From fcf1ca56d34ea8b019950f45ee3a82af2dfa987e Mon Sep 17 00:00:00 2001
From: stevensting <stefan@klasse-methode.it>
Date: Wed, 22 Jul 2026 13:27:50 +0200
Subject: [PATCH 01/25] chore: publish 13.1.1+32.0.12-fpm release

---
 compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.yml b/compose.yml
index c28829c..1ca84b4 100644
--- a/compose.yml
+++ b/compose.yml
@@ -95,7 +95,7 @@ services:
         failure_action: rollback
         order: start-first
       labels:
-        - "coop-cloud.${STACK_NAME}.version=13.1.0+32.0.11-fpm"
+        - "coop-cloud.${STACK_NAME}.version=13.1.1+32.0.12-fpm"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.volumes.redis=false"

From 53d7f765aefdf70a68e15941061c83c65190f211 Mon Sep 17 00:00:00 2001
From: Renovate Bot <renovate@coopcloud.tech>
Date: Fri, 24 Jul 2026 02:28:12 +0000
Subject: [PATCH 02/25] chore(deps): update nextcloud docker tag to v32.0.13

---
 compose.fulltextsearch.yml | 2 +-
 compose.yml                | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/compose.fulltextsearch.yml b/compose.fulltextsearch.yml
index 3ecc656..3cf76af 100644
--- a/compose.fulltextsearch.yml
+++ b/compose.fulltextsearch.yml
@@ -29,7 +29,7 @@ services:
         mode: 0600
 
   searchindexer:
-    image: nextcloud:32.0.12-fpm
+    image: nextcloud:32.0.13-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached
diff --git a/compose.yml b/compose.yml
index 1ca84b4..06a1142 100644
--- a/compose.yml
+++ b/compose.yml
@@ -48,7 +48,7 @@ services:
       start_period: 5m
 
   app:
-    image: nextcloud:32.0.12-fpm
+    image: nextcloud:32.0.13-fpm
     depends_on:
       - db
     configs:
@@ -109,7 +109,7 @@ services:
       start_period: 15m
 
   cron:
-    image: nextcloud:32.0.12-fpm
+    image: nextcloud:32.0.13-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached

From 6619501f5c3a871b4b3f103b0c67f0a58313f56a Mon Sep 17 00:00:00 2001
From: Renovate Bot <renovate@coopcloud.tech>
Date: Fri, 24 Jul 2026 19:17:43 +0000
Subject: [PATCH 03/25] chore(deps): update redis docker tag to v8.8.1

---
 compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.yml b/compose.yml
index 06a1142..a69e37c 100644
--- a/compose.yml
+++ b/compose.yml
@@ -125,7 +125,7 @@ services:
 
 
   cache:
-    image: redis:8.8.0-alpine
+    image: redis:8.8.1-alpine
     networks:
       - internal
     volumes:

From 7e4cbce41ec15f4976bbbc3864d2cf13edfb4bda Mon Sep 17 00:00:00 2001
From: Renovate Bot <renovate@coopcloud.tech>
Date: Tue, 21 Jul 2026 09:27:05 +0000
Subject: [PATCH 04/25] chore(deps): update
 docker.elastic.co/elasticsearch/elasticsearch docker tag to v8.19.19

---
 compose.fulltextsearch.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.fulltextsearch.yml b/compose.fulltextsearch.yml
index 3cf76af..f6cd53d 100644
--- a/compose.fulltextsearch.yml
+++ b/compose.fulltextsearch.yml
@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   elasticsearch:
-    image: "docker.elastic.co/elasticsearch/elasticsearch:8.19.16"
+    image: "docker.elastic.co/elasticsearch/elasticsearch:8.19.19"
     environment:
       - cluster.name=docker-cluster
       - bootstrap.memory_lock=true

From d8f5c23897a036fd78a0df311960208157d7130a Mon Sep 17 00:00:00 2001
From: Renovate Bot <renovate@coopcloud.tech>
Date: Thu, 16 Jul 2026 02:21:07 +0000
Subject: [PATCH 05/25] chore(deps): update nginx docker tag to v1.31.3

---
 compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.yml b/compose.yml
index a69e37c..55cb91c 100644
--- a/compose.yml
+++ b/compose.yml
@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   web:
-    image: nginx:1.31.1
+    image: nginx:1.31.3
     depends_on:
       - app
     configs:

From f60f10c6dde470c824f606f63e02aea9f6674760 Mon Sep 17 00:00:00 2001
From: Renovate Bot <renovate@coopcloud.tech>
Date: Wed, 11 Mar 2026 00:56:15 +0000
Subject: [PATCH 06/25] chore(deps): update mariadb docker tag to v11.8

---
 compose.mariadb.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.mariadb.yml b/compose.mariadb.yml
index 5cb08bc..f4b96ed 100644
--- a/compose.mariadb.yml
+++ b/compose.mariadb.yml
@@ -9,7 +9,7 @@ services:
       - MYSQL_PASSWORD_FILE=/run/secrets/db_password
 
   db:
-    image: "mariadb:11.4"
+    image: "mariadb:11.8"
     environment:
       - MYSQL_DATABASE=nextcloud
       - MYSQL_USER=nextcloud

