Add reference to work package in opendesk.family so the MR is shown in the GitLab tab

chore(changelog): Fix typo in component name open-xchange
chore(reuse): Annotate merge request templates in REUSE.toml
2025-12-06 07:21:36 +01:00 · 2025-06-25 09:27:57 +00:00 · 2025-06-18 10:17:15 +02:00 · 2025-06-16 16:38:48 +02:00 · 2025-06-16 14:35:49 +02:00 · 2025-06-16 10:27:17 +02:00
28 changed files with 456 additions and 104 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,7 +4,7 @@
 ---
 include:
  - project: "${PROJECT_PATH_GITLAB_CONFIG_TOOLING}"
-    ref: "v2.4.9"
+    ref: "v2.4.10"
    file:
      - "ci/common/lint.yml"
      - "ci/release-automation/semantic-release.yml"
@@ -182,6 +182,9 @@ variables:
    options:
      - "yes"
      - "no"
+  DIFF_ON_BRANCH:
+    description: "Provide a branch to run `helmfile diff` for the specified branch."
+    value: ""
  RUN_TESTS:
    description: "Triggers execution of E2E-tests."
    value: "no"
@@ -220,6 +223,9 @@ variables:
  TESTS_PROJECT_URL:
    description: "Project url for e2e-tests (`<domain of gitlab>/api/v4/projects/<id>`)"
    value: "gitlab.opencode.de/api/v4/projects/1506"
+  HELM_IMAGE_PIN:
+    description: "The Helm image tag/checksum."
+    value: "1.3.3@sha256:3e195942e6988b8b93c62349700c0ed8428e3a8fbe2655bd7f5378dc88bc8ccb"

 # Declare .environments which is in `opendesk-env` repository. In case it is not available
 # 'cache' is used because job as a dummy key, as the job is not allowed to be empty.
@@ -232,8 +238,7 @@ variables:
  extends: ".environments"
  environment:
    name: "${NAMESPACE}"
-  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:1.3.2\
-          @sha256:87358b39af7403c9a536d1b71fd87ee84394310497dc0fbc90f78b75a3057712"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:${HELM_IMAGE_PIN}"
  script:
    - "cd ${CI_PROJECT_DIR}/helmfile/apps/${COMPONENT}"
    # MASTER_PASSWORD_WEB_VAR as precedence for MASTER_PASSWORD
@@ -671,6 +676,34 @@ fetch-administrator-credentials:
    reports:
      dotenv: ".env"

