IONOS: update vanilla app submodules to max NC33-compatible versions (NSW-1051)

[printminion-co]

Summary

Bump every vanilla (nextcloud/*) app submodule to the newest stable release that supports NC33. Targets come from .dev/tools/vanilla-apps-scan.sh --build-check (added in IONOS-Productivity/nc-docs-and-tools#219, following its new guide upgrade-all-vanilla-app-submodules.md). For each app, the target is the newest stable tag whose info.xml covers NC33. It is cross-checked against the App Store platform 33.0.9 release list, and "at max" is decided by comparing SHAs.

One commit per app. 10 bumped, 7 already at max. (Rebased onto ionos-dev-v33 after 85e5f4f removed the richdocuments submodule; the richdocuments bump was dropped.)

App	Pinned	Target	NC range	Store max	Status	Build (npm ^11.3.0)
contacts	v8.4.0	v8.9.1	33–36	v8.9.1	bump	ok
calendar	v6.6.0	v6.6.1	32–35	v6.6.1	bump	ok
notify_push	v1.4.0	v1.4.1	30–35	v1.4.1	bump	no package.json
tasks	v0.18.1	v0.18.1	31–35	v0.18.1	at max	-
spreed	v23.0.10	v23.0.11	33–33	v23.0.11	bump	ok
groupfolders	v21.0.0	v21.0.15	33–33	v21.0.15	bump	ok
notes	v6.0.2	v6.1.0	33–36	v6.1.0	bump	ok
deck	v1.17.5	v1.17.5	33–33	v1.17.5	at max	-
text	v33.0.9	v33.0.9	33–33	n/a	at max	-
whiteboard	v1.5.9	v2.0.0	31–35	v2.0.0	bump	ok
circles	v33.0.9	v33.0.9	33–33	n/a	at max	-
integration_openai	v4.5.2	v4.5.2	33–34	v4.5.2	at max	-
collectives	v4.6.1	v4.7.1	32–35	v4.7.1	bump	ok
tables	v2.1.1	v2.3.1	33–36	v2.3.1	bump	ok
end_to_end_encryption	v2.2.4	v2.3.0	33–35	v2.3.0	bump	ok
twofactor_totp	v33.0.9	v33.0.9	33–33	n/a	at max	-
files_pdfviewer	v33.0.9	v33.0.9	33–33	n/a	at max	-

n/a = bundled with the server, so not listed in the App Store; the aligned v33.0.9 tag is used.

Out of scope: IONOS forks (IONOS-Productivity/nc-*), IONOS custom apps (ncw-*), IONOS/, 3rdparty.

Notes

• whiteboard 1.5.9 → 2.0.0 (major). Upstream changes: Vue 3 migration, requires NC31+, JWT secret marked sensitive on NC32+ (release notes). The config keys IONOS/configure.sh sets (collabBackendUrl, jwt_secret_key, already --sensitive) are unchanged in v2.0.0, so no config change is needed. Reviewer check: the separately deployed whiteboard websocket backend should run a 2.x image. The local dev setup uses whiteboard:stable; the production image tag is not in this repo.
• notify_push 1.4.0 → 1.4.1. Patch release; the Rust binary comes from the release pipeline as before.
• contacts → v8.9.1 (updated from v8.9.0 after v8.9.1 appeared on 2026-09-30). It's tagged and listed in the App Store, but has no GitHub release page yet, so the Tag link shows the tag.
• No app was pinned below its max compatible tag. Every npm-based target installs under CI's npm (^11.3.0), so the npm 10 gap that forced older contacts pins in earlier sweeps no longer applies.

Checklist

• run .dev/container/check_release.sh pr-370 ncw — validate pr locally
• re-run .dev/tools/vanilla-apps-scan.sh on the branch — every row "at max" (17/17)
• smoke: whiteboard (2.0), contacts, tables load; occ app:list shows them enabled, no upgrade errors
• review/merge IONOS-Productivity/nc-docs-and-tools#219 (guide + tool)

Jira: NSW-1051

[Copilot]

Copilot review overview

🔵 Needs a closer look

The changes require final human review because they are too complex or risky for automated approval.

Review effort: Lite
Findings: None

What changed in this PR

Updates 11 vanilla app submodules to their latest stable NC33-compatible releases.

Changes:

• Bumps 11 external app gitlinks, including Whiteboard 1.5.9 → 2.0.0.
• Aligns app versions with NC33 compatibility and current Node/npm build requirements.
• Requires validation of the separately deployed Whiteboard WebSocket backend.

File	Description

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[bromiesTM]

Looks correct to me. Quick visual check was also ok