From 4c41c2179939dd8c5b8aed593f3dd59710fba82e Mon Sep 17 00:00:00 2001
From: Renovate Bot <renovate@coopcloud.tech>
Date: Tue, 2 Jun 2026 00:16:58 +0000
Subject: [PATCH 07/25] chore(deps): update mariadb docker tag to v12

---
 compose.mariadb.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.mariadb.yml b/compose.mariadb.yml
index f4b96ed..94557af 100644
--- a/compose.mariadb.yml
+++ b/compose.mariadb.yml
@@ -9,7 +9,7 @@ services:
       - MYSQL_PASSWORD_FILE=/run/secrets/db_password
 
   db:
-    image: "mariadb:11.8"
+    image: "mariadb:12.3"
     environment:
       - MYSQL_DATABASE=nextcloud
       - MYSQL_USER=nextcloud

From 8e57236f0d4547f7213eaf33c64e19ac6945ec8e Mon Sep 17 00:00:00 2001
From: Linus Gasser <linus.gasser@epfl.ch>
Date: Sat, 25 Jul 2026 21:59:52 +0200
Subject: [PATCH 08/25] Releasing updates

---
 release/13.1.4+32.0.13-fpm | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 release/13.1.4+32.0.13-fpm

diff --git a/release/13.1.4+32.0.13-fpm b/release/13.1.4+32.0.13-fpm
new file mode 100644
index 0000000..5081da3
--- /dev/null
+++ b/release/13.1.4+32.0.13-fpm
@@ -0,0 +1,4 @@
+    chore(deps): update mariadb docker tag to v12
+    chore(deps): update mariadb docker tag to v11.8
+    chore(deps): update nginx docker tag to v1.31.3
+    chore(deps): update docker.elastic.co/elasticsearch/elasticsearch docker tag to v8.19.19

From 1d9c844cadd15ced4bc2451b4142bff75c8c0d1b Mon Sep 17 00:00:00 2001
From: Danny Groenewegen <danny@ecommons.space>
Date: Sun, 2 Aug 2026 17:02:40 +0200
Subject: [PATCH 09/25] fix: remove -c max_connections flag from postgres
 command to fix pgautoupgrade

The pgautoupgrade switch from 13.1.0+32.0.11-fpm was released untested and had a bug: the db service's `-c max_connections=...` command breaks pgautoupgrade, failing with `initdb: invalid option -- 'c'`. See pgautoupgrade/docker-pgautoupgrade#148
---
 compose.postgres.yml | 3 ++-
 compose.yml          | 2 +-
 release/next         | 2 ++
 3 files changed, 5 insertions(+), 2 deletions(-)
 create mode 100644 release/next

diff --git a/compose.postgres.yml b/compose.postgres.yml
index cee110c..777f9df 100644
--- a/compose.postgres.yml
+++ b/compose.postgres.yml
@@ -11,7 +11,8 @@ services:
 
   db:
     image: "pgautoupgrade/pgautoupgrade:14-debian"
-    command: -c "max_connections=${MAX_DB_CONNECTIONS:-100}"
+    #setting max_connections with -c breaks pgautoupgrade
+    #command: -c "max_connections=${MAX_DB_CONNECTIONS:-100}"
     volumes:
       - "postgres:/var/lib/postgresql/data"
     networks:
diff --git a/compose.yml b/compose.yml
index 55cb91c..d974851 100644
--- a/compose.yml
+++ b/compose.yml
@@ -95,7 +95,7 @@ services:
         failure_action: rollback
         order: start-first
       labels:
-        - "coop-cloud.${STACK_NAME}.version=13.1.1+32.0.12-fpm"
+        - "coop-cloud.${STACK_NAME}.version=13.1.1+32.0.13-fpm"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.volumes.redis=false"
diff --git a/release/next b/release/next
new file mode 100644
index 0000000..d71cfdc
--- /dev/null
+++ b/release/next
@@ -0,0 +1,2 @@
+Important:
+The pgautoupgrade switch from 13.1.0+32.0.11-fpm was released untested and had a bug: the db service's `-c max_connections=...` command breaks pgautoupgrade, failing with `initdb: invalid option -- 'c'`. If your db got stuck mid-upgrade on 13.1.0-13.1.4 with that error: restore the old data dir and remove the upgrade lock file. Then redeploy this version.

