From f58a600fbd21222a152f645da44c5055d84eb26e Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Fri, 11 Sep 2026 02:41:09 +0000 Subject: [PATCH] upstream(gitea): add mariadb release-notes sources (overlay db pin was invisible to abra survey) --- cc-ci-plan/upstream/gitea.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/cc-ci-plan/upstream/gitea.md b/cc-ci-plan/upstream/gitea.md index a522edc..33e214b 100644 --- a/cc-ci-plan/upstream/gitea.md +++ b/cc-ci-plan/upstream/gitea.md @@ -10,8 +10,27 @@ This is where CVE-2026-60004 + CVE-2026-59774 (both CVSS 9.8, fixed in 1.27.1) w and why the 2026-08-03/07 reports under-counted gitea's CVEs. advisory-scan.py fetches every URL in this file, so keep vendor security pages listed here. | db | postgres | https://github.com/postgres/postgres | https://www.postgresql.org/docs/release/ | +| db (mariadb overlay) | mariadb | https://github.com/MariaDB/server | https://mariadb.com/docs/release-notes/community-server/10.11 (series index — the CVE tables live on the PER-RELEASE pages, e.g. https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19) | ## Standing notes +- **mariadb overlay** (compose.mariadb.yml): pinned `mariadb:10.11.x` (10.11 LTS, maintained until + Feb 2028). ⚠ BOTH db overlays (postgres + mariadb) define the same service name `db`, and + `abra recipe upgrade -m` machine output keeps only ONE `db` entry — the postgres one (files are + processed alphabetically; the mariadb result is clobbered). ALWAYS check the mariadb pin against + Docker Hub directly; the weekly survey's single "db:" line hides it. Per-release security notes + (CVE tables — GitHub release bodies only link out): + https://mariadb.com/docs/release-notes/community-server/10.11/10.11.3.md + https://mariadb.com/docs/release-notes/community-server/10.11/10.11.6.md + https://mariadb.com/docs/release-notes/community-server/10.11/10.11.8.md + https://mariadb.com/docs/release-notes/community-server/10.11/10.11.11.md + https://mariadb.com/docs/release-notes/community-server/10.11/10.11.12.md + https://mariadb.com/docs/release-notes/community-server/10.11/10.11.15.md + https://mariadb.com/docs/release-notes/community-server/10.11/10.11.16.md + https://mariadb.com/docs/release-notes/community-server/10.11/10.11.17.md + https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18.md + https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19.md + (the 10 CVE-bearing releases of the 10.11.2→10.11.19 window, 2026-09-11; append newer pages for + later windows). - **postgres major version**: recipe uses plain postgres (not pgautoupgrade); pg_backup.sh uses pg_dump/psql (logical backup, not pg_upgrade). Major version bump (e.g. 15→16) requires operator to manually restore from logical backup — no auto-migration tooling. Bump only within same major (e.g. 15.13→15.18) unless recipe adds pg_upgrade support. - **compose.postgres.yml**: postgres is an optional overlay (not in the main compose.yml). The cc-ci tests determine whether the postgres overlay is used. `abra recipe upgrade` reads it too and will propose a db bump — hold db unless doing a migration-aware major bump. - **1.25.0**: Removed deprecated auth sources — legacy auth setups may need reconfiguration.