c43689b852
[v7.0/forgejo] fix(security): GO-2024-2947
...
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/4245
2024-06-26 12:08:03 +02:00
74466215e4
[v7.0/backport] Update module github.com/gorilla/feeds to v1.2.0
...
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/4166
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [github.com/gorilla/feeds](https://github.com/gorilla/feeds ) | require | minor | `v1.1.2` -> `v1.2.0` |
---
<details>
<summary>gorilla/feeds (github.com/gorilla/feeds)</summary>
[Compare Source](https://github.com/gorilla/feeds/compare/v1.1.2...v1.2.0 )
- Add the `isPermaLink` attribute to `guid` in RSS by [@​yardenshoham](https://github.com/yardenshoham ) in https://github.com/gorilla/feeds/pull/107
- [@​yardenshoham](https://github.com/yardenshoham ) made their first contribution in https://github.com/gorilla/feeds/pull/107
**Full Changelog**: https://github.com/gorilla/feeds/compare/v1.1.2...v1.2.0
</details>
---
📅 **Schedule**: Branch creation - "before 4am" (UTC), Automerge - "before 4am" (UTC).
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MDkuMSIsInVwZGF0ZWRJblZlciI6IjM3LjQwOS4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiXX0=-->
2024-06-19 08:11:44 +02:00
e7977767fa
chore(dependency): whitelist mholt/archiver/v3 CVE-2024-0406
...
It is not possible to tell vulncheck that Forgejo is not affected by
CVE-2024-0406. Use a mirror of the repository to do that.
Refs: https://github.com/mholt/archiver/issues/404
(cherry picked from commit 3bfec270ac
2024-06-05 22:19:30 +02:00
1f08add260
Replace reply with a forked version to fix the cut-off of the incoming mail text ( #3747 )
...
replace reply with forgejos forked version
If plain text is selected as the message format in e.g. Apple Mail, the inline attachments are no longer at the end of the mail, but instead directly where they are in the mail. When parsing the mail, these inline attachments are replaced by "--". The new reply version no longer cuts the text at the first "--".
Tests for this are present in reply (7dc5750c6dhttps://codeberg.org/forgejo/forgejo/issues/3496#issuecomment-1798416
---
Additionally, I reduced the allocations for the inline attachments.
2024-05-13 23:51:40 +02:00
696ed328fb
fix(security): CVE-2024-24788 malformed DNS message
...
Refs: https://pkg.go.dev/vuln/GO-2024-2824
(cherry picked from commit f3045f0519
2024-05-08 14:47:59 +00:00
f8a3482cdb
Update module gitea.com/go-chi/binding to v0.0.0-20240430071103-39a851e106ed
...
(cherry picked from commit 58bf120eba
2024-05-07 08:35:25 +01:00
b74c8015f1
[CHORE] Update golang.org/x/net
...
Per https://pkg.go.dev/vuln/GO-2024-2687
(cherry picked from commit ded1080bc2
2024-04-04 06:09:34 +00:00
149efabe07
Update dependency go to v1.22.2
...
(cherry picked from commit e6da9c6cd9
2024-04-04 06:09:34 +00:00
f3ea363dd2
fix: set proper go directive
...
(cherry picked from commit 99efe01a08
2024-04-04 05:58:09 +00:00
2937333e2d
[v7.0/forgejo] Go and JS dependencies
2024-04-02 12:27:01 +02:00
0cb9ea64a6
Update module github.com/opencontainers/image-spec to v1.1.0
2024-03-30 06:05:12 +00:00
f579bde69d
[CHORE] Cleanup dependency
...
- Remove `gitea.com/lunny/dingtalk_webhook` as dependency, we only use
two structs which are small enough to be recreated in Forgejo and don't
need to rely on the dependency.
- Existing tests (thanks @oliverpool) prove that this has no effect.
2024-03-30 00:01:42 +01:00
168c56d7d4
Merge pull request 'Update module github.com/gliderlabs/ssh to v0.3.7' ( #2806 ) from renovate/github.com-gliderlabs-ssh-0.x into forgejo
...
