recipe-maintainers/gitea
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore: upgrade db to 10.11.19 (mariadb overlay) #9

Merged
trav merged 1 commits from upgrade-28c01fd into main 2026-09-14 19:27:09 +00:00
Conversation 2 Commits 1 Files Changed 1
+1 -1
autonomic-bot commented 2026-09-11 02:48:24 +00:00
Owner
Copy Link
Copy Source

Upgrade for the optional mariadb db overlay (compose.mariadb.yml) — the app image is already at the latest upstream tag, and the postgres overlay is deliberately held (reasoning below).

What changes

service image current → new notes
db (mariadb overlay, compose.mariadb.yml) mariadb 10.11.2 → 10.11.19 patch bump within the 10.11 LTS series (maintained until Feb 2028)
app (compose.yml) gitea/gitea 1.27.3-rootless (unchanged) latest upstream tag — abra: "no new versions available for gitea/gitea"
db (postgres overlay, compose.postgres.yml) postgres 15.19 (unchanged) HELD — see "postgres overlay held" below

Upstream release notes: db (mariadb overlay) 10.11.2→10.11.19: https://mariadb.com/docs/release-notes/community-server/10.11 — series index; the CVE tables live on the per-release pages (10.11.3 … 10.11.19), e.g. https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19

Why the weekly survey missed this

abra recipe upgrade -m machine output keys upgrades by service name — and BOTH db overlays define the same service db, so only one db entry survives (the postgres one; compose files are processed alphabetically and the mariadb result is clobbered). The mariadb pin had silently fallen 17 patch releases behind. Direct Docker Hub check: 10.11.19 (released 2026-08-24) is the newest 10.11.x. Noted as a standing gotcha in the cc-ci upstream registry so future runs check the mariadb pin by hand.

Security

32 CVEs fixed across 10.11.3 → 10.11.19 (union of the vendor release notes and the deterministic GitHub-advisory scan; full scan block + adjudication in the run log gitea-upgrade-2026-09-11.md), including 2 critical (CVE-2026-49261, fixed 10.11.18; CVE-2026-85746, fixed 10.11.19) and several high (CVE-2026-44168, CVE-2026-48163, CVE-2026-48165, CVE-2026-86047), plus a large bugfix batch (InnoDB race/crash fixes, replication OOB/crash fixes, privilege hardening incl. the wsrep_sst_auth / wsrep_node_address shell-injection fixes MDEV-40027/40056).

Operator action required

None for the mariadb bump — same-series patch, drop-in. Verified live on the cc-ci dev swarm: deployed dev-gitea with COMPOSE_FILE=compose.yml:compose.mariadb.yml, let 10.11.2 initialize the db volume, then swapped the image in place with this PR head — 10.11.19 opened the 10.11.2-initialized data dir cleanly (no re-init; the gitea schema created under 10.11.2 intact), gitea 1.27.3 converged and served (/api/healthz, /api/v1/version, /user/login all 200). Dev deploy torn down afterwards.

postgres overlay held at 15.19 on purpose. The only available bumps are majors (16.x / 17.x / 18.x). This recipe pins plain postgres (not pgautoupgrade) and ships no pg_upgrade tooling — pg_backup.sh is logical-only (pg_dump/psql) and the backupbot hooks are not an in-place major-migration path — so a major bump breaks every in-place upgrade (PG15 data dir vs PG16 binary ⇒ the db refuses to start until an operator manually dump/restores). The cc-ci test path uses the sqlite3 overlay, so CI would not even exercise it. 15.19 is already the latest 15.x, so there is no within-major bump either. A migration-aware major bump (pgautoupgrade image, or a documented dump/restore procedure) would be separate recipe work — operator call, not something to smuggle into a patch PR.

