4 people 4b743d2e8c fix(packages): reject newline-bearing rubygems dependency metadata (#39782) (#39900) ...

Backport #39782 by @basavaraj-sm05

The RubyGems compact index (the shared `/versions` file and per-package
`info/<name>` files) is line-based.
https://github.com/go-gitea/gitea/pull/38061 rejected line breaks in the
gem name, but the platform, dependency names and version requirements
from the gemspec still accepted them, letting an uploader forge index
lines for bundler clients.

The parser now rejects a line break in any of those fields. The Marshal
based endpoints are length prefixed and unaffected.

Co-authored-by: Basavaraj S m <basavaraj@digiscrypt.com>
Co-authored-by: silverwind <me@silverwind.io>

2026-10-21 05:24:52 +00:00

..

alpine

chore: update Go to v1.27 (#39068)

2026-08-24 07:28:17 +00:00

arch

fix: drop newline-bearing member names in arch ParsePackage (#38102)

2026-08-07 20:47:33 +00:00

cargo

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

chef

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

composer

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

conan

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

conda

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

container

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

cran

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

debian

fix: various security fixes (#38406)

2026-07-12 17:14:09 +00:00

goproxy

fix(packages): validate module version in goproxy ParsePackage (#38104)

2026-06-15 19:14:14 +02:00

helm

feat(packages): add support for uploading helm provenance files (#36695)

2026-08-09 12:55:43 +00:00

maven

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

npm

fix(packages/npm): restore former tarball URLs (#39681) (#39749)

2026-10-12 20:10:28 +02:00

nuget

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

pub

enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)

2026-05-29 01:12:11 +00:00

pypi

Implement FSFE REUSE for golang files (#21840)

2022-11-27 18:20:29 +00:00

rpm

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

rubygems

fix(packages): reject newline-bearing rubygems dependency metadata (#39782) (#39900)

2026-10-21 05:24:52 +00:00

swift

fix(packages): limit Swift package manifests (#39025)

2026-08-22 00:11:29 +00:00

terraform

refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)

2026-06-27 10:24:02 -07:00

vagrant

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

content_store.go

fix: restore missing blob file when re-publishing a package (#39239)

2026-09-05 10:33:36 +02:00

filelist.go

fix: various security fixes (#38406)

2026-07-12 17:14:09 +00:00

hashed_buffer_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

hashed_buffer.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

multi_hasher_test.go

Replace fmt.Sprintf with hex.EncodeToString (#21960)

2022-11-28 11:19:18 +00:00

multi_hasher.go

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00