recipe-maintainers/gitea
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore: upgrade to 28.2.0-rootless #11

Merged
trav merged 1 commits from upgrade-28.2.0-rootless into main 2026-10-26 16:19:40 +00:00
Conversation 2 Commits 1 Files Changed 1
+1 -1
autonomic-bot commented 2026-10-23 02:50:38 +00:00
Owner
Copy Link
Copy Source

Gitea 28.1.0 → 28.2.0

Bumps the gitea/gitea app image to the latest 28.x maintenance release. One-line compose change; no config/env/volume changes.

service image current new
app gitea/gitea 28.1.0-rootless 28.2.0-rootless
db (optional postgres overlay) postgres 15.19 15.19 (unchanged)

Security

Gitea 28.2.0 fixes 9 newly-fixed Gitea CVEs plus dependency CVE-2026-78659 (golang.org/x/net v0.60.0). Highest severity of the nine is high:

  • CVE-2026-109553 (high) — SSH certificate principals matched against all stored public keys
  • CVE-2026-104627 (high) — OpenID association callback missing state binding
  • CVE-2026-107686, CVE-2026-110494, CVE-2026-105661, CVE-2026-110311, CVE-2026-105964 (medium)
  • CVE-2026-107618, CVE-2026-97204 (low)

Three further CVEs are disclosed with 28.2.0 but were already fixed before this window (CVE-2026-110324 in 28.1.0; CVE-2026-109844 in 28.0.0; CVE-2026-97859 in 1.27.3/28.0.0).

Deterministic advisory scan: 9 counted by patched ranges; union with release notes = 10 (incl. the x/net dependency CVE). One open case (CVE-2026-62925) is not-fixed in this window — it affects <= 1.27.2 and is already fixed in 1.27.3. No failed sources.

Operator Action Required

  • None for this bump. No breaking changes, migrations, or new/renamed config in 28.2.0. The 28.0.0 breaking changes (internal Git proxy / egress settings, RUN_RETENTION_DAYS) are already present in upstream main at 28.1.0.
  • Postgres stays at 15.19. Gitea 28.2.0 has no newer Postgres requirement; a 15→16/17/18 major bump needs a manual logical restore and is deliberately out of scope.
  • app.ini writability: this PR does not touch the config mount. Gitea 1.24+ still warns Unable to update WORK_PATH ... read-only file system on the current base; that is the pre-existing issue addressed separately by open PR #4 (fix-app-ini-writable), not a regression introduced here. The dev deploy showed the app healthy (1/1, /api/healthz 200, gitea version 28.2.0) with that same warning.

Upstream release notes: app gitea 28.1.0→28.2.0: https://github.com/go-gitea/gitea/releases/tag/v28.2.0
Vendor security post (CVE list): https://blog.gitea.com/release-of-28.2.0/
(db unchanged, no release notes.)

Recommended release command (operator, after merge; the PR leaves the version label at 3.6.9+28.1.0-rootless):

abra recipe release gitea -z

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

## Gitea 28.1.0 → 28.2.0 Bumps the `gitea/gitea` app image to the latest 28.x maintenance release. One-line compose change; no config/env/volume changes. | service | image | current | new | |---------|-------|---------|-----| | app | gitea/gitea | 28.1.0-rootless | **28.2.0-rootless** | | db (optional postgres overlay) | postgres | 15.19 | 15.19 (unchanged) | ## Security Gitea 28.2.0 fixes **9 newly-fixed Gitea CVEs** plus dependency **CVE-2026-78659** (`golang.org/x/net` v0.60.0). Highest severity of the nine is high: - CVE-2026-109553 (high) — SSH certificate principals matched against all stored public keys - CVE-2026-104627 (high) — OpenID association callback missing `state` binding - CVE-2026-107686, CVE-2026-110494, CVE-2026-105661, CVE-2026-110311, CVE-2026-105964 (medium) - CVE-2026-107618, CVE-2026-97204 (low) Three further CVEs are disclosed with 28.2.0 but were already fixed before this window (CVE-2026-110324 in 28.1.0; CVE-2026-109844 in 28.0.0; CVE-2026-97859 in 1.27.3/28.0.0). Deterministic advisory scan: 9 counted by patched ranges; union with release notes = **10** (incl. the x/net dependency CVE). One open case (CVE-2026-62925) is **not-fixed in this window** — it affects `<= 1.27.2` and is already fixed in 1.27.3. No failed sources. ## Operator Action Required - **None for this bump.** No breaking changes, migrations, or new/renamed config in 28.2.0. The 28.0.0 breaking changes (internal Git proxy / egress settings, `RUN_RETENTION_DAYS`) are already present in upstream main at 28.1.0. - **Postgres stays at 15.19.** Gitea 28.2.0 has no newer Postgres requirement; a 15→16/17/18 major bump needs a manual logical restore and is deliberately out of scope. - **app.ini writability:** this PR does not touch the config mount. Gitea 1.24+ still warns `Unable to update WORK_PATH ... read-only file system` on the current base; that is the pre-existing issue addressed separately by open PR #4 (`fix-app-ini-writable`), not a regression introduced here. The dev deploy showed the app healthy (1/1, `/api/healthz` 200, `gitea version 28.2.0`) with that same warning. **Upstream release notes:** app gitea 28.1.0→28.2.0: https://github.com/go-gitea/gitea/releases/tag/v28.2.0 **Vendor security post (CVE list):** https://blog.gitea.com/release-of-28.2.0/ (db unchanged, no release notes.) Recommended release command (operator, after merge; the PR leaves the version label at `3.6.9+28.1.0-rootless`): `abra recipe release gitea -z` Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-10-23 02:50:39 +00:00
chore: upgrade to 28.2.0-rootless
cc-ci/testme cc-ci: success
Details
719d230085
autonomic-bot requested review from trav 2026-10-23 02:50:39 +00:00
autonomic-bot requested review from notplants 2026-10-23 02:50:39 +00:00
autonomic-bot commented 2026-10-23 02:50:48 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-10-23 02:51:13 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — gitea @ 719d2300 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `gitea` @ `719d2300` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/77/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/77) [![level](https://ci.autonomic.zone/runs/77/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/77) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/77) · [dashboard](https://ci.autonomic.zone/)
trav merged commit 4b8b9ee34f into main 2026-10-26 16:19:40 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
notplants
trav
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/gitea#11