1
0
Fork
You've already forked forgejo
0
forked from forgejo/forgejo
Beyond coding. We forge.
  • Go 81.1%
  • go-html-template 10.9%
  • JavaScript 2.7%
  • CSS 1.9%
  • TypeScript 1.7%
  • Other 1.5%
Find a file
Renovate Bot 2567513237 Update module golang.org/x/image to v0.43.0 [SECURITY] (v15.0/forgejo) ( #13198 ) 
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/image](https://pkg.go.dev/golang.org/x/image) | [`v0.41.0` → `v0.43.0`](https://cs.opensource.google/go/x/image/+/refs/tags/v0.41.0...refs/tags/v0.43.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fimage/v0.43.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fimage/v0.41.0/v0.43.0?slim=true) |
---
### Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image
[CVE-2026-33813](https://nvd.nist.gov/vuln/detail/CVE-2026-33813) / [GO-2026-4961](https://pkg.go.dev/vuln/GO-2026-4961)
<details>
<summary>More information</summary>
#### Details
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
#### Severity
Unknown
#### References
- [https://go.dev/cl/759860](https://go.dev/cl/759860)
- [https://go.dev/cl/780860](https://go.dev/cl/780860)
- [https://go.dev/issue/78407](https://go.dev/issue/78407)
This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-4961) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>
---
### Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image
[CVE-2026-46601](https://nvd.nist.gov/vuln/detail/CVE-2026-46601) / [GO-2026-5061](https://pkg.go.dev/vuln/GO-2026-5061)
<details>
<summary>More information</summary>
#### Details
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
#### Severity
Unknown
#### References
- [https://go.dev/cl/787681](https://go.dev/cl/787681)
- [https://go.dev/issue/79869](https://go.dev/issue/79869)
This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5061) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>
---
### Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
[CVE-2026-46602](https://nvd.nist.gov/vuln/detail/CVE-2026-46602) / [GO-2026-5062](https://pkg.go.dev/vuln/GO-2026-5062)
<details>
<summary>More information</summary>
#### Details
The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption.
#### Severity
Unknown
#### References
- [https://go.dev/cl/788422](https://go.dev/cl/788422)
- [https://go.dev/issue/79905](https://go.dev/issue/79905)
This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5062) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
 - At any time (no schedule defined)
- Automerge
 - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIzNC4wIiwidGFyZ2V0QnJhbmNoIjoidjE1LjAvZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->
Reviewed-on: forgejo/forgejo#13198
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
2026年06月26日 00:19:22 +02:00
.devcontainer Update dependency go to v1.26 (forgejo) ( #11320 ) 2026年03月12日 01:26:23 +01:00
.forgejo [v15.0/forgejo] ci: don't use redict during Forgejo testing ( #13119 ) 2026年06月18日 14:28:26 +02:00
.semgrep ci: detect and prevent empty case statements in Go code ( #11593 ) 2026年03月10日 02:50:28 +01:00
assets [v15.0/forgejo] chore: remove EXIF stripping capability due to usage of AGPL licensed exif-terminator library ( #13115 ) 2026年06月17日 17:11:36 +02:00
build [v15.0/forgejo] fix: introduce lint-single-response to prevent control flow continuing past a ctx.Error(...)-style method ( #13092 ) 2026年06月14日 22:43:53 +02:00
cmd [v15.0/forgejo] chore: remove EXIF stripping capability due to usage of AGPL licensed exif-terminator library ( #13115 ) 2026年06月17日 17:11:36 +02:00
contrib chore: rename 'forgejo_migrations' to 'forgejo_migrations_legacy' 2025年10月14日 14:40:49 -06:00
custom/conf [v15.0/forgejo] chore: fix cookie name comments in example ini ( #12132 ) 2026年04月15日 23:26:05 +02:00
docker [v15.0/forgejo] chore(Dockerfile.rootless): update shadowed env variables ( #12137 ) 2026年04月16日 10:44:47 +02:00
models [v15.0/forgejo] fix: do not try to remove task logs that don't exist ( #13055 ) 2026年06月21日 14:55:36 +02:00
modules chore(refactor): run routers/api/v1/permissions/tests from tests/integration ( #13157 ) 2026年06月21日 22:49:02 +02:00
options [v15.0/forgejo] fix: do not hide previous attempts without task for latest attempt ( #12787 ) 2026年05月28日 16:54:33 +02:00
public [v15.0/forgejo] chore: PGP sign .well-known/security.txt [skip ci] ( #12503 ) 2026年05月11日 04:49:13 +02:00
release-notes [v15.0/forgejo] fix: in actions_service cancelJobsForRun is bugous use killRun instead ( #12492 ) 2026年05月09日 21:00:52 +02:00
release-notes-published chore(release-notes): Forgejo v14.0.3 [skip ci] ( #11583 ) 2026年03月09日 07:00:32 +01:00
releases/images [DOCS] RELEASE-NOTES.md 2024年02月05日 14:44:32 +01:00
routers [v15.0/forgejo] chore(refactor): s/Base.Data["requiredScopeCategories"]/APIContext.RequiredScopeCategories/ ( #13181 ) 2026年06月24日 00:57:40 +02:00
services [v15.0/forgejo] chore(refactor): s/Base.Data["requiredScopeCategories"]/APIContext.RequiredScopeCategories/ ( #13181 ) 2026年06月24日 00:57:40 +02:00
templates [v15.0/forgejo] correcting referrer policy in HTML <meta> tag ( #13042 ) 2026年06月10日 21:44:17 +02:00
