<?xml version="1.0" encoding="UTF-8"?><?xml-stylesheet href="/pretty-feed-v3.xsl" type="text/xsl"?><rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Forgejo News</title><description>Forgejo is a self-hosted lightweight software forge. Easy to install and low maintenance, it just does the job.</description><link>https://forgejo.org/</link><item><title>Forgejo monthly update - October 2024</title><link>https://forgejo.org/2024-10-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2024-10-monthly-update/</guid><description>Forgejo is two years old and has been a lively human adventure, a story worth telling. A hackathon organized by Codeberg generated thousands of new translations. Forgejo v9.0.0 was published, as well as a security patch release which was backported to Forgejo v7, the six month old Long Term Support version. A kubernetes cluster was created to replace the current infrastructure, running Forgejo from the Helm Chart.</description><pubDate>Thu, 31 Oct 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;The monthly report is meant to provide a good overview of what has changed in Forgejo in the past month. If you would like to help, please get in touch in &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;the chatroom&lt;/a&gt; or participate in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions&quot;&gt;ongoing discussions&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Two years - a recap&lt;/h2&gt; &lt;p&gt;In October 2022 &lt;a href=&quot;https://gitea-open-letter.coding.social/&quot;&gt;Forgejo was announced&lt;/a&gt; in reaction to the takeover of &lt;a href=&quot;https://en.wikipedia.org/wiki/Gitea#Forgejo_fork&quot;&gt;Gitea&lt;/a&gt;. After a two months of preparation, &lt;a href=&quot;https://forgejo.org/2022-12-26-monthly-update/&quot;&gt;the first release&lt;/a&gt; was published and &lt;a href=&quot;https://blog.codeberg.org/codeberg-launches-forgejo.html&quot;&gt;Codeberg announced&lt;/a&gt; using it because &lt;em&gt;&quot;it provides Codeberg with an essential feature: trust&quot;&lt;/em&gt;.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://forgejo.org/2023-01-31-monthly-update/#security-releases&quot;&gt;security team&lt;/a&gt; got quite busy soon and &lt;a href=&quot;https://forgejo.org/2023-01-31-monthly-update/&quot;&gt;published multiple releases&lt;/a&gt;. The release team was also able to deliver but &lt;a href=&quot;https://forgejo.org/2023-02-12-tags/&quot;&gt;a mistake was made&lt;/a&gt;. This was the first occasion for Forgejo to show that problems are explained transparently and their impact articulated clearly. The integrated CI, Forgejo Actions, &lt;a href=&quot;https://forgejo.org/2023-02-27-forgejo-actions/&quot;&gt;was announced&lt;/a&gt; and &lt;a href=&quot;https://forgejo.org/2023-03-monthly-update/#dogfooding-forgejo-actions&quot;&gt;started to be used by Forgejo itself&lt;/a&gt; very early on.&lt;/p&gt; &lt;p&gt;In February 2023 someone new (who wasn’t a contributor that the project is relying on) joined the chat and issue tracker, spoke repeatedly in ways that was hurtful/painful to Forgejo community members, and did not seem to have capacity to speak more sensitively, despite offers for support and repeated requests. &lt;a href=&quot;https://forgejo.org/2023-03-monthly-update/#the-forgejo-community-is-healing&quot;&gt;It distracted community members from productive and important work&lt;/a&gt; on governance, strategy and development. Some community members went silent, others were on edge. The &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/commit/5c07b3801537212ed6be1edfec298d7b004ce92d/MODERATION-PROCESS.md&quot;&gt;moderation process&lt;/a&gt; was created during these challenging times. It took months for the community to heal.&lt;/p&gt; &lt;p&gt;In search for long term sustainability, &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/1&quot;&gt;the first grant application&lt;/a&gt; was sent. It was awarded and the funds allowed Codeberg to hire developers early 2024. It was not perfectly managed and &lt;a href=&quot;https://forgejo.org/2024-09-monthly-update/#sustainability&quot;&gt;in December 2024&lt;/a&gt; a significant part of the funds will be returned because they were not spent. It currently is the priority of the sustainability team &lt;a href=&quot;https://forgejo.org/2024-08-monthly-update/#sustainability&quot;&gt;established in August 2024&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;After weeks of discussions, a decision was made to &lt;a href=&quot;https://forgejo.org/2023-06-copyleft/&quot;&gt;welcome copyleft contributions in Forgejo&lt;/a&gt; in June 2023. The &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/commit/5c07b3801537212ed6be1edfec298d7b004ce92d/DECISION-MAKING.md&quot;&gt;Forgejo decision making process&lt;/a&gt; requires that all concerns are heard and answered before a decision is final. It takes long but is also a key to being inclusive. It became a reality &lt;a href=&quot;https://forgejo.org/2024-08-gpl/&quot;&gt;a year later, in August 2024&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Forgejo federation is and will always be the highest priority of the Forgejo project. Every month, since the beginning, &lt;a href=&quot;https://forgejo.org/2023-06-monthly-update/#state-of-the-forge-federation-2023-edition&quot;&gt;updates on its progress&lt;/a&gt; are published. It is still not in a usable state, two years later, and that has caused some frustration &lt;a href=&quot;https://forgejo.org/2024-08-monthly-update/#federation&quot;&gt;but the work continues&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;In August 2023 &lt;a href=&quot;https://forgejo.org/2023-08-release-v1-20-3-0/#fixing-the-risk-of-data-loss-related-to-storage-sections&quot;&gt;a regression was discovered&lt;/a&gt; to cause data loss. A lot of work went into fixing it and publishing documentation explaining how to recover. It was caused by a refactor that was not properly tested and was one of the main motivation to require that &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/commit/5c07b3801537212ed6be1edfec298d7b004ce92d/PullRequestsAgreement.md&quot;&gt;every pull request merged in Forgejo is tested&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;In &lt;a href=&quot;https://forgejo.org/2023-09-monthly-update/&quot;&gt;the&lt;/a&gt; &lt;a href=&quot;https://forgejo.org/2023-10-monthly-update/&quot;&gt;last&lt;/a&gt; &lt;a href=&quot;https://forgejo.org/2023-11-monthly-update/&quot;&gt;months&lt;/a&gt; of 2023, Forgejo contributors kept improving while rebasing all the changes on top of the Gitea codebase. However, when Gitea Cloud was announced in December 2023 and after &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/92&quot;&gt;some investigation&lt;/a&gt;, it became clear that &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/102&quot;&gt;Gitea turned Open Core&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;In January 2024, &lt;a href=&quot;https://forgejo.org/2024-01-monthly-update/#localization&quot;&gt;the Forgejo localization&lt;/a&gt; team came into existence, in anticipation of a hard fork. Before that, the Forgejo translations depended on Gitea translations which are trapped in a proprietary service. The initial localization team covered Arabic, Dutch, French, Russian, Greek and German and kept growing since.&lt;/p&gt; &lt;p&gt;Forgejo was ready for such an event and &lt;a href=&quot;https://forgejo.org/2024-02-forking-forward/&quot;&gt;declared its intention to become a hard fork&lt;/a&gt;, separating itself from Gitea even further. Just as for the decision to welcome copyleft contributions, this required weeks of (sometime intense) discussions. And it also &lt;a href=&quot;https://forgejo.org/2024-02-monthly-update/#implementation-of-the-hard-fork&quot;&gt;took weeks of work to be implemented&lt;/a&gt; in March 2023. Coincidentally the Open Core turn of Gitea was confirmed when a the first proprietary version of Gitea was announced around the same time.&lt;/p&gt; &lt;p&gt;There was a sense of liberation when the hard fork began: it was possible to write code incompatible with the Gitea codebase! But there was also a price to pay: features and bug fixes relying on such code could not be shared with Gitea. It would have been easy to be carried away and get stuck with not enough contributors to maintain a codebase that diverged too quickly. To mitigate that risk &lt;a href=&quot;https://forgejo.org/2024-04-monthly-update/#dependency-management&quot;&gt;dependency management tooling&lt;/a&gt; and a weekly observation of Gitea activity was organized and is still in place.&lt;/p&gt; &lt;p&gt;The Forgejo v9.0 release that &lt;a href=&quot;https://forgejo.org/2024-10-release-v9-0/&quot;&gt;was published in October 2024&lt;/a&gt; is the third major release after the hard fork. It includes a feature that would have never been possible before (quotas) because it requires architectural changes conflicting with the Gitea codebase. Forgejo v7 is a &lt;a href=&quot;https://forgejo.org/2024-04-release-v7-0/&quot;&gt;Long Term Support release&lt;/a&gt;, the first of its kind, supported during a year instead of three months. It is another benefit of the hard fork, made possible because Forgejo is no longer bound to the Gitea release cycle.&lt;/p&gt; &lt;p&gt;In these past two years Forgejo matured and transformed into an independent project, with a solid user base and a lively community of contributors. It involved a lot of coding and other time consuming technical work. But it was first and foremost a human adventure, with its share of plot twists and drama.&lt;/p&gt; &lt;h2&gt;Forgejo releases&lt;/h2&gt; &lt;p&gt;On 16 October &lt;a href=&quot;https://forgejo.org/2024-10-release-v9-0/&quot;&gt;Forgejo v9.0 was published&lt;/a&gt;. It is the first version to be released under a copyleft license. Codeberg was upgraded a week later. Regressions were discovered and fixed. Some of them were only noticeable visually (diagrams not showing labels or the displayed name of archives). Another was about the container image size that grew significantly (&lt;a href=&quot;https://code.forgejo.org/forgejo/-/packages/container/forgejo/9.0.0&quot;&gt;180MB for v9.0.0&lt;/a&gt;) and was reduced to &lt;a href=&quot;https://code.forgejo.org/forgejo/-/packages/container/forgejo/9.0.1&quot;&gt;70MB for v9.0.1&lt;/a&gt;, back to the size of the &lt;a href=&quot;https://code.forgejo.org/forgejo/-/packages/container/forgejo/7&quot;&gt;Forgejo v7&lt;/a&gt; images.&lt;/p&gt; &lt;p&gt;On 28 October &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#9-0-1&quot;&gt;Forgejo v9.0.1&lt;/a&gt; was published and fixes those regressions. It also contains two security fixes that were backported and published as &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-10&quot;&gt;Forgejo v7.0.10&lt;/a&gt;, the Long Term Support version.&lt;/p&gt; &lt;p&gt;These releases are the first to reflect the new Forgejo lifecycle. Before Long Term Release support existed, only v9 and v8 would have been supported, i.e. the last two major versions. But since &lt;a href=&quot;https://forgejo.org/docs/next/contributor/release/#release-cycle&quot;&gt;v7 is supported until July 2025&lt;/a&gt;, the supported versions are now v9 and v7, i.e. the latest version and the long term support version.&lt;/p&gt; &lt;h2&gt;User Research&lt;/h2&gt; &lt;p&gt;The user research team conducted &lt;a href=&quot;https://codeberg.org/forgejo/user-research/src/branch/main/surveys/repository-settings&quot;&gt;a survey regarding the repository settings&lt;/a&gt; during two weeks in October. It encouraged participation by showing banners to users of Codeberg in the repository section, linking to an external survey on Cryptpad.&lt;/p&gt; &lt;p&gt;There have been 118 submissions and the analysis is still ongoing, but there is already valuable feedback among the reviewed feedback. Thanks to all the participants!&lt;/p&gt; &lt;p&gt;There has been a rather &lt;a href=&quot;https://codeberg.org/forgejo/user-research/src/commit/cd211e8cd40497a5e6e677a9d38b5450a2f519f9/interviews/other-feedback/2024-10-10-accessibility.md&quot;&gt;spontaneous interview regarding accessibility&lt;/a&gt; with a Codeberg user. They reported a serious issue with their screen reader, which we didn&apos;t yet manage to reproduce (even after a contributor set up a test environment with the proprietary operating system and the screen reader). Investigation of this issue currently has high priority and we hope to fix the issues as soon as possible.&lt;/p&gt; &lt;h2&gt;Security Policy&lt;/h2&gt; &lt;p&gt;Forgejo &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/185&quot;&gt;published&lt;/a&gt; its &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/SECURITY-POLICY.md&quot;&gt;security policy&lt;/a&gt; to clarify communication and collaboration of the Forgejo security team with external parties such as libraries, security researchers and users.&lt;/p&gt; &lt;p&gt;Advance notice of security releases are &lt;a href=&quot;https://codeberg.org/forgejo/security-announcements/issues&quot;&gt;available publicly&lt;/a&gt;. They do not contain specific information until the day of the release and are meant to help Forgejo admin plan for an upgrade.&lt;/p&gt; &lt;p&gt;Gitea was given a detailed description of the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/milestone/8544&quot;&gt;security issues&lt;/a&gt; fixed in the the v9.0.1 and v7.0.10 releases in advance, as well as a patch waiving copyright to fix them. From now on, any third party willing to receive such details in advance is required to explicitly agree to comply with the security policy.&lt;/p&gt; &lt;h2&gt;Helm chart&lt;/h2&gt; &lt;p&gt;A new major version, &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v10.0.0&quot;&gt;10.0.0&lt;/a&gt; was published. It updates the Forgejo docker tag to v9.&lt;/p&gt; &lt;p&gt;The Forgejo helm chart had &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases&quot;&gt;security patch updates&lt;/a&gt;, in both v7 and v10. &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v7.1.3&quot;&gt;Helm chart v7.1.3&lt;/a&gt; and &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v10.0.1&quot;&gt;v10.0.1&lt;/a&gt; are the latest.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/Codeberg/translathon-2024#translathon-2024&quot;&gt;translation hackathon (translathon)&lt;/a&gt; organized by Codeberg this month resulted in many new contributors joining and making thousands of additions and improvements.&lt;/p&gt; &lt;p&gt;In total, 57 people contributed to the translations this month, which is significantly more than any previous month.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5703&quot;&gt;new script&lt;/a&gt; was added to process the localization files and verify that they contain only valid HTML insertions that follow the strictly defined rules. This should make it nearly impossible to insert malicious HTML.&lt;/p&gt; &lt;p&gt;Due to project&apos;s legacy, the localization strings traditionally were able to contain any arbitrary HTML code and often had hardcoded links and other aging code. The addition of this script reduces the number of attack vectors on Forgejo&apos;s codebase and improves it&apos;s maintainability. Fortunately, there have been no security incidents caused by this flaw.&lt;/p&gt; &lt;h2&gt;Infrastructure&lt;/h2&gt; &lt;p&gt;A new &lt;a href=&quot;https://code.forgejo.org/infrastructure/k8s-cluster/src/commit/42b69d45dc19bfcca53b7174c4b394c89bb3d8c6/README.md&quot;&gt;k8s cluster&lt;/a&gt; was created and planned to replace the &lt;a href=&quot;https://code.forgejo.org/infrastructure/documentation/src/commit/31044c95882a4dd9b3c463c81f060586f2dc96f2/README.md&quot;&gt;current setup&lt;/a&gt;. Instead of ad-hoc scripts, conventions and associated documentation, it relies on a &lt;a href=&quot;https://code.forgejo.org/infrastructure/k8s-cluster/src/commit/42b69d45dc19bfcca53b7174c4b394c89bb3d8c6/flux&quot;&gt;declarative description&lt;/a&gt; that updates the cluster when a commit is pushed to the repository.&lt;/p&gt; &lt;p&gt;It went through a few disaster recovery tests and is now in production, hosting &lt;a href=&quot;https://next.forgejo.org&quot;&gt;https://next.forgejo.org&lt;/a&gt; and &lt;a href=&quot;https://v7.next.forgejo.org&quot;&gt;https://v7.next.forgejo.org&lt;/a&gt;, ready to welcome other Forgejo instances.&lt;/p&gt; &lt;p&gt;The motivation for creating this new cluster is to improve the availability of &lt;a href=&quot;https://code.forgejo.org&quot;&gt;https://code.forgejo.org&lt;/a&gt; in the &lt;a href=&quot;https://forgejo.org/2024-09-monthly-update/#infrastructure&quot;&gt;wake of last month downtime&lt;/a&gt;. But it also significantly improves automation and reduces the technical debt. It will obsolete the ad-hoc scripts (&lt;a href=&quot;https://code.forgejo.org/infrastructure/wakeup-on-logs&quot;&gt;wakeup-on-logs&lt;/a&gt;, &lt;a href=&quot;https://code.forgejo.org/infrastructure/documentation/src/commit/31044c95882a4dd9b3c463c81f060586f2dc96f2/README.md&quot;&gt;shell scripts&lt;/a&gt;, ...), conventions and &lt;a href=&quot;https://code.forgejo.org/infrastructure/documentation/src/commit/31044c95882a4dd9b3c463c81f060586f2dc96f2/README.md&quot;&gt;documentation&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A k8s cluster is more attractive to Forgejo contributors who are willing to improve and maintain the infrastructure. They are in familiar territory if they already know k8s and do not need to learn new tools. They can start contributing with pull requests to the &lt;a href=&quot;https://code.forgejo.org/infrastructure/k8s-cluster&quot;&gt;repository describing the cluster&lt;/a&gt; and eventually apply to become a member of the devops team when they gained enough trust.&lt;/p&gt; &lt;p&gt;It is a lot more work to learn k8s from scratch than it is to learn the current ad-hoc system from scratch. From that point of view, this transformation does not make it easier to find volunteers willing to participate. However, there are a lot of devops who already learned k8s while nobody knows the current ad-hoc system. They do not need to learn k8s and can jump right in.&lt;/p&gt; &lt;h2&gt;Sustainability&lt;/h2&gt; &lt;p&gt;The beneficiaries of the NLnet grant application sent in April 2024 are no longer available. A &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/63#issuecomment-2391355&quot;&gt;call for participation&lt;/a&gt; was posted to find Forgejo contributors willing to participate.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/0ko&quot;&gt;https://codeberg.org/0ko&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/242336&quot;&gt;https://codeberg.org/242336&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/algernon&quot;&gt;https://codeberg.org/algernon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/AliveDevil&quot;&gt;https://codeberg.org/AliveDevil&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/amano.kenji&quot;&gt;https://codeberg.org/amano.kenji&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/anbraten&quot;&gt;https://codeberg.org/anbraten&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/avobs&quot;&gt;https://codeberg.org/avobs&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/behm&quot;&gt;https://codeberg.org/behm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/brainiac&quot;&gt;https://codeberg.org/brainiac&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/cdotnow&quot;&gt;https://codeberg.org/cdotnow&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/chrisnicola&quot;&gt;https://codeberg.org/chrisnicola&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ChrSt&quot;&gt;https://codeberg.org/ChrSt&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/cider&quot;&gt;https://codeberg.org/cider&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/CL0Pinette&quot;&gt;https://codeberg.org/CL0Pinette&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Crown0815&quot;&gt;https://codeberg.org/Crown0815&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/cryptolukas&quot;&gt;https://codeberg.org/cryptolukas&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Cyborus&quot;&gt;https://codeberg.org/Cyborus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DamianT&quot;&gt;https://codeberg.org/DamianT&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/danshearer&quot;&gt;https://codeberg.org/danshearer&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/David-Guillot&quot;&gt;https://codeberg.org/David-Guillot&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dawn-solace&quot;&gt;https://codeberg.org/dawn-solace&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Dirk&quot;&gt;https://codeberg.org/Dirk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dmowitz&quot;&gt;https://codeberg.org/dmowitz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dragon&quot;&gt;https://codeberg.org/dragon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/d-s&quot;&gt;https://codeberg.org/d-s&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/edgalligan&quot;&gt;https://codeberg.org/edgalligan&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Ellpeck&quot;&gt;https://codeberg.org/Ellpeck&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Ember&quot;&gt;https://codeberg.org/Ember&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/etescartz&quot;&gt;https://codeberg.org/etescartz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ewfg&quot;&gt;https://codeberg.org/ewfg&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ezra&quot;&gt;https://codeberg.org/ezra&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/floss4good&quot;&gt;https://codeberg.org/floss4good&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/foxy&quot;&gt;https://codeberg.org/foxy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fuggla&quot;&gt;https://codeberg.org/fuggla&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GDWR&quot;&gt;https://codeberg.org/GDWR&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/gregdechene&quot;&gt;https://codeberg.org/gregdechene&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/grgi&quot;&gt;https://codeberg.org/grgi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/grosmanal&quot;&gt;https://codeberg.org/grosmanal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/herzenschein&quot;&gt;https://codeberg.org/herzenschein&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/io7m&quot;&gt;https://codeberg.org/io7m&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/iustin&quot;&gt;https://codeberg.org/iustin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jacobwillden&quot;&gt;https://codeberg.org/jacobwillden&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JakobDev&quot;&gt;https://codeberg.org/JakobDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jalil&quot;&gt;https://codeberg.org/jalil&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jean-daricade&quot;&gt;https://codeberg.org/jean-daricade&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jogibear9988&quot;&gt;https://codeberg.org/jogibear9988&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/julianmarcos&quot;&gt;https://codeberg.org/julianmarcos&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jutty&quot;&gt;https://codeberg.org/jutty&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jwakely&quot;&gt;https://codeberg.org/jwakely&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kidsan&quot;&gt;https://codeberg.org/kidsan&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Kidswiss&quot;&gt;https://codeberg.org/Kidswiss&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kita&quot;&gt;https://codeberg.org/kita&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kuolemaa&quot;&gt;https://codeberg.org/kuolemaa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Kwonunn&quot;&gt;https://codeberg.org/Kwonunn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kytta&quot;&gt;https://codeberg.org/kytta&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lapo&quot;&gt;https://codeberg.org/lapo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/l_austenfeld&quot;&gt;https://codeberg.org/l_austenfeld&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Laxystem&quot;&gt;https://codeberg.org/Laxystem&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lime360&quot;&gt;https://codeberg.org/lime360&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lingling&quot;&gt;https://codeberg.org/lingling&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Link1J&quot;&gt;https://codeberg.org/Link1J&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lippoliv&quot;&gt;https://codeberg.org/lippoliv&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/LunarLambda&quot;&gt;https://codeberg.org/LunarLambda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lynoure&quot;&gt;https://codeberg.org/lynoure&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/MaddinM&quot;&gt;https://codeberg.org/MaddinM&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mahlzahn&quot;&gt;https://codeberg.org/mahlzahn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mai-Lapyst&quot;&gt;https://codeberg.org/Mai-Lapyst&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/malik&quot;&gt;https://codeberg.org/malik&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/marcellmars&quot;&gt;https://codeberg.org/marcellmars&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/marshmallow&quot;&gt;https://codeberg.org/marshmallow&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/martinwguy&quot;&gt;https://codeberg.org/martinwguy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/matrss&quot;&gt;https://codeberg.org/matrss&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Merith-TK&quot;&gt;https://codeberg.org/Merith-TK&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/michael-sparrow&quot;&gt;https://codeberg.org/michael-sparrow&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mikolaj&quot;&gt;https://codeberg.org/mikolaj&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/minecraftchest1&quot;&gt;https://codeberg.org/minecraftchest1&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mzhang&quot;&gt;https://codeberg.org/mzhang&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/NameLessGO&quot;&gt;https://codeberg.org/NameLessGO&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/natct&quot;&gt;https://codeberg.org/natct&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/neilvandyke&quot;&gt;https://codeberg.org/neilvandyke&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/neonew&quot;&gt;https://codeberg.org/neonew&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nette&quot;&gt;https://codeberg.org/nette&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nick3331&quot;&gt;https://codeberg.org/nick3331&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/niklaskorz&quot;&gt;https://codeberg.org/niklaskorz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Nordfriese&quot;&gt;https://codeberg.org/Nordfriese&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nostar&quot;&gt;https://codeberg.org/nostar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ntn888&quot;&gt;https://codeberg.org/ntn888&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ossie&quot;&gt;https://codeberg.org/ossie&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/patdyn&quot;&gt;https://codeberg.org/patdyn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/patrickuhlmann&quot;&gt;https://codeberg.org/patrickuhlmann&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/pat-s&quot;&gt;https://codeberg.org/pat-s&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/petris&quot;&gt;https://codeberg.org/petris&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/pinskia&quot;&gt;https://codeberg.org/pinskia&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/poVoq&quot;&gt;https://codeberg.org/poVoq&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/removewingman&quot;&gt;https://codeberg.org/removewingman&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/reynir&quot;&gt;https://codeberg.org/reynir&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rvba&quot;&gt;https://codeberg.org/rvba&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sandebert&quot;&gt;https://codeberg.org/sandebert&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SebasRebazCoding&quot;&gt;https://codeberg.org/SebasRebazCoding&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SinTan1729&quot;&gt;https://codeberg.org/SinTan1729&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Snoweuph&quot;&gt;https://codeberg.org/Snoweuph&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SpareJoe&quot;&gt;https://codeberg.org/SpareJoe&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SR-G&quot;&gt;https://codeberg.org/SR-G&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/stb&quot;&gt;https://codeberg.org/stb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/strypey&quot;&gt;https://codeberg.org/strypey&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thefinn93&quot;&gt;https://codeberg.org/thefinn93&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/theycallhermax&quot;&gt;https://codeberg.org/theycallhermax&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tilegg&quot;&gt;https://codeberg.org/tilegg&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/timedin&quot;&gt;https://codeberg.org/timedin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tmb&quot;&gt;https://codeberg.org/tmb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Tom3201&quot;&gt;https://codeberg.org/Tom3201&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/vadim&quot;&gt;https://codeberg.org/vadim&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/voltagex&quot;&gt;https://codeberg.org/voltagex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wangito33&quot;&gt;https://codeberg.org/wangito33&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xenrox&quot;&gt;https://codeberg.org/xenrox&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yoctozepto&quot;&gt;https://codeberg.org/yoctozepto&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yonas&quot;&gt;https://codeberg.org/yonas&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ZzenlD&quot;&gt;https://codeberg.org/ZzenlD&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/413x1nkp&quot;&gt;https://translate.codeberg.org/user/413x1nkp&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/aleksi&quot;&gt;https://translate.codeberg.org/user/aleksi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/artnay&quot;&gt;https://translate.codeberg.org/user/artnay&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/atarwn&quot;&gt;https://translate.codeberg.org/user/atarwn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Atul_Eterno&quot;&gt;https://translate.codeberg.org/user/Atul_Eterno&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/balinteus&quot;&gt;https://translate.codeberg.org/user/balinteus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/be4zad&quot;&gt;https://translate.codeberg.org/user/be4zad&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Benny&quot;&gt;https://translate.codeberg.org/user/Benny&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Beowulf&quot;&gt;https://translate.codeberg.org/user/Beowulf&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/buhtz&quot;&gt;https://translate.codeberg.org/user/buhtz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/CDN18&quot;&gt;https://translate.codeberg.org/user/CDN18&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ddogfoodd&quot;&gt;https://translate.codeberg.org/user/ddogfoodd&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/div72&quot;&gt;https://translate.codeberg.org/user/div72&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/eldyj&quot;&gt;https://translate.codeberg.org/user/eldyj&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/emansije&quot;&gt;https://translate.codeberg.org/user/emansije&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/feroli&quot;&gt;https://translate.codeberg.org/user/feroli&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Fjuro&quot;&gt;https://translate.codeberg.org/user/Fjuro&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Fnurkla&quot;&gt;https://translate.codeberg.org/user/Fnurkla&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/hankskyjames777&quot;&gt;https://translate.codeberg.org/user/hankskyjames777&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/jaahas&quot;&gt;https://translate.codeberg.org/user/jaahas&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/JoseDouglas26&quot;&gt;https://translate.codeberg.org/user/JoseDouglas26&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/kecrily&quot;&gt;https://translate.codeberg.org/user/kecrily&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/kmpm&quot;&gt;https://translate.codeberg.org/user/kmpm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/kwoot&quot;&gt;https://translate.codeberg.org/user/kwoot&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/lumi200&quot;&gt;https://translate.codeberg.org/user/lumi200&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/marcoaraujojunior&quot;&gt;https://translate.codeberg.org/user/marcoaraujojunior&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/meskobalazs&quot;&gt;https://translate.codeberg.org/user/meskobalazs&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Outbreak2096&quot;&gt;https://translate.codeberg.org/user/Outbreak2096&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/overloop&quot;&gt;https://translate.codeberg.org/user/overloop&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/pgmtx&quot;&gt;https://translate.codeberg.org/user/pgmtx&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/q3yi&quot;&gt;https://translate.codeberg.org/user/q3yi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/qwerty287&quot;&gt;https://translate.codeberg.org/user/qwerty287&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/SerikaFrame&quot;&gt;https://translate.codeberg.org/user/SerikaFrame&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/sinsky&quot;&gt;https://translate.codeberg.org/user/sinsky&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/SmolLemon&quot;&gt;https://translate.codeberg.org/user/SmolLemon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/SomeTr&quot;&gt;https://translate.codeberg.org/user/SomeTr&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/SteffoSpieler&quot;&gt;https://translate.codeberg.org/user/SteffoSpieler&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/stevenroose&quot;&gt;https://translate.codeberg.org/user/stevenroose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/thodorisl&quot;&gt;https://translate.codeberg.org/user/thodorisl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/tkbremnes&quot;&gt;https://translate.codeberg.org/user/tkbremnes&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Vac31&quot;&gt;https://translate.codeberg.org/user/Vac31&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/whitecold&quot;&gt;https://translate.codeberg.org/user/whitecold&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/William_Weber_Berrutti&quot;&gt;https://translate.codeberg.org/user/William_Weber_Berrutti&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/WithLithum&quot;&gt;https://translate.codeberg.org/user/WithLithum&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Wuzzy&quot;&gt;https://translate.codeberg.org/user/Wuzzy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Xinayder&quot;&gt;https://translate.codeberg.org/user/Xinayder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/xtex&quot;&gt;https://translate.codeberg.org/user/xtex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/yeziruo&quot;&gt;https://translate.codeberg.org/user/yeziruo&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo v9.0 is available</title><link>https://forgejo.org/2024-10-release-v9-0/</link><guid isPermaLink="true">https://forgejo.org/2024-10-release-v9-0/</guid><description>Forgejo v9.0 is available. It is the first version to be released under a copyleft license. Forgejo has early support for a soft-quota that can protect your server from high disk usage due to abuse. It also removes support for go-git, considered too hazardous for daily usage compared to Git. The translations saw an unprecedented number of improvements thanks to the hackathon organized by Codeberg.