From 3be4c3aa4a458da9a1bc31b4219689aec6c39f66 Mon Sep 17 00:00:00 2001
From: Danny Groenewegen <mail@dannygroenewegen.nl>
Date: Sun, 2 Aug 2026 17:13:45 +0200
Subject: [PATCH 10/25] chore: publish 13.1.5+32.0.13-fpm release

---
 compose.yml                          | 2 +-
 release/{next => 13.1.5+32.0.13-fpm} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename release/{next => 13.1.5+32.0.13-fpm} (100%)

diff --git a/compose.yml b/compose.yml
index d974851..990d4b7 100644
--- a/compose.yml
+++ b/compose.yml
@@ -95,7 +95,7 @@ services:
         failure_action: rollback
         order: start-first
       labels:
-        - "coop-cloud.${STACK_NAME}.version=13.1.1+32.0.13-fpm"
+        - "coop-cloud.${STACK_NAME}.version=13.1.5+32.0.13-fpm"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.volumes.redis=false"
diff --git a/release/next b/release/13.1.5+32.0.13-fpm
similarity index 100%
rename from release/next
rename to release/13.1.5+32.0.13-fpm

From f9e57d1ec17e6e7846025a228160f6ed1e2261e6 Mon Sep 17 00:00:00 2001
From: Linus Gasser <linus.gasser@epfl.ch>
Date: Sat, 8 Aug 2026 10:47:50 +0200
Subject: [PATCH 11/25] Last release for nextcloud-32

---
 compose.fulltextsearch.yml | 2 +-
 compose.yml                | 4 ++--
 release/13.2.0+32-fpm      | 1 +
 3 files changed, 4 insertions(+), 3 deletions(-)
 create mode 100644 release/13.2.0+32-fpm

diff --git a/compose.fulltextsearch.yml b/compose.fulltextsearch.yml
index f6cd53d..bc85ca6 100644
--- a/compose.fulltextsearch.yml
+++ b/compose.fulltextsearch.yml
@@ -29,7 +29,7 @@ services:
         mode: 0600
 
   searchindexer:
-    image: nextcloud:32.0.13-fpm
+    image: nextcloud:32-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached
diff --git a/compose.yml b/compose.yml
index 990d4b7..4bb9666 100644
--- a/compose.yml
+++ b/compose.yml
@@ -48,7 +48,7 @@ services:
       start_period: 5m
 
   app:
-    image: nextcloud:32.0.13-fpm
+    image: nextcloud:32-fpm
     depends_on:
       - db
     configs:
@@ -109,7 +109,7 @@ services:
       start_period: 15m
 
   cron:
-    image: nextcloud:32.0.13-fpm
+    image: nextcloud:32-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached
diff --git a/release/13.2.0+32-fpm b/release/13.2.0+32-fpm
new file mode 100644
index 0000000..6fcc63a
--- /dev/null
+++ b/release/13.2.0+32-fpm
@@ -0,0 +1 @@
+Last release for nextcloud-32, pointing to the latest version of nextcloud-32.

From abd102e3a8aa5023e2f27155614af8aeab2d668e Mon Sep 17 00:00:00 2001
From: Danny Groenewegen <danny@ecommons.space>
Date: Sat, 8 Aug 2026 13:04:12 +0200
Subject: [PATCH 12/25] fix: align nginx_conf config name with its compose key

Name dropped the _conf suffix, so abra's live-vs-desired lookup
(keyed by compose config name) never matched and always showed
nginx_conf as (new) on deploy, even when unchanged.
---
 compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.yml b/compose.yml
index 4bb9666..99626ae 100644
--- a/compose.yml
+++ b/compose.yml
@@ -154,7 +154,7 @@ volumes:
 
 configs:
   nginx_conf:
-    name: ${STACK_NAME}_nginx_${NGINX_CONF_VERSION}
+    name: ${STACK_NAME}_nginx_conf_${NGINX_CONF_VERSION}
     file: nginx.conf.tmpl
     template_driver: golang
   fpm_tune:

From 14ec244f97cdb18f6f5fc1fa863d770dc74b959b Mon Sep 17 00:00:00 2001
From: Danny Groenewegen <danny@ecommons.space>
Date: Sun, 9 Aug 2026 20:48:18 +0200
Subject: [PATCH 13/25] fix: use pgautoupgrade's default healthcheck

---
 compose.postgres.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/compose.postgres.yml b/compose.postgres.yml
index 777f9df..c3f071b 100644
--- a/compose.postgres.yml
+++ b/compose.postgres.yml
@@ -23,11 +23,11 @@ services:
       POSTGRES_DB: nextcloud
     secrets:
       - db_password
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready", "-U", "nextcloud"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
+    # The pgautoupgrade image already ships its own HEALTHCHECK.
+    # This runs pg_isready but also takes into accounts if pg_upgrade is being run.
+    # No need to override it here.
+    # healthcheck:
+    #   test: ["CMD", "/usr/local/bin/pgautoupgrade-healthcheck.sh"]
     deploy:
       labels:
         backupbot.backup.pre-hook: "/pg_backup.sh backup"

From 5d923d343f8cc45315d23254f98aeae73d8208e8 Mon Sep 17 00:00:00 2001
From: Danny Groenewegen <mail@dannygroenewegen.nl>
Date: Sun, 9 Aug 2026 20:52:28 +0200
Subject: [PATCH 14/25] chore: publish 13.2.0+32-fpm release

