Merge pull request 'chore(release-notes): keep release notes in release-notes-published' (#6165) from earl-warren/forgejo:wip-release-notes into forgejo

+12 -12

RELEASE-NOTES.md

··· 4 4 5 5 A [patch or minor release](https://semver.org/spec/v2.0.0.html) (e.g. upgrading from v7.0.0 to v7.0.1 or v7.1.0) does not require manual intervention. But [major releases](https://semver.org/spec/v2.0.0.html#spec-item-8) where the first version number changes (e.g. upgrading from v1.21 to v7.0) contain breaking changes and the release notes explain how to deal with them. 6 6 7 - The release notes of each release [are available in the corresponding milestone](https://codeberg.org/forgejo/forgejo/milestones), starting with [Forgejo 7.0.7](https://codeberg.org/forgejo/forgejo/milestone/7683) and [Forgejo 8.0.1](https://codeberg.org/forgejo/forgejo/milestone/7682). 7 + The release notes of each release [are available in the release-notes-published directory of this repository](release-notes-published), starting with [Forgejo 7.0.7](release-notes-published/7.0.7.md) and [Forgejo 8.0.1](release-notes-published/8.0.1.md). 8 8 9 9 ## 9.0.2 10 10 11 - The Forgejo v9.0.2 release notes are [available in the v9.0.2 milestone](https://codeberg.org/forgejo/forgejo/milestone/8610). 11 + See the [Forgejo 9.0.2 release notes](release-notes-published/9.0.2.md). 12 12 13 13 ## 9.0.1 14 14 15 - The Forgejo v9.0.1 release notes are [available in the v9.0.1 milestone](https://codeberg.org/forgejo/forgejo/milestone/8544). 15 + See the [Forgejo 9.0.1 release notes](release-notes-published/9.0.1.md). 16 16 17 17 ## 9.0.0 18 18 19 - The Forgejo v9.0.0 release notes are [available in the v9.0.0 milestone](https://codeberg.org/forgejo/forgejo/milestone/7235). 19 + See the [Forgejo 9.0.0 release notes](release-notes-published/9.0.0.md). 20 20 21 21 ## 8.0.3 22 22 23 - The Forgejo v8.0.3 release notes are [available in the v8.0.3 milestone](https://codeberg.org/forgejo/forgejo/milestone/8231). 23 + See the [Forgejo 8.0.3 release notes](release-notes-published/8.0.3.md). 24 24 25 25 ## 8.0.2 26 26 27 - The Forgejo v8.0.2 release notes are [available in the v8.0.2 milestone](https://codeberg.org/forgejo/forgejo/milestone/7728). 27 + See the [Forgejo 8.0.2 release notes](release-notes-published/8.0.2.md). 28 28 29 29 ## 8.0.1 30 30 31 - The Forgejo v8.0.1 release notes are [available in the v8.0.1 milestone](https://codeberg.org/forgejo/forgejo/milestone/7682). 31 + See the [Forgejo 8.0.1 release notes](release-notes-published/8.0.1.md). 32 32 33 33 ## 8.0.0 34 34 ··· 169 169 170 170 ## 7.0.11 171 171 172 - The Forgejo v7.0.11 release notes are [available in the v7.0.11 milestone](https://codeberg.org/forgejo/forgejo/milestone/8609). 172 + See the [Forgejo 7.0.11 release notes](release-notes-published/7.0.11.md). 173 173 174 174 ## 7.0.10 175 175 176 - The Forgejo v7.0.10 release notes are [available in the v7.0.10 milestone](https://codeberg.org/forgejo/forgejo/milestone/8286). 176 + See the [Forgejo 7.0.10 release notes](release-notes-published/7.0.10.md). 177 177 178 178 ## 7.0.9 179 179 180 - The Forgejo v7.0.9 release notes are [available in the v7.0.9 milestone](https://codeberg.org/forgejo/forgejo/milestone/8232). 180 + See the [Forgejo 7.0.9 release notes](release-notes-published/7.0.9.md). 181 181 182 182 ## 7.0.8 183 183 184 - The Forgejo v7.0.8 release notes are [available in the v7.0.8 milestone](https://codeberg.org/forgejo/forgejo/milestone/7729). 184 + See the [Forgejo 7.0.8 release notes](release-notes-published/7.0.8.md). 185 185 186 186 ## 7.0.7 187 187 188 - The Forgejo v7.0.7 release notes are [available in the v7.0.7 milestone](https://codeberg.org/forgejo/forgejo/milestone/7683). 188 + See the [Forgejo 7.0.7 release notes](release-notes-published/7.0.7.md). 189 189 190 190 ## 7.0.6 191 191

