From 253e1f5383452bef0cdf016e63f4242523c3bd22 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Fri, 25 Sep 2026 11:36:41 +0200 Subject: [PATCH 1/2] feat: release 11.0.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump version.php to 11.0.1 and materialize the changelog fragments for the first patch release of the 11.0 line. $OC_Version becomes [11, 0, 1, 0]: the 4th digit is the internal DB-upgrade patch level, not the public patch number, and nothing in this release needs it moved. The 15 fragments in changelog/unreleased/ move into changelog/11.0.1_2026-09-25/ (git mv, so the renames stay tracked) and CHANGELOG.md is regenerated with calens. unreleased/ keeps its .gitkeep and is now empty, ready for the next cycle. Security: - #41827 reject SVG/script content before it reaches ImageMagick bitmap previews - #41834 pin the Imagick coder for each preview provider - #41856 prevent path traversal via appconfig public_/remote_ keys Bugfixes: - #41676 reduce priority of checkPropFind event - #41779 do not echo secrets when setting config values via occ - #41782 restore index usage for filecache writes on Oracle - #41807 show federated users in the share dialog when local users also match - #41808 avoid a deprecation notice when hashing the file cache path on Oracle - #41824 ship only the app payload in the release tarballs - #41835 release the file handle when a bitmap preview cannot be decoded - #41855 show a media type icon when a preview file cannot be opened - #41869 restrict federated address book sync to the trusted server Changes: - #41775 update PHP dependencies - #41785 require rhukster/dom-sanitizer as a tagged release - #41808 restore Oracle database support in the command line installer The #41824 fragment is carried over from #41825, which prepared this release on a release/v11.0.1 branch that the org maintenance ruleset freezes after its first push; that branch cannot take the changelog commit, so this supersedes it. Once merged, v11.0.1 gets tagged on the merged commit and the release bundles are built and published from owncloud/server-release. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- CHANGELOG.md | 47 +++++++++++++++++-- .../{unreleased => 11.0.1_2026-09-25}/41676 | 0 .../{unreleased => 11.0.1_2026-09-25}/41779 | 0 .../{unreleased => 11.0.1_2026-09-25}/41807 | 0 .../{unreleased => 11.0.1_2026-09-25}/41808 | 0 .../41808-oracle-path-hash | 0 .../{unreleased => 11.0.1_2026-09-25}/41818 | 0 changelog/11.0.1_2026-09-25/41824 | 23 +++++++++ .../{unreleased => 11.0.1_2026-09-25}/41827 | 0 .../{unreleased => 11.0.1_2026-09-25}/41834 | 0 .../{unreleased => 11.0.1_2026-09-25}/41835 | 0 .../{unreleased => 11.0.1_2026-09-25}/41855 | 0 .../{unreleased => 11.0.1_2026-09-25}/41856 | 0 .../{unreleased => 11.0.1_2026-09-25}/41869 | 0 .../PHPdependencies202608onward | 0 .../domsanitizer-tagged-version | 0 version.php | 4 +- 17 files changed, 67 insertions(+), 7 deletions(-) rename changelog/{unreleased => 11.0.1_2026-09-25}/41676 (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/41779 (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/41807 (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/41808 (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/41808-oracle-path-hash (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/41818 (100%) create mode 100644 changelog/11.0.1_2026-09-25/41824 rename changelog/{unreleased => 11.0.1_2026-09-25}/41827 (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/41834 (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/41835 (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/41855 (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/41856 (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/41869 (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/PHPdependencies202608onward (100%) rename changelog/{unreleased => 11.0.1_2026-09-25}/domsanitizer-tagged-version (100%) diff --git a/CHANGELOG.md b/CHANGELOG.md index 36b1695f5de2..fd09ec8b9a7c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Table of Contents -* [Changelog for unreleased](#changelog-for-owncloud-core-unreleased-unreleased) +* [Changelog for 11.0.1](#changelog-for-owncloud-core-1101-2026-09-25) * [Changelog for 11.0.0](#changelog-for-owncloud-core-1100-2026-07-30) * [Changelog for 10.16.4](#changelog-for-owncloud-core-10164-2026-07-29) * [Changelog