diff --git a/CHANGELOG.md b/CHANGELOG.md index 36b1695f5de2..d7fdab835a2b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Table of Contents -* [Changelog for unreleased](#changelog-for-owncloud-core-unreleased-unreleased) +* [Changelog for 11.0.1](#changelog-for-owncloud-core-1101-2026-09-25) * [Changelog for 11.0.0](#changelog-for-owncloud-core-1100-2026-07-30) * [Changelog for 10.16.4](#changelog-for-owncloud-core-10164-2026-07-29) * [Changelog for 10.16.3](#changelog-for-owncloud-core-10163-2026-05-22) @@ -31,12 +31,12 @@ * [Changelog for 10.4.1](#changelog-for-owncloud-core-1041-2020-03-30) * [Changelog for 10.4.0](#changelog-for-owncloud-core-1040-2020-02-10) * [Changelog for 10.3.2](#changelog-for-owncloud-core-1032-2019-12-04) -# Changelog for ownCloud Core [unreleased] (UNRELEASED) +# Changelog for ownCloud Core [11.0.1] (2026-09-25) -The following sections list the changes in ownCloud core unreleased relevant to +The following sections list the changes in ownCloud core 11.0.1 relevant to ownCloud admins and users. -[unreleased]: https://github.com/owncloud/core/compare/v11.0.0...master +[11.0.1]: https://github.com/owncloud/core/compare/v11.0.0...v11.0.1 ## Summary @@ -48,8 +48,10 @@ ownCloud admins and users. * Bugfix - Restore index usage for filecache writes on Oracle: [#41782](https://github.com/owncloud/core/issues/41782) * Bugfix - Show federated users in the share dialog when local users also match: [#41807](https://github.com/owncloud/core/pull/41807) * Bugfix - Avoid a deprecation notice when hashing the file cache path on Oracle: [#41808](https://github.com/owncloud/core/pull/41808) +* Bugfix - Ship only the app payload in the release tarballs: [#41824](https://github.com/owncloud/core/issues/41824) * Bugfix - Release the file handle when a bitmap preview cannot be decoded: [#41835](https://github.com/owncloud/core/pull/41835) * Bugfix - Show a media type icon when a preview file cannot be opened: [#41855](https://github.com/owncloud/core/pull/41855) +* Bugfix - Restrict federated address book sync to the trusted server: [#41869](https://github.com/owncloud/core/pull/41869) * Change - Update PHP dependencies: [#41775](https://github.com/owncloud/core/pull/41775) * Change - Require rhukster/dom-sanitizer as a tagged release: [#41785](https://github.com/owncloud/core/pull/41785) * Change - Restore Oracle database support in the command line installer: [#41808](https://github.com/owncloud/core/pull/41808) @@ -230,6 +232,30 @@ ownCloud admins and users. https://github.com/owncloud/core/pull/41808 +* Bugfix - Ship only the app payload in the release tarballs: [#41824](https://github.com/owncloud/core/issues/41824) + + The release bundles contained 13 bundled apps as the working tree they had been + built in, rather than as the app's release artifact. Each of those app + directories carried `.git/` (a shallow clone including its pack file), + `.github/`, `tests/`, `vendor-bin/` and `build/artifacts/`, the last holding a + second copy of the app's own tarball. That was 101.94 MB of the 441.8 MB + uncompressed complete tarball, in 16 shipped git repositories. + + Three things made it more than dead weight. `files_antivirus` shipped its + anti-virus acceptance data, so a ClamAV scan of the tarball, or of any image + built from it, reported `Eicar-Test-Signature FOUND` and could be rejected by an + anti-virus gate. The development files were covered by the app's + `appinfo/signature.json`, so an administrator could not delete them without + breaking `occ integrity:check-app`. And the shipped `.git/` carried the release + engineer's clone metadata, including their name and e-mail address. + + The affected app releases have been repackaged, and the release tooling now + refuses to build a bundle that contains a build working tree, so this cannot + recur unnoticed. The standard tarball was affected as well, through + `notifications`. + + https://github.com/owncloud/core/issues/41824 + * Bugfix - Release the file handle when a bitmap preview cannot be decoded: [#41835](https://github.com/owncloud/core/pull/41835) Bitmap previews closed the file they had opened only when decoding succeeded, so @@ -261,10 +287,23 @@ ownCloud admins and users. https://github.com/owncloud/core/pull/41855 +* Bugfix - Restrict federated address book sync to the trusted server: [#41869](https://github.com/owncloud/core/pull/41869) + + The federated system address book sync could request resources that do not + belong to the trusted server it was syncing with, and could follow redirects + away from that server. + + Requests which would leave the trusted server are now refused, and resource + references which do not belong to it are skipped and logged. + + https://github.com/owncloud/core/pull/41869 + * Change - Update PHP dependencies: [#41775](https://github.com/owncloud/core/pull/41775) The following have been updated: + * composer/semver (3.4.4 to 3.5.0) + * doctrine/lexer (3.0.1 to 3.0.2) * firebase/php-jwt (v7.1.0 to v7.2.0) @@ -285,6 +324,8 @@ ownCloud admins and users. * monolog/monolog (3.10.0 to 3.12.0) + * nikic/php-parser (v5.8.0 to v5.9.0) + * pear/archive_tar (1.6.0 to 1.6.1) * phpseclib/phpseclib (3.0.55 to 3.0.57) diff --git a/changelog/unreleased/41676 b/changelog/11.0.1_2026-09-25/41676 similarity index 100% rename from