+13

release-notes-published/7.0.10.md

··· 1 +  2 + 3 + ## Release notes 4 +  5 + - Security bug fixes 6 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5719) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5723)): Forgejo generates a token which is used to authenticate web endpoints that are only meant to be used internally, for instance when the SSH daemon is used to push a commit with Git. The verification of this token was not done in constant time and was susceptible to [timing attacks](https://en.wikipedia.org/wiki/Timing_attack). A pre-condition for such an attack is the precise measurements of the time for each operation. Since it requires observing the timing of network operations, the issue is mitigated when a Forgejo instance is accessed over the internet because the ISP introduce unpredictable random delays. 7 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5718) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5720)): Because of a missing permission check, the branch used to propose a pull request to a repository can always be deleted by the user performing the merge. It was fixed so that such a deletion is only allowed if the user performing the merge has write permission to the repository from which the pull request was made. 8 + - Localization 9 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5182) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5401)): Translation backports to v7 10 + - Included for completeness but not worth a release note 11 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5725): Update dependency mermaid to v10.9.3 [SECURITY] (v7.0/forgejo) 12 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5241): Update dependency go to v1.22.7 (v7.0/forgejo) 13 +

+14

release-notes-published/7.0.11.md

··· 1 +  2 + 3 + ## Release notes 4 +  5 + - Security bug fixes 6 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5976)): [commit](https://codeberg.org/forgejo/forgejo/commit/1ce33aa38d1d258d14523ff2c7c2dbf339f22b74) it was possible to use a token sent via email for secondary email validation to reset the password instead. In other words, a token sent for a given action (registration, password reset or secondary email validation) could be used to perform a different action. It is no longer possible to use a token for an action that is different from its original purpose. 7 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5976)): [commit](https://codeberg.org/forgejo/forgejo/commit/061abe60045212acf8c3f5c49b5cc758b4cbcde9) a fork of a public repository would show in the list of forks, even if its owner was not a public user or organization. Such a fork is now hidden from the list of forks of the public repository. 8 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5976)): [commit](https://codeberg.org/forgejo/forgejo/commit/3e3ef76808100cb1c853378733d0f6a910324ac6) the members of an organization team with read access to a repository (e.g. to read issues) but no read access to the code could read the RSS or atom feeds which include the commit activity. Reading the RSS or atom feeds is now denied unless the team has read permissions on the code. 9 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5976)): [commit](https://codeberg.org/forgejo/forgejo/commit/9508aa7713632ed40124a933d91d5766cf2369c2) the tokens used when [replying by email to issues or pull requests](https://forgejo.org/docs/v9.0/user/incoming/) were weaker than the [rfc2104 recommendations](https://datatracker.ietf.org/doc/html/rfc2104#section-5). The tokens are now truncated to 128 bits instead of 80 bits. It is no longer possible to reply to emails sent before the upgrade because the weaker tokens are invalid. 10 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5976)): [commit](https://codeberg.org/forgejo/forgejo/commit/786dfc7fb81ee76d4292ca5fcb33e6ea7bdccc29) a registered user could modify the update frequency of any push mirror (e.g. every 4h instead of every 8h). They are now only able to do that if they have administrative permissions on the repository. 11 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5976)): [commit](https://codeberg.org/forgejo/forgejo/commit/e6bbecb02d47730d3cc630d419fe27ef2fb5cb39) it was possible to use basic authorization (i.e. user:password) for requests to the API even when security keys were enrolled for a user. It is no longer possible, an application token must be used instead. 12 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5976)): [commit](https://codeberg.org/forgejo/forgejo/commit/7067cc7da4f144cc8a2fd2ae6e5307e0465ace7f) some markup sanitation rules were not as strong as they could be (e.g. allowing `emoji somethingelse` as well as `emoji`). The rules are now stricter and do not allow for such cases. 13 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5976)): [commit](https://codeberg.org/forgejo/forgejo/commit/b70196653f9d7d3b9d4e72d114e5cc6f472988c4) when Forgejo is configured to enable instance wide search (e.g. with [bleve](https://blevesearch.com/)), results found in the repositories of private or limited users were displayed to anonymous visitors. The results found in private or limited organizations were not displayed. The search results found in the repositories of private or limited user are no longer displayed to anonymous visitors. 14 +

+13

release-notes-published/7.0.7.md

··· 1 + This is a security release. See the documentation for more information on the [upgrade procedure](https://forgejo.org/docs/v7.0/admin/upgrade/). 2 + 3 + - Security 4 + A [change introduced in Forgejo v1.21](https://codeberg.org/forgejo/forgejo/pulls/1433) allows a Forgejo user with write permission on a repository description to [inject a client-side script into the web page viewed by the visitor](https://en.wikipedia.org/wiki/Cross-site_scripting). This XSS allows for `href` in anchor elements to be set to a `javascript:` URI in the repository description, which will execute the specified script upon clicking (and not upon loading). [`AllowStandardURLs`](https://pkg.go.dev/github.com/microcosm-cc/bluemonday#Policy.AllowStandardURLs) is now called for the repository description policy, which ensures that URIs in anchor elements are `mailto:`, `http://` or `https://` and thereby disallowing the `javascript:` URI. 5 + 6 +  7 + 8 +  9 + - Bug fixes 10 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4896) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4900)): disallow javascript: URI in the repository description 11 + - Localization 12 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4568) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4882)): i18n: backport of #4568 #4668 and #4783 to v7 13 +

