[stable28] chore(deps): Bump deepdiver/zipstreamer by @susnux in https://github.com/nextcloud/server/pull/45896
[stable28] fix(files): Properly handle denied ownership transfers by @backportbot in https://github.com/nextcloud/server/pull/45905
[stable28] fix(files_versions): renaming file version when its not a string by @susnux in https://github.com/nextcloud/server/pull/46092
[stable28] fix(security): Update code signing revocation list by @nextcloud-command in https://github.com/nextcloud/server/pull/46155
[stable28] fix(caldav): When message is a reply compare the message sender not the recipient by @backportbot in https://github.com/nextcloud/server/pull/46145
[stable28] fix(openapi): Regenerate OpenAPI after server changes by @nickvergessen in https://github.com/nextcloud/server/pull/46164
[stable28] fix: avoid duplicate tag inserts by checking if the mapping exists already in db by @backportbot in https://github.com/nextcloud/server/pull/45994
[stable28] Update favorites navigation list on folder renames by @backportbot in https://github.com/nextcloud/server/pull/46138
[stable28] fix(files_sharing): Also set the expiration date timezone during validation by @backportbot in https://github.com/nextcloud/server/pull/46141
[stable28] fix: getMountsForFileId may return an unordered list by @backportbot in https://github.com/nextcloud/server/pull/46214
[stable28] feat(files): increase max copy-move concurrency to 5 by @backportbot in https://github.com/nextcloud/server/pull/46129
[stable28] Don't trigger action when renaming by @backportbot in https://github.com/nextcloud/server/pull/46019
[stable28] Rename openFileInfo to fileInfo by @backportbot in https://github.com/nextcloud/server/pull/45987
build(deps-dev): Bump karma-coverage from 2.2.0 to 2.2.1 by @dependabot in https://github.com/nextcloud/server/pull/46241
build(deps-dev): Bump @types/dockerode from 3.3.28 to 3.3.29 by @dependabot in https://github.com/nextcloud/server/pull/46243
build(deps-dev): Bump cypress from 13.7.2 to 13.7.3 by @dependabot in https://github.com/nextcloud/server/pull/46245
[stable28] fix(setupchecks): skip check when disk_free_space is disabled by @backportbot in https://github.com/nextcloud/server/pull/46223
[stable28] fix(security): Update CA certificate bundle by @nextcloud-command in https://github.com/nextcloud/server/pull/46265
[stable28] chore: upgrade @nextcloud/files and @nextcloud/sharing by @skjnldsv in https://github.com/nextcloud/server/pull/46236
[stable28] fix(ExternalSharing): Handle template shares from external sources by @backportbot in https://github.com/nextcloud/server/pull/46280
[stable28] fix(DAV): offset not applied by @blizzz in https://github.com/nextcloud/server/pull/46221
[stable28] fix(settings): Use axios directly for health check to preven URL sanitizing by @backportbot in https://github.com/nextcloud/server/pull/45770
[stable28] build(deps): Bump @nextcloud/vue from 8.11.2 to 8.14.0 by @dependabot in https://github.com/nextcloud/server/pull/46239
chore(deps-dev): bump jsdoc from 4.0.2 to 4.0.3 by @dependabot in https://github.com/nextcloud/server/pull/46336
chore(deps-dev): bump ts-jest from 29.1.2 to 29.1.5 by @dependabot in https://github.com/nextcloud/server/pull/46338
chore(deps-dev): bump mime from 4.0.1 to 4.0.4 by @dependabot in https://github.com/nextcloud/server/pull/46337
chore(deps): bump dompurify from 3.1.4 to 3.1.6 by @dependabot in https://github.com/nextcloud/server/pull/46335
[stable28] chore(mp3info): apply upstream patch for invalid array access by @backportbot in https://github.com/nextcloud/server/pull/46341
[stable28] fix(FilesView): Update files view upon share creation/delete by @backportbot in https://github.com/nextcloud/server/pull/46118
[stable28] fix(s3): Don't wait indefinitely for S3 to return by @backportbot in https://github.com/nextcloud/server/pull/46366
[stable28] fix(SharingDetailsView): Prevent illegal unselection of read permissions by @backportbot in https://github.com/nextcloud/server/pull/46364
[stable28] fix(SetupCheck): jsm test shall not give up with first no-response by @blizzz in https://github.com/nextcloud/server/pull/46302
[stable28] fix(IntegrityCheck): Ensure the check is run if no results are available by @backportbot in https://github.com/nextcloud/server/pull/46297
[stable28] fix(cron): Log long running jobs by @backportbot in https://github.com/nextcloud/server/pull/46191
[stable28] sidebar: allow turning off tags view by default by @solracsf in https://github.com/nextcloud/server/pull/46316
build(deps): Bump @nextcloud/calendar-availability-vue from 2.2.0 to 2.2.2 by @dependabot in https://github.com/nextcloud/server/pull/46238
[stable28] fix(carddav): limit vcard size by @backportbot in https://github.com/nextcloud/server/pull/46313
[stable28] fix(caldav): encode calendar URIs with umlauts for activities by @backportbot in https://github.com/nextcloud/server/pull/46011
[stable28] delete background jobs by id when cleaning up by @backportbot in https://github.com/nextcloud/server/pull/45920
[stable28] fix: don't use custom certificate bundle if no customer certificates are configured by @backportbot in https://github.com/nextcloud/server/pull/46067
[stable28] fix(settings): define a 'heartbeat' route, so SecurityHeaders can handle redirected root by @backportbot in https://github.com/nextcloud/server/pull/45955
[stable28] fix(files_trashbin): Make files view registering an init script by @susnux in https://github.com/nextcloud/server/pull/46417
[stable28] fix(workflows): Fix file systemtag cache by @backportbot in https://github.com/nextcloud/server/pull/46411
[stable28] Fix npm audit by @nextcloud-command in https://github.com/nextcloud/server/pull/45891
[stable28] perf: Set session.cache_limiter at runtime to avoid clients caching static assets served by PHP by @backportbot in https://github.com/nextcloud/server/pull/46394
[stable28] test: run tests in child process by @kesselb in https://github.com/nextcloud/server/pull/46430
[stable28] fix(caldav): limit vevent size by @backportbot in https://github.com/nextcloud/server/pull/46421
[stable28] fix(theming): Don't reset the cachebuster value when we reset theming by @backportbot in https://github.com/nextcloud/server/pull/46433
[stable28] fix(Session): avoid race conditions on clustered setups by @backportbot in https://github.com/nextcloud/server/pull/46436
[stable28] fix: Update Nextcloud libraries by @backportbot in https://github.com/nextcloud/server/pull/46422
[stable28] fix: Do not log an error when connecting to SFTP without a logged in user by @backportbot in https://github.com/nextcloud/server/pull/46060
[stable28] feat: don't count failed CSRF as failed login attempt by @backportbot in https://github.com/nextcloud/server/pull/46442
[stable28] fix: allows admin to edit global credentials by @backportbot in https://github.com/nextcloud/server/pull/46090
[stable28] fix: don't return null for SharedStorage::getWrapperStorage with share recursion by @backportbot in https://github.com/nextcloud/server/pull/44323
[stable28] fix(theming): Conitionally disable blur filter for performance by @backportbot in https://github.com/nextcloud/server/pull/46431
28.0.8 RC1 by @Altahrim in https://github.com/nextcloud/server/pull/46390

Full Changelog: https://github.com/nextcloud/server/compare/v28.0.7...v28.0.8rc1