FileRun 2026.3.0🔗

The changes of FileRun 2026.3.0, released in September 2026.

Last updated on September 6, 2026.

A note on applying this update: the update is now protected from other site visitors with a one-time update key, which your current control panel cannot pass to the browser on its own. After clicking "Install update", copy the key printed at the end of the update log (🔑 Update key: …) before reloading the page, and paste it on the page that follows. If you missed it, the key is in the file system/data/temp/update.key on the server. This step is needed only once: from this version on, the control panel handles the key by itself.

Highlights🔗

This update contains more than 270 documented changes — the result of months of work with one main goal: protecting your accounts, your files and every connection made to your server. Several of the vulnerabilities it fixes are severe, so we recommend that you apply it as soon as possible.

The security work is only part of this release. It also brings a long list of fixes and improvements to every part of FileRun. A new folder-size cache makes uploads and browsing much faster for accounts with a disk space quota, and folder sizes are now shown in the file list, in the mobile apps and in WebDAV clients. Guest access is smoother: every link FileRun e-mails to a guest now signs them in automatically and opens the shared item. Sharing, the software updater, WebDAV, the API, the control panel and the theme have all been improved. Here is what deserves your attention:

• Passkeys are here. Users can now sign in with a fingerprint, a face, a device PIN or a USB security key. A passkey is faster than a password, it cannot be guessed or stolen in a data leak, and it is resistant to phishing.
• Two-factor protection for every account, by default. E-mailed codes now protect accounts by default, so multifactor authentication no longer depends on every user configuring an authenticator app. One-time recovery codes cover the loss of a device, a new "Sessions" panel shows and revokes active sign-ins, and admins can make a second factor mandatory. Every change that affects the security of an account must now be confirmed with the strongest verification method that account has.
• A new OAuth2 engine. The OAuth2 server was completely rewritten for security, performance and OAuth 2.1 readiness. Apps and devices now connect with individual, named app passwords instead of the account password, and access tokens are cryptographically signed, so they cannot be forged. Existing desktop, mobile and WebDAV connections are migrated automatically — your users will not need to reconnect anything.
• OpenID Connect sign-in. A new authentication plugin connects FileRun to any identity provider that supports the OpenID Connect standard — Authentik, Keycloak, Authelia, Microsoft Entra ID, Google and others — with complete sign-out in both directions.
• Many security fixes. A long list of vulnerabilities and access control issues was fixed, from remote code execution, username enumeration and IP address spoofing to permission checks in sharing, groups and roles. Most were found by our own AI-assisted security audit of the entire FileRun codebase: AI now lets attackers search for weaknesses faster than ever, so we used the same acceleration for the defense. The others were reported to us privately by a security researcher, whom we thank. Several of these vulnerabilities are severe, and the details of one are withheld until installations have had time to update, so please do not delay this update.
• Noticeably faster. A new folder-size cache makes storage quota calculation instant and uploads much faster for accounts with a quota, and folder sizes are now visible in the file list, in the mobile apps and in WebDAV clients. Browsing folders, moving items and WebDAV transfers are faster as well.
• Ready for the newest Nextcloud mobile app, and better WebDAV. The newest versions of the Nextcloud app check the available storage space before uploading, and the server now reports it, so uploads from the latest app versions work, and the iOS app can sign in again. Every WebDAV client can now show the available space before a transfer starts, and lock requests are answered exactly as the WebDAV standard prescribes, for better compatibility with the Windows WebDAV client and Microsoft Office.
• A more complete audit trail. Group and role changes, e-mail address changes and automatic account cleanups are now recorded in the activity log, and the changes the software makes on its own are filed under a dedicated "System" account. Together with the enforced multifactor authentication, this makes security requirements such as NIS2, and the questionnaires of cyber-insurance providers, easier to answer.
• A much larger API. User groups, roles, comments, tags, file locking and the trash can now be managed through the API, which makes FileRun easier to automate and to integrate.
• A smoother experience for guests. A guest no longer needs one specific link to reach the files shared with them: every link FileRun e-mails to a guest now signs them in automatically and opens the shared item.
• More control over the theme. The theme customization page gains nine new color presets, a "Shadows" setting, an "Elevated surface" color and separate "Primary text" and "Links" colors, and a new documentation page explains how to put together a complete light and dark color scheme, with a ready-made AI prompt.
• A failed update has no chance of leaving a broken installation. The updater now keeps a backup of everything it replaces and restores it if the update fails partway, it swaps each application folder in one step so the installation is never left half updated, and it protects the moment between the file swap and the database update with a one-time update key. The installation package and the update package are now one and the same file, and re-applying an update also repairs a damaged application file.
• And many refinements. A Hebrew translation, support for PHP 8.5, wildcards in the file search, a reorganized admin control panel, an audio player that floats over the file list and can be minimized, colorful thumbnails for 3D STL files with no external software required, and more than one hundred smaller fixes.

New features🔗

• Added support for PHP 8.5.
  • A new Docker image labeled "filerun/filerun:2026.03" was made for it.
  • If you are configuring your own PHP server, keep in mind that you need ionCube Loader 15.5.0 (released March 2026) or newer.
• Added support for passkeys (WebAuthn, FIDO2).
• Added an "OpenID Connect" authentication plugin.
  • Endpoint discovery via {issuer}/.well-known/openid-configuration
  • PKCE (S256), nonce, ID token signature/claims validation against the provider's JWKS, and a userinfo subject cross-check (OIDC Core 5.3.2).
  • RP-initiated logout (the browser completes the sign-out at the provider's end-session endpoint).
  • Back-channel logout (the provider terminates matching FileRun sessions by POSTing signed logout tokens to auth/backchannel_logout, logged as a dedicated activity action).
• Added an "Authentik OpenID Connect" authentication plugin.
  • Compared to the OAuth2-based plugin, it handles logging out bidirectionally. The legacy "Authentik OAuth2" plugin is marked as deprecated; existing installations keep working on it untouched, but migration to the new plugin is recommended.
• Added support for WebDAV quota properties (RFC 4331), allowing WebDAV clients to display quota usage and proactively prevent actions that would result in errors because of quota exhaustion.
• Added a Hebrew translation.

Security🔗

• TOTP secret length raised from 10 to 20 bytes (160 bits, per RFC 4226).
• Improved encryption of data sent via QR codes.

