Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package forgejo-longterm for
openSUSE:Factory checked in at 2026-09-22 15:52:48
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/forgejo-longterm (Old)
and /work/SRC/openSUSE:Factory/.forgejo-longterm.new.383539 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "forgejo-longterm"
Tue Sep 22 15:52:48 2026 rev:13 rq:1379590 version:15.0.8
Changes:
--------
--- /work/SRC/openSUSE:Factory/forgejo-longterm/forgejo-longterm.changes
2026-08-01 18:33:57.497389233 +0200
+++
/work/SRC/openSUSE:Factory/.forgejo-longterm.new.383539/forgejo-longterm.changes
2026-09-22 15:53:37.908260280 +0200
@@ -1,0 +2,84 @@
+Sun Sep 13 15:34:18 UTC 2026 - [email protected]
+
+- Update to 15.0.8
+
https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.8.md
+ * Security bug fixes
+ + fix: prevent template expansion from interfering with git repo
initialization.
+ When generating a new repository from a template repository, Forgejo
clones the
+ template repository, removes the .git folder, performs variable
template expansion
+ on files listed in .forgejo/template, and initializes a new git
repository. During
+ this process, variable template expansion could be misused in order to
create a new
+ .git folder, which git would adopt and incorporate during its
initialization of a
+ new git repository. A malicious template repository could be used to
read arbitrary
+ data from the Forgejo host, and to execute arbitrary processes on the
Forgejo host,
+ as a remote code execution attack. To address this issue, after
variable expansion
+ is completed, any existing .git folder is removed from the directory
before the git
+ repository is initialized.
+ + ensure authorization reducer is accessed when checking editable PRs in
APIs. When
+ editing a git repo contents through Forgejo's API, a specialized
security control
+ is used to permit repository maintainers to edit branches that they do
not own when
+ an open pull request with the "allow maintainer edit" option is
present. This
+ specialized security control did not take into account API-specific
security
+ restrictions, such as repo-specific access tokens. As a result, it was
possible for
+ an API access token with restricted permission to make modifications
outside of that
+ restricted permission. The specialized security control has been
updated to take
+ into account API authentication security restrictions.
+ * Bug fixes
+ + fix: centralize recalculation of 'access' table, fix restricted user
inconsistencies
+ + fix(quota): avoid double-counting package blobs
+ + fix: show job logs if there are any
+ + fix: codepaths where git repos are not closed correctly, may relate to
leaking git
+ cat-file --batch[-check] commands
+ + fix: organization team set as 'admin' is granted 'owner' permission over
related repositories
+ * Security changes without a feature or bug label
+ + Users with only read permission on a repository (including
unauthenticated callers
+ on public repositories) could retrieve the metadata and the full
contents of
+ attachments belonging to draft releases, even though draft releases are
hidden from
+ them. The GetReleaseAttachment API endpoint and the web attachment
download route
+ (ServeAttachment) did not check whether the release is a draft, while
GetRelease and
+ ListReleaseAttachments already do. This is the same class of issue
fixed upstream by
+ Gitea in CVE-2026-27660 and GHSA-q9pg-jj6x-j9p6.
+ * Included for completeness but not user-facing (chores, etc.)
