it received the start of the file. A request for several parts at once now receives the whole file. Before, it received an empty response. A download with an empty If-Range header no longer fails.
• Fix: A client that resumes a download, or that asks whether its copy of a file is still current, now gets the answer that the HTTP standard defines. A client can ask the server to refuse a resumed download when the file has changed in the meantime. The server now does so. Before, the client received a part of the new file. A downloaded file now has its modification date in the response.
• Fix: A file whose name has a double quote is now downloaded under its whole name. Before, the name ended at the quote.

Uploads🔗

• Fix: An upload whose data had all reached the server, but which failed at its last step, left its temporary file (with the .upload extension) in the folder, and uploading the same file again was refused with the message "There is a temporary file which looks complete". The next upload of the same file, from the web interface or from the API, now completes the upload with that temporary file, without sending the data again.
• Fix: With versioning enabled, uploading a file over an empty file failed with "Failed to update the file", from the web interface, from the API and with a chunked upload of a Nextcloud client.
• Fix: The image editor could not save an image larger than the upload size limit of PHP (upload_max_filesize, 2 MB by default), and a refused save did not show the details of the error. The image is now sent in chunks, like the files uploaded in the file manager, so no size limit of PHP applies.
• Fix: The text editor could not save a file larger than the POST size limit of PHP (post_max_size, 8 MB by default), and the save failed with "Unexpected server reply". The text is now sent in chunks, like the image editor's, so no size limit of PHP applies.

File metadata🔗

• Fix: The automatic metadata extraction read nothing from the Exif data of most WebP pictures, so their author, description, copyright and "Date taken" stayed empty.
• Fix: On a Windows server, a file in the Shorten audio format (.shn), or any audio or video file that starts with the signature of that format, made the "Media Info" viewer and the metadata extraction of the file fail with an internal error. The details of Shorten files are no longer read: the "Media Info" viewer says that the format is not supported.
• Fix: The "Date taken" that the automatic metadata extraction reads from the Exif data of a WebP picture was shifted by the time zone of the server: on a server set to a time zone three hours ahead of UTC, it was three hours later than the time in the file.

User accounts, roles and groups🔗

• Fix: The user retention settings no longer deactivate and then delete accounts that might still be in use. Only the web interface counted as activity, so an account used only through WebDAV, the API, or the mobile and desktop apps looked inactive.
• Fix: Changing the role of an independent administrator, where the new role gives the account a different home folder, left every user account that administrator had created without a home folder: their home folder setting was emptied. The files on the server were not touched. Those accounts now get the same path under the administrator's new home folder, which is what editing the administrator's account already did. As with any change of a home folder path, files are not moved on the server.
• Fix: A group created with every user selected no longer takes the visitor and the system accounts as members, and neither can be added to a group by hand: a membership grants access to what is shared with the group, and the visitor account is every anonymous reader of a public link.
• Fix: The CSV import of user accounts stopped with "The server encountered an error!" at a record whose username column was empty. Such a record is now reported as missing its username and skipped, as a record without a name is, and the import goes on with the records after it.
• Fix: When an administrator creates a user account with the option to e-mail the sign-in details, and the mail server refuses the message, the account was reported as created with no word about the e-mail. The answer now says that the e-mail could not be sent. This applies to the control panel, the API and the CSV import.
• Fix: Importing user accounts from a CSV file with "Send a notification now" checked sent no e-mail when the passwords in the file were already hashed, and reported for each account that the e-mail could not be sent. The e-mail is now sent with the username and tells the user to sign in with the password they already use.
• Fix: The CSV export of the user accounts no longer includes the built-in visitor and system accounts. The export is now recorded in the activity log ("Users exported", with the file name and the number of rows), and an installation with a very large number of accounts no longer risks the memory limit.
• Fix: The e-mail with the sign-in details, sent when an administrator creates a user account, told the user that the account might still be waiting for activation whenever sign-up with administrator approval was turned on, even though the account was active. The text is now sent only to an account that is not active: a sign-up waiting for approval, or an account the administrator created as inactive. The e-mail of a sign-up without administrator approval carries the activation link as before.
• Fix: When editing a role's home folder path failed while the accounts holding the role were being updated for the new path (for example because the new folder could not be created), the answer said that the role was not updated while the new path was already stored, with some of the accounts moved and the others not. The role and the accounts are now left as they were, as the answer says.

Miscellaneous fixes🔗

• Fix: Added a workaround for opening files in new tabs in Safari on iOS 27.
• Fix: An empty file uploaded as a profile picture, as a software update package, or for importing users or settings is refused with the message "File is empty". Before, the upload failed later with a less clear error, and an empty update package replaced the package that had been uploaded before it.
• Fix: The form for editing a user account could open on a disabled tab, such as a permissions tab of an account that has a role, when that tab was the one last used. It now opens on the first tab that can be used.