Skip to content

feat: release 11.0.1 #41867

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oc-tmueller merged 2 commits into from
Sep 25, 2026
Merged

feat: release 11.0.1 #41867

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
253e1f5
feat: release 11.0.1
oc-tmueller Sep 25, 2026
2f3ad40
fix: name every updated PHP dependency in the 11.0.1 changelog
oc-tmueller Sep 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 45 additions & 4 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Table of Contents

* [Changelog for unreleased](#changelog-for-owncloud-core-unreleased-unreleased)
* [Changelog for 11.0.1](#changelog-for-owncloud-core-1101-2026-09-25)
* [Changelog for 11.0.0](#changelog-for-owncloud-core-1100-2026-07-30)
* [Changelog for 10.16.4](#changelog-for-owncloud-core-10164-2026-07-29)
* [Changelog for 10.16.3](#changelog-for-owncloud-core-10163-2026-05-22)
Expand Down Expand Up @@ -31,12 +31,12 @@
* [Changelog for 10.4.1](#changelog-for-owncloud-core-1041-2020-03-30)
* [Changelog for 10.4.0](#changelog-for-owncloud-core-1040-2020-02-10)
* [Changelog for 10.3.2](#changelog-for-owncloud-core-1032-2019-12-04)
# Changelog for ownCloud Core [unreleased] (UNRELEASED)
# Changelog for ownCloud Core [11.0.1] (2026-09-25)

The following sections list the changes in ownCloud core unreleased relevant to
The following sections list the changes in ownCloud core 11.0.1 relevant to
ownCloud admins and users.

[unreleased]: https://github.com/owncloud/core/compare/v11.0.0...master
[11.0.1]: https://github.com/owncloud/core/compare/v11.0.0...v11.0.1

## Summary

Expand All @@ -48,8 +48,10 @@ ownCloud admins and users.
* Bugfix - Restore index usage for filecache writes on Oracle: [#41782](https://github.com/owncloud/core/issues/41782)
* Bugfix - Show federated users in the share dialog when local users also match: [#41807](https://github.com/owncloud/core/pull/41807)
* Bugfix - Avoid a deprecation notice when hashing the file cache path on Oracle: [#41808](https://github.com/owncloud/core/pull/41808)
* Bugfix - Ship only the app payload in the release tarballs: [#41824](https://github.com/owncloud/core/issues/41824)
* Bugfix - Release the file handle when a bitmap preview cannot be decoded: [#41835](https://github.com/owncloud/core/pull/41835)
* Bugfix - Show a media type icon when a preview file cannot be opened: [#41855](https://github.com/owncloud/core/pull/41855)
* Bugfix - Restrict federated address book sync to the trusted server: [#41869](https://github.com/owncloud/core/pull/41869)
* Change - Update PHP dependencies: [#41775](https://github.com/owncloud/core/pull/41775)
* Change - Require rhukster/dom-sanitizer as a tagged release: [#41785](https://github.com/owncloud/core/pull/41785)
* Change - Restore Oracle database support in the command line installer: [#41808](https://github.com/owncloud/core/pull/41808)
Expand Down Expand Up @@ -230,6 +232,30 @@ ownCloud admins and users.

https://github.com/owncloud/core/pull/41808

* Bugfix - Ship only the app payload in the release tarballs: [#41824](https://github.com/owncloud/core/issues/41824)

The release bundles contained 13 bundled apps as the working tree they had been
built in, rather than as the app's release artifact. Each of those app
directories carried `.git/` (a shallow clone including its pack file),
`.github/`, `tests/`, `vendor-bin/` and `build/artifacts/`, the last holding a
second copy of the app's own tarball. That was 101.94 MB of the 441.8 MB
uncompressed complete tarball, in 16 shipped git repositories.

Three things made it more than dead weight. `files_antivirus` shipped its
anti-virus acceptance data, so a ClamAV scan of the tarball, or of any image
built from it, reported `Eicar-Test-Signature FOUND` and could be rejected by an
anti-virus gate. The development files were covered by the app's
`appinfo/signature.json`, so an administrator could not delete them without
breaking `occ integrity:check-app`. And the shipped `.git/` carried the release
engineer's clone metadata, including their name and e-mail address.

The affected app releases have been repackaged, and the release tooling now
refuses to build a bundle that contains a build working tree, so this cannot
recur unnoticed. The standard tarball was affected as well, through
`notifications`.

https://github.com/owncloud/core/issues/41824

* Bugfix - Release the file handle when a bitmap preview cannot be decoded: [#41835](https://github.com/owncloud/core/pull/41835)

Bitmap previews closed the file they had opened only when decoding succeeded, so
Expand Down Expand Up @@ -261,10 +287,23 @@ ownCloud admins and users.

https://github.com/owncloud/core/pull/41855

* Bugfix - Restrict federated address book sync to the trusted server: [#41869](https://github.com/owncloud/core/pull/41869)

The federated system address book sync could request resources that do not
belong to the trusted server it was syncing with, and could follow redirects
away from that server.

Requests which would leave the trusted server are now refused, and resource
references which do not belong to it are skipped and logged.

https://github.com/owncloud/core/pull/41869

* Change - Update PHP dependencies: [#41775](https://github.com/owncloud/core/pull/41775)

The following have been updated:

* composer/semver (3.4.4 to 3.5.0)

* doctrine/lexer (3.0.1 to 3.0.2)

* firebase/php-jwt (v7.1.0 to v7.2.0)
Expand All @@ -285,6 +324,8 @@ ownCloud admins and users.

