From 37782cee829b83a2607735b4b81634431c78dfb2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Fri, 25 Sep 2026 10:01:01 +0200 Subject: [PATCH 1/3] feat: release 10.16.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump version.php to 10.16.5 and materialize the changelog fragments for this release. $OC_Version becomes [10, 16, 5, 0]: the 4th digit is the internal DB-upgrade patch level, not the public patch number, and nothing in this release needs it moved. The 11 fragments in changelog/unreleased/ move into changelog/10.16.5_2026-09-25/ (git mv, so the renames stay tracked) and CHANGELOG.md is regenerated with calens. unreleased/ keeps its .gitkeep and is now empty, ready for the next cycle. Security: - #41784 update PHP dependencies to close published advisories - #41803 prevent path traversal via appconfig public_/remote_ keys - #41827 reject SVG/script content before it reaches ImageMagick bitmap previews - #41834 pin the Imagick coder for each preview provider Bugfixes: - #41782 restore index usage for filecache writes on Oracle - #41808 avoid a deprecation notice when hashing the file cache path on Oracle - #41814 show federated users in the share dialog when local users also match - #41819 speed up Oracle schema introspection - #41835 release the file handle when a bitmap preview cannot be decoded - #41855 report a preview file that cannot be opened without logging noise Changes: - #41788 update PHP dependencies Same shape as 852062dd ("feat: release 10.16.4"), which did the changelog and the version bump in one commit. Once merged, v10.16.5 gets tagged on the merged commit and the release bundles are built and published from owncloud/server-release. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- CHANGELOG.md | 293 ++++++++++++++++++ .../{unreleased => 10.16.5_2026-09-25}/41783 | 0 .../{unreleased => 10.16.5_2026-09-25}/41803 | 0 .../{unreleased => 10.16.5_2026-09-25}/41814 | 0 .../41815-oracle-path-hash | 0 .../{unreleased => 10.16.5_2026-09-25}/41819 | 0 .../{unreleased => 10.16.5_2026-09-25}/41827 | 0 .../{unreleased => 10.16.5_2026-09-25}/41834 | 0 .../{unreleased => 10.16.5_2026-09-25}/41835 | 0 .../{unreleased => 10.16.5_2026-09-25}/41855 | 0 .../PHPdependencies20260821 | 0 .../PHPdependencies202608onward | 0 version.php | 4 +- 13 files changed, 295 insertions(+), 2 deletions(-) rename changelog/{unreleased => 10.16.5_2026-09-25}/41783 (100%) rename changelog/{unreleased => 10.16.5_2026-09-25}/41803 (100%) rename changelog/{unreleased => 10.16.5_2026-09-25}/41814 (100%) rename changelog/{unreleased => 10.16.5_2026-09-25}/41815-oracle-path-hash (100%) rename changelog/{unreleased => 10.16.5_2026-09-25}/41819 (100%) rename changelog/{unreleased => 10.16.5_2026-09-25}/41827 (100%) rename changelog/{unreleased => 10.16.5_2026-09-25}/41834 (100%) rename changelog/{unreleased => 10.16.5_2026-09-25}/41835 (100%) rename changelog/{unreleased => 10.16.5_2026-09-25}/41855 (100%) rename changelog/{unreleased => 10.16.5_2026-09-25}/PHPdependencies20260821 (100%) rename changelog/{unreleased => 10.16.5_2026-09-25}/PHPdependencies202608onward (100%) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9ab3f6a90709..78e68dd64364 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,6 @@ # Table of Contents +* [Changelog for 10.16.5](#changelog-for-owncloud-core-10165-2026-09-25) * [Changelog for 10.16.4](#changelog-for-owncloud-core-10164-2026-07-29) * [Changelog for 10.16.3](#changelog-for-owncloud-core-10163-2026-05-22) * [Changelog for 10.16.2](#changelog-for-owncloud-core-10162-2026-04-02) @@ -29,6 +30,298 @@ * [Changelog for 10.4.1](#changelog-for-owncloud-core-1041-2020-03-30) * [Changelog for 10.4.0](#changelog-for-owncloud-core-1040-2020-02-10) * [Changelog for 10.3.2](#changelog-for-owncloud-core-1032-2019-12-04) +# Changelog for ownCloud Core [10.16.5] (2026-09-25) + +The following sections list the changes in ownCloud core 10.16.5 relevant to +ownCloud admins and users. + +[10.16.5]: https://github.com/owncloud/core/compare/v10.16.4...v10.16.5 + +## Summary + +* Security - Update PHP dependencies to close published advisories: [#41784](https://github.com/owncloud/core/pull/41784) +* Security - Prevent path traversal via appconfig public_/remote_ keys: [#41803](https://github.com/owncloud/core/pull/41803) +* Security - Reject SVG/script content before it reaches ImageMagick bitmap previews: [#41827](https://github.com/owncloud/core/pull/41827) +* Security - Pin the Imagick coder for each preview provider: [#41834](https://github.com/owncloud/core/pull/41834) +* Bugfix - Restore index usage for filecache writes on Oracle: [#41782](https://github.com/owncloud/core/issues/41782) +* Bugfix - Avoid a deprecation notice when hashing the file cache path on Oracle: [#41808](https://github.com/owncloud/core/pull/41808) +* Bugfix - Show federated users in the share dialog when local users also match: [#41814](https://github.com/owncloud/core/pull/41814) +* Bugfix - Speed up Oracle schema introspection: [#41819](https://github.com/owncloud/core/pull/41819) +* Bugfix - Release the file handle when a bitmap preview cannot be decoded: [#41835](https://github.com/owncloud/core/pull/41835) +* Bugfix - Report a preview file that cannot be opened without logging noise: [#41855](https://github.com/owncloud/core/pull/41855) +* Change - Update PHP dependencies: [#41788](https://github.com/owncloud/core/pull/41788) + +## Details + +* Security - Update PHP dependencies to close published advisories: [#41784](https://github.com/owncloud/core/pull/41784) + + The 10.16 branch had not seen a dependency update since the 10.16.4 release, and + several bundled packages were carrying published advisories. They have been + updated to versions that are not affected: + + - guzzlehttp/guzzle (7.10.0 to 7.15.3) - guzzlehttp/promises (2.3.0 to 2.5.2) - + guzzlehttp/psr7 (2.8.0 to 2.13.0) - phpseclib/phpseclib (3.0.52 to 3.0.56) - + rhukster/dom-sanitizer (dev-main to 1.0.14) - symfony/polyfill-php80 (v1.33.0 to + v1.37.0) - symfony/routing (v5.4.52 to v5.4.53) + + This closes sixteen advisories: CVE-2026-69246, CVE-2026-69245, CVE-2026-67354, + CVE-2026-67355, CVE-2026-67353, CVE-2026-67339, CVE-2026-59883, CVE-2026-55767 + and CVE-2026-55568 in guzzlehttp/guzzle; CVE-2026-59882, CVE-2026-55766, + CVE-2026-48998 and CVE-2026-49214 in guzzlehttp/psr7; CVE-2026-55599 in + phpseclib/phpseclib; CVE-2026-48784 in symfony/routing; and CVE-2026-40301 in + rhukster/dom-sanitizer. + + Rhukster/dom-sanitizer was required as "dev-main", an unversioned branch pin. + Such a pin carries no version number, so vulnerability scanners cannot match it + against advisory ranges and silently report nothing for the package. It is now + required as a tagged release, which both applies the CVE-2026-40301 fix and + makes the dependency visible to scanners. + + Firebase/php-jwt remains at 6.10.0 and is still affected by CVE-2025-45769 (low, + weak encryption). The advisory is only fixed in 7.0.0, and every 7.x release + requires PHP 8.0 or later, so it cannot be applied to the 10.16 line, which + supports PHP 7.4. + + https://github.com/owncloud/core/pull/41784 + +* Security - Prevent path traversal via appconfig public_/remote_ keys: [#41803](https://github.com/owncloud/core/pull/41803) + + We've fixed a path traversal in the appconfig `public_`/`remote_` service + handlers. An authenticated admin could set such a key on the `core` app to a + traversal value which was later included by `public.php`, leading to remote code + execution. An included handler must now resolve to a PHP file inside the app's + own directory, and the app-id guard can no longer be bypassed by mangled + spellings such as a trailing space. + + Note for integrators: the appconfig endpoints now refuse to *read* a `core` + `public_`/`remote_` key as well as to write one. `getValue`/`hasKey` on the + legacy `core/ajax/appconfig` endpoint had no such guard at all and returned the + stored handler path; `GET /settings/appconfig/core/...` refused the exact + lowercase prefix already, and now refuses a mangled spelling of it too + (`PUBLIC_webdav`, app id `CORE` or `core `), as well as any key on `core` + outside `[a-zA-Z0-9_.