</description><pubDate>Wed, 16 Oct 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;/download/&quot;&gt;Forgejo v9.0&lt;/a&gt; was released 16 October 2024. You will find a short selection of the changes it introduces below and a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/milestone/7235&quot;&gt;complete list in the release notes&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;If stability is more important than new features, consider using Forgejo v7.0 instead: it is a Long Term Support release that will receive bug fixes until 16 July 2025. Forgejo v9.0 will be supported until &lt;a href=&quot;https://forgejo.org/docs/next/contributor/release/#release-cycle&quot;&gt;15 January 2025&lt;/a&gt;, when Forgejo v10.0 is published.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://v9.next.forgejo.org/&quot;&gt;dedicated test instance&lt;/a&gt; is available to try it out. Before upgrading it is &lt;em&gt;strongly recommended&lt;/em&gt; to make a full backup as explained in the &lt;a href=&quot;/docs/v9.0/admin/upgrade/&quot;&gt;upgrade guide&lt;/a&gt; and carefully read &lt;em&gt;all breaking changes&lt;/em&gt; from the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/milestone/7235&quot;&gt;release notes&lt;/a&gt;. If in doubt, do not hesitate to ask for help &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;in the chat room&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Summary&lt;/h2&gt; &lt;p&gt;Forgejo v9.0 is the first version to be released under a copyleft license, &lt;a href=&quot;https://forgejo.org/2024-08-monthly-update/#forgejo-is-now-copyleft&quot;&gt;after a year of discussions&lt;/a&gt;. Among the motivations for this change is the realization that a pattern emerged over the years, exemplified by Redis, CockroachDB, Terraform and many others. They turned proprietary because people chose their own financial gain over the interest of the general public. Forgejo admins no longer have to worry about this sword of Damocles: relicensing it as a proprietary software is not allowed.&lt;/p&gt; &lt;p&gt;The removal of the &lt;a href=&quot;https://github.com/go-git/go-git&quot;&gt;go-git&lt;/a&gt; backend is part of a larger effort to make Forgejo easier to maintain, more robust and even smaller than it already is (~100MB). When presented with &lt;code&gt;go-git&lt;/code&gt; as an alternative to Git, a Forgejo admin may overlook that it has less features and a history of &lt;a href=&quot;https://github.com/go-git/go-git/issues/878&quot;&gt;corrupting repositories&lt;/a&gt;. It would have been possible to work on documentation and new tests to ensure administrators do not run into these pitfalls, but the effort would have been out of proportion compared to the benefits it provides.&lt;/p&gt; &lt;p&gt;The Forgejo localization community was created early 2024 with the ambitious goal of gaining enough momentum to sustain a long term effort. A daunting task considering there are over 5,000 strings to translate, verify and improve. There has been many calls for help in the past and the community keeps growing steadily. Fortunately, the &lt;a href=&quot;https://codeberg.org/Codeberg/translathon-2024#translathon-2024&quot;&gt;translation hackathon (translathon)&lt;/a&gt; organized by Codeberg in October was exceptional. It attracted an unprecedented number of participants who improved or created thousands of translations.&lt;/p&gt; &lt;h2&gt;New features&lt;/h2&gt; &lt;p&gt;Below is short selection of the most notable changes. The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/milestone/7235&quot;&gt;complete list is available in the release notes&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4212&quot;&gt;PR&lt;/a&gt;: Added the foundations of a flexible, configurable quota system.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4819&quot;&gt;PR&lt;/a&gt;: Allow push mirrors to use an SSH key as the authentication method for the mirroring action instead of using user:password authentication. The SSH keypair is created by Forgejo and the destination repository must be configured with the public key to allow for push over SSH.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1445&quot;&gt;PR&lt;/a&gt;: A release asset can be a URL instead of a file.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4490&quot;&gt;PR&lt;/a&gt;: Accessibility keyboard support for test actions.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5482&quot;&gt;PR&lt;/a&gt; (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5524&quot;&gt;backported&lt;/a&gt;): &quot;Assign to me&quot; button on Pull Requests and Issues.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4903&quot;&gt;PR&lt;/a&gt;: Support grouping by any path for arch package.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4780&quot;&gt;PR&lt;/a&gt;: Add signature support for the RPM module.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4801&quot;&gt;PR&lt;/a&gt;: &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/feb43b2584b7f64ec7f9952af2b50b2210e6e6cf&quot;&gt;commit&lt;/a&gt; The actions logs older than &lt;code&gt;[actions].LOG_RETENTION_DAYS&lt;/code&gt; days are removed (the default is 365).&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4607&quot;&gt;PR&lt;/a&gt;: &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/d0227c236aa195bd03990210f968b8e52eb20b79&quot;&gt;commit&lt;/a&gt; issue Templates: add option to have dropdown printed list.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2869&quot;&gt;PR&lt;/a&gt;: Logs journald integration.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4710&quot;&gt;PR&lt;/a&gt;: Refactor repository migration items.&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Copyleft&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://forgejo.org/2024-08-gpl/&quot;&gt;The impact of the license change&lt;/a&gt; has been carefully considered with regard to the variety of usages of Forgejo. Someone might have chosen to avoid copyleft software, for example because it is discouraged in a company. However, Forgejo depends on Git, one of the most successful pieces of copyleft software. Both Forgejo and Git must be used together, either as individual binaries or bundled into the &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/v9.0-test&quot;&gt;official container images&lt;/a&gt;. The license of Git is &lt;a href=&quot;https://git-scm.com/about/free-and-open-source&quot;&gt;GNU GPL v2&lt;/a&gt;, another version of the same &lt;a href=&quot;https://www.gnu.org/licenses/copyleft.html&quot;&gt;copyleft license&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The majority of Forgejo&apos;s codebase is still MIT-licensed, but it is expected that an increasing number of files will switch to GNU GPL v3+ over time. With the notable exception of the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5083&quot;&gt;API swagger file that is and will stay MIT&lt;/a&gt; to clarify that the intent of the Forgejo authors is that it is used for interoperability with no restriction. It is not an original work and enforcing copyright on that file would probably be difficult anyway.&lt;/p&gt; &lt;h2&gt;Quotas&lt;/h2&gt; &lt;p&gt;Forgejo got early support for a soft-quota system that can protect your server from high disk usage due to abuse or user mistakes. This feature is still in development. If you will try to use it, consider sending us feedback via &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/&quot;&gt;a discussion&lt;/a&gt;, or the Matrix channels.&lt;/p&gt; &lt;p&gt;Forgejo has chosen to use a &quot;soft&quot; quota implementation. It means that Forgejo checks the quota usage only before an action is executed, but it will allow a started action to complete.&lt;/p&gt; &lt;p&gt;In some cases (like pushing to Git repositories), it is hard to estimate the exact new size, because it depends on how much data is available and how much we can benefit from compression. As a result, it is possible to exceed the quota if the operation was started before the quota was used up. After the quota is exceeded, new operations that would increase the quota won&apos;t be possible.&lt;/p&gt; &lt;p&gt;Furthermore, there is currently little support for early prevention of operations in the UI: The handling of, for example, web operations that are denied later is not yet optimal.&lt;/p&gt; &lt;p&gt;Read more in the &lt;a href=&quot;https://forgejo.org/docs/v9.0/admin/quota/&quot;&gt;Soft-Quota page of the documentation&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;The multi-architecture OCI leak is fixed&lt;/h2&gt; &lt;p&gt;When a multi-architecture container image is pushed to the Forgejo registry, the same tag is used but refers to different images. This is what Forgejo itself relies on to provide &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/7&quot;&gt;either arm64 or amd64&lt;/a&gt; depending on the platform (e.g. &lt;code&gt;docker pull codeberg.org/forgejo/forgejo:7&lt;/code&gt;).&lt;/p&gt; &lt;p&gt;This is implemented with &lt;a href=&quot;https://github.com/opencontainers/image-spec/blob/main/image-index.md&quot;&gt;an image index&lt;/a&gt; which points to &lt;a href=&quot;https://github.com/opencontainers/image-spec/blob/main/manifest.md&quot;&gt;image manifests&lt;/a&gt;. This level of indirection was unfortunately not taken into account when cleaning up dangling blobs. When a multi-architecture image was either deleted from the web interface or overridden by pushing new images with the same tag, the blobs were never deleted. This bug has been present in Forgejo since the beginning and went unnoticed for a long time, presumably because multi-architecture images are uncommon.&lt;/p&gt; &lt;p&gt;Forgejo will remove dangling blobs when it starts as well as in the existing daily container image cleanup. This will show in the logs with when looking for &lt;code&gt;grep -i CleanupSHA256&lt;/code&gt;:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;2024/10/15 00:00:00 ...er/cleanup_sha256.go:106:cleanupSHA256() [I] Nothing to cleanup 2024/10/15 00:00:00 ...er/cleanup_sha256.go:29:CleanupSHA256() [I] Finished to cleanup dangling images with a sha256:* version &lt;/code&gt;&lt;/pre&gt; &lt;p&gt;The time required for the cleanup to complete should be under a minute, even if ten of thousands of blobs were leaked. It is however recommended to give it a try using a backup of the Forgejo instance to be sure. For instance when &lt;a href=&quot;https://code.forgejo.org&quot;&gt;https://code.forgejo.org&lt;/a&gt; was upgraded, it cleaned up a few thousand dangling blobs for a total of around 50GB within less than 15 seconds. To accommodate large instances such as Codeberg, blobs are cleaned up 500 at a time.&lt;/p&gt; &lt;h2&gt;Removal of go-git support&lt;/h2&gt; &lt;p&gt;Forgejo used to have 2 Git backends: the normal git and &lt;a href=&quot;https://github.com/go-git/go-git&quot;&gt;go-git&lt;/a&gt; which is a Git implementation in pure Go. This the benefit of being a little bit faster than Git on Windows.&lt;/p&gt; &lt;p&gt;Supporting go-git would mean holding Forgejo back. Every Git Feature that Forgejo wants to use also needs to be implemented in go-git. For example: setting git notes in the Web UI is currently not possible in go-git. In addition go-git may lead to data loss and repository corruption &lt;a href=&quot;https://github.com/go-git/go-git/issues/878&quot;&gt;(one example)&lt;/a&gt;. It is not widely used and does not have extensive testing (see &lt;a href=&quot;https://github.com/go-git/go-git/issues/878&quot;&gt;the latest example of such corruption&lt;/a&gt;).&lt;/p&gt; &lt;p&gt;For these reasons, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4941&quot;&gt;go-git was removed from the codebase&lt;/a&gt;. It only affects users who built Forgejo manually using &lt;code&gt;TAGS=gogit&lt;/code&gt;, which no longer has any effect. This removal only happened in the development branch and not in the existing stable Forgejo branches, up to &lt;code&gt;v8.0/forgejo&lt;/code&gt; included.&lt;/p&gt; &lt;h2&gt;Transparent removal of Couchbase&lt;/h2&gt; &lt;p&gt;Using &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5090&quot;&gt;Couchbase as a session provider was removed&lt;/a&gt;. This is not a breaking change because it will transparently fallback to the file provider. The rationale for removing Couchbase support is that it is &lt;a href=&quot;https://www.couchbase.com/blog/couchbase-adopts-bsl-license/&quot;&gt;not free software&lt;/a&gt; and therefore cannot be tested in Forgejo and neither should be supported.&lt;/p&gt; &lt;h2&gt;Gitea compatibility&lt;/h2&gt; &lt;p&gt;Forgejo v9.0 has &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/branch/main/upgrade/upgrade.sh#L56-L57&quot;&gt;automated upgrade tests from Gitea v1.22 to Forgejo v9.0&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;An instance running Gitea versions up to v1.21 can be upgraded to Forgejo v7.0 or v8.0&lt;/li&gt; &lt;li&gt;An instance running Gitea v1.22 can be upgraded to Forgejo v8.0 or Forgejo v9.0&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Read more about &lt;a href=&quot;/2024-02-forking-forward/&quot;&gt;Gitea compatibility in the blog post explaining the hard fork that happened in February 2024&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Release schedule and Long Term Support&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;/docs/v9.0/contributor/release/#release-cycle&quot;&gt;time based release schedule&lt;/a&gt; was established to publish a release every three months. Patch releases will be published more frequently, depending on the severity of the bug or security fixes they contain.&lt;/p&gt; &lt;table&gt; &lt;thead&gt; &lt;tr&gt; &lt;th&gt;&lt;strong&gt;Date&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;Version&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;Release date&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;End Of Life&lt;/strong&gt;&lt;/th&gt; &lt;/tr&gt; &lt;/thead&gt; &lt;tbody&gt;&lt;tr&gt; &lt;td&gt;2024 Q1&lt;/td&gt; &lt;td&gt;&lt;strong&gt;7.0.0&lt;/strong&gt;&lt;/td&gt; &lt;td&gt;23 April 2024&lt;/td&gt; &lt;td&gt;&lt;strong&gt;16 July 2025&lt;/strong&gt;&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2024 Q2&lt;/td&gt; &lt;td&gt;8.0.0&lt;/td&gt; &lt;td&gt;30 July 2024&lt;/td&gt; &lt;td&gt;16 October 2024&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2024 Q3&lt;/td&gt; &lt;td&gt;&lt;strong&gt;9.0.0&lt;/strong&gt;&lt;/td&gt; &lt;td&gt;16 October 2024&lt;/td&gt; &lt;td&gt;15 January 2025&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2025 Q1&lt;/td&gt; &lt;td&gt;10.0.0&lt;/td&gt; &lt;td&gt;15 January 2025&lt;/td&gt; &lt;td&gt;16 April 2025&lt;/td&gt; &lt;/tr&gt; &lt;/tbody&gt;&lt;/table&gt; &lt;h3&gt;9.0-test daily releases&lt;/h3&gt; &lt;p&gt;Releases are built daily from the latest changes found in the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/v9.0/forgejo&quot;&gt;v9.0/forgejo&lt;/a&gt; development branch. They are deployed to the &lt;a href=&quot;https://v9.next.forgejo.org&quot;&gt;https://v9.next.forgejo.org&lt;/a&gt; instance for manual verification in case a bug fix is of particular interest ahead of the next patch release. It can also be installed locally with:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;OCI images: &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/9.0-test&quot;&gt;root&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/9.0-test-rootless&quot;&gt;rootless&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v9.0-test&quot;&gt;Binaries&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Their names are staying the same but they are replaced by new builds every day.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;This release contains many translation additions and improvements done by contributors on &lt;a href=&quot;https://translate.codeberg.org/projects/forgejo/forgejo/&quot;&gt;Codeberg Translate&lt;/a&gt;, and numerous improvements to the UX and translatability of English locale.&lt;/p&gt; &lt;p&gt;Translation updates and some improvements of English locale were also ported to v7.0 where there was no risk of regressions.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/Codeberg/translathon-2024#translathon-2024&quot;&gt;translation hackathon (translathon)&lt;/a&gt; organized by Codeberg in October resulted in many new contributors joining and making thousands of additions and improvements.&lt;/p&gt; &lt;h2&gt;Get Forgejo v9.0&lt;/h2&gt; &lt;p&gt;See the &lt;a href=&quot;/download/&quot;&gt;download page&lt;/a&gt; for instructions on how to install Forgejo, and read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/milestone/7235&quot;&gt;release notes&lt;/a&gt; for more information.&lt;/p&gt; &lt;h3&gt;Upgrading&lt;/h3&gt; &lt;p&gt;Carefully read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/milestone/7235&quot;&gt;breaking changes&lt;/a&gt; section of the release notes.&lt;/p&gt; &lt;p&gt;The actual upgrade process is as simple as replacing the binary or container image with the corresponding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v9.0.0&quot;&gt;Forgejo binary&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/9.0.0&quot;&gt;container image&lt;/a&gt;. If you&apos;re using the container images, you can use the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/9.0&quot;&gt;&lt;code&gt;9.0&lt;/code&gt; tag&lt;/a&gt; to stay up to date with the latest &lt;code&gt;9.0.Y&lt;/code&gt; patch release automatically.&lt;/p&gt; &lt;p&gt;Make sure to check the &lt;a href=&quot;/docs/v9.0/admin/upgrade&quot;&gt;Forgejo upgrade documentation&lt;/a&gt; for recommendations on how to properly backup your instance before the upgrade.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo do not hold back, it is also your project. Open an issue in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;the issue tracker&lt;/a&gt; for feature requests or bug reports, reach out &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop into &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;the Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) and say hi!&lt;/p&gt; &lt;h3&gt;Donate&lt;/h3&gt; &lt;p&gt;Forgejo is proud to be &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/&quot;&gt;funded transparently&lt;/a&gt;. Additionally it accept donations &lt;a href=&quot;https://liberapay.com/forgejo&quot;&gt;through Liberapay&lt;/a&gt;. It is also possible to &lt;a href=&quot;https://docs.codeberg.org/improving-codeberg/donate/&quot;&gt;donate to Codeberg e.V.&lt;/a&gt; in case the Liberapay option does not work out for you, and part of the funding is used to &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/#forgejo-resources-per-year&quot;&gt;compensate for work on Forgejo&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;However, the Liberapay team allows for money to go directly to developers without a round-trip to Codeberg. Additionally, Liberapay allows for a steady and reliable funding stream next to other options, a crucial aspect for the project. The distribution of funds through Liberapay is &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#liberapay-team-members&quot;&gt;transparently controlled using the decision-making process&lt;/a&gt;, and Forgejo contributors are encouraged to consider applying to benefit from this funding opportunity.&lt;/p&gt; &lt;p&gt;Thank you for using Forgejo and considering a donation, in case your financial situation allows you to.&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - September 2024</title><link>https://forgejo.org/2024-09-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2024-09-monthly-update/</guid><description>Forgejo v9.0 release candidates are available for testing to prepare for the release scheduled 16 October 2024. The contributor and testing documentation were improved with the goal of encouraging more diverse participation. The infrastructure dedicated to Forgejo development suffered a downtime because of excessive crawling and mitigation measures were implemented.</description><pubDate>Sun, 06 Oct 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;The monthly report is meant to provide a good overview of what has changed in Forgejo in the past month. If you would like to help, please get in touch in &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;the chatroom&lt;/a&gt; or participate in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions&quot;&gt;ongoing discussions&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Forgejo v9.0 release candidates&lt;/h2&gt; &lt;p&gt;The first release candidates for &lt;a href=&quot;https://forgejo.org/docs/next/contributor/release/#release-cycle&quot;&gt;Forgejo v9.0&lt;/a&gt; was published &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/5380&quot;&gt;25 September&lt;/a&gt; and code.forgejo.org upgraded. A call &lt;a href=&quot;https://forgejo.org/2024-09-preparing-v9/&quot;&gt;for participation&lt;/a&gt; was published, asking for help with translations and testing.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/227&quot;&gt;regression was discovered&lt;/a&gt; in the v9.0 release candidate that incorrectly deleted some of the images &lt;a href=&quot;https://code.forgejo.org/oci/-/packages&quot;&gt;mirrored from the Docker hub&lt;/a&gt;. It disrupted the CI intermittently during 48h before a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5430&quot;&gt;fix was published and deployed&lt;/a&gt;. The root cause was a bug in the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4698&quot;&gt;cron task that cleanup dangling container images&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Forgejo Design process&lt;/h2&gt; &lt;p&gt;Efforts on long-term improvements to Forgejo have been kept low in the past month, however there was a noteworthy exchange on &lt;a href=&quot;https://codeberg.org/forgejo/design/issues/20&quot;&gt;moderation features&lt;/a&gt; in Forgejo. Initially, an idea was investigated to track reported content in a specific issue tracker, but the idea was discarded some time later due to the volume of spam issues on Codeberg, which probably requires a more efficient UI. The moderation features will not make it into Forgejo v9, but they will remain in the focus of design work.&lt;/p&gt; &lt;h2&gt;Contributor documentation and test suite&lt;/h2&gt; &lt;p&gt;By the end of August, a &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/212&quot;&gt;discussion emerged to improve Forgejo&apos;s testing infrastructure&lt;/a&gt;, making it more friendly to new developers.&lt;/p&gt; &lt;p&gt;Since the last monthly update, multiple improvements have been made:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;The contributing resources in the documentation have been &lt;a href=&quot;https://codeberg.org/forgejo/docs/pulls/821&quot;&gt;cleaned and updated&lt;/a&gt;, with the goal of encouraging more diverse contributions, &lt;a href=&quot;https://forgejo.org/docs/next/contributor/welcome/&quot;&gt;sending a warm welcome&lt;/a&gt; to new contributors and clarifying the motivation and instructions for writing tests. If you did not yet contribute to Forgejo, now is a good time to get started and provide us with feedback.&lt;/li&gt; &lt;li&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5235&quot;&gt;in-repo hints for testing&lt;/a&gt; have been deduplicated and updated to make getting started easier. And numerous smaller improvements have been made to the end-to-end test suite that uses real browsers to ensure actions in the Forgejo UI work as expected. They &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5322&quot;&gt;added&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5287&quot;&gt;improved&lt;/a&gt; examples.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Using the improved test infrastructure, the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commits/branch/forgejo/tests/e2e&quot;&gt;frequency of new browser tests&lt;/a&gt; has increased a lot compared to recent months.&lt;/p&gt; &lt;h2&gt;Helm chart&lt;/h2&gt; &lt;p&gt;A new major version, &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v9.0.0&quot;&gt;9.0.0&lt;/a&gt; was published. It sets proper namespaces and allows override.&lt;/p&gt; &lt;p&gt;The Forgejo helm chart had &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases&quot;&gt;many minor and patch updates&lt;/a&gt;, in both v7 and v8. &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v7.1.2&quot;&gt;Helm chart v7.1.2&lt;/a&gt; and &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v8.1.1&quot;&gt;v8.2.3&lt;/a&gt; are the latest.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;A significant effort was made to backport translations to the LTS version (Forgejo v7.0). There was hope for new languages added in this version to reach better completion in its primary lifetime, but it is taking longer than expected. This and other considerations led to &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/226&quot;&gt;a proposal&lt;/a&gt; to do less backporting to old stable to prevent breakage and save time.&lt;/p&gt; &lt;p&gt;A very large change was &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5306&quot;&gt;ported from Gitea&lt;/a&gt; and is good for internationalization. But it was not easy to also preserve the existing strings and it could have broken a few non-English strings in Forgejo v9. Some translators caught the problem and it was luckily fixed in time.&lt;/p&gt; &lt;p&gt;The overall translation activity was about twice lower than last month, which was very active.&lt;/p&gt; &lt;h2&gt;Forgejo Actions&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://code.forgejo.org/forgejo/nlnet-off-ngie-forgejo&quot;&gt;security audit&lt;/a&gt; bootstrapped &lt;a href=&quot;/2024-08-monthly-update/#forgejo-runner&quot;&gt;last month&lt;/a&gt; has its own repository to track the work done as transparently as possible. A &lt;a href=&quot;https://code.forgejo.org/forgejo/nlnet-off-ngie-forgejo/issues/1&quot;&gt;suitable pentester&lt;/a&gt; was found and &lt;a href=&quot;https://code.forgejo.org/forgejo/nlnet-off-ngie-forgejo/issues/2&quot;&gt;the scope of the audit&lt;/a&gt; was determined during a call. A rough plan was &lt;a href=&quot;https://code.forgejo.org/forgejo/nlnet-off-ngie-forgejo/issues/3&quot;&gt;drafted&lt;/a&gt; and approved by NLnet who is funding the audit. The work should begin in November 2024.&lt;/p&gt; &lt;h2&gt;Optimizing CI pipelines&lt;/h2&gt; &lt;p&gt;In order to ensure a high software quality, Forgejo (like most larger project) runs CI/CD pipelines that perform a series of automated checks on the source code, ensuring that contribution meet certain quality standards.&lt;/p&gt; &lt;p&gt;Running these pipelines consumes significant amount of energy and adds to the climate footprint of free/libre software development.&lt;/p&gt; &lt;p&gt;In a quest to make Forgejo &lt;a href=&quot;https://wimvanderbauwhede.codeberg.page/articles/frugal-computing/&quot;&gt;more frugal in the use of computing&lt;/a&gt; in the development lifecycle, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/5127&quot;&gt;optimizations to the CI/CD pipelines&lt;/a&gt; have been considered and a part of the work was merged.&lt;/p&gt; &lt;p&gt;The optimizations include &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5297&quot;&gt;caching the playwright environment in a test image&lt;/a&gt; and improvements to the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5328&quot;&gt;caching of Go dependencies&lt;/a&gt; that improves on the caching available from the &lt;code&gt;setup-go&lt;/code&gt; action that spent 10x2 minutes per job creating compressed archives. The action is &lt;a href=&quot;https://codeberg.org/fnetX/setup-cache-go&quot;&gt;also available to other projects&lt;/a&gt; and a dedicated contribution to the Forgejo Actions ecosystem.&lt;/p&gt; &lt;h2&gt;Infrastructure&lt;/h2&gt; &lt;p&gt;On &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/219&quot;&gt;9 September&lt;/a&gt; code.forgejo.org was down during 10 hours. It was overwhelmed by excessive crawling and the response time was so slow that it kept accumulating a backlog and answering every request with a timeout. On top of that it happened late at night and although it was trivially fixed by restarting Forgejo, it only happened the next morning.&lt;/p&gt; &lt;p&gt;This was the first significant downtime and &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/220&quot;&gt;impacted a number of Forgejo instances&lt;/a&gt; that are using Forgejo Actions hosted on code.forgejo.org. A number of measures were taken to prevent that from happening:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/infrastructure/documentation/pulls/9&quot;&gt;Rate-limiting is imposed&lt;/a&gt; on the most aggressive crawlers.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/robots.txt&quot;&gt;Exclusion rules&lt;/a&gt; were defined and added to robots.txt.&lt;/li&gt; &lt;li&gt;Members of the devops team are notified on their mobile when &lt;a href=&quot;https://status.forgejo.ovh/&quot;&gt;monitoring detects a problem&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;An ad-hoc script was written to detect excessive timeouts during extended periods of time and automatically restart Forgejo if needed.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The script is a hack that must not stay. It proved useful a couple of times while working on strategies to reduce crawling to manageable levels. It still represents over 50% of the incoming requests but they do not impact the instance performances.&lt;/p&gt; &lt;p&gt;The long term solution, as code.forgejo.org audience grows, is to improve its availability. The test instances at v*.next.forgejo.org are already &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/&quot;&gt;using Forgejo helm&lt;/a&gt;, each in &lt;a href=&quot;https://code.forgejo.org/infrastructure/k8s&quot;&gt;a dedicated k3s cluster&lt;/a&gt;. A long lived &lt;a href=&quot;https://code.forgejo.org/infrastructure/documentation#k8s-node&quot;&gt;k8s cluster&lt;/a&gt; is being deployed to use the same Forgejo helm so code.forgejo.org can be migrated there. The goal is for built-in health monitoring to automatically react to an unhealthy Forgejo instance and restart it using idiomatic k8s methods instead of an ad-hoc script.&lt;/p&gt; &lt;p&gt;There is no urgency for the k8s cluster to replace the LXC based infrastructure. But it will take some time to improve code.forgejo.org availability in this way and the works started right away so that it has a chance to be ready before the next incident happens.&lt;/p&gt; &lt;h2&gt;Sustainability&lt;/h2&gt; &lt;p&gt;A procedure for receiving payment from Codeberg on Forgejo work &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/61&quot;&gt;was documented&lt;/a&gt; and discussed. The details of the funds received and spent in 2024 were &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls/60/files&quot;&gt;updated&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The progress of the ongoing grant &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/src/branch/main/2022-12-01-nlnet&quot;&gt;was updated&lt;/a&gt;. It was extended until the end of 2024 and got an informal agreement to increase the funding by 10K€. The legal status of the donations in Europe &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/62&quot;&gt;was documented&lt;/a&gt; with an example based on a Freelance established in Portugal, with links to do the same for other European countries.&lt;/p&gt; &lt;p&gt;The progress of the federation grant &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/src/branch/main/2022-08-01-nlnet&quot;&gt;was also updated&lt;/a&gt; and a &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls/59&quot;&gt;request for payment drafted&lt;/a&gt; for 2,500€. The grant will expire 1 December 2024 and the unspent funds will be returned to NLnet where they can be used by other projects.&lt;/p&gt; &lt;p&gt;Questions were received from NLnet on the latest grant application and &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls/57&quot;&gt;an answer sent&lt;/a&gt; which led to &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/63&quot;&gt;followup questions&lt;/a&gt;. Because of the required delay in answering those questions, the grant application was moved by a few months, to the next call.&lt;/p&gt; &lt;p&gt;The sustainability team elected &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#sustainability-team&quot;&gt;its first member&lt;/a&gt;. They helped with following up with the current grants and document the progress made so far.&lt;/p&gt; &lt;p&gt;The relevance of creating a non profit exclusively dedicated to managing the Forgejo funds and governed by the Forgejo decision making process &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/224&quot;&gt;was discussed&lt;/a&gt;. A balance should be found between the burden of managing a new organization and the benefit of being more flexible than Codeberg. The current situation is problematic as a significant amount of the funds obtained in the past two years (in excess of 60,000€) will have to be returned when the grants expire by the end of 2024.