Nulo/forgejo
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
forgejo/RELEASE-NOTES.md
Loïc Dachary aa7c9f4f99
[DOCS] RELEASE-NOTES: 1.19.0 
(cherry picked from commit e84e43887beae3a2f18afb8ef71fdc17078413bc)

[DOCS] RELEASE-NOTES: add scoped access tokens

(cherry picked from commit 688f831853ef179d511cc7594dd23cc46ccef654)

[DOCS] RELEASE-NOTES: Scoped labels

(cherry picked from commit 747479a07b3b7b329016337025eddbc82c4073a4)

[DOCS] RELEASE-NOTES: OIDC groups

(cherry picked from commit 10c505fe8941b81824f08e4c6a39d12517c182bc)

[DOCS] RELEASE-NOTES: Copy Link is broken

On firefox it fails with Uncaught TypeError: navigator.clipboard is
   undefined
On chromium it fails with Uncaught TypeError: Cannot read properties of undefined (reading 'writeText')

(cherry picked from commit 148b2ff093fa87672aa09d09484b7803bbdecc39)

[DOCS] RELEASE-NOTES: Copy citation

(cherry picked from commit d0f217735f506d0f4fb414f38860d821cd1925b5)

[DOCS] RELEASE-NOTES: Support org/user level projects

(cherry picked from commit de845c7bcf4637f442a612fafb6a663c7dc69473)

[DOCS] RELEASE-NOTES: v1.19 has a documentation

(cherry picked from commit 9a5b46da32fa12c32215a0c0a8b233c14a10c9b0)

[DOCS] RELEASE-NOTES: do not split webhook section

(cherry picked from commit 00ed02032124ca75644ec2365f054c56d7e68d20)

[DOCS] RELEASE-NOTES: Incoming emails

(cherry picked from commit 06c455b33bf39a7595a31a983dbaab7e28795f55)

[DOCS] RELEASE-NOTES: secrets are an implementation detail

(cherry picked from commit 8236dc3a573f9cdb892894416268d3a115c77fd1)

[DOCS] RELEASE-NOTES: Prohibit fork if user reached maximum

(cherry picked from commit 0f80b8c696ef8c407466605588f341b710a023ab)

[DOCS] RELEASE-NOTES: scoped tokens: do not duplicate the docs

(cherry picked from commit 9bc4793c078e115ab5d59fda89fb43765dcb0526)

[DOCS] RELEASE-NOTES: rss feed for tags and releases

(cherry picked from commit 599b36fada5f12a3fb4e0eed4f787606af701e46)

[DOCS] RELEASE-NOTES: protected branches wildcard

(cherry picked from commit 2b316c495056b9ae9191f51f550eb0a5c76ae6c1)

[DOCS] RELEASE-NOTES: disable releases

(cherry picked from commit 9a60773f1dcaf241b43707c2009e0223d0b3eed9)

[DOCS] RELEASE-NOTES: review box

(cherry picked from commit 09867dd1220c66c6ad468f9f0a0a22740510f373)

[DOCS] RELEASE-NOTES: asciicast support

(cherry picked from commit ea9658379b25f9c1dec487fd5d9139d37735e113)

[DOCS] RELEASE-NOTES: attention blocks

(cherry picked from commit 70b387750b2fea65e68aa2b1486ffcfef0dbd2fd)

[DOCS] RELEASE-NOTES: commit cross reference

(cherry picked from commit fe706dad13db9f3ad4fd6699b20337712e7a674b)

[DOCS] RELEASE-NOTES: strip user completion border case

(cherry picked from commit 33ca51b4b699ba347d395796d80eebab09b1a2f6)

[DOCS] RELEASE-NOTES: card preview

(cherry picked from commit 626cd78ca6d2c95dcd90c33d0f9e3e99f48912e7)

[DOCS] RELEASE-NOTES: raw copy button

(cherry picked from commit edfb467d64190df7b8056e5ced164678ea5a1ea7)

[DOCS] RELEASE-NOTES: allow edits by maintainers by default

(cherry picked from commit 7006405bc6113f4b7acd26d91d1f928022d00bdf)

[DOCS] RELEASE-NOTES: database auto migration is a little arcane

(cherry picked from commit 78030fa9af4a05e2092d54e18e7b2dee2037c299)

[DOCS] RELEASE-NOTES: fix typos & minor rewording

(cherry picked from commit ae1d47f656df2c11c140095d8710361ebe545af5)
(cherry picked from commit ad08ca9955304663367fa66e8d2097b78bc5b438)

[DOCS] RELEASE-NOTES: webhook authorization header

(cherry picked from commit c35e2c4f6f985be5763363ae2b03e5d23378f0d2)

