ownCloud Classic 11.0.0 is here

[DeepDiver1975]

ownCloud Classic 11.0.0 is here

ownCloud Classic 11.0.0 is released — the first major release of the 11.x line,
and the first one built and signed end-to-end on our new G2 code-signing PKI.

It contains 11 security fixes, raises the minimum PHP version to 8.3, and
removes a long list of deprecated features. Upgrading is recommended for all
installations, but this is a major release: please read the breaking changes
below before you upgrade.

• Release: https://github.com/owncloud/core/releases/tag/v11.0.0
• Full changelog: https://github.com/owncloud/core/blob/v11.0.0/CHANGELOG.md
  (47 entries: 11 security, 17 changes, 19 bugfixes)

Read this before upgrading

1. PHP 8.3 is now the minimum. (#41449)
Instances on an older PHP will refuse to start — the version check now runs early
in lib/base.php. The mail subsystem moved to symfony/mailer, and the unused
ext-apc requirement was dropped.

2. The group-admin (subadmin) feature is disabled by default. (#41634)
That code path has known security shortcomings, so it is now gated behind a new
allow_subadmins system config. After upgrading, existing group-admin
assignments are ignored until an administrator sets
'allow_subadmins' => true in config.php.

3. G1 app signatures stop verifying on 2027-01-01. (#41680)
App signature verification is now done by the new G2 verifier: full certificate
chain validation against bundled trust anchors, an algorithm allowlist, and a
fail-closed CRL check. G1-signed apps still verify during the transition, but all
G1 signatures stop verifying after the hardcoded sunset at
2026-12-31T23:59:59Z, regardless of individual certificate expiry. If you run
third-party apps signed under G1, ask their maintainers for G2-signed releases
well ahead of that date.

4. occ integrity:sign-app and occ integrity:sign-core are gone. (#41712)
Signing is a release/CI concern, not something you do against a running instance.
Verification is unchanged — occ integrity:check-app and integrity:check-core
work exactly as before.

5. occ db:convert-type is gone. (#41451)
It was experimental, untested and unsupported.

6. Legacy and deprecated classes have been removed. (#41455)
OC_DB, OC_DB_StatementWrapper, OC_Group_Backend, OC_Group_Database,
OC_OCS_Result, \OCP\DB, MDBSchemaWriter, and the OC_Group_Interface /
OC_User_Interface interfaces. Third-party apps using these need updating.

Upgrades are supported from 8.2.11, 9.0.9, and 9.1 onwards.

If you configured htaccess.RewriteBase, re-run
occ maintenance:update:htaccess after upgrading — 11.0.0 fixes rewrite rules
that were rejecting API requests for files whose names end in .jpg, .png,
.svg or .json (#41418).

Get it

11.0.0 ships as a container image:

docker pull owncloud/server:11.0.0

Note that owncloud/server:latest still points at 10.16.4. 11.0.0 is opt-in
for now — pull the explicit tag if you want it.

Image page: https://hub.docker.com/r/owncloud/server

Security fixes

• Prevent params body from overriding validated occ command — #41577
• Remove plaintext federation auth token from the error log — #41578
• Replace strcmp token oracle with hash-based comparison in federation — #41579
• Restrict unserialize() allowed classes in CommandJob — #41582
• Sanitize storage connection error messages returned to clients — #41585
• Prevent user enumeration via differential password-reset UI — #41586
• Do not trust cached binary paths — #41732
• Enforce the read permission in the public share preview endpoint — #41751
• Confine backend-provided user homes to the data directory — #41752
• Encode search highlights before returning them as a DAV property — #41760
• Group-admin disabled by default — #41634 (see breaking changes)

Other notable changes

• Generated URLs are no longer stored in the memory cache — #41733.
  Generating a URL measured faster than a cache round trip, so the cache only
  added a place where URLs could go stale or be tampered with.
• Autoloader information is no longer stored in any memory cache — #41376
• The internet connectivity check URL is now configurable, defaulting to an
  independent IPv6-capable resource — #41506
• HTML metacharacters are covered by the username validation allow-list — #41738
• The write-hook veto is honoured on legacy chunked WebDAV uploads — #41762
• Decrypt versions and trashbin so encryption can actually be disabled — #41623
• Federation between systems in subdirectories now works — #41599
• user:home:list-dirs / user:home:list-users no longer crash on PHP 8 — #41630
• MIME types for OpenDocument formats added; Microsoft Office icons refreshed — #41648, #41347

What changed in the bundle since the 10.16 line

Added to the Complete bundle: brute_force_protection, migrate_to_ocis,
notes, richdocuments, twofactor_totp.

Removed: impersonate, kerberos, sharepoint, templateeditor,
updater, web. The updater app is also gone from the Standard edition —
upgrade by pulling the new image instead.

Bundled app versions in 11.0.0

Standard edition (also included in Complete)

App	Version
configreport	v0.4.2
encryption	v1.7.1
example-files	v1.4.0
external	v1.5.2
files_mediaviewer	v1.1.1
firstrunwizard	v1.4.2
market	v0.10.1
notifications	v0.7.1
user_external	v0.7.1

Complete edition — additional apps

App	Version
activity	v2.8.1
admin_audit	v2.2.1
announcementcenter	v1.3.1
brute_force_protection	v1.4.1
customgroups	v0.10.2
diagnostics	v0.3.1
drawio	v1.1.1
files_antivirus	v1.3.1
files_classifier	v1.6.1
files_external_dropbox	v2.1.1
files_external_ftp	v0.3.1
files_ldap_home	v0.6.2
files_lifecycle	v1.4.1
files_pdfviewer	v1.1.1
files_primary_s3	v1.7.1
files_texteditor	v2.7.1
firewall	v2.11.1
graphapi	v0.4.1
guests	v0.13.1
metrics	v1.5.1
migrate_to_ocis	v3.0.0
notes	v2.2.0
oauth2	v0.7.1
openidconnect	v2.4.1
password_policy	v2.3.1
ransomware_protection	v1.8.1
richdocuments	v4.3.0
systemtags_management	v0.5.1
theme-enterprise	v2.4.1
twofactor_totp	v0.10.2
user_ldap	v0.20.3
user_shibboleth	v3.7.1
windows_network_drive	v2.5.1
wopi	v1.9.1
workflow	v0.7.1

Integrity

The image is built from a G2 code-signed release tree — core and every bundled
app carry a G2 signature (ECDSA P-384 / SHA-384, one certificate per app,
chaining to the G2 root). You can check this on your running instance:

docker exec <container> occ integrity:check-core
docker exec <container> occ integrity:check-app <app>

Both report an intact, signed installation.

Feedback

Found a bug or a regression? Reply in this thread, or open an issue against the
relevant repository under https://github.com/owncloud. Thanks to everyone who
tested the three release candidates — you got us here. 🙏