+18

release-notes-published/7.0.8.md

··· 1 + This is a security release. See the documentation for more information on the [upgrade procedure](https://forgejo.org/docs/v7.0/admin/upgrade/). 2 + 3 + - Security bug fixes 4 + [The scope of application tokens was not verified](https://codeberg.org/forgejo/forgejo/pulls/5149) when writing containers or Conan packages. This is of no consequence when the user associated with the application token does not have write access to packages. If the user has write access to packages, such a token can be used to write containers and Conan packages. An application token that was used to write containers or Conan packages without the `package:write` scope will now fail with an unauthorized error. It must be re-created to include the `package:write` scope. 5 + 6 + 7 +  8 + 9 +  10 + - User Interface bug fixes 11 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5029) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5033)): Overflow for images on project cards. 12 + - Bug fixes 13 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5149) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5150)): The scope of application tokens is not verified when writing containers or Conan packages. 14 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4885) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4950)): Run full PR checks on AGit push. 15 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/3264) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4999)): - [commit](https://codeberg.org/forgejo/forgejo/commit/364922c6e4f28264add9e2501a352c25ad6a0993) When a repository is adopted, its object format is not set in the database. 16 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/3264) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4999)): - [commit](https://codeberg.org/forgejo/forgejo/commit/e7f332a55d6a48a3f3b4f2bfa43d18455ac00acc) During a migration from bitbucket, LFS downloads fail. 17 + - Localization 18 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4889) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5138)): Backports of #4889 and #4984 to v7

+9

release-notes-published/7.0.9.md

··· 1 +  2 + 3 +  4 + - Security 5 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5244) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5246)): replace v-html with v-text in branch search inputbox for XSS protection 6 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5201): Upgrade [webpack to v5.94.0](https://github.com/webpack/webpack/releases/tag/v5.94.0) as a precaution to mitigate [CVE-2024-43788](https://github.com/advisories/GHSA-4vvj-4cpr-p986), although we were not yet able to confirm that this can be exploited in Forgejo. 7 + - Localization 8 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5070) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5181)): i18n: update of translations from Codeberg Translate 9 +

+20

release-notes-published/8.0.1.md

··· 1 + This is a security release. See the documentation for more information on the [upgrade procedure](https://forgejo.org/docs/v8.0/admin/upgrade/). 2 + 3 + - Security bug fixes 4 + A [change introduced in Forgejo v1.21](https://codeberg.org/forgejo/forgejo/pulls/1433) allows a Forgejo user with write permission on a repository description to [inject a client-side script into the web page viewed by the visitor](https://en.wikipedia.org/wiki/Cross-site_scripting). This XSS allows for `href` in anchor elements to be set to a `javascript:` URI in the repository description, which will execute the specified script upon clicking (and not upon loading). [`AllowStandardURLs`](https://pkg.go.dev/github.com/microcosm-cc/bluemonday#Policy.AllowStandardURLs) is now called for the repository description policy, which ensures that URIs in anchor elements are `mailto:`, `http://` or `https://` and thereby disallowing the `javascript:` URI. 5 + 6 +  7 + 8 +  9 + - User Interface bug fixes 10 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4835) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4848)): Do not include trailing EOL character when counting lines 11 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4836) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4847)): Add background to reactions on hover 12 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4806) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4807)): Prevent uppercase in header of dashboard context selector 13 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4754) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4756)): Fix page layout in admin settings 14 + - Bug fixes 15 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4896) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4901)): disallow javascript: URI in the repository description 16 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4852) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4865)): Ensure all filters are persistent in issue filters 17 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4828) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4840)): Allow 4 charachter SHA in `/src/commit` 18 + - Localization 19 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4668) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4881)): i18n: backport of #4668 and #4783 to v8 20 +

