From 0a26bf6d6d9c0d1eac2793d7990c669aef3c4b8d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Wed, 29 Jul 2026 10:09:20 +0200 Subject: [PATCH] feat(server): update 11.0.0-rc2 to 11.0.0-rc3 image from GitHub release tarball MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the pinned 11.0.0-rc2 tarball with the newly published 11.0.0-rc3 release: https://github.com/owncloud/core/releases/download/v11.0.0-rc3/owncloud-complete-20260729.tar.bz2 (sha256 b1edfba0a816abfb485b4fbbdfdfb96c5b7a3296fbfa1701e69eb49aa96e45e1) As with rc2 and 10.16.3, the dated "-complete-" bundle is pinned rather than the core-only or -qa asset. RC3 closes four security issues found during RC testing: #41578 plaintext federation auth token removed from the error log #41732 preview helper binary paths no longer trusted from the distributed cache (command injection) #41751 public share preview endpoint enforces the read permission #41752 backend-provided user homes confined to the data directory (RCE-class; new "user.home_base_dirs" config option) Bundle changes (owncloud/server-release specs/11.0.0-rc3-complete.yaml): external v1.5.1 -> v1.5.2 files_ldap_home v0.6.1 -> v0.6.2 firstrunwizard v1.4.1 -> v1.4.2 user_ldap v0.20.1 -> v0.20.3 notes v2.1.2 -> v2.2.0 migrate_to_ocis (new) -> v3.0.0 kerberos v1.1.1 -> removed The versioned .trivyignore directory is renamed to match and shrinks back to the single Windows-only entry: the five JS CVEs rc2 had to accept came from the bundled "notes" app vendoring old angular/prismjs/underscore, and notes v2.2.0 upgrades those libraries (underscore 1.13.8, angular 1.8.3, prism 1.30.0), resolving exactly those findings. Co-Authored-By: Claude Opus 5 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .github/workflows/main.yml | 6 +++--- CHANGELOG.md | 5 +++++ README.md | 2 +- agents.md | 4 ++-- v24.04/11.0.0-rc2/.trivyignore | 13 ------------- v24.04/11.0.0-rc3/.trivyignore | 2 ++ 6 files changed, 13 insertions(+), 19 deletions(-) delete mode 100644 v24.04/11.0.0-rc2/.trivyignore create mode 100644 v24.04/11.0.0-rc3/.trivyignore diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 0e11922e..4f6bae4d 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -49,10 +49,10 @@ jobs: 10 latest smoke-version-jq: ".versionstring" - - version: 11.0.0-rc2 - tarball: https://github.com/owncloud/core/releases/download/v11.0.0-rc2/owncloud-complete-20260723.tar.bz2 + - version: 11.0.0-rc3 + tarball: https://github.com/owncloud/core/releases/download/v11.0.0-rc3/owncloud-complete-20260729.tar.bz2 base: v24.04 - trivy-ignore: v24.04/11.0.0-rc2/.trivyignore + trivy-ignore: v24.04/11.0.0-rc3/.trivyignore smoke-version-jq: "" update-docker-hub-description: diff --git a/CHANGELOG.md b/CHANGELOG.md index 7c642afe..26c6ca4d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## 2026-07-29 + +* Changed + * Update 11.0.0-rc2 to 11.0.0-rc3 built from the GitHub release tarball + ## 2026-07-23 * Changed diff --git a/README.md b/README.md index 27462fa7..816bf431 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,7 @@ ownCloud is an open-source file sync, share and content collaboration software t ## Docker Tags and respective Dockerfile links - [`10.16.3`, `10.16`, `10`, `latest`](https://github.com/owncloud-docker/server/blob/master/v22.04/Dockerfile.multiarch) available as `owncloud/server:10.16.3` -- [`11.0.0-rc2`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.0.0-rc2` +- [`11.0.0-rc3`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.0.0-rc3` ## Default volumes diff --git a/agents.md b/agents.md index bf0752ee..ee4bbe3b 100644 --- a/agents.md +++ b/agents.md @@ -20,7 +20,7 @@ GitHub Actions. - `v22.04/Dockerfile.multiarch` — image definition (`FROM owncloud/base:22.04`) - `v22.04/overlay/` — files copied into the image root (`ADD overlay /`); currently empty - `v22.04//.trivyignore` — accepted-CVE exclusions for the Trivy scan -- `v24.04/` — Ubuntu 24.04 based image (ownCloud 11.0.0-rc2) +- `v24.04/` — Ubuntu 24.04 based image (ownCloud 11.0.0-rc3) - `v24.04/Dockerfile.multiarch`, `v24.04/overlay/`, `v24.04//.trivyignore` — as above - `docs/` — design/spec notes - `images/` — README screenshots @@ -39,7 +39,7 @@ There is no local application build (no Node/pnpm/Make toolchain). The image is built by `.github/workflows/main.yml`, which calls reusable workflows from [`owncloud-docker/ubuntu`](https://github.com/owncloud-docker/ubuntu): -- Matrix builds two releases: `10.16.3` (base `v22.04`) and `11.0.0-rc2` +- Matrix builds two releases: `10.16.3` (base `v22.04`) and `11.0.0-rc3` (base `v24.04`), each via `/Dockerfile.multiarch`. - The ownCloud version is injected with the `TARBALL_URL` build arg — there is no version pinned inside the Dockerfile. diff --git a/v24.04/11.0.0-rc2/.trivyignore b/v24.04/11.0.0-rc2/.trivyignore deleted file mode 100644 index eeed8ba6..00000000 --- a/v24.04/11.0.0-rc2/.trivyignore +++ /dev/null @@ -1,13 +0,0 @@ -# vulnerability is affecting windows only -CVE-2024-51736 - -# client-side JS libs vendored by the bundled "notes" marketplace app; frontend -# only (not server-side core) and fixable only upstream in owncloud/core -# angular 1.4.14 - prototype pollution -CVE-2019-10768 -# prismjs 0.0.1 - ReDoS -CVE-2021-23341 -CVE-2021-32723 -# underscore 1.7.0 - template code execution / ReDoS -CVE-2021-23358 -CVE-2026-27601 diff --git a/v24.04/11.0.0-rc3/.trivyignore b/v24.04/11.0.0-rc3/.trivyignore new file mode 100644 index 00000000..91164a26 --- /dev/null +++ b/v24.04/11.0.0-rc3/.trivyignore @@ -0,0 +1,2 @@ +# vulnerability is affecting windows only +CVE-2024-51736