4.4 KiB
4.4 KiB
Upstream sources — gitea
| service | image | source repo | releases / changelog |
|---|---|---|---|
| app | gitea/gitea | https://github.com/go-gitea/gitea | https://github.com/go-gitea/gitea/releases |
Security announcements: https://blog.gitea.com/ — per-release posts (e.g. https://blog.gitea.com/release-of-1.27.1/) carry the CVE list; the GitHub release notes do NOT. This is where CVE-2026-60004 + CVE-2026-59774 (both CVSS 9.8, fixed in 1.27.1) were announced, and why the 2026-08-03/07 reports under-counted gitea's CVEs. advisory-scan.py fetches every URL in this file, so keep vendor security pages listed here. | db | postgres | https://github.com/postgres/postgres | https://www.postgresql.org/docs/release/ | | db (mariadb overlay) | mariadb | https://github.com/MariaDB/server | https://mariadb.com/docs/release-notes/community-server/10.11 (series index — the CVE tables live on the PER-RELEASE pages, e.g. https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19) |
Standing notes
- mariadb overlay (compose.mariadb.yml): pinned
mariadb:10.11.x(10.11 LTS, maintained until Feb 2028). ⚠ BOTH db overlays (postgres + mariadb) define the same service namedb, andabra recipe upgrade -mmachine output keeps only ONEdbentry — the postgres one (files are processed alphabetically; the mariadb result is clobbered). ALWAYS check the mariadb pin against Docker Hub directly; the weekly survey's single "db:" line hides it. Per-release security notes (CVE tables — GitHub release bodies only link out): https://mariadb.com/docs/release-notes/community-server/10.11/10.11.3.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.6.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.8.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.11.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.12.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.15.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.16.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.17.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18.md https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19.md (the 10 CVE-bearing releases of the 10.11.2→10.11.19 window, 2026-09-11; append newer pages for later windows). - postgres major version: recipe uses plain postgres (not pgautoupgrade); pg_backup.sh uses pg_dump/psql (logical backup, not pg_upgrade). Major version bump (e.g. 15→16) requires operator to manually restore from logical backup — no auto-migration tooling. Bump only within same major (e.g. 15.13→15.18) unless recipe adds pg_upgrade support.
- compose.postgres.yml: postgres is an optional overlay (not in the main compose.yml). The cc-ci tests determine whether the postgres overlay is used.
abra recipe upgradereads it too and will propose a db bump — hold db unless doing a migration-aware major bump. - 1.25.0: Removed deprecated auth sources — legacy auth setups may need reconfiguration.
- 1.25.0: CreateVariable API now returns 201 instead of 200 — API consumers may need updating.
- 1.26.0: Removed GET API registration-token endpoint — scripts using this endpoint must update.
- 1.26.0: PUBLIC_URL_DETECTION now defaults to 'auto' — verify reverse proxy setups work after upgrade.
- 1.26.2: Multiple CVE security fixes — strongly recommended upgrade.
- 1.26.3: carries a regression (#38177 "context deadline exceeded" opening repo code pages) — upstream says upgrade straight to 1.26.4, skip 1.26.3.
- 1.27.0 (released 2026-07-13, MINOR with BREAKING changes):
Feat(actions)!: improve support for reusable workflows(#37478) andUse Content-Security-Policy: script nonce(#37232, may break custom inline JS / reverse-proxy CSP). Many security + feature additions. A dedicated minor-bump run should evaluate CSP / reusable-workflow impact before adopting. - 1.27.1 (released 2026-07-27, PATCH): security fix (oauth2 mandatory 2FA enforcement on authorize/grant endpoints, #38606), API swagger alignment, diff-contrast enhancement, and many bugfixes (actions reusable-workflow/job-stranding, OIDC end-session, repo-deletion cleanup, webhook/mail). No breaking changes; safe patch bump from 1.27.0. Release notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.1