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2806
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-03-28 14:01:48 +00:00
9ff9036377
Update module github.com/klauspost/compress to v1.17.7
2024-03-25 20:07:17 +00:00
5194bd15ef
Merge pull request 'Update module github.com/editorconfig/editorconfig-core-go/v2 to v2.6.1' ( #2804 ) from renovate/github.com-editorconfig-editorconfig-core-go-v2-2.x into forgejo
...
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2804
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
2024-03-25 19:48:58 +00:00
a6fdab95f8
Update module github.com/go-enry/go-enry/v2 to v2.8.7
2024-03-25 19:05:23 +00:00
ac08242493
Update module github.com/gliderlabs/ssh to v0.3.7
2024-03-25 18:24:23 +00:00
eccd824b01
Update module github.com/editorconfig/editorconfig-core-go/v2 to v2.6.1
2024-03-25 17:37:18 +00:00
6e968e0ce3
Update gitea.com/go-chi/session digest to 16768d9
2024-03-25 15:18:21 +00:00
46aaecc2b8
Update gitea.com/go-chi/captcha digest to fb487f6
2024-03-25 13:37:57 +00:00
84f28f36b0
go: upgrade to go v1.22
2024-03-25 06:52:23 +01:00
0a88259df4
Update Chroma to v2.13.0 ( #29732 )
...
This adds new lexers and includes some fixes. See
https://github.com/alecthomas/chroma/releases/tag/v2.13.0 for the full
changelog.
---------
Co-authored-by: Giteabot <teabot@gitea.io>
(cherry picked from commit 3e7ae79f99ef0e5ba3d1201c38f491121ea2a156)
2024-03-20 08:46:28 +01:00
6cb9e8d869
Make runs-on support variable expression ( #29468 )
...
As title.
Close issue: https://gitea.com/gitea/act_runner/issues/445
Follow: https://gitea.com/gitea/act/pulls/91
Move `getSecretsOfTask` and `getVariablesOfTask` under `models` because
of circular dependency issues.
(cherry picked from commit a1f5dd767729e30d07ab42fda80c19f30a72679f)
2024-03-11 23:36:59 +07:00
abb0294996
Partially enable MSSQL case-sensitive collation support ( #29238 )
...
Follow #28662
(cherry picked from commit 29a8c8de779924694fadad80b31cc855dd62c0f2)
2024-03-11 23:36:59 +07:00
578f0b3335
[DEPS] Bump mysql driver
...
- Bump the SQL driver for MySQL to
[v1.8.0](https://github.com/go-sql-driver/mysql/releases/tag/v1.8.0 ),
which notably includes support for ed25519 authentication scheme (by
yours truly).
- Resolves #1868
2024-03-10 14:57:56 +01:00
2c26b187ea
bump protobuf module ( #29617 )
...
(cherry picked from commit 06039bf0b7ec4dffe74ae323b8bbbbedec69d0c8)
2024-03-06 11:39:07 +08:00
0c4872f839
[CHORE] Update `connect-go` to maintained fork
...
- Update github.com/bufbuild/connect-go to
https://github.com/connectrpc/connect-go .
- This is a fork that's actively maintained and is recommend by the
original library. Looking at the recent release notes, it looks like
going in the right direction what one would expect of a library, no
strange features being added, lots of improvements.
- There's still an indirect dependency by
`code.gitea.io/actions-proto-go` on a old version of `connect-go`.
2024-02-28 09:40:56 +01:00
295cd6be94
[GITEA] Use existing error functionality
...
- There's no need to use `github.com/pkg/errors` when the standard
library already has the functionality to wrap and create errors.
(cherry picked from commit 40f603a538aa68a2753f48e252d739cc6f40ccd203c4b97358f25eeb7695989d8fa1cb10e890ed8e581519389d03d00b11ac04e6c853d4https://codeberg.org/forgejo/forgejo/pulls/2249
(cherry picked from commit 2c4c29f7bc
2024-02-05 16:09:40 +01:00
92413041bd
[GITEA] Use maintained gziphandler
...
- https://github.com/NYTimes/gziphandler doesn't seems to be maintained
anymore and Forgejo already includes
https://github.com/klauspost/compress which provides a maintained and
faster gzip handler fork.
