Mathieu Fenniak 4b83448b7d 2026-06-10 security patches (#13001) ... - fix: prevent stored XSS in user display name on Actions page - fix: LFS locks must belong to the intended repo, port from Gitea - fix: prevent unauthorized access to draft releases via API - fix: prevent writes to OpenID visibility which may affect other users - fix: prevent viewing private PRs that are linked to public issues on public projects Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13001 Reviewed-by: 0ko <0ko@noreply.codeberg.org> Reviewed-by: Beowulf <beowulf@beocode.eu>		2026-06-10 06:05:01 +02:00
..
actions	chore: re-enable nilnil lint for models/actions/task.go (#12768)	2026-06-05 01:38:23 +02:00
agit	chore: fix typos throughout the codebase (#10753)	2026-01-26 22:57:33 +01:00
asymkey	fix: cleanup data before migration retry (#12370)	2026-05-05 12:41:42 +02:00
attachment	fix: check that attachments belong to correct resource	2026-03-06 11:21:07 -07:00
auth	chore: add more error output for an invalid JWT key identifier (#12903)	2026-06-02 23:39:51 +02:00
authz	feat: enable auth to git LFS via authorized integrations (#12725)	2026-05-28 23:20:58 +02:00
automerge	fix: apply signed-merge checks by merge style (#11403)	2026-04-09 20:26:27 +02:00
context	feat: in-browser validation of website URLs for user, repository, and organization profiles (#12991)	2026-06-08 17:35:15 +02:00
contexttest	feat: add more filters to actions run and tasks api (#11584)	2026-03-10 01:20:00 +01:00
convert	feat(api,ui): add multiline comment on pullrequest (#12582)	2026-06-03 16:06:29 +02:00
cron	fix: cleanup data before migration retry (#12370)	2026-05-05 12:41:42 +02:00
doctor	fix(doctor): ensure the doctor runs with the same settings.AppPath as Forgejo (#12901)	2026-06-06 03:23:06 +02:00
externalaccount	chore(cleanup): replaces unnecessary calls to formatting functions by non-formatting equivalents (#7994)	2025-05-29 17:34:29 +02:00
f3	chore: update gof3/v3 v3.11.15 (#10673)	2026-01-13 16:59:56 +01:00
federation	fix(activitypub): only return public activities on request (#12382)	2026-05-09 05:02:57 +02:00
feed	chore: fix typos throughout the codebase (#10753)	2026-01-26 22:57:33 +01:00
forgejo	chore: move all test blank imports in a single package (#10662)	2026-01-02 05:32:32 +01:00
forms	feat: apply service.VALID_SITE_URL_SCHEMES to apply to repository and organization profiles (#12962)	2026-06-08 15:17:51 +02:00
gitdiff	fix: relocate PR review comments using git blame --reverse, improving comment placement (#12015)	2026-04-11 21:45:39 +02:00
indexer	fix(issue-search): delete issue from indexer on DeleteIssue (#11585)	2026-03-09 18:51:18 +01:00
issue	chore: add modernizer linter (#11936)	2026-04-02 03:29:37 +02:00
lfs	2026-06-10 security patches (#13001)	2026-06-10 06:05:01 +02:00
mailer	feat(api,ui): add multiline comment on pullrequest (#12582)	2026-06-03 16:06:29 +02:00
markup	chore: remove branding from context imports (#9628)	2025-10-11 01:52:51 +02:00
migrations	fix: do not migrate confidential issues and internal notes from Gitlab (#12735)	2026-05-28 20:45:24 +02:00
mirror	fix: store pull mirror creds encrypted with keying (#11909)	2026-04-04 13:53:22 +02:00
moderation	chore: move all test blank imports in a single package (#10662)	2026-01-02 05:32:32 +01:00
notify	fix(issue-search): delete issue from indexer on DeleteIssue (#11585)	2026-03-09 18:51:18 +01:00
org	fix: add missing deleting beans for organizations (#11699)	2026-03-17 09:11:52 +01:00
packages	feat: adds option to force overwrite new branch for /contents route (#12663)	2026-06-06 16:45:57 +02:00
pull	feat(api,ui): add multiline comment on pullrequest (#12582)	2026-06-03 16:06:29 +02:00
redirect	chore: move all test blank imports in a single package (#10662)	2026-01-02 05:32:32 +01:00
release	fix: don't trip deleting attachment with missing permission error (#11642)	2026-03-12 20:29:10 +01:00
remote	chore: fix typos throughout the codebase (#10753)	2026-01-26 22:57:33 +01:00
repository	feat: adds option to force overwrite new branch for /contents route (#12663)	2026-06-06 16:45:57 +02:00
secrets	feat: allow renaming and replacing secrets (#11732)	2026-03-23 03:30:02 +01:00
shared/automerge	fix: suppress false-positive error log when PR is already in the automerge queue (#9784)	2025-10-21 08:19:33 +02:00
stats	chore: upgrade to https://code.forgejo.org/xorm/xorm v1.4.0 (#12639)	2026-05-20 20:20:08 +02:00
task	fix: cleanup data before migration retry (#12370)	2026-05-05 12:41:42 +02:00
uinotification	chore: branding import path (#7337)	2025-03-27 19:40:14 +00:00
user	fix: re-uploading the same avatar doesn't delete it (#12823)	2026-05-30 13:25:36 +02:00
webhook	feat: Update Microsoft Teams webhook to use AdaptiveCard (#11704)	2026-05-26 16:10:55 +02:00
wiki	feat: replace repo based server-side hooks with centralised hooks (#10397)	2026-04-27 22:34:46 +02:00