Of course the argument is poor for a ubuntu LTS distribution which is supported for 5 years.
Running a Nextcloud release without security and stability updates puts your data at risk.
Even though it is php 7.0 it still gets security updates and thus is not or little risk. Much less risk then forcing people to possibly compile the latest php version themselves or taking updated php packages from the next best repository they find in the internet without any idea how well that would be maintained by whoever provides them.
Or forcing people to upgrade to the next ubuntu 18.04 LTS (which of course means in the end that maybe in two years you are in the same situation, again). Not that that will go so easily and well that in the end everything is as secure and stable as before…
Of course, paid customers can get a LTS version of nextcloud… What does that tell me??
Thus, I guess in the end this will simply mean that in a couple of months from now there will be more and more nextcloud installations in the internet with a number of potential security issues that won’t be fixed…
In particular, because at least for the Ubuntu release schedule end of support for Nextcloud 15 end of 2019 it means another 4 months until the release of Ubuntu 20.04 LTS. Thus, end of 2019 when I have to decide to upgrade to Ubuntu 18.04 LTS only to get php 7.2 for updated nextcloud or wait another four months and hope nothing happens and then upgrade to 20.04 LTS and the latest nextcloud.
So it would be much nicer if nextcloud 15 was supported until mid of 2020…
The “Apps with available updates” showed two apps: Two-factor U2F and Group Folders.
I disabled the Two-factor U2F app and refreshed… The Open Updater button appeared…
I’m guessing this is because, according to the documentation, nextcloud 16 requires
php 7.1 and I’m running Ubuntu 16.04.6 LTS which only has php 7.0.33 in its repos.
For me this was happening even after updating PHP to 7.2…
Thus, end of 2019 when I have to decide to upgrade to Ubuntu
18.04 LTS only to get php 7.2 for updated nextcloud
Upgrading to PHP 7.2 and staying on Nextcloud 15 / Ubuntu 16.04 works just fine…
Same problem here. I’m using Nextcloud 15.0.10 with Ubuntu 16.04.6 LTS which is not providing PHP 7.2. A manual “hacking-Update” from 7.0.33 to 7.2 is (imho) not an option.
Ubuntu 16.04 LTS is a fully supported OS with actual security-updates (including PHP). There are security-concerns because of php-version in Ubuntu 16.04.6 LTS? Really…? Can somebody please make it possible to support Ubuntu 16.04 LTS at least until 20.04 LTS is comming out?
Well “Hacking” maybe is the wrong word. But in our production-envirement it is good practice to use LTS-Versions of the OS - Including the provided packages of the distributor.
Just like already says:
Blockquote
Even though it is php 7.0 it still gets security updates and thus is not or little risk. Much less risk then forcing people to possibly compile the latest php version themselves or taking updated php packages from the next best repository they find in the internet without any idea how well that would be maintained by whoever provides them.
Am I understanding this correctly? My Nextcloud installation is notifying me of an update being available from 15.0.10 to 16.0.3, but the update button is missing because of a PHP version bump requirement that isn’t mentioned anywhere. That seems like a remarkably poor user experience - I’m receiving notifications every time I boot various devices that I can do nothing about because Nextcloud isn’t telling me what the problem is.
Am I understanding this correctly? My Nextcloud installation is notifying me of an update being available from 15.0.10 to 16.0.3, but the update button is missing because of a PHP version bump requirement that isn’t mentioned anywhere…
I’d be ok with staying with Nextcloud 15, as I understand that new major releases may change the required installation prerequisites.
But - how can I then easily upgrade to 15.0.11 once it’s out (and which works on my Debian 9 Stretch system) until I upgrade the base system, if Nextcloud only offers (or not…) Nextcloud 16.0.3 which then cannot be installed?
For anyone else who comes across this thread, I solved the problem by upgrading the PHP version of my server from 7.0 to 7.1, whereupon the button reappeared and I was able to update to Nextcloud 16.0.3 without issue.
Although the new PHP version dependency is listed in Nextcloud’s docs, it’s still a poor user experience to notify them of updates they cannot install without researching why a button might be missing from the UI. There is no indication in the admin panel as to why you might not be able to install the update. This could be handled better by having the update notification read something like this instead:
An update to Nextcloud 16.0.3 is available, but your server does not currently meet the requirements to install it. Please upgrade your server’s PHP version to at least 7.1 to install Nextcloud 16.0.3.
So you fully trust Ondřej Surý and his PHP packages. You fully trust they quickly get important, security updates. You fully reviewed the process how those packages are built and trust the process and all people involved. You fully trust those packages don‘t have any side effects on your system and they won‘t temper with your system?
Of course it works. But there is a good reason why many people choose to use only the official packages from your distribution for highest level of system stability and security within a reasonable setting, even if it means that you don’t always have the latest version.
And updating php to a different version can have effects on any of your installed web apps, so in that process you need to review and possibly reconfigure those as well.
That’s why I choose a LTS version of ubuntu so that I mostly have to do that every four years only when I switch to the next Ubuntu LTS…
I cannot agree more. This whole “Nextcloud Update-Behaviour” is not what I expect from a professional solution. I would expect, that a product like nextcloud whould define a clear release-strategy. For example: “Distro xy LTS is supportet until …” And of course I would expect, that the LTS-Versions of the “big distros” are included. But I couldn’t find something like this.
So options are (some, not all options):
Stay on Nextcloud 15 without any security-patches from now
=> No, defenitly not
Update to Ubuntu 18.04 LTS and migrate the whole nextcloud-server to it
=> Öm…No. I planed to do a Distro-Update when 20.04 is there.
Do the PHP-Update and trust mr. Ondřej Surý
=> Not the best option either (you name it).
Do the PHP-Update by myself
=> No option too (at least for me).
Pay Nextcloud to do the Update
=> Not possible too
So finaly I go with option 3 until Ubuntu 20.04 is there.
For a professional operator, this update-siuation is frustrating. I definitly hope nextcloud will improve the update-strategy in the future…
I agree with people staying on a stable release of any kind of software but this does not apply to some software mentioned above!
PHP 7.0 has officially reached its EOL in January 2019 and is not getting any updates/patches whatsoever. (https://www.php.net/supported-versions.php) Upgrading/Migrating your PHP to at least 7.1 or 7.2 is therefore inevitable, to continue using PHP knowing you will still get security patches for a certain time.
I had a look on GitHub and noticed that others reported this on there as well. There seems to be kind of a bug telling people with (15.0.10) that there is a newer version available but does not show the buttons, when people don’t have the required PHP version.
That does not apply to the version provided with the major distributions. They still get important updates and backports allowing to run them even after they are stopped upstream.
RHEL7/CentOS7 still has PHP 5.4 and still gets updates.
Ubuntu 16.04 LTS has php 7.0 and will still get updates during the LTS period.
If you only look at the version numbers on those distributions you’ll find that many software is supposed to be unsupported or supposedly with security issues. But the security updates for those versions have been backported thus just looking at the version number is not enough…
This is an old thread. I just found some information about dropping the support of php 7.0:
The policy seems to be more that a new version is supposed to be supported by all the latest LTS versions. I am not sure, if it is difficult to keep support for many versions at the same time, if there are security concerns (php itself is not supported any more even when distributions do support them) also regarding the bug bounty, performance …?
As normal user, you usually have enough time to switch to a newer LTS version and you generally benefit from newer versions.
Making changes to NC16 is too late, you can keep an eye open for future changes and object when they are about to happen.