+diff-on-branch:
+  stage: "post-execute"
+  cache: {}
+  dependencies: []
+  extends: ".environments"
+  environment:
+    name: "${NAMESPACE}"
+  image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/helm:${HELM_IMAGE_PIN}"
+  rules:
+    - if: "$DIFF_ON_BRANCH"
+  script:
+    - |
+      echo "Downloading branch ${DIFF_ON_BRANCH}"
+      SAFE_BRANCH_NAME=$(echo "$DIFF_ON_BRANCH" | tr '/' '-')
+      BASE_URL="https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/-/archive"
+      FILE_NAME="opendesk-${SAFE_BRANCH_NAME}.tar.gz"
+      curl -L "${BASE_URL}/${DIFF_ON_BRANCH}/${FILE_NAME}" -o branch.tar.gz
+      mkdir ${DIFF_ON_BRANCH_SUBDIRECTORY} && tar -xzf branch.tar.gz -C ${DIFF_ON_BRANCH_SUBDIRECTORY} --strip-components=1
+      cd ${DIFF_ON_BRANCH_SUBDIRECTORY}
+      helmfile --namespace ${NAMESPACE} diff | grep -v '^ ' || true
+  tags:
+    - "docker"
+    - "kubernetes"
+    - "${CLUSTER}"
+  variables:
+    HELMFILE_ENVIRONMENT: "dev"
+    DIFF_ON_BRANCH_SUBDIRECTORY: "diff-on-branch"
+
 import-default-accounts:
  stage: "post-execute"
  extends: ".environments"
--- a/.gitlab/merge_request_templates/Bugfix.md
+++ b/.gitlab/merge_request_templates/Bugfix.md
@@ -0,0 +1,81 @@
+## 📌 Summary
+
+Brief description of the issue and what this MR resolves.
+
+> Example:
+> Fixes a bug where users were unable to save their profile due to a missing field validation.
+
+---
+
+## ✅ Changes
+
+Explain for the reviewer how the change addresses the issue:
+
+- Fixed null check on user input
+- Added unit test for edge case
+- Updated error handling in the `ProfileService`
+
+---
+
+## 🧪 Analysis
+
+Explain the **underlying cause** of the bug:
+
+- What was the unexpected behavior?
+- Why did it happen?
+- Where in the code or logic did it occur?
+
+---
+
+## 📚 Related Issue(s)
+
+- Should be listed as part of the commit message.
+- Fixes #[issue-number]
+- Related to #[optional additional issues]
+
+## 🧪 How to Reproduce & Test
+
+Link to issue or document the required details below.
+
+### Before the Fix:
+
+1. Go to `/profile/edit`
+2. Leave the "email" field empty
+3. Click "Save"
+4. Observe 500 server error
+
+### After the Fix:
+
+1. Same steps as above
+2. Now see appropriate validation message
+3. No server error occurs
+
+---
+
+## Checklist / Sign-offs
+
+### 💿 CI/CD
+
+- [ ] CI pipeline passes for all jobs
+- [ ] Linting and formatting checks pass
+- [ ] Review app (if used) reflects fix correctly
+
+### 🖥 QA & Product
+
+Set related labels on the MR for
+
+- [ ] `PO::👀`
+- [ ] `Tech Lead::👀`
+- [ ] `Testautomation::👀`
+- [ ] `QA::👀`
+
+---
+
+## 👷 Developer Checklist
+
+- [ ] Code builds and passes linting
+- [ ] Tests added or updated
+- [ ] Verified fix locally
+- [ ] Regression testing done for related functionality
+- [ ] No new warnings or errors in logs
+
--- a/.gitlab/merge_request_templates/Default.md
+++ b/.gitlab/merge_request_templates/Default.md
@@ -1,16 +1 @@
-<!--
-SPDX-FileCopyrightText: 2024 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH
-SPDX-License-Identifier: Apache-2.0
-->
-
-# Summary
-
- *describe the reason for/content of the MR*
-
-# Commits
-
-%{all_commits}
-
-# Authors
-
-%{co_authored_by}
+Please select one of the templates, in case your contribution contains more than a **simple** typo fix.
--- a/.gitlab/merge_request_templates/Feature.md
+++ b/.gitlab/merge_request_templates/Feature.md
@@ -0,0 +1,74 @@
+## 📌 Summary
+
+Briefly describe what this feature MR does and why it’s needed.
+
+> Example:
+> Adds user profile editing capabilities to the dashboard. This enables users to update their personal information without admin intervention.*
+
+---
+
+## ✅ Changes
+
+List the key changes made in this MR:
+
+- Added new route /profile/edit
+- Created `ProfileEditForm` component
+- Integrated with backend API for user updates
+- Added unit tests and basic form validation
+
+---
+
+## 🧪 Tests
+
+Provide steps for QA or reviewers to test the feature.
+
+1. Login as any user
+2. Navigate to `/profile/edit`
+3. Update profile info and save
+4. Verify changes are persisted and reflected in the UI
+
+---
+
+## 📚 Related Issue(s)
+
+- Closes #[issue number]
+- Depends on #[merge request or issue, if any]
+
+---
+
+## 🕵️ Notes for Reviewer
+
+Mention anything reviewers should be aware of:
+
+- Known issues or limitations
+- Code sections that may need special attention
+- Design considerations or edge cases handled
+
+---
+
+## Checklist / Sign-offs
+
+### 💿 CI/CD
+
+- [ ] CI pipeline passes for all jobs
+- [ ] Linting and formatting checks pass
+- [ ] Review app (if used) reflects fix correctly
+
+### 🖥 QA & Product
+
+Set related labels on the MR for
+
+- [ ] `PO::👀`
+- [ ] `Tech Lead::👀`
+- [ ] `Testautomation::👀`
+- [ ] `QA::👀`
+
+---
+
+## 👷 Developer Checklist
+
+- [ ] Code builds and passes linting
+- [ ] Tests added or updated
+- [ ] Verified fix locally
+- [ ] Regression testing done for related functionality
+- [ ] No new warnings or errors in logs
--- a/.gitlab/merge_request_templates/Other.md
+++ b/.gitlab/merge_request_templates/Other.md
@@ -0,0 +1,33 @@
+## 📌 Summary
+
+Provide a concise summary of **what** this MR does and **why**.
+
+> Example:
+> This MR updates the CI configuration to cache NPM dependencies and reduce pipeline execution time.
+
+---
+
+## ✅ Changes
+
+List the key updates made:
+
+- ...
+- ...
+
+---
+
+## 🧪 Tests (if applicable)
+
+Explain how reviewers or CI can verify the change works as intended.
+
+> Example:
+>- For CI: Check job `build:frontend` completes in <3 mins.
+>- For docs: View rendered markdown locally or in GitLab.
+
+---
+
+## 🧾 Checks
+
+- [ ] CI passes
+- [ ] No functional changes
+- [ ] Verified (if needed)
--- a/.gitlab/merge_request_templates/Update.md
+++ b/.gitlab/merge_request_templates/Update.md
@@ -0,0 +1,50 @@
+## ⬆️ Application Update
+
+Expected MR Title and git commit message:
+
+`feat/fix(<app-name>): Update from <old-version> to <new-version>`
+
+### 📋 Changelog/Release Notes
+
+- [ ] Upstream release notes: `[link]`
+- [ ] No breaking changes (or listed below)
+- [ ] Relevant changes communicated (if needed)
+- [ ] OP#<work package ID from release work package in opendesk.family> 
+
+---
+
+### 🔄 Migrations to Run (if any)
+
+Describe any migrations that need to be performed when upgrading to this application version.
+
+- [ ] Database migrations
+- [ ] Configuration changes
+- [ ] Cache clears / rebuilds
+- [ ] Other: _describe_
+
+## Checklist / Sign-offs
+
+### 💿 CI/CD
+
+- [ ] CI pipeline passes for all jobs
+- [ ] Linting and formatting checks pass
+- [ ] Review app (if used) reflects fix correctly
+
+### 🖥 QA & Product
+
+Set related labels on the MR for
+
+- [ ] `PO::👀`
+- [ ] `Tech Lead::👀`
+- [ ] `Testautomation::👀`
+- [ ] `QA::👀`
+
+---
+
+## 👷 Developer Checklist
+
+- [ ] Code builds and passes linting
+- [ ] Tests added or updated
+- [ ] Verified fix locally
+- [ ] Regression testing done for related functionality
+- [ ] No new warnings or errors in logs
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,41 @@
+# [1.5.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.4.1...v1.5.0) (2025-06-16)
+
+
+### Bug Fixes
+
+* **dovecot:** Enable Dovecot ACL for CE (file) & EE (cassandra) ([9354ee7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9354ee719628c876c26e91e1b57a4a0cfafedca1))
+* **notes:** Support templating of Ingress annotations `bodyTimeout` and `bodySize` to allow application defined upload limits to be reached ([69faf77](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/69faf77d15d1df441eb62c58374620f8035f2596))
+* **nubus:** Create required LDAP objects for `global.additionalMailDomains` ([4dcb683](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/4dcb6831189fc9cedb244c3fd7997d57e8a78c5a))
+* **nubus:** Explicitly template security context for Keycloak proxy ([e959438](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/e9594382ed7a2469240d62134b34bcf3e5d06a59))
+* **nubus:** Update CSS for login screen to show login button for federated IdP ([0d4e1b0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0d4e1b01e3e82ace7f7438a754235a009036b90d))
+* **nubus:** Use read-only root filesystem for Keycloak bootstrap ([1edd7c3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1edd7c3f062ec411b8b38f45be9ef22a200b4bea))
+* **open-xchange:** Enabled mail login resolver ([7547f49](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7547f4948ea13357c4cbc3ae69ae4e7210fdf4a2))
+* **open-xchange:** Update App Suite 8.37 to latest patch level (8.37.69) ([bc436b2](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc436b248525bf76584dd21f735694065bcb67a5))
+* **open-xchange:** Update Dovecot CE chart to support ACLs (mailbox sharing) and usernames different from local part of mail address ([87c30ab](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/87c30ab8e32c1b405f6aff8eda5eed5f74d5df0a))
+* **open-xchange:** Use login name instead of email between OX and Dovecot ([8e9ef08](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8e9ef0867beb8381ad4a5f55f2e9d12bd7dbbba2))
+* **openproject:** Update from 16.0.0 to 16.0.1 ([b60f9c7](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/b60f9c7576deca327ad36c48ad0b1a7e3e9d3c9c))
+
+
+### Features
+
+* **ci:** Update Helm to 3.18.1 and Helmfile to 1.1.1 ([59a4086](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/59a40864edbdf9775e0d6003425c3b05b7b7cb15))
+* **notes:** Update from 2.4.0 to 3.2.1 ([9f4e3c8](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9f4e3c86c74ef6c6f618150a7a9d0935fb5ed437))
+* **open-xchange:** Support for `mailAlternativAddress`(es) for sending and receiving emails ([6d6b1a6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/6d6b1a6dd754dcb283fd23f08f9df937f8e08c59))
+* **openproject:** Update from 15.5.1 to 16.0.0 including Helm chart update ([add7266](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/add72669aedfcd57b41fe8680f14940ab77f6aef))
+
+## [1.4.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.4.0...v1.4.1) (2025-06-02)
+
+
+### Bug Fixes
+
+* **nextcloud:** Update NC CE to 30.0.10 ([785be8b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/785be8b6621305e79acca62250720028b9ca7a30))
+* **nextcloud:** Update Nextcloud incl. apps to 30.0.10 ([559fbf6](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/559fbf6801fc785f26f9e6287e0730f86b459a01))
+* **nubus:** Use `.Values.theme.texts.productName` for Keycloak's `loginTitle` instead of static product name string ([d1a1e5d](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d1a1e5dc29ca21fd822abd127406f6859603b9c7))
+* **open-xchange:** Re-adding `com.openexchange.oauth.provider.*` to fix central contacts feature ([561e44f](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/561e44fd4cc42089954868da60edbd210b9a2608))
+* **open-xchange:** Set `com.openexchange.hostname` to get working links in outgoing system mails (e.g. task assignments) ([0d61687](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/0d616871e3f5114ec429714658500c09af842fe6))
+* **postfix:** Require TLSv1.3 ([3b3d8ac](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3b3d8aca54bdaea055289c993e3f158d93864223))
+* **requirements.md:** Helm 3.18.x is not supported due to upstream bug ([1ea9cae](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/1ea9cae1ce46f864dc03d94c1a72956c5f5ba9a9))
+
 # [1.4.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.3.2...v1.4.0) (2025-05-20)


--- a/README-EE.md
+++ b/README-EE.md
@@ -86,7 +86,7 @@ repositories:

 ## License keys

-Some applications require license information for their Enterprise features to be enabled. With the aforementioned registry credentials you will also receive a file called `enterprise.yaml` containing the relevant license keys.
+Some applications require license information for their Enterprise features to be enabled. With the aforementioned registry credentials you will also receive a file called [`enterprise.yaml`](./helmfile/environments/default/enterprise_keys.yaml.gotmpl) containing the relevant license keys.

