Update to NC 33 fails because of changes in http-client

[EV21]

The Basics

• Nextcloud Server version (e.g., 29.x.x):
  • 32.latest > 33.0.0
• Operating system and version (e.g., Ubuntu 24.04):
  • Uberspace7 (some CentOS)
• Web server and version (e.g, Apache 2.4.25):
  • Apache (not relevant)
• Reverse proxy and version _(e.g. nginx 1.27.2)
  • nginx (not relevant)
• PHP version (e.g, 8.3):
  • 8.3.8
• Is this the first time you’ve seen this error? (Yes / No):
  • yes
• When did this problem seem to first start?
  • after automated updater does the update to 33.0
• Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
  • Nextcloud — UberLab 7 documentation
• Are you using CloudfIare, mod_security, or similar? (Yes / No)
  • no

Summary of the issue you are facing:

Nextcloud got stuck in maintenance mode (I think) because of the changes by @ernolf (hi )

refactor(http-client): use direct HTTP/2 cURL hint and align tests

Steps to replicate it (hint: details matter!):

1. click an Uberspace U7

2. install NC 32

3. update to NC33

4. get stuck

Log entries

Nextcloud

~]$ php occ upgrade
Setting log level to debug
Updating database schema
Updated database
An unhandled exception has been thrown:
Error: Undefined constant "CURL_HTTP_VERSION_2TLS" in /var/www/virtual/cloudev/html/lib/private/Http/Client/Client.php:62
Stack trace:
#0 /var/www/virtual/user/html/lib/private/Http/Client/Client.php(219): OC\Http\Client\Client->buildRequestOptions(Array)
#1 /var/www/virtual/user/html/lib/private/App/AppStore/Fetcher/Fetcher.php(92): OC\Http\Client\Client->get('https://apps.ne...', Array)
#2 /var/www/virtual/user/html/lib/private/App/AppStore/Fetcher/AppFetcher.php(56): OC\App\AppStore\Fetcher\Fetcher->fetch('', '')
#3 /var/www/virtual/user/html/lib/private/App/AppStore/Fetcher/Fetcher.php(170): OC\App\AppStore\Fetcher\AppFetcher->fetch('', '', false)
#4 /var/www/virtual/user/html/lib/private/App/AppStore/Fetcher/AppFetcher.php(157): OC\App\AppStore\Fetcher\Fetcher->get(false)
#5 /var/www/virtual/user/html/lib/private/Installer.php(379): OC\App\AppStore\Fetcher\AppFetcher->get(false)
#6 /var/www/virtual/user/html/lib/private/Updater.php(379): OC\Installer->isUpdateAvailable('activity')
#7 /var/www/virtual/user/html/lib/private/Updater.php(242): OC\Updater->upgradeAppStoreApps(Array)
#8 /var/www/virtual/user/html/lib/private/Updater.php(100): OC\Updater->doUpgrade('33.0.0.16', '32.0.6.1')
#9 [...]

My Workaround

Change lib/private/Http/Client/Client.php

				\CURLOPT_HTTP_VERSION => \CURL_HTTP_VERSION_2TLS,

to

				\CURLOPT_HTTP_VERSION => \CURL_HTTP_VERSION_NONE,

then rerun

php occ update

and

php occ maintenance:mode --off

then turn off the auto updater and just do manual updates (with that hack as shown before) as long as this issue persists
or use a backup to return to NC32, turn off automated updates and only use NC32.x.x updates

[EV21]

oh, my bad

[Nextcloud] Needs update to newly required PHP version 8.4.

it looks like 8.4 is required now - so

~]$ uberspace tools version use php 8.4

then do the update…

[bb77]

Glad you were able to solve the problem.

However, for anyone else reading this, I would like to add that, although PHP 8.4 is now the recommended version for Nextcloud 33, it is not a strict requirement. I successfully updated my test instance from 32.0.6 to 33.0.0 using the command line updater yesterday, and it was running PHP 8.3, and still is.

See also…

https://docs.nextcloud.com/server/latest/admin_manual/installation/system_requirements.html

https://docs.nextcloud.com/server/33/admin_manual/release_notes/upgrade_to_33.html

So, this is most likely a specific issue with your instance, or more likely with Uberspace.

[ernolf]

@EV21

because of the changes by @ernolf (hi )

Thank you for your report.

I originally submitted a more robust version of the code in the pull request, which certainly wouldn’t have caused this problem, because I knew perfectly well that you guys out there are working with some pretty exotic PHP versions. However, two reviewers insisted that I simplify the robust version.

You can read my reasoning (which has now come to pass) here:

miaulalala

---

In that context, I’d be interested to know which constants your PHP (8.3) version has.

