feat(server): update 11.0.0-rc2 to 11.0.0-rc3 image from GitHub release tarball - #675
Merged
Conversation
…se tarball Replace the pinned 11.0.0-rc2 tarball with the newly published 11.0.0-rc3 release: https://github.com/owncloud/core/releases/download/v11.0.0-rc3/owncloud-complete-20260729.tar.bz2 (sha256 b1edfba0a816abfb485b4fbbdfdfb96c5b7a3296fbfa1701e69eb49aa96e45e1) As with rc2 and 10.16.3, the dated "-complete-" bundle is pinned rather than the core-only or -qa asset. RC3 closes four security issues found during RC testing: #41578 plaintext federation auth token removed from the error log #41732 preview helper binary paths no longer trusted from the distributed cache (command injection) #41751 public share preview endpoint enforces the read permission #41752 backend-provided user homes confined to the data directory (RCE-class; new "user.home_base_dirs" config option) Bundle changes (owncloud/server-release specs/11.0.0-rc3-complete.yaml): external v1.5.1 -> v1.5.2 files_ldap_home v0.6.1 -> v0.6.2 firstrunwizard v1.4.1 -> v1.4.2 user_ldap v0.20.1 -> v0.20.3 notes v2.1.2 -> v2.2.0 migrate_to_ocis (new) -> v3.0.0 kerberos v1.1.1 -> removed The versioned .trivyignore directory is renamed to match and shrinks back to the single Windows-only entry: the five JS CVEs rc2 had to accept came from the bundled "notes" app vendoring old angular/prismjs/underscore, and notes v2.2.0 upgrades those libraries (underscore 1.13.8, angular 1.8.3, prism 1.30.0), resolving exactly those findings. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
phil-davis
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the
v24.04matrix entry from 11.0.0-rc2 to 11.0.0-rc3, releasedtoday at https://github.com/owncloud/core/releases/tag/v11.0.0-rc3.
Pinned asset
As with rc2 and 10.16.3, the dated
-complete-bundle is pinned rather than thecore-only (
owncloud-11.0.0-rc3.tar.bz2) or-qaasset.Security fixes in rc3
Four security issues found during RC testing are closed:
user.home_base_dirsconfig optionAlso carries six bugfixes (#41717
navigation icons, #41720
malformed-translation crash, #41723
avatar cropper, #41740 legacy ajax
routes) and documents PHP 8.3 as the new minimum —
owncloud/phpv24.04 alreadyships PHP 8.3, so no base-image work is needed.
Bundle changes
From
owncloud/server-releasespecs/11.0.0-rc2-complete.yaml→specs/11.0.0-rc3-complete.yaml:.trivyignoreshrinks backThe versioned directory is renamed
v24.04/11.0.0-rc2/→v24.04/11.0.0-rc3/and reduced to the single Windows-only entry.
The five JS CVEs rc2 had to accept (
CVE-2019-10768,CVE-2021-23341,CVE-2021-32723,CVE-2021-23358,CVE-2026-27601) existed only because thebundled
notesapp vendored old angular/prismjs/underscore.notesv2.2.0upgrades those libraries (underscore → 1.13.8, angular → 1.8.3, prism → 1.30.0),
explicitly to resolve those Trivy findings,
so the exclusions are no longer warranted.
If the scan turns up a finding the upgrade did not cover, only the specific
still-failing IDs should be re-added with a justification comment.
Docs
README.md(published verbatim as the Docker Hub description),CHANGELOG.mdand the two stale
agents.mdmentions are updated to11.0.0-rc3.🤖 Generated with Claude Code