On Sat, 19 Sep 2026 02:03:54 +0200,
Pavel Korovin <p@tristero.se> wrote:
> 
> On 09/18, Kirill A. Korinsky wrote:
> > On Tue, 15 Sep 2026 15:51:07 +0200,
> > Anton Kasimov <kasimov.an@gmail.com> wrote:
> > > 
> > > [1  <multipart/alternative (7bit)>]
> > > [1.1  <text/plain; UTF-8 (8bit)>]
> > > Please update Gitea in the stable branch as well.
> > > 
> > > The security issues fixed in the recent releases are fairly serious. In
> > > configurations with anonymous read access to repositories enabled, some
> > > of these issues may allow an attacker to gain full access to the server
> > > with the privileges of the |_gitea|user.
> > > 
> > > The settings recommended by the port already mitigate the most critical
> > > issues, but updating Gitea in stable would still be highly desirable.
> > > 
> > > Diff attached.
> > > 
> > >
> > 
> > It fixes serious enough things, for example:
> > https://app.opencve.io/cve/CVE-2026-60004
> > 
> > And if new release can be built by go from 7.9, I think we should commit it.
> > 
> > pvk@, are you OK?
> 
> Sure, I'm OK with it.
> 

Thanks, commited to 7.9

-- 
wbr, Kirill