- Bugfix - Feature - Code style update (formatting, renaming) - Refactoring (no functional changes, no api changes) - Build related changes - Documentation content changes

.github/dependabot.yml

@@ -0,0 +1,64 @@
+# SPDX-FileCopyrightText: 2025 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# Dependabot configuration.
+#
+# The `ignore` entries below cover two advisories that cannot be fixed from this
+# repository. Dependabot's update job fails when it cannot produce a security
+# update, so leaving them enabled turns every run red:
+#
+#   undici 6.29.0  - reached only through semantic-release -> @semantic-release/npm
+#                    -> npm -> node-gyp. npm vendors this dependency inside its own
+#                    tarball (inBundle: true), so neither an `overrides` entry nor a
+#                    lockfile edit reaches it; `npm ci` restores 6.29.0. npm 11.21.1
+#                    and 12.2.1 both still bundle 6.29.0, so there is no release to
+#                    move to. Dependabot reports: "Security update not possible for
+#                    undici ... latest possible version is 6.29.0".
+#
+#   elliptic 6.6.1 - dev-only, via @nextcloud/vite-config -> node-stdlib-browser.
+#                    6.6.1 is the latest published version, so no fix exists.
+#                    Dependabot reports: "Security update not found for elliptic ...
+#                    dependency is up to date but still vulnerable".
+#
+# Revisit both when npm ships a patched undici, or when a patched elliptic is
+# published. The corresponding Dependabot alerts stay open as a reminder.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      npm_and_yarn:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # The range must cover the version Dependabot would try to move to, not
+      # just the vulnerable one: `ignore.versions` matches the *target* version,
+      # so "<6.29.1" would still attempt 6.29.1 and leave the job red. 6.29.1 is
+      # the earliest patched release and is unreachable here, so it is included.
+      - dependency-name: undici
+        versions:
+          - "<=6.29.1"
+      # 6.6.1 is the newest published version, so no fix exists yet. Scoped to
+      # this version range rather than the package, so a future patched release
+      # is still picked up automatically.
+      - dependency-name: elliptic
+        versions:
+          - "<=6.6.1"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch

.github/workflows/block-unconventional-commits.yml

@@ -1,6 +1,6 @@
 # This workflow is provided via the organization template repository
 #
-# https://github.com/LibreCodeCoop/.github
+# https://github.com/nextcloud/.github
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 #
 # SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors

.github/workflows/dependabot-approve-merge.yml

@@ -25,7 +25,7 @@ concurrency:
 jobs:
   auto-approve-merge:
     if: github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'renovate[bot]'
-    runs-on: ubuntu-latest-low
+    runs-on: ubuntu-latest
     permissions:
       # for hmarr/auto-approve-action to approve PRs
       pull-requests: write
@@ -38,12 +38,19 @@ jobs:
           exit 1
 
       # GitHub actions bot approve
+      # Best-effort: GITHUB_TOKEN cannot approve PRs when the repo setting
+      # "Allow GitHub Actions to create and approve pull requests" is disabled,
+      # so tolerate failure (Mergify queue handles the actual merge in this repo).
       - uses: hmarr/auto-approve-action@b40d6c9ed2fa10c9a2749eca7eb004418a705501 # v2
+        continue-on-error: true
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       # Nextcloud bot approve and merge request
+      # Best-effort: requires the DEPENDABOT_AUTOMERGE_TOKEN secret; tolerate
+      # failures so the check stays green instead of blocking Dependabot PRs.
       - uses: ahmadnassri/action-dependabot-auto-merge@45fc124d949b19b6b8bf6645b6c9d55f4f9ac61a # v2
+        continue-on-error: true
         with:
           target: minor
           github-token: ${{ secrets.DEPENDABOT_AUTOMERGE_TOKEN }}

.github/workflows/lint-eslint.yml

@@ -1,6 +1,6 @@
 # This workflow is provided via the organization template repository
 #
-# https://github.com/LibreCodeCoop/.github
+# https://github.com/nextcloud/.github
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 #
 # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
@@ -61,14 +61,14 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
+          fallbackNode: "^20"
+          fallbackNpm: "^10"
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ steps.versions.outputs.nodeVersion }}
 

.github/workflows/lint-info-xml.yml

@@ -1,6 +1,6 @@
 # This workflow is provided via the organization template repository
 #
-# https://github.com/LibreCodeCoop/.github
+# https://github.com/nextcloud/.github
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 #
 # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
@@ -27,8 +27,6 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-          sparse-checkout: |
-            appinfo/
 
       - name: Download schema
         run: wget https://raw.githubusercontent.com/nextcloud/appstore/master/nextcloudappstore/api/v1/release/info.xsd