 Please place the file next your other `.yaml.gotmpl` file(s) that configure your deployment.

--- a/README.md
+++ b/README.md
@@ -35,13 +35,13 @@ openDesk currently features the following functional main components:
 | Function             | Functional Component        | Component<br/>Version                                                                                                         | Upstream Documentation                                                                                                                |
 |----------------------|-----------------------------|-------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|
 | Chat & collaboration | Element ft. Nordeck widgets | [1.11.89](https://github.com/element-hq/element-desktop/releases/tag/v1.11.89)                                                | [For the most recent release](https://element.io/user-guide)                                                                          |
-| Collaborative notes  | Notes (aka Docs)            | [2.4.0](https://github.com/suitenumerique/docs/releases/tag/v2.4.0)                                                           | Online documentation/welcome document available in installed application                                                              |
+| Collaborative notes  | Notes (aka Docs)            | [3.2.1](https://github.com/suitenumerique/docs/releases/tag/v3.2.1)                                                           | Online documentation/welcome document available in installed application                                                              |
 | Diagram editor       | CryptPad ft. diagrams.net   | [2024.9.0](https://github.com/cryptpad/cryptpad/releases/tag/2024.9.0)                                                        | [For the most recent release](https://docs.cryptpad.org/en/)                                                                          |
-| File management      | Nextcloud                   | [30.0.6](https://nextcloud.com/de/changelog/#30-0-6)                                                                          | [Nextcloud 30](https://docs.nextcloud.com/)                                                                                           |
+| File management      | Nextcloud                   | [30.0.10](https://nextcloud.com/de/changelog/#30-0-10)                                                                          | [Nextcloud 30](https://docs.nextcloud.com/)                                                                                           |
 | Groupware            | OX App Suite                | [8.37](https://documentation.open-xchange.com/appsuite/releases/8.37/)                                                        | Online documentation available from within the installed application; [Additional resources](https://documentation.open-xchange.com/) |
 | Knowledge management | XWiki                       | [16.10.5](https://www.xwiki.org/xwiki/bin/view/ReleaseNotes/Data/XWiki/16.10.5/)                                              | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation)                                                     |
 | Portal & IAM         | Nubus                       | [1.9.1](https://docs.software-univention.de/nubus-kubernetes-release-notes/latest/en/changelog.html#version-1-9-1-2025-05-07) | [Univention's documentation website](https://docs.software-univention.de/n/en/nubus.html)                                             |
-| Project management   | OpenProject                 | [15.5.1](https://www.openproject.org/docs/release-notes/15-5-1/)                                                              | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
+| Project management   | OpenProject                 | [16.0.1](https://www.openproject.org/docs/release-notes/16-0-1/)                                                              | [For the most recent release](https://www.openproject.org/docs/user-guide/)                                                           |
 | Videoconferencing    | Jitsi                       | [2.0.9955](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_9955)                                         | [For the most recent  release](https://jitsi.github.io/handbook/docs/category/user-guide/)                                            |
 | Weboffice            | Collabora                   | [24.04.13](https://www.collaboraoffice.com/code-24-04-release-notes/)                                                         | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/)        |

--- a/REUSE.toml
+++ b/REUSE.toml
@@ -31,4 +31,9 @@ SPDX-License-Identifier = "CC-BY-SA-4.0"
 [[annotations]]
 path = ".opencode/screenshots/*"
 SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
-SPDX-License-Identifier = "CC-BY-SA-4.0"
+SPDX-License-Identifier = "CC-BY-SA-4.0"
+
+[[annotations]]
+path = ".gitlab/merge_request_templates/*.md"
+SPDX-FileCopyrightText = "2025 Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) GmbH"
+SPDX-License-Identifier = "Apache-2.0"
--- a/docs/enhanced-configuration/idp-federation.md
+++ b/docs/enhanced-configuration/idp-federation.md
@@ -22,7 +22,7 @@ SPDX-License-Identifier: Apache-2.0

 Most organizations already have an Identity and Access Management (IAM) system with an identity provider (IdP) for single sign-on (SSO) to internal or external web applications.

-This document explains how to configure your organization's IdP and the openDesk IdP to support account federation with openDesk SSO based on your organization's login.
+This document helps in setting up your organization's IdP and openDesk to enable IdP federation.

 # References

@@ -33,7 +33,7 @@ We would like to list successful IdP federation scenarios:
 | [EU Login](https://webgate.ec.europa.eu/cas/userdata/myAccount.cgi) | v0.9.0, v1.2.0           |
 | [ProConnect](https://www.proconnect.gouv.fr/)                       | v0.9.0                   |

->If you have successfully federated using another External IdP, please let us know so we can update the list above.
+> If you have successfully federated using another External IdP, please let us know so we can update the list above.

 # Prerequisites

@@ -70,6 +70,23 @@ This document focuses on the OIDC federation between an external IdP and the ope

 # Example configuration

+The following section explains how to configure the IdP federation manually in an example upstream IdP and in openDesk.
+
+With openDesk 1.4.0 IdP federation has to be enabled as part of the deployment using the `functional.authentication.ssoFederation` section, see [`functional.yaml.gotmpl`](../../helmfile/environments/default/functional.yaml.gotmpl) for reference.
+
+You can use the description below to configure and test the federation that can be exported and used as part of the deployment afterwards, e.g. with the following commands from within the Keycloak Pod:
+
+```shell
+# Set the variables according to your deployment first, below are just example values.
+export FEDERATION_IDP_ALIAS=sso-federation-idp
+export NAMESPACE=example_namespace
+export CLUSTER_NETWORKING_DOMAIN=svc.cluster.local
+# Authenticate with Keycloak
+/opt/keycloak/bin/kcadm.sh config credentials --server http://ums-keycloak.${NAMESPACE}.${CLUSTER_NETWORKING_DOMAIN}:8080 --realm master --user ${KEYCLOAK_ADMIN} --password ${KEYCLOAK_ADMIN_PASSWORD}
+# Request details of IdP configuration
+/opt/keycloak/bin/kcadm.sh get identity-provider/instances/${FEDERATION_IDP_ALIAS} -r opendesk
+```
+
 ## Versions

 The example was tested with openDesk v0.7.0 using its integrated Keycloak v24.0.3. As external IdP, we also used an openDesk deployment of the same version, but created a separate realm for proper configuration separation.
--- a/docs/migrations.md
+++ b/docs/migrations.md
@@ -11,6 +11,7 @@ SPDX-License-Identifier: Apache-2.0
 * [Manual checks/actions](#manual-checksactions)
  * [v1.4.0+](#v140)
    * [Pre-upgrade to v1.4.0+](#pre-upgrade-to-v140)
+      * [Helmfile new feature: `functional.authentication.ssoFederation`](#helmfile-new-feature-functionalauthenticationssofederation)
      * [Helmfile cleanup: `global.additionalMailDomains` as list](#helmfile-cleanup-globaladditionalmaildomains-as-list)
  * [v1.2.0+](#v120)
    * [Pre-upgrade to v1.2.0+](#pre-upgrade-to-v120)
@@ -104,6 +105,12 @@ If you would like more details about the automated migrations, please read secti

