github/gitea
4
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-10-19 08:17:05 +00:00
Code Issues Packages Projects Releases Wiki Activity
21,806 Commits 24 Branches 263 Tags
main
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
GiteaBot 458eda0f1d [skip ci] Updated translations via Crowdin 2026-10-19 00:56:21 +00:00
GiteaBot 8d6b3e48d3 [skip ci] Updated translations via Crowdin 2026-10-16 00:49:28 +00:00
GiteaBot f0434cd8f2 [skip ci] Updated translations via Crowdin 2026-10-14 00:50:13 +00:00
GiteaBot bd28f254fa [skip ci] Updated translations via Crowdin 2026-10-13 01:03:45 +00:00
Giteabot 0eb0126fa2 chore(deps): update dependencies (#39742) 2026-10-12 18:12:22 +02:00
Giteabot 2f94380222 fix(deps): update module golang.org/x/net to v0.60.0 [security] (#39695) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.59.0` →
`v0.60.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.59.0...refs/tags/v0.60.0)
|
![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.60.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.59.0/v0.60.0?slim=true)
|

---

### HTTP/2 server memory exhaustion due to Trailer headers in net/http
[CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) /
[GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603)

<details>
<summary>More information</summary>

#### Details
When "Trailer" headers are sent by a client, the HTTP server internally
uses the header values to populate the Request.Trailer map passed to the
server handler. Because Request.Trailer is a map, each entry incurs
memory overhead. For HTTP/2 servers, a malicious client can exploit this
by sending a "Trailer" header that declares a large number of fields,
causing the server to allocate a disproportionate amount of memory while
bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits.
This exploit is not applicable for HTTP/1 servers, which do not support
multiplexing a large number of requests over one TCP connection, and
whose Server.MaxHeaderBytes are calculated differently.

#### Severity
Unknown

#### References
- [https://go.dev/cl/847185](https://go.dev/cl/847185)
- [https://go.dev/cl/847314](https://go.dev/cl/847314)
- [https://go.dev/issue/81857](https://go.dev/issue/81857)
-
[https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI)
-
[https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-6603) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### HTTP/2 transport accepts malformed framing-related headers in
net/http
[CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) /
[GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610)

<details>
<summary>More information</summary>

#### Details
Historically, we have been rather lax about malformed framing-related
headers in our HTTP/2 implementation, as they cannot interfere with
HTTP/2 framing. However, this makes it possible for our HTTP/2
implementation to forward responses containing such headers to an HTTP/1
client when acting as a reverse proxy. If the HTTP/1 client also does
not behave strictly enough, this can result in response smuggling.

#### Severity
Unknown

#### References
- [https://go.dev/cl/835145](https://go.dev/cl/835145)
- [https://go.dev/cl/836385](https://go.dev/cl/836385)
- [https://go.dev/issue/81115](https://go.dev/issue/81115)
-
[https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-6610) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Excessive CPU consumption from repeated initial window changes in
net/http
[CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) /
[GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611)

<details>
<summary>More information</summary>

#### Details
A malicious HTTP/2 peer can cause excessive CPU consumption in the
client or server by opening a large number of streams and then sending
many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE
values.

#### Severity
Unknown

#### References
- [https://go.dev/cl/847186](https://go.dev/cl/847186)
- [https://go.dev/cl/847308](https://go.dev/cl/847308)
- [https://go.dev/issue/81742](https://go.dev/issue/81742)
-
[https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI)
-
[https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-6611) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Double flow control refund on HTTP/2 server streams in net/http
[CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) /
[GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612)

<details>
<summary>More information</summary>

#### Details
The HTTP/2 server can refund connection-level flow control twice for the
same data: Once when a client resets a stream (refunding data for any
sent-but-unread portion of the stream), and again when a request handler
reads the buffered data. A malicious client can exploit this to bypass
the configured connection-level flow control limit
(MaxReceiveBufferPerConnection). Total buffered data is still limited by
the concurrent stream limit and stream-level flow control.

#### Severity
Unknown

#### References
- [https://go.dev/cl/847187](https://go.dev/cl/847187)
- [https://go.dev/cl/847310](https://go.dev/cl/847310)
- [https://go.dev/issue/81743](https://go.dev/issue/81743)
-
[https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI)
-
[https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-6612) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### HTTP/2 server crash due to HPACK encoder race in net/http
[CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) /
[GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617)

<details>
<summary>More information</summary>

#### Details
HTTP/2 servers could end up crashing due to inadvertently modifying its
HPACK encoder concurrently. This happens because the server modifies the
HPACK encoder from two goroutines without synchronization: one uses the
encoder to encode a HEADERS frame as part of a response sent to a client
and the other modifies the encoder's table size when handling a SETTINGS
frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A
malicious client can repeatedly send a request while changing the header
table size to crash the server.