---
 compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.yml b/compose.yml
index 99626ae..c596243 100644
--- a/compose.yml
+++ b/compose.yml
@@ -95,7 +95,7 @@ services:
         failure_action: rollback
         order: start-first
       labels:
-        - "coop-cloud.${STACK_NAME}.version=13.1.5+32.0.13-fpm"
+        - "coop-cloud.${STACK_NAME}.version=13.2.0+32-fpm"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.volumes.redis=false"

From 2fb279d96abcb173e699859e31a64fcabe530b12 Mon Sep 17 00:00:00 2001
From: Danny Groenewegen <danny@ecommons.space>
Date: Sun, 9 Aug 2026 22:03:22 +0200
Subject: [PATCH 15/25] feat: add check_major_upgrade abra.sh function to check
 readiness for the next major

Checks version skip, pending DB upgrade, occ update:check status, and
non-shipped app compatibility (with an apps.nextcloud.com fallback
lookup) to verify if it looks safe to upgrade to the next Nextcloud major
version.
---
 README.md    |  44 +++++++++++++-
 abra.sh      | 159 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 release/next |   1 +
 3 files changed, 201 insertions(+), 3 deletions(-)
 create mode 100644 release/next

diff --git a/README.md b/README.md
index dd86ffa..e0466f8 100644
--- a/README.md
+++ b/README.md
@@ -130,9 +130,49 @@ To disable dashboard app (since it is so corporate):
 - Configure a `defaultapp` in your `config.php` or use [apporder](https://apps.nextcloud.com/apps/apporder)
 
 ## Upgrading Nextcloud
-Upgrading Nextcloud can be a hair raising experiance. They [don't support downgrading](https://docs.nextcloud.com/server/latest/admin_manual/maintenance/upgrade.html) even for minor versions.
 
-Many of us  have found that jumping major versions when upgrading is also a bad idea. We have however found that it's ok to skip minor version upgrades and go to the last minor version before a major version (e.g. 24.0.0 to 24.9.9 before going to 25.0.0). To extra cautious just upgrade one release at a time. Read the release notes and check your logs.
+Upgrading Nextcloud can be a hair raising experiance. They
+[don't support downgrading](https://docs.nextcloud.com/server/latest/admin_manual/maintenance/upgrade.html)
+even for minor versions.
+
+### Upgrade path
+
+Many of us have found that jumping major versions when upgrading is a bad idea.
+We have however found that it's ok to skip minor version upgrades and go to the
+last minor version before a major version (e.g. 24.0.0 to 24.9.9 before going to
+25.0.0). To be extra cautious just upgrade one release at a time. Read the
+release notes and check your logs.
+
+### Checking upgrade readiness
+
+Before upgrading to a new major, check whether the instance (and its enabled
+apps) look ready:
+
+`abra app cmd <app-name> app check_major_upgrade`
+
+This checks that you're not skipping a major version, that there's no pending DB
+upgrade left over from a previous update, and that every enabled non-shipped app
+declares support for the target major (falling back to an apps.nextcloud.com
+lookup to see if an app update would fix it). Shipped apps (`files`, `settings`,
+etc.) are skipped since they come bundled and are upgraded within the Docker
+image. Pass an explicit target major as the first argument (e.g.
+`check_major_upgrade 33`) to check readiness for a specific major, or it
+defaults to current major + 1. This is a sanity check, not a guarantee. Still
+read Nextcloud's release notes for any
+[critical changes between major versions](https://docs.nextcloud.com/server/stable/admin_manual/release_notes/index.html#critical-changes).
+
+### Staying on an old major version
+
+If you're not able to move to a new major version yet (e.g. because of app
+incompatibility), note that (starting from v32) before we release a recipe
+container a new major Nextcloud version, we also publish one more release of the
+previous major that points its image at the floating `nextcloud:XX-fpm` tag
+(e.g. `nextcloud:32-fpm`) instead of a pinned patch version. Deploying that
+release is less predictable: every redeploy pulls whatever the latest `32-fpm`
+build happens to be at that moment, rather than a fixed, reproducible version.
+But it means you keep getting security patches for the old major if you can't
+move to the next major. See [MAINTENANCE.md](./MAINTENANCE.md#release-cadence)
+for how this fits into our release process.
 
 ## Upgrading Nextcloud apps (plug-ins)
 
diff --git a/abra.sh b/abra.sh
index af39f71..f201ab7 100644
--- a/abra.sh
+++ b/abra.sh
@@ -10,7 +10,8 @@ export CRONTAB_VERSION=v1
 export PG_BACKUP_VERSION=v2
 
 run_occ() {
-    su -p www-data -s /bin/sh -c "/var/www/html/occ $@"
+    # NOTE: uses $* (not $@) so this still works when called with multiple args as seperate words.
+    su -p www-data -s /bin/sh -c "/var/www/html/occ $*"
 }
 
