feat(server): update 11.0.0 to 11.0.1 image from GitHub release tarball

[oc-tmueller]

ownCloud 11.0.1 is published, so point the v24.04 matrix entry at the new tarball:

https://github.com/owncloud/core/releases/download/v11.0.1/owncloud-complete-20260925.tar.bz2
sha256 bdbb68d0e7a1bbf1cf5f82a70ab0e1aeae0f0f0c6802ae4651c3dbd854f5b1db

Note

The 11.0.1 -complete- bundle carries the same 20260925 date stamp as the 10.16.5 bundle in #714 — both were built today, exactly as 11.0.0-rc3 and 10.16.4 shared 20260729. They are distinct files (10.16.5 is 676e366b…, 76 MB, against 101 MB here) and the tag in the URL disambiguates.

What's in 11.0.1

Three security fixes:

PR	Fix
#41827	SVG/MVG and script content is rejected before it reaches the ImageMagick bitmap preview path
#41834	The Imagick coder is pinned per preview provider
#41856	appconfig public_/remote_ keys can no longer be used for path traversal

Plus nine bugfixes — among them #41824, which stops the release tarballs shipping app development trees — and three changes.

New: the 11.0 and 11 tags

This entry now also publishes the floating 11.0 and 11 tags.

11.0.0 published under its exact version only, and #678 was explicit that promoting the 11.x line was a separate decision. That reasoning was sound while 11.x was a single release — there was nothing for a floating tag to float over. With a second release on the line it has run out: someone tracking the 11.0 series has no tag to follow, which is exactly what 11.0 is for.

latest deliberately stays on the 10.x line, so an unpinned docker pull owncloud/server still gets Classic 10 and nothing breaks for anyone tracking it. Moving latest remains its own decision.

.trivyignore

The versioned directory is renamed; its one entry goes and two arrive. None of this is inferred from the app pins — it was measured against the built image with the same Trivy version CI pins (v0.70.0, via trivy-action v0.36.0's default), the same severity: HIGH,CRITICAL, the same --ignore-unfixed and the same skip-files.

entry	verdict	evidence
CVE-2026-69246	dropped	was guzzle 7.15.1 via files_external_dropbox; the app moved v2.1.1 → v2.1.2 and the bundle now ships 7.15.2, the fixed version. The finding is gone from the scan.
CVE-2024-4367	added	pdfjs-dist 2.10.0 reported from apps/files_pdfviewer/js/vendor/pdfjs/package.json (v1.1.2)
CVE-2026-84445	added	google.golang.org/grpc v1.84.0-dev inside apps/migrate_to_ocis/bin/rclone_linux_amd64 (v3.0.2)

Why the two additions are acceptable, and why they are new:

• CVE-2024-4367 is already fixed in the vendored copy. The /FontMatrix backport landed in build/pdf.js and build/pdf.worker.js in files_pdfviewer#351, released in v1.1.1, and is guarded there by a regression test against a PoC PDF. The row appears because v1.1.2 added a package.json to the vendored directory — deliberately, so scanners and SBOM tooling can inventory the library — and that manifest still reports the upstream version. v1.1.1 shipped no manifest there and so was never scanned; the finding is new because the manifest is new, not because the code changed. Clears when the vendored copy is regenerated from pdf.js ≥ 4.2.67 (files_pdfviewer#363).
• CVE-2026-84445 has no released fix. migrate_to_ocis moved v3.0.0 → v3.0.2 and with it to upstream rclone v1.75.1; the patched grpc is on rclone master but in no rclone release, so there is nothing for the app to rebundle. Not reachable: the panic is in the xDS routing interceptor, installed only by servers built with xds.NewGRPCServer(), and needs an inbound RPC carrying neither :authority nor Host — the app shells out to rclone sync and rclone obscure and never serves gRPC. Clears when rclone ships a release with the fixed grpc (migrate_to_ocis#74).

Both match the acceptances owncloud/server-release carries for this same bundle, so the image gate and the release gate now agree.

Verification

Built v24.04/Dockerfile.multiarch locally against the pinned tarball:

{"installed":true,"maintenance":false,"needsDbUpgrade":false,"version":"11.0.1.0","versionstring":"11.0.1",…}

which is what CI asserts via smoke-version-jq. The Trivy scan reports exactly the two findings above with no ignorefile and exits 0 with v24.04/11.0.1/.trivyignore — so both additions are load-bearing, the dropped entry no longer fires, and nothing is missing. editorconfig-checker clean.

Once merged, the build job on master publishes 11.0.1, 11.0, 11 and the date-stamped 11.0.1-20260925 to Docker Hub.

Important

This PR and #714 both touch agents.md, README.md and CHANGELOG.md at the same lines. Whichever merges second needs a rebase, resolved by keeping both version bumps and folding the two ## 2026-09-25 entries into one section — taking one side wholesale would silently revert the other bump and leave the docs naming a version the matrix no longer builds. I will do that rebase on whichever is second.

🤖 Generated with Claude Code