feat(server): update 11.0.1 to 11.1.0 image from GitHub release tarball

.github/acceptance/expected-failures-11.0.1-full.md → .github/acceptance/expected-failures-11.1.0-full.md

@@ -1,4 +1,4 @@
-# Scenarios of ownCloud core 11.0.1's acceptance tests that are expected to fail against this
+# Scenarios of ownCloud core 11.1.0's acceptance tests that are expected to fail against this
 # image (full run). run.sh fails the job on any other failure, and on a listed
 # scenario that passes. One entry per line, as in core's own lists:
 # `- [apiSuite/file.feature:12](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSuite/file.feature#L12)`
@@ -13,6 +13,10 @@
 - [cliProvisioning/resetUserPassword.feature:19](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPassword.feature#L19)
 - [cliProvisioning/resetUserPasswordOc10Issue36985.feature:8](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPasswordOc10Issue36985.feature#L8)
 
+# Stale in 11.1.0's tests: the scenario still expects 16 repair steps, but 11.1.0
+# registers a 17th (UpdateCertificateStore). Fix proposed in owncloud/core#41965.
+- [cliMain/maintenance.feature:9](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliMain/maintenance.feature#L9)
+
 ## API
 
 # From local full runs: these failed in the suite and fail again on their own against

.github/acceptance/expected-failures-11.0.1-smoke.md → .github/acceptance/expected-failures-11.1.0-smoke.md

@@ -1,4 +1,4 @@
-# Scenarios of ownCloud core 11.0.1's acceptance tests that are expected to fail against this
+# Scenarios of ownCloud core 11.1.0's acceptance tests that are expected to fail against this
 # image (smoke run). run.sh fails the job on any other failure, and on a listed
 # scenario that passes. One entry per line, as in core's own lists:
 # `- [apiSuite/file.feature:12](https://github.com/owncloud/core/blob/master/tests/acceptance/features/apiSuite/file.feature#L12)`
@@ -12,3 +12,7 @@
 - [cliManageApps/appsPath.feature:47](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliManageApps/appsPath.feature#L47)
 - [cliProvisioning/resetUserPassword.feature:19](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPassword.feature#L19)
 - [cliProvisioning/resetUserPasswordOc10Issue36985.feature:8](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliProvisioning/resetUserPasswordOc10Issue36985.feature#L8)
+
+# Stale in 11.1.0's tests: the scenario still expects 16 repair steps, but 11.1.0
+# registers a 17th (UpdateCertificateStore). Fix proposed in owncloud/core#41965.
+- [cliMain/maintenance.feature:9](https://github.com/owncloud/core/blob/master/tests/acceptance/features/cliMain/maintenance.feature#L9)

.github/workflows/main.yml

@@ -36,9 +36,9 @@ jobs:
             qa-sha256: 97371a5b1e1f3fd334aea42e3c67419f002b26260539a15e14e2672471bafb05
             base: v22.04
             php: "7.4"
-          - version: 11.0.1
-            tarball: https://github.com/owncloud/core/releases/download/v11.0.1/owncloud-complete-20260925.tar.bz2
-            qa-sha256: 932006415aa75d7cc6161594997dab88cb1cef1960c62eef79d45436700942dc
+          - version: 11.1.0
+            tarball: https://github.com/owncloud/core/releases/download/v11.1.0/owncloud-complete-20261103.tar.bz2
+            qa-sha256: 3c063d72422938c71f2ce53900b0d719ab418f49a9b5dda65fafc76630b2e45b
             base: v24.04
             php: "8.3"
 
@@ -83,12 +83,12 @@ jobs:
               10
               latest
             smoke-version-jq: ".versionstring"
-          - version: 11.0.1
-            tarball: https://github.com/owncloud/core/releases/download/v11.0.1/owncloud-complete-20260925.tar.bz2
+          - version: 11.1.0
+            tarball: https://github.com/owncloud/core/releases/download/v11.1.0/owncloud-complete-20261103.tar.bz2
             base: v24.04
-            trivy-ignore: v24.04/11.0.1/.trivyignore
+            trivy-ignore: v24.04/11.1.0/.trivyignore
             extra-tags: |
-              11.0
+              11.1
               11
             smoke-version-jq: ".versionstring"
 