 install_apps() {
@@ -193,3 +194,159 @@ set_windowsfriendly_filenames() {
 upgrade_mariadb() {
     mariadb-upgrade -p`cat /run/secrets/db_root_password`
 }
+
+# Checks whether this instance looks ready to update to the next Nextcloud
+# major version.
+#
+# Usage:
+#   abra app cmd <app-name> app check_major_upgrade
+#   abra app cmd <app-name> app check_major_upgrade 33     # check readiness for a specific target
+#
+# What it checks:
+#   - current version is exactly one major behind the target
+#   - no pending DB upgrade from a previous, unfinished update
+#   - whether a newer release is available on the current major
+#     (recommended before upgradeing to the next major)
+#   - every enabled, non-shipped app's compatibility with the target major
+#   - for apps that don't, whether apps.nextcloud.com already has a newer
+#     release that does
+#
+# It does NOT check every precondition, always read the release notes
+# from Nextcloud too.
+check_major_upgrade() {
+    target_major=$1
+
+    echo "=== Nextcloud major upgrade readiness check ==="
+
+    status_json=$(run_occ status --output=json 2>/dev/null)
+    if [ -z "$status_json" ]; then
+        echo "[FAIL] Could not read 'occ status' - is Nextcloud installed and reachable?"
+        return 1
+    fi
+
+    current_version=$(echo "$status_json" | php -r '$d=json_decode(stream_get_contents(STDIN),true); echo $d["versionstring"] ?? "";')
+    current_major=${current_version%%.*}
+    needs_db_upgrade=$(echo "$status_json" | php -r '$d=json_decode(stream_get_contents(STDIN),true); echo ($d["needsDbUpgrade"] ?? false) ? "true" : "false";')
+
+    if [ -z "$current_major" ]; then
+        echo "[FAIL] Could not determine the current Nextcloud version from 'occ status'."
+        return 1
+    fi
+
+    if [ -z "$target_major" ]; then
+        target_major=$((current_major + 1))
+    fi
+
+    echo "Current version:      $current_version"
+    echo "Target major version: $target_major"
+
+    ok=true
+
+    if [ "$target_major" -le "$current_major" ]; then
+        echo "[FAIL] Target major ($target_major) is not newer than the current major ($current_major)."
+        ok=false
+    elif [ "$target_major" -gt "$((current_major + 1))" ]; then
+        echo "[FAIL] Cannot skip major versions. Upgrade to $((current_major + 1)) first."
+        ok=false
+    fi
+
+    if [ "$needs_db_upgrade" = "true" ]; then
+        echo "[FAIL] A pending database upgrade was detected. Run 'occ upgrade' for the current version first."
+        ok=false
+    fi
+
+    echo
+    echo "--- occ update:check ---"
+    update_check_output=$(run_occ "update:check" 2>&1)
+    if [ -z "$update_check_output" ]; then
+        echo "[WARN] 'occ update:check' produced no output, could not verify."
+    elif echo "$update_check_output" | grep -q "Everything up to date"; then
+        echo "[OK]   Everything up to date."
+    else
+        available_version=$(echo "$update_check_output" | grep -oE 'Nextcloud [0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?' | head -n1 | awk '{print $2}')
+        available_major=${available_version%%.*}
+        if [ -z "$available_major" ]; then
+            echo "[WARN] Could not parse 'occ update:check' output to determine the available version."
+        elif [ "$available_major" = "$current_major" ]; then
+            echo "[WARN] $available_version is available on the current major. Recommended to update to that before upgrading to $target_major."
+        else
+            echo "[OK]   Already on the latest release of major $current_major (next available update is $available_version)."
+        fi
+    fi
+    echo
+
+    echo "--- Non-shipped app compatibility with Nextcloud $target_major ---"
+    echo "(shipped apps are skipped, they come bundled with the docker image)"
+    apps_json=$(run_occ "app:list --shipped=false --enabled --output=json" 2>/dev/null)
+
+    if [ -z "$apps_json" ]; then
+        echo "[WARN] 'occ app:list' returned no output, could not check non-shipped app compatibility."
+        enabled_apps=""
+    else
+        apps_json_valid=$(echo "$apps_json" | php -r '$d=json_decode(stream_get_contents(STDIN),true); echo (json_last_error() === JSON_ERROR_NONE && is_array($d)) ? "1" : "0";')
+        if [ "$apps_json_valid" != "1" ]; then
+            echo "[WARN] Could not parse 'occ app:list' output, could not check non-shipped app compatibility."
+            enabled_apps=""
+        else
+            enabled_apps=$(echo "$apps_json" | php -r '$d=json_decode(stream_get_contents(STDIN),true); foreach(array_keys($d["enabled"] ?? []) as $a) echo $a."\n";')
+            if [ -z "$enabled_apps" ]; then
+                echo "No non-shipped apps are enabled - nothing to check here."
+            fi
+        fi
+    fi
+
+    compatible_apps=""
+    compatible_apps_fetched=0
+
+    for app in $enabled_apps; do
+        info_file=$(find /var/www/html/apps /var/www/html/custom_apps -maxdepth 3 -type f -ipath "*/$app/appinfo/info.xml" 2>/dev/null | head -n1)
+
+        if [ -z "$info_file" ]; then
+            echo "[WARN] $app: could not locate appinfo/info.xml, skipping"
+            continue
+        fi
+
+        max_version=$(php -r '
+            $x = @simplexml_load_file($argv[1]);
+            $dep = $x ? ($x->dependencies->nextcloud ?? null) : null;
+            echo $dep !== null ? (string)$dep["max-version"] : "";
+        ' "$info_file")
+
+        if [ -z "$max_version" ]; then
+            echo "[WARN] $app: no max-version declared in info.xml, assume compatible but verify manually"
+            continue
+        fi
+
+        if [ "${max_version%%.*}" -ge "$target_major" ] 2>/dev/null; then
+            echo "[OK]   $app: installed version supports up to Nextcloud $max_version"
+            continue
+        fi
+
+        echo "[INFO] $app: installed version only supports up to Nextcloud $max_version"
+
+        if [ "$compatible_apps_fetched" != "1" ]; then
+            compatible_apps_fetched=1
+            compatible_apps=$(curl -fsSL --max-time 30 "https://apps.nextcloud.com/api/v1/platform/${target_major}.0.0/apps.json" 2>/dev/null \
+                | php -r '$d=json_decode(stream_get_contents(STDIN),true); if(is_array($d)) foreach($d as $a) echo $a["id"]."\n";')
+        fi
+
+        if [ -z "$compatible_apps" ]; then
+            echo "[FAIL] $app: could not reach apps.nextcloud.com to check for a newer compatible release, verify manually"
+            ok=false
+        elif echo "$compatible_apps" | grep -qxF "$app"; then
+            echo "[WARN] $app: apps.nextcloud.com has a release that supports $target_major. It may not update until Nextcloud is upgraded, occ upgrade will try to update it automatically"
+        else
+            echo "[FAIL] $app: no apps.nextcloud.com release supports $target_major yet, it will be disabled during the upgrade"
+            ok=false
+        fi
+    done
+
+    echo
+    if [ "$ok" = true ]; then
+        echo "=== READY: no blocking issues found for upgrade to major $target_major ==="
+        return 0
+    else
+        echo "=== NOT READY: resolve the [FAIL] items above before running the upgrade ==="
+        return 1
+    fi
+}
diff --git a/release/next b/release/next
new file mode 100644
index 0000000..4c2a64c
--- /dev/null
+++ b/release/next
@@ -0,0 +1 @@
+Added `check_major_upgrade` (`abra app cmd <app-name> app check_major_upgrade`) to check whether an instance is ready to upgrade to the next Nextcloud major version.

