diff --git a/apps/federatedfilesharing/lib/AppInfo/Application.php b/apps/federatedfilesharing/lib/AppInfo/Application.php
index 287626b69303..ccbee8ba8214 100644
--- a/apps/federatedfilesharing/lib/AppInfo/Application.php
+++ b/apps/federatedfilesharing/lib/AppInfo/Application.php
@@ -148,16 +148,7 @@ function ($c) use ($server) {
 		$container->registerService(
 			'NotificationManager',
 			function ($c) {
-				return new NotificationManager(
-					$c->query('Permissions')
-				);
-			}
-		);
-
-		$container->registerService(
-			'Permissions',
-			function ($c) {
-				return new Permissions();
+				return new NotificationManager();
 			}
 		);
 
@@ -208,9 +199,7 @@ protected function initFederatedShareProvider() {
 			\OC::$server->getMemCacheFactory(),
 			\OC::$server->getHTTPClientService()
 		);
-		$notificationManager = new NotificationManager(
-			new Permissions()
-		);
+		$notificationManager = new NotificationManager();
 		$notifications = new Notifications(
 			$addressHandler,
 			\OC::$server->getHTTPClientService(),
diff --git a/apps/federatedfilesharing/lib/FedShareManager.php b/apps/federatedfilesharing/lib/FedShareManager.php
index a60d323194f2..4e101e1033a4 100644
--- a/apps/federatedfilesharing/lib/FedShareManager.php
+++ b/apps/federatedfilesharing/lib/FedShareManager.php
@@ -69,11 +69,6 @@ class FedShareManager {
 	 */
 	private $addressHandler;
 
-	/**
-	 * @var Permissions
-	 */
-	private $permissions;
-
 	/**
 	 * @var EventDispatcherInterface
 	 */
@@ -88,7 +83,6 @@ class FedShareManager {
 	 * @param ActivityManager $activityManager
 	 * @param NotificationManager $notificationManager
 	 * @param AddressHandler $addressHandler
-	 * @param Permissions $permissions
 	 * @param EventDispatcherInterface $eventDispatcher
 	 */
 	public function __construct(
@@ -98,7 +92,6 @@ public function __construct(
 		ActivityManager $activityManager,
 		NotificationManager $notificationManager,
 		AddressHandler $addressHandler,
-		Permissions $permissions,
 		EventDispatcherInterface $eventDispatcher
 	) {
 		$this->federatedShareProvider = $federatedShareProvider;
@@ -107,7 +100,6 @@ public function __construct(
 		$this->activityManager = $activityManager;
 		$this->notificationManager = $notificationManager;
 		$this->addressHandler = $addressHandler;
-		$this->permissions = $permissions;
 		$this->eventDispatcher = $eventDispatcher;
 	}
 
@@ -316,7 +308,7 @@ public function undoReshare(IShare $share) {
 	 * @return void
 	 */
 	public function updateOcmPermissions(IShare $share, $ocmPermissions) {
-		$permissions = $this->permissions->toOcPermissions($ocmPermissions);
+		$permissions = Permissions::toOcPermissions($ocmPermissions);
 		$this->updatePermissions($share, $permissions);
 	}
 
@@ -328,8 +320,9 @@ public function updateOcmPermissions(IShare $share, $ocmPermissions) {
 	 *
 	 * @return void
 	 */
-	public function updatePermissions(IShare $share, $permissions) {
-		if ($share->getPermissions() !== $permissions) {
+	public function updatePermissions(IShare $share, int $permissions): void {
+		# permissions can only be reduced but not upgraded
+		if (Permissions::isNewPermissionHigher($share->getPermissions(), $permissions)) {
 			$share->setPermissions($permissions);
 			$this->federatedShareProvider->update($share);
 		}
diff --git a/apps/federatedfilesharing/lib/Ocm/NotificationManager.php b/apps/federatedfilesharing/lib/Ocm/NotificationManager.php
index 9f810798ffbd..5577c9eb09aa 100644
--- a/apps/federatedfilesharing/lib/Ocm/NotificationManager.php
+++ b/apps/federatedfilesharing/lib/Ocm/NotificationManager.php
@@ -29,20 +29,6 @@
  * @package OCA\FederatedFileSharing\Ocm
  */
 class NotificationManager {
-	/**
-	 * @var Permissions
-	 */
-	protected $permissions;
-
-	/**
-	 * NotificationManager constructor.
-	 *
-	 * @param Permissions $permissions
-	 */
-	public function __construct(Permissions $permissions) {
-		$this->permissions = $permissions;
-	}
-
 	/**
 	 * @param string $type
 	 *
@@ -87,7 +73,7 @@ public function convertToOcmFileNotification($remoteId, $token, $action, $data =
 		$notification->addNotificationData('message', $messages[$action]);
 