tests [v15.0/forgejo] fix: GET /repos/{owner}/{repo}/issues/comments/{id} does not fail if the poster is a deleted user ( #13182 ) 2026年06月23日 22:16:13 +02:00
tools chore: move backend-checks CI checks to Makefile: make pr-go ( #11053 ) 2026年02月17日 02:41:40 +01:00
web_src [v15.0/forgejo] fix(ui): improve contrast of checkboxes in markup ( #12949 ) 2026年06月05日 15:26:45 +02:00
.air.toml chore: rename 'migrations' to 'gitea_migrations' 2025年10月14日 14:40:49 -06:00
.deadcode-out [v15.0/forgejo] chore(refactor): s/Base.Data["requiredScopeCategories"]/APIContext.RequiredScopeCategories/ ( #13181 ) 2026年06月24日 00:57:40 +02:00
.dockerignore fix: Dockerfile should re-use bindata files when possible 2025年06月13日 14:00:57 +02:00
.editorconfig i18n(next): convert indention style to tabs: en, editorconfig ( #10661 ) 2026年01月02日 05:56:48 +01:00
.envrc.example Make direnv optional to let developers use their own direnv configuration 2024年11月06日 20:34:49 +01:00
.gitattributes Add interface{} to any replacement to make fmt, exclude *.pb.go ( #30461 ) 2024年04月15日 20:01:36 +02:00
.gitignore chore: polish linter error vs. dead code reporting ( #11217 ) 2026年03月20日 07:06:09 +01:00
.gitmodules cleanup(tests): remove manual testing submodule 2024年04月21日 10:13:51 +02:00
.gitpod.yml Remove sqlite-viewer and using database client ( #31223 ) 2024年06月09日 11:13:39 +02:00
.golangci.yml chore(refactor): run routers/api/v1/permissions/tests from tests/integration ( #13157 ) 2026年06月21日 22:49:02 +02:00
.ignore Add /options/license and /options/gitignore to .ignore ( #30219 ) 2024年04月07日 15:40:31 +02:00
.mailmap Add .mailmap with aliases for Unknwon (github.com/Unknwon) 2024年08月14日 08:26:16 -04:00
.markdownlint.yaml Update JS dependencies ( #28537 ) 2023年12月30日 05:29:03 +00:00
.node-version Update Node.js to v24.14.1 (forgejo) ( #11805 ) 2026年03月25日 06:47:24 +01:00
.npmrc Upgrade to npm lockfile v3 and explicitely set it ( #23561 ) 2023年03月18日 19:38:10 +01:00
.release-notes-assistant.yaml chore(release-notes): teach release-notes-assistant that v11.0 is LTS ( #10638 ) 2025年12月30日 10:00:22 +01:00
.spectral.yaml Add spectral linter for Swagger ( #20321 ) 2022年07月11日 18:07:16 -05:00
.yamllint.yaml fully replace drone with actions ( #27556 ) 2023年10月11日 06:39:32 +00:00
BSDmakefile feat: Makefile & BSDmakefile changes ( #7455 ) 2025年04月27日 10:04:32 +00:00
CODEOWNERS chore: add @0xllx0 to federation codeowners ( #10716 ) 2026年01月09日 23:53:06 +01:00
CONTRIBUTING.md docs: replace Developer Guide link with the new Contributor Guide one. 2024年08月26日 13:22:39 +03:00
DCO Remove address from DCO ( #22595 ) 2023年01月24日 18:52:38 +00:00
Dockerfile Update data.forgejo.org/oci/golang Docker tag to v1.26 (forgejo) ( #11662 ) 2026年03月13日 08:17:21 +01:00
Dockerfile.rootless Update data.forgejo.org/oci/golang Docker tag to v1.26 (forgejo) ( #11662 ) 2026年03月13日 08:17:21 +01:00
eslint.config.mjs Update linters (forgejo) ( #11627 ) 2026年03月12日 18:27:43 +01:00
flake.lock chore: bump nixpkgs in flake.lock ( #10128 ) 2025年11月16日 01:18:26 +01:00
flake.nix refactor: Simplify flake.nix ( #9805 ) 2025年10月22日 19:09:11 +02:00
go.mod Update module golang.org/x/image to v0.43.0 [SECURITY] (v15.0/forgejo) ( #13198 ) 2026年06月26日 00:19:22 +02:00
go.sum Update module golang.org/x/image to v0.43.0 [SECURITY] (v15.0/forgejo) ( #13198 ) 2026年06月26日 00:19:22 +02:00
LICENSE Forgejo v9.0 is GPLv3+ 2024年08月22日 09:09:29 +02:00
main.go fix: do not mix urfave v2 with urfave v3 ( #8168 ) 2025年06月12日 15:38:03 +02:00
Makefile [v15.0/forgejo] fix: introduce lint-single-response to prevent control flow continuing past a ctx.Error(...)-style method ( #13092 ) 2026年06月14日 22:43:53 +02:00
manifest.scm Add a GNU Guix manifest ( #8038 ) 2025年06月03日 08:08:17 +02:00
package-lock.json Update playwright monorepo to v1.60.0 (v15.0/forgejo) ( #13021 ) 2026年06月09日 17:41:52 +02:00
package.json Update playwright monorepo to v1.60.0 (v15.0/forgejo) ( #13021 ) 2026年06月09日 17:41:52 +02:00
playwright.config.ts chore: remove webkit and mobile safari from playwright ( #10103 ) 2025年11月13日 17:23:08 +01:00
README.md chore: fix a few typos in the documentation ( #9134 ) 2025年09月04日 01:53:40 +02:00
release-notes-assistant.sh chore: improve the wording of the "not worth a release note" category ( #8542 ) 2025年07月18日 07:19:15 +02:00
RELEASE-NOTES.md chore(release-notes): fix release notes of chroma update in v8.0.0 2025年10月05日 17:10:38 +05:00
shell.nix chore: use interactive sqlite via nix ( #10439 ) 2025年12月17日 13:20:33 +01:00
stylelint.config.js Merge pull request 'Port "Enable declaration-block-no-redundant-longhand-properties ( #30950 )' ( #3769 ) from beowulf/gitea-port-pull-30950 into forgejo 2024年05月14日 22:23:54 +00:00
tailwind.config.js chore(ui): change /devtest to /-/demo ( #11019 ) 2026年01月26日 13:12:25 +01:00
tsconfig.json feat(ui): replace Monaco with CodeMirror ( #10559 ) 2026年01月04日 23:52:33 +01:00
vitest.config.ts feat(ui): replace Monaco with CodeMirror ( #10559 ) 2026年01月04日 23:52:33 +01:00
webpack.config.js chore(ui): change /devtest to /-/demo ( #11019 ) 2026年01月26日 13:12:25 +01:00

