From 27c5dd9fa6b92e1206e2397cfc4b4eb1e8f6840b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Tue, 3 Nov 2026 11:01:06 +0100 Subject: [PATCH 1/2] feat(server): update 10.16.6 to 10.16.7 image from GitHub release tarball MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Build the 10.16.x image from the owncloud-complete-20261103 bundle on the v10.16.7 release, and move the line's .trivyignore and acceptance expected-failure lists to the new version. All three .trivyignore entries still apply unchanged: a local trivy 0.70.0 scan of the built image without the file reports exactly CVE-2024-51736, GHSA-27qh-8cxx-2cr5 and CVE-2026-69246; with it, nothing. Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 --- ...6.6-full.md => expected-failures-10.16.7-full.md} | 4 ++-- ...6-smoke.md => expected-failures-10.16.7-smoke.md} | 4 ++-- .github/workflows/main.yml | 12 ++++++------ CHANGELOG.md | 5 +++++ README.md | 2 +- agents.md | 2 +- v22.04/{10.16.6 => 10.16.7}/.trivyignore | 0 7 files changed, 17 insertions(+), 12 deletions(-) rename .github/acceptance/{expected-failures-10.16.6-full.md => expected-failures-10.16.7-full.md} (96%) rename .github/acceptance/{expected-failures-10.16.6-smoke.md => expected-failures-10.16.7-smoke.md} (93%) rename v22.04/{10.16.6 => 10.16.7}/.trivyignore (100%) diff --git a/.github/acceptance/expected-failures-10.16.6-full.md b/.github/acceptance/expected-failures-10.16.7-full.md similarity index 96% rename from .github/acceptance/expected-failures-10.16.6-full.md rename to .github/acceptance/expected-failures-10.16.7-full.md index 485a03f..71fa997 100644 --- a/.github/acceptance/expected-failures-10.16.6-full.md +++ b/.github/acceptance/expected-failures-10.16.7-full.md @@ -1,4 +1,4 @@ -# Scenarios of ownCloud core 10.16.6's acceptance tests that are expected to fail against this +# Scenarios of ownCloud core 10.16.7's acceptance tests that are expected to fail against this # image (full run). run.sh fails the job on any other failure, and on a listed # scenario that passes. One entry per line, as in core's own lists: # `- [apiSuite/file.feature:12](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSuite/file.feature#L12)` @@ -7,7 +7,7 @@ # Found in this repository's CI; they depend on how the image is set up. # 10.16-only: this feature is gone from core's master, so its master link is a 404; -# the scenario is in the v10.16.6 tag. +# the scenario is in the v10.16.7 tag. - [cliDbConversion/dbConversion.feature:30](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliDbConversion/dbConversion.feature#L30) - [cliMain/configKey.feature:81](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliMain/configKey.feature#L81) - [cliManageApps/appsPath.feature:18](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliManageApps/appsPath.feature#L18) diff --git a/.github/acceptance/expected-failures-10.16.6-smoke.md b/.github/acceptance/expected-failures-10.16.7-smoke.md similarity index 93% rename from .github/acceptance/expected-failures-10.16.6-smoke.md rename to .github/acceptance/expected-failures-10.16.7-smoke.md index 9690352..4d88706 100644 --- a/.github/acceptance/expected-failures-10.16.6-smoke.md +++ b/.github/acceptance/expected-failures-10.16.7-smoke.md @@ -1,4 +1,4 @@ -# Scenarios of ownCloud core 10.16.6's acceptance tests that are expected to fail against this +# Scenarios of ownCloud core 10.16.7's acceptance tests that are expected to fail against this # image (smoke run). run.sh fails the job on any other failure, and on a listed # scenario that passes. One entry per line, as in core's own lists: # `- [apiSuite/file.feature:12](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSuite/file.feature#L12)` @@ -7,7 +7,7 @@ # Found in this repository's CI; they depend on how the image is set up. # 10.16-only: this feature is gone from core's master, so its master link is a 404; -# the scenario is in the v10.16.6 tag. +# the scenario is in the v10.16.7 tag. - [cliDbConversion/dbConversion.feature:30](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliDbConversion/dbConversion.feature#L30) - [cliMain/configKey.feature:81](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliMain/configKey.feature#L81) - [cliManageApps/appsPath.feature:18](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliManageApps/appsPath.feature#L18) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index