Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package forgejo-longterm for openSUSE:Factory checked in at 2026-10-07 19:32:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/forgejo-longterm (Old) and /work/SRC/openSUSE:Factory/.forgejo-longterm.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "forgejo-longterm" Wed Oct 7 19:32:13 2026 rev:14 rq:1382852 version:15.0.9 Changes: -------- --- /work/SRC/openSUSE:Factory/forgejo-longterm/forgejo-longterm.changes 2026-09-22 15:53:37.908260280 +0200 +++ /work/SRC/openSUSE:Factory/.forgejo-longterm.new.3698736/forgejo-longterm.changes 2026-10-07 19:32:50.052214284 +0200 @@ -1,0 +2,30 @@ +Thu Oct 1 16:56:55 UTC 2026 - [email protected] + +- Update to 15.0.9 + https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.9.md + * Security bug fixes + + Critical: prevent ApplyDiffPatch from mutating bare repo config. When a patch is applied + to a Forgejo repo through Forgejo's Web UI, Web cherry-pick, or /diffpatch API, + a git apply --index command-line is executed to apply the patch to a temporary bare + git repository. An unusual behaviour of git apply can cause arbitrary files the + working direction to be changed, which is within the bare repository, and that + behaviour can be abused by a malicious user to perform unexpected operations on the + Forgejo host. This vulnerability allows execution of arbitrary processes on the + Forgejo host as a remote code execution attack. The issue has been addressed by + ensuring that the working directory is an unrelated temporary directory. This + vulnerability is a variation on PR 13705, a vulnerability that was fixed in Forgejo + v15.0.6. This variation was not detected at that time. + + prevent CSRF attacks on OpenID identity associations. When OpenID sign-in is enabled + on a Forgejo host, a logged-in user can add an additional OpenID address to their user + account in the /user/settings/security page. The HTTP endpoint responsible for + registering an OpenID address is an HTTP GET request, as required by the OpenID + specification. The endpoint was vulnerable to a CSRF attack where an unexpected GET + request generated by a user's browser can register an unexpected OpenID identity on + their currently logged-in Forgejo account. The vulnerability has been remediated by + validating that a request to add an OpenID identity is initiated by the currently + logged-in user. + * Included for completeness but not user-facing (chores, etc.) + + feat: add support in Forgejo's update checker for LTS and multiple releases + + fix: prevent rollback of git commits during push mirror operations + +------------------------------------------------------------------- Old: ---- forgejo-src-15.0.8.tar.gz forgejo-src-15.0.8.tar.gz.asc New: ---- forgejo-src-15.0.9.tar.gz forgejo-src-15.0.9.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ forgejo-longterm.spec ++++++ --- /var/tmp/diff_new_pack.KhT5gV/_old 2026-10-07 19:32:53.724367642 +0200 +++ /var/tmp/diff_new_pack.KhT5gV/_new 2026-10-07 19:32:53.729367851 +0200 @@ -25,7 +25,7 @@ %bcond_without apparmor %endif Name: forgejo-longterm -Version: 15.0.8 +Version: 15.0.9 Release: 0 Summary: Self-hostable forge License: GPL-3.0-or-later ++++++ forgejo-src-15.0.8.tar.gz -> forgejo-src-15.0.9.tar.gz ++++++ /work/SRC/openSUSE:Factory/forgejo-longterm/forgejo-src-15.0.8.tar.gz /work/SRC/openSUSE:Factory/.forgejo-longterm.new.3698736/forgejo-src-15.0.9.tar.gz differ: char 13, line 1