Could you please run → this script ← on your system like this:

php8.3 -f /path/to/php_dump_consts.php --prefix=CURL_HTTP

and share the output here.

I will advocate for restoring the guarded version (my original code) to prevent a flood of reports once version 33 becomes more widespread, as I can do without that like a toothache.

good luck,

---

ernolf

[EV21]

@ernolf

Could you please run → this script ← on your system like this:

php8.3 -f /path/to/php_dump_consts.php --prefix=CURL_HTTP

and share the output here.

with php 8.3 it is:
[... html]$ php -f php_dump_consts.php -- --prefix=CURL_HTTP
== curl ==
CURL_HTTP_VERSION_1_0                    [int]    = 1
CURL_HTTP_VERSION_1_1                    [int]    = 2
CURL_HTTP_VERSION_NONE                   [int]    = 0

[... html]$ uberspace tools version use php 8.4
Selected PHP version 8.4
The new configuration is adapted immediately. Patch updates will be applied automatically.

[... html]$ php -f php_dump_consts.php -- --prefix=CURL_HTTP
== curl ==
CURL_HTTP_VERSION_1_0                    [int]    = 1
CURL_HTTP_VERSION_1_1                    [int]    = 2
CURL_HTTP_VERSION_NONE                   [int]    = 0
CURL_HTTP_VERSION_2_0                    [int]    = 3
CURL_HTTP_VERSION_2                      [int]    = 3
CURL_HTTP_VERSION_2TLS                   [int]    = 4
CURL_HTTP_VERSION_2_PRIOR_KNOWLEDGE      [int]    = 5
CURL_HTTP_VERSION_3                      [int]    = 30
CURL_HTTP_VERSION_3ONLY                  [int]    = 31

another contributor is already doing a pull request that mentions this issue in the troubleshooting section

Updated nextcloud guide to use new php version 8.4 (#1986)

---

It looks like the (better) 8.4 version is now self build by the uberspace team. I have no idea where that limited 8.3 is from.

quote from the blog Unboxing Uberspace8

Maintenance U7

Wie oben bereits einmal angesprochen: Ja, CentOS7 ist End of Life, aber nein, U7 ist nicht unsicher. Seit dem Ende des offiziellen Supports durch RedHat kaufen wir Extended Support von anderer Seite ein. Außerdem bauen wir ja inzwischen eh viele Pakete selbst, zuletzt sogar PHP 8.4 mit einem ziemlichen Aufwand durch Jonas, der sich ein paar Tage durch den Abhängigkeits-Dschungel geschlagen hat.

[ernolf]

@EV21

quote from the blog

Now you’ve piqued my interest. The way they describe it, they’re buying in external support to keep selling end-of-life products. That doesn’t sound very trustworthy!

@EV21

with php 8.3 it is:
[... html]$ php -f php_dump_consts.php -- --prefix=CURL_HTTP
== curl ==
CURL_HTTP_VERSION_1_0                    [int]    = 1
CURL_HTTP_VERSION_1_1                    [int]    = 2
CURL_HTTP_VERSION_NONE                   [int]    = 0

Could you please also share the output of this request:

php -f php_dump_consts.php -- --prefix=PHP_VERSION

.. or if you don’t mind - for me to better understand your PHP version, perhaps even the output of

php -f php_dump_consts.php -- --category=core

---

ernolf

[ernolf]

@EV21

another contributor is already doing a pull request that mentions this issue in the troubleshooting section

Yes, and it seams to be merged already:

Update fails with “Undefined constant CURL_HTTP_VERSION_2TLS” - Nextcloud —...

---

ernolf

[mad_mat]

I don’t think it has anything to do with PHP 8.3. It’s about support for http2.
I have PHP 8.3 and everything is running normally.

