mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-09 17:37:20 -06:00
3699309edde9bbe5a96b73937989e407ff951374
518 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
William Desportes
|
87a703819b |
fix(queue): bump levelqueue to v0.5.0 and remove workarounds (#40219)
levelqueue v0.5.1 fixes this upstream (https://gitea.com/lunny/levelqueue/pulls/8), so this now only bumps the dependency. A push wrote "high" before the payload, so an interrupted push left an id counted with no key. `LPop` then returned `ErrNotFound` without advancing "low" and the wrapper retried forever: nothing popped, no worker started, later items unreachable. All were only fixable by clearing the queue, losing the backlog: - https://github.com/go-gitea/gitea/issues/32006 — mail, 0 workers - https://github.com/go-gitea/gitea/issues/28919 — mirror, "already in queue" - https://github.com/go-gitea/gitea/issues/33862 — archives hanging - https://github.com/go-gitea/gitea/issues/33882 — self-healing request v0.5.1 writes counter and payload in one batch, moves the counters past missing keys, and repairs leftover unique-queue set entries, so affected instances recover on their next pop. No test: the behaviour lives in the dependency, which covers it in its own `recover_test.go`. --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
||
|
silverwind
|
87ebf3b1ba |
feat(auth)!: remove support for obsolete OpenID 2.0 draft (#40231)
Remove OpenID 2.0 authentication. The spec is an obsolete draft, major providers dropped it years ago, and the code keeps needing security fixes like https://github.com/go-gitea/gitea/pull/39642. OpenID Connect and OAuth2 are unaffected. Docs: https://gitea.com/gitea/docs/pulls/633. - The `[openid]` settings, OpenID sign-in, sign-up and account association are gone - A migration drops the `user_open_id` table with all user OpenID URIs - Accounts registered via OpenID have a random password and regain access via password reset Fixes: https://github.com/go-gitea/gitea/issues/1310 Fixes: https://github.com/go-gitea/gitea/issues/3521 |
||
|
Giteabot
|
917badaae6 |
fix(deps): update module github.com/andybalholm/brotli to v1.2.7 [security] (#40246)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/andybalholm/brotli](https://redirect.github.com/andybalholm/brotli) | `v1.2.1` → `v1.2.7` |  |  | --- ### Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli BIT-brotli-2026-111497 / BIT-dotnet-2026-111497 / BIT-dotnet-sdk-2026-111497 / BIT-node-2026-111497 / BIT-node-min-2026-111497 / BIT-powershell-2026-111497 / [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497) / [GHSA-9v8h-qqgm-4m35](https://redirect.github.com/advisories/GHSA-9v8h-qqgm-4m35) / [GHSA-c9gr-gmg4-2vqv](https://redirect.github.com/advisories/GHSA-c9gr-gmg4-2vqv) / [GO-2026-6888](https://pkg.go.dev/vuln/GO-2026-6888) / PYSEC-2026-4322 / PYSEC-2026-4323 <details> <summary>More information</summary> #### Details In github.com/andybalholm/brotli before v1.2.7, the decompressor allocates memory for Huffman tables and block-type trees on every meta-block header without bounding the cumulative allocations relative to the input size. A small crafted brotli stream containing many empty meta-blocks with new Huffman trees can trigger hundreds of megabytes of allocations per kilobyte of input, leading to denial of service. #### Severity Unknown #### References - [https://github.com/andybalholm/brotli/security/advisories/GHSA-c9gr-gmg4-2vqv](https://redirect.github.com/andybalholm/brotli/security/advisories/GHSA-c9gr-gmg4-2vqv) - [ |
||
|
silverwind
|
e87ac3a0f4 |
chore(deps): update go.yaml.in/yaml/v4 to v4.0.0 (#40222)
Update go-yaml from the rc.6 pseudo-version to the stable v4.0.0 release, and actionslib to v1.5.2, which does the same in https://gitea.com/gitea/actionslib/pulls/32. The bump also brings in actionslib v1.5.1. v4 double-quotes the `on` key like yaml.v3 did, so one jobparser fixture changes. Runner counterpart: https://gitea.com/gitea/runner/pulls/1381. Fixes: https://github.com/go-gitea/gitea/issues/40145 |
||
|
silverwind
|
5c723ee0fd |
refactor(markdown): remove goldmark-highlighting (#39751)