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/0ko&quot;&gt;https://codeberg.org/0ko&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/adaaa&quot;&gt;https://codeberg.org/adaaa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/aimuz&quot;&gt;https://codeberg.org/aimuz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Alexilator&quot;&gt;https://codeberg.org/Alexilator&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/algernon&quot;&gt;https://codeberg.org/algernon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Arsen&quot;&gt;https://codeberg.org/Arsen&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/avobs&quot;&gt;https://codeberg.org/avobs&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ayakael&quot;&gt;https://codeberg.org/ayakael&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bartavi&quot;&gt;https://codeberg.org/bartavi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/benniekiss&quot;&gt;https://codeberg.org/benniekiss&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bramh&quot;&gt;https://codeberg.org/bramh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/btlogy&quot;&gt;https://codeberg.org/btlogy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/cbn8krgm&quot;&gt;https://codeberg.org/cbn8krgm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/cemoktra&quot;&gt;https://codeberg.org/cemoktra&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/chrysn&quot;&gt;https://codeberg.org/chrysn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Chucky2401&quot;&gt;https://codeberg.org/Chucky2401&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/clarfonthey&quot;&gt;https://codeberg.org/clarfonthey&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/coderofsalvation&quot;&gt;https://codeberg.org/coderofsalvation&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/CommanderRedYT&quot;&gt;https://codeberg.org/CommanderRedYT&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DamianT&quot;&gt;https://codeberg.org/DamianT&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/danjones000&quot;&gt;https://codeberg.org/danjones000&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ddevault&quot;&gt;https://codeberg.org/ddevault&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/delgh1&quot;&gt;https://codeberg.org/delgh1&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Dirk&quot;&gt;https://codeberg.org/Dirk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dmowitz&quot;&gt;https://codeberg.org/dmowitz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/douglasparker&quot;&gt;https://codeberg.org/douglasparker&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dragon&quot;&gt;https://codeberg.org/dragon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/el0n&quot;&gt;https://codeberg.org/el0n&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Ember&quot;&gt;https://codeberg.org/Ember&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Erayd&quot;&gt;https://codeberg.org/Erayd&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/esainane&quot;&gt;https://codeberg.org/esainane&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ezra&quot;&gt;https://codeberg.org/ezra&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/f403&quot;&gt;https://codeberg.org/f403&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/floss4good&quot;&gt;https://codeberg.org/floss4good&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/foxy&quot;&gt;https://codeberg.org/foxy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fuggla&quot;&gt;https://codeberg.org/fuggla&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GamePlayer-8&quot;&gt;https://codeberg.org/GamePlayer-8&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GDWR&quot;&gt;https://codeberg.org/GDWR&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gnu1&quot;&gt;https://codeberg.org/Gnu1&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/grgi&quot;&gt;https://codeberg.org/grgi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/h759bkyo4&quot;&gt;https://codeberg.org/h759bkyo4&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/IamLunchbox&quot;&gt;https://codeberg.org/IamLunchbox&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/io7m&quot;&gt;https://codeberg.org/io7m&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JacksonBailey&quot;&gt;https://codeberg.org/JacksonBailey&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jean-daricade&quot;&gt;https://codeberg.org/jean-daricade&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jwildeboer&quot;&gt;https://codeberg.org/jwildeboer&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kuolemaa&quot;&gt;https://codeberg.org/kuolemaa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Kwonunn&quot;&gt;https://codeberg.org/Kwonunn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lapo&quot;&gt;https://codeberg.org/lapo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/LDericher&quot;&gt;https://codeberg.org/LDericher&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/linos&quot;&gt;https://codeberg.org/linos&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/MaddinM&quot;&gt;https://codeberg.org/MaddinM&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mahlzahn&quot;&gt;https://codeberg.org/mahlzahn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mai-Lapyst&quot;&gt;https://codeberg.org/Mai-Lapyst&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/maltejur&quot;&gt;https://codeberg.org/maltejur&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/marcellmars&quot;&gt;https://codeberg.org/marcellmars&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/matrss&quot;&gt;https://codeberg.org/matrss&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mcnesium&quot;&gt;https://codeberg.org/mcnesium&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mdt&quot;&gt;https://codeberg.org/mdt&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Merith-TK&quot;&gt;https://codeberg.org/Merith-TK&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/michael-sparrow&quot;&gt;https://codeberg.org/michael-sparrow&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/midirhee12&quot;&gt;https://codeberg.org/midirhee12&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mih&quot;&gt;https://codeberg.org/mih&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mirkoperillo&quot;&gt;https://codeberg.org/mirkoperillo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mkobel&quot;&gt;https://codeberg.org/mkobel&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mlncn&quot;&gt;https://codeberg.org/mlncn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mvdkleijn&quot;&gt;https://codeberg.org/mvdkleijn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/neonew&quot;&gt;https://codeberg.org/neonew&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Neureka&quot;&gt;https://codeberg.org/Neureka&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nhathaway&quot;&gt;https://codeberg.org/nhathaway&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nobodyinperson&quot;&gt;https://codeberg.org/nobodyinperson&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ossie&quot;&gt;https://codeberg.org/ossie&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/paspflue&quot;&gt;https://codeberg.org/paspflue&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/patdyn&quot;&gt;https://codeberg.org/patdyn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/pat-s&quot;&gt;https://codeberg.org/pat-s&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/pavi&quot;&gt;https://codeberg.org/pavi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/poVoq&quot;&gt;https://codeberg.org/poVoq&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/pylixonly&quot;&gt;https://codeberg.org/pylixonly&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/removewingman&quot;&gt;https://codeberg.org/removewingman&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rtfb&quot;&gt;https://codeberg.org/rtfb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rvba&quot;&gt;https://codeberg.org/rvba&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/s1m&quot;&gt;https://codeberg.org/s1m&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sandebert&quot;&gt;https://codeberg.org/sandebert&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/saurabh&quot;&gt;https://codeberg.org/saurabh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sclu1034&quot;&gt;https://codeberg.org/sclu1034&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SLASHLogin&quot;&gt;https://codeberg.org/SLASHLogin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/s-l-s&quot;&gt;https://codeberg.org/s-l-s&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SludgePhD&quot;&gt;https://codeberg.org/SludgePhD&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/solomonv&quot;&gt;https://codeberg.org/solomonv&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Squel&quot;&gt;https://codeberg.org/Squel&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/stb&quot;&gt;https://codeberg.org/stb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/stevenroose&quot;&gt;https://codeberg.org/stevenroose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tgy&quot;&gt;https://codeberg.org/tgy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thefinn93&quot;&gt;https://codeberg.org/thefinn93&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thefox&quot;&gt;https://codeberg.org/thefox&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/toolforger&quot;&gt;https://codeberg.org/toolforger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/VadZ&quot;&gt;https://codeberg.org/VadZ&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/virtulis&quot;&gt;https://codeberg.org/virtulis&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/voltagex&quot;&gt;https://codeberg.org/voltagex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wangito33&quot;&gt;https://codeberg.org/wangito33&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xenrox&quot;&gt;https://codeberg.org/xenrox&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Xinayder&quot;&gt;https://codeberg.org/Xinayder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xtex&quot;&gt;https://codeberg.org/xtex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yoctozepto&quot;&gt;https://codeberg.org/yoctozepto&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yonas&quot;&gt;https://codeberg.org/yonas&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/aleksi&quot;&gt;https://translate.codeberg.org/user/aleksi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ciampix&quot;&gt;https://translate.codeberg.org/user/ciampix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/emansije&quot;&gt;https://translate.codeberg.org/user/emansije&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/EssGeeEich&quot;&gt;https://translate.codeberg.org/user/EssGeeEich&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/muhaaliss&quot;&gt;https://translate.codeberg.org/user/muhaaliss&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Outbreak2096&quot;&gt;https://translate.codeberg.org/user/Outbreak2096&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/salif&quot;&gt;https://translate.codeberg.org/user/salif&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/toasterbirb&quot;&gt;https://translate.codeberg.org/user/toasterbirb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Zughy&quot;&gt;https://translate.codeberg.org/user/Zughy&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Help us in making Forgejo v9 a great release</title><link>https://forgejo.org/2024-09-preparing-v9/</link><guid isPermaLink="true">https://forgejo.org/2024-09-preparing-v9/</guid><description>Your help in preparing the next Forgejo release is appreciated. Now is a good time to step in.</description><pubDate>Wed, 25 Sep 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;We are looking forward to shipping the improvements we have made in the past months to all Forgejo users. Today, we have reached the next milestone in our &lt;a href=&quot;/docs/v8.0/developer/release/#release-cycle&quot;&gt;release cycle&lt;/a&gt;, reaching a period of feature freeze to focus on fixing bugs. The release of Forgejo v9.0 is scheduled for 16 October 2024.&lt;/p&gt; &lt;p&gt;It is a good moment for you to help ensuring the next Forgejo release is a success. Thank you for your support!&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;With the feature freeze comes a period of less new strings to translate. Now is the best time to translate Forgejo into your language, we invite you to &lt;a href=&quot;/docs/next/contributor/localization/&quot;&gt;check out the localization guide&lt;/a&gt; and joining us on Weblate.&lt;/p&gt; &lt;p&gt;Localizing Forgejo helps more users around the world to get involved in free/libre software development, including end-users submitting bug reports and students who get in touch with Forgejo in schools.&lt;/p&gt; &lt;p&gt;Additionally, raising the completion status before the next release reduces the effort on our end to backport translations to existing Forgejo releases.&lt;/p&gt; &lt;p&gt;Join our localization effort today!&lt;/p&gt; &lt;h2&gt;Using&lt;/h2&gt; &lt;p&gt;If you can upgrade your Forgejo version to the latest state in the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/v9.0/forgejo&quot;&gt;&lt;code&gt;v9.0/forgejo&lt;/code&gt;&lt;/a&gt; branch, you can spot and report issues before other users do. Ensure you make a backup of your data, just in case.&lt;/p&gt; &lt;p&gt;We are looking forward to your feedback or bug reports. Test the upcoming version of Forgejo today!&lt;/p&gt; &lt;h2&gt;Developing&lt;/h2&gt; &lt;p&gt;If you always wanted to help developing for Forgejo, we appreciate your help in fixing bugs for the upcoming version.&lt;/p&gt; &lt;p&gt;Take a look at &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues?labels=201023%2c222666&quot;&gt;this list of bugs that might be &quot;good first issue&quot;s&lt;/a&gt;. Let us know if you are interested to take a look at any of them, and we&apos;ll be here to assist you completing them before the release date.&lt;/p&gt; &lt;p&gt;If you can spare more time, also take a look at other and new bug reports, try to reproduce them and diagnose the issues together with the team.&lt;/p&gt; &lt;h2&gt;Donating&lt;/h2&gt; &lt;p&gt;If you cannot spare some time right now, but still want to support Forgejo, consider &lt;a href=&quot;https://liberapay.com/forgejo&quot;&gt;setting up a donation to our Liberapay team&lt;/a&gt; or &lt;a href=&quot;https://docs.codeberg.org/improving-codeberg/donate/&quot;&gt;donating to Codeberg&lt;/a&gt; to enable other Forgejo developers to complete their work.&lt;/p&gt; &lt;h3&gt;Get in touch&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - August 2024</title><link>https://forgejo.org/2024-08-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2024-08-monthly-update/</guid><description>Forgejo changed its license from MIT to GNU GPL v3+, it is now copyleft, just like Git. A pull request for federated user activity following using ActivityPub saw significant progress. Space usage quotas for users and organizations was implemented. The Forgejo security policy was published.</description><pubDate>Sat, 31 Aug 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;The monthly report is meant to provide a good overview of what has changed in Forgejo in the past month. If you would like to help, please get in touch in &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;the chatroom&lt;/a&gt; or participate in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions&quot;&gt;ongoing discussions&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;It was decided more than a year ago and finally happened: Forgejo changed its license from MIT to &lt;a href=&quot;https://forgejo.org/2024-08-gpl/&quot;&gt;GNU GPL v3+&lt;/a&gt; and accepts contributions with a simple &lt;a href=&quot;https://forgejo.org/docs/next/developer/dco/&quot;&gt;Developer Certificate of Origin&lt;/a&gt;. It is an additional guarantee that it will not drift away from Free Software and become &lt;a href=&quot;https://en.wikipedia.org/wiki/Open-core_model&quot;&gt;Open Core&lt;/a&gt; like GitLab or Gitea.&lt;/p&gt; &lt;p&gt;Last month, the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/4153&quot;&gt;v8.0 release date was postponed multiple times&lt;/a&gt; because bugs were discovered at the last minute. This rather time consuming effort was rewarded by a smooth upgrade of Codeberg and other instances. The absence of problems allowed Forgejo contributors to focus on features and structural improvements: ActivityPub federation, storage quotas, security policy, and more.&lt;/p&gt; &lt;h2&gt;Forgejo is now copyleft&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://forgejo.org/2024-08-gpl/&quot;&gt;The impact of the license change&lt;/a&gt; has been carefully considered with regard to the variety of usages of Forgejo. Someone might have chosen to avoid copyleft software, for example because it is discouraged in a company. However, Forgejo depends on Git, one of the most successful copyleft software. Both Forgejo and Git must be used together, either as individual binaries or bundled into the &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/v9.0-test&quot;&gt;official container images&lt;/a&gt;. The license of Git is &lt;a href=&quot;https://git-scm.com/about/free-and-open-source&quot;&gt;GNU GPL v2&lt;/a&gt;, another version of the same &lt;a href=&quot;https://www.gnu.org/licenses/copyleft.html&quot;&gt;copyleft license&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The majority of Forgejo&apos;s codebase is still MIT-licensed, but it is expected that an increasing number of files will switch to GNU GPL v3+ over time. With the notable exception of the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5083&quot;&gt;API swagger file that is and will stay MIT&lt;/a&gt; to clarify that the intent of the Forgejo authors is that it is used for interoperability with no restriction. It is not an original work and enforcing copyright on that file would probably be difficult anyway.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/192&quot;&gt;discussions on how to improve&lt;/a&gt; Forgejo&apos;s licensing are still very lively and will eventually lead to decisions that will improve its legal protection, in the interest of the general public.&lt;/p&gt; &lt;h2&gt;Federation&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/208&quot;&gt;Federation is getting useful&lt;/a&gt;. There is now more than preliminary background work, and the first exciting things could be tried out by users. The work is not near the goal yet.&lt;/p&gt; &lt;p&gt;Building upon the foundations released with Forgejo v8.0, a pull request for &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4767&quot;&gt;federated user activity following&lt;/a&gt; saw significant progress. The core idea is that any activity (where activity is defined as anything that ends up in the Forgejo user activity) is wrapped in an ap.Note, and sent to followers in the ActivityPub sense. Similarly, the inbox of local users now accepts such Notes. Additionally, there&apos;s now a &quot;Feeds&quot; tab on the user profile page, which displays the received notes.&lt;/p&gt; &lt;h2&gt;go-git support is removed from the codebase&lt;/h2&gt; &lt;p&gt;Forgejo used to have 2 Git backends: the normal git and &lt;a href=&quot;https://github.com/go-git/go-git&quot;&gt;go-git&lt;/a&gt; which is a Git implementation in pure Go. This had 2 benefits:&lt;/p&gt; &lt;ol&gt; &lt;li&gt;You don&apos;t need git installed.&lt;/li&gt; &lt;li&gt;It is a little bit faster than Git on Windows.&lt;/li&gt; &lt;/ol&gt; &lt;p&gt;Supporting go-git would mean holding Forgejo back. Every Git Feature that Forgejo wants to use also needs to be implemented in go-git. For example: setting git notes in the Web UI is currently not possible in go-git. In addition go-git may lead to data loss and repository corruption &lt;a href=&quot;https://github.com/go-git/go-git/issues/878&quot;&gt;(one example)&lt;/a&gt;. It is not widely used and does not have extensive testing (see &lt;a href=&quot;https://github.com/go-git/go-git/issues/878&quot;&gt;the latest example of such corruption&lt;/a&gt;).&lt;/p&gt; &lt;p&gt;For these reasons, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4941&quot;&gt;go-git was removed from the codebase&lt;/a&gt;. It only affects users who built Forgejo manually using &lt;code&gt;TAGS=gogit&lt;/code&gt;, which no longer has any effect. This removal only happened in the development branch and not in the existing stable Forgejo branches, up to &lt;code&gt;v8.0/forgejo&lt;/code&gt; included.&lt;/p&gt; &lt;h2&gt;Noteworthy pull requests&lt;/h2&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4212&quot;&gt;Space usage quotas for users and organizations&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1445&quot;&gt;A release asset can be a URL instead of a file&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4698&quot;&gt;Add a cron task to cleanup dangling container images with version sha256:*&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5090&quot;&gt;Remove support for Couchbase as a session provider&lt;/a&gt;; it instead will now fallback to the file provider. The rationale for removing Couchbase support is that it&apos;s not free software, &lt;a href=&quot;https://www.couchbase.com/blog/couchbase-adopts-bsl-license/&quot;&gt;https://www.couchbase.com/blog/couchbase-adopts-bsl-license/&lt;/a&gt;, and therefore cannot be tested in Forgejo and neither should be supported.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4819&quot;&gt;Allow push mirrors to use a SSH key as the authentication method&lt;/a&gt; for the mirroring action instead of using user:password authentication. The SSH keypair is created by Forgejo and the destination repository must be configured with the public key to allow for push over SSH.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/bf7373a2520ae56a1dc00416efa02de9749b63d3&quot;&gt;Forgejo Actions logs are compressed by default&lt;/a&gt;. It can be disabled by setting [actions].LOG_COMPRESSION=none.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Read more &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/milestones&quot;&gt;in the draft release notes for the upcoming major version&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;OCI mirror&lt;/h2&gt; &lt;p&gt;Forgejo &lt;a href=&quot;https://code.forgejo.org/forgejo/oci-mirror/src/commit/5c750a36ad39692206cc04eca85b6a34b5367a31/.forgejo/workflows/mirror.yml&quot;&gt;maintains a mirror&lt;/a&gt; of &lt;a href=&quot;https://code.forgejo.org/oci/-/packages&quot;&gt;container images&lt;/a&gt; that are commonly used in the CI and the release process. The primary motivation is to not be subject to rate limiting &lt;a href=&quot;https://docs.docker.com/docker-hub/download-rate-limit/&quot;&gt;when using the Docker hub&lt;/a&gt; as well as saving bandwidth.&lt;/p&gt; &lt;p&gt;There still were two problems that led to a rate limiting incident disrupting the CI during a few hours:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;A number of references to container images were not using the mirror - they were replaced&lt;/li&gt; &lt;li&gt;The mirror itself was rate limited because it used &lt;code&gt;skopeo copy&lt;/code&gt; - it was &lt;a href=&quot;https://code.forgejo.org/forgejo/oci-mirror/pulls/4&quot;&gt;replaced with &lt;code&gt;skopeo sync&lt;/code&gt;&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Release notes automation&lt;/h2&gt; &lt;p&gt;In addition to the preview shown in each pull request, the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/milestones&quot;&gt;Forgejo milestones&lt;/a&gt; for all upcoming releases are &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/eb25bc9edb5d33621fbebda20475139f42d62ad7/.forgejo/workflows/release-notes-assistant-milestones.yml&quot;&gt;updated daily with the draft release notes&lt;/a&gt; compiled from all the pull requests.&lt;/p&gt; &lt;h2&gt;Design and User Interface&lt;/h2&gt; &lt;p&gt;Semantic HTML often was a discussion topic, and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4995&quot;&gt;a pull request was merged to demonstrate&lt;/a&gt; how forms could look like with less classes and less weird divs all over the place. They bring consistency out of the box (you only need to change some CSS properties, no need to keep your templates in sync). It was followed by &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5031&quot;&gt;a refactor of some forms to improve semantic HTML, usability, accessibility, and reduce the JavaScript footprint&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/212&quot;&gt;A discussion started to improve the testing infrastructure&lt;/a&gt;. The &quot;reasonable effort&quot; for the tests is eaten up by just figuring out how to get test data populated. Contributors asked to write tests, should not follow a paper chase. It led to pull requests to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5108&quot;&gt;move &lt;code&gt;CreateDeclarativeRepo&lt;/code&gt; to more accessible location&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/5110&quot;&gt;improve diffs generated by Forgejo to make testing more convenient&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Helm chart&lt;/h2&gt; &lt;p&gt;The Forgejo helm chart had &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases&quot;&gt;many minor and patch updates&lt;/a&gt;, in both v7 and v8. &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v7.0.5&quot;&gt;Helm chart v7.0.5&lt;/a&gt; and &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v8.1.1&quot;&gt;v8.1.1&lt;/a&gt; were released which contain Forgejo security fixes.&lt;/p&gt; &lt;p&gt;Each version is tested against a kubernetes cluster to verify it works. It was using &lt;a href=&quot;https://kind.sigs.k8s.io/&quot;&gt;kind&lt;/a&gt; but it turned out to be difficult to debug when the number of transient errors increased. &lt;a href=&quot;https://k3s.io/&quot;&gt;K3S&lt;/a&gt; is &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/pulls/773/files&quot;&gt;used&lt;/a&gt; instead and proved to be more stable.&lt;/p&gt; &lt;h2&gt;Forgejo v8.0 install party&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/198&quot;&gt;The Forgejo v8.0 install party&lt;/a&gt; was a nice community meetup and we got to know some Forgejo users. Some users performed their updates live and had only minor issues that were mostly caused by an issue on their end. Due to the lack of actual problems, some might have perceived it as boring. Finally, it was decided to also upgrade Codeberg to Forgejo v8, which was also a smooth experience.&lt;/p&gt; &lt;h2&gt;Social account&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;https://floss.social/@forgejo&lt;/a&gt; was setup about two years ago and it works flawlessly. However, a problem emerged over the past six months that &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/205&quot;&gt;requires finding a new home&lt;/a&gt;: the moderation team at floss.social cannot be contacted, &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/87&quot;&gt;despite numerous attempts over a period of months and via multiple channels&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Nothing indicates it is anything more than a case of being overwhelmed by requests on a rather large instance. But it is best addressed by looking for a new home now instead of waiting that an event requiring moderation happens and is left unattended.&lt;/p&gt; &lt;h2&gt;Security policy&lt;/h2&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/159&quot;&gt;discussion began&lt;/a&gt; in 2023, before Forgejo became a hard-fork of Gitea, to improve the security collaboration with upstream projects. It led to &lt;a href=&quot;https://pad.gusted.xyz/s/uN6kscBuh&quot;&gt;a security policy&lt;/a&gt; that was &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/159&quot;&gt;agreed on&lt;/a&gt; according to the &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/159&quot;&gt;Forgejo decision making process&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Dependency management&lt;/h2&gt; &lt;p&gt;A dedicated &lt;a href=&quot;https://code.forgejo.org/forgejo-contrib/forgejo-renovate/src/branch/main/.forgejo/workflows/renovate.yml#L21&quot;&gt;renovate repository&lt;/a&gt; runs every 30 minutes in the &lt;a href=&quot;https://code.forgejo.org&quot;&gt;https://code.forgejo.org&lt;/a&gt; instance to service Forgejo related projects, saving them the burden of running it individually.&lt;/p&gt; &lt;p&gt;The configuration of renovate within Forgejo spaces is the same with regard to Go dependencies. Instead of repeating them in each repository (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/d34d8ec2cfd92451edbadb371cd101fdf2160fad/renovate.json&quot;&gt;forgejo/renovate.json&lt;/a&gt;, &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/commit/1008f44ddbfdc732a41b466985cac0785924af18/renovate.json&quot;&gt;runner/renovate.json&lt;/a&gt;), they &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/commit/82523d1d8e52f607bf7dd87d64f892b704803354/renovate.json&quot;&gt;import a shared configuration&lt;/a&gt; found in &lt;a href=&quot;https://code.forgejo.org/forgejo/renovate-config/src/commit/9f969e5d320ebad4816c51ae30ff4131dc559802/renovate.json&quot;&gt;a repository&lt;/a&gt; created for that purpose.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;5 batches of translation updates were merged with 2090 new strings and 1020 string improvements - more than the previous two months combined.&lt;/p&gt; &lt;p&gt;The localization team keeps making sure that the merged translation updates are backported to the current stable versions of Forgejo, so that the releases are always shipped with the most complete and highest quality translations available.&lt;/p&gt; &lt;p&gt;Forgejo is used by a wide variety of people and organizations around the world. For some of them the availability and quality of translations are important factors. Everyone is welcome to contribute to the localization by translating and checking strings. Details on how to participate can be found &lt;a href=&quot;https://forgejo.org/docs/next/contributor/localization/&quot;&gt;here&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Forgejo runner&lt;/h2&gt; &lt;p&gt;A new version of the Forgejo runner was published which &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/RELEASE-NOTES.md#3-5-1&quot;&gt;fixes a security issue&lt;/a&gt;. It was made easier by using the same tooling as Forgejo itself to &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/pulls?poster=163&quot;&gt;upgrade the dependencies&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Security is the most important aspect that the Forgejo runner needs to address before it can be considered for beta testing and will be helped &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/204&quot;&gt;by a security audit&lt;/a&gt; which is in the early stages with &lt;a href=&quot;https://www.radicallyopensecurity.com&quot;&gt;Radically Open Security&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;It will also need more contributors to help with its long term maintenance and anyone interested is encouraged to join.