+24

release-notes-published/8.0.2.md

··· 1 + This is a security release. See the documentation for more information on the [upgrade procedure](https://forgejo.org/docs/v8.0/admin/upgrade/). 2 + 3 + - Security 4 + [The scope of application tokens was not verified](https://codeberg.org/forgejo/forgejo/pulls/5149) when writing containers or Conan packages. This is of no consequence when the user associated with the application token does not have write access to packages. If the user has write access to packages, such a token can be used to write containers and Conan packages. An application token that was used to write containers or Conan packages without the `package:write` scope will now fail with an unauthorized error. It must be re-created to include the `package:write` scope. 5 + 6 +  7 + 8 +  9 + - User Interface bug fixes 10 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5029) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5032)): Overflow for images on project cards. 11 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4798) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4919)): Allow unreacting from comment popover. 12 + - Bug fixes 13 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5149) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5151)): The scope of application tokens is not verified when writing containers or Conan packages. 14 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5065) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5080)): When a Forgejo Actions workflow includes a `workflow_dispatch` with `inputs` and other events (for instance `push`), it is silently ignored because of a parsing error. 15 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5053): Automerge on AGit pull requests is ignored. 16 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4998) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5050)): [commit](https://codeberg.org/forgejo/forgejo/commit/7f1db1df3ee8d620f997b8e70a40c2f48ae96c0f) Show lock owner instead of repo owner on LFS setting page. 17 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4998) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5050)): [commit](https://codeberg.org/forgejo/forgejo/commit/ebfdc659d814561f8783094e2eb26738a5500e55) Render plain text file if the LFS object doesn't exist. 18 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4998) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5050)): [commit](https://codeberg.org/forgejo/forgejo/commit/9e066c3cad7bb1b30e2def34bd0608aac825cf58) Panic of ssh public key page after deletion of an auth source. 19 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4998) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5050)): [commit](https://codeberg.org/forgejo/forgejo/commit/a8e25e907c66140961f28ba92403176c816dfb60) Add missing repository type filter parameters to pager. 20 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4907) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4965)): Reverted a change from Gitea which prevented allow/reject reviews on merged or closed PRs. This change was not considered by the Forgejo UI team and there is a consensus that it feels like a regression, since it interferes with workflows known to be used by Forgejo users without providing a tangible benefit. 21 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4885) ([backported](https://codeberg.org/forgejo/forgejo/pulls/4951)): Run full PR checks on AGit push. 22 + - Localization 23 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4984) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5116)): i18n: update of translations from Codeberg Translate 24 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4889) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5114)): i18n: update of translations from Codeberg Translate

+10

release-notes-published/8.0.3.md

··· 1 +  2 + 3 +  4 + - Security 5 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5244) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5247)): replace v-html with v-text in branch search inputbox for XSS protection 6 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5202): Upgrade [webpack to v5.94.0](https://github.com/webpack/webpack/releases/tag/v5.94.0) as a precaution to mitigate [CVE-2024-43788](https://github.com/advisories/GHSA-4vvj-4cpr-p986), although we were not yet able to confirm that this can be exploited in Forgejo. 7 + - Localization 8 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5182) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5230)): i18n: update of translations from Codeberg Translate 9 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5070) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5161)): i18n: update of translations from Codeberg Translate 10 +