Render fenced code blocks with Gitea's own code block renderer instead of `goldmark-highlighting`, using the managed lexer lookup from `modules/highlight`. Indented and fenced blocks now share one rendering path. Rendered output is unchanged. The trailing newline is stripped on copy in the frontend since https://github.com/go-gitea/gitea/pull/39755. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Giteabot
|
12b20c7c99 |
chore(deps): update dependencies (#40168)
> [!NOTE]
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) | Type |
Update | Pending |
|---|---|---|---|---|---|---|
| [@primer/octicons](https://primer.style/octicons)
([source](https://redirect.github.com/primer/octicons)) | [`19.41.0` →
`19.42.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.41.0/19.42.0)
|
|
| dependencies | minor | |
|
[@typescript-eslint/parser](https://typescript-eslint.io/packages/parser)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser))
| [`8.72.0` →
`8.72.1`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.72.0/8.72.1)
|
|
| devDependencies | patch | |
| @​vitest/eslint-plugin | [`1.6.27` →
`1.6.28`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.27/1.6.28)
|
|
| devDependencies | patch | |
| [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) |
`v10.3.0` → `v10.3.2` |
|
| action | patch | `v10.3.3` |
| [chart.js](https://www.chartjs.org)
([source](https://redirect.github.com/chartjs/Chart.js)) | [`4.5.1` →
`4.6.1`](https://renovatebot.com/diffs/npm/chart.js/4.5.1/4.6.1) |
|
| dependencies | minor | |
| [cli/cli](https://redirect.github.com/cli/cli) | `2.103.2` → `2.103.3`
|
|
| | patch | |
|
[connectrpc.com/connect/v2](https://redirect.github.com/connectrpc/connect-go)
| `v2.0.1` → `v2.0.2` |
|
| require | patch | |
|
[crowdin/github-action](https://redirect.github.com/crowdin/github-action)
| `v3.4.0` → `v3.5.0` |
|
| action | minor | |
| [djlint](https://redirect.github.com/djlint/djLint) | `==1.46.6` →
`==1.47.1` |
|
| dependency-groups | minor | `1.49.2` (+4) |
| [docker/login-action](https://redirect.github.com/docker/login-action)
| `v4.6.0` → `v4.7.0` |
|
| action | minor | |
| [elasticsearch](https://hub.docker.com/_/elasticsearch)
([source](https://redirect.github.com/elastic/dockerfiles)) | `3f4d63c`
→ `ef5cafd` | | | service | digest | |
|
[eslint-plugin-unicorn](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn)
| [`78.0.0` →
`79.0.0`](https://renovatebot.com/diffs/npm/eslint-plugin-unicorn/78.0.0/79.0.0)
|
|
| devDependencies | major | |
| [eslint-plugin-vue](https://eslint.vuejs.org)
([source](https://redirect.github.com/vuejs/eslint-plugin-vue)) |
[`10.11.1` →
`10.12.0`](https://renovatebot.com/diffs/npm/eslint-plugin-vue/10.11.1/10.12.0)
|
|
| devDependencies | minor | |
|
[getmeili/meilisearch](https://redirect.github.com/meilisearch/meilisearch)
| `c94e58c` → `1f578fa` | | | service | digest | |
| [gitea.dev/sdk](https://gitea.com/gitea/go-sdk) | `v1.3.0` → `v1.5.0`
|
|
| require | minor | `v1.5.1` |
|
[github.com/buildkite/terminal-to-html/v3](https://redirect.github.com/buildkite/terminal-to-html)
| `v3.17.1` → `v3.17.3` |
|
| require | patch | |
|
[github.com/dlclark/regexp2/v2](https://redirect.github.com/dlclark/regexp2)
| `v2.9.1` → `v2.11.0` |
|
| require | minor | `v2.12.0` |
|
[github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi)
| `v0.151.0` → `v0.152.0` |
|
| require | minor | |
|
[github.com/go-co-op/gocron/v2](https://redirect.github.com/go-co-op/gocron)
| `v2.22.0` → `v2.23.0` |
|
| require | minor | |
|
[github.com/go-redsync/redsync/v4](https://redirect.github.com/go-redsync/redsync)
| `v4.18.0` → `v4.18.1` |
|
| require | patch | |
| [github.com/google/pprof](https://redirect.github.com/google/pprof) |
`1facf8f` → `dbd0ed3` |
|
| require | digest | |
|
[gitlab.com/gitlab-org/api/client-go/v3](https://gitlab.com/gitlab-org/api/client-go)
| `v3.29.0` → `v3.39.1` |
|
| require | minor | `v3.40.2` (+3) |
| [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) |
`v1.84.0` → `v1.85.0` |
|
| require | minor | |
| [katex](https://katex.org)
([source](https://redirect.github.com/KaTeX/KaTeX)) | [`0.19.0` →
`0.19.1`](https://renovatebot.com/diffs/npm/katex/0.19.0/0.19.1) |
|
| dependencies | patch | |
|
[markdownlint-cli](https://redirect.github.com/igorshubovych/markdownlint-cli)
| [`0.49.1` →
`0.50.0`](https://renovatebot.com/diffs/npm/markdownlint-cli/0.49.1/0.50.0)
|
|