From 0998a98df5e3eb76c6efb35fe4645508e5b44690 Mon Sep 17 00:00:00 2001
From: Linus Gasser <linus.gasser@epfl.ch>
Date: Sat, 8 Aug 2026 10:50:51 +0200
Subject: [PATCH 16/25] Updating to nextcloud 33.0.7

---
 compose.fulltextsearch.yml |  2 +-
 compose.yml                |  6 +++---
 release/next               | 14 +++++++++++++-
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/compose.fulltextsearch.yml b/compose.fulltextsearch.yml
index bc85ca6..ef47b35 100644
--- a/compose.fulltextsearch.yml
+++ b/compose.fulltextsearch.yml
@@ -29,7 +29,7 @@ services:
         mode: 0600
 
   searchindexer:
-    image: nextcloud:32-fpm
+    image: nextcloud:33.0.7-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached
diff --git a/compose.yml b/compose.yml
index c596243..fb59d60 100644
--- a/compose.yml
+++ b/compose.yml
@@ -48,7 +48,7 @@ services:
       start_period: 5m
 
   app:
-    image: nextcloud:32-fpm
+    image: nextcloud:33.0.7-fpm
     depends_on:
       - db
     configs:
@@ -95,7 +95,7 @@ services:
         failure_action: rollback
         order: start-first
       labels:
-        - "coop-cloud.${STACK_NAME}.version=13.2.0+32-fpm"
+        - "coop-cloud.${STACK_NAME}.version=14.0.0+33.0.7-fpm"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.volumes.redis=false"
@@ -109,7 +109,7 @@ services:
       start_period: 15m
 
   cron:
-    image: nextcloud:32-fpm
+    image: nextcloud:33.0.7-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached
diff --git a/release/next b/release/next
index 4c2a64c..7a815a2 100644
--- a/release/next
+++ b/release/next
@@ -1 +1,13 @@
-Added `check_major_upgrade` (`abra app cmd <app-name> app check_major_upgrade`) to check whether an instance is ready to upgrade to the next Nextcloud major version.
+Upgrades Nextcloud from 32.0.13 to 33 (major version upgrade).
+
+IMPORTANT:
+- Nextcloud does NOT support downgrades. Take a backup before deploying.
+- Do not skip major versions: your instance must be on the latest 32.x before
+  upgrading to 33. If you are on an older 32.x, deploy 32.0.13 first.
+- After deploying, check the logs and run any pending repair/upgrade steps:
+  `abra app cmd <app> app run_occ '"app:update --all"'`
+- Review app (plug-in) compatibility with Nextcloud 33 before upgrading; some
+  apps may need to be updated or temporarily disabled.
+- Added `check_major_upgrade` (`abra app cmd <app-name> app check_major_upgrade`) 
+  to check whether an instance is ready to upgrade to the next Nextcloud 
+  major version.

