Repository: owncloud/ocis
Pull request #9377 (2024-06-13 13:24:51)

enhancement: bump reva and remove explicit automount mountpoint naming
## Description
bumps reva, as a side-effect it removes the explicit automount mountpoint naming

## Related Issue
- https://github.com/cs3org/reva/pull/4714
- https://github.com/cs3org/reva/pull/4723
- https://github.com/owncloud/ocis/issues/8961

## How Has This Been Tested?
- ci tests

## Types of changes
- [X] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] Technical debt
- [ ] Tests only (no source changes)

sonarcloud[bot]: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=9377) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=9377&resolved=false&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=9377&resolutions=WONTFIX)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=9377&resolved=false&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=9377&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=9377&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=9377)


sonarcloud[bot]: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=9377) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=9377&resolved=false&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=9377&resolutions=WONTFIX)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=9377&resolved=false&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=9377&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=9377&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=9377)



Patch:
diff --git a/.drone.star b/.drone.star
index e7b1f09452b..533aca9845c 100644
--- a/.drone.star
+++ b/.drone.star
@@ -1294,7 +1294,7 @@ def dockerReleases(ctx):
         for arch in config["dockerReleases"]["architectures"]:
             repo_pipelines.append(dockerRelease(ctx, arch, repo, build_type))
 
-        manifest = releaseDockerManifest(ctx, repo, build_type)
+        manifest = releaseDockerManifest(repo, build_type)
         manifest["depends_on"] = getPipelineNames(repo_pipelines)
         repo_pipelines.append(manifest)
 
@@ -1309,7 +1309,7 @@ def dockerReleases(ctx):
 def dockerRelease(ctx, arch, repo, build_type):
     build_args = [
         "REVISION=%s" % (ctx.build.commit),
-        "VERSION=%s" % (ctx.build.ref.replace("refs/tags/", "") if ctx.build.event == "tag" else "master"),
+        "VERSION=%s" % (ctx.build.ref.replace("refs/tags/", "") if ctx.build.event == "tag" else "latest"),
     ]
     depends_on = getPipelineNames(testOcisAndUploadResults(ctx) + testPipelines(ctx))
 
@@ -1686,34 +1686,22 @@ def licenseCheck(ctx):
         "volumes": [pipelineVolumeGo],
     }]
 
-def releaseDockerManifest(ctx, repo, build_type):
+def releaseDockerManifest(repo, build_type):
     spec = "manifest.tmpl"
-    spec_latest = "manifest-latest.tmpl"
     if "rolling" not in repo:
-        spec = "manifest.production.tmpl"
-        spec_latest = "manifest.production-latest.tmpl"
+        spec = "manifest-production.tmpl"
 
-    steps = [
-        {
-            "name": "execute",
-            "image": PLUGINS_MANIFEST,
-            "settings": {
-                "username": {
-                    "from_secret": "docker_username",
-                },
-                "password": {
-                    "from_secret": "docker_password",
-                },
-                "spec": "ocis/docker/%s" % spec,
-                "auto_tag": True if ctx.build.event == "tag" else False,
-                "ignore_missing": True,
-            },
+    return {
+        "kind": "pipeline",
+        "type": "docker",
+        "name": "manifest-%s" % build_type,
+        "platform": {
+            "os": "linux",
+            "arch": "amd64",
         },
-    ]
-    if len(ctx.build.ref.split("-")) == 1:
-        steps.append(
+        "steps": [
             {
-                "name": "execute-latest",
+                "name": "execute",
                 "image": PLUGINS_MANIFEST,
                 "settings": {
                     "username": {
@@ -1722,27 +1710,12 @@ def releaseDockerManifest(ctx, repo, build_type):
                     "password": {
                         "from_secret": "docker_password",
                     },
-                    "spec": "ocis/docker/%s" % spec_latest,
+                    "spec": "ocis/docker/%s" % spec,
                     "auto_tag": True,
                     "ignore_missing": True,
                 },
-                "when": {
-                    "ref": [
-                        "refs/tags/v*",
-                    ],
-                },
             },
-        )
-
-    return {
-        "kind": "pipeline",
-        "type": "docker",
-        "name": "manifest-%s" % build_type,
-        "platform": {
-            "os": "linux",
-            "arch": "amd64",
-        },
-        "steps": steps,
+        ],
         "trigger": {
             "ref": [
                 "refs/heads/master",
diff --git a/changelog/unreleased/bump-reva.md b/changelog/unreleased/bump-reva.md
index bbae0003245..ee203b6bdd3 100644
--- a/changelog/unreleased/bump-reva.md
+++ b/changelog/unreleased/bump-reva.md
@@ -2,6 +2,7 @@ Enhancement: Bump Reva
 
