Docker Swarm requires the bind source to exist on the node before
scheduling the task; /etc/timezone is Debian/Ubuntu-specific and
missing on other distros, causing deploy failures. /etc/localtime
alone covers timezone info portably.
app.ini.tmpl changed in "BREAKING CHANGE: remove forgejo" but the config version
stayed at v22. Swarm configs are immutable, so upgrading an existing deployment
aborts:
FATA failed to update config <stack>_app_ini_v22: Error response from daemon:
rpc error: code = InvalidArgument desc = only updates to Labels are allowed
Bumping to v23 makes Swarm create a new config object instead of mutating v22; the
orphaned v22 can be pruned after rollout.
Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1:
- CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch
submitted twice triggers an add/add conflict that writes an executable
post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea
service account. Affects 1.17-1.27.0; public PoC.
- CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE
accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0),
escalating to RCE by reading config/tokens.
Based on current upstream main, so it includes the BREAKING CHANGE: remove forgejo
work; the previous branch predated it and was verified against a tree that would
not have deployed. Version label left at 3.6.0+1.24.2-rootless per upgrade-PR
convention (operator runs abra recipe release).
Add an opt-in compose.lfs.yml that mounts the lfs_jwt_secret secret and
enables GITEA_LFS_START_SERVER for plain gitea (forgejo already bundles
LFS). Emit LFS_JWT_SECRET in app.ini whenever the LFS server is on so the
JWT secret is stable across redeploys instead of being regenerated on
every restart (app.ini is a read-only config mount).
Bump version 3.5.2 -> 3.6.0.
Beto
notplants
notplants
autonomic-bot
fauno
ammaratef45
3wc
p4u1
3wordchant
cas
knoflook
javielico