4 people 32b8d732b8 2026-05-12 security patches (#12493) ...

- fix: prevent git write to wiki repo from unauthorized user via git HTTP
- fix: prevent LFS authorization token from being used for read/write access after user's access is restricted from Forgejo
- fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing resources beyond their permitted scope via non-API endpoints (e.g. /user/repo/raw/...)
- fix: implementing missing OAuth validation checks, improve protections against race conditions
- fix: prevent OAuth redirect URI spoofing via non-ascii case collision
- fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12493): <!--number 12493 --><!--line 0 --><!--description MjAyNi0wNS0xMiBzZWN1cml0eSBwYXRjaGVz-->2026-05-12 security patches<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: Derzsi Dániel <daniel@tohka.us>
Co-authored-by: jvoisin <julien.voisin@dustri.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12493

2026-05-12 04:54:25 +02:00

..

3139.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3285.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3307.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3334.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3337.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3363.md

docs(release-notes): proofread multiline release-notes files

2024-07-15 21:22:56 +02:00

3383.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3414.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3430.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3434.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3442.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3642.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3654.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3723.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3724.md

Adjust codespell config + make it fix few typos which sneaked in since addition of codespell support (#4857)

2024-08-08 16:07:35 +00:00

3729.md

docs(release-notes): proofread multiline release-notes files

2024-07-15 21:22:56 +02:00

3752.md

docs(release-notes): proofread multiline release-notes files

2024-07-15 21:22:56 +02:00

3791.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3808.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3811.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3830.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3836.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3838.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3847.md

docs(release-notes): proofread multiline release-notes files

2024-07-15 21:22:56 +02:00

3870.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3886.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3917.md

docs(release-notes): proofread multiline release-notes files

2024-07-15 21:22:56 +02:00

3934.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3952.md

chore(release-notes): fix release notes of chroma update in v8.0.0

2025-10-05 17:10:38 +05:00

3985.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

3989.md

docs(release-notes): proofread multiline release-notes files

2024-07-15 21:22:56 +02:00

4026.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4027.md

Adjust codespell config + make it fix few typos which sneaked in since addition of codespell support (#4857)

2024-08-08 16:07:35 +00:00

4072.md

docs(release-notes): proofread multiline release-notes files

2024-07-15 21:22:56 +02:00

4083.md

docs(release-notes): proofread multiline release-notes files

2024-07-15 21:22:56 +02:00

4095.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4125.md

[Feat]Add link to show all Issues/PullRequests (#4125)

2024-10-09 04:56:40 +00:00

4134.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4136.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4139.md

docs(release-notes): proofread multiline release-notes files

2024-07-15 21:22:56 +02:00

4143.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4145.md

docs(release-notes): proofread multiline release-notes files

2024-07-15 21:22:56 +02:00

4160.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4189.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4201.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4212.md

feat(quota): Add a terse release not about quotas

2024-08-02 11:10:34 +02:00

4218.md

docs(release-notes): fix artifact range requests

2024-07-10 08:52:06 +02:00

4222.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4240.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4253.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4262.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4266.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4291.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4367.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4375.md

docs(release-notes): for pull requests #4400, #4375 [skip ci] (#4442)

2024-07-10 05:14:16 +00:00

4400.md

docs(release-notes): for pull requests #4400, #4375 [skip ci] (#4442)

2024-07-10 05:14:16 +00:00

4427.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4429.md

docs(release-notes): display URLs in .sh-session files

2024-07-09 08:24:46 +02:00

4439.md

docs(release-notes): flatten release-notes files

2024-07-11 14:20:34 +02:00

4487.md

[BUG] Don't fire notification for comment of pending review

2024-08-18 17:04:00 +02:00

4506.md

[CHORE] Use github.com/ProtonMail/go-crypto

2024-07-15 17:27:37 +02:00

4547.md

[UI] Convert milestone to HTMX

2024-07-17 14:52:00 +02:00

4595.md

added release notes for pr 4595

2024-07-23 18:47:42 +02:00

4605.md

feat: allow .webp attachments by default

2024-07-21 13:01:08 +05:00

4607.md

Add a release note for cherry-picked features

2024-07-22 15:46:01 +02:00

4635.md

[SECURITY] Notify users about account security changes

2024-07-23 18:31:47 +02:00

4684.md

Forgejo v9.0 is GPLv3+

2024-08-22 09:09:29 +02:00

4716.md

chore(release-notes): weekly cherry-pick week 2024-31

2024-07-28 09:00:29 +02:00

4724.md

cherry-pick OIDC changes from gitea (#4724)