 bumps reva version
 
+https://github.com/owncloud/ocis/pull/9377
 https://github.com/owncloud/ocis/pull/9330
 https://github.com/owncloud/ocis/pull/9318
 https://github.com/owncloud/ocis/pull/9269
diff --git a/deployments/examples/ocis_keycloak/config/keycloak/clients/android_app.json b/deployments/examples/ocis_keycloak/config/keycloak/clients/android_app.json
index 0dd4106e3f4..438b62508de 100644
--- a/deployments/examples/ocis_keycloak/config/keycloak/clients/android_app.json
+++ b/deployments/examples/ocis_keycloak/config/keycloak/clients/android_app.json
@@ -1,64 +1,62 @@
 {
-  "clientId": "e4rAsNUSIUs0lF4nbv9FmCeUkTlV9GdgTLDH1b5uie7syb90SzEVrbN7HIpmWJeD",
-  "name": "ownCloud Android app",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "secret": "dInFYGV33xKzhbRmpqQltYNdfLdJIfJ9L5ISoKhNoT9qZftpdWSP71VrpGR9pmoD",
-  "redirectUris": [
-    "oc://android.owncloud.com"
-  ],
-  "webOrigins": [],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": true,
-  "serviceAccountsEnabled": false,
-  "publicClient": false,
-  "frontchannelLogout": false,
-  "protocol": "openid-connect",
-  "attributes": {
-    "saml.assertion.signature": "false",
-    "saml.force.post.binding": "false",
-    "saml.multivalued.roles": "false",
-    "saml.encrypt": "false",
-    "post.logout.redirect.uris": "+",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "saml.server.signature": "false",
-    "saml.server.signature.keyinfo.ext": "false",
-    "exclude.session.state.from.auth.response": "false",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "saml_force_name_id_format": "false",
-    "saml.client.signature": "false",
-    "tls.client.certificate.bound.access.tokens": "false",
-    "saml.authnstatement": "false",
-    "display.on.consent.screen": "false",
-    "saml.onetimeuse.condition": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "profile",
-    "roles",
-    "groups",
-    "basic",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ],
-  "access": {
-    "view": true,
-    "configure": true,
-    "manage": true
-  }
-}
\ No newline at end of file
+    "clientId": "e4rAsNUSIUs0lF4nbv9FmCeUkTlV9GdgTLDH1b5uie7syb90SzEVrbN7HIpmWJeD",
+    "name": "ownCloud Android app",
+    "surrogateAuthRequired": false,
+    "enabled": true,
+    "alwaysDisplayInConsole": false,
+    "clientAuthenticatorType": "client-secret",
+    "secret" : "dInFYGV33xKzhbRmpqQltYNdfLdJIfJ9L5ISoKhNoT9qZftpdWSP71VrpGR9pmoD",
+    "redirectUris": [
+        "oc://android.owncloud.com"
+    ],
+    "webOrigins": [],
+    "notBefore": 0,
+    "bearerOnly": false,
+    "consentRequired": false,
+    "standardFlowEnabled": true,
+    "implicitFlowEnabled": false,
+    "directAccessGrantsEnabled": true,
+    "serviceAccountsEnabled": false,
+    "publicClient": false,
+    "frontchannelLogout": false,
+    "protocol": "openid-connect",
+    "attributes": {
+        "saml.assertion.signature": "false",
+        "saml.force.post.binding": "false",
+        "saml.multivalued.roles": "false",
+        "saml.encrypt": "false",
+        "backchannel.logout.revoke.offline.tokens": "false",
+        "saml.server.signature": "false",
+        "saml.server.signature.keyinfo.ext": "false",
+        "exclude.session.state.from.auth.response": "false",
+        "backchannel.logout.session.required": "true",
+        "client_credentials.use_refresh_token": "false",
+        "saml_force_name_id_format": "false",
+        "saml.client.signature": "false",
+        "tls.client.certificate.bound.access.tokens": "false",
+        "saml.authnstatement": "false",
+        "display.on.consent.screen": "false",
+        "saml.onetimeuse.condition": "false"
+    },
+    "authenticationFlowBindingOverrides": {},
+    "fullScopeAllowed": true,
+    "nodeReRegistrationTimeout": -1,
+    "defaultClientScopes": [
+        "web-origins",
+        "role_list",
+        "profile",
+        "roles",
+        "email"
+    ],
+    "optionalClientScopes": [
+        "address",
+        "phone",
+        "offline_access",
+        "microprofile-jwt"
+    ],
+    "access": {
+        "view": true,
+        "configure": true,
+        "manage": true
+    }
+}
diff --git a/deployments/examples/ocis_keycloak/config/keycloak/clients/cyberduck.json b/deployments/examples/ocis_keycloak/config/keycloak/clients/cyberduck.json
index 85a4e72c5cd..50da0dfecc3 100644
--- a/deployments/examples/ocis_keycloak/config/keycloak/clients/cyberduck.json
+++ b/deployments/examples/ocis_keycloak/config/keycloak/clients/cyberduck.json
@@ -1,67 +1,63 @@
 {
-  "clientId": "3keLfua0olYvW1zKXTDB3OjAMPEYWEQNuiscli395GKJOiPnPURNQWGvGCJZf4Hw",
-  "name": "Cyberduck",
-  "description": "",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "secret": "yoqICbLIeYbpZPqDH4D8k4NKb04HqnrWBntEeVZEQ5gO1RmaUlln0Aqu1dj2UoF4",
-  "redirectUris": [
-    "x-cyberduck-action:oauth",
-    "x-mountainduck-action:oauth"
-  ],
-  "webOrigins": [],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": true,
-  "serviceAccountsEnabled": false,
-  "publicClient": false,
-  "frontchannelLogout": false,
-  "protocol": "openid-connect",
-  "attributes": {
-    "saml.assertion.signature": "false",
-    "saml.force.post.binding": "false",
-    "saml.multivalued.roles": "false",
-    "saml.encrypt": "false",
-    "oauth2.device.authorization.grant.enabled": "false",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "saml.server.signature": "false",
-    "saml.server.signature.keyinfo.ext": "false",
-    "exclude.session.state.from.auth.response": "false",
-    "oidc.ciba.grant.enabled": "false",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "saml_force_name_id_format": "false",
-    "saml.client.signature": "false",
-    "tls.client.certificate.bound.access.tokens": "false",
-    "saml.authnstatement": "false",
-    "display.on.consent.screen": "false",
-    "saml.onetimeuse.condition": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "profile",
-    "roles",
-    "groups",
-    "basic",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ],
-  "access": {
-    "view": true,
-    "configure": true,
-    "manage": true
-  }
-}
\ No newline at end of file
+    "clientId": "3keLfua0olYvW1zKXTDB3OjAMPEYWEQNuiscli395GKJOiPnPURNQWGvGCJZf4Hw",
+    "name": "Cyberduck",
+    "surrogateAuthRequired": false,
+    "enabled": true,
+    "alwaysDisplayInConsole": false,
+    "clientAuthenticatorType": "client-secret",
+    "secret" : "yoqICbLIeYbpZPqDH4D8k4NKb04HqnrWBntEeVZEQ5gO1RmaUlln0Aqu1dj2UoF4",
+    "redirectUris": [
+        "x-cyberduck-action:oauth",
+        "x-mountainduck-action:oauth"
+    ],
+    "webOrigins": [],
+    "notBefore": 0,
+    "bearerOnly": false,
+    "consentRequired": false,
+    "standardFlowEnabled": true,
+    "implicitFlowEnabled": false,
+    "directAccessGrantsEnabled": true,
+    "serviceAccountsEnabled": false,
+    "publicClient": false,
+    "frontchannelLogout": false,
+    "protocol": "openid-connect",
+    "attributes": {
+        "saml.assertion.signature": "false",
+        "saml.force.post.binding": "false",
+        "saml.multivalued.roles": "false",
+        "saml.encrypt": "false",
+        "backchannel.logout.revoke.offline.tokens": "false",
+        "saml.server.signature": "false",
+        "saml.server.signature.keyinfo.ext": "false",
+        "exclude.session.state.from.auth.response": "false",
+        "backchannel.logout.session.required": "true",
+        "client_credentials.use_refresh_token": "false",
+        "saml_force_name_id_format": "false",
+        "saml.client.signature": "false",
+        "tls.client.certificate.bound.access.tokens": "false",
+        "saml.authnstatement": "false",
+        "display.on.consent.screen": "false",
+        "saml.onetimeuse.condition": "false"
+    },
+    "authenticationFlowBindingOverrides": {},
+    "fullScopeAllowed": true,
+    "nodeReRegistrationTimeout": -1,
+    "defaultClientScopes": [
+        "web-origins",
+        "role_list",
+        "profile",
+        "roles",
+        "email"
+    ],
+    "optionalClientScopes": [
+        "address",
+        "phone",
+        "offline_access",
+        "microprofile-jwt"
+    ],
+    "access": {
+        "view": true,
+        "configure": true,
+        "manage": true
+    }
+}
diff --git a/deployments/examples/ocis_keycloak/config/keycloak/clients/desktop_client.json b/deployments/examples/ocis_keycloak/config/keycloak/clients/desktop_client.json
index 0aeb310097d..85ead935493 100644
--- a/deployments/examples/ocis_keycloak/config/keycloak/clients/desktop_client.json
+++ b/deployments/examples/ocis_keycloak/config/keycloak/clients/desktop_client.json
@@ -1,65 +1,63 @@
 {
-  "clientId": "xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69",
-  "name": "ownCloud Desktop Client",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "secret": "UBntmLjC2yYCeHwsyj73Uwo9TAaecAetRwMw0xYcvNL9yRdLSUi0hUAHfvCHFeFh",
-  "redirectUris": [
-    "http://127.0.0.1:*",
-    "http://localhost:*"
-  ],
-  "webOrigins": [],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": true,
-  "serviceAccountsEnabled": false,
-  "publicClient": false,
-  "frontchannelLogout": false,
-  "protocol": "openid-connect",
-  "attributes": {
-    "saml.assertion.signature": "false",
-    "saml.force.post.binding": "false",
-    "saml.multivalued.roles": "false",
-    "saml.encrypt": "false",
-    "post.logout.redirect.uris": "+",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "saml.server.signature": "false",
-    "saml.server.signature.keyinfo.ext": "false",
-    "exclude.session.state.from.auth.response": "false",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "saml_force_name_id_format": "false",
-    "saml.client.signature": "false",
-    "tls.client.certificate.bound.access.tokens": "false",
-    "saml.authnstatement": "false",
-    "display.on.consent.screen": "false",
-    "saml.onetimeuse.condition": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "profile",
-    "roles",
-    "groups",
-    "basic",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ],
-  "access": {
-    "view": true,
-    "configure": true,
-    "manage": true
-  }
-}
\ No newline at end of file
+    "clientId": "xdXOt13JKxym1B1QcEncf2XDkLAexMBFwiT9j6EfhhHFJhs2KM9jbjTmf8JBXE69",
+    "name": "ownCloud desktop client",
+    "surrogateAuthRequired": false,
+    "enabled": true,
+    "alwaysDisplayInConsole": false,
+    "clientAuthenticatorType": "client-secret",
+    "secret" : "UBntmLjC2yYCeHwsyj73Uwo9TAaecAetRwMw0xYcvNL9yRdLSUi0hUAHfvCHFeFh",
+    "redirectUris": [
+        "http://127.0.0.1:*",
+        "http://localhost:*"
+    ],
+    "webOrigins": [],
+    "notBefore": 0,
+    "bearerOnly": false,
+    "consentRequired": false,
+    "standardFlowEnabled": true,
+    "implicitFlowEnabled": false,
+    "directAccessGrantsEnabled": true,
+    "serviceAccountsEnabled": false,
+    "publicClient": false,
+    "frontchannelLogout": false,
+    "protocol": "openid-connect",
+    "attributes": {
+        "saml.assertion.signature": "false",
+        "saml.force.post.binding": "false",
+        "saml.multivalued.roles": "false",
+        "saml.encrypt": "false",
+        "backchannel.logout.revoke.offline.tokens": "false",
+        "saml.server.signature": "false",
+        "saml.server.signature.keyinfo.ext": "false",
+        "exclude.session.state.from.auth.response": "false",
+        "backchannel.logout.session.required": "true",
+        "client_credentials.use_refresh_token": "false",
+        "saml_force_name_id_format": "false",
+        "saml.client.signature": "false",
+        "tls.client.certificate.bound.access.tokens": "false",
+        "saml.authnstatement": "false",
+        "display.on.consent.screen": "false",
+        "saml.onetimeuse.condition": "false"
+    },
+    "authenticationFlowBindingOverrides": {},
+    "fullScopeAllowed": true,
+    "nodeReRegistrationTimeout": -1,
+    "defaultClientScopes": [
+        "web-origins",
+        "role_list",
+        "profile",
+        "roles",
+        "email"
+    ],
+    "optionalClientScopes": [
+        "address",
+        "phone",
+        "offline_access",
+        "microprofile-jwt"
+    ],
+    "access": {
+        "view": true,
+        "configure": true,
+        "manage": true
+    }
+}
diff --git a/deployments/examples/ocis_keycloak/config/keycloak/clients/ios_app.json b/deployments/examples/ocis_keycloak/config/keycloak/clients/ios_app.json
index ec879ec7027..8e753f6cc59 100644
--- a/deployments/examples/ocis_keycloak/config/keycloak/clients/ios_app.json
+++ b/deployments/examples/ocis_keycloak/config/keycloak/clients/ios_app.json
@@ -1,64 +1,62 @@
 {
-  "clientId": "mxd5OQDk6es5LzOzRvidJNfXLUZS2oN3oUFeXPP8LpPrhx3UroJFduGEYIBOxkY1",
-  "name": "ownCloud iOS app",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "secret": "KFeFWWEZO9TkisIQzR3fo7hfiMXlOpaqP8CFuTbSHzV1TUuGECglPxpiVKJfOXIx",
-  "redirectUris": [
-    "oc://ios.owncloud.com"
-  ],
-  "webOrigins": [],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": true,
-  "serviceAccountsEnabled": false,
-  "publicClient": false,
-  "frontchannelLogout": false,
-  "protocol": "openid-connect",
-  "attributes": {
-    "saml.assertion.signature": "false",
-    "saml.force.post.binding": "false",
-    "saml.multivalued.roles": "false",
-    "saml.encrypt": "false",
-    "post.logout.redirect.uris": "+",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "saml.server.signature": "false",
-    "saml.server.signature.keyinfo.ext": "false",
-    "exclude.session.state.from.auth.response": "false",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "saml_force_name_id_format": "false",
-    "saml.client.signature": "false",
-    "tls.client.certificate.bound.access.tokens": "false",
-    "saml.authnstatement": "false",
-    "display.on.consent.screen": "false",
-    "saml.onetimeuse.condition": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "profile",
-    "roles",
-    "groups",
-    "basic",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ],
-  "access": {
-    "view": true,
-    "configure": true,
-    "manage": true
-  }
-}
\ No newline at end of file
+    "clientId": "mxd5OQDk6es5LzOzRvidJNfXLUZS2oN3oUFeXPP8LpPrhx3UroJFduGEYIBOxkY1",
+    "name": "ownCloud iOS app",
+    "surrogateAuthRequired": false,
+    "enabled": true,
+    "alwaysDisplayInConsole": false,
+    "clientAuthenticatorType": "client-secret",
+    "secret" : "KFeFWWEZO9TkisIQzR3fo7hfiMXlOpaqP8CFuTbSHzV1TUuGECglPxpiVKJfOXIx",
+    "redirectUris": [
+        "oc://ios.owncloud.com"
+    ],
+    "webOrigins": [],
+    "notBefore": 0,
+    "bearerOnly": false,
+    "consentRequired": false,
+    "standardFlowEnabled": true,
+    "implicitFlowEnabled": false,
+    "directAccessGrantsEnabled": true,
+    "serviceAccountsEnabled": false,
+    "publicClient": false,
+    "frontchannelLogout": false,
+    "protocol": "openid-connect",
+    "attributes": {
+        "saml.assertion.signature": "false",
+        "saml.force.post.binding": "false",
+        "saml.multivalued.roles": "false",
+        "saml.encrypt": "false",
+        "backchannel.logout.revoke.offline.tokens": "false",
+        "saml.server.signature": "false",
+        "saml.server.signature.keyinfo.ext": "false",
+        "exclude.session.state.from.auth.response": "false",
+        "backchannel.logout.session.required": "true",
+        "client_credentials.use_refresh_token": "false",
+        "saml_force_name_id_format": "false",
+        "saml.client.signature": "false",
+        "tls.client.certificate.bound.access.tokens": "false",
+        "saml.authnstatement": "false",
+        "display.on.consent.screen": "false",
+        "saml.onetimeuse.condition": "false"
+    },
+    "authenticationFlowBindingOverrides": {},
+    "fullScopeAllowed": true,
+    "nodeReRegistrationTimeout": -1,
+    "defaultClientScopes": [
+        "web-origins",
+        "role_list",
+        "profile",
+        "roles",
+        "email"
+    ],
+    "optionalClientScopes": [
+        "address",
+        "phone",
+        "offline_access",
+        "microprofile-jwt"
+    ],
+    "access": {
+        "view": true,
+        "configure": true,
+        "manage": true
+    }
+}
diff --git a/deployments/examples/ocis_keycloak/config/keycloak/clients/web.json b/deployments/examples/ocis_keycloak/config/keycloak/clients/web.json
index b88f7c13121..f4feda1805a 100644
--- a/deployments/examples/ocis_keycloak/config/keycloak/clients/web.json
+++ b/deployments/examples/ocis_keycloak/config/keycloak/clients/web.json
@@ -1,72 +1,64 @@
 {
-  "clientId": "web",
-  "name": "",
-  "description": "",
-  "rootUrl": "https://ocis.owncloud.test",
-  "adminUrl": "https://ocis.owncloud.test",
-  "baseUrl": "",
-  "surrogateAuthRequired": false,
-  "enabled": true,
-  "alwaysDisplayInConsole": false,
-  "clientAuthenticatorType": "client-secret",
-  "redirectUris": [
-    "https://ocis.owncloud.test/*"
-  ],
-  "webOrigins": [
-    "https://ocis.owncloud.test"
-  ],
-  "notBefore": 0,
-  "bearerOnly": false,
-  "consentRequired": false,
-  "standardFlowEnabled": true,
-  "implicitFlowEnabled": false,
-  "directAccessGrantsEnabled": true,
-  "serviceAccountsEnabled": false,
-  "publicClient": true,
-  "frontchannelLogout": false,
-  "protocol": "openid-connect",
-  "attributes": {
-    "saml.assertion.signature": "false",
-    "saml.force.post.binding": "false",
-    "saml.multivalued.roles": "false",
-    "saml.encrypt": "false",
-    "post.logout.redirect.uris": "+",
-    "oauth2.device.authorization.grant.enabled": "false",
-    "backchannel.logout.revoke.offline.tokens": "false",
-    "saml.server.signature": "false",
-    "saml.server.signature.keyinfo.ext": "false",
-    "exclude.session.state.from.auth.response": "false",
-    "oidc.ciba.grant.enabled": "false",
-    "backchannel.logout.url": "https://ocis.owncloud.test/backchannel_logout",
-    "backchannel.logout.session.required": "true",
-    "client_credentials.use_refresh_token": "false",
-    "saml_force_name_id_format": "false",
-    "saml.client.signature": "false",
-    "tls.client.certificate.bound.access.tokens": "false",
-    "saml.authnstatement": "false",
-    "display.on.consent.screen": "false",
-    "saml.onetimeuse.condition": "false"
-  },
-  "authenticationFlowBindingOverrides": {},
-  "fullScopeAllowed": true,
-  "nodeReRegistrationTimeout": -1,
-  "defaultClientScopes": [
-    "web-origins",
-    "profile",
-    "roles",
-    "groups",
-    "basic",
-    "email"
-  ],
-  "optionalClientScopes": [
-    "address",
-    "phone",
-    "offline_access",
-    "microprofile-jwt"
-  ],
-  "access": {
-    "view": true,
-    "configure": true,
-    "manage": true
-  }
-}
\ No newline at end of file
+    "clientId": "web",
+    "rootUrl": "https://ocis.owncloud.test",
+    "adminUrl": "https://ocis.owncloud.test",
+    "surrogateAuthRequired": false,
+    "enabled": true,
+    "alwaysDisplayInConsole": false,
+    "clientAuthenticatorType": "client-secret",
+    "redirectUris": [
+        "https://ocis.owncloud.test/*"
+    ],
+    "webOrigins": [
+        "https://ocis.owncloud.test"
+    ],
+    "notBefore": 0,
+    "bearerOnly": false,
+    "consentRequired": false,
+    "standardFlowEnabled": true,
+    "implicitFlowEnabled": false,
+    "directAccessGrantsEnabled": true,
+    "serviceAccountsEnabled": false,
+    "publicClient": true,
+    "frontchannelLogout": false,
+    "protocol": "openid-connect",
+    "attributes": {
+        "saml.assertion.signature": "false",
+        "saml.force.post.binding": "false",
+        "saml.multivalued.roles": "false",
+        "saml.encrypt": "false",
+        "backchannel.logout.revoke.offline.tokens": "false",
+        "saml.server.signature": "false",
+        "saml.server.signature.keyinfo.ext": "false",
+        "exclude.session.state.from.auth.response": "false",
+        "backchannel.logout.session.required": "true",
+        "client_credentials.use_refresh_token": "false",
+        "saml_force_name_id_format": "false",
+        "saml.client.signature": "false",
+        "tls.client.certificate.bound.access.tokens": "false",
+        "saml.authnstatement": "false",
+        "display.on.consent.screen": "false",
+        "saml.onetimeuse.condition": "false"
+    },
+    "authenticationFlowBindingOverrides": {},
+    "fullScopeAllowed": true,
+    "nodeReRegistrationTimeout": -1,
+    "defaultClientScopes": [
+        "web-origins",
+        "role_list",
+        "profile",
+        "roles",
+        "email"
+    ],
+    "optionalClientScopes": [
+        "address",
+        "phone",
+        "offline_access",
+        "microprofile-jwt"
+    ],
+    "access": {
+        "view": true,
+        "configure": true,
+        "manage": true
+    }
+}
diff --git a/deployments/examples/ocis_keycloak/config/keycloak/ocis-realm.dist.json b/deployments/examples/ocis_keycloak/config/keycloak/ocis-realm.dist.json
index e10b200e9bf..571b673fdb6 100644
--- a/deployments/examples/ocis_keycloak/config/keycloak/ocis-realm.dist.json
+++ b/deployments/examples/ocis_keycloak/config/keycloak/ocis-realm.dist.json
@@ -38,7 +38,6 @@
   "editUsernameAllowed": false,
   "bruteForceProtected": true,
   "permanentLockout": false,
-  "maxTemporaryLockouts": 0,
   "maxFailureWaitSeconds": 900,
   "minimumQuickLoginWaitSeconds": 60,
   "waitIncrementSeconds": 60,
@@ -445,80 +444,7 @@
       ]
     }
   },
-  "groups": [
-    {
-      "id": "99187f82-71b6-4f21-a255-0d87bb286607",
-      "name": "philosophy-haters",
-      "path": "/philosophy-haters",
-      "subGroups": [],
-      "attributes": {},
-      "realmRoles": [],
-      "clientRoles": {}
-    },
-    {
-      "id": "2129ab43-0221-40e1-871a-394a8c9b6434",
-      "name": "physics-lovers",
-      "path": "/physics-lovers",
-      "subGroups": [],
-      "attributes": {},
-      "realmRoles": [],
-      "clientRoles": {}
-    },
-    {
-      "id": "8246d8bc-8e35-4b11-916e-f8d7729d6a23",
-      "name": "polonium-lovers",
-      "path": "/polonium-lovers",
-      "subGroups": [],
-      "attributes": {},
-      "realmRoles": [],
-      "clientRoles": {}
-    },
-    {
-      "id": "fabf9b54-c27e-495e-961d-9c9f2ebfd482",
-      "name": "quantum-lovers",
-      "path": "/quantum-lovers",
-      "subGroups": [],
-      "attributes": {},
-      "realmRoles": [],
-      "clientRoles": {}
-    },
-    {
-      "id": "f5613e5a-84b6-4e85-bcb3-0fff9fa6a191",
-      "name": "radium-lovers",
-      "path": "/radium-lovers",
-      "subGroups": [],
-      "attributes": {},
-      "realmRoles": [],
-      "clientRoles": {}
-    },
-    {
-      "id": "32031f61-035e-4355-b7bf-17ff314581f3",
-      "name": "sailing-lovers",
-      "path": "/sailing-lovers",
-      "subGroups": [],
-      "attributes": {},
-      "realmRoles": [],
-      "clientRoles": {}
-    },
-    {
-      "id": "8520544b-eb76-449d-8498-fbe0e1e62a97",
-      "name": "users",
-      "path": "/users",
-      "subGroups": [],
-      "attributes": {},
-      "realmRoles": [],
-      "clientRoles": {}
-    },
-    {
-      "id": "d0a10993-e532-49b7-b2b4-009f9b31d43a",
-      "name": "violin-haters",
-      "path": "/violin-haters",
-      "subGroups": [],
-      "attributes": {},
-      "realmRoles": [],
-      "clientRoles": {}
-    }
-  ],
+  "groups": [],
   "defaultRole": {
     "id": "82e13ea7-aac4-4d2c-9fc7-cff8333dbe19",
     "name": "default-roles-ocis",
@@ -538,11 +464,10 @@
   "otpPolicyPeriod": 30,
   "otpPolicyCodeReusable": false,
   "otpSupportedApplications": [
-    "totpAppFreeOTPName",
+    "totpAppMicrosoftAuthenticatorName",
     "totpAppGoogleName",
-    "totpAppMicrosoftAuthenticatorName"
+    "totpAppFreeOTPName"
   ],
-  "localizationTexts": {},
   "webAuthnPolicyRpEntityName": "keycloak",
   "webAuthnPolicySignatureAlgorithms": [
     "ES256"
@@ -555,7 +480,6 @@
   "webAuthnPolicyCreateTimeout": 0,
   "webAuthnPolicyAvoidSameAuthenticatorRegister": false,
   "webAuthnPolicyAcceptableAaguids": [],
-  "webAuthnPolicyExtraOrigins": [],
   "webAuthnPolicyPasswordlessRpEntityName": "keycloak",
   "webAuthnPolicyPasswordlessSignatureAlgorithms": [
     "ES256"
@@ -568,18 +492,17 @@
   "webAuthnPolicyPasswordlessCreateTimeout": 0,
   "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false,
   "webAuthnPolicyPasswordlessAcceptableAaguids": [],
-  "webAuthnPolicyPasswordlessExtraOrigins": [],
   "users": [
     {
       "id": "389845cd-65b9-47fc-b723-ba75940bcbd7",
+      "createdTimestamp": 1611912383386,
       "username": "admin",
+      "enabled": true,
+      "totp": false,
+      "emailVerified": true,
       "firstName": "Admin",
       "lastName": "Admin",
       "email": "admin@example.org",
-      "emailVerified": true,
-      "createdTimestamp": 1611912383386,
-      "enabled": true,
-      "totp": false,
       "credentials": [
         {
           "id": "499e0fbe-1c10-4588-9db4-e8a1012b9246",
@@ -603,27 +526,25 @@
         ]
       },
       "notBefore": 0,
-      "groups": [
-        "/users"
-      ]
+      "groups": []
     },
     {
       "id": "0a9f434c-4864-49cf-ac15-46ed0f49d59b",
+      "createdTimestamp": 1611912153544,
       "username": "einstein",
+      "enabled": true,
+      "totp": false,
+      "emailVerified": true,
       "firstName": "Albert",
       "lastName": "Einstein",
       "email": "einstein@example.org",
-      "emailVerified": true,
-      "createdTimestamp": 1611912153544,
-      "enabled": true,
-      "totp": false,
       "credentials": [
         {
           "id": "19efcb24-c5ec-42ed-97e1-2475ca025f40",
           "type": "password",
           "createdDate": 1611912169712,
-          "secretData": "{\"value\":\"5+ofM8OpvpiPZyi4ZJuB2Pa3jGOIcY2uXui2p8KRWCs=\",\"salt\":\"wfhXLZScHStB14ZxML9d7g==\",\"additionalParameters\":{}}",
-          "credentialData": "{\"hashIterations\":5,\"algorithm\":\"argon2\",\"additionalParameters\":{\"hashLength\":[\"32\"],\"memory\":[\"7168\"],\"type\":[\"id\"],\"version\":[\"1.3\"],\"parallelism\":[\"1\"]}}"
+          "secretData": "{\"value\":\"RFmvq2E9BRSkTlzax83HU02nMA83KisDenT6cnb8EspZTrsXvIrFBspIeOZIZfZaJIacFBg1FXslHZMwbUp8qA==\",\"salt\":\"p2wYyBMa41n3A6/5ZAFUww==\",\"additionalParameters\":{}}",
+          "credentialData": "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}"
         }
       ],
       "disableableCredentialTypes": [],
@@ -640,23 +561,18 @@
         ]
       },
       "notBefore": 0,
-      "groups": [
-        "/physics-lovers",
-        "/sailing-lovers",
-        "/users",
-        "/violin-haters"
-      ]
+      "groups": []
     },
     {
       "id": "b44a81e2-e3ed-4241-a9ce-44604f7ac9eb",
+      "createdTimestamp": 1678101111607,
       "username": "katherine",
+      "enabled": true,
+      "totp": false,
+      "emailVerified": true,
       "firstName": "Katherine",
       "lastName": "Johnson",
       "email": "katherine@example.org",
-      "emailVerified": true,
-      "createdTimestamp": 1678101111607,
-      "enabled": true,
-      "totp": false,
       "credentials": [
         {
           "id": "be18ccc9-b80f-4895-bf06-8e8e4605c634",
@@ -678,14 +594,14 @@
     },
     {
       "id": "48016357-346a-443e-bf7a-945c9448a99b",
+      "createdTimestamp": 1611912241951,
       "username": "marie",
+      "enabled": true,
+      "totp": false,
+      "emailVerified": true,
       "firstName": "Marie",
       "lastName": "Curie",
       "email": "marie@example.org",
-      "emailVerified": true,
-      "createdTimestamp": 1611912241951,
-      "enabled": true,
-      "totp": false,
       "credentials": [
         {
           "id": "ff304f90-a934-4bf1-9cfe-bd165751c110",
@@ -709,30 +625,25 @@
         ]
       },
       "notBefore": 0,
-      "groups": [
-        "/physics-lovers",
-        "/polonium-lovers",
-        "/radium-lovers",
-        "/users"
-      ]
+      "groups": []
     },
     {
       "id": "d18c3689-b816-455a-9728-cd8c9797f315",
+      "createdTimestamp": 1611912340085,
       "username": "moss",
+      "enabled": true,
+      "totp": false,
+      "emailVerified": true,
       "firstName": "Maurice",
       "lastName": "Moss",
       "email": "moss@example.org",
-      "emailVerified": true,
-      "createdTimestamp": 1611912340085,
-      "enabled": true,
-      "totp": false,
       "credentials": [
         {
           "id": "273679bf-80ef-4c83-ac23-0ee569c3bece",
           "type": "password",
           "createdDate": 1611912354500,
-          "secretData": "{\"value\":\"f22la+Ghr2xDBOA1tJrMlc2GFy9ZiGcTJuto2U9KaHE=\",\"salt\":\"fjwq6/u6YI+r1xdZL0UtxA==\",\"additionalParameters\":{}}",
-          "credentialData": "{\"hashIterations\":5,\"algorithm\":\"argon2\",\"additionalParameters\":{\"hashLength\":[\"32\"],\"memory\":[\"7168\"],\"type\":[\"id\"],\"version\":[\"1.3\"],\"parallelism\":[\"1\"]}}"
+          "secretData": "{\"value\":\"u1oYT2/nE7cWKY4MK57zzyOAbnBGjTt1J3MWCJJfnBpSZnO0q1nB9Eymt2P9te702E0ijPDTb8towbxSm60dfQ==\",\"salt\":\"0LnbBHsRET4CLI/bzW4xng==\",\"additionalParameters\":{}}",
+          "credentialData": "{\"hashIterations\":27500,\"algorithm\":\"pbkdf2-sha256\",\"additionalParameters\":{}}"
         }
       ],
       "disableableCredentialTypes": [],
@@ -749,20 +660,18 @@
         ]
       },
       "notBefore": 0,
-      "groups": [
-        "/users"
-      ]
+      "groups": []
     },
     {
       "id": "373be4c5-7f65-4e91-ba0e-bfb618c96046",
+      "createdTimestamp": 1611912442173,
       "username": "richard",
+      "enabled": true,
+      "totp": false,
+      "emailVerified": true,
       "firstName": "Richard",
       "lastName": "Feynman",
       "email": "richard@example.org",
-      "emailVerified": true,
-      "createdTimestamp": 1611912442173,
-      "enabled": true,
-      "totp": false,
       "credentials": [
         {
           "id": "2fb1bcd7-8a51-4732-b695-dc4aa14b1dca",
@@ -786,12 +695,7 @@
         ]
       },
       "notBefore": 0,
-      "groups": [
-        "/philosophy-haters",
-        "/physics-lovers",
-        "/quantum-lovers",
-        "/users"
-      ]
+      "groups": []
     }
   ],
   "scopeMappings": [
@@ -831,7 +735,6 @@
       "enabled": true,
       "alwaysDisplayInConsole": false,
       "clientAuthenticatorType": "client-secret",
-      "secret": "pIw3cF77kEYSYR2r1HfOzySTBLO7aYeM",
       "redirectUris": [],
       "webOrigins": [],
       "notBefore": 0,
@@ -845,7 +748,6 @@
       "frontchannelLogout": false,
       "protocol": "openid-connect",
       "attributes": {
-        "client.secret.creation.time": "1718778122",
         "post.logout.redirect.uris": "+"
       },
       "authenticationFlowBindingOverrides": {},
@@ -855,7 +757,6 @@
         "web-origins",
         "profile",
         "roles",
-        "basic",
         "email"
       ],
       "optionalClientScopes": [
@@ -875,7 +776,6 @@
       "enabled": true,
       "alwaysDisplayInConsole": false,
       "clientAuthenticatorType": "client-secret",
-      "secret": "PY3vaoPyw7VCfHxDf41JKbGtR2WOV85S",
       "redirectUris": [
         "/realms/oCIS/account/*"
       ],
@@ -891,15 +791,12 @@
       "frontchannelLogout": false,
       "protocol": "openid-connect",
       "attributes": {
-        "client.secret.creation.time": "1718778122",
         "post.logout.redirect.uris": "+"
       },
       "authenticationFlowBindingOverrides": {},
       "fullScopeAllowed": false,
       "nodeReRegistrationTimeout": 0,
-      "defaultClientScopes": [
-        "basic"
-      ],
+      "defaultClientScopes": [],
       "optionalClientScopes": []
     },
     {
@@ -948,7 +845,6 @@
         "acr",
         "profile",
         "roles",
-        "basic",
         "email"
       ],
       "optionalClientScopes": [
@@ -984,9 +880,7 @@
       "authenticationFlowBindingOverrides": {},
       "fullScopeAllowed": false,
       "nodeReRegistrationTimeout": 0,
-      "defaultClientScopes": [
-        "basic"
-      ],
+      "defaultClientScopes": [],
       "optionalClientScopes": []
     },
     {
@@ -997,7 +891,6 @@
       "enabled": true,
       "alwaysDisplayInConsole": false,
       "clientAuthenticatorType": "client-secret",
-      "secret": "3mksmxreyii6xcc6N2JRGLT4fehwE1HT",
       "redirectUris": [],
       "webOrigins": [],
       "notBefore": 0,
@@ -1011,15 +904,12 @@
       "frontchannelLogout": false,
       "protocol": "openid-connect",
       "attributes": {
-        "client.secret.creation.time": "1718778122",
         "post.logout.redirect.uris": "+"
       },
       "authenticationFlowBindingOverrides": {},
       "fullScopeAllowed": false,
       "nodeReRegistrationTimeout": 0,
-      "defaultClientScopes": [
-        "basic"
-      ],
+      "defaultClientScopes": [],
       "optionalClientScopes": []
     },
     {
@@ -1071,8 +961,6 @@
         "web-origins",
         "profile",
         "roles",
-        "groups",
-        "basic",
         "email"
       ],
       "optionalClientScopes": [
@@ -1131,8 +1019,6 @@
         "web-origins",
         "profile",
         "roles",
-        "groups",
-        "basic",
         "email"
       ],
       "optionalClientScopes": [
@@ -1212,18 +1098,16 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "locale",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "locale",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         }
       ],
-      "defaultClientScopes": [
-        "basic"
-      ],
+      "defaultClientScopes": [],
       "optionalClientScopes": []
     },
     {
@@ -1283,8 +1167,6 @@
         "web-origins",
         "profile",
         "roles",
-        "groups",
-        "basic",
         "email"
       ],
       "optionalClientScopes": [
@@ -1344,8 +1226,6 @@
         "web-origins",
         "profile",
         "roles",
-        "groups",
-        "basic",
         "email"
       ],
       "optionalClientScopes": [
@@ -1364,8 +1244,8 @@
       "protocol": "openid-connect",
       "attributes": {
         "include.in.token.scope": "true",
-        "consent.screen.text": "${emailScopeConsentText}",
-        "display.on.consent.screen": "true"
+        "display.on.consent.screen": "true",
+        "consent.screen.text": "${emailScopeConsentText}"
       },
       "protocolMappers": [
         {
@@ -1375,12 +1255,12 @@
           "protocolMapper": "oidc-usermodel-property-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "emailVerified",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "email_verified",
-            "jsonType.label": "boolean",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "boolean"
           }
         },
         {
@@ -1390,12 +1270,12 @@
           "protocolMapper": "oidc-usermodel-property-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "email",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "email",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         }
       ]
@@ -1407,8 +1287,8 @@
       "protocol": "openid-connect",
       "attributes": {
         "include.in.token.scope": "true",
-        "consent.screen.text": "${addressScopeConsentText}",
-        "display.on.consent.screen": "true"
+        "display.on.consent.screen": "true",
+        "consent.screen.text": "${addressScopeConsentText}"
       },
       "protocolMappers": [
         {
@@ -1472,8 +1352,8 @@
       "protocol": "openid-connect",
       "attributes": {
         "include.in.token.scope": "true",
-        "consent.screen.text": "${profileScopeConsentText}",
-        "display.on.consent.screen": "true"
+        "display.on.consent.screen": "true",
+        "consent.screen.text": "${profileScopeConsentText}"
       },
       "protocolMappers": [
         {
@@ -1483,12 +1363,12 @@
           "protocolMapper": "oidc-usermodel-property-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "lastName",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "family_name",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1498,12 +1378,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "middleName",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "middle_name",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1513,12 +1393,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "picture",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "picture",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1528,12 +1408,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "locale",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "locale",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1543,12 +1423,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "profile",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "profile",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1558,12 +1438,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "website",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "website",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1585,12 +1465,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "nickname",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "nickname",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1600,12 +1480,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "updatedAt",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "updated_at",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1615,12 +1495,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "gender",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "gender",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1630,12 +1510,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "birthdate",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "birthdate",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1645,12 +1525,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "zoneinfo",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "zoneinfo",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1660,12 +1540,12 @@
           "protocolMapper": "oidc-usermodel-property-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "firstName",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "given_name",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1675,12 +1555,12 @@
           "protocolMapper": "oidc-usermodel-property-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "username",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "preferred_username",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         }
       ]
@@ -1692,8 +1572,8 @@
       "protocol": "openid-connect",
       "attributes": {
         "include.in.token.scope": "true",
-        "consent.screen.text": "${phoneScopeConsentText}",
-        "display.on.consent.screen": "true"
+        "display.on.consent.screen": "true",
+        "consent.screen.text": "${phoneScopeConsentText}"
       },
       "protocolMappers": [
         {
@@ -1703,12 +1583,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "phoneNumber",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "phone_number",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         },
         {
@@ -1718,51 +1598,12 @@
           "protocolMapper": "oidc-usermodel-attribute-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "phoneNumberVerified",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "phone_number_verified",
-            "jsonType.label": "boolean",
-            "userinfo.token.claim": "true"
-          }
-        }
-      ]
-    },
-    {
-      "id": "c3a6224b-49aa-4a25-953d-7e326d66893d",
-      "name": "basic",
-      "description": "OpenID Connect scope for add all basic claims to the token",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "false",
-        "display.on.consent.screen": "false"
-      },
-      "protocolMappers": [
-        {
-          "id": "2d4f3f17-1ab7-429e-88e1-cdf08d3533c6",
-          "name": "auth_time",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usersessionmodel-note-mapper",
-          "consentRequired": false,
-          "config": {
-            "user.session.note": "AUTH_TIME",
-            "introspection.token.claim": "true",
-            "userinfo.token.claim": "true",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "claim.name": "auth_time",
-            "jsonType.label": "long"
-          }
-        },
-        {
-          "id": "3e7da934-3de3-4bd1-a565-8ac62419c138",
-          "name": "sub",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-sub-mapper",
-          "consentRequired": false,
-          "config": {
-            "introspection.token.claim": "true",
-            "access.token.claim": "true"
+            "jsonType.label": "boolean"
           }
         }
       ]
@@ -1774,8 +1615,8 @@
       "protocol": "openid-connect",
       "attributes": {
         "include.in.token.scope": "false",
-        "consent.screen.text": "${rolesScopeConsentText}",
-        "display.on.consent.screen": "true"
+        "display.on.consent.screen": "true",
+        "consent.screen.text": "${rolesScopeConsentText}"
       },
       "protocolMappers": [
         {
@@ -1807,42 +1648,12 @@
           "protocolMapper": "oidc-usermodel-realm-role-mapper",
           "consentRequired": false,
           "config": {
-            "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "roles",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true",
-            "multivalued": "true"
-          }
-        }
-      ]
-    },
-    {
-      "id": "7438d93e-b07a-4913-9419-3273be364c4b",
-      "name": "groups",
-      "description": "OpenID Connect scope for add user groups to the access token",
-      "protocol": "openid-connect",
-      "attributes": {
-        "include.in.token.scope": "false",
-        "display.on.consent.screen": "true",
-        "gui.order": "",
-        "consent.screen.text": ""
-      },
-      "protocolMappers": [
-        {
-          "id": "5349faf2-64a6-481f-b207-39ffef2cd597",
-          "name": "groups",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-group-membership-mapper",
-          "consentRequired": false,
-          "config": {
-            "full.path": "false",
-            "introspection.token.claim": "true",
             "userinfo.token.claim": "true",
             "id.token.claim": "true",
-            "lightweight.claim": "false",
-            "access.token.claim": "true",
-            "claim.name": "groups"
+            "jsonType.label": "String",
+            "multivalued": "true"
           }
         }
       ]
@@ -1854,8 +1665,8 @@
       "protocol": "openid-connect",
       "attributes": {
         "include.in.token.scope": "false",
-        "consent.screen.text": "",
-        "display.on.consent.screen": "false"
+        "display.on.consent.screen": "false",
+        "consent.screen.text": ""
       },
       "protocolMappers": [
         {
@@ -1925,12 +1736,12 @@
           "protocolMapper": "oidc-usermodel-property-mapper",
           "consentRequired": false,
           "config": {
+            "userinfo.token.claim": "true",
             "user.attribute": "username",
             "id.token.claim": "true",
             "access.token.claim": "true",
             "claim.name": "upn",
-            "jsonType.label": "String",
-            "userinfo.token.claim": "true"
+            "jsonType.label": "String"
           }
         }
       ]
@@ -1942,9 +1753,7 @@
     "email",
     "roles",
     "web-origins",
-    "acr",
-    "basic",
-    "groups"
+    "acr"
   ],
   "defaultOptionalClientScopes": [
     "offline_access",
@@ -1955,7 +1764,6 @@
   "browserSecurityHeaders": {
     "contentSecurityPolicyReportOnly": "",
     "xContentTypeOptions": "nosniff",
-    "referrerPolicy": "no-referrer",
     "xRobotsTag": "none",
     "xFrameOptions": "SAMEORIGIN",
     "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
@@ -1974,45 +1782,6 @@
   "identityProviderMappers": [],
   "components": {
     "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy": [
-      {
-        "id": "4682fe74-f3a9-445a-a7ab-557fb532fe6b",
-        "name": "Consent Required",
-        "providerId": "consent-required",
-        "subType": "anonymous",
-        "subComponents": {},
-        "config": {}
-      },
-      {
-        "id": "c46009e5-c8b5-4051-bf7f-7b1481a9aa86",
-        "name": "Max Clients Limit",
-        "providerId": "max-clients",
-        "subType": "anonymous",
-        "subComponents": {},
-        "config": {
-          "max-clients": [
-            "200"
-          ]
-        }
-      },
-      {
-        "id": "43edf979-28d2-46c8-9f93-48b3de185570",
-        "name": "Allowed Protocol Mapper Types",
-        "providerId": "allowed-protocol-mappers",
-        "subType": "anonymous",
-        "subComponents": {},
-        "config": {
-          "allowed-protocol-mapper-types": [
-            "saml-user-property-mapper",
-            "saml-role-list-mapper",
-            "oidc-address-mapper",
-            "oidc-sha256-pairwise-sub-mapper",
-            "oidc-usermodel-property-mapper",
-            "oidc-usermodel-attribute-mapper",
-            "oidc-full-name-mapper",
-            "saml-user-attribute-mapper"
-          ]
-        }
-      },
       {
         "id": "6fc7d765-7da8-4985-ba0b-e83827b04bd3",
         "name": "Allowed Client Scopes",
@@ -2025,6 +1794,14 @@
           ]
         }
       },
+      {
+        "id": "4682fe74-f3a9-445a-a7ab-557fb532fe6b",
+        "name": "Consent Required",
+        "providerId": "consent-required",
+        "subType": "anonymous",
+        "subComponents": {},
+        "config": {}
+      },
       {
         "id": "5a9aef85-98a6-4e90-b30f-8aa715e1f5e6",
         "name": "Allowed Protocol Mapper Types",
@@ -2033,14 +1810,14 @@
         "subComponents": {},
         "config": {
           "allowed-protocol-mapper-types": [
+            "oidc-sha256-pairwise-sub-mapper",
+            "saml-user-property-mapper",
+            "oidc-full-name-mapper",
+            "oidc-usermodel-property-mapper",
+            "oidc-address-mapper",
             "saml-user-attribute-mapper",
             "oidc-usermodel-attribute-mapper",
-            "oidc-address-mapper",
-            "saml-role-list-mapper",
-            "oidc-full-name-mapper",
-            "saml-user-property-mapper",
-            "oidc-sha256-pairwise-sub-mapper",
-            "oidc-usermodel-property-mapper"
+            "saml-role-list-mapper"
           ]
         }
       },
@@ -2056,6 +1833,18 @@
           ]
         }
       },
+      {
+        "id": "c46009e5-c8b5-4051-bf7f-7b1481a9aa86",
+        "name": "Max Clients Limit",
+        "providerId": "max-clients",
+        "subType": "anonymous",
+        "subComponents": {},
+        "config": {
+          "max-clients": [
+            "200"
+          ]
+        }
+      },
       {
         "id": "c788e6bf-2f57-4a82-b32e-ac8d48a4f676",
         "name": "Full Scope Disabled",
@@ -2063,16 +1852,23 @@
         "subType": "anonymous",
         "subComponents": {},
         "config": {}
-      }
-    ],
-    "org.keycloak.userprofile.UserProfileProvider": [
+      },
       {
-        "id": "28d6b4ce-33d4-40c0-adef-b27e35b7e122",
-        "providerId": "declarative-user-profile",
+        "id": "43edf979-28d2-46c8-9f93-48b3de185570",
+        "name": "Allowed Protocol Mapper Types",
+        "providerId": "allowed-protocol-mappers",
+        "subType": "anonymous",
         "subComponents": {},
         "config": {
-          "kc.user.profile.config": [
-            "{\"attributes\":[{\"name\":\"username\",\"displayName\":\"${username}\",\"validations\":{\"length\":{\"min\":3,\"max\":255},\"username-prohibited-characters\":{},\"up-username-not-idn-homograph\":{}},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"email\",\"displayName\":\"${email}\",\"validations\":{\"email\":{},\"length\":{\"max\":255}},\"required\":{\"roles\":[\"user\"]},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"firstName\",\"displayName\":\"${firstName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"required\":{\"roles\":[\"user\"]},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false},{\"name\":\"lastName\",\"displayName\":\"${lastName}\",\"validations\":{\"length\":{\"max\":255},\"person-name-prohibited-characters\":{}},\"required\":{\"roles\":[\"user\"]},\"permissions\":{\"view\":[\"admin\",\"user\"],\"edit\":[\"admin\",\"user\"]},\"multivalued\":false}],\"groups\":[{\"name\":\"user-metadata\",\"displayHeader\":\"User metadata\",\"displayDescription\":\"Attributes, which refer to user metadata\"}],\"unmanagedAttributePolicy\":\"ENABLED\"}"
+          "allowed-protocol-mapper-types": [
+            "saml-user-property-mapper",
+            "oidc-address-mapper",
+            "oidc-usermodel-property-mapper",
+            "oidc-sha256-pairwise-sub-mapper",
+            "oidc-usermodel-attribute-mapper",
+            "saml-role-list-mapper",
+            "saml-user-attribute-mapper",
+            "oidc-full-name-mapper"
           ]
         }
       }
@@ -2084,12 +1880,6 @@
         "providerId": "rsa-generated",
         "subComponents": {},
         "config": {
-          "privateKey": [
-            "MIIEowIBAAKCAQEAtddPjTKbLAv02Zh3CTCfZHbgCi4M0dFOU1OJ8tHvxt7nuDz7DTA//V0T4WSgdMOLDNVs6J5KNO7ddF6aB1laCWwfGG/ZAxHyrIzTI+iFK5qG19jnvPGBzPbdffxKyC6TcUwTz6z01pbovLftwXyNtAqxwgJvfjdg4j7PYvabk97ketRWw1uH+Jlqa/TOFlbQuweea2w9CJJmofJ/lzgHk5JAyYm/oT0gVB/ukCSgh+So+AtZ8fzwawdS9uQZhvu3sU//M9j+liT+mv5Dq+uB+NIx24xWPW/hWgPlqBBZ0o1ZEbK4jtyxjDOTAs6w6/IT+OO8a9z0BsMC7nl1EzA1LQIDAQABAoIBABl/HknmMci8HRxSMEVLGoZRKWUerjB7QG1sQLhEhHImOL0QsS4uY5fdxaxXBNfqanmlsUwalGgV+ATZljpNO9PSDmLJnVbnXNdMivcKzXq0LjpfUPr2rU8KbDsT4CkaaBUSPZLjJZSzJeCpiijqPco5V6b5hXLf8Uc31wdWxwYKv4XYBOgXZGkHk27f6CdqjCzNYWhJYIHeBqISUMDEQoZx9YxemudbdNF8Vo/Keyj/vqYXdLwyyJf9A7DY/A6mZWp3XMQtlL0CykVjnbgm/EzYaXuwZSCY1sYHl7AhOu83AjPR7aYpkY662l1VuwaGliKk2+iIrIhYWDAOaluSBvcCgYEA/2vPm67piTw3umNca1EZqYC/Sta2d4yKthYh+gXzbWDDeVI63Kn1d2cWau0qV9SLwpY+UcTVReiqf5EHxOdhUzm7H7kcAUPydIOFX78BJ7sYa8TW/iZ+pvrAx/43EqCsdNMHcNVsqKMmJhpAozCMyG0BxFTsesuG4o3fCEBjoFcCgYEAtkDPeLZWw1ClocHcgTFSNRZF+wIYPpItS2NG0fRJk4jTv10nVoHRGflqhH3052iZkMpHMrB8YtbcOWET9nh3oJq3wB5VpQigPWjkmo00hNLQ36MbTbBuinmIPdy2SknoiojfSfgYcxmi3f8RHqPOLLkyAZjclJj6lAbq/aJklBsCgYBdV3rhPASgYF9FQDZwCY1FQoWlxd2cxsGSVXhJNI+HM0t8NK7KIVpRLl0k6lMFEemZTOqtWy9Ngv976vZZ4OzSS1C1ASLY24npRn8hRF4ZtOfxyld/PXYfc5er/p0Fs64Sa2RWucghwK2aUxG4EXABdsSkiRx6q5I5jPsqus0ttQKBgQCwvcs1cgZT5OqrIng3ZWAmkVIOKKrgSxvXxw/P3cpYY9GM+8aBUuU3/jN5BzkwDLUXv8Ip+xK1O05X6rfURmEkg8X8bq55nBLhWs6Ovq8Wu+bJacC5p4abjV49N8Qj6Oa1KiT387uqK0tRY+DzSMFRh8th1x7akDw4vzi1/PzyzwKBgG2C0QFuJqoVQlRnAB8Jid7ChliuPP+1KhZMd4mJ7yOaU1r+TKWPPIk5iNd3zkjc0UZGg/6h1WvZQazHAxn1/BMHR7ZY3zmBsCQ1TiRRfyr18v9rBRUS3GwmXgToJwl65aNO6cGAIvS/7TH2Zfmdjc5rkjWCv4U32+tpCGNtoaPC"
-          ],
-          "certificate": [
-            "MIIClzCCAX8CBgGQLyjUfjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARvQ0lTMB4XDTI0MDYxOTA2MjAyM1oXDTM0MDYxOTA2MjIwM1owDzENMAsGA1UEAwwEb0NJUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALXXT40ymywL9NmYdwkwn2R24AouDNHRTlNTifLR78be57g8+w0wP/1dE+FkoHTDiwzVbOieSjTu3XRemgdZWglsHxhv2QMR8qyM0yPohSuahtfY57zxgcz23X38Ssguk3FME8+s9NaW6Ly37cF8jbQKscICb343YOI+z2L2m5Pe5HrUVsNbh/iZamv0zhZW0LsHnmtsPQiSZqHyf5c4B5OSQMmJv6E9IFQf7pAkoIfkqPgLWfH88GsHUvbkGYb7t7FP/zPY/pYk/pr+Q6vrgfjSMduMVj1v4VoD5agQWdKNWRGyuI7csYwzkwLOsOvyE/jjvGvc9AbDAu55dRMwNS0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEApg4N+/dI+UimwbpW7nsJWFu/FA8GgbEEBqbbjatgqeUJNuvi0jFueiYFnO/Pppp++PQDvKKwE7XfnEuippNNKWFQnwJQf9ZRnysNlYMq+vBT37+QIps2z772pq7bway5t7YlwjBhILNGIA9mzbsFK2SnyY0V5y0qQgEaZePMP/2cq5Ur9tKMUIIsTfBgkk3YLpxgq/rwTOtxfo6me5WpD5dXT57NXV9wmtxStE9z6INvMjp7FPZO8mai97X/SfgNhuGkN+EclvYEM/5/xfNR4rhPSnlsHwX2jjVuVuJZQKKY7DlVDohKMJzLf1Ocfe44mSRkQWCeGnJpg8NrtaxYTg=="
-          ],
           "priority": [
             "100"
           ]
@@ -2101,12 +1891,6 @@
         "providerId": "hmac-generated",
         "subComponents": {},
         "config": {
-          "kid": [
-            "a25fabf6-4224-4e0e-876b-cbfcb0a79628"
-          ],
-          "secret": [
-            "4TbJ63S8xc-vEmTtAtd0YQbO9sCqeUs9B0SpOiokavNFWwRq5hrxcyXsG1GKpCAcEheGKnjNgkNAOR3jvnKDVnq-jJd9II2G6-A6G-XH7HMG7REWi2OVDf7a5eGmdFeRNdI5kQhGceS-H03hF3Q9uI4tv1mlgoeBpVxfWrS5_dQ"
-          ],
           "priority": [
             "100"
           ],
@@ -2115,38 +1899,12 @@
           ]
         }
       },
-      {
-        "id": "a137a686-5876-4faf-8d1e-e3a59f55095e",
-        "name": "hmac-generated-hs512",
-        "providerId": "hmac-generated",
-        "subComponents": {},
-        "config": {
-          "kid": [
-            "f00e19d2-5070-4730-a68a-2a14912ef7a8"
-          ],
-          "secret": [
-            "nXZiaEzaQQUrFkmkq7vRPbZ54_m-u5zo5o9j-5WxtbdwCaHGNN3hGHOjq_4z4zfB4ooRVcUtzQL_48kOoRYmvJy7_w-rfIIooxN5yGU4sVJRj3wV3cVwxPqNAVLj_pAxJnTLXGC-cckpFkWw9XfIPLG-D3Nkv05WEgVSnIuNXOo"
-          ],
-          "priority": [
-            "100"
-          ],
-          "algorithm": [
-            "HS512"
-          ]
-        }
-      },
       {
         "id": "992dcc80-dc41-4b00-bab8-6ec1c839f3a4",
         "name": "aes-generated",
         "providerId": "aes-generated",
         "subComponents": {},
         "config": {
-          "kid": [
-            "aec7cbf7-7e70-4acd-b1b6-adc7a0d58e2f"
-          ],
-          "secret": [
-            "-WfcWG4blS3bT0nsLsj-Rw"
-          ],
           "priority": [
             "100"
           ]
@@ -2183,6 +1941,40 @@
         }
       ]
     },
+    {
+      "id": "404d2769-f3ba-4b5e-b43f-1bca919334f2",
+      "alias": "Authentication Options",
+      "description": "Authentication options.",
+      "providerId": "basic-flow",
+      "topLevel": false,
+      "builtIn": true,
+      "authenticationExecutions": [
+        {
+          "authenticator": "basic-auth",
+          "authenticatorFlow": false,
+          "requirement": "REQUIRED",
+          "priority": 10,
+          "autheticatorFlow": false,
+          "userSetupAllowed": false
+        },
+        {
+          "authenticator": "basic-auth-otp",
+          "authenticatorFlow": false,
+          "requirement": "DISABLED",
+          "priority": 20,
+          "autheticatorFlow": false,
+          "userSetupAllowed": false
+        },
+        {
+          "authenticator": "auth-spnego",
+          "authenticatorFlow": false,
+          "requirement": "DISABLED",
+          "priority": 30,
+          "autheticatorFlow": false,
+          "userSetupAllowed": false
+        }
+      ]
+    },
     {
       "id": "123e5711-1ee5-4f7e-ac9c-64c644daaea9",
       "alias": "Browser - Conditional OTP",
@@ -2555,6 +2347,32 @@
         }
       ]
     },
+    {
+      "id": "8f5fab27-9b06-444d-931b-d03be9e6d4af",
+      "alias": "http challenge",
+      "description": "An authentication flow based on challenge-response HTTP Authentication Schemes",
+      "providerId": "basic-flow",
+      "topLevel": true,
+      "builtIn": true,
+      "authenticationExecutions": [
+        {
+          "authenticator": "no-cookie-redirect",
+          "authenticatorFlow": false,
+          "requirement": "REQUIRED",
+          "priority": 10,
+          "autheticatorFlow": false,
+          "userSetupAllowed": false
+        },
+        {
+          "authenticatorFlow": true,
+          "requirement": "REQUIRED",
+          "priority": 20,
+          "autheticatorFlow": true,
+          "flowAlias": "Authentication Options",
+          "userSetupAllowed": false
+        }
+      ]
+    },
     {
       "id": "c53eb19d-49e9-4252-8a10-4d5c6a12e61b",
       "alias": "registration",
@@ -2590,6 +2408,14 @@
           "autheticatorFlow": false,
           "userSetupAllowed": false
         },
+        {
+          "authenticator": "registration-profile-action",
+          "authenticatorFlow": false,
+          "requirement": "REQUIRED",
+          "priority": 40,
+          "autheticatorFlow": false,
+          "userSetupAllowed": false
+        },
         {
           "authenticator": "registration-password-action",
           "authenticatorFlow": false,
@@ -2696,9 +2522,9 @@
       "config": {}
     },
     {
-      "alias": "TERMS_AND_CONDITIONS",
+      "alias": "terms_and_conditions",
       "name": "Terms and Conditions",
-      "providerId": "TERMS_AND_CONDITIONS",
+      "providerId": "terms_and_conditions",
       "enabled": false,
       "defaultAction": false,
       "priority": 20,
@@ -2740,15 +2566,6 @@
       "priority": 60,
       "config": {}
     },
-    {
-      "alias": "delete_credential",
-      "name": "Delete Credential",
-      "providerId": "delete_credential",
-      "enabled": true,
-      "defaultAction": false,
-      "priority": 100,
-      "config": {}
-    },
     {
       "alias": "update_user_locale",
       "name": "Update User Locale",
@@ -2765,25 +2582,22 @@
   "resetCredentialsFlow": "reset credentials",
   "clientAuthenticationFlow": "clients",
   "dockerAuthenticationFlow": "docker auth",
-  "firstBrokerLoginFlow": "first broker login",
   "attributes": {
     "cibaBackchannelTokenDeliveryMode": "poll",
+    "cibaExpiresIn": "120",
     "cibaAuthRequestedUserHint": "login_hint",
+    "oauth2DeviceCodeLifespan": "600",
     "clientOfflineSessionMaxLifespan": "0",
     "oauth2DevicePollingInterval": "5",
     "clientSessionIdleTimeout": "0",
-    "clientOfflineSessionIdleTimeout": "0",
-    "cibaInterval": "5",
-    "realmReusableOtpCode": "false",
-    "cibaExpiresIn": "120",
-    "oauth2DeviceCodeLifespan": "600",
     "parRequestUriLifespan": "60",
     "clientSessionMaxLifespan": "0",
-    "organizationsEnabled": "false"
+    "clientOfflineSessionIdleTimeout": "0",
+    "cibaInterval": "5",
+    "realmReusableOtpCode": "false"
   },
-  "keycloakVersion": "25.0.0",
+  "keycloakVersion": "21.1.0",
   "userManagedAccessAllowed": false,
-  "organizationsEnabled": false,
   "clientProfiles": {
     "profiles": []
   },
diff --git a/deployments/examples/ocis_keycloak/docker-compose.yml b/deployments/examples/ocis_keycloak/docker-compose.yml
index 922aeefd217..2944477b02e 100644
--- a/deployments/examples/ocis_keycloak/docker-compose.yml
+++ b/deployments/examples/ocis_keycloak/docker-compose.yml
@@ -112,7 +112,7 @@ services:
     restart: always
 