Fixed security vulnerabilities🔗

• Fixed a concurrency bypass vulnerability in the brute-force password attack protection.
• Fixed a time-based username enumeration vulnerability in the login process.
• Added IP address spoofing protection. To apply this, configure the trusted proxy IP addresses in the "System" section of the FileRun control panel.
• Fixed a file security issue allowing a user with "Manager" access to one share and "Viewer" access to another share from the same owner to move files from the "Manager" share into the read-only ("Viewer") one, and equally into a web link folder whose role forbids uploading.
• Fixed a file security issue allowing a user with access to a share with the "Manager" role to move files inside that share when the user does not have upload permission on his account.
• Invalid password throttling no longer informs the user about the current state, to prevent account enumeration.
• Replaced the sleep()-based throttling, which was a denial-of-service attack vector in the login process.
• Fixed an information disclosure issue affecting file metadata.
• Fixed an administrator being able to put a new user account into groups they are not allowed to manage. Only one of the groups named had to be theirs, and an independent administrator could name any group at all, including groups belonging to another administrator. Being in a group grants access to whatever is shared with it.
• Fixed an access control issue with adding user accounts to groups.
• Fixed an access control issue with removing user accounts from groups.
• Fixed an administrator who is allowed to create user accounts being able to give an account any permissions they wished, administrative ones included, by naming a role their own account is not allowed to use. Only the roles an administrator is shown can be assigned now.
• Fixed the paths of the external programs used for thumbnails and previews (FFmpeg, ImageMagick, vips, LibreOffice, Apache Tika) being placed into a command line and run through a shell, which let a superuser reach the underlying shell through those settings. Every external program is now started with its arguments passed one by one, without a shell, so nothing in a path or an argument can be read as a command. (We thank the security researcher Valentin Lobstein (Chocapikk) for the responsible disclosure.)
  • (BREAKING) The FFmpeg "Additional command arguments" setting has been removed, because a free-form argument string can only reach a program through a command line. Installs that used it set the arguments in customizables/config.php instead, for example $config['system']['external_programs']['arguments']['ffmpeg'] = ['-hwaccel', 'auto']; — one array element per argument. The same setting works for any external program, keyed by its binary path, its file name, or the file name without the extension.
  • Extra options written into $config['system']['java_path'] (such as java -Xmx1g) no longer take effect, since the value is now the program itself rather than the start of a command line. Move them to $config['system']['external_programs']['arguments']['java'].
• Fixed a security vulnerability in the photo proof sheet tool. Until the update is applied, the issue can be mitigated by hiding the plugin from the control panel. (We thank the security researcher Valentin Lobstein (Chocapikk) for the responsible disclosure.)
• Hardened the role editing page in the admin panel against an unsafe deserialization of its stored role permission settings.
• Fixed a database injection vulnerability on the role editing page, reachable through a crafted role setting by an administrator allowed to manage user roles.
• Fixed the creation of metadata field sets in the admin panel not being protected against CSRF.
• Fixed independent admin users being able to edit and delete e-mail notification rules belonging to other administrators by requesting them by ID.
• Fixed the activity history of a folder showing regular users entries which should have been kept from them: entries of accounts outside the list the activity log is limited to, comment and tag entries (including their contents) they have no permission to read, and entries from before the moment the folder was shared with them.
• Fixed folder names being used unescaped in database searches, where the "%" and "_" characters act as wildcards. A folder carrying either character therefore also matched the folders next to it whose names differ only at those positions — deleting "Project_2024" matched "Project 2024" as well, and removed its share records, links, folder notification subscriptions, metadata values and file activity history, including those belonging to other users. Folder renames, folder searches and the folder activity list reached too far in the same way. Folder names are now escaped before they are used in a database search.
• Fixed an administrator limited to particular groups being able to read the activity log of any user by filtering the log by that user, when the administrator's groups had no members or the administrator was limited to no group at all.
• Fixed the storage usage tool in the admin control panel letting any administrator read the storage usage of any user account by requesting it by ID; the request is now limited to the accounts the administrator is allowed to see in the list.
• Fixed a username containing special characters being able to match, during LDAP/AD sign-in, a different directory record than the one typed.
• Fixed an access control issue which gave regular administrator accounts access to an area reserved for the superuser, where a sensitive credential was disclosed and an SQL injection was possible. Exploiting it required a signed-in administrator account. The details are withheld for now, to give installations time to update. (We thank the security researcher Valentin Lobstein (Chocapikk) for the responsible disclosure.)
• Fixed several parts of the file manager interface rendering names and other server-provided text without HTML escaping, so that a crafted name could run script in the browser of another user who viewed it. All of these values are now escaped.
• The web interface now HTML-escapes dialog messages, notifications and window titles by default, closing script injection (XSS) paths through file names and other user-provided content shown inside server messages, window titles and upload status text.
• Fixed an access control issue on installations running on a case-insensitive filesystem (Windows, macOS), where the access rules protecting a folder could fail to apply, so its contents could be reached without the intended permission.
• Fixed a security issue where, under some web server configurations, server-side maintenance scripts intended to run only from the command line could be reached over the web. These scripts now refuse to run unless started from the command line, and the installation ships web-server rules that deny web access to the folder holding them.

User account security improvements🔗

• Added support for using e-mailed codes as a second verification factor. This method is now used by default to protect security changes. This makes it so that the only accounts left without multifactor authentication are accounts without even an e-mail address. (We are considering making it impossible to have accounts without e-mail addresses.)
• When "Require user to use two-step verification" is enabled for a user account, that account will be forced to configure a second verification method. The user can choose between Passkeys and Authenticator app.
• Removed the options for enforcing password composition rules (uppercase/lowercase, letters/digits and special characters), as per the OWASP recommendations.
• Resetting an account's password no longer resets the two-factor authentication, to keep two-factor authentication as a last line of defense in case a user's e-mail address is compromised.
• Making changes that affect account security in any way is now protected with the strongest configured verification method (Passkeys > Authenticator app > E-mail code > password).
• Admins can now force individual user accounts to use a second verification factor, and the users cannot disable that.
• Added a control panel option for setting the admin contact information. If set, this information is presented to the users in case they need assistance.
• Added support for using passkeys (WebAuthn, FIDO2) as a second-factor verification method. Users can verify their identities using their fingerprints, faces, device PINs or USB keys. It is faster and more secure than using temporary codes from authenticator apps.
• Added an option to allow users to protect their accounts with two-factor authentication even when third-party authentication is enabled. This also works with SSO — the users will be asked for the second factor after the remote sign-in.
• Removed the control panel option "Allow users to change their passwords". You can still prevent individual accounts from making changes to their authentication settings.
• (BREAKING) Accounts that do not use a second authentication factor can no longer access WebDAV using their passwords. Access should instead be done with credentials generated via "Connect app".
• Added support for one-time authentication recovery codes, to be used when the user loses access to their passkeys and/or authenticator app.
• Added a profile settings section called Sessions, where the user can see and revoke authenticated sessions.
• The "Require user to change the password" option is now enforced every time the user loads the main interface, not just at login time.
• The password policy rules are now also applied when creating or updating user accounts as an admin.
• Added a command-line tool (cron/reset_superuser_2fa.php) for resetting the superuser's two-step authentication, allowing the user to log in by using only the password.
• Added an API method for the superuser to generate app passwords for any user.
• The app passwords, the sessions and the connected apps of a user account are now automatically revoked when the account is given administrative permissions. The revocation covers each way an account can become an administrator, and an account which was an administrator already keeps everything it holds. What the account was given while it was an ordinary one would otherwise go on working with administrative permissions behind it: the account is read afresh on every request, so an access token issued before the promotion acted with the permissions the account had just been given - which is exactly what refusing to create app passwords for administrator accounts is there to prevent.

