Release Notes — v5.1.1 — Performance and bug fixes

Overview

This release adds small improvment for metadata console, caching performance, and minor bug fixes.

• Fix: Enable Toggling Restrict values for TagCloud on/off WPB-29504.
• Perf: PolicyGroup concurrent-safe Caching memoization WPB-28683.
• Fix: Policy concurrent map in policy dao.
• Security: Updates for dependency vulnerabilities.
• Maintenance: Update the Go toolchain to version 1.27.3.

Change log

You can find a summary of the change log here.

Fix an issue with Nats jetstream, Adds collabora feature controls

Change log

You can find a summary of the change log here.

Release Notes — v5.1.0 — Entity Value Policies & Metadata Refactor

Overview

This release introduces access policies for Namespace Entity Values (EV), refactors the user metadata service layer, and improves the admin console experience for managing metadata namespaces and their associated entities.

✨ New Features

Entity Value Policies

• Introduced access control policies for Entities via the new idm_usr_entity_policies model
• Added a 5.1.0 migration granting standard profile GET access to rest:user-meta/entity
• Added IsContextEditable flag on entities, derived from policy context, allowing fine-grained control over whether end users can add new tag values

New REST Endpoints

• Dedicated CRUD endpoints for Entities and Entity Values are now the primary mechanism for creating and managing EV data, replacing implicit parsing from JsonDefinition
• Default policies are applied automatically when entities and values are created via the new endpoints

Admin Console — Namespace & Entity Value Management

• Namespace creation in the admin console now uses the dedicated Entity Value endpoints
• MetaNamespace and MetaNamespaceFieldOptions components refactored to TypeScript with improved state management
• New "Disable new values" flag available on tag-cloud namespace entities, controlling the PoliciesContextEditable setting per entity
• Added translation key for entity values closed list

EvResolver — Entity Value Link Resolution

• Added Detach() method for explicit DELETE-path handling
• Resolve() now batch-fetches and detaches removed links in a single pass
• Extracted normalizeLabels and resolveEntityValues as focused helpers
• Resolver is instantiated once outside the request loop for efficiency

♻️ Refactors

Backend

• UpdateUsermetaNamespace REST handler is now responsible for Namespace CRUD only — entity and value operations are handled by their own dedicated handlers
• Entity value resolution moved from client.go into the gRPC layer
• DAO initialization for Entities and Values refactored; DAO resolution uses named lookup in gRPC handlers and unit tests
• Added UUID field to Namespace entities
• Improved and fixed user meta service migration ordering
• IDM user meta storage driver resolution and policy spec refactored for clarity

Frontend

• JsonDefinition parse and write operations are now performed client-side, after the namespace and entities are already created server-side
• Fixed select field displaying key instead of value across all user metadata display and select views
• Removed unused proto messages; regenerated protos and Swagger spec for the JS SDK

🐛 Bug Fixes

🔒 Security

• Dependency update: vitest sub-dependencies bumped to resolve Semgrep-flagged vulnerabilities

🧪 Tests

• Unit tests added for ev-resolver
• Unit tests added for gRPC handler layer
• Improved existing meta unit tests
• Fixed migration conflict causing test run failures

📦 Build & Distribution

• Production dist rebuilt for changed frontend plugins:
  • access.settings
  • meta.user
  • uploader.html
  • gui.ajax
• npm lockfile restored and node modules reinstalled cleanly
• TypeScript dev dependency and tsconfig added to metadata admin console

Change log

You can find a summary of the change log here.

Release Notes — v5.0.3

Bug Fixes

Collabora Action Buttons Hidden
Hide Collabora action buttons based on feature controls, giving administrators finer-grained management of Collabora functionality.

etcd Stability Improvements
Multiple fixes to stabilize startup sequence, default site configurations, race conditions, and migration flow when using etcd.

Startup & Bootstrap Improvements
Increased before-serve timeout and improved error display on bootstrap failure to prevent premature startup failures.

Vault Error Breaking the Mailer
Fixed error that was interrupting the mailer service on startup.

FirstRun Migration Overwriting Installer Configs
Fixed an issue where the FirstRun migration would overwrite existing installer configurations.

Email Template Footer Images
Fixed support for footer images in custom email templates.

Metadata Search OnlyValuesFromList Enforcement
Fixed the onlyValuesFromList constraint not being enforced in the onChange handler for metadata search fields.