+ + Update dependency svgo to v4.1.0 [SECURITY] (v15.0/forgejo)
+ + fix(dev): update gitignore e2e for new branding
+ + chore: remove legacy generateRepoCommit
+ + fix: simplify concurrency in GetContributorStats
+ + Update module golang.org/x/crypto to v0.56.0 [SECURITY] (v15.0/forgejo)
+ + chore(tests): /user/events notifications shows in the UI
+ + chore: upgrade go language directive to go1.26
+ + Update forgejo go-chi packages (v15.0/forgejo)
+ + chore(tests): increase doRepoWikiGitOperationInner from 2 to 60 seconds
+ + fix(ci): semgrep duplicate id
+ + Update module xorm.io/xorm to v1.4.1 (v15.0/forgejo)
+ + chore(ci): use oci/ci:3 instead of oci/playwright:latest for e2e
+ * Update node modules
+
+-------------------------------------------------------------------
+Sat Aug 22 18:51:30 UTC 2026 - [email protected]
+
+- Update to 15.0.7
+
https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.7.md
+ * Security bug fixes
+ + fix: public-only and repo-specific access to
/repos/{owner}/{repo}/pulls/{index}/update
+ + fix: expand local reusable workflows from base branch w/
pull_request_target
+ + fix: disallow owner as collaboration access mode
+ * Bug fixes
+ + fix(api): unblock fall-through to urlencoded names in wiki
+ + fix: error when replying to comments on removed lines-of-code in review
+ + fix: expire task logs even if there is no log file
+ + fix: prevent Actions trigger pull_request from drifting
+ + fix: exclude deleted artifacts when calculating storage consumption
+ + fix: comment placement in pull request reviews
+ + fix: trigger Actions for original commits (#13706)
+ + fix: prevent panic by returning error if dbfs file does not exist
+ * Included for completeness but not user-facing (chores, etc.)
+ + Update go toolchain directive to v1.26.7 (v15.0/forgejo)
+ + Update module golang.org/x/image to v0.45.0 [SECURITY] (v15.0/forgejo)
+ + Update golang.org/x/mod (indirect) to v0.40.0 [SECURITY] (v15.0/forgejo)
- autoclosed
+ + Update go toolchain directive to v1.26.6 [SECURITY] (v15.0/forgejo)
+ + Fix TestCannotCreatePrivateKey in Guix container.
+ + retry diff page load on TestPullRequestCommentPlacement when expected
commit isn't matched
+ + Update dependency mermaid to v11.16.1 [SECURITY] (v15.0/forgejo)
+ + Update dependency postcss to v8.5.23 [SECURITY] (v15.0/forgejo)
+
+-------------------------------------------------------------------
Old:
----
forgejo-src-15.0.6.tar.gz
forgejo-src-15.0.6.tar.gz.asc
New:
----
forgejo-src-15.0.8.tar.gz
forgejo-src-15.0.8.tar.gz.asc
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ forgejo-longterm.spec ++++++
--- /var/tmp/diff_new_pack.Wi3rvV/_old 2026-09-22 15:54:09.526568613 +0200
+++ /var/tmp/diff_new_pack.Wi3rvV/_new 2026-09-22 15:54:09.529568737 +0200
@@ -25,7 +25,7 @@
%bcond_without apparmor
%endif
Name: forgejo-longterm
-Version: 15.0.6
+Version: 15.0.8
Release: 0
Summary: Self-hostable forge
License: GPL-3.0-or-later
++++++ forgejo-src-15.0.6.tar.gz -> forgejo-src-15.0.8.tar.gz ++++++
