recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upstream(gitea): add mariadb release-notes sources (overlay db pin was invisible to abra survey)

Browse Source
This commit is contained in:
notplants
2026-09-11 02:41:09 +00:00
parent 193befdb99
commit f58a600fbd
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cc-ci-plan/upstream/gitea.md
+19
View File
@@ -10,8 +10,27 @@ This is where CVE-2026-60004 + CVE-2026-59774 (both CVSS 9.8, fixed in 1.27.1) w
and why the 2026-08-03/07 reports under-counted gitea's CVEs. advisory-scan.py fetches every URL
in this file, so keep vendor security pages listed here.
| db | postgres | https://github.com/postgres/postgres | https://www.postgresql.org/docs/release/ |
| db (mariadb overlay) | mariadb | https://github.com/MariaDB/server | https://mariadb.com/docs/release-notes/community-server/10.11 (series index — the CVE tables live on the PER-RELEASE pages, e.g. https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19) |
## Standing notes
- **mariadb overlay** (compose.mariadb.yml): pinned `mariadb:10.11.x` (10.11 LTS, maintained until
Feb 2028). ⚠ BOTH db overlays (postgres + mariadb) define the same service name `db`, and
`abra recipe upgrade -m` machine output keeps only ONE `db` entry — the postgres one (files are
processed alphabetically; the mariadb result is clobbered). ALWAYS check the mariadb pin against
Docker Hub directly; the weekly survey's single "db:" line hides it. Per-release security notes
(CVE tables — GitHub release bodies only link out):
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.3.md
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.6.md
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.8.md
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.11.md
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.12.md
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.15.md
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.16.md
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.17.md
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18.md
https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19.md
(the 10 CVE-bearing releases of the 10.11.2→10.11.19 window, 2026-09-11; append newer pages for
later windows).
- **postgres major version**: recipe uses plain postgres (not pgautoupgrade); pg_backup.sh uses pg_dump/psql (logical backup, not pg_upgrade). Major version bump (e.g. 15→16) requires operator to manually restore from logical backup — no auto-migration tooling. Bump only within same major (e.g. 15.13→15.18) unless recipe adds pg_upgrade support.
- **compose.postgres.yml**: postgres is an optional overlay (not in the main compose.yml). The cc-ci tests determine whether the postgres overlay is used. `abra recipe upgrade` reads it too and will propose a db bump — hold db unless doing a migration-aware major bump.
- **1.25.0**: Removed deprecated auth sources — legacy auth setups may need reconfiguration.