Upgrade Gitea to 28.3.0, Actions runner to 5.2.4 #693

2026-11-02T07:23:48Z

raucao commented

2026-11-02 07:23:48 +00:00

Summary

Bumps the pinned versions in site-cookbooks/kosmos_gitea:

Component	Before	After
Gitea	28.1.0	28.3.0
Gitea Actions runner	5.2.2	5.2.4

Cookbook version 0.3.4 → 0.3.5, with a CHANGELOG entry.

Breaking changes

None. 28.2.0 and 28.3.0 are both maintenance releases; no app.ini keys were added, removed or renamed, and no manual migration steps are needed. We skip 28.2.0, so both release notes were reviewed.

Security fixes included

Token scope enforcement across many API and web routes (public-only tokens could read private data and, for admins, create administrators)
OAuth2 ACCOUNT_LINKING = auto account takeover
Review-triggered Actions workflows running with repository secrets
Stored XSS via Actions artifact Content-Encoding
SSH certificate principal confusion, OpenID association CSRF
Several private-data leaks in feeds, profiles, project boards and issue timelines

Behavior changes to be aware of (no cookbook change)

git maintenance now defaults to the gc strategy
Profile pages treat token requests as anonymous; user/org RSS/Atom feeds require read:user / read:organization
The API rejects changes to issues, labels, milestones and releases of archived repositories
Review-triggered workflows run on the pull request head
The gitea-vscode OAuth2 application is pre-registered
Email validation relaxed to what Go's mail.ParseAddress accepts

Runner 5.2.4

No config.yaml changes required. 5.2.4 fixes the v4 artifact API in exec mode so upload-artifact v4 and later work; 5.2.3 fixes the action header group, dry runs touching the Docker daemon, and damaged shared action cache trees.

Verification

Checksums were verified by downloading the published binaries and hashing them locally.

Converged gitea-2 and confirmed:

gitea --version → 28.3.0 built with go1.27.3
gitea_runner --version → v5.2.4
https://gitea.kosmos.org/api/v1/version → {"version":"28.3.0"}, web UI HTTP 200
gitea, gitea-runner-kosmos, gitea-runner-kredits, gitea-runner-5apps all active; systemctl --failed empty
Runner re-registered: runner: gitea-runner-kosmos, with version: v5.2.4 ... declare successfully

Chef run: 26/247 resources updated in 35s.

## Summary Bumps the pinned versions in `site-cookbooks/kosmos_gitea`: | Component | Before | After | | --- | --- | --- | | Gitea | 28.1.0 | **28.3.0** | | Gitea Actions runner | 5.2.2 | **5.2.4** | Cookbook version `0.3.4` → `0.3.5`, with a CHANGELOG entry. ## Breaking changes None. 28.2.0 and 28.3.0 are both maintenance releases; no `app.ini` keys were added, removed or renamed, and no manual migration steps are needed. We skip 28.2.0, so both release notes were reviewed. ## Security fixes included - Token scope enforcement across many API and web routes (public-only tokens could read private data and, for admins, create administrators) - OAuth2 `ACCOUNT_LINKING = auto` account takeover - Review-triggered Actions workflows running with repository secrets - Stored XSS via Actions artifact `Content-Encoding` - SSH certificate principal confusion, OpenID association CSRF - Several private-data leaks in feeds, profiles, project boards and issue timelines ## Behavior changes to be aware of (no cookbook change) - `git maintenance` now defaults to the `gc` strategy - Profile pages treat token requests as anonymous; user/org RSS/Atom feeds require `read:user` / `read:organization` - The API rejects changes to issues, labels, milestones and releases of archived repositories - Review-triggered workflows run on the pull request head - The `gitea-vscode` OAuth2 application is pre-registered - Email validation relaxed to what Go's `mail.ParseAddress` accepts ## Runner 5.2.4 No `config.yaml` changes required. 5.2.4 fixes the v4 artifact API in `exec` mode so `upload-artifact` v4 and later work; 5.2.3 fixes the action header group, dry runs touching the Docker daemon, and damaged shared action cache trees. ## Verification Checksums were verified by downloading the published binaries and hashing them locally. Converged `gitea-2` and confirmed: - `gitea --version` → `28.3.0 built with go1.27.3` - `gitea_runner --version` → `v5.2.4` - `https://gitea.kosmos.org/api/v1/version` → `{"version":"28.3.0"}`, web UI HTTP 200 - `gitea`, `gitea-runner-kosmos`, `gitea-runner-kredits`, `gitea-runner-5apps` all active; `systemctl --failed` empty - Runner re-registered: `runner: gitea-runner-kosmos, with version: v5.2.4 ... declare successfully` Chef run: 26/247 resources updated in 35s.

raucao added 1 commit 2026-11-02 07:23:48 +00:00

Upgrade Gitea to 28.3.0, Actions runner to 5.2.4 27dd10d2ee

Gitea 28.1.0 -> 28.3.0 (skipping 28.2.0). Both are maintenance releases
with no breaking changes and no app.ini changes. They carry a large set of
security fixes: token scope enforcement across many API and web routes,
OAuth2 ACCOUNT_LINKING=auto account takeover, review-triggered Actions
workflows running with repository secrets, stored XSS via Actions artifact
Content-Encoding, SSH certificate principal confusion, OpenID association
CSRF, and several private-data leaks in feeds, profiles, project boards and
issue timelines.

Behavior changes to be aware of, none requiring a cookbook change:
git maintenance now defaults to the gc strategy; profile pages treat token
requests as anonymous and user/org RSS/Atom feeds require read:user or
read:organization; the API rejects changes to issues, labels, milestones
and releases of archived repositories; review-triggered workflows run on
the pull request head; the gitea-vscode OAuth2 application is
pre-registered; email validation is relaxed to what Go's mail.ParseAddress
accepts.

Gitea Actions runner 5.2.2 -> 5.2.4. No config.yaml changes were required.
5.2.4 fixes the v4 artifact API in exec mode so upload-artifact v4 and
later work; 5.2.3 fixes the action header group, dry runs touching the
Docker daemon, and damaged shared action cache trees.

Checksums verified against the published binaries.

raucao added the

service

gitea

ops security kredits-1 labels 2026-11-02 07:29:42 +00:00

raucao merged commit ee922186eb into master

2026-11-02 07:29:47 +00:00

raucao deleted branch chore/upgrade_gitea

2026-11-02 07:29:47 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/chef#693