app.ini.tmpl changed in "BREAKING CHANGE: remove forgejo" but the config version
stayed at v22. Swarm configs are immutable, so upgrading an existing deployment
aborts:
FATA failed to update config <stack>_app_ini_v22: Error response from daemon:
rpc error: code = InvalidArgument desc = only updates to Labels are allowed
Bumping to v23 makes Swarm create a new config object instead of mutating v22; the
orphaned v22 can be pruned after rollout.
Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1:
- CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch
submitted twice triggers an add/add conflict that writes an executable
post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea
service account. Affects 1.17-1.27.0; public PoC.
- CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE
accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0),
escalating to RCE by reading config/tokens.
Based on current upstream main, so it includes the BREAKING CHANGE: remove forgejo
work; the previous branch predated it and was verified against a tree that would
not have deployed. Version label left at 3.6.0+1.24.2-rootless per upgrade-PR
convention (operator runs abra recipe release).
autonomic-bot