| devDependencies | minor | |
|
[material-icon-theme](https://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/main/README.md)
([source](https://redirect.github.com/material-extensions/vscode-material-icon-theme))
| [`5.39.0` →
`5.40.0`](https://renovatebot.com/diffs/npm/material-icon-theme/5.39.0/5.40.0)
|
|
| devDependencies | minor | |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `v1.60.1` →
`v1.61.0` |
|
| require | minor | `v1.61.1` |
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`12.14.0` →
`12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |
|
| packageManager | minor | |
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`>= 12.14.0` → `>=
12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |
|
| engines | minor | |
| [postcss](https://postcss.org/)
([source](https://redirect.github.com/postcss/postcss)) | [`8.5.31` →
`8.5.32`](https://renovatebot.com/diffs/npm/postcss/8.5.31/8.5.32) |
|
| dependencies | patch | |
| [renovate](https://renovatebot.com)
([source](https://redirect.github.com/renovatebot/renovate)) |
[`44.172.2` →
`44.190.1`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.172.2&to=44.190.1)
|
|
| | minor | `44.200.0` (+21) |
|
[renovatebot/github-action](https://redirect.github.com/renovatebot/github-action)
| `v46.3.9` → `v46.3.10` |
|
| action | patch | `v46.3.12` (+1) |
|
[typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint))
| [`8.72.0` →
`8.72.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.72.0/8.72.1)
|
|
| devDependencies | patch | |
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`8.3.4` →
`8.3.5`](https://renovatebot.com/diffs/npm/vite/8.3.4/8.3.5) |
|
| dependencies | patch | |
---
### Release Notes
<details>
<summary>primer/octicons (@​primer/octicons)</summary>
###
[`v19.42.0`](https://redirect.github.com/primer/octicons/releases/tag/%40primer/octicons%4019.42.0)
[Compare
Source](https://redirect.github.com/primer/octicons/compare/@primer/octicons@19.41.0...@primer/octicons@19.42.0)
##### Minor Changes
- [#​1381](https://redirect.github.com/primer/octicons/pull/1381)
[`d25ce68df9d08abd65431a8a48b45446432f1b45`](
|
||
|
Giteabot
|
9cacca6f65 |
fix(deps): update module golang.org/x/net to v0.62.0 [security] (#40050)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.61.0` → `v0.62.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.61.0...refs/tags/v0.62.0) |  |  | --- ### Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net [CVE-2026-78661](https://nvd.nist.gov/vuln/detail/CVE-2026-78661) / [GO-2026-6860](https://pkg.go.dev/vuln/GO-2026-6860) <details> <summary>More information</summary> #### Details When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse. #### References - [https://go.dev/cl/849365](https://go.dev/cl/849365) - [https://go.dev/issue/82224](https://go.dev/issue/82224) - [https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs](https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6860) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net [CVE-2026-97045](https://nvd.nist.gov/vuln/detail/CVE-2026-97045) / [GO-2026-6866](https://pkg.go.dev/vuln/GO-2026-6866) <details> <summary>More information</summary> #### Details In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text. #### References - [https://go.dev/cl/855121](https://go.dev/cl/855121) - [https://go.dev/issue/82622](https://go.dev/issue/82622) - [https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs](https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6866) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> |
||
|
Giteabot
|
f0bb283a17 |
chore(deps): update dependencies (#40020)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
5e4ed4d508 |
fix: correctly parse and validate forwarded client IPs and remove unmaintained chi-middleware/proxy (#39190)
Replace the unmaintained `chi-middleware/proxy` with an in-tree handler that detects client IPs correctly behind common reverse proxies. 1. Handle repeated header lines and comma-separated proxy hops. 2. Accept and normalize IPs, including `ip:port`. 3. Keep the client port from the header value or `X-Real-Port` instead of logging port 0. 4. Prefer the last `X-Real-IP` line. 5. Keep the proxy's address when the selected value is invalid. 6. Read `Forwarded` only when `X-Forwarded-For` is absent. Docs PR: https://gitea.com/gitea/docs/pulls/560 Fixes: https://github.com/go-gitea/gitea/issues/35682 Fixes: https://github.com/go-gitea/gitea/issues/36814 Co-authored-by: bircni <bircni@icloud.com> |
