From 0e577ed6c97cb5648adb43402abcc7dd52a2feed Mon Sep 17 00:00:00 2001 From: forgejo-release-manager Date: Tue, 12 May 2026 09:10:46 +0200 Subject: [PATCH] chore(release-notes): Forgejo v15.0.2 (#12536) https://codeberg.org/forgejo/forgejo/milestone/84479 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12536 Reviewed-by: Beowulf --- release-notes-published/15.0.2.md | 33 +++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 release-notes-published/15.0.2.md diff --git a/release-notes-published/15.0.2.md b/release-notes-published/15.0.2.md new file mode 100644 index 0000000000..c5c8c14648 --- /dev/null +++ b/release-notes-published/15.0.2.md @@ -0,0 +1,33 @@ + + + + +## Release notes + +- Security bug fixes + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): fix: prevent git write to wiki repo from unauthorized user via git HTTP + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): fix: prevent LFS authorization token from being used for read/write access after user's access is restricted from Forgejo + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing resources beyond their permitted scope via non-API endpoints (e.g. /user/repo/raw/...) + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): fix: implementing missing OAuth validation checks, improve protections against race conditions + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): fix: prevent OAuth redirect URI spoofing via non-ascii case collision + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12494): fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks +- User Interface bug fixes + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12366) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12492)): When the author of a pull request is [denied the right to run Actions](https://forgejo.org/docs/next/user/actions/security-pull-request/) by clicking on the "Deny" button on the pull request trust management panel, the workflow runs created for all commits pushed to the pull request are cancelled. Before that, runs that were automatically cancelled because a newer commit was pushed to the pull request [were stuck in a state waiting for approval](https://codeberg.org/forgejo/forgejo/issues/12350). + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12447) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12461)): fix: paginate team members list +- Bug fixes + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12302) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12470)): When a review was created as pending and then submitted, the review request wasn't deleted. These review requests couldn't be removed, as the now existing review shadowed the review request. Now, review requests get deleted when a pending review from that reviewer gets submitted, and broken review requests in already existing data can be normally removed via the UI. + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12446) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12452)): fix: make package cleanup work again + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12370) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12422)): fix: cleanup data before migration retry +- Included for completeness but not user-facing (chores, etc.) + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12382) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12533)): fix(activitypub): only return public activities on request (#12382) + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12531): Update dependency mermaid to v11.15.0 [SECURITY] (v15.0/forgejo) + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12503): chore: PGP sign .well-known/security.txt [skip ci] + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12465): Update module golang.org/x/net to v0.53.0 [SECURITY] (v15.0/forgejo) + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12433) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12467)): [pagure] ensure moving all commits in a pull request + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12231) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12468)): refactor: clarify four different outputs that authentication methods provide + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12202) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12462)): refactor: change authentication to return structured data + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12456): Update go toolchain directive to v1.26.3 (v15.0/forgejo) + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12351) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12395)): fix: get tag must return the tag signature instead of commit signature + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12357) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12362)): fix: set `repo_id` for migrated attachment + - [PR](https://codeberg.org/forgejo/forgejo/pulls/12291) ([backported](https://codeberg.org/forgejo/forgejo/pulls/12354)): fix(oauth): only accept refresh tokens as refresh tokens +