Gitea Act Runner vulnerabilities

CVE-2026-58053 [CRITICAL] CWE-269 CVE-2026-58053: Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a D