From 145f4eaac4a9f69d90f08c0b056eac6202267dfe Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Thu, 24 Sep 2026 11:40:12 +0200
Subject: [PATCH] gitea: pin to 1.27.3 (CVE-2026-60004, CVE-2026-20896,
 CVE-2026-27771)

The floating gitea/gitea:1 tag with IfNotPresent pull policy left the
node on a cached 1.26.1 image. Pin the version and let Renovate track it.
---
 gitea/gitea-deployment.yaml | 2 +-
 renovate.json               | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/gitea/gitea-deployment.yaml b/gitea/gitea-deployment.yaml
index e7e17a4..9b58e1d 100644
--- a/gitea/gitea-deployment.yaml
+++ b/gitea/gitea-deployment.yaml
@@ -20,7 +20,7 @@ spec:
         fsGroup: 1000
       containers:
         - name: gitea
-          image: gitea/gitea:1
+          image: gitea/gitea:1.27.3
           env:
             - name: USER_UID
               value: "1000"
diff --git a/renovate.json b/renovate.json
index 269bf18..58977ed 100644
--- a/renovate.json
+++ b/renovate.json
@@ -17,7 +17,8 @@
     "managerFilePatterns": [
       "/apps/templates/.+\\.yaml$/",
       "/serpbear/.+\\.yaml$/",
-      "/bolletjestrui/.+\\.yaml$/"
+      "/bolletjestrui/.+\\.yaml$/",
+      "/gitea/.+\\.yaml$/"
     ]
   },
   "customManagers": [