+114

release-notes-published/9.0.0.md

··· 1 + A [companion blog post](https://forgejo.org/2024-10-release-v9-0/) provides additional context on this major release. 2 + 3 +  4 + 5 +  6 + - Breaking changes 7 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4724): OIDC integrations that POST to `/login/oauth/introspect` without sending HTTP basic authentication will now fail with a 401 HTTP Unauthorized error. To fix the error, the client must begin sending HTTP basic authentication with a valid client ID and secret. This endpoint was previously authenticated via the introspection token itself, which is less secure. 8 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5515) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5526)): **Fixing this bug is a breaking change because existing tokens with a public scope will no longer return private resources. They have to be deleted and re-created without the public scope to restore their original behavior**. The public scope of an application token does not filter out private repositories, organizations or packages in some cases. This scope is not the default, it has to be manually set via the web UI or the API. When the public scope is explicitly added to an application token that is allowed to list the repositories and packages of a user or an organization, it is meant as a restriction. For instance if a user has two repositories, one private and the other publicly visible, a token with the public scope used with the API endpoint listing the repositories that belong to this user must only return the publicly visible one and not reveal the existence of the private one. 9 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4941): Drop support to build Forgejo with the optional go-git Git backend. It only affects users who built Forgejo manually using `TAGS=gogits`, which no longer has any effect. Moving forward, we only support the default backend using the git binary. Please get in touch if you used the go-git backend and require any assistance moving away from it. 10 + - User Interface features 11 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5286): Set created_by as the default filter for /issues and /pulls. 12 + Note that this also affects /org/*/pulls and /org/*/issues, but for them this default might be reverted back in the future releases. 13 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5270): Set fuzzy as default for issue search. 14 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5214): Improve commit graph layout. 15 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5205): mermaid: [Add support for iconify icons](https://github.com/mermaid-js/mermaid/pull/5793). 16 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5205): mermaid: [Allow multi-line relationship labels](https://github.com/mermaid-js/mermaid/pull/5711). 17 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5205): mermaid: [Adds architecture diagrams which allows users to show relations between services](https://github.com/mermaid-js/mermaid/pull/5452). 18 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5110): Improve diffs generated by Forgejo. 19 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5002): Add `rel="nofollow"` to in-list labels. 20 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4782): Distinguish between new tags, releases and pre-releases on activity page. 21 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4749): Highlighted code search results. 22 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4710): Refactor repo migration items. 23 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4697): Add package counter to repo/user/org overview pages. 24 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4571): Replace `vue-bar-graph` with `chart.js`. 25 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4541): Add more emoji and code block rendering in issues. 26 + - User Interface bug fixes 27 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5261): Bad spacing on new release page. 28 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5180): Milestone assignment in new issue. 29 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4928): git-grep: ensure bounded default for MatchesPerFile. 30 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4597): Incorrect go to citation button. 31 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4538): Incorrect HTMX support for profile card. 32 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4490): Accessibility keyboard support for test actions. 33 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4455): Update pull request icons. 34 + - Features 35 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5482) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5524)): "Assign to me" button on PR and Issues. 36 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5351) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5407)): Add architecture-specific removal support for arch package. 37 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5372) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5406)): [commit](https://codeberg.org/forgejo/forgejo/commit/9d3473119893ffde0ab36d98e7a0e41c5d0ba9a3) Add bin to Composer Metadata. 38 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5383): Internationalization user experience improvements on team permissions and issue closing. 39 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5325): [commit](https://codeberg.org/forgejo/forgejo/commit/2da0ebbd2314f12b287694c378a888311dd337bc) Support allowed hosts for migrations to work with proxy. 40 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5125): Trivial default quota configuration. 41 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5120): Language detection in the repository learned about the following languages: [Luau](https://github.com/github-linguist/linguist/pull/6612), [BQN](https://github.com/github-linguist/linguist/pull/6623), [Cron table](https://github.com/github-linguist/linguist/pull/6759), [NMODL](https://github.com/github-linguist/linguist/pull/6776), [Pkl](https://github.com/github-linguist/linguist/pull/6730), [templ](https://github.com/github-linguist/linguist/pull/6798), [FIRRTL](https://github.com/github-linguist/linguist/pull/6848), [Julia REPL](https://github.com/github-linguist/linguist/pull/6859), [Caddyfile](https://github.com/github-linguist/linguist/pull/6862). 42 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5120): The following extensions or filenames in a repository are associated with the matching language: [.sublime-color-scheme](https://github.com/github-linguist/linguist/pull/6758), [MODULE.bazel.lock](https://github.com/github-linguist/linguist/pull/6783), [Cargo.toml.orig](https://github.com/github-linguist/linguist/pull/6787), [tsx](https://github.com/github-linguist/linguist/pull/6788), [justfile](https://github.com/github-linguist/linguist/pull/6795), [.zig.zon](https://github.com/github-linguist/linguist/pull/6820), [.envrc](https://github.com/github-linguist/linguist/pull/6865). 43 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5090): Remove support for Couchbase as a session provider; it instead will now fallback to the file provider. The rationale for removing Couchbase support is that it's not free software, https://www.couchbase.com/blog/couchbase-adopts-bsl-license/, and therefore cannot be tested in Forgejo and neither should be supported. 44 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4967): git-grep: allow searching for words with initial dashes. 45 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4927): git-grep: skip binary files. 46 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4924): [commit](https://codeberg.org/forgejo/forgejo/commit/bf7373a2520ae56a1dc00416efa02de9749b63d3) Forgejo Actions logs are compressed by default. It can be disabled by setting `[actions].LOG_COMPRESSION=none`. 47 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4903): Support grouping by any path for arch package. 48 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4891): Remove expensive nearest branch calculatations (`$.BranchName`) from commit diff view (`/:owner/:repo/commit/:commit`). 49 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4819): Allow push mirrors to use a SSH key as the authentication method for the mirroring action instead of using user:password authentication. The SSH keypair is created by Forgejo and the destination repository must be configured with the public key to allow for push over SSH. 50 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4801): [commit](https://codeberg.org/forgejo/forgejo/commit/11b6253e7532ba11dee8bc31d4c262b102674a4d) Use UTC as a timezone when running scheduled actions tasks. 51 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4801): [commit](https://codeberg.org/forgejo/forgejo/commit/feb43b2584b7f64ec7f9952af2b50b2210e6e6cf) The actions logs older than `[actions].LOG_RETENTION_DAYS` days are removed (the default is 365). 52 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4780): Add signature support for the RPM module. 53 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4766): Allow color and background-color style properties for table cells. 54 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4716): [commit](https://codeberg.org/forgejo/forgejo/commit/8d23433dab08fcbb8043e5d239171fba59c53108): support pull_request_target event for commit status. 55 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4716): [commit](https://codeberg.org/forgejo/forgejo/commit/cb9071bbf433715f0e16e39cb60126b65f8236a0): support delete user email in admin panel. 56 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4704): Notify owner about TOTP enrollment. 57 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4635): Email notifications are now sent when account security changes are made: password changed, primary email changed (email sent to old primary mail), TOTP disabled or a security key removed. 58 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4633): Enable `INVALIDATE_REFRESH_TOKENS`. 59 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4625): Sort milestones by name by default instead of the due date. 60 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4607): [commit](https://codeberg.org/forgejo/forgejo/commit/21fdd28f084e7f1aef309c9ebd7599ffa6986453) allow synchronizing user status from OAuth2 login providers. 