-]{1,64}`. Scripts which need a handler path should read it + with `occ config:app:get`. + + Requesting a service which is not registered now answers 404 on both + `public.php` and `remote.php`. `public.php` previously reported a logged 500, + and `remote.php` sent a malformed status line; its refusals now answer 503, + which is the status a WebDAV client already saw for them. + + https://github.com/owncloud/core/pull/41803 + +* Security - Reject SVG/script content before it reaches ImageMagick bitmap previews: [#41827](https://github.com/owncloud/core/pull/41827) + + Bitmap previews (PDF, Font, ...) sanitized SVG content before decoding it, but + fell back to the original, unsanitized bytes whenever the sanitizer could not + parse the input - which happened for any malformed SVG or non-XML payload, not + only for genuinely broken SVG files. A crafted malformed SVG or a raw MVG script + could therefore reach ImageMagick unsanitized and trigger an MSL script that + reads or writes arbitrary files as the web server user. + + Bitmap previews no longer attempt to sanitize and fall back; they now reject any + content that is detected as text, XML, SVG, or MVG before ImageMagick ever sees + it, and decode through the same hardened Imagick options already used by the + dedicated SVG preview provider. + + Media type detection from file content now always reports a media type. It + previously passed an unusable value on to its caller when the magic database + behind it could not be loaded, which left the new check above with nothing to + test the content against - so the content that check exists to reject was + admitted instead. + + Previews that read a file also no longer pass it to ImageMagick before the + hardened Imagick options are applied. + + https://github.com/owncloud/core/pull/41827 + https://github.com/owncloud/core/pull/41863 + +* Security - Pin the Imagick coder for each preview provider: [#41834](https://github.com/owncloud/core/pull/41834) + + Bitmap and SVG previews decoded content with no format hint, so ImageMagick's + own content-sniffing - independent of the mime-type check that decides whether a + preview is attempted at all - could pick a different coder than the one a + provider actually serves. PostScript-looking content, which the mime check must + allow through for the PDF and Postscript providers, could therefore still reach + the Ghostscript delegate through any other bitmap provider (SGI, Font, + Illustrator, Photoshop, TIFF, Heic). + + Each provider now pins the exact Imagick coder it expects instead of letting + ImageMagick guess from the file's content. The pin is applied in memory and + introduces no temporary file of its own. + + Because media types are derived from the file name extension, a file whose + extension does not match its actual content no longer gets a preview: a JPEG + saved as photo.tif is routed to the TIFF provider, pinned to the TIFF coder, and + falls back to a media type icon where content sniffing previously rendered it. + This is the intended trade-off - content sniffing is what allowed a preview + provider to be steered to an unrelated coder in the first place. + + The affected extensions are ai, bw, eps, heic, heif, int, inta, pdf, ps, psd, + rgb, rgba, sgi, tif and tiff. Of those providers only SGI and Heic are + registered by default, so on a stock install this is visible for bw, int, inta, + rgb, rgba, sgi, heic and heif; the rest need their provider enabled in + enabledPreviewProviders. + + The font extensions otf, pfb and ttf change differently: the font coder accepts + any bytes, so a mismatched file still produces a thumbnail, just one drawn by + the font coder rather than reflecting the file's real content. Real .otf files + gain previews they did not have before, because an unpinned read had no decode + delegate for them at all. + + Office documents and SVG are pinned too but are not affected. For Office the pin + covers the PDF LibreOffice has just produced rather than anything the user + uploaded, and for SVG content that is not parseable XML never reached a coder + before this change either. + + One route is deliberately left open, and is worth stating so the expectation is + set: which provider handles a preview can be steered by the request, so asking + for a file to be previewed