# Upstream sources — gitea

| service | image | source repo | releases / changelog |
|---------|-------|-------------|----------------------|
| app     | gitea/gitea | https://github.com/go-gitea/gitea | https://github.com/go-gitea/gitea/releases |

**Security announcements: https://blog.gitea.com/ — per-release posts (e.g.
https://blog.gitea.com/release-of-1.27.1/) carry the CVE list; the GitHub release notes do NOT.**
This is where CVE-2026-60004 + CVE-2026-59774 (both CVSS 9.8, fixed in 1.27.1) were announced,
and why the 2026-08-03/07 reports under-counted gitea's CVEs. advisory-scan.py fetches every URL
in this file, so keep vendor security pages listed here.
| db      | postgres | https://github.com/postgres/postgres | https://www.postgresql.org/docs/release/ |
| db (mariadb overlay) | mariadb | https://github.com/MariaDB/server | https://mariadb.com/docs/release-notes/community-server/10.11 (series index — the CVE tables live on the PER-RELEASE pages, e.g. https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19) |

## Standing notes
- **mariadb overlay** (compose.mariadb.yml): pinned `mariadb:10.11.x` (10.11 LTS, maintained until
  Feb 2028). ⚠ BOTH db overlays (postgres + mariadb) define the same service name `db`, and
  `abra recipe upgrade -m` machine output keeps only ONE `db` entry — the postgres one (files are
  processed alphabetically; the mariadb result is clobbered). ALWAYS check the mariadb pin against
  Docker Hub directly; the weekly survey's single "db:" line hides it. Per-release security notes
  (CVE tables — GitHub release bodies only link out): 
  https://mariadb.com/docs/release-notes/community-server/10.11/10.11.3.md
  https://mariadb.com/docs/release-notes/community-server/10.11/10.11.6.md
  https://mariadb.com/docs/release-notes/community-server/10.11/10.11.8.md
  https://mariadb.com/docs/release-notes/community-server/10.11/10.11.11.md
  https://mariadb.com/docs/release-notes/community-server/10.11/10.11.12.md
  https://mariadb.com/docs/release-notes/community-server/10.11/10.11.15.md
  https://mariadb.com/docs/release-notes/community-server/10.11/10.11.16.md
  https://mariadb.com/docs/release-notes/community-server/10.11/10.11.17.md
  https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18.md
  https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19.md
  (the 10 CVE-bearing releases of the 10.11.2→10.11.19 window, 2026-09-11; append newer pages for
  later windows).
- **postgres major version**: recipe uses plain postgres (not pgautoupgrade); pg_backup.sh uses pg_dump/psql (logical backup, not pg_upgrade). Major version bump (e.g. 15→16) requires operator to manually restore from logical backup — no auto-migration tooling. Bump only within same major (e.g. 15.13→15.18) unless recipe adds pg_upgrade support.
- **compose.postgres.yml**: postgres is an optional overlay (not in the main compose.yml). The cc-ci tests determine whether the postgres overlay is used. `abra recipe upgrade` reads it too and will propose a db bump — hold db unless doing a migration-aware major bump.
- **1.25.0**: Removed deprecated auth sources — legacy auth setups may need reconfiguration.
- **1.25.0**: CreateVariable API now returns 201 instead of 200 — API consumers may need updating.
- **1.26.0**: Removed GET API registration-token endpoint — scripts using this endpoint must update.
- **1.26.0**: PUBLIC_URL_DETECTION now defaults to 'auto' — verify reverse proxy setups work after upgrade.
- **1.26.2**: Multiple CVE security fixes — strongly recommended upgrade.
- **1.26.3**: carries a regression (#38177 "context deadline exceeded" opening repo code pages) — upstream says upgrade straight to 1.26.4, skip 1.26.3.
- **1.27.0** (released 2026-07-13, MINOR with BREAKING changes): `Feat(actions)!: improve support for reusable workflows` (#37478) and `Use Content-Security-Policy: script nonce` (#37232, may break custom inline JS / reverse-proxy CSP). Many security + feature additions. A dedicated minor-bump run should evaluate CSP / reusable-workflow impact before adopting.
- **1.27.1** (released 2026-07-27, PATCH): security fix (oauth2 mandatory 2FA enforcement on authorize/grant endpoints, #38606), API swagger alignment, diff-contrast enhancement, and many bugfixes (actions reusable-workflow/job-stranding, OIDC end-session, repo-deletion cleanup, webhook/mail). No breaking changes; safe patch bump from 1.27.0. Release notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.1