recipe-maintainers/gitea
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore: upgrade to 1.27.3-rootless #8

Closed
autonomic-bot wants to merge 0 commits from upgrade-1.27.3-rootless into main
pull from: upgrade-1.27.3-rootless
merge into: :main
Conversation 3 Commits - Files Changed -
+1 -1
autonomic-bot commented 2026-08-31 19:53:10 +00:00
Owner
Copy Link
Copy Source

chore: upgrade to 1.27.3-rootless

Upgrade the gitea app image 1.27.2-rootless → 1.27.3-rootless.

Image tags

service image current → new
app gitea/gitea 1.27.2-rootless → 1.27.3-rootless
db postgres 15.19 (unchanged — major held)

Upstream release notes:

Security — 26 CVEs fixed (strongly recommended upgrade)

For a patch series, this is a large security batch (fork-PR Actions approval bypasses → code
execution on self-hosted runners; restricted-user data leaks across API/packages/activity; package
registry upload DoS amplification; token-scope enforcement; Git hook permission regression). Full
CVE list is published on the vendor blog (NOT on GitHub):

https://blog.gitea.com/release-of-1.27.3/

Verbatim advisory scan: see the upgrade log cc-ci-logs/upgrades/gitea-upgrade-2026-08-31.md — 24
CVEs counted deterministically + 1 adjudicated FIXED (CVE-2026-62925) + 1 named only in the vendor
blog (CVE-2026-70406) = 26. (CVE-2025-68939 = STILL-UNKNOWN, not counted.)

Operator action required

  • No breaking changes / no migrations / no config changes — pure patch bump.
  • Postgres left at 15.19: the 16/17/18 majors are held per the standing note (plain postgres;
    operator dump/restore when the major is bumped). Do NOT bump the DB major here.
  • Recommended release command (runs the semver bump + tag + publish after this PR merges):
abra recipe release gitea -z

Notes

  • Direct deploy verified on cc-ci (dev-gitea, --chaos, then torn down): app converged, healthcheck
    and /api/v1/version return 200, version endpoint reports 1.27.3.
  • The read-only app.ini warning observed at deploy is the known condition covered by PR #4
    (fix-app-ini-writable) — this upgrade does NOT touch it.
  • PR #4 (fix-app-ini-writable) was left untouched by this upgrade.

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

# chore: upgrade to 1.27.3-rootless Upgrade the gitea app image `1.27.2-rootless` → `1.27.3-rootless`. ## Image tags | service | image | current → new | |---------|-------|---------------| | app | gitea/gitea | `1.27.2-rootless` → `1.27.3-rootless` | | db | postgres | `15.19` (unchanged — major held) | **Upstream release notes:** - app gitea/gitea 1.27.2→1.27.3: https://github.com/go-gitea/gitea/releases/tag/v1.27.3 ## Security — 26 CVEs fixed (strongly recommended upgrade) For a patch series, this is a **large security batch** (fork-PR Actions approval bypasses → code execution on self-hosted runners; restricted-user data leaks across API/packages/activity; package registry upload DoS amplification; token-scope enforcement; Git hook permission regression). Full CVE list is published on the vendor blog (NOT on GitHub): https://blog.gitea.com/release-of-1.27.3/ Verbatim advisory scan: see the upgrade log `cc-ci-logs/upgrades/gitea-upgrade-2026-08-31.md` — 24 CVEs counted deterministically + 1 adjudicated FIXED (CVE-2026-62925) + 1 named only in the vendor blog (CVE-2026-70406) = **26**. (CVE-2025-68939 = STILL-UNKNOWN, not counted.) ## Operator action required - **No breaking changes / no migrations / no config changes** — pure patch bump. - **Postgres left at 15.19**: the `16/17/18` majors are held per the standing note (plain postgres; operator dump/restore when the major is bumped). Do NOT bump the DB major here. - Recommended release command (runs the semver bump + tag + publish after this PR merges): ``` abra recipe release gitea -z ``` ## Notes - Direct deploy verified on cc-ci (`dev-gitea`, `--chaos`, then torn down): app converged, healthcheck and `/api/v1/version` return 200, version endpoint reports `1.27.3`. - The read-only `app.ini` warning observed at deploy is the known condition covered by PR #4 (`fix-app-ini-writable`) — this upgrade does NOT touch it. - PR #4 (`fix-app-ini-writable`) was left untouched by this upgrade. Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-08-31 19:53:10 +00:00
chore: upgrade to 1.27.3-rootless
cc-ci/testme cc-ci: success
Details
dd017ef40c
autonomic-bot requested review from trav 2026-08-31 19:53:10 +00:00
autonomic-bot requested review from notplants 2026-08-31 19:53:10 +00:00
autonomic-bot commented 2026-08-31 19:53:17 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-08-31 19:53:21 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — gitea @ dd017ef4 ✅ passed → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1306

(summary card unavailable — see the run for details.) full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `gitea` @ `dd017ef4` ✅ **passed** → https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1306 _(summary card unavailable — see the run for details.)_ [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1306) · [dashboard](https://ci.commoninternet.net/)
autonomic-bot commented 2026-09-11 02:06:21 +00:00
Author
Owner
Copy Link
Copy Source

Auto-closed by /recipe-upgrade: its changes are already in upstream main (merged upstream); mirror main re-synced

Auto-closed by /recipe-upgrade: its changes are already in upstream main (merged upstream); mirror main re-synced
autonomic-bot closed this pull request 2026-09-11 02:06:21 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/gitea#8