feat: release 11.0.1

[oc-tmueller]

Prepares owncloud/core for the v11.0.1 tag — the first patch release of the 11.0 line.

Supersedes #41825. That PR sat on a branch named release/v11.0.1, and the org
owncloud-maintenance-branch-policy ruleset (18556467) matches refs/heads/release/*: after its
first push the branch takes non_fast_forward + pull_request, so it can neither be rebased onto
current master (it was 24 commits behind) nor take the changelog commit. Its changelog/unreleased/41824
fragment is carried over here verbatim. The branch itself cannot be deleted.

version.php

$OC_VersionString 11.0.0 → 11.0.1, $OC_Version [11, 0, 0, 0] → [11, 0, 1, 0].

The 4th digit is the internal DB-upgrade patch level, not the public version, and stays at 0: there
are no migrations or db_structure.xml changes since v11.0.0, and the 3rd-digit bump alone triggers
the upgrade.

Changelog

The 14 fragments in changelog/unreleased/ move into changelog/11.0.1_2026-09-25/ (git mv, all at
100% similarity) and CHANGELOG.md is regenerated with calens. unreleased/ keeps its .gitkeep and
is now empty, ready for the next cycle.

-# Changelog for ownCloud Core [unreleased] (UNRELEASED)
+# Changelog for ownCloud Core [11.0.1] (2026-09-25)
-[unreleased]: https://github.com/owncloud/core/compare/v11.0.0...master
+[11.0.1]: https://github.com/owncloud/core/compare/v11.0.0...v11.0.1

Same shape as 852062dd ("feat: release 10.16.4") and ad4be191 ("feat: release 11.0.0"), which
each did the changelog and the version bump in one commit.

The date is provisional. One more PR is still expected in this release; when it lands, this branch
gets rebased, ocrelease changelog re-run so its fragment joins the folder, and the folder renamed if
the day has moved. That push will dismiss any approval (dismiss_stale_reviews_on_push: true on
master), so please expect one re-review — sorry in advance.

Second commit: two dependencies the notes did not name

Diffing composer.lock at v11.0.0 against this branch gives 26 changed production packages; the
PHPdependencies202608onward fragment listed 24. composer/semver (3.4.4 to 3.5.0) and
nikic/php-parser (v5.8.0 to v5.9.0) were both missing, and both are direct entries in
composer.json's require — each was dropped by the very pass that bumped it (#41864 and #41829 both
edited that fragment without adding their own package). The list already names transitive dependencies
such as guzzlehttp/psr7, so these were omissions, not a scoping choice. This is the last point at
which fixing them is free.

The four remaining lock differences are require-dev only and stay out, matching the fragment's
existing production-only scope — the tarball installs --no-dev.

That commit also restores CHANGELOG.md's trailing newline. ocrelease changelog writes calens'
stdout as captured by execa, which strips it; the last six chore: update changelog revisions all end
in one and so does calens' own output, so the next regeneration would have produced a one-byte no-op
diff.

After merge

v11.0.1 gets tagged (annotated, signed) on the merged commit, and the bundles are built and published
from owncloud/server-release — spec PR owncloud/server-release#53, which is red by construction until
that tag exists.

🤖 Generated with Claude Code

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[phil-davis]

I am surprised that this is in the reuire section of composer.json
I thought that it was only used by phpunit, and related dependencies of that.
I see that it is also in require-dev of symfony/translation.
Anyway, it doesn't hurt to list it here.

[DeepDiver1975]

We used it in the occ commands which check app code - if I remember correctly. I dropped them for 11... right?

[phil-davis]

That sounds correct. I didn't find any real uses of php-parser in our own code when I did a quick search.
We could probably move php-parser to require-dev, and then I suppose it would not get included in a production release bundle.

[oc-tmueller]

Rebased onto master @ 04fa66ae60 to pick up #41869 ("restrict federated address book sync to the trusted server"), which is now part of 11.0.1.

Rebuilt rather than rebased: master also gained #41866 (chore: update changelog), so CHANGELOG.md had been regenerated on both sides — and a plain rebase would in any case have left changelog/unreleased/41869 behind, shipping a release with a non-empty unreleased/ and no entry for the fix.

What changed: the folder now holds 15 fragments instead of 14, changelog/11.0.1_2026-09-25/41869 among them, and the release notes gain

* Bugfix - Restrict federated address book sync to the trusted server: [#41869](https://github.com/owncloud/core/pull/41869)

The date is unchanged — still 2026-09-25.

Verified after the rebuild:

• 41869 moved as a 0-delta pure rename; content byte-identical to origin/master's copy
• CHANGELOG.md is byte-identical to calens' own output for this tree
• changelog/unreleased/ holds only .gitkeep
• the dependency finding re-checked against the new base: composer.lock v11.0.0..HEAD still shows 26 changed production packages, and composer/semver + nikic/php-parser are still the only two missing — fix: restrict federated address book sync to the trusted server #41869 touched no dependency
• the branch's entire diff against master is 17 files: version.php, the 15 fragment moves, CHANGELOG.md, and the one dependency-fragment edit

This dismissed any approval (dismiss_stale_reviews_on_push: true on master) — as flagged in the description, sorry. This is the rebase that was being waited for, so no further churn is expected: next step is merge, then v11.0.1 gets tagged on the merged commit.

One classification question for a reviewer, not changed here: #41869's fragment is typed Bugfix, so it renders under Bugfixes rather than Security, even though the fix refuses requests that would leave the trusted server. If that should read as a Security entry, the fragment's first word is the only thing that needs changing — and it has to change before the tag, since the fragment ships inside the tarball.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com