E-mail address changes🔗

• It can now be done only by validating ownership of the new address with a code.
• It is now done securely, by verifying the user's identity with the configured multifactor verification. Successful and failed attempts are now logged.

Password reset🔗

• The password reset function is now protected by the enabled multifactor verification methods.
• It allows the user to set a new password directly, skipping the step where a random temporary one is sent via e-mail.
• The password reset function now emails codes instead of a link. The codes are valid for only 10 minutes. A new reset request cannot be sent until the previous one expires.
• Resetting the account password now clears all existing authenticated sessions and also deletes OAuth2 grants and "Connect app" credentials.
• Resetting the superuser account password from the command line now clears the existing authenticated sessions. OAuth2 grants and "Connect app" credentials are not affected, but the admin should consider resetting them if the superuser account was compromised.
• The password recovery process now clears all user sessions, revokes all OAuth2 grants and deletes all credentials created via "Connect app".
• The command-line tool that resets the superuser password no longer records the new password in the activity log; the entry now states only that the password was reset from the command line.

OAuth2 changes and improvements🔗

• (BREAKING) API and WebDAV access can no longer be done using a user account's main username and password. Access is now possible only with app passwords, generated using the "Connect app" function.
• The two built-in API/OAuth2 clients (Desktop0000000000000000000Apps, Generic0000000000000000000WebDAV) are gone — apps no longer use OAuth2 at all.
• Existing connections keep working. Previously issued WebDAV, desktop-app and mobile credentials are carried over automatically during the update — your users won't need to reconnect their devices.
• Third-party integrations, however, will need to be authorized again (the users will need to use the "Connect app" feature and configure the third-party app with that).
• Each app password can be named, so you'll always know which entry belongs to your laptop, your phone, or that backup tool you set up last year.
• Tamper-proof access tokens. The keys apps use to access your files are now cryptographically signed, so they cannot be forged or altered, and sensitive codes are stored encrypted. API tokens are now standard signed JWTs (roughly 1 KB — ensure your proxy allows typical Authorization header sizes).
• Protection against interception attacks. Connections from apps that can't keep a secret (like mobile apps) now require PKCE, an industry-standard safeguard that prevents a stolen authorization code from being usable by anyone else — including protection against attempts to sneak around it.
• Public vs. confidential apps. When registering an OAuth2 app in the control panel, you can now mark it as public (e.g., a mobile app that can't store a secret); such apps are then required to use the PKCE safeguard.
• The OAuth2 password grant no longer issues refresh tokens — simply repeat the exchange when the token expires.
• The token info endpoint's client_id field now returns the client's string identifier rather than an internal number.

Authentication🔗

• The third-party authentication option "Sync passwords to the local database" has been removed.
• The passwords that FileRun generates are now created in a cryptographically secure fashion.
• The Microsoft Azure OAuth2 setup page now shows the redirect URL with the "!" percent-encoded as "%21", to help avoid a URL validation failure on the Azure configuration page.
• For security reasons, app password creation via the API is no longer permitted for any account type.
• (BREAKING) The WordPress authentication plugin has been removed. Installs which were using it fall back to the built-in authentication; WordPress can still be connected through the OpenID Connect plugin or OAuth2, using a WordPress provider plugin.
• Fixed the OAuth2 error "Cannot modify header information - headers already sent" when the Enable debugging option is checked.
• Fixed the superuser being able to log in to FileRun with the local password when the authentication plugin fails.
• Fixed the LDAP/AD user import failing to run, and stopping at the first already-existing account.
• Fixed LDAP/AD group names and user records containing special characters (such as a comma or parenthesis) being handled incorrectly during sign-in and user import, which caused affected users to be missed.

Software update🔗

• New: the installation package and the update package are now one and the same zip file: the file downloaded for a fresh installation is also the file the control panel's "Offline update" takes, and the online update downloads that same file.
• New: a software update now replaces every application file, not only the ones that changed since the previous version, so re-applying an update also repairs an application file that was damaged or modified. A file added inside one of the shipped application folders (apps/Core, apps/Drive, apps/Autodesk, apps/Example) is removed together with the folder it was in, and kept in the update's backup folder; anything added in the web root, in an application folder of your own under apps/, or under system/ is left alone, as before.
• New: the software updater keeps every file and folder it replaces or removes in a backup folder (system/data/temp/_backup <version> (<date>)), and when the update fails partway it puts them all back, so the installation returns to the version it had instead of being left half updated. The backup of the previous update is removed when a new one starts.
• Security fix: the short interval during a software update, between replacing the application files and running the database step that completes it, was not protected against access from outside. It is now sealed with a one-time update key: an update started from the control panel gives the key to the browser that started it, so the procedure does not change there; an update applied by other means (copying the files by hand, a new container image, or the control panel of an older FileRun release) creates the file system/data/temp/update.key automatically, and the administrator reads the key from it on the server and types it in the browser. Until the update is completed, every page shows the update page.
• New: cron/db_update.php runs the current version's database migrations again from the command line, to repair the database structure of an installation that is already up to date.
• New: the control panel's Software update page has a "Repair database" button, which runs the current version's database migrations again, the same as cron/db_update.php does from the command line.
• Fix: the software updater could leave the installation broken when a file inside an application folder could not be removed (for example, in a folder owned by a different system user): it deleted the old folder before copying the new one, its permission check looked only at the top folders, and it deleted the downloaded update package even after a failure. The check now covers every folder inside the updated and removed items and refuses before anything is changed; each folder is replaced by copying the new version next to the old one and swapping the two, so the installation is either the old version or the new one at any moment; a failed update keeps the downloaded package, so it can be run again after the problem is fixed; a closed browser tab no longer stops a running update.
• Fix: on Windows, when the software updater fails replacing a file via rename/move with "Access is denied" it now overcomes this by updating the file contents in place.
• Fix: uploading an update package through the control panel ("Offline update") never completed when the package was larger than the upload chunk size: the last chunk was written, but the upload kept reporting the position reached by the chunk before it.
• Fix: the installer checked whether the typed database name exists by searching for it as a pattern, so a name containing "_" or "%" also matched other databases. Installing into a new database named, for example, "my_db" failed with an unclear error while a database named "myXdb" existed on the server.

