Only posting here because I've been asked about it. Gitea is protected against both of these issues.
(bias note: part of project leadership of Gitea)
Edit: As a note, security incidents happen to everyone and we shouldn't shame anyone for reporting them, especially as that'd otherwise cause less issues to be reported overall.
> Gitea is protected against both of these issues.
Is Gitea's immunity just incidental because it was written by a different person, or is it due to a deliberate defensive system that prevents such bug/mistake from occurring?
Very interested in knowing too, since the issues seems to not be related at all, or similar, so now this must mean a Gitea "project leader" would only say this if they have some sort of layer that doesn't require them to manually patch issues individually. Meaning, firewall? Would be weird if that's built-in into Gitea though... Hmm.
So not "Gitea is protected against both of these issues" but "Gitea fixed these issues earlier", which kind of feels like a less marketing-friendly version of what the Gitea employee said above.
Why people can't just talk clearly and not try to oversell whatever they're doing? It's a disease at this point.
i like how this is a side effect of a bunch of assorted changes in a commit and PR solely described as "Fix path resolving" making it hard for anyone running Gitea to even know this is a security fix
I'm not completely sure if this is supposed to be sincere, but it should be.
It's not uncommon practice to omit the security implications on public facing commit messages when fixing secirity issues, so as to not to draw attention until it's ready for distribution.
CVE AND release note not enough tipping off for you?
it is absolutely not on maintainers of projects to proactively notify those who've forked the project. clear and transparent notices are exactly the right approach
I was one of the members who was a part of the initial grant for federation in Gitea, but sadly due to illness and other similar neither I nor my teammate were able to work on the grant (so no funding ended up being released), however the work we did start was completed, and we have continued to work on foundations since. Since spam/moderation/limitations are so significant we are focused on that portion first, since we don't want to open up another vector for it without having at least the minimum of protections in place. We have also been extremely fortunate to have experienced developers who do work on existing federated software share so much of their time, expertise, and experiences with us to help shape our work.
I'm one of the project leads of Gitea and we've put a ton of work into Gitea Actions, I'd be interested in any compatibility gaps that you've run into.
oh hello, thank you for your work on an excellent product! one small difference i ran into last weekend is that foregjo forwards the FORGEJO_TOKEN in the environment to composite actions so that they don't need to have a required "token" input.
I'm one of the project leads of Gitea. I'd be interested in knowing which features you are missing from Gitea compared to Gitlab? We are doing some backlog grooming right now, and input is very appreciated:)
Not who you asked, but I was going to say Actions or CI/CD from when I tried out Gitea a few years ago (back when running a Jenkins instance was more normal) but looks like Gitea supports that kind of workflow now: https://about.gitea.com/products/runner/
Two of the big issues I had were around the user/repository forced structure. That works to some extent when you have multiple users with a small number of repositories. But for my personal projects I wanted more control over the structure and grouping.
I worked around it to some extent by having an organisation per category, but that doesn't work at scale. For example, you can't group Text-to-Speech projects around the different libraries (coqui-ai, Qwen3, parler, etc.), or language tooling installation scripts by programming language. -- Those have a group/subgroup/repository style structure.
The other related feature is having organisation or group-level issues and corresponding tracking features.
Gitolite doesn't impose/enforce a structure on the user. GitWeb/CGit have a free-form category (e.g. "lang/python") that the project can be assigned to. That works, but I'd like it to support multiple tags/labels for that.
I want org-mode markup support for the wikis and readmes. Github supports this, and gitlab sorta does. You should hook up pandoc to it, and support everything it can handle.
I'm a project lead of Gitea, and former elected board member of Codeberg. Gitea remains opensource (feel free to check out the repo and you can see that the license remiains as is), and maintains yearly community elections. The codeberg board was informed a full year prior to their "we just found out blog post", and so "catching the whole community by surprise" is very much not accurate since they very much knew. As well, we (the company) were very public with our activities prior to our blog post announcing things, including working to support other open source projects migrate, and posting about it through various channels (social media, chat, etc..).
(bias note: part of project leadership of Gitea)
Edit: As a note, security incidents happen to everyone and we shouldn't shame anyone for reporting them, especially as that'd otherwise cause less issues to be reported overall.
reply