   keycloak:
-    image: quay.io/keycloak/keycloak:25.0.0
+    image: quay.io/keycloak/keycloak:24.0.1
     networks:
       ocis-net:
     command: ["start", "--proxy=edge", "--spi-connections-http-client-default-disable-trust-manager=${INSECURE:-false}", "--import-realm"]
diff --git a/go.mod b/go.mod
index 56a433063ef..3538cf06d7f 100644
--- a/go.mod
+++ b/go.mod
@@ -15,7 +15,7 @@ require (
 	github.com/cenkalti/backoff v2.2.1+incompatible
 	github.com/coreos/go-oidc/v3 v3.10.0
 	github.com/cs3org/go-cs3apis v0.0.0-20231023073225-7748710e0781
-	github.com/cs3org/reva/v2 v2.19.2-0.20240607120909-0a9c7b8bef6a
+	github.com/cs3org/reva/v2 v2.19.2-0.20240618080316-ed0273c9db9b
 	github.com/dhowden/tag v0.0.0-20230630033851-978a0926ee25
 	github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
 	github.com/egirna/icap-client v0.1.1
@@ -83,7 +83,7 @@ require (
 	github.com/shamaton/msgpack/v2 v2.2.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/afero v1.11.0
-	github.com/spf13/cobra v1.8.1
+	github.com/spf13/cobra v1.8.0
 	github.com/stretchr/testify v1.9.0
 	github.com/test-go/testify v1.1.4
 	github.com/thejerf/suture/v4 v4.0.5
diff --git a/go.sum b/go.sum
index 2db88cc01ff..3886058b60b 100644
--- a/go.sum
+++ b/go.sum
@@ -1015,6 +1015,7 @@ github.com/cornelk/hashmap v1.0.8/go.mod h1:RfZb7JO3RviW/rT6emczVuC/oxpdz4UsSB2L
 github.com/cpu/goacmedns v0.1.1/go.mod h1:MuaouqEhPAHxsbqjgnck5zeghuwBP1dLnPoobeGqugQ=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4=
 github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
@@ -1024,8 +1025,8 @@ github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c=
 github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME=
 github.com/cs3org/go-cs3apis v0.0.0-20231023073225-7748710e0781 h1:BUdwkIlf8IS2FasrrPg8gGPHQPOrQ18MS1Oew2tmGtY=
 github.com/cs3org/go-cs3apis v0.0.0-20231023073225-7748710e0781/go.mod h1:UXha4TguuB52H14EMoSsCqDj7k8a/t7g4gVP+bgY5LY=
-github.com/cs3org/reva/v2 v2.19.2-0.20240607120909-0a9c7b8bef6a h1:D1Pg9i+pZhzn/h5397/ukX0XYYPBaUVLh6Zhe83vKUg=
-github.com/cs3org/reva/v2 v2.19.2-0.20240607120909-0a9c7b8bef6a/go.mod h1:lKqw0VuP1NcZbhj0e6tGoAGq3tgWO/pLafVJyDK0yVI=
+github.com/cs3org/reva/v2 v2.19.2-0.20240618080316-ed0273c9db9b h1:IPFiNd8Xev9WxAt+LkJUxnbyU8Y1rGi5Ha0S+ZNObr8=
+github.com/cs3org/reva/v2 v2.19.2-0.20240618080316-ed0273c9db9b/go.mod h1:Rb2XnhpGKnH7k6WBFZlMygbyBxW6ma09Z4Uk+ro0v+A=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=
 github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
 github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
@@ -1995,8 +1996,8 @@ github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNo
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cobra v1.1.1/go.mod h1:WnodtKOvamDL/PwE2M4iKs8aMDBZ5Q5klgD3qfVJQMI=
-github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
-github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
diff --git a/ocis/docker/manifest.production.tmpl b/ocis/docker/manifest.production.tmpl
index 29428742cf1..10c45ca1126 100644
--- a/ocis/docker/manifest.production.tmpl
+++ b/ocis/docker/manifest.production.tmpl
@@ -1,4 +1,4 @@
-image: owncloud/ocis:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}master{{/if}}
+image: owncloud/ocis:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}
 {{#if build.tags}}
 tags:
 {{#each build.tags}}
diff --git a/ocis/docker/manifest.tmpl b/ocis/docker/manifest.tmpl
index 71ac9aad6e8..5df44182a1e 100644
--- a/ocis/docker/manifest.tmpl
+++ b/ocis/docker/manifest.tmpl
@@ -1,4 +1,4 @@
-image: owncloud/ocis-rolling:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}master{{/if}}
+image: owncloud/ocis-rolling:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}
 {{#if build.tags}}
 tags:
 {{#each build.tags}}
diff --git a/services/frontend/pkg/command/events.go b/services/frontend/pkg/command/events.go
index b7cb4b6217a..2487165533a 100644
--- a/services/frontend/pkg/command/events.go
+++ b/services/frontend/pkg/command/events.go
@@ -3,17 +3,14 @@ package command
 import (
 	"context"
 	"errors"
-	"fmt"
-	"path"
-	"path/filepath"
-	"slices"
-	"strconv"
-	"strings"
 
