chore: bump Nextcloud to 33.0.8; 33.0.7:0 → 33.0.8:0

[helix-nine]

Bumps the bundled Nextcloud image from 33.0.7 to 33.0.8, releasing as StartOS version 33.0.8:0.

Per UPDATING.md, the pin is the NEXTCLOUD_VERSION ARG default in nextcloud.Dockerfile.

Upstream

• nextcloud:33.0.8-apache is published (2026-08-14) and resolves for amd64 and arm64.
• Still the 33 maintenance line. 34.0.3 exists, but the 34 major bumps have been closed repeatedly (chore: bump Nextcloud to 34.0.0; 33.0.5:0 → 34.0.0:0 #112, chore: bump Nextcloud to 34.0.0; 33.0.5:0 → 34.0.0:0 #113, chore: bump Nextcloud to 34.0.1; 33.0.5:0 → 34.0.1:0 #114, chore: bump Nextcloud to 34.0.2 (major, 33 → 34); 33.0.6:2 → 34.0.2:0 #123), and UPDATING.md describes this as a patch bump — so this stays on 33.
• The 33 image is still FROM php:8.4-apache-trixie with imagick-3.8.1; nothing changed in the image beyond the version.
• Postgres (postgres:17-alpine) and Valkey (valkey/valkey:9-alpine) track floating majors and are unchanged.

The 33.0.7 known issue is resolved. 33.0.7 shipped server#62148, which hard-returned false from IMagickSupport::hasExtension() and supportsFormat(), disabling ImageMagick previews. In v33.0.8 both early returns are gone, so thumbnails for PDF, SVG, TIFF, HEIC, PSD and the rest work again. Verified by diffing lib/private/Preview/IMagickSupport.php between the two tags.

Other notable backports: sharing fixes (missing recipient/owner no longer breaks a share, rejected shares stay rejected), encryption fixes (zero-byte encrypted files reported the wrong size), security hardening (host/IP validation, code signing revocation list, admin permission required for all system tag changes), plus federated calendar accept/decline and a setting to skip password confirmation on selected IP ranges. Full changelog.

Also in this release

• Cleared the abandoned nextcloud:create-admin-user task replay key — the TODO.md item recorded in 254ec77, folded into this release's migrations.up as it asked. The action was renamed create-admin-user → get-admin-credentials in 479c4e1, orphaning the old replay key; nothing reaps it, and because the id no longer exists the task can never be resolved or run away. sdk.action.clearTask is a free no-op where the key is absent. Confirmed safe inside a migration: clear_tasks in start-core is a pure DB mutation with no services.get, so it can't hit the create_task init deadlock. TODO.md is now empty.
• Refreshed the filebrowser-startos#next pin eee37f2 → c35ff45 (File Browser 2.63.23:0, start-sdk 2.0.9). Its versionRange stays ^2.62.2:1 — nothing in its contract changed, and raising the floor would needlessly exclude working installs.
• Fixed a stale action id in the README's AI quick-reference, which still listed create-admin-user instead of get-admin-credentials — the same rename this release cleans up after.
• No SDK bump: @start9labs/start-sdk is already pinned at 2.0.9, the latest on npm. The package-lock.json growth is the SDK's bundled @start9labs/start-core subtree being recorded (16 additive inBundle entries, 0 removals) — the slot's node_modules had been stale at 2.0.7. npm ci is green and there is exactly one SDK copy in the tree.

Version placement

33.0.7:0 is tagged (v33.0.7_0) and is the registry's current best, so 33.0.8:0 is free. current.ts is edited in place rather than freezing 33.0.7:0 into other[]: the added clearTask is idempotent and purely additive, migrateFrom035x is retained on current unchanged, and this matches how every prior 33.0.x bump in this repo was shipped.

Test plan

• npm run check green (33.0.8:0).
• npm ci from the committed lockfile succeeds.
• nextcloud:33.0.8-apache verified present on Docker Hub for amd64 + arm64.
• make / install-and-upgrade smoke test (PR review).