&lt;/p&gt; &lt;h2&gt;Sustainability&lt;/h2&gt; &lt;p&gt;Donations to the &lt;a href=&quot;https://liberapay.com/forgejo&quot;&gt;Forgejo Liberapay team&lt;/a&gt; reached around 40€ per week and are distributed to &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#liberapay-team-members&quot;&gt;three beneficiaries&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Drawing upon &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/144&quot;&gt;previous sustainability discussions&lt;/a&gt;, a &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls?labels=244292&quot;&gt;grant application was submitted&lt;/a&gt; for the &lt;a href=&quot;https://www.sovereigntechfund.de/&quot;&gt;Sovereign Tech Fund&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The creation of a sustainability team, tasked to map out and implement a strategy on how to make Forgejo a durable endeavour over the next years &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/163&quot;&gt;was proposed&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/0ko&quot;&gt;https://codeberg.org/0ko&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/abueide&quot;&gt;https://codeberg.org/abueide&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/AdamGreenberg&quot;&gt;https://codeberg.org/AdamGreenberg&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/alex19srv&quot;&gt;https://codeberg.org/alex19srv&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/algernon&quot;&gt;https://codeberg.org/algernon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/AliveDevil&quot;&gt;https://codeberg.org/AliveDevil&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Andre601&quot;&gt;https://codeberg.org/Andre601&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/arija&quot;&gt;https://codeberg.org/arija&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/AverageHelper&quot;&gt;https://codeberg.org/AverageHelper&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/avobs&quot;&gt;https://codeberg.org/avobs&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ayakael&quot;&gt;https://codeberg.org/ayakael&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/behm&quot;&gt;https://codeberg.org/behm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bengrue&quot;&gt;https://codeberg.org/bengrue&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Beowulf&quot;&gt;https://codeberg.org/Beowulf&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bookworm&quot;&gt;https://codeberg.org/bookworm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bramh&quot;&gt;https://codeberg.org/bramh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/catgirll&quot;&gt;https://codeberg.org/catgirll&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/CPU_Blanc&quot;&gt;https://codeberg.org/CPU_Blanc&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/depeo&quot;&gt;https://codeberg.org/depeo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Dirk&quot;&gt;https://codeberg.org/Dirk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dploeger&quot;&gt;https://codeberg.org/dploeger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dragon&quot;&gt;https://codeberg.org/dragon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/el0n&quot;&gt;https://codeberg.org/el0n&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ell1e&quot;&gt;https://codeberg.org/ell1e&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/eloy&quot;&gt;https://codeberg.org/eloy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/emilylange&quot;&gt;https://codeberg.org/emilylange&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fadedave&quot;&gt;https://codeberg.org/fadedave&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fontenot&quot;&gt;https://codeberg.org/fontenot&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/gedw99&quot;&gt;https://codeberg.org/gedw99&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/h759bkyo4&quot;&gt;https://codeberg.org/h759bkyo4&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/heartshake&quot;&gt;https://codeberg.org/heartshake&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hexa&quot;&gt;https://codeberg.org/hexa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/intelfx&quot;&gt;https://codeberg.org/intelfx&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/io7m&quot;&gt;https://codeberg.org/io7m&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ironmagma&quot;&gt;https://codeberg.org/ironmagma&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/izzy&quot;&gt;https://codeberg.org/izzy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JakobDev&quot;&gt;https://codeberg.org/JakobDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/j-dominguez9&quot;&gt;https://codeberg.org/j-dominguez9&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jean-daricade&quot;&gt;https://codeberg.org/jean-daricade&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jthvai&quot;&gt;https://codeberg.org/jthvai&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/justinsimmons&quot;&gt;https://codeberg.org/justinsimmons&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jwildeboer&quot;&gt;https://codeberg.org/jwildeboer&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kita&quot;&gt;https://codeberg.org/kita&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kuolemaa&quot;&gt;https://codeberg.org/kuolemaa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Kwonunn&quot;&gt;https://codeberg.org/Kwonunn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/l_austenfeld&quot;&gt;https://codeberg.org/l_austenfeld&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/liberodark&quot;&gt;https://codeberg.org/liberodark&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/LordMZTE&quot;&gt;https://codeberg.org/LordMZTE&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mahlzahn&quot;&gt;https://codeberg.org/mahlzahn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mai-Lapyst&quot;&gt;https://codeberg.org/Mai-Lapyst&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/maltejur&quot;&gt;https://codeberg.org/maltejur&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/marcellmars&quot;&gt;https://codeberg.org/marcellmars&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/martinwguy&quot;&gt;https://codeberg.org/martinwguy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/matrss&quot;&gt;https://codeberg.org/matrss&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/maxadamo&quot;&gt;https://codeberg.org/maxadamo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mehrad&quot;&gt;https://codeberg.org/mehrad&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mickenordin&quot;&gt;https://codeberg.org/mickenordin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mkobel&quot;&gt;https://codeberg.org/mkobel&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mrwsl&quot;&gt;https://codeberg.org/mrwsl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/msrd0&quot;&gt;https://codeberg.org/msrd0&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Musselman&quot;&gt;https://codeberg.org/Musselman&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/naipotato&quot;&gt;https://codeberg.org/naipotato&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/omenos&quot;&gt;https://codeberg.org/omenos&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/paspflue&quot;&gt;https://codeberg.org/paspflue&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/patdyn&quot;&gt;https://codeberg.org/patdyn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/paulvt&quot;&gt;https://codeberg.org/paulvt&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Porkepix&quot;&gt;https://codeberg.org/Porkepix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/realaravinth&quot;&gt;https://codeberg.org/realaravinth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/recursive_recursion&quot;&gt;https://codeberg.org/recursive_recursion&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/reynir&quot;&gt;https://codeberg.org/reynir&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rohitsharma09&quot;&gt;https://codeberg.org/rohitsharma09&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Ryuno-Ki&quot;&gt;https://codeberg.org/Ryuno-Ki&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/schelmo&quot;&gt;https://codeberg.org/schelmo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sclu1034&quot;&gt;https://codeberg.org/sclu1034&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SIMULATAN&quot;&gt;https://codeberg.org/SIMULATAN&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/skobkin&quot;&gt;https://codeberg.org/skobkin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/slingamn&quot;&gt;https://codeberg.org/slingamn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sneakers-the-rat&quot;&gt;https://codeberg.org/sneakers-the-rat&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/solomonv&quot;&gt;https://codeberg.org/solomonv&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/stb&quot;&gt;https://codeberg.org/stb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/strk&quot;&gt;https://codeberg.org/strk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/taifoss&quot;&gt;https://codeberg.org/taifoss&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Techwizz&quot;&gt;https://codeberg.org/Techwizz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tepozoa&quot;&gt;https://codeberg.org/tepozoa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thefox&quot;&gt;https://codeberg.org/thefox&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thilinajayanath&quot;&gt;https://codeberg.org/thilinajayanath&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/toolforger&quot;&gt;https://codeberg.org/toolforger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/vwbusguy&quot;&gt;https://codeberg.org/vwbusguy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wangyan&quot;&gt;https://codeberg.org/wangyan&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/waseigo&quot;&gt;https://codeberg.org/waseigo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/WhyNotHugo&quot;&gt;https://codeberg.org/WhyNotHugo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xlii&quot;&gt;https://codeberg.org/xlii&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xyhhx&quot;&gt;https://codeberg.org/xyhhx&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yarikoptic&quot;&gt;https://codeberg.org/yarikoptic&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yoctozepto&quot;&gt;https://codeberg.org/yoctozepto&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ciampix&quot;&gt;https://translate.codeberg.org/user/ciampix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/emansije&quot;&gt;https://translate.codeberg.org/user/emansije&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ewm&quot;&gt;https://translate.codeberg.org/user/ewm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Fjuro&quot;&gt;https://translate.codeberg.org/user/Fjuro&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/hahahahacker2009&quot;&gt;https://translate.codeberg.org/user/hahahahacker2009&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/hankskyjames777&quot;&gt;https://translate.codeberg.org/user/hankskyjames777&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/hoovad&quot;&gt;https://translate.codeberg.org/user/hoovad&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/hugoalh&quot;&gt;https://translate.codeberg.org/user/hugoalh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/leana8959&quot;&gt;https://translate.codeberg.org/user/leana8959&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/lotigara&quot;&gt;https://translate.codeberg.org/user/lotigara&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Outbreak2096&quot;&gt;https://translate.codeberg.org/user/Outbreak2096&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/pswsm&quot;&gt;https://translate.codeberg.org/user/pswsm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/qui&quot;&gt;https://translate.codeberg.org/user/qui&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Wuzzy&quot;&gt;https://translate.codeberg.org/user/Wuzzy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Xinayder&quot;&gt;https://translate.codeberg.org/user/Xinayder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/zub&quot;&gt;https://translate.codeberg.org/user/zub&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Zughy&quot;&gt;https://translate.codeberg.org/user/Zughy&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo is now copyleft, just like Git</title><link>https://forgejo.org/2024-08-gpl/</link><guid isPermaLink="true">https://forgejo.org/2024-08-gpl/</guid><description>In June 2023, Forgejo agreed to allow copyleft code to be merged in the codebase. A year later, in August 2024, the first pull requests to take advantage of this opportunity were merged. Forgejo versions starting from v9.0 are now released under a copyleft license and earlier Forgejo versions, including v8.0 and v7.0 patch releases remain under the MIT license.</description><pubDate>Thu, 22 Aug 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Forgejo is changing its license to a &lt;a href=&quot;https://en.wikipedia.org/wiki/Copyleft&quot;&gt;Copyleft license&lt;/a&gt;. This blog post will try to bring clarity about the impact to you, explain the motivation behind this change and answer some questions you might have.&lt;/p&gt; &lt;h2&gt;How will this impact me?&lt;/h2&gt; &lt;p&gt;We have carefully considered the impact the license change has on the variety of usages of Forgejo, and we believe there is little reason to worry. We are not aware of any negative consequences implied by the license change to users who are aligned with Forgejo&apos;s values. While we cannot give legal advice of any kind, we&apos;ll give a first overview of the new requirements.&lt;/p&gt; &lt;p&gt;If you set up Forgejo from our official distributions (e.g. binaries, docker images etc), it is very unlikely that you are affected at all. We do our best to ensure that our Forgejo distributions are fully compliant out of the box.&lt;/p&gt; &lt;p&gt;You can also build Forgejo from source, even modify it, host it for yourself and others.&lt;/p&gt; &lt;p&gt;If you are redistributing Forgejo binaries, for example because you are packaging it for GNU/Linux distributions or some specific container / package format, you are now required to provide the full source of your Forgejo variant (including potential modifications) under the same license terms as Forgejo itself.&lt;/p&gt; &lt;p&gt;You are free to sell Forgejo services, including hosting it for others. If you act according to our values and ensure your users receive the freedoms Forgejo grants you, it is unlikely that you have to do adjustments to your business now or in the future.&lt;/p&gt; &lt;p&gt;You might have chosen to avoid copyleft software, for example because it is discouraged in your company. However, Forgejo depends on Git, one of the most successful copyleft software. Both Forgejo and Git must be used together, either as individual binaries or bundled into the &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/v9.0-test&quot;&gt;official container images&lt;/a&gt;. The license of Git is &lt;a href=&quot;https://git-scm.com/about/free-and-open-source&quot;&gt;GNU GPL v2&lt;/a&gt;, another version of the same &lt;a href=&quot;https://www.gnu.org/licenses/copyleft.html&quot;&gt;copyleft license&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Why the license change?&lt;/h2&gt; &lt;p&gt;Developers who choose to publish their work under a copyleft license are excluded from participating in software that is published under a permissive license. That is at the opposite of the &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/MISSION.md#values&quot;&gt;core values&lt;/a&gt; of the Forgejo project and &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/20&quot;&gt;in June 2023 it was decided to also accept copylefted&lt;/a&gt; contributions. A year later, in August 2024, the first pull request &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/AGREEMENTS.md#licensing&quot;&gt;to take advantage of this opportunity&lt;/a&gt; was &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4698/files&quot;&gt;proposed and merged&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A copyleft license makes reusing other copyleft software easier. Recently, we discovered that &lt;a href=&quot;https://forgejo.org/2024-07-non-free-dependency-found/&quot;&gt;some of the dependencies we used were incompatible with the license Forgejo was distributed with&lt;/a&gt;, and they had to be removed for now. Choosing copyleft licenses enables us to reuse more work, and saves us precious time to focus on improving Forgejo itself.&lt;/p&gt; &lt;p&gt;Copyleft licenses do not only benefit the developers. They also guarantee freedoms to users of the software. They reduce the risk of exploitive business practices, like creating a modified version of Forgejo with less freedoms to the users, which could ultimately trap users in a vendor lock-in.&lt;/p&gt; &lt;h2&gt;What is changing, now and in the future?&lt;/h2&gt; &lt;p&gt;Forgejo versions starting from v9.0 are now released &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/LICENSE&quot;&gt;under the GPL v3+&lt;/a&gt; and earlier Forgejo versions, including v8.0 and v7.0 patch releases remain under &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/v8.0/forgejo/LICENSE&quot;&gt;the MIT license&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The license of Forgejo is not carved in stone and this change shows that it can adapt to the needs of the project. It also shows that it is a long process: it took months of discussions to reach the agreement in 2023. And another year for it to be put to use. This slow pace reflects how difficult it is to make a sound decision knowing it will have a long lasting impact.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/192&quot;&gt;discussions on how to improve&lt;/a&gt; Forgejo&apos;s licensing are still very lively and will eventually lead to decisions that will improve its legal protection, in the interest of the general public.&lt;/p&gt; &lt;h2&gt;Contribute to Forgejo&lt;/h2&gt; &lt;p&gt;Forgejo is in a unique position among the software forges: It serves its users and is guaranteed to be free and independent, managed by a non-profit organization and &lt;a href=&quot;https://codeberg.org/forgejo/governance&quot;&gt;a transparent governance process&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;If you are considering contributing to Forgejo, now that your work is protected by a copyleft license, we welcome you to our exciting journey and we are looking forward to forging with you.&lt;/p&gt; &lt;p&gt;If you want to back Forgejo&apos;s independence with a financial contribution, check out our newly-created &lt;a href=&quot;https://liberapay.com/forgejo&quot;&gt;Liberapay team&lt;/a&gt; to compensate our developers for their invested time.&lt;/p&gt; &lt;p&gt;If you have any feedback or suggestions, do not hold back, it is also your project. Open an issue in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;the issue tracker&lt;/a&gt; for feature requests or bug reports, reach out &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop into &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;the Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) and say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo Security Release v8.0.1 &amp; v7.0.7</title><link>https://forgejo.org/2024-08-release-v801/</link><guid isPermaLink="true">https://forgejo.org/2024-08-release-v801/</guid><description>The Forgejo v8.0.1 &amp; v7.0.7 releases contain a security fix for a cross-site scripting (XSS) vulnerability that allowed repository owners to create links that executed javascript when clicking on them.</description><pubDate>Fri, 09 Aug 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Forgejo &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v8.0.1&quot;&gt;v8.0.1&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v7.0.7&quot;&gt;v7.0.7&lt;/a&gt; was released 9 August 2024.&lt;/p&gt; &lt;p&gt;These releases contain a fix for a security issue, which can be exploited by registered Forgejo users who can change the description of a repository. A &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1433&quot;&gt;change introduced in Forgejo v1.21&lt;/a&gt; allows a Forgejo user with write permission on a repository description &lt;a href=&quot;https://en.wikipedia.org/wiki/Cross-site_scripting&quot;&gt;to inject a client-side script into the web page viewed by the visitor&lt;/a&gt;. This XSS vulnerability allows for &lt;code&gt;href&lt;/code&gt; in anchor elements to be set to a &lt;code&gt;javascript:&lt;/code&gt; URI in the repository description, which will execute the specified script upon clicking (and not upon loading). &lt;a href=&quot;https://pkg.go.dev/github.com/microcosm-cc/bluemonday#Policy.AllowStandardURLs&quot;&gt;&lt;code&gt;AllowStandardURLs&lt;/code&gt;&lt;/a&gt; is now called for the repository description policy, which ensures that URIs in anchor elements are &lt;code&gt;mailto:&lt;/code&gt;, &lt;code&gt;http://&lt;/code&gt; or &lt;code&gt;https://&lt;/code&gt; thereby disallowing the &lt;code&gt;javascript:&lt;/code&gt; URI.&lt;/p&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We &lt;em&gt;strongly recommend&lt;/em&gt; that all Forgejo installations are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - July 2024</title><link>https://forgejo.org/2024-07-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2024-07-monthly-update/</guid><description>A non-free JavaScript library was found in the project&apos;s dependency structure, and the entire component that relied on it was re-implemented. Forgejo v8.0 is available with new features, a new approach to UI and UX, careful upgrade of dependencies to improve stability and security. Foundation parts for ActivityPub based federation and data portability were merged in.</description><pubDate>Wed, 31 Jul 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;The monthly report is meant to provide a good overview of what has changed in Forgejo in the past month. If you would like to help, please get in touch in &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;the chatroom&lt;/a&gt; or participate in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions&quot;&gt;ongoing discussions&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;&lt;a href=&quot;https://forgejo.org/2024-07-non-free-dependency-found/&quot;&gt;A non-free JavaScript library was found&lt;/a&gt; in the project&apos;s dependency structure, and the entire component that relied on it was re-implemented. The new versions 8.0.0 and 7.0.6 were released without this library. This step is important to meet the core values of Forgejo.&lt;/p&gt; &lt;p&gt;&lt;a href=&quot;https://forgejo.org/2024-07-release-v8-0/&quot;&gt;Forgejo v8.0 is available&lt;/a&gt; with new features (support for workflow dispatch, better defaults to avoid spam on new instances etc.), a new approach to UI and UX, careful upgrade of dependencies to improve stability and security. Foundation parts for ActivityPub based federation and data portability were merged in.&lt;/p&gt; &lt;h2&gt;Forgejo v8.0 release&lt;/h2&gt; &lt;p&gt;A gentle way of describing Forgejo User eXperience is that it is an acquired taste: it grew over the years, driven by the inspiration of the person with the keyboard in their hand. Once implemented it almost never changed. A user who started with Forgejo in 2022 can only see minor changes in 2024 and not all of them make intuitive sense. The solution to this problem is simple and was identified early on: &lt;a href=&quot;https://jdittrich.github.io/userNeedResearchBook/&quot;&gt;User Research&lt;/a&gt;. But only in the making of Forgejo v8.0 did it get some momentum.&lt;/p&gt; &lt;p&gt;A special effort was also made to reduce the breaking changes of this release to a minimum. For instance it would have been easier to implement &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3363&quot;&gt;this improvement to the rootless OCI image&lt;/a&gt; as a breaking change. But significant time was spent to figure out a way to make it backward compatible. Another example is the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3934&quot;&gt;new default for self-registration&lt;/a&gt; that only applies to new installations to not require a manual intervention to change the settings.&lt;/p&gt; &lt;h2&gt;Licensing&lt;/h2&gt; &lt;p&gt;The release of Forgejo v8.0 was delayed because it was discovered that a non-free dependency of a dependency initially created for Gitea was loaded into the project.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://github.com/go-gitea/gitea/commit/81cfe243f9cb90b0a75de7a03bb2d264c97f0036#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519R9&quot;&gt;dependency already existed&lt;/a&gt; at the time of the fork from Gitea and was therefore included in Forgejo from the beginning. The commitment of Forgejo is to always be &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/MISSION.md#values&quot;&gt;free as in freedom, open source and a community-first product&lt;/a&gt;. Non-free dependencies and distribution licenses are incompatible with the values of Forgejo. Therefore, it was of high importance to remove the problematic dependency&lt;/p&gt; &lt;p&gt;Read more in &lt;a href=&quot;/2024-07-non-free-dependency-found/&quot;&gt;the &quot;Non-free dependency discovered in Forgejo and removed&quot;&lt;/a&gt; blog post.&lt;/p&gt; &lt;p&gt;In &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/24&quot;&gt;June last year&lt;/a&gt; an agreement &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/AGREEMENTS.md#licensing&quot;&gt;was reached&lt;/a&gt; by which:&lt;/p&gt; &lt;blockquote&gt; &lt;p&gt;Forgejo accepts contributions compatible with the GPLv3-or-later license. The license under which Forgejo is distributed will be changed upon the acceptance of such contributions. See the LICENSE file for the current license.&lt;/p&gt; &lt;/blockquote&gt; &lt;p&gt;This has not happened yet but there now are pull requests in flight that have copylefted code in them. &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/192&quot;&gt;Discussions started&lt;/a&gt; to find the best way to move forward.&lt;/p&gt; &lt;h2&gt;Design&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/design&quot;&gt;forgejo/design&lt;/a&gt; repository was created. Design being wider than the visual appearance, it&apos;s about User eXperience, workflows, efficiency, and even technical aspects. It is the interface between the UI and User Research Teams, they iterate on features, gather data, exchange ideas.&lt;/p&gt; &lt;p&gt;The envisioned workflow is:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Feature requests are filed to Forgejo.&lt;/li&gt; &lt;li&gt;When some of them sound interesting or related, a new issue in forgejo/design is created to coordinate the work on a feature.&lt;/li&gt; &lt;li&gt;New insights (e.g. from user research, but also from duplicate or related issues) can be quickly referenced in the related issue.&lt;/li&gt; &lt;li&gt;The related Git repository is used for developing the actual state of the feature. People can propose changes which are documented in markdown files.&lt;/li&gt; &lt;li&gt;Whenever a design is ready, it can be referenced again in the Forgejo repository and used for implementation.&lt;/li&gt; &lt;li&gt;When a developer wants to start working on something and would like to get design feedback, they also open an issue in the design repo to gain input UI wise and from user research.&lt;/li&gt; &lt;li&gt;Finally, the design repo should contain guidelines for consistency as a developer resource.&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Helm chart&lt;/h2&gt; &lt;p&gt;It is used to deploy the test instances v8.next.forgejo.org and v9.next.forgejo.org using a &lt;a href=&quot;https://code.forgejo.org/infrastructure/k8s&quot;&gt;dedicated repository&lt;/a&gt; in the newly created &lt;a href=&quot;https://code.forgejo.org/infrastructure&quot;&gt;infrastructure organization&lt;/a&gt; that contains the code automating the updates to the Forgejo infrastructure.&lt;/p&gt; &lt;p&gt;The Forgejo helm chart had &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases&quot;&gt;four patch updates&lt;/a&gt;, one for &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v7.0.2&quot;&gt;7.0.2&lt;/a&gt; which depends on Forgejo v7.0.5, one for &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v7.0.3&quot;&gt;7.0.3&lt;/a&gt; and another for &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v5.1.3&quot;&gt;5.1.3&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A new major version, &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v8.1.0&quot;&gt;8.1.0&lt;/a&gt; was published and includes &lt;a href=&quot;https://forgejo.org/2024-07-release-v8-0/&quot;&gt;Forgejo v8.0.0&lt;/a&gt; as well as changes from the Gitea chart.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;Malayalam and Serbian translations, although incomplete, existed in the past but were deleted from the repository over a year ago, before the Forgejo localization team was established. They were stored on a proprietary translation platform, waiting to reach a percentage of completion before being added back. But Forgejo works differently: all translations are present in the repository and only a selected subset is displayed to the user, when they reach an acceptable completion percentage. The once deleted files for Malayalam and Serbian were restored in the repository to help resume the translation effort.&lt;/p&gt; &lt;h2&gt;Release notes assistant&lt;/h2&gt; &lt;p&gt;Forgejo release notes do not fit the popular trend that consists on enforcing &lt;a href=&quot;https://www.conventionalcommits.org/&quot;&gt;conventional commits&lt;/a&gt; so that &lt;a href=&quot;https://github.com/orhun/git-cliff&quot;&gt;tools&lt;/a&gt; can collect them because:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;strong&gt;The unit of change in Forgejo is the pull request, not the commit.&lt;/strong&gt; It is not uncommon for a pull request to contain multiple commits that are related but independent from each other. Squashing them into a single commit is not an option. There are diverging opinions on the matter and enforcing a merge policy where pull requests are always squashed into a single commit leads to a nicely flat commit history. But Forgejo made a different choice.&lt;/li&gt; &lt;li&gt;&lt;strong&gt;A single commit or pull request may require multiple release note lines.&lt;/strong&gt; When upgrading a dependency by modifying one line in the &lt;code&gt;go.mod&lt;/code&gt; file leads to user facing changes, each of them needs to be described in the release notes. Forgejo relies on hundreds of other Free Software projects and although most of them are plumbing that the Forgejo user do not need to be aware of, others are very visible such as the web editor.&lt;/li&gt; &lt;li&gt;&lt;strong&gt;Release notes need manual editing.&lt;/strong&gt; No matter how good and disciplined the author of a pull request is, there will be typos and unification problems that are best addressed when preparing the release, at the very last stage.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Discussions started early 2024 (&lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/159&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/155&quot;&gt;there&lt;/a&gt;) to distribute the release notes workload to the author of each pull request rather than relying on a single person manually doing the same a few days before the release. As the number of contributors to Forgejo increased significantly early 2024, the quality of the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-0&quot;&gt;v7.0.0 release notes&lt;/a&gt; was sub-standard and a solution had to be found.&lt;/p&gt; &lt;p&gt;Read more in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/197&quot;&gt;Scaling out Forgejo release notes&lt;/a&gt; postmortem.&lt;/p&gt; &lt;h2&gt;Sustainability&lt;/h2&gt; &lt;p&gt;Donations are now accepted for the &lt;a href=&quot;https://liberapay.com/forgejo&quot;&gt;Forgejo Liberapay team&lt;/a&gt;. Liberapay is a French non-profit dedicated to crowdfunding with predictable income, allowing transfers via multiple payment options and providers with a comparably low fee. It was already possible to &lt;a href=&quot;https://docs.codeberg.org/improving-codeberg/donate/&quot;&gt;donate to Codeberg e.V.&lt;/a&gt;, and part of the funding was used to &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/#forgejo-resources-per-year&quot;&gt;compensate for work on Forgejo&lt;/a&gt;. However, the Liberapay team now allows for money to go directly to developers without a roundtrip to Codeberg. Additionally, Liberapay allows for a steady and reliable funding stream next to other options, a crucial aspect for our project. The distribution of funds through Liberapay is &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#liberapay-team-members&quot;&gt;transparently controlled using our decision-making process&lt;/a&gt;, and Forgejo contributors are encouraged to consider applying to benefit from this funding opportunity.&lt;/p&gt; &lt;p&gt;The NLnet grant application &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls?labels=220838&quot;&gt;submitted 1 April&lt;/a&gt; passed the first round of review and will have to answer questions to qualify for the second round.&lt;/p&gt; &lt;p&gt;Drawing upon &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/144&quot;&gt;previous sustainability discussions&lt;/a&gt;, a &lt;a href=&quot;https://codeberg.org/avobs/sustainability/src/branch/main/2024-07-22%20STF/application_text.md&quot;&gt;grant application was drafted&lt;/a&gt; for the &lt;a href=&quot;https://www.sovereigntechfund.de/&quot;&gt;Sovereign Tech Fund&lt;/a&gt;. It seems to be a good fit for Forgejo, and in particular for the a similar project outline already proposed to OTF. Unlike the OTF call, STF does not have deadlines for general funding requests. It could be submitted before mid-August.&lt;/p&gt; &lt;p&gt;Discussions started to etablish a sustainability team, tasked to map out and implement a strategy on how to make Forgejo a durable endeavour over the next years. It seems that the project is at a point where it could use a concerted effort in this direction, even if, or maybe because, it isn&apos;t a very popular matter.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/0ko&quot;&gt;https://codeberg.org/0ko&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ajtatum&quot;&gt;https://codeberg.org/ajtatum&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/alexandria&quot;&gt;https://codeberg.org/alexandria&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/algernon&quot;&gt;https://codeberg.org/algernon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/anbraten&quot;&gt;https://codeberg.org/anbraten&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/arija&quot;&gt;https://codeberg.org/arija&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/avobs&quot;&gt;https://codeberg.org/avobs&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/awiteb&quot;&gt;https://codeberg.org/awiteb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/banaanihillo&quot;&gt;https://codeberg.org/banaanihillo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/behm&quot;&gt;https://codeberg.org/behm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bencurio&quot;&gt;https://codeberg.org/bencurio&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/benedictjohannes&quot;&gt;https://codeberg.org/benedictjohannes&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/benniekiss&quot;&gt;https://codeberg.org/benniekiss&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Beowulf&quot;&gt;https://codeberg.org/Beowulf&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bramh&quot;&gt;https://codeberg.org/bramh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/chizutan5&quot;&gt;https://codeberg.org/chizutan5&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/clarfonthey&quot;&gt;https://codeberg.org/clarfonthey&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/clemensgeibel&quot;&gt;https://codeberg.org/clemensgeibel&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/codebert&quot;&gt;https://codeberg.org/codebert&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Crown0815&quot;&gt;https://codeberg.org/Crown0815&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Cyborus&quot;&gt;https://codeberg.org/Cyborus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Darthagnon&quot;&gt;https://codeberg.org/Darthagnon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dcz&quot;&gt;https://codeberg.org/dcz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/depeo&quot;&gt;https://codeberg.org/depeo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Dirk&quot;&gt;https://codeberg.org/Dirk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dleberre&quot;&gt;https://codeberg.org/dleberre&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dstensnes&quot;&gt;https://codeberg.org/dstensnes&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/efertone&quot;&gt;https://codeberg.org/efertone&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/el0n&quot;&gt;https://codeberg.org/el0n&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Ember&quot;&gt;https://codeberg.org/Ember&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ethanaobrien&quot;&gt;https://codeberg.org/ethanaobrien&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/evrial&quot;&gt;https://codeberg.org/evrial&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/floss4good&quot;&gt;https://codeberg.org/floss4good&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GDWR&quot;&gt;https://codeberg.org/GDWR&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/grosmanal&quot;&gt;https://codeberg.org/grosmanal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hazy&quot;&gt;https://codeberg.org/hazy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hugorodrigues&quot;&gt;https://codeberg.org/hugorodrigues&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/iaxat&quot;&gt;https://codeberg.org/iaxat&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ikuyo&quot;&gt;https://codeberg.org/ikuyo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Ilyas0Iks&quot;&gt;https://codeberg.org/Ilyas0Iks&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JakobDev&quot;&gt;https://codeberg.org/JakobDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jalil&quot;&gt;https://codeberg.org/jalil&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jdittrich&quot;&gt;https://codeberg.org/jdittrich&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jean-daricade&quot;&gt;https://codeberg.org/jean-daricade&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jthvai&quot;&gt;https://codeberg.org/jthvai&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jwildeboer&quot;&gt;https://codeberg.org/jwildeboer&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kita&quot;&gt;https://codeberg.org/kita&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kpfleming&quot;&gt;https://codeberg.org/kpfleming&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Kwonunn&quot;&gt;https://codeberg.org/Kwonunn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/l_austenfeld&quot;&gt;https://codeberg.org/l_austenfeld&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/leana8959&quot;&gt;https://codeberg.org/leana8959&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/liberodark&quot;&gt;https://codeberg.org/liberodark&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/LunarLambda&quot;&gt;https://codeberg.org/LunarLambda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