 		if ($action === 'permissions') {
-			$ocmPermissions = $this->permissions->toOcmPermissions($data['permissions']);
+			$ocmPermissions = Permissions::toOcmPermissions($data['permissions']);
 			$notification->addNotificationData('permission', $ocmPermissions);
 		}
 
diff --git a/apps/federatedfilesharing/lib/Ocm/Permissions.php b/apps/federatedfilesharing/lib/Ocm/Permissions.php
index f75118d79c27..c8d6d6aaf2b7 100644
--- a/apps/federatedfilesharing/lib/Ocm/Permissions.php
+++ b/apps/federatedfilesharing/lib/Ocm/Permissions.php
@@ -40,11 +40,11 @@ class Permissions {
 	 *
 	 * @return array
 	 */
-	public function toOcmPermissions($ocPermissions) {
+	public static function toOcmPermissions(int $ocPermissions): array {
 		$ocPermissions = (int) $ocPermissions;
 		$ocmPermissions = [];
 		if ($ocPermissions & Constants::PERMISSION_READ) {
-			$ocmPermissions[] = self::OCM_PERMISSION_READ . '';
+			$ocmPermissions[] = self::OCM_PERMISSION_READ;
 		}
 		if (($ocPermissions & Constants::PERMISSION_CREATE)
 			|| ($ocPermissions & Constants::PERMISSION_UPDATE)
@@ -62,7 +62,7 @@ public function toOcmPermissions($ocPermissions) {
 	 *
 	 * @return int
 	 */
-	public function toOcPermissions($ocmPermissions) {
+	public static function toOcPermissions(array $ocmPermissions): int {
 		$permissionMap = [
 			self::OCM_PERMISSION_READ => Constants::PERMISSION_READ,
 			self::OCM_PERMISSION_WRITE => Constants::PERMISSION_CREATE + Constants::PERMISSION_UPDATE,
@@ -77,4 +77,8 @@ public function toOcPermissions($ocmPermissions) {
 
 		return $ocPermissions;
 	}
+
+	public static function isNewPermissionHigher(int $existingPermission, int $newPermission): bool {
+		return ($existingPermission | $newPermission) === $existingPermission;
+	}
 }
diff --git a/apps/federatedfilesharing/tests/Controller/RequestHandlerTest.php b/apps/federatedfilesharing/tests/Controller/RequestHandlerTest.php
index 65952c893d3c..2592d396d570 100644
--- a/apps/federatedfilesharing/tests/Controller/RequestHandlerTest.php
+++ b/apps/federatedfilesharing/tests/Controller/RequestHandlerTest.php
@@ -447,6 +447,7 @@ public function testUpdatePermissions() {
 		$this->ocmMiddleware->expects($this->once())
 			->method('getValidShare')
 			->willReturn($share);
+		$this->ocmMiddleware->method('normalizePermissions')->willReturnArgument(0);
 		$this->fedShareManager->expects($this->once())
 			->method('isFederatedReShare')
 			->willReturn(true);
diff --git a/apps/federatedfilesharing/tests/FedShareManagerTest.php b/apps/federatedfilesharing/tests/FedShareManagerTest.php
index a46c8cc05847..8bd482900baf 100644
--- a/apps/federatedfilesharing/tests/FedShareManagerTest.php
+++ b/apps/federatedfilesharing/tests/FedShareManagerTest.php
@@ -64,9 +64,6 @@ class FedShareManagerTest extends TestCase {
 	/** @var AddressHandler | \PHPUnit\Framework\MockObject\MockObject */
 	private $addressHandler;
 
