IONOS(update): update IONOS-owned app submodules for Nextcloud v32 (NSW-946)

[printminion-co]

Note

Stacked PR 3 of 3 — top of the stack. This PR targets mk/dev/NSW-945-vanilla-apps-nc32 (the head of #323), not ionos-dev-v32.

ionos-dev-v32
 └─ #322  NSW-944  IONOS delta on vanilla v32.0.14
     └─ #323  NSW-945  vanilla app submodules
         └─ #324  NSW-946  IONOS-owned app submodules

The diff and commit list below therefore contain only this PR's own 6 submodule bumps. Review #322 and #323 first.

Summary

Third and last piece of the v32 upgrade: the twelve apps-external/ submodules whose URL points
at an IONOS-Productivity/* repo. Four of them declared max-version="31" and would have refused
to enable on NC32.

Stacked on #323 (NSW-945), which is stacked on #322 (NSW-944). ionos-dev-v32 is bare vanilla
v32.0.14 with no apps-external submodules at all — those arrive in #322 — so this branch could
not be cut from it directly.

Audit of all twelve IONOS-owned apps

max is appinfo/info.xml max-version before this PR. "IONOS delta" = commits on the fork's
ionos-dev that are not upstream.

App	Fork repo	max	IONOS delta	Action
activity	nc-activity	31	1 commit — lib/Settings/Admin.php	rebased onto v32.0.14
bruteforcesettings	nc-bruteforcesettings	31	1 commit — lib/Settings/IPWhitelist.php	rebased onto v32.0.14
password_policy	nc-password_policy	31	1 commit — lib/Settings/Settings.php	rebased onto v32.0.14
notifications	nc-notifications	31	none	re-based at v32.0.14, no cherry-pick
ncw_apps_menu	ncw-apps-menu	32	custom app	nextcloud/ocp → dev-stable32
ncw_mailtemplate	ncw-mailtemplate	32	custom app	nextcloud/ocp → dev-stable32
forms	nc-forms	32	none (== upstream v5.2.0)	verified, no change
assistant	nc-assistant	33	2 commits	verified, no change
user_oidc	nc-user_oidc	33	4 commits	verified, no change
user_saml	nc-user_saml	33	8 commits	verified, no change
mail	ncw-mail	33	726 commits	verified, no change
ncw_tools	ncw-tools	33	custom app	verified, no change

All twelve now report max-version >= 32. Every verify-only app is pinned at its fork's branch
tip, so none were stale.

Removed-API audit — clean across all twelve. No OC_Helper::, no OC_Template /
OCP\Template / OC_Util::add*, no appinfo/app.php, no /apps/files/api/v1/thumbnail.

Reconciliation of the three real deltas

All three are the same patch: implements ISettings → IDelegatedSettings, plus getName() and
getAuthorizedAppConfig(). They pair with IONOS(admin-delegation): add delegated settings support to Settings and NavigationManager in #322.

All three were kept, none dropped. Upstream has not absorbed them — at v32.0.14 all three
classes still read implements ISettings. IDelegatedSettings itself is byte-identical between
v31 and v32, so the patches are semantically valid as-is.

bruteforcesettings conflicted: NC32 added #[\Override] attributes to that class, moving the
hunk context. Resolved by keeping them and applying #[\Override] to the two new methods too.
activity auto-merged and got the same treatment for consistency. password_policy has no
#[\Override] at v32, so none were added.

Two forks carry no IONOS code

nc-notifications and nc-forms are vanilla mirrors wearing a fork URL — git diff origin/stable31 origin/ionos-dev in nc-notifications is empty, and nc-forms/ionos-dev is
exactly upstream v5.2.0. Neither has a single IONOS-authored commit. Both forks are kept for now
per the ticket scope; de-forking them is worth its own ticket, adjacent to NSW-962.

On the two ncw-* composer bumps

These apps were already NC32-compatible and CI already Psalms them against stable32 —
psalm-matrix.yml derives its matrix from info.xml rather than from composer.json. The bump
aligns local composer psalm runs with CI; it is not a coverage fix.

Depends on

• IONOS(activity): NC32 fork release (NSW-946) nc-activity#2
• IONOS(bruteforcesettings): NC32 fork release (NSW-946) nc-bruteforcesettings#2
• IONOS(password_policy): NC32 fork release (NSW-946) nc-password_policy#2
• chore: bump nextcloud/ocp to dev-stable32 (NSW-946) ncw-apps-menu#40
• chore: bump nextcloud/ocp to dev-stable32 (NSW-946) ncw-mailtemplate#25

All five are merged. Every gitlink in this PR now points at a fork tag or a merge commit — none
at a PR head:

submodule	gitlink	ref
activity	e88a7517	tag v32.0.14-e88a751
bruteforcesettings	90d00db1	tag v32.0.14-90d00db
password_policy	aba443b7	tag v32.0.14-aba443b
notifications	b87d0372	tag v32.0.14-b87d037
ncw_apps_menu	7115c949	tag v1.0.0-7115c94
ncw_mailtemplate	bcb0bb2c	merge commit of ncw-mailtemplate#25

The three new tags are prereleases on each fork's ionos-dev-v32 tip; each tip is upstream
v32.0.14 plus the single IONOS delegated-settings commit, and each declares
min-version="32" max-version="32". notifications needed no PR — the fork carries no IONOS
commits.