61 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4607): [commit](https://codeberg.org/forgejo/forgejo/commit/004cc6dc0ab7cc9c324ccb4ecd420c6aeeb20500) add option to change mail from user display name. 62 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4607): [commit](https://codeberg.org/forgejo/forgejo/commit/d0227c236aa195bd03990210f968b8e52eb20b79) issue Templates: add option to have dropdown printed list. 63 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4605): the default setting attachment.ALLOWED_TYPES was adjusted to allow .webp attachments in issues - a more efficient format for images like screenshots. All attachments are treated as normal files and are not re-encoded by Forgejo. If you have customized this setting, you may also want to add .webp to it for the benefit of your users, as well as to reduce server traffic and storage usage. 64 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4542): Convert milestone to HTMX. 65 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4516): Use the full user name in emails to address the recipient, when available. 66 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4449): Enhancing OAuth2 Provider with Granular Scopes for Resource Access. 67 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4429): [Display URLs in .sh-session files](https://github.com/buildkite/terminal-to-html/pull/163). 68 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4367): The caching of contributor stats was improved (the data used by `/<user>/<repo>/activity/recent-commits`) to use the configured cache TTL from the config (`[cache].ITEM_TTL`) instead of a hardcoded TTL of ten minutes. The computation of this operation is computationally heavy and makes a lot of requests to the database and Git on repositories with a lot of commits. It should be cached for longer than what was previously hardcoded, ten minutes. 69 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4266): Add support for LFS server implementations which have batch API responses in an older/deprecated schema. 70 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4218): [Forgejo Actions artifacts](https://forgejo.org/docs/next/user/actions/#artifacts) support [range requests](https://en.wikipedia.org/wiki/Byte_serving) to resume a download. 71 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4212): Added the foundations of a flexible, configurable quota system. 72 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/2869): Logs journald integration. 73 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/1445): A release asset can be a URL instead of a file. 74 + - Bug fixes 75 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5529) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5565)): Don't allow owner team with incorrect unit access (includes doctor fix). 76 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5470) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5547)): Schedule workflows are canceled when pushing to the default branch. 77 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5492) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5507)): Incorrect Discord webhook JSON for issue events. 78 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5372) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5406)): [commit](https://codeberg.org/forgejo/forgejo/commit/f709de24039ab7e605d3e09e3b61240836381603) wrong last modify time. 79 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5372) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5406)): [commit](https://codeberg.org/forgejo/forgejo/commit/2675a24649af2fff34f5c7e416d6ff78591d8d9c) Repo Activity: count new issues that were closed. 80 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5372) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5406)): [commit](https://codeberg.org/forgejo/forgejo/commit/526054332acb221e061d3900bba2dc6e012da52d) incorrect /tokens API. 81 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5372) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5406)): [commit](https://codeberg.org/forgejo/forgejo/commit/0cafec4c7a2faf810953e9d522faf5dc019e1522) Do not escape relative path in RPM primary index. 82 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5325): [commit](https://codeberg.org/forgejo/forgejo/commit/eb765dabfd43e353bd2208e8375b102935d0f103) Handle invalid target when creating releases using API. 83 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5325): [commit](https://codeberg.org/forgejo/forgejo/commit/5af168fb92e5dd3b0c81d97ba27a6f19739bef18) /repos/{owner}/{repo}/pulls/{index}/files endpoint not populating previous_filename. 84 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5269): Improve textarea paste. 85 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5195): [commit](https://codeberg.org/forgejo/forgejo/commit/196907e359420f63003f884d1cf827b4a4d7a4e5) Handle "close" actionable references for manual merges. 86 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5195): [commit](https://codeberg.org/forgejo/forgejo/commit/46b1f2e7e4e795331f28f74666094c9416499e03) Team admins are allowed to search team members via the API. 87 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5109): [commit](https://codeberg.org/forgejo/forgejo/commit/3ade4d9b2bfa6ae84a1ded932907a53060565575) Don't return 500 if mirror url contains special chars. 88 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5109): [commit](https://codeberg.org/forgejo/forgejo/commit/dda53569b1b70507469fc296881eec89606ab9c3) Agit automerge is not working properly. 89 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5075): Improve the display of PR & issue short links. 90 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4978): Migrate scoped GitLab labels as scoped Forgejo labels. 91 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4924): [commit](https://codeberg.org/forgejo/forgejo/commit/9812b7af91b69386c5d4c08982aece7bd8f9a174) /repos/{owner}/{repo}/pulls/{index} [requested_reviewers contains null for teams](https://codeberg.org/forgejo/forgejo/issues/4108). 92 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4809): Validate title length when updating an issue. 93 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4801): [commit](https://codeberg.org/forgejo/forgejo/commit/0dbc6230286e113accbc6d5e829ce8dae1d1f5d4) Hide the "Details" link of commit status when the user cannot access actions. 94 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4801): [commit](https://codeberg.org/forgejo/forgejo/commit/6e63afe31f43eaf5ff7c8595ddeaf8515c2dc0c0) The API endpoint to get the actions registration token is GET /repos/{owner}/{repo}/actions/runners/registration-token and not GET /repos/{owner}/{repo}/runners/registration-token. 95 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4801): [commit](https://codeberg.org/forgejo/forgejo/commit/6e63afe31f43eaf5ff7c8595ddeaf8515c2dc0c0) Runner registration token via API is broken for repo level runners. 96 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4801): [commit](https://codeberg.org/forgejo/forgejo/commit/c784a5874066ca1a1fd518408d5767b4eb57bd69) Deleted projects causes bad popover text on issues. 97 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4801): [commit](https://codeberg.org/forgejo/forgejo/commit/42bb51af9b8283071e15ac6470ada9824d87cd40) Distinguish LFS object errors to ignore missing objects during migration. 98 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4801): [commit](https://codeberg.org/forgejo/forgejo/commit/6328f648decc2754ef10ee5ca6ca9785a156614c) When viewing the revision history of wiki pages, the pagination links are broken: instead of org/repo/wiki/Page?action=_revision&page=2, the link is only org/repo/wiki/Page?page=2, thus bringing the user back to the wiki page. 99 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4801): [commit](https://codeberg.org/forgejo/forgejo/commit/2310556158d70bf1dbfca96dc928e1be3d3f41be) Also rename the head branch of open pull requests when renaming a branch. 100 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4716): [commit](https://codeberg.org/forgejo/forgejo/commit/ee11a263f8c9de33d42fc117443f4054a311c875): add return type to GetRawFileOrLFS and GetRawFile. 101 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4716): [commit](https://codeberg.org/forgejo/forgejo/commit/f61873c7e42b613405d367421ad19db80f831053): properly filter issue list given no assignees filter. 102 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4698): Cron task to cleanup dangling container images with version sha256:*. 103 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4619): Allow updates to runners' secrets. 104 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4487): Do not fire webhook notifications for updates and deletions of comments that are part of an ongoing review (a review that is still in draft). Also, content history will not be saved for such comments, to avoid exposing fixing embarrassing typos you've have made while the review was still pending. 105 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4427): Fixed social media previews for links to wiki pages. 106 + - Localization 107 + - Updates of translations from [Codeberg Translate](https://translate.codeberg.org/projects/forgejo/forgejo/). 108 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4980): Improve the clarity of confirmation in email messages. 109 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5523) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5534)): Fine tune language for units. 110 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5537) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5538)): Improve translation strings for webhook events. 111 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4829): Allow different translations of creation links and titles. 112 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4599): English strings improvements for internationalization. 113 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/4596): Encourage participation in the localization of Forgejo in language settings. 114 +