From 080fedc4b6237df471c2d21084f80db85c428995 Mon Sep 17 00:00:00 2001
From: Linus Gasser <linus.gasser@epfl.ch>
Date: Tue, 11 Aug 2026 21:59:03 +0200
Subject: [PATCH 17/25] Re-arrange notes

---
 release/next | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/release/next b/release/next
index 7a815a2..e104a8f 100644
--- a/release/next
+++ b/release/next
@@ -1,13 +1,13 @@
 Upgrades Nextcloud from 32.0.13 to 33 (major version upgrade).
 
 IMPORTANT:
-- Nextcloud does NOT support downgrades. Take a backup before deploying.
 - Do not skip major versions: your instance must be on the latest 32.x before
   upgrading to 33. If you are on an older 32.x, deploy 32.0.13 first.
+- Added `check_major_upgrade` (`abra app cmd <app-name> app check_major_upgrade`) 
+  to check whether an instance is ready to upgrade to the next Nextcloud 
+  major version.
+- Nextcloud does NOT support downgrades. Take a backup before deploying.
 - After deploying, check the logs and run any pending repair/upgrade steps:
   `abra app cmd <app> app run_occ '"app:update --all"'`
 - Review app (plug-in) compatibility with Nextcloud 33 before upgrading; some
   apps may need to be updated or temporarily disabled.
-- Added `check_major_upgrade` (`abra app cmd <app-name> app check_major_upgrade`) 
-  to check whether an instance is ready to upgrade to the next Nextcloud 
-  major version.

From 2e0a4cf928462b9d1a4368a22a5b0663c8b59a55 Mon Sep 17 00:00:00 2001
From: Linus Gasser <linus.gasser@epfl.ch>
Date: Tue, 11 Aug 2026 22:17:39 +0200
Subject: [PATCH 18/25] chore: publish 14.0.0+33.0.7-fpm release

---
 release/{next => 14.0.0+33.0.7-fpm} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename release/{next => 14.0.0+33.0.7-fpm} (100%)

diff --git a/release/next b/release/14.0.0+33.0.7-fpm
similarity index 100%
rename from release/next
rename to release/14.0.0+33.0.7-fpm

From 533f4bf66c0f6abfe82a23ca35ae965a61c9c066 Mon Sep 17 00:00:00 2001
From: Renovate Bot <renovate@coopcloud.tech>
Date: Tue, 11 Aug 2026 14:16:53 +0000
Subject: [PATCH 19/25] chore(deps): update
 docker.elastic.co/elasticsearch/elasticsearch docker tag to v8.19.20

---
 compose.fulltextsearch.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.fulltextsearch.yml b/compose.fulltextsearch.yml
index ef47b35..341c592 100644
--- a/compose.fulltextsearch.yml
+++ b/compose.fulltextsearch.yml
@@ -2,7 +2,7 @@ version: "3.8"
 
 services:
   elasticsearch:
-    image: "docker.elastic.co/elasticsearch/elasticsearch:8.19.19"
+    image: "docker.elastic.co/elasticsearch/elasticsearch:8.19.20"
     environment:
       - cluster.name=docker-cluster
       - bootstrap.memory_lock=true

From 2b23d5f6541fc007580f0fdef2b0690a2da4a676 Mon Sep 17 00:00:00 2001
From: Linus Gasser <linus.gasser@epfl.ch>
Date: Tue, 11 Aug 2026 22:20:41 +0200
Subject: [PATCH 20/25] chore: publish 14.0.1+33.0.7-fpm release

---
 compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.yml b/compose.yml
index fb59d60..2554d2b 100644
--- a/compose.yml
+++ b/compose.yml
@@ -95,7 +95,7 @@ services:
         failure_action: rollback
         order: start-first
       labels:
-        - "coop-cloud.${STACK_NAME}.version=14.0.0+33.0.7-fpm"
+        - "coop-cloud.${STACK_NAME}.version=14.0.1+33.0.7-fpm"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.volumes.redis=false"

From c0683807bb43381e68b6d4a2b424d9201e023314 Mon Sep 17 00:00:00 2001
From: Javielico <103+javielico@noreply.git.coopcloud.tech>
Date: Mon, 10 Aug 2026 19:12:08 +0000
Subject: [PATCH 21/25] Adding myself as maintainer

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index e0466f8..8de10a1 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
 Fully automated luxury Nextcloud via docker-swarm.
 
