[renovate]

This PR contains the following updates:

Package	Update	Change
opencloudeu/opencloud-rolling	major	7.5.0 → 9.0.0

---

Release Notes

opencloud-eu/opencloud (opencloudeu/opencloud-rolling)

v9.0.0

Compare Source

❤️ Thanks to all contributors! ❤️

@​AlexAndBear, @​JammingBen, @​Svanvith, @​aduffeck, @​butonic, @​dragonchaser, @​fschade, @​maki5, @​micbar, @​rhafer, @​saw-jan, @​v-scharf

💥 Breaking changes

• Push based thumbnailer architecture [#​3397]
• feat(guestlinks)!: auth-guest service [#​3609]

🐛 Bug Fixes

• Skip extraction for directories before checking the size limit [#​3832]
• log errors when a personal space is deleted [#​3710]
• fix(cli): detect storage driver from storage path in revisions and trash commands [#​3776]
• fix(idp): show keyboard focus on every control [#​3732]
• fix: show the lilac logo on the login page [#​3773]
• fix(frontend): report content search only when full-text search is enabled [#​3760]
• fix: allow guests to list role definitions [#​3729]
• fix: nats checks were missing the configured auth [#​3724]
• fix(collaboration): answer a wopi lock in a read-only session with 200 instead of locking [#​3711]
• fix(collaboration): show the secure view watermark only for view-only tokens [#​3712]
• fix: add restart command output [#​3706]

📈 Enhancement

• feat: new mail notifications based on design system [#​3789]
• feat(search): configurable query filter, leaves the personal space root and .space out by default [#​3787]
• feat: expose the default project space quota in the capabilities [#​3719]
• feat(collaboration): close the CheckFileInfo gaps for the office apps [#​3730]
• fix(proxy): allow guest link auth for app open and new endpoints [#​3737]
• feat: make space2share migration repeatable [#​3669]
• feat: run the decomposed drivers on foreign metadata via metadata_prefix [#​3670]
• feat: add more cli options to unified roles [#​3658]
• feat(web): use the OpenCloud brand colors for the primary color role [#​3631]

✅ Tests

• ci: disable async uploads for litmus tests [#​3777]
• tests: add acceptance tests for renewing guest links [#​3753]
• tests: check that a guest can only access the shared resource [#​3752]
• tests: add acceptance tests for sharing with guests via email [#​3751]
• Bump reva and add some tests for new features [#​3715]
• api-test: check PROPFIND/REPORT has-preview [#​3714]
• test(api): simply HTTP request retry conditions [#​3696]
• test: retry acceptance requests while share manager is migrating [#​3681]
• api-test: extend search tests [#​3634]

📚 Documentation

• docs: update unified Roles [#​3738]
• fix(proxy): make metrics table MDX-compatible [#​3680]

📦️ Dependencies

• [full-ci] chore: bump web to v8.2.1 [#​3834]
• [full-ci] chore: bump web to v8.2.0 [#​3816]
• chore: bump reva to latest main [#​3720]
• chore: bump reva to latest main [#​3713]
• chore: bump reva to latest main [#​3700]
• chore: bump reva to latest main [#​3685]
• build(deps): bump github.com/onsi/ginkgo/v2 from 2.32.1 to 2.33.0 [#​3596]
• build(deps): bump github.com/open-policy-agent/opa from 1.19.1 to 1.21.1 [#​3599]

v8.1.0

Compare Source

❤️ Thanks to all contributors! ❤️

@​NickWalters, @​aduffeck, @​butonic, @​dschmidt, @​fschade, @​maki5, @​micbar, @​pascalwengerter, @​pbleser-oc, @​rhafer, @​saw-jan, @​schweigisito, @​v-scharf, @​zerox80

🔒 Security

• feat(proxy): add optional OIDC access token audience validation [#​3466]

🐛 Bug Fixes

• Reindex disabled spaces once they get enabled again [#​3579]
• fix(search): tika key fixes [#​3651]
• fix(search): keep trashed and live folders at the same path apart [#​3602]
• Fix/uploads cli no async consumer [#​3603]
• Remove the timeout when reindexing spaces [#​3543]
• fix(shares): not auto accepting shares created by guest users [#​3533]
• fix(graph): fix PatchMe method to prevent password change [#​3526]