-	/** @var Permissions | \PHPUnit\Framework\MockObject\MockObject */
-	private $permissions;
-
 	/** @var EventDispatcherInterface | \PHPUnit\Framework\MockObject\MockObject */
 	private $eventDispatcher;
 
@@ -87,8 +84,6 @@ protected function setUp(): void {
 		$this->addressHandler = $this->getMockBuilder(AddressHandler::class)
 			->disableOriginalConstructor()->getMock();
 
-		$this->permissions = $this->createMock(Permissions::class);
-
 		$this->eventDispatcher = $this->getMockBuilder(EventDispatcherInterface::class)
 			->getMock();
 
@@ -101,7 +96,6 @@ protected function setUp(): void {
 					$this->activityManager,
 					$this->notificationManager,
 					$this->addressHandler,
-					$this->permissions,
 					$this->eventDispatcher
 				]
 			)
@@ -298,4 +292,31 @@ public function testIsFederatedReShare() {
 			$isFederatedShared
 		);
 	}
+
+	public function providesPermissions(): \Generator {
+		$read = Permissions::toOcPermissions(['read']);
+		$readWrite = Permissions::toOcPermissions(['read', 'write']);
+		$readShare = Permissions::toOcPermissions(['read', 'share']);
+		$readWriteShare = Permissions::toOcPermissions(['read', 'write', 'share']);
+
+		yield 'read -> write is not allowed' => [$read, $readWrite, false];
+		yield 'write -> read is allowed' => [$readWrite, $read, true];
+		yield 'read+share -> write is not allowed' => [$readShare, $readWrite, false];
+		yield 'write+share -> read is allowed' => [$readWriteShare, $read, true];
+	}
+
+	/**
+	 * @dataProvider providesPermissions
+	 */
+	public function testGrantingHigherPermission(int $currentPermissions, int $newPermissions, bool $allowed): void {
+		$share = $this->getMockBuilder(IShare::class)
+			->disableOriginalConstructor()->getMock();
+		$share->method('getPermissions')->willReturn($currentPermissions);
+
+		$this->federatedShareProvider->expects($allowed ? $this->once() : $this->never())
+			->method('update')
+			->with($share);
+
+		$this->fedShareManager->updatePermissions($share, $newPermissions);
+	}
 }
diff --git a/apps/federatedfilesharing/tests/NotificationsTest.php b/apps/federatedfilesharing/tests/NotificationsTest.php
index 416b35f1093c..27abf88ec1ff 100644
--- a/apps/federatedfilesharing/tests/NotificationsTest.php
+++ b/apps/federatedfilesharing/tests/NotificationsTest.php
@@ -65,9 +65,7 @@ public function setUp(): void {
 		$this->config = $this->createMock(IConfig::class);
 		$this->discoveryManager = $this->getMockBuilder(DiscoveryManager::class)
 			->disableOriginalConstructor()->getMock();
-		$this->notificationManager = new NotificationManager(
-			$this->createMock(Permissions::class)
-		);
+		$this->notificationManager = new NotificationManager();
 		$this->httpClientService = $this->createMock(IClientService::class);
 		$this->addressHandler = $this->getMockBuilder(AddressHandler::class)
 			->disableOriginalConstructor()->getMock();
diff --git a/apps/federatedfilesharing/tests/Ocm/PermissionsTest.php b/apps/federatedfilesharing/tests/Ocm/PermissionsTest.php
index 107b2500c529..24934370e7c6 100644
--- a/apps/federatedfilesharing/tests/Ocm/PermissionsTest.php
+++ b/apps/federatedfilesharing/tests/Ocm/PermissionsTest.php
@@ -32,24 +32,14 @@
  * @group DB
  */
 class PermissionsTest extends TestCase {
-	/**
-	 * @var Permissions
-	 */
-	private $permissions;
-
-	protected function setUp(): void {
-		parent::setUp();
-		$this->permissions = new Permissions();
-	}
-
 	/**
 	 * @dataProvider dataTestToOcPermissions
 	 *
 	 * @param string[] $ocmPermissions
 	 * @param int $expectedOcPermissions
 	 */
-	public function testToOcPermissions($ocmPermissions, $expectedOcPermissions) {
-		$ocPermissions = $this->permissions->toOcPermissions($ocmPermissions);
+	public function testToOcPermissions(array $ocmPermissions, int $expectedOcPermissions): void {
+		$ocPermissions = Permissions::toOcPermissions($ocmPermissions);
 		$this->assertEquals($expectedOcPermissions, $ocPermissions);
 	}
 
