14.2.2 Dependency maintenance release

A dependency maintenance release. No API or behaviour changes — this is a drop-in
upgrade from 14.2.1.

Updated dependencies

• jackson-databind 2.22.1 -> 2.22.2
• jakarta.annotation-api 2.1.1 -> 3.0.0

Jakarta Annotations 3.0 is the Jakarta EE 11 release, but it is still built for
Java 11 (bytecode major 55, and an OSGi Require-Capability of
osgi.ee=JavaSE version=11), so it does not affect this library's JDK 11
baseline. Compared to 2.1.1 it only drops the deprecated
jakarta.annotation.ManagedBean, which this library does not use.

Build

• Removed the dead nexus-staging-maven-plugin.version property from pom.xml.
  The plugin is no longer part of the build — publishing goes through the
  central-publishing-maven-plugin.

Note on Jackson 3.x

We are deliberately staying on the Jackson 2.x line. Jackson 3.x requires
Java 17 and would break the JDK 11 baseline that the 14.x series commits to.
Moving to Jackson 3 would also mean new Maven coordinates
(tools.jackson.core), a package rename to tools.jackson.databind, and a
consumer-visible change to the @JsonDeserialize annotation used on the public
Quota class — so it is a future major-version change, not a patch.

Everything else in the build is already on its latest stable release; the only
newer artifacts available are pre-releases (slf4j 2.1.0-alpha1,
jakarta.xml.bind-api 4.1.0-M1).

Maven coordinates

<dependency>
    <groupId>org.aarboard.nextcloud</groupId>
    <artifactId>nextcloud-api</artifactId>
    <version>14.2.2</version>
</dependency>

14.2.1 Dependency maintenance release

A maintenance release. No API changes — existing code needs no adjustment when upgrading from 14.2.0.

Dependency updates

• commons-codec 1.22.0 → 1.22.1 — the only change that reaches your runtime classpath.
• testcontainers (test scope) 1.21.4 → 2.0.5 — affects this project's own integration tests, not consumers.

The pom previously pinned Testcontainers to the 1.21.x line with a note claiming that 2.x requires Java 17. That turned out to be wrong for the published artifacts: Testcontainers builds its main source sets with options.release=8, and the 2.0.5 jar contains no bytecode above class-file major 52 outside the multi-release META-INF/versions overlays, which a JDK 11 runtime ignores. The full integration suite (129 tests against a containerized Nextcloud) passes on JDK 11 with 2.0.5. Upstream only runs its own CI on Java 17/21, so that caveat is now recorded in the pom instead of a hard requirement.

Build and CI

• cyclonedx-maven-plugin 2.9.2 → 2.9.3
• jacoco-maven-plugin 0.8.12 → 0.8.15
• actions/upload-artifact 4 → 7

Requirements

Unchanged: Java 11+. There were no open Dependabot security alerts against this project at the time of release; all previous ones were already resolved in 14.1.5 and 14.2.0.

<dependency>
    <groupId>org.aarboard.nextcloud</groupId>
    <artifactId>nextcloud-api</artifactId>
    <version>14.2.1</version>
</dependency>

Full changelog: 14.2.0...14.2.1

14.2.0 Group Folders, system tags, expanded share API & security hardening

Highlights

A large feature, security and hardening release on top of 14.1.6. Requires Java 11+.

New features

• Group Folders app (#109) — create, rename, delete and list group folders, grant/revoke group access, set group permissions and quota (GroupFolders).
• System tags (#110) — list, create and delete tags, and assign/remove tags on a file (SystemTags).
• Expanded Share API (#107) — federated/remote shares (list accepted & pending, get info, delete, accept/decline), (re)send the share notification email, new ShareType values CIRCLE and TALK, new ShareData attributes (NOTE, LABEL, ATTRIBUTES, SENDMAIL), and Share.getNote() / getLabel().
• Safe TLS trust — trustCertificate(X509Certificate) / trustCertificates(InputStream) to trust a specific self-signed or private-CA certificate while keeping chain and hostname verification enabled. WebDAV now honours the same trust configuration as the OCS calls (#125).