Checklist

• merge the five app-repo PRs above
• repoint the activity / bruteforcesettings / password_policy gitlinks at their v32.0.14-<sha7> fork tags
• repoint the ncw_apps_menu / ncw_mailtemplate gitlinks at their merge commits
• run .dev/container/check_release.sh pr-<this PR> ncw — validate pr locally
• on the artifact: occ app:list shows all twelve enabled
• on the artifact: occ admin-delegation:show lists the Activity, brute-force IP allowlist and Password Policy sections, and a delegated non-admin sees exactly those

Spotted, not fixed here

• ncw-mailtemplate's update-nextcloud-ocp-matrix.yml targets stable30, three majors behind — which is why that dependency drifted.
• ncw-mail is on a 5.5.11 base while the fork already carries a v5.6.14 tag. Not a v32 blocker (declares 30-33).

Jira: NSW-946

[printminion-co]

Progress

Merged and finalised:

• chore: bump nextcloud/ocp to dev-stable32 (NSW-946) ncw-apps-menu#40 merged → gitlink now pins tag v1.0.0-7115c94 (was the PR head)
• chore: bump nextcloud/ocp to dev-stable32 (NSW-946) ncw-mailtemplate#25 merged → gitlink now pins master merge commit bcb0bb2cd822f81f62744da89892d20348a02557

Both moved off PR heads; branch force-pushed.

Cypress failures on nc-activity#2 are base failures — verified, not assumed.

Control PR IONOS-Productivity/nc-activity#3 contained bare upstream v32.0.14 with zero file
changes and failed the same two jobs:

	runner 1	runner 2
nc-activity#2 (with IONOS delta)	fail	fail
nc-activity#3 (bare v32.0.14)	fail	fail

The delta touches only lib/Settings/Admin.php; the failing spec exercises the user
notification page rendered by lib/Settings/Personal.php. Control PR closed.

Psalm failure on nc-password_policy#2 is likewise a base failure. It dies in
composer require --dev roave/security-advisories because vanilla composer.json requires
nextcloud/ocp: dev-master (PHP ~8.3+) against config.platform.php: 8.1 — and
git diff v32.0.14..HEAD -- composer.json composer.lock on that branch is empty.

Still open: merge nc-activity#2, nc-bruteforcesettings#2, nc-password_policy#2, then cut their
v32.0.14-<sha7> tags and repoint those three gitlinks.

[printminion-co]

The three fork PRs cannot reach all-green — and never could

Their checks are not slow, they are stuck. These forks inherit upstream Nextcloud workflows that
pin runs-on: ubuntu-latest-low, a runner label the IONOS-Productivity org does not provide
(actions/runners reports 0). Those jobs queue indefinitely.

Fork	jobs on ubuntu-latest-low (stuck)	jobs on ubuntu-latest (run)
nc-activity	30	22
nc-bruteforcesettings	32	17
nc-password_policy	26	16

Pre-existing, not caused by this work: nc-bruteforcesettings has never once had a successful
PHPUnit run — the sole attempt, on kh/dev/delegate-admin-settings in Feb 2026 (the branch that
produced the commit cherry-picked here), was cancelled.

What the runnable checks actually say

PR	Green	Red
nc-activity#2	static-psalm-analysis, php-cs, stylelint, init	Cypress runner 1/2 — base failure, proven by control PR
nc-bruteforcesettings#2	static-psalm-analysis, php-cs, stylelint, Build and deploy	none
nc-password_policy#2	php-cs, stylelint, openapi	static-psalm-analysis — base failure, dies in dependency install

Psalm is green on activity and bruteforcesettings — the check that would catch a broken
IDelegatedSettings implementation. On password_policy Psalm never reached the analysis phase, so
it says nothing either way about the delta.

No failure anywhere is attributable to the IONOS delta. Waiting for green is not a viable gate;
these three are ready for human review as they stand.

Adding to the follow-up list: the IONOS forks of Nextcloud apps have no runner for
ubuntu-latest-low, so roughly two-thirds of their inherited CI has never executed. That is a
standing blind spot across every nc-* fork, not just these three.

[printminion-co]

Ready for review.

The PR map, the review order and the merge order across all six PRs are in one note on the
root PR: #322 (comment)

Short version: review #322 → #323 → #324 (the last together with the three fork PRs); merge the
fork PRs first, then #322 → #323 → #324.

[printminion-co]

Upstreaming status for the three delegation forks

The three fork PRs this server PR consumes each re-apply the same one-file IONOS patch — an admin settings class switching from ISettings to IDelegatedSettings. All three are now on their way upstream, so the delta can eventually be dropped rather than re-applied at every NC major.

App	NC32 fork PR (this stack)	Internal review PR	Upstream PR	Jira
activity	IONOS-Productivity/nc-activity#2	IONOS-Productivity/nc-activity#4	nextcloud/activity#2885	NSW-808
bruteforcesettings	IONOS-Productivity/nc-bruteforcesettings#2	(closed unmerged, #4)	nextcloud/bruteforcesettings#1246	NSW-809
password_policy	IONOS-Productivity/nc-password_policy#2	IONOS-Productivity/nc-password_policy#3	nextcloud/password_policy#1023	NSW-813

Each upstream PR is a single commit against the app's current master, one file, authored by Kai Henseler with the original Signed-off-by preserved, reworded to Conventional Commits with all IONOS/NSW tokens and fork-internal references stripped, per .dev/docs/how-to/upstream-to-vanilla-app.md. No ncw-config ADMIN_DELEGATION_MAP registration is carried upstream, so each change stands on its own.

This does not change anything in this PR. The gitlinks here still point at the fork line, and must keep doing so until Nextcloud merges and releases each change on a branch we consume. The three Jira tickets are parked in the "Waiting for NC/Collabora" sprint to track that.