Performance🔗

• WebDAV performance optimizations for handling even more requests per second.
• Optimized the translation system to minimize the performance impact on the application.

Added a folder-size cache🔗

• Uploads are now much faster for user accounts with a storage quota set.
• Folder sizes, when they have been calculated, are now shown in the file list, the mobile apps and WebDAV clients. They are shown for all users, not only for those that have a quota set.
• Storage quota usage calculation is now instant in most cases.
• A command-line tool for cache warming is included.

Storage space calculation and quotas🔗

• New: for accounts with a space quota, the storage usage now shows as a panel at the bottom of the folder tree — a usage bar with the used percentage, and the used and total space — replacing the "Storage usage" button of the corner menu.
• (BREAKING) The storage quota system no longer takes old file versions into account.
• The storage quota system no longer takes the thumbnail and preview cache into account.
• Fix: The storage quota system now also takes into account the user's trash folder, when FileRun is configured to store the trash outside the user's home folder.
• Fix: When user A shares a home folder with user B, and user B has files inside their trash folder, those files no longer count towards user A's storage usage quota.
• Fixed enforcement of the storage quota when zipping files inside the home folder.
• Fixed the calculation and enforcement of the storage quota usage when updating a file whose current version is to be added to versioning.
• Fixed the trash storage space usage scanning to report failures to read trashed files instead of silently counting them as empty.

User accounts, groups and roles🔗

User accounts🔗

• Fixed a refused attempt to create a user account leaving its home folder behind on disk. The folder was created before the details of the account were validated.
• Fixed a user account being created without the groups it was meant to be in, whenever one of them no longer existed. The account is refused now, and the reason given.
• Fixed a user account created with its credentials e-mailed answering with an error and nothing else when the mail could not be sent. The account had been created, and the activity log recorded it as created with nothing wrong.
• When creating user accounts, errors that are encountered after the account was created are now reported to the admin and the full details are saved to the activity log entry. Example failures: a group the account could not be put into, the e-mail with its sign-in details that could not be sent, app passwords a promotion could not revoke.
• Fix: an account owned by an independent administrator and created with a role that has no home folder template path, the Guest role included, was stored with the administrator's own home folder as its home folder. The same happened to an account the administrator created without a role and with the home folder field left empty. Such accounts now get no home folder, as they do when they have no owner. Accounts created before this fix keep the home folder they were stored with.

Groups🔗

• Fixed an account being left out without a word when adding it to several groups at once, or when adding several accounts to a group. Each one that could not be added is now named, with the reason.
• Fixed an administrator who is allowed to manage only specific user groups being able to create new groups. Creating groups is now limited to the superuser, to independent administrators, and to administrators allowed to manage all groups.
• Fixed a user account being added to a group belonging to a different administrator, whenever the group was named rather than chosen and two administrators had each named a group the same. This affects the API endpoints for creating a user account and for changing the groups of one, the CSV user import and the group synchronisation of an external directory.
• Fixed an independent administrator never being told that a group they were creating carries the name of one they already have.
• Fixed the CSV user import creating a group with an empty name for each empty entry in the group column, which a trailing separator or an empty cell produces.
• Fixed a group name carrying spaces around it creating a second group beside the one it already names, everywhere a name is turned into a group: the user API endpoints, the CSV import, and the group sync of an external directory.

Roles🔗

• Fixed a role created by an independent administrator losing its owner when the superuser saved that role, which took the role away from the administrator who created it.
• Fixed the home folders of user accounts created by an administrator being recalculated every time their role was saved, instead of only when the home folder template path changed.
• Fixed the amount of storage space an independent administrator could assign when creating or editing a role. User accounts without a role were not counted towards the total already assigned, so more space could be handed out than the administrator's own limit allowed.
• Fixed the requirement to select at least one group under "Can manage" not being enforced for roles. A role could be granted the permission to create user accounts or to manage roles without any group selected, and such a role was then treated as if groups had been selected. Roles already saved in this state are corrected during the update.
• Fixed three validation messages shown when saving a role always appearing in English instead of the selected language.
• Fixed an administrator other than the superuser clearing a role's administrative settings whenever a change was saved to that role. Renaming a role, or changing one of its permissions, also removed the setting stating what type of administrator the role makes, the groups it may manage and its home folder template path. These are settings only the superuser can assign, and they are now left as they are.
• Fixed the home folder path of a role being cleared whenever the role was saved by an administrator who has a home folder template path set for their own account. Such an administrator cannot set home folder paths, so the path submitted is now ignored instead of the one the role already has being emptied.
• Fixed an independent administrator never being told that a role they were creating or renaming carries the name of one they already have.
• Fixed an administrator being refused the name of a role owned by an independent administrator.