||
|
Giteabot
|
7e164fe61a |
chore(deps): update dependencies, migrate to connectrpc.com/connect v2 (#39854)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
afishcalledwander
|
42b1f95261 |
fix: optimize packages upload memory (#39366)
Bound the memory used when parsing uploaded packages, so instances with low memory limits survive non-standard packages. 1. Metadata files are read through a size-limited reader, archives themselves stay unbounded so large payloads keep working 2. zstd decoding caps the window at 128 MiB, the zstd CLI default 3. RPM headers go through a first-party reader with rpmlib's size and array count limits that allocates only what the upload contains, until https://github.com/sassoftware/go-rpmutils/pull/44 is released. Signing still verifies the payload digest, and its signature header matches rpmsign's byte for byte 4. Swift and NuGet read the zip entry they size-checked, a duplicate name could stand in for it before 5. Terraform states check `LIMIT_SIZE_TERRAFORM_STATE` before parsing, NuGet symbol PDBs share a 256 MiB budget 6. Oversized container configs are rejected instead of stored without metadata, invalid Vagrant boxes answer 400 instead of 500 Signed-off-by: techknowlogick <git@tklk.dev> Co-authored-by: techknowlogick <git@tklk.dev> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: techknowlogick <techknowlogick@gitea.com> |
||
|
Lunny Xiao
|
c1ae4ec29e |
fix(actions): keep folded block scalars intact across serialization (#39787)
Folded (`>`) scalars in workflows gained blank lines and had spaces turned into newlines every time Gitea re-serialized a job. This bumps go-yaml to its main branch and drops our workarounds. The runner gets the same change in https://gitea.com/gitea/runner/pulls/1321. - go-yaml main fixes the accumulating blank lines (https://github.com/yaml/go-yaml/pull/366) and the block scalar indentation indicators (https://github.com/yaml/go-yaml/pull/414), so `BlockSafeString` and the folded scalar requoting go away - The job encoder no longer wraps lines, because go-yaml still wraps more-indented lines of folded scalars and turns a space into a newline - The fix applies to folded scalars anywhere in a workflow, including workflow-level `env` Fixes https://github.com/go-gitea/gitea/issues/39775 Co-authored-by: silverwind <me@silverwind.io> |
||
|
bircni
|
4b5f1f46de |
enhance(actions): show the steps the runner reports (#39720)
Gitea derives the steps of a job from the workflow file, so the `pre` and `post` steps of actions only show up inside "Set up job" and "Complete job". Fixes https://github.com/go-gitea/gitea/issues/24604. A runner can now report the steps it actually runs, and Gitea shows those instead. Runners that don't report them keep the current view, and older Gitea versions ignore them. Related: - Proto: https://gitea.com/gitea/actions-proto-def/pulls/19 - Runner: https://gitea.com/gitea/runner/pulls/1293 |
||
|
Giteabot
|
0eb0126fa2 | chore(deps): update dependencies (#39742) | ||
|
Giteabot
|
2f94380222 |
fix(deps): update module golang.org/x/net to v0.60.0 [security] (#39695)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.59.0` → `v0.60.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.59.0...refs/tags/v0.60.0) |  |  | --- ### HTTP/2 server memory exhaustion due to Trailer headers in net/http [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) / [GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603) <details> <summary>More information</summary> #### Details When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently. #### Severity Unknown #### References - [https://go.dev/cl/847185](https://go.dev/cl/847185) - [https://go.dev/cl/847314](https://go.dev/cl/847314) - [https://go.dev/issue/81857](https://go.dev/issue/81857) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6603) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### HTTP/2 transport accepts malformed framing-related headers in net/http [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) / [GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610) <details> <summary>More