@@ -91,8 +81,8 @@ public function dataTestToOcPermissions() {
 	 * @param int $ocPermissions
 	 * @param string[] $expectedOcmPermissions
 	 */
-	public function testToOcmPermissions($ocPermissions, $expectedOcmPermissions) {
-		$ocmPermissions = $this->permissions->toOcmPermissions($ocPermissions);
+	public function testToOcmPermissions(int $ocPermissions, array $expectedOcmPermissions): void {
+		$ocmPermissions = Permissions::toOcmPermissions($ocPermissions);
 		$this->assertEquals($expectedOcmPermissions, $ocmPermissions);
 	}
 
diff --git a/changelog/10.12.2_2023-05-31/40792 b/changelog/10.12.2_2023-05-31/40792
new file mode 100644
index 000000000000..6c597fa18ea2
--- /dev/null
+++ b/changelog/10.12.2_2023-05-31/40792
@@ -0,0 +1,3 @@
+Bugfix: Filter sensitive data in log for Session::loginInOwnCloud
+
+https://github.com/owncloud/core/pull/40792
diff --git a/changelog/10.12.2_2023-05-31/40803 b/changelog/10.12.2_2023-05-31/40803
new file mode 100644
index 000000000000..ebdfe19037b5
--- /dev/null
+++ b/changelog/10.12.2_2023-05-31/40803
@@ -0,0 +1,3 @@
+Bugfix: Disallow permission tobe upgraded via federated sharing
+
+https://github.com/owncloud/core/pull/40803
diff --git a/lib/private/Log.php b/lib/private/Log.php
index a1fba6eb0c04..6820bbf0435d 100644
--- a/lib/private/Log.php
+++ b/lib/private/Log.php
@@ -81,6 +81,7 @@ class Log implements ILogger {
 		'validateUserPass',
 		'loginWithPassword',
 		'createSessionToken',
+		'loginInOwnCloud',
 
 		// TokenProvider
 		'getToken',
diff --git a/resources/config/ca-bundle.crt b/resources/config/ca-bundle.crt
index da637630d853..d3426c320926 100644
--- a/resources/config/ca-bundle.crt
+++ b/resources/config/ca-bundle.crt
@@ -1,7 +1,7 @@
 ##
 ## Bundle of CA Root Certificates
 ##
-## Certificate data from Mozilla as of: Thu Feb 23 15:38:48 2023 GMT
+## Certificate data from Mozilla as of: Tue Jun  6 12:15:39 2023 GMT
 ##
 ## This is a bundle of X.509 certificates of public Certificate Authorities
 ## (CA). These were automatically extracted from Mozilla's root certificates
@@ -14,7 +14,7 @@
 ## Just configure this file as the SSLCACertificateFile.
 ##
 ## Conversion done with mk-ca-bundle.pl version 1.29.
-## SHA256: 90c470e705b4b5f36f09684dc50e2b79c8b86989a848b62cd1a7bd6460ee65f6
+## SHA256: c47475103fb05bb562bbadff0d1e72346b03236154e1448a6ca191b740f83507
 ##
 
 
@@ -603,26 +603,6 @@ NwUASZQDhETnv0Mxz3WLJdH0pmT1kvarBes96aULNmLazAZfNou2XjG4Kvte9nHfRCaexOYNkbQu
 dZWAUWpLMKawYqGT8ZvYzsRjdT9ZR7E=
 -----END CERTIFICATE-----
 