/work/SRC/openSUSE:Factory/forgejo-longterm/forgejo-src-15.0.6.tar.gz
/work/SRC/openSUSE:Factory/.forgejo-longterm.new.383539/forgejo-src-15.0.8.tar.gz
differ: char 13, line 1
++++++ node_modules.obscpio ++++++
/work/SRC/openSUSE:Factory/forgejo-longterm/node_modules.obscpio
/work/SRC/openSUSE:Factory/.forgejo-longterm.new.383539/node_modules.obscpio
differ: char 1131835, line 4147
++++++ node_modules.spec.inc ++++++
++++ 1325 lines (skipped)
++++ between /work/SRC/openSUSE:Factory/forgejo-longterm/node_modules.spec.inc
++++ and
/work/SRC/openSUSE:Factory/.forgejo-longterm.new.383539/node_modules.spec.inc
++++++ package-lock.json ++++++
--- /var/tmp/diff_new_pack.Wi3rvV/_old 2026-09-22 15:54:10.192596051 +0200
+++ /var/tmp/diff_new_pack.Wi3rvV/_new 2026-09-22 15:54:10.209596752 +0200
@@ -55,11 +55,11 @@
"idiomorph": "0.3.0",
"jquery": "3.7.1",
"katex": "0.16.38",
- "mermaid": "11.15.0",
+ "mermaid": "11.16.1",
"mini-css-extract-plugin": "2.10.0",
"minimatch": "10.2.4",
"pdfobject": "2.3.0",
- "postcss": "8.5.18",
+ "postcss": "8.5.23",
"postcss-loader": "8.2.1",
"postcss-nesting": "14.0.0",
"pretty-ms": "9.0.0",
@@ -117,7 +117,7 @@
"stylelint-declaration-block-no-ignored-properties": "2.8.0",
"stylelint-declaration-strict-value": "1.11.1",
"stylelint-value-no-unknown-custom-properties": "6.1.1",
- "svgo": "4.0.2",
+ "svgo": "4.1.0",
"typescript": "5.9.3",
"typescript-eslint": "8.56.1",
"vite-string-plugin": "2.0.0",
@@ -261,9 +261,9 @@
}
},
"node_modules/@braintree/sanitize-url": {
- "version": "7.1.1",
- "resolved":
"https://registry.npmjs.org/@braintree/sanitize-url/-/sanitize-url-7.1.1.tgz";,
- "integrity":
"sha512-i1L7noDNxtFyL5DmZafWy1wRVhGehQmzZaz1HiN5e7iylJMSZR7ekOV7NsIqa5qBldlLrsKv4HbgFUVlQrz8Mw==",
+ "version": "7.1.2",
+ "resolved":
"https://registry.npmjs.org/@braintree/sanitize-url/-/sanitize-url-7.1.2.tgz";,
+ "integrity":
"sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA==",
"license": "MIT"
},
"node_modules/@cacheable/memory": {
@@ -2751,12 +2751,12 @@
}
},
"node_modules/@mermaid-js/parser": {
- "version": "1.1.1",
- "resolved":
"https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.1.1.tgz";,
- "integrity":
"sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw==",
+ "version": "1.2.0",
+ "resolved":
"https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.0.tgz";,
+ "integrity":
"sha512-oYPyv8A4As1yH5Bx+04iQEQxXuIQDe0GKCNSRgao6z8AM9jixXIfP0vsppRLvGf+nKIOb9/LdpWA4YuJiVvESA==",
"license": "MIT",
"dependencies": {
- "@chevrotain/types": "~11.1.1"
+ "@chevrotain/types": "~11.1.2"
}
},
"node_modules/@monogrid/gainmap-js": {
@@ -6591,17 +6591,17 @@
}
},
"node_modules/css-select": {
- "version": "5.2.2",
- "resolved":
"https://registry.npmjs.org/css-select/-/css-select-5.2.2.tgz";,
- "integrity":
"sha512-TizTzUddG/xYLA3NXodFM0fSbNizXjOKhqiQQwvhlspadZokn1KDy0NZFS0wuEubIYAV5/c1/lAr0TaaFXEXzw==",
+ "version": "6.0.0",
+ "resolved":
"https://registry.npmjs.org/css-select/-/css-select-6.0.0.tgz";,
+ "integrity":
"sha512-rZZVSLle8v0+EY8QAkDWrKhpgt6SA5OtHsgBnsj6ZaLb5dmDVOWUDtQitd9ydxxvEjhewNudS6eTVU7uOyzvXw==",