information</summary> #### Details Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling. #### Severity Unknown #### References - [https://go.dev/cl/835145](https://go.dev/cl/835145) - [https://go.dev/cl/836385](https://go.dev/cl/836385) - [https://go.dev/issue/81115](https://go.dev/issue/81115) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6610) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Excessive CPU consumption from repeated initial window changes in net/http [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) / [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611) <details> <summary>More information</summary> #### Details A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. #### Severity Unknown #### References - [https://go.dev/cl/847186](https://go.dev/cl/847186) - [https://go.dev/cl/847308](https://go.dev/cl/847308) - [https://go.dev/issue/81742](https://go.dev/issue/81742) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6611) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Double flow control refund on HTTP/2 server streams in net/http [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) / [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) <details> <summary>More information</summary> #### Details The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. #### Severity Unknown #### References - [https://go.dev/cl/847187](https://go.dev/cl/847187) - [https://go.dev/cl/847310](https://go.dev/cl/847310) - [https://go.dev/issue/81743](https://go.dev/issue/81743) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6612) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### HTTP/2 server crash due to HPACK encoder race in net/http [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) / [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617) <details> <summary>More information</summary> #### Details HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server. #### Severity Unknown #### References - [https://go.dev/cl/847188](https://go.dev/cl/847188) - [https://go.dev/cl/847313](https://go.dev/cl/847313) - [https://go.dev/issue/81867](https://go.dev/issue/81867) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6617) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjEuNCIsInVwZGF0ZWRJblZlciI6IjQ0LjEyMS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> |
||
|
silverwind
|
64f4b5856a |
enhance(actions): improve matrix job titles, bump actionslib (#39485)
Bump actionslib to v1.3.0 and format matrix job titles like GitHub.
- Matrix values are listed in declaration order, nested arrays and
objects are flattened, null and empty values are skipped
- Expression-evaluated names are trimmed and fall back to the job ID
when blank
- Matrix `include` and `exclude` match keys case-insensitively and
coerce numbers like GitHub
| Matrix | Before | After |
|---|---|---|
| `v: ["a,b"]` | `job (a,b)` | `job (a,b)` |
| `v: ["a, b"]` | `job (a, b)` | `job (a, b)` |
| `v: [[a, b]]` | `job ([a b])` | `job (a, b)` |
| `os: [x], arch: [y]` | `job (y, x)` | `job (x, y)` |
| `v: [{t: a, p: "b,c"}]` | `job (map[p:b,c t:a])` | `job (a, b,c)` |
| `v: [{t: a, p: [b, c]}]` | `job (map[p:[b c] t:a])` | `job (a, b, c)`
|
---------
Co-authored-by: Zettat123 <zettat123@gmail.com>
Co-authored-by: bircni <bircni@icloud.com>
|
||
|
Giteabot
|
27d876e311 |
chore(deps): update dependencies, add new lint rules, fix lint (#39601)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
ad38b60983 |
refactor!: remove go-git backend (#39487)
Removes the go-git backend so every build uses the git CLI backend. Its Windows performance advantage is gone, it lacks SHA-256 support, and it breaks repositories on Windows. The performance changes moved to https://github.com/go-gitea/gitea/pull/39526. Fixes https://github.com/go-gitea/gitea/issues/38359 Fixes https://github.com/go-gitea/gitea/issues/34694 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
cf89ecd887 |
refactor!: move go-chi/session into Gitea (#39504)
The `gitea.com/go-chi/session` package only exists for Gitea, so it
moves into `modules/session` to fix its bugs directly. Fixes the flake
in
https://github.com/go-gitea/gitea/actions/runs/36726154500/job/109923538400.
