Upgrade to 4.0.0 breaks NC 32, 33

[MacLemon]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Steps to reproduce

1. Update integration_zammad
2. See Nextcloud error message: DB needs update
3. Fix Nextcloud instance by deactivating integration_zammad

Or if you're unlucky, now must forced upgrade to Nextcloud 33, though you wanted to stay on 32 for stability reasons.

Expected behaviour

Should not break Nextcloud in a way that requires shell access.

Actual behaviour

Upgrading via occ shows this error:

Exception: Database error when running migration 040000Date20260129225956 for app integration_zammad
Authenticated ciphertext could not be decoded.
Update failed

Server configuration

Web server: Nginx

Database: PostgreSQL

PHP version: 8.3

Nextcloud version: (see Nextcloud admin page)

• 32
• 33

List of activated apps

Enabled:
  - activity: 5.0.0
  - analytics: 6.3.0
  - announcementcenter: 7.3.0
  - app_api: 32.0.0
  - bookmarks: 16.1.3
  - bruteforcesettings: 5.0.0
  - calendar: 6.2.2
  - calendar_resource_management: 0.11.0
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - collectives: 4.2.0
  - comments: 1.22.0
  - contacts: 8.3.7
  - contactsinteraction: 1.13.1
  - cookbook: 0.11.6
  - cospend: 3.2.0
  - dashboard: 7.12.0
  - dav: 1.34.2
  - deck: 1.16.3
  - event_update_notification: 2.8.0
  - external: 7.0.0
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_accesscontrol: 3.0.2
  - files_automatedtagging: 3.0.3
  - files_downloadlimit: 5.0.0
  - files_external: 1.24.1
  - files_pdfviewer: 5.0.0
  - files_reminders: 1.5.0
  - files_retention: 3.0.0
  - files_sharing: 1.24.1
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - forms: 5.2.6
  - groupfolders: 20.1.12
  - impersonate: 3.0.1
  - integration_discourse: 3.2.0
  - integration_github: 3.2.2
  - integration_gitlab: 5.0.0
  - limit_login_to_ip: 4.3.0
  - logreader: 5.0.0
  - lookup_server_connector: 1.20.0
  - nextcloud_announcements: 4.0.0
  - notes: 4.13.1
  - notifications: 5.0.0
  - notify_push: 1.3.1
  - oauth2: 1.20.0
  - password_policy: 4.0.0
  - photos: 5.0.0
  - privacy: 4.0.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - quota_warning: 1.23.0
  - recommendations: 5.0.0
  - related_resources: 3.0.0
  - serverinfo: 4.0.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - spreed: 22.0.11
  - systemtags: 1.22.0
  - tables: 1.0.5
  - tasks: 0.17.1
  - terms_of_service: 4.6.1
  - text: 6.0.1
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - twofactor_totp: 14.0.0
  - twofactor_webauthn: 2.6.0
  - updatenotification: 1.22.0
  - user_status: 1.12.0
  - user_usage_report: 3.0.0
  - viewer: 5.0.0
  - weather_status: 1.12.0
  - workflow_pdf_converter: 3.0.0
  - workflow_script: 3.0.0
  - workflowengine: 2.14.0

Browser

Browser name: any

Browser version: any

Operating system: Client irrelevant, is a server-side issue

[marcelklehr]

Analysis on a prod system reveals: https://github.com/nextcloud/integration_zammad/blob/main/lib/Migration/Version040000Date20260129225956.php#L37

We should have checked for empty values before decrypting the values. Now, the migration is not marked as done, but some values have likely already been migrated. We will have to change the migration to check if a value is marked as sensitive and only if not apply the migration procedure.

@MacLemon We will likely tackle this some time next week. Thank you for reporting this!