From c1695dcf728363f4f8398dffd09ef87313c7d1c5 Mon Sep 17 00:00:00 2001
From: autonomic-bot <autonomic-bot@git.autonomic.zone>
Date: Mon, 13 Jul 2026 20:05:06 +0000
Subject: [PATCH] upstream(gitea): note 1.26.3 regression + 1.27.0 breaking
 changes

---
 cc-ci-plan/upstream/gitea.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/cc-ci-plan/upstream/gitea.md b/cc-ci-plan/upstream/gitea.md
index f57ba92..8e17b92 100644
--- a/cc-ci-plan/upstream/gitea.md
+++ b/cc-ci-plan/upstream/gitea.md
@@ -7,9 +7,11 @@
 
 ## Standing notes
 - **postgres major version**: recipe uses plain postgres (not pgautoupgrade); pg_backup.sh uses pg_dump/psql (logical backup, not pg_upgrade). Major version bump (e.g. 15→16) requires operator to manually restore from logical backup — no auto-migration tooling. Bump only within same major (e.g. 15.13→15.18) unless recipe adds pg_upgrade support.
-- **compose.postgres.yml**: postgres is an optional overlay (not in the main compose.yml). The cc-ci tests determine whether the postgres overlay is used.
+- **compose.postgres.yml**: postgres is an optional overlay (not in the main compose.yml). The cc-ci tests determine whether the postgres overlay is used. `abra recipe upgrade` reads it too and will propose a db bump — hold db unless doing a migration-aware major bump.
 - **1.25.0**: Removed deprecated auth sources — legacy auth setups may need reconfiguration.
 - **1.25.0**: CreateVariable API now returns 201 instead of 200 — API consumers may need updating.
 - **1.26.0**: Removed GET API registration-token endpoint — scripts using this endpoint must update.
 - **1.26.0**: PUBLIC_URL_DETECTION now defaults to 'auto' — verify reverse proxy setups work after upgrade.
 - **1.26.2**: Multiple CVE security fixes — strongly recommended upgrade.
+- **1.26.3**: carries a regression (#38177 "context deadline exceeded" opening repo code pages) — upstream says upgrade straight to 1.26.4, skip 1.26.3.
+- **1.27.0** (released 2026-07-13, MINOR with BREAKING changes): `Feat(actions)!: improve support for reusable workflows` (#37478) and `Use Content-Security-Policy: script nonce` (#37232, may break custom inline JS / reverse-proxy CSP). Many security + feature additions. A dedicated minor-bump run should evaluate CSP / reusable-workflow impact before adopting.