 ### Pre-upgrade to v1.4.0+

+#### Helmfile new feature: `functional.authentication.ssoFederation`
+
+**Target group:** Deployments that make use of IdP federation as described in [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
+
+Please ensure to configure your IdP federation config details as part of `functional.authentication.ssoFederation`. You can find more details in the "Example configuration" section of [`idp-federation.md`](./enhanced-configuration/idp-federation.md).
+
 #### Helmfile cleanup: `global.additionalMailDomains` as list

 **Target group:** Installations that have set `global.additionalMailDomains`.
--- a/docs/requirements.md
+++ b/docs/requirements.md
@@ -29,14 +29,14 @@ openDesk is a Kubernetes-only solution and requires an existing Kubernetes (K8s)
 - K8s cluster >= v1.24, [CNCF Certified Kubernetes distribution](https://www.cncf.io/certification/software-conformance/)
 - Domain and DNS Service
 - Ingress controller (Ingress NGINX) >= [4.11.5/1.11.5](https://github.com/kubernetes/ingress-nginx/releases)
- [Helm](https://helm.sh/) >= v3.17.3
+- [Helm](https://helm.sh/) >= v3.17.3, but not v3.18.0[^1]
 - [Helmfile](https://helmfile.readthedocs.io/en/latest/) >= v1.0.0
 - [HelmDiff](https://github.com/databus23/helm-diff) >= v3.11.0
- Volume provisioner supporting RWO (read-write-once)[^1]
+- Volume provisioner supporting RWO (read-write-once)[^2]
 - Certificate handling with [cert-manager](https://cert-manager.io/)

 **Additional openDesk Enterprise requirements**
- [OpenKruise](https://openkruise.io/)[^2] >= v1.6
+- [OpenKruise](https://openkruise.io/)[^3] >= v1.6

 # Hardware

@@ -117,7 +117,7 @@ deployments, you need to make use of your own production-grade services; see the
 |----------|---------------------|---------|-----------------------|
 | Cache    | Memcached           | `1.6.x` | Memcached             |
 |          | Redis               | `7.x.x` | Redis                 |
-| Database | Cassandra[^2]       | `5.0.x` | Cassandra             |
+| Database | Cassandra[^3]       | `5.0.x` | Cassandra             |
 |          | MariaDB             | `10.x`  | MariaDB               |
 |          | PostgreSQL          | `15.x`  | PostgreSQL            |
 | Mail     | Mail Transfer Agent |         | Postfix               |
@@ -137,6 +137,8 @@ Helmfile requires [HelmDiff](https://github.com/databus23/helm-diff) to compare

 # Footnotes

-[^1]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail.
+[^1]: Due to a [Helm bug](https://github.com/helm/helm/issues/30890) Helm 3.18.0 is not supported.

-[^2]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
+[^2]: Due to [restrictions on Kubernetes `emptyDir`](https://github.com/kubernetes/kubernetes/pull/130277) you need a volume provisioner that has sticky bit support, otherwise the OpenProject seeder job will fail.
+
+[^3]: Required for Dovecot Pro as part of openDesk Enterprise Edition.
--- a/docs/security-context.md
+++ b/docs/security-context.md
@@ -182,9 +182,9 @@ This list gives you an overview of templated security settings and if they compl
 | **nubus**/ums/nubusGuardian/managementApi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusGuardian/managementUi | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusGuardian/openPolicyAgent | :white_check_mark: | no | no | yes | yes | 1000 | 1000 | yes | yes |
-| **nubus**/ums/nubusKeycloakBootstrap | :x: | no | n/a | no | yes | 1000 | 1000 | yes | yes |
+| **nubus**/ums/nubusKeycloakBootstrap | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusKeycloakExtensions/handler | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
-| **nubus**/ums/nubusKeycloakExtensions/proxy | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
+| **nubus**/ums/nubusKeycloakExtensions/proxy | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusLdapNotifier | :x: | no | n/a | yes | yes | 101 | 102 | yes | yes |
 | **nubus**/ums/nubusNotificationsApi | :x: | no | n/a | yes | yes | 1000 | 1000 | yes | yes |
 | **nubus**/ums/nubusPortalConsumer | :x: | n/a | n/a | n/a | n/a | n/a | n/a | yes | no |
--- a/helmfile/apps/notes/values.yaml.gotmpl
+++ b/helmfile/apps/notes/values.yaml.gotmpl
@@ -17,6 +17,13 @@ ingress:
  tls:
    enabled: "{{ .Values.ingress.tls.enabled }}"
    secretName: {{ .Values.ingress.tls.secretName | quote }}
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "{{ .Values.ingress.parameters.bodySize.notes }}"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.notes }}"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.notes }}"
+    nginx.org/client-max-body-size: "{{ .Values.ingress.parameters.bodySize.notes }}"
+    nginx.org/proxy-read-timeout: "{{ .Values.ingress.parameters.bodyTimeout.notes }}s"
+    nginx.org/proxy-send-timeout: "{{ .Values.ingress.parameters.bodyTimeout.notes }}s"

