From 2d0ab468d212e2ff98e626f0a5705e42ab8b4d0f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Wed, 29 Jul 2026 18:01:22 +0200 Subject: [PATCH] feat(server): update 10.16.3 to 10.16.4 image from GitHub release tarball MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the 10.16.3 tarball with the newly published 10.16.4 release: https://github.com/owncloud/core/releases/download/v10.16.4/owncloud-complete-20260729.tar.bz2 (sha256 cc7707b25450716c1b0aead59d405919ac0911188acf4c928d586f9dd7498452) This also switches the 10.x entry from the download.owncloud.com/server/stable mirror to the immutable, tag-scoped GitHub release asset, matching how the 11.0.0-rc* entries are pinned. Note the "-complete-" bundle for 10.16.4 carries the same 20260729 date stamp as the 11.0.0-rc3 bundle -- both were built the same day -- but they are distinct files (rc3 is b1edfba0...); the tag in the URL disambiguates. As before, the dated "-complete-" bundle is pinned rather than the core-only or -qa asset. 10.16.4 contains two fixes over 10.16.3: #41574 subadmin email change no longer associates the verification token and confirmation link with the caller's account instead of the target user's #41763 legacy chunked WebDAV uploads now honour the pre-write hook veto, so the filename blacklist is enforced on the chunked path as it already was for ordinary uploads The versioned .trivyignore directory is renamed to match. Its contents are unchanged and still accurate: no bundled app changed version between 10.16.3 and 10.16.4 (all 55 apps identical), files_primary_s3 still vendors aws-sdk-php 3.337.3 (below the 3.371.4 that fixes GHSA-27qh-8cxx-2cr5), and openidconnect is still 2.3.3, so the CVE-2026-44167 false positive stands. Verified locally: built v22.04/Dockerfile.multiarch against the pinned tarball and confirmed /status.php reports versionstring 10.16.4, which is what the CI smoke test asserts via smoke-version-jq. Co-Authored-By: Claude Opus 5 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .github/workflows/main.yml | 6 +++--- CHANGELOG.md | 1 + README.md | 2 +- agents.md | 2 +- v22.04/{10.16.3 => 10.16.4}/.trivyignore | 0 5 files changed, 6 insertions(+), 5 deletions(-) rename v22.04/{10.16.3 => 10.16.4}/.trivyignore (100%) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 4f6bae4..fac1d49 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -40,10 +40,10 @@ jobs: strategy: matrix: release: - - version: 10.16.3 - tarball: https://download.owncloud.com/server/stable/owncloud-complete-20260522.tar.bz2 + - version: 10.16.4 + tarball: https://github.com/owncloud/core/releases/download/v10.16.4/owncloud-complete-20260729.tar.bz2 base: v22.04 - trivy-ignore: v22.04/10.16.3/.trivyignore + trivy-ignore: v22.04/10.16.4/.trivyignore extra-tags: | 10.16 10 diff --git a/CHANGELOG.md b/CHANGELOG.md index 26c6ca4..58f4a88 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ ## 2026-07-29 * Changed + * Update 10.16.3 to 10.16.4 built from the GitHub release tarball * Update 11.0.0-rc2 to 11.0.0-rc3 built from the GitHub release tarball ## 2026-07-23 diff --git a/README.md b/README.md index 816bf43..c2577b0 100644 --- a/README.md +++ b/README.md @@ -33,7 +33,7 @@ ownCloud is an open-source file sync, share and content collaboration software t ## Docker Tags and respective Dockerfile links -- [`10.16.3`, `10.16`, `10`, `latest`](https://github.com/owncloud-docker/server/blob/master/v22.04/Dockerfile.multiarch) available as `owncloud/server:10.16.3` +- [`10.16.4`, `10.16`, `10`, `latest`](https://github.com/owncloud-docker/server/blob/master/v22.04/Dockerfile.multiarch) available as `owncloud/server:10.16.4` - [`11.0.0-rc3`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.0.0-rc3` ## Default volumes diff --git a/agents.md b/agents.md index ee4bbe3..a2339de 100644 --- a/agents.md +++ b/agents.md @@ -39,7 +39,7 @@ There is no local application build (no Node/pnpm/Make toolchain). The image is built by `.github/workflows/main.yml`, which calls reusable workflows from [`owncloud-docker/ubuntu`](https://github.com/owncloud-docker/ubuntu): -- Matrix builds two releases: `10.16.3` (base `v22.04`) and `11.0.0-rc3` +- Matrix builds two releases: `10.16.4` (base `v22.04`) and `11.0.0-rc3` (base `v24.04`), each via `/Dockerfile.multiarch`. - The ownCloud version is injected with the `TARBALL_URL` build arg — there is no version pinned inside the Dockerfile. diff --git a/v22.04/10.16.3/.trivyignore b/v22.04/10.16.4/.trivyignore similarity index 100% rename from v22.04/10.16.3/.trivyignore rename to v22.04/10.16.4/.trivyignore