All core entities except File implement a createAccess() override. As the default return value of Entity::access is TRUE, this leads to the problem that the value for File is always TRUE - ignoring "create files" permission.
Our assumption is currently, that not creating that override when adding entity_access in #3011 was an oversight.
I'm not sure if this is a bug or a feature request. Feedback is welcome.
Also related: #4975 - TRUE is a dangerous default value, anyway.
Recent comments
Thanks, the /tmp folder was the problem. I moved it elsewhere and then the updated worked. Thanks again!
Update 1.35.1 appears to install but hasn't
Probably not the reason, but worth to do a quick check: Sometimes the update cache interferes, so if something's odd with updates - some module (or core) claims to have updated, but then...
Update 1.35.1 appears to install but hasn't
Nope, not touched any permissions!
Update 1.35.1 appears to install but hasn't