📈 Enhancement

• feat: add new editor roles [#​3637]
• feat(collaboration): let admins disable wopi extensions [#​3633]
• fix(collaboration): send LastModifiedTime and the EuroOffice file size [#​3636]
• feat(collaboration): mobile web view for EuroOffice [#​3635]
• fix(collaboration): harden wopi token handling [#​3630]
• add posixfs index command [#​3068]
• feat(proxy): add per-service metrics to the proxy service [#​3521]

✅ Tests

• fix(search): ellipsize parity matrix labels by runes, not bytes [#​3643]
• fix(collaboration): mint the mobile view test token with the token manager secret [#​3647]
• run cli tests with decomposed nightly [#​3580]
• [decomposed] test(api): remove passing notification tests from expected failure [#​3555]
• api-test: add CLI test for reindexing all spaces including disabled [#​3560]

📚 Documentation

• [SKIP CI] fix: add file_read documentation to audit log docu [#​3503]

📦️ Dependencies

• [full-ci] chore: bump web to v8.1.0 [#​3656]
• chore: bump reva to latest main [#​3642]
• chore: bump libre-graph-api-go to v1.0.8 [#​3645]
• build(deps): bump github.com/nats-io/nats.go from 1.53.1 to 1.54.0 [#​3584]
• build(deps): bump github.com/onsi/gomega from 1.42.1 to 1.43.1 [#​3582]
• build(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 [#​3581]
• build(deps): bump github.com/beevik/etree from 1.7.1 to 1.8.0 [#​3583]
• build(deps): bump golang.org/x/image from 0.45.0 to 0.46.0 [#​3573]
• build(deps): bump github.com/nats-io/nats-server/v2 from 2.14.5 to 2.15.0 [#​3576]
• build(deps): bump golang.org/x/text from 0.41.0 to 0.42.0 [#​3552]
• build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 [#​3551]
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.70.0 to 0.71.0 [#​3427]
• build(deps): bump github.com/olekukonko/errors from 1.2.0 to 1.3.0 [#​3557]
• build(deps): bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 [#​3550]
• build(deps): bump github.com/shamaton/msgpack/v2 from 2.4.1 to 2.4.2 [#​3459]
• build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.45.0 to 1.46.0 [#​3428]
• build(deps): bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 [#​3492]

v8.0.1

Compare Source

❤️ Thanks to all contributors! ❤️

@​aduffeck, @​maki5, @​pascalwengerter, @​pbleser-oc, @​rhafer, @​zerox80

🔒 Security

• feat(proxy): add optional OIDC access token audience validation [#​3466]

🐛 Bug Fixes

• Remove the timeout when reindexing spaces [#​3543]
• fix(shares): not auto accepting shares created by guest users [#​3533]
• fix(graph): fix PatchMe method to prevent password change [#​3526]

📦️ Dependencies

• build(deps): bump github.com/shamaton/msgpack/v2 from 2.4.1 to 2.4.2 [#​3459]
• build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.45.0 to 1.46.0 [#​3428]
• build(deps): bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 [#​3492]

v8.0.0

Compare Source

❤️ Thanks to all contributors! ❤️

@​butonic, @​dschmidt, @​fredrikblau, @​fschade, @​maki5, @​pbleser-oc, @​rhafer, @​saw-jan, @​sigurdvaa, @​v-scharf, @​zerox80

💥 Breaking changes

• fix(search): hierarchy tokenizer for bleve path fields [#​3510]
• feat(search): check the index schema on startup and refuse breaking changes [#​3197]
• refactor: reflection-based search mapping + location geopoint [#​3345]
• fix(search): make openSearch and bleve behave the same [#​3408]

✅ Tests

• api-test: retry token refresh on transient IDP failures [#​3507]
• fix(test): removeAccessToSpace test helper [#​3511]
• api-tests: add search retry to all search tests [#​3500]
• test(search): fail the parity suite when the committed matrix is stale [#​3423]
• ci: run search API and e2e suites against OpenSearch [#​3379]
• test(search): engine parity suite for bleve and opensearch [#​3418]

