gitea v1.27.3

Fixes CVE-2026-59774, an unauthenticated arbitrary file read in the
Org-mode renderer (POST /{owner}/{repo}/markup, #+INCLUDE directive)
affecting 1.22.1-1.27.0. It was used against this instance on 2026-09-10
to read app.ini, steal INTERNAL_TOKEN and plant an uploadpack
packObjectsHook that ran a Monero miner on every clone. The 1.25 branch
never received the fix, so this skips 1.26.

Env-var config still works: the rootless image's environment-to-ini is
now a shim for `gitea config edit-ini --in-place --apply-env`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

gitea/application.yaml

@@ -120,7 +120,7 @@ spec:
       containers:
         - name: gitea
           # https://github.com/go-gitea/gitea/releases
-          image: docker.gitea.com/gitea:1.25.3-rootless
+          image: docker.gitea.com/gitea:1.27.3-rootless
           imagePullPolicy: IfNotPresent
           securityContext:
             readOnlyRootFilesystem: true