No dropdown is rendered in attendee field

[nipuli]

Steps to reproduce

1. install calendar app (version 6.4.2) into nc (version 34.0.0)
2. switch to calendar view
3. create new event with +event
4. click into search field of attendees
5. type the first two letters of a known user

Expected behavior

6. the field should provide a list of suitable users containing the search letters in their names.

Actual behavior

6. No dropdown is rendered in attendee field, it does not contain anything, but a short blink of an activity after any typing

Calendar app version

6.4.2

CalDAV-clients used

none, web frontend. Dav is installed in version 1.39.0

Browser

Firefox 140.11 and Chromium 149.0.7827

Client operating system

Linux

Server operating system

Alma Linux 10.2

Web server

Apache

Database engine version

MySQL

PHP engine version

PHP 8.4

Nextcloud version

34.0.0

Updated from an older installed version or fresh install

Fresh install

List of activated apps

- activity: 7.0.0
  - appstore: 1.0.0
  - bruteforcesettings: 7.0.0
  - calendar: 6.4.2
  - circles: 34.0.0
  - cloud_federation_api: 1.18.0
  - comments: 1.24.0
  - contactsinteraction: 1.15.0
  - dashboard: 7.14.0
  - dav: 1.39.0
  - federatedfilesharing: 1.24.0
  - federation: 1.24.0
  - files: 2.6.0
  - files_downloadlimit: 5.2.0-dev.0
  - files_lock: 34.0.0
  - files_pdfviewer: 7.0.0-dev.0
  - files_reminders: 1.7.0
  - files_sharing: 1.26.0
  - files_trashbin: 1.24.0
  - files_versions: 1.27.0
  - firstrunwizard: 7.0.0-dev.0
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - nextcloud_announcements: 6.0.0
  - notes: 6.0.0
  - notifications: 7.0.0-dev.1
  - oauth2: 1.22.0
  - office: 1.0.0
  - password_policy: 6.0.0-dev.0
  - photos: 7.0.0
  - privacy: 6.0.0-dev.1
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - recommendations: 7.0.0-dev.0
  - related_resources: 5.0.0-dev.0
  - richdocuments: 11.0.0
  - richdocumentscode: 26.4.104
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - spreed: 24.0.0
  - support: 6.0.0
  - survey_client: 6.0.0-dev.0
  - systemtags: 1.24.0
  - text: 8.0.0
  - theming: 2.9.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_totp: 16.0.0
  - updatenotification: 1.24.0
  - user_ldap: 1.25.0
  - user_saml: 8.1.2
  - user_status: 1.14.0
  - viewer: 7.0.0-dev.0
  - weather_status: 1.14.0
  - webhook_listeners: 1.6.0
  - workflowengine: 2.16.0

Nextcloud configuration

"system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "trusted_domains": [
            "<fqdn1>",
            "<fqdn2>"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "34.0.0.12",
        "overwrite.cli.url": "https:\/\/<fqdn>",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "maintenance_window_start": 1,
        "theme": "",
        "loglevel": 2,
        "log_rotate_size": 104857600,
        "default_phone_region": "DE",
        "mail_smtpsecure": "tls",
        "updater.release.channel": "stable",
        "auth.webauthn.enabled": "false",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "app_install_overwrite": [],
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory"
    }

Web server error log

Some blocks of 4 of those around the time in half an hour distance; nothing else in the ssl_error.log:
[access_compat:error] [pid xxxx:tid xxxx] [remote ::x:xxxxxx] AH01797: client denied by server configuration: /var/www/html/nextcloud/data/.ncdata

Two entries in ssl_access.log look suspicious to me:
GET /ocs/v2.php/apps/files_sharing/api/v1/sharees?format=json&search=wa&perPage=200&itemType=pringroucipals HTTP/2.0

Log file

is too old since from yesterday

Browser log

Additional info

Searching for users in file sharing works as expected and shows list of users.

Opening the browser inspector reveals:

• Attendee endpoint returns HTTP 200
• Response contains name, emails, lang, tzid, type=individual, source=system
• Before the event already, there is a Console warning: Calendar API not initialized yet, ProposalEditor.vue

Searching for the supsicious log entry pringroucipals (see above) finds it in the 4 files

• nextcloud/apps/calendar/js/calendar-main.js
• nextcloud/apps/calendar/js/calendar-main.js.map
• nextcloud/apps/calendar/js/calendar-src_services_autocompleteService_ts-src_utils_closestColor_js-src_utils_xxxx.js and
• ~.js.map