recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upstream(gitea): note 1.26.3 regression + 1.27.0 breaking changes

Browse Source
This commit is contained in:
autonomic-bot
2026-07-13 20:05:06 +00:00
parent d45a55a65f
commit c1695dcf72
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cc-ci-plan/upstream/gitea.md
View File

@ -7,9 +7,11 @@
## Standing notes
- **postgres major version**: recipe uses plain postgres (not pgautoupgrade); pg_backup.sh uses pg_dump/psql (logical backup, not pg_upgrade). Major version bump (e.g. 15→16) requires operator to manually restore from logical backup — no auto-migration tooling. Bump only within same major (e.g. 15.13→15.18) unless recipe adds pg_upgrade support.
- **compose.postgres.yml**: postgres is an optional overlay (not in the main compose.yml). The cc-ci tests determine whether the postgres overlay is used.
- **compose.postgres.yml**: postgres is an optional overlay (not in the main compose.yml). The cc-ci tests determine whether the postgres overlay is used. `abra recipe upgrade` reads it too and will propose a db bump — hold db unless doing a migration-aware major bump.
- **1.25.0**: Removed deprecated auth sources — legacy auth setups may need reconfiguration.
- **1.25.0**: CreateVariable API now returns 201 instead of 200 — API consumers may need updating.
- **1.26.0**: Removed GET API registration-token endpoint — scripts using this endpoint must update.
- **1.26.0**: PUBLIC_URL_DETECTION now defaults to 'auto' — verify reverse proxy setups work after upgrade.
- **1.26.2**: Multiple CVE security fixes — strongly recommended upgrade.
- **1.26.3**: carries a regression (#38177 "context deadline exceeded" opening repo code pages) — upstream says upgrade straight to 1.26.4, skip 1.26.3.
- **1.27.0** (released 2026-07-13, MINOR with BREAKING changes): `Feat(actions)!: improve support for reusable workflows` (#37478) and `Use Content-Security-Policy: script nonce` (#37232, may break custom inline JS / reverse-proxy CSP). Many security + feature additions. A dedicated minor-bump run should evaluate CSP / reusable-workflow impact before adopting.