"dev": true,
"license": "BSD-2-Clause",
"dependencies": {
"boolbase": "^1.0.0",
- "css-what": "^6.1.0",
- "domhandler": "^5.0.2",
- "domutils": "^3.0.1",
- "nth-check": "^2.0.1"
+ "css-what": "^7.0.0",
+ "domhandler": "^5.0.3",
+ "domutils": "^3.2.2",
+ "nth-check": "^2.1.1"
},
"funding": {
"url": "https://github.com/sponsors/fb55";
@@ -6622,9 +6622,9 @@
}
},
"node_modules/css-what": {
- "version": "6.2.2",
- "resolved": "https://registry.npmjs.org/css-what/-/css-what-6.2.2.tgz";,
- "integrity":
"sha512-u/O3vwbptzhMs3L1fQE82ZSLHQQfto5gyZzwteVIEyeaY5Fc7R4dapF/BvRoSYFeqfBk4m0V1Vafq5Pjv25wvA==",
+ "version": "7.0.0",
+ "resolved": "https://registry.npmjs.org/css-what/-/css-what-7.0.0.tgz";,
+ "integrity":
"sha512-wD5oz5xibMOPHzy13CyGmogB3phdvcDaB5t0W/Nr5Z2O/agcB8YwOz6e2Lsp10pNDzBoDO9nVa3RGs/2BttpHQ==",
"dev": true,
"license": "BSD-2-Clause",
"engines": {
@@ -6689,9 +6689,9 @@
"license": "MIT"
},
"node_modules/cytoscape": {
- "version": "3.33.1",
- "resolved":
"https://registry.npmjs.org/cytoscape/-/cytoscape-3.33.1.tgz";,
- "integrity":
"sha512-iJc4TwyANnOGR1OmWhsS9ayRS3s+XQ185FmuHObThD+5AeJCakAAbWv8KimMTt08xCCLNgneQwFp+JRJOr9qGQ==",
+ "version": "3.34.0",
+ "resolved":
"https://registry.npmjs.org/cytoscape/-/cytoscape-3.34.0.tgz";,
+ "integrity":
"sha512-62rNSrioXw93uliKFBwjukeQyeWwH2PqDrTac31r2P6464u3AUvTk0xS4LVvT251g7IgkFunrI48ZEZGjywSOg==",
"license": "MIT",
"engines": {
"node": ">=0.10"
@@ -7484,9 +7484,9 @@
}
},
"node_modules/dompurify": {
- "version": "3.3.1",
- "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz";,
- "integrity":
"sha512-qkdCKzLNtrgPFP1Vo+98FRzJnBRGe4ffyCea9IwHB1fyxPOeNTHpLKYGd4Uk9xvNoH0ZoOjwZxNptyMwqrId1Q==",
+ "version": "3.4.13",
+ "resolved":
"https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz";,
+ "integrity":
"sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==",
"license": "(MPL-2.0 OR Apache-2.0)",
"optionalDependencies": {
"@types/trusted-types": "^2.0.7"
@@ -11184,26 +11184,26 @@
}
},
"node_modules/mermaid": {
- "version": "11.15.0",
- "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.15.0.tgz";,
- "integrity":
"sha512-pTMbcf3rWdtLiYGpmoTjHEpeY8seiy6sR+9nD7LOs8KfUbHE4lOUAprTRqRAcWSQ6MQpdX+YEsxShtGsINtPtw==",
+ "version": "11.16.1",
+ "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.16.1.tgz";,
+ "integrity":
"sha512-TQsq6u22fAn3rek5VOubrhKPo1g5hwC3FXUN9hiyupTckcYiGuuKGkNQrKYwGJkXUxZdojwRG46gsSCFZMDp4g==",
"license": "MIT",
"dependencies": {
- "@braintree/sanitize-url": "^7.1.1",
+ "@braintree/sanitize-url": "^7.1.2",
"@iconify/utils": "^3.0.2",
- "@mermaid-js/parser": "^1.1.1",
+ "@mermaid-js/parser": "^1.2.0",
"@types/d3": "^7.4.3",
"@upsetjs/venn.js": "^2.0.0",
- "cytoscape": "^3.33.1",
+ "cytoscape": "^3.33.3",
"cytoscape-cose-bilkent": "^4.1.0",
"cytoscape-fcose": "^2.2.0",
"d3": "^7.9.0",
"d3-sankey": "^0.12.3",
"dagre-d3-es": "7.0.14",
- "dayjs": "^1.11.19",
- "dompurify": "^3.3.1",
+ "dayjs": "^1.11.20",
+ "dompurify": "^3.3.3",
"es-toolkit": "^1.45.1",
- "katex": "^0.16.25",
+ "katex": "^0.16.45",