 ingressCollaborationWS:
  enabled: {{ .Values.ingress.enabled }}
@@ -27,12 +34,12 @@ ingressCollaborationWS:
    enabled: "{{ .Values.ingress.tls.enabled }}"
    secretName: {{ .Values.ingress.tls.secretName | quote }}
  annotations:
-    nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Can-Edit, X-User-Id"
-    nginx.ingress.kubernetes.io/auth-url: https://{{ .Values.global.hosts.notes }}.{{ .Values.global.domain }}/api/v1.0/documents/collaboration-auth/
    nginx.ingress.kubernetes.io/enable-websocket: "true"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "86400"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "86400"
    nginx.ingress.kubernetes.io/upstream-hash-by: $arg_room
+    nginx.ingress.kubernetes.io/auth-response-headers: null
+    nginx.ingress.kubernetes.io/auth-url: null
    {{- with .Values.annotations.notes.ingressCollaborationWS }}
    {{ . | toYaml | nindent 4 }}
    {{- end }}
@@ -91,7 +98,6 @@ frontend:
  envVars:
    PORT: 8080
    NEXT_PUBLIC_API_ORIGIN: {{ printf "https://%s.%s" .Values.global.hosts.notes .Values.global.domain | quote }}
-    NEXT_PUBLIC_Y_PROVIDER_URL: {{ printf "wss://%s.%s/ws" .Values.global.hosts.notes .Values.global.domain | quote }}
    NEXT_PUBLIC_MEDIA_URL: {{ printf "https://%s" (.Values.objectstores.notes.endpoint | default (printf "%s.%s" .Values.global.hosts.minioApi .Values.global.domain)) | quote }}
  runtimeEnvs:
    ICS_BASE_URL: {{ printf "https://%s.%s" .Values.global.hosts.intercomService .Values.global.domain | quote }}
@@ -144,6 +150,7 @@ yProvider:
    seLinuxOptions:
      {{ .Values.seLinuxOptions.notesBackend | toYaml | nindent 6 }}
  envVars:
+    COLLABORATION_BACKEND_BASE_URL: {{ printf "https://%s.%s" .Values.global.hosts.notes .Values.global.domain | quote }}
    COLLABORATION_LOGGING: {{ if .Values.debug.enabled }}"true"{{ else }}"false"{{ end }}
    COLLABORATION_SERVER_ORIGIN: {{ printf "https://%s.%s" .Values.global.hosts.notes .Values.global.domain | quote }}
    COLLABORATION_SERVER_SECRET: {{ .Values.secrets.notes.collaborationSecret | quote }}
@@ -214,8 +221,8 @@ backend:
    OIDC_OP_LOGOUT_ENDPOINT: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout"
    OIDC_RP_SIGN_ALGO: RS256
    OIDC_RP_SCOPES: "openid opendesk-notes-scope"
-    USER_OIDC_FIELD_TO_SHORTNAME: "given_name"
-    USER_OIDC_FIELDS_TO_FULLNAME: "given_name,family_name"
+    OIDC_USERINFO_SHORTNAME_FIELD: "given_name"
+    OIDC_USERINFO_FULLNAME_FIELDS: "given_name,family_name"
    USER_OIDC_ESSENTIAL_CLAIMS: "email"
    OIDC_REDIRECT_ALLOWED_HOSTS: {{ printf "https://%s.%s/*" .Values.global.hosts.notes .Values.global.domain | quote }}
    OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{}"
@@ -232,6 +239,8 @@ backend:
    COLLABORATION_SERVER_ORIGIN: {{ printf "https://%s.%s" .Values.global.hosts.notes .Values.global.domain | quote }}
    COLLABORATION_SERVER_SECRET: {{ .Values.secrets.notes.collaborationSecret | quote }}
    COLLABORATION_WS_URL:  {{ printf "wss://%s.%s/collaboration/ws/" .Values.global.hosts.notes .Values.global.domain | quote }}
+    FRONTEND_HOMEPAGE_FEATURE_ENABLED: False
+    FRONTEND_FOOTER_FEATURE_ENABLED: False
  migrate:
    command:
      - "/bin/sh"
--- a/helmfile/apps/nubus/values-nubus.yaml.gotmpl
+++ b/helmfile/apps/nubus/values-nubus.yaml.gotmpl
@@ -200,9 +200,9 @@ keycloak:
    login:
      messages:
        de:
-          loginTitle: "Anmeldung bei opendesk"
+          loginTitle: "Anmeldung bei {{ .Values.theme.texts.productName }}"
        en:
-          loginTitle: "Sign in to opendesk"
+          loginTitle: "Sign in to {{ .Values.theme.texts.productName }}"
  podAnnotations:
    intents.otterize.com/service-name: "ums-keycloak"
    {{- with .Values.annotations.nubusKeycloak.pod }}
@@ -706,6 +706,17 @@ nubusKeycloakExtensions:
    resources:
      {{ .Values.resources.umsKeycloakExtensionProxy | toYaml | nindent 6 }}
    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - "ALL"
+      enabled: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      seccompProfile:
+        type: "RuntimeDefault"
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
      seccompProfile:
        type: "RuntimeDefault"
      seLinuxOptions:
@@ -1485,6 +1496,7 @@ nubusStackDataUms:
      {{ .Values.annotations.nubusStackDataUms.serviceAccount | toYaml | nindent 6 }}
  templateContext:
    initialPasswordAdministrator: {{ .Values.secrets.nubus.systemAccounts.administratorPassword | quote }}
+    additionalMailDomains: {{ .Values.global.additionalMailDomains | toYaml | nindent 6 }}
    apps: {{ .Values.apps | toYaml | nindent 6 }}
    defaultGroupOtherObjects: "cn=Domain Users,cn=groups,{{ .Values.ldap.baseDn }}"
    opendeskEnterprise: {{ env "OPENDESK_ENTERPRISE" }}
@@ -1765,7 +1777,7 @@ nubusKeycloakBootstrap:
    capabilities:
      drop:
        - "ALL"
-    readOnlyRootFilesystem: false
+    readOnlyRootFilesystem: true
    runAsGroup: 1000
    runAsNonRoot: true
    runAsUser: 1000
--- a/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-dovecot-enterprise.yaml.gotmpl
@@ -28,7 +28,7 @@ dovecot:
      value: {{ .Values.secrets.cassandra.dovecotDictmapUser | quote }}
    keyspace: {{ .Values.databases.dovecotDictmap.name | quote }}
  sharedMailboxes:
-    enabled: false
+    enabled: true
    host: {{ .Values.databases.dovecotACL.host | quote }}
    port: {{ .Values.databases.dovecotACL.port }}
    username: {{ .Values.databases.dovecotACL.username | quote }}
--- a/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
@@ -291,7 +291,12 @@ appsuite:
        open-xchange-documents-backend: "disabled"
        open-xchange-documents-monitoring: "disabled"
        open-xchange-documents-templates: "disabled"
+        # Required for the central contacts integration
+        open-xchange-oauth-provider: "enabled"
+        # Needed to set com.openexchange.hostname
+        open-xchange-hostname-config-cascade: "enabled"
    properties:
+      com.openexchange.hostname: {{ printf "%s.%s" .Values.global.hosts.openxchange .Values.global.domain }}
      com.openexchange.UIWebPath: "/appsuite/"
      com.openexchange.showAdmin: "false"
      # PDF Export
@@ -323,14 +328,32 @@ appsuite:
      com.openexchange.oidc.userLookupNamePart: "full"
