TheFox0x7 fb4d5e9d50 fix(git): reject fsck-invalid objects on push (#39472) ...

Set receive.fsckObjects=true in Gitea's internal global git config so
the receiving git process rejects bad, malicious or duplicate objects at
push time, before Gitea ever stores them.

Assisted-by: Codet:claude-opus-4-8

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>

2026-09-29 20:31:50 +02:00

..

actions

feat(actions): update actionslib, support self:, misc fixes (#39358)

2026-09-25 00:06:42 +02:00

analyze

Fix incorrect vendored detections (#36508)

2026-02-01 10:35:51 +00:00

assetfs

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

auth

fix(git)!: use internal proxy for all git operations (#39426)

2026-09-29 14:43:36 +02:00

avatar

chore: misc go 1.27 tweaks (#39069)

2026-08-24 18:26:10 +00:00

badge

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

base

refactor: drop two unmaintained dependencies, rename the byte size helpers (#39083)

2026-08-27 15:31:20 +00:00

cache

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

cachegroup

Cache GPG keys, emails and users when list commits (#34086)

2025-04-09 16:34:38 +00:00

charset

chore: fix various problems (#39298)

2026-09-14 22:15:21 +02:00

commitstatus

Update Combine method to treat warnings as failures and adjust tests (#37048)

2026-03-31 17:22:18 +00:00

consts

feat(ssh): auto generate additional ssh keys (#33974)

2026-06-08 18:18:58 +00:00

container

fix: make auth source group sync correctly handle team removal (#37161)

2026-07-24 02:05:38 +00:00

csv

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

dump

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

egress

fix(git)!: use internal proxy for all git operations (#39426)

2026-09-29 14:43:36 +02:00

emoji

enhance(emoji): update to Unicode 17, unify and lazy-load emoji data (#39363)

2026-09-24 20:23:15 +00:00

fileicon

refactor: decouple git.Repository(ctx) from git.Commit & git.Tree (#38464)

2026-07-15 17:30:01 +00:00

generate

feat(ssh): auto generate additional ssh keys (#33974)

2026-06-08 18:18:58 +00:00

git

fix(git): reject fsck-invalid objects on push (#39472)

2026-09-29 20:31:50 +02:00

glob

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

globallock

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

graceful

fix(process): reap entire process group on cmd.Cancel (#39143)

2026-08-29 19:54:07 +00:00

gtprof

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

hcaptcha

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

highlight

refactor: render highlight language (#38793)

2026-08-06 18:07:36 +08:00

htmlutil

chore: fix various problems (#39298)

2026-09-14 22:15:21 +02:00

httpcache

enhance: support ETag on streamed repository archives, support If-None-Match: * (#39289)

2026-09-16 12:30:22 +02:00

httplib

feat(actions): Add artifact preview in Actions run view (#36754)

2026-09-26 07:42:36 +00:00

indexer

fix(indexer): index full file paths and real offsets in bleve (#39405)

2026-09-24 07:57:42 +00:00

issue/template

refactor: http request binding (#38971)

2026-08-19 14:15:42 +08:00

json

chore: update Go to v1.27 (#39068)

2026-08-24 07:28:17 +00:00

label

enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)

2026-05-29 01:12:11 +00:00

lfs

fix(lfs): accept successful transfer responses (#38866)

2026-08-11 11:47:20 +02:00

lfstransfer

fix: add default timeout and handle errors for HaveIBeenPwned API (#39316)

2026-09-16 20:41:57 +02:00

log

fix(ssh): fetch ssh key by fingerprint (#39423)

2026-09-25 06:22:04 -07:00

markup

fix(feed): use meaningful lines as comment excerpt (#39276)

2026-09-25 03:08:15 +00:00

mcaptcha

refactor: implement mcaptcha client and add comments/tests (#38561)

2026-07-21 13:41:54 +00:00

metrics

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

migration

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

nosql

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

optional

enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866)

2026-05-29 01:12:11 +00:00

options

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

packages

enhance(packages): implement npm single-version API and add per-version repository (#39267)

2026-09-08 18:25:29 +00:00

paginator

feat(ui): add "follow rename" to file commit history list (#34994)

2026-06-03 17:40:38 +00:00

pprof

refactor: fix legacy problems in cmd/serv.go (#38505)

2026-07-17 22:28:59 +08:00

private

fix: PR merge (#39442)

2026-09-26 17:38:42 +00:00

process

fix(process): reap entire process group on cmd.Cancel (#39143)

2026-08-29 19:54:07 +00:00

proxy

fix(git)!: use internal proxy for all git operations (#39426)

2026-09-29 14:43:36 +02:00

proxyprotocol

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

public

enhance(emoji): update to Unicode 17, unify and lazy-load emoji data (#39363)

2026-09-24 20:23:15 +00:00

queue

fix: make local queue PopItem can be notified (#39011)

2026-08-22 01:30:41 +00:00

recaptcha

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

references

enhance: allow auto-closing PRs from PRs (#39393)

2026-09-25 11:35:13 +00:00

regexplru

fix: correct stdErr match in isErrBlameNotFoundOrNotEnoughLines (#39309)

2026-09-14 14:59:18 +00:00

repository

fix: PR merge (#39442)

2026-09-26 17:38:42 +00:00

reqctx

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

secret

Upgrade golangci-lint to v1.64.5 (#33654)

2025-02-21 00:05:40 +08:00

session

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

setting

fix(git)!: use internal proxy for all git operations (#39426)

2026-09-29 14:43:36 +02:00

sitemap

chore: fix form string abuse (#38106)

2026-06-14 18:26:22 +00:00

ssh

fix(ssh): fetch ssh key by fingerprint (#39423)

2026-09-25 06:22:04 -07:00

storage

refactor: replace Azure Blob SDK with a REST client (#39315)

2026-09-16 17:06:00 +02:00

structs

docs(webhook): review.type comment lists values the webhook never sends (#39451)

2026-09-27 00:32:14 +02:00

svg

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

system

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

tailmsg

Support performance trace (#32973)

2025-01-21 18:57:07 +00:00

tempdir

refactor: retry file remove/rename when a file is busy and clean up os detection (#38588)

2026-07-23 14:31:29 +00:00

templates

fix(feed): use meaningful lines as comment excerpt (#39276)

2026-09-25 03:08:15 +00:00

test

fix(repo): commit page fails to render unsigned commits with a different committer (#39381)

2026-09-23 14:34:19 +00:00

testlogger

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

timeutil

chore: refactor StaticRootPath (#39384)

2026-09-22 22:49:36 +08:00

translation

chore: form binding trim space (#38978)

2026-08-19 12:50:06 +00:00

turnstile

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

typesniffer

Feature non-zipped actions artifacts (action v7) (#36786)

2026-03-26 00:37:48 +08:00

updatechecker

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

uri

fix: various security fixes (#38406)

2026-07-12 17:14:09 +00:00

user

Refactor older tests to use testify (#33140)

2025-01-09 09:21:47 +08:00

util

refactor: replace Azure Blob SDK with a REST client (#39315)

2026-09-16 17:06:00 +02:00

validation

refactor: fix go vet errors related to composite literals (#39341)

2026-09-24 09:17:25 +00:00

web

fix: pass merge commit messages to git via stdin (#39269)

2026-09-19 13:04:53 +00:00

webhook

actions: report commit status for pull_request_review events (#36589)

2026-02-20 16:12:22 +00:00

zstd

chore(deps): upgrade zstd seekable package (#37988)

2026-06-04 13:38:56 +00:00