Sharing and guest accounts🔗

Shares and share links🔗

• New: the "Copy link" button of the sharing window has a menu with the ways of copying the link — "Copy link to preview", "Copy link to open in browser" and "Copy link to download" — which copy a URL that opens the shared file in the FileRun preview, opens its contents directly in the browser, or downloads it, and the "QR Code" of the link. The download option is also offered for a folder, whose link then downloads a zip archive. These options used to be in the link's role menu, for one file at a time. With several items, the copy options apply to all their links at once.
• New: the sharing dialog now shows which recipients are guest users.
• Fix: the sharing window described every role as for a regular account, so a guest could be given the Editor role, described as "Can edit existing files", although guest accounts cannot change files. With a guest among the recipients, the role menu now describes the roles from the Guest role's permissions and offers only the roles that differ for a guest: Viewer, Commenter when the Guest role may read comments or metadata, and Uploader for folders.
• Fixed a refused download blaming the owner of the file, when what stood in the way was in fact the account the server gives its visitors, or the account of the user who shared the link.
• Fixed a download limit being accepted on a link when created via API.
• Fixed the "Sharing / With users" section refusing to open at all for a user whose shared folder had been moved out of their home folder by somebody else. A user's home folder can sit inside another user's home folder, which lets the second user move anything of the first one anywhere. A share remembers where the item is, so such a move left it pointing outside the home folder of the user who shared it, and that user could no longer see any of the folders and files they had shared - one stranded share hid all the others. A share is now removed when the move takes the item out of the home folder it was shared from, and the removal is written to the activity log under the "System" account, naming the item, who had shared it, who was receiving it and why it was removed.
• Fixed: A share record naming a user account or a group that no longer exists jammed the sharing information of the item: a deleted group stopped the share dialog from loading it at all, and a deleted user account showed as a nameless entry that could not be removed. Such a record can never work again, so the daily cleanup now removes these on its own, and the share dialog leaves them out.

Guest accounts🔗

• New: guest user access via links can now be disabled separately (Control panel » Users » Settings » Guest access » "Enable guest user access via links"); with it off, guests sign in only with their usernames and passwords, and share e-mails hand them regular links. Disabling "Enable guest user accounts" now disables guest accounts entirely, on every channel — previously it only stopped the links and the creation of new guests. The guest retention cleanup keeps running while guest accounts are disabled.
• New: "Enable the invitation of new guest users" (Control panel » Users » Settings » Guest access) turns off the creation of new guest accounts through sharing for everybody, whatever the individual user permissions allow. The guest accounts which already exist keep working, and administrators can still create guest accounts from the users list.
• New: all the guest user settings now sit on their own control panel page, "Guest access", under "Users" » "Settings". They were previously spread between "Security" and "Options".
• New: when editing a user account, choosing the Guest role shows a warning that guest accounts without access to any share get automatically deleted.
• Guest accounts are no longer covered by the general inactive-account deactivation and deletion settings; the guest account retention setting is the only automatic cleanup that applies to them.
• Fixed: Shares received through groups did not count when deciding whether a guest account still has a reason to exist. A guest whose only remaining access came through a group was told at sign-in that nothing is shared with them anymore, and the account was closed on the spot. In the other direction, a guest account whose last share went away with a group was left behind for good: removing the guest from the group, deleting the group, or unsharing the item from the group closed nothing. Group shares now count everywhere the life of a guest account is decided, and each of those removals closes a guest account that is left with nothing shared.
• Fixed: Sharing files with a guest user sent two e-mails — one when the guest account was created, one about the share — and the link in the share message did not work for the guest: it led to a sign-in form, and a guest is never given a password. A guest now receives a single e-mail per shared item, and its link signs them in and opens the item. Because this e-mail is the only way a guest can learn about the share, it is sent even when "Notify people" is not checked; an existing guest shared with while the checkbox was cleared used to receive nothing at all. A guest who receives a share through a group also gets their own message with their own working link now, instead of being included in the message the rest of the group shares.

User visibility and user search🔗

• Fixed: Accounts limited by the "Users this user may see" permission could see more than configured: when the visible selection included a group with no members, the user pickers and the share dialog's user search listed every user account; and when the selection named only users, the share dialog's search offered every group.
• Fixed: The user search — the API endpoint and the pickers alike — no longer lists the internal system accounts (the anonymous visitor account) as if they were regular users.
• Fixed: The admin user search answered with an internal error when an account's visibility selection resolved to nobody; it now answers with an empty list.
• Fixed: An account whose "Users this user may see" selection resolved to nobody was shown the activity of every user — the restriction was applied only when the list of visible users had somebody in it. Such an account now sees only its own actions in the activity listings, and no count of new events from others.
• Fixed: Recent, Starred, locating an item and the activity entries resolved items inside received shares without checking that the receiver and the sharer may see each other, and so produced entries that answered with a refusal when opened. Shares between accounts that may not see each other are now skipped there, the same way opening the share directly refuses them.

Activity log and notifications🔗

• New: a "System" user account, beside the "Visitor" one. Changes the software makes on its own are now recorded in the activity log under it, instead of being filed under whoever happened to set them off. Nothing can sign in as this account, it cannot be edited, deactivated or deleted. It is listed in the control panel so that its activity can be looked up, and it can be named in the notification rules.
• New: account deactivations caused by a passed expiration date are now recorded in the activity log.
• New: the automatic deactivation of inactive user accounts is now recorded in the activity log — filed under the System account, with a mark in the affected account's own activity history. The inactive-accounts CLI tool records its deactivations the same way.
• New: automatic account deletions are now filed under the System account in the activity log instead of the superuser.
• The actions of adding/editing/deleting a group are now added to the activity logs, together with their failed counterparts.
• The failed actions of editing/deleting a role are now added to the activity logs.
• Adding/removing users to/from groups is now logged to the activity logs.
• Fixed a failed attempt to remove a tag being written to the activity log under the internal code name of the action instead of a readable description. The same action was also missing from the list an administrator picks from when choosing what to be notified about.
• Fixed the activity log naming the wrong sharing role in the reason recorded when a guest account was refused a download. The role written down was always "content manager", whichever one the share actually carried.
• Fixed every other user account sharing a home folder being told when one of them downloaded, previewed or permanently deleted a file from their own trash. The trash of an account is stored inside its home folder, so an item placed there was treated as sitting in a folder the other accounts hold: its name reached them in their activity log, and a download reached them by e-mail as well. What one account puts in its trash is now its own. Moving an item to the trash and putting one back are unaffected, both happening in a folder the others do see.
• Fixed the activity log entry a user receives about a file moved by somebody else naming where the file went by the path of whoever moved it, instead of the path the receiving user has to that place. A destination outside the receiving user's home folder was shown all the same, although there is no path to it from there; it is now left out. Where such a path was rewritten, a home folder path containing characters outside the English alphabet also left a fragment of the folder's own location in it.
• Fix: saving an e-mail notification rule with no action selected reported an internal error instead of the proper validation message.

