Mathieu Fenniak 32b8d732b8 2026-05-12 security patches (#12493) ... - fix: prevent git write to wiki repo from unauthorized user via git HTTP - fix: prevent LFS authorization token from being used for read/write access after user's access is restricted from Forgejo - fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing resources beyond their permitted scope via non-API endpoints (e.g. /user/repo/raw/...) - fix: implementing missing OAuth validation checks, improve protections against race conditions - fix: prevent OAuth redirect URI spoofing via non-ascii case collision - fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks <!--start release-notes-assistant--> ## Release notes <!--URL:https://codeberg.org/forgejo/forgejo--> - Security bug fixes - [PR](https://codeberg.org/forgejo/forgejo/pulls/12493): <!--number 12493 --><!--line 0 --><!--description MjAyNi0wNS0xMiBzZWN1cml0eSBwYXRjaGVz-->2026-05-12 security patches<!--description--> <!--end release-notes-assistant--> Co-authored-by: Derzsi Dániel <daniel@tohka.us> Co-authored-by: jvoisin <julien.voisin@dustri.org> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12493		2026-05-12 04:54:25 +02:00
..
3139.md
3285.md
3307.md
3334.md
3337.md
3363.md
3383.md
3414.md
3430.md
3434.md
3442.md
3642.md
3654.md
3723.md
3724.md
3729.md
3752.md
3791.md
3808.md
3811.md
3830.md
3836.md
3838.md
3847.md
3870.md
3886.md
3917.md
3934.md
3952.md	chore(release-notes): fix release notes of chroma update in v8.0.0	2025-10-05 17:10:38 +05:00
3985.md
3989.md
4026.md
4027.md
4072.md
4083.md
4095.md
4125.md	[Feat]Add link to show all Issues/PullRequests (#4125)	2024-10-09 04:56:40 +00:00
4134.md
4136.md
4139.md
4143.md
4145.md
4160.md
4189.md
4201.md
4212.md
4218.md
4222.md
4240.md
4253.md
4262.md
4266.md
4291.md
4367.md
4375.md
4400.md
4427.md
4429.md
4439.md
4487.md	[BUG] Don't fire notification for comment of pending review	2024-08-18 17:04:00 +02:00
4506.md
4547.md
4595.md
4605.md
4607.md
4635.md
4684.md	Forgejo v9.0 is GPLv3+	2024-08-22 09:09:29 +02:00
4716.md
4724.md
4801.md
4819.md	[FEAT] Allow pushmirror to use publickey authentication	2024-08-22 17:05:07 +02:00
4907.md
4924.md
4941.md
4998.md	chore(release-notes): weekly cherry-pick week 2024-34	2024-08-19 09:27:37 +02:00
5065.md	chore(release-notes): workflow_dispatch parsing error fix	2024-08-23 08:37:00 +02:00
5090.md	[CHORE] Move to new sessioner library	2024-08-25 03:47:08 +02:00
5109.md	chore(release-notes): weekly cherry-pick week 2024-35	2024-08-26 07:44:20 +02:00
5120.md	chore(release-notes): Update module github.com/go-enry/go-enry/v2 to v2.8.9	2024-08-26 09:54:03 +02:00
5149.md	[SEC] Ensure propagation of API scopes for Conan and Container authentication	2024-08-28 10:33:32 +02:00
5195.md	chore(release-notes): weekly cherry-pick week 2024-36	2024-09-01 08:39:30 +02:00
5205.md	chore(release-notes): Update dependency mermaid v11.2.0	2024-09-14 10:55:08 +02:00
5325.md	[gitea] week 2024-38 cherry pick (gitea/main -> forgejo) (release notes)	2024-09-20 07:11:08 +02:00
5372.md	chore(release-notes): weekly cherry-pick week 2024-39	2024-09-27 08:47:23 +02:00
5384.md	Move web app manifest to a own cache-able route and add a setting to set "display": "standalone"; Closes #2638 (#5384)	2026-01-09 17:49:29 +01:00
5416.md	chore(release-notes): weekly cherry-pick week 2024-40	2024-09-29 11:35:18 +02:00
5459.md	chore(release-notes): Update dependency mermaid to v11.3.0	2024-10-04 08:53:11 +02:00