mahlzahn&quot;&gt;https://codeberg.org/mahlzahn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mai-Lapyst&quot;&gt;https://codeberg.org/Mai-Lapyst&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/marcellmars&quot;&gt;https://codeberg.org/marcellmars&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/martinwguy&quot;&gt;https://codeberg.org/martinwguy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/meaz&quot;&gt;https://codeberg.org/meaz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mrwsl&quot;&gt;https://codeberg.org/mrwsl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mysticmode&quot;&gt;https://codeberg.org/mysticmode&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nhathaway&quot;&gt;https://codeberg.org/nhathaway&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oelmekki&quot;&gt;https://codeberg.org/oelmekki&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/patdyn&quot;&gt;https://codeberg.org/patdyn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/pointlessone&quot;&gt;https://codeberg.org/pointlessone&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/poVoq&quot;&gt;https://codeberg.org/poVoq&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rdvn&quot;&gt;https://codeberg.org/rdvn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rohitsharma09&quot;&gt;https://codeberg.org/rohitsharma09&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sbatial&quot;&gt;https://codeberg.org/sbatial&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/shisui&quot;&gt;https://codeberg.org/shisui&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Skivling&quot;&gt;https://codeberg.org/Skivling&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/slingamn&quot;&gt;https://codeberg.org/slingamn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/solomonv&quot;&gt;https://codeberg.org/solomonv&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/strk&quot;&gt;https://codeberg.org/strk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tepozoa&quot;&gt;https://codeberg.org/tepozoa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thefox&quot;&gt;https://codeberg.org/thefox&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thepaperpilot&quot;&gt;https://codeberg.org/thepaperpilot&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ThetaDev&quot;&gt;https://codeberg.org/ThetaDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thetredev&quot;&gt;https://codeberg.org/thetredev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/toolforger&quot;&gt;https://codeberg.org/toolforger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tseeker&quot;&gt;https://codeberg.org/tseeker&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/twenty-panda&quot;&gt;https://codeberg.org/twenty-panda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/uda&quot;&gt;https://codeberg.org/uda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wetneb&quot;&gt;https://codeberg.org/wetneb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Xinayder&quot;&gt;https://codeberg.org/Xinayder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xvello&quot;&gt;https://codeberg.org/xvello&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zotan&quot;&gt;https://codeberg.org/zotan&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/anonymous&quot;&gt;https://translate.codeberg.org/user/anonymous&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/b1nar10&quot;&gt;https://translate.codeberg.org/user/b1nar10&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/balinteus&quot;&gt;https://translate.codeberg.org/user/balinteus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ch0ccyra1n&quot;&gt;https://translate.codeberg.org/user/ch0ccyra1n&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ciampix&quot;&gt;https://translate.codeberg.org/user/ciampix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/emansije&quot;&gt;https://translate.codeberg.org/user/emansije&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/EssGeeEich&quot;&gt;https://translate.codeberg.org/user/EssGeeEich&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ewm&quot;&gt;https://translate.codeberg.org/user/ewm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Fjuro&quot;&gt;https://translate.codeberg.org/user/Fjuro&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/hankskyjames777&quot;&gt;https://translate.codeberg.org/user/hankskyjames777&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/kdh8219&quot;&gt;https://translate.codeberg.org/user/kdh8219&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/manolosd&quot;&gt;https://translate.codeberg.org/user/manolosd&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/meskobalazs&quot;&gt;https://translate.codeberg.org/user/meskobalazs&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Nifou&quot;&gt;https://translate.codeberg.org/user/Nifou&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/revi&quot;&gt;https://translate.codeberg.org/user/revi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/salif&quot;&gt;https://translate.codeberg.org/user/salif&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Wuzzy&quot;&gt;https://translate.codeberg.org/user/Wuzzy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ZDev&quot;&gt;https://translate.codeberg.org/user/ZDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Zughy&quot;&gt;https://translate.codeberg.org/user/Zughy&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Non-free dependency discovered in Forgejo and removed</title><link>https://forgejo.org/2024-07-non-free-dependency-found/</link><guid isPermaLink="true">https://forgejo.org/2024-07-non-free-dependency-found/</guid><description>A non-free JavaScript library was found in the project&apos;s dependency structure, and the entire component that relied on it was re-implemented. The new versions 8.0.0 and 7.0.6 will be released without this library. This step is important to meet the core values of Forgejo.</description><pubDate>Tue, 30 Jul 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;On 18 July 2024, a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/4569&quot;&gt;small piece of non Free Software was discovered&lt;/a&gt; within the Forgejo codebase. It is only used to display the top authors contribution graph (which is part of the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/activity&quot;&gt;repository activity&lt;/a&gt;) in the web interface. A replacement &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4571&quot;&gt;was implemented&lt;/a&gt; and merged on 20 July 2024. This piece of non-Free Software is no longer contained in the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#8-0-0&quot;&gt;v8.0.0 release&lt;/a&gt; and the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-6&quot;&gt;v7.0.6 point release&lt;/a&gt;.&lt;/p&gt; &lt;hr /&gt; &lt;p&gt;During a discussion about the future of Forgejo&apos;s license, it was discovered that a non-free dependency of a dependency initially created for Gitea was loaded into the project.&lt;/p&gt; &lt;p&gt;The usage of the non-free dependency was &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/4569&quot;&gt;reported&lt;/a&gt; in the main issue tracker on 18 July. A few hours later, a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4571&quot;&gt;pull request&lt;/a&gt; was opened to remove the dependency. In addition, &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/193&quot;&gt;a discussion&lt;/a&gt; was created to track the problem and the resulting consequences as a whole. The pull request was merged just over one day after the initial submission.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://github.com/go-gitea/gitea/commit/81cfe243f9cb90b0a75de7a03bb2d264c97f0036#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519R9&quot;&gt;dependency already existed&lt;/a&gt; at the time of the fork from Gitea and was therefore included in Forgejo from the beginning. The commitment of Forgejo is to always be &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/MISSION.md#values&quot;&gt;free as in freedom, open source and a community-first product&lt;/a&gt;. Non-free dependencies and distribution licenses are incompatible with the values of Forgejo. Therefore, it was of high importance to remove the problematic dependency.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;/2024-06-release-v8-0/&quot;&gt;release of 8.0.0&lt;/a&gt; was therefore blocked until the problem was solved. The removal of the binary was also ported to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-6&quot;&gt;7.0.6&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Additionally &lt;a href=&quot;https://github.com/lafriks/vue-bar-graph/issues/14&quot;&gt;the author&lt;/a&gt; of the dependency and &lt;a href=&quot;https://github.com/go-gitea/gitea/issues/31660&quot;&gt;Gitea&lt;/a&gt; were informed of the non-free subdependency.&lt;/p&gt; &lt;p&gt;In order to rule out further infringements, an &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4574&quot;&gt;improved tool was introduced&lt;/a&gt; to check the licenses of all dependencies. It runs in the CI, and fails if an incompatibility is found. Due to the new tool which works more precisely, it can lead to more licenses being included in the &lt;a href=&quot;https://next.forgejo.org/assets/licenses.txt&quot;&gt;&lt;code&gt;license.txt&lt;/code&gt;&lt;/a&gt; - also from dependencies that are removed in the build process. But better this safe way than missing licenses from dependencies in the end.&lt;/p&gt; &lt;p&gt;Because &lt;a href=&quot;https://gsap.com/community/standard-license/&quot;&gt;GSAP&lt;/a&gt;, the indirect dependency, is not Free Software, it cannot be &lt;a href=&quot;https://codeberg.org/forgejo&quot;&gt;distributed in the Forgejo organization&lt;/a&gt; hosted by Codeberg. It is prohibited by the &lt;a href=&quot;https://codeberg.org/Codeberg/org/src/branch/main/TermsOfUse.md#2-allowed-content-usage&quot;&gt;Codeberg Terms of Use&lt;/a&gt; and goes against the &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/MISSION.md#values&quot;&gt;Forgejo core values&lt;/a&gt;. &lt;strong&gt;The Forgejo binaries and container images will be deleted.&lt;/strong&gt; It will take some time, since the technical impact on existing Forgejo instances that depend on them has to be carefully addressed.&lt;/p&gt; &lt;hr /&gt; &lt;p&gt;During the investigation, two other indirect dependencies with incompatible licenses were found.&lt;/p&gt; &lt;p&gt;One is a dependency which was used for citing a repository in APA format (if the repository is set up for this) and has been &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4595&quot;&gt;removed for the moment&lt;/a&gt;. It has a more restrictive, &lt;a href=&quot;https://github.com/Juris-M/citeproc-js/blob/master/LICENSE&quot;&gt;copyleft license&lt;/a&gt; which is incompatible with the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/LICENSE&quot;&gt;current license&lt;/a&gt; of Forgejo. Repositories can therefore currently only be cited in the widely used BibTeX format. As Forgejo decided to accept copyleft license last year, this dependency may be added again in the future.&lt;/p&gt; &lt;p&gt;The other is &lt;a href=&quot;https://github.com/kieler/elkjs&quot;&gt;elkjs&lt;/a&gt; included by &lt;a href=&quot;https://github.com/mermaid-js/mermaid&quot;&gt;Mermaid&lt;/a&gt;. It also has a more restrictive, &lt;a href=&quot;https://github.com/kieler/elkjs/blob/master/LICENSE.md&quot;&gt;copyleft license&lt;/a&gt; which is incompatible with the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/LICENSE&quot;&gt;current license&lt;/a&gt; of Forgejo. Since &lt;a href=&quot;https://mermaid.js.org/syntax/flowchart.html?#renderer&quot;&gt;elk as renderer is experimental&lt;/a&gt; so far, it was decided to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4670&quot;&gt;remove elk manually&lt;/a&gt;. If you decide to set elkjs specifically as a renderer, an error now occurs. This is currently the only solution for the license issue.&lt;/p&gt; </content:encoded></item><item><title>Forgejo v8.0 is available</title><link>https://forgejo.org/2024-07-release-v8-0/</link><guid isPermaLink="true">https://forgejo.org/2024-07-release-v8-0/</guid><description>Forgejo v8.0 is available with new features (support for workflow dispatch, better defaults to avoid spam on new instances etc.), a new approach to UI and UX, careful upgrade of dependencies to improve stability and security. Foundation parts for ActivityPub based federation and data portability were merged in, bringing these features closer to completion, but they&apos;re not available yet.</description><pubDate>Tue, 30 Jul 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;/download/&quot;&gt;Forgejo v8.0&lt;/a&gt; was released 30 July 2024. You will find a short selection of the changes it introduces below and in a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#8-0-0&quot;&gt;complete list in the release notes&lt;/a&gt;. It is released the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-6&quot;&gt;same day as Forgejo v7.0.6&lt;/a&gt; to address licensing issues impacting frontend features (APA citation format, mermaid ELK rendering and the display of contributor graphs). &lt;a href=&quot;https://forgejo.org/2024-07-non-free-dependency-found/&quot;&gt;Read more in the dedicated blog post&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;It comes with &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#8-0-0&quot;&gt;a number of new features&lt;/a&gt;, as usual. But the most impactful changes are of a different nature: increased stability, less random UI modifications and almost no breaking changes.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;A newly created &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#user-interface&quot;&gt;UI team&lt;/a&gt; engaged in a different approach and can be credited for a drastic reduction in random User Interface changes in this release.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/2779&quot;&gt;A dependency dashboard&lt;/a&gt; is now used to carefully &lt;a href=&quot;https://forgejo.org/docs/latest/developer/dependencies/&quot;&gt;watch over each of them&lt;/a&gt;, with a direct impact on stability and security.&lt;/li&gt; &lt;li&gt;The breaking changes were reduced to a minimum because there is now an increased focus on backward compatibility.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;If stability is more important than new features, consider using Forgejo v7.0 instead: it is a Long Term Support release that will receive bug fixes until 16 July 2025. Forgejo v8.0 will be supported until 16 October 2024, when Forgejo v9.0 is published.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://v8.next.forgejo.org/&quot;&gt;dedicated test instance is available&lt;/a&gt; to try it out. Before upgrading it is &lt;em&gt;strongly recommended&lt;/em&gt; to make a full backup as explained in the &lt;a href=&quot;/docs/v8.0/admin/upgrade/&quot;&gt;upgrade guide&lt;/a&gt; and carefully read &lt;em&gt;all breaking changes&lt;/em&gt; from the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#8-0-0&quot;&gt;release notes&lt;/a&gt;. If in doubt, do not hesitate to ask for help &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or in the &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;chat room&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;New features&lt;/h3&gt; &lt;ul&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v8.0/user/actions/#onworkflow_dispatch&quot;&gt;Manually trigger a Forgejo Action&lt;/a&gt;&lt;/strong&gt; workflow with the input provided by the user in the web interface.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3934&quot;&gt;Self-registration is now disabled by default&lt;/a&gt;&lt;/strong&gt; on the installation page. This is done to prevent the creation of unmaintained instances with open registration that are abused by spammers for malicious purposes.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3139&quot;&gt;Generated release attachments can optionally be hidden&lt;/a&gt;&lt;/strong&gt; to not be confused with the archives uploaded by the user. For instance, each Forgejo release includes &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/download/v7.0.5/forgejo-src-7.0.5.tar.gz&quot;&gt;a source archive&lt;/a&gt; which is different from the generated archive.&lt;/p&gt; &lt;p&gt; &lt;/p&gt; &lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Read more &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#8-0-0&quot;&gt;in the Forgejo v8.0.0 release notes&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;A new approach to UI and UX&lt;/h3&gt; &lt;p&gt;The first user visible benefit of the new approach is a drastic reduction of the seemingly random User Interface changes that were frequently found in previous releases.&lt;/p&gt; &lt;p&gt;A gentle way of describing Forgejo User eXperience is that it is an acquired taste: it grew over the years, driven by the inspiration of the person with the keyboard in their hand. Once implemented it almost never changed. A user who started with Forgejo in 2022 can only see minor changes in 2024 and not all of them make intuitive sense. The solution to this problem is simple and was identified early on: &lt;a href=&quot;https://jdittrich.github.io/userNeedResearchBook/&quot;&gt;User Research&lt;/a&gt;. But only in the making of Forgejo v8.0 did it get some momentum.&lt;/p&gt; &lt;p&gt;The time and energy of &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#user-interface&quot;&gt;Forgejo contributors with the skills and desire to improve the User eXperience&lt;/a&gt; went in four equally important directions:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Conducting user testing sessions (&lt;a href=&quot;https://codeberg.org/forgejo/user-research/issues/34&quot;&gt;June 2024&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/user-research/src/branch/main/interviews/2024-04/template.md&quot;&gt;April 2024&lt;/a&gt;) to observe how Forgejo is used. How do users work with Forgejo? What problems do they run into?&lt;/li&gt; &lt;li&gt;Discussing &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/178&quot;&gt;a new workflow for designing and implementing feature requests&lt;/a&gt;. The focus is on the problems rather than the solution. When a user or a developer has a solution in mind, it is not uncommon that it does not solve an actual problem.&lt;/li&gt; &lt;li&gt;Giving some love to the current user interface, fixing bugs and backporting them to the stable versions (e.g. &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=87703&amp;amp;milestone=6654&quot;&gt;7.0.5&lt;/a&gt;). Review and apply &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=223008&quot;&gt;upgrades&lt;/a&gt; of &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/8afdafebf9fa2cb748a13e56ff3d865675ae27b6/package.json&quot;&gt;JavaScript packages&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=202906&quot;&gt;other dependencies&lt;/a&gt; used to build the UI.&lt;/li&gt; &lt;li&gt;Improving the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commits/branch/forgejo/tests/e2e&quot;&gt;JavaScript test coverage&lt;/a&gt; which is still currently under 10% but has seen more improvement in the past three months than in the past two years.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;In a nutshell, Forgejo&apos;s goal is now to design its User eXperience based on what user needs, as demonstrated by observations, rather than what they think that they want.&lt;/p&gt; &lt;h3&gt;Removal of Microsoft SQL Server support&lt;/h3&gt; &lt;p&gt;When Forgejo started almost two years ago, it focused on supporting and documenting a subset of the features present in the codebase. It made a implicit promise to its users to produce quality releases where new features could be added and bug fixed. It is a simple problem to solve as long as there are two necessary ingredients:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Contributors with the knowledge to diagnose a problem&lt;/li&gt; &lt;li&gt;Automated tests guarding the code against regressions when a new feature or a bug fix is merged in the codebase&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Microsoft SQL Server never met these conditions and &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/122&quot;&gt;discussions began early 2024&lt;/a&gt; to address the problem. The short version is that there is no reported use of a Forgejo instance running Microsoft SQL Server currently, and the decision was made to remove it from the codebase.&lt;/p&gt; &lt;p&gt;An alternative would have been to leave it, to give a chance to someone with the right skills to step up and contribute their knowledge to support Microsoft SQL Server. But that would not solve the other problem: because Microsoft SQL Server is not Free Software, it cannot be integrated in the automated tests. That would be adding a non Free Software dependency to Forgejo, which goes against its core values.&lt;/p&gt; &lt;p&gt;Because Forgejo is still young and none of its users rely on Microsoft SQL Server support, it can be dropped without inconveniencing anyone. As Forgejo&apos;s popularity grows, keeping the feature in the codebase would increase the probability that users rely on Microsoft SQL Server. It would then be a difficult situation for Forgejo and it is best to avoid that trap.&lt;/p&gt; &lt;p&gt;See also the &lt;a href=&quot;/2024-06-monthly-update/#standard-formats-and-protocols&quot;&gt;related section on standard formats and protocols&lt;/a&gt; in the June 2024 report.&lt;/p&gt; &lt;h3&gt;Less breaking changes&lt;/h3&gt; &lt;p&gt;A special effort was made to reduce the breaking changes of this release to a minimum. For instance it would have been easier to implement &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3363&quot;&gt;this improvement to the rootless OCI image&lt;/a&gt; as a breaking change. But significant time was spent to figure out a way to make it backward compatible. Another example is the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3934&quot;&gt;new default for self-registration&lt;/a&gt; that only applies to new installations to not require a manual intervention to change the settings.&lt;/p&gt; &lt;h3&gt;Improved stability&lt;/h3&gt; &lt;p&gt;Forgejo directly depends on hundreds of software projects: OCI images are based on &lt;a href=&quot;https://alpinelinux.org/&quot;&gt;Alpine Linux&lt;/a&gt;, markdown rendering uses &lt;a href=&quot;https://github.com/yuin/goldmark&quot;&gt;goldmark&lt;/a&gt;, TLS certificates are obtained using &lt;a href=&quot;https://github.com/caddyserver/certmagic&quot;&gt;certmagic&lt;/a&gt; and the list goes on, ranging from CI tooling that only matter to Forgejo developers to user interface components such as the &lt;a href=&quot;https://microsoft.github.io/monaco-editor/&quot;&gt;editor used to write issue comments&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Watching over those dependencies was an unsolved problem:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;bugs (or even security) fixes were not applied because no contributor had the time or the inclination to watch over them manually&lt;/li&gt; &lt;li&gt;batch upgrades, dozens of direct dependencies at a time, occasionally happened without actually reading through the release notes of each of them, let alone evaluate the risk of regression or the new features they include&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;It was resolved in v8.0 with &lt;a href=&quot;https://codeberg.org/forgejo/tools/src/branch/main/scripts/wcp&quot;&gt;specific tooling&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/2779&quot;&gt;a dependency dashboard&lt;/a&gt; updated hourly by &lt;a href=&quot;https://github.com/renovatebot/renovate&quot;&gt;renovate&lt;/a&gt; and watched over daily by Forgejo contributors. When a new release of a dependency is published, it is immediately proposed for review and the decision to upgrade is made in accordance to the new &lt;a href=&quot;/docs/v8.0/developer/dependencies/&quot;&gt;dependency management process&lt;/a&gt;. The tooling made it possible and sustainable to observe the evolution of hundred of dependencies.&lt;/p&gt; &lt;p&gt;The immediate benefits are:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;more stability as batch upgrades no longer happen with the associated risk of regression&lt;/li&gt; &lt;li&gt;bugs and security fixes found in dependencies are applied without undue delay, and backported to stable releases&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;Gitea compatibility&lt;/h3&gt; &lt;p&gt;Forgejo v8.0 was manually tested to be compatible with Gitea v1.22. Users reported successful upgrades of an instance of Gitea v1.22 to the development version of Forgejo v8.0. In addition, &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/pulls/205&quot;&gt;automated upgrade tests from Gitea v1.22 to Forgejo v8.0&lt;/a&gt; were implemented and are run prior to each Forgejo release.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;An instance running Gitea versions up to v1.21 can be upgraded to Forgejo v7.0 or v8.0&lt;/li&gt; &lt;li&gt;An instance running Gitea v1.22 can be upgraded to Forgejo v8.0&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Read more about &lt;a href=&quot;/2024-02-forking-forward/&quot;&gt;Gitea compatibility in the blog post explaining the hard fork that happened in February 2024&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Release schedule and Long Term Support&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;/docs/v8.0/developer/release/#release-cycle&quot;&gt;time based release schedule&lt;/a&gt; was established to publish a release every three months. Patch releases will be published more frequently, depending on the severity of the bug or security fixes they contain.&lt;/p&gt; &lt;table&gt; &lt;thead&gt; &lt;tr&gt; &lt;th&gt;&lt;strong&gt;Date&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;Version&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;Release date&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;End Of Life&lt;/strong&gt;&lt;/th&gt; &lt;/tr&gt; &lt;/thead&gt; &lt;tbody&gt;&lt;tr&gt; &lt;td&gt;2023 Q4&lt;/td&gt; &lt;td&gt;1.21.1-0&lt;/td&gt; &lt;td&gt;26 November 2023&lt;/td&gt; &lt;td&gt;17 July 2024&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2024 Q1&lt;/td&gt; &lt;td&gt;7.0.0&lt;/td&gt; &lt;td&gt;23 April 2024&lt;/td&gt; &lt;td&gt;&lt;strong&gt;16 July 2025&lt;/strong&gt;&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2024 Q2&lt;/td&gt; &lt;td&gt;&lt;strong&gt;8.0.0&lt;/strong&gt;&lt;/td&gt; &lt;td&gt;30 July 2024&lt;/td&gt; &lt;td&gt;16 October 2024&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2024 Q3&lt;/td&gt; &lt;td&gt;9.0.0&lt;/td&gt; &lt;td&gt;16 October 2024&lt;/td&gt; &lt;td&gt;15 January 2025&lt;/td&gt; &lt;/tr&gt; &lt;/tbody&gt;&lt;/table&gt; &lt;h3&gt;8.0-test daily releases&lt;/h3&gt; &lt;p&gt;Releases are built daily from the latest changes found in the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/v8.0/forgejo&quot;&gt;v8.0/forgejo&lt;/a&gt; development branch. They are deployed to the &lt;a href=&quot;https://v8.next.forgejo.org&quot;&gt;https://v8.next.forgejo.org&lt;/a&gt; instance for manual verification in case a bug fix is of particular interest ahead of the next patch release. It can also be installed locally with:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;OCI images: &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/8.0-test&quot;&gt;root&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/8.0-test-rootless&quot;&gt;rootless&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v8.0-test&quot;&gt;Binaries&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Their name stays the same but they are replaced by a new build every day.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#localization&quot;&gt;localization team&lt;/a&gt; brought a batch of translations weekly, from the Weblate &lt;a href=&quot;https://translate.codeberg.org/projects/forgejo/forgejo/&quot;&gt;project&lt;/a&gt;. A particular effort was made to backport all of them to Forgejo v7.0.&lt;/p&gt; &lt;p&gt;The work on refactoring base localization to improve User eXperience and translatability was also ported to v7.0, when there was no risk of regressions.&lt;/p&gt; &lt;p&gt;Anyone is welcome to participate in improving translation &lt;a href=&quot;/docs/v8.0/developer/localization&quot;&gt;for their language&lt;/a&gt; as well as &lt;a href=&quot;/docs/v8.0/developer/localization-english/#contributing&quot;&gt;the English base&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Federation&lt;/h3&gt; &lt;p&gt;Does &lt;code&gt;Forgejo&lt;/code&gt; support federation? Not yet. Was there progress? Yes.&lt;/p&gt; &lt;p&gt;Building blocks for both &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;ActivityPub federation&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3590&quot;&gt;data portability improvements&lt;/a&gt; were merged into the codebase. They are not yet used for any user visible feature but they are a stepping stone. Their implementation was made significantly easier by the hard fork because they can rely on a codebase that is better tested.&lt;/p&gt; &lt;p&gt;The ActivityPub based communication between two Forgejo instances is used by a new internal test scenario where adding a star to a repository on one instance also adds a star on a federated repository on the other instance.&lt;/p&gt; &lt;p&gt;Read more about &lt;a href=&quot;/2024-06-monthly-update/#federation&quot;&gt;federation&lt;/a&gt; and &lt;a href=&quot;/2024-06-monthly-update/#data-portability&quot;&gt;data portability&lt;/a&gt; in the June 2024 &lt;a href=&quot;https://forgejo.org/2024-06-monthly-update/&quot;&gt;Forgejo monthly update&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Get Forgejo v8.0&lt;/h3&gt; &lt;p&gt;See the &lt;a href=&quot;/download/&quot;&gt;download page&lt;/a&gt; for instructions on how to install Forgejo, and read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#8-0-0&quot;&gt;release notes&lt;/a&gt; for more information.&lt;/p&gt; &lt;h3&gt;Upgrading&lt;/h3&gt; &lt;p&gt;Carefully read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#8-0-0&quot;&gt;breaking changes&lt;/a&gt; section of the release notes.&lt;/p&gt; &lt;p&gt;The actual upgrade process is as simple as replacing the binary or container image with the corresponding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v8.0.0&quot;&gt;Forgejo binary&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/8.0.0&quot;&gt;container image&lt;/a&gt;. If you&apos;re using the container images, you can use the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/8.0&quot;&gt;&lt;code&gt;8.0&lt;/code&gt; tag&lt;/a&gt; to stay up to date with the latest &lt;code&gt;8.0.Y&lt;/code&gt; patch release automatically.&lt;/p&gt; &lt;p&gt;Make sure to check the &lt;a href=&quot;/docs/v8.0/admin/upgrade&quot;&gt;Forgejo upgrade documentation&lt;/a&gt; for recommendations on how to properly backup your instance before the upgrade.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo do not hold back, it is also your project. Open an issue in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;the issue tracker&lt;/a&gt; for feature requests or bug reports, reach out &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop into &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;the Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) and say hi!&lt;/p&gt; &lt;h3&gt;Donate&lt;/h3&gt; &lt;p&gt;Forgejo is proud to be &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/&quot;&gt;funded transparently&lt;/a&gt;. Since a few days, we additionally accept donations from our users through &lt;a href=&quot;https://liberapay.com/forgejo&quot;&gt;our Forgejo Liberapay team&lt;/a&gt;. If you appreciate Forgejo, consider setting up a donation to help going forward. Liberapay is a French non-profit dedicated to crowdfunding with predictable income, allowing transfers via multiple payment options and providers with a comparably low fee. It was already possible to &lt;a href=&quot;https://docs.codeberg.org/improving-codeberg/donate/&quot;&gt;donate to Codeberg e.V.&lt;/a&gt; (you can still do in case the Liberapay option does not work out for you), and part of the funding was used to &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/#forgejo-resources-per-year&quot;&gt;compensate for work on Forgejo&lt;/a&gt;. However, the Liberapay team now allows for money to go directly to developers without a round-trip to Codeberg.&lt;/p&gt; &lt;p&gt;Additionally, Liberapay allows for a steady and reliable funding stream next to other options, a crucial aspect for our project. The distribution of funds through Liberapay is &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#liberapay-team-members&quot;&gt;transparently controlled using our decision-making process&lt;/a&gt;, and Forgejo contributors are encouraged to consider applying to benefit from this funding opportunity. Thank you for using Forgejo and considering a donation, in case your financial situation allows you to.&lt;/p&gt; &lt;h3&gt;Forgejo Upgrade Party and Get-Together&lt;/h3&gt; &lt;p&gt;Let&apos;s upgrade together!&lt;/p&gt; &lt;p&gt;The Forgejo v8 release is available. We are looking forward to meeting with you via OpenTalk, providing a space for admins and developers to assist each other. We are excited to learn from your setups and the challenges you encounter to further improve Forgejo in the future.&lt;/p&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.codeberg.page/Events/events/2024/08-02-forgejo-upgrade-party/&quot;&gt;Read the full invite on the Codeberg Event Calendar!&lt;/a&gt;&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - June 2024</title><link>https://forgejo.org/2024-06-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2024-06-monthly-update/</guid><description>The User Research effort that gained momentum two months ago continues with a new round of user testing sessions. It is key to collect evidence about what Forgejo users need, a requirement to build a roadmap and reduce the growing backlog of bug reports and feature requests. Building blocks for both ActivityPub federation and data portability improvements were merged into the codebase. They are not yet used for any user visible feature but they are a stepping stone. Their implementation was made significantly easier by the hard fork because they can rely on a codebase that is better tested.</description><pubDate>Sun, 30 Jun 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;The monthly report is meant to provide a good overview of what has changed in Forgejo in the past month. If you would like to help, please get in touch in &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;the chatroom&lt;/a&gt; or participate in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions&quot;&gt;ongoing discussions&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/156&quot;&gt;User Research effort&lt;/a&gt; that gained momentum two months ago continues with a new round of &lt;a href=&quot;https://codeberg.org/forgejo/user-research/issues/34&quot;&gt;user testing sessions&lt;/a&gt;. It is key to collect evidence about what Forgejo users need, a requirement to build a roadmap and reduce the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;growing backlog&lt;/a&gt; of bug reports and feature requests.