+33

release-notes-published/9.0.1.md

··· 1 +  2 + 3 + ## Release notes 4 +  5 + - Security bug fixes 6 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5719) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5724)): Forgejo generates a token which is used to authenticate web endpoints that are only meant to be used internally, for instance when the SSH daemon is used to push a commit with Git. The verification of this token was not done in constant time and was susceptible to [timing attacks](https://en.wikipedia.org/wiki/Timing_attack). A pre-condition for such an attack is the precise measurements of the time for each operation. Since it requires observing the timing of network operations, the issue is mitigated when a Forgejo instance is accessed over the internet because the ISP introduce unpredictable random delays. 7 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5718) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5721)): Because of a missing permission check, the branch used to propose a pull request to a repository can always be deleted by the user performing the merge. It was fixed so that such a deletion is only allowed if the user performing the merge has write permission to the repository from which the pull request was made. 8 + - Bug fixes 9 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5439) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5708)): Fix boolean inputs in workflow_dispatch 10 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5634) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5636)): package arch database not updating when uploading "any" architecture 11 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5627) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5631)): correct SQL query for active issues 12 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5626) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5629)): specify default value for `EXPLORE_DEFAULT_SORT`. 13 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5613) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5624)): fix: Add `recentupdated` as recognized sort option 14 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5616): Update dependency mermaid to v11.3.0 (v9.0/forgejo) 15 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5587) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5588)): Dockerfile: use alpine:3.20 instead of golang:1.23-alpine3.20 16 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5585) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5586)): Dockerfile: unnecessary container image layer duplication 17 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5647): [commit](https://codeberg.org/forgejo/forgejo/commit/1913399d8176944f170d4f1c032dc37003aaafc0) Always update expiration time when creating an artifact 18 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5647): [commit](https://codeberg.org/forgejo/forgejo/commit/4fe311e7c0292e3ac79f8bc063f1bcacef4494f0) Update scheduled tasks even if changes are pushed by "ActionsUser" 19 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5715): [commit](https://codeberg.org/forgejo/forgejo/commit/768402c8841db5e8acc97919149ba329d5124e17) Fix disable 2fa bug 20 + - Localization 21 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5583) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5680)): i18n: update of translations from Codeberg Translate 22 + - Included for completeness but not worth a release note 23 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5702) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5710)): fix: use buffered iterate for debian searchpackages 24 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5688) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5691)): fix: make branch protection work for new branches 25 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5651) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5656)): link to security policy in security.txt 26 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5653) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5655)): fix: don't show truncated comments in RSS/Atom feeds 27 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5652) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5654)): fix: typo on releases for source code downloads 28 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5640) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5645)): Revert "add gap between branch dropdown and PR button" 29 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5615) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5618)): fix: Don't double escape delete branch text 30 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5595) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5596)): fix: Add server logging for OAuth server errors 31 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5592) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5594)): forgejo-cli is now a symlink and cannot be used for sanity checks 32 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5491) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5575)): fix: correct documentation for non 200 responses in swagger 33 +