OAuth Silent Failure on Wrong Password
Fixed silent failure when incorrect credentials were used during OAuth authentication — users now receive proper error feedback.

MongoDB Special Character Escaping in Path Filters
Fixed unescaped special characters in MongoDB path filters causing incorrect search results.

File List Sorting in BlockNote
Fixed the sorting hook for file lists and table of contents within BlockNote pages.

Datasource Migration Flow and DSN Validation
Improved the datasource migration flow in the admin panel and added DSN connection validation before proceeding.

Unix Socket Support for Database
Fixed DSN parsing to skip host/port resolution when using Unix socket connections.

Read-Only Filesystem Error in Convert Tools
Fixed a read-only filesystem error when convert tools attempted to write temporary files to /tmp.

Recycle Bin Lookup Anchor
Fixed recycle bin path resolution to match exact leaf-name, preventing false grep matches.

User Creation Notification Email
Fixed notification emails not being sent upon user creation by propagating the request context correctly.

Default Cache Behavior
Restored correct default cache usage that was inadvertently disabled.

NATS JetStream Queue Retention Policy
Fixed an incorrect retention policy applied to NATS JetStream queues causing message handling issues.

Admin Namespace Missing i18n Translations
Fixed missing translations in the admin namespace caused by a TypeEditor import issue.

Public Link for Pages Not Defaulting to Pages View
Fixed an issue where public links for Pages did not display the Pages view by default.

Dependency Updates

• Bumped golang.org/x/net, golang.org/x/crypto, and golang.org/x/image to latest versions.

Change log

You can find a summary of the change log here.

This is a maintenance release for the stable branch, focused on sync reliability, namespace policy handling, and a refresh of the enterprise packaging.

• In Pydio Cells, we fixed S2S sync diff handling, pub/sub writer assertions, a panic in flows action-message logging, and a namespace upsert path that could miss policy updates.
• The Helm deployment template was cleaned up by removing a duplicate selector label.
• In Cells Enterprise, the Docker image build files and Go module dependencies were refreshed.

Change log

You can find a summary of the change log here.

This is a minor release for the stable branch, with a focus on sync reliability, bootstrap fixes, iOS compatibility, and a refresh of the operator packaging.

• Fixed several sync engine issues, including partial sync handling, event ordering, metadata propagation, and goroutine lifecycle problems.
• Improved startup and admin tooling: meta table initialization, scan initialization, and the admin config list command are now more robust, and a new company seeding command is available for operators.
• Restored backward compatibility for iOS clients by keeping presigned URL handling compatible and preserving the thumbnail processing flag in serialized metadata.
• Updated the quic-go dependency in the main tree and in cells-fuse.

Change log

You can find a summary of the change log here.

Cells v5 is our most ambitious release yet. It brings a redesigned content experience with the new Pages display and a completely revamped custom metadata system, alongside a big improvement to the microservices engine built for cloud and clustered deployments. From end-user collaboration to large-scale Kubernetes operations, every layer of the platform has been rethought.

What's new for users and editors

The new Pages display introduces a modernized browsing and authoring experience: default namespaces are installed on first run, the editor gains richer formatting and Table-of-Content hints, and the overall navigation has been refreshed to make publishing internal pages feel as natural as managing files.

Custom metadata has been rebuilt around a new Entity Values store, unlocking togglable fields, focus-based editing, popover tagging, validation flows on the info panel, and pre-filled schema defaults for personal team uploads. Combined with debounced search across text-based fields and expanded i18n coverage (German, French, Norwegian, Brazilian Portuguese, Japanese, Ukrainian), the day-to-day experience is faster, friendlier, and easier to tailor to each organization.

Pydio Cells 5.0 is built for the cloud

Under the hood, we've enhanced the v4 runtime with an update to the plugin-based microservices engine, now driven entirely by a single bootstrap.yaml configuration. Every infrastructure component — servers, brokers, queues, caches, config and storage backends — is initialized through a unified URL-scheme plugin system (grpc://, nats://, redis://, sql://, mongodb://, vault://, etcd://…), making it trivial to swap an embedded backend for a managed cloud service.

