Nextcloud 29.0.6 is out

[necrevistonnezr]

I’m still convinced the decision to have core functions only available as apps or extensions is fundamentally wrong. Core functions should always be maintained and supported together with the “core”, not outsourced to the community. Heck, the full-text search is an “app”.
This slowly changed with the introduction of Nextcloud AIO and I’m equally convinced it would be a perfect fit for Cloudron.

[necrevistonnezr]

Any hope?

[micmc]

@necrevistonnezr said in Nextcloud 29.0.5 is out:

I’m still convinced the decision to have core functions only available as apps or extensions is fundamentally wrong. Core functions should always be maintained and supported together with the “core”, not outsourced to the community. Heck, the full-text search is an “app”.
This slowly changed with the introduction of Nextcloud AIO and I’m equally convinced it would be a perfect fit for Cloudron.

Not only I agree 100% but this is exactly what keeps me from FULLY use the potential of this beast. Of course I use it, but not as much as I could and as I should indeed, as a complete replacement for MS and G.

That said, this app alone is a great sales point for a WIDE market of potential client for Cloudron. Still one at the TOP of Popular apps on the Apps Store's list, and anyone can potentially build an entire business offering only NextCloud hosting services to clients, this is a market that keeps growing.

Both these contribute to create, as @jdaviescoates says, this actual love/hate relationship one have with NextCloud, nevertheless considering the potential of the app I believe all this should be considered very seriously specially as the very nature of the app is kind of critical for its users when in production use.

My point would be we need to do all that can be done to at least KEEP alive the popular apps we already have on Cloudron. I know, there's not much that can be done against the rapid development of technology, however at least for the popular apps when technology forces changes Cloudron should bring a closer attention and make everything possible to keep the app running smoothly with Cloudron as usual.

Also, envision what's coming with the actual trends in app development, and foresee to be able to adapt quickly enough for the coming flood of apps, so Cloudron can stay ahead of the "flood" of 'panels' coming out there

[necrevistonnezr]

to add to this: This would be a unique selling point for Cloudron - AFAIK none of the competitors who promise to deliver easy self-hosting have Nextcloud AIO (at least not reliably working)

[necrevistonnezr]

Interesting: 29.0.5 is not listed here (anymore): https://nextcloud.com/changelog/
but here: https://github.com/nextcloud/server/releases/tag/v29.0.5

[necrevistonnezr]

They recognized the error (probably the one @girish mentioned above) and will got straight to 29.0.6 (and 30….): https://help.nextcloud.com/t/rc1-of-29-0-6-available/202059

[necrevistonnezr]

29.06 seems to be released now: https://nextcloud.com/changelog/

[nebulon]

Unfortunately it seems to have the same issue still. The issue is, that the very first login attempt for LDAP users throws an error, subsequent logins work fine. We are investigating...

[necrevistonnezr]

29.0.6 is (now) also a security update:
As per https://adv-archiv.dfn-cert.de/adv/2024-2304/:

2024-2304: Nextcloud Server: A vulnerability allows spying on information
History: Version 1 (2024-09-04 18:17)

Description:
An attacker can remotely exploit a vulnerability to circumvent security measures.
No privileges are required for the exploitation of the vulnerability.
The manufacturer confirms the vulnerability and has released Nextcloud Server 29.0.6 as a security update.

For Fedora 39 and 40, security updates in the form of 'nextcloud-29.0.6-2' packages are available and for Fedora EPEL 9 the package 'nextcloud-29.0.6-1.el9' in the 'testing' status to fix the vulnerability.

Vulnerabilities:
CVE-2024-39338
Vulnerability in Axios enables server-side request-forgery (SSRF) attack

[girish]

The packaging issue was reported upstream at https://github.com/nextcloud/server/issues/47768

[nebulon]

We managed to mitigate this issue by ensuring cron.sh was run at least once on first start. It is unclear how it is connected to the ldap login, but it solved it. Further it mitigates a warning in the first 5min in the admin section that the cronjob was last run years ago

[necrevistonnezr]

Fantastic! (btw it seems that 29.0.7 is around the corner... )

[girish]

It seems 30 is out! I think we will take the change to switch to OIDC now. Just have to figure out what is the migration strategy for people who use groups.

[LoudLemur]

Nextcloud Hub9 was launched this morning with lots of great features, including federation of Talk.