From a58cf74033856adad5659a76f74fec8a33f9edf3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Thu, 23 Jul 2026 12:10:23 +0200 Subject: [PATCH 1/3] feat(server): update 11.0.0-rc1 to 11.0.0-rc2 image from GitHub release tarball MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the pinned 11.0.0-rc1 tarball with the newly published 11.0.0-rc2 release: https://github.com/owncloud/core/releases/download/v11.0.0-rc2/owncloud-11.0.0-rc2.tar.bz2 (sha256 9738a7a95c50cf693249f45259354e0c3cb61aac5b759a623c954ccac50ba2f0) Unlike rc1, rc2 does not publish a separate "-complete-" tarball asset, so the release asset is pinned directly. Renamed the versioned .trivyignore directory to match, and fixed agents.md's already-stale 11.0.0-prealpha mentions. Co-authored-by: Claude Sonnet 5 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .github/workflows/main.yml | 6 +++--- CHANGELOG.md | 5 +++++ README.md | 2 +- agents.md | 4 ++-- v24.04/{11.0.0-rc1 => 11.0.0-rc2}/.trivyignore | 0 5 files changed, 11 insertions(+), 6 deletions(-) rename v24.04/{11.0.0-rc1 => 11.0.0-rc2}/.trivyignore (100%) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 2ea0878..dc28ddc 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -49,10 +49,10 @@ jobs: 10 latest smoke-version-jq: ".versionstring" - - version: 11.0.0-rc1 - tarball: https://github.com/owncloud/core/releases/download/v11.0.0-rc1/owncloud-complete-20260629.tar.bz2 + - version: 11.0.0-rc2 + tarball: https://github.com/owncloud/core/releases/download/v11.0.0-rc2/owncloud-11.0.0-rc2.tar.bz2 base: v24.04 - trivy-ignore: v24.04/11.0.0-rc1/.trivyignore + trivy-ignore: v24.04/11.0.0-rc2/.trivyignore smoke-version-jq: "" update-docker-hub-description: diff --git a/CHANGELOG.md b/CHANGELOG.md index 9385661..7c642af 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## 2026-07-23 + +* Changed + * Update 11.0.0-rc1 to 11.0.0-rc2 built from the GitHub release tarball + ## 2026-06-29 * Changed diff --git a/README.md b/README.md index 4b1be10..27462fa 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,7 @@ ownCloud is an open-source file sync, share and content collaboration software t ## Docker Tags and respective Dockerfile links - [`10.16.3`, `10.16`, `10`, `latest`](https://github.com/owncloud-docker/server/blob/master/v22.04/Dockerfile.multiarch) available as `owncloud/server:10.16.3` -- [`11.0.0-rc1`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.0.0-rc1` +- [`11.0.0-rc2`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.0.0-rc2` ## Default volumes diff --git a/agents.md b/agents.md index e1eac66..bf0752e 100644 --- a/agents.md +++ b/agents.md @@ -20,7 +20,7 @@ GitHub Actions. - `v22.04/Dockerfile.multiarch` — image definition (`FROM owncloud/base:22.04`) - `v22.04/overlay/` — files copied into the image root (`ADD overlay /`); currently empty - `v22.04//.trivyignore` — accepted-CVE exclusions for the Trivy scan -- `v24.04/` — Ubuntu 24.04 based image (ownCloud 11.0.0-prealpha) +- `v24.04/` — Ubuntu 24.04 based image (ownCloud 11.0.0-rc2) - `v24.04/Dockerfile.multiarch`, `v24.04/overlay/`, `v24.04//.trivyignore` — as above - `docs/` — design/spec notes - `images/` — README screenshots @@ -39,7 +39,7 @@ There is no local application build (no Node/pnpm/Make toolchain). The image is built by `.github/workflows/main.yml`, which calls reusable workflows from [`owncloud-docker/ubuntu`](https://github.com/owncloud-docker/ubuntu): -- Matrix builds two releases: `10.16.3` (base `v22.04`) and `11.0.0-prealpha` +- Matrix builds two releases: `10.16.3` (base `v22.04`) and `11.0.0-rc2` (base `v24.04`), each via `/Dockerfile.multiarch`. - The ownCloud version is injected with the `TARBALL_URL` build arg — there is no version pinned inside the Dockerfile. diff --git a/v24.04/11.0.0-rc1/.trivyignore b/v24.04/11.0.0-rc2/.trivyignore similarity index 100% rename from v24.04/11.0.0-rc1/.trivyignore rename to v24.04/11.0.0-rc2/.trivyignore From 1ac13133752814787e544f5fcb67effffc1f897e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Thu, 23 Jul 2026 14:03:33 +0200 Subject: [PATCH 2/3] fix(server): pin the 11.0.0-rc2 complete tarball, not the core-only asset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use owncloud-complete-20260723.tar.bz2 (sha256 c31bec173c6ddc7a2e276031ee46e777a77ed852b157f65861bc68b6ab412b50), consistent with how 10.16.3 and the previous 11.0.0-rc1 build were pinned to a "-complete-" release asset bundling apps, rather than the bare owncloud-11.0.0-rc2.tar.bz2 core-only asset. Co-authored-by: Claude Sonnet 5 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index dc28ddc..0e11922 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -50,7 +50,7 @@ jobs: latest smoke-version-jq: ".versionstring" - version: 11.0.0-rc2 - tarball: https://github.com/owncloud/core/releases/download/v11.0.0-rc2/owncloud-11.0.0-rc2.tar.bz2 + tarball: https://github.com/owncloud/core/releases/download/v11.0.0-rc2/owncloud-complete-20260723.tar.bz2 base: v24.04 trivy-ignore: v24.04/11.0.0-rc2/.trivyignore smoke-version-jq: "" From 0ad1ae5ebd2fddbcdd4cdccf6dcf89b6e7462f6c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <1005065+DeepDiver1975@users.noreply.github.com> Date: Thu, 23 Jul 2026 14:21:35 +0200 Subject: [PATCH 3/3] fix(server): ignore bundled notes-app JS CVEs in 11.0.0-rc2 Trivy scan MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 11.0.0-rc2 complete tarball bundles the "notes" marketplace app, which vendors old client-side JS libraries that Trivy flags as HIGH/CRITICAL, failing the scan (build itself succeeds): angular 1.4.14 CVE-2019-10768 (prototype pollution) prismjs 0.0.1 CVE-2021-23341, CVE-2021-32723 (ReDoS) underscore 1.7.0 CVE-2021-23358, CVE-2026-27601 (template code exec / ReDoS) These are frontend-only, live in an optional bundled app, and can only be fixed upstream in owncloud/core. Accept them in the per-version .trivyignore with justification, matching the repo's existing pattern. Co-authored-by: Claude Opus 4.8 Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> --- v24.04/11.0.0-rc2/.trivyignore | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/v24.04/11.0.0-rc2/.trivyignore b/v24.04/11.0.0-rc2/.trivyignore index 91164a2..eeed8ba 100644 --- a/v24.04/11.0.0-rc2/.trivyignore +++ b/v24.04/11.0.0-rc2/.trivyignore @@ -1,2 +1,13 @@ # vulnerability is affecting windows only CVE-2024-51736 + +# client-side JS libs vendored by the bundled "notes" marketplace app; frontend +# only (not server-side core) and fixable only upstream in owncloud/core +# angular 1.4.14 - prototype pollution +CVE-2019-10768 +# prismjs 0.0.1 - ReDoS +CVE-2021-23341 +CVE-2021-32723 +# underscore 1.7.0 - template code execution / ReDoS +CVE-2021-23358 +CVE-2026-27601