* monolog/monolog (3.10.0 to 3.12.0)

* nikic/php-parser (v5.8.0 to v5.9.0)

* pear/archive_tar (1.6.0 to 1.6.1)

* phpseclib/phpseclib (3.0.55 to 3.0.57)
Expand Down
0 changelog/unreleased/41676 → changelog/11.0.1_2026-09-25/41676
View file
Open in desktop
File renamed without changes.
0 changelog/unreleased/41779 → changelog/11.0.1_2026-09-25/41779
View file
Open in desktop
File renamed without changes.
0 changelog/unreleased/41807 → changelog/11.0.1_2026-09-25/41807
View file
Open in desktop
File renamed without changes.
0 changelog/unreleased/41808 → changelog/11.0.1_2026-09-25/41808
View file
Open in desktop
File renamed without changes.
0 changelog/unreleased/41808-oracle-path-hash → .../11.0.1_2026-09-25/41808-oracle-path-hash
View file
Open in desktop
File renamed without changes.
0 changelog/unreleased/41818 → changelog/11.0.1_2026-09-25/41818
View file
Open in desktop
File renamed without changes.
23 changes: 23 additions & 0 deletions changelog/11.0.1_2026-09-25/41824
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
Bugfix: Ship only the app payload in the release tarballs

The release bundles contained 13 bundled apps as the working tree they had been
built in, rather than as the app's release artifact. Each of those app
directories carried `.git/` (a shallow clone including its pack file),
`.github/`, `tests/`, `vendor-bin/` and `build/artifacts/`, the last holding a
second copy of the app's own tarball. That was 101.94 MB of the 441.8 MB
uncompressed complete tarball, in 16 shipped git repositories.

Three things made it more than dead weight. `files_antivirus` shipped its
anti-virus acceptance data, so a ClamAV scan of the tarball, or of any image
built from it, reported `Eicar-Test-Signature FOUND` and could be rejected by an
anti-virus gate. The development files were covered by the app's
`appinfo/signature.json`, so an administrator could not delete them without
breaking `occ integrity:check-app`. And the shipped `.git/` carried the release
engineer's clone metadata, including their name and e-mail address.

The affected app releases have been repackaged, and the release tooling now
refuses to build a bundle that contains a build working tree, so this cannot
recur unnoticed. The standard tarball was affected as well, through
`notifications`.

https://github.com/owncloud/core/issues/41824
0 changelog/unreleased/41827 → changelog/11.0.1_2026-09-25/41827
View file
Open in desktop
File renamed without changes.
0 changelog/unreleased/41834 → changelog/11.0.1_2026-09-25/41834
View file
Open in desktop
File renamed without changes.
0 changelog/unreleased/41835 → changelog/11.0.1_2026-09-25/41835
View file
Open in desktop
File renamed without changes.
0 changelog/unreleased/41855 → changelog/11.0.1_2026-09-25/41855
View file
Open in desktop
File renamed without changes.
0 changelog/unreleased/41856 → changelog/11.0.1_2026-09-25/41856
View file
Open in desktop
File renamed without changes.
0 changelog/unreleased/41869 → changelog/11.0.1_2026-09-25/41869
View file
Open in desktop
File renamed without changes.
4 changes: 4 additions & 0 deletions ...og/unreleased/PHPdependencies202608onward → ....1_2026-09-25/PHPdependencies202608onward
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ Change: Update PHP dependencies

The following have been updated:

* composer/semver (3.4.4 to 3.5.0)

* doctrine/lexer (3.0.1 to 3.0.2)

* firebase/php-jwt (v7.1.0 to v7.2.0)
Expand All @@ -22,6 +24,8 @@ The following have been updated:

* monolog/monolog (3.10.0 to 3.12.0)

* nikic/php-parser (v5.8.0 to v5.9.0)

@phil-davis phil-davis Sep 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am surprised that this is in the reuire section of composer.json
I thought that it was only used by phpunit, and related dependencies of that.
I see that it is also in require-dev of symfony/translation.
Anyway, it doesn't hurt to list it here.

@DeepDiver1975 DeepDiver1975 Sep 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We used it in the occ commands which check app code - if I remember correctly. I dropped them for 11... right?

@phil-davis phil-davis Sep 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That sounds correct. I didn't find any real uses of php-parser in our own code when I did a quick search.
We could probably move php-parser to require-dev, and then I suppose it would not get included in a production release bundle.


* pear/archive_tar (1.6.0 to 1.6.1)

* phpseclib/phpseclib (3.0.55 to 3.0.57)
Expand Down
0 ...og/unreleased/domsanitizer-tagged-version → ....1_2026-09-25/domsanitizer-tagged-version
View file
Open in desktop
File renamed without changes.
4 changes: 2 additions & 2 deletions version.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,10 @@
// We only can count up. The 4. digit is only for the internal patch-level to trigger DB upgrades
// between betas, final and RCs. This is _not_ the public version number. Reset minor/patch-level
// when updating major/minor version number.
$OC_Version = [11, 0, 0, 0];
$OC_Version = [11, 0, 1, 0];

// The human-readable string
$OC_VersionString = '11.0.0';
$OC_VersionString = '11.0.1';

$OC_VersionCanBeUpgradedFrom = [[8, 2, 11],[9, 0, 9],[9, 1]];

Expand Down
Loading