📈 Enhancement

• add insecure to search reindex [#​3505]
• feat(graph): expand thumbnails on driveItems [#​3471]
• graph: expose lockInfo on driveItems [#​3444]
• graph: expose @​libre.graph.shareTypes on driveItems [#​3438]
• feat(search): live photo facet [#​3202]
• feat: support $expand=children on the driveItem endpoint [#​3445]
• feat(search): motion photo facet [#​3200]
• feat(search): video facet [#​3201]
• graph: expose pendingOperations on driveItems [#​3437]
• feat(search): extract more data from tika 4 (if available) [#​3198]
• graph: expose following state, tags and allowed actions on driveItems [#​3113]
• feat(search): scope searches to a drive via the driveId field [#​3424]
• chore(policies): disable gRPC or event handlers by configuration + add metrics [#​3287]
• moved ShareCreated event consumer from frontend to shared service [#​3389]

🐛 Bug Fixes

• fix(search): extract facets from the main tika document only [#​3484]
• fix(thumbnails): bound declared image dimensions before decoding [#​3457]
• test(search): re-search until the expected files are in the result [#​3488]
• fix(config): correct pending version annotations [#​3487]
• Activitylog event handler split [#​3241]
• test(search): wait for expected properties and documents [#​3486]
• fix: log jwt expired on debug level instead of error [#​3463]
• fix(proxy): restrict JWT signed urls to the allowed HTTP methods [#​3481]
• fix: notification handling for share removal and space membership expiry [#​3257]
• fix: posix cli commands [#​3348]

📦️ Dependencies

• [full-ci] chore: bump web to v8.0.0. set introduction version v.8.0.0 [#​3528]
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.70.0 to 0.71.0 [#​3441]
• build(deps): bump go.opentelemetry.io/contrib/zpages from 0.70.0 to 0.71.0 [#​3442]
• build(deps): bump go.opentelemetry.io/otel from 1.45.0 to 1.46.0 [#​3426]
• build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 [#​3429]
• build(deps): bump github.com/blevesearch/bleve/v2 from 2.6.0 to 2.6.1 [#​3417]
• build(deps): bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 [#​3409]
• build(deps): bump github.com/opensearch-project/opensearch-go/v4 from 4.6.0 to 4.7.3 [#​3216]
• build(deps): bump github.com/KimMachineGun/automemlimit from 0.7.5 to 1.0.0 [#​3404]
• build(deps): bump github.com/nats-io/nats.go from 1.52.0 to 1.53.1 [#​3403]
• build(deps): bump github.com/open-policy-agent/opa from 1.19.0 to 1.19.1 [#​3402]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Risk: MEDIUM-HIGH. Major jump 7.5.0 → 9.0.0, skipping two releases (8.0.x, 8.1.0). It is the self-hosted file store (NFS-backed, single pod with persistent data), so a failed migration affects stored data.

Breaking changes (from upstream CHANGELOG.md; the entries are titles only, so I couldn't read migration details):

• 8.0.0, search: the index schema is now checked on startup and breaking changes are refused (#3197). The search index lives on the NFS volume under /var/lib/opencloud. The pod may crash-loop until the index is removed and rebuilt. This is the most likely failure here.
• 8.0.0, web and thumbnails: web bumped to v8.0.0, plus thumbnail dimension bounds (#3457). Low impact.
• 9.0.0, push-based thumbnailer (#3397): architecture change. The changelog gives no env vars or migration steps. This repo runs everything in one process via opencloud server and sets no THUMBNAILS_* vars, so it should work with defaults, but I can't confirm that.
• 9.0.0, new auth-guest service (#3609, guest links): marked breaking (feat!). This repo sets no AUTH_GUEST_* or guest-related PROXY_* vars. It should start automatically in single-binary mode, but that is unverified.
• No renamed env vars found that affect this HelmRelease (IDM_*, OC_*, PROXY_TLS, OC_DECOMPOSEDFS_METADATA_BACKEND, NATS_NATS_STORE_DIR are not mentioned). I read only the first 100k of the 120k-character changelog, and the PR bodies (#3397, #3609) were not fetched.

Action needed:

1. Snapshot or back up the nfs-opencloud-storage-users-pvc and nfs-opencloud-data-pvc data before merging.
2. Read the PR descriptions for #3397 and #3609 in opencloud-eu/opencloud for required config.
3. After merge, watch the pod logs. If search fails the schema check, delete the search index directory and let it reindex.
4. Don't merge on green alone. CI doesn't show whether the app starts with the existing data.