3 people ef2ceff6cd fix(actions): drop untrusted Content-Encoding from v1 artifact uploads (#39855) (#39996) ...

Backport #39855 by @basavaraj-sm05

Legacy (v1 to v3) artifact uploads stored the request's
`Content-Encoding` header in the column that v4 artifacts read as their
`Content-Type`.

- Store only the `gzip` marker on legacy uploads, the only encoding
their clients send
- Pick the PDF and audio/video serve headers only for content types that
`mime.ParseMediaType` accepts

Co-authored-by: Basavaraj S m <basavaraj@digiscrypt.com>
Co-authored-by: silverwind <me@silverwind.io>

2026-10-24 15:06:46 +02:00

..

actions

fix(actions): keep folded block scalars intact across serialization (#39787) (#39817)

2026-10-17 03:15:42 +00:00

analyze

…

assetfs

chore(deps): update go toolchain directive to v1.27.2 (#39685) (#39687)

2026-10-08 11:25:28 -07:00

auth

fix(webauthn): accept unsolicited client extension outputs from WebKit clients (#39792) (#39806)

2026-10-16 09:28:24 +00:00

avatar

chore: misc go 1.27 tweaks (#39069)

2026-08-24 18:26:10 +00:00

badge

…

base

refactor: drop two unmaintained dependencies, rename the byte size helpers (#39083)

2026-08-27 15:31:20 +00:00

cache

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

cachegroup

…

charset

fix(markup): don't escape ambiguous characters in MathML (#39493) (#39505)

2026-09-30 16:56:23 +00:00

commitstatus

…

consts

…

container

…

csv

…

dump

…

egress

fix(egress): expose more ranges as restricted rather than reserved (#39560) (#39624)

2026-10-06 15:24:11 +08:00

emoji

enhance(emoji): update to Unicode 17, unify and lazy-load emoji data (#39363)

2026-09-24 20:23:15 +00:00

fileicon

…

generate

…

git

fix: use clear error message when failed to parse git version (#39898) (#39903)

2026-10-21 04:35:32 +00:00

glob

fix(actions): harden log cursor, activity type and actor filter handling (#39721) (#39731)

2026-10-10 20:23:39 +00:00

globallock

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

graceful

fix(process): reap entire process group on cmd.Cancel (#39143)

2026-08-29 19:54:07 +00:00

gtprof

fix: trace git command correctly (#39520) (#39524)

2026-10-01 10:19:33 +00:00

hcaptcha

…

highlight

…

htmlutil

fix(markup): resolve and proxy srcset links of <source> elements (#39708) (#39756)

2026-10-13 15:46:51 +08:00

httpcache

fix(httpcache): raw files return 304 after a change when the new commit is older (#39435) (#39591)

2026-10-04 13:39:06 +00:00

httplib

fix(actions): drop untrusted Content-Encoding from v1 artifact uploads (#39855) (#39996)

2026-10-24 15:06:46 +02:00

indexer

fix(indexer): index full file paths and real offsets in bleve (#39405)

2026-09-24 07:57:42 +00:00

issue/template

refactor: http request binding (#38971)

2026-08-19 14:15:42 +08:00

json

enhance(packages/npm): improve npm client compatibility (#39434) (#39522)

2026-10-01 08:09:21 +00:00

label

…

lfs

fix(lfs): send the default branch as ref in batch download requests (#39891) (#39920)

2026-10-21 10:59:03 +00:00

lfstransfer

fix: add default timeout and handle errors for HaveIBeenPwned API (#39316)

2026-09-16 20:41:57 +02:00

log

fix(ssh): fetch ssh key by fingerprint (#39423)

2026-09-25 06:22:04 -07:00

markup

fix(markup): resolve and proxy srcset links of <source> elements (#39708) (#39756)

2026-10-13 15:46:51 +08:00

mcaptcha

…

metrics

…

migration

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

nosql

…

optional

fix(api): keep milestone due date when it is omitted in edit request (#39869) (#39921)

2026-10-21 17:59:21 +02:00

options

…

packages

fix(packages): reject newline-bearing rubygems dependency metadata (#39782) (#39900)

2026-10-21 05:24:52 +00:00

paginator

…

pprof

…

private

fix: various bugs (#39661) (#39667)

2026-10-07 10:11:58 -07:00

process

fix(process): reap entire process group on cmd.Cancel (#39143)

2026-08-29 19:54:07 +00:00

proxy

fix(git)!: use internal proxy for all git operations (#39426)

2026-09-29 14:43:36 +02:00

proxyprotocol

…

public

enhance(emoji): update to Unicode 17, unify and lazy-load emoji data (#39363)

2026-09-24 20:23:15 +00:00

queue

fix: make local queue PopItem can be notified (#39011)

2026-08-22 01:30:41 +00:00

recaptcha

…

references

fix(markup): link team mentions that use a different org name case (#39436) (#39588)

2026-10-04 13:10:58 +00:00

regexplru

fix: correct stdErr match in isErrBlameNotFoundOrNotEnoughLines (#39309)

2026-09-14 14:59:18 +00:00

repository

fix(lfs): send the default branch as ref in batch download requests (#39891) (#39920)

2026-10-21 10:59:03 +00:00

reqctx

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

secret

…

session

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

setting

enhance(oauth): pre-register a builtin OAuth2 application for gitea-vscode (#39785) (#39801)

2026-10-16 12:40:16 -07:00

sitemap

…

ssh

fix(ssh): fetch ssh key by fingerprint (#39423)

2026-09-25 06:22:04 -07:00

storage

fix: correct RemoveWithRetry error handling (#39619) (#39626)

2026-10-06 09:36:06 +00:00

structs

fix(api): adding issue labels by name attaches both the repo and the org label (#39873) (#39951)

2026-10-22 21:40:40 +00:00

svg

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

system

…

tailmsg

…

tempdir

…

templates

fix(feed): use meaningful lines as comment excerpt (#39276)

2026-09-25 03:08:15 +00:00

test

fix(repo): commit page fails to render unsigned commits with a different committer (#39381)

2026-09-23 14:34:19 +00:00

testlogger

…

timeutil

chore: refactor StaticRootPath (#39384)

2026-09-22 22:49:36 +08:00

translation

chore: form binding trim space (#38978)

2026-08-19 12:50:06 +00:00

turnstile

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

typesniffer

…

updatechecker

…

uri

…

user

…

util

fix: correct RemoveWithRetry error handling (#39619) (#39626)

2026-10-06 09:36:06 +00:00

validation

fix: various bugs (#39661) (#39667)

2026-10-07 10:11:58 -07:00

web

chore(deps): update go toolchain directive to v1.27.2 (#39685) (#39687)

2026-10-08 11:25:28 -07:00

webhook

…

zstd

…