 	"github.com/cs3org/reva/v2/pkg/events"
 	"github.com/cs3org/reva/v2/pkg/events/stream"
 	"github.com/cs3org/reva/v2/pkg/rgrpc/todo/pool"
 	"github.com/cs3org/reva/v2/pkg/utils"
+	"go-micro.dev/v4/metadata"
+	"google.golang.org/protobuf/types/known/fieldmaskpb"
+
 	"github.com/owncloud/ocis/v2/ocis-pkg/log"
 	"github.com/owncloud/ocis/v2/ocis-pkg/middleware"
 	"github.com/owncloud/ocis/v2/ocis-pkg/registry"
@@ -21,15 +18,13 @@ import (
 	"github.com/owncloud/ocis/v2/ocis-pkg/tracing"
 	"github.com/owncloud/ocis/v2/services/frontend/pkg/config"
 	"github.com/owncloud/ocis/v2/services/settings/pkg/store/defaults"
-	"go-micro.dev/v4/metadata"
-	"google.golang.org/protobuf/types/known/fieldmaskpb"
 
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	group "github.com/cs3org/go-cs3apis/cs3/identity/group/v1beta1"
 	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	collaboration "github.com/cs3org/go-cs3apis/cs3/sharing/collaboration/v1beta1"
-	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+
 	settingssvc "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/settings/v0"
 )
 
@@ -116,41 +111,23 @@ func AutoAcceptShares(ev events.ShareCreated, autoAcceptDefault bool, l log.Logg
 		return
 	}
 
-	uids, err := getUserIDs(ctx, gatewaySelector, ev.GranteeUserID, ev.GranteeGroupID)
+	userIDs, err := getUserIDs(ctx, gatewaySelector, ev.GranteeUserID, ev.GranteeGroupID)
 	if err != nil {
 		l.Error().Err(err).Msg("cannot get grantees")
 		return
 	}
 
-	gwc, err = gatewaySelector.Next()
-	if err != nil {
-		l.Error().Err(err).Msg("cannot get gateway client")
-		return
-	}
-	info, err := utils.GetResourceByID(ctx, ev.ItemID, gwc)
-	if err != nil {
-		l.Error().Err(err).Msg("error getting resource")
-		return
-	}
-
-	for _, uid := range uids {
+	for _, uid := range userIDs {
 		if !autoAcceptShares(ctx, uid, autoAcceptDefault, vs) {
 			continue
 		}
 
-		mp, err := getMountPoint(ctx, l, ev.ItemID, uid, gatewaySelector, info)
-		if err != nil {
-			l.Error().Err(err).Msg("error getting mount point")
-			continue
-
-		}
-
 		gwc, err := gatewaySelector.Next()
 		if err != nil {
 			l.Error().Err(err).Msg("cannot get gateway client")
 			continue
 		}
-		resp, err := gwc.UpdateReceivedShare(ctx, updateShareRequest(ev.ShareID, uid, mp))
+		resp, err := gwc.UpdateReceivedShare(ctx, updateShareRequest(ev.ShareID, uid))
 		if err != nil {
 			l.Error().Err(err).Msg("error sending grpc request")
 			continue
@@ -163,66 +140,6 @@ func AutoAcceptShares(ev events.ShareCreated, autoAcceptDefault bool, l log.Logg
 
 }
 
-func getMountPoint(ctx context.Context, l log.Logger, itemid *provider.ResourceId, uid *user.UserId, gatewaySelector pool.Selectable[gateway.GatewayAPIClient], info *provider.ResourceInfo) (string, error) {
-	lrs, err := getSharesList(ctx, gatewaySelector, uid)
-	if err != nil {
-		return "", err
-	}
-
-	// we need to sort the received shares by mount point in order to make things easier to evaluate.
-	base := path.Base(info.GetPath())
-	mount := base
-	mounts := make([]string, 0, len(lrs.Shares))
-	var exists bool
-
-	for _, s := range lrs.Shares {
-		if s.State != collaboration.ShareState_SHARE_STATE_ACCEPTED {
-			// we don't care about unaccepted shares
-			continue
-		}
-
-		if utils.ResourceIDEqual(s.GetShare().GetResourceId(), itemid) {
-			// a share to the same resource already exists and is mounted
-			return s.GetMountPoint().GetPath(), nil
-		}
-
-		if s.GetMountPoint().GetPath() == mount {
-			// does the shared resource still exist?
-			gwc, err := gatewaySelector.Next()
-			if err != nil {
-				l.Error().Err(err).Msg("cannot get gateway client")
-				continue
-			}
-			_, err = utils.GetResourceByID(ctx, s.GetShare().GetResourceId(), gwc)
-			if err == nil {
-				exists = true
-			}
-			// TODO we could delete shares here if the stat returns code NOT FOUND ... but listening for file deletes would be better
-		}
-		// collect all mount points
-		mounts = append(mounts, s.GetMountPoint().GetPath())
-	}
-
-	// If the mount point really already exists, we need to insert a number into the filename
-	if exists {
-		// now we have a list of shares, we want to iterate over all of them and check for name collisions agents a mount points list
-		for i := 1; i <= len(mounts)+1; i++ {
-			ext := filepath.Ext(base)
-			name := strings.TrimSuffix(base, ext)
-			// be smart about .tar.(gz|bz) files
-			if strings.HasSuffix(name, ".tar") {
-				name = strings.TrimSuffix(name, ".tar")
-				ext = ".tar" + ext
-			}
-			mount = name + " (" + strconv.Itoa(i) + ")" + ext
-			if !slices.Contains(mounts, mount) {
-				return mount, nil
-			}
-		}
-	}
-	return mount, nil
-}
-
 func getUserIDs(ctx context.Context, gatewaySelector pool.Selectable[gateway.GatewayAPIClient], uid *user.UserId, gid *group.GroupId) ([]*user.UserId, error) {
 	if uid != nil {
 		return []*user.UserId{uid}, nil
@@ -257,40 +174,15 @@ func autoAcceptShares(ctx context.Context, uid *user.UserId, defaultValue bool,
 	return defaultValue
 }
 
-func updateShareRequest(shareID *collaboration.ShareId, uid *user.UserId, path string) *collaboration.UpdateReceivedShareRequest {
+func updateShareRequest(shareID *collaboration.ShareId, uid *user.UserId) *collaboration.UpdateReceivedShareRequest {
 	return &collaboration.UpdateReceivedShareRequest{
 		Opaque: utils.AppendJSONToOpaque(nil, "userid", uid),
 		Share: &collaboration.ReceivedShare{
 			Share: &collaboration.Share{
 				Id: shareID,
 			},
-			MountPoint: &provider.Reference{
-				Path: path,
-			},
 			State: collaboration.ShareState_SHARE_STATE_ACCEPTED,
 		},
-		UpdateMask: &fieldmaskpb.FieldMask{Paths: []string{"state", "mount_point"}},
-	}
-}
-
-// getSharesList gets the list of all shares for the given user.
-func getSharesList(ctx context.Context, gatewaySelector pool.Selectable[gateway.GatewayAPIClient], uid *user.UserId) (*collaboration.ListReceivedSharesResponse, error) {
-	gwc, err := gatewaySelector.Next()
-	if err != nil {
-		return nil, err
-	}
-	shares, err := gwc.ListReceivedShares(ctx, &collaboration.ListReceivedSharesRequest{
-		Opaque: utils.AppendJSONToOpaque(nil, "userid", uid),
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	if shares.Status.Code != rpc.Code_CODE_OK {
-		if shares.Status.Code == rpc.Code_CODE_NOT_FOUND {
-			return nil, fmt.Errorf("not found")
-		}
-		return nil, fmt.Errorf(shares.GetStatus().GetMessage())
+		UpdateMask: &fieldmaskpb.FieldMask{Paths: []string{"state"}},
 	}
-	return shares, nil
 }
diff --git a/services/graph/pkg/errorcode/cs3.go b/services/graph/pkg/errorcode/cs3.go
index 9367d93fcbd..37524bacd5d 100644
--- a/services/graph/pkg/errorcode/cs3.go
+++ b/services/graph/pkg/errorcode/cs3.go
@@ -5,6 +5,7 @@ import (
 
 	cs3rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+
 	"github.com/cs3org/reva/v2/pkg/utils"
 )
 
@@ -19,12 +20,13 @@ import (
 // This function is particularly useful when dealing with CS3 responses,
 // and a unified error handling within the application is necessary.
 func FromCS3Status(status *cs3rpc.Status, inerr error, ignore ...cs3rpc.Code) error {
+	err := Error{errorCode: GeneralException, msg: "unspecified error has occurred", origin: ErrorOriginCS3}
+
 	if inerr != nil {
-		return Error{msg: inerr.Error(), errorCode: GeneralException}
+		err.msg = inerr.Error()
+		return err
 	}
 
-	err := Error{errorCode: GeneralException, msg: "unspecified error has occurred"}
-
 	if status != nil {
 		err.msg = status.GetMessage()
 	}
diff --git a/services/graph/pkg/errorcode/errorcode.go b/services/graph/pkg/errorcode/errorcode.go
index f4a9bda4102..297c334e101 100644
--- a/services/graph/pkg/errorcode/errorcode.go
+++ b/services/graph/pkg/errorcode/errorcode.go
@@ -12,15 +12,28 @@ import (
 	libregraph "github.com/owncloud/libre-graph-api-go"
 )
 
-// ErrorCode defines code as used in MS Graph - see https://docs.microsoft.com/en-us/graph/errors?context=graph%2Fapi%2F1.0&view=graph-rest-1.0
-type ErrorCode int
-
 // Error defines a custom error struct, containing and MS Graph error code and a textual error message
 type Error struct {
 	errorCode ErrorCode
 	msg       string
+	origin    ErrorOrigin
 }
 
+// ErrorOrigin gives information about where the error originated
+type ErrorOrigin int
+
+const (
+	// ErrorOriginUnknown is the default error source
+	// and indicates that the error does not have any information about its origin
+	ErrorOriginUnknown ErrorOrigin = iota
+
+	// ErrorOriginCS3 indicates that the error originated from a CS3 service
+	ErrorOriginCS3
+)
+
+// ErrorCode defines code as used in MS Graph - see https://docs.microsoft.com/en-us/graph/errors?context=graph%2Fapi%2F1.0&view=graph-rest-1.0
+type ErrorCode int
+
 // List taken from https://github.com/microsoft/microsoft-graph-docs-1/blob/main/concepts/errors.md#code-property
 const (
 	// AccessDenied defines the error if the caller doesn't have permission to perform the action.
@@ -148,7 +161,7 @@ func (e ErrorCode) String() string {
 	return errorCodes[e]
 }
 
-// Error return the concatenation of the error string and optional message
+// Error returns the concatenation of the error string and optional message
 func (e Error) Error() string {
 	errString := errorCodes[e.errorCode]
 	if e.msg != "" {
@@ -161,13 +174,35 @@ func (e Error) GetCode() ErrorCode {
 	return e.errorCode
 }
 
+// GetOrigin returns the source of the error
+func (e Error) GetOrigin() ErrorOrigin {
+	return e.origin
+}
+
+// WithOrigin returns a new Error with the provided origin
+func (e Error) WithOrigin(o ErrorOrigin) Error {
+	e.origin = o
+	return e
+}
+
 // RenderError render the Graph Error based on a code or default one
 func RenderError(w http.ResponseWriter, r *http.Request, err error) {
-	var errcode Error
-	if errors.As(err, &errcode) {
-		errcode.Render(w, r)
+	e, ok := ToError(err)
+	if !ok {
+		GeneralException.Render(w, r, http.StatusInternalServerError, err.Error())
 		return
 	}
 
-	GeneralException.Render(w, r, http.StatusInternalServerError, err.Error())
+	e.Render(w, r)
+}
+
+// ToError checks if the error is of type Error and returns it,
+// the second parameter indicates if the error conversion was successful
+func ToError(err error) (Error, bool) {
+	var e Error
+	if errors.As(err, &e) {
+		return e, true
+	}
+
+	return Error{}, false
 }
diff --git a/services/graph/pkg/service/v0/api_drives_drive_item.go b/services/graph/pkg/service/v0/api_drives_drive_item.go
index 962d427769c..2712b99ec1e 100644
--- a/services/graph/pkg/service/v0/api_drives_drive_item.go
+++ b/services/graph/pkg/service/v0/api_drives_drive_item.go
@@ -360,7 +360,7 @@ func (api DrivesDriveItemApi) DeleteDriveItem(w http.ResponseWriter, r *http.Req
 
 	shareID := ExtractShareIdFromResourceId(itemID)
 	if err := api.drivesDriveItemService.UnmountShare(ctx, shareID); err != nil {
-		api.logger.Debug().Err(err).Msg(err.Error())
+		api.logger.Debug().Err(err).Msg(ErrUnmountShare.Error())
 		errorcode.RenderError(w, r, err)
 		return
 	}
@@ -518,8 +518,15 @@ func (api DrivesDriveItemApi) CreateDriveItem(w http.ResponseWriter, r *http.Req
 
 	mountedShares, err := api.drivesDriveItemService.MountShare(ctx, &resourceId, requestDriveItem.GetName())
 	if err != nil {
-		api.logger.Debug().Err(err).Msg(err.Error())
-		errorcode.RenderError(w, r, err)
+		api.logger.Debug().Err(err).Msg(ErrMountShare.Error())
+
+		switch e, ok := errorcode.ToError(err); {
+		case ok && e.GetOrigin() == errorcode.ErrorOriginCS3 && e.GetCode() == errorcode.ItemNotFound:
+			ErrDriveItemConversion.Render(w, r)
+		default:
+			errorcode.RenderError(w, r, err)
+		}
+
 		return
 	}
 
