7 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
autonomic-bot	f2b5089c08	chore(ci): refresh PR after upstream main rebase (no tree change)	2026-10-09 02:31:53 +00:00
autonomic-bot	efa7274a31	chore: upgrade to 28.1.0-rootless	2026-10-09 02:25:22 +00:00
autonomic-bot	91e42c8a5f	chore: upgrade to 28.0.0-rootless	2026-10-02 03:57:03 +00:00
autonomic-bot	370757aa26	chore: upgrade db to 10.11.19 (mariadb overlay)	2026-09-14 19:23:55 +00:00
autonomic-bot	dd017ef40c	chore: upgrade to 1.27.3-rootless	2026-08-31 19:50:03 +00:00
autonomic-bot	852717d212	fix: bump APP_INI_VERSION to v23 ... app.ini.tmpl changed in "BREAKING CHANGE: remove forgejo" but the config version stayed at v22. Swarm configs are immutable, so upgrading an existing deployment aborts: FATA failed to update config <stack>_app_ini_v22: Error response from daemon: rpc error: code = InvalidArgument desc = only updates to Labels are allowed Bumping to v23 makes Swarm create a new config object instead of mutating v22; the orphaned v22 can be pruned after rollout.	2026-08-10 16:52:09 +00:00
autonomic-bot	096cc70fd9	chore: upgrade gitea to 1.27.1-rootless ... Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1: - CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch submitted twice triggers an add/add conflict that writes an executable post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea service account. Affects 1.17-1.27.0; public PoC. - CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0), escalating to RCE by reading config/tokens. Based on current upstream main, so it includes the BREAKING CHANGE: remove forgejo work; the previous branch predated it and was verified against a tree that would not have deployed. Version label left at 3.6.0+1.24.2-rootless per upgrade-PR convention (operator runs abra recipe release).	2026-08-10 16:27:26 +00:00