bircni bc578b7eba fix: Various sec fixes (#38108) (#38147) ...

Backport #38108

- Enforce repository token scope on RSS/Atom feed endpoints so a PAT
without repo scope can no longer read private repo commit data.
- Block HTTP redirects during repository migration clones to prevent
SSRF reaching internal addresses via an attacker-controlled redirect.
- Redact the notification subject after repo access is revoked so
private issue/PR metadata is no longer leaked through the notification
API.

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

2026-06-28 02:18:12 -05:00

..

actions

feat: workflow subdirectory discovery + move custom workflows to custom/ (#693)

2026-06-27 14:34:46 -05:00

analyze

feat: add .mokogitea directory support alongside .gitea and .github

2026-05-15 20:19:43 -05:00

assetfs

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

auth

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

avatar

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

badge

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

base

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

cache

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

cachegroup

Cache GPG keys, emails and users when list commits (#34086)

2025-04-09 16:34:38 +00:00

charset

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

commitstatus

Update Combine method to treat warnings as failures and adjust tests (#37048)

2026-03-31 17:22:18 +00:00

container

Refactor sidebar assignee&milestone&project selectors (#32465)

2024-11-11 04:07:54 +08:00

csv

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

dump

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

emoji

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

eventsource

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

fileicon

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

generate

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

git

fix: Various sec fixes (#38108) (#38147)

2026-06-28 02:18:12 -05:00

gitrepo

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

glob

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

globallock

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

graceful

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

gtprof

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

hcaptcha

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

highlight

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

hostmatcher

fix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)

2026-06-28 02:17:27 -05:00

htmlutil

Fix markup heading parsing, fix emphasis parsing (#36284)

2026-01-23 20:24:58 +00:00

httpcache

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

httplib

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

indexer

feat(issues): advanced search with custom field filters (#496)

2026-06-06 06:06:32 -05:00

issue/template

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

json

Fix corrupted JSON caused by goccy library (#37214) (#37220)

2026-04-14 17:24:39 +00:00

label

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

lfs

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

lfstransfer

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

log

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

markup

fix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)

2026-06-26 21:40:23 -05:00

mcaptcha

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

metrics

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

migration

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

nosql

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

optional

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

options

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

packages

fix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)

2026-06-28 02:17:28 -05:00

paginator

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

pprof

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

private

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

process

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

proxy

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

proxyprotocol

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

public

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

queue

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

recaptcha

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

references

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

regexplru

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

repository

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

reqctx

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

secret

Upgrade golangci-lint to v1.64.5 (#33654)

2025-02-21 00:05:40 +08:00

session

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

setting

fix: "run as root" check (#37622) (#37625)

2026-06-26 21:37:42 -05:00

sitemap

Fix sitemap (#22272)

2022-12-30 23:31:00 +08:00

ssh

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

storage

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

structs

feat: add delete allowlist for branch protection rules (#696)

2026-06-27 15:35:13 -05:00

svg

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

system

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

tailmsg

Support performance trace (#32973)

2025-01-21 18:57:07 +00:00

tempdir

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

templates

fix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)

2026-06-26 21:40:23 -05:00

test

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

testlogger

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

timeutil

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

translation

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

turnstile

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

typesniffer

Feature non-zipped actions artifacts (action v7) (#36786)

2026-03-26 00:37:48 +08:00

updatechecker

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

uri

Implement FSFE REUSE for golang files (#21840)

2022-11-27 18:20:29 +00:00

user

Refactor older tests to use testify (#33140)

2025-01-09 09:21:47 +08:00

util

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

validation

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

web

chore: rename Go module from git. to code.mokoconsulting.tech (#336)

2026-05-31 10:28:25 -05:00

webhook

actions: report commit status for pull_request_review events (#36589)

2026-02-20 16:12:22 +00:00

zstd

Refactor embedded assets and drop unnecessary dependencies (#34692)

2025-06-12 03:59:33 +00:00