5477.md	chore(release-notes): weekly cherry-pick week 2024-41	2024-10-06 08:21:41 +02:00
5515.md	chore(release-note): Fix bug when a token is given public only	2024-10-10 16:00:16 +03:00
5543.md	chore(release-notes): weekly cherry-pick week 2024-42	2024-10-13 14:17:08 +03:00
5601.md	chore(release-notes): Update module github.com/go-enry/go-enry/v2 to v2.9.1	2024-10-18 10:12:06 +02:00
5621.md	chore(release-notes): notes for week 2024-43 weekly cherry pick	2024-10-22 18:14:27 +02:00
5677.md	feat: Add partial quoting	2024-10-26 19:15:43 +02:00
5714.md	chore(release-notes): notes for the week 2024-44 weekly cherry pick	2024-10-27 11:27:40 +01:00
5718.md	security: add permission check to 'delete branch after merge'	2024-10-28 05:48:10 +01:00
5719.md	fix(sec): use constant time check for internal token	2024-10-28 06:25:52 +01:00
5751.md	chore(release-notes): Update dependency mermaid to v11.4.0	2024-10-31 07:15:14 +01:00
5778.md	chore(release-notes): related pull requests workflow fixes	2024-11-04 12:10:15 +01:00
5789.md	chore(release-notes): notes for the week 2024-45 weekly cherry pick	2024-11-05 09:39:24 +01:00
5974.md	chore(release-notes): 15 November 2024 security fixes	2024-11-15 11:17:14 +01:00
5988.md	chore(release-notes): notes for the week 2024-46 weekly cherry pick	2024-11-16 15:25:37 +01:00
5997.md	chore(release-notes): notes for the week 2024-47 weekly cherry pick	2024-11-18 19:20:54 +01:00
6062.md	chore(release-notes): notes for the week 2024-48 weekly cherry pick	2024-11-24 15:43:19 +00:00
6110.md	chore(release-notes): notes for the week 2024-49 weekly cherry pick	2024-12-03 10:21:20 +01:00
6200.md	chore(release-notes): notes for the week 2024-50 weekly cherry pick	2024-12-08 09:10:58 +01:00
6271.md	chore(release-notes): notes for the week 2024-51 weekly cherry pick	2024-12-15 10:16:04 +01:00
6351.md	Release-note and file rename for Alt Linux Apt-RPM support (#6656)	2025-01-23 07:22:05 +00:00
6445.md	add release notes	2025-01-01 19:50:39 +01:00
6471.md	chore(release-notes): notes for the week 2025-02 weekly cherry pick	2025-01-05 13:47:27 +00:00
6523.md	feat(ui): create a comment aggregator to reduce noise in issues (#6523)	2025-03-05 17:24:51 +00:00
6553.md	chore(release-notes): add chroma update to v10.0.0 release notes	2025-10-05 17:24:51 +05:00
6639.md	fix: teach the doctor about orphaned two_factor rows (#6639)	2025-01-21 17:30:08 +00:00
6763.md	chore(release-notes): notes for the week 2025-06 weekly cherry pick	2025-02-02 12:05:46 +01:00
6813.md	Reimplement editor Tab handling with accessibility safeguards (#6813)	2025-05-25 19:17:03 +02:00
6933.md	Show if commit is signed in activity feed and unify sha box (#6933)	2025-05-03 10:54:52 +00:00
7251.md	fix: discard v25 secrets migrations errors instead of failing (#7251)	2025-03-17 16:25:37 +00:00
7459.md	chore(release-notes): add chroma update to v12.0.0 release notes	2025-10-05 17:43:06 +05:00
7607.md	chore(release-notes): add chroma update to v12.0.0 release notes	2025-10-05 17:43:06 +05:00
7738.md	chore(release-notes): add chroma update to v12.0.0 release notes	2025-10-05 17:43:06 +05:00
7890.md	chore(release-notes): add chroma update to v12.0.0 release notes	2025-10-05 17:43:06 +05:00
8035.md	chore(upgrade): urfave/cli from v2 to v3 (#8035)	2025-06-01 22:16:37 +02:00
8393.md	chore(release-notes): add chroma update to v13.0.0 release notes	2025-10-05 17:50:35 +05:00
8502.md	Update module code.forgejo.org/forgejo/act to v1.32.0 (forgejo) (#8502)	2025-07-23 01:01:31 +02:00