- Enables Jitter to prevent BREACH attacks, as this *seems* to be
possible in the context of Forgejo.
(cherry picked from commit cc2847241d99ba56a876https://codeberg.org/forgejo/forgejo/pulls/1581
(cherry picked from commit 711638193d9c12a37fded13065345445a16f8c3ca497acb31ffe87fd82896ac12e6693981ec37e1e5d6892ec109df7968f4f7d588d1833https://codeberg.org/forgejo/forgejo/pulls/2075
(cherry picked from commit defb1012815830f204a1029f4e9863816fe55812https://codeberg.org/forgejo/forgejo/pulls/2249
(cherry picked from commit 99866d8045
2024-02-05 16:09:40 +01:00
662c8ee341
[GITEA] Use existing jsonschema library
...
- Use the 'existing' jsonschema library for the nodeinfo integration test.
(cherry picked from commit 73864840f2da36df306bhttps://codeberg.org/forgejo/forgejo/pulls/1581
(cherry picked from commit 2b4ab46d8ehttps://codeberg.org/forgejo/forgejo/pulls/1617
(cherry picked from commit 80641303440ccefc633e19e647b5312bcc04889d2fd1932699b9a3e1e52592d932d23fc125217feaf9801ba57bhttps://codeberg.org/forgejo/forgejo/pulls/2034
(cherry picked from commit 2558a8a764f53b2d3112c098055f0a0e1591554a876d9d5c6fhttps://codeberg.org/forgejo/forgejo/pulls/2249
(cherry picked from commit 7110bb6a78
2024-02-05 16:09:40 +01:00
fa37a211fb
[GITEA] Drop sha256-simd in favor of stdlib
...
- In Go 1.21 the crypto/sha256 [got a massive
improvement](https://go.dev/doc/go1.21#crypto/sha256 ) by utilizing the
SHA instructions for AMD64 CPUs, which sha256-simd already was doing.
The performance is now on par and I think it's preferable to use the
standard library rather than a package when possible.
```
cpu: AMD Ryzen 5 3600X 6-Core Processor
│ simd.txt │ go.txt │
│ sec/op │ sec/op vs base │
Hash/8Bytes-12 63.25n ± 1% 73.38n ± 1% +16.02% (p=0.002 n=6)
Hash/64Bytes-12 98.73n ± 1% 105.30n ± 1% +6.65% (p=0.002 n=6)
Hash/1K-12 567.2n ± 1% 572.8n ± 1% +0.99% (p=0.002 n=6)
Hash/8K-12 4.062µ ± 1% 4.062µ ± 1% ~ (p=0.396 n=6)
Hash/1M-12 512.1µ ± 0% 510.6µ ± 1% ~ (p=0.485 n=6)
Hash/5M-12 2.556m ± 1% 2.564m ± 0% ~ (p=0.093 n=6)
Hash/10M-12 5.112m ± 0% 5.127m ± 0% ~ (p=0.093 n=6)
geomean 13.82µ 14.27µ +3.28%
│ simd.txt │ go.txt │
│ B/s │ B/s vs base │
Hash/8Bytes-12 120.6Mi ± 1% 104.0Mi ± 1% -13.81% (p=0.002 n=6)
Hash/64Bytes-12 618.2Mi ± 1% 579.8Mi ± 1% -6.22% (p=0.002 n=6)
Hash/1K-12 1.682Gi ± 1% 1.665Gi ± 1% -0.98% (p=0.002 n=6)
Hash/8K-12 1.878Gi ± 1% 1.878Gi ± 1% ~ (p=0.310 n=6)
Hash/1M-12 1.907Gi ± 0% 1.913Gi ± 1% ~ (p=0.485 n=6)
Hash/5M-12 1.911Gi ± 1% 1.904Gi ± 0% ~ (p=0.093 n=6)
Hash/10M-12 1.910Gi ± 0% 1.905Gi ± 0% ~ (p=0.093 n=6)
geomean 1.066Gi 1.032Gi -3.18%
```
(cherry picked from commit abd94ff5b515e81637abhttps://codeberg.org/forgejo/forgejo/pulls/1581
(cherry picked from commit 325d92917fhttps://codeberg.org/forgejo/forgejo/pulls/1617
(cherry picked from commit 358819e895362fd7aae14f64ee294e4bde77f7b11311e30a8157b69e334c52dc892fad77f54f41870d0392f3a5https://codeberg.org/forgejo/forgejo/pulls/2034
(cherry picked from commit 92798364e843d218127745c88b86a3a1cd6f4e3a01191dc2ad151e07f37e
2024-02-05 16:09:40 +01:00
8735fcdb7d
[GITEA] Vendor rupture dependency
...