changelog/unreleased/41676 rename to changelog/11.0.1_2026-09-25/41676 diff --git a/changelog/unreleased/41779 b/changelog/11.0.1_2026-09-25/41779 similarity index 100% rename from changelog/unreleased/41779 rename to changelog/11.0.1_2026-09-25/41779 diff --git a/changelog/unreleased/41807 b/changelog/11.0.1_2026-09-25/41807 similarity index 100% rename from changelog/unreleased/41807 rename to changelog/11.0.1_2026-09-25/41807 diff --git a/changelog/unreleased/41808 b/changelog/11.0.1_2026-09-25/41808 similarity index 100% rename from changelog/unreleased/41808 rename to changelog/11.0.1_2026-09-25/41808 diff --git a/changelog/unreleased/41808-oracle-path-hash b/changelog/11.0.1_2026-09-25/41808-oracle-path-hash similarity index 100% rename from changelog/unreleased/41808-oracle-path-hash rename to changelog/11.0.1_2026-09-25/41808-oracle-path-hash diff --git a/changelog/unreleased/41818 b/changelog/11.0.1_2026-09-25/41818 similarity index 100% rename from changelog/unreleased/41818 rename to changelog/11.0.1_2026-09-25/41818 diff --git a/changelog/11.0.1_2026-09-25/41824 b/changelog/11.0.1_2026-09-25/41824 new file mode 100644 index 000000000000..5f44ec381443 --- /dev/null +++ b/changelog/11.0.1_2026-09-25/41824 @@ -0,0 +1,23 @@ +Bugfix: Ship only the app payload in the release tarballs + +The release bundles contained 13 bundled apps as the working tree they had been +built in, rather than as the app's release artifact. Each of those app +directories carried `.git/` (a shallow clone including its pack file), +`.github/`, `tests/`, `vendor-bin/` and `build/artifacts/`, the last holding a +second copy of the app's own tarball. That was 101.94 MB of the 441.8 MB +uncompressed complete tarball, in 16 shipped git repositories. + +Three things made it more than dead weight. `files_antivirus` shipped its +anti-virus acceptance data, so a ClamAV scan of the tarball, or of any image +built from it, reported `Eicar-Test-Signature FOUND` and could be rejected by an +anti-virus gate. The development files were covered by the app's +`appinfo/signature.json`, so an administrator could not delete them without +breaking `occ integrity:check-app`. And the shipped `.git/` carried the release +engineer's clone metadata, including their name and e-mail address. + +The affected app releases have been repackaged, and the release tooling now +refuses to build a bundle that contains a build working tree, so this cannot +recur unnoticed. The standard tarball was affected as well, through +`notifications`. + +https://github.com/owncloud/core/issues/41824 diff --git a/changelog/unreleased/41827 b/changelog/11.0.1_2026-09-25/41827 similarity index 100% rename from changelog/unreleased/41827 rename to changelog/11.0.1_2026-09-25/41827 diff --git a/changelog/unreleased/41834 b/changelog/11.0.1_2026-09-25/41834 similarity index 100% rename from changelog/unreleased/41834 rename to changelog/11.0.1_2026-09-25/41834 diff --git a/changelog/unreleased/41835 b/changelog/11.0.1_2026-09-25/41835 similarity index 100% rename from changelog/unreleased/41835 rename to changelog/11.0.1_2026-09-25/41835 diff --git a/changelog/unreleased/41855 b/changelog/11.0.1_2026-09-25/41855 similarity index 100% rename from changelog/unreleased/41855 rename to changelog/11.0.1_2026-09-25/41855 diff --git a/changelog/unreleased/41856 b/changelog/11.0.1_2026-09-25/41856 similarity index 100% rename from changelog/unreleased/41856 rename to changelog/11.0.1_2026-09-25/41856 diff --git a/changelog/unreleased/41869 b/changelog/11.0.1_2026-09-25/41869 similarity index 100% rename from changelog/unreleased/41869 rename to changelog/11.0.1_2026-09-25/41869 diff --git a/changelog/unreleased/PHPdependencies202608onward b/changelog/11.0.1_2026-09-25/PHPdependencies202608onward similarity index 94% rename from changelog/unreleased/PHPdependencies202608onward rename to changelog/11.0.1_2026-09-25/PHPdependencies202608onward index 7a4c35236010..bb8c5cee325c 100644 --- a/changelog/unreleased/PHPdependencies202608onward +++ b/changelog/11.0.1_2026-09-25/PHPdependencies202608onward @@ -2,6 +2,8 @@ Change: Update PHP dependencies The following have been updated: + * composer/semver (3.4.4 to 3.5.0) + * doctrine/lexer (3.0.1 to 3.0.2) * firebase/php-jwt (v7.1.0 to v7.2.0) @@ -22,6 +24,8 @@ The following have been updated: * monolog/monolog (3.10.0 to 3.12.0) + * nikic/php-parser (v5.8.0 to v5.9.0) + * pear/archive_tar (1.6.0 to 1.6.1) * phpseclib/phpseclib (3.0.55 to 3.0.57) diff --git a/changelog/unreleased/domsanitizer-tagged-version b/changelog/11.0.1_2026-09-25/domsanitizer-tagged-version similarity index 100% rename from changelog/unreleased/domsanitizer-tagged-version rename to changelog/11.0.1_2026-09-25/domsanitizer-tagged-version diff --git a/version.php b/version.php index 71d65700a4d7..969457ada284 100644 --- a/version.php +++ b/version.php @@ -25,10 +25,10 @@ // We only can count up. The 4. digit is only for the internal patch-level to trigger DB upgrades // between betas, final and RCs. This is _not_ the public version number. Reset minor/patch-level // when updating major/minor version number. -$OC_Version = [11, 0, 0, 0]; +$OC_Version = [11, 0, 1, 0]; // The human-readable string -$OC_VersionString = '11.0.0'; +$OC_VersionString = '11.0.1'; $OC_VersionCanBeUpgradedFrom = [[8, 2, 11],[9, 0, 9],[9, 1]];