-Hongkong Post Root CA 1
-=======================
------BEGIN CERTIFICATE-----
-MIIDMDCCAhigAwIBAgICA+gwDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UEBhMCSEsxFjAUBgNVBAoT
-DUhvbmdrb25nIFBvc3QxIDAeBgNVBAMTF0hvbmdrb25nIFBvc3QgUm9vdCBDQSAxMB4XDTAzMDUx
-NTA1MTMxNFoXDTIzMDUxNTA0NTIyOVowRzELMAkGA1UEBhMCSEsxFjAUBgNVBAoTDUhvbmdrb25n
-IFBvc3QxIDAeBgNVBAMTF0hvbmdrb25nIFBvc3QgUm9vdCBDQSAxMIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEArP84tulmAknjorThkPlAj3n54r15/gK97iSSHSL22oVyaf7XPwnU3ZG1
-ApzQjVrhVcNQhrkpJsLj2aDxaQMoIIBFIi1WpztUlVYiWR8o3x8gPW2iNr4joLFutbEnPzlTCeqr
-auh0ssJlXI6/fMN4hM2eFvz1Lk8gKgifd/PFHsSaUmYeSF7jEAaPIpjhZY4bXSNmO7ilMlHIhqqh
-qZ5/dpTCpmy3QfDVyAY45tQM4vM7TG1QjMSDJ8EThFk9nnV0ttgCXjqQesBCNnLsak3c78QA3xMY
-V18meMjWCnl3v/evt3a5pQuEF10Q6m/hq5URX208o1xNg1vysxmKgIsLhwIDAQABoyYwJDASBgNV
-HRMBAf8ECDAGAQH/AgEDMA4GA1UdDwEB/wQEAwIBxjANBgkqhkiG9w0BAQUFAAOCAQEADkbVPK7i
-h9legYsCmEEIjEy82tvuJxuC52pF7BaLT4Wg87JwvVqWuspube5Gi27nKi6Wsxkz67SfqLI37pio
-l7Yutmcn1KZJ/RyTZXaeQi/cImyaT/JaFTmxcdcrUehtHJjA2Sr0oYJ71clBoiMBdDhViw+5Lmei
-IAQ32pwL0xch4I+XeTRvhEgCIDMb5jREn5Fw9IBehEPCKdJsEhTkYY2sEJCehFC78JZvRZ+K88ps
-T/oROhUVRsPNH4NbLUES7VBnQRM9IauUiqpOfMGx+6fWtScvl6tu4B3i0RwsH0Ti/L6RoZz71ilT
-c4afU9hDDl3WY4JxHYB0yvbiAmvZWg==
------END CERTIFICATE-----
-
 SecureSign RootCA11
 ===================
 -----BEGIN CERTIFICATE-----
@@ -1261,40 +1241,6 @@ Y2XQ8xwOFvVrhlhNGNTkDY6lnVuR3HYkUD/GKvvZt5y11ubQ2egZixVxSK236thZiNSQvxaz2ems
 WWFUyBy6ysHK4bkgTI86k4mloMy/0/Z1pHWWbVY=
 -----END CERTIFICATE-----
 
