LoginSign Up
← Back to all sparks
N

Nextcloud

COLLAB
Velocity6.3

Self-hosted cloud platform for file sync, collaboration, and communication with integrated video conferencing and office tools

nextcloud.com ↗

Nextcloud ships three patch lines in a day as 35.0.2 adds webhook metadata and a report API.

self-hostedfile-sharingsecurity-patcheswebhooksoffice-suite
◆Current state
Nextcloud released 35.0.2, 34.0.5 and 33.0.10 on the same day, a month after the 35.0.0 major that swapped OnlyOffice for Euro-Office and added FrankenPHP support. The backports share a security-flavored core: a CSRF token on the share-accept endpoint, upload checks against session and share tokens, and logs that no longer leak sensitive data. 35.0.2 also adds richer node-webhook metadata, webhook-compatible comment events and an API for system-report sections.
◆Where it's heading
The patch stream is still dominated by sharing permissions, resharer caps and encryption cache fixes, now applied across three supported branches at once. The small additions in 35.0.2, webhooks and the 'Unified Sharing Legacy Sync' groundwork, point to sharing being rebuilt under the hood and to more automation hooks for integrators. The 35 line is absorbing regressions from the major at a steady monthly pace.
◆Prediction
Expect a 35.0.3 within a month continuing sharing and encryption fixes, with more of the unified-sharing work surfacing; the entries do not say when that rework becomes user-visible.

◆Recent moves

  1. 14d ago

    Nextcloud 35.0.2: webhook metadata, sharing fixes, report API

    The second patch on the 35 line mixes sharing and encryption fixes with small integration additions: extra metadata on node webhooks, webhook-compatible comment events and an API for system-report sections. It also lays groundwork for a unified sharing sync, the clearest hint of where the sharing rework is heading.

  2. 14d ago

    Nextcloud 33.0.10: share CSRF fix and sharing backports

    The 33 line gets the same security and sharing backports as 34.0.5, including the share-accept CSRF fix and the encryption key-cache cap. Maintenance only, but it shows Nextcloud still patching three majors in parallel.

  3. 14d ago

    Nextcloud 34.0.5: share CSRF fix, log redaction, sharing backports

    A large backport bundle for the 34 line, led by a CSRF token on share acceptance, token-checked uploads and log redaction. It brings 34 in line with the sharing and encryption fixes already shipped on 35.

  4. 1mo ago

    Nextcloud 35.0.1: sharing fixes, encryption key-cache cap, sidebar API back

    The first 35.x patch fixes link shares lost on ownership transfer, caps and invalidates the encryption key cache, and restores the Files sidebar API that apps depend on. It is the expected post-major stabilization pass.

  5. 1mo ago

    Nextcloud 35: Euro-Office replaces OnlyOffice, FrankenPHP support

    ⚡ SPARK

    The 35.0.0 major breaks from the three-branch patch rhythm with new surface: Euro-Office in office-suite settings, a shared Office admin section, FrankenPHP, calendar import over OCS and workflow-engine runtime operations. Most of the changelog is still fixes, consistent with a hardening-heavy release.

  6. 1mo ago

    Nextcloud 32.0.15: share expiration time correction

    32.0.15 corrects a share expiration bug where the deadline was set to the wrong time of day (now 23:59:59). A small fix backported to the oldest active branch.