diff --git a/services/notifications/pkg/email/l10n/locale/ca/LC_MESSAGES/notifications.po b/services/notifications/pkg/email/l10n/locale/ca/LC_MESSAGES/notifications.po
index 4ef8ad7defe..5ad58d5ff27 100644
--- a/services/notifications/pkg/email/l10n/locale/ca/LC_MESSAGES/notifications.po
+++ b/services/notifications/pkg/email/l10n/locale/ca/LC_MESSAGES/notifications.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-04-19 11:11+0000\n"
 "Last-Translator: Arnau Morancho, 2023\n"
 "Language-Team: Catalan (https://app.transifex.com/owncloud-org/teams/6149/ca/)\n"
diff --git a/services/notifications/pkg/email/l10n/locale/de/LC_MESSAGES/notifications.po b/services/notifications/pkg/email/l10n/locale/de/LC_MESSAGES/notifications.po
index 5e583321ce2..5c578d8daee 100644
--- a/services/notifications/pkg/email/l10n/locale/de/LC_MESSAGES/notifications.po
+++ b/services/notifications/pkg/email/l10n/locale/de/LC_MESSAGES/notifications.po
@@ -13,7 +13,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-04-19 11:11+0000\n"
 "Last-Translator: Michael Barz <mbarz@owncloud.com>, 2023\n"
 "Language-Team: German (https://app.transifex.com/owncloud-org/teams/6149/de/)\n"
diff --git a/services/notifications/pkg/email/l10n/locale/de_DE/LC_MESSAGES/notifications.po b/services/notifications/pkg/email/l10n/locale/de_DE/LC_MESSAGES/notifications.po
index c6b052cbcb2..a55fc2361cd 100644
--- a/services/notifications/pkg/email/l10n/locale/de_DE/LC_MESSAGES/notifications.po
+++ b/services/notifications/pkg/email/l10n/locale/de_DE/LC_MESSAGES/notifications.po
@@ -12,7 +12,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-04-19 11:11+0000\n"
 "Last-Translator: Michael Barz <mbarz@owncloud.com>, 2023\n"
 "Language-Team: German (Germany) (https://app.transifex.com/owncloud-org/teams/6149/de_DE/)\n"
diff --git a/services/notifications/pkg/email/l10n/locale/en_GB/LC_MESSAGES/notifications.po b/services/notifications/pkg/email/l10n/locale/en_GB/LC_MESSAGES/notifications.po
index 7c9d9795e2f..36a02158867 100644
--- a/services/notifications/pkg/email/l10n/locale/en_GB/LC_MESSAGES/notifications.po
+++ b/services/notifications/pkg/email/l10n/locale/en_GB/LC_MESSAGES/notifications.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-04-19 11:11+0000\n"
 "Last-Translator: Andi Chandler <andi@gowling.com>, 2023\n"
 "Language-Team: English (United Kingdom) (https://app.transifex.com/owncloud-org/teams/6149/en_GB/)\n"
diff --git a/services/notifications/pkg/email/l10n/locale/es/LC_MESSAGES/notifications.po b/services/notifications/pkg/email/l10n/locale/es/LC_MESSAGES/notifications.po
index 09c473f4595..3bcc676f3e0 100644
--- a/services/notifications/pkg/email/l10n/locale/es/LC_MESSAGES/notifications.po
+++ b/services/notifications/pkg/email/l10n/locale/es/LC_MESSAGES/notifications.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-04-19 11:11+0000\n"
 "Last-Translator: Juan Carlos Garrote, 2023\n"
 "Language-Team: Spanish (https://app.transifex.com/owncloud-org/teams/6149/es/)\n"
diff --git a/services/notifications/pkg/email/l10n/locale/ko/LC_MESSAGES/notifications.po b/services/notifications/pkg/email/l10n/locale/ko/LC_MESSAGES/notifications.po
index 66b73bd08b4..1f7095bd9d3 100644
--- a/services/notifications/pkg/email/l10n/locale/ko/LC_MESSAGES/notifications.po
+++ b/services/notifications/pkg/email/l10n/locale/ko/LC_MESSAGES/notifications.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-04-19 11:11+0000\n"
 "Last-Translator: Hugo Blackwood, 2023\n"
 "Language-Team: Korean (https://app.transifex.com/owncloud-org/teams/6149/ko/)\n"
diff --git a/services/notifications/pkg/email/l10n/locale/pt_BR/LC_MESSAGES/notifications.po b/services/notifications/pkg/email/l10n/locale/pt_BR/LC_MESSAGES/notifications.po
index 49c401b674a..c02a7829a95 100644
--- a/services/notifications/pkg/email/l10n/locale/pt_BR/LC_MESSAGES/notifications.po
+++ b/services/notifications/pkg/email/l10n/locale/pt_BR/LC_MESSAGES/notifications.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-04-19 11:11+0000\n"
 "Last-Translator: Flávio Veras <flaviove@gmail.com>, 2023\n"
 "Language-Team: Portuguese (Brazil) (https://app.transifex.com/owncloud-org/teams/6149/pt_BR/)\n"
diff --git a/services/notifications/pkg/email/l10n/locale/sq/LC_MESSAGES/notifications.po b/services/notifications/pkg/email/l10n/locale/sq/LC_MESSAGES/notifications.po
index 05e7bd48d78..9b9840fe43d 100644
--- a/services/notifications/pkg/email/l10n/locale/sq/LC_MESSAGES/notifications.po
+++ b/services/notifications/pkg/email/l10n/locale/sq/LC_MESSAGES/notifications.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-04-19 11:11+0000\n"
 "Last-Translator: Besnik Bleta <besnik@programeshqip.org>, 2024\n"
 "Language-Team: Albanian (https://app.transifex.com/owncloud-org/teams/6149/sq/)\n"
diff --git a/services/notifications/pkg/email/l10n/locale/tr/LC_MESSAGES/notifications.po b/services/notifications/pkg/email/l10n/locale/tr/LC_MESSAGES/notifications.po
index eb0be7f6ea8..a81d4993760 100644
--- a/services/notifications/pkg/email/l10n/locale/tr/LC_MESSAGES/notifications.po
+++ b/services/notifications/pkg/email/l10n/locale/tr/LC_MESSAGES/notifications.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-04-19 11:11+0000\n"
 "Last-Translator: Begüm Topyıldız <bgmtpyldz@gmail.com>, 2023\n"
 "Language-Team: Turkish (https://app.transifex.com/owncloud-org/teams/6149/tr/)\n"
diff --git a/services/notifications/pkg/email/l10n/locale/zh-Hans/LC_MESSAGES/notifications.po b/services/notifications/pkg/email/l10n/locale/zh-Hans/LC_MESSAGES/notifications.po
index 013148ee721..bc689dfb315 100644
--- a/services/notifications/pkg/email/l10n/locale/zh-Hans/LC_MESSAGES/notifications.po
+++ b/services/notifications/pkg/email/l10n/locale/zh-Hans/LC_MESSAGES/notifications.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-04-19 11:11+0000\n"
 "Last-Translator: Shouyuan, 2023\n"
 "Language-Team: Chinese Simplified (https://app.transifex.com/owncloud-org/teams/6149/zh-Hans/)\n"
diff --git a/services/notifications/pkg/email/l10n/locale/zh_CN/LC_MESSAGES/notifications.po b/services/notifications/pkg/email/l10n/locale/zh_CN/LC_MESSAGES/notifications.po
index b5c1c5e7ee8..ae9388805dc 100644
--- a/services/notifications/pkg/email/l10n/locale/zh_CN/LC_MESSAGES/notifications.po
+++ b/services/notifications/pkg/email/l10n/locale/zh_CN/LC_MESSAGES/notifications.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-04-19 11:11+0000\n"
 "Last-Translator: Shouyuan, 2023\n"
 "Language-Team: Chinese (China) (https://app.transifex.com/owncloud-org/teams/6149/zh_CN/)\n"
diff --git a/services/userlog/pkg/service/l10n/locale/bg_BG/LC_MESSAGES/userlog.po b/services/userlog/pkg/service/l10n/locale/bg_BG/LC_MESSAGES/userlog.po
index 7f9443b7e25..3650c4d12d6 100644
--- a/services/userlog/pkg/service/l10n/locale/bg_BG/LC_MESSAGES/userlog.po
+++ b/services/userlog/pkg/service/l10n/locale/bg_BG/LC_MESSAGES/userlog.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-03-15 08:28+0000\n"
 "Last-Translator: Martin Zhekov <martin03staff@gmail.com>, 2023\n"
 "Language-Team: Bulgarian (Bulgaria) (https://app.transifex.com/owncloud-org/teams/6149/bg_BG/)\n"
diff --git a/services/userlog/pkg/service/l10n/locale/de/LC_MESSAGES/userlog.po b/services/userlog/pkg/service/l10n/locale/de/LC_MESSAGES/userlog.po
index 66550e46177..880383f4410 100644
--- a/services/userlog/pkg/service/l10n/locale/de/LC_MESSAGES/userlog.po
+++ b/services/userlog/pkg/service/l10n/locale/de/LC_MESSAGES/userlog.po
@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-03-15 08:28+0000\n"
 "Last-Translator: Michael Barz <mbarz@owncloud.com>, 2023\n"
 "Language-Team: German (https://app.transifex.com/owncloud-org/teams/6149/de/)\n"
diff --git a/services/userlog/pkg/service/l10n/locale/de_DE/LC_MESSAGES/userlog.po b/services/userlog/pkg/service/l10n/locale/de_DE/LC_MESSAGES/userlog.po
index 902b4f34bf3..c877d74629c 100644
--- a/services/userlog/pkg/service/l10n/locale/de_DE/LC_MESSAGES/userlog.po
+++ b/services/userlog/pkg/service/l10n/locale/de_DE/LC_MESSAGES/userlog.po
@@ -13,7 +13,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-03-15 08:28+0000\n"
 "Last-Translator: Edith Parzefall, 2024\n"
 "Language-Team: German (Germany) (https://app.transifex.com/owncloud-org/teams/6149/de_DE/)\n"
diff --git a/services/userlog/pkg/service/l10n/locale/en_GB/LC_MESSAGES/userlog.po b/services/userlog/pkg/service/l10n/locale/en_GB/LC_MESSAGES/userlog.po
index 9eba7810283..b9de1e9180e 100644
--- a/services/userlog/pkg/service/l10n/locale/en_GB/LC_MESSAGES/userlog.po
+++ b/services/userlog/pkg/service/l10n/locale/en_GB/LC_MESSAGES/userlog.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-03-15 08:28+0000\n"
 "Last-Translator: Andi Chandler <andi@gowling.com>, 2023\n"
 "Language-Team: English (United Kingdom) (https://app.transifex.com/owncloud-org/teams/6149/en_GB/)\n"
diff --git a/services/userlog/pkg/service/l10n/locale/es/LC_MESSAGES/userlog.po b/services/userlog/pkg/service/l10n/locale/es/LC_MESSAGES/userlog.po
index 99479c3c4c3..1308b78dbc3 100644
--- a/services/userlog/pkg/service/l10n/locale/es/LC_MESSAGES/userlog.po
+++ b/services/userlog/pkg/service/l10n/locale/es/LC_MESSAGES/userlog.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-03-15 08:28+0000\n"
 "Last-Translator: Juan Carlos Garrote, 2023\n"
 "Language-Team: Spanish (https://app.transifex.com/owncloud-org/teams/6149/es/)\n"
diff --git a/services/userlog/pkg/service/l10n/locale/ko/LC_MESSAGES/userlog.po b/services/userlog/pkg/service/l10n/locale/ko/LC_MESSAGES/userlog.po
index b35606bb853..22b3f00b3cd 100644
--- a/services/userlog/pkg/service/l10n/locale/ko/LC_MESSAGES/userlog.po
+++ b/services/userlog/pkg/service/l10n/locale/ko/LC_MESSAGES/userlog.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-03-15 08:28+0000\n"
 "Last-Translator: Hugo Blackwood, 2023\n"
 "Language-Team: Korean (https://app.transifex.com/owncloud-org/teams/6149/ko/)\n"
diff --git a/services/userlog/pkg/service/l10n/locale/pt_BR/LC_MESSAGES/userlog.po b/services/userlog/pkg/service/l10n/locale/pt_BR/LC_MESSAGES/userlog.po
index 014cb6b0db5..09a46a5861f 100644
--- a/services/userlog/pkg/service/l10n/locale/pt_BR/LC_MESSAGES/userlog.po
+++ b/services/userlog/pkg/service/l10n/locale/pt_BR/LC_MESSAGES/userlog.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-03-15 08:28+0000\n"
 "Last-Translator: Flávio Veras <flaviove@gmail.com>, 2023\n"
 "Language-Team: Portuguese (Brazil) (https://app.transifex.com/owncloud-org/teams/6149/pt_BR/)\n"
diff --git a/services/userlog/pkg/service/l10n/locale/sq/LC_MESSAGES/userlog.po b/services/userlog/pkg/service/l10n/locale/sq/LC_MESSAGES/userlog.po
index 71b8036461f..222104f8d46 100644
--- a/services/userlog/pkg/service/l10n/locale/sq/LC_MESSAGES/userlog.po
+++ b/services/userlog/pkg/service/l10n/locale/sq/LC_MESSAGES/userlog.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-03-15 08:28+0000\n"
 "Last-Translator: Besnik Bleta <besnik@programeshqip.org>, 2023\n"
 "Language-Team: Albanian (https://app.transifex.com/owncloud-org/teams/6149/sq/)\n"
diff --git a/services/userlog/pkg/service/l10n/locale/tr/LC_MESSAGES/userlog.po b/services/userlog/pkg/service/l10n/locale/tr/LC_MESSAGES/userlog.po
index e978ce45b6a..9c13d117cc0 100644
--- a/services/userlog/pkg/service/l10n/locale/tr/LC_MESSAGES/userlog.po
+++ b/services/userlog/pkg/service/l10n/locale/tr/LC_MESSAGES/userlog.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-03-15 08:28+0000\n"
 "Last-Translator: Begüm Topyıldız <bgmtpyldz@gmail.com>, 2023\n"
 "Language-Team: Turkish (https://app.transifex.com/owncloud-org/teams/6149/tr/)\n"
diff --git a/services/userlog/pkg/service/l10n/locale/zh-Hans/LC_MESSAGES/userlog.po b/services/userlog/pkg/service/l10n/locale/zh-Hans/LC_MESSAGES/userlog.po
index e890ed9cdb7..0746f1135c5 100644
--- a/services/userlog/pkg/service/l10n/locale/zh-Hans/LC_MESSAGES/userlog.po
+++ b/services/userlog/pkg/service/l10n/locale/zh-Hans/LC_MESSAGES/userlog.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-03-15 08:28+0000\n"
 "Last-Translator: fnoopv <fnoopv@outlook.com>, 2024\n"
 "Language-Team: Chinese Simplified (https://app.transifex.com/owncloud-org/teams/6149/zh-Hans/)\n"
diff --git a/services/userlog/pkg/service/l10n/locale/zh_CN/LC_MESSAGES/userlog.po b/services/userlog/pkg/service/l10n/locale/zh_CN/LC_MESSAGES/userlog.po
index 25fdbbf3abf..03d0e816b80 100644
--- a/services/userlog/pkg/service/l10n/locale/zh_CN/LC_MESSAGES/userlog.po
+++ b/services/userlog/pkg/service/l10n/locale/zh_CN/LC_MESSAGES/userlog.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2024-06-19 03:36+0000\n"
+"POT-Creation-Date: 2024-05-30 00:30+0000\n"
 "PO-Revision-Date: 2023-03-15 08:28+0000\n"
 "Last-Translator: Shouyuan, 2023\n"
 "Language-Team: Chinese (China) (https://app.transifex.com/owncloud-org/teams/6149/zh_CN/)\n"
diff --git a/vendor/github.com/cs3org/reva/v2/internal/grpc/services/usershareprovider/usershareprovider.go b/vendor/github.com/cs3org/reva/v2/internal/grpc/services/usershareprovider/usershareprovider.go
index 779409faac0..4bec8dd75d9 100644
--- a/vendor/github.com/cs3org/reva/v2/internal/grpc/services/usershareprovider/usershareprovider.go
+++ b/vendor/github.com/cs3org/reva/v2/internal/grpc/services/usershareprovider/usershareprovider.go
@@ -20,8 +20,11 @@ package usershareprovider
 
 import (
 	"context"
+	"path/filepath"
 	"regexp"
 	"slices"
+	"strconv"
+	"strings"
 
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
@@ -46,6 +49,12 @@ import (
 	"github.com/cs3org/reva/v2/pkg/utils"
 )
 
+const (
+	_fieldMaskPathMountPoint  = "mount_point"
+	_fieldMaskPathPermissions = "permissions"
+	_fieldMaskPathState       = "state"
+)
+
 func init() {
 	rgrpc.Register("usershareprovider", NewDefault)
 }
@@ -407,7 +416,7 @@ func (s *service) UpdateShare(ctx context.Context, req *collaboration.UpdateShar
 
 	// If this is a permissions update, check if user's permissions on the resource are sufficient to set the desired permissions
 	var newPermissions *provider.ResourcePermissions
-	if slices.Contains(req.GetUpdateMask().GetPaths(), "permissions") {
+	if slices.Contains(req.GetUpdateMask().GetPaths(), _fieldMaskPathPermissions) {
 		newPermissions = req.GetShare().GetPermissions().GetPermissions()
 	} else {
 		newPermissions = req.GetField().GetPermissions().GetPermissions()
@@ -497,40 +506,176 @@ func (s *service) GetReceivedShare(ctx context.Context, req *collaboration.GetRe
 }
 
 func (s *service) UpdateReceivedShare(ctx context.Context, req *collaboration.UpdateReceivedShareRequest) (*collaboration.UpdateReceivedShareResponse, error) {
-
-	if req.Share == nil {
-		return &collaboration.UpdateReceivedShareResponse{
-			Status: status.NewInvalid(ctx, "updating requires a received share object"),
-		}, nil
-	}
-	if req.Share.Share == nil {
-		return &collaboration.UpdateReceivedShareResponse{
-			Status: status.NewInvalid(ctx, "share missing"),
-		}, nil
-	}
-	if req.Share.Share.Id == nil {
-		return &collaboration.UpdateReceivedShareResponse{
-			Status: status.NewInvalid(ctx, "share id missing"),
-		}, nil
-	}
-	if req.Share.Share.Id.OpaqueId == "" {
+	if req.GetShare().GetShare().GetId().GetOpaqueId() == "" {
 		return &collaboration.UpdateReceivedShareResponse{
 			Status: status.NewInvalid(ctx, "share id empty"),
 		}, nil
 	}
 
+	isStateTransitionShareAccepted := slices.Contains(req.GetUpdateMask().GetPaths(), _fieldMaskPathState) && req.GetShare().GetState() == collaboration.ShareState_SHARE_STATE_ACCEPTED
+	isMountPointSet := slices.Contains(req.GetUpdateMask().GetPaths(), _fieldMaskPathMountPoint) && req.GetShare().GetMountPoint().GetPath() != ""
+	// we calculate a valid mountpoint only if the share should be accepted and the mount point is not set explicitly
+	if isStateTransitionShareAccepted && !isMountPointSet {
+		gatewayClient, err := s.gatewaySelector.Next()
+		if err != nil {
+			return nil, err
+		}
+
+		s, err := setReceivedShareMountPoint(ctx, gatewayClient, req)
+		switch {
+		case err != nil:
+			fallthrough
+		case s.GetCode() != rpc.Code_CODE_OK:
+			return &collaboration.UpdateReceivedShareResponse{
+				Status: s,
+			}, err
+		}
+	}
+
 	var uid userpb.UserId
 	_ = utils.ReadJSONFromOpaque(req.Opaque, "userid", &uid)
-	share, err := s.sm.UpdateReceivedShare(ctx, req.Share, req.UpdateMask, &uid)
+	updatedShare, err := s.sm.UpdateReceivedShare(ctx, req.Share, req.UpdateMask, &uid)
 	if err != nil {
 		return &collaboration.UpdateReceivedShareResponse{
 			Status: status.NewInternal(ctx, "error updating received share"),
 		}, nil
 	}
 
-	res := &collaboration.UpdateReceivedShareResponse{
+	return &collaboration.UpdateReceivedShareResponse{
 		Status: status.NewOK(ctx),
-		Share:  share,
+		Share:  updatedShare,
+	}, nil
+}
+
+func setReceivedShareMountPoint(ctx context.Context, gwc gateway.GatewayAPIClient, req *collaboration.UpdateReceivedShareRequest) (*rpc.Status, error) {
+	receivedShare, err := gwc.GetReceivedShare(ctx, &collaboration.GetReceivedShareRequest{
+		Ref: &collaboration.ShareReference{
+			Spec: &collaboration.ShareReference_Id{
+				Id: req.GetShare().GetShare().GetId(),
+			},
+		},
+	})
+	switch {
+	case err != nil:
+		fallthrough
+	case receivedShare.GetStatus().GetCode() != rpc.Code_CODE_OK:
+		return receivedShare.GetStatus(), err
 	}
-	return res, nil
+
+	if receivedShare.GetShare().GetMountPoint().GetPath() != "" {
+		return status.NewOK(ctx), nil
+	}
+
+	resourceStat, err := gwc.Stat(ctx, &provider.StatRequest{
+		Ref: &provider.Reference{
+			ResourceId: receivedShare.GetShare().GetShare().GetResourceId(),
+		},
+	})
+	switch {
+	case err != nil:
+		fallthrough
+	case resourceStat.GetStatus().GetCode() != rpc.Code_CODE_OK:
+		return resourceStat.GetStatus(), err
+	}
+
+	// handle mount point related updates
+	{
+		var userID *userpb.UserId
+		_ = utils.ReadJSONFromOpaque(req.Opaque, "userid", &userID)
+
+		// check if the requested mount point is available and if not, find a suitable one
+		availableMountpoint, _, err := GetMountpointAndUnmountedShares(ctx, gwc,
+			resourceStat.GetInfo().GetId(),
+			resourceStat.GetInfo().GetName(),
+			userID,
+		)
+		if err != nil {
+			return status.NewInternal(ctx, err.Error()), nil
+		}
+
+		if !slices.Contains(req.GetUpdateMask().GetPaths(), _fieldMaskPathMountPoint) {
+			req.GetUpdateMask().Paths = append(req.GetUpdateMask().GetPaths(), _fieldMaskPathMountPoint)
+		}
+
+		req.GetShare().MountPoint = &provider.Reference{
+			Path: availableMountpoint,
+		}
+	}
+
+	return status.NewOK(ctx), nil
+}
+
+// GetMountpointAndUnmountedShares returns a new or existing mountpoint for the given info and produces a list of unmounted received shares for the same resource
+func GetMountpointAndUnmountedShares(ctx context.Context, gwc gateway.GatewayAPIClient, id *provider.ResourceId, name string, userId *userpb.UserId) (string, []*collaboration.ReceivedShare, error) {
+	listReceivedSharesReq := &collaboration.ListReceivedSharesRequest{}
+	if userId != nil {
+		listReceivedSharesReq.Opaque = utils.AppendJSONToOpaque(nil, "userid", userId)
+	}
+
+	listReceivedSharesRes, err := gwc.ListReceivedShares(ctx, listReceivedSharesReq)
+	if err != nil {
+		return "", nil, errtypes.InternalError("grpc list received shares request failed")
+	}
+
+	if err := errtypes.NewErrtypeFromStatus(listReceivedSharesRes.GetStatus()); err != nil {
+		return "", nil, err
+	}
+
+	unmountedShares := []*collaboration.ReceivedShare{}
+	base := filepath.Clean(name)
+	mount := base
+	existingMountpoint := ""
+	mountedShares := make([]string, 0, len(listReceivedSharesRes.GetShares()))
+	var pathExists bool
+
+	for _, s := range listReceivedSharesRes.GetShares() {
+		resourceIDEqual := utils.ResourceIDEqual(s.GetShare().GetResourceId(), id)
+
+		if resourceIDEqual && s.State == collaboration.ShareState_SHARE_STATE_ACCEPTED {
+			// a share to the resource already exists and is mounted, remembers the mount point
+			_, err := utils.GetResourceByID(ctx, s.GetShare().GetResourceId(), gwc)
+			if err == nil {
+				existingMountpoint = s.GetMountPoint().GetPath()
+			}
+		}
+
+		if resourceIDEqual && s.State != collaboration.ShareState_SHARE_STATE_ACCEPTED {
+			// a share to the resource already exists but is not mounted, collect the unmounted share
+			unmountedShares = append(unmountedShares, s)
+		}
+
+		if s.State == collaboration.ShareState_SHARE_STATE_ACCEPTED {
+			// collect all accepted mount points
+			mountedShares = append(mountedShares, s.GetMountPoint().GetPath())
+			if s.GetMountPoint().GetPath() == mount {
+				// does the shared resource still exist?
+				_, err := utils.GetResourceByID(ctx, s.GetShare().GetResourceId(), gwc)
+				if err == nil {
+					pathExists = true
+				}
+				// TODO we could delete shares here if the stat returns code NOT FOUND ... but listening for file deletes would be better
+			}
+		}
+	}
+
+	if existingMountpoint != "" {
+		// we want to reuse the same mountpoint for all unmounted shares to the same resource
+		return existingMountpoint, unmountedShares, nil
+	}
+
+	// If the mount point really already exists, we need to insert a number into the filename
+	if pathExists {
+		// now we have a list of shares, we want to iterate over all of them and check for name collisions agents a mount points list
+		for i := 1; i <= len(mountedShares)+1; i++ {
+			ext := filepath.Ext(base)
+			name := strings.TrimSuffix(base, ext)
+
+			mount = name + " (" + strconv.Itoa(i) + ")" + ext
+			if !slices.Contains(mountedShares, mount) {
+				return mount, unmountedShares, nil
+			}
+		}
+	}
+
+	return mount, unmountedShares, nil
 }
diff --git a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/pending.go b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/pending.go
index 5ab1c1782c8..95028624460 100644
--- a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/pending.go
+++ b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/pending.go
@@ -23,24 +23,22 @@ import (
 	"fmt"
 	"net/http"
 	"path"
-	"path/filepath"
-	"slices"
 	"strconv"
-	"strings"
 