as a PDF hands that file's bytes to the PDF coder + whatever they are. This is not a change - content sniffing reached the same + coder before - and the PDF, PostScript and EPS coders are the ones a + distribution's ImageMagick policy denies by default. Deployments that enable + those coders should keep that policy as the control, because it applies + process-wide rather than per provider. + + https://github.com/owncloud/core/pull/41834 + https://github.com/owncloud/core/pull/41863 + +* Bugfix - Restore index usage for filecache writes on Oracle: [#41782](https://github.com/owncloud/core/issues/41782) + + On Oracle every compare column of an upsert was wrapped in to_char(). That cast + is only needed for text and binary columns, which Oracle cannot compare + directly, but it was applied to all of them - and to_char(column) cannot use an + index on that column. Writes to the file cache compare storage and path_hash, so + uploads, renames and file scans could no longer use the unique index + fs_storage_path_hash and became very slow on large installations. + + Only text and binary compare columns are cast now, so every other comparison + uses its index again. + + https://github.com/owncloud/core/issues/41782 + https://github.com/owncloud/core/pull/41783 + +* Bugfix - Avoid a deprecation notice when hashing the file cache path on Oracle: [#41808](https://github.com/owncloud/core/pull/41808) + + Oracle cannot store empty strings, so the file cache converts them to null + before writing a row. For the storage root, whose path is the empty string, that + left md5() being called with null. PHP 8 reports that as a deprecated implicit + null to string conversion: noise in the log whenever a storage root is inserted, + and an error under PHPUnit's strict error handling. The stored path_hash itself + was never wrong, because md5(null) coerces to md5(''). + + The value is now cast to a string before hashing. + + https://github.com/owncloud/core/pull/41808 + https://github.com/owncloud/core/pull/41815 + +* Bugfix - Show federated users in the share dialog when local users also match: [#41814](https://github.com/owncloud/core/pull/41814) + + The share dialog only offered federated users when the search returned no local + users and no local groups, so a single local match hid every federated result - + including exact federated cloud id matches. Searching for a surname stem shared + by local accounts therefore made federated users unreachable unless the full + cloud id was typed. + + The suggestion that made this filtering necessary is generated by the server: a + search term containing an "@" was always offered as a federated cloud id, even + when it was the email address of an existing local account. That guess is now + skipped whenever the search matched a local user or group exactly, so the share + dialog no longer needs to discard genuine federated results. + + https://github.com/owncloud/enterprise/issues/4392 + https://github.com/owncloud/core/pull/41814 + +* Bugfix - Speed up Oracle schema introspection: [#41819](https://github.com/owncloud/core/pull/41819) + + Installing and upgrading ownCloud on Oracle took an unreasonably long time. A + fresh `occ maintenance:install` on the 10.16 branch needed over 40 minutes, + while the same install on the master branch finished in well under a minute. + + The cause was the bundled doctrine/dbal 2.13, which introspects a schema by + describing every table on its own: for each table it issues one query for the + columns, one for the indexes, one for the foreign keys and one for the table + comment. Each of those queries inlines the table name as a literal, so Oracle + cannot share cursors between them and hard parses every single one, which costs + a few hundred milliseconds each. The migration code then asks for the full + schema once per applied migration, so the number of queries grows with the + number of tables multiplied by the number of migrations. With 68 migrations and + roughly 48 tables that added up to thousands of hard parsed queries. + + Oracle schema introspection now reads the whole data dictionary with a fixed + number of queries instead of four