- Sessions are only written back when changed, so a read-only request
can't revert a concurrent change or restore a logged-out session, like
|
||
|
silverwind
|
bea6fcaa84 |
refactor: move go-chi/cache into Gitea (#39530)
The `gitea.com/go-chi/cache` package only exists for Gitea, so it moves into `modules/cache`. - `ITEM_TTL = -1` disables caching as documented - Sub-second TTLs round up instead of never expiring - The Redis adapter no longer grows a `MacaronCache` hash - Use two-queue cache for in-memory cache Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
873efed5a6 |
refactor: move go-chi/captcha into Gitea (#39529)
The `gitea.com/go-chi/captcha` package only exists for Gitea, so it moves into `modules/imagecaptcha`. - Reloading an expired challenge shows a new image instead of a broken one - Every answer is consumed on its first check - OpenID registration stops after a failed captcha --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
e6ffbea888 |
refactor: move go-chi/binding into Gitea (#39528)
The `gitea.com/go-chi/binding` package only exists for Gitea, so it moves into `modules/web/binding` to fix its bugs directly. Split out of https://github.com/go-gitea/gitea/pull/39504. - GET and HEAD always bind the query - JSON `null` slice elements and nested `TrimSpace` fields bind correctly - Integer fields reject out-of-range values instead of wrapping - An empty JSON body binds nothing and an unknown binding rule is an error Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: bircni <bircni@icloud.com> |
||
|
silverwind
|
2f01ec38bd |
fix: use READ COMMITTED transactions on MySQL and MariaDB (#39506)
MariaDB 11.6.2+ defaults `innodb_snapshot_isolation` to `ON`, which fails REPEATABLE READ transactions with error 1020 when a row they write changed after their first read. Gitea's background work like push processing writes the same rows, so merges, issue closes and workflow runs fail sporadically. - Use READ COMMITTED on MySQL and MariaDB, like PostgreSQL and MSSQL - Update xorm to v1.4.3 Replaces: https://github.com/go-gitea/gitea/pull/39494 Fixes: https://github.com/go-gitea/gitea/issues/39492 --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
fba8d7eace | chore(deps): update dependencies (#39462) | ||
|
silverwind
|
f757631a47 |
feat(actions): update actionslib, support self:, misc fixes (#39358)
Updates actionslib to https://gitea.com/gitea/actionslib/releases/tag/v1.2.1, moves workflow parsing into it and aligns behaviour with GitHub. 1. `uses:` supports `self:` (Gitea-only feature) and `$/` paths. 1. `strategy`, `matrix`, `max-parallel` and `fail-fast` accept expressions, including over `needs`. A job whose `name`, `runs-on` or `continue-on-error` reads `needs` is resolved once they finish. 1. A job `if:` may only read `github`, `needs`, `vars` and `inputs` and is decided before the matrix, as on github.com. 1. Matrix `fail-fast` cancels the other combinations, and `always()` jobs keep running when a run is cancelled. 1. Invalid workflow files, including a malformed `on:` and unknown or cyclic `needs`, show up on push as failed runs with the error. 1. A job whose `if:` or `concurrency:` fails to evaluate is skipped or failed with the error, instead of staying blocked. 1. Reusable workflows: a missing and an unreadable repository fail alike, public callers cannot use private workflows, nested jobs cannot exceed the caller's token permissions. 1. Runner labels match case-insensitively, and `runs-on` accepts an array from an expression. Runner PR: https://gitea.com/gitea/runner/pulls/1247 Docs PR: https://gitea.com/gitea/docs/pulls/553 Fixes: https://github.com/go-gitea/gitea/issues/38990 Fixes: https://github.com/go-gitea/gitea/issues/39382 Fixes: https://github.com/go-gitea/gitea/issues/32364 Fixes: https://github.com/go-gitea/gitea/issues/36077 Fixes: https://github.com/go-gitea/gitea/issues/23277 Fixes: https://github.com/go-gitea/gitea/issues/29020 Co-authored-by: Claude (Opus 5) <noreply@anthropic.com> Co-authored-by: Zettat123 <zettat123@gmail.com> |
||
|
Giteabot
|
fc28937a8d | chore(deps): update dependencies (#39367) | ||
|
silverwind
|
afb7edef07 |
refactor: replace AWS SDK with a REST client for CodeCommit migration (#39330)
