Merge remote-tracking branch 'origin/master' into fix/skip-RemoveBrokenProperties-if-already-run

Author: kyteinsky

.github/CODEOWNERS

@@ -10,7 +10,7 @@
 /__mocks__                                    @nextcloud/server-frontend
 /__tests__                                    @nextcloud/server-frontend
 /dist                                         @nextcloud/server-frontend
-/cypress                                      @nextcloud/server-frontend
+/tests/playwright                             @nextcloud/server-frontend
 **/css                                        @nextcloud/server-frontend
 **/js                                         @nextcloud/server-frontend
 **/src                                        @nextcloud/server-frontend
@@ -25,7 +25,7 @@ package-lock.json                             @nextcloud/server-dependabot
 
 # App maintainers
 /apps/admin_audit/appinfo/info.xml            @luka-nextcloud @samin-z
-/apps/cloud_federation_api/appinfo/info.xml   @nfebe @mejo-
+/apps/cloud_federation_api/appinfo/info.xml   @mejo-
 /apps/comments/appinfo/info.xml               @edward-ly @sorbaugh
 /apps/contactsinteraction/appinfo/info.xml    @kesselb @SebastianKrupinski
 /apps/contactsinteraction/lib                 @kesselb @SebastianKrupinski
@@ -37,17 +37,17 @@ package-lock.json                             @nextcloud/server-dependabot
 /apps/dav/tests/unit/CardDAV                  @hamza221 @SebastianKrupinski
 /apps/encryption/appinfo/info.xml             @come-nc @icewind1991
 /apps/federatedfilesharing/appinfo/info.xml   @icewind1991 @danxuliu
-/apps/federation/appinfo/info.xml             @nfebe @sorbaugh
-/apps/files/appinfo/info.xml                  @skjnldsv @ArtificialOwl @come-nc @artonge @icewind1991 @szaimen @susnux @nfebe
+/apps/federation/appinfo/info.xml             @sorbaugh
+/apps/files/appinfo/info.xml                  @skjnldsv @icewind1991 @szaimen @susnux
 /apps/files_external/appinfo/info.xml         @icewind1991 @artonge
 /apps/files_reminders/appinfo/info.xml        @skjnldsv @sorbaugh
-/apps/files_sharing/appinfo/info.xml          @skjnldsv @come-nc
+/apps/files_sharing/appinfo/info.xml          @skjnldsv @provokateurin
 /apps/files_trashbin/appinfo/info.xml         @icewind1991 @sorbaugh
 /apps/files_versions/appinfo/info.xml         @artonge @icewind1991
 /apps/oauth2/appinfo/info.xml                 @julien-nc @ChristophWurst
 /apps/provisioning_api/appinfo/info.xml       @provokateurin @nickvergessen
 /apps/settings/appinfo/info.xml               @hweihwang @sorbaugh
-/apps/sharebymail/appinfo/info.xml            @Altahrim @skjnldsv
+/apps/sharebymail/appinfo/info.xml            @provokateurin @skjnldsv
 /apps/systemtags/appinfo/info.xml             @Antreesy @marcelklehr
 /apps/theming/appinfo/info.xml                @skjnldsv @juliusknorr
 /apps/twofactor_backupcodes/appinfo/info.xml  @miaulalala @ChristophWurst

.github/ISSUE_TEMPLATE/BUG_REPORT.yml

@@ -26,14 +26,16 @@ body:
       label: "⚠️ This issue respects the following points: ⚠️"
       description: All conditions are **required**. Your issue can be closed if these are checked incorrectly.
       options:
-        - label: This is a **bug**, not a question or a configuration/webserver/proxy issue.
+        - label: This is **not** a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug _(if unsure, ask the [Community Help Forum](https://help.nextcloud.com))_.
           required: true
-        - label: This issue is **not** already reported on [Github](https://github.com/nextcloud/server/issues?q=is%3Aopen+is%3Aissue+label%3Abug) OR [Nextcloud Community Forum](https://help.nextcloud.com/) _(I've searched it)_.
+        - label: This issue is **not** already reported on [Github](https://github.com/nextcloud/server/issues?q=is%3Aissue+label%3Abug) OR solved at the [Community Help Forum](https://help.nextcloud.com/) _(I've searched!)_.
           required: true
-        - label: Nextcloud Server **is** up to date. See [Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) for supported versions.
+        - label: I'm using a maintained major version of Nextcloud Server **and** tested against the latest patch level. _([Supported major versions and current patch levels](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule))_.
           required: true
         - label: I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/).
           required: true
+        - label: I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.
+          required: true
   - type: textarea
     id: bug-description
     attributes:
@@ -74,7 +76,8 @@ body:
         - "32"
         - "33"
         - "34"
-        - "35 (master)"
+        - "35"
+        - "36 (master)"
     validations:
       required: true
   - type: dropdown