&lt;/p&gt; &lt;p&gt;Building blocks for both &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;ActivityPub federation&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3590&quot;&gt;data portability improvements&lt;/a&gt; were merged into the codebase. They are not yet used for any user visible feature but they are a stepping stone. Their implementation was made significantly easier by the hard fork because they can rely on a codebase that is better tested.&lt;/p&gt; &lt;h2&gt;User Research&lt;/h2&gt; &lt;p&gt;Discussions began on &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/178&quot;&gt;a new workflow for design work and feature requests&lt;/a&gt;. Users are encouraged to describe the problem rather than the solution. Feature requests typically consist of the description of a solution. However, often there are multiple solutions to one problem, and there are multiple problems with one solution.&lt;/p&gt; &lt;p&gt;New feature requests are not ready to implement: they are investigated first, similar to how new bugs are triaged. A research and design process can be established, similar to what was done for the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/4119&quot;&gt;summary tab for repositories&lt;/a&gt; and bootstrap actual process for changes in Forgejo. This adds a step between what user needs and development, but since the backlog of feature requests is growing anyway, it may not be an issue. On the contrary: merging similar feature requests together can reduce the backlog of open feature requests and only the most valuable changes are implemented.&lt;/p&gt; &lt;p&gt;A new round of &lt;a href=&quot;https://codeberg.org/forgejo/user-research/issues/34&quot;&gt;user testing sessions&lt;/a&gt; was conducted from 26 June to 28 June. It is &lt;a href=&quot;https://codeberg.org/forgejo/user-research/src/branch/main/interviews/2024-06/template.md&quot;&gt;based on an interview script&lt;/a&gt; improved from the one that was already used &lt;a href=&quot;https://codeberg.org/forgejo/user-research/src/branch/main/interviews/2024-04/template.md&quot;&gt;in April 2024&lt;/a&gt; during the first round.&lt;/p&gt; &lt;h2&gt;Features&lt;/h2&gt; &lt;p&gt;Notable improvements:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4189&quot;&gt;Better logic for showing user feed/public activity elements&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4134&quot;&gt;Folding results for repo search&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4072&quot;&gt;Implement tab indentation and list continuation in the issue editor&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;Stars federated via ActivityPub&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4138&quot;&gt;Support redis alternative - redict and garnet&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3590&quot;&gt;F3 initial driver&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=209916&quot;&gt;Read more&lt;/a&gt; in the pull requests.&lt;/p&gt; &lt;h2&gt;Standard formats and protocols&lt;/h2&gt; &lt;p&gt;Forgejo supports third party software and services that use standards. For instance it relies on SQL for interactions with databases, HTTP, HTML and JavaScript for web interactions. As an exception when the software or service is available under a Free Software license, the absence of standardized communication protocol is not a requirement, for instance for &lt;a href=&quot;https://github.com/google/leveldb&quot;&gt;LevelDB&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;It is not an easy goal to achieve because software publishers keep deviating from standards or change the license of their software to no longer be Free Software.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Microsoft SQL Server deviates from the SQL standard in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/2d9afd0c2194b60689717c2a9dc36284f012f7b6#diff-c286fd6672a72eeb3c97959eb3af0bf43959334a&quot;&gt;ways that required special treatment&lt;/a&gt; and the decision was made two months ago to no longer include such specific adjustments.&lt;/li&gt; &lt;li&gt;Redis used to be Free Software, but the newer versions &lt;a href=&quot;https://web.archive.org/web/20240511181042if_/https://redis.io/legal/licenses/&quot;&gt;are not&lt;/a&gt;. The protocol is not standard but alternative servers exist and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4138&quot;&gt;Forgejo is now tested to work with them&lt;/a&gt;. Only the older Free Software version of Redis will continue to be supported, but the proprietary versions will not.&lt;/li&gt; &lt;li&gt;Safari is expected to support HTML, HTTP &amp;amp; JavaScript in the same way other browsers do, but fails some tests. The approach chosen was to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3334/files#diff-d98036e3541a0bc9dcffae7c5b40a8bfeb670760&quot;&gt;skip Safari testing&lt;/a&gt; instead of finding a workaround. An effort is generally made to workaround the non-conformant behavior of Free Software Web browsers. But, for reasons similar to MSSQL, such an effort is not sustainable for proprietary Web browsers.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Other discussions happened on integrating Forgejo with third party software or services that are not Free Software and do not comply with a standard format or protocol (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3989&quot;&gt;Azure Blob Storage&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/174&quot;&gt;CockroachDB&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4154&quot;&gt;Friendly Captcha&lt;/a&gt;).&lt;/p&gt; &lt;h2&gt;Data portability&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://f3.forgefriends.org/&quot;&gt;Friendly Forge Format (F3)&lt;/a&gt; is designed to improve data portability and make it possible to mirror software projects from one forge to another using a standard format. The &lt;a href=&quot;https://f3.forgefriends.org/compliance.html&quot;&gt;v2.0.0&lt;/a&gt; was published in June 2024 and is the first stable version. It is implemented in &lt;a href=&quot;https://code.forgejo.org/f3/gof3&quot;&gt;a Go package&lt;/a&gt; that can be used as a reference. A native driver for Forgejo &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3590&quot;&gt;was merged&lt;/a&gt; so that it can be used, for instance, to transport data when an ActivityPub message is received. Or as an alternate implementation for the migration code.&lt;/p&gt; &lt;p&gt;Read more in F3 related &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues?labels=114735&quot;&gt;issues&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=114735&quot;&gt;pull requests&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Federation&lt;/h2&gt; &lt;p&gt;The pull request to implement &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;federated repository stars&lt;/a&gt; was merged. The feature allows you to define following repositories such as origin of mirrors or forks. If then the mirror or fork gets a star by someone, the origin repository will also get a star via federated ActivityPub like activity. Only the star activity is federated, the unstar activity is not federated and the user interface is not available yet.&lt;/p&gt; &lt;p&gt;A new federation suite was &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/branch/main/federation&quot;&gt;added to the end-to-end tests&lt;/a&gt;. It is very basic but the first of its kind. Launching two Forgejo instances that &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/branch/main/federation/scenario-star/run.sh&quot;&gt;star each other via ActivityPub&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Although GitLab federation efforts are &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/184&quot;&gt;now on pause&lt;/a&gt; it includes an experimental implementation of the ActivityPub building blocks which is roughly at the same stage as Forgejo. Support for &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/commit/e4fa6d814fce398fd4065e40c67a53acbbf2e3a5/lib/lib.sh#L199-L227&quot;&gt;launching a GitLab instance&lt;/a&gt; was added to the end-to-end tests. This will eventually allow to play scenarios in which GitLab and Forgejo can communicate in a controlled environment. And in the short term to apply minimal testing on each of them independently, for instance with &lt;a href=&quot;https://codeberg.org/socialweb.coop/activitypub-testing&quot;&gt;activitypub-testing&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Read more &lt;a href=&quot;https://domaindrivenarchitecture.org/posts/2024-06-05-howto-federated-stars/&quot;&gt;in the June 2024 report&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;UI team&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#user-interface&quot;&gt;UI team&lt;/a&gt; was &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/128&quot;&gt;created&lt;/a&gt; and has &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/144&quot;&gt;three members&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Before engaging in more ambitious goals, they started to care for the day to day chores that keep Forgejo releases going:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Implementing and reviewing &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?state=closed&amp;amp;labels=87703%2c78139&amp;amp;milestone=6042&quot;&gt;new UI features&lt;/a&gt; which is particularly challenging because the test coverage of the Web UI is still very low.&lt;/li&gt; &lt;li&gt;Backporting bug fixes to the stable versions (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=87703&amp;amp;milestone=6405&quot;&gt;7.0.4&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=87703&amp;amp;milestone=6654&quot;&gt;7.0.5&lt;/a&gt;).&lt;/li&gt; &lt;li&gt;Reviewing &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=223008&quot;&gt;upgrades&lt;/a&gt; of &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/8afdafebf9fa2cb748a13e56ff3d865675ae27b6/package.json&quot;&gt;JavaScript packages&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=85536&quot;&gt;other dependencies&lt;/a&gt; that are used to build the Web UI. It would be relatively easy if every package consistently complied with &lt;a href=&quot;https://semver.org/&quot;&gt;semantic versioning&lt;/a&gt; and published descriptive release notes. But the norm is rather the opposite and each potential upgrade requires a fair amount of scrutiny.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;An experiment to hire a freelance to work on improving the JavaScript test coverage was conducted to figure out if it leads to results that are worth the effort. It was interrupted when evidence surfaced that the work was almost identical to what an AI would produce.&lt;/p&gt; &lt;h2&gt;Infrastructure&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://forgejo.org/docs/next/developer/infrastructure/#hetzner0104&quot;&gt;machine&lt;/a&gt; added last month is now in production and stable. It did not go smoothly because the hardware provisioned turned out to be unreliable and crashed frequently. The devops team spent hours over a period of a week to figure out the root cause and stabilize it. This was not transparent to Forgejo contributors because the CI stopped working half a dozen time and stayed down during a few hours. But nothing was lost and the downtime was kept to a minimum. It happened in between releases and did not disrupt the release process.&lt;/p&gt; &lt;p&gt;The upside of these troubles was to check that every aspect of the disaster recovery scenario work as it should, including loosing all disks on the machine. The defective hardware was not stabilized, it could not. It turned out that all machines with the same motherboard were similarly flawed. Hetzner acknowledged their defective product range, apologized, reimbursed the costs and is in the process of changing their Q&amp;amp;A to include the test script that was provided to demonstrate the problem.&lt;/p&gt; &lt;h2&gt;Releases&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-4&quot;&gt;Forgejo v7.0.4&lt;/a&gt; (fixing &lt;a href=&quot;https://codeberg.org/forgejo/security-announcements/issues/11&quot;&gt;vulnerabilities&lt;/a&gt;) was released. The security fix it contains was also &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.21.11-2&quot;&gt;backported and released as Forgejo v1.21.11-2&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;There now is a &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/168&quot;&gt;stronger requirement for testing&lt;/a&gt; for all backports to a stable release. The bug fixes originating from Gitea were previously merged even when they were not covered by any test. Tests are now added when the fix is worth the effort. The test itself is implemented &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4217&quot;&gt;in the development branch&lt;/a&gt; and the commit that contains the fix is &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/4219&quot;&gt;cherry-picked with the backport of the test&lt;/a&gt; to demonstrate it works as it should.&lt;/p&gt; &lt;p&gt;A discussion regarding the &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/180&quot;&gt;Forgejo v8.0.0 feature freeze&lt;/a&gt; an attempt to better define the requirements imposed during such a period and the &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/180#issuecomment-2043685&quot;&gt;need to fix bugs when the infrastructure to write tests is missing&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Dependency Management&lt;/h2&gt; &lt;p&gt;Caring for the hundreds of Forgejo dependencies has been a recurring activity since the beginning of the project back in 2022. When the hard fork happened early 2024 Forgejo gained the freedom to decide on each of them and began to organize accordingly. Gitea was first and using the &lt;a href=&quot;https://codeberg.org/forgejo/tools/src/branch/main/scripts/wcp&quot;&gt;dedicated tool&lt;/a&gt; that was developed to sort the commits of interest became a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?q=week+2024&amp;amp;state=closed&quot;&gt;comfortable weekly routine&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The backlog of all other dependencies was more challenging. A &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/2779&quot;&gt;dependency dashboard was setup&lt;/a&gt; and started with a large backlog. Only in June 2024 was it cleared, months later. Pull requests with upgrades are &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues?labels=223008&quot;&gt;now dealt with daily&lt;/a&gt; and diligently so they do not pile up again.&lt;/p&gt; &lt;p&gt;The method to analyze each of them &lt;a href=&quot;https://forgejo.org/docs/latest/developer/dependencies/&quot;&gt;was documented&lt;/a&gt; and heavily relies on the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/renovate.json&quot;&gt;dependency specifications&lt;/a&gt; to keep the workload to a minimum. For instance it can arrange for updates to only be proposed every three months for CI tooling while it immediately proposes an upgrade if has an impact on security.&lt;/p&gt; &lt;h2&gt;Helm chart&lt;/h2&gt; &lt;p&gt;The Forgejo helm chart had &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases&quot;&gt;two patch updates&lt;/a&gt;, one for &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v7.0.1&quot;&gt;7.0.1&lt;/a&gt; which depends on Forgejo v7.0.4 and another for &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases/tag/v5.1.2&quot;&gt;5.1.2&lt;/a&gt; which depends on Forgejo v1.21.11-2.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#helm&quot;&gt;Forgejo helm team&lt;/a&gt; was &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/136&quot;&gt;created&lt;/a&gt; was created and &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/149&quot;&gt;two members joined&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;4 batches of updates were merged containing total of 937 new translations and 518 improvements. Some improvements were made to the process of localization management. One of which is that now backporting of translation updates to stable versions can happen in batches before releases are published instead of weekly.&lt;/p&gt; &lt;p&gt;No new team applications were submitted or accepted this month. Some languages are not actively maintained currently. View completeness of translations in our project on &lt;a href=&quot;https://translate.codeberg.org/projects/forgejo/forgejo&quot;&gt;Codeberg Translate&lt;/a&gt; and &lt;a href=&quot;https://forgejo.org/docs/latest/developer/localization/&quot;&gt;Learn how to help&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Sustainability&lt;/h2&gt; &lt;p&gt;There is a &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/185&quot;&gt;new funding opportunity&lt;/a&gt; for &lt;a href=&quot;https://www.sovereigntechfund.de/&quot;&gt;Sovereign Tech Fund&lt;/a&gt; and a &lt;a href=&quot;https://codeberg.org/avobs/sovereign_tech/src/branch/main/application_text.md&quot;&gt;grant application is being drafted&lt;/a&gt;. Its scope is similar to &lt;a href=&quot;https://www.opentech.fund/funds/free-and-open-source-software-sustainability-fund/&quot;&gt;OTF&lt;/a&gt; and most of the material can be re-used.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls?state=all&amp;amp;labels=217359&quot;&gt;grant proposal&lt;/a&gt; submitted 16 May for the &lt;a href=&quot;https://www.opentech.fund/funds/free-and-open-source-software-sustainability-fund/&quot;&gt;Free and Open Source Software Sustainability Fund&lt;/a&gt; was &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls/48&quot;&gt;declined&lt;/a&gt;. In a newsletter OTF announced that they received 80 applications.&lt;/p&gt; &lt;p&gt;A reply was expected for the NLnet grant application &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls?labels=220838&quot;&gt;submitted 1 April&lt;/a&gt; but was further delayed and is expected in July.&lt;/p&gt; &lt;h2&gt;Moderation&lt;/h2&gt; &lt;p&gt;There has been very few minor moderation incident (spam or trolls) and one time warning. This is significantly less than the past month where there were bursts of unsolicited activity that sometime required daily intervention. Even the smallest interventions were logged in accordance to the &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/MODERATION-PROCESS.md&quot;&gt;moderation process&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A concern was raised regarding the &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/87&quot;&gt;lack of answer of the floss.social moderation team&lt;/a&gt; despite numerous attempts over a period of months. There has been no major incident so far but it may be wise to take steps for Forgejo to be in a space where it is possible to reach the moderation team before it happens.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/0ko&quot;&gt;https://codeberg.org/0ko&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/abacabadabacaba&quot;&gt;https://codeberg.org/abacabadabacaba&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Aeris1One&quot;&gt;https://codeberg.org/Aeris1One&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/aimuz&quot;&gt;https://codeberg.org/aimuz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/algernon&quot;&gt;https://codeberg.org/algernon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/atimy&quot;&gt;https://codeberg.org/atimy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/avidseeker&quot;&gt;https://codeberg.org/avidseeker&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/avobs&quot;&gt;https://codeberg.org/avobs&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bdube_gh&quot;&gt;https://codeberg.org/bdube_gh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/becm&quot;&gt;https://codeberg.org/becm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bengrue&quot;&gt;https://codeberg.org/bengrue&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Beowulf&quot;&gt;https://codeberg.org/Beowulf&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/buhtz&quot;&gt;https://codeberg.org/buhtz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/cuboci&quot;&gt;https://codeberg.org/cuboci&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Cyborus&quot;&gt;https://codeberg.org/Cyborus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Cysioland&quot;&gt;https://codeberg.org/Cysioland&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/delvh&quot;&gt;https://codeberg.org/delvh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dev_T&quot;&gt;https://codeberg.org/dev_T&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Dirk&quot;&gt;https://codeberg.org/Dirk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/drawingpixels&quot;&gt;https://codeberg.org/drawingpixels&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/efertone&quot;&gt;https://codeberg.org/efertone&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/el0n&quot;&gt;https://codeberg.org/el0n&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/f00&quot;&gt;https://codeberg.org/f00&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fr33domlover&quot;&gt;https://codeberg.org/fr33domlover&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fractalf&quot;&gt;https://codeberg.org/fractalf&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/gerald&quot;&gt;https://codeberg.org/gerald&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GKuhn&quot;&gt;https://codeberg.org/GKuhn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GooRoo&quot;&gt;https://codeberg.org/GooRoo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GT&quot;&gt;https://codeberg.org/GT&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/h759bkyo4&quot;&gt;https://codeberg.org/h759bkyo4&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hackos&quot;&gt;https://codeberg.org/hackos&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Hanker&quot;&gt;https://codeberg.org/Hanker&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Haui&quot;&gt;https://codeberg.org/Haui&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hazy&quot;&gt;https://codeberg.org/hazy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hoijui&quot;&gt;https://codeberg.org/hoijui&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/how&quot;&gt;https://codeberg.org/how&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ikuyo&quot;&gt;https://codeberg.org/ikuyo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jadeprime&quot;&gt;https://codeberg.org/jadeprime&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jakjakob&quot;&gt;https://codeberg.org/jakjakob&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jean-daricade&quot;&gt;https://codeberg.org/jean-daricade&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jthvai&quot;&gt;https://codeberg.org/jthvai&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jwildeboer&quot;&gt;https://codeberg.org/jwildeboer&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/karolyi&quot;&gt;https://codeberg.org/karolyi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kita&quot;&gt;https://codeberg.org/kita&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Kitanit&quot;&gt;https://codeberg.org/Kitanit&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Kwonunn&quot;&gt;https://codeberg.org/Kwonunn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/l_austenfeld&quot;&gt;https://codeberg.org/l_austenfeld&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lingling&quot;&gt;https://codeberg.org/lingling&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Linneris&quot;&gt;https://codeberg.org/Linneris&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lordwektabyte&quot;&gt;https://codeberg.org/lordwektabyte&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mai-Lapyst&quot;&gt;https://codeberg.org/Mai-Lapyst&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/martianh&quot;&gt;https://codeberg.org/martianh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/martinwguy&quot;&gt;https://codeberg.org/martinwguy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mirkoperillo&quot;&gt;https://codeberg.org/mirkoperillo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mnq&quot;&gt;https://codeberg.org/mnq&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mritunjayr&quot;&gt;https://codeberg.org/mritunjayr&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mrwsl&quot;&gt;https://codeberg.org/mrwsl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/neomaitre&quot;&gt;https://codeberg.org/neomaitre&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nilesh&quot;&gt;https://codeberg.org/nilesh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oelmekki&quot;&gt;https://codeberg.org/oelmekki&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/patdyn&quot;&gt;https://codeberg.org/patdyn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Pi-Cla&quot;&gt;https://codeberg.org/Pi-Cla&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/pmb&quot;&gt;https://codeberg.org/pmb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/podhorsky-ksj&quot;&gt;https://codeberg.org/podhorsky-ksj&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/poVoq&quot;&gt;https://codeberg.org/poVoq&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/programmerjake&quot;&gt;https://codeberg.org/programmerjake&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/proton-ab&quot;&gt;https://codeberg.org/proton-ab&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/qaqland&quot;&gt;https://codeberg.org/qaqland&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/realaravinth&quot;&gt;https://codeberg.org/realaravinth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Renich&quot;&gt;https://codeberg.org/Renich&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/samcday&quot;&gt;https://codeberg.org/samcday&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/scruel&quot;&gt;https://codeberg.org/scruel&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Senku&quot;&gt;https://codeberg.org/Senku&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sevki&quot;&gt;https://codeberg.org/sevki&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/silverpill&quot;&gt;https://codeberg.org/silverpill&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SinTan1729&quot;&gt;https://codeberg.org/SinTan1729&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sirhectorin&quot;&gt;https://codeberg.org/sirhectorin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/solemden&quot;&gt;https://codeberg.org/solemden&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/soundstrip&quot;&gt;https://codeberg.org/soundstrip&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/stdedos&quot;&gt;https://codeberg.org/stdedos&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tampler&quot;&gt;https://codeberg.org/tampler&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tgy&quot;&gt;https://codeberg.org/tgy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thedustinmiller&quot;&gt;https://codeberg.org/thedustinmiller&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thefox&quot;&gt;https://codeberg.org/thefox&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Thesola10&quot;&gt;https://codeberg.org/Thesola10&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ThetaDev&quot;&gt;https://codeberg.org/ThetaDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thetredev&quot;&gt;https://codeberg.org/thetredev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/toolforger&quot;&gt;https://codeberg.org/toolforger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/twenty-panda&quot;&gt;https://codeberg.org/twenty-panda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/uku&quot;&gt;https://codeberg.org/uku&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/vai&quot;&gt;https://codeberg.org/vai&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/vikaschoudhary&quot;&gt;https://codeberg.org/vikaschoudhary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/virtulis&quot;&gt;https://codeberg.org/virtulis&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/vwbusguy&quot;&gt;https://codeberg.org/vwbusguy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Wuzzy&quot;&gt;https://codeberg.org/Wuzzy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/XaviCC&quot;&gt;https://codeberg.org/XaviCC&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Xinayder&quot;&gt;https://codeberg.org/Xinayder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xlii&quot;&gt;https://codeberg.org/xlii&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yongbin&quot;&gt;https://codeberg.org/yongbin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/wintryexit&quot;&gt;https://translate.codeberg.org/user/wintryexit&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/leana8959&quot;&gt;https://translate.codeberg.org/user/leana8959&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/hankskyjames777&quot;&gt;https://translate.codeberg.org/user/hankskyjames777&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Fjuro&quot;&gt;https://translate.codeberg.org/user/Fjuro&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Atalanttore&quot;&gt;https://translate.codeberg.org/user/Atalanttore&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/kdh8219&quot;&gt;https://translate.codeberg.org/user/kdh8219&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ledyba&quot;&gt;https://translate.codeberg.org/user/ledyba&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/purkwiat&quot;&gt;https://translate.codeberg.org/user/purkwiat&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/gitcookie-1&quot;&gt;https://translate.codeberg.org/user/gitcookie-1&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/yeziruo&quot;&gt;https://translate.codeberg.org/user/yeziruo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/qwerty287&quot;&gt;https://translate.codeberg.org/user/qwerty287&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/SDKAAA&quot;&gt;https://translate.codeberg.org/user/SDKAAA&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/mondstern&quot;&gt;https://translate.codeberg.org/user/mondstern&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Application-Maker&quot;&gt;https://translate.codeberg.org/user/Application-Maker&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/sinsky&quot;&gt;https://translate.codeberg.org/user/sinsky&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/emansije&quot;&gt;https://translate.codeberg.org/user/emansije&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/bbjubjub2494&quot;&gt;https://translate.codeberg.org/user/bbjubjub2494&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/lotigara&quot;&gt;https://translate.codeberg.org/user/lotigara&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/b1nar10&quot;&gt;https://translate.codeberg.org/user/b1nar10&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/overloop&quot;&gt;https://translate.codeberg.org/user/overloop&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/bart&quot;&gt;https://translate.codeberg.org/user/bart&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/sunwoo1524&quot;&gt;https://translate.codeberg.org/user/sunwoo1524&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - May 2024</title><link>https://forgejo.org/2024-05-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2024-05-monthly-update/</guid><description>A UI team was created by Forgejo contributors who have been at work for months on the necessary backports of bug fixes to the Forgejo v7.0 stable branch. More ambitious discussions started on the long term strategies to refactor the codebase and improve the User eXperience. Forgejo needs help to triage. If you ever create a new issue, take a moment of your time to also look at a few others and help them get to the finish line.</description><pubDate>Mon, 03 Jun 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;The monthly report is meant to provide a good overview of what has changed in Forgejo in the past month. If you would like to help, please get in touch in &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;the chatroom&lt;/a&gt; or participate in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions&quot;&gt;ongoing discussions&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/128&quot;&gt;UI team&lt;/a&gt; was created by Forgejo contributors who have been at work for months on the necessary backports of bug fixes to the Forgejo v7.0 stable branch. More &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/160&quot;&gt;ambitious discussions&lt;/a&gt; started on the long term strategies to refactor the codebase and improve the User eXperience.&lt;/p&gt; &lt;h3&gt;Call for help&lt;/h3&gt; &lt;p&gt;Forgejo needs help to &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/161&quot;&gt;triage bug reports&lt;/a&gt; and feature requests. The growing backlog is &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/53&quot;&gt;not a new problem&lt;/a&gt; and is actively worked on. If you ever create a new issue, take a moment of your time to also look at a few others and help them get to the finish line.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;p&gt;For a bug fix, reading the description and trying to reproduce it manually to confirm it is still relevant will bring them closer to a resolution. Either because the developer knows it is worth their time or because it cannot be reproduced and is already fixed.&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;For a feature request, read the &lt;strong&gt;Needs and benefits&lt;/strong&gt; section and maybe ask the author to clarify. If you are convinced, add a short comment in the first person to describe how it would help you.&lt;/p&gt; &lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;UI team&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/160&quot;&gt;Forgejo UI discussions&lt;/a&gt; led to &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/128&quot;&gt;the creation of a UI team&lt;/a&gt; and four candidates (&lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/131&quot;&gt;1&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/132&quot;&gt;2&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/134&quot;&gt;3&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/138&quot;&gt;4&lt;/a&gt;) are lined up to be the initial members to bootstrap it.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://matrix.to/#/#forgejo-ui:matrix.org&quot;&gt;dedicated Matrix channel&lt;/a&gt; was created and &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;added to the Forgejo Matrix space&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;In addition to discussions regarding future developments, the team took care of the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=87703&quot;&gt;UI related features and bug fixes&lt;/a&gt;, both for the development branch and for the stable branch.