eb02c02..9cff461 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -31,9 +31,9 @@ jobs: fail-fast: false matrix: release: - - version: 10.16.6 - tarball: https://github.com/owncloud/core/releases/download/v10.16.6/owncloud-complete-20261006.tar.bz2 - qa-sha256: 5b1bfa2ffc9b0156bf1cee446e56744883b69415948f634baf2bfa4c2d0ea0df + - version: 10.16.7 + tarball: https://github.com/owncloud/core/releases/download/v10.16.7/owncloud-complete-20261103.tar.bz2 + qa-sha256: 97371a5b1e1f3fd334aea42e3c67419f002b26260539a15e14e2672471bafb05 base: v22.04 php: "7.4" - version: 11.0.1 @@ -74,10 +74,10 @@ jobs: fail-fast: false matrix: release: - - version: 10.16.6 - tarball: https://github.com/owncloud/core/releases/download/v10.16.6/owncloud-complete-20261006.tar.bz2 + - version: 10.16.7 + tarball: https://github.com/owncloud/core/releases/download/v10.16.7/owncloud-complete-20261103.tar.bz2 base: v22.04 - trivy-ignore: v22.04/10.16.6/.trivyignore + trivy-ignore: v22.04/10.16.7/.trivyignore extra-tags: | 10.16 10 diff --git a/CHANGELOG.md b/CHANGELOG.md index 403637b..74cba2b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## 2026-11-03 + +* Changed + * Update 10.16.6 to 10.16.7 built from the GitHub release tarball + ## 2026-10-06 * Changed diff --git a/README.md b/README.md index db899ef..9ffde95 100644 --- a/README.md +++ b/README.md @@ -33,7 +33,7 @@ ownCloud is an open-source file sync, share and content collaboration software t ## Docker Tags and respective Dockerfile links -- [`10.16.6`, `10.16`, `10`, `latest`](https://github.com/owncloud-docker/server/blob/master/v22.04/Dockerfile.multiarch) available as `owncloud/server:10.16.6` +- [`10.16.7`, `10.16`, `10`, `latest`](https://github.com/owncloud-docker/server/blob/master/v22.04/Dockerfile.multiarch) available as `owncloud/server:10.16.7` - [`11.0.1`, `11.0`, `11`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.0.1` ## Default volumes diff --git a/agents.md b/agents.md index 9f0a5ab..f455a95 100644 --- a/agents.md +++ b/agents.md @@ -39,7 +39,7 @@ There is no local application build (no Node/pnpm/Make toolchain). The image is built by `.github/workflows/main.yml`, which calls reusable workflows from [`owncloud-docker/ubuntu`](https://github.com/owncloud-docker/ubuntu): -- Matrix builds two releases: `10.16.6` (base `v22.04`) and `11.0.1` +- Matrix builds two releases: `10.16.7` (base `v22.04`) and `11.0.1` (base `v24.04`), each via `/Dockerfile.multiarch`. - The ownCloud version is injected with the `TARBALL_URL` build arg — there is no version pinned inside the Dockerfile. diff --git a/v22.04/10.16.6/.trivyignore b/v22.04/10.16.7/.trivyignore similarity index 100% rename from v22.04/10.16.6/.trivyignore rename to v22.04/10.16.7/.trivyignore From 86dbd2e914f4c7d809114331b5421e2b1facc62e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Tue, 3 Nov 2026 11:08:05 +0100 Subject: [PATCH 2/2] docs(trivy): restate the 10.16.7 core library versions in the acceptances MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- v22.04/10.16.7/.trivyignore | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/v22.04/10.16.7/.trivyignore b/v22.04/10.16.7/.trivyignore index 49d9d6a..93ec2fd 100644 --- a/v22.04/10.16.7/.trivyignore +++ b/v22.04/10.16.7/.trivyignore @@ -1,5 +1,5 @@ # vulnerability is affecting windows only: symfony/process v3.4.47 vendored by updater -# v1.1.2 (core lib ships v5.4.51, which is already past the 5.4.46 fix). v1.1.2 is the +# v1.1.2 (core lib ships v5.4.54, which is already past the 5.4.46 fix). v1.1.2 is the # newest updater release, so there is nothing to bump to. CVE-2024-51736 @@ -11,7 +11,7 @@ GHSA-27qh-8cxx-2cr5 # fix requires ownCloud to update bundled guzzlehttp/guzzle (-> 7.15.2) in graphapi # v0.3.1 (7.4.5), files_external_dropbox v2.0.2 (7.8.1) and updater v1.1.2 (7.9.2). -# Core lib is no longer affected: 10.16.5 ships 7.15.5 (owncloud/core#41784). The two +# Core lib is no longer affected: 10.16.7 ships 7.16.1 (7.15.5 since owncloud/core#41784). The two # apps do have fixed releases -- dropbox v2.1.2 and graphapi v0.3.2 -- but both are # signed in the G2 envelope, which 10.16's integrity check rejects outright, so the # bundle holds the older pins.