This is a security release. See the documentation for more information on the upgrade procedure.
- Security
The scope of application tokens was not verified when writing containers or Conan packages. This is of no consequence when the user associated with the application token does not have write access to packages. If the user has write access to packages, such a token can be used to write containers and Conan packages. An application token that was used to write containers or Conan packages without the
package:writescope will now fail with an unauthorized error. It must be re-created to include thepackage:writescope.
- User Interface bug fixes
- PR (backported): Overflow for images on project cards.
- PR (backported): Allow unreacting from comment popover.
- Bug fixes
- PR (backported): The scope of application tokens is not verified when writing containers or Conan packages.
- PR (backported): When a Forgejo Actions workflow includes a
workflow_dispatchwithinputsand other events (for instancepush), it is silently ignored because of a parsing error. - PR: Automerge on AGit pull requests is ignored.
- PR (backported): commit Show lock owner instead of repo owner on LFS setting page.
- PR (backported): commit Render plain text file if the LFS object doesn't exist.
- PR (backported): commit Panic of ssh public key page after deletion of an auth source.
- PR (backported): commit Add missing repository type filter parameters to pager.
- PR (backported): Reverted a change from Gitea which prevented allow/reject reviews on merged or closed PRs. This change was not considered by the Forgejo UI team and there is a consensus that it feels like a regression, since it interferes with workflows known to be used by Forgejo users without providing a tangible benefit.
- PR (backported): Run full PR checks on AGit push.
- Localization
- PR (backported): i18n: update of translations from Codeberg Translate
- PR (backported): i18n: update of translations from Codeberg Translate