recipe-maintainers/gitea
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

chore: upgrade to 28.3.0-rootless #12

Closed
autonomic-bot wants to merge 0 commits from upgrade-28.3.0-rootless into main
pull from: upgrade-28.3.0-rootless
merge into: :main
Conversation 3 Commits - Files Changed -
+1 -1
autonomic-bot commented 2026-11-06 03:44:51 +00:00
Owner
Copy Link
Copy Source

Recipe upgrade for gitea: app image gitea/gitea 28.2.0-rootless → 28.3.0-rootless (upstream 28.3.0, released 2026-11-01). The recipe version label is intentionally left untouched in this PR; the publish step is below.

Image tag table

service image current new notes
app gitea/gitea 28.2.0-rootless 28.3.0-rootless abra offers 28.3.0-rootless; plain semver tag.
db (optional postgres overlay) postgres 15.19 15.19 (held) No newer 15.x patch. 15→16+ major needs an operator-managed restore (recipe has logical pg_dump/psql only, no pg_upgrade); out of scope. CI uses the sqlite3 overlay.
db (optional mariadb overlay) mariadb 10.11.19 10.11.19 (held) 10.11 LTS; 10.11.19 is the newest 10.11.x.

Operator Action Required

Gitea 28.3.0 is the third maintenance release of the 28 series; upstream strongly recommends upgrading.

  • Security: 21 CVEs fixed by this window — 20 tracked by the GitHub Security Advisories for go-gitea/gitea as fixed in 28.3.0, plus CVE-2026-111943 (Go 1.27.3 toolchain / certificate-trust change), which is named only in the vendor security post, not the GitHub advisories. Highlights include CVE-2026-118386 (review-triggered Actions workflows), CVE-2026-117635 / CVE-2026-119441 / CVE-2026-116289 (public-only token scope bypasses), CVE-2026-113429 (stored XSS via Actions artifact), CVE-2026-120263 (OAuth2 account auto-link), and the several private-visibility leaks.
  • Dependency: golang.org/x/net updated to v0.62.0 (security, #40050).
  • No breaking changes, no DB migration, no new-or-renamed config. The 28.0.0 breaking changes (internal Git proxy/egress, Actions retention) are already in the 28.2.0 base.
  • app.ini writability: not regressed. The pre-existing read-only WORK_PATH warning remains; it is the unrelated unmerged mirror PR #4 (fix-app-ini-writable) that addresses it. This PR changes only the image tag.
  • Recipe README has no 28.3.0-specific upgrade instructions.

Upstream release notes: app gitea 28.2.0→28.3.0: https://github.com/go-gitea/gitea/releases/tag/v28.3.0
Vendor security post: https://blog.gitea.com/release-of-28.3.0/

Recommended release bump (operator, after merge)

abra recipe release gitea -z

Reasoning: maintenance/security release; the recipe change is image-tag-only, no new feature surface in the recipe. That publishes 3.6.11+28.3.0-rootless from the current 3.6.10+28.2.0-rootless.

Nothing here is merged; this PR awaits operator review.

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

Recipe upgrade for `gitea`: app image `gitea/gitea` **28.2.0-rootless → 28.3.0-rootless** (upstream 28.3.0, released 2026-11-01). The recipe version label is intentionally left untouched in this PR; the publish step is below. ## Image tag table | service | image | current | new | notes | |---------|-------|---------|-----|-------| | app | gitea/gitea | 28.2.0-rootless | **28.3.0-rootless** | abra offers `28.3.0-rootless`; plain semver tag. | | db (optional postgres overlay) | postgres | 15.19 | 15.19 (held) | No newer 15.x patch. 15→16+ major needs an operator-managed restore (recipe has logical pg_dump/psql only, no pg_upgrade); out of scope. CI uses the sqlite3 overlay. | | db (optional mariadb overlay) | mariadb | 10.11.19 | 10.11.19 (held) | 10.11 LTS; 10.11.19 is the newest 10.11.x. | ## Operator Action Required Gitea 28.3.0 is the third maintenance release of the 28 series; upstream strongly recommends upgrading. - **Security:** 21 CVEs fixed by this window — 20 tracked by the GitHub Security Advisories for `go-gitea/gitea` as fixed in 28.3.0, plus **CVE-2026-111943** (Go 1.27.3 toolchain / certificate-trust change), which is named only in the vendor security post, not the GitHub advisories. Highlights include CVE-2026-118386 (review-triggered Actions workflows), CVE-2026-117635 / CVE-2026-119441 / CVE-2026-116289 (public-only token scope bypasses), CVE-2026-113429 (stored XSS via Actions artifact), CVE-2026-120263 (OAuth2 account auto-link), and the several private-visibility leaks. - **Dependency:** `golang.org/x/net` updated to v0.62.0 (security, #40050). - **No breaking changes, no DB migration, no new-or-renamed config.** The 28.0.0 breaking changes (internal Git proxy/egress, Actions retention) are already in the 28.2.0 base. - **app.ini writability:** not regressed. The pre-existing read-only `WORK_PATH` warning remains; it is the unrelated unmerged mirror PR #4 (`fix-app-ini-writable`) that addresses it. This PR changes only the image tag. - Recipe README has no 28.3.0-specific upgrade instructions. **Upstream release notes:** app gitea 28.2.0→28.3.0: https://github.com/go-gitea/gitea/releases/tag/v28.3.0 **Vendor security post:** https://blog.gitea.com/release-of-28.3.0/ ## Recommended release bump (operator, after merge) `abra recipe release gitea -z` Reasoning: maintenance/security release; the recipe change is image-tag-only, no new feature surface in the recipe. That publishes `3.6.11+28.3.0-rootless` from the current `3.6.10+28.2.0-rootless`. Nothing here is merged; this PR awaits operator review. Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-11-06 03:44:52 +00:00
chore: upgrade to 28.3.0-rootless
cc-ci/testme cc-ci: success
Details
364cb4b820
autonomic-bot requested review from trav 2026-11-06 03:44:52 +00:00
autonomic-bot requested review from notplants 2026-11-06 03:44:52 +00:00
autonomic-bot commented 2026-11-06 03:45:00 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-11-06 03:45:18 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — gitea @ 364cb4b8 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `gitea` @ `364cb4b8` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/132/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/132) [![level](https://ci.autonomic.zone/runs/132/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/132) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/132) · [dashboard](https://ci.autonomic.zone/)
autonomic-bot commented 2026-11-09 20:10:02 +00:00
Author
Owner
Copy Link
Copy Source

Upstreamed to git.coopcloud.tech/coop-cloud/gitea and released as 3.6.11+28.3.0-rootless: https://git.coopcloud.tech/coop-cloud/gitea/src/tag/3.6.11+28.3.0-rootless — closing.

Upstreamed to git.coopcloud.tech/coop-cloud/gitea and released as `3.6.11+28.3.0-rootless`: https://git.coopcloud.tech/coop-cloud/gitea/src/tag/3.6.11+28.3.0-rootless — closing.
autonomic-bot closed this pull request 2026-11-09 20:10:03 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aadil (alizeh) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants spacehobo (Nick Moffitt) trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/gitea#12