sudo -u http php-legacy /big/www/oc.dummy.dummy/occ -V

dummy.dummy 33.0.0

curl -I --http2 https://oc.dummy.dummy/login

HTTP/2 200
x-powered-by: PHP/8.3.30
x-request-id: OgSTj1gNDxImjYppklAp
cache-control: no-cache, no-store, must-revalidate
content-security-policy: default-src ‘none’;base-uri ‘none’;manifest-src ‘self’;script-src ‘nonce-XbwsR2xf/HSB6Kq8R1EAsYTdf07nQmv93aXVrr/0wJM=’ blob: ‘wasm-unsafe-eval’;script-src-elem ‘strict-dynamic’ ‘nonce-XbwsR2xf/HSB6Kq8R1EAsYTdf07nQmv93aXVrr/0wJM=’ blob: ‘wasm-unsafe-eval’;style-src ‘self’ ‘unsafe-inline’;img-src ‘self’ data: blob: https://*.tile.openstreetmap.org https://lool.dummy.dummy;font-src ‘self’ data:;connect-src ‘self’ blob: coturn.dummy.dummy:5349 wss://signaling.dummy.dummy wss://oc.dummy.dummy;media-src ‘self’ blob:;frame-src ‘self’ nc: https://lool.dummy.dummy;child-src blob: ‘self’;frame-ancestors ‘self’ https://lool.dummy.dummy;worker-src blob: ‘self’;form-action ‘self’ https://lool.dummy.dummy
feature-policy: autoplay ‘self’;camera ‘self’;fullscreen ‘self’ https://lool.dummy.dummy;geolocation ‘none’;microphone ‘self’;payment ‘none’
x-robots-tag: noindex, nofollow
set-cookie: oc_sessionPassphrase=%2FdVzSK%2BQzPsmAaAYLH5Ol%2Bm%2Fq3tBENZpnN6Vf9aeAUAOYko5SbKdMbUh%2BBRtOcCDFTZSugkx3pso1jhgppe5L1v4tal5Ndvap9JYGCpsHOSnddbP8EzYtGc3f04GrmEf; path=/; secure; HttpOnly; SameSite=Lax
set-cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
set-cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
set-cookie: ocygtlnb9hr9=5vsfpjbn45lg3iav5oon4vbakr; path=/; secure; HttpOnly; SameSite=Lax
strict-transport-security: max-age=15768000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
access-control-allow-origin: https://ssl.dummy.dummy
access-control-allow-methods: GET, POST, OPTIONS, PROPFIND, PROPPATCH, REPORT, PUT, MOVE, DELETE, LOCK, UNLOCK
access-control-allow-headers: User-Agent, Authorization, Content-type, Depth, If-match, If-None-Match, Lock-Token, Timeout, Destination, Overwrite, Prefer, X-client, X-Requested-With
access-control-expose-headers: Etag, Preference-Applied
referrer-policy: no-referrer
content-length: 35596
x-xss-protection: 1; mode=block
content-type: text/html; charset=UTF-8
date: Wed, 25 Feb 2026 06:58:34 GMT
server: Apache

If the web server does not support http2, perhaps because you are on a NAS, then I had to adjust the code.

/big/www/dummy.dummy/lib/private/Http/Client/Client.php

51-     }
52-
53-     private function buildRequestOptions(array $options): array {
54-             $proxy = $this->getProxyUri();
55-
56-             $defaults = [
57-                     RequestOptions::VERIFY => $this->getCertBundle(),
58-                     RequestOptions::TIMEOUT => IClient::DEFAULT_REQUEST_TIMEOUT,
59-                     // Prefer HTTP/2 globally (PSR-7 request version)
60-                     // RequestOptions::VERSION => ‘2.2’,
61-                     // http 1.1 only
62-                     RequestOptions::VERSION => ‘1.1’,
63-             ];
64-             // http 1.1 only
65-             // $defaults[‘curl’][\CURLOPT_HTTP_VERSION] = \CURL_HTTP_VERSION_2TLS;
66-             $defaults[‘curl’][\CURLOPT_HTTP_VERSION] = \CURL_HTTP_VERSION_NONE;
67-
68-             $options[‘nextcloud’][‘allow_local_address’] = $this->isLocalAddressAllowed($options);
69-             if ($options[‘nextcloud’][‘allow_local_address’] === false) {
70-                     $onRedirectFunction = function (
71-                             \Psr\Http\Message\RequestInterface $request,
72-                             \Psr\Http\Message\ResponseInterface $response,
73-                             \Psr\Http\Message\UriInterface $uri,
74-                     ) use ($options) {

[EV21]

[html]$ uberspace tools version use php 8.3
Selected PHP version 8.3
The new configuration is adapted immediately. Patch updates will be applied automatically.
[html]$ php -f php_dump_consts.php -- --prefix=PHP_VERSION
== Core ==
PHP_VERSION                              [string] = '8.3.8'
PHP_VERSION_ID                           [int]    = 80308

Latest would be 8.3.30 (15 Jan 2026)
But the used version is 8.3.8 (06 Jun 2024)

[html]$ uberspace tools version use php 8.4
Selected PHP version 8.4
The new configuration is adapted immediately. Patch updates will be applied automatically.
[html]$ php -f php_dump_consts.php -- --prefix=PHP_VERSION
== Core ==
PHP_VERSION                              [string] = '8.4.18'
PHP_VERSION_ID                           [int]    = 80418
[html]$

Latest is 8.4.18 (self build) (12 Feb 2026)

oh, now I see it is by far not the latest support release even when they said they are doing security updates on a regular basis…

So the extended support thing did not work like expected so they started with self building PHP8.4.
I think I heard or read somewhere that they also want to extend that process to the other supported PHP versions as the current (outdated) product U7 is not planned to end soon.