3 people 6195cda58f fix(actions): bound request body size in artifacts v4 twirp handlers (#39818) (#39822) ...

Backport #39818 by @SHIVANSHGARG07

parseProtobufBody read the full Twirp request body via io.ReadAll with
no size limit, allowing an authenticated runner token holder to force
unbounded memory allocation. Cap it at 1 MiB via io.LimitReader,
matching the existing pattern in job_summary.go.

Fixes https://github.com/go-gitea/gitea/issues/39814

Co-authored-by: Shivansh Garg <shivanshgarg587@gmail.com>

2026-10-17 23:17:45 -07:00

..

api

fix(actions): bound request body size in artifacts v4 twirp handlers (#39818) (#39822)

2026-10-17 23:17:45 -07:00

common

fix(api): allow bots with pending password changes (#39551) (#39566)

2026-10-03 19:19:44 +00:00

install

refactor: "install" page (#39400)

2026-09-23 23:14:31 +00:00

private

fix: various bugs (#39661) (#39667)

2026-10-07 10:11:58 -07:00

utils

Refactor flash message and remove SanitizeHTML template func (#37179)

2026-04-12 10:17:25 +08:00

web

fix: correct label deletion and release attachment load (#39743) (#39752)

2026-10-13 00:53:02 +00:00

init.go

fix(git)!: use internal proxy for all git operations (#39426)

2026-09-29 14:43:36 +02:00