for 10.16.3](#changelog-for-owncloud-core-10163-2026-05-22) @@ -31,12 +31,12 @@ * [Changelog for 10.4.1](#changelog-for-owncloud-core-1041-2020-03-30) * [Changelog for 10.4.0](#changelog-for-owncloud-core-1040-2020-02-10) * [Changelog for 10.3.2](#changelog-for-owncloud-core-1032-2019-12-04) -# Changelog for ownCloud Core [unreleased] (UNRELEASED) +# Changelog for ownCloud Core [11.0.1] (2026-09-25) -The following sections list the changes in ownCloud core unreleased relevant to +The following sections list the changes in ownCloud core 11.0.1 relevant to ownCloud admins and users. -[unreleased]: https://github.com/owncloud/core/compare/v11.0.0...master +[11.0.1]: https://github.com/owncloud/core/compare/v11.0.0...v11.0.1 ## Summary @@ -48,8 +48,10 @@ ownCloud admins and users. * Bugfix - Restore index usage for filecache writes on Oracle: [#41782](https://github.com/owncloud/core/issues/41782) * Bugfix - Show federated users in the share dialog when local users also match: [#41807](https://github.com/owncloud/core/pull/41807) * Bugfix - Avoid a deprecation notice when hashing the file cache path on Oracle: [#41808](https://github.com/owncloud/core/pull/41808) +* Bugfix - Ship only the app payload in the release tarballs: [#41824](https://github.com/owncloud/core/issues/41824) * Bugfix - Release the file handle when a bitmap preview cannot be decoded: [#41835](https://github.com/owncloud/core/pull/41835) * Bugfix - Show a media type icon when a preview file cannot be opened: [#41855](https://github.com/owncloud/core/pull/41855) +* Bugfix - Restrict federated address book sync to the trusted server: [#41869](https://github.com/owncloud/core/pull/41869) * Change - Update PHP dependencies: [#41775](https://github.com/owncloud/core/pull/41775) * Change - Require rhukster/dom-sanitizer as a tagged release: [#41785](https://github.com/owncloud/core/pull/41785) * Change - Restore Oracle database support in the command line installer: [#41808](https://github.com/owncloud/core/pull/41808) @@ -230,6 +232,30 @@ ownCloud admins and users. https://github.com/owncloud/core/pull/41808 +* Bugfix - Ship only the app payload in the release tarballs: [#41824](https://github.com/owncloud/core/issues/41824) + + The release bundles contained 13 bundled apps as the working tree they had been + built in, rather than as the app's release artifact. Each of those app + directories carried `.git/` (a shallow clone including its pack file), + `.github/`, `tests/`, `vendor-bin/` and `build/artifacts/`, the last holding a + second copy of the app's own tarball. That was 101.94 MB of the 441.8 MB + uncompressed complete tarball, in 16 shipped git repositories. + + Three things made it more than dead weight. `files_antivirus` shipped its + anti-virus acceptance data, so a ClamAV scan of the tarball, or of any image + built from it, reported `Eicar-Test-Signature FOUND` and could be rejected by an + anti-virus gate. The development files were covered by the app's + `appinfo/signature.json`, so an administrator could not delete them without + breaking `occ integrity:check-app`. And the shipped `.git/` carried the release + engineer's clone metadata, including their name and e-mail address. + + The affected app releases have been repackaged, and the release tooling now + refuses to build a bundle that contains a build working tree, so this cannot + recur unnoticed. The standard tarball was affected as well, through + `notifications`. + + https://github.com/owncloud/core/issues/41824 + * Bugfix - Release the file handle when a bitmap preview cannot be decoded: [#41835](https://github.com/owncloud/core/pull/41835) Bitmap previews closed the file they had opened only when decoding succeeded, so @@ -261,6 +287,17 @@ ownCloud admins and users. https://github.com/owncloud/core/pull/41855 +* Bugfix - Restrict federated address book sync to the trusted server: [#41869](https://github.com/owncloud/core/pull/41869) + + The federated system address book sync could request resources that do not + belong to the trusted server it was syncing with, and could follow redirects + away from that server. + + Requests which would leave the trusted server are now refused, and resource + references which do not belong to it are skipped and logged. + + https://github.com/owncloud/core/pull/41869 + * Change - Update PHP dependencies: [#41775](https://github.com/owncloud/core/pull/41775) The following have been updated: @@ -10359,4 +10396,4 @@ ownCloud admins and users. [10.0.4]: https://github.com/owncloud/core/compare/v10.0.3...v10.0.4 [10.0.3]: https://github.com/owncloud/core/compare/v10.0.2...v10.0.3 [10.0.2]: https://github.com/owncloud/core/compare/v10.0.1...v10.0.2 -[10.0.1]: https://github.com/owncloud/core/compare/v10.0.0...v10.0.1 +[10.0.1]: https://github.com/owncloud/core/compare/v10.0.0...v10.0.1 \ No newline at end of file diff --git a/changelog/unreleased/41676 b/changelog/11.0.1_2026-09-25/41676 similarity index 100% rename from changelog/unreleased/41676 rename to changelog/11.0.1_2026-09-25/41676 diff --git a/changelog/unreleased/41779 b/changelog/11.0.1_2026-09-25/41779 similarity index 100% rename from changelog/unreleased/41779 rename to changelog/11.0.1_2026-09-25/41779 diff --git a/changelog/unreleased/41807 b/changelog/11.0.1_2026-09-25/41807 similarity index 100% rename from changelog/unreleased/41807 rename to changelog/11.0.1_2026-09-25/41807 diff --git a/changelog/unreleased/41808 b/changelog/11.0.1_2026-09-25/41808 similarity index 100% rename from changelog/unreleased/41808 rename to changelog/11.0.1_2026-09-25/41808 diff --git a/changelog/unreleased/41808-oracle-path-hash b/changelog/11.0.1_2026-09-25/41808-oracle-path-hash similarity index 100% rename from changelog/unreleased/41808-oracle-path-hash rename to changelog/11.0.1_2026-09-25/41808-oracle-path-hash diff --git a/changelog/unreleased/41818 b/changelog/11.0.1_2026-09-25/41818 similarity index 100% rename from changelog/unreleased/41818 rename to changelog/11.0.1_2026-09-25/41818 diff --git a/changelog/11.0.1_2026-09-25/41824 b/changelog/11.0.1_2026-09-25/41824 new file mode 100644 index 000000000000..5f44ec381443 --- /dev/null +++ b/changelog/11.0.1_2026-09-25/41824 @@ -0,0 +1,23 @@ +Bugfix: Ship only the app payload in the release tarballs + +The release bundles contained 13 bundled apps as the working tree they had been +built in, rather than as the app's release artifact. Each of those app +directories carried `.git/` (a shallow clone including its pack file), +`.github/`, `tests/`, `vendor-bin/` and `build/artifacts/`, the last holding a +second copy of the app's own tarball. That was 101.94 MB of the 441.8 MB +uncompressed complete tarball, in 16 shipped git repositories. + +Three things made it more than dead weight. `files_antivirus` shipped its +anti-virus acceptance data, so a ClamAV scan of the tarball, or of any image +built from it, reported `Eicar-Test-Signature FOUND` and could be rejected by an +anti-virus gate. The development files were covered by the app's +`appinfo/signature.json`, so an administrator could not delete them without +breaking `occ integrity:check-app`. And the shipped `.git/` carried the release +engineer's clone metadata, including their name and e-mail address. + +The affected app releases have been repackaged, and the release tooling now +refuses to build a bundle that contains a build working tree, so this cannot +recur unnoticed. The standard tarball was affected as well, through +`notifications`. + +https://github.com/owncloud/core/issues/41824 diff --git a/changelog/unreleased/41827 b/changelog/11.0.1_2026-09-25/41827 similarity index 100% rename from changelog/unreleased/41827 rename to changelog/11.0.1_2026-09-25/41827 diff --git a/changelog/unreleased/41834 b/changelog/11.0.1_2026-09-25/41834 similarity index 100% rename from changelog/unreleased/41834 rename to changelog/11.0.1_2026-09-25/41834 diff --git a/changelog/unreleased/41835 b/changelog/11.0.1_2026-09-25/41835 similarity index 100% rename from changelog/unreleased/41835 rename to changelog/11.0.1_2026-09-25/41835 diff --git a/changelog/unreleased/41855 b/changelog/11.0.1_2026-09-25/41855 similarity index 100% rename from changelog/unreleased/41855 rename to changelog/11.0.1_2026-09-25/41855 diff --git a/changelog/unreleased/41856 b/changelog/11.0.1_2026-09-25/41856 similarity index 100% rename from changelog/unreleased/41856 rename to changelog/11.0.1_2026-09-25/41856 diff --git a/changelog/unreleased/41869 b/changelog/11.0.1_2026-09-25/41869 similarity index 100% rename from changelog/unreleased/41869 rename to changelog/11.0.1_2026-09-25/41869 diff --git a/changelog/unreleased/PHPdependencies202608onward b/changelog/11.0.1_2026-09-25/PHPdependencies202608onward