[DOCS] RELEASE-NOTES: video element in markdown

(cherry picked from commit bcb0bd51d2114a7f086358b568928c3feeefea57)

[DOCS] RELEASE-NOTES: move scoped labels to the documentation

(cherry picked from commit c5eedaf4f398ca232ca65f132d504425dd8ac3ba)

[DOCS] RELEASE-NOTES: cosmetic improvements

(cherry picked from commit b93df350d96c0cb8b6b6b924a1dd8af1551f2263)

[DOCS] RELEASE-NOTES: 1.19.0-0 is really : 1.19.0-2

(cherry picked from commit 60d770c2c95d841c597f619e73582bbdfcdb0143)

[DOCS] RELEASE-NOTES: relevant repositories

(cherry picked from commit de6ed5b87f845bb86f4d3aa4085f373958797ebe)
(cherry picked from commit 71d91fdf22d04cb8d0c88eac87a9a59e1c558bd7)

[DOCS] RELEASE-NOTES: semantic version

(cherry picked from commit af062d77f0641426aa048e5975585b01652aea01)

[DOCS] RELEASE-NOTES: reflogs

(cherry picked from commit 084713d8aae787e2db76219f29840f006967ff92)
(cherry picked from commit 9f76fe16614d358b7e9ae116f27c84d3598a7e26)
(cherry picked from commit e97834a439b4abc770689d8b9902fc9379650990)
(cherry picked from commit 60865f6966542b77baa83f9f419711b7fb7b0fd9)
(cherry picked from commit d4d6046f98561d248bacee8d18b18f584c613942)
(cherry picked from commit 2bbe36116ee403e0e98532f6dd8a3fcf9bce35e9)
(cherry picked from commit 73c4e9baa92ca5c7e02ad1561a9451a9b4bb17a6)
2023-05-10 09:20:14 +02:00

51 KiB
Raw Permalink Blame History

Release Notes

A Forgejo release is published shortly after a Gitea release is published and they have matching release numbers. Additional Forgejo releases may be published to address urgent security issues or bug fixes. Forgejo release notes include all Gitea release notes.

The Forgejo admin should carefully read the required manual actions before upgrading. A point release (e.g. v1.19.1 or v1.19.2) does not require manual actions but others might (e.g. v1.18.0, v1.19.0).

1.19.0-2

The complete list of commits included in the Forgejo v1.19.0-2 release can be reviewed from the command line with:

$ git clone https://codeberg.org/forgejo/forgejo/
$ git -C forgejo log --oneline --no-merges origin/v1.18/forgejo..origin/v1.19/forgejo

  • Breaking changes

    • Scoped access tokens

      Forgejo access token, used with the API can now have a "scope" that limits what it can access. Existing tokens stored in the database and created before Forgejo v1.19 had unlimited access. For backward compatibility, their access will remain the same and they will continue to work as before. However, newly created token that do not specify a scope will now only have read-only access to public user profile and public repositories.

      For instance, the /users/{username}/tokens API endpoint will require the scopes: ['all', 'sudo'] parameter and the forgejo admin user generate-access-token will require the --scopes all,sudo argument obtain tokens with ulimited access as before for admin users.

      Read more about the scoped tokens.

    • Disable all units except code and pulls on forks

      When forking a repository, the fork will now have issues, projects, releases, packages and wiki disabled. These can be enabled in the repository settings afterwards. To change back to the previous default behavior, configure DEFAULT_FORK_REPO_UNITS to be the same value as DEFAULT_REPO_UNITS.

    • Filter repositories by default on the explore page

      The explore page now always filters out repositories that are considered not relevant because they are either forks or have no topic and not description and no icon. A link is shown to display all repositories, unfiltered.

      Explore repositories

    • Remove deprecated DSA host key from Docker Container Since OpenSSH 7.0 and greater similarly disable the ssh-dss (DSA) public key algorithm, and recommend against its use. http://www.openssh.com/legacy.html

    • Additional restrictions on valid user names

      The algorithm for validating user names was modified and some users may have invalid names. The command forgejo doctor --run check-user-names will list all of them so they can be renamed.

      If a Forgejo instance has users or organizations named forgejo-actions and gitea-actions, they will also need to be renamed before the upgrade. They are now reserved names for the experimental internal CI/CD named Actions.

  • Features

  • User Interface improvements

  • Container images upgraded to Alpine 3.17

    The Forgejo container images are now based on Alpine 3.17 instead of Alpine 3.16. It includes an upgrade from git 2.36.5 to git 2.38.4 and from openssh 9.0p1 to openssh 9.1p1.

1.18.5-0

This stable release contains an important security fix for Forgejo to raise the protection against brute force attack on hashed passwords stored in the database to match industry standards, as described in detail in a companion blog post.