&lt;/p&gt; &lt;h2&gt;Code&lt;/h2&gt; &lt;h3&gt;Features&lt;/h3&gt; &lt;p&gt;Notable improvements and bug fixes:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Groundwork for stars federated via ActivityPub (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3494&quot;&gt;1&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3662&quot;&gt;2&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3792&quot;&gt;3&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3871&quot;&gt;4&lt;/a&gt;)&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/3139&quot;&gt;Allow hiding auto generated release archives&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/3654&quot;&gt;Code Search for non-default branches and tags when repository indexer is disabled&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/3836&quot;&gt;Parse prefix from redis URI for queues&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3847&quot;&gt;Wiki content search using git-grep&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=209916&quot;&gt;Read more&lt;/a&gt; in the pull requests.&lt;/p&gt; &lt;h3&gt;Improving tests&lt;/h3&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/170&quot;&gt;discussion started&lt;/a&gt; to improve the tests in the Forgejo codebase. Initial ideas cover the following:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Allow integration tests outside of the tests/integration folder&lt;/li&gt; &lt;li&gt;Prevent having to store binary blobs within the codebase&lt;/li&gt; &lt;li&gt;Make the tests faster&lt;/li&gt; &lt;li&gt;Document the testing tweaks&lt;/li&gt; &lt;li&gt;Add test coverage&lt;/li&gt; &lt;li&gt;Add performance testing&lt;/li&gt; &lt;li&gt;Make the playwright tests easier to use&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;End to end tests&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;end to end test suite&lt;/a&gt; race conditions (in the tests of &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/pulls/175&quot;&gt;push&lt;/a&gt; and &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/pulls/182&quot;&gt;scheduled&lt;/a&gt; actions) were fixed. It still suffers from transient environmental failures (it relies or a large number of external resources), but it happens less than once a week. In some cases it can be fixed by &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/pulls/178&quot;&gt;adding a retry&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A test for the &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/pulls/189&quot;&gt;pull request automerge features&lt;/a&gt; was added.&lt;/p&gt; &lt;h3&gt;Deprecating go-git&lt;/h3&gt; &lt;p&gt;Discussions &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/164&quot;&gt;to deprecate go-git&lt;/a&gt; received strong support. If Forgejo wants to support go-git, every git Feature also needs to be implemented in go-git. For example: setting git notes in the Web UI is currently not possible in go-git.&lt;/p&gt; &lt;p&gt;The benefits of go-git may not be worth the effort. Git is already preinstalled on many distributions. If Forgejo is installed using Docker or a package manager, Git will already be installed with it.&lt;/p&gt; &lt;h2&gt;Infrastructure&lt;/h2&gt; &lt;p&gt;A new &lt;a href=&quot;https://forgejo.org/docs/next/developer/infrastructure/#hetzner0104&quot;&gt;machine&lt;/a&gt; was added to the Forgejo infrastructure. The capacity provisioned last year proved to be enough to sustain the increased activity since early 2024, with no slowdown or space restrictions. Even if the number of Forgejo contributors do not increase this year, testing federated features will require significantly more resources, for instance to launch a GitLab instance with ActivityPub extensions enabled.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/114&quot;&gt;forgefriends hosting request&lt;/a&gt; is partially complete. The &lt;a href=&quot;https://code.forgejo.org/forgefriends/&quot;&gt;https://code.forgejo.org/forgefriends/&lt;/a&gt; and &lt;a href=&quot;https://code.forgejo.org/f3/&quot;&gt;https://code.forgejo.org/f3/&lt;/a&gt; organizations were created and allocated Forgejo Actions runners. The &lt;a href=&quot;https://f3.forgefriends.org/&quot;&gt;F3&lt;/a&gt; organization was migrated from the &lt;a href=&quot;https://lab.forgefriends.org/friendlyforgeformat/&quot;&gt;GitLab instance&lt;/a&gt;. The &lt;a href=&quot;https://forum.forgefriends.org/&quot;&gt;F3 forum&lt;/a&gt; was migrated to &lt;a href=&quot;https://forgejo.org/docs/next/developer/infrastructure/#hetzner0104&quot;&gt;a dedicated LXC container&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A semi-manual &lt;a href=&quot;https://forgejo.org/docs/next/developer/static-pages/&quot;&gt;static page hosting service&lt;/a&gt; dedicated to code.forgejo.org was created. It is deployed to host the &lt;a href=&quot;https://f3.forgefriends.org&quot;&gt;F3&lt;/a&gt; and &lt;a href=&quot;https://forgefriends.org&quot;&gt;forgefriends&lt;/a&gt; websites and could be used as an alternative to &lt;a href=&quot;https://forgejo.org/docs/v7.0/developer/infrastructure/#uberspace&quot;&gt;Uberspace&lt;/a&gt; for &lt;a href=&quot;https://forgejo.org&quot;&gt;https://forgejo.org&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Releases&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-2&quot;&gt;Forgejo v7.0.2&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-3&quot;&gt;Forgejo v7.0.3&lt;/a&gt; (fixing &lt;a href=&quot;https://codeberg.org/forgejo/security-announcements/issues/10&quot;&gt;vulnerabilities&lt;/a&gt;) were released.&lt;/p&gt; &lt;p&gt;They both rely on the &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/159&quot;&gt;release note files&lt;/a&gt; that &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/ade7304eea8ffdf5440adb71dfb2dcb50159379a/release-notes/8.0.0&quot;&gt;are created at the same time as the pull requests&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;After a commit made its way to the v7.0 branch and was &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3867&quot;&gt;reverted at the last minute&lt;/a&gt; to avoid regression, it was &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/168&quot;&gt;proposed to require testing&lt;/a&gt; for all non-trivial commits cherry-picked from Gitea into the stable branch.&lt;/p&gt; &lt;h2&gt;Dependency Management&lt;/h2&gt; &lt;h3&gt;Tooling&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/tools/src/commit/52e2ded048ecb080a92bc957743fa35086ce37e0/scripts/weekly-cherry-pick.sh&quot;&gt;cherry-picking tool&lt;/a&gt; developed to keep track of commits cherry-picked from related repositories is used for:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3917&quot;&gt;the Forgejo development branch&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3942&quot;&gt;the Forgejo v7.0 stable branch&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/pulls/506&quot;&gt;the Forgejo helm&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;OCI mirror&lt;/h3&gt; &lt;p&gt;Forgejo maintains a set of &lt;a href=&quot;https://code.forgejo.org/oci/-/packages&quot;&gt;OCI images&lt;/a&gt; mirrors for the benefit of the CI, so that it is not rate limited by docker.io. They were previously manually maintained and a weekly scheduled workflow was created to &lt;a href=&quot;https://code.forgejo.org/forgejo/oci-mirror/src/commit/c6b1f3588f72fc9ac7a949120a084f343a716993/.forgejo/workflows/mirror.yml&quot;&gt;take care of it automatically&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;It was initially held back because of a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/780&quot;&gt;long standing bug&lt;/a&gt; preventing the use of &lt;a href=&quot;https://docs.docker.com/reference/cli/docker/buildx/imagetools/create/&quot;&gt;docker buildx imagetools create&lt;/a&gt; to mirror multi-architecture OCI images. It was worked around using &lt;a href=&quot;https://github.com/containers/skopeo&quot;&gt;skopeo&lt;/a&gt; which provides the same feature but does not run into the Forgejo bug that would prevent it to work.&lt;/p&gt; &lt;h2&gt;Helm chart&lt;/h2&gt; &lt;p&gt;The Forgejo helm chart had &lt;a href=&quot;https://code.forgejo.org/forgejo-helm/forgejo-helm/releases&quot;&gt;one major update&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The Forgejo helm chart moved from &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-helm&quot;&gt;forgejo-contrib&lt;/a&gt; to a &lt;a href=&quot;https://code.forgejo.org/forgejo-helm&quot;&gt;dedicated organization&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/136&quot;&gt;Forgejo helm team&lt;/a&gt; was proposed, with two potential members. A &lt;a href=&quot;https://matrix.to/#/#forgejo-helm-chart:matrix.org&quot;&gt;dedicated Matrix channel&lt;/a&gt; was created and added to &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;the Forgejo Matrix space&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;3 new team members were onboarded: &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/127&quot;&gt;[1]&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/137&quot;&gt;[2]&lt;/a&gt;. 5 batches of updates were merged containing total of 515 new translations and 1122 improvements. Traditional Chinese have seen a particularly high amount of fixes and improvements this month from a new team member. All translation changes got backported to according point releases of Forgejo v7.0, which is expected to continue receiving translation improvements.&lt;/p&gt; &lt;p&gt;There are still countless improvements to be made for many languages and you can help to improve the localization too. &lt;a href=&quot;https://forgejo.org/docs/latest/developer/localization&quot;&gt;Learn how&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Federation&lt;/h2&gt; &lt;p&gt;The pull request to implement &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;federated repository stars&lt;/a&gt; was split into smaller ones, five of which were merged in the development branch.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;Federated staring of repositories&lt;/a&gt; (in review)&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3886&quot;&gt;UI to define following repos&lt;/a&gt; (merged)&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3871&quot;&gt;Finalize receive activity&lt;/a&gt; (merged)&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3792&quot;&gt;Creation of federated user&lt;/a&gt; (merged)&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3662&quot;&gt;Federation: Parse ActorId &amp;amp; cache FederationHost&lt;/a&gt; (merged)&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3494&quot;&gt;Validate like activities&lt;/a&gt; (merged)&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Read more in the May 2024 reports (&lt;a href=&quot;https://domaindrivenarchitecture.org/posts/2024-05-15-state-of-federation/&quot;&gt;1&lt;/a&gt;, &lt;a href=&quot;https://domaindrivenarchitecture.org/posts/2024-05-24-state-of-federation/&quot;&gt;2&lt;/a&gt;).&lt;/p&gt; &lt;h2&gt;Governance&lt;/h2&gt; &lt;h3&gt;Sustainability&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/144&quot;&gt;discussion started&lt;/a&gt; on Forgejo durability in the next 10 years led to &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls?state=all&amp;amp;labels=217359&quot;&gt;a grant proposal&lt;/a&gt; submitted 16 May for the &lt;a href=&quot;https://www.opentech.fund/funds/free-and-open-source-software-sustainability-fund/&quot;&gt;Free and Open Source Software Sustainability Fund&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A reply was expected for the NLnet grant application &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls?labels=220838&quot;&gt;submitted 1 April&lt;/a&gt; but was delayed because of the large number of applicants. The arrangements made to ensure the two grants do not overlap in time were changed. Because of this delay and on condition that an extension can be negotiated, avoidance of an overlap may no longer be necessary.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/0ko&quot;&gt;https://codeberg.org/0ko&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/9pfs&quot;&gt;https://codeberg.org/9pfs&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/aaronriedel&quot;&gt;https://codeberg.org/aaronriedel&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/algernon&quot;&gt;https://codeberg.org/algernon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Andre601&quot;&gt;https://codeberg.org/Andre601&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/AndrewKvalheim&quot;&gt;https://codeberg.org/AndrewKvalheim&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ansemjo&quot;&gt;https://codeberg.org/ansemjo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Awlex&quot;&gt;https://codeberg.org/Awlex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/axd99&quot;&gt;https://codeberg.org/axd99&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Beowulf&quot;&gt;https://codeberg.org/Beowulf&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/channel-42&quot;&gt;https://codeberg.org/channel-42&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/clarfonthey&quot;&gt;https://codeberg.org/clarfonthey&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/comcloudway&quot;&gt;https://codeberg.org/comcloudway&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/CommanderRedYT&quot;&gt;https://codeberg.org/CommanderRedYT&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crapStone&quot;&gt;https://codeberg.org/crapStone&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Crown0815&quot;&gt;https://codeberg.org/Crown0815&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Cyborus&quot;&gt;https://codeberg.org/Cyborus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DD-P&quot;&gt;https://codeberg.org/DD-P&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/deblan&quot;&gt;https://codeberg.org/deblan&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/defanor&quot;&gt;https://codeberg.org/defanor&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Dirk&quot;&gt;https://codeberg.org/Dirk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Drakon&quot;&gt;https://codeberg.org/Drakon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/efertone&quot;&gt;https://codeberg.org/efertone&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/el0n&quot;&gt;https://codeberg.org/el0n&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/emersion&quot;&gt;https://codeberg.org/emersion&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/f00&quot;&gt;https://codeberg.org/f00&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fhuberts&quot;&gt;https://codeberg.org/fhuberts&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Firepup650&quot;&gt;https://codeberg.org/Firepup650&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fistons&quot;&gt;https://codeberg.org/fistons&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/foxy&quot;&gt;https://codeberg.org/foxy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Frankkkkk&quot;&gt;https://codeberg.org/Frankkkkk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/FunctionalHacker&quot;&gt;https://codeberg.org/FunctionalHacker&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ggpsv&quot;&gt;https://codeberg.org/ggpsv&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/glts&quot;&gt;https://codeberg.org/glts&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/h759bkyo4&quot;&gt;https://codeberg.org/h759bkyo4&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hazy&quot;&gt;https://codeberg.org/hazy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hoppinglife&quot;&gt;https://codeberg.org/hoppinglife&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/intelfx&quot;&gt;https://codeberg.org/intelfx&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/io7m&quot;&gt;https://codeberg.org/io7m&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jadeprime&quot;&gt;https://codeberg.org/jadeprime&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JakobDev&quot;&gt;https://codeberg.org/JakobDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/james2432&quot;&gt;https://codeberg.org/james2432&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jean-daricade&quot;&gt;https://codeberg.org/jean-daricade&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/johnthomas00&quot;&gt;https://codeberg.org/johnthomas00&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jwildeboer&quot;&gt;https://codeberg.org/jwildeboer&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KalleMP&quot;&gt;https://codeberg.org/KalleMP&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kdh8219&quot;&gt;https://codeberg.org/kdh8219&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kenzu&quot;&gt;https://codeberg.org/kenzu&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Kladky&quot;&gt;https://codeberg.org/Kladky&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Kwonunn&quot;&gt;https://codeberg.org/Kwonunn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/leana8959&quot;&gt;https://codeberg.org/leana8959&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/leetickett&quot;&gt;https://codeberg.org/leetickett&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Lgmrszd&quot;&gt;https://codeberg.org/Lgmrszd&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/liberodark&quot;&gt;https://codeberg.org/liberodark&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/magicfelix&quot;&gt;https://codeberg.org/magicfelix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mai-Lapyst&quot;&gt;https://codeberg.org/Mai-Lapyst&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mainboarder&quot;&gt;https://codeberg.org/mainboarder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/martinwguy&quot;&gt;https://codeberg.org/martinwguy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/matrss&quot;&gt;https://codeberg.org/matrss&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mguims&quot;&gt;https://codeberg.org/mguims&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/milahu&quot;&gt;https://codeberg.org/milahu&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/minion&quot;&gt;https://codeberg.org/minion&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mirkoperillo&quot;&gt;https://codeberg.org/mirkoperillo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/neomaitre&quot;&gt;https://codeberg.org/neomaitre&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/npgo22&quot;&gt;https://codeberg.org/npgo22&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/NRK&quot;&gt;https://codeberg.org/NRK&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/omenos&quot;&gt;https://codeberg.org/omenos&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/openbrian&quot;&gt;https://codeberg.org/openbrian&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/pensicus&quot;&gt;https://codeberg.org/pensicus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/peylight&quot;&gt;https://codeberg.org/peylight&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/PixelHamster&quot;&gt;https://codeberg.org/PixelHamster&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/popey&quot;&gt;https://codeberg.org/popey&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/proton-ab&quot;&gt;https://codeberg.org/proton-ab&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Renich&quot;&gt;https://codeberg.org/Renich&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/roberth&quot;&gt;https://codeberg.org/roberth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/robko23&quot;&gt;https://codeberg.org/robko23&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sclu1034&quot;&gt;https://codeberg.org/sclu1034&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/scy&quot;&gt;https://codeberg.org/scy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SeaswimmerTheFsh&quot;&gt;https://codeberg.org/SeaswimmerTheFsh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sevki&quot;&gt;https://codeberg.org/sevki&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SinTan1729&quot;&gt;https://codeberg.org/SinTan1729&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/stephanm&quot;&gt;https://codeberg.org/stephanm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sthagen&quot;&gt;https://codeberg.org/sthagen&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sthenault&quot;&gt;https://codeberg.org/sthenault&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/svoop&quot;&gt;https://codeberg.org/svoop&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/TheAwiteb&quot;&gt;https://codeberg.org/TheAwiteb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thefox&quot;&gt;https://codeberg.org/thefox&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/trymeout&quot;&gt;https://codeberg.org/trymeout&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tseeker&quot;&gt;https://codeberg.org/tseeker&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/twenty-panda&quot;&gt;https://codeberg.org/twenty-panda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ujr&quot;&gt;https://codeberg.org/ujr&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/varp0n&quot;&gt;https://codeberg.org/varp0n&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/voltagex&quot;&gt;https://codeberg.org/voltagex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/woutput&quot;&gt;https://codeberg.org/woutput&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xinnix&quot;&gt;https://codeberg.org/xinnix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xunzi&quot;&gt;https://codeberg.org/xunzi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yarikoptic&quot;&gt;https://codeberg.org/yarikoptic&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ZilloweZ&quot;&gt;https://codeberg.org/ZilloweZ&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/747&quot;&gt;https://translate.codeberg.org/user/747&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/anonymous&quot;&gt;https://translate.codeberg.org/user/anonymous&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/b1nar10&quot;&gt;https://translate.codeberg.org/user/b1nar10&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Cwpute&quot;&gt;https://translate.codeberg.org/user/Cwpute&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/emansije&quot;&gt;https://translate.codeberg.org/user/emansije&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/enricpineda&quot;&gt;https://translate.codeberg.org/user/enricpineda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Fitik&quot;&gt;https://translate.codeberg.org/user/Fitik&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Fjuro&quot;&gt;https://translate.codeberg.org/user/Fjuro&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/furry&quot;&gt;https://translate.codeberg.org/user/furry&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/hankskyjames777&quot;&gt;https://translate.codeberg.org/user/hankskyjames777&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/kita&quot;&gt;https://translate.codeberg.org/user/kita&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ledyba&quot;&gt;https://translate.codeberg.org/user/ledyba&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/mareklach&quot;&gt;https://translate.codeberg.org/user/mareklach&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/monstorix&quot;&gt;https://translate.codeberg.org/user/monstorix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Mumulhl&quot;&gt;https://translate.codeberg.org/user/Mumulhl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Mylloon&quot;&gt;https://translate.codeberg.org/user/Mylloon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/NameLessGO&quot;&gt;https://translate.codeberg.org/user/NameLessGO&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Nifou&quot;&gt;https://translate.codeberg.org/user/Nifou&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/nmmr&quot;&gt;https://translate.codeberg.org/user/nmmr&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/petrcech&quot;&gt;https://translate.codeberg.org/user/petrcech&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Pi-Cla&quot;&gt;https://translate.codeberg.org/user/Pi-Cla&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/salif&quot;&gt;https://translate.codeberg.org/user/salif&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/sunwoo1524&quot;&gt;https://translate.codeberg.org/user/sunwoo1524&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/VioletLul&quot;&gt;https://translate.codeberg.org/user/VioletLul&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Werenter&quot;&gt;https://translate.codeberg.org/user/Werenter&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Wuzzy&quot;&gt;https://translate.codeberg.org/user/Wuzzy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Xinayder&quot;&gt;https://translate.codeberg.org/user/Xinayder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/yeziruo&quot;&gt;https://translate.codeberg.org/user/yeziruo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/zyachel&quot;&gt;https://translate.codeberg.org/user/zyachel&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - April 2024</title><link>https://forgejo.org/2024-04-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2024-04-monthly-update/</guid><description>Contributors got together to celebrate the release of Forgejo v7.0 and Codeberg was upgraded the next day. A lot of effort went into the automation of the development process, for dependency management and releases, so that contributors can focus on what matters most. As Forgejo matures, more and more of the work is about day to day management of bug reports, localization, security, etc. All aspects that make Forgejo a product that can be relied on for the years ahead. 17 interviews were conducted to better understand how Forgejo is used and shape its roadmap in a user centered way.</description><pubDate>Tue, 30 Apr 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;The monthly report is meant to provide a good overview of what has changed in Forgejo in the past month. If you would like to help, please get in touch in &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;the chatroom&lt;/a&gt; or participate in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions&quot;&gt;ongoing discussions&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Contributors got together to celebrate the release of &lt;a href=&quot;https://forgejo.org/2024-04-release-v7-0/&quot;&gt;Forgejo v7.0&lt;/a&gt; and Codeberg was upgraded the next day. A lot of effort went into the automation of the development process, for dependency management and releases, so that contributors can focus on what matters most. As Forgejo matures, more and more of the work is about day to day management of bug reports, localization, security, etc. All aspects that make Forgejo a product that can be relied on for the years ahead. 17 interviews were conducted to better understand how Forgejo is used and shape its roadmap in a user centered way.&lt;/p&gt; &lt;h2&gt;Forgejo 7.0&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://forgejo.org/2024-04-release-v7-0/&quot;&gt;Forgejo v7.0 was published 23 April&lt;/a&gt; with translations in Bulgarian, Esperanto, Filipino and Slovenian; SourceHut builds integration; support for the SHA-256 hash function in Git; source code search by default and more. It also is the first Long Term Support version and will receive updates until July 2025. The adoption of semantic versioning is the reason for the version bump from v1.21 to v7.0 and is compatible with existing tools.&lt;/p&gt; &lt;h3&gt;Regressions and 7.0.1&lt;/h3&gt; &lt;p&gt;Previous Forgejo releases were synchronized with the Gitea release cycle and usually published after the first patch release, when the most disruptive bugs or regressions were discovered and fixed.&lt;a href=&quot;https://forgejo.org/2024-02-forking-forward/&quot;&gt;Forgejo became a hard fork&lt;/a&gt; two months ago and it was its first major release. Two significant regressions were discovered less than 48h after the release. Their impact and workarounds were documented &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-0&quot;&gt;by amending the 7.0.0 release notes&lt;/a&gt; while the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-1&quot;&gt;7.0.1 patch release&lt;/a&gt; was prepared. It was released four days later.&lt;/p&gt; &lt;h3&gt;Celebration and motivations&lt;/h3&gt; &lt;p&gt;On 27 April Forgejo contributors got together in a videoconference to celebrate the publication of the 7.0 release and remember the evolution of the project since its inception in 2022. They also &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/158&quot;&gt;shared their motivations and goals for 2024&lt;/a&gt; in a discussion for everyone to know what they find important, but also what motivates them to contribute to a given topic.&lt;/p&gt; &lt;h3&gt;Codeberg upgrade&lt;/h3&gt; &lt;p&gt;The Codeberg staging instance was used with Forgejo 7.0 release candidates and a copy of the production data in an attempt to identify scaling issues and regressions.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/Codeberg-Infrastructure/forgejo/src/branch/codeberg-7&quot;&gt;Codeberg specific patches&lt;/a&gt; were ported (new templates and CSS &lt;a href=&quot;https://forgejo.org/docs/latest/developer/customization/&quot;&gt;need to be adapted&lt;/a&gt;) and Codeberg was migrated to 7.0 on 28 April.&lt;/p&gt; &lt;h3&gt;Release notes quality&lt;/h3&gt; &lt;p&gt;In order to &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/155&quot;&gt;improve the quality of the release notes&lt;/a&gt;, a &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/159&quot;&gt;new requirement&lt;/a&gt; to merging a pull request was discussed and led to &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/118&quot;&gt;an agreement proposal&lt;/a&gt;. The author of a pull request would be required to provide a snippet if their change needs to show in the release notes.&lt;/p&gt; &lt;h2&gt;Backport automation&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://github.com/kiegroup/git-backporting/&quot;&gt;git-backporting&lt;/a&gt; action was &lt;a href=&quot;https://github.com/kiegroup/git-backporting/compare/v4.6.0...v4.8.0&quot;&gt;improved&lt;/a&gt; to support:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;multiple targets&lt;/li&gt; &lt;li&gt;notifications on error&lt;/li&gt; &lt;li&gt;merged and squash pull requests&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;As expected it is now used to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?poster=165271&amp;amp;state=closed&quot;&gt;backport most pull requests&lt;/a&gt; from the development branch to the &lt;code&gt;v7.0/forgejo&lt;/code&gt; branch.&lt;/p&gt; &lt;p&gt;The release notes themselves that were previously only found in the development branch are now &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3489&quot;&gt;also backported to the stable branch&lt;/a&gt; where they belong.&lt;/p&gt; &lt;h2&gt;Code&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo&quot;&gt;https://codeberg.org/forgejo/forgejo&lt;/a&gt;&lt;/p&gt; &lt;p&gt;Notable improvements and bug fixes:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3139&quot;&gt;Add Option to hide Release Archive links&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3383&quot;&gt;Limit database max connections by default&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3414&quot;&gt;ldap synchronization can use a new field to make domain name configurable&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=209916&quot;&gt;Read more&lt;/a&gt; in the pull requests.&lt;/p&gt; &lt;h2&gt;Security&lt;/h2&gt; &lt;p&gt;There is &lt;a href=&quot;https://forgejo.org/2024-03-xz/&quot;&gt;no direct impact of the xz backdoor (CVE-2024-3094) on Forgejo&lt;/a&gt;. This CVE got a lot of attention and a blog post was published to explain why Forgejo is not affected.&lt;/p&gt; &lt;p&gt;The Forgejo v1.21.11-0 release &lt;a href=&quot;https://forgejo.org/2024-04-release-v1-21-11-0/&quot;&gt;was published 18 April&lt;/a&gt; and contains two security fixes: a privilege escalation that allows any registered user to change the visibility of any public repository; and a cross-site scripting (XSS) vulnerability that enabled attackers to run unsandboxed client-side scripts on pages served from the forge&apos;s domain.&lt;/p&gt; &lt;h2&gt;User Research&lt;/h2&gt; &lt;p&gt;The work started early March on &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/130&quot;&gt;Forgejo Usability&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/131&quot;&gt;Designing a modern contribution workflow&lt;/a&gt; led to 17 interviews &lt;a href=&quot;https://codeberg.org/forgejo/user-research/src/branch/main/interviews/2024-04&quot;&gt;for which transcripts were archived&lt;/a&gt;. They provide material that can be re-used in various contexts, even for the benefit of forges other than Forgejo.&lt;/p&gt; &lt;p&gt;Some of the information already influenced decisions and implementation details in discussions, and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/?q=&amp;amp;type=all&amp;amp;state=open&amp;amp;labels=208298&amp;amp;milestone=0&amp;amp;assignee=0&amp;amp;poster=179&quot;&gt;issues were created&lt;/a&gt; in response to the user interviews, for example to improve the new repo units button and feedback for features that are still in development, such as &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/3502&quot;&gt;improving assignment to issues&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A discussion on how to &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/156&quot;&gt;move on with user research&lt;/a&gt; was started.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/157&quot;&gt;survey started&lt;/a&gt; on &lt;strong&gt;Exploring the Contributor Experience&lt;/strong&gt; where Forgejo contributors are asked to answer a series of questions.&lt;/p&gt; &lt;h2&gt;Dependency Management&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/2779&quot;&gt;dependency update dashboard&lt;/a&gt; is used daily to observe and update Forgejo dependencies. When a new release is available, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/.forgejo/workflows/renovate.yml&quot;&gt;a daily scheduled workflow&lt;/a&gt; will create a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?poster=165503&quot;&gt;pull request&lt;/a&gt; which:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;will be merged automatically, for instance if it is a patch upgrade from a dependency known to have a trusted release process&lt;/li&gt; &lt;li&gt;be reviewed by a Forgejo contributor to decided if it worth an upgrade&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;With hundreds of dependencies, there is a significant backlog to absorb and it is done incrementally by improving the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/renovate.json&quot;&gt;configuration file&lt;/a&gt; with:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;groups of dependencies, for instance &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/27fa12427ce86cd81dbecd184b13a3dd3d7061d9/renovate.json#L7&quot;&gt;postcss&lt;/a&gt; where multiple dependencies are treated as one&lt;/li&gt; &lt;li&gt;automerging &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/27fa12427ce86cd81dbecd184b13a3dd3d7061d9/renovate.json#L80&quot;&gt;patch releases&lt;/a&gt;&lt;/li&gt; &lt;li&gt;adding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/27fa12427ce86cd81dbecd184b13a3dd3d7061d9/renovate.json#L134&quot;&gt;custom dependency detection&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;When Forgejo became a hard fork two months ago, maintainers switched from rebasing weekly on top of Gitea to cherry picking commits instead. A &lt;a href=&quot;https://codeberg.org/forgejo/tools&quot;&gt;tool&lt;/a&gt; has been developed to make this process easier, and automate as much of it as possible. As the tool keeps evolving, the weekly cherry pick pull request become &lt;a href=&quot;https://codeberg.org/forgejo/tools/issues/31#issuecomment-1792960&quot;&gt;easier to create&lt;/a&gt;, review, and even includes &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3513&quot;&gt;interesting statistics&lt;/a&gt; at the bottom of the summary.