28.0.8 RC1

[Altahrim]

• [stable28] fix: don't return null for SharedStorage::getWrapperStorage with share recursion #44323
• [stable28] fix(settings): Use axios directly for health check to preven URL sanitizing #45770
• [stable28] Fix npm audit #45891
• [stable28] chore(deps): Bump deepdiver/zipstreamer #45896
• [stable28] fix(files): Properly handle denied ownership transfers #45905
• [stable28] delete background jobs by id when cleaning up #45920
• [stable28] fix(settings): define a 'heartbeat' route, so SecurityHeaders can handle redirected root #45955
• [stable28] Rename openFileInfo to fileInfo #45987
• [stable28] fix: avoid duplicate tag inserts by checking if the mapping exists already in db #45994
• [stable28] fix(caldav): encode calendar URIs with umlauts for activities #46011
• [stable28] Don't trigger action when renaming #46019
• [stable28] fix: Do not log an error when connecting to SFTP without a logged in user #46060
• [stable28] fix: don't use custom certificate bundle if no customer certificates are configured #46067
• [stable28] fix: allows admin to edit global credentials #46090
• [stable28] fix(files_versions): renaming file version when its not a string #46092
• [stable28] fix(FilesView): Update files view upon share creation/delete #46118
• [stable28] feat(files): increase max copy-move concurrency to 5 #46129
• [stable28] Update favorites navigation list on folder renames #46138
• [stable28] fix(files_sharing): Also set the expiration date timezone during validation #46141
• [stable28] fix(caldav): When message is a reply compare the message sender not the recipient #46145
• [stable28] fix(security): Update code signing revocation list #46155
• [stable28] fix(openapi): Regenerate OpenAPI after server changes #46164
• [stable28] fix(cron): Log long running jobs #46191
• [stable28] fix: getMountsForFileId may return an unordered list #46214
• [stable28] fix(DAV): offset not applied #46221
• [stable28] fix(setupchecks): skip check when disk_free_space is disabled #46223
• [stable28] chore: upgrade @nextcloud/files and @nextcloud/sharing #46236
• build(deps): Bump @nextcloud/calendar-availability-vue from 2.2.0 to 2.2.2 #46238
• [stable28] build(deps): Bump @nextcloud/vue from 8.11.2 to 8.14.0 #46239
• build(deps-dev): Bump karma-coverage from 2.2.0 to 2.2.1 #46241
• build(deps-dev): Bump @types/dockerode from 3.3.28 to 3.3.29 #46243
• build(deps-dev): Bump cypress from 13.7.2 to 13.7.3 #46245
• [stable28] fix(security): Update CA certificate bundle #46265
• [stable28] fix(ExternalSharing): Handle template shares from external sources #46280
• [stable28] fix(IntegrityCheck): Ensure the check is run if no results are available #46297
• [stable28] fix(SetupCheck): jsm test shall not give up with first no-response #46302
• [stable28] fix(carddav): limit vcard size #46313
• [stable28] sidebar: allow turning off tags view by default #46316
• chore(deps): bump dompurify from 3.1.4 to 3.1.6 #46335
• chore(deps-dev): bump jsdoc from 4.0.2 to 4.0.3 #46336
• chore(deps-dev): bump mime from 4.0.1 to 4.0.4 #46337
• chore(deps-dev): bump ts-jest from 29.1.2 to 29.1.5 #46338
• [stable28] chore(mp3info): apply upstream patch for invalid array access #46341
• [stable28] fix(SharingDetailsView): Prevent illegal unselection of read permissions #46364
• [stable28] fix(s3): Don't wait indefinitely for S3 to return #46366
• [stable28] perf: Set session.cache_limiter at runtime to avoid clients caching static assets served by PHP #46394
• [stable28] fix(workflows): Fix file systemtag cache #46411
• [stable28] fix(files_trashbin): Make files view registering an init script #46417
• [stable28] fix(caldav): limit vevent size #46421
• [stable28] fix: Update Nextcloud libraries #46422
• [stable28] test: run tests in child process #46430
• [stable28] fix(theming): Conitionally disable blur filter for performance #46431
• [stable28] fix(theming): Don't reset the cachebuster value when we reset theming #46433
• [stable28] fix(Session): avoid race conditions on clustered setups #46436
• [stable28] feat: don't count failed CSRF as failed login attempt #46442
• [stable28] chore(deps): Bump deepdiver/zipstreamer from 2.0.2 to 2.0.3 3rdparty#1865
• [stable28] chore: set version in composer.json 3rdparty#1892
• [stable28] chore(mp3info): apply upstream patch for invalid array access 3rdparty#1895
• [stable28] ignore empty fileIds circles#1624
• [stable28] Fix npm audit files_pdfviewer#984
• [stable28] Update nextcloud/ocp dependency firstrunwizard#1244
• [stable28] Fix npm audit firstrunwizard#1258
• [stable28] Update nextcloud/ocp dependency logreader#1253
• Chore(deps): Bump @nextcloud/files from 3.1.0 to 3.1.1 photos#2398
• [stable28] Fix npm audit photos#2464
• [stable28] Update nextcloud/ocp dependency photos#2473
• [stable28] Various fix from 30 photos#2518
• Chore(deps-dev): Bump postcss from 8.4.35 to 8.4.39 photos#2523
• [stable28] fix: avoid erroring out on corrupt image data photos#2529
• [stable28] fix(l10n): Translate "All Tags" string photos#2531
• [stable28] feat: Handle complex location type photos#2537
• [stable28] Fix npm audit privacy#1090
• [stable28] Update nextcloud/ocp dependency related_resources#437
• [stable28] Fix npm audit related_resources#439
• [stable28] Update nextcloud/ocp dependency serverinfo#624
• [stable28] fix: handle getNetInterfaces error serverinfo#632
• [stable28] fix: update wording about apps element in monitoring response serverinfo#634
• [stable28] chore: update workflows from templates survey_client#225
• [stable28] Update nextcloud/ocp dependency survey_client#292
• [stable28] Fix npm audit suspicious_login#886
• [stable28] fix(description): 5688 no need to encode filename text#5718
• [stable28] Update nextcloud/ocp dependency text#5911
• [stable28] Fix npm audit text#5914
• [stable28] perf: Reduce polling interval for read only users text#5935
• chore(deps): update cypress (stable28) text#5972
• [stable28] fix(attachments): Don't require document session for getting attachments text#5980
• [stable28] Revert "chore(deps): update cypress" text#5982
• [stable28] Request the native app to reload the direct editing view on 403 errors text#5984
• [stable28] Keep base version etag during reload text#5986
• [stable28] fix(ApiService): Catch NotPermittedException and return 404 text#6022
• [stable28] ci(test): use codecov token twofactor_totp#1536
• fix(deps): update dependency webdav to ^5.6.0 (stable28) viewer#2257
• [stable28] Fix npm audit viewer#2337
• [stable28] fix(requesttoken): Make sure to use the correct requesttoken in WebdavClient viewer#2343

[blizzz]

Required PRs

• [stable28] fix(Session): avoid race conditions on clustered setups #46436
• [stable28] feat: don't count failed CSRF as failed login attempt #46442

[susnux]

Would really appreciate:

• [stable28] fix: Update Nextcloud libraries #46422

Happy to have this to align stable29 and stable28 for fixes:

• [stable28] fix(theming): Conitionally disable blur filter for performance #46431