4 people 4b743d2e8c fix(packages): reject newline-bearing rubygems dependency metadata (#39782) (#39900) ...

Backport #39782 by @basavaraj-sm05

The RubyGems compact index (the shared `/versions` file and per-package
`info/<name>` files) is line-based.
https://github.com/go-gitea/gitea/pull/38061 rejected line breaks in the
gem name, but the platform, dependency names and version requirements
from the gemspec still accepted them, letting an uploader forge index
lines for bundler clients.

The parser now rejects a line break in any of those fields. The Marshal
based endpoints are length prefixed and unaffected.

Co-authored-by: Basavaraj S m <basavaraj@digiscrypt.com>
Co-authored-by: silverwind <me@silverwind.io>

2026-10-21 05:24:52 +00:00

..

actions

fix(actions): keep folded block scalars intact across serialization (#39787) (#39817)

2026-10-17 03:15:42 +00:00

analyze

Fix incorrect vendored detections (#36508)

2026-02-01 10:35:51 +00:00

assetfs

chore(deps): update go toolchain directive to v1.27.2 (#39685) (#39687)

2026-10-08 11:25:28 -07:00

auth

fix(webauthn): accept unsolicited client extension outputs from WebKit clients (#39792) (#39806)

2026-10-16 09:28:24 +00:00

avatar

chore: misc go 1.27 tweaks (#39069)

2026-08-24 18:26:10 +00:00

badge

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

base

refactor: drop two unmaintained dependencies, rename the byte size helpers (#39083)

2026-08-27 15:31:20 +00:00

cache

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

cachegroup

Cache GPG keys, emails and users when list commits (#34086)

2025-04-09 16:34:38 +00:00

charset

fix(markup): don't escape ambiguous characters in MathML (#39493) (#39505)

2026-09-30 16:56:23 +00:00

commitstatus

Update Combine method to treat warnings as failures and adjust tests (#37048)

2026-03-31 17:22:18 +00:00

consts

feat(ssh): auto generate additional ssh keys (#33974)

2026-06-08 18:18:58 +00:00

container

fix: make auth source group sync correctly handle team removal (#37161)

2026-07-24 02:05:38 +00:00

csv

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

dump

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

egress

fix(egress): expose more ranges as restricted rather than reserved (#39560) (#39624)

2026-10-06 15:24:11 +08:00

emoji

enhance(emoji): update to Unicode 17, unify and lazy-load emoji data (#39363)

2026-09-24 20:23:15 +00:00

fileicon

refactor: decouple git.Repository(ctx) from git.Commit & git.Tree (#38464)

2026-07-15 17:30:01 +00:00

generate

feat(ssh): auto generate additional ssh keys (#33974)

2026-06-08 18:18:58 +00:00

git

fix: use clear error message when failed to parse git version (#39898) (#39903)

2026-10-21 04:35:32 +00:00

glob

fix(actions): harden log cursor, activity type and actor filter handling (#39721) (#39731)

2026-10-10 20:23:39 +00:00

globallock

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

graceful

fix(process): reap entire process group on cmd.Cancel (#39143)

2026-08-29 19:54:07 +00:00

gtprof

fix: trace git command correctly (#39520) (#39524)

2026-10-01 10:19:33 +00:00

hcaptcha

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

highlight

refactor: render highlight language (#38793)

2026-08-06 18:07:36 +08:00

htmlutil

fix(markup): resolve and proxy srcset links of <source> elements (#39708) (#39756)

2026-10-13 15:46:51 +08:00

httpcache

fix(httpcache): raw files return 304 after a change when the new commit is older (#39435) (#39591)

2026-10-04 13:39:06 +00:00

httplib

feat(actions): Add artifact preview in Actions run view (#36754)

2026-09-26 07:42:36 +00:00

indexer

fix(indexer): index full file paths and real offsets in bleve (#39405)

2026-09-24 07:57:42 +00:00

issue/template

refactor: http request binding (#38971)

2026-08-19 14:15:42 +08:00

json

enhance(packages/npm): improve npm client compatibility (#39434) (#39522)

2026-10-01 08:09:21 +00:00

label

enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)

2026-05-29 01:12:11 +00:00

lfs

fix(lfs): validate OID before building filesystem object path (#39762) (#39766)

2026-10-13 17:19:59 -07:00

lfstransfer

fix: add default timeout and handle errors for HaveIBeenPwned API (#39316)