#### Severity
Unknown

#### References
- [https://go.dev/cl/847188](https://go.dev/cl/847188)
- [https://go.dev/cl/847313](https://go.dev/cl/847313)
- [https://go.dev/issue/81867](https://go.dev/issue/81867)
-
[https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI)
-
[https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-6617) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend Renovate
CLI](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjEuNCIsInVwZGF0ZWRJblZlciI6IjQ0LjEyMS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
 2026-10-09 05:47:50 +02:00
GiteaBot 437ca2dc6f [skip ci] Updated translations via Crowdin 2026-10-09 01:02:07 +00:00
Giteabot 871d29553b chore(deps): update go toolchain directive to v1.27.2 (#39685) 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [go](https://go.dev/)
([source](https://redirect.github.com/golang/go)) | toolchain | patch |
`1.27.1` → `1.27.2` |

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend Renovate
CLI](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjEuNCIsInVwZGF0ZWRJblZlciI6IjQ0LjEyMS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
 2026-10-08 19:10:01 +02:00
GiteaBot 89ec271d9c [skip ci] Updated translations via Crowdin 2026-10-08 01:00:05 +00:00
GiteaBot 6e7de91f99 [skip ci] Updated translations via Crowdin 2026-10-06 00:58:27 +00:00
Giteabotandsilverwind 27d876e311 chore(deps): update dependencies, add new lint rules, fix lint (#39601) 
Co-authored-by: silverwind <me@silverwind.io>
 2026-10-05 10:11:50 +00:00
GiteaBot b576f5bb34 [skip ci] Updated translations via Crowdin 2026-10-05 01:04:01 +00:00
GiteaBot daaed0d7f4 [skip ci] Updated translations via Crowdin 2026-10-03 00:55:34 +00:00
GiteaBot f81a2ab69a [skip ci] Updated translations via Crowdin 2026-10-01 01:08:18 +00:00
GiteaBot 1ab2358d92 [skip ci] Updated translations via Crowdin 2026-09-29 19:04:59 +00:00
Giteabot fba8d7eace chore(deps): update dependencies (#39462) 2026-09-28 14:05:07 +02:00
GiteaBot 47529e225c [skip ci] Updated translations via Crowdin 2026-09-28 01:03:09 +00:00
GiteaBot 3c5d2d1b63 [skip ci] Updated translations via Crowdin 2026-09-27 01:03:20 +00:00
GiteaBot 27d787d70a [skip ci] Updated translations via Crowdin 2026-09-25 00:54:17 +00:00
GiteaBot 2177969aba [skip ci] Updated translations via Crowdin 2026-09-24 00:54:31 +00:00
GiteaBot de5913d647 [skip ci] Updated translations via Crowdin 2026-09-22 00:54:27 +00:00
Giteabot fc28937a8d chore(deps): update dependencies (#39367) 2026-09-21 12:23:03 -04:00
GiteaBot 9b6a82d7e1 [skip ci] Updated translations via Crowdin 2026-09-21 00:59:22 +00:00
GiteaBot 9ae7ea7ec6 [skip ci] Updated translations via Crowdin 2026-09-20 01:00:17 +00:00
GiteaBot 2a3d047339 [skip ci] Updated translations via Crowdin 2026-09-19 00:53:07 +00:00
GiteaBot 6400c1545e [skip ci] Updated translations via Crowdin 2026-09-18 00:54:14 +00:00
GiteaBot f0d2195998 [skip ci] Updated translations via Crowdin 2026-09-17 00:54:44 +00:00
GiteaBot 62945266d4 [skip ci] Updated translations via Crowdin 2026-09-16 00:55:08 +00:00
GiteaBot 7b036e96c2 [skip ci] Updated translations via Crowdin 2026-09-15 00:55:42 +00:00
Giteabotandsilverwind cefb81a16f chore(deps): update dependencies (#39306) 
Co-authored-by: silverwind <me@silverwind.io>
 2026-09-14 13:18:00 +00:00
GiteaBot 25984bef0f [skip ci] Updated translations via Crowdin 2026-09-14 00:59:43 +00:00
GiteaBot 4ed7020d07 [skip ci] Updated translations via Crowdin 2026-09-13 01:00:55 +00:00