Recommended Action

We strongly recommend that all Forgejo installations are upgraded to the latest version as soon as possible.

If PASSWORD_HASH_ALGO is explicitly set in app.ini, comment it out so that the stronger algorithm is used instead.

All password hashes stored with another algorithm will be updated to the new algorithm on the next usage of this password (e.g. a user provides the password to the Forgejo server when they login). It does not require manual intervention.

Forgejo

Gitea

Note that there is no Forgejo v1.18.4-N because Gitea v1.18.4 was replaced by Gitea v1.18.5 a few days after its release because of a regression. Forgejo was not affected.

1.18.3-2

This stable release includes a security fix for git and bug fixes.

Git

Git recently announced new versions to address two CVEs (CVE-2023-22490, CVE-2023-23946). On 14 Februrary 2023, Git published the maintenance release v2.39.2, together with releases for older maintenance tracks v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. All major GNU/Linux distributions also provide updated packages via their security update channels.

We recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

  • When using a Forgejo binary: upgrade the git package to a version greater or equal to v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7 or v2.30.8
  • When using a Forgejo container image: docker pull codeberg.org/forgejo/forgejo:1.18.3-2

Forgejo

Gitea

1.18.3-1

This stable release includes bug fixes.

Forgejo

Gitea

1.18.3-0

This stable release includes bug fixes.

Forgejo

Gitea

1.18.2-1

This stable release includes a security fix. It was possible to reveal a user's email address, which is problematic because users can choose to hide their email address from everyone. This was possible because the notification email for a repository transfer request to an organization included every user's email address in the owner team. This has been fixed by sending individual emails instead and the code was refactored to prevent it from happening again.

We strongly recommend that all installations are upgraded to the latest version as soon as possible.

Gitea

1.18.2-0

This stable release includes bug fixes.

Gitea

1.18.1-0

This is the first Forgejo stable point release.

Forgejo

Critical security update for Git

Git recently announced new versions to address two CVEs (CVE-2022-23521, CVE-2022-41903). On 17 January 2023, Git published the maintenance release v2.39.1, together with releases for older maintenance tracks v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6, v2.33.6, v2.32.5, v2.31.6, and v2.30.7. All major GNU/Linux distributions also provide updated packages via their security update channels.

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

  • When using a Forgejo binary: upgrade the git package to a version greater or equal to v2.39.1, v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6, v2.33.6, v2.32.5, v2.31.6, or v2.30.7
  • When using a Forgejo container image: docker pull codeberg.org/forgejo/forgejo:1.18.1-0

Read more in the Forgejo blog.

Release process stability

The release process based on Woodpecker CI was entirely reworked to be more resilient to transient errors. A new release is first uploaded into the new Forgejo experimental organization for testing purposes.

Automated end to end testing of releases was implemented with a full development cycle including the creation of a new repository and a run of CI. It relieves the user and developer from the burden of tedious manual testing.

Container environment variables

When running a container, all environment variables starting with FORGEJO__ can be used instead of GITEA__. For backward compatibility with existing scripts, it is still possible to use GITEA__ instead of FORGEJO__. For instance:

docker run --name forgejo -e FORGEJO__security__INSTALL_LOCK=true codeberg.org/forgejo/forgejo:1.18.1-0

Forgejo hook types

A new forgejo hook type is available and behaves exactly the same as the existing gitea hook type. It will be used to implement additional features specific to Forgejo in a way that will be backward compatible with Gitea.

X-Forgejo headers

Wherever a X-Gitea header is received or sent, an identical X-Forgejo is added. For instance when a notification mail is sent, the X-Forgejo-Reason header is set to explain why. Or when a webhook is sent, the X-Forgejo-Event header is set with push, tag, etc. for Woodpecker CI to decide on an action.

Look and feel fixes

The Forgejo theme was modified to take into account user feedback.

Gitea

1.18.0-1

This is the first Forgejo release.

Forgejo improvements

Woodpecker CI

A new CI configuration based on Woodpecker CI was created. It is used to:

Look and feel

The default themes were replaced by Forgejo themes and the landing page was modified to display the Forgejo logo and names but the look and feel remains otherwise identical to Gitea.

Landing page

Privacy

Gitea instances fetch https://dl.gitea.io/gitea/version.json weekly by default, which raises privacy concerns. In Forgejo this feature needs to be explicitly activated at installation time or by modifying the configuration file. Forgejo also provides an alternative RSS feed to be informed when a new release is published.

Gitea

1.18.0-0

This release was replaced by 1.18.0-1 a few hours after being published because the release process was interrupted.

1.18.0-rc1-2

This is the first Forgejo release candidate.