14.2.0 Group Folders, system tags, expanded share API & security hardening

Highlights

A large feature, security and hardening release on top of 14.1.6. Requires Java 11+.

New features

• Group Folders app (#109) — create, rename, delete and list group folders, grant/revoke group access, set group permissions and quota (GroupFolders).
• System tags (#110) — list, create and delete tags, and assign/remove tags on a file (SystemTags).
• Expanded Share API (#107) — federated/remote shares (list accepted & pending, get info, delete, accept/decline), (re)send the share notification email, new ShareType values CIRCLE and TALK, new ShareData attributes (NOTE, LABEL, ATTRIBUTES, SENDMAIL), and Share.getNote() / getLabel().
• Safe TLS trust — trustCertificate(X509Certificate) / trustCertificates(InputStream) to trust a specific self-signed or private-CA certificate while keeping chain and hostname verification enabled. WebDAV now honours the same trust configuration as the OCS calls (#125).

Security

• Hardened XML parsing against XXE (DTDs / external entities disabled).
• Basic-auth credentials are no longer embedded in the request URL.
• The shared HTTP client is cached per TLS/proxy configuration, so trustAllCertificates can no longer leak to a secure connector (also makes client creation thread-safe).
• Reject path separators in user/group identifiers to prevent URL/path injection.
• trustAllCertificates now logs a warning when it disables validation.

Bug fixes

• Connector lifecycle (#87) — closing one NextcloudConnector no longer shuts down the shared HTTP client used by others; the shared client is torn down only when the last connector is closed.

Development

• JaCoCo coverage in the build, plus a bearer-token authentication integration test, on top of the Testcontainers-based CI introduced in 14.1.6.

Thanks to Denis Verkhovsky for the Group Folders / tagging implementation this release drew on.

---

Note: the share expireDate parameter (#76) and the empty-collection JSON / non-standard-port WebDAV fixes (#112) were released earlier in 14.1.6.

14.1.6 Share expiry date + WebDAV/JSON fixes

Highlights

A feature + bug-fix release. Drop-in replacement for 14.1.5.

New

• Set an expiration date when creating a share. doShare / doShareAsync gained an optional LocalDate expireDate parameter (issue #76). The existing overloads are unchanged, so this is fully backwards compatible.

Fixes

• Empty results no longer crash JSON parsing. The OCS API serializes empty collections as [] instead of {}, which previously threw a MismatchedInputException (e.g. when listing users or groups on an empty result). Empty collections now parse correctly (issue #112).
• File uploads work on non-standard ports. Preemptive authentication now uses the configured port, so servers reachable on a non-standard port (e.g. behind a reverse proxy) no longer issue an auth challenge that a streamed upload could not retry (issue #112).

Testing / CI

• Integration tests can now auto-provision a throw-away Nextcloud server via Testcontainers when Docker is available, and run on every push and pull request in GitHub Actions. The full suite passes against a clean Nextcloud 31.

Requires Java 11+.

14.1.5 Dependency & security updates

@

Highlights

This is a maintenance release focused on dependency and security updates. No API changes — it is a drop-in replacement for 14.1.0.

Security

Updated jackson-databind from 2.20.0 to 2.22.1, resolving 5 Dependabot advisories (2 high, 3 moderate):

• PolymorphicTypeValidator bypass via generic type parameters (high)
• PolymorphicTypeValidator array subtype allowlist bypass (high)
• InetSocketAddress deserialization SSRF via eager DNS resolution (moderate)
• Case-insensitive deserialization bypassing @JsonIgnoreProperties (moderate)
• @JsonIgnore on a Record bypassed with PropertyNamingStrategy (moderate)

Dependency updates

• commons-codec 1.19.0 → 1.22.0
• commons-io 2.20.0 → 2.22.0
• commons-lang3 3.19.0 → 3.20.0
• jaxb-runtime 4.0.6 → 4.0.9 (test jaxb-impl aligned to 4.0.9)
• central-publishing-maven-plugin 0.9.0 → 0.11.0

Documentation & tooling

• Fixed the Maven Central coordinates in the README usage example (org.aarboard.nextcloud:nextcloud-api)
• Removed the obsolete oss.sonatype.org snapshot badge
• Added Dependabot configuration for Maven and GitHub Actions

Requires Java 11+.
@

Add auto build and deployment

14.1.5-SNAPSHOT

switch deployment script to central server too

14.1.0 More user properties

• Add HTTP proxy support (via system variables https.proxyHost and https.proxyPort)
  Thanks to @xylo
• Add User properties: lastLogin, backend, language, locale, and subAdminGroups
  Thanks to @xylo

Upgrade to Java 11+

• 2025-10-21
  • Bump required java version from 8 to 11+ (Thanks to kindlich)
  • Make connection autoclosable (thanks to raboof)
  • Bump pom.xml dependencies where possible

First 13.0.0 release with updated dependencies

• Switch to jakarta xml stuff for simpler Java 11+ compatibility
• The api remains identical, except the places where javax.xml stuff was exposed
  They now use the jakarta.xml names
• Bump all dependencies to latest versions, also build environment
• Added Cyclode DX SBOM

Release 12.0.5

• Release 12.0.5
• added bearer authentication for non-webdav calls
• Thanks to Arnout Engelen

12.0.2 Release

upgraded jaxb-runtime to 3.0.2 too because of indirect dependencies

12.0.1 release, security fix

• Release 12.0.1, upgraded various dependencies
• jackson-databind upgraded to 2.13.2.2 to fix CVE-2020-36518 (Thanks to MrRoubous)