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	collaboration "github.com/cs3org/go-cs3apis/cs3/sharing/collaboration/v1beta1"
 	ocmv1beta1 "github.com/cs3org/go-cs3apis/cs3/sharing/ocm/v1beta1"
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	"github.com/go-chi/chi/v5"
+	"github.com/pkg/errors"
+	"google.golang.org/protobuf/types/known/fieldmaskpb"
+
+	"github.com/cs3org/reva/v2/internal/grpc/services/usershareprovider"
 	"github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/response"
 	"github.com/cs3org/reva/v2/pkg/appctx"
 	"github.com/cs3org/reva/v2/pkg/conversions"
 	"github.com/cs3org/reva/v2/pkg/errtypes"
-	"github.com/cs3org/reva/v2/pkg/utils"
-	"github.com/go-chi/chi/v5"
-	"github.com/pkg/errors"
-	"google.golang.org/protobuf/types/known/fieldmaskpb"
 )
 
 const (
@@ -75,8 +73,13 @@ func (h *Handler) AcceptReceivedShare(w http.ResponseWriter, r *http.Request) {
 		response.WriteOCSResponse(w, r, *ocsResponse, nil)
 		return
 	}
-
-	mount, unmountedShares, err := GetMountpointAndUnmountedShares(ctx, client, sharedResource.Info)
+	mount, unmountedShares, err := usershareprovider.GetMountpointAndUnmountedShares(
+		ctx,
+		client,
+		sharedResource.GetInfo().GetId(),
+		sharedResource.GetInfo().GetName(),
+		nil,
+	)
 	if err != nil {
 		response.WriteOCSError(w, r, response.MetaServerError.StatusCode, "could not determine mountpoint", err)
 		return
@@ -119,76 +122,6 @@ func (h *Handler) AcceptReceivedShare(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// GetMountpointAndUnmountedShares returns a new or existing mountpoint for the given info and produces a list of unmounted received shares for the same resource
-func GetMountpointAndUnmountedShares(ctx context.Context, gwc gateway.GatewayAPIClient, info *provider.ResourceInfo) (string, []*collaboration.ReceivedShare, error) {
-	unmountedShares := []*collaboration.ReceivedShare{}
-	receivedShares, err := listReceivedShares(ctx, gwc)
-	if err != nil {
-		return "", unmountedShares, err
-	}
-
-	// we need to sort the received shares by mount point in order to make things easier to evaluate.
-	base := filepath.Clean(info.Name)
-	mount := base
-	existingMountpoint := ""
-	mountedShares := make([]string, 0, len(receivedShares))
-	var pathExists bool
-
-	for _, s := range receivedShares {
-		resourceIDEqual := utils.ResourceIDEqual(s.GetShare().GetResourceId(), info.GetId())
-
-		if resourceIDEqual && s.State == collaboration.ShareState_SHARE_STATE_ACCEPTED {
-			// a share to the resource already exists and is mounted, remember the mount point
-			_, err := utils.GetResourceByID(ctx, s.GetShare().GetResourceId(), gwc)
-			if err == nil {
-				existingMountpoint = s.GetMountPoint().GetPath()
-			}
-		}
-
-		if resourceIDEqual && s.State != collaboration.ShareState_SHARE_STATE_ACCEPTED {
-			// a share to the resource already exists but is not mounted, collect the unmounted share
-			unmountedShares = append(unmountedShares, s)
-		}
-
-		if s.State == collaboration.ShareState_SHARE_STATE_ACCEPTED {
-			// collect all accepted mount points
-			mountedShares = append(mountedShares, s.GetMountPoint().GetPath())
-			if s.GetMountPoint().GetPath() == mount {
-				// does the shared resource still exist?
-				_, err := utils.GetResourceByID(ctx, s.GetShare().GetResourceId(), gwc)
-				if err == nil {
-					pathExists = true
-				}
-				// TODO we could delete shares here if the stat returns code NOT FOUND ... but listening for file deletes would be better
-			}
-		}
-	}
-
-	if existingMountpoint != "" {
-		// we want to reuse the same mountpoint for all unmounted shares to the same resource
-		return existingMountpoint, unmountedShares, nil
-	}
-
-	// If the mount point really already exists, we need to insert a number into the filename
-	if pathExists {
-		// now we have a list of shares, we want to iterate over all of them and check for name collisions agents a mount points list
-		for i := 1; i <= len(mountedShares)+1; i++ {
-			ext := filepath.Ext(base)
-			name := strings.TrimSuffix(base, ext)
-			// be smart about .tar.(gz|bz) files
-			if strings.HasSuffix(name, ".tar") {
-				name = strings.TrimSuffix(name, ".tar")
-				ext = ".tar" + ext
-			}
-			mount = name + " (" + strconv.Itoa(i) + ")" + ext
-			if !slices.Contains(mountedShares, mount) {
-				return mount, unmountedShares, nil
-			}
-		}
-	}
-	return mount, unmountedShares, nil
-}
-
 // RejectReceivedShare handles DELETE Requests on /apps/files_sharing/api/v1/shares/{shareid}
 func (h *Handler) RejectReceivedShare(w http.ResponseWriter, r *http.Request) {
 	shareID := chi.URLParam(r, "shareid")
diff --git a/vendor/github.com/cs3org/reva/v2/pkg/storage/fs/posix/blobstore/blobstore.go b/vendor/github.com/cs3org/reva/v2/pkg/storage/fs/posix/blobstore/blobstore.go
index eee4a3f8c44..bdbeb4536d7 100644
--- a/vendor/github.com/cs3org/reva/v2/pkg/storage/fs/posix/blobstore/blobstore.go
+++ b/vendor/github.com/cs3org/reva/v2/pkg/storage/fs/posix/blobstore/blobstore.go
@@ -47,10 +47,11 @@ func (bs *Blobstore) Upload(node *node.Node, source string) error {
 	}
 	defer file.Close()
 
-	f, err := os.OpenFile(node.InternalPath(), os.O_CREATE|os.O_WRONLY, 0700)
+	f, err := os.OpenFile(node.InternalPath(), os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0700)
 	if err != nil {
 		return errors.Wrapf(err, "could not open blob '%s' for writing", node.InternalPath())
 	}
+	defer f.Close()
 
 	w := bufio.NewWriter(f)
 	_, err = w.ReadFrom(file)
diff --git a/vendor/github.com/spf13/cobra/.golangci.yml b/vendor/github.com/spf13/cobra/.golangci.yml
index 2c8f4808c1a..a618ec24d84 100644
--- a/vendor/github.com/spf13/cobra/.golangci.yml
+++ b/vendor/github.com/spf13/cobra/.golangci.yml
@@ -26,28 +26,33 @@ linters:
     - errcheck
     #- exhaustive
     #- funlen
+    - gas
     #- gochecknoinits
     - goconst
-    - gocritic
+    #- gocritic
     #- gocyclo
-    - gofmt
+    #- gofmt
     - goimports
+    - golint
     #- gomnd
     #- goprintffuncname
-    - gosec
-    - gosimple
+    #- gosec
+    #- gosimple
     - govet
     - ineffassign
+    - interfacer
     #- lll
-    - misspell
+    - maligned
+    - megacheck
+    #- misspell
     #- nakedret
     #- noctx
-    - nolintlint
+    #- nolintlint
     #- rowserrcheck
     #- scopelint
-    - staticcheck
+    #- staticcheck
     #- structcheck ! deprecated since v1.49.0; replaced by 'unused'
-    - stylecheck
+    #- stylecheck
     #- typecheck
     - unconvert
     #- unparam
diff --git a/vendor/github.com/spf13/cobra/active_help.go b/vendor/github.com/spf13/cobra/active_help.go
index 25c30e3ccc3..5f965e057f2 100644
--- a/vendor/github.com/spf13/cobra/active_help.go
+++ b/vendor/github.com/spf13/cobra/active_help.go
@@ -17,17 +17,21 @@ package cobra
 import (
 	"fmt"
 	"os"
+	"regexp"
+	"strings"
 )
 
 const (
 	activeHelpMarker = "_activeHelp_ "
 	// The below values should not be changed: programs will be using them explicitly
 	// in their user documentation, and users will be using them explicitly.
-	activeHelpEnvVarSuffix  = "ACTIVE_HELP"
-	activeHelpGlobalEnvVar  = configEnvVarGlobalPrefix + "_" + activeHelpEnvVarSuffix
+	activeHelpEnvVarSuffix  = "_ACTIVE_HELP"
+	activeHelpGlobalEnvVar  = "COBRA_ACTIVE_HELP"
 	activeHelpGlobalDisable = "0"
 )
 
+var activeHelpEnvVarPrefixSubstRegexp = regexp.MustCompile(`[^A-Z0-9_]`)
+
 // AppendActiveHelp adds the specified string to the specified array to be used as ActiveHelp.
 // Such strings will be processed by the completion script and will be shown as ActiveHelp
 // to the user.
@@ -56,5 +60,8 @@ func GetActiveHelpConfig(cmd *Command) string {
 // variable.  It has the format <PROGRAM>_ACTIVE_HELP where <PROGRAM> is the name of the
 // root command in upper case, with all non-ASCII-alphanumeric characters replaced by `_`.
 func activeHelpEnvVar(name string) string {
-	return configEnvVar(name, activeHelpEnvVarSuffix)
+	// This format should not be changed: users will be using it explicitly.
+	activeHelpEnvVar := strings.ToUpper(fmt.Sprintf("%s%s", name, activeHelpEnvVarSuffix))
+	activeHelpEnvVar = activeHelpEnvVarPrefixSubstRegexp.ReplaceAllString(activeHelpEnvVar, "_")
+	return activeHelpEnvVar
 }
diff --git a/vendor/github.com/spf13/cobra/args.go b/vendor/github.com/spf13/cobra/args.go
index ed1e70ceaa4..e79ec33a81d 100644
--- a/vendor/github.com/spf13/cobra/args.go
+++ b/vendor/github.com/spf13/cobra/args.go
@@ -52,9 +52,9 @@ func OnlyValidArgs(cmd *Command, args []string) error {
 	if len(cmd.ValidArgs) > 0 {
 		// Remove any description that may be included in ValidArgs.
 		// A description is following a tab character.
-		validArgs := make([]string, 0, len(cmd.ValidArgs))
+		var validArgs []string
 		for _, v := range cmd.ValidArgs {
-			validArgs = append(validArgs, strings.SplitN(v, "\t", 2)[0])
+			validArgs = append(validArgs, strings.Split(v, "\t")[0])
 		}
 		for _, v := range args {
 			if !stringInSlice(v, validArgs) {
diff --git a/vendor/github.com/spf13/cobra/bash_completions.go b/vendor/github.com/spf13/cobra/bash_completions.go
index f4d198cbcbd..8a531518409 100644
--- a/vendor/github.com/spf13/cobra/bash_completions.go
+++ b/vendor/github.com/spf13/cobra/bash_completions.go
@@ -597,16 +597,19 @@ func writeRequiredFlag(buf io.StringWriter, cmd *Command) {
 		if nonCompletableFlag(flag) {
 			return
 		}
-		if _, ok := flag.Annotations[BashCompOneRequiredFlag]; ok {
-			format := "    must_have_one_flag+=(\"--%s"
-			if flag.Value.Type() != "bool" {
-				format += "="
-			}
-			format += cbn
-			WriteStringAndCheck(buf, fmt.Sprintf(format, flag.Name))
-
-			if len(flag.Shorthand) > 0 {
-				WriteStringAndCheck(buf, fmt.Sprintf("    must_have_one_flag+=(\"-%s"+cbn, flag.Shorthand))
+		for key := range flag.Annotations {
+			switch key {
+			case BashCompOneRequiredFlag:
+				format := "    must_have_one_flag+=(\"--%s"
+				if flag.Value.Type() != "bool" {
+					format += "="
+				}
+				format += cbn
+				WriteStringAndCheck(buf, fmt.Sprintf(format, flag.Name))
+
+				if len(flag.Shorthand) > 0 {
+					WriteStringAndCheck(buf, fmt.Sprintf("    must_have_one_flag+=(\"-%s"+cbn, flag.Shorthand))
+				}
 			}
 		}
 	})
@@ -618,7 +621,7 @@ func writeRequiredNouns(buf io.StringWriter, cmd *Command) {
 	for _, value := range cmd.ValidArgs {
 		// Remove any description that may be included following a tab character.
 		// Descriptions are not supported by bash completion.
-		value = strings.SplitN(value, "\t", 2)[0]
+		value = strings.Split(value, "\t")[0]
 		WriteStringAndCheck(buf, fmt.Sprintf("    must_have_one_noun+=(%q)\n", value))
 	}
 	if cmd.ValidArgsFunction != nil {
diff --git a/vendor/github.com/spf13/cobra/cobra.go b/vendor/github.com/spf13/cobra/cobra.go
index e0b0947b04c..a6b160ce53c 100644
--- a/vendor/github.com/spf13/cobra/cobra.go
+++ b/vendor/github.com/spf13/cobra/cobra.go
@@ -193,6 +193,8 @@ func ld(s, t string, ignoreCase bool) int {
 	d := make([][]int, len(s)+1)
 	for i := range d {
 		d[i] = make([]int, len(t)+1)
+	}
+	for i := range d {
 		d[i][0] = i
 	}
 	for j := range d[0] {
diff --git a/vendor/github.com/spf13/cobra/command.go b/vendor/github.com/spf13/cobra/command.go
index 54748fc67eb..2fbe6c131a7 100644
--- a/vendor/github.com/spf13/cobra/command.go
+++ b/vendor/github.com/spf13/cobra/command.go
@@ -154,10 +154,8 @@ type Command struct {
 	// pflags contains persistent flags.
 	pflags *flag.FlagSet
 	// lflags contains local flags.
-	// This field does not represent internal state, it's used as a cache to optimise LocalFlags function call
 	lflags *flag.FlagSet
 	// iflags contains inherited flags.
-	// This field does not represent internal state, it's used as a cache to optimise InheritedFlags function call
 	iflags *flag.FlagSet
 	// parentsPflags is all persistent flags of cmd's parents.
 	parentsPflags *flag.FlagSet
@@ -708,7 +706,7 @@ Loop:
 			// This is not a flag or a flag value. Check to see if it matches what we're looking for, and if so,
 			// return the args, excluding the one at this position.
 			if s == x {
-				ret := make([]string, 0, len(args)-1)
+				ret := []string{}
 				ret = append(ret, args[:pos]...)
 				ret = append(ret, args[pos+1:]...)
 				return ret
@@ -756,14 +754,14 @@ func (c *Command) findSuggestions(arg string) string {
 	if c.SuggestionsMinimumDistance <= 0 {
 		c.SuggestionsMinimumDistance = 2
 	}
-	var sb strings.Builder
+	suggestionsString := ""
 	if suggestions := c.SuggestionsFor(arg); len(suggestions) > 0 {
-		sb.WriteString("\n\nDid you mean this?\n")
+		suggestionsString += "\n\nDid you mean this?\n"
 		for _, s := range suggestions {
-			_, _ = fmt.Fprintf(&sb, "\t%v\n", s)
+			suggestionsString += fmt.Sprintf("\t%v\n", s)
 		}
 	}
-	return sb.String()
+	return suggestionsString
 }
 
 func (c *Command) findNext(next string) *Command {
@@ -875,7 +873,7 @@ func (c *Command) ArgsLenAtDash() int {
 
 func (c *Command) execute(a []string) (err error) {
 	if c == nil {
-		return fmt.Errorf("called Execute() on a nil Command")
+		return fmt.Errorf("Called Execute() on a nil Command")
 	}
 
 	if len(c.Deprecated) > 0 {
@@ -1189,11 +1187,10 @@ func (c *Command) InitDefaultHelpFlag() {
 	c.mergePersistentFlags()
 	if c.Flags().Lookup("help") == nil {
 		usage := "help for "
-		name := c.displayName()
-		if name == "" {
+		if c.Name() == "" {
 			usage += "this command"
 		} else {
-			usage += name
+			usage += c.Name()
 		}
 		c.Flags().BoolP("help", "h", false, usage)
 		_ = c.Flags().SetAnnotation("help", FlagSetByCobraAnnotation, []string{"true"})
@@ -1239,7 +1236,7 @@ func (c *Command) InitDefaultHelpCmd() {
 			Use:   "help [command]",
 			Short: "Help about any command",
 			Long: `Help provides help for any command in the application.
-Simply type ` + c.displayName() + ` help [path to command] for full details.`,
+Simply type ` + c.Name() + ` help [path to command] for full details.`,
 			ValidArgsFunction: func(c *Command, args []string, toComplete string) ([]string, ShellCompDirective) {
 				var completions []string
 				cmd, _, e := c.Root().Find(args)
@@ -1430,10 +1427,6 @@ func (c *Command) CommandPath() string {
 	if c.HasParent() {
 		return c.Parent().CommandPath() + " " + c.Name()
 	}
-	return c.displayName()
-}
-
-func (c *Command) displayName() string {
 	if displayName, ok := c.Annotations[CommandDisplayNameAnnotation]; ok {
 		return displayName
 	}
@@ -1443,11 +1436,10 @@ func (c *Command) displayName() string {
 // UseLine puts out the full usage for a given command (including parents).
 func (c *Command) UseLine() string {
 	var useline string
-	use := strings.Replace(c.Use, c.Name(), c.displayName(), 1)
 	if c.HasParent() {
-		useline = c.parent.CommandPath() + " " + use
+		useline = c.parent.CommandPath() + " " + c.Use
 	} else {
-		useline = use
+		useline = c.Use
 	}
 	if c.DisableFlagsInUseLine {
 		return useline
@@ -1460,6 +1452,7 @@ func (c *Command) UseLine() string {
 
 // DebugFlags used to determine which flags have been assigned to which commands
 // and which persist.
+// nolint:goconst
 func (c *Command) DebugFlags() {
 	c.Println("DebugFlags called on", c.Name())
 	var debugflags func(*Command)
@@ -1649,7 +1642,7 @@ func (c *Command) GlobalNormalizationFunc() func(f *flag.FlagSet, name string) f
 // to this command (local and persistent declared here and by all parents).
 func (c *Command) Flags() *flag.FlagSet {
 	if c.flags == nil {
-		c.flags = flag.NewFlagSet(c.displayName(), flag.ContinueOnError)
+		c.flags = flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 		if c.flagErrorBuf == nil {
 			c.flagErrorBuf = new(bytes.Buffer)
 		}
@@ -1660,11 +1653,10 @@ func (c *Command) Flags() *flag.FlagSet {
 }
 
 // LocalNonPersistentFlags are flags specific to this command which will NOT persist to subcommands.
-// This function does not modify the flags of the current command, it's purpose is to return the current state.
 func (c *Command) LocalNonPersistentFlags() *flag.FlagSet {
 	persistentFlags := c.PersistentFlags()
 
-	out := flag.NewFlagSet(c.displayName(), flag.ContinueOnError)
+	out := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	c.LocalFlags().VisitAll(func(f *flag.Flag) {
 		if persistentFlags.Lookup(f.Name) == nil {
 			out.AddFlag(f)
@@ -1674,12 +1666,11 @@ func (c *Command) LocalNonPersistentFlags() *flag.FlagSet {
 }
 
 // LocalFlags returns the local FlagSet specifically set in the current command.
-// This function does not modify the flags of the current command, it's purpose is to return the current state.
 func (c *Command) LocalFlags() *flag.FlagSet {
 	c.mergePersistentFlags()
 
 	if c.lflags == nil {
-		c.lflags = flag.NewFlagSet(c.displayName(), flag.ContinueOnError)
+		c.lflags = flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 		if c.flagErrorBuf == nil {
 			c.flagErrorBuf = new(bytes.Buffer)
 		}
@@ -1702,12 +1693,11 @@ func (c *Command) LocalFlags() *flag.FlagSet {
 }
 
 // InheritedFlags returns all flags which were inherited from parent commands.
-// This function does not modify the flags of the current command, it's purpose is to return the current state.
 func (c *Command) InheritedFlags() *flag.FlagSet {
 	c.mergePersistentFlags()
 
 	if c.iflags == nil {
-		c.iflags = flag.NewFlagSet(c.displayName(), flag.ContinueOnError)
+		c.iflags = flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 		if c.flagErrorBuf == nil {
 			c.flagErrorBuf = new(bytes.Buffer)
 		}
@@ -1728,7 +1718,6 @@ func (c *Command) InheritedFlags() *flag.FlagSet {
 }
 
 // NonInheritedFlags returns all flags which were not inherited from parent commands.
-// This function does not modify the flags of the current command, it's purpose is to return the current state.
 func (c *Command) NonInheritedFlags() *flag.FlagSet {
 	return c.LocalFlags()
 }
@@ -1736,7 +1725,7 @@ func (c *Command) NonInheritedFlags() *flag.FlagSet {
 // PersistentFlags returns the persistent FlagSet specifically set in the current command.
 func (c *Command) PersistentFlags() *flag.FlagSet {
 	if c.pflags == nil {
-		c.pflags = flag.NewFlagSet(c.displayName(), flag.ContinueOnError)
+		c.pflags = flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 		if c.flagErrorBuf == nil {
 			c.flagErrorBuf = new(bytes.Buffer)
 		}
@@ -1749,9 +1738,9 @@ func (c *Command) PersistentFlags() *flag.FlagSet {
 func (c *Command) ResetFlags() {
 	c.flagErrorBuf = new(bytes.Buffer)
 	c.flagErrorBuf.Reset()
-	c.flags = flag.NewFlagSet(c.displayName(), flag.ContinueOnError)
+	c.flags = flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	c.flags.SetOutput(c.flagErrorBuf)
-	c.pflags = flag.NewFlagSet(c.displayName(), flag.ContinueOnError)
+	c.pflags = flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	c.pflags.SetOutput(c.flagErrorBuf)
 
 	c.lflags = nil
@@ -1868,7 +1857,7 @@ func (c *Command) mergePersistentFlags() {
 // If c.parentsPflags == nil, it makes new.
 func (c *Command) updateParentsPflags() {
 	if c.parentsPflags == nil {
-		c.parentsPflags = flag.NewFlagSet(c.displayName(), flag.ContinueOnError)
+		c.parentsPflags = flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 		c.parentsPflags.SetOutput(c.flagErrorBuf)
 		c.parentsPflags.SortFlags = false
 	}
diff --git a/vendor/github.com/spf13/cobra/completions.go b/vendor/github.com/spf13/cobra/completions.go
index c0c08b05721..b60f6b20007 100644
--- a/vendor/github.com/spf13/cobra/completions.go
+++ b/vendor/github.com/spf13/cobra/completions.go
@@ -17,8 +17,6 @@ package cobra
 import (
 	"fmt"
 	"os"
-	"regexp"
-	"strconv"
 	"strings"
 	"sync"
 
@@ -213,29 +211,24 @@ func (c *Command) initCompleteCmd(args []string) {
 				// 2- Even without completions, we need to print the directive
 			}
 