"khroma": "^2.1.0",
"marked": "^16.3.0",
"roughjs": "^4.6.6",
@@ -11212,6 +11212,37 @@
"uuid": "^11.1.0 || ^12 || ^13 || ^14.0.0"
}
},
+ "node_modules/mermaid/node_modules/commander": {
+ "version": "8.3.0",
+ "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz";,
+ "integrity":
"sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
+ "license": "MIT",
+ "engines": {
+ "node": ">= 12"
+ }
+ },
+ "node_modules/mermaid/node_modules/dayjs": {
+ "version": "1.11.21",
+ "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.21.tgz";,
+ "integrity":
"sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==",
+ "license": "MIT"
+ },
+ "node_modules/mermaid/node_modules/katex": {
+ "version": "0.16.47",
+ "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz";,
+ "integrity":
"sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==",
+ "funding": [
+ "https://opencollective.com/katex";,
+ "https://github.com/sponsors/katex";
+ ],
+ "license": "MIT",
+ "dependencies": {
+ "commander": "^8.3.0"
+ },
+ "bin": {
+ "katex": "cli.js"
+ }
+ },
"node_modules/mermaid/node_modules/marked": {
"version": "16.4.2",
"resolved": "https://registry.npmjs.org/marked/-/marked-16.4.2.tgz";,
@@ -12611,9 +12642,9 @@
}
},
"node_modules/postcss": {
- "version": "8.5.18",
- "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.18.tgz";,
- "integrity":
"sha512-xdB1oSLHbz1vRWgCDalrCqEFTWzFlhqFC5tIHLMOSUIjhm3XXQ1qrFy8S/ESr1JYRRXqM3c1QFiMZUJdUTqyMQ==",
+ "version": "8.5.23",
+ "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz";,
+ "integrity":
"sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
"funding": [
{
"type": "opencollective",
@@ -12630,7 +12661,7 @@
],
"license": "MIT",
"dependencies": {
- "nanoid": "^3.3.12",
+ "nanoid": "^3.3.16",
"picocolors": "^1.1.1",
"source-map-js": "^1.2.1"
},
@@ -14628,19 +14659,19 @@
"dev": true
},
"node_modules/svgo": {
- "version": "4.0.2",
- "resolved": "https://registry.npmjs.org/svgo/-/svgo-4.0.2.tgz";,
- "integrity":
"sha512-ekx94z1rRc5LDi6oSUaeRnYhd0UOJxdtQCL2rF8xpWxD3TPAsISWOrxezqGovqS38GRZOdpDfvQe3ts6F7nsng==",
+ "version": "4.1.0",
+ "resolved": "https://registry.npmjs.org/svgo/-/svgo-4.1.0.tgz";,
+ "integrity":
"sha512-bkxnTg1kSU0guhIBmibA6UUhrQmPVA1XsQLN+ylCd+UWzbnLkySOcXpyk1mrl05f+pcaCx2eHb+sp6BgMZWX+Q==",
"dev": true,
"license": "MIT",
"dependencies": {
"commander": "^11.1.0",
- "css-select": "^5.1.0",
+ "css-select": "^6.0.0",
"css-tree": "^3.0.1",
- "css-what": "^6.1.0",
+ "css-what": "^7.0.0",
"csso": "^5.0.5",
"picocolors": "^1.1.1",
- "sax": "^1.5.0"
+ "sax": "1.6.1"
},
"bin": {
"svgo": "bin/svgo.js"
@@ -14664,9 +14695,9 @@
}
},
"node_modules/svgo/node_modules/sax": {
- "version": "1.6.0",
- "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.0.tgz";,
- "integrity":
"sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA==",
+ "version": "1.6.1",
+ "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.1.tgz";,
+ "integrity":
"sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==",
"dev": true,
"license": "BlueOak-1.0.0",
"engines": {
