21.0.3 RC1

[blizzz]

• [stable21] Don't break OCC if an app is breaking in it's Application class #26879 Don't break OCC if an app is breaking in it's Application class
• [Security] Bump handlebars from 4.7.6 to 4.7.7 #26905 Bump handlebars from 4.7.6 to 4.7.7
• [Security] Bump url-parse from 1.4.7 to 1.5.1 #26911 Bump url-parse from 1.4.7 to 1.5.1
• [Security] Bump lodash from 4.17.20 to 4.17.21 #26912 Bump lodash from 4.17.20 to 4.17.21
• [Security] Bump hosted-git-info from 2.8.8 to 2.8.9 #26918 Bump hosted-git-info from 2.8.8 to 2.8.9
• [stable21] fix occ command user:add-app-password #26952 Fix occ command user:add-app-password
• [stable21] Add bruteforce protection to the shareinfo endpoint #26955 Add bruteforce protection to the shareinfo endpoint
• [stable21] ignore readonly flag for directories #26964 Ignore readonly flag for directories
• [stable21] Throttle MountPublicLinkController when share is not found #26972 Throttle MountPublicLinkController when share is not found
• [stable21] Respect default share permissions for federated reshares #26999 Respect default share permissions for federated reshares
• [stable21] Harden apptoken check #27012 Harden apptoken check
• [stable21] Use parent wrapper to properly handle moves on the same source/target storage #27015 Use parent wrapper to properly handle moves on the same source/target storage
• [stable21] Fix log error when creating files from an empty template #27021 Fix log error when creating files from an empty template
• [stable21] fix error when using CORS with no auth credentials #27028 Fix error when using CORS with no auth credentials
• [stable21] Fix filesize error on log rotation, if file does not exist  #27058 Fix filesize error on log rotation, if file does not exist
• [stable21] Avoid reading ~/.aws/config when using S3 provider #27097 Avoid reading ~/.aws/config when using S3 provider
• [stable21] Move remnants of ocs api requests to v2 endpoint #27109 Move remnants of ocs api requests to v2 endpoint
• [stable21] Add DB exception '@throws' tag to QBMapper PHPDoc #27121 Add DB exception '@throws' tag to QBMapper PHPDoc
• [stable21] improve type handling of Avatar::generateAvatarFromSvg #27124 Improve type handling of Avatar::generateAvatarFromSvg
• [stable21] Bump patch dependencies #27184 Bump patch dependencies
• [stable21] Fix the get editable fields endpoint without a user id #27195 Fix the get editable fields endpoint without a user id
• [stable21] Use noreply@ as email address for share emails #27208 Use noreply@ as email address for share emails
• Bump vue-loader from 15.9.6 to 15.9.7 #27231 Bump vue-loader from 15.9.6 to 15.9.7
• Bump moment-timezone from 0.5.32 to 0.5.33 #27237 Bump moment-timezone from 0.5.32 to 0.5.33
• [Security] Bump browserslist from 4.16.0 to 4.16.6 #27248 Bump browserslist from 4.16.0 to 4.16.6
• [Security] Bump ws from 7.3.1 to 7.4.6 #27250 Bump ws from 7.3.1 to 7.4.6
• [stable21] properly use limit and offset for search in Jail wrapper #27303 Properly use limit and offset for search in Jail wrapper
• [stable21] Make user:report command scale #27318 Make user:report command scale
• [stable21] Properly log expiration date removal in audit log #27324 Properly log expiration date removal in audit log
• [stable21] emit UserLoggedInEvent on apache auth #27333 Emit UserLoggedInEvent on apache auth
• [stable21] Don't allow executing cli if cache backend is unavailable #27334 Don't allow executing cli if cache backend is unavailable
• [stable21] Propagate throttling on OCS response #27336 Propagate throttling on OCS response
• [stable21] Replace OCSController with OCP\API #27346 Replace OCSController with OCP\API
• [stable21] Don't throw when comments is disabled #27347 Don't throw when comments is disabled
• [stable21] Set umask before operations that create local files #27350 Set umask before operations that create local files
• [stable21] Escape filename in Content-Disposition #27359 Escape filename in Content-Disposition
• [stable21] Don't update statuses to offline again and again #27411 Don't update statuses to offline again and again
• [stable21] Fix some php 8 warnings #27415 Fix some php 8 warnings
• [stable21] Don't pass a column object to addOrderBy #27446 Don't pass a column object to addOrderBy
• [stable21] Header must contain a colon #27455 Header must contain a colon
• [Security] Bump postcss from 7.0.35 to 7.0.36 #27569 Bump postcss from 7.0.35 to 7.0.36
• [stable21] Properly cleanup entries of WebAuthn on user deletion #27599 Properly cleanup entries of WebAuthn on user deletion
• [stable21] Throttle on public DAV endpoint #27616 Throttle on public DAV endpoint
• Bump dompurify from 2.2.8 to 2.2.9 #27622 Bump dompurify from 2.2.8 to 2.2.9
• files_pdfviewer#397 Remove encodeURI code
• files_pdfviewer#417 Disable content copy for PDF files that specify it
• notifications#997 Only ask for permissions on HTTPS
• photos#784 Fix sorting if one of the file name is only composed with number
• serverinfo#295 Hide free space if it can't be calculated
• serverinfo#308 Update chart.js
• text#1610 Only return workspace property for top node in a propfind request
• viewer#923 Add fixup
• viewer#928 Fix: fullscreen for Firefox
• viewer#937 Use physical pixel size for preview resolution

Pending PRs:

• [stable21] Files & Core accessibility fixes #26650 Files & Core accessibility fixes
• [stable21] Fix account data visibility after disabling public addressbook upload #26724 Fix account data visibility after disabling public addressbook upload
• [stable21] fix return value of getStorageInfo when 'quota_include_external_storage' is enabled #27107 Fix return value of getStorageInfo when 'quota_include_external_storage' is enabled
• [stable21] Fix Oracle query limit compliance in Comments #27203 Fix Oracle query limit compliance in Comments
• [stable21] better cleanup of filecache when deleting an external storage #27205 Better cleanup of filecache when deleting an external storage
• [stable21] avoid fread on directories and unencrypted files #27406 Avoid fread on directories and unencrypted files
• [stable21] Only allow removing existing shares that would not be allowed due to reshare restrictions #27551 Only allow removing existing shares that would not be allowed due to reshare restrictions
• nextcloud_announcements#78 Update openssl for PHP 8.0
• text#1646 ViewerComponent: pass on autofocus to EditorWrapper