recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c57ddfd7f171325f56968d9bfc3c1de7b3fdf4b9
cc-ci-orchestrator/cc-ci-plan/upstream/gitea.md
T

6.6 KiB
Raw Blame History

Upstream sources — gitea

service image source repo releases / changelog
app gitea/gitea https://github.com/go-gitea/gitea https://github.com/go-gitea/gitea/releases

Security announcements: https://blog.gitea.com/ — per-release posts (e.g. https://blog.gitea.com/release-of-1.27.1/) carry the CVE list; the GitHub release notes do NOT. This is where CVE-2026-60004 + CVE-2026-59774 (both CVSS 9.8, fixed in 1.27.1) were announced, and why the 2026-08-03/07 reports under-counted gitea's CVEs. advisory-scan.py fetches every URL in this file, so keep vendor security pages listed here. | db | postgres | https://github.com/postgres/postgres | https://www.postgresql.org/docs/release/ | | db (mariadb overlay) | mariadb | https://github.com/MariaDB/server | https://mariadb.com/docs/release-notes/community-server/10.11 (series index — the CVE tables live on the PER-RELEASE pages, e.g. https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19) |

Standing notes

  • mariadb overlay (compose.mariadb.yml): pinned mariadb:10.11.x (10.11 LTS, maintained until Feb 2028). ⚠ BOTH db overlays (postgres + mariadb) define the same service name db, and abra recipe upgrade -m machine output keeps only ONE db entry — the postgres one (files are processed alphabetically; the mariadb result is clobbered). ALWAYS check the mariadb pin against Docker Hub directly; the weekly survey's single "db:" line hides it. Per-release security notes (CVE tables — GitHub release bodies only link out): https://mariadb.com/docs/release-notes/community-server/10.11/10.11.3.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.6.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.8.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.11.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.12.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.15.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.16.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.17.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19.md (the 10 CVE-bearing releases of the 10.11.2→10.11.19 window, 2026-09-11; append newer pages for later windows).
  • postgres major version: recipe uses plain postgres (not pgautoupgrade); pg_backup.sh uses pg_dump/psql (logical backup, not pg_upgrade). Major version bump (e.g. 15→16) requires operator to manually restore from logical backup — no auto-migration tooling. Bump only within same major (e.g. 15.13→15.18) unless recipe adds pg_upgrade support.
  • compose.postgres.yml: postgres is an optional overlay (not in the main compose.yml). The cc-ci tests determine whether the postgres overlay is used. abra recipe upgrade reads it too and will propose a db bump — hold db unless doing a migration-aware major bump.
  • 1.25.0: Removed deprecated auth sources — legacy auth setups may need reconfiguration.
  • 1.25.0: CreateVariable API now returns 201 instead of 200 — API consumers may need updating.
  • 1.26.0: Removed GET API registration-token endpoint — scripts using this endpoint must update.
  • 1.26.0: PUBLIC_URL_DETECTION now defaults to 'auto' — verify reverse proxy setups work after upgrade.
  • 1.26.2: Multiple CVE security fixes — strongly recommended upgrade.
  • 1.26.3: carries a regression (#38177 "context deadline exceeded" opening repo code pages) — upstream says upgrade straight to 1.26.4, skip 1.26.3.
  • 1.27.0 (released 2026-07-13, MINOR with BREAKING changes): Feat(actions)!: improve support for reusable workflows (#37478) and Use Content-Security-Policy: script nonce (#37232, may break custom inline JS / reverse-proxy CSP). Many security + feature additions. A dedicated minor-bump run should evaluate CSP / reusable-workflow impact before adopting.
  • 1.27.1 (released 2026-07-27, PATCH): security fix (oauth2 mandatory 2FA enforcement on authorize/grant endpoints, #38606), API swagger alignment, diff-contrast enhancement, and many bugfixes (actions reusable-workflow/job-stranding, OIDC end-session, repo-deletion cleanup, webhook/mail). No breaking changes; safe patch bump from 1.27.0. Release notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.1
  • 28.0.0 (released 2026-09-29, NEW MAJOR, BREAKING): git network operations now route through an internal proxy and egress settings changed (Fix(git)!, #39426) — outbound Git may need [egress] allow-listing; Actions adds RUN_RETENTION_DAYS (#38855). Also a large SECURITY batch (SSH key fingerprint identification, rejected invalid/duplicate Git objects, repo-scoped team authz, x/crypto DoS). GitHub notes: https://github.com/go-gitea/gitea/releases/tag/v28.0.0 — vendor post: https://blog.gitea.com/release-of-28.0.0/
  • 28.1.0 (released 2026-10-06, MINOR): 9 security fixes (push-mirror permission/DISABLE_NEW_PUSH, local-path import authz, repository media stored XSS, OAuth2 refresh-token kind, issue-attachment authz, FORCE_PRIVATE push-to-create, private RSS/Atom feed leak, tag-delete deleting releases, migration page-size DoS), plus MySQL/MariaDB READ COMMITTED and go-git repack fixes. No breaking changes. GitHub notes: https://github.com/go-gitea/gitea/releases/tag/v28.1.0 — vendor post (CVE list): https://blog.gitea.com/release-of-28.1.0/
  • 28.2.0 (released 2026-10-18, MINOR): 9 newly-fixed Gitea CVEs (SSH cert principal confusion, OpenID linking state, locked-issue reactions authz, release-attachment metadata leak, /{username}/-/repositories panic, draft-release attachment disclosure, Actions artifact v4 body limit, CSRF on repo topics, cross-org label deletion) plus dependency CVE-2026-78659 (golang.org/x/net v0.60.0). Three more CVEs are disclosed here but were already fixed in ≤28.1 (CVE-2026-110324, CVE-2026-109844, CVE-2026-97859). No breaking changes and no Postgres requirement. GitHub notes: https://github.com/go-gitea/gitea/releases/tag/v28.2.0 — vendor post (CVE list): https://blog.gitea.com/release-of-28.2.0/
  • app.ini writability: Gitea 1.24+ writes runtime config (e.g. WORK_PATH) back to app.ini; mounting it directly from a read-only swarm config makes that write fail (non-fatal but warned). The unmerged mirror PR #4 (fix-app-ini-writable) seeds a writable copy in the config volume. Image bumps must not change the config mount / docker-setup.sh handling on their own.
Reference in New Issue View Git Blame Copy Permalink