Files and folders🔗

• Browsing a folder and moving items are faster: the same permission checks were being answered twice for every item.
• Fixed a rename which changes only the letter case of a name destroying a file or a folder, in the web interface and over WebDAV alike. The check deciding whether the new name was free compared it with the old one without regard to case, and so could not tell the item itself, spelled differently, from a different item carrying that spelling. On storage which tells two spellings apart, as a Linux server does, one folder can hold both "report.txt" and "REPORT.TXT": renaming the first onto the name of the second wrote over the second, and what it held was gone. On storage which answers to a name written in any case, as a Windows or a macOS server does, the same blind spot cost the item itself over WebDAV, which performs a rename by naming the destination. A destination already taken is moved to the trash before the item is sent there, such a storage reported the item itself as being at that destination, and so the item being renamed was the one moved to the trash - the rename then failed, with the item gone from the folder it was in. The new name is now looked for among the entries the folder actually holds, spelled exactly as it was given, so a change of case goes through only when nothing else carries it.
• Fixed the tools which place their result next to the file they work on - splitting a PDF, merging several PDFs, the photo proof sheet, converting a file, opening one with the Google Docs editor - refusing to run on any file opened from a collection or from a photo album, and asking the user to copy the file to another folder and try again there.
• Fix: a move, or a deletion to the trash, which the filesystem refused for a reason other than the item being on another disk (for example a permission error) was reported as successful while the item stayed where it was. Such a failure is now reported.
• Fix: creating a new file from a plugin's entry in the "New" menu, with a name already used in the folder, only reported the error; the file name prompt now reopens so a different name can be typed.
• New: file names that end with a dot or a space can now be allowed with two settings under Control panel » Files » Settings » Advanced. They replace the $config['app']['allow_filenames_dot_space'] configuration option; an installation that had the option set gets both settings enabled by the update.

File locking🔗

• Fixed comments being added to and removed from a file that another user had locked. A lock stops every other change made to a file, but the check was never reached for comments.
• Fixed the owner of a file being unable to lock it while another user held the lock, unless the owner was also an administrator. Taking a lock over required being the owner and an administrator, where removing one required being only one of the two - so the same file could be unlocked and locked again in two steps, which is what the rule was meant to allow in one.

Trash🔗

• Fixed a file/folder being moved out of the trash folder by API, which left its trash record behind naming something that was no longer there. The record then showed in the trash listing an item that could not be put back, and emptying the trash was what finally cleared it. The way out of the trash is the restoration, which puts the item where it was deleted from and removes the record, so a move naming a trash item is now refused.
• Browsing the trash no longer deletes the database records of items whose files are missing; the scheduled cleanup tasks handle those.

3D files🔗

• New: colorful thumbnails for colorful STL files.
• Thumbnails for STL files are now generated by FileRun with no external requirement other than the PHP GD library.
• The 3D viewer now looks at a model from the same angle its thumbnail is drawn from: from the right, the front, and above.
• Fixed the 3D viewer showing STL models lying on their side.
• Fixed the 3D viewer showing a colorful STL file in the wrong colors.
• Fix: in Safari, the 3D viewer showed the model only in fullscreen; outside fullscreen the preview stayed blank.

Audio player🔗

• New: the audio player is a floating window that can be moved and minimized, instead of a bar fixed under the file list. It is loaded only when an audio file is opened. "Next" and "Previous" skip to the nearest audio file instead of stopping at the first file of another type, and a playback the browser blocks is reported instead of ignored.
• Fix: in Safari, the first double-click on an audio file now starts the playback; before, it only opened the player, and the playback started with the second double-click.
• Fix: previewing an old version of an audio file from the versions list now plays that version.

Search🔗

• New: the search box accepts wildcards: "*" stands for any number of characters and "?" for exactly one, so "report*" finds the names starting with "report" and "*.pdf" those ending in ".pdf". A keyword without a wildcard is still looked for anywhere inside the name, and a keyword between quotes is searched for exactly as typed.
• New: the search panel explains the search syntax. The information button next to "File or folder name" lists the wildcards, the way a plain keyword is matched, and the quoting which searches for a name exactly as typed.
• Fix: searching for a name containing "_" also found the names carrying any other character in that position ("report_2024" also found "report 2024"), and a "%" was silently removed from what was typed, which made files carrying it impossible to find by it. Both characters are now searched for as they were typed.
• Fix: the "Metadata search mode" setting (Control panel » Files » Searching) had no effect; metadata searches always used "Broad match".
• Fix: the search indexing queue worker (cron/process_search_index_queue.php) died on the first queued action Elasticsearch refused, and left its lock file in place for three hours. A failed action is now logged and the queue continues, and the lock is released whatever happens.
• Fix: removing a folder did not remove the documents of its files from the search index on Elasticsearch 8 and newer, whose bulk API refuses the _type parameter the request carried.

Theme customization🔗

• New: "Navy", "Sky blue", "Indigo", "Orange", "Yellow", "Lime", "Cyan", "Pink" and "Mint" color presets in the theme customization page of the control panel.
• New: a documentation page on personalizing the theme colors (https://docs.filerun.com/theme_colors): what each color of the Customize page controls, and a prompt for getting a complete light and dark color scheme from an AI assistant, ready to type into the control panel.
• New: a "Shadows" setting on the theme customization page (Interface » Theme » Customize): None, Soft, Normal or Strong, applied to the shadows of menus, dialog windows, tooltips, cards and floating panels, in both modes. A flat, shadowless look no longer needs a CSS override.
• New: an "Elevated surface" color on the theme customization page: the background of drop-down menus and floating panels. In dark mode it is a lighter grey than the page by default; a tinted color scheme can now tint these surfaces too.
• New: the theme customization page has a separate "Primary text" color for the text and icons drawn in the primary color — links, the selected tab, the icons and checkboxes in lists, secondary buttons — so a bright button color can be paired with a legible text color. It follows the primary color until it is set.
• New: the theme customization page also has a "Links" color, separate from the primary text color, so links stay distinguishable on color schemes whose text color is close to the body text. It follows the primary text color until it is set.
• Fix: the avatar generated for the superuser account (the initials on the theme's primary color) always drew the initials in white; on color schemes whose primary color carries dark text they were unreadable. The initials now use the theme's "on primary" color.
• Fix: setting a shape size of 0 on the theme Customize page, for square corners, had no effect; the default corner radius was applied instead.
• Fix: the "Black and white" color preset gave links the same color as the text around them. The preset now sets the standard browser link colors (blue in light mode, light blue in dark mode); apply the preset again on the Customize page to pick up the change.

