Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package forgejo for openSUSE:Factory checked in at 2026-07-31 15:27:54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/forgejo (Old) and /work/SRC/openSUSE:Factory/.forgejo.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "forgejo" Fri Jul 31 15:27:54 2026 rev:48 rq:1368725 version:16.0.2 Changes: -------- --- /work/SRC/openSUSE:Factory/forgejo/forgejo.changes 2026-07-26 11:31:26.608838530 +0200 +++ /work/SRC/openSUSE:Factory/.forgejo.new.2004/forgejo.changes 2026-07-31 16:07:01.683845746 +0200 @@ -1,0 +2,52 @@ +Thu Jul 30 23:19:33 UTC 2026 - Marcus Rueckert <[email protected]> + +- update to 16.0.2: + - Security bug fixes + - PR (backported): fix: add CGNAT (100.64.0.0/10) to 'private' + hostmatcher rule + - PR: - fix: prevent arbitrary file reads from org-mode + rendering + - PR: - fix: prevent stored XSS in Actions pre-execution + warnings and errors + - Bug fixes + - PR (backported): fix: only look for jobs in repositories + where Actions are enabled + - PR (backported): fix: prevent stuck runner jobs when + FetchTask performance is slower than client-side timeout + - PR (backported): fix: enable reverse-proxy authentication on + git routes + - PR (backported): fix oauth2: Initialize gothic even if oauth2 + is disabled + - PR (backported): fix: suppress git subcommand errors caused + by context cancellation involving SIGTERM + - PR (backported): fix: multiple session middlewares have + independent in-memory state + - Included for completeness but not user-facing (chores, etc.) + - PR: Update module github.com/go-ldap/ldap/v3 to v3.4.14 + (v16.0/forgejo) + - PR: Update module github.com/klauspost/compress to v1.18.7 + [SECURITY] (v16.0/forgejo) + - PR (backported): add forgejo and pagure to the swagger api + definition + - PR: Update module github.com/go-chi/chi/v5 to v5.3.0 + [SECURITY] (v16.0/forgejo) + - PR: Update dependency postcss to v8.5.18 [SECURITY] + (v16.0/forgejo) + - PR: Update module golang.org/x/text to v0.39.0 [SECURITY] + (v16.0/forgejo) + - PR: Update module code.forgejo.org/forgejo/runner/v12 to + v12.13.2 (v16.0/forgejo) + - PR: Update google.golang.org/grpc (indirect) to v1.82.1 + [SECURITY] (v16.0/forgejo) + - PR (backported): chore: document + SSH_ALLOW_UNEXPECTED_AUTHORIZED_KEYS + - PR: Update dependency svgo to v4.0.2 [SECURITY] + (v16.0/forgejo) + +------------------------------------------------------------------- +Tue Jul 28 15:01:04 UTC 2026 - Marcus Rueckert <[email protected]> + +- Apparmor: + update profile for centralized git hooks + +------------------------------------------------------------------- Old: ---- forgejo-src-16.0.1.tar.gz forgejo-src-16.0.1.tar.gz.asc New: ---- forgejo-src-16.0.2.tar.gz forgejo-src-16.0.2.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ forgejo.spec ++++++ --- /var/tmp/diff_new_pack.kHjTy7/_old 2026-07-31 16:07:12.424219448 +0200 +++ /var/tmp/diff_new_pack.kHjTy7/_new 2026-07-31 16:07:12.424219448 +0200 @@ -25,7 +25,7 @@ %bcond_without apparmor %endif Name: forgejo -Version: 16.0.1 +Version: 16.0.2 Release: 0 Summary: Self-hostable forge License: GPL-3.0-or-later ++++++ forgejo-hooks-abstraction.apparmor ++++++ --- /var/tmp/diff_new_pack.kHjTy7/_old 2026-07-31 16:07:12.512222510 +0200 +++ /var/tmp/diff_new_pack.kHjTy7/_new 2026-07-31 16:07:12.516222649 +0200 @@ -7,4 +7,5 @@ /usr/bin/env rPx -> forgejo//simple_tool, /usr/bin/cat rPx -> forgejo//simple_tool, /usr/bin/basename rPx -> forgejo//simple_tool, + /usr/bin/dirname rPx -> forgejo//simple_tool, ++++++ forgejo-src-16.0.1.tar.gz -> forgejo-src-16.0.2.tar.gz ++++++ /work/SRC/openSUSE:Factory/forgejo/forgejo-src-16.0.1.tar.gz /work/SRC/openSUSE:Factory/.forgejo.new.2004/forgejo-src-16.0.2.tar.gz differ: char 14, line 1 ++++++ forgejo.apparmor ++++++ --- /var/tmp/diff_new_pack.kHjTy7/_old 2026-07-31 16:07:12.560224180 +0200 +++ /var/tmp/diff_new_pack.kHjTy7/_new 2026-07-31 16:07:12.560224180 +0200 @@ -5,6 +5,7 @@ @{APP_DATADIR} = /var/lib/forgejo @{APP_LOGDIR} = /var/log/forgejo @{APP_REPOSITORY_DIRS} = @{APP_DATADIR}/data/forgejo-repositories @{APP_DATADIR}/repositories +@{APP_HOOKS_DIRS} = @{APP_DATADIR}/data/home/hooks @{APP_REPOSITORY_DIRS}/*/*/hooks profile forgejo /usr/bin/forgejo flags=(attach_disconnected) { include <abstractions/forgejo> @@ -79,11 +80,10 @@ owner @{APP_REPOSITORY_DIRS}/ r, owner @{APP_REPOSITORY_DIRS}/** rwlk, - owner @{APP_REPOSITORY_DIRS}/*/*.git/hooks/pre-receive Px -> forgejo//hooks-pre-receive, - owner @{APP_REPOSITORY_DIRS}/*/*.git/hooks/post-receive Px -> forgejo//hooks-post-receive, - owner @{APP_REPOSITORY_DIRS}/*/*.git/hooks/proc-receive Px -> forgejo//hooks-proc-receive, - - owner @{APP_REPOSITORY_DIRS}/*/*.git/hooks/update Px -> forgejo//hooks-update, + owner @{APP_HOOKS_DIRS}/pre-receive Px -> forgejo//hooks-pre-receive, + owner @{APP_HOOKS_DIRS}/post-receive Px -> forgejo//hooks-post-receive, + owner @{APP_HOOKS_DIRS}/proc-receive Px -> forgejo//hooks-proc-receive, + owner @{APP_HOOKS_DIRS}/update Px -> forgejo//hooks-update, owner @{APP_DATADIR}/data/tmp/local-repo/pull.*/ r, owner @{APP_DATADIR}/data/tmp/local-repo/pull.*/** rwlk, @@ -127,9 +127,9 @@ profile hooks-pre-receive { include <abstractions/forgejo-hooks> - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/pre-receive r, - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/pre-receive.d/ r, - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/pre-receive.d/gitea Px -> forgejo//hooks-gitea, + owner @{APP_HOOKS_DIRS}/pre-receive r, + owner @{APP_HOOKS_DIRS}/pre-receive.d/ r, + owner @{APP_HOOKS_DIRS}/pre-receive.d/gitea Px -> forgejo//hooks-gitea, include if exists <forgejo.d/hooks-pre-receive.d> include if exists <local/forgejo-hooks-pre-receive> @@ -138,9 +138,9 @@ profile hooks-post-receive { include <abstractions/forgejo-hooks> - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/post-receive r, - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/post-receive.d/ r, - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/post-receive.d/gitea Px -> forgejo//hooks-gitea, + owner @{APP_HOOKS_DIRS}/post-receive r, + owner @{APP_HOOKS_DIRS}/post-receive.d/ r, + owner @{APP_HOOKS_DIRS}/post-receive.d/gitea Px -> forgejo//hooks-gitea, include if exists <forgejo.d/hooks-post-receive.d> include if exists <local/forgejo-hooks-post-receive> @@ -149,9 +149,9 @@ profile hooks-proc-receive { include <abstractions/forgejo-hooks> - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/proc-receive r, - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/proc-receive.d/ r, - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/proc-receive.d/gitea Px -> forgejo//hooks-gitea, + owner @{APP_HOOKS_DIRS}/proc-receive r, + owner @{APP_HOOKS_DIRS}/proc-receive.d/ r, + owner @{APP_HOOKS_DIRS}/proc-receive.d/gitea Px -> forgejo//hooks-gitea, include if exists <forgejo.d/hooks-proc-receive.d> include if exists <local/forgejo-hooks-proc-receive> @@ -160,9 +160,9 @@ profile hooks-update { include <abstractions/forgejo-hooks> - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/update r, - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/update.d/ r, - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/update.d/gitea Px -> forgejo//hooks-gitea, + owner @{APP_HOOKS_DIRS}/update r, + owner @{APP_HOOKS_DIRS}/update.d/ r, + owner @{APP_HOOKS_DIRS}/update.d/gitea Px -> forgejo//hooks-gitea, include if exists <forgejo.d/hooks-update.d> include if exists <local/forgejo-hooks-update> @@ -171,7 +171,7 @@ profile hooks-gitea { include <abstractions/forgejo-hooks> - owner @{APP_REPOSITORY_DIRS}/*/*/hooks/*.d/gitea r, + owner @{APP_HOOKS_DIRS}/*.d/gitea r, /usr/bin/forgejo Px -> forgejo//forgejo-hooks, } @@ -181,6 +181,7 @@ /usr/bin/env rm, /usr/bin/cat rm, /usr/bin/basename rm, + /usr/bin/dirname rm, } } ++++++ node_modules.obscpio ++++++ /work/SRC/openSUSE:Factory/forgejo/node_modules.obscpio /work/SRC/openSUSE:Factory/.forgejo.new.2004/node_modules.obscpio differ: char 485671519, line 1671762 ++++++ node_modules.spec.inc ++++++ --- /var/tmp/diff_new_pack.kHjTy7/_old 2026-07-31 16:07:13.428254383 +0200 +++ /var/tmp/diff_new_pack.kHjTy7/_new 2026-07-31 16:07:13.432254522 +0200 @@ -935,7 +935,7 @@ Source10934: https://registry.npmjs.org/points-on-path/-/points-on-path-0.2.1.tgz#/points-on-path-0.2.1.tgz Source10935: https://registry.npmjs.org/pony-cause/-/pony-cause-1.1.1.tgz#/pony-cause-1.1.1.tgz Source10936: https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz#/possible-typed-array-names-1.1.0.tgz -Source10937: https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz#/postcss-8.5.15.tgz +Source10937: https://registry.npmjs.org/postcss/-/postcss-8.5.18.tgz#/postcss-8.5.18.tgz Source10938: https://registry.npmjs.org/postcss-html/-/postcss-html-1.8.1.tgz#/postcss-html-1.8.1.tgz Source10939: https://registry.npmjs.org/postcss-import/-/postcss-import-15.1.0.tgz#/postcss-import-15.1.0.tgz Source10940: https://registry.npmjs.org/postcss-js/-/postcss-js-4.1.0.tgz#/postcss-js-4.1.0.tgz @@ -1069,7 +1069,7 @@ Source11068: https://registry.npmjs.org/supports-hyperlinks/-/supports-hyperlinks-3.2.0.tgz#/supports-hyperlinks-3.2.0.tgz Source11069: https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz#/supports-preserve-symlinks-flag-1.0.0.tgz Source11070: https://registry.npmjs.org/svg-tags/-/svg-tags-1.0.0.tgz#/svg-tags-1.0.0.tgz -Source11071: https://registry.npmjs.org/svgo/-/svgo-4.0.1.tgz#/svgo-4.0.1.tgz +Source11071: https://registry.npmjs.org/svgo/-/svgo-4.0.2.tgz#/svgo-4.0.2.tgz Source11072: https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-5.32.6.tgz#/swagger-ui-dist-5.32.6.tgz Source11073: https://registry.npmjs.org/sync-fetch/-/sync-fetch-0.4.5.tgz#/sync-fetch-0.4.5.tgz Source11074: https://registry.npmjs.org/table/-/table-6.9.0.tgz#/table-6.9.0.tgz ++++++ package-lock.json ++++++ --- /var/tmp/diff_new_pack.kHjTy7/_old 2026-07-31 16:07:13.472255914 +0200 +++ /var/tmp/diff_new_pack.kHjTy7/_new 2026-07-31 16:07:13.480256192 +0200 @@ -60,7 +60,7 @@ "mini-css-extract-plugin": "2.10.0", "minimatch": "10.2.5", "pdfobject": "2.3.0", - "postcss": "8.5.15", + "postcss": "8.5.18", "postcss-loader": "8.2.1", "postcss-nesting": "14.0.0", "pretty-ms": "9.0.0", @@ -119,7 +119,7 @@ "stylelint-declaration-strict-value": "1.11.1", "stylelint-plugin-logical-css": "2.1.0", "stylelint-value-no-unknown-custom-properties": "6.1.1", - "svgo": "4.0.1", + "svgo": "4.0.2", "typescript": "5.9.3", "typescript-eslint": "8.60.1", "vite-string-plugin": "2.0.4", @@ -13003,9 +13003,9 @@ } }, "node_modules/postcss": { - "version": "8.5.15", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz";, - "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==", + "version": "8.5.18", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.18.tgz";, + "integrity": "sha512-xdB1oSLHbz1vRWgCDalrCqEFTWzFlhqFC5tIHLMOSUIjhm3XXQ1qrFy8S/ESr1JYRRXqM3c1QFiMZUJdUTqyMQ==", "funding": [ { "type": "opencollective", @@ -15060,9 +15060,9 @@ "dev": true }, "node_modules/svgo": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/svgo/-/svgo-4.0.1.tgz";, - "integrity": "sha512-XDpWUOPC6FEibaLzjfe0ucaV0YrOjYotGJO1WpF0Zd+n6ZGEQUsSugaoLq9QkEZtAfQIxT42UChcssDVPP3+/w==", + "version": "4.0.2", + "resolved": "https://registry.npmjs.org/svgo/-/svgo-4.0.2.tgz";, + "integrity": "sha512-ekx94z1rRc5LDi6oSUaeRnYhd0UOJxdtQCL2rF8xpWxD3TPAsISWOrxezqGovqS38GRZOdpDfvQe3ts6F7nsng==", "dev": true, "license": "MIT", "dependencies": {