Replace `aws-sdk-go-v2` in the CodeCommit migration with a minimal REST client for the four read-only API calls it uses. Binary shrinks by ~3.1 MB. Mock data was recorded against live from a AWS CodeCommit repo and then anonymized. Also stop storing the repo description as the default branch which fixes below issue. All comments in https://github.com/go-gitea/gitea/issues/34627 are addressed, the merge metadata was fixed earlier in https://github.com/go-gitea/gitea/pull/34645. Fixes: https://github.com/go-gitea/gitea/issues/34627 |
||
|
silverwind
|
c6c671e113 |
refactor: replace Azure Blob SDK with a REST client (#39315)
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
13033827b1 |
chore(deps): update actionslib to v1.0.0 (#39295)
Co-authored-by: bircni <bircni@icloud.com> |
||
|
Giteabot
|
cefb81a16f |
chore(deps): update dependencies (#39306)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
cc6fc41723 |
chore(deps): update dependencies (#39256)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
1b2479b548 | fix(deps): update module golang.org/x/crypto to v0.56.0 [security] (#39219) | ||
|
Giteabot
|
535fc29ae8 | chore(deps): update dependencies (#39176) | ||
|
silverwind
|
66c672d0b7 | refactor: drop two unmaintained dependencies, rename the byte size helpers (#39083) | ||
|
Giteabot
|
4c915ae0c2 | chore(deps): update dependencies (#39066) | ||
|
wxiaoguang
|
f261adb53f |
chore: form binding trim space (#38978)
Use "binding:TrimSpace" instead of fragile IsEmptyString And fix a bug in locale's `HasKey`: it should also try the default language if current language doesn't have the translation key, a new test is added. |
||
|
wxiaoguang
|
6904f6480c |
refactor: http request binding (#38971)
Better than before, still not good enough (more work can be done in the future) And add the missing error handling in the PrivateContext "bind" middleware. By the way, picked some "TrimSpace" changes from "fix: trim whitespace from SMTP address and port - #38934" (fix #38926) |
||
|
Giteabot
|
e223c42ee6 | fix(deps): update module golang.org/x/mod to v0.40.0 [security] (#38914) | ||
|
Giteabot
|
596b7f7a25 | chore(deps): update dependencies (#38947) | ||
|
Giteabot
|
133a3b8567 |
fix(deps): update module golang.org/x/image to v0.45.0 [security] (#38930)
Co-authored-by: bircni <bircni@icloud.com> |
||
|
silverwind
|
e3ee28f15b |
fix(avatar): use sha256 and inline the federated avatar lookup (#38843)
- Hash emails with sha256. Gravatar moved to sha256, and both it and libravatar.org serve the same image for either hash. - Drop `strk.kbt.io/projects/go/libravatar` for a 46 line inline SRV lookup. It could not bound or cancel its DNS query and panicked on an unexpected resolver error. The replacement carries the request context and a 3s timeout. - Fix federated avatars querying DNS for every avatar on every render. `loadAvatarSetting` compared a cache field that was never assigned, so each call rebuilt the resolver and dropped its cache. That cache is gone, both settings are read where they are used. - Migration 348 recreates `email_hash` with a 64 char hash column and a `hash_type` column, so a later algorithm change can tell old rows apart. The MD5 rows are unreachable and their `UNIQUE` email index would reject the SHA256 replacements. - Fix a re-saved avatar form replacing an uploaded avatar with a random one. - Remove the `duoshuo` `GRAVATAR_SOURCE` alias, that service shut down in 2017. - Remove dead i18n key. Fixes: https://github.com/go-gitea/gitea/issues/34284 Fixes: https://github.com/go-gitea/gitea/issues/28110 Docs: https://gitea.com/gitea/docs/pulls/499 Signed-off-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
a8fe401613 | chore(deps): update dependencies (#38851) | ||
|
Lunny Xiao
|
2087d4a1a5 |
refactor: use the shared workflow model from actionslib (#38768)