Web interface🔗

• New: the file list scrolls automatically while a selection rectangle is dragged to its edge, the same way it does while dragging a file.
• New: in the thumbnail views the up and down arrows now move to the item above or below, and the left and right arrows to the neighbouring item.
• New: an "Appearance" entry in the file list's Options menu, for choosing between dark mode, light mode and following the device setting ("Auto"). The choice is saved in the browser and applies to the whole interface. It shows when the control panel's dark mode setting is "Let browsers decide".
• The "Forget link" context menu option has been moved under "Organize".
• Fixed the file plugin option "Hide option for creating new files" never being shown, and having no effect when it was.
• Fixed the file plugin option "Open in a new browser tab" having no effect. The setting was saved but never read.
• Fixed the "Inactivity timeout" setting having no effect. A signed-in user was never signed out, however long they had been away.
• Fix: shift-click in the file list now selects by the displayed order.
• Fix: the selection rectangle dragged over the file list was drawn in a fixed grey, which did not match customized theme colors and was nearly invisible in dark mode; it now follows the theme's primary text color.
• Fix: in dark mode, pages no longer flash a white background while loading.
• Fix: files added to the upload panel were listed in reverse order, and the row highlighted at the start of the upload was not the one being uploaded.
• Fix: on pages that can scroll (such as the sign-in page on a small screen), menus and popup panels could open in the wrong place — at the top of the page, or clamped and flipped as if the visible area had not moved.
• Fix: on phones and tablets, a PDF file opened in the file viewer could not be read: iOS showed a picture of its first page which could not be scrolled, and Android showed an empty frame. On mobile devices the viewer now shows an "Open PDF document" button, which opens the file in a new browser tab where the browser displays it in full. A tap on the file opens the new tab directly; the "Preview" menu option, a link to the file and swiping to it inside the viewer show the button.
• Fix: the web interface no longer accumulates removed page elements in memory during long sessions.
• Fix: with the double-click action set to "Open in browser", double-clicking a video or audio file opened a browser tab that never finished loading. The double-click now opens the file the same way the "Open with" » "New tab" option does.
• Fix: in Safari, pasting a screenshot from the clipboard into a folder left the file manager on the "Collecting file information" message and uploaded nothing. A failure while reading pasted or dropped files now closes that message and reports the failure.

Admin control panel🔗

• New: the admin control panel has been reorganized.
• New: the file list settings (default layout, thumbnails in the detailed list, double-click action, pagination, dotfiles, tags shown) moved from "Interface" » "General" to "Files" » "Settings" » "File list"; the language settings are now on their own page, "Interface" » "Language".
• New: the control panel shows the superuser a notifications button, next to the panel's title, for a software update and for a license expiring within 30 days.
• The floating notice about an available software update no longer appears in the control panel, where the notifications button tells the superuser instead; the file manager keeps it.
• Fix: in the admin control panel lists, dragging a selection rectangle over the rows drew the rectangle but selected nothing.
• Fix: the search box of the groups, roles, metadata file types and metadata field sets lists did nothing for independent administrators, and for administrators whose access is limited to a role; the lists ignored the typed text.
• Fix: typing into the search box of the e-mail notification rules list reported an internal error for independent administrators.
• Fix: the share links list reported an internal error for administrators whose access is limited to particular groups.
• Fix: filtering the list of share links by folder also listed the links of folders whose names differ only where the chosen folder contains a "_" or a "%".
• Fix: the users list, the space quota tool and the activity log reported an internal error for administrators limited to groups which have no members.
• Fix: for administrators limited to particular groups, the users list left out every account created through the API; it also listed administrators whose admin rights come from a role, although administrator accounts are meant to be hidden from it.
• Fix: the metadata field management pages failed with an internal error for fields whose parent field set record no longer exists.
• Fix: adding a metadata file type without selecting any field set reported an internal error although the file type was created.
• Fix: the metadata field option "Hide fieldset name in column header" was removed from the control panel; it no longer had any effect.
• Fix: in the "Storage usage" list, sorting by the "Quota" and "Used" columns ordered the rows by the displayed text instead of the size. The red highlight of a "Used" value that reached the quota also never showed.
• Fix: the "Storage usage" list included the system, the visitor and the guest accounts, which hold no home folder.

Translations🔗

• Fixed many missing translations.

WebDAV🔗

• New: a WebDAV lock request naming a file that does not exist now creates the file, empty, and locks it, as the standard prescribes. This is how the Windows WebDAV client and Microsoft Office save a new document: the name is reserved with a lock first, the content written into it after, so saving a new file through a mapped drive failed at the first step.
• Fixed the reply to a WebDAV lock request not following the WebDAV standard.
• Fix: newer versions of the Nextcloud app refused every upload with "Storage quota is reached" (error 507): the app checks the available space before uploading, and because the server did not report it, the app treated the account as completely full. The server now reports the available space, including the special "unlimited" value the Nextcloud apps expect for accounts without a quota.
• Fix: the Nextcloud iOS app could not complete the sign-in. The app sends the sign-in flow's poll token in the URL rather than in the request body, and the server read the body alone, so every poll was refused while the browser reported success.

API🔗

The endpoints added and changed are listed on API changes in 2026.3.

New🔗

• New: user groups can be created, edited, deleted, searched by name, and fetched information about them over the API.
• New: user accounts can be added to and removed from groups over the API.
• New: roles can be created, edited, deleted and fetched information about them over the API.
• New: the comments written on a file or a folder can be listed, added and removed over the API.
• New: a "comments" scope, which the comments endpoints are authorized with. An authorization carrying every other scope does not reach them, so an application is granted the ability to write comments in the name of the user separately from the rest.
• New: a file can be locked and unlocked over the API, which until now only the web interface and WebDAV could do. Both answer for the "modify" scope.
• New: the tags of a file or a folder can be listed over the API. Adding tags was already possible, reading them back was not. Each tag is answered with its text, its colour and its id, the newest one first. It answers for the "metadata" scope.
• New: the tags of a file or a folder can be removed over the API. Each tag is named by the id of its record, the one the listing answers with, so nothing has to be spelled out the way it was written. Several can be removed in one request, and the answer says for each of them whether it was removed. A tag attached to some other item is not reachable through the path of this one. It answers for the "metadata" scope.
• New: deleting a file or a folder via the API answers with the path the item is reachable under while it is inside the trash. Until now the answer carried nothing pointing to it, and the only way to find it was to list the trash and match by name, which cannot tell apart two items deleted under the same name.
• New: an item can be restored from the trash over the API, which until now only the web interface could do. It is named by the path the deletion answered with, and the answer says where the item ended up: it goes back to the folder it was deleted from, or to the home folder when that folder is gone. An item whose original name has been taken in the meantime is not written over, and stays in the trash. It answers for the "delete" scope, the one that puts items there.
• New: the trash can be emptied over the API. It answers for the "delete" scope.
• New: a user account can be deactivated over the API, which until now required sending the whole account back through the editing endpoint. It answers for the "admin" scope.

