Patcito/projects enhancements - #1
Open
6543 wants to merge 4 commits into
Open
Conversation
as reported in https://drone.gitea.io/go-gitea/gitea/28939/1/4 use log.Error instead of log.Info fix comments fix eslint fix goimport order add migrations for project priorities fix _repository.less lint errors update swagger fixes according to @6543 suggestions s/NotInProjectID/ExcludeProjectID/g update boards priority in a single transaction as per @zeripath Co-authored-by: zeripath <art27@cantab.net> update swagger Clean up the indenting Co-authored-by: zeripath <art27@cantab.net> use tabs Co-authored-by: zeripath <art27@cantab.net> use tabs add loadRepository as per @zeripath suggestion move projects css to features/projects.less as per @silverwind request go-gitea#12506 (review) use transaction to update projects issues priorities as per @zeripath suggestion go-gitea#12506 (comment) make import fit on one line make use of loadRepository indent html properly as per suggestion by @silverwind go-gitea#12506 (comment) remove non-working code as per @zeripath suggestion go-gitea#12506 (comment) remove non-used code as per @zeripath suggestion go-gitea#12506 (comment) fix syntax, remove content-type on request go-gitea#12506 (comment) use closest instead of parent as per @silverwind suggestion go-gitea#12506 (review) use for instead of forEach because @silverwind use for instead of forEach because @silverwind go-gitea#12506 (review) use // falls through as per @silverwind go-gitea#12506 (comment) listen to body keyup only on project page go-gitea#12506 (review) Update models/project_board.go Co-authored-by: Lauris BH <lauris@nix.lv> move all issue related code to its own util file and re-use those functions in index.js and projects.js as per @silverwind and @zeripath Update models/project_issue.go Co-authored-by: 6543 <6543@obermui.de> fix linting Update web_src/js/features/issuesutil.js Co-authored-by: silverwind <me@silverwind.io> Update web_src/js/features/issuesutil.js Co-authored-by: silverwind <me@silverwind.io> Update web_src/js/features/issuesutil.js Co-authored-by: silverwind <me@silverwind.io> Update web_src/js/features/projects.js Co-authored-by: silverwind <me@silverwind.io> Update web_src/js/features/projects.js Co-authored-by: silverwind <me@silverwind.io> Update models/project_issue.go Update models/issue.go Co-authored-by: zeripath <art27@cantab.net> Update web_src/js/features/issuesutil.js Co-authored-by: silverwind <me@silverwind.io> various js fix per @silverwind suggestions various fixes according to @silverwind and @zeripath use await for fetch when possible specify table name as per @lafriks suggestion specify table name as per @lafriks suggestion in more queries go-gitea#12506 (review) go-gitea#12506 (comment) Update templates/repo/projects/view.tmpl Co-authored-by: silverwind <me@silverwind.io> Update templates/repo/projects/view.tmpl Co-authored-by: silverwind <me@silverwind.io> Update web_src/js/features/projects.js Co-authored-by: silverwind <me@silverwind.io> fix project_issue table name in query make another fetch async as per @silverwind Update models/project.go Co-authored-by: Lauris BH <lauris@nix.lv> Update models/project.go Co-authored-by: Lauris BH <lauris@nix.lv> more and rename UpdateBoards functions as per @6543 Update models/project.go Co-authored-by: Lauris BH <lauris@nix.lv> Update models/project.go Co-authored-by: Lauris BH <lauris@nix.lv> add / to route fixup! fix backend lint as reported in https://drone.gitea.io/go-gitea/gitea/28939/1/4 Update models/project.go Co-authored-by: zeripath <art27@cantab.net> Update routers/repo/issue.go Co-authored-by: zeripath <art27@cantab.net> Update web_src/less/features/projects.less Co-authored-by: silverwind <me@silverwind.io> fix uneeded column in query and remove css class as suggested by @silverwind Update models/project.go Co-authored-by: Lauris BH <lauris@nix.lv> add X to close sidebar and other css suggestions by @silverwind add emoji to project issue titles use issue.* instead as suggested by @zeripath still waiting for xorm v1.0.5 to update go.mod fix project_issue query for now fix card details css
6543
pushed a commit
that referenced
this pull request
Apr 8, 2024
