feat(server): update 10.16.4 to 10.16.5 image from GitHub release tarball

[oc-tmueller]

ownCloud 10.16.5 is published, so point the v22.04 matrix entry at the new tarball:

https://github.com/owncloud/core/releases/download/v10.16.5/owncloud-complete-20260925.tar.bz2
sha256 676e366b881141c46f858c4e05086a59ba8092640f0d641146201830e0b920bf

As before, the dated -complete- bundle is pinned rather than the core-only or -qa asset.

Note

The 10.16.5 -complete- bundle carries the same 20260925 date stamp as the 11.0.1 bundle — both were built today, exactly as 10.16.4 and 11.0.0-rc3 shared 20260729. They are distinct files (11.0.1 is bdbb68d0…, 101 MB, against 676e366b…, 76 MB here) and the tag in the URL disambiguates.

What's in 10.16.5

Four security fixes:

PR	Fix
#41784	Bundled PHP dependencies updated to close sixteen published advisories — guzzle 7.10.0 → 7.15.5, plus phpseclib, psr7, promises, dom-sanitizer, symfony/routing, symfony/polyfill-php80
#41803	appconfig public_/remote_ keys can no longer be used for path traversal
#41827	SVG/MVG and script content is rejected before it reaches the ImageMagick bitmap preview path
#41834	The Imagick coder is pinned per preview provider

Plus seven bugfixes (#41782, #41808, #41814, #41815, #41835, #41855, #41869) and one further dependency update (#41787).

.trivyignore

The versioned directory is renamed, and unlike the last two bumps the contents are not unchanged — four bundled apps moved in this release (market 0.9.0 → 0.9.1, files_primary_s3 1.6.1 → 1.6.4, oauth2 0.6.1 → 0.6.3, openidconnect 2.3.3 → 2.3.5), which retires two of the five entries:

entry	verdict	evidence
CVE-2026-44167	dropped	openidconnect v2.3.5 vendors phpseclib 3.0.56, past the 3.0.54 fix
CVE-2026-54133	dropped	files_primary_s3 v1.6.4 vendors mtdowling/jmespath.php 2.9.2, the fixed version
CVE-2024-51736	kept	symfony/process v3.4.47 via updater v1.1.2 — Windows-only, and v1.1.2 is still the newest updater release
GHSA-27qh-8cxx-2cr5	kept	aws-sdk-php 3.337.3 via files_primary_s3 v1.6.4 — every release from 3.338.0 on, including the first patched 3.371.4, requires php ≥ 8.1, so there is no fix that runs on this php 7.4 line
CVE-2026-69246	kept	guzzle — no longer a core-lib finding (10.16.5 ships 7.15.5), but still vendored old by graphapi v0.3.1 (7.4.5), files_external_dropbox v2.0.2 (7.8.1) and updater v1.1.2 (7.9.2)

The two kept app entries have fixed releases — dropbox v2.1.2 and graphapi v0.3.2 — that 10.16 cannot use: both are signed in the G2 envelope, which 10.16's integrity check rejects outright. The notes in the file now say so, rather than describing them as plain missing upstream fixes.

Verification

Built v22.04/Dockerfile.multiarch locally against the pinned tarball:

• /status.php reports "versionstring":"10.16.5" — what CI asserts via smoke-version-jq.
• Reproducing the reusable workflow's Trivy scan (HIGH,CRITICAL, --ignore-unfixed, the same skip-files, --exit-code 1) against the image reports exactly three findings with no ignorefile — the three retained entries, and nothing else — and zero with v22.04/10.16.5/.trivyignore. So every retained entry is load-bearing, neither dropped entry still fires, and nothing is missing.
• editorconfig-checker clean over the tree.

The same checks run on this PR (editorconfig lint, multiarch build, smoke test, Trivy).

Once merged, the build job on master publishes 10.16.5, 10.16, 10, latest and the date-stamped 10.16.5-20260925 to Docker Hub, and re-syncs the README as the image description.

🤖 Generated with Claude Code