IPv6 Spamhaus check always reports "not blacklisted"
The IPv6 blocklist check in `management/status_checks.py` builds the DNSBL query name by reversing the 16-bit groups of the address instead of reversing individual nibbles.
The malformed name returns NXDOMAIN, which evaluate_spamhaus_lookup()` treats as "not blacklisted," so the IPv6 check always passes regardless of actual listing status.
DNSBLs (including Spamhaus) expect nibble-reversed format.
This fix presents it in the correct nibble-reversed format.
Version 77 (September 26, 2026)
-------------------------------
* Roundcube updated to version 1.6.19, fixing numerous security issues.
* Nextcloud updated to version 27.1.11, and install failure fixed.
Bump Nextcloud core to 27.1.11 (latest 27.x, the highest release still
supported on PHP 8.0) and the bundled apps to their highest NC 27
compatible versions: contacts 5.5.4, calendar 4.7.20, user_external 3.4.0.
Add the 25 -> 26 step to the upgrade chain so existing installs migrate
25 -> 26 -> 27 in one run.
Closes#2399.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The setup script is using GitHub's auto-generated source archive URL
(archive/refs/tags/) to download the Nextcloud contacts and calendar apps.
Source archives exclude `vendor/` composer dependencies and compiled frontend
assets since they're gitignored, causing app:enable to fail with: `Could not
download app contacts`.
Switch to the release tarball URL (releases/download/) which includes all
pre-built assets.
* Updated Roundcube to 1.6.15, fixing a security vulnerability.
* Fixed error when configuring S3 backups on empty buckets.
* Fixed issue in management daemon name resolution.
* Fixed accessibility issues in the control panel.
- Removed `aria-hidden="true"` from the `global_modal` div.
This attribute was set but not updated, causing screen readers to ignore the modal even when it was open. Bootstrap sets and modifies `aria-hidden` automatically, so the correct approach is not to set it manually.
- The `global_modal` div has `role="dialog"` (correct) but lacked `aria-modal="true"`.
The ARIA specification recommends setting this attribute to ensure screen readers know that focus is (and should be) trapped in the modal. I added it.
- Removed `aria-hidden="true"` from the close button.
This button can receive keyboard focus, so it should have an accessible name. If it is hidden, a screen reader user experiences focus on an unnamed element, which is confusing.
- Added `aria-label="Close Dialog"` to the close button.
The visible label `×` does not describe the button’s function, but the new ARIA label does.
N9ZL