-E-Tugra Certification Authority
-===============================
------BEGIN CERTIFICATE-----
-MIIGSzCCBDOgAwIBAgIIamg+nFGby1MwDQYJKoZIhvcNAQELBQAwgbIxCzAJBgNVBAYTAlRSMQ8w
-DQYDVQQHDAZBbmthcmExQDA+BgNVBAoMN0UtVHXEn3JhIEVCRyBCaWxpxZ9pbSBUZWtub2xvamls
-ZXJpIHZlIEhpem1ldGxlcmkgQS7Fni4xJjAkBgNVBAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBN
-ZXJrZXppMSgwJgYDVQQDDB9FLVR1Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEzMDMw
-NTEyMDk0OFoXDTIzMDMwMzEyMDk0OFowgbIxCzAJBgNVBAYTAlRSMQ8wDQYDVQQHDAZBbmthcmEx
-QDA+BgNVBAoMN0UtVHXEn3JhIEVCRyBCaWxpxZ9pbSBUZWtub2xvamlsZXJpIHZlIEhpem1ldGxl
-cmkgQS7Fni4xJjAkBgNVBAsMHUUtVHVncmEgU2VydGlmaWthc3lvbiBNZXJrZXppMSgwJgYDVQQD
-DB9FLVR1Z3JhIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
-MIICCgKCAgEA4vU/kwVRHoViVF56C/UYB4Oufq9899SKa6VjQzm5S/fDxmSJPZQuVIBSOTkHS0vd
-hQd2h8y/L5VMzH2nPbxHD5hw+IyFHnSOkm0bQNGZDbt1bsipa5rAhDGvykPL6ys06I+XawGb1Q5K
-CKpbknSFQ9OArqGIW66z6l7LFpp3RMih9lRozt6Plyu6W0ACDGQXwLWTzeHxE2bODHnv0ZEoq1+g
-ElIwcxmOj+GMB6LDu0rw6h8VqO4lzKRG+Bsi77MOQ7osJLjFLFzUHPhdZL3Dk14opz8n8Y4e0ypQ
-BaNV2cvnOVPAmJ6MVGKLJrD3fY185MaeZkJVgkfnsliNZvcHfC425lAcP9tDJMW/hkd5s3kc91r0
-E+xs+D/iWR+V7kI+ua2oMoVJl0b+SzGPWsutdEcf6ZG33ygEIqDUD13ieU/qbIWGvaimzuT6w+Gz
-rt48Ue7LE3wBf4QOXVGUnhMMti6lTPk5cDZvlsouDERVxcr6XQKj39ZkjFqzAQqptQpHF//vkUAq
-jqFGOjGY5RH8zLtJVor8udBhmm9lbObDyz51Sf6Pp+KJxWfXnUYTTjF2OySznhFlhqt/7x3U+Lzn
-rFpct1pHXFXOVbQicVtbC/DP3KBhZOqp12gKY6fgDT+gr9Oq0n7vUaDmUStVkhUXU8u3Zg5mTPj5
-dUyQ5xJwx0UCAwEAAaNjMGEwHQYDVR0OBBYEFC7j27JJ0JxUeVz6Jyr+zE7S6E5UMA8GA1UdEwEB
-/wQFMAMBAf8wHwYDVR0jBBgwFoAULuPbsknQnFR5XPonKv7MTtLoTlQwDgYDVR0PAQH/BAQDAgEG
-MA0GCSqGSIb3DQEBCwUAA4ICAQAFNzr0TbdF4kV1JI+2d1LoHNgQk2Xz8lkGpD4eKexd0dCrfOAK
-kEh47U6YA5n+KGCRHTAduGN8qOY1tfrTYXbm1gdLymmasoR6d5NFFxWfJNCYExL/u6Au/U5Mh/jO
-XKqYGwXgAEZKgoClM4so3O0409/lPun++1ndYYRP0lSWE2ETPo+Aab6TR7U1Q9Jauz1c77NCR807
-VRMGsAnb/WP2OogKmW9+4c4bU2pEZiNRCHu8W1Ki/QY3OEBhj0qWuJA3+GbHeJAAFS6LrVE1Uweo
-a2iu+U48BybNCAVwzDk/dr2l02cmAYamU9JgO3xDf1WKvJUawSg5TB9D0pH0clmKuVb8P7Sd2nCc
-dlqMQ1DujjByTd//SffGqWfZbawCEeI6FiWnWAjLb1NBnEg4R2gz0dfHj9R0IdTDBZB6/86WiLEV
-KV0jq9BgoRJP3vQXzTLlyb/IQ639Lo7xr+L0mPoSHyDYwKcMhcWQ9DstliaxLL5Mq+ux0orJ23gT
-Dx4JnW2PAJ8C2sH6H3p6CcRK5ogql5+Ji/03X186zjhZhkuvcQu02PJwT58yE+Owp1fl2tpDy4Q0