.github/dependabot.yml

@@ -16,6 +16,8 @@ updates:
   labels:
     - "3. to review"
     - "feature: dependencies"
+  cooldown:
+    default-days: 7
 
 # Main composer (linting, testing, openapi)
 - package-ecosystem: composer
@@ -35,6 +37,10 @@ updates:
   labels:
     - "3. to review"
     - "feature: dependencies"
+  open-pull-requests-limit: 20
+  versioning-strategy: increase
+  cooldown:
+    default-days: 7
 
 # Main master npm frontend dependencies
 - package-ecosystem: npm
@@ -47,10 +53,11 @@ updates:
     day: saturday
     time: "03:00"
     timezone: Europe/Paris
-  open-pull-requests-limit: 20
   labels:
     - "3. to review"
     - "feature: dependencies"
+  open-pull-requests-limit: 20
+  versioning-strategy: increase
   # Disable automatic rebasing because without a build CI will likely fail anyway
   rebase-strategy: "disabled"
   cooldown:
@@ -74,7 +81,7 @@ updates:
 
 # Composer dependencies for linting and testing
 - package-ecosystem: composer
-  target-branch: stable34
+  target-branch: stable35
   directories:
     - "/"
     - "/vendor-bin/behat"
@@ -88,6 +95,8 @@ updates:
     day: saturday
     time: "03:30"
     timezone: Europe/Paris
+  cooldown:
+    default-days: 7
   labels:
     - "3. to review"
     - "feature: dependencies"
@@ -98,7 +107,7 @@ updates:
 
 # frontend dependencies
 - package-ecosystem: npm
-  target-branch: stable34
+  target-branch: stable35
   directories:
     - "/"
     - "/build/frontend"
@@ -111,10 +120,11 @@ updates:
   cooldown:
     default-days: 4
     semver-major-days: 8
-  open-pull-requests-limit: 20
   labels:
     - "3. to review"
     - "feature: dependencies"
+  open-pull-requests-limit: 20
+  versioning-strategy: increase
   # Disable automatic rebasing because without a build CI will likely fail anyway
   rebase-strategy: "disabled"
   groups:
@@ -133,6 +143,58 @@ updates:
 