Cells v5 ships with a production-grade Helm chart designed around externally-managed backends. Every infrastructure dependency — MariaDB/PostgreSQL, MongoDB, Redis, NATS, etcd, MinIO/S3, Vault — can now be configured as an external service, removing the internal coupling that previously tied the chart to bundled subcharts. The bundled subcharts are deprecated; production deployments are expected to point Cells at managed or operator-deployed services. A dedicated cells-controller service mediates Kubernetes ConfigMaps and Secrets at runtime.

Other Major Features

New PostgreSQL support
PostgreSQL joins MariaDB/MySQL as a fully supported primary database, with all idm/data/scheduler stores tested end-to-end and the migration framework adapted to PG-specific behavior (collation, column semantics, automigrate). The minimum DB versions, install docs and i18n strings have been refreshed accordingly.

Multi-tenancy support [ED]
Cells v5 introduces first-class multi-tenancy. Tenants are isolated at the configuration, data and identity layers, with a configurable tenant header to route requests across deployments.

Cloud-native clustering, fully rewritten
The Kubernetes and clustering layers have been rewritten from the ground up: stateless pods, externalized config and registry, replica-aware connectors for every backend, and a controller service to mediate cluster-wide state. With v5, every infrastructure dependency — database, document store, cache, broker, object storage, secrets — can be delegated to a managed or operator-deployed service, so Cells pods carry no internal state of their own. The Helm chart is now the recommended way to run Cells at scale.

Enterprise & Security [ED]
The Enterprise build adds LLM/OpenAI integration for AI-assisted features, a dryRun mode for the scheduler syncer, refined policy/ACL semantics (user UUIDs instead of logins, cross-node ACL references), and an additional S3 signature mode (signed + trailer) for broader SDK compatibility. On the security side, SameSite=Strict session cookies, read-authorization enforcement on Cells/Roles/Namespace endpoints, and blocking of unsafe forgot-password external links harden the platform out of the box.

Routing flexibility
Caddy and the Sites configuration have been decoupled from the main HTTP server mux. The gateway is now composable — you can run Caddy embedded, behind your own reverse proxy, or replace it entirely, while internal HTTP services keep running on their own dedicated mux.

Observability
End-to-end OpenTelemetry is built in: distributed traces, structured logs and metrics exported via OTLP, ready to plug into any modern observability stack.

Breaking Changes & Deprecation

• Reverse URL is now compulsory when running Cells behind a reverse proxy. The external URL must be configured explicitly — relying on implicit detection from incoming requests is no longer supported.
• Bundled Helm subcharts are deprecated. Production deployments must point Cells at external (managed or operator-deployed) services. Bundled charts remain only for local trials.
• GCS datasources removed, and structured datasources are now hidden behind an advanced configuration.
• Legacy config migrations deprecated — upgrades go through the new v4 → v5 migration framework (schemas, personal access tokens, policies, namespaces, metadata). Read the upgrade guide before you begin.
• Misc API changes: editor URL keys exposed on REST endpoints, presigned-URL flag on /versions, expanded CheckFileInfo response in the WOPI/Collabora integration, and several smaller adjustments — see the API changelog.

Codebase

V5 is the result of two years of intensive engineering on top of the v4 stateless foundation. Highlights:

• New editor.bnote plugin for the Pages display functionality.
• New runtime manager with dynamic service composition driven by bootstrap.yaml.
• Storage layer rewritten on GORM with multi-database support.
• New broker and queue implementations: a file-system PubSub broker, and pluggable goqueue/debounce queues.
• Toolchain upgraded to Go 1.26, with updated Caddy, Hydra, Bleve and pgx dependencies.

Resources

• Upgrade Instructions: Must Read!
• Support: Forum
• Administration Guide: Quick Start
• Kubernetes Deployment: Helm Chart Guide
• Developer Docs: API, Knowledge Base
• Show your love: Star on Github or follow us on LinkedIn!

Contributions

This release ships with refreshed translations across German, French, Brazilian Portuguese and Japanese.
Norwegian and Ukrainian are on their way, thanks to our amazing Crowdin community.

If you want to help us and participate by adding translation to your language, it is really easy: just navigate to the Pydio Cells project in Crowdin, create an account and get started!

Change log

You can find a summary of the change log here.

Last update of pdf library could break loading of pdf files with special characters

Change log

You can find a summary of the change log here.

Dependencies updates for security on both server and frontend

Change log

You can find a summary of the change log here.

Patch an edge case causing UX failure

Change log

You can find a summary of the change log here.