autonomic-bot
5775fe23f8
Why: gitea 1.27.1 fixed CVE-2026-60004 + CVE-2026-59774 (both CVSS 9.8). The
2026-08-03 report printed gitea's CVE count as '1', the 2026-08-07 report as
'none'. Cause chain: the upgrade subagent read the GitHub release notes, which
name NEITHER cve (they are announced only in the vendor blog's security section),
so it recorded one unrelated minor item; the report then derived security content
from those notes plus model knowledge, and the model's training predates the CVEs.
Nothing in the pipeline ever queried an advisory source.
cc-ci-plan/advisory-scan.py — deterministic, per recipe, per upgrade window:
1. GitHub Security Advisories API for every source repo in the upstream registry.
PRIMARY: CVE + GHSA + severity + vulnerable/patched ranges, so 'fixed by THIS
upgrade' is computed. Needs no new per-recipe config (134 registry URLs are
already github.com).
2. Vendor release/security pages — every registry URL, fetched + regex-scanned.
This is the source that actually had the gitea CVEs.
3. OSV where a package mapping exists — supplementary.
Each source reports its own status so 'checked, none found' is never confused with
'not checked'. Source selection was measured, not assumed: for these two CVEs OSV
404'd and NVD's API had them by neither CPE, id, nor keyword — advisory DBs lag the
vendor, hence 1+2 lead.
Wiring is strictly ADDITIVE:
- /recipe-upgrade gains step 2a: run the scan, paste the block into the per-recipe
log, and report the UNION of it and the existing release-note reading. The scan
may never lower a count established by reading.
- /recipe-report treats the block as a FURTHER source, prefers its advisory ids /
severities / fixed-in versions for citation, and must render '?' (not 'none')
when a scan is absent or has failed sources — the false-clean 'none' is exactly
what happened on 2026-08-07.
- upstream/gitea.md records blog.gitea.com as the security-announcement URL.
Verified on the real regression: 1.27.0 -> 1.27.1 now yields exactly the 2 missed
criticals with their GHSA ids; the wider 1.26.2 -> 1.27.1 window yields 62.
2.8 KiB
2.8 KiB
Upstream sources — gitea
| service | image | source repo | releases / changelog |
|---|---|---|---|
| app | gitea/gitea | https://github.com/go-gitea/gitea | https://github.com/go-gitea/gitea/releases |
Security announcements: https://blog.gitea.com/ — per-release posts (e.g. https://blog.gitea.com/release-of-1.27.1/) carry the CVE list; the GitHub release notes do NOT. This is where CVE-2026-60004 + CVE-2026-59774 (both CVSS 9.8, fixed in 1.27.1) were announced, and why the 2026-08-03/07 reports under-counted gitea's CVEs. advisory-scan.py fetches every URL in this file, so keep vendor security pages listed here. | db | postgres | https://github.com/postgres/postgres | https://www.postgresql.org/docs/release/ |
Standing notes
- postgres major version: recipe uses plain postgres (not pgautoupgrade); pg_backup.sh uses pg_dump/psql (logical backup, not pg_upgrade). Major version bump (e.g. 15→16) requires operator to manually restore from logical backup — no auto-migration tooling. Bump only within same major (e.g. 15.13→15.18) unless recipe adds pg_upgrade support.
- compose.postgres.yml: postgres is an optional overlay (not in the main compose.yml). The cc-ci tests determine whether the postgres overlay is used.
abra recipe upgradereads it too and will propose a db bump — hold db unless doing a migration-aware major bump. - 1.25.0: Removed deprecated auth sources — legacy auth setups may need reconfiguration.
- 1.25.0: CreateVariable API now returns 201 instead of 200 — API consumers may need updating.
- 1.26.0: Removed GET API registration-token endpoint — scripts using this endpoint must update.
- 1.26.0: PUBLIC_URL_DETECTION now defaults to 'auto' — verify reverse proxy setups work after upgrade.
- 1.26.2: Multiple CVE security fixes — strongly recommended upgrade.
- 1.26.3: carries a regression (#38177 "context deadline exceeded" opening repo code pages) — upstream says upgrade straight to 1.26.4, skip 1.26.3.
- 1.27.0 (released 2026-07-13, MINOR with BREAKING changes):
Feat(actions)!: improve support for reusable workflows(#37478) andUse Content-Security-Policy: script nonce(#37232, may break custom inline JS / reverse-proxy CSP). Many security + feature additions. A dedicated minor-bump run should evaluate CSP / reusable-workflow impact before adopting. - 1.27.1 (released 2026-07-27, PATCH): security fix (oauth2 mandatory 2FA enforcement on authorize/grant endpoints, #38606), API swagger alignment, diff-contrast enhancement, and many bugfixes (actions reusable-workflow/job-stranding, OIDC end-session, repo-deletion cleanup, webhook/mail). No breaking changes; safe patch bump from 1.27.0. Release notes: https://github.com/go-gitea/gitea/releases/tag/v1.27.1