-8ijE6m30Ku/Ba3ba+367hTzSU8JNvnHhRdH9I2cNE3X7z2VnIp2usAnRCf8dNL/+I5c30jn6PQ0G
-C7TbO6Orb1wdtn7os4I07QZcJA==
------END CERTIFICATE-----
-
 T-TeleSec GlobalRoot Class 2
 ============================
 -----BEGIN CERTIFICATE-----
@@ -3370,3 +3316,48 @@ BggqhkjOPQQDAwNoADBlAjAVXUI9/Lbu9zuxNuie9sRGKEkz0FhDKmMpzE2xtHqiuQ04pV1IKv3L
 snNdo4gIxwwCMQDAqy0Obe0YottT6SXbVQjgUMzfRGEWgqtJsLKB7HOHeLRMsmIbEvoWTSVLY70e
 N9k=
 -----END CERTIFICATE-----
+
+BJCA Global Root CA1
+====================
+-----BEGIN CERTIFICATE-----
+MIIFdDCCA1ygAwIBAgIQVW9l47TZkGobCdFsPsBsIDANBgkqhkiG9w0BAQsFADBUMQswCQYDVQQG
+EwJDTjEmMCQGA1UECgwdQkVJSklORyBDRVJUSUZJQ0FURSBBVVRIT1JJVFkxHTAbBgNVBAMMFEJK
+Q0EgR2xvYmFsIFJvb3QgQ0ExMB4XDTE5MTIxOTAzMTYxN1oXDTQ0MTIxMjAzMTYxN1owVDELMAkG
+A1UEBhMCQ04xJjAkBgNVBAoMHUJFSUpJTkcgQ0VSVElGSUNBVEUgQVVUSE9SSVRZMR0wGwYDVQQD
+DBRCSkNBIEdsb2JhbCBSb290IENBMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPFm
+CL3ZxRVhy4QEQaVpN3cdwbB7+sN3SJATcmTRuHyQNZ0YeYjjlwE8R4HyDqKYDZ4/N+AZspDyRhyS
+sTphzvq3Rp4Dhtczbu33RYx2N95ulpH3134rhxfVizXuhJFyV9xgw8O558dnJCNPYwpj9mZ9S1Wn
+P3hkSWkSl+BMDdMJoDIwOvqfwPKcxRIqLhy1BDPapDgRat7GGPZHOiJBhyL8xIkoVNiMpTAK+BcW
+yqw3/XmnkRd4OJmtWO2y3syJfQOcs4ll5+M7sSKGjwZteAf9kRJ/sGsciQ35uMt0WwfCyPQ10WRj
+eulumijWML3mG90Vr4TqnMfK9Q7q8l0ph49pczm+LiRvRSGsxdRpJQaDrXpIhRMsDQa4bHlW/KNn
+MoH1V6XKV0Jp6VwkYe/iMBhORJhVb3rCk9gZtt58R4oRTklH2yiUAguUSiz5EtBP6DF+bHq/pj+b
+OT0CFqMYs2esWz8sgytnOYFcuX6U1WTdno9uruh8W7TXakdI136z1C2OVnZOz2nxbkRs1CTqjSSh
+GL+9V/6pmTW12xB3uD1IutbB5/EjPtffhZ0nPNRAvQoMvfXnjSXWgXSHRtQpdaJCbPdzied9v3pK
+H9MiyRVVz99vfFXQpIsHETdfg6YmV6YBW37+WGgHqel62bno/1Afq8K0wM7o6v0PvY1NuLxxAgMB
+AAGjQjBAMB0GA1UdDgQWBBTF7+3M2I0hxkjk49cULqcWk+WYATAPBgNVHRMBAf8EBTADAQH/MA4G
+A1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOCAgEAUoKsITQfI/Ki2Pm4rzc2IInRNwPWaZ+4
+YRC6ojGYWUfo0Q0lHhVBDOAqVdVXUsv45Mdpox1NcQJeXyFFYEhcCY5JEMEE3KliawLwQ8hOnThJ
+dMkycFRtwUf8jrQ2ntScvd0g1lPJGKm1Vrl2i5VnZu69mP6u775u+2D2/VnGKhs/I0qUJDAnyIm8
+60Qkmss9vk/Ves6OF8tiwdneHg56/0OGNFK8YT88X7vZdrRTvJez/opMEi4r89fO4aL/3Xtw+zuh
+TaRjAv04l5U/BXCga99igUOLtFkNSoxUnMW7gZ/NfaXvCyUeOiDbHPwfmGcCCtRzRBPbUYQaVQNW
+4AB+dAb/OMRyHdOoP2gxXdMJxy6MW2Pg6Nwe0uxhHvLe5e/2mXZgLR6UcnHGCyoyx5JO1UbXHfmp