      com.openexchange.oidc.enablePasswordGrant: "true"
      com.openexchange.oidc.passwordGrantUserNamePart: "local-part"
+      # OAUTH
+      com.openexchange.oauth.provider.enabled: "true"
+      com.openexchange.oauth.provider.allowedIssuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
+      com.openexchange.oauth.provider.contextLookupClaim: "context"
+      com.openexchange.oauth.provider.contextLookupNamePart: "full"
+      com.openexchange.oauth.provider.jwt.jwksUri: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
+      com.openexchange.oauth.provider.mode: "expect_jwt"
+      com.openexchange.oauth.provider.userLookupNamePart: "full"
+      com.openexchange.oauth.provider.userLookupClaim: "opendesk_username"
      # MAIL
      com.openexchange.mail.authType: "xoauth2"
-      com.openexchange.mail.loginSource: "mail"
+      com.openexchange.mail.loginSource: "name"
      com.openexchange.mail.mailServer: "dovecot"
      com.openexchange.mail.mailServerSource: "global"
      com.openexchange.mail.transport.authType: "xoauth2"
      com.openexchange.mail.transportServer: "postfix-ox"
      com.openexchange.mail.transportServerSource: "global"
+      # Mail Login Resolver
+      com.openexchange.mail.login.resolver.enabled: "true"
+      com.openexchange.mail.login.resolver.ldap.enabled: "true"
+      com.openexchange.mail.login.resolver.ldap.clientId: "contactsLdapClient"
+      com.openexchange.mail.login.resolver.ldap.mailLoginSearchFilter: "(entryUUID=[mailLogin])"
+      com.openexchange.mail.login.resolver.ldap.userNameAttribute: "uid"
+      com.openexchange.mail.login.resolver.ldap.contextNameAttribute: "oxContextIDNum"
+      com.openexchange.mail.login.resolver.ldap.entitySearchFilter: "(&(oxContextIDNum=[cid])(uid=[uname]))"
+      com.openexchange.mail.login.resolver.ldap.mailLoginAttribute: "entryUUID"
      # Requirements for OX-Connector
      com.openexchange.user.enforceUniqueDisplayName: "false"
      com.openexchange.folderstorage.database.preferDisplayName: "false"
--- a/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/open-xchange/values-postfix.yaml.gotmpl
@@ -55,6 +55,10 @@ postfix:
  {{- if .Values.apps.dkimpy.enabled }}
  dkimpyHost: "opendesk-dkimpy-milter.{{ .Release.Namespace }}.svc.{{.Values.cluster.networking.domain }}:8892"
  {{- end }}
+
+  minTLSVersion: "TLSv1.3"
+  smtpdTLSMandatoryCiphers: "high"
+
  rspamdHost: ""
  relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
  allowRelayNets: false
--- a/helmfile/apps/services-external/values-postfix.yaml.gotmpl
+++ b/helmfile/apps/services-external/values-postfix.yaml.gotmpl
@@ -65,8 +65,14 @@ postfix:
  {{- end }}
  rspamdHost: ""
  relayHost: {{ if .Values.smtp.host }}{{ printf "[%s]:%d" .Values.smtp.host .Values.smtp.port | quote }}{{ else }}""{{ end }}
+
+  # Warning: This setting allows unauthenticated mail relay from relayNets!
  relayNets: {{ join " " .Values.cluster.networking.cidr | quote }}
  allowRelayNets: true
+
+  minTLSVersion: "TLSv1.3"
+  smtpdTLSMandatoryCiphers: "high"
+
  smtpSASLAuthEnable: "yes"
  smtpSASLPasswordMaps: "lmdb:/etc/postfix/sasl_passwd.map"
  smtpTLSSecurityLevel: "encrypt"
--- a/helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/charts.yaml.gotmpl
@@ -6,12 +6,11 @@ charts:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/product-development/charts/opendesk-dovecot-pro"
    name: "dovecot"
-    version: "3.0.0"
+    version: "3.1.1"
    verify: true
  oxAppSuite:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/charts-mirror"
    name: "appsuite-public-sector-pro-chart"
-    version: "1.15.236"
+    version: "1.17.292"
    verify: false
-...
--- a/helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl
+++ b/helmfile/environments/default-enterprise-overrides/images.yaml.gotmpl
@@ -9,13 +9,13 @@ images:
  dovecot:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/dovecot-pro"
-    tag: "3.0.1-rev3@sha256:b87f16562dd486c0f97e8147a797af16a54f25f1ac64826f4f53bd8177ec9a33"
+    tag: "3.0.2-rev7@sha256:4330240bfeda4dd8b6aa32a6b7f03382126d47caf4f37a5578ad17746101c88b"
  nextcloud:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/nextcloud/images/opendesk-nextcloud"
-    tag: "1.2.0@sha256:ddd2bec74a22a713967f62fcdcf18fa8d53d730c1db296d570143754c93d20a5"
+    tag: "30.0.10@sha256:a63374dd44d3c6a8873da31fe0554b97fb29993a4cf18b9dd6a304b577f2f2b8"
  openxchangeCoreMW:
    registry: "registry.opencode.de"
    repository: "zendis/opendesk-enterprise/components/supplier/open-xchange/images-mirror/middleware-public-sector-pro"
-    tag: "8.35.85@sha256:54d01a16ea29a3ae8f1857e5bdf6d2e34046b8a3fa3d6179bb3ad3d047e1318f"
+    tag: "8.37.69@sha256:40908484e71bc45ad23598685b0519d82fc9e3cf372e00fe38befe9196cf84e2"
 ...
--- a/helmfile/environments/default/charts.yaml.gotmpl
+++ b/helmfile/environments/default/charts.yaml.gotmpl
@@ -99,7 +99,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/charts/opendesk-dovecot"
    name: "dovecot"
-    version: "3.0.0"
+    version: "3.1.1"
    verify: true
  element:
    # providerCategory: "Platform"
@@ -355,7 +355,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/charts-mirror"
    name: "openproject"
-    version: "9.10.1"
+    version: "10.0.3"
    verify: true
  openprojectBootstrap:
    # providerCategory: "Platform"
@@ -387,7 +387,7 @@ charts:
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/charts-mirror"
    name: "appsuite-public-sector"
-    version: "2.19.254"
+    version: "2.19.262"
    verify: false
  oxAppSuiteBootstrap:
    # providerCategory: "Platform"
--- a/helmfile/environments/default/global.generated.yaml.gotmpl
+++ b/helmfile/environments/default/global.generated.yaml.gotmpl
@@ -3,5 +3,5 @@
 ---
 global:
  systemInformation:
-    releaseVersion: "v1.4.0"
+    releaseVersion: "v1.5.0"
 ...
--- a/helmfile/environments/default/images.yaml.gotmpl
+++ b/helmfile/environments/default/images.yaml.gotmpl
@@ -20,7 +20,7 @@ images:
    # upstreamRepository: "bitnami/cassandra"
    registry: "registry-1.docker.io"
    repository: "bitnami/cassandra"
-    tag: "5.0.4-debian-12-r3@sha256:af57aa07f866673d4f605bc555e2699dfa7615de216d6a2d0cc607c81831ec2f"