8783.md	chore(release-notes): add chroma update to v13.0.0 release notes	2025-10-05 17:50:35 +05:00
9023.md	fix!: use run ID instead of run Index in artifacts download web views	2025-08-27 08:53:20 +02:00
9362.md	fix: do not display the title of unsubscribed issues or pull requests in the notification web page (#9362)	2025-09-19 22:32:06 +02:00
9373.md	feat: add foreign keys to stopwatch & tracked_time tables (#9373)	2025-10-01 00:31:38 +02:00
9458.md	fix!: detect extra cmdline args and emit errors (#9458)	2025-10-08 18:20:28 +02:00
9513.md	fix!: prevent forked .profile repositories from displaying profile content (#9513)	2025-10-07 18:53:57 +02:00
9638.md	feat: strip EXIF information from uploaded avatars (#9638)	2025-10-13 23:16:17 +02:00
9830.md	feat: replace cross origin protection (#9830)	2025-10-29 22:43:22 +01:00
9848.md	chore: add release notes for backports of v11 and v13 [skip ci] (#9857)	2025-10-26 04:51:04 +01:00
9849.md	chore: add release notes for backports of v11 and v13 [skip ci] (#9857)	2025-10-26 04:51:04 +01:00
10010.md	feat: ensure only expected ssh public keys are in authorized_keys file (#10010)	2025-11-09 01:06:04 +01:00
10380.md	feat: Follow remote users; feed tab (#10380)	2026-04-12 03:31:03 +02:00
10397.md	feat: replace repo based server-side hooks with centralised hooks (#10397)	2026-04-27 22:34:46 +02:00
10645.md	branding!: make cookies brand independent (#10645)	2026-03-19 04:34:27 +01:00
11096.md	fix(ui)!: remove squash merge committer trailer admin option (#11096)	2026-02-07 12:58:26 +01:00
11098.md	chore(Dockerfile.rootless): remove legacy config file support (#11098)	2026-03-02 06:03:39 +01:00
11194.md	chore: unify signing key configuration across modules (#11194)	2026-04-21 19:39:33 +02:00
11282.md	fix: prevent panic on gitlab import (releases/issues) (#11282)	2026-03-03 21:36:14 +01:00
11365.md	fix(ui): improve Git notes editing (#11365)	2026-03-10 23:49:18 +01:00
11437.md	feat: implement repo-specific access tokens broadly for universal API permission checks (#11437)	2026-02-28 19:47:06 +01:00
11457.md	docs: add release notes for PR #11457	2026-03-01 17:05:53 +01:00
11458.md	docs: add release notes for PR #11458	2026-03-01 10:54:43 -07:00
11514.md	chore: release notes from #11514 & #11515 backports	2026-03-08 20:07:52 -06:00
11515.md	chore: release notes from #11514 & #11515 backports	2026-03-08 20:07:52 -06:00
11699.md	fix: add missing deleting beans for organizations (#11699)	2026-03-17 09:11:52 +01:00
11736.md	feat: ensure repo-specific access tokens can't perform repo admin operations (#11736)	2026-03-20 16:14:36 +01:00
12095.md	feat: support simple JSON API for PyPI package registry (#12095)	2026-04-30 16:58:28 +02:00
12293.md	fix: verify PR author has write access to head to support allow maintainers edit (#12292)	2026-04-29 05:26:22 +02:00
12294.md	fix: verify PR author has write access to head to support allow maintainers edit (#12292)	2026-04-29 05:26:22 +02:00
12295.md	fix: verify PR author has write access to head to support allow maintainers edit (#12292)	2026-04-29 05:26:22 +02:00
12302.md	fix: Prevent unremovable review requests after submitting pending reviews (#12302)	2026-05-08 05:52:59 +02:00
12366.md	fix: in actions_service cancelJobsForRun is bugous use killRun instead (#12366)	2026-05-09 04:46:56 +02:00
12494.md	2026-05-12 security patches (#12493)	2026-05-12 04:54:25 +02:00
12495.md	2026-05-12 security patches (#12493)	2026-05-12 04:54:25 +02:00