Update to latest release of nextcloud 35

Finally getting to the latest release of nextcloud.
MAINTENANCE.md requests that two maintainers install this
repo successfully on one of their main-servers.

abra.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-export FPM_TUNE_VERSION=v6
+export FPM_TUNE_VERSION=v5
 export NGINX_CONF_VERSION=v9
 export MY_CNF_VERSION=v6
 export ENTRYPOINT_VERSION=v3

compose.fulltextsearch.yml

@@ -29,7 +29,7 @@ services:
         mode: 0600
 
   searchindexer:
-    image: nextcloud:34.0.5-fpm
+    image: nextcloud:35.0.2-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached

compose.yml

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   web:
-    image: nginx:1.31.7
+    image: nginx:1.31.6
     depends_on:
       - app
     configs:
@@ -48,7 +48,7 @@ services:
       start_period: 5m
 
   app:
-    image: nextcloud:34.0.5-fpm
+    image: nextcloud:35.0.2-fpm
     depends_on:
       - db
     configs:
@@ -109,7 +109,7 @@ services:
       start_period: 15m
 
   cron:
-    image: nextcloud:34.0.5-fpm
+    image: nextcloud:35.0.2-fpm
     volumes:
       - nextcloud:/var/www/html/
       - nextapps:/var/www/html/custom_apps:cached

fpm-tune.ini

@@ -1,14 +1,5 @@
-[www]
 pm = dynamic
 pm.max_children = {{ env "FPM_MAX_CHILDREN" }}
 pm.start_servers = {{ env "FPM_START_SERVERS" }}
 pm.min_spare_servers = {{ env "FPM_MIN_SPARE_SERVERS" }}
 pm.max_spare_servers = {{ env "FPM_MAX_SPARE_SERVERS" }}
-
-; Mitigations for CVE-2026-109618 / CVE-2026-109619 until the image ships
-; PHP >= 8.5.12, see https://www.php.net/archive/2026.php#2026-10-21-5
-php_admin_value[memory_limit] = -1
-php_admin_value[post_max_size] = 32M
-php_admin_value[upload_max_filesize] = 30M
-php_admin_value[session.upload_progress.enabled] = 0
-php_admin_value[fatal_error_backtraces] = 0

release/next

@@ -1,4 +1,13 @@
-Security: mitigates PHP RCE CVE-2026-109618 / CVE-2026-109619 (https://www.php.net/archive/2026.php#2026-10-21-5)
-via the FPM pool config: memory_limit=-1, post_max_size=32M, upload_max_filesize=30M,
-session.upload_progress.enabled=0, fatal_error_backtraces=0. PHP_MEMORY_LIMIT and PHP_UPLOAD_LIMIT
-are overridden for web requests until the nextcloud image ships PHP >= 8.5.12.
+Upgrades Nextcloud from 34 to 35 (major version upgrade).
+
+IMPORTANT:
+- Do not skip major versions: your instance must be on the latest 34.x before
+  upgrading to 35.
+- Use `check_major_upgrade` (`abra app cmd <app-name> app check_major_upgrade`)
+  to check whether an instance is ready to upgrade to the next Nextcloud
+  major version.
+- Nextcloud does NOT support downgrades. Take a backup before deploying.
+- After deploying, check the logs and run any pending repair/upgrade steps:
+  `abra app cmd <app> app run_occ '"app:update --all"'`
+- Review app (plug-in) compatibility with Nextcloud 35 before upgrading; some
+  apps may need to be updated or temporarily disabled.