GiteaBot 4d43445532 [skip ci] Updated translations via Crowdin 2026-09-11 00:52:31 +00:00
GiteaBot 579de92b8a [skip ci] Updated translations via Crowdin 2026-09-10 00:53:46 +00:00
GiteaBot 92f2f6161b [skip ci] Updated translations via Crowdin 2026-09-09 00:54:44 +00:00
GiteaBot e8254bd5c1 [skip ci] Updated translations via Crowdin 2026-09-08 00:55:59 +00:00
Giteabotandsilverwind cc6fc41723 chore(deps): update dependencies (#39256) 
Co-authored-by: silverwind <me@silverwind.io>
 2026-09-07 16:35:03 +02:00
GiteaBot 1770470148 [skip ci] Updated translations via Crowdin 2026-09-07 01:00:02 +00:00
GiteaBot e5e7b2e76e [skip ci] Updated translations via Crowdin 2026-09-06 01:01:12 +00:00
GiteaBot e4455fb494 [skip ci] Updated translations via Crowdin 2026-09-05 00:52:41 +00:00
GiteaBot 231ee19cff [skip ci] Updated translations via Crowdin 2026-09-04 00:53:26 +00:00
Giteabot 1b2479b548 fix(deps): update module golang.org/x/crypto to v0.56.0 [security] (#39219) 2026-09-03 13:58:21 +02:00
GiteaBot dc6ac9489e [skip ci] Updated translations via Crowdin 2026-09-03 00:56:21 +00:00
Giteabot f735df4dee chore(deps): update dependency go to v1.27.1 (#39206) 2026-09-02 16:39:30 +02:00
GiteaBot 5ec9714dde [skip ci] Updated translations via Crowdin 2026-09-02 00:55:19 +00:00
GiteaBot ee8f2b4039 [skip ci] Updated translations via Crowdin 2026-09-01 01:05:52 +00:00
Giteabot 535fc29ae8 chore(deps): update dependencies (#39176) 2026-08-31 12:34:15 +02:00
GiteaBot 4f307ec685 [skip ci] Updated translations via Crowdin 2026-08-31 01:00:29 +00:00
GiteaBot 48d2403c0f [skip ci] Updated translations via Crowdin 2026-08-30 12:31:22 +00:00
GiteaBot 8c9305f060 [skip ci] Updated translations via Crowdin 2026-08-30 00:59:29 +00:00
GiteaBot 9297205f2c [skip ci] Updated translations via Crowdin 2026-08-29 00:49:02 +00:00
GiteaBot 062c8f2241 [skip ci] Updated translations via Crowdin 2026-08-28 03:21:07 +00:00
GiteaBot 2c6dacb015 [skip ci] Updated translations via Crowdin 2026-08-27 01:57:53 +00:00
GiteaBot 90c43e8e78 [skip ci] Updated translations via Crowdin 2026-08-26 00:23:26 +00:00
GiteaBot 9eb4a9afad [skip ci] Updated translations via Crowdin 2026-08-25 00:23:02 +00:00
Giteabot 4c915ae0c2 chore(deps): update dependencies (#39066) 2026-08-24 17:05:31 +00:00
GiteaBot e50e4ed869 [skip ci] Updated translations via Crowdin 2026-08-24 00:24:14 +00:00
GiteaBot d8f0e7e679 [skip ci] Updated translations via Crowdin 2026-08-23 00:24:38 +00:00
GiteaBot fcc23af280 [skip ci] Updated translations via Crowdin 2026-08-21 01:49:11 +00:00
GiteaBot 89b891b168 [skip ci] Updated translations via Crowdin 2026-08-20 01:44:24 +00:00
Giteabot e355c39e91 chore(deps): update dependency go to v1.26.7 (#38987) 2026-08-19 16:32:52 +00:00
GiteaBot 6c425fae6e [skip ci] Updated translations via Crowdin 2026-08-19 01:45:26 +00:00
GiteaBot 19ee791fe7 [skip ci] Updated translations via Crowdin 2026-08-18 01:43:54 +00:00
Giteabot e223c42ee6 fix(deps): update module golang.org/x/mod to v0.40.0 [security] (#38914) 2026-08-17 19:29:07 +00:00
Giteabot 596b7f7a25 chore(deps): update dependencies (#38947) 2026-08-17 15:10:17 +02:00
GiteaBot 3cd6672e48 [skip ci] Updated translations via Crowdin 2026-08-17 00:22:34 +00:00
GiteaBot 56ad4689ad [skip ci] Updated translations via Crowdin 2026-08-16 00:24:11 +00:00
Giteabotandbircni 133a3b8567 fix(deps): update module golang.org/x/image to v0.45.0 [security] (#38930) 
