metsw24-max 09f78aed19 fix: drop newline-bearing member names in arch ParsePackage (#38102) ...

The arch parser keeps tar member names verbatim. The index writer joins
those values one per line into the pacman database. So a member name
with a newline adds lines to that package's own `files` entry, which
libalpm reads as further fields.

The scope is one package record. An uploader cannot forge entries for
another package, and can set the same fields in `.PKGINFO` anyway. This
is input validation, not a privilege boundary.

`ParsePackage` now drops names that contain CR or LF. `joinFields` drops
such values again when writing the index, which also covers packages
that are already stored. Real packages never carry newlines in file
paths, so well-formed uploads are unaffected.

---------

Co-authored-by: silverwind <me@silverwind.io>

2026-08-07 20:47:33 +00:00

..

actions

feat(actions): support $/ prefix in reusable workflow uses: (#38822)

2026-08-07 15:39:36 +00:00

analyze

Fix incorrect vendored detections (#36508)

2026-02-01 10:35:51 +00:00

assetfs

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

auth

fix(auth): set WebAuthn user verification per request (#38805)

2026-08-07 00:11:34 +00:00

avatar

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

badge

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

base

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

cache

fix: git cache (#38763)

2026-08-05 00:17:07 +08:00

cachegroup

Cache GPG keys, emails and users when list commits (#34086)

2025-04-09 16:34:38 +00:00

charset

perf(gitdiff): optimize inline diff highlighting using cache (#38706)

2026-07-30 16:43:36 +00:00

commitstatus

Update Combine method to treat warnings as failures and adjust tests (#37048)

2026-03-31 17:22:18 +00:00

consts

feat(ssh): auto generate additional ssh keys (#33974)

2026-06-08 18:18:58 +00:00

container

fix: make auth source group sync correctly handle team removal (#37161)

2026-07-24 02:05:38 +00:00

csv

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

dump

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

emoji

perf(emoji): optimize FindEmojiSubmatchIndex using slice-based Trie (#38573)

2026-07-23 08:29:28 +00:00

fileicon

refactor: decouple git.Repository(ctx) from git.Commit & git.Tree (#38464)

2026-07-15 17:30:01 +00:00

generate

feat(ssh): auto generate additional ssh keys (#33974)

2026-06-08 18:18:58 +00:00

git

enhance: fall back to DEFAULT_TEMPLATE.md when style-specific template is missing (#38803)

2026-08-07 14:11:03 +00:00

glob

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

globallock

fix: misc fixes in pub/gpg/tests (#38809)

2026-08-07 11:49:23 +00:00

graceful

enhance(tls): use go's tls defaults (#38687)

2026-08-05 21:34:46 +00:00

gtprof

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

hcaptcha

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

highlight

refactor: render highlight language (#38793)

2026-08-06 18:07:36 +08:00

hostmatcher

fix: various security fixes (#38406)

2026-07-12 17:14:09 +00:00

htmlutil

feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433)

2026-06-14 15:52:37 +02:00

httpcache

fix: remove "no-transfrom" from the cache-control header (#37985)

2026-06-04 00:12:02 +08:00

httplib

fix: remove "no-transfrom" from the cache-control header (#37985)

2026-06-04 00:12:02 +08:00

indexer

chore: still keep ctx in git.Repository struct for cat-file batch command (#38684)

2026-07-28 17:04:22 +00:00

issue/template

refactor: remove Ctx field from git.Repository (#38500)

2026-07-17 18:44:31 +08:00

json

feat: Replace SSE with WebSocket for UI notifications (#36965)

2026-07-27 07:46:00 +00:00

label

enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)

2026-05-29 01:12:11 +00:00

lfs

fix(lfs): failed upload deletes a concurrent upload's meta object (#38693)

2026-07-31 11:05:41 +00:00

lfstransfer

refactor: fix legacy problems in cmd/serv.go (#38505)

2026-07-17 22:28:59 +08:00

log

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

markup

enhance: fall back to DEFAULT_TEMPLATE.md when style-specific template is missing (#38803)

2026-08-07 14:11:03 +00:00

mcaptcha

refactor: implement mcaptcha client and add comments/tests (#38561)

2026-07-21 13:41:54 +00:00

metrics

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

migration

enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)

2026-05-29 01:12:11 +00:00

nosql

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

optional

enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)

2026-05-29 01:12:11 +00:00

options

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

packages

fix: drop newline-bearing member names in arch ParsePackage (#38102)

2026-08-07 20:47:33 +00:00

paginator

feat(ui): add "follow rename" to file commit history list (#34994)

2026-06-03 17:40:38 +00:00

pprof

refactor: fix legacy problems in cmd/serv.go (#38505)

2026-07-17 22:28:59 +08:00

private

refactor: fix legacy problems in cmd/serv.go (#38505)

2026-07-17 22:28:59 +08:00

process

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

proxy

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

proxyprotocol

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

public

refactor: introduce trString for frontend (#38741)

2026-08-03 04:40:02 +00:00

queue

feat: Replace SSE with WebSocket for UI notifications (#36965)

2026-07-27 07:46:00 +00:00

recaptcha

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

references

chore(typo): fix grammar in comments, API docs and error messages (#38370)

2026-07-08 23:52:06 +02:00

regexplru

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

repository

chore: still keep ctx in git.Repository struct for cat-file batch command (#38684)

2026-07-28 17:04:22 +00:00

reqctx

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

secret

Upgrade golangci-lint to v1.64.5 (#33654)

2025-02-21 00:05:40 +08:00

session

fix: skip OIDC end-session after password login for OAuth2 users (#38439)

2026-07-27 15:35:48 +00:00

setting

fix: git cache (#38763)

2026-08-05 00:17:07 +08:00

sitemap

chore: fix form string abuse (#38106)

2026-06-14 18:26:22 +00:00

ssh

test: compare key file contents instead of FileInfo in TestInitKeys (#38330)

2026-07-04 22:30:12 +02:00

storage

fix(storage): fix Azure Blob dump failing with file does not exist (#38814)

2026-08-07 16:35:30 +00:00

structs

enhance(api): expose file mode in contents API response (#38713)

2026-08-03 06:41:27 +00:00

svg

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

system

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

tailmsg

Support performance trace (#32973)

2025-01-21 18:57:07 +00:00

tempdir

refactor: retry file remove/rename when a file is busy and clean up os detection (#38588)

2026-07-23 14:31:29 +00:00

templates

enhance: fall back to DEFAULT_TEMPLATE.md when style-specific template is missing (#38803)

2026-08-07 14:11:03 +00:00

test

fix: misc fixes in pub/gpg/tests (#38809)

2026-08-07 11:49:23 +00:00

testlogger

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

timeutil

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

translation

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

turnstile

fix(turnstile): route CAPTCHA verification through the configured proxy (#38412)

2026-07-12 11:33:14 +00:00

typesniffer

Feature non-zipped actions artifacts (action v7) (#36786)

2026-03-26 00:37:48 +08:00

updatechecker

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

uri

fix: various security fixes (#38406)

2026-07-12 17:14:09 +00:00

user

Refactor older tests to use testify (#33140)

2025-01-09 09:21:47 +08:00

util

enhance(ui): improve luminance calculations (#38682)

2026-08-06 08:41:40 +02:00

validation

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

web

refactor: introduce trString for frontend (#38741)

2026-08-03 04:40:02 +00:00

webhook

actions: report commit status for pull_request_review events (#36589)

2026-02-20 16:12:22 +00:00

zstd

chore(deps): upgrade zstd seekable package (#37988)

2026-06-04 13:38:56 +00:00