chore: publish 3.6.8+28.0.0-rootless release

Reviewed-on: #67

compose.mariadb.yml

@@ -10,7 +10,7 @@ services:
     secrets:
       - db_password
   db:
-    image: "mariadb:10.11.2"
+    image: "mariadb:10.11.19"
     deploy:
       labels:
           backupbot.backup.pre-hook: 'mysqldump --single-transaction -u root -p"$$(cat /run/secrets/db_root_password)" gitea > /var/lib/mysql/backup.sql'

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "gitea/gitea:1.27.3-rootless"
+    image: "gitea/gitea:28.0.0-rootless"
     configs:
       - source: app_ini
         target: /etc/gitea/app.ini
@@ -87,7 +87,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true"
-        - coop-cloud.${STACK_NAME}.version=3.6.5+1.27.3-rootless
+        - coop-cloud.${STACK_NAME}.version=3.6.8+28.0.0-rootless
 
 
 networks:

release/3.6.8+28.0.0-rootless

@@ -0,0 +1 @@
+ git egress has been reworked. ALLOWED_DOMAINS / BLOCKED_DOMAINS / ALLOW_LOCALNETWORKS are deprecated (migrated to [security] ALLOWED_HOST_LIST / BLOCKED_HOST_LIST) Operators who restrict git egress must switch to EGRESS_MODE = strict + explicit CIDRs to keep a deny-by-default policy.