

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13003): <!--number 13003 --><!--line 0 --><!--description LSBmaXg6IExGUyBsb2NrcyBtdXN0IGJlbG9uZyB0byB0aGUgaW50ZW5kZWQgcmVwbywgcG9ydCBmcm9tIEdpdGVh-->- fix: LFS locks must belong to the intended repo, port from Gitea<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13003): <!--number 13003 --><!--line 1 --><!--description LSBmaXg6IHByZXZlbnQgdW5hdXRob3JpemVkIGFjY2VzcyB0byBkcmFmdCByZWxlYXNlcyB2aWEgQVBJ-->- fix: prevent unauthorized access to draft releases via API<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13003): <!--number 13003 --><!--line 2 --><!--description LSBmaXg6IHByZXZlbnQgd3JpdGVzIHRvIE9wZW5JRCB2aXNpYmlsaXR5IHdoaWNoIG1heSBhZmZlY3Qgb3RoZXIgdXNlcnM=-->- fix: prevent writes to OpenID visibility which may affect other users<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13003): <!--number 13003 --><!--line 3 --><!--description LSBmaXg6IHByZXZlbnQgdmlld2luZyBwcml2YXRlIFBScyB0aGF0IGFyZSBsaW5rZWQgdG8gcHVibGljIGlzc3VlcyBvbiBwdWJsaWMgcHJvamVjdHM=-->- fix: prevent viewing private PRs that are linked to public issues on public projects<!--description-->
- Included for completeness but not user-facing (chores, etc.)
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13022): <!--number 13022 --><!--line 0 --><!--description Y2hvcmUoZGVwcyk6IFVwZGF0ZSBwbGF5d3JpZ2h0IHRvIHYxLjYwLjA=-->chore(deps): Update playwright to v1.60.0<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12915): <!--number 12915 --><!--line 0 --><!--description VXBkYXRlIGdvIHRvb2xjaGFpbiBkaXJlY3RpdmUgdG8gdjEuMjUuMTEgW1NFQ1VSSVRZXSAodjExLjAvZm9yZ2Vqbyk=-->Update go toolchain directive to v1.25.11 [SECURITY] (v11.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12827): <!--number 12827 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuNDEuMCBbU0VDVVJJVFldICh2MTEuMC9mb3JnZWpvKQ==-->Update module golang.org/x/image to v0.41.0 [SECURITY] (v11.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12687): <!--number 12687 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjU1LjAgW1NFQ1VSSVRZXSAodjExLjAvZm9yZ2Vqbyk=-->Update module golang.org/x/net to v0.55.0 [SECURITY] (v11.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12678): <!--number 12678 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvY3J5cHRvIHRvIHYwLjUyLjAgW1NFQ1VSSVRZXSAodjExLjAvZm9yZ2Vqbyk=-->Update module golang.org/x/crypto to v0.52.0 [SECURITY] (v11.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12442) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12578)): <!--number 12578 --><!--line 0 --><!--description Zml4OiBtYWtlIHRoZSBmb3JrIEFQSSByZXNwZWN0IENhbkNyZWF0ZU9yZ1JlcG8gcG9saWN5-->fix: make the fork API respect CanCreateOrgRepo policy<!--description-->
<!--end release-notes-assistant-->