nextcloud/server
☁️ Nextcloud server, a safe home for all your data
How server is put together
Nextcloud Server is a self-hosted content collaboration and file-sync platform, structured as a modular PHP application core (lib/, ocs/, core/) with a large ecosystem of first-party apps (apps/dav, apps/encryption, apps/federation, apps/comments, etc.) and a Vue.js frontend. Requests enter through PHP front controllers (index.php, remote.php, public.php, ocs/v1.php, ocs/v2.php, status.php, cron.php) that bootstrap via lib/base.php and lib/OC.php, dispatching to app controllers defined by per-app routes. The frontend is built in two flavors — a modern Vue 3 + Vite bundle (build/frontend) and a legacy Vue 2 + Webpack bundle (build/frontend-legacy) — communicating with the backend over OCS/REST and WebDAV. Data is persisted to a relational database (Postgres/MySQL) as seen in the devcontainer stack, with configuration in config/config.php.
Languages
Frameworks
Datastores
Infrastructure
Major components
PHP core / bootstrap (lib/)
Bootstraps the application, autoloading, request routing and core server services via lib/base.php and lib/OC.php.
OCS API layer (ocs/, ocs-provider/)
Exposes the Open Collaboration Services REST API through versioned entry points v1.php and v2.php.
Front controllers
Handle inbound HTTP entry points: index.php (web UI), remote.php (WebDAV/remote), public.php (public shares), status.php, cron.php.
DAV app (apps/dav)
Implements WebDAV/CalDAV/CardDAV endpoints for file, calendar, and contacts synchronization.
Encryption app (apps/encryption)
Provides server-side encryption of stored files.
Federation apps (apps/federation, apps/federatedfilesharing, apps/cloud_federation_api)
Enable cross-server trust, federated identity, and file sharing between Nextcloud instances.
Modern frontend (build/frontend)
Vue 3 + Vite client bundle for the current Nextcloud web UI.
Legacy frontend (build/frontend-legacy)
Vue 2 + Webpack bundle maintaining older UI components and app views.
The team opened version 36 as the new master branch while shipping sharing improvements, avatar fixes, and routine security updates.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
The team opened version 36 as the new master branch while shipping sharing improvements, avatar fixes, and routine security updates.
Week of 2026-08-17
A high-volume week cutting the 35.0 beta 4 release alongside navigation features, developer tooling, and heavy dependency housekeeping.
Week of 2026-08-10
The busiest week focused on granular 'native' share access, admin audit logging improvements, and test-suite cleanup.
Week of 2026-08-03
Work centered on a redesigned app menu, encrypted database setup options, and improvements to unified search and profiles.
Week of 2026-07-27
A very quiet week with a single minor test cleanup.
Over the past few weeks Nextcloud's development ramped up from a quiet single-commit week into a busy push toward two milestones: cutting the 35.0 beta and opening version 36 as the new master. The dominant themes were a major overhaul of file sharing (finer-grained 'native' access controls, better privacy safeguards, and password/expiration handling for email recipients), user-facing polish like a redesigned app menu and configurable toast-notification timeouts, plus steady security, dependency, and translation maintenance.
Week by week
2026-08-24The team opened version 36 as the new master branch while shipping sharing improvements, avatar fixes, and routine security updates.latest6 changes
Chore
Version 36 becomes the new master
The codebase was bumped to version 36, updating app versions, requirements, and third-party libraries to start the next release cycle.
Feature
Configurable toast notification timeout
Users can now choose how long pop-up notifications stay on screen, with preset options up to 30 seconds or never auto-dismissing.
Feature
Filter shares by state
Sharing views gained the ability to narrow the list of shares by their current status.
Fix
Avatars load for email-style user IDs
Profile pictures now display correctly for users whose account IDs are formatted like email addresses.
Fix
Share privacy and password-expiration handling
Fixed a bug that could leak share details and applied password-expiration settings to shares sent to email recipients.
Fix
Security certificate and login fixes
Refreshed the CA certificate bundle, updated expiry timing, and corrected how the WebAuthn login name is stored.
2026-08-17A high-volume week cutting the 35.0 beta 4 release alongside navigation features, developer tooling, and heavy dependency housekeeping.6 changes
Chore
Released 35.0.0 beta 4
Tagged a new beta of version 35 for testers along with recompiled front-end assets.
Feature
Navigation actions in the interface
Apps can now define and show custom actions within the app navigation menu.
Feature
Encrypted database connections during setup
The installer now supports SSL/TLS-secured connections when configuring the database.
Chore
Routine dependency updates
Bumped numerous front-end libraries (Vue, Pinia, and others) via automated dependency tooling.
Fix
Security revocation list refresh
Updated the code-signing revocation list to keep app signature checks current.
Refactor
Removed legacy autoloading code
Cleaned up an obsolete internal mechanism for loading application code.
2026-08-10The busiest week focused on granular 'native' share access, admin audit logging improvements, and test-suite cleanup.6 changes
Feature
Fine-grained 'native' share access
Users with native access to a file can now view and make certain changes to its shares.
Feature
Room building name in calendar metadata
Meeting-room resources can now carry the name of the building they belong to.
Refactor
Improved admin audit logging
Reworked how audit entries handle parameter types and clarified missing IDs for new file reads.
Fix
Multi-permission share creation
Fixed a problem when creating shares that grant multiple mount permissions at once.
Fix
Database query corrections
Resolved ambiguous column references in preview queries and a prepared-statement regression.
Chore
Test suite modernization
Upgraded PHPUnit, added performance analysis, and stabilized several install and app-enable tests.
2026-08-03Work centered on a redesigned app menu, encrypted database setup options, and improvements to unified search and profiles.6 changes
Feature
Redesigned app menu
The app menu now opens on hover and drops below the header, with a cleaned-up App Store entry and clearer active states.
Feature
SSL/TLS database configuration
Added support for passing encrypted-connection settings when installing against a database.
Feature
Modern command-line API
Introduced a cleaner developer interface for building console commands and ported several file commands to it.
Feature
Shared resources profile API
Added an interface for exposing resources shared on a user's profile.
Fix
Unified search result behavior
Cleared stale search results on each keystroke and prevented results from appearing out of order.
Fix
Graceful handling of missing share owner
Avoided a crash that occurred when a share's owner account could not be found.
2026-07-27A very quiet week with a single minor test cleanup.1 change
Chore
Calendar test cleanup
Removed unused imports from a calendar resource-and-rooms updater test.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 1105 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required