+    tag: "5.0.4-debian-12-r4@sha256:9d909ebe10802dae2fb99ef7c8e9e0dbc496c8d30366e2f7abbe0713b945fa7d"
  cassandraExporter:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -84,7 +84,7 @@ images:
    # upstreamRepository: "alpine/k8s"
    registry: "registry-1.docker.io"
    repository: "alpine/k8s"
-    tag: "1.33.0@sha256:60333a52c38e9a8df0a9b93a5a24a4870f0db2c7ea3266b185386bd0a500d7dc"
+    tag: "1.33.1@sha256:7f8133af0dd210cb5b168f889c5bc77dd65ecc935f3e3cb72d1b98ff96bfed40"
  element:
    # providerCategory: "Supplier"
    # providerResponsible: "Element"
@@ -128,7 +128,7 @@ images:
    # providerResponsible: "Element"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-element-syncadmins"
-    tag: "1.0.3@sha256:1dea24d5f65a6f9ac63b402c772dd81dcd07a847d24845901c8a039461043097"
+    tag: "1.0.5@sha256:ae0e18eadea762e11f8edacc52285742a5c4ed6e2e92bfa32ec5638e377e7b7b"
  freshclam:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -320,7 +320,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud"
-    tag: "2.5.0@sha256:9457bc2116620e52dcd1f5f12f042090aa4cca2a3e4d5f64b7c84c232ca6bb63"
+    tag: "30.0.10@sha256:a022c6279072eb45d14cab29296860a15ad0d5801f50a56928334eb99bae50d0"
  nextcloudExporter:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -328,7 +328,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-exporter"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nextcloud-exporter"
-    tag: "1.0.1@sha256:63e63c7420e37d3989fa0ffdbcf18a07b2a603ab9b2a849c2e7e44342dd82af0"
+    tag: "1.0.3@sha256:d38f211a3cdc8397deccd0243061e20972a8a796eeb9bb552fe4ddec5d56c829"
  nginxS3Gateway:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
@@ -344,7 +344,7 @@ images:
    # upstreamRepository: "lasuite/impress-backend"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-notes"
-    tag: "1.7.0-docs-v2.4.0-backend@sha256:837e09dfcb4014de97b5254956dda899e586170276d1d0b0f94cca0685f3d2ef"
+    tag: "1.9.0-docs-v3.2.1-backend@sha256:17c16e4e00b15e4637d01553d56e7eecb7a477bec48677d1e7fb07b04c48d2b8"
  notesFrontend:
    # providerCategory: "Supplier"
    # providerResponsible: "DINUM"
@@ -352,7 +352,7 @@ images:
    # upstreamRepository: "lasuite/impress-frontend"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-notes"
-    tag: "1.7.0-docs-v2.4.0-frontend@sha256:98fb87ad877eb5658c6bef1c09adf4e03f816dce61867bc099838aca15890887"
+    tag: "1.9.0-docs-v3.2.1-frontend@sha256:328d5a8bf41875eb5945229adfc4a52eb2fef109e25d980910ee77edd4bc1887"
  notesYProvider:
    # providerCategory: "Supplier"
    # providerResponsible: "DINUM"
@@ -360,7 +360,7 @@ images:
    # upstreamRepository: "lasuite/impress-y-provider"
    registry: "registry-1.docker.io"
    repository: "lasuite/impress-y-provider"
-    tag: "v2.4.0@sha256:329d47f5cda80941a7f0812969c3194ba68da3e7e1ef38e3d08c266fc97555c1"
+    tag: "v3.2.1@sha256:9dd7068336c02fe71806bc3576e7dc8636d7ccb139667c6303f0753e18d3ab7e"
  nubusDataLoader:
    # providerCategory: "Supplier"
    # providerResponsible: "Univention"
@@ -530,7 +530,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/opendesk-nubus"
-    tag: "1.14.0@sha256:66ee00b6e44276f5f1e9d7a8066352fd5772820c50c10381acfd48c97f0acf4a"
+    tag: "1.14.4@sha256:cf0e22c1eef138a413a90a60c5405126dc769195dd4dd37229a27afaa82ef3b3"
  nubusOpendeskExtensionA2gMapper:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -730,7 +730,7 @@ images:
    # upstreamMirrorStartFrom: ["13", "1", "1"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/openproject/images-mirror/open_desk"
-    tag: "15.5.1@sha256:9ca328a30fc1e143fc1a34942836ff44923c05c327c27779e248767f2ce9ffc7"
+    tag: "16.0.1@sha256:c5b1172aed7e5e5ae21cca915e3349cc67fdf1366c9ded3c94db1ae5084e3841"
  openprojectBootstrap:
    # providerCategory: "Platform"
    # providerResponsible: "openDesk"
@@ -764,7 +764,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "6", "0"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/core-guidedtours"
-    tag: "8.6.15@sha256:f8ea7b3f4003b518c43b12118980d26d1258396f55848af6a64e7a3e7e103c1d"
+    tag: "8.6.17@sha256:27178fc42f2334385f1d206e4e7991d4953a102f114729d186b61c0d40babb4f"
  openxchangeCoreMW:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -774,7 +774,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "51"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/middleware-public-sector"
-    tag: "8.37.62@sha256:2eb5f4a472c329cbf170b6e7fba5790756dcc3f6360d5d36dfff5eb06b09f8c3"
+    tag: "8.37.69@sha256:dc06c7d9880505ad44ec7892ddf8f379fcd5f106ba1508436501c8f6e94dddb3"
  openxchangeCoreUI:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -814,7 +814,7 @@ images:
    # upstreamMirrorStartFrom: ["8", "20", "50"]
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/supplier/open-xchange/images-mirror/documentconverter"
-    tag: "8.37.1751@sha256:c1bbe271d6c0ba9ecc1bbb4ba2a944099f0ba90133dd4e6d3aecd0ea51b2e5bd"
+    tag: "8.37.1818@sha256:d9dc76ac6b24987c1fc0d95ffd81b3d594f7f34aa38a687b98c738bdcd110928"
  openxchangeGotenberg:
    # providerCategory: "Supplier"
    # providerResponsible: "Open-Xchange"
@@ -882,7 +882,7 @@ images:
    # upstreamRepository: "bmi/opendesk/components/platform-development/images/postfix"
    registry: "registry.opencode.de"
    repository: "bmi/opendesk/components/platform-development/images/postfix"
-    tag: "3.0.2@sha256:e65c6a70d2095a839c4337ef5dacefd42781641b7ac4dc202ff111881dae3716"
+    tag: "3.0.3@sha256:12bcebf57ddb53258c48eaa60e9c25b441f4319ee1b94b363c652ad0a992a875"
  postfixBootstrap:
    # providerCategory: "Community"
    # providerResponsible: "openDesk"
--- a/helmfile/environments/default/ingress.yaml.gotmpl
+++ b/helmfile/environments/default/ingress.yaml.gotmpl
@@ -12,6 +12,7 @@ ingress:
      collabora: "100M"
      element: "100M"
      nextcloud: "100M"
+      notes: "100M"
      openproject: "100M"
      oxAppSuite: "100M"
      xwiki: "100M"
@@ -19,6 +20,7 @@ ingress:
      collabora: 600
      element: 60
      nextcloud: 600
+      notes: 60
      openproject: 60
      oxAppSuite: 60
      xwiki: 60
--- a/helmfile/files/theme/portal/stylesheet.css
+++ b/helmfile/files/theme/portal/stylesheet.css
@@ -97,41 +97,6 @@
  --login-logo: url("/static-files/login/logo.svg") no-repeat center;
 }