Recommended release

abra recipe release gitea -z

(patch: overlay-only image bump, no app change, no config change)

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

Upgrade for the optional **mariadb db overlay** (`compose.mariadb.yml`) — the app image is already at the latest upstream tag, and the postgres overlay is deliberately **held** (reasoning below). ### What changes | service | image | current → new | notes | |---|---|---|---| | db (mariadb overlay, `compose.mariadb.yml`) | mariadb | `10.11.2` → `10.11.19` | patch bump within the 10.11 LTS series (maintained until Feb 2028) | | app (`compose.yml`) | gitea/gitea | `1.27.3-rootless` (unchanged) | latest upstream tag — abra: "no new versions available for gitea/gitea" | | db (postgres overlay, `compose.postgres.yml`) | postgres | `15.19` (unchanged) | **HELD** — see "postgres overlay held" below | **Upstream release notes:** db (mariadb overlay) 10.11.2→10.11.19: https://mariadb.com/docs/release-notes/community-server/10.11 — series index; the CVE tables live on the per-release pages (10.11.3 … 10.11.19), e.g. https://mariadb.com/docs/release-notes/community-server/10.11/10.11.19 ### Why the weekly survey missed this `abra recipe upgrade -m` machine output keys upgrades by *service name* — and BOTH db overlays define the same service `db`, so only one `db` entry survives (the postgres one; compose files are processed alphabetically and the mariadb result is clobbered). The mariadb pin had silently fallen 17 patch releases behind. Direct Docker Hub check: `10.11.19` (released 2026-08-24) is the newest 10.11.x. Noted as a standing gotcha in the cc-ci upstream registry so future runs check the mariadb pin by hand. ### Security **32 CVEs fixed** across 10.11.3 → 10.11.19 (union of the vendor release notes and the deterministic GitHub-advisory scan; full scan block + adjudication in the run log `gitea-upgrade-2026-09-11.md`), including **2 critical** (CVE-2026-49261, fixed 10.11.18; CVE-2026-85746, fixed 10.11.19) and several high (CVE-2026-44168, CVE-2026-48163, CVE-2026-48165, CVE-2026-86047), plus a large bugfix batch (InnoDB race/crash fixes, replication OOB/crash fixes, privilege hardening incl. the wsrep_sst_auth / wsrep_node_address shell-injection fixes MDEV-40027/40056). ### Operator action required **None for the mariadb bump** — same-series patch, drop-in. Verified live on the cc-ci dev swarm: deployed `dev-gitea` with `COMPOSE_FILE=compose.yml:compose.mariadb.yml`, let 10.11.2 initialize the db volume, then swapped the image in place with this PR head — 10.11.19 opened the 10.11.2-initialized data dir cleanly (no re-init; the gitea schema created under 10.11.2 intact), gitea 1.27.3 converged and served (`/api/healthz`, `/api/v1/version`, `/user/login` all 200). Dev deploy torn down afterwards. **postgres overlay held at 15.19 on purpose.** The only available bumps are majors (16.x / 17.x / 18.x). This recipe pins plain `postgres` (not pgautoupgrade) and ships no pg_upgrade tooling — `pg_backup.sh` is logical-only (pg_dump/psql) and the backupbot hooks are not an in-place major-migration path — so a major bump breaks every in-place upgrade (PG15 data dir vs PG16 binary ⇒ the db refuses to start until an operator manually dump/restores). The cc-ci test path uses the sqlite3 overlay, so CI would not even exercise it. 15.19 is already the latest 15.x, so there is no within-major bump either. A migration-aware major bump (pgautoupgrade image, or a documented dump/restore procedure) would be separate recipe work — operator call, not something to smuggle into a patch PR. ### Recommended release `abra recipe release gitea -z` (patch: overlay-only image bump, no app change, no config change) Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-09-11 02:48:24 +00:00
chore: upgrade db to 10.11.19 (mariadb overlay)
cc-ci/testme cc-ci: success
Details
28c01fd760
autonomic-bot requested review from trav 2026-09-11 02:48:24 +00:00
autonomic-bot requested review from notplants 2026-09-11 02:48:24 +00:00
autonomic-bot commented 2026-09-11 02:48:31 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-09-11 02:48:34 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — gitea @ 28c01fd7 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `gitea` @ `28c01fd7` ✅ **passed** [![cc-ci result card](https://ci.commoninternet.net/runs/1349/summary.png)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1349) [![level](https://ci.commoninternet.net/runs/1349/badge.svg)](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1349) [full logs](https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1349) · [dashboard](https://ci.commoninternet.net/)
trav merged commit df1d40e990 into main 2026-09-14 19:27:09 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/gitea#9