Changelog for ownCloud Core 10.16.1 (2026-02-18)
The following sections list the changes in ownCloud core 10.16.1 relevant to ownCloud admins and users.
Summary
Bugfix - Apply SVG sanitization to all file content before using ImageMagick: #41433
Bugfix - Disallow empty tokens when pairing trusted servers: #41434
Change - Update PHP dependencies: #41408
Enhancement - Add mimetype aliases/mapping for .toml and .ovpn: #41431
Details
Bugfix - Apply SVG sanitization to all file content before using ImageMagick: #41433
Any file content is now sanitized for SVG threats before being processed by ImageMagick, preventing potential security vulnerabilities.
https://github.com/owncloud/core/pull/41433
Bugfix - Disallow empty tokens when pairing trusted servers: #41434
An empty token could be used to pair trusted servers, which is not secure.
https://github.com/owncloud/core/pull/41434
Change - Update PHP dependencies: #41408
The following have been updated: - monolog/monolog (2.10.0 to 2.11.0) - pear/pear-core-minimal (v1.10.16 to v1.10.18) - phpseclib/phpseclib (3.0.47 to 3.0.48) - phpseclib/phpseclib (3.0.46 to 3.0.49) - pimple/pimple (3.5.0 to 3.6.0) - sabre/http (5.1.12 to 5.1.13) - sabre/vobject (4.5.7 to 4.5.8) - symfony/process (5.4.47 to 5.4.51) - theseer/tokenizer (1.2.3 to 1.3.1)
https://github.com/owncloud/core/pull/41408 https://github.com/owncloud/core/pull/41421 https://github.com/owncloud/core/pull/41446
Enhancement - Add mimetype aliases/mapping for .toml and .ovpn: #41431
Mimetype aliases and mapping for .toml and .ovpn files got added.
https://github.com/owncloud/core/pull/41431
[10.16.0]: https://github.com/owncloud/core/compare/v10.15.3...v10.16.0
## Summary
* Bugfix - Unavailable shares storage will not block folder listing: [#41338](https://github.com/owncloud/core/pull/41338)
* Bugfix - Subadmins won't add users to groups: [#41405](https://github.com/owncloud/core/pull/41405)
* Bugfix - The phar stream wrapper is disabled by default: [#41406](https://github.com/owncloud/core/pull/41406)
* Change - Add user hint in share dialog that password policy can apply: [#41314](https://github.com/owncloud/core/pull/41314)
* Change - Update PHP dependencies: [#41287](https://github.com/owncloud/core/pull/41287)
* Enhancement - Improve global search experience for Chinese and Japanese input: [#41328](https://github.com/owncloud/core/pull/41328)
## Details
* Bugfix - Unavailable shares storage will not block folder listing: [#41338](https://github.com/owncloud/core/pull/41338)
In case a shared storage is not available in certain situations no folder listing would be shown
to the user.
https://github.com/owncloud/core/pull/41338
* Bugfix - Subadmins won't add users to groups: [#41405](https://github.com/owncloud/core/pull/41405)
Subadmins won't be able to add user to groups, not even to groups they're managing. Only admins
will be able to.
https://github.com/owncloud/core/pull/41405
* Bugfix - The phar stream wrapper is disabled by default: [#41406](https://github.com/owncloud/core/pull/41406)
Previously, it was only disabled for non-cli access, but now it's disabled globally.
https://github.com/owncloud/core/pull/41406
* Change - Add user hint in share dialog that password policy can apply: [#41314](https://github.com/owncloud/core/pull/41314)
To avoid user confusion the share dialog informs the user that password policy can apply in case
enabled.
https://github.com/owncloud/core/pull/41314
* Change - Update PHP dependencies: [#41287](https://github.com/owncloud/core/pull/41287)
The following have been updated: - doctrine/deprecations (1.1.3 to 1.1.5) -
google/apiclient (v2.16.0 to v2.16.1) - google/auth (v1.37.1 to v1.37.2) -
guzzlehttp/guzzle (7.8.1 to 7.9.3) - guzzlehttp/promises (2.0.3 to 2.2.0) -
guzzlehttp/psr7 (2.7.0 to 2.7.1) - icewind/smb (3.6.0 to 3.7.0) - icewind/streams (0.7.7 to
0.7.8) - laravel/serializable-closure (1.3.3 to 1.3.7) - league/mime-type-detection
(1.15.0 to 1.16.0) - mikey179/vfsstream (1.6.11 to 1.6.12) - monolog/monolog (2.9.3 to
2.10.0) - myclabs/deep-copy (1.12.1 to 1.13.4) - pear/pear-core-minimal (v1.10.15 to
v1.10.16) - pear/archive_tar (1.5.0 to 1.6.0) - phpseclib/phpseclib (3.0.39 to 3.0.46) -
sabre/dav (4.6.0 to 4.7.0) - sabre/event (5.1.4 to 5.1.7) - sabre/http (5.1.10 to 5.1.12) -
sabre/uri (2.3.3 t0 2.3.4) - sabre/vobject (4.5.4 to 4.5.7) - sabre/xml (2.2.7 to 2.2.11) -
symfony/console (5.4.40 to 5.4.47) - symfony/deprecation-contracts (2.5.3 to 2.5.4) -
symfony/event-dispatcher (5.4.40 to 5.4.45) - symfony/event-dispatcher-contracts
(2.5.3 to 2.5.4) - symfony/polyfill-php80 (1.29.0 to 1.33.0) - symfony/process (v5.4.40 to
v5.4.47) - symfony/routing (5.4.40 to 5.4.48) - symfony/service-contracts (2.5.3 to 2.5.4)
- symfony/string (5.4.40 to 5.4.47) - symfony/translation (5.4.40 to 5.4.45) -
symfony/translation-contracts (2.5.3 to 2.5.4)
https://github.com/owncloud/core/pull/41287
https://github.com/owncloud/core/pull/41297
https://github.com/owncloud/core/pull/41306
https://github.com/owncloud/core/pull/41307
https://github.com/owncloud/core/pull/41315
https://github.com/owncloud/core/pull/41320
https://github.com/owncloud/core/pull/41327
https://github.com/owncloud/core/pull/41329
https://github.com/owncloud/core/pull/41333
https://github.com/owncloud/core/pull/41334
https://github.com/owncloud/core/pull/41337
https://github.com/owncloud/core/pull/41341
https://github.com/owncloud/core/pull/41344
https://github.com/owncloud/core/pull/41345
https://github.com/owncloud/core/pull/41363
https://github.com/owncloud/core/pull/41366
https://github.com/owncloud/core/pull/41377
https://github.com/owncloud/core/pull/41382
https://github.com/owncloud/core/pull/41390
* Enhancement - Improve global search experience for Chinese and Japanese input: [#41328](https://github.com/owncloud/core/pull/41328)
Now the minimum characters input required is 2 for Chinese/Japanese inputs when performing
global search.
https://github.com/owncloud/core/issues/25021
https://github.com/owncloud/core/issues/9916
https://github.com/owncloud/core/pull/41328