CHANGELOG.md

@@ -2,8 +2,11 @@
 
 ## 2026-11-03
 
+* Added
+  * Publish the floating `11.1` tag for the 11.x image; `11.0` stays on 11.0.1
 * Changed
   * Update 10.16.6 to 10.16.7 built from the GitHub release tarball
+  * Update 11.0.1 to 11.1.0 built from the GitHub release tarball
 
 ## 2026-10-06
 

README.md

@@ -34,7 +34,7 @@ ownCloud is an open-source file sync, share and content collaboration software t
 ## Docker Tags and respective Dockerfile links
 
 - [`10.16.7`, `10.16`, `10`, `latest`](https://github.com/owncloud-docker/server/blob/master/v22.04/Dockerfile.multiarch) available as `owncloud/server:10.16.7`
-- [`11.0.1`, `11.0`, `11`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.0.1`
+- [`11.1.0`, `11.1`, `11`](https://github.com/owncloud-docker/server/blob/master/v24.04/Dockerfile.multiarch) available as `owncloud/server:11.1.0`
 
 ## Default volumes
 

agents.md

@@ -20,7 +20,7 @@ GitHub Actions.
   - `v22.04/Dockerfile.multiarch` — image definition (`FROM owncloud/base:22.04`)
   - `v22.04/overlay/` — files copied into the image root (`ADD overlay /`); currently empty
   - `v22.04/<version>/.trivyignore` — accepted-CVE exclusions for the Trivy scan
-- `v24.04/` — Ubuntu 24.04 based image (ownCloud 11.0.1)
+- `v24.04/` — Ubuntu 24.04 based image (ownCloud 11.1.0)
   - `v24.04/Dockerfile.multiarch`, `v24.04/overlay/`, `v24.04/<version>/.trivyignore` — as above
 - `docs/` — design/spec notes
 - `images/` — README screenshots
@@ -39,7 +39,7 @@ There is no local application build (no Node/pnpm/Make toolchain). The image is
 built by `.github/workflows/main.yml`, which calls reusable workflows from
 [`owncloud-docker/ubuntu`](https://github.com/owncloud-docker/ubuntu):
 
-- Matrix builds two releases: `10.16.7` (base `v22.04`) and `11.0.1`
+- Matrix builds two releases: `10.16.7` (base `v22.04`) and `11.1.0`
   (base `v24.04`), each via `<base>/Dockerfile.multiarch`.
 - The ownCloud version is injected with the `TARBALL_URL` build arg — there is no
   version pinned inside the Dockerfile.

v24.04/11.1.0/.trivyignore

@@ -0,0 +1,26 @@
+# already fixed in the vendored copy: pdfjs-dist 2.10.0 reported from
+# apps/files_pdfviewer/js/vendor/pdfjs/package.json (files_pdfviewer v1.1.2). The
+# /FontMatrix fix was backported into build/pdf.js and build/pdf.worker.js in
+# owncloud/files_pdfviewer#351 (v1.1.1) and is guarded there by a regression test
+# against a PoC PDF. The vendored package.json deliberately keeps reporting the
+# upstream version so scanners can inventory the library, which is why the row
+# appears at all -- v1.1.1 shipped no package.json and so was never scanned.
+# Drops out when the vendored copy is regenerated from pdf.js >= 4.2.67
+# (owncloud/files_pdfviewer#363).
+CVE-2024-4367
+
+# not fixed in this bundle: Go standard library go1.26.9, reported from
+# apps/migrate_to_ocis/bin/rclone_linux_amd64 (migrate_to_ocis v3.0.3, which
+# bundles upstream rclone v1.75.2). Fixed in go1.26.10 / 1.27.3, which no rclone
+# release is built with yet. GO-2026-6809 adds a crypto/x509 denylist of
+# compromised intermediate CAs. rclone is only a client here, so the exposure is
+# a man-in-the-middle presenting a chain through such an intermediate while an
+# admin runs the files migration (`occ migrate:to-ocis:migrate:files`, the only
+# step where rclone connects). With --insecure (-k) certificates are not
+# verified at all, so the denylist would not help there either. Accepted for
+# 11.1.0 in owncloud/server-release's spec check and in migrate_to_ocis's own
+# scan (owncloud/migrate_to_ocis#80), both until 2026-11-30. Do not carry this
+# into the next 11.x file once its bundle ships a migrate_to_ocis whose rclone
+# is built with go >= 1.26.10. The exp: date makes this image's scan fail on the
+# same day the other two acceptances lapse.
+CVE-2026-111943 exp:2026-11-30