similarity index 100% rename from changelog/unreleased/PHPdependencies202608onward rename to changelog/11.0.1_2026-09-25/PHPdependencies202608onward diff --git a/changelog/unreleased/domsanitizer-tagged-version b/changelog/11.0.1_2026-09-25/domsanitizer-tagged-version similarity index 100% rename from changelog/unreleased/domsanitizer-tagged-version rename to changelog/11.0.1_2026-09-25/domsanitizer-tagged-version diff --git a/version.php b/version.php index 71d65700a4d7..969457ada284 100644 --- a/version.php +++ b/version.php @@ -25,10 +25,10 @@ // We only can count up. The 4. digit is only for the internal patch-level to trigger DB upgrades // between betas, final and RCs. This is _not_ the public version number. Reset minor/patch-level // when updating major/minor version number. -$OC_Version = [11, 0, 0, 0]; +$OC_Version = [11, 0, 1, 0]; // The human-readable string -$OC_VersionString = '11.0.0'; +$OC_VersionString = '11.0.1'; $OC_VersionCanBeUpgradedFrom = [[8, 2, 11],[9, 0, 9],[9, 1]]; From 2f3ad40c49fa0486c370e1060dc9499b57acbad3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Fri, 25 Sep 2026 11:37:15 +0200 Subject: [PATCH 2/2] fix: name every updated PHP dependency in the 11.0.1 changelog MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit composer/semver (3.4.4 to 3.5.0) and nikic/php-parser (v5.8.0 to v5.9.0) both moved since v11.0.0, both are direct entries in composer.json's require, and neither was named in the fragment. Diffing composer.lock at v11.0.0 against this branch gives 26 changed production packages; the fragment listed 24. Each was missed by the pass that bumped it: #41864 edited this fragment in the same commit that raised composer/semver, and #41829 did the same for nikic/php-parser. The list is not direct-only either — it already names transitive dependencies such as guzzlehttp/psr7 and symfony/mime — so both are omissions, not a scoping decision. An administrator reconciling the 11.0.1 notes against advisory ranges would read both as unchanged. The four remaining differences are require-dev only (myclabs/deep-copy, phpunit/phpunit, sebastian/exporter, sebastian/recursion-context) and stay out, matching the fragment's existing production-only scope; the tarball installs --no-dev. Also restores CHANGELOG.md's trailing newline. `ocrelease changelog` writes calens' stdout as captured by execa, which strips it; the last six "chore: update changelog" revisions of the file all end in one, and so does calens' own output, so the next regeneration would have put it back as a one-line no-op diff. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- CHANGELOG.md | 6 +++++- changelog/11.0.1_2026-09-25/PHPdependencies202608onward | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fd09ec8b9a7c..d7fdab835a2b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -302,6 +302,8 @@ ownCloud admins and users. The following have been updated: + * composer/semver (3.4.4 to 3.5.0) + * doctrine/lexer (3.0.1 to 3.0.2) * firebase/php-jwt (v7.1.0 to v7.2.0) @@ -322,6 +324,8 @@ ownCloud admins and users. * monolog/monolog (3.10.0 to 3.12.0) + * nikic/php-parser (v5.8.0 to v5.9.0) + * pear/archive_tar (1.6.0 to 1.6.1) * phpseclib/phpseclib (3.0.55 to 3.0.57) @@ -10396,4 +10400,4 @@ ownCloud admins and users. [10.0.4]: https://github.com/owncloud/core/compare/v10.0.3...v10.0.4 [10.0.3]: https://github.com/owncloud/core/compare/v10.0.2...v10.0.3 [10.0.2]: https://github.com/owncloud/core/compare/v10.0.1...v10.0.2 -[10.0.1]: https://github.com/owncloud/core/compare/v10.0.0...v10.0.1 \ No newline at end of file +[10.0.1]: https://github.com/owncloud/core/compare/v10.0.0...v10.0.1 diff --git a/changelog/11.0.1_2026-09-25/PHPdependencies202608onward b/changelog/11.0.1_2026-09-25/PHPdependencies202608onward index 7a4c35236010..bb8c5cee325c 100644 --- a/changelog/11.0.1_2026-09-25/PHPdependencies202608onward +++ b/changelog/11.0.1_2026-09-25/PHPdependencies202608onward @@ -2,6 +2,8 @@ Change: Update PHP dependencies The following have been updated: + * composer/semver (3.4.4 to 3.5.0) + * doctrine/lexer (3.0.1 to 3.0.2) * firebase/php-jwt (v7.1.0 to v7.2.0) @@ -22,6 +24,8 @@ The following have been updated: * monolog/monolog (3.10.0 to 3.12.0) + * nikic/php-parser (v5.8.0 to v5.9.0) + * pear/archive_tar (1.6.0 to 1.6.1) * phpseclib/phpseclib (3.0.55 to 3.0.57)