 # Older stable releases
 
+# Composer dependencies for linting and testing
+- package-ecosystem: composer
+  target-branch: stable34
+  directories:
+    - "/"
+    - "/vendor-bin/behat"
+    - "/vendor-bin/cs-fixer"
+    - "/vendor-bin/openapi-extractor"
+    - "/vendor-bin/phpunit"
+    - "/vendor-bin/psalm"
+  schedule:
+    interval: weekly
+    day: saturday
+    time: "04:30"
+    timezone: Europe/Paris
+  cooldown:
+    default-days: 7
+  labels:
+    - "3. to review"
+    - "feature: dependencies"
+  ignore:
+    # only patch updates on stable branches
+    - dependency-name: "*"
+      update-types: ["version-update:semver-major", "version-update:semver-minor"]
+
+# frontend dependencies
+- package-ecosystem: npm
+  target-branch: stable34
+  directories:
+    - "/"
+    - "/build/frontend"
+    - "/build/frontend-legacy"
+  schedule:
+    interval: weekly
+    day: saturday
+    time: "04:30"
+    timezone: Europe/Paris
+  cooldown:
+    default-days: 4
+    semver-major-days: 8
+  labels:
+    - "3. to review"
+    - "feature: dependencies"
+  open-pull-requests-limit: 20
+  versioning-strategy: increase
+  # Disable automatic rebasing because without a build CI will likely fail anyway
+  rebase-strategy: "disabled"
+  ignore:
+    # no major updates on stable branches
+    - dependency-name: "*"
+      update-types: ["version-update:semver-major"]
+
 # Composer dependencies for linting and testing
 - package-ecosystem: composer
   target-branch: stable33
@@ -148,6 +210,8 @@ updates:
     day: saturday
     time: "04:30"
     timezone: Europe/Paris
+  cooldown:
+    default-days: 7
   labels:
     - "3. to review"
     - "feature: dependencies"
@@ -159,7 +223,10 @@ updates:
 # frontend dependencies
 - package-ecosystem: npm
   target-branch: stable33
-  directory: "/"
+  directories:
+    - "/"
+    - "/build/frontend"
+    - "/build/frontend-legacy"
   schedule:
     interval: weekly
     day: saturday
@@ -168,10 +235,11 @@ updates:
   cooldown:
     default-days: 4
     semver-major-days: 8
-  open-pull-requests-limit: 20
   labels:
     - "3. to review"
     - "feature: dependencies"
+  open-pull-requests-limit: 20
+  versioning-strategy: increase
   # Disable automatic rebasing because without a build CI will likely fail anyway
   rebase-strategy: "disabled"
   ignore:
@@ -194,6 +262,8 @@ updates:
     day: saturday
     time: "04:30"
     timezone: Europe/Paris
+  cooldown:
+    default-days: 7
   labels:
     - "3. to review"
     - "feature: dependencies"

.github/workflows/ai-policy.yml

@@ -32,7 +32,9 @@ jobs:
       - name: Collect PR commit messages
         id: collect
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
           COMMITS_URL: ${{ github.event.pull_request.commits_url }}
         run: |
           set -euo pipefail
@@ -125,7 +127,9 @@ jobs:
       - name: Create 'AI assisted' label if absent
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
         run: |
           gh api "repos/${{ github.repository }}/labels" \
             --method POST \
@@ -137,11 +141,13 @@ jobs:
       - name: Label PR as AI assisted
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
         run: |
-          gh pr edit "${{ github.event.pull_request.number }}" \
-            --repo "${{ github.repository }}" \
-            --add-label "AI assisted"
+          gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels" \
+            --method POST \
+            -f "labels[]=AI assisted"
           echo "Added 'AI assisted' label to PR #${{ github.event.pull_request.number }}"
 
       - name: Fail on coding-agent Signed-off-by

.github/workflows/autocheckers.yml

@@ -20,7 +20,7 @@ jobs:
       src: ${{ steps.changes.outputs.src }}
 
     steps:
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: changes
         continue-on-error: true
         with:
@@ -48,13 +48,13 @@ jobs:
 
     steps:
       - name: Checkout server
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: true
 
       - name: Set up php
-        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc #v2.37.1
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #v2.37.2
         timeout-minutes: 5
         with:
           php-version: '8.3'
@@ -77,13 +77,13 @@ jobs:
 
     steps:
       - name: Checkout server
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           submodules: true
 
       - name: Set up php
-        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc #v2.37.1
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #v2.37.2
         timeout-minutes: 5
         with:
           php-version: '8.3'

.github/workflows/block-merge-freeze.yml

@@ -54,4 +54,4 @@ jobs:
 
       - name: Run check
         if: ${{ env.server_ref != '' }}
-        run: cat version.php | grep 'OC_VersionString' | grep -i -v 'RC'
+        run: cat version.php | grep 'OC_VersionString' | grep -i -v -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'

.github/workflows/block-outdated-3rdparty.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Check requirement
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: changes
         continue-on-error: true
         with:
@@ -31,7 +31,7 @@ jobs:
               - 'version.php'
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/block-unconventional-commits.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/codeql.yml

@@ -32,18 +32,18 @@ jobs:
           build-mode: none
     steps:
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+      uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
         config-file: ./.github/codeql-config.yml
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+      uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       with:
         category: "/language:${{matrix.language}}"