2026-09-16 20:41:57 +02:00

log

fix(ssh): fetch ssh key by fingerprint (#39423)

2026-09-25 06:22:04 -07:00

markup

fix(markup): resolve and proxy srcset links of <source> elements (#39708) (#39756)

2026-10-13 15:46:51 +08:00

mcaptcha

refactor: implement mcaptcha client and add comments/tests (#38561)

2026-07-21 13:41:54 +00:00

metrics

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

migration

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

nosql

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

optional

enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)

2026-05-29 01:12:11 +00:00

options

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

packages

fix(packages): reject newline-bearing rubygems dependency metadata (#39782) (#39900)

2026-10-21 05:24:52 +00:00

paginator

feat(ui): add "follow rename" to file commit history list (#34994)

2026-06-03 17:40:38 +00:00

pprof

refactor: fix legacy problems in cmd/serv.go (#38505)

2026-07-17 22:28:59 +08:00

private

fix: various bugs (#39661) (#39667)

2026-10-07 10:11:58 -07:00

process

fix(process): reap entire process group on cmd.Cancel (#39143)

2026-08-29 19:54:07 +00:00

proxy

fix(git)!: use internal proxy for all git operations (#39426)

2026-09-29 14:43:36 +02:00

proxyprotocol

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

public

enhance(emoji): update to Unicode 17, unify and lazy-load emoji data (#39363)

2026-09-24 20:23:15 +00:00

queue

fix: make local queue PopItem can be notified (#39011)

2026-08-22 01:30:41 +00:00

recaptcha

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

references

fix(markup): link team mentions that use a different org name case (#39436) (#39588)

2026-10-04 13:10:58 +00:00

regexplru

fix: correct stdErr match in isErrBlameNotFoundOrNotEnoughLines (#39309)

2026-09-14 14:59:18 +00:00

repository

fix: PR merge (#39442)

2026-09-26 17:38:42 +00:00

reqctx

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

secret

Upgrade golangci-lint to v1.64.5 (#33654)

2025-02-21 00:05:40 +08:00

session

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

setting

enhance(oauth): pre-register a builtin OAuth2 application for gitea-vscode (#39785) (#39801)

2026-10-16 12:40:16 -07:00

sitemap

chore: fix form string abuse (#38106)

2026-06-14 18:26:22 +00:00

ssh

fix(ssh): fetch ssh key by fingerprint (#39423)

2026-09-25 06:22:04 -07:00

storage

fix: correct RemoveWithRetry error handling (#39619) (#39626)

2026-10-06 09:36:06 +00:00

structs

docs(webhook): review.type comment lists values the webhook never sends (#39451)

2026-09-27 00:32:14 +02:00

svg

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

system

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

tailmsg

Support performance trace (#32973)

2025-01-21 18:57:07 +00:00

tempdir

refactor: retry file remove/rename when a file is busy and clean up os detection (#38588)

2026-07-23 14:31:29 +00:00

templates

fix(feed): use meaningful lines as comment excerpt (#39276)

2026-09-25 03:08:15 +00:00

test

fix(repo): commit page fails to render unsigned commits with a different committer (#39381)

2026-09-23 14:34:19 +00:00

testlogger

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

timeutil

chore: refactor StaticRootPath (#39384)

2026-09-22 22:49:36 +08:00

translation

chore: form binding trim space (#38978)

2026-08-19 12:50:06 +00:00

turnstile

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

typesniffer

Feature non-zipped actions artifacts (action v7) (#36786)

2026-03-26 00:37:48 +08:00

updatechecker

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

uri

fix: various security fixes (#38406)

2026-07-12 17:14:09 +00:00

user

Refactor older tests to use testify (#33140)

2025-01-09 09:21:47 +08:00

util

fix: correct RemoveWithRetry error handling (#39619) (#39626)

2026-10-06 09:36:06 +00:00

validation

fix: various bugs (#39661) (#39667)

2026-10-07 10:11:58 -07:00

web

chore(deps): update go toolchain directive to v1.27.2 (#39685) (#39687)

2026-10-08 11:25:28 -07:00

webhook

actions: report commit status for pull_request_review events (#36589)

2026-02-20 16:12:22 +00:00

zstd

chore(deps): upgrade zstd seekable package (#37988)

2026-06-04 13:38:56 +00:00