-			noDescriptions := cmd.CalledAs() == ShellCompNoDescRequestCmd
-			if !noDescriptions {
-				if doDescriptions, err := strconv.ParseBool(getEnvConfig(cmd, configEnvVarSuffixDescriptions)); err == nil {
-					noDescriptions = !doDescriptions
-				}
-			}
-			noActiveHelp := GetActiveHelpConfig(finalCmd) == activeHelpGlobalDisable
-			out := finalCmd.OutOrStdout()
+			noDescriptions := (cmd.CalledAs() == ShellCompNoDescRequestCmd)
 			for _, comp := range completions {
-				if noActiveHelp && strings.HasPrefix(comp, activeHelpMarker) {
-					// Remove all activeHelp entries if it's disabled.
-					continue
+				if GetActiveHelpConfig(finalCmd) == activeHelpGlobalDisable {
+					// Remove all activeHelp entries in this case
+					if strings.HasPrefix(comp, activeHelpMarker) {
+						continue
+					}
 				}
 				if noDescriptions {
 					// Remove any description that may be included following a tab character.
-					comp = strings.SplitN(comp, "\t", 2)[0]
+					comp = strings.Split(comp, "\t")[0]
 				}
 
 				// Make sure we only write the first line to the output.
 				// This is needed if a description contains a linebreak.
 				// Otherwise the shell scripts will interpret the other lines as new flags
 				// and could therefore provide a wrong completion.
-				comp = strings.SplitN(comp, "\n", 2)[0]
+				comp = strings.Split(comp, "\n")[0]
 
 				// Finally trim the completion.  This is especially important to get rid
 				// of a trailing tab when there are no description following it.
@@ -244,14 +237,14 @@ func (c *Command) initCompleteCmd(args []string) {
 				// although there is no description).
 				comp = strings.TrimSpace(comp)
 
-				// Print each possible completion to the output for the completion script to consume.
-				fmt.Fprintln(out, comp)
+				// Print each possible completion to stdout for the completion script to consume.
+				fmt.Fprintln(finalCmd.OutOrStdout(), comp)
 			}
 
 			// As the last printout, print the completion directive for the completion script to parse.
 			// The directive integer must be that last character following a single colon (:).
 			// The completion script expects :<directive>
-			fmt.Fprintf(out, ":%d\n", directive)
+			fmt.Fprintf(finalCmd.OutOrStdout(), ":%d\n", directive)
 
 			// Print some helpful info to stderr for the user to understand.
 			// Output from stderr must be ignored by the completion script.
@@ -298,7 +291,7 @@ func (c *Command) getCompletions(args []string) (*Command, []string, ShellCompDi
 	}
 	if err != nil {
 		// Unable to find the real command. E.g., <program> someInvalidCmd <TAB>
-		return c, []string{}, ShellCompDirectiveDefault, fmt.Errorf("unable to find a command for arguments: %v", trimmedArgs)
+		return c, []string{}, ShellCompDirectiveDefault, fmt.Errorf("Unable to find a command for arguments: %v", trimmedArgs)
 	}
 	finalCmd.ctx = c.ctx
 
@@ -906,34 +899,3 @@ func CompError(msg string) {
 func CompErrorln(msg string) {
 	CompError(fmt.Sprintf("%s\n", msg))
 }
-
-// These values should not be changed: users will be using them explicitly.
-const (
-	configEnvVarGlobalPrefix       = "COBRA"
-	configEnvVarSuffixDescriptions = "COMPLETION_DESCRIPTIONS"
-)
-
-var configEnvVarPrefixSubstRegexp = regexp.MustCompile(`[^A-Z0-9_]`)
-
-// configEnvVar returns the name of the program-specific configuration environment
-// variable.  It has the format <PROGRAM>_<SUFFIX> where <PROGRAM> is the name of the
-// root command in upper case, with all non-ASCII-alphanumeric characters replaced by `_`.
-func configEnvVar(name, suffix string) string {
-	// This format should not be changed: users will be using it explicitly.
-	v := strings.ToUpper(fmt.Sprintf("%s_%s", name, suffix))
-	v = configEnvVarPrefixSubstRegexp.ReplaceAllString(v, "_")
-	return v
-}
-
-// getEnvConfig returns the value of the configuration environment variable
-// <PROGRAM>_<SUFFIX> where <PROGRAM> is the name of the root command in upper
-// case, with all non-ASCII-alphanumeric characters replaced by `_`.
-// If the value is empty or not set, the value of the environment variable
-// COBRA_<SUFFIX> is returned instead.
-func getEnvConfig(cmd *Command, suffix string) string {
-	v := os.Getenv(configEnvVar(cmd.Root().Name(), suffix))
-	if v == "" {
-		v = os.Getenv(configEnvVar(configEnvVarGlobalPrefix, suffix))
-	}
-	return v
-}
diff --git a/vendor/github.com/spf13/cobra/flag_groups.go b/vendor/github.com/spf13/cobra/flag_groups.go
index 560612fd338..0671ec5f202 100644
--- a/vendor/github.com/spf13/cobra/flag_groups.go
+++ b/vendor/github.com/spf13/cobra/flag_groups.go
@@ -23,9 +23,9 @@ import (
 )
 
 const (
-	requiredAsGroupAnnotation   = "cobra_annotation_required_if_others_set"
-	oneRequiredAnnotation       = "cobra_annotation_one_required"
-	mutuallyExclusiveAnnotation = "cobra_annotation_mutually_exclusive"
+	requiredAsGroup   = "cobra_annotation_required_if_others_set"
+	oneRequired       = "cobra_annotation_one_required"
+	mutuallyExclusive = "cobra_annotation_mutually_exclusive"
 )
 
 // MarkFlagsRequiredTogether marks the given flags with annotations so that Cobra errors
@@ -37,7 +37,7 @@ func (c *Command) MarkFlagsRequiredTogether(flagNames ...string) {
 		if f == nil {
 			panic(fmt.Sprintf("Failed to find flag %q and mark it as being required in a flag group", v))
 		}
-		if err := c.Flags().SetAnnotation(v, requiredAsGroupAnnotation, append(f.Annotations[requiredAsGroupAnnotation], strings.Join(flagNames, " "))); err != nil {
+		if err := c.Flags().SetAnnotation(v, requiredAsGroup, append(f.Annotations[requiredAsGroup], strings.Join(flagNames, " "))); err != nil {
 			// Only errs if the flag isn't found.
 			panic(err)
 		}
@@ -53,7 +53,7 @@ func (c *Command) MarkFlagsOneRequired(flagNames ...string) {
 		if f == nil {
 			panic(fmt.Sprintf("Failed to find flag %q and mark it as being in a one-required flag group", v))
 		}
-		if err := c.Flags().SetAnnotation(v, oneRequiredAnnotation, append(f.Annotations[oneRequiredAnnotation], strings.Join(flagNames, " "))); err != nil {
+		if err := c.Flags().SetAnnotation(v, oneRequired, append(f.Annotations[oneRequired], strings.Join(flagNames, " "))); err != nil {
 			// Only errs if the flag isn't found.
 			panic(err)
 		}
@@ -70,7 +70,7 @@ func (c *Command) MarkFlagsMutuallyExclusive(flagNames ...string) {
 			panic(fmt.Sprintf("Failed to find flag %q and mark it as being in a mutually exclusive flag group", v))
 		}
 		// Each time this is called is a single new entry; this allows it to be a member of multiple groups if needed.
-		if err := c.Flags().SetAnnotation(v, mutuallyExclusiveAnnotation, append(f.Annotations[mutuallyExclusiveAnnotation], strings.Join(flagNames, " "))); err != nil {
+		if err := c.Flags().SetAnnotation(v, mutuallyExclusive, append(f.Annotations[mutuallyExclusive], strings.Join(flagNames, " "))); err != nil {
 			panic(err)
 		}
 	}
@@ -91,9 +91,9 @@ func (c *Command) ValidateFlagGroups() error {
 	oneRequiredGroupStatus := map[string]map[string]bool{}
 	mutuallyExclusiveGroupStatus := map[string]map[string]bool{}
 	flags.VisitAll(func(pflag *flag.Flag) {
-		processFlagForGroupAnnotation(flags, pflag, requiredAsGroupAnnotation, groupStatus)
-		processFlagForGroupAnnotation(flags, pflag, oneRequiredAnnotation, oneRequiredGroupStatus)
-		processFlagForGroupAnnotation(flags, pflag, mutuallyExclusiveAnnotation, mutuallyExclusiveGroupStatus)
+		processFlagForGroupAnnotation(flags, pflag, requiredAsGroup, groupStatus)
+		processFlagForGroupAnnotation(flags, pflag, oneRequired, oneRequiredGroupStatus)
+		processFlagForGroupAnnotation(flags, pflag, mutuallyExclusive, mutuallyExclusiveGroupStatus)
 	})
 
 	if err := validateRequiredFlagGroups(groupStatus); err != nil {
@@ -130,7 +130,7 @@ func processFlagForGroupAnnotation(flags *flag.FlagSet, pflag *flag.Flag, annota
 					continue
 				}
 
-				groupStatus[group] = make(map[string]bool, len(flagnames))
+				groupStatus[group] = map[string]bool{}
 				for _, name := range flagnames {
 					groupStatus[group][name] = false
 				}
@@ -232,9 +232,9 @@ func (c *Command) enforceFlagGroupsForCompletion() {
 	oneRequiredGroupStatus := map[string]map[string]bool{}
 	mutuallyExclusiveGroupStatus := map[string]map[string]bool{}
 	c.Flags().VisitAll(func(pflag *flag.Flag) {
-		processFlagForGroupAnnotation(flags, pflag, requiredAsGroupAnnotation, groupStatus)
-		processFlagForGroupAnnotation(flags, pflag, oneRequiredAnnotation, oneRequiredGroupStatus)
-		processFlagForGroupAnnotation(flags, pflag, mutuallyExclusiveAnnotation, mutuallyExclusiveGroupStatus)
+		processFlagForGroupAnnotation(flags, pflag, requiredAsGroup, groupStatus)
+		processFlagForGroupAnnotation(flags, pflag, oneRequired, oneRequiredGroupStatus)
+		processFlagForGroupAnnotation(flags, pflag, mutuallyExclusive, mutuallyExclusiveGroupStatus)
 	})
 
 	// If a flag that is part of a group is present, we make all the other flags
@@ -253,17 +253,17 @@ func (c *Command) enforceFlagGroupsForCompletion() {
 	// If none of the flags of a one-required group are present, we make all the flags
 	// of that group required so that the shell completion suggests them automatically
 	for flagList, flagnameAndStatus := range oneRequiredGroupStatus {
-		isSet := false
+		set := 0
 
-		for _, isSet = range flagnameAndStatus {
+		for _, isSet := range flagnameAndStatus {
 			if isSet {
-				break
+				set++
 			}
 		}
 
 		// None of the flags of the group are set, mark all flags in the group
 		// as required
-		if !isSet {
+		if set == 0 {
 			for _, fName := range strings.Split(flagList, " ") {
 				_ = c.MarkFlagRequired(fName)
 			}
diff --git a/vendor/github.com/spf13/cobra/powershell_completions.go b/vendor/github.com/spf13/cobra/powershell_completions.go
index a830b7bcad2..55195193944 100644
--- a/vendor/github.com/spf13/cobra/powershell_completions.go
+++ b/vendor/github.com/spf13/cobra/powershell_completions.go
@@ -28,8 +28,8 @@ import (
 func genPowerShellComp(buf io.StringWriter, name string, includeDesc bool) {
 	// Variables should not contain a '-' or ':' character
 	nameForVar := name
-	nameForVar = strings.ReplaceAll(nameForVar, "-", "_")
-	nameForVar = strings.ReplaceAll(nameForVar, ":", "_")
+	nameForVar = strings.Replace(nameForVar, "-", "_", -1)
+	nameForVar = strings.Replace(nameForVar, ":", "_", -1)
 
 	compCmd := ShellCompRequestCmd
 	if !includeDesc {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index a5c2596851e..b87ee9e60f6 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -366,7 +366,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1
 github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1
 github.com/cs3org/go-cs3apis/cs3/tx/v1beta1
 github.com/cs3org/go-cs3apis/cs3/types/v1beta1
-# github.com/cs3org/reva/v2 v2.19.2-0.20240607120909-0a9c7b8bef6a
+# github.com/cs3org/reva/v2 v2.19.2-0.20240618080316-ed0273c9db9b
 ## explicit; go 1.21
 github.com/cs3org/reva/v2/cmd/revad/internal/grace
 github.com/cs3org/reva/v2/cmd/revad/runtime
@@ -1829,7 +1829,7 @@ github.com/spacewander/go-suffix-tree
 github.com/spf13/afero
 github.com/spf13/afero/internal/common
 github.com/spf13/afero/mem
-# github.com/spf13/cobra v1.8.1
+# github.com/spf13/cobra v1.8.0
 ## explicit; go 1.15
 github.com/spf13/cobra
 # github.com/spf13/pflag v1.0.5


Test patch:
diff --git a/ocis/docker/manifest-latest.tmpl b/ocis/docker/manifest-latest.tmpl
deleted file mode 100644
index 5893e1d9b53..00000000000
--- a/ocis/docker/manifest-latest.tmpl
+++ /dev/null
@@ -1,11 +0,0 @@
-image: owncloud/ocis-rolling:latest
-manifests:
-  - image: owncloud/ocis-rolling:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-amd64
-    platform:
-      architecture: amd64
-      os: linux
-  - image: owncloud/ocis-rolling:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-arm64
-    platform:
-      architecture: arm64
-      variant: v8
-      os: linux
diff --git a/ocis/docker/manifest.production-latest.tmpl b/ocis/docker/manifest.production-latest.tmpl
deleted file mode 100644
index 4d06b3e225e..00000000000
--- a/ocis/docker/manifest.production-latest.tmpl
+++ /dev/null
@@ -1,11 +0,0 @@
-image: owncloud/ocis:latest
-manifests:
-  - image: owncloud/ocis:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-amd64
-    platform:
-      architecture: amd64
-      os: linux
-  - image: owncloud/ocis:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}linux-arm64
-    platform:
-      architecture: arm64
-      variant: v8
-      os: linux
diff --git a/services/graph/pkg/errorcode/cs3_test.go b/services/graph/pkg/errorcode/cs3_test.go
index 5b160e7ad78..45ec797c87d 100644
--- a/services/graph/pkg/errorcode/cs3_test.go
+++ b/services/graph/pkg/errorcode/cs3_test.go
@@ -44,6 +44,11 @@ func TestFromCS3Status(t *testing.T) {
 	}
 
 	for _, test := range tests {
+		var e errorcode.Error
+		if errors.As(test.expected, &e) {
+			test.expected = e.WithOrigin(errorcode.ErrorOriginCS3)
+		}
+
 		if got := errorcode.FromCS3Status(test.status, test.err, test.ignore...); !reflect.DeepEqual(got, test.expected) {
 			t.Error("Test Failed: {} expected, received: {}", test.expected, got)
 		}
@@ -56,7 +61,7 @@ func TestFromStat(t *testing.T) {
 		err    error
 		result error
 	}{
-		{nil, errors.New("some error"), errorcode.New(errorcode.GeneralException, "some error")},
+		{nil, errors.New("some error"), errorcode.New(errorcode.GeneralException, "some error").WithOrigin(errorcode.ErrorOriginCS3)},
 		{&provider.StatResponse{Status: &cs3rpc.Status{Code: cs3rpc.Code_CODE_OK}}, nil, nil},
 	}
 
diff --git a/services/graph/pkg/service/v0/api_driveitem_permissions_test.go b/services/graph/pkg/service/v0/api_driveitem_permissions_test.go
index 20ee36a42ad..3d9dd889faa 100644
--- a/services/graph/pkg/service/v0/api_driveitem_permissions_test.go
+++ b/services/graph/pkg/service/v0/api_driveitem_permissions_test.go
@@ -17,12 +17,6 @@ import (
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	storageprovider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
 	types "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
-	roleconversions "github.com/cs3org/reva/v2/pkg/conversions"
-	revactx "github.com/cs3org/reva/v2/pkg/ctx"
-	"github.com/cs3org/reva/v2/pkg/rgrpc/status"
-	"github.com/cs3org/reva/v2/pkg/storagespace"
-	"github.com/cs3org/reva/v2/pkg/utils"
-	cs3mocks "github.com/cs3org/reva/v2/tests/cs3mocks/mocks"
 	"github.com/go-chi/chi/v5"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -31,6 +25,13 @@ import (
 	"github.com/tidwall/gjson"
 	"google.golang.org/grpc"
 
+	roleconversions "github.com/cs3org/reva/v2/pkg/conversions"
+	revactx "github.com/cs3org/reva/v2/pkg/ctx"
+	"github.com/cs3org/reva/v2/pkg/rgrpc/status"
+	"github.com/cs3org/reva/v2/pkg/storagespace"
+	"github.com/cs3org/reva/v2/pkg/utils"
+	cs3mocks "github.com/cs3org/reva/v2/tests/cs3mocks/mocks"
+
 	"github.com/owncloud/ocis/v2/ocis-pkg/log"
 	"github.com/owncloud/ocis/v2/services/graph/mocks"
 	"github.com/owncloud/ocis/v2/services/graph/pkg/config/defaults"
@@ -249,7 +250,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 			statResponse.Status = status.NewNotFound(context.Background(), "not found")
 			permission, err := driveItemPermissionsService.Invite(context.Background(), driveItemId, driveItemInvite)
 			Expect(err).To(HaveOccurred())
-			Expect(err).To(MatchError(errorcode.New(errorcode.ItemNotFound, "not found")))
+			Expect(err).To(MatchError(errorcode.New(errorcode.ItemNotFound, "not found").WithOrigin(errorcode.ErrorOriginCS3)))
 			Expect(permission).To(BeZero())
 		})
 	})
@@ -999,7 +1000,7 @@ var _ = Describe("DriveItemPermissionsService", func() {
 
 			driveItemPermission.SetExpirationDateTime(expiration)
 			res, err := driveItemPermissionsService.UpdatePermission(context.Background(), driveItemId, "permissionid", driveItemPermission)
-			Expect(err).To(MatchError(errorcode.New(errorcode.InvalidRequest, "expiration date is in the past")))
+			Expect(err).To(MatchError(errorcode.New(errorcode.InvalidRequest, "expiration date is in the past").WithOrigin(errorcode.ErrorOriginCS3)))
 			Expect(res).To(BeZero())
 		})
 	})
diff --git a/services/graph/pkg/service/v0/api_drives_drive_item_test.go b/services/graph/pkg/service/v0/api_drives_drive_item_test.go
index 1d2a3ae34ed..7cdc245fb3f 100644
--- a/services/graph/pkg/service/v0/api_drives_drive_item_test.go
+++ b/services/graph/pkg/service/v0/api_drives_drive_item_test.go
@@ -152,7 +152,7 @@ var _ = Describe("DrivesDriveItemService", func() {
 				Once()
 
 			_, err := drivesDriveItemService.GetShare(context.Background(), &collaborationv1beta1.ShareId{})
-			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error())))
+			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error()).WithOrigin(errorcode.ErrorOriginCS3)))
 		})
 
 		It("fails if share lookup does not report an error but the status is off", func() {
@@ -161,12 +161,12 @@ var _ = Describe("DrivesDriveItemService", func() {
 				EXPECT().
 				GetReceivedShare(context.Background(), mock.Anything, mock.Anything).
 				Return(&collaborationv1beta1.GetReceivedShareResponse{
-					Status: status.NewNotFound(context.Background(), someErr.Error()),
+					Status: status.NewInvalid(context.Background(), someErr.Error()),
 				}, nil).
 				Once()
 
 			_, err := drivesDriveItemService.GetShare(context.Background(), &collaborationv1beta1.ShareId{})
-			Expect(err).To(MatchError(errorcode.New(errorcode.ItemNotFound, someErr.Error())))
+			Expect(err).To(MatchError(errorcode.New(errorcode.InvalidRequest, someErr.Error()).WithOrigin(errorcode.ErrorOriginCS3)))
 		})
 
 		It("successfully returns a share", func() {
@@ -219,7 +219,7 @@ var _ = Describe("DrivesDriveItemService", func() {
 				request.Share.State = collaborationv1beta1.ShareState_SHARE_STATE_ACCEPTED
 				request.UpdateMask.Paths = append(request.UpdateMask.Paths, "state")
 			})
-			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error())))
+			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error()).WithOrigin(errorcode.ErrorOriginCS3)))
 		})
 
 		It("fails if share update does not report an error but the status is off", func() {
@@ -236,7 +236,7 @@ var _ = Describe("DrivesDriveItemService", func() {
 				request.Share.State = collaborationv1beta1.ShareState_SHARE_STATE_ACCEPTED
 				request.UpdateMask.Paths = append(request.UpdateMask.Paths, "state")
 			})
-			Expect(err).To(MatchError(errorcode.New(errorcode.ItemNotFound, someErr.Error())))
+			Expect(err).To(MatchError(errorcode.New(errorcode.ItemNotFound, someErr.Error()).WithOrigin(errorcode.ErrorOriginCS3)))
 		})
 	})
 
@@ -265,7 +265,7 @@ var _ = Describe("DrivesDriveItemService", func() {
 				request.Share.State = collaborationv1beta1.ShareState_SHARE_STATE_ACCEPTED
 				request.UpdateMask.Paths = append(request.UpdateMask.Paths, "state")
 			})
-			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error())))
+			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error()).WithOrigin(errorcode.ErrorOriginCS3)))
 			Expect(err.(interface{ Unwrap() []error }).Unwrap()).To(HaveLen(2))
 			Expect(shares).To(HaveLen(1))
 		})
@@ -281,7 +281,7 @@ var _ = Describe("DrivesDriveItemService", func() {
 				Once()
 
 			err := drivesDriveItemService.UnmountShare(context.Background(), &collaborationv1beta1.ShareId{})
-			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error())))
+			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error()).WithOrigin(errorcode.ErrorOriginCS3)))
 		})
 