-/* Beta overlay for Notes */
-.portal-tile[target="tab_notes"]:before {
-  position: absolute;
-  content: "Beta";
-  color: #571EFA;
-  transform: rotate(45deg);
-  top: 8px;
-  right: 0px;
-  font-size: var(--font-size-5);
-  font-weight: bold;
-  z-index: 1;
-}
-
-@media screen and (max-width: 748px) {
-  .portal-tile[target="tab_notes"]:before {
-      top: 5px;
-      font-size: 10px;
-  }
-  .portal-tile__name {
-      font-size: 13px;
-  }
-}
-
-.portal-tile[target="tab_notes"]:after {
-  position: absolute;
-  content: "";
-  top: 1px;
-  right: 1px;
-  border-style: solid;
-  border-width: 0 calc(var(--app-tile-side-length) / 2) calc(var(--app-tile-side-length) / 2) 0;
-  border-color: transparent #E9E4FC transparent transparent;
-  z-index: 0;
-  border-top-right-radius: calc(var(--border-radius-apptile) - 1px);
-}
-
 /* Keycloak user screens begin */
 #kc-login,
 #kc-logout,
@@ -145,6 +110,13 @@
  color: var(--color-opendesk-white) !important;
 }

+#social-sso-federation-idp {
+    margin: 0;
+    color: var(--color-opendesk-white);
+    background-color: var(--pf-c-button--m-primary--BackgroundColor);
+    border-radius: var(--border-radius-interactable, 0.25rem);
+}
+
 #kc-login:hover,
 #kc-logout:hover,
 #saveTOTPBtn:hover,
--- a/publiccode.yml
+++ b/publiccode.yml
@@ -22,7 +22,7 @@ name: "openDesk"
 platforms:
  - "web"
 developmentStatus: "stable"
-softwareVersion: "1.3.1"
+softwareVersion: "1.5.0"
 releaseDate: "2025-04-23"
 softwareType: "standalone/web"
 url: "https://gitlab.opencode.de/bmi/opendesk/"
Author	SHA1	Message	Date
Niels Lindenthal	58fbf4644e	Add reference to work package in opendesk.family so the MR is shown in the GitLab tab	2025-06-25 09:27:57 +00:00
Niels Lindenthal	3df9342b31	chore(changelog): Fix typo in component name `open-xchange`	2025-06-18 10:17:15 +02:00
Thorsten Roßner	6baec0b587	chore(reuse): Annotate merge request templates in REUSE.toml	2025-06-16 16:38:48 +02:00
René Fischer	5a3e47ea5d	chore(merge_request_templates): Add merge request templates	2025-06-16 14:35:49 +02:00
Thorsten Roßner	74c4cc309d	chore(notes): Remove "Beta" label from portal tile	2025-06-16 10:27:17 +02:00
Thorsten Roßner	feaaa81094	chore(release): 1.5.0 [skip ci] # [1.5.0](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.4.1...v1.5.0) (2025-06-16) ### Bug Fixes * dovecot: Enable Dovecot ACL for CE (file) & EE (cassandra) ([`9354ee7`](`9354ee7196`)) * notes: Support templating of Ingress annotations `bodyTimeout` and `bodySize` to allow application defined upload limits to be reached ([`69faf77`](`69faf77d15`)) * nubus: Create required LDAP objects for `global.additionalMailDomains` ([`4dcb683`](`4dcb683118`)) * nubus: Explicitly template security context for Keycloak proxy ([`e959438`](`e9594382ed`)) * nubus: Update CSS for login screen to show login button for federated IdP ([`0d4e1b0`](`0d4e1b01e3`)) * nubus: Use read-only root filesystem for Keycloak bootstrap ([`1edd7c3`](`1edd7c3f06`)) * open-xchange: Enabled mail login resolver ([`7547f49`](`7547f4948e`)) * open-xchange: Update Dovecot CE chart to support ACLs (mailbox sharing) and usernames different from local part of mail address ([`87c30ab`](`87c30ab8e3`)) * open-xchange: Use login name instead of email between OX and Dovecot ([`8e9ef08`](`8e9ef0867b`)) * openproject: Update from 16.0.0 to 16.0.1 ([`b60f9c7`](`b60f9c7576`)) * openxchange: Update App Suite 8.37 to latest patch level (8.37.69) ([`bc436b2`](`bc436b2485`)) ### Features * ci: Update Helm to 3.18.1 and Helmfile to 1.1.1 ([`59a4086`](`59a40864ed`)) * notes: Update from 2.4.0 to 3.2.1 ([`9f4e3c8`](`9f4e3c86c7`)) * open-xchange: Support for `mailAlternativAddress`(es) for sending and receiving emails ([`6d6b1a6`](`6d6b1a6dd7`)) * openproject: Update from 15.5.1 to 16.0.0 including Helm chart update ([`add7266`](`add72669ae`))	2025-06-16 08:03:51 +00:00
Thorsten Roßner	03f414ffaf	chore(publiccode.yml): Update version number to 1.5.0	2025-06-16 08:38:18 +02:00
Thorsten Roßner	f773a9371c	ci(diff-on-branch): Merge doublette `variables` block	2025-06-16 08:36:25 +02:00
rweber	69faf77d15	fix(notes): Support templating of Ingress annotations `bodyTimeout` and `bodySize` to allow application defined upload limits to be reached	2025-06-16 08:36:25 +02:00
rweber	9f4e3c86c7	feat(notes): Update from 2.4.0 to 3.2.1	2025-06-16 08:36:25 +02:00
Thorsten Roßner	e06642f6b6	ci(diff-on-branch): Update to ensure opendesk-env files are loaded	2025-06-16 08:36:25 +02:00
Thorsten Roßner	0d4e1b01e3	fix(nubus): Update CSS for login screen to show login button for federated IdP	2025-06-16 08:36:25 +02:00
Viktor Pracht	bc436b2485	fix(openxchange): Update App Suite 8.37 to latest patch level (8.37.69)	2025-06-16 08:35:28 +02:00
René Fischer	3b9fd4eb99	docs(README-EE.md): Add link to enterprise_keys.yml.gotmpl	2025-06-16 08:35:28 +02:00
Yannik Schmidt	e9594382ed	fix(nubus): Explicitly template security context for Keycloak proxy	2025-06-16 08:35:28 +02:00
Timo Hollwedel	1edd7c3f06	fix(nubus): Use read-only root filesystem for Keycloak bootstrap	2025-06-16 08:35:28 +02:00
Thomas Kaltenbrunner	6d6b1a6dd7	feat(open-xchange): Support for `mailAlternativAddress`(es) for sending and receiving emails	2025-06-16 08:35:28 +02:00
Christophe Bliard	b60f9c7576	fix(openproject): Update from 16.0.0 to 16.0.1	2025-06-16 08:35:28 +02:00
Thorsten Roßner	4dcb683118	fix(nubus): Create required LDAP objects for `global.additionalMailDomains`	2025-06-16 08:35:28 +02:00
Thorsten Roßner	bc8028dd93	ci: Add `diff-on-branch` feature	2025-06-16 08:35:28 +02:00
Thorsten Roßner	e143a9c9d8	chore(helmfile): Bump images of `opendesk-element-syncadmins`, `opendesk-nextcloud-exporter` and `postfix` to current builds using the gitlab-config v2.4.10 to avoid layer mimetype issues when mirroring images	2025-06-16 08:35:28 +02:00
Thomas Kaltenbrunner	9354ee7196	fix(dovecot): Enable Dovecot ACL for CE (file) & EE (cassandra)	2025-06-16 08:35:28 +02:00
Viktor Pracht	8e9ef0867b	fix(open-xchange): Use login name instead of email between OX and Dovecot	2025-06-16 08:35:28 +02:00
Thorsten Roßner	87c30ab8e3	fix(open-xchange): Update Dovecot CE chart to support ACLs (mailbox sharing) and usernames different from local part of mail address	2025-06-16 08:35:28 +02:00
Viktor Pracht	7547f4948e	fix(open-xchange): Enabled mail login resolver	2025-06-16 08:35:28 +02:00
Viktor Pracht	b608a610fe	chore(openxchange): Updated OX App Suite Pro charts only to 8.37	2025-06-16 08:35:09 +02:00
Thorsten Roßner	59a40864ed	feat(ci): Update Helm to 3.18.1 and Helmfile to 1.1.1	2025-06-03 07:42:45 +00:00
Markus Kahl	add72669ae	feat(openproject): Update from 15.5.1 to 16.0.0 including Helm chart update	2025-06-03 06:49:58 +00:00
Thorsten Roßner	fe510fa679	chore(helmfile): Post release update of `global.generated.yaml.gotmpl`	2025-06-02 10:10:32 +02:00
Thorsten Roßner	805cdf26ae	chore(release): 1.4.1 [skip ci] ## [1.4.1](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v1.4.0...v1.4.1) (2025-06-02) ### Bug Fixes * nextcloud: Update NC CE to 30.0.10 ([`785be8b`](`785be8b662`)) * nextcloud: Update Nextcloud incl. apps to 30.0.10 ([`559fbf6`](`559fbf6801`)) * nubus: Use `.Values.theme.texts.productName` for Keycloak's `loginTitle` instead of static product name string ([`d1a1e5d`](`d1a1e5dc29`)) * open-xchange: Re-adding `com.openexchange.oauth.provider.` to fix central contacts feature ([`561e44f`](`561e44fd4c`)) open-xchange: Set `com.openexchange.hostname` to get working links in outgoing system mails (e.g. task assignments) ([`0d61687`](`0d616871e3`)) * postfix: Require TLSv1.3 ([`3b3d8ac`](`3b3d8aca54`)) * requirements.md: Helm 3.18.x is not supported due to upstream bug ([`1ea9cae`](`1ea9cae1ce`))	2025-06-02 08:01:20 +00:00
Thorsten Roßner	559fbf6801	fix(nextcloud): Update Nextcloud incl. apps to 30.0.10	2025-06-02 07:05:58 +02:00
Thorsten Roßner	561e44fd4c	fix(open-xchange): Re-adding `com.openexchange.oauth.provider.*` to fix central contacts feature	2025-06-02 07:05:58 +02:00
Thomas Kaltenbrunner	0d616871e3	fix(open-xchange): Set `com.openexchange.hostname` to get working links in outgoing system mails (e.g. task assignments)	2025-06-02 07:05:58 +02:00
Thorsten Roßner	b185fe055c	docs(migrations.md): [#188 ] Update to point out requirement for IdP federation configuration	2025-06-02 07:05:58 +02:00
Thorsten Roßner	d1a1e5dc29	fix(nubus): Use `.Values.theme.texts.productName` for Keycloak's `loginTitle` instead of static product name string	2025-06-02 07:05:58 +02:00
Tilman Lüttje	1ea9cae1ce	fix(requirements.md): Helm 3.18.x is not supported due to upstream bug	2025-06-02 07:05:52 +02:00
Thomas Kaltenbrunner	3b3d8aca54	fix(postfix): Require TLSv1.3	2025-05-30 17:02:07 +02:00
Tilman Lüttje	785be8b662	fix(nextcloud): Update NC CE to 30.0.10	2025-05-30 17:01:45 +02:00