Bug 296351 - www/gitea: update to 1.26.4, fixes 15 CVEs
Summary: www/gitea: update to 1.26.4, fixes 15 CVEs
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Yusuf Yaman
URL:
Keywords: security
Depends on:
Blocks:
 
Reported: 2026-06-28 12:49 UTC by ports@foss-daily.org
Modified: 2026-06-28 17:35 UTC (History)
2 users (show)

See Also:
nxjoseph: merge-quarterly+

Attachments
update patch + VuXML (3.69 KB, patch)
2026-06-28 12:49 UTC, ports@foss-daily.org 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description ports@foss-daily.org 2026-06-28 12:49:41 UTC 
Created attachment 272220 [details]
update patch + VuXML

Patch to update gitea to newest version + fix CVE's. I included VuXML with vuln's of gitea what i managed to find on the internet. Formatting of VuXML might be a bit weird since my editor was messing up spacing and i didn't know how to fix it but i think it should be alright.
Comment 1 commit-hook freebsd_committer freebsd_triage 2026-06-28 14:25:08 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=c553340805b50a2ce1e50a5c50bace3a3de94aaf

commit c553340805b50a2ce1e50a5c50bace3a3de94aaf
Author:     ports@foss-daily.org <ports@foss-daily.org>
AuthorDate: 2026-06-28 14:23:13 +0000
Commit:     Yusuf Yaman <nxjoseph@FreeBSD.org>
CommitDate: 2026-06-28 14:24:25 +0000

    www/gitea: Security update 1.26.1 => 1.26.4

    While here, fix pkg-plist when BINDATA option is enabled.

    Release Notes:
    https://blog.gitea.com/release-of-1.26.2
    https://blog.gitea.com/release-of-1.26.3-and-1.26.4

    PR:             296351
    Approved by:    osa, vvd (Mentors, implicit)
    MFH:            2026Q2
    Security:       CVE-2026-27783
    Security:       CVE-2026-25714
    Security:       CVE-2026-20706
    Security:       CVE-2026-27771
    Security:       CVE-2026-28744
    Security:       CVE-2026-28699
    Security:       CVE-2026-26231
    Security:       CVE-2026-20896
    Security:       CVE-2026-22874
    Security:       CVE-2026-27775
    Security:       CVE-2026-27761
    Security:       CVE-2026-25038
    Security:       CVE-2026-24451
    Security:       CVE-2026-20779
    Security:       CVE-2026-28740

 www/gitea/Makefile  | 3 +--
 www/gitea/distinfo  | 6 +++---
 www/gitea/pkg-plist | 1 +
 3 files changed, 5 insertions(+), 5 deletions(-)
Comment 2 commit-hook freebsd_committer freebsd_triage 2026-06-28 14:29:09 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=a87cdca0aa7f45aa1703cffd1ccfa13e4c4ec03d

commit a87cdca0aa7f45aa1703cffd1ccfa13e4c4ec03d
Author:     ports@foss-daily.org <ports@foss-daily.org>
AuthorDate: 2026-06-28 14:25:57 +0000
Commit:     Yusuf Yaman <nxjoseph@FreeBSD.org>
CommitDate: 2026-06-28 14:27:32 +0000

    security/vuxml: Document www/gitea vulnerabilities

    PR:             296351
    Approved by:    osa, vvd (Mentors, implicit)

 security/vuxml/vuln/2026.xml | 56 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
Comment 3 commit-hook freebsd_committer freebsd_triage 2026-06-28 14:30:10 UTC 
A commit in branch 2026Q2 references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=a6295df499dc88c05effda7ed31267d9571b5356

commit a6295df499dc88c05effda7ed31267d9571b5356
Author:     ports@foss-daily.org <ports@foss-daily.org>
AuthorDate: 2026-06-28 14:23:13 +0000
Commit:     Yusuf Yaman <nxjoseph@FreeBSD.org>
CommitDate: 2026-06-28 14:29:00 +0000

    www/gitea: Security update 1.26.1 => 1.26.4

    While here, fix pkg-plist when BINDATA option is enabled.

    Release Notes:
    https://blog.gitea.com/release-of-1.26.2
    https://blog.gitea.com/release-of-1.26.3-and-1.26.4

    PR:             296351
    Approved by:    osa, vvd (Mentors, implicit)
    MFH:            2026Q2
    Security:       CVE-2026-27783
    Security:       CVE-2026-25714
    Security:       CVE-2026-20706
    Security:       CVE-2026-27771
    Security:       CVE-2026-28744
    Security:       CVE-2026-28699
    Security:       CVE-2026-26231
    Security:       CVE-2026-20896
    Security:       CVE-2026-22874
    Security:       CVE-2026-27775
    Security:       CVE-2026-27761
    Security:       CVE-2026-25038
    Security:       CVE-2026-24451
    Security:       CVE-2026-20779
    Security:       CVE-2026-28740

    (cherry picked from commit c553340805b50a2ce1e50a5c50bace3a3de94aaf)

 www/gitea/Makefile  | 3 +--
 www/gitea/distinfo  | 6 +++---
 www/gitea/pkg-plist | 1 +
 3 files changed, 5 insertions(+), 5 deletions(-)
Comment 4 commit-hook freebsd_committer freebsd_triage 2026-06-28 14:36:12 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/ports/commit/?id=f56b9d9907954643e85277287ce023a8a9522932

commit f56b9d9907954643e85277287ce023a8a9522932
Author:     Yusuf Yaman <nxjoseph@FreeBSD.org>
AuthorDate: 2026-06-28 14:34:27 +0000
Commit:     Yusuf Yaman <nxjoseph@FreeBSD.org>
CommitDate: 2026-06-28 14:34:47 +0000

    UPDATING: Document breaking change in www/gitea

    PR:             296351
    Approved by:    osa, vvd (Mentors, implicit)

 UPDATING | 10 ++++++++++
 1 file changed, 10 insertions(+)
Comment 5 Yusuf Yaman freebsd_committer freebsd_triage 2026-06-28 14:42:28 UTC 
Hi,

Thank you for your submission!

I have tested build in Poudriere on 14.4-RELEASE-amd64-main-8a30f577217d and it seems OK but except when I built with BINDATA option enabled, encountered with pkg-plist error.

Thanks for also writing the VuXML entry, it was definitely easier to fix the spacing problems than documenting :D

Since I saw a breaking change in the changelog, I also added an entry to UPDATING.

Committed, thanks!
Comment 6 ports@foss-daily.org 2026-06-28 17:35:14 UTC 
(In reply to Yusuf Yaman from comment #5)
No problem :D