2024-08-08 06:32:14 +00:00

4801.md

chore(release-notes): weekly cherry-pick week 2024-32

2024-08-04 18:24:10 +02:00

4819.md

[FEAT] Allow pushmirror to use publickey authentication

2024-08-22 17:05:07 +02:00

4907.md

add release notes

2024-08-13 22:14:46 +01:00

4924.md

chore(release-notes): weekly cherry-pick week 2024-33

2024-08-13 09:05:50 +02:00

4941.md

[CHORE] Drop go-git support

2024-08-12 19:11:09 +02:00

4998.md

chore(release-notes): weekly cherry-pick week 2024-34

2024-08-19 09:27:37 +02:00

5065.md

chore(release-notes): workflow_dispatch parsing error fix

2024-08-23 08:37:00 +02:00

5090.md

[CHORE] Move to new sessioner library

2024-08-25 03:47:08 +02:00

5109.md

chore(release-notes): weekly cherry-pick week 2024-35

2024-08-26 07:44:20 +02:00

5120.md

chore(release-notes): Update module github.com/go-enry/go-enry/v2 to v2.8.9

2024-08-26 09:54:03 +02:00

5149.md

[SEC] Ensure propagation of API scopes for Conan and Container authentication

2024-08-28 10:33:32 +02:00

5195.md

chore(release-notes): weekly cherry-pick week 2024-36

2024-09-01 08:39:30 +02:00

5205.md

chore(release-notes): Update dependency mermaid v11.2.0

2024-09-14 10:55:08 +02:00

5325.md

[gitea] week 2024-38 cherry pick (gitea/main -> forgejo) (release notes)

2024-09-20 07:11:08 +02:00

5372.md

chore(release-notes): weekly cherry-pick week 2024-39

2024-09-27 08:47:23 +02:00

5384.md

Move web app manifest to a own cache-able route and add a setting to set "display": "standalone"; Closes #2638 (#5384)

2026-01-09 17:49:29 +01:00

5416.md

chore(release-notes): weekly cherry-pick week 2024-40

2024-09-29 11:35:18 +02:00

5459.md

chore(release-notes): Update dependency mermaid to v11.3.0

2024-10-04 08:53:11 +02:00

5477.md

chore(release-notes): weekly cherry-pick week 2024-41

2024-10-06 08:21:41 +02:00

5515.md

chore(release-note): Fix bug when a token is given public only

2024-10-10 16:00:16 +03:00

5543.md

chore(release-notes): weekly cherry-pick week 2024-42

2024-10-13 14:17:08 +03:00

5601.md

chore(release-notes): Update module github.com/go-enry/go-enry/v2 to v2.9.1

2024-10-18 10:12:06 +02:00

5621.md

chore(release-notes): notes for week 2024-43 weekly cherry pick

2024-10-22 18:14:27 +02:00

5677.md

feat: Add partial quoting

2024-10-26 19:15:43 +02:00

5714.md

chore(release-notes): notes for the week 2024-44 weekly cherry pick

2024-10-27 11:27:40 +01:00

5718.md

security: add permission check to 'delete branch after merge'

2024-10-28 05:48:10 +01:00

5719.md

fix(sec): use constant time check for internal token

2024-10-28 06:25:52 +01:00

5751.md

chore(release-notes): Update dependency mermaid to v11.4.0

2024-10-31 07:15:14 +01:00

5778.md

chore(release-notes): related pull requests workflow fixes

2024-11-04 12:10:15 +01:00

5789.md

chore(release-notes): notes for the week 2024-45 weekly cherry pick

2024-11-05 09:39:24 +01:00

5974.md

chore(release-notes): 15 November 2024 security fixes

2024-11-15 11:17:14 +01:00

5988.md

chore(release-notes): notes for the week 2024-46 weekly cherry pick

2024-11-16 15:25:37 +01:00

5997.md

chore(release-notes): notes for the week 2024-47 weekly cherry pick

2024-11-18 19:20:54 +01:00

6062.md

chore(release-notes): notes for the week 2024-48 weekly cherry pick

2024-11-24 15:43:19 +00:00

6110.md

chore(release-notes): notes for the week 2024-49 weekly cherry pick

2024-12-03 10:21:20 +01:00

6200.md

chore(release-notes): notes for the week 2024-50 weekly cherry pick

2024-12-08 09:10:58 +01:00

6271.md

chore(release-notes): notes for the week 2024-51 weekly cherry pick

2024-12-15 10:16:04 +01:00

6351.md

Release-note and file rename for Alt Linux Apt-RPM support (#6656)

2025-01-23 07:22:05 +00:00

6445.md

add release notes

2025-01-01 19:50:39 +01:00

6471.md

chore(release-notes): notes for the week 2025-02 weekly cherry pick

2025-01-05 13:47:27 +00:00

6523.md

feat(ui): create a comment aggregator to reduce noise in issues (#6523)

2025-03-05 17:24:51 +00:00

6553.md

chore(release-notes): add chroma update to v10.0.0 release notes

2025-10-05 17:24:51 +05:00

6639.md

fix: teach the doctor about orphaned two_factor rows (#6639)

2025-01-21 17:30:08 +00:00

6763.md

chore(release-notes): notes for the week 2025-06 weekly cherry pick

2025-02-02 12:05:46 +01:00

6813.md

Reimplement editor Tab handling with accessibility safeguards (#6813)

2025-05-25 19:17:03 +02:00

6933.md

Show if commit is signed in activity feed and unify sha box (#6933)

