From a6e141f805ce138074b8fa64cc92c9d0402f95e5 Mon Sep 17 00:00:00 2001
From: forgejo-release-manager <contact-forgejo-release-manager@forgejo.org>
Date: Tue, 12 May 2026 09:08:47 +0200
Subject: [PATCH] chore(release-notes): Forgejo v11.0.14 [skip ci] (#12535)

https://codeberg.org/forgejo/forgejo/milestone/84476
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12535
Reviewed-by: Beowulf <beowulf@beocode.eu>
---
 release-notes-published/11.0.14.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 release-notes-published/11.0.14.md

diff --git a/release-notes-published/11.0.14.md b/release-notes-published/11.0.14.md
new file mode 100644
index 0000000000..1c7bf69e3f
--- /dev/null
+++ b/release-notes-published/11.0.14.md
@@ -0,0 +1,17 @@
+
+
+<!--start release-notes-assistant-->
+
+## Release notes
+<!--URL:https://codeberg.org/forgejo/forgejo-->
+- Security bug fixes
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 0 --><!--description LSBmaXg6IHByZXZlbnQgZ2l0IHdyaXRlIHRvIHdpa2kgcmVwbyBmcm9tIHVuYXV0aG9yaXplZCB1c2VyIHZpYSBnaXQgSFRUUA==-->fix: prevent git write to wiki repo from unauthorized user via git HTTP<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 1 --><!--description LSBmaXg6IHByZXZlbnQgTEZTIGF1dGhvcml6YXRpb24gdG9rZW4gZnJvbSBiZWluZyB1c2VkIGZvciByZWFkL3dyaXRlIGFjY2VzcyBhZnRlciB1c2VyJ3MgYWNjZXNzIGlzIHJlc3RyaWN0ZWQgZnJvbSBGb3JnZWpv-->fix: prevent LFS authorization token from being used for read/write access after user's access is restricted from Forgejo<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 2 --><!--description LSBmaXg6IHByZXZlbnQgc2NvcGVkIEFQSSBhY2Nlc3MgKE9BdXRoIHRva2VucywgQWNjZXNzIHRva2VucykgZnJvbSBhY2Nlc3NpbmcgcmVzb3VyY2VzIGJleW9uZCB0aGVpciBwZXJtaXR0ZWQgc2NvcGUgdmlhIG5vbi1BUEkgZW5kcG9pbnRzIChlLmcuIC91c2VyL3JlcG8vcmF3Ly4uLik=-->fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing resources beyond their permitted scope via non-API endpoints (e.g. /user/repo/raw/...)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 3 --><!--description LSBmaXg6IGltcGxlbWVudGluZyBtaXNzaW5nIE9BdXRoIHZhbGlkYXRpb24gY2hlY2tzLCBpbXByb3ZlIHByb3RlY3Rpb25zIGFnYWluc3QgcmFjZSBjb25kaXRpb25z-->fix: implementing missing OAuth validation checks, improve protections against race conditions<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 4 --><!--description LSBmaXg6IHByZXZlbnQgT0F1dGggcmVkaXJlY3QgVVJJIHNwb29maW5nIHZpYSBub24tYXNjaWkgY2FzZSBjb2xsaXNpb24=-->fix: prevent OAuth redirect URI spoofing via non-ascii case collision<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12495): <!--number 12495 --><!--line 5 --><!--description LSBmaXg6IHN0cmVuZ3RoZW4gQWN0aW9ucyBBcnRpZmFjdCBWNCBzaWduYXR1cmUgYWxnb3JpdGhtIGFnYWluc3Qgc3Bvb2ZpbmcgYXR0YWNrcw==-->fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks<!--description-->
+- Included for completeness but not user-facing (chores, etc.)
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12527): <!--number 12527 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgbWVybWFpZCB0byB2MTEuMTUuMCBbU0VDVVJJVFldICh2MTEuMC9mb3JnZWpvKQ==-->Update dependency mermaid to v11.15.0 [SECURITY] (v11.0/forgejo)<!--description-->
+  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12463): <!--number 12463 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjUzLjAgW1NFQ1VSSVRZXSAodjExLjAvZm9yZ2Vqbyk=-->Update module golang.org/x/net to v0.53.0 [SECURITY] (v11.0/forgejo)<!--description-->
+<!--end release-notes-assistant-->