- The [rupture](https://github.com/ethantkoenig/rupture ) dependency was
essentially outdated in the sense it was using old version of
dependencies.
- The usage by Forgejo was rather a small portion, so that portion is
now vendored (with its tests).
- Removes old dependencies from go.sum (less dependencies is better for
reviewing what the heck we're importing). Just to note that they were
likely not being used by Go's build process (according to
https://go.dev/ref/mod#minimal-version-selection ), so it's really a
matter of formal cleaning up dependencies we don't use and therefor
don't want to download and be in our go.sum.
(cherry picked from commit aa72a5f009https://codeberg.org/forgejo/forgejo/pulls/2148
(cherry picked from commit fbe8d65f0be18debcb6ahttps://codeberg.org/forgejo/forgejo/pulls/2245
(cherry picked from commit 8c43c2ada8
2024-02-05 15:08:04 +01:00
ba24e0ba61
Use new RPM constants ( #28931 )
...
https://github.com/sassoftware/go-rpmutils/pull/24 got merged.
2024-01-25 21:40:24 +00:00
82acf22d9c
Update go dependencies and fix go-git ( #28893 )
...
More details are in the comment of repo_base_gogit.go
And ref: https://github.com/go-git/go-git/issues/1006
2024-01-23 05:40:00 +00:00
4abd63d378
Upgrade xorm to v1.3.7 to fix a resource leak problem caused by Iterate ( #28891 )
...
Mainly fix an error https://gitea.com/xorm/xorm/issues/2393
2024-01-22 18:24:55 +08:00
5574968ecb
Set the `isPermaLink` attribute to `false` in the `guid` sub-element ( #28860 )
...
Our `guid` is not a valid URL so according to the RSS spec the
`isPermaLink` attribute needs to be set to `false`.
Example:
```diff
<item>
<title>yardenshoham opened issue <a href="https://3000-yardenshoham-gitea-jqlxjixsez9.ws-us107.gitpod.io/yardenshoham/test/issues/2">yardenshoham/test#2</a> ;</title>
<link>https://3000-yardenshoham-gitea-jqlxjixsez9.ws-us107.gitpod.io/yardenshoham/test/issues/2 </link>
<description>2#hey</description>
<content:encoded><![CDATA[2#hey]]></content:encoded>
<author>yardenshoham</author>
- <guid>355: https://3000-yardenshoham-gitea-jqlxjixsez9.ws-us107.gitpod.io/yardenshoham/test/issues/2 </guid>
+ <guid isPermaLink="false">355: https://3000-yardenshoham-gitea-jqlxjixsez9.ws-us107.gitpod.io/yardenshoham/test/issues/2 </guid>
<pubDate>Tue, 16 Jan 2024 18:54:36 +0000</pubDate>
</item>
```
References:
-
https://www.rssboard.org/rss-specification#ltguidgtSubelementOfLtitemgt
- Fixes https://github.com/go-gitea/gitea/issues/28734
- https://github.com/gorilla/feeds/issues/78
- https://github.com/go-gitea/gitea/pull/21550
- https://github.com/gorilla/feeds/pull/107
Signed-off-by: Yarden Shoham <git@yardenshoham.com>
2024-01-20 02:38:16 +00:00
fee80a1847
Update github.com/cloudflare/circl ( #28789 )
...
cloudflare/circl: https://github.com/advisories/GHSA-9763-4f94-gfch
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-15 11:14:26 +08:00
2df7563f31
Recommend/convert to use case-sensitive collation for MySQL/MSSQL ( #28662 )
...
