Changelog for ownCloud Core 10.16.1 (2026-02-18)

The following sections list the changes in ownCloud core 10.16.1 relevant to ownCloud admins and users.
Summary

    Bugfix - Apply SVG sanitization to all file content before using ImageMagick: #41433
    Bugfix - Disallow empty tokens when pairing trusted servers: #41434
    Change - Update PHP dependencies: #41408
    Enhancement - Add mimetype aliases/mapping for .toml and .ovpn: #41431

Details

    Bugfix - Apply SVG sanitization to all file content before using ImageMagick: #41433

    Any file content is now sanitized for SVG threats before being processed by ImageMagick, preventing potential security vulnerabilities.

    https://github.com/owncloud/core/pull/41433

    Bugfix - Disallow empty tokens when pairing trusted servers: #41434

    An empty token could be used to pair trusted servers, which is not secure.

    https://github.com/owncloud/core/pull/41434

    Change - Update PHP dependencies: #41408

    The following have been updated: - monolog/monolog (2.10.0 to 2.11.0) - pear/pear-core-minimal (v1.10.16 to v1.10.18) - phpseclib/phpseclib (3.0.47 to 3.0.48) - phpseclib/phpseclib (3.0.46 to 3.0.49) - pimple/pimple (3.5.0 to 3.6.0) - sabre/http (5.1.12 to 5.1.13) - sabre/vobject (4.5.7 to 4.5.8) - symfony/process (5.4.47 to 5.4.51) - theseer/tokenizer (1.2.3 to 1.3.1)

    https://github.com/owncloud/core/pull/41408 https://github.com/owncloud/core/pull/41421 https://github.com/owncloud/core/pull/41446

    Enhancement - Add mimetype aliases/mapping for .toml and .ovpn: #41431

    Mimetype aliases and mapping for .toml and .ovpn files got added.

    https://github.com/owncloud/core/pull/41431

[10.16.0]: https://github.com/owncloud/core/compare/v10.15.3...v10.16.0

## Summary

* Bugfix - Unavailable shares storage will not block folder listing: [#41338](https://github.com/owncloud/core/pull/41338)
* Bugfix - Subadmins won't add users to groups: [#41405](https://github.com/owncloud/core/pull/41405)
* Bugfix - The phar stream wrapper is disabled by default: [#41406](https://github.com/owncloud/core/pull/41406)
* Change - Add user hint in share dialog that password policy can apply: [#41314](https://github.com/owncloud/core/pull/41314)
* Change - Update PHP dependencies: [#41287](https://github.com/owncloud/core/pull/41287)
* Enhancement - Improve global search experience for Chinese and Japanese input: [#41328](https://github.com/owncloud/core/pull/41328)

## Details

* Bugfix - Unavailable shares storage will not block folder listing: [#41338](https://github.com/owncloud/core/pull/41338)

   In case a shared storage is not available in certain situations no folder listing would be shown
   to the user.

   https://github.com/owncloud/core/pull/41338

* Bugfix - Subadmins won't add users to groups: [#41405](https://github.com/owncloud/core/pull/41405)

   Subadmins won't be able to add user to groups, not even to groups they're managing. Only admins
   will be able to.

   https://github.com/owncloud/core/pull/41405

* Bugfix - The phar stream wrapper is disabled by default: [#41406](https://github.com/owncloud/core/pull/41406)

   Previously, it was only disabled for non-cli access, but now it's disabled globally.

   https://github.com/owncloud/core/pull/41406

* Change - Add user hint in share dialog that password policy can apply: [#41314](https://github.com/owncloud/core/pull/41314)

   To avoid user confusion the share dialog informs the user that password policy can apply in case
   enabled.

   https://github.com/owncloud/core/pull/41314

* Change - Update PHP dependencies: [#41287](https://github.com/owncloud/core/pull/41287)

   The following have been updated: - doctrine/deprecations (1.1.3 to 1.1.5) -
   google/apiclient (v2.16.0 to v2.16.1) - google/auth (v1.37.1 to v1.37.2) -
   guzzlehttp/guzzle (7.8.1 to 7.9.3) - guzzlehttp/promises (2.0.3 to 2.2.0) -
   guzzlehttp/psr7 (2.7.0 to 2.7.1) - icewind/smb (3.6.0 to 3.7.0) - icewind/streams (0.7.7 to
   0.7.8) - laravel/serializable-closure (1.3.3 to 1.3.7) - league/mime-type-detection
   (1.15.0 to 1.16.0) - mikey179/vfsstream (1.6.11 to 1.6.12) - monolog/monolog (2.9.3 to
   2.10.0) - myclabs/deep-copy (1.12.1 to 1.13.4) - pear/pear-core-minimal (v1.10.15 to
   v1.10.16) - pear/archive_tar (1.5.0 to 1.6.0) - phpseclib/phpseclib (3.0.39 to 3.0.46) -
   sabre/dav (4.6.0 to 4.7.0) - sabre/event (5.1.4 to 5.1.7) - sabre/http (5.1.10 to 5.1.12) -
   sabre/uri (2.3.3 t0 2.3.4) - sabre/vobject (4.5.4 to 4.5.7) - sabre/xml (2.2.7 to 2.2.11) -
   symfony/console (5.4.40 to 5.4.47) - symfony/deprecation-contracts (2.5.3 to 2.5.4) -
   symfony/event-dispatcher (5.4.40 to 5.4.45) - symfony/event-dispatcher-contracts
   (2.5.3 to 2.5.4) - symfony/polyfill-php80 (1.29.0 to 1.33.0) - symfony/process (v5.4.40 to
   v5.4.47) - symfony/routing (5.4.40 to 5.4.48) - symfony/service-contracts (2.5.3 to 2.5.4)
   - symfony/string (5.4.40 to 5.4.47) - symfony/translation (5.4.40 to 5.4.45) -
   symfony/translation-contracts (2.5.3 to 2.5.4)

   https://github.com/owncloud/core/pull/41287
   https://github.com/owncloud/core/pull/41297
   https://github.com/owncloud/core/pull/41306
   https://github.com/owncloud/core/pull/41307
   https://github.com/owncloud/core/pull/41315
   https://github.com/owncloud/core/pull/41320
   https://github.com/owncloud/core/pull/41327
   https://github.com/owncloud/core/pull/41329
   https://github.com/owncloud/core/pull/41333
   https://github.com/owncloud/core/pull/41334
   https://github.com/owncloud/core/pull/41337
   https://github.com/owncloud/core/pull/41341
   https://github.com/owncloud/core/pull/41344
   https://github.com/owncloud/core/pull/41345
   https://github.com/owncloud/core/pull/41363
   https://github.com/owncloud/core/pull/41366
   https://github.com/owncloud/core/pull/41377
   https://github.com/owncloud/core/pull/41382
   https://github.com/owncloud/core/pull/41390

* Enhancement - Improve global search experience for Chinese and Japanese input: [#41328](https://github.com/owncloud/core/pull/41328)

   Now the minimum characters input required is 2 for Chinese/Japanese inputs when performing
   global search.

   https://github.com/owncloud/core/issues/25021
   https://github.com/owncloud/core/issues/9916
   https://github.com/owncloud/core/pull/41328