 <!-- metadata -->
-* **Maintainer**: [@dannygroenewegen](https://git.coopcloud.tech/dannygroenewegen), [@ineiti](https://git.coopcloud.tech/ineiti)
+* **Maintainer**: [@dannygroenewegen](https://git.coopcloud.tech/dannygroenewegen), [@ineiti](https://git.coopcloud.tech/ineiti), [@javielico](https://git.coopcloud.tech/javielico)
 * **Category**: Apps
 * **Status**: 5
 * **Image**: [`nextcloud`](https://hub.docker.com/_/nextcloud), 4, upstream

From bac93fd4a5c37a32c112ac6ffb93b5bd30fdd4f6 Mon Sep 17 00:00:00 2001
From: Linus Gasser <linus.gasser@epfl.ch>
Date: Tue, 11 Aug 2026 22:20:41 +0200
Subject: [PATCH 22/25] Update to postgresql-17

---
 compose.postgres.yml | 2 +-
 release/next         | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 release/next

diff --git a/compose.postgres.yml b/compose.postgres.yml
index c3f071b..b9c581a 100644
--- a/compose.postgres.yml
+++ b/compose.postgres.yml
@@ -10,7 +10,7 @@ services:
       - NEXTCLOUD_UPDATE=1
 
   db:
-    image: "pgautoupgrade/pgautoupgrade:14-debian"
+    image: "pgautoupgrade/pgautoupgrade:17-debian"
     #setting max_connections with -c breaks pgautoupgrade
     #command: -c "max_connections=${MAX_DB_CONNECTIONS:-100}"
     volumes:
diff --git a/release/next b/release/next
new file mode 100644
index 0000000..10a29c1
--- /dev/null
+++ b/release/next
@@ -0,0 +1 @@
+Update pgautoupgrade to postgresql v17
\ No newline at end of file

From 72562871ea818e736cd833a3a8c42a18a476bee5 Mon Sep 17 00:00:00 2001
From: Danny Groenewegen <mail@dannygroenewegen.nl>
Date: Thu, 13 Aug 2026 12:20:17 +0200
Subject: [PATCH 23/25] chore: publish 14.1.0+33.0.7-fpm release

---
 compose.yml                         | 2 +-
 release/{next => 14.1.0+33.0.7-fpm} | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename release/{next => 14.1.0+33.0.7-fpm} (100%)

diff --git a/compose.yml b/compose.yml
index 2554d2b..bf89823 100644
--- a/compose.yml
+++ b/compose.yml
@@ -95,7 +95,7 @@ services:
         failure_action: rollback
         order: start-first
       labels:
-        - "coop-cloud.${STACK_NAME}.version=14.0.1+33.0.7-fpm"
+        - "coop-cloud.${STACK_NAME}.version=14.1.0+33.0.7-fpm"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.volumes.redis=false"
diff --git a/release/next b/release/14.1.0+33.0.7-fpm
similarity index 100%
rename from release/next
rename to release/14.1.0+33.0.7-fpm

From fd01844b8fae85458d724fc7b19c6002da69c314 Mon Sep 17 00:00:00 2001
From: Linus Gasser <linus.gasser@epfl.ch>
Date: Fri, 14 Aug 2026 11:19:19 +0200
Subject: [PATCH 24/25] Update to latest version

---
 compose.fulltextsearch.yml | 2 +-
 compose.yml                | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/compose.fulltextsearch.yml b/compose.fulltextsearch.yml
index 341c592..1e19d42 100644
--- a/compose.fulltextsearch.yml
+++ b/compose.fulltextsearch.yml
@@ -29,7 +29,7 @@ services:
         mode: 0600
 
   searchindexer:
-    image: nextcloud:33.0.7-fpm
+    image: nextcloud:33.0.8-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached
diff --git a/compose.yml b/compose.yml
index bf89823..b3b296b 100644
--- a/compose.yml
+++ b/compose.yml
@@ -48,7 +48,7 @@ services:
       start_period: 5m
 
   app:
-    image: nextcloud:33.0.7-fpm
+    image: nextcloud:33.0.8-fpm
     depends_on:
       - db
     configs:
@@ -109,7 +109,7 @@ services:
       start_period: 15m
 
   cron:
-    image: nextcloud:33.0.7-fpm
+    image: nextcloud:33.0.8-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached

From 65e13ff3f30bae7fa3f1d730da8b3b6d5dabb9b0 Mon Sep 17 00:00:00 2001
From: Linus Gasser <linus.gasser@epfl.ch>
Date: Fri, 14 Aug 2026 12:47:36 +0200
Subject: [PATCH 25/25] chore: publish 14.1.1+33.0.8-fpm release

---
 compose.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.yml b/compose.yml
index b3b296b..46de6f4 100644
--- a/compose.yml
+++ b/compose.yml
@@ -95,7 +95,7 @@ services:
         failure_action: rollback
         order: start-first
       labels:
-        - "coop-cloud.${STACK_NAME}.version=14.1.0+33.0.7-fpm"
+        - "coop-cloud.${STACK_NAME}.version=14.1.1+33.0.8-fpm"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "backupbot.backup.volumes.redis=false"