Result of `go get -u golang.org/x/net; make tidy`. This is related to the following vulncheck warning: ``` There are 2 vulnerabilities in modules that you require that are neither imported nor called. You may not need to take any action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck for details. Vulnerability #1: GO-2024-2687 HTTP/2 CONTINUATION flood in net/http More info: https://pkg.go.dev/vuln/GO-2024-2687 Module: golang.org/x/net Found in: golang.org/x/net@v0.22.0 Fixed in: golang.org/x/net@v0.23.0 Vulnerability #2: GO-2022-0470 No access control in github.com/blevesearch/bleve and bleve/v2 More info: https://pkg.go.dev/vuln/GO-2022-0470 Module: github.com/blevesearch/bleve/v2 Found in: github.com/blevesearch/bleve/v2@v2.3.10 Fixed in: N/A ```
6543
pushed a commit
that referenced
this pull request
Apr 9, 2024
Backport go-gitea#30283 by @silverwind Result of `go get -u golang.org/x/net; make tidy`. This is related to the following vulncheck warning: ``` There are 2 vulnerabilities in modules that you require that are neither imported nor called. You may not need to take any action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck for details. Vulnerability #1: GO-2024-2687 HTTP/2 CONTINUATION flood in net/http More info: https://pkg.go.dev/vuln/GO-2024-2687 Module: golang.org/x/net Found in: golang.org/x/net@v0.22.0 Fixed in: golang.org/x/net@v0.23.0 Vulnerability #2: GO-2022-0470 No access control in github.com/blevesearch/bleve and bleve/v2 More info: https://pkg.go.dev/vuln/GO-2022-0470 Module: github.com/blevesearch/bleve/v2 Found in: github.com/blevesearch/bleve/v2@v2.3.10 Fixed in: N/A ``` Co-authored-by: silverwind <me@silverwind.io>
silverwind
pushed a commit
that referenced
this pull request
Apr 21, 2026
## Overview This PR updates the Go toolchain version from `1.25.5` to `1.25.6` for the Gitea project. ## Changes ### Toolchain Update - **Go Toolchain**: Updated from `go1.25.5` to `go1.25.6` This is a minor toolchain version bump that ensures the project uses the latest patch release of Go 1.25. ## Security Improvements While this PR primarily addresses the toolchain update, the project maintains a strong security posture through: ### Current Security Measures ```log Vulnerability #1: GO-2026-4342 Excessive CPU consumption when building archive index in archive/zip More info: https://pkg.go.dev/vuln/GO-2026-4342 Standard library Found in: archive/zip@go1.25.5 Fixed in: archive/zip@go1.25.6 Example traces found: #1: modules/packages/nuget/metadata.go:217:25: nuget.ParseNuspecMetaData calls zip.Reader.Open Vulnerability #2: GO-2026-4341 Memory exhaustion in query parameter parsing in net/url More info: https://pkg.go.dev/vuln/GO-2026-4341 Standard library Found in: net/url@go1.25.5 Fixed in: net/url@go1.25.6 Example traces found: #1: modules/storage/minio.go:284:34: storage.MinioStorage.URL calls url.ParseQuery #2: routers/api/v1/repo/action.go:1640:29: repo.DownloadArtifactRaw calls url.URL.Query Vulnerability go-gitea#3: GO-2026-4340 Handshake messages may be processed at the incorrect encryption level in crypto/tls More info: https://pkg.go.dev/vuln/GO-2026-4340 Standard library Found in: crypto/tls@go1.25.5 Fixed in: crypto/tls@go1.25.6 Example traces found: #1: services/auth/source/ldap/source_search.go:129:25: ldap.dial calls ldap.Conn.StartTLS, which calls tls.Conn.Handshake #2: modules/graceful/server.go:156:14: graceful.Server.Serve calls http.Server.Serve, which eventually calls tls.Conn.HandshakeContext go-gitea#3: modules/lfs/content_store.go:132:27: lfs.hashingReader.Read calls tls.Conn.Read go-gitea#4: modules/proxyprotocol/conn.go:91:21: proxyprotocol.Conn.Write calls tls.Conn.Write go-gitea#5: modules/session/virtual.go:168:39: session.VirtualStore.Release calls couchbase.CouchbaseProvider.Exist, which eventually calls tls.Dial go-gitea#6: services/auth/source/ldap/source_search.go:120:22: ldap.dial calls ldap.DialTLS, which calls tls.DialWithDialer go-gitea#7: services/migrations/gogs.go:114:34: migrations.client calls http.Transport.RoundTrip, which eventually calls tls.Dialer.DialContext ``` ## Breaking Changes None expected. This is a minor toolchain patch update.
silverwind
pushed a commit
that referenced
this pull request
Apr 21, 2026
# Summary: - Adjust the toolchain version to fix the security issues ```log Vulnerability #1: GO-2026-4337 Unexpected session resumption in crypto/tls More info: https://pkg.go.dev/vuln/GO-2026-4337 Standard library Found in: crypto/tls@go1.25.6 Fixed in: crypto/tls@go1.25.7 Example traces found: ``` Signed-off-by: Pascal Zimmermann <pascal.zimmermann@theiotstudio.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
just save commits of
https://github.com/go-gitea/gitea/pull/12506