3 people 6195cda58f fix(actions): bound request body size in artifacts v4 twirp handlers (#39818) (#39822) ...

Backport #39818 by @SHIVANSHGARG07

parseProtobufBody read the full Twirp request body via io.ReadAll with
no size limit, allowing an authenticated runner token holder to force
unbounded memory allocation. Cap it at 1 MiB via io.LimitReader,
matching the existing pattern in job_summary.go.

Fixes https://github.com/go-gitea/gitea/issues/39814

Co-authored-by: Shivansh Garg <shivanshgarg587@gmail.com>

2026-10-17 23:17:45 -07:00

..

ping

refactor: use the shared workflow model from actionslib (#38768)

2026-08-07 20:56:40 -07:00

runner

revert: return 401 for unregistered runner (#39599)

2026-10-04 22:04:11 -07:00

actions.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

artifact.pb.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

artifact.proto

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

artifacts_chunks.go

feat(actions)!: add RUN_RETENTION_DAYS to delete old action runs (#38855)

2026-08-22 21:32:59 +00:00

artifacts_utils.go

chore: misc go 1.27 tweaks (#39069)

2026-08-24 18:26:10 +00:00

artifacts.go

fix(httplib): prevent leaking localhost:3000 in public links (#39217)

2026-09-02 19:32:33 +00:00

artifactsv4.go

fix(actions): bound request body size in artifacts v4 twirp handlers (#39818) (#39822)

2026-10-17 23:17:45 -07:00

job_summary.go

feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)

2026-06-08 19:11:00 +00:00