Move CI to Nextcloud 34 and fix Lint and integration failures

[oleksandr-nc]

CI on main is red in all three places: Lint (since June), and the integration jobs on both Nextcloud 32 and 33 after the 2026-09-10 maintenance releases. This moves the integration matrix to Nextcloud 34, drops 32 and 33, and fixes each failure.

Integration tests

• Matrix is ["34"] in all three jobs. Nextcloud 35 goes final on 2026-09-16, but nextcloud:35 is not on Docker Hub yet, so it joins once the image is published (the workflow comment also says to raise after_n_builds in codecov.yml back to 9; it is 6 for a single-version matrix, otherwise Codecov waits forever).
• Password confirmation. nextcloud/server "Do not set last-password-confirm for apptoken sessions" (first 34 release: 34.0.1) means an app-password session never counts as password-confirmed, so create_user, delete_user, enable_app and disable_app return 403 "Password confirmation is required". The main job now adds the job network gateway, where test requests come from, to allowed_no_password_confirmation_ranges.
• Rate limiting was never disabled. The workflow set ratelimit_protection_enabled, which Nextcloud does not read; the real key is ratelimit.protection.enabled. That removes the circles create 429s (10 per minute) and makes the shares ratelimit_overwrite lines redundant, so they are gone.
• Cospend is installed, so its 41 tests run instead of skipping.
• Circles ownership transfer is skipped on SQLite. The circles app locks member rows with SELECT ... FOR UPDATE, which Nextcloud's SQLite platform rejects ("Operation 'FOR UPDATE' is not supported by platform"), so test_promote_to_owner_transfers_and_demotes_caller failed 3 of 3 times on SQLite nextcloud:34. It still runs (and passes) on MySQL/PostgreSQL.
• Nextcloud 33.0.9 also broke occ user:auth-tokens:add (it reads a --login-name option that stable33 never defines), which is why NC 33 failed before running any test. 34.0.4 is not affected.

Lint

• ruff 0.16.7 flags PLR0917 (too many positional arguments) on 25 signatures, mostly MCP tools; it is ignored next to PLR0913. The six FURB192 hits in test_versions.py use min() now.
• pyright has failed since icalendar 7.2.0 typed Component.__getitem__ as a union of every property class. _format_event and _format_task now narrow with isinstance and read the typed categories property, which exists since icalendar 7.0.0. Parsed output is byte-identical for multiple CATEGORIES lines, escaped commas, missing categories and RRULE.

README

The Nextcloud badge is 34 | 35, the CI paragraph is updated, and "Getting an App Password" explains the password-confirmation limitation for the four admin tools and the allowed_no_password_confirmation_ranges setting (34.0.3 and newer).

Verification

• ruff check, ruff format --check, isort --check src/ and pyright 1.1.414 are clean; unit tests: 104 passed.
• Against a local nextcloud:34 (34.0.4) container configured like CI: user creation with an app password returns 403 without the range and 200 with the gateway range; 15 consecutive circle creations all return 200 with ratelimit.protection.enabled=false; test_session_cache.py 12 passed (its app-password tests were skipped on 33); test_calendar.py and test_tasks.py 95 passed.
• Full integration suite against a local Nextcloud 35.0.0 RC3 instance (MySQL, app password auth): 864 passed, nothing failed or skipped, including circles ownership transfer.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9b2b50c8-0280-4d8c-aa11-fd2e14545c1d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.22%. Comparing base (d6c3af6) to head (a67025c).

Additional details and impacted files

@@             Coverage Diff             @@
##             main      #60       +/-   ##
===========================================
+ Coverage   43.77%   96.22%   +52.44%     
===========================================
  Files          31       31               
  Lines        3367     3363        -4     
===========================================
+ Hits         1474     3236     +1762     
+ Misses       1893      127     -1766     

Flag	Coverage Δ
integration	95.06% <100.00%> (?)
nc34	95.06% <100.00%> (?)
py3.12	9.48% <0.00%> (+0.01%)	⬆️
py3.13	9.48% <0.00%> (+0.01%)	⬆️
py3.14	9.48% <0.00%> (+0.01%)	⬆️
session-cache	19.95% <12.50%> (+0.08%)	⬆️
unit	9.48% <0.00%> (+0.01%)	⬆️
user-permissions	40.49% <12.50%> (+0.07%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.