2025-05-03 10:54:52 +00:00

7251.md

fix: discard v25 secrets migrations errors instead of failing (#7251)

2025-03-17 16:25:37 +00:00

7459.md

chore(release-notes): add chroma update to v12.0.0 release notes

2025-10-05 17:43:06 +05:00

7607.md

chore(release-notes): add chroma update to v12.0.0 release notes

2025-10-05 17:43:06 +05:00

7738.md

chore(release-notes): add chroma update to v12.0.0 release notes

2025-10-05 17:43:06 +05:00

7890.md

chore(release-notes): add chroma update to v12.0.0 release notes

2025-10-05 17:43:06 +05:00

8035.md

chore(upgrade): urfave/cli from v2 to v3 (#8035)

2025-06-01 22:16:37 +02:00

8393.md

chore(release-notes): add chroma update to v13.0.0 release notes

2025-10-05 17:50:35 +05:00

8502.md

Update module code.forgejo.org/forgejo/act to v1.32.0 (forgejo) (#8502)

2025-07-23 01:01:31 +02:00

8783.md

chore(release-notes): add chroma update to v13.0.0 release notes

2025-10-05 17:50:35 +05:00

9023.md

fix!: use run ID instead of run Index in artifacts download web views

2025-08-27 08:53:20 +02:00

9362.md

fix: do not display the title of unsubscribed issues or pull requests in the notification web page (#9362)

2025-09-19 22:32:06 +02:00

9373.md

feat: add foreign keys to stopwatch & tracked_time tables (#9373)

2025-10-01 00:31:38 +02:00

9458.md

fix!: detect extra cmdline args and emit errors (#9458)

2025-10-08 18:20:28 +02:00

9513.md

fix!: prevent forked .profile repositories from displaying profile content (#9513)

2025-10-07 18:53:57 +02:00

9638.md

feat: strip EXIF information from uploaded avatars (#9638)

2025-10-13 23:16:17 +02:00

9830.md

feat: replace cross origin protection (#9830)

2025-10-29 22:43:22 +01:00

9848.md

chore: add release notes for backports of v11 and v13 [skip ci] (#9857)

2025-10-26 04:51:04 +01:00

9849.md

chore: add release notes for backports of v11 and v13 [skip ci] (#9857)

2025-10-26 04:51:04 +01:00

10010.md

feat: ensure only expected ssh public keys are in authorized_keys file (#10010)

2025-11-09 01:06:04 +01:00

10380.md

feat: Follow remote users; feed tab (#10380)

2026-04-12 03:31:03 +02:00

10397.md

feat: replace repo based server-side hooks with centralised hooks (#10397)

2026-04-27 22:34:46 +02:00

10645.md

branding!: make cookies brand independent (#10645)

2026-03-19 04:34:27 +01:00

11096.md

fix(ui)!: remove squash merge committer trailer admin option (#11096)

2026-02-07 12:58:26 +01:00

11098.md

chore(Dockerfile.rootless): remove legacy config file support (#11098)

2026-03-02 06:03:39 +01:00

11194.md

chore: unify signing key configuration across modules (#11194)

2026-04-21 19:39:33 +02:00

11282.md

fix: prevent panic on gitlab import (releases/issues) (#11282)

2026-03-03 21:36:14 +01:00

11365.md

fix(ui): improve Git notes editing (#11365)

2026-03-10 23:49:18 +01:00

11437.md

feat: implement repo-specific access tokens broadly for universal API permission checks (#11437)

2026-02-28 19:47:06 +01:00

11457.md

docs: add release notes for PR #11457

2026-03-01 17:05:53 +01:00

11458.md

docs: add release notes for PR #11458

2026-03-01 10:54:43 -07:00

11514.md

chore: release notes from #11514 & #11515 backports

2026-03-08 20:07:52 -06:00

11515.md

chore: release notes from #11514 & #11515 backports

2026-03-08 20:07:52 -06:00

11699.md

fix: add missing deleting beans for organizations (#11699)

2026-03-17 09:11:52 +01:00

11736.md

feat: ensure repo-specific access tokens can't perform repo admin operations (#11736)

2026-03-20 16:14:36 +01:00

12095.md

feat: support simple JSON API for PyPI package registry (#12095)

2026-04-30 16:58:28 +02:00

12293.md

fix: verify PR author has write access to head to support allow maintainers edit (#12292)

2026-04-29 05:26:22 +02:00

12294.md

fix: verify PR author has write access to head to support allow maintainers edit (#12292)

2026-04-29 05:26:22 +02:00

12295.md

fix: verify PR author has write access to head to support allow maintainers edit (#12292)

2026-04-29 05:26:22 +02:00

12302.md

fix: Prevent unremovable review requests after submitting pending reviews (#12302)

2026-05-08 05:52:59 +02:00

12366.md

fix: in actions_service cancelJobsForRun is bugous use killRun instead (#12366)

2026-05-09 04:46:56 +02:00

12494.md

2026-05-12 security patches (#12493)

2026-05-12 04:54:25 +02:00

12495.md

2026-05-12 security patches (#12493)

2026-05-12 04:54:25 +02:00