Mainly for MySQL/MSSQL.
It is important for Gitea to use case-sensitive database charset
collation. If the database is using a case-insensitive collation, Gitea
will show startup error/warning messages, and show the errors/warnings
on the admin panel's Self-Check page.
Make `gitea doctor convert` work for MySQL to convert the collations of
database & tables & columns.
* Fix #28131
## ⚠️ BREAKING ⚠️
It is not quite breaking, but it's highly recommended to convert the
database&table&column to a consistent and case-sensitive collation.
2024-01-10 11:03:23 +00:00
da58bb85fa
Upgrade xorm to new version which supported update join for all supported databases ( #28590 )
...
Fix https://github.com/go-gitea/gitea/pull/28547#issuecomment-1867740842
Since https://gitea.com/xorm/xorm/pulls/2383 merged, xorm now supports
UPDATE JOIN.
To keep consistent from different databases, xorm use
`engine.Join().Update`, but the actural generated SQL are different
between different databases.
For MySQL, it's `UPDATE talbe1 JOIN table2 ON join_conditions SET xxx
Where xxx`.
For MSSQL, it's `UPDATE table1 SET xxx FROM TABLE1, TABLE2 WHERE
join_conditions`.
For SQLITE per https://www.sqlite.org/lang_update.html , sqlite support
`UPDATE table1 SET xxx FROM table2 WHERE join conditions` from
3.33.0(2020-8-14).
POSTGRES is the same as SQLITE.
2023-12-31 05:00:35 +00:00
11f0519ad8
Update go dependencies ( #28518 )
...
Update golang.org/x/crypto for CVE-2023-48795 and update other packages.
`go-git` is not updated because it needs time to figure out why some
tests fail.
2023-12-19 09:18:42 +08:00
cd2ff6e83d
Bump google/go-github to v57 ( #28514 )
2023-12-18 15:42:04 -06:00
047c69bd85
Improve CLI code and descriptions ( #28482 )
...
* Close #28444
* Actually, it doesn't need to use that trick because it looks like it
is not necessary, no user really needs it
* Remove the hidden (legacy) "doctor" subcommand and update documents
* Fix "actions" usage
2023-12-15 15:49:01 +00:00
da0c4b8d10
Remove SSH workaround ( #27893 )
...
Revert the workaround of #26409 and fix #26411 , update github.com/gliderlabs/ssh to include 02f9d57300
2023-11-03 15:21:05 +00:00
e75b89ea6e
Upgrade xorm to 1.3.4 ( #27807 )
...
Noticeable change:
Remove the `OrderBy("1") `
[patch](https://github.com/go-gitea/gitea/pull/27673#issuecomment-1768570142 )
for mssql since xorm has [fixed
it](0f085408af
2023-10-27 13:28:53 +02:00
8d6577dabd
Chroma v2.10.0 ( #27803 )
...
Bump the chroma version to v2.10.0:
https://github.com/alecthomas/chroma/releases/tag/v2.10.0
This release includes a better Java lexer
https://github.com/alecthomas/chroma/pull/873
2023-10-26 23:42:24 +02:00
e91d4f106b
Upgrade xorm ( #27673 )
...
Related to https://gitea.com/xorm/xorm/pulls/2341
2023-10-19 10:25:57 +00:00
b5a4ec0fb1
Upgrade go dependencies ( #27599 )
...
Upgrade all dependencies in `go.mod`
`golang.org/x/net` v0.17.0 also fixes
[CVE-2023-39325](https://github.com/advisories/GHSA-4374-p667-p6c8 )
---------
Co-authored-by: delvh <dev.lh@web.de>
2023-10-13 16:11:15 +00:00
e51f96829f
Downgrade `go-co-op/gocron` to v1.31.1 ( #27511 )
2023-10-07 18:54:02 -04:00
e3229c8e9b
bump go-deps ( #27489 )
2023-10-07 05:55:08 +00:00
9e446dbf04
bump bleve ( #27300 )
...
Co-authored-by: yp05327 <576951401@qq.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2023-09-27 07:10:58 +00:00
Earl Warren