Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package forgejo for openSUSE:Factory checked in at 2026-06-11 17:29:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/forgejo (Old) and /work/SRC/openSUSE:Factory/.forgejo.new.1981 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "forgejo" Thu Jun 11 17:29:00 2026 rev:46 rq:1358690 version:15.0.3 Changes: -------- --- /work/SRC/openSUSE:Factory/forgejo/forgejo.changes 2026-06-08 14:23:09.015658548 +0200 +++ /work/SRC/openSUSE:Factory/.forgejo.new.1981/forgejo.changes 2026-06-11 17:30:25.218028003 +0200 @@ -1,0 +2,38 @@ +Thu Jun 11 10:13:31 UTC 2026 - Richard Rahl <[email protected]> + +- Update to 15.0.3: + + fix: prevent stored XSS in user display name on Actions page + + fix: LFS locks must belong to the intended repo, port from Gitea + + fix: prevent unauthorized access to draft releases via API + + fix: prevent writes to OpenID visibility which may affect other users + + fix: prevent viewing private PRs that are linked to public issues on public projects + + fix: do not migrate confidential issues and internal notes from Gitlab + + fix: improve visibility of mismatched repository & package visibility + + fix: display the actions trust management panel on merged and closed pull requests + + fix(ui): improve contrast of checkboxes in markup + + fix(ui): hide some disallowed actions that lead to 404 errors in archived repos + + fix(ui): do not clip overflow in workflow dispatch menu + + fix: show the actions trust management panel when runs from trusted users are pending approval + + fix: always display the pull request merge box if there are actions pending approval + + fix(ui): fix typo in issue sort dropdown; relevance was misnamed as relevency + + fix: do not hide previous attempts without task for latest attempt + + fix(ui): use URL query escaping for SSH key verification reload token link + + fix(doctor): ensure the doctor runs with the same settings.AppPath as Forgejo + + fix: make email token extraction case-insensitive + + fix: cancel dependent jobs when rerunning jobs + + fix: check quota in LFS uploads against the repository owner, not operating user + + fix: load repo language for converting to api struct + + fix: workflow with pull_request trigger and path filter not run when merging + + fix: update statuses in phases to prevent out of order updates from stalling workflows + + fix: return 404 instead of 500 for non-existing SHA in commit status endpoint + + fix(issue-search): single exclude query was erroneosly considered as must + + fix: remove link to artefacts that have expired + + fix: wipe run artifacts before rerun + +------------------------------------------------------------------- +Sun Jun 7 00:43:10 UTC 2026 - Marcus Rueckert <[email protected]> + +- apparmor profile: allow reading of credential files. This fixes + migration of private repositories + +------------------------------------------------------------------- Old: ---- forgejo-src-15.0.2.tar.gz forgejo-src-15.0.2.tar.gz.asc node_modules.sums New: ---- forgejo-src-15.0.3.tar.gz forgejo-src-15.0.3.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ forgejo.spec ++++++ --- /var/tmp/diff_new_pack.5lb3jJ/_old 2026-06-11 17:30:44.882852795 +0200 +++ /var/tmp/diff_new_pack.5lb3jJ/_new 2026-06-11 17:30:44.886852963 +0200 @@ -25,7 +25,7 @@ %bcond_without apparmor %endif Name: forgejo -Version: 15.0.2 +Version: 15.0.3 Release: 0 Summary: Self-hostable forge License: GPL-3.0-or-later @@ -46,7 +46,6 @@ Source11: forgejo.firewalld Source12: forgejo-abstraction.apparmor Source13: forgejo-hooks-abstraction.apparmor -Source14: node_modules.sums Source99: README.SUSE Patch0: custom-app.ini.patch BuildRequires: golang(API) >= 1.25 ++++++ forgejo-src-15.0.2.tar.gz -> forgejo-src-15.0.3.tar.gz ++++++ /work/SRC/openSUSE:Factory/forgejo/forgejo-src-15.0.2.tar.gz /work/SRC/openSUSE:Factory/.forgejo.new.1981/forgejo-src-15.0.3.tar.gz differ: char 14, line 1 ++++++ forgejo.apparmor ++++++ --- /var/tmp/diff_new_pack.5lb3jJ/_old 2026-06-11 17:30:45.018858500 +0200 +++ /var/tmp/diff_new_pack.5lb3jJ/_new 2026-06-11 17:30:45.022858668 +0200 @@ -71,6 +71,8 @@ /usr/bin/bash Px -> forgejo//git-bash, + owner /tmp/forgejo-clone-credentials-* rwlk, + owner @{APP_DATADIR}/data/home/.gitconfig rwlk, owner @{APP_DATADIR}/data/home/.gitconfig.lock rwlk, ++++++ node_modules.obscpio ++++++ /work/SRC/openSUSE:Factory/forgejo/node_modules.obscpio /work/SRC/openSUSE:Factory/.forgejo.new.1981/node_modules.obscpio differ: char 235215307, line 815153 ++++++ node_modules.spec.inc ++++++ --- /var/tmp/diff_new_pack.5lb3jJ/_old 2026-06-11 17:30:45.618883666 +0200 +++ /var/tmp/diff_new_pack.5lb3jJ/_new 2026-06-11 17:30:45.626884002 +0200 @@ -175,7 +175,7 @@ Source10174: https://registry.npmjs.org/@npmcli/fs/-/fs-3.1.1.tgz#/@npmcli-fs-3.1.1.tgz Source10175: https://registry.npmjs.org/@one-ini/wasm/-/wasm-0.1.1.tgz#/@one-ini-wasm-0.1.1.tgz Source10176: https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz#/@pkgjs-parseargs-0.11.0.tgz -Source10177: https://registry.npmjs.org/@playwright/test/-/test-1.57.0.tgz#/@playwright-test-1.57.0.tgz +Source10177: https://registry.npmjs.org/@playwright/test/-/test-1.60.0.tgz#/@playwright-test-1.60.0.tgz Source10178: https://registry.npmjs.org/@popperjs/core/-/core-2.11.8.tgz#/@popperjs-core-2.11.8.tgz Source10179: https://registry.npmjs.org/@primer/octicons/-/octicons-19.14.0.tgz#/@primer-octicons-19.14.0.tgz Source10180: https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-beta.53.tgz#/@rolldown-pluginutils-1.0.0-beta.53.tgz @@ -927,8 +927,8 @@ Source10926: https://registry.npmjs.org/pirates/-/pirates-4.0.7.tgz#/pirates-4.0.7.tgz Source10927: https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz#/pkg-dir-4.2.0.tgz Source10928: https://registry.npmjs.org/pkg-types/-/pkg-types-1.3.1.tgz#/pkg-types-1.3.1.tgz -Source10929: https://registry.npmjs.org/playwright/-/playwright-1.57.0.tgz#/playwright-1.57.0.tgz -Source10930: https://registry.npmjs.org/playwright-core/-/playwright-core-1.57.0.tgz#/playwright-core-1.57.0.tgz +Source10929: https://registry.npmjs.org/playwright/-/playwright-1.60.0.tgz#/playwright-1.60.0.tgz +Source10930: https://registry.npmjs.org/playwright-core/-/playwright-core-1.60.0.tgz#/playwright-core-1.60.0.tgz Source10931: https://registry.npmjs.org/pluralize/-/pluralize-8.0.0.tgz#/pluralize-8.0.0.tgz Source10932: https://registry.npmjs.org/points-on-curve/-/points-on-curve-0.2.0.tgz#/points-on-curve-0.2.0.tgz Source10933: https://registry.npmjs.org/points-on-path/-/points-on-path-0.2.1.tgz#/points-on-path-0.2.1.tgz ++++++ package-lock.json ++++++ --- /var/tmp/diff_new_pack.5lb3jJ/_old 2026-06-11 17:30:45.682886351 +0200 +++ /var/tmp/diff_new_pack.5lb3jJ/_new 2026-06-11 17:30:45.686886519 +0200 @@ -84,7 +84,7 @@ "devDependencies": { "@axe-core/playwright": "4.11.0", "@eslint-community/eslint-plugin-eslint-comments": "4.7.1", - "@playwright/test": "1.57.0", + "@playwright/test": "1.60.0", "@stoplight/spectral-cli": "6.15.0", "@stylistic/eslint-plugin": "5.10.0", "@stylistic/stylelint-plugin": "4.0.1", @@ -2766,13 +2766,13 @@ } }, "node_modules/@playwright/test": { - "version": "1.57.0", - "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.57.0.tgz";, - "integrity": "sha512-6TyEnHgd6SArQO8UO2OMTxshln3QMWBtPGrOCgs3wVEmQmwyuNtB10IZMfmYDE0riwNR1cu4q+pPcxMVtaG3TA==", + "version": "1.60.0", + "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.60.0.tgz";, + "integrity": "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag==", "dev": true, "license": "Apache-2.0", "dependencies": { - "playwright": "1.57.0" + "playwright": "1.60.0" }, "bin": { "playwright": "cli.js" @@ -12448,13 +12448,13 @@ } }, "node_modules/playwright": { - "version": "1.57.0", - "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.57.0.tgz";, - "integrity": "sha512-ilYQj1s8sr2ppEJ2YVadYBN0Mb3mdo9J0wQ+UuDhzYqURwSoW4n1Xs5vs7ORwgDGmyEh33tRMeS8KhdkMoLXQw==", + "version": "1.60.0", + "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.60.0.tgz";, + "integrity": "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA==", "dev": true, "license": "Apache-2.0", "dependencies": { - "playwright-core": "1.57.0" + "playwright-core": "1.60.0" }, "bin": { "playwright": "cli.js" @@ -12467,9 +12467,9 @@ } }, "node_modules/playwright-core": { - "version": "1.57.0", - "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.57.0.tgz";, - "integrity": "sha512-agTcKlMw/mjBWOnD6kFZttAAGHgi/Nw0CZ2o6JqWSbMlI219lAFLZZCyqByTsvVAJq5XA5H8cA6PrvBRpBWEuQ==", + "version": "1.60.0", + "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.60.0.tgz";, + "integrity": "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA==", "dev": true, "license": "Apache-2.0", "bin": {