 		It("requests only accepted shares to be unmounted", func() {
@@ -358,7 +358,7 @@ var _ = Describe("DrivesDriveItemService", func() {
 				Times(1)
 
 			err := drivesDriveItemService.UnmountShare(context.Background(), &collaborationv1beta1.ShareId{})
-			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error())))
+			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error()).WithOrigin(errorcode.ErrorOriginCS3)))
 			Expect(err.(interface{ Unwrap() []error }).Unwrap()).To(HaveLen(1))
 		})
 	})
@@ -436,7 +436,7 @@ var _ = Describe("DrivesDriveItemService", func() {
 				Times(3)
 
 			shares, err := drivesDriveItemService.MountShare(context.Background(), nil, "some")
-			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error())))
+			Expect(err).To(MatchError(errorcode.New(errorcode.GeneralException, someErr.Error()).WithOrigin(errorcode.ErrorOriginCS3)))
 			Expect(err.(interface{ Unwrap() []error }).Unwrap()).To(HaveLen(3))
 			Expect(shares).To(HaveLen(0))
 		})
diff --git a/tests/acceptance/expected-failures-API-on-OCIS-storage.md b/tests/acceptance/expected-failures-API-on-OCIS-storage.md
index 1df96b9d604..a5935fd7474 100644
--- a/tests/acceptance/expected-failures-API-on-OCIS-storage.md
+++ b/tests/acceptance/expected-failures-API-on-OCIS-storage.md
@@ -88,6 +88,13 @@ Synchronization features like etag propagation, setting mtime and locking files
 - [coreApiTrashbin/trashbinSharingToShares.feature:241](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/coreApiTrashbin/trashbinSharingToShares.feature#L241)
 - [coreApiTrashbin/trashbinSharingToShares.feature:269](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/coreApiTrashbin/trashbinSharingToShares.feature#L269)
 
+#### [Sharing folder and sub-folder with same user but different permission,the permission of sub-folder is not obeyed ](https://github.com/owncloud/ocis/issues/2440)
+
+- [coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature:232](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature#L232)
+- [coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature:260](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature#L260)
+- [coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature:317](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature#L317)
+- [coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature:345](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature#L345)
+
 #### [Edit user share response has a "name" field](https://github.com/owncloud/ocis/issues/1225)
 
 - [coreApiShareUpdateToShares/updateShare.feature:200](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/coreApiShareUpdateToShares/updateShare.feature#L200)
diff --git a/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md b/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md
index 07556a6dd0b..ec4cb86dace 100644
--- a/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md
+++ b/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md
@@ -274,7 +274,6 @@ The expected failures in this file are from features in the owncloud/ocis repo.
 - [apiSharingNgLinkShare/linkShare.feature:3507](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNgLinkShare/linkShare.feature#L3507)
 - [apiSharingNgLinkShare/linkShare.feature:3634](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNgLinkShare/linkShare.feature#L3634)
 - [apiSharingNgLinkShare/linkShare.feature:3762](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNgLinkShare/linkShare.feature#L3762)
-- [apiSharingNgLinkShare/linkShare.feature:4030](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNgLinkShare/linkShare.feature#L4030)
 - [apiSharingNg/removeAccessToDriveItem.feature:125](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/removeAccessToDriveItem.feature#L125)
 - [apiSharingNg/removeAccessToDriveItem.feature:141](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/removeAccessToDriveItem.feature#L141)
 - [apiSharingNg/removeAccessToDriveItem.feature:161](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSharingNg/removeAccessToDriveItem.feature#L161)
diff --git a/tests/acceptance/features/apiSharingNg/listPermissions.feature b/tests/acceptance/features/apiSharingNg/listPermissions.feature
index 2b7914c5c06..494c534db13 100644
--- a/tests/acceptance/features/apiSharingNg/listPermissions.feature
+++ b/tests/acceptance/features/apiSharingNg/listPermissions.feature
@@ -1051,7 +1051,7 @@ Feature: List a sharing permissions
     And user "Brian" has been created with default attributes and without skeleton files
     When user "Alice" gets permissions list for file "textfile.txt" of the space "Personal" using the Graph API
     Then the HTTP status code should be "200"
-    And user "Alice" should be able to send the following resource share invitation with all allowed permission roles
+    And user "Alice" should be able to send share the following invitation with all allowed permission roles
       | resource     | textfile.txt |
       | space        | Personal     |
       | sharee       | Brian        |
@@ -1063,7 +1063,7 @@ Feature: List a sharing permissions
     And user "Brian" has been created with default attributes and without skeleton files
     When user "Alice" gets permissions list for folder "folder" of the space "Personal" using the Graph API
     Then the HTTP status code should be "200"
-    And user "Alice" should be able to send the following resource share invitation with all allowed permission roles
+    And user "Alice" should be able to send share the following invitation with all allowed permission roles
       | resource     | folder   |
       | space        | Personal |
       | sharee       | Brian    |
@@ -1266,7 +1266,7 @@ Feature: List a sharing permissions
     And user "Brian" has been created with default attributes and without skeleton files
     When user "Alice" lists the permissions of space "new-space" using permissions endpoint of the Graph API
     Then the HTTP status code should be "200"
-    And user "Alice" should be able to send the following resource share invitation with all allowed permission roles
+    And user "Alice" should be able to send share the following invitation with all allowed permission roles
       | space        | new-space    |
       | sharee       | Brian        |
       | shareType    | user         |
@@ -1280,7 +1280,7 @@ Feature: List a sharing permissions
     And user "Brian" has been created with default attributes and without skeleton files
     When user "Alice" gets permissions list for file "textfile.txt" of the space "new-space" using the Graph API
     Then the HTTP status code should be "200"
-    And user "Alice" should be able to send the following resource share invitation with all allowed permission roles
+    And user "Alice" should be able to send share the following invitation with all allowed permission roles
       | resource     | textfile.txt |
       | space        | new-space    |
       | sharee       | Brian        |
@@ -1337,7 +1337,7 @@ Feature: List a sharing permissions
     And user "Brian" has been created with default attributes and without skeleton files
     When user "Alice" gets permissions list for folder "folder" of the space "new-space" using the Graph API
     Then the HTTP status code should be "200"
-    And user "Alice" should be able to send the following resource share invitation with all allowed permission roles
+    And user "Alice" should be able to send share the following invitation with all allowed permission roles
       | resource  | folder    |
       | space     | new-space |
       | sharee    | Brian     |
diff --git a/tests/acceptance/features/apiSharingNgLinkShare/linkShare.feature b/tests/acceptance/features/apiSharingNgLinkShare/linkShare.feature
index 7f9962bb385..733456800dd 100644
--- a/tests/acceptance/features/apiSharingNgLinkShare/linkShare.feature
+++ b/tests/acceptance/features/apiSharingNgLinkShare/linkShare.feature
@@ -3315,7 +3315,7 @@ Feature: Create a share link for a resource
       }
       """
 
-
+    
   Scenario Outline: create a quick link share of a file using permissions endpoint
     Given user "Alice" has uploaded file with content "other data" to "textfile1.txt"
     When user "Alice" creates the following resource link share using the Graph API:
@@ -3695,7 +3695,7 @@ Feature: Create a share link for a resource
       """
 
 
-  Scenario Outline: create a quick link share of a project-space using permissions endpoint
+ Scenario Outline: create a quick link share of a project-space using permissions endpoint
     Given using spaces DAV path
     And the administrator has assigned the role "Space Admin" to user "Alice" using the Graph API
     And user "Alice" has created a space "projectSpace" with the default quota using the Graph API
@@ -3761,7 +3761,7 @@ Feature: Create a share link for a resource
       | createOnly       |
       | blocksDownload   |
 
-
+    
   Scenario: create an internal quick link share of a project-space using permissions endpoint
     Given using spaces DAV path
     And the administrator has assigned the role "Space Admin" to user "Alice" using the Graph API
@@ -3817,214 +3817,4 @@ Feature: Create a share link for a resource
           }
         }
       }
-      """
-
-
-  Scenario Outline: create quick link share of a project space drive using root endpoint
-    Given using spaces DAV path
-    And the administrator has assigned the role "Space Admin" to user "Alice" using the Graph API
-    And user "Alice" has created a space "projectSpace" with the default quota using the Graph API
-    When user "Alice" creates the following space link share using root endpoint of the Graph API:
-      | space           | projectSpace       |
-      | permissionsRole | <permissions-role> |
-      | password        | %public%           |
-      | displayName     | Link               |
-      | quickLink       | true               |
-    Then the HTTP status code should be "200"
-    And the JSON data of the response should match
-      """
-      {
-        "type": "object",
-        "required": [
-          "hasPassword",
-          "id",
-          "link"
-        ],
-        "properties": {
-          "hasPassword": {
-            "const": true
-          },
-          "id": {
-            "pattern": "^[a-zA-Z]{15}$"
-          },
-          "link": {
-            "type": "object",
-            "required": [
-              "@libre.graph.displayName",
-              "@libre.graph.quickLink",
-              "preventsDownload",
-              "type",
-              "webUrl"
-            ],
-            "properties": {
-              "@libre.graph.displayName": {
-                "const": "Link"
-              },
-              "@libre.graph.quickLink": {
-                "const": true
-              },
-              "preventsDownload": {
-                "const": false
-              },
-              "type": {
-                "const": "<permissions-role>"
-              },
-              "webUrl": {
-                "type": "string",
-                "pattern": "^%base_url%/s/[a-zA-Z]{15}$"
-              }
-            }
-          }
-        }
-      }
-      """
-    Examples:
-      | permissions-role |
-      | view             |
-      | upload           |
-      | edit             |
-      | createOnly       |
-
-
-  Scenario: create an internal quick link share of a project space drive using root endpoint
-    Given using spaces DAV path
-    And the administrator has assigned the role "Space Admin" to user "Alice" using the Graph API
-    And user "Alice" has created a space "projectSpace" with the default quota using the Graph API
-    When user "Alice" creates the following space link share using root endpoint of the Graph API:
-      | space           | projectSpace |
-      | permissionsRole | internal     |
-      | displayName     | Link         |
-      | quickLink       | true         |
-    Then the HTTP status code should be "200"
-    And the JSON data of the response should match
-      """
-      {
-        "type": "object",
-        "required": [
-          "hasPassword",
-          "id",
-          "link"
-        ],
-        "properties": {
-          "hasPassword": {
-            "const": false
-          },
-          "id": {
-            "pattern": "^[a-zA-Z]{15}$"
-          },
-          "link": {
-            "type": "object",
-            "required": [
-              "@libre.graph.displayName",
-              "@libre.graph.quickLink",
-              "preventsDownload",
-              "type",
-              "webUrl"
-            ],
-            "properties": {
-              "@libre.graph.displayName": {
-                "const": "Link"
-              },
-              "@libre.graph.quickLink": {
-                "const": true
-              },
-              "preventsDownload": {
-                "const": false
-              },
-              "type": {
-                "const": "internal"
-              },
-              "webUrl": {
-                "type": "string",
-                "pattern": "^%base_url%/s/[a-zA-Z]{15}$"
-              }
-            }
-          }
-        }
-      }
-      """
-
-
-  Scenario Outline: update link share of a folder inside personal drive using permissions endpoint
-    Given user "Alice" has created folder "folder"
-    And user "Alice" has created the following resource link share:
-      | space           | Personal           |
-      | resource        | folder             |
-      | permissionsRole | <permissions-role> |
-      | password        | %public%           |
-      | displayName     | Homework           |
-    When user "Alice" updates the last public link share using the permissions endpoint of the Graph API:
-      | space              | Personal               |
-      | resource           | folder                 |
-      | permissionsRole    | <new-permissions-role> |
-      | password           | p@$$w0rD               |
-      | expirationDateTime | 2201-07-15T14:00:00Z   |
-    Then the HTTP status code should be "200"
-    And the JSON data of the response should match
-      """
-        {
-          "type": "object",
-          "required": [
-            "hasPassword",
-            "id",
-            "link",
-            "expirationDateTime",
-            "createdDateTime"
-          ],
-          "properties": {
-            "hasPassword": {
-              "const": true
-            },
-            "id": {
-              "type": "string",
-              "pattern": "^[a-zA-Z]{15}$"
-            },
-            "expirationDateTime": {
-              "const": "2201-07-15T23:59:59Z"
-            },
-            "link": {
-              "type": "object",
-              "required": [
-                "@libre.graph.displayName",
-                "@libre.graph.quickLink",
-                "preventsDownload",
-                "type",
-                "webUrl"
-              ],
-              "properties": {
-                "@libre.graph.displayName": {
-                  "const": "Homework"
-                },
-                "@libre.graph.quickLink": {
-                  "const": false
-                },
-                "preventsDownload": {
-                  "const": false
-                },
-                "type": {
-                  "const": "<new-permissions-role>"
-                },
-                "webUrl": {
-                  "type": "string",
-                  "pattern": "^%base_url%/s/[a-zA-Z]{15}$"
-                }
-              }
-            }
-          }
-        }
-      """
-    Examples:
-      | permissions-role | new-permissions-role |
-      | view             | edit                 |
-      | view             | upload               |
-      | view             | createOnly           |
-      | edit             | view                 |
-      | edit             | upload               |
-      | edit             | createOnly           |
-      | upload           | view                 |
-      | upload           | edit                 |
-      | upload           | createOnly           |
-      | createOnly       | view                 |
-      | createOnly       | edit                 |
-      | createOnly       | upload               |
-      | blocksDownload   | blocksDownload       |
\ No newline at end of file
+      """
\ No newline at end of file
diff --git a/tests/acceptance/features/apiSpaces/filePreviews.feature b/tests/acceptance/features/apiSpaces/filePreviews.feature
index d6d7476d278..249b6538a16 100644
--- a/tests/acceptance/features/apiSpaces/filePreviews.feature
+++ b/tests/acceptance/features/apiSpaces/filePreviews.feature
@@ -61,23 +61,6 @@ Feature: Preview file in project space
       | filesForUpload/lorem.txt      | lorem.txt      |
 
 
-  Scenario Outline: download preview of shared file shared via Secure viewer permission role
-    Given user "Brian" has been created with default attributes and without skeleton files
-    And user "Alice" has uploaded a file from "<source>" to "<destination>" via TUS inside of the space "Alice Hansen" using the WebDAV API
-    And user "Alice" has sent the following resource share invitation:
-      | resource        | <destination> |
-      | space           | Personal      |
-      | sharee          | Brian         |
-      | shareType       | user          |
-      | permissionsRole | Secure viewer |
-    When user "Brian" downloads the preview of shared resource "/Shares/<destination>" with width "32" and height "32" using the WebDAV API
-    Then the HTTP status code should be "403"
-    Examples:
-      | source                        | destination    |
-      | filesForUpload/testavatar.png | testavatar.png |
-      | filesForUpload/lorem.txt      | lorem.txt      |
-
-
   Scenario: download preview of file inside shared folder in project space
     Given user "Brian" has been created with default attributes and without skeleton files
     And user "Alice" has created a folder "folder" in space "previews of the files"
diff --git a/tests/acceptance/features/apiSpacesShares/shareOperations.feature b/tests/acceptance/features/apiSpacesShares/shareOperations.feature
index 82e2f241d3b..93a6517bf0f 100644
--- a/tests/acceptance/features/apiSpacesShares/shareOperations.feature
+++ b/tests/acceptance/features/apiSpacesShares/shareOperations.feature
@@ -382,33 +382,6 @@ Feature: sharing
       | Uploader         |
 
 
-  Scenario: sharee cannot download file shared with Secure viewer permission by sharee
-    Given using old DAV path
-    And user "Alice" has uploaded file with content "hello world" to "textfile.txt"
-    And user "Alice" has sent the following resource share invitation:
-      | resource        | textfile.txt  |
-      | space           | Personal      |
-      | sharee          | Brian         |
-      | shareType       | user          |
-      | permissionsRole | Secure viewer |
-    And user "Brian" downloads file "/Shares/textfile.txt" using the WebDAV API
-    Then the HTTP status code should be "403"
-
-
-  Scenario: sharee cannot download file inside folder shared with Secure viewer permission by sharee
-    Given using old DAV path
-    And user "Alice" has created folder "FolderToShare"
-    And user "Alice" has uploaded file with content "hello world" to "FolderToShare/textfile.txt"
-    And user "Alice" has sent the following resource share invitation:
-      | resource        | FolderToShare |
-      | space           | Personal      |
-      | sharee          | Brian         |
-      | shareType       | user          |
-      | permissionsRole | Secure viewer |
-    And user "Brian" downloads file "/Shares/FolderToShare/textfile.txt" using the WebDAV API
-    Then the HTTP status code should be "403"
-
-
   Scenario Outline: space admin tries to remove password of a public link share (change/create permission)
     Given using spaces DAV path
     And using OCS API version "<ocs-api-version>"
diff --git a/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpace.feature b/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpace.feature
index 741603903b0..24d7a72149c 100644
--- a/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpace.feature
+++ b/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpace.feature
@@ -155,7 +155,6 @@ Feature: Share a file or folder that is inside a space
     And the information about the last share for user "Brian" should include
       | expiration |  |
 
-
   Scenario: user cannot delete share role
     Given using OCS API version "<ocs_api_version>"
     And using SharingNG
diff --git a/tests/acceptance/features/bootstrap/SharingNgContext.php b/tests/acceptance/features/bootstrap/SharingNgContext.php
index f1268ec76ad..0bd676d1c2b 100644
--- a/tests/acceptance/features/bootstrap/SharingNgContext.php
+++ b/tests/acceptance/features/bootstrap/SharingNgContext.php
@@ -124,13 +124,12 @@ class SharingNgContext implements Context {
 		$space = $bodyRows['space'];
 
 		$spaceId = ($this->spacesContext->getSpaceByName($user, $space))["id"];
-		$bodyRows['quickLink'] = $bodyRows['quickLink'] ?? false;
+
 		$bodyRows['displayName'] = $bodyRows['displayName'] ?? null;
 		$bodyRows['expirationDateTime'] = $bodyRows['expirationDateTime'] ?? null;
 		$bodyRows['password'] = $bodyRows['password'] ?? null;
 		$body = [
 			'type' => $bodyRows['permissionsRole'],
-			"@libre.graph.quickLink" => filter_var($bodyRows['quickLink'], FILTER_VALIDATE_BOOLEAN),
 			'displayName' => $bodyRows['displayName'],
 			'expirationDateTime' => $bodyRows['expirationDateTime'],
 			'password' => $this->featureContext->getActualPassword($bodyRows['password'])
@@ -1276,7 +1275,7 @@ class SharingNgContext implements Context {
 	}
 
 	/**
-	 * @Then user :user should be able to send the following resource share invitation with all allowed permission roles
+	 * @Then user :user should be able to send share the following invitation with all allowed permission roles
 	 *
 	 * @param string $user
 	 * @param TableNode $table
diff --git a/tests/acceptance/features/coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature b/tests/acceptance/features/coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature
index 3268321d241..f7ff248903f 100644
--- a/tests/acceptance/features/coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature
+++ b/tests/acceptance/features/coreApiShareCreateSpecialToShares2/createShareReceivedInMultipleWays.feature
@@ -253,22 +253,21 @@ Feature: share resources where the sharee receives the share in multiple ways
       | shareType       | group         |
       | permissionsRole | Viewer        |
     And user "Brian" should be able to rename file "/Shares/parent/child1/child2/textfile-2.txt" to "/Shares/parent/child1/child2/rename.txt"
-    And user "Brian" should be able to rename file "/Shares/child1/child2/rename.txt" to "/Shares/child1/child2/rename2.txt"
-    And user "Alice" should not be able to rename file "/Shares/child1/child2/rename2.txt" to "/Shares/child1/child2/rename3.txt"
+    And user "Brian" should not be able to rename file "/Shares/child1/child2/rename.txt" to "/Shares/child1/child2/rename2.txt"
+    And user "Alice" should not be able to rename file "/Shares/child1/child2/rename.txt" to "/Shares/child1/child2/rename2.txt"
 
   @issue-2440
   Scenario: sharing parent folder to user with all permissions and its child folder to group with read permission then check delete operation
     Given group "grp1" has been created
     And user "Carol" has been created with default attributes and without skeleton files
     And user "Carol" has created the following folders
-      | path                         |
-      | /parent                      |
-      | /parent/child1               |
-      | /parent/child1/child2        |
-      | /parent/child1/child2/child3 |
+      | path                  |
+      | /parent               |
+      | /parent/child1        |
+      | /parent/child1/child2 |
     And user "Alice" has been added to group "grp1"
     And user "Brian" has been added to group "grp1"
-    And user "Carol" has uploaded file with content "some data" to "/parent/child1/child2/child3/textfile-2.txt"
+    And user "Carol" has uploaded file with content "some data" to "/parent/child1/child2/textfile-2.txt"
     And user "Carol" has sent the following resource share invitation:
       | resource        | parent   |
       | space           | Personal |
@@ -281,8 +280,8 @@ Feature: share resources where the sharee receives the share in multiple ways
       | sharee          | grp1          |
       | shareType       | group         |
       | permissionsRole | Viewer        |
-    And user "Brian" should be able to delete file "/Shares/parent/child1/child2/child3/textfile-2.txt"
-    And user "Brian" should be able to delete folder "/Shares/child1/child2/child3"
+    And user "Brian" should be able to delete file "/Shares/parent/child1/child2/textfile-2.txt"
+    And user "Brian" should not be able to delete folder "/Shares/child1/child2"
     And user "Alice" should not be able to delete folder "/Shares/child1/child2"
 
 
@@ -339,8 +338,8 @@ Feature: share resources where the sharee receives the share in multiple ways
       | shareType       | user          |
       | permissionsRole | Editor        |
     And user "Brian" should be able to rename file "/Shares/child1/child2/textfile-2.txt" to "/Shares/child1/child2/rename.txt"
-    And user "Brian" should be able to rename file "/Shares/parent/child1/child2/rename.txt" to "/Shares/parent/child1/child2/rename2.txt"
-    And user "Alice" should not be able to rename file "/Shares/parent/child1/child2/rename2.txt" to "/Shares/parent/child1/child2/rename3.txt"
+    And user "Brian" should not be able to rename file "/Shares/parent/child1/child2/rename.txt" to "/Shares/parent/child1/child2/rename2.txt"
+    And user "Alice" should not be able to rename file "/Shares/parent/child1/child2/rename.txt" to "/Shares/parent/child1/child2/rename2.txt"
 
   @issue-2440
   Scenario: sharing parent folder to group with read permission and its child folder to user with all permissions then check delete operation
@@ -367,7 +366,7 @@ Feature: share resources where the sharee receives the share in multiple ways
       | shareType       | user          |
       | permissionsRole | Editor        |
     And user "Brian" should be able to delete file "/Shares/child1/child2/textfile-2.txt"
-    And user "Brian" should be able to delete folder "/Shares/parent/child1/child2"
+    And user "Brian" should not be able to delete folder "/Shares/parent/child1"
     And user "Alice" should not be able to delete folder "/Shares/parent/child1"