per table. Reading a 48 table schema went down + from 194 queries to 6, and `occ maintenance:install` against Oracle on PHP 7.4 + went down from 43 minutes to 30 seconds. The resulting schema is unchanged; it + is compared against the previous implementation in the test suite. + + Doctrine/dbal does the same thing natively from version 3.4 onwards, which is + why the master branch was never affected. Upgrading doctrine/dbal on the 10.16 + branch is not an option, because its 3.x line changes public API that + third-party apps use. + + https://github.com/owncloud/core/pull/41819 + +* Bugfix - Release the file handle when a bitmap preview cannot be decoded: [#41835](https://github.com/owncloud/core/pull/41835) + + Bitmap previews closed the file they had opened only when decoding succeeded, so + every file that could not be decoded leaked a file handle for the lifetime of + the process. Generating previews for a directory of files that ImageMagick has + no decoder for could therefore exhaust the available file handles. + + A file that cannot be opened at all is now reported as having no preview right + away, instead of travelling on until ImageMagick rejects the empty content and + an unrelated warning plus a misleading decoder error have been logged. + + https://github.com/owncloud/core/pull/41835 + +* Bugfix - Report a preview file that cannot be opened without logging noise: [#41855](https://github.com/owncloud/core/pull/41855) + + Generating an SVG preview read the file without checking that it had been + opened. A file the storage could not open, or one whose name the filesystem + rejects, still fell back to a media type icon, but only after warning about the + read and then logging ImageMagick's complaint about content it had never + received. The bitmap providers shared that gap for one of the two values an + unsuccessful open can return. + + Generating an SVG preview for a file that opened but then failed to be read - an + encrypted file with a missing or damaged key, for instance - already fell back + to the icon, but held the file handle and its lock until the request ended. The + bitmap providers were not affected by this one. + + Both providers now check the handle before reading, so such a file gets the + media type icon with nothing logged that points at the wrong cause, and the SVG + provider releases the handle whether or not the read succeeds. + + https://github.com/owncloud/core/pull/41855 + https://github.com/owncloud/core/pull/41863 + +* Change - Update PHP dependencies: [#41788](https://github.com/owncloud/core/pull/41788) + + The following have been updated: + + * deepdiver/zipstreamer (2.0.3 to 3.0.1) + + * guzzlehttp/guzzle (7.15.3 to 7.15.5) + + * guzzlehttp/promises (2.5.2 to 2.5.3) + + * guzzlehttp/psr7 (2.13.0 to 2.13.1) + + * monolog/monolog (2.11.0 to 2.11.1) + + * pear/archive_tar (1.6.0 to 1.6.1) + + * phpseclib/phpseclib (3.0.56 to 3.0.57) + + * punic/punic (3.8.1 to 3.8.2) + + * rhukster/dom-sanitizer (1.0.14 to 1.0.17) + + https://github.com/owncloud/core/pull/41788 + https://github.com/owncloud/core/pull/41793 + https://github.com/owncloud/core/pull/41810 + https://github.com/owncloud/core/pull/41830 + https://github.com/owncloud/core/pull/41843 + # Changelog for ownCloud Core [10.16.4] (2026-07-29) The following sections list the changes in ownCloud core 10.16.4 relevant to diff --git a/changelog/unreleased/41783 b/changelog/10.16.5_2026-09-25/41783 similarity index 100% rename from changelog/unreleased/41783 rename to changelog/10.16.5_2026-09-25/41783 diff --git a/changelog/unreleased/41803 b/changelog/10.16.5_2026-09-25/41803 similarity index 100% rename from changelog/unreleased/41803 rename to changelog/10.16.5_2026-09-25/41803 diff --git a/changelog/unreleased/41814 b/changelog/10.16.5_2026-09-25/41814 similarity index 100% rename from changelog/unreleased/41814 rename to changelog/10.16.5_2026-09-25/41814 diff --git a/changelog/unreleased/41815-oracle-path-hash b/changelog/10.16.5_2026-09-25/41815-oracle-path-hash similarity index 100% rename from changelog/unreleased/41815-oracle-path-hash rename to changelog/10.16.5_2026-09-25/41815-oracle-path-hash diff --git a/changelog/unreleased/41819 b/changelog/10.16.5_2026-09-25/41819 similarity index 100% rename from changelog/unreleased/41819 rename to changelog/10.16.5_2026-09-25/41819 diff --git a/changelog/unreleased/41827 b/changelog/10.16.5_2026-09-25/41827 similarity index 100% rename from changelog/unreleased/41827 rename to changelog/10.16.5_2026-09-25/41827 diff --git a/changelog/unreleased/41834 b/changelog/10.16.5_2026-09-25/41834 similarity index 100% rename from changelog/unreleased/41834 rename to changelog/10.16.5_2026-09-25/41834 diff --git a/changelog/unreleased/41835 b/changelog/10.16.5_2026-09-25/41835 similarity index 100% rename from changelog/unreleased/41835 rename to changelog/10.16.5_2026-09-25/41835 diff --git a/changelog/unreleased/41855 b/changelog/10.16.5_2026-09-25/41855 similarity index 100% rename from changelog/unreleased/41855 rename to changelog/10.16.5_2026-09-25/41855 diff --git a/changelog/unreleased/PHPdependencies20260821 b/changelog/10.16.5_2026-09-25/PHPdependencies20260821 similarity index 100% rename from changelog/unreleased/PHPdependencies20260821 rename to changelog/10.16.5_2026-09-25/PHPdependencies20260821 diff --git a/changelog/unreleased/PHPdependencies202608onward b/changelog/10.16.5_2026-09-25/PHPdependencies202608onward similarity index 100% rename from changelog/unreleased/PHPdependencies202608onward rename to changelog/10.16.5_2026-09-25/PHPdependencies202608onward diff --git a/version.php b/version.php index 6529b6b8fb19..1d47854a2ca3 100644 --- a/version.php +++ b/version.php @@ -25,10 +25,10 @@ // We only can count up. The 4. digit is only for the internal patch-level to trigger DB upgrades // between betas, final and RCs. This is _not_ the public version number. Reset minor/patch-level // when updating major/minor version number. -$OC_Version = [10, 16, 4, 0]; +$OC_Version = [10, 16, 5, 0]; // The human-readable string -$OC_VersionString = '10.16.4'; +$OC_VersionString = '10.16.5'; $OC_VersionCanBeUpgradedFrom = [[8, 2, 11],[9, 0, 9],[9, 1]]; From f91a51343dc000ca25253d4f728c2ec8660d5635 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Fri, 25 Sep 2026 10:23:10 +0200 Subject: [PATCH 2/3] fix: correct three defects in the 10.16.5 release notes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found reviewing the release commit, all three in text that ships inside the tarball, so this is the last point at which they are free to fix. **Six updated dependencies were unnamed.** Diffing composer.lock at v10.16.4 against this branch gives 17 changed production packages; the entry listed 11. Missing: sabre/dav (4.7.0 to 4.7.1), sabre/event (5.1.7 to 5.1.9), sabre/vobject (4.5.8 to 4.6.1), pimple/pimple (v3.6.1 to v3.6.2), nikic/php-parser (v5.7.0 to v5.9.0) and dg/composer-cleaner (v2.2.1 to v2.2.2). All but sabre/event are direct entries in composer.json's require, and sabre/vobject is a minor bump of the vCard/iCalendar parser behind CalDAV and CardDAV — an administrator auditing what moved in that stack for 10.16.5 would have seen nothing. Five of the six came from #41787, whose URL was missing from the entry as well; nikic/php-parser then went on to v5.9.0 in #41830, which was already listed. Earlier releases on this branch do list sabre bumps here (10.10.0, 10.11.0, 10.12.0), so the omission also broke the house convention. **Two entries linked a pull request that never reached this branch.** #41819 was merged into ci/oracle-db-in-github-actions-10.16, an intermediate branch that no longer exists on the remote; the change reached 10.16 through #41815 (940873659b). Likewise the 41835 entry cited only master's #41835, while the 10.16 delivery was #41837 (6443822a65). Both now cite the 10.16 pull request first, matching what 41827, 41834 and 41855 already do with #41863 — so calens also makes the branch's own pull request the primary link. CHANGELOG.md is regenerated with calens and, as on the rest of this branch, written without a trailing newline: `ocrelease changelog` captures calens' stdout through execa, which strips it, and every released section on 10.16 was produced that way. Adding one here would only create churn at the next release. