docs: Adjust Changelog to include all Security relevant details (#38876)

Signed-off-by: bircni <bircni@icloud.com>

CHANGELOG.md

@@ -7,7 +7,9 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
 ## [1.27.1](https://github.com/go-gitea/gitea/releases/tag/v1.27.1) - 2026-07-27
 
 * SECURITY
-  * fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)
+  * Fix: orgmode render include path (#38642) (#38645)
+  * Fix: git patch apply (#38637) (#38638)
+  * Fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606)
 
 * API
   * fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592)

cmd/web.go

@@ -244,7 +244,8 @@ func servePprof() {
 	_, _, finished := process.GetManager().AddTypedContext(context.TODO(), "Web: PProf Server", process.SystemProcessType, true)
 	// The pprof server is for debug purpose only, it shouldn't be exposed on public network. At the moment, it's not worth introducing a configurable option for it.
 	log.Info("Starting pprof server on localhost:6060")
-	log.Info("Stopped pprof server: %v", http.ListenAndServe("localhost:6060", mux))
+	server := &http.Server{Addr: "localhost:6060", Handler: mux, ReadHeaderTimeout: 10 * time.Second}
+	log.Info("Stopped pprof server: %v", server.ListenAndServe())
 	finished()
 }
 

modules/graceful/server_http.go

@@ -8,6 +8,7 @@ import (
 	"crypto/tls"
 	"net"
 	"net/http"
+	"time"
 )
 
 func newHTTPServer(network, address, name string, handler http.Handler) (*Server, ServeFunction) {
@@ -17,9 +18,10 @@ func newHTTPServer(network, address, name string, handler http.Handler) (*Server
 	protocols.SetHTTP2(true)            // HTTP/2 can only be used when Gitea is configured to use TLS
 	protocols.SetUnencryptedHTTP2(true) // Allow HTTP/2 without TLS, in case Gitea is behind a reverse proxy
 	httpServer := http.Server{
-		Protocols:   &protocols,
-		Handler:     handler,
-		BaseContext: func(net.Listener) context.Context { return GetManager().HammerContext() },
+		Protocols:         &protocols,
+		Handler:           handler,
+		BaseContext:       func(net.Listener) context.Context { return GetManager().HammerContext() },
+		ReadHeaderTimeout: 10 * time.Second,
 	}
 	server.OnShutdown = func() {
 		httpServer.SetKeepAlivesEnabled(false)