+26

release-notes-published/9.0.2.md

··· 1 +  2 + 3 + ## Release notes 4 +  5 + - Security bug fixes 6 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5975)): [commit](https://codeberg.org/forgejo/forgejo/commit/1ce33aa38d1d258d14523ff2c7c2dbf339f22b74) it was possible to use a token sent via email for secondary email validation to reset the password instead. In other words, a token sent for a given action (registration, password reset or secondary email validation) could be used to perform a different action. It is no longer possible to use a token for an action that is different from its original purpose. 7 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5975)): [commit](https://codeberg.org/forgejo/forgejo/commit/061abe60045212acf8c3f5c49b5cc758b4cbcde9) a fork of a public repository would show in the list of forks, even if its owner was not a public user or organization. Such a fork is now hidden from the list of forks of the public repository. 8 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5975)): [commit](https://codeberg.org/forgejo/forgejo/commit/3e3ef76808100cb1c853378733d0f6a910324ac6) the members of an organization team with read access to a repository (e.g. to read issues) but no read access to the code could read the RSS or atom feeds which include the commit activity. Reading the RSS or atom feeds is now denied unless the team has read permissions on the code. 9 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5975)): [commit](https://codeberg.org/forgejo/forgejo/commit/9508aa7713632ed40124a933d91d5766cf2369c2) the tokens used when [replying by email to issues or pull requests](https://forgejo.org/docs/v9.0/user/incoming/) were weaker than the [rfc2104 recommendations](https://datatracker.ietf.org/doc/html/rfc2104#section-5). The tokens are now truncated to 128 bits instead of 80 bits. It is no longer possible to reply to emails sent before the upgrade because the weaker tokens are invalid. 10 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5975)): [commit](https://codeberg.org/forgejo/forgejo/commit/786dfc7fb81ee76d4292ca5fcb33e6ea7bdccc29) a registered user could modify the update frequency of any push mirror (e.g. every 4h instead of every 8h). They are now only able to do that if they have administrative permissions on the repository. 11 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5975)): [commit](https://codeberg.org/forgejo/forgejo/commit/e6bbecb02d47730d3cc630d419fe27ef2fb5cb39) it was possible to use basic authorization (i.e. user:password) for requests to the API even when security keys were enrolled for a user. It is no longer possible, an application token must be used instead. 12 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5975)): [commit](https://codeberg.org/forgejo/forgejo/commit/7067cc7da4f144cc8a2fd2ae6e5307e0465ace7f) some markup sanitation rules were not as strong as they could be (e.g. allowing `emoji somethingelse` as well as `emoji`). The rules are now stricter and do not allow for such cases. 13 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5974) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5975)): [commit](https://codeberg.org/forgejo/forgejo/commit/b70196653f9d7d3b9d4e72d114e5cc6f472988c4) when Forgejo is configured to enable instance wide search (e.g. with [bleve](https://blevesearch.com/)), results found in the repositories of private or limited users were displayed to anonymous visitors. The results found in private or limited organizations were not displayed. The search results found in the repositories of private or limited user are no longer displayed to anonymous visitors. 14 + - Bug fixes 15 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5941) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5945)): fix: handle renamed dependency for cargo registry. 16 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5795) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5800)): support `www.github.com` for migrations. 17 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5887): move forgot_password-link to fix login tab order. 18 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5850) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5879)): code owners will not be mentioned when a pull request comes from a forked repository. 19 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5831) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5834)): labels are missing in the pull request payload removing a label. 20 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5778) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5810)): in a Forgejo Actions workflow, the `unlabeled` event type for pull requests was incorrectly mapped to the labeled event type. 21 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5778) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5810)): when a Forgejo Actions issue or pull request workflow is triggered by an `labeled` or `unlabeled` event type, it misses information about the label added or removed. It is now available in the `label` data member of the event payload. 22 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5778) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5810)): the pull request workflow must always update the head SHA commit status. Not just when the PR is synchronized, opened or closed. Otherwise, a job that is run more often than on commits (e.g. checking for specific labels or approvals) cannot be defined as a required check. 23 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5746) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5759)): fix git-grep for code search when git version is below 2.38. 24 + - Localization 25 + - [PR](https://codeberg.org/forgejo/forgejo/pulls/5681) ([backported](https://codeberg.org/forgejo/forgejo/pulls/5748)): i18n: update of translations from Codeberg Translate. 26 +

+1

release-notes-published/up-to-and-including-8.0.0.md

··· 1 + ../RELEASE-NOTES.md

Configure Feed

Configure Feed