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- CHANGELOG.md | 23 +++++++++++++++---- changelog/10.16.5_2026-09-25/41819 | 1 + changelog/10.16.5_2026-09-25/41835 | 1 + .../PHPdependencies202608onward | 13 +++++++++++ 4 files changed, 34 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 78e68dd64364..f827f5c0e519 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -46,10 +46,10 @@ ownCloud admins and users. * Bugfix - Restore index usage for filecache writes on Oracle: [#41782](https://github.com/owncloud/core/issues/41782) * Bugfix - Avoid a deprecation notice when hashing the file cache path on Oracle: [#41808](https://github.com/owncloud/core/pull/41808) * Bugfix - Show federated users in the share dialog when local users also match: [#41814](https://github.com/owncloud/core/pull/41814) -* Bugfix - Speed up Oracle schema introspection: [#41819](https://github.com/owncloud/core/pull/41819) +* Bugfix - Speed up Oracle schema introspection: [#41815](https://github.com/owncloud/core/pull/41815) * Bugfix - Release the file handle when a bitmap preview cannot be decoded: [#41835](https://github.com/owncloud/core/pull/41835) * Bugfix - Report a preview file that cannot be opened without logging noise: [#41855](https://github.com/owncloud/core/pull/41855) -* Change - Update PHP dependencies: [#41788](https://github.com/owncloud/core/pull/41788) +* Change - Update PHP dependencies: [#41787](https://github.com/owncloud/core/pull/41787) ## Details @@ -231,7 +231,7 @@ ownCloud admins and users. https://github.com/owncloud/enterprise/issues/4392 https://github.com/owncloud/core/pull/41814 -* Bugfix - Speed up Oracle schema introspection: [#41819](https://github.com/owncloud/core/pull/41819) +* Bugfix - Speed up Oracle schema introspection: [#41815](https://github.com/owncloud/core/pull/41815) Installing and upgrading ownCloud on Oracle took an unreasonably long time. A fresh `occ maintenance:install` on the 10.16 branch needed over 40 minutes, @@ -258,6 +258,7 @@ ownCloud admins and users. branch is not an option, because its 3.x line changes public API that third-party apps use. + https://github.com/owncloud/core/pull/41815 https://github.com/owncloud/core/pull/41819 * Bugfix - Release the file handle when a bitmap preview cannot be decoded: [#41835](https://github.com/owncloud/core/pull/41835) @@ -272,6 +273,7 @@ ownCloud admins and users. an unrelated warning plus a misleading decoder error have been logged. https://github.com/owncloud/core/pull/41835 + https://github.com/owncloud/core/pull/41837 * Bugfix - Report a preview file that cannot be opened without logging noise: [#41855](https://github.com/owncloud/core/pull/41855) @@ -294,12 +296,14 @@ ownCloud admins and users. https://github.com/owncloud/core/pull/41855 https://github.com/owncloud/core/pull/41863 -* Change - Update PHP dependencies: [#41788](https://github.com/owncloud/core/pull/41788) +* Change - Update PHP dependencies: [#41787](https://github.com/owncloud/core/pull/41787) The following have been updated: * deepdiver/zipstreamer (2.0.3 to 3.0.1) + * dg/composer-cleaner (v2.2.1 to v2.2.2) + * guzzlehttp/guzzle (7.15.3 to 7.15.5) * guzzlehttp/promises (2.5.2 to 2.5.3) @@ -308,14 +312,25 @@ ownCloud admins and users. * monolog/monolog (2.11.0 to 2.11.1) + * nikic/php-parser (v5.7.0 to v5.9.0) + * pear/archive_tar (1.6.0 to 1.6.1) * phpseclib/phpseclib (3.0.56 to 3.0.57) + * pimple/pimple (v3.6.1 to v3.6.2) + * punic/punic (3.8.1 to 3.8.2) * rhukster/dom-sanitizer (1.0.14 to 1.0.17) + * sabre/dav (4.7.0 to 4.7.1) + + * sabre/event (5.1.7 to 5.1.9) + + * sabre/vobject (4.5.8 to 4.6.1) + + https://github.com/owncloud/core/pull/41787 https://github.com/owncloud/core/pull/41788 https://github.com/owncloud/core/pull/41793 https://github.com/owncloud/core/pull/41810 diff --git a/changelog/10.16.5_2026-09-25/41819 b/changelog/10.16.5_2026-09-25/41819 index a5bb06b8fc0e..5f93f0884a3d 100644 --- a/changelog/10.16.5_2026-09-25/41819 +++ b/changelog/10.16.5_2026-09-25/41819 @@ -27,4 +27,5 @@ why the master branch was never affected. Upgrading doctrine/dbal on the 10.16 branch is not an option, because its 3.x line changes public API that third-party