Welcome to Forgejo

Hi there! Tired of big platforms playing monopoly? Providing Git hosting for your project, friends, company or community? Forgejo (/for'd͡ʒe.jo/ inspired by forĝejo – the Esperanto word for forge) has you covered with its intuitive interface, light and easy hosting and a lot of built-in functionality.

Forgejo was created in 2022 because we think that the project should be owned by an independent community. If you second that, then Forgejo is for you! Our promise: Independent Free/Libre Software forever!

What does Forgejo offer?

If you like any of the following, Forgejo is literally meant for you:

  • Lightweight: Forgejo can easily be hosted on nearly every machine. Running on a Raspberry? Small cloud instance? No problem!
  • Project management: Besides Git hosting, Forgejo offers issues, pull requests, wikis, kanban boards and much more to coordinate with your team.
  • Publishing: Have something to share? Use releases to host your software for download, or use the package registry to publish it for docker, npm and many other package managers.
  • Customizable: Want to change your look? Change some settings? There are many config switches to make Forgejo work exactly like you want.
  • Powerful: Organizations & team permissions, CI integration, Code Search, LDAP, OAuth and much more. If you have advanced needs, Forgejo has you covered.
  • Privacy: From update checker to default settings: Forgejo is built to be privacy first for you and your crew.
  • Federation: (WIP) We are actively working to connect software forges with each other through ActivityPub, and create a collaborative network of personal instances.

Learn more

Dive into the documentation, subscribe to releases and blog post on our website, find us on the Fediverse or hop into our Matrix room if you have any questions or want to get involved.

License

Forgejo is distributed under the terms of the GPL version 3.0 or any later version.

The agreement for this license was documented in June 2023 and implemented during the development of Forgejo v9.0. All Forgejo versions before v9.0 are distributed under the MIT license.

Get involved

If you are interested in making Forgejo better, either by reporting a bug or by changing the governance, please take a look at the contribution guide.