Forgejo v16.0.6 released

Forgejo hat v16.06 released. Dieser Release ist ein Security Releases. Also ran und umgehend aktualisieren.

Release notes

• Security bug fixes

  • PR: - fix: dispatch pull_request_review & pull_request_review_comment from pull request base, not head. Fork pull requests against a repository with Forgejo Action workflows that use the on.pull_request_review and on.pull_request_review_comment event were not correctly identified as forked pull requests. Forgejo Actions treats forked pull requests in special manners, including requiring approval before their workflows are executed, and omiting secrets from their execution context. These protections were disabled on these workflows, which could be triggered on the forked pull request after creation. The vulnerability has been addressed by correcting the identification of these events, and covering all forked pull request event executions with extensive related integration tests to ensure no other events were subject to this error.

  • PR: - fix: avoid loading unnecessary data during tag creation patch PR. When creating a tag via the release API, the implementation for loading related objects was invoked on an unsaved release object with a 0 ID. This caused unrelated release attachment metadata to be loaded into memory, and in the case of tag creation via the API, returned as part of the API response. The related loading routines have been disabled when the object is unsaved. (This patch was not included in the embargoed security patches from the 2026-10-12 security release, as its security implications were not known at the time it was authored. It is documented here for awareness of the security risk being addressed in this release.)

  • PR: - fix: prevent reading arbitrary label metadata. The API DELETE /repos/{owner}/{repo}/issues/{index}/labels/{identifier} allows identifiers to be either a label name, or a label unique database identifier (.id field in API responses). The API performs write access checks against the repository, and the unique database identifier can be a label from a different repository. The resulting delete operation is a no-op as an issue on one repository cannot contain a label from another repository, but the label metadata may be leaked by the API response. To fix the issue, labels are queried by the repository of the API invocation.

  • PR: - fix: prevent deletion of labels from org/repo with mismatched ownership. The APIs DELETE /orgs/{org}/labels/{id} and DELETE /repos/{owner}/{repo}/labels/{id} accessed a common internal function to delete a label within their parent organization or repository. As this common codepath didn't differentiate the owner identity, a common database identifier being used by an organization and a repository could be confused as to the true owner of a label, confounding the permission checks on the owner. The issue has been fixed by separating and distinguising the codepaths.

  • PR (backported): fix: avoid loading unnecessary data during tag creation

Quelle: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.6.md