cc-ci-orchestrator/cc-ci-plan/upstream/gitea.md

Upstream sources — gitea

service	image	source repo	releases / changelog
app	gitea/gitea	https://github.com/go-gitea/gitea	https://github.com/go-gitea/gitea/releases
db	postgres	https://github.com/postgres/postgres	https://www.postgresql.org/docs/release/

Standing notes

• postgres major version: recipe uses plain postgres (not pgautoupgrade); pg_backup.sh uses pg_dump/psql (logical backup, not pg_upgrade). Major version bump (e.g. 15→16) requires operator to manually restore from logical backup — no auto-migration tooling. Bump only within same major (e.g. 15.13→15.18) unless recipe adds pg_upgrade support.
• compose.postgres.yml: postgres is an optional overlay (not in the main compose.yml). The cc-ci tests determine whether the postgres overlay is used. abra recipe upgrade reads it too and will propose a db bump — hold db unless doing a migration-aware major bump.
• 1.25.0: Removed deprecated auth sources — legacy auth setups may need reconfiguration.
• 1.25.0: CreateVariable API now returns 201 instead of 200 — API consumers may need updating.
• 1.26.0: Removed GET API registration-token endpoint — scripts using this endpoint must update.
• 1.26.0: PUBLIC_URL_DETECTION now defaults to 'auto' — verify reverse proxy setups work after upgrade.
• 1.26.2: Multiple CVE security fixes — strongly recommended upgrade.
• 1.26.3: carries a regression (#38177 "context deadline exceeded" opening repo code pages) — upstream says upgrade straight to 1.26.4, skip 1.26.3.
• 1.27.0 (released 2026-07-13, MINOR with BREAKING changes): Feat(actions)!: improve support for reusable workflows (#37478) and Use Content-Security-Policy: script nonce (#37232, may break custom inline JS / reverse-proxy CSP). Many security + feature additions. A dedicated minor-bump run should evaluate CSP / reusable-workflow impact before adopting.