Fixes🔗

• (Security) The "admin" scope is now refused to a user account that is not an administrator. Any account could be issued an access token carrying it - what stopped an administrative request was the permissions of the account, read afresh on every request, so the same token became an administrative one the moment the account was given administrative permissions. The whole request is now turned down, at the moment the token is issued, and an application asking for that scope is no longer offered for approval to an account that cannot grant it.
• Fixed the API rejecting requests to create an administrator user account. The "admin_type" parameter was validated against the wrong value, so no valid setting was accepted.
• Fixed the API refusing to create a role unless the request included a maximum upload size and a space quota. Both are optional and are now treated as no limit when left out.
• Fixed the API endpoint returning the details of a user account also including sensitive authentication fields that should never leave the server. Those fields are now excluded from the response.
• Fixed the API endpoint for creating user accounts ignoring the groups named in the request. (The new account was instead assigned to a group named after an internal database table, which the endpoint created the first time it ran.)
• Fixed the API endpoint for editing a user account failing when the request did not state whether the account is active. The setting is now left as it was.
• Fixed the API endpoint for editing a user account answering without any message when the account was saved.
• Fixed the API endpoint for changing the groups of a user account failing whenever one of the groups named in the request did not exist yet.
• Fixed the API endpoint for changing the groups of a user account not checking whether the administrator making the request is allowed to manage that account.
• Fixed the API endpoint for changing the groups of a user account creating a group with an empty name whenever the request carried one. The name is trimmed and an entry left with nothing is skipped, which is what the endpoint creating an account already did.
• Fixed the API endpoint for extracting zip archives reporting the missing parameter as "extractTo" instead of "target".
• Fixed the search by file contents answering with no results when the limit parameter was not sent.

Fixes🔗

• Fixed a bug preventing users from having folders/files named 'exe' when they were not allowed to upload/create '.exe' files. ("exe" is used here as an example file extension)
• When sharing files/folders with multiple recipients, a problem with one of the recipients no longer stops the whole process: the problematic recipient is skipped and the problem is reported.
• Fixed being able to remove disabled user accounts from shares.
• Fixed listing of deactivated user accounts when sharing files/folders.
• Fixed the incorrect listing of disabled user accounts under "@Shared" when accessed via WebDAV, mobile or desktop sync.
• Fixed a PHP warning: PHP Deprecated: FR\Core\Auth\OAuth2\Client\Tool\RequestFactory::getRequest(): Implicitly marking parameter $body as nullable is deprecated, the explicit nullable type must be used instead
• Fixed a PHP error when running cron/empty_trash.php with no username specified.
• Fixed a PHP error when trying to edit a role that can administer only a certain list of users (FR\Core\Users\UserGroups::getNameById(): Argument #1 ($id) must be of type int, string given, called in Core/!cpanel/users/roles/edit.php on line 81).
• Fixed the "Extract PDF pages" plugin.
• Fixed extracting metadata from certain QuickTime videos with GPS location.
• Fixed a bug preventing the display of users with shares in the file list when loading the user interface for the first time as a guest user.
• Fixed a PHP error when converting files with Zamzar (FR\Drive\Files\Actions\Write\CreateFile::setDataSource(): Argument #1 ($dataSource) must be of type FR\Drive\Files\DataSource\DataSource, null given, called in E:\web\filerun\Server\apps\Drive\!classes\Files\Actions\Write\CreateFile.php on line 56)
• Fixed file grid sorting, where empty column values would sort before high values instead of before low ones.
• Fixed a file grid sorting bug that prevented sorting by certain columns.
• Fixed email_notifications.php crashing with an unhandled error for "shared_folder_available" notifications: Undefined array key "users", called in apps/Core/!classes/Notifications/Collect.php on line 311.
• Better error handling when avatar image files are missing.
• Fix: some refusal messages reached the user empty, leaving only the generic failure headline — for example "The original share does not allow resharing!" when the receiver of a share without resharing rights tried to publish a link on it.
• Fix: deleting a folder left the metadata extraction queue holding an entry for every file that had been inside it. The scheduled task discards entries whose files are gone, so nothing was processed wrongly, but the queue kept growing between runs and the task spent its time on the dead entries.
• Fix: the contact sheet file plugin always passed ImageMagick the -limit and -auto-orient options, including to gm and magick, which it was written not to do: it tested the program name after the montage sub-command had already been appended to it, so the test never matched.
• Fix: an error response caused by a database error, or by an error from a library, could be sent with an invalid HTTP status code, such as 42 for a missing table. An error response now always carries a valid status code: the one the error defines when it is between 400 and 599, and 500 otherwise.

Other🔗

• Independent admin accounts can now be given a separate "Max guest users" limit, capping how many guest accounts they and their users can create independently of their regular user limit.
• The API endpoint /api.php/Core/!admin/users/info now allows the superuser to list all user accounts, and the result also includes the user IDs and usernames.
• The daily maintenance cron job now also cleans up database path records whose files no longer exist; a failing maintenance task no longer prevents the remaining tasks from running.
• The scheduled cron tasks (daily, every 5 minutes, every minute) are skipped while maintenance mode is enabled.
• New: cli.php, in the root of the installation, runs any command-line route, for example php cli.php 'Core/!cli/cron/daily'. Any further arguments are passed to the route's script, as with the scripts in the cron folder.
• New: the automatic check for software updates can be switched off under Control panel » System » Settings.
• Fix: the paths cleanup CLI command could skip records within a run while it was deleting others.

Under the hood🔗

• (BREAKING) Every database table is now named after the app it belongs to (fr_core_* for the core tables, fr_drive_* for the file management ones); the df_ tables are renamed by the update. Anything reading the database directly (reports, backup scripts, integrations) needs the new names, for example fr_core_users instead of df_users and fr_drive_shares instead of df_modules_shares.
• Rewritten the OAuth2 server from scratch for security, performance and readiness for OAuth2.1.
• Increased tests coverage for less regression bugs.