Security

• Hardened XML parsing against XXE (DTDs / external entities disabled).
• Basic-auth credentials are no longer embedded in the request URL.
• The shared HTTP client is cached per TLS/proxy configuration, so trustAllCertificates can no longer leak to a secure connector (also makes client creation thread-safe).
• Reject path separators in user/group identifiers to prevent URL/path injection.
• trustAllCertificates now logs a warning when it disables validation.

Bug fixes

• Connector lifecycle (#87) — closing one NextcloudConnector no longer shuts down the shared HTTP client used by others; the shared client is torn down only when the last connector is closed.

Development

• JaCoCo coverage in the build, plus a bearer-token authentication integration test, on top of the Testcontainers-based CI introduced in 14.1.6.

Thanks to Denis Verkhovsky for the Group Folders / tagging implementation this release drew on.

---

Note: the share expireDate parameter (#76) and the empty-collection JSON / non-standard-port WebDAV fixes (#112) were released earlier in 14.1.6.

14.1.6 Share expiry date + WebDAV/JSON fixes

Highlights

A feature + bug-fix release. Drop-in replacement for 14.1.5.

New

• Set an expiration date when creating a share. doShare / doShareAsync gained an optional LocalDate expireDate parameter (issue #76). The existing overloads are unchanged, so this is fully backwards compatible.

Fixes

• Empty results no longer crash JSON parsing. The OCS API serializes empty collections as [] instead of {}, which previously threw a MismatchedInputException (e.g. when listing users or groups on an empty result). Empty collections now parse correctly (issue #112).
• File uploads work on non-standard ports. Preemptive authentication now uses the configured port, so servers reachable on a non-standard port (e.g. behind a reverse proxy) no longer issue an auth challenge that a streamed upload could not retry (issue #112).

Testing / CI

• Integration tests can now auto-provision a throw-away Nextcloud server via Testcontainers when Docker is available, and run on every push and pull request in GitHub Actions. The full suite passes against a clean Nextcloud 31.

Requires Java 11+.

14.1.5 Dependency & security updates

@

Highlights

This is a maintenance release focused on dependency and security updates. No API changes — it is a drop-in replacement for 14.1.0.

Security

Updated jackson-databind from 2.20.0 to 2.22.1, resolving 5 Dependabot advisories (2 high, 3 moderate):

• PolymorphicTypeValidator bypass via generic type parameters (high)
• PolymorphicTypeValidator array subtype allowlist bypass (high)
• InetSocketAddress deserialization SSRF via eager DNS resolution (moderate)
• Case-insensitive deserialization bypassing @JsonIgnoreProperties (moderate)
• @JsonIgnore on a Record bypassed with PropertyNamingStrategy (moderate)

Dependency updates

• commons-codec 1.19.0 → 1.22.0
• commons-io 2.20.0 → 2.22.0
• commons-lang3 3.19.0 → 3.20.0
• jaxb-runtime 4.0.6 → 4.0.9 (test jaxb-impl aligned to 4.0.9)
• central-publishing-maven-plugin 0.9.0 → 0.11.0

Documentation & tooling

• Fixed the Maven Central coordinates in the README usage example (org.aarboard.nextcloud:nextcloud-api)
• Removed the obsolete oss.sonatype.org snapshot badge
• Added Dependabot configuration for Maven and GitHub Actions

Requires Java 11+.
@

Add auto build and deployment

14.1.5-SNAPSHOT

switch deployment script to central server too

14.1.0 More user properties

• Add HTTP proxy support (via system variables https.proxyHost and https.proxyPort)
  Thanks to @xylo
• Add User properties: lastLogin, backend, language, locale, and subAdminGroups
  Thanks to @xylo

Upgrade to Java 11+

• 2025-10-21
  • Bump required java version from 8 to 11+ (Thanks to kindlich)
  • Make connection autoclosable (thanks to raboof)
  • Bump pom.xml dependencies where possible

First 13.0.0 release with updated dependencies

• Switch to jakarta xml stuff for simpler Java 11+ compatibility
• The api remains identical, except the places where javax.xml stuff was exposed
  They now use the jakarta.xml names
• Bump all dependencies to latest versions, also build environment
• Added Cyclode DX SBOM

Release 12.0.5

• Release 12.0.5
• added bearer authentication for non-webdav calls
• Thanks to Arnout Engelen