Co-authored-by: bircni <bircni@icloud.com>
 2026-08-15 15:43:20 +02:00
GiteaBot 43ace7cc8a [skip ci] Updated translations via Crowdin 2026-08-15 00:22:56 +00:00
Giteabot 5b7b00477a chore(deps): update dependency go to v1.26.6 (#38912) 2026-08-14 10:28:00 -07:00
GiteaBot 8b40df255b [skip ci] Updated translations via Crowdin 2026-08-14 00:37:15 +00:00
GiteaBot 5287860efb [skip ci] Updated translations via Crowdin 2026-08-13 00:36:53 +00:00
GiteaBot 9b24e8c76d [skip ci] Updated translations via Crowdin 2026-08-12 00:35:36 +00:00
GiteaBot 7e3eeca779 [skip ci] Updated translations via Crowdin 2026-08-11 00:31:26 +00:00
Giteabot a8fe401613 chore(deps): update dependencies (#38851) 2026-08-10 15:50:32 +02:00
GiteaBot b5aa8c4ff0 [skip ci] Updated translations via Crowdin 2026-08-10 00:32:58 +00:00
GiteaBot fecd2f3bc2 [skip ci] Updated translations via Crowdin 2026-08-09 00:32:02 +00:00
GiteaBot c14edf3313 [skip ci] Updated translations via Crowdin 2026-08-08 00:28:20 +00:00
Giteabot b349a4e746 fix(deps): update dependency mermaid to v11.16.1 [security] (#38813) 2026-08-07 02:48:19 -04:00
Giteabotsilverwindwxiaoguang
 		a954257fb1 chore(deps): update dependencies (#38757) 
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
 2026-08-03 21:37:12 +08:00
GiteaBot cb4c65f035 [skip ci] Updated translations via Crowdin 2026-08-03 00:53:25 +00:00
GiteaBot c5b6e044d7 [skip ci] Updated translations via Crowdin 2026-08-02 00:53:53 +00:00
GiteaBot cb79bb367e [skip ci] Updated translations via Crowdin 2026-08-01 00:53:28 +00:00
GiteaBot b244391e18 [skip ci] Updated translations via Crowdin 2026-07-30 00:46:23 +00:00
GiteaBot 298d73cde6 [skip ci] Updated translations via Crowdin 2026-07-29 00:48:51 +00:00
GiteaBot a75ed103f4 [skip ci] Updated translations via Crowdin 2026-07-28 00:48:26 +00:00
Giteabotandsilverwind 94a2c3ec18 chore(deps): update dependencies (#38660) 
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: silverwind <me@silverwind.io>
 2026-07-27 16:55:27 +00:00
GiteaBot 4da9b59414 [skip ci] Updated translations via Crowdin 2026-07-27 00:55:53 +00:00
GiteaBot a2166293f7 [skip ci] Updated translations via Crowdin 2026-07-26 00:56:06 +00:00
Giteabot 39cc4db4ba fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] (#38623) 2026-07-24 22:14:44 +00:00
Giteabot be41cff5e2 fix(deps): update dependency js-yaml to v5.2.2 [security] (#38622) 2026-07-24 23:20:03 +02:00
GiteaBot fa64b4627a [skip ci] Updated translations via Crowdin 2026-07-23 00:51:47 +00:00
Giteabot bc3f63095b fix(deps): update module google.golang.org/grpc to v1.82.1 [security] (#38567) 2026-07-22 16:47:29 +02:00
Giteabot 17ce342dcb chore(deps): update dependency @codemirror/lang-markdown to v6.5.1 (#38546) 2026-07-20 10:57:04 +00:00
Giteabot 2fec2affc4 chore(deps): update dependencies (#38538) 
Also include:
chore(deps): update npm dependencies #38542
chore(deps): update action dependencies #38541
chore(deps): update module golang.org/x/vuln to v1.6.0 #38540
 2026-07-20 09:27:21 +00:00
Giteabot 173965f66b chore(deps): update python dependencies (#38539) 2026-07-20 08:17:04 +00:00
GiteaBot 730b6f2daf [skip ci] Updated translations via Crowdin 2026-07-20 00:53:27 +00:00
GiteaBot 2cc28ac2a9 [skip ci] Updated translations via Crowdin 2026-07-18 00:46:45 +00:00
GiteaBot bca44bd736 [skip ci] Updated translations via Crowdin 2026-07-17 00:51:13 +00:00
Giteabot fa50ad2aa9 chore(deps): update dependency djlint to v1.40.4 (#38428) 2026-07-15 13:32:27 +00:00