I think this is quite dangerous concerning security issues but also bugs which got fixed in newer ownCloud versions.
Maybe it could be in the interest of the ownCloud team to get this ancient version removed from the app store? Or at least a disclaimer added to the page that users are installing such an outdated version having known bugs and security issues?
Is there some one from ownCloud in contact with QNAP or is it possible for QNAP customers to write tickets?
This app is not owned or maintained by ownCloud. It is like any other public package registry (DockerHub, npmjs, pypi, etc.) Anyone can create and publish packages there, and users should not blindly trust package sources on the internet.
IMO, there is nothing we can do (and that’s good) since this package is not owned by ownCloud. Imagine that someone can request a package deletion of e.g. a container image mynamespace/owncloud on DockerHub just because it is called owncloud.
Maybe the ownCloud team as the vendor of the product still has the possibility to request either a removal or a mark as outdated if strong reasons are given (like security issues which exists for this 10.0.10 version) that because it’s not a random user requesting it but the actual vendor. And the info that the version is outdated is freely available and can be verified by QNAP.
I think it could be also damaging the reputation of ownCloud if users can installing a more then four year old version of ownCloud on their system that easily.
I wouldn’t see it that dramatic, at least it’s a 10.x! Of course, any newer version is better, more secure and so on. But it’s the maintainers alone job to care about the package. If he doesn’t, find someone who creates a newer package based on a core current version.
i haven’t mentioned it explicitly but there actually already a (nearly) current version 10.10.0 available for QNAP systems in their app store.
So i think having two variants of ownCloud in the QNAP app store (one stone old and one nearly current) with users (like seen in Copy many files to a folder via browser fails) still installing the outdated version instead of the current is something quite problematic / really bad user experience :-/