.github/workflows/lint-php-cs.yml

@@ -1,6 +1,6 @@
 # This workflow is provided via the organization template repository
 #
-# https://github.com/LibreCodeCoop/.github
+# https://github.com/nextcloud/.github
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 #
 # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
@@ -31,10 +31,10 @@ jobs:
 
       - name: Get php version
         id: versions
-        uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
+        uses: icewind1991/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.3.4
 
       - name: Set up php${{ steps.versions.outputs.php-min }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0
         with:
           php-version: ${{ steps.versions.outputs.php-min }}
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
@@ -43,12 +43,10 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Remove nextcloud/ocp
+      - name: Install dependencies
         run: |
           composer remove nextcloud/ocp --dev --no-scripts
-
-      - name: Install composer dependencies
-        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+          composer i
 
       - name: Lint
         run: composer run cs:check || ( echo 'Please run `composer run cs:fix` to format your code' && exit 1 )

.github/workflows/lint-php.yml

@@ -1,6 +1,6 @@
 # This workflow is provided via the organization template repository
 #
-# https://github.com/LibreCodeCoop/.github
+# https://github.com/nextcloud/.github
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 #
 # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
@@ -21,8 +21,7 @@ jobs:
   matrix:
     runs-on: ubuntu-latest
     outputs:
-      php-min: ${{ steps.versions.outputs.php-min }}
-      php-max: ${{ steps.versions.outputs.php-max }}
+      php-versions: ${{ steps.versions.outputs.php-versions }}
     steps:
       - name: Checkout app
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -31,14 +30,14 @@ jobs:
 
       - name: Get version matrix
         id: versions
-        uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
+        uses: icewind1991/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.0.0
 
   php-lint:
     runs-on: ubuntu-latest
     needs: matrix
     strategy:
       matrix:
-        php-versions: ['${{ needs.matrix.outputs.php-min }}', '${{ needs.matrix.outputs.php-max }}']
+        php-versions: ${{fromJson(needs.matrix.outputs.php-versions)}}
 
     name: php-lint
 
@@ -49,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite

.github/workflows/lint-stylelint.yml

@@ -1,6 +1,6 @@
 # This workflow is provided via the organization template repository
 #
-# https://github.com/LibreCodeCoop/.github
+# https://github.com/nextcloud/.github
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 #
 # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
@@ -30,14 +30,14 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
+          fallbackNode: "^20"
+          fallbackNpm: "^10"
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ steps.versions.outputs.nodeVersion }}
 

.github/workflows/npm-build.yml → .github/workflows/node.yml

@@ -1,12 +1,12 @@
 # This workflow is provided via the organization template repository
 #
-# https://github.com/LibreCodeCoop/.github
+# https://github.com/nextcloud/.github
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 #
 # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: MIT
 
-name: Build Javascript
+name: Node
 
 on: pull_request
 
@@ -58,26 +58,20 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
+          fallbackNode: "^20"
+          fallbackNpm: "^10"
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ steps.versions.outputs.nodeVersion }}
 
       - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
         run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
 
-      - name: Validate package-lock.json # See https://github.com/npm/cli/issues/4460
-        run: |
-          npm i -g npm-package-lock-add-resolved@1.1.4
-          npm-package-lock-add-resolved
-          git --no-pager diff --exit-code
-
       - name: Install dependencies & build
         env:
           CYPRESS_INSTALL_BINARY: 0

.github/workflows/openapi.yml

@@ -1,6 +1,6 @@
 # This workflow is provided via the organization template repository
 #
-# https://github.com/LibreCodeCoop/.github
+# https://github.com/nextcloud/.github
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 #
 # SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
@@ -32,10 +32,10 @@ jobs:
 
       - name: Get php version
         id: php_versions
-        uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
+        uses: icewind1991/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.3.4
 
       - name: Set up php
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0
         with:
           php-version: ${{ steps.php_versions.outputs.php-available }}
           extensions: xml
@@ -52,17 +52,17 @@ jobs:
 
       - name: Read package.json node and npm engines version
         if: steps.check_typescript_openapi.outputs.files_exists == 'true'
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: node_versions
         # Continue if no package.json
         continue-on-error: true
         with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
+          fallbackNode: '^20'
+          fallbackNpm: '^10'
 
       - name: Set up node ${{ steps.node_versions.outputs.nodeVersion }}
         if: ${{ steps.node_versions.outputs.nodeVersion }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ steps.node_versions.outputs.nodeVersion }}
 
@@ -78,8 +78,8 @@ jobs:
         run: |
           npm ci
 
-      - name: Install composer dependencies
-        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+      - name: Set up dependencies
+        run: composer i
 
       - name: Regenerate OpenAPI
         run: composer run openapi