chore: bump Nextcloud to 34.0.2 (major, 33 → 34); 33.0.6:2 → 34.0.2:0

[helix-nine]

Bumps the bundled Nextcloud image from 33.0.6 to 34.0.2, releasing as StartOS version 34.0.2:0.

This is a major upstream bump — 33 → 34, picking up 34.0.0, 34.0.1 and 34.0.2 in one step. An earlier revision of this description called it a 33.0.7 maintenance release; that was wrong and is corrected below.

Per UPDATING.md, the pin is the NEXTCLOUD_VERSION ARG default in nextcloud.Dockerfile.

• nextcloud:34.0.2-apache publishes amd64 and arm64.
• Postgres (postgres:17-alpine) and Valkey (valkey/valkey:9-alpine) track floating majors and are unchanged. Nextcloud 34's system requirements still list PostgreSQL 14–18, so 17 remains supported.

What crossing the major actually costs

PHP moves 8.4 → 8.5 inside the image. nextcloud:33.0.6-apache is FROM php:8.4-apache-trixie; 34.0.2-apache is FROM php:8.5-apache-trixie (nextcloud/docker#2580). 8.5 is 34's recommended version. The floor is unchanged — lib/versioncheck.php is byte-identical between v33.0.6 and v34.0.2 (≥ 8.2, < 8.6).

Removed APIs. 34 drops the globally-shared jQuery, jQuery UI, Backbone, Handlebars and OC.Files.Client, plus back-end \OCP\Share_Backend*, several EmptyContentSecurityPolicy methods, IManager::registerResourceProvider, Notification\IManager::registerNotifier and a batch of \OC_Util statics. Third-party apps that still use them will need their own updates. (critical changes)

No dropped platforms, no removed apps. Same PHP floor, same supported database versions, and core/shipped.json between v33.0.6 and v34.0.2 is additions only.

Migrations run on first start. core/Migrations/Version34000* converts oc_jobs.argument to TEXT, swaps a unique index on oc_mounts, and adds job_classes_registry and job_runs. The oc_jobs conversion can be slow on an instance with a large jobs table.

Changed default worth knowing: minimum.supported.desktop.version goes 3.1.50 → 3.2.50, so desktop clients older than 3.2.50 are refused by default.

Diff contents

• nextcloud.Dockerfile — NEXTCLOUD_VERSION 33.0.6 → 34.0.2.
• startos/versions/current.ts — version and release notes, all five locales.
• startos/actions/maintenance/disableUnstableApps.ts — adds appstore, files_lock and office to the preserved-defaults list. These are exactly the three apps 34 adds to shippedApps/defaultEnabled in core/shipped.json, so without this the action would disable apps Nextcloud ships enabled.
• README.md — the preserved-defaults count in the action's description. The list is 55 entries on master and 58 here; the old "~48" was already stale.
• package-lock.json — refreshes the filebrowser-startos#next git pin (eee37f2 → c35ff45), which also moves that dependency's own start-sdk pin 2.0.7 → 2.0.9, matching this package's root pin. package.json is unchanged (the dep floats on #next). The remaining churn is ~150 additive inBundle entries for start-sdk's bundled @start9labs/start-core subtree — no version changes, nothing removed, and npm ci succeeds from the committed lock.

@start9labs/start-sdk is already at 2.0.9, so there is no SDK bump here.

No new StartOS migration

current.ts is edited in place. The rule is that a new version file is only needed when the bump carries new up/down migration logic — this one carries none, so the existing migrations are untouched. (That is still true for a major upstream bump; the majorness is Nextcloud's, not the package layout's.)

Two things to decide before this merges

1. This cannot be the release a StartOS 0.3.5.x user lands on. Nextcloud refuses to skip a major, and it is enforced in code, not just documented — version.php at v34.0.2 declares $OC_VersionCanBeUpgradedFrom = ['33.0' => true, '34.0' => true]. A 0.3.5.x instance is on Nextcloud 32.0.11, so this package's own guard fires first:

startos/init/bootstrapNextcloud.ts:165
if (image[0] > installed[0] + 1) throw new Error(
  `Cannot update Nextcloud from major version ${installed[0]} directly to ${image[0]}. …`)

Init fails and the update rolls back. The 0.3.5.x layout migration in the version graph runs before that throw, so those users would burn a full permissions walk and end up back where they started. They need a 33.x release to step through first — which makes #121 (33.0.6:3, the 0.3.5.x migration fix) a prerequisite, not a parallel change. I have not exercised that path on a VM; it is a read of the two guards above.

2. 34.0.2 ships with ImageMagick previews disabled. Upstream merged fix: Disable imagick preview providers (nextcloud/server#62145, backported to stable34 as #62147) as a security stopgap; IMagickSupport::hasExtension() and supportsFormat() both return false at v34.0.2. PreviewManager::registerCoreProviders() gates the whole imagick block on that, so PDF, SVG, TIFF, PSD, EPS, TTF, HEIC/HEIF, TGA and SGI previews are all gone, not just HEIC — PDF thumbnails being the one users will notice. PNG/JPEG/GIF/BMP/WebP/video are unaffected. The re-enable (#62600, with magic-byte checks) merged to master on 2026‑07‑28 and its stable34 backport #62620 merged 2026‑07‑29, but no 34.0.3 tag exists yet. Waiting for 34.0.3 would avoid shipping a known preview regression.

An earlier revision of this description attributed this to #62148/#62619 and said it should land in 33.0.8 — those are the stable33 backports; the 34-line numbers are the ones above.

Security

No published CVE or GitHub advisory names 34.0.0, 34.0.1 or 34.0.2. I pulled all 275 published advisories from nextcloud/security-advisories; none list a 34.x version as vulnerable or patched, and none were published after 2026‑06‑08. That is not evidence 34.0.x fixed nothing — upstream's stated policy is to publicise CVEs about three weeks after a release, and 34.0.2 is six days old. 34.0.2 does carry unattributed hardening: sabre/xml callable-deserialization disabled, federated-share creation rate limiting, user-search disclosure tightening, and a code-signing revocation list plus CA bundle refresh.

Test plan

• npm run check — green.
• npm ci from the committed lockfile — succeeds, one @start9labs/start-sdk copy on disk at 2.0.9.
• Registry checked: 34.0.2:0 is unpublished (current published version is 33.0.6:2).
• Not yet done: no VM install/upgrade run against this build, and specifically no 33 → 34 upgrade exercised end-to-end.

Full upstream changelogs: 34.0.0 · 34.0.1 · 34.0.2