docs: add server release notes for 10.16.4 - #199
Merged
Conversation
10.16.4 was published 2026-07-29 as a security release. It carries a critical fix for the legacy chunked WebDAV upload path, which did not enforce the filename blacklist, plus the subadmin email-change fix. Uses a flat "Security Fixes" list rather than the nested Security:/Bugfix: grouping of the 10.16.3 block, matching the 10.16.1 and 10.15.2 shape - with only two entries the nesting adds no clarity. The GHSA advisories are not linked because both are still in triage/draft and their URLs are not publicly reachable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
phil-davis
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add release notes for ownCloud Classic 10.16.4, published 2026-07-29. The page previously stopped at 10.16.3, so admins had no rendered page telling them what changed or that they should upgrade.
10.16.4 is a security release. It carries a critical fix for the legacy chunked WebDAV upload path, which assembled the final file without honouring the pre-write hook veto — so the filename blacklist enforced on ordinary uploads was bypassable via chunking.
Changes
modules/ROOT/pages/server_release_notes.adoc— new== Changes in 10.16.4section inserted above 10.16.3 (newest first), covering owncloud/core#41763 and owncloud/core#41574.Notes on style
=== Security Fixeslist rather than the nested* Security:/* Bugfix:grouping of the 10.16.3 block. That nesting exists because 10.16.3 had six entries across categories; with two entries the flat form (same shape as the 10.16.1 and 10.15.2 blocks in this file) reads better.triage/draft, so their URLs 404 for the public. PR links are what this file uses throughout.Verification
Rendered locally with asciidoctor — no warnings or errors. Confirmed in the output HTML:
<h2 id="_changes_in_10_16_4">appears before_changes_in_10_16_3IMPORTANTadmonition renders asadmonitionblock important=== Security Fixesrenders as a[discrete]<h3>(excluded from the TOC, as intended){oc-changelog-url}is substituted correctly+line continuations keep each description attached to its bulletRelated
latest-server-download-versionto 10.16.4master🤖 Generated with Claude Code