bircni 178d33ed4d fix: add missing access checks and size limits (#39942) ...

Several handlers and parsers skipped checks that their siblings already
perform.

- Reject issue, comment, label, milestone and release mutations in
archived repositories via the API with one guard per route group,
matching the web UI
- Hide timeline references and dependencies pointing at issues the doer
cannot read, in the web UI and the API, including pull requests of the
same repository without pull request access
- Reject workflow runs with more than `MaxJobNumPerRun` jobs, including
inline reusable workflow jobs, and show rejected pushes as invalid
workflow runs
- Bound how much of a Helm chart archive is inflated while looking for
`Chart.yaml`

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-10-27 21:40:42 +01:00

..

actions

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

analyze

Fix incorrect vendored detections (#36508)

2026-02-01 10:35:51 +00:00

assetfs

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

auth

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

avatar

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

badge

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

base

enhance(repo): prefill new issue and pull request sidebars from query parameters (#39804)

2026-10-17 10:58:33 +00:00

cache

refactor: move go-chi/cache into Gitea (#39530)

2026-10-02 18:16:34 +02:00

cachegroup

Cache GPG keys, emails and users when list commits (#34086)

2025-04-09 16:34:38 +00:00

charset

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

citation

perf(citation): optimize CITATION.cff rendering (#39575)

2026-10-04 23:50:46 +00:00

commitstatus

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

consts

refactor: clarify GOOS detection (#39620)

2026-10-06 08:22:36 +00:00

container

fix: make auth source group sync correctly handle team removal (#37161)

2026-07-24 02:05:38 +00:00

csv

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

dump

refactor: clarify GOOS detection (#39620)

2026-10-06 08:22:36 +00:00

egress

fix(egress): expose more ranges as restricted rather than reserved (#39560)

2026-10-06 14:36:06 +08:00

emoji

enhance(emoji): update to Unicode 17, unify and lazy-load emoji data (#39363)

2026-09-24 20:23:15 +00:00

fileicon

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

generate

feat(ssh): auto generate additional ssh keys (#33974)

2026-06-08 18:18:58 +00:00

git

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

glob

fix(actions): harden log cursor, activity type and actor filter handling (#39721)

2026-10-10 19:52:23 +00:00

globallock

test: speed up go tests (#39914)

2026-10-26 11:22:44 +00:00

graceful

fix(process): reap entire process group on cmd.Cancel (#39143)

2026-08-29 19:54:07 +00:00

gtprof

fix: trace git command correctly (#39520)

2026-10-01 10:01:45 +00:00

hcaptcha

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

highlight

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

htmlutil

fix(markup): resolve and proxy srcset links of <source> elements (#39708)

2026-10-13 01:33:19 +00:00

httpcache

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

httplib

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

imagecaptcha

refactor: move go-chi/captcha into Gitea (#39529)

2026-10-02 22:21:41 +08:00

indexer

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

issue/template

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

json

fix: get valid UTF-8 for diff_hunk and composer readme (#39932)

2026-10-24 15:17:08 +02:00

label

enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)

2026-05-29 01:12:11 +00:00

lfs

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

lfstransfer

fix: add default timeout and handle errors for HaveIBeenPwned API (#39316)

2026-09-16 20:41:57 +02:00

log

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

markup

fix(markup): keep commit title emoji inside links (#39986)

2026-10-26 15:27:42 +00:00

mcaptcha

refactor: implement mcaptcha client and add comments/tests (#38561)

2026-07-21 13:41:54 +00:00

metrics

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

migration

feat: Improve Gitea-compatible forge migrations, fix many migration bugs (#39424)

2026-10-24 01:15:31 +00:00

nosql

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

optional

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

options

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

packages

fix: add missing access checks and size limits (#39942)

2026-10-27 21:40:42 +01:00

paginator

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

pprof

refactor: fix legacy problems in cmd/serv.go (#38505)

2026-07-17 22:28:59 +08:00

private

fix: various bugs (#39661)

2026-10-08 00:33:55 +08:00

process

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

proxy

fix(git)!: use internal proxy for all git operations (#39426)

2026-09-29 14:43:36 +02:00

proxyprotocol

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

public

enhance(emoji): update to Unicode 17, unify and lazy-load emoji data (#39363)

2026-09-24 20:23:15 +00:00

queue

chore(deps): update dependencies (#40020)

2026-10-26 14:36:25 +00:00

recaptcha

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

references

fix(markup): link team mentions that use a different org name case (#39436)

2026-10-04 14:51:46 +02:00

regexplru

test: fix unit tests failing on repeated runs (#39915)

2026-10-22 01:27:02 +00:00

repository

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

reqctx

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

secret

Upgrade golangci-lint to v1.64.5 (#33654)

2025-02-21 00:05:40 +08:00

session

refactor!: move go-chi/session into Gitea (#39504)

2026-10-02 21:08:14 +02:00

setting

fix(git): default to the gc maintenance strategy (#40022)

2026-10-26 14:05:34 +00:00

sitemap

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

ssh

fix: avoid useless "Failed authentication attempt" logs (#39602)

2026-10-05 01:45:50 -07:00

storage

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

structs

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

svg

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

system

test: fix unit tests failing on repeated runs (#39915)

2026-10-22 01:27:02 +00:00

tailmsg

Support performance trace (#32973)

2025-01-21 18:57:07 +00:00

tempdir

refactor: retry file remove/rename when a file is busy and clean up os detection (#38588)

2026-07-23 14:31:29 +00:00

templates

fix(markup): keep commit title emoji inside links (#39986)

2026-10-26 15:27:42 +00:00

test

fix(repo): commit page fails to render unsigned commits with a different committer (#39381)

2026-09-23 14:34:19 +00:00

testlogger

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

timeutil

chore: refactor StaticRootPath (#39384)

2026-09-22 22:49:36 +08:00

translation

chore: form binding trim space (#38978)

2026-08-19 12:50:06 +00:00

turnstile

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

typesniffer

Feature non-zipped actions artifacts (action v7) (#36786)

2026-03-26 00:37:48 +08:00

updatechecker

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

uri

fix: various security fixes (#38406)

2026-07-12 17:14:09 +00:00

user

refactor: clarify GOOS detection (#39620)

2026-10-06 08:22:36 +00:00

util

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

validation

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

web

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

webhook

actions: report commit status for pull_request_review events (#36589)

2026-02-20 16:12:22 +00:00

zstd

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00