Update Nextcloud to 29.0.9

[pachulo]

https://nextcloud.com/changelog/#latest29

[pachulo]

Updated my instance and hit this bug, so I think we will skip this version.

[mritzmann]

so I think we will skip this version

Isn't 29.0.9 a security release that should not be skipped?

From the 29.0.9 blog post, which is also in the security category:

we strongly recommend you to update to version 28.0.12, 29.0.9 or 30.0.2 respectively. Maintenance updates include important bug fixes, stability and security upgrades. It is a quick and safe process, as always!

[pachulo]

we strongly recommend you to update to version 28.0.12, 29.0.9 or 30.0.2 respectively. Maintenance updates include important bug fixes, stability and security upgrades.

Yes indeed, but that's a canned message they usually write.

I can't see any security advisory in https://github.com/nextcloud/security-advisories/security/advisories or any fix with the security tag on the corresponding milestone.

It is a quick and safe process, as always!

And this part isn't always true, either. 🤣

Anyway, an option will be to move to the latest/stable channel, were we will be updating it to 30.0.2, which is not affected by this bug.

[mritzmann]

Yes indeed, but that's a canned message they usually write.

Indeed 🙈

I can't see any security advisory

I wouldn’t rely on the security advisories, as security advisories are sometimes (or always?) only made public after three months after patching. For me, this means every single patch release is essentially a security release.

Example Timeline for GHSA-9v72-9xv5-3p7c:

• 28.03.2024: They fixed the security problem in Nextcloud v28.0.4
• 14.06.2024: Three months later the Security-Advisories was publised

(A bit off-topic: Honestly, I still don’t fully understand how I’m supposed to manage this as the admin of a Nextcloud installation. On one hand, I want to keep my installation free of bugs, so I often prefer to skip faulty releases. But on the other hand, Nextcloud requires me to install every patch release because I can’t tell if it’s a security release or not.)

[pachulo]

I wouldn’t rely on the security advisories, as security advisories are sometimes (or always?) only made public after three months after patching. For me, this means every single patch release is essentially a security release.

That's indeed a very good point; at least we know it's not affected by any public vulnerabilities and we will have a new version in less than a month. And I know this is far from ideal.

(A bit off-topic: Honestly, I still don’t fully understand how I’m supposed to manage this as the admin of a Nextcloud installation. On one hand, I want to keep my installation free of bugs, so I often prefer to skip faulty releases. But on the other hand, Nextcloud requires me to install every patch release because I can’t tell if it’s a security release or not.)

Let me just tell you that you are not alone: I myself keep my instance on the latest-1 version, because regressions like this one are more likely to happen on the shinny major versions. But, as we have seen here, regressions also slip into the oldest versions.

Related to this: long ago I proposed the creation of a new channel: oldest-supported, where you, as a nextcloud admin, could forget about having to jump from channels and always got a version which has already had multiple point releases, lessening the chances of hitting regressions as much as possible (without having to buy Nextcloud enterprise I mean). But in the end we didn't find a solution which was not manual 😢 .

Anyway, would you be interested in collaborating in such chore @mritzmann ? Because back in the day my feeling was that I was like the only one using old channels and refreshing manually when I felt like.

[mritzmann]

I'm sorry, but I don't have enough resources (in terms of time) due to studying and so on 😮‍💨

[pachulo]

I decided that, as not many of our users use the channels for old versions, we will be publishing this even with the PDF viewer regression anyway, because it's not such a big deal for me or @mritzmann .

[pachulo]

Well, more proof that this was not an easy call @mritzmann ... 😓 nextcloud/server#49498 (comment)