apps use. +https://github.com/owncloud/core/pull/41815 https://github.com/owncloud/core/pull/41819 diff --git a/changelog/10.16.5_2026-09-25/41835 b/changelog/10.16.5_2026-09-25/41835 index c98de24f308c..89df4c92fdb5 100644 --- a/changelog/10.16.5_2026-09-25/41835 +++ b/changelog/10.16.5_2026-09-25/41835 @@ -10,3 +10,4 @@ away, instead of travelling on until ImageMagick rejects the empty content and a unrelated warning plus a misleading decoder error have been logged. https://github.com/owncloud/core/pull/41835 +https://github.com/owncloud/core/pull/41837 diff --git a/changelog/10.16.5_2026-09-25/PHPdependencies202608onward b/changelog/10.16.5_2026-09-25/PHPdependencies202608onward index c77230d0aacd..a493ed158910 100644 --- a/changelog/10.16.5_2026-09-25/PHPdependencies202608onward +++ b/changelog/10.16.5_2026-09-25/PHPdependencies202608onward @@ -4,6 +4,8 @@ The following have been updated: * deepdiver/zipstreamer (2.0.3 to 3.0.1) + * dg/composer-cleaner (v2.2.1 to v2.2.2) + * guzzlehttp/guzzle (7.15.3 to 7.15.5) * guzzlehttp/promises (2.5.2 to 2.5.3) @@ -12,14 +14,25 @@ The following have been updated: * monolog/monolog (2.11.0 to 2.11.1) + * nikic/php-parser (v5.7.0 to v5.9.0) + * pear/archive_tar (1.6.0 to 1.6.1) * phpseclib/phpseclib (3.0.56 to 3.0.57) + * pimple/pimple (v3.6.1 to v3.6.2) + * punic/punic (3.8.1 to 3.8.2) * rhukster/dom-sanitizer (1.0.14 to 1.0.17) + * sabre/dav (4.7.0 to 4.7.1) + + * sabre/event (5.1.7 to 5.1.9) + + * sabre/vobject (4.5.8 to 4.6.1) + +https://github.com/owncloud/core/pull/41787 https://github.com/owncloud/core/pull/41788 https://github.com/owncloud/core/pull/41793 https://github.com/owncloud/core/pull/41810 From 5702ed419100c0b1c8722177eb4f2be536e0b58b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Fri, 25 Sep 2026 12:05:46 +0200 Subject: [PATCH 3/3] chore: fold the federated address book sync fix into the 10.16.5 release notes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Its fix merged into 10.16 after the release notes were first prepared, so its changelog fragment was still sitting in changelog/unreleased and would have been deferred to the next release while the fix itself shipped in this one. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- CHANGELOG.md | 13 +++++++++++++ changelog/{unreleased => 10.16.5_2026-09-25}/41869 | 0 2 files changed, 13 insertions(+) rename changelog/{unreleased => 10.16.5_2026-09-25}/41869 (100%) diff --git a/CHANGELOG.md b/CHANGELOG.md index f827f5c0e519..6a071edbfb4a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -49,6 +49,7 @@ ownCloud admins and users. * Bugfix - Speed up Oracle schema introspection: [#41815](https://github.com/owncloud/core/pull/41815) * Bugfix - Release the file handle when a bitmap preview cannot be decoded: [#41835](https://github.com/owncloud/core/pull/41835) * Bugfix - Report a preview file that cannot be opened without logging noise: [#41855](https://github.com/owncloud/core/pull/41855) +* Bugfix - Restrict federated address book sync to the trusted server: [#41869](https://github.com/owncloud/core/pull/41869) * Change - Update PHP dependencies: [#41787](https://github.com/owncloud/core/pull/41787) ## Details @@ -296,6 +297,18 @@ ownCloud admins and users. https://github.com/owncloud/core/pull/41855 https://github.com/owncloud/core/pull/41863 +* Bugfix - Restrict federated address book sync to the trusted server: [#41869](https://github.com/owncloud/core/pull/41869) + + The federated system address book sync could request resources that do not + belong to the trusted server it was syncing with, and could follow redirects + away from that server. + + Requests which would leave the trusted server are now refused, and resource + references which do not belong to it are skipped and logged. + + https://github.com/owncloud/core/pull/41869 + https://github.com/owncloud/core/pull/41870 + * Change - Update PHP dependencies: [#41787](https://github.com/owncloud/core/pull/41787) The following have been updated: diff --git a/changelog/unreleased/41869 b/changelog/10.16.5_2026-09-25/41869 similarity index 100% rename from changelog/unreleased/41869 rename to changelog/10.16.5_2026-09-25/41869