+GQrI+pXObSOYqgs4rZpWDW+N8TEAiMEXnM0ZNjX+VVOg4DwzX5Ze4jLp3zO7Bkqp2IRzznfSxqxx
+4VyjHQy7Ct9f4qNx2No3WqB4K/TUfet27fJhcKVlmtOJNBir+3I+17Q9eVzYH6Eze9mCUAyTF6ps
+3MKCuwJXNq+YJyo5UOGwifUll35HaBC07HPKs5fRJNz2YqAo07WjuGS3iGJCz51TzZm+ZGiPTx4S
+SPfSKcOYKMryMguTjClPPGAyzQWWYezyr/6zcCwupvI=
+-----END CERTIFICATE-----
+
+BJCA Global Root CA2
+====================
+-----BEGIN CERTIFICATE-----
+MIICJTCCAaugAwIBAgIQLBcIfWQqwP6FGFkGz7RK6zAKBggqhkjOPQQDAzBUMQswCQYDVQQGEwJD
+TjEmMCQGA1UECgwdQkVJSklORyBDRVJUSUZJQ0FURSBBVVRIT1JJVFkxHTAbBgNVBAMMFEJKQ0Eg
+R2xvYmFsIFJvb3QgQ0EyMB4XDTE5MTIxOTAzMTgyMVoXDTQ0MTIxMjAzMTgyMVowVDELMAkGA1UE
+BhMCQ04xJjAkBgNVBAoMHUJFSUpJTkcgQ0VSVElGSUNBVEUgQVVUSE9SSVRZMR0wGwYDVQQDDBRC
+SkNBIEdsb2JhbCBSb290IENBMjB2MBAGByqGSM49AgEGBSuBBAAiA2IABJ3LgJGNU2e1uVCxA/jl
+SR9BIgmwUVJY1is0j8USRhTFiy8shP8sbqjV8QnjAyEUxEM9fMEsxEtqSs3ph+B99iK++kpRuDCK
+/eHeGBIK9ke35xe/J4rUQUyWPGCWwf0VHKNCMEAwHQYDVR0OBBYEFNJKsVF/BvDRgh9Obl+rg/xI
+1LCRMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMDA2gAMGUCMBq8
+W9f+qdJUDkpd0m2xQNz0Q9XSSpkZElaA94M04TVOSG0ED1cxMDAtsaqdAzjbBgIxAMvMh1PLet8g
+UXOQwKhbYdDFUDn9hf7B43j4ptZLvZuHjw/l1lOWqzzIQNph91Oj9w==
+-----END CERTIFICATE-----
diff --git a/sonar-project.properties b/sonar-project.properties
index 2cae88ff0c49..7bc11cc225a6 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -1,7 +1,7 @@
 # Organization and project keys are displayed in the right sidebar of the project homepage
 sonar.organization=owncloud-1
 sonar.projectKey=owncloud_core
-sonar.projectVersion=10.12.1
+sonar.projectVersion=10.12.2
 sonar.host.url=https://sonarcloud.io
 
 # =====================================================
diff --git a/version.php b/version.php
index a70a567bda66..b053889258d3 100644
--- a/version.php
+++ b/version.php
@@ -25,10 +25,10 @@
 // We only can count up. The 4. digit is only for the internal patchlevel to trigger DB upgrades
 // between betas, final and RCs. This is _not_ the public version number. Reset minor/patchlevel
 // when updating major/minor version number.
-$OC_Version = [10, 12, 1, 3];
+$OC_Version = [10, 12, 2, 1];
 
 // The human-readable string
-$OC_VersionString = '10.12.1';
+$OC_VersionString = '10.12.2';
 
 $OC_VersionCanBeUpgradedFrom = [[8, 2, 11],[9, 0, 9],[9, 1]];