Pairs with https://gitea.com/gitea/runner/pulls/1143. Gitea depends on `gitea.com/gitea/runner` for exactly two packages: `act/model` and `act/exprparser`, the workflow model and the expression evaluator it needs to parse workflows and to build the task payload the runner consumes. Pulling the whole runner module in for that is heavy and puts shared code in the repository of one of the two consumers. Both packages now live in `gitea.dev/actionslib` (`pkg/model`, `pkg/exprparser`), the module Gitea and the runner already share for the runner API, so the dependency on the runner repository is dropped here. ### Changes - `gitea.com/gitea/runner/act/model` -> `gitea.dev/actionslib/pkg/model`, `.../act/exprparser` -> `gitea.dev/actionslib/pkg/exprparser` (22 files, import paths only). - `routers/api/actions/runner/interceptor.go` takes the `x-runner-uuid` / `x-runner-token` names from `gitea.dev/actionslib/pkg/protocol` instead of repeating the literals the runner also has. - `go.mod`: `gitea.com/gitea/runner` removed. --------- Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Zettat123 <zettat123@gmail.com> |
||
|
Giteabot
|
a954257fb1 |
chore(deps): update dependencies (#38757)
Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Giteabot
|
94a2c3ec18 |
chore(deps): update dependencies (#38660)
Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: silverwind <me@silverwind.io> |
||
|
mohammad rahimi
|
13d0f24423 |
feat: Replace SSE with WebSocket for UI notifications (#36965)
* Closes #36942 * Fixes #19265 Replaces the SSE-based push channel (`/user/events`) with a WebSocket endpoint (`/-/ws`). ### What changes - **New `/-/ws` endpoint** (authenticated). One WebSocket per origin, shared across tabs via a single `SharedWorker`. - **Pubsub broker** (`services/pubsub`) for fan-out by topic, behind a `Broker` interface. `MemoryBroker` is the default (single process); a Redis backend is available for multi-process setups, configured via `[websocket].PUBSUB_TYPE` / `PUBSUB_CONN_STR`. The internal Gitea queue was not usable here because it has FIFO/single-consumer semantics. - **Push-only event production.** Events are emitted by write-triggered notifiers — `NotificationCountChange`, `PublishStopwatchesForUser`, and the logout publisher — wired into the existing `notify.Notifier` interface. No server-side pollers. - **Typed pub/sub on the client.** `web_src/js/modules/worker.ts` is a singleton transport; features subscribe per event type via `onUserEvent('notification-count', cb)` instead of branching on `event.data.type`. - **Wire contract** (`UserEventType` union) is shared between the worker and consumers via `web_src/js/types.ts`, kept in sync with `services/websocket/events.go`. - **Client-side periodic polling fallback** kicks in only when the WebSocket cannot be established (e.g. proxy blocks WS, browser lacks module-SharedWorker support). ### What's removed - `modules/eventsource` (SSE manager, run loop, messenger). - `/user/events` route and `tests/integration/eventsource_test.go`. - All server-side polling for stopwatches and notification counts. ### Stopwatch multi-tab fix The navbar stopwatch icon was previously rendered conditionally on `{{if $activeStopwatch}}`, so tabs loaded before the timer started had no DOM element to update. The icon and popup are now always rendered (toggled with `tw-hidden`), and the start/stop/cancel handlers POST silently so all open tabs reflect the change in real time. ### Deployment note WebSocket needs the upgrade headers to pass through a reverse proxy, e.g. for nginx: ```nginx proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; ``` Without them the WebSocket cannot be established, and after 3 consecutive failed opens the shared worker signals `push-unavailable`: the notification count and stopwatch fall back to periodic polling on the existing `[ui.notification]` timeouts. Real-time push is lost, the features keep working. The reverse-proxy docs need the same note (see the `docs-update-needed` label). --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Epid <rexmrj@gmail.com> |
||
|
Giteabot
|
39cc4db4ba | fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] (#38623) | ||
|
Giteabot
|
bc3f63095b | fix(deps): update module google.golang.org/grpc to v1.82.1 [security] (#38567) | ||
|
wxiaoguang
|
4af9156c36 |
refactor: implement mcaptcha client and add comments/tests (#38561)
End users still need it, so it's better to make it maintainable with tests and OOM-safe. --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
2fec2affc4 |
chore(deps): update dependencies (#38538)
Also include: chore(deps): update npm dependencies #38542 chore(deps): update action dependencies #38541 chore(deps): update module golang.org/x/vuln to v1.6.0 #38540 |