&lt;/p&gt; &lt;h2&gt;Forgejo v1.20 end of life&lt;/h2&gt; &lt;p&gt;With the release of Forgejo 7.0, the Forgejo v1.20 release is EOL (End Of Life) and will no longer receive security patches. The last of them was &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3319&quot;&gt;backported&lt;/a&gt; and made available in the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commits/branch/v1.20/forgejo&quot;&gt;v1.20/forgejo&lt;/a&gt; branch for the benefit of source builds in April.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;end-to-end tests&lt;/a&gt; were also &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/pulls/167&quot;&gt;updated&lt;/a&gt; to remove v1.20 support and &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/branch/main/README.md#removing-legacy-tests&quot;&gt;the policy to managed&lt;/a&gt; legacy tests was documented.&lt;/p&gt; &lt;h2&gt;Debian packages&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-deb&quot;&gt;Debian package&lt;/a&gt; has undergone extensive changes. In addition to gaining support for Forgejo v7.0 LTS, its CI was &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-deb/src/branch/main/.forgejo/workflows/forgejo-deb.yml&quot;&gt;migrated to Forgejo Actions&lt;/a&gt; and includes a pull request test suite. The repository now has an LTS release channel. Enhancements are in the works to remove Forgejo&apos;s common data from the compiled binaries and instead storing it in a forgejo-common package. This lays the groundwork for things like multi-architecture builds.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-deb/issues/34&quot;&gt;call for maintainers&lt;/a&gt; was posted so that there are at least three maintainers to ensure:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Debian packages are available within 12 hours of Forgejo releases&lt;/li&gt; &lt;li&gt;Pull requests can be reviewed by at least one maintainer&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-deb&quot;&gt;https://codeberg.org/forgejo-contrib/forgejo-deb&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Helm chart&lt;/h2&gt; &lt;p&gt;The Forgejo helm chart had &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-helm/releases&quot;&gt;one major updates&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-helm/releases&quot;&gt;https://codeberg.org/forgejo-contrib/forgejo-helm/releases&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;The localization keeps going forward. 1 member &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/112&quot;&gt;was onboarded&lt;/a&gt; and 2 more applications were created. Some optimizations to the merge process were made to make it go faster. 6 batches of updates &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?state=closed&amp;amp;poster=67160&quot;&gt;were merged&lt;/a&gt;, containing total of 2273 new translations and 1913 improvements. The translation effort had finally seen the light with the Forgejo 7.0.0 release, which is the first release containing major Forgejo localization improvements. There are still countless improvements to be made for many languages and you can help to improve the localization too. &lt;a href=&quot;https://forgejo.org/docs/latest/developer/localization&quot;&gt;Learn how&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Federation&lt;/h2&gt; &lt;p&gt;The pull request to implement &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;federated stars&lt;/a&gt; passes tests and is ready for merging. It is a very large pull request and it was requested by reviewers to split it into smaller, more manageable pull requests. In the same way the large webhook refactor was done. The first pull request &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3494&quot;&gt;was open and is its final stage&lt;/a&gt; to validate ActivityPub messages.&lt;/p&gt; &lt;p&gt;A new pull request to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/3128&quot;&gt;implement federated search&lt;/a&gt; was proposed with a demonstration searching for an actor on &lt;a href=&quot;https://next.forgejo.org&quot;&gt;https://next.forgejo.org&lt;/a&gt; from a locally running Forgejo instance.&lt;/p&gt; &lt;h2&gt;Governance&lt;/h2&gt; &lt;h3&gt;Sustainability&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/144&quot;&gt;discussion started&lt;/a&gt; on Forgejo durability in the next 10 years led to drafting a grant proposal for the new &lt;a href=&quot;https://www.opentech.fund/funds/free-and-open-source-software-sustainability-fund/&quot;&gt;Free and Open Source Software Sustainability Fund&lt;/a&gt;. It proposes the creation of a non-profit organization managed transparently so that it can be audited at any time. Its purpose would be to define a collective roadmap and use the grant to fund the work. To preserve the Forgejo dynamic that is key to its momentum, it will be setup to ensure volunteers keep being its driving force.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/0ko&quot;&gt;https://codeberg.org/0ko&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/adaaa&quot;&gt;https://codeberg.org/adaaa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/algernon&quot;&gt;https://codeberg.org/algernon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Andre601&quot;&gt;https://codeberg.org/Andre601&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/anri&quot;&gt;https://codeberg.org/anri&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/AverageHelper&quot;&gt;https://codeberg.org/AverageHelper&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/axd99&quot;&gt;https://codeberg.org/axd99&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/banaanihillo&quot;&gt;https://codeberg.org/banaanihillo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bapt&quot;&gt;https://codeberg.org/bapt&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/BaumiCoder&quot;&gt;https://codeberg.org/BaumiCoder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bdr9&quot;&gt;https://codeberg.org/bdr9&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bdube&quot;&gt;https://codeberg.org/bdube&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Beowulf&quot;&gt;https://codeberg.org/Beowulf&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/buhtz&quot;&gt;https://codeberg.org/buhtz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ChrSt&quot;&gt;https://codeberg.org/ChrSt&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/clarfonthey&quot;&gt;https://codeberg.org/clarfonthey&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/con-f-use&quot;&gt;https://codeberg.org/con-f-use&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Crown0815&quot;&gt;https://codeberg.org/Crown0815&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Cyborus&quot;&gt;https://codeberg.org/Cyborus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ddevault&quot;&gt;https://codeberg.org/ddevault&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/deblan&quot;&gt;https://codeberg.org/deblan&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Dirk&quot;&gt;https://codeberg.org/Dirk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Drakon&quot;&gt;https://codeberg.org/Drakon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/el0n&quot;&gt;https://codeberg.org/el0n&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/eo&quot;&gt;https://codeberg.org/eo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/flipreverse&quot;&gt;https://codeberg.org/flipreverse&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/foxy&quot;&gt;https://codeberg.org/foxy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Frankkkkk&quot;&gt;https://codeberg.org/Frankkkkk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/gmask&quot;&gt;https://codeberg.org/gmask&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/grosmanal&quot;&gt;https://codeberg.org/grosmanal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/h759bkyo4&quot;&gt;https://codeberg.org/h759bkyo4&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hazy&quot;&gt;https://codeberg.org/hazy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ikidd&quot;&gt;https://codeberg.org/ikidd&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/iminfinity&quot;&gt;https://codeberg.org/iminfinity&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/intelfx&quot;&gt;https://codeberg.org/intelfx&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/itsdrike&quot;&gt;https://codeberg.org/itsdrike&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JakobDev&quot;&gt;https://codeberg.org/JakobDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jean-daricade&quot;&gt;https://codeberg.org/jean-daricade&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JeremyStarTM&quot;&gt;https://codeberg.org/JeremyStarTM&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jfinkhaeuser&quot;&gt;https://codeberg.org/jfinkhaeuser&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Justman10000&quot;&gt;https://codeberg.org/Justman10000&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jwells&quot;&gt;https://codeberg.org/jwells&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jwildeboer&quot;&gt;https://codeberg.org/jwildeboer&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kB01&quot;&gt;https://codeberg.org/kB01&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kita&quot;&gt;https://codeberg.org/kita&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KlavsKlavsen&quot;&gt;https://codeberg.org/KlavsKlavsen&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KOLANICH&quot;&gt;https://codeberg.org/KOLANICH&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lampajr&quot;&gt;https://codeberg.org/lampajr&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/liberodark&quot;&gt;https://codeberg.org/liberodark&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Link1J&quot;&gt;https://codeberg.org/Link1J&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mai-Lapyst&quot;&gt;https://codeberg.org/Mai-Lapyst&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mainboarder&quot;&gt;https://codeberg.org/mainboarder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/maltfield&quot;&gt;https://codeberg.org/maltfield&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/markuzcha&quot;&gt;https://codeberg.org/markuzcha&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/matheusmoreira&quot;&gt;https://codeberg.org/matheusmoreira&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/maya&quot;&gt;https://codeberg.org/maya&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/MichaelTen&quot;&gt;https://codeberg.org/MichaelTen&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mlncn&quot;&gt;https://codeberg.org/mlncn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mnq&quot;&gt;https://codeberg.org/mnq&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/moonglum&quot;&gt;https://codeberg.org/moonglum&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/natct&quot;&gt;https://codeberg.org/natct&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nercon&quot;&gt;https://codeberg.org/nercon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nezbednik&quot;&gt;https://codeberg.org/nezbednik&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/NicolasCARPi&quot;&gt;https://codeberg.org/NicolasCARPi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/payas&quot;&gt;https://codeberg.org/payas&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Pi-Cla&quot;&gt;https://codeberg.org/Pi-Cla&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/PixelHamster&quot;&gt;https://codeberg.org/PixelHamster&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/popey&quot;&gt;https://codeberg.org/popey&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/programmerjake&quot;&gt;https://codeberg.org/programmerjake&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rafadc&quot;&gt;https://codeberg.org/rafadc&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/realaravinth&quot;&gt;https://codeberg.org/realaravinth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ReptoxX&quot;&gt;https://codeberg.org/ReptoxX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/saltstack-admin&quot;&gt;https://codeberg.org/saltstack-admin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sbatial&quot;&gt;https://codeberg.org/sbatial&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sergeyk&quot;&gt;https://codeberg.org/sergeyk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/shanzez&quot;&gt;https://codeberg.org/shanzez&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/silverwind&quot;&gt;https://codeberg.org/silverwind&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SinTan1729&quot;&gt;https://codeberg.org/SinTan1729&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SnowCode&quot;&gt;https://codeberg.org/SnowCode&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sosasees&quot;&gt;https://codeberg.org/sosasees&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SR-G&quot;&gt;https://codeberg.org/SR-G&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/stsp&quot;&gt;https://codeberg.org/stsp&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Sunner&quot;&gt;https://codeberg.org/Sunner&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tampler&quot;&gt;https://codeberg.org/tampler&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thefox&quot;&gt;https://codeberg.org/thefox&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/theoryshaw&quot;&gt;https://codeberg.org/theoryshaw&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thepaperpilot&quot;&gt;https://codeberg.org/thepaperpilot&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Thesola10&quot;&gt;https://codeberg.org/Thesola10&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thomas-maurice&quot;&gt;https://codeberg.org/thomas-maurice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tmb&quot;&gt;https://codeberg.org/tmb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/VehementHam&quot;&gt;https://codeberg.org/VehementHam&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/VicinityNeurosis&quot;&gt;https://codeberg.org/VicinityNeurosis&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/vsz&quot;&gt;https://codeberg.org/vsz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wangito33&quot;&gt;https://codeberg.org/wangito33&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wetneb&quot;&gt;https://codeberg.org/wetneb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Wuzzy&quot;&gt;https://codeberg.org/Wuzzy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Xinayder&quot;&gt;https://codeberg.org/Xinayder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yarikoptic&quot;&gt;https://codeberg.org/yarikoptic&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yumisea&quot;&gt;https://codeberg.org/yumisea&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zareck&quot;&gt;https://codeberg.org/zareck&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zontreck&quot;&gt;https://codeberg.org/zontreck&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zotan&quot;&gt;https://codeberg.org/zotan&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Zottelchen&quot;&gt;https://codeberg.org/Zottelchen&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zwanto&quot;&gt;https://codeberg.org/zwanto&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/747&quot;&gt;https://translate.codeberg.org/user/747&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/emansije&quot;&gt;https://translate.codeberg.org/user/emansije&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Eriwi&quot;&gt;https://translate.codeberg.org/user/Eriwi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/EssGeeEich&quot;&gt;https://translate.codeberg.org/user/EssGeeEich&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/FedericoSchonborn&quot;&gt;https://translate.codeberg.org/user/FedericoSchonborn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Fjuro&quot;&gt;https://translate.codeberg.org/user/Fjuro&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/FunctionalHacker&quot;&gt;https://translate.codeberg.org/user/FunctionalHacker&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/furry&quot;&gt;https://translate.codeberg.org/user/furry&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/hankskyjames777&quot;&gt;https://translate.codeberg.org/user/hankskyjames777&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/kdh8219&quot;&gt;https://translate.codeberg.org/user/kdh8219&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/kecrily&quot;&gt;https://translate.codeberg.org/user/kecrily&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/leana8959&quot;&gt;https://translate.codeberg.org/user/leana8959&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/lucasmz&quot;&gt;https://translate.codeberg.org/user/lucasmz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/m0s&quot;&gt;https://translate.codeberg.org/user/m0s&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Mormegil&quot;&gt;https://translate.codeberg.org/user/Mormegil&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Mylloon&quot;&gt;https://translate.codeberg.org/user/Mylloon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Quitaxd&quot;&gt;https://translate.codeberg.org/user/Quitaxd&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/rguards&quot;&gt;https://translate.codeberg.org/user/rguards&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/salif&quot;&gt;https://translate.codeberg.org/user/salif&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/sinsky&quot;&gt;https://translate.codeberg.org/user/sinsky&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/SteffoSpieler&quot;&gt;https://translate.codeberg.org/user/SteffoSpieler&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/toasterbirb&quot;&gt;https://translate.codeberg.org/user/toasterbirb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/WithLithum&quot;&gt;https://translate.codeberg.org/user/WithLithum&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/yeziruo&quot;&gt;https://translate.codeberg.org/user/yeziruo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ZilloweZ&quot;&gt;https://translate.codeberg.org/user/ZilloweZ&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Zughy&quot;&gt;https://translate.codeberg.org/user/Zughy&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo v7.0 is available</title><link>https://forgejo.org/2024-04-release-v7-0/</link><guid isPermaLink="true">https://forgejo.org/2024-04-release-v7-0/</guid><description>Forgejo v7.0 is available with translations in Bulgarian, Esperanto, Filipino and Slovenian; SourceHut builds integration; support for the SHA-256 hash function in Git; source code search by default and more. It also is the first Long Term Support version and will receive updates until July 2025. The adoption of semantic versioning is the reason for the version bump from v1.21 to v7.0 and is compatible with existing tools.</description><pubDate>Tue, 23 Apr 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;/download/&quot;&gt;Forgejo v7.0&lt;/a&gt; was released 23 April 2024. You will find the most interesting changes it introduces below and in a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-0&quot;&gt;complete list in the release notes&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://v7.next.forgejo.org/&quot;&gt;dedicated test instance is available&lt;/a&gt; to try it out. Before upgrading it is &lt;em&gt;strongly recommended&lt;/em&gt; to make a full backup as explained in the &lt;a href=&quot;/docs/v7.0/admin/upgrade/&quot;&gt;upgrade guide&lt;/a&gt; and carefully read &lt;em&gt;all breaking changes&lt;/em&gt; from the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-0&quot;&gt;release notes&lt;/a&gt;. If in doubt, do not hesitate to ask for help &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or in the &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;chat room&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The adoption of &lt;a href=&quot;https://semver.org/spec/v2.0.0.html&quot;&gt;Semantic Versioning 2.0.0&lt;/a&gt; is the reason for the version bump from &lt;code&gt;v1.21&lt;/code&gt; to &lt;code&gt;v7.0&lt;/code&gt; and is compatible with existing tools.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://translate.codeberg.org/projects/forgejo/forgejo&quot;&gt;Translations in four new languages&lt;/a&gt;&lt;/strong&gt; with a usable level of completion are available to users: Bulgarian, Esperanto, Filipino and Slovenian.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v7.0/user/webhooks/&quot;&gt;SourceHut Builds integration&lt;/a&gt;&lt;/strong&gt; can be used to submit jobs to &lt;a href=&quot;https://man.sr.ht/builds.sr.ht/&quot;&gt;SourceHut&lt;/a&gt; on push events.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v7.0/user/code-search/#basic-git-grep&quot;&gt;Source code search code now available by default&lt;/a&gt;&lt;/strong&gt; using &lt;a href=&quot;https://git-scm.com/docs/git-grep&quot;&gt;git grep&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://forgejo.org/docs/v7.0/user/repository-activity/&quot;&gt;Activity graphs&lt;/a&gt;&lt;/strong&gt; show the contributors, code frequency and the recent commits in the activity tab of repositories.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://forgejo.org/docs/v7.0/user/wiki/#activation-and-permissions&quot;&gt;The wiki can be edited by any user&lt;/a&gt;&lt;/strong&gt; with read permissions by selecting &lt;code&gt;Allow anyone to edit the wiki&lt;/code&gt; on the repository settings. The default is to only allow users with write permissions on the repository.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/d68a613ba8fd860863a3465b5b5945b191b87b25&quot;&gt;Git repositories using SHA-256 are supported&lt;/a&gt;&lt;/strong&gt;. Although Git repositories using SHA-1 are not vulnerable to &lt;a href=&quot;https://shattered.io/&quot;&gt;collision attacks&lt;/a&gt; since Git v2.13.0, this hash algorithm is still weak. Git &lt;a href=&quot;https://git-scm.com/docs/hash-function-transition&quot;&gt;transition to a SHA-256 hash function&lt;/a&gt; was decided to be trustworthy and useful in practice for at least 10 years. &lt;strong&gt;As of Forgejo 7.0.2 some features are &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/3613&quot;&gt;still unreliable when using SHA-256&lt;/a&gt;.&lt;/strong&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://forgejo.org/docs/v7.0/user/readme-badges/&quot;&gt;Repository badges&lt;/a&gt;&lt;/strong&gt; can be used to embed information about a given repository such as the CI state, the number of issues, etc.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Read more &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-0&quot;&gt;in the Forgejo v7.0.0 release notes&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;7.0 Long Term Support (LTS) and semantic versioning&lt;/h2&gt; &lt;p&gt;The &lt;code&gt;7.0&lt;/code&gt; version is the first Long Term Support (LTS) release. Critical bug and security fixes will be published in patch releases (&lt;code&gt;7.0.1&lt;/code&gt;, &lt;code&gt;7.0.2&lt;/code&gt;, etc.) until &lt;strong&gt;July 2025&lt;/strong&gt;. It is also the first version to use &lt;a href=&quot;https://semver.org/spec/v2.0.0.html&quot;&gt;semantic versioning&lt;/a&gt;. Forgejo implemented semantic versioning internally in earlier releases (for instance &lt;code&gt;v1.21&lt;/code&gt; is &lt;code&gt;v6.0&lt;/code&gt;) and it is now exposed publicly.&lt;/p&gt; &lt;h3&gt;Gitea API compatibility&lt;/h3&gt; &lt;p&gt;Tools that are developed for the Gitea API will keep working with the new Forgejo numbering scheme. They typically make assertions on the release number to unlock new functionalities and that logic will not be impacted by a bump in the release number. The proprietary version of Gitea has a different numbering scheme (v21.X.Y, v22.X.Y) and is in a similar situation.&lt;/p&gt; &lt;p&gt;Read more about &lt;a href=&quot;/2024-02-forking-forward/&quot;&gt;Gitea compatibility in the blog post explaining the hard fork that happened in February 2024&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Time based release schedule&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://forgejo.org/docs/v7.0/developer/release/#release-cycle&quot;&gt;time based release schedule&lt;/a&gt; was established to publish a release every three months. Patch releases will be published more frequently, depending on the severity of the bug or security fixes they contain. The exact number of the release cannot be known in advance because it will be determined by the features and breaking changes it contains, as specified by the &lt;a href=&quot;https://semver.org/spec/v2.0.0.html&quot;&gt;Semantic Versioning 2.0.0&lt;/a&gt; specifications.&lt;/p&gt; &lt;table&gt; &lt;thead&gt; &lt;tr&gt; &lt;th&gt;&lt;strong&gt;Date&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;Version&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;Release date&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;End Of Life&lt;/strong&gt;&lt;/th&gt; &lt;/tr&gt; &lt;/thead&gt; &lt;tbody&gt;&lt;tr&gt; &lt;td&gt;2024 Q1&lt;/td&gt; &lt;td&gt;7.0.0+gitea-1.22.0&lt;/td&gt; &lt;td&gt;23 April 2024&lt;/td&gt; &lt;td&gt;&lt;strong&gt;16 July 2025&lt;/strong&gt;&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2024 Q2&lt;/td&gt; &lt;td&gt;8.0.0+gitea-A.B.C&lt;/td&gt; &lt;td&gt;17 July 2024&lt;/td&gt; &lt;td&gt;16 October 2024&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2024 Q3&lt;/td&gt; &lt;td&gt;X.Y.Z+gitea-A.B.C&lt;/td&gt; &lt;td&gt;16 October 2024&lt;/td&gt; &lt;td&gt;15 January 2025&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2024 Q4&lt;/td&gt; &lt;td&gt;X.Y.Z+gitea-A.B.C&lt;/td&gt; &lt;td&gt;15 January 2025&lt;/td&gt; &lt;td&gt;16 April 2025&lt;/td&gt; &lt;/tr&gt; &lt;/tbody&gt;&lt;/table&gt; &lt;h3&gt;7.0-test daily releases&lt;/h3&gt; &lt;p&gt;Releases are built daily from the latest changes found in the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/v7.0/forgejo&quot;&gt;v7.0/forgejo&lt;/a&gt; development branch. They are deployed to the &lt;a href=&quot;https://v7.next.forgejo.org&quot;&gt;https://v7.next.forgejo.org&lt;/a&gt; instance for manual verification in case a bug fix is of particular interest ahead of the next patch release. It can also be installed locally with:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;OCI images: &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/7.0-test&quot;&gt;root&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/7.0-test-rootless&quot;&gt;rootless&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v7.0-test&quot;&gt;Binaries&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Their name stays the same but they are replaced by a new build every day.&lt;/p&gt; &lt;h2&gt;Webhook subsystem refactor&lt;/h2&gt; &lt;p&gt;The webhook subsystem underwent a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2717&quot;&gt;substantial refactor&lt;/a&gt; to ease the additions of new webhook types. The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/2714&quot;&gt;SourceHut Builds&lt;/a&gt; is a driving example of how the refactored webhook architecture can be used to implement a new webhook type.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;Forgejo now got its own independent &lt;a href=&quot;https://forgejo.org/docs/v7.0/developer/localization&quot;&gt;localization foundation&lt;/a&gt;. New &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#localization&quot;&gt;teams&lt;/a&gt; were formed, a Weblate &lt;a href=&quot;https://translate.codeberg.org/projects/forgejo/forgejo/&quot;&gt;project&lt;/a&gt; was set up. The localization no longer relies on a proprietary service.&lt;/p&gt; &lt;p&gt;Work on refactoring base localization to improve User eXperience and translatability is in progress. Lots of strings were updated to improve readability and be easier to understand, many got basic plural support. File and repo sizes were &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2528&quot;&gt;made translatable&lt;/a&gt;, localization of activity heatmap &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2612&quot;&gt;was fixed&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;As soon as the initiative &lt;a href=&quot;https://forgejo.org/2024-01-monthly-update/#localization&quot;&gt;was announced&lt;/a&gt; in January, the call for participation got a great response and volunteers from around the world are working daily to improve translations. New languages were added. The ones which got active maintainers and have reached a usable level of completion &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2724&quot;&gt;were made available&lt;/a&gt; to the users: Bulgarian, Esperanto, Filipino, Slovenian.&lt;/p&gt; &lt;p&gt;Anyone is welcome to participate in improving translation &lt;a href=&quot;https://forgejo.org/docs/latest/developer/localization&quot;&gt;for their language&lt;/a&gt; as well as &lt;a href=&quot;https://forgejo.org/docs/v7.0/developer/localization-english/#contributing&quot;&gt;the English base&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Federation&lt;/h3&gt; &lt;p&gt;Does &lt;code&gt;Forgejo&lt;/code&gt; support federation? Not yet. Was there progress? Yes.&lt;/p&gt; &lt;p&gt;The monthly reports &lt;a href=&quot;/tag/report/&quot;&gt;have details&lt;/a&gt; on these progress.&lt;/p&gt; &lt;p&gt;Forges have existed for over twenty years and none of them has achieved data portability let alone federation. Forgejo is one year old and it will take it a some time to get there.&lt;/p&gt; &lt;h3&gt;Get Forgejo v7.0&lt;/h3&gt; &lt;p&gt;See the &lt;a href=&quot;/download/&quot;&gt;download page&lt;/a&gt; for instructions on how to install Forgejo, and read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-0&quot;&gt;release notes&lt;/a&gt; for more information.&lt;/p&gt; &lt;h3&gt;Upgrading&lt;/h3&gt; &lt;p&gt;Carefully read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-0&quot;&gt;breaking changes&lt;/a&gt; section of the release notes.&lt;/p&gt; &lt;p&gt;The actual upgrade process is as simple as replacing the binary or container image with the corresponding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v7.0.0&quot;&gt;Forgejo binary&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/7.0.0&quot;&gt;container image&lt;/a&gt;. If you&apos;re using the container images, you can use the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/7.0&quot;&gt;&lt;code&gt;7.0&lt;/code&gt; tag&lt;/a&gt; to stay up to date with the latest &lt;code&gt;7.0.Y&lt;/code&gt; patch release automatically.&lt;/p&gt; &lt;p&gt;Make sure to check the &lt;a href=&quot;/docs/v7.0/admin/upgrade&quot;&gt;Forgejo upgrade documentation&lt;/a&gt; for recommendations on how to properly backup your instance before the upgrade.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo do not hold back, it is also your project. Open an issue in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;the issue tracker&lt;/a&gt; for feature requests or bug reports, reach out &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop into &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;the Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) and say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo Security Release 1.21.11-0</title><link>https://forgejo.org/2024-04-release-v1-21-11-0/</link><guid isPermaLink="true">https://forgejo.org/2024-04-release-v1-21-11-0/</guid><description>The Forgejo v1.21.11-0 release contains two security fixes: a privilege escalation that allows any registered user to change the visibility of any public repository; and a cross-site scripting (XSS) vulnerability that enabled attackers to run unsandboxed client-side scripts on pages served from the forge&apos;s domain.</description><pubDate>Thu, 18 Apr 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.21.11-0&quot;&gt;Forgejo v1.21.11-0&lt;/a&gt; was released 18 April 2024.&lt;/p&gt; &lt;p&gt;This release contains &lt;em&gt;two security fixes&lt;/em&gt;, both of which can be exploited by registered Forgejo users. One flaw allows &lt;em&gt;anyone&lt;/em&gt; who can open a pull request against a repository to change its visibility. The other lets the attacker run unsandboxed client-side scripts on pages served from the forge&apos;s domain, a &lt;a href=&quot;https://en.wikipedia.org/wiki/Cross-site_scripting&quot;&gt;Cross-site scripting (XSS)&lt;/a&gt; vulnerability.&lt;/p&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We &lt;em&gt;strongly recommend&lt;/em&gt; that all Forgejo installations are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;h3&gt;Privilege escalation through &lt;code&gt;git push&lt;/code&gt; options&lt;/h3&gt; &lt;p&gt;By far the more serious issue is a privilege escalation through &lt;code&gt;git push&lt;/code&gt; options, which allowed any registered user to change the visibility of any repository they could see - public repositories included -, regardless of what level of access they had.&lt;/p&gt; &lt;p&gt;A more detailed deep-dive about this vulnerability will follow in a later blog post.&lt;/p&gt; &lt;h3&gt;Cross-site scripting (XSS) vulnerability&lt;/h3&gt; &lt;p&gt;The other vulnerability is a &lt;a href=&quot;https://en.wikipedia.org/wiki/Cross-site_scripting&quot;&gt;Cross-site scripting (XSS)&lt;/a&gt; vulnerability that could be exploited by a registered Forgejo user.&lt;/p&gt; &lt;p&gt;In certain situations, rendered repository contents weren&apos;t properly guarded, and allowed unsandboxed client-side scripts to run from the same domain as the forge itself.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - March 2024</title><link>https://forgejo.org/2024-03-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2024-03-monthly-update/</guid><description>Forgejo 7.0.0 release candidates are now available for testing at https://v7.next.forgejo.org or by downloading OCI images and binaries, updated daily. It will be the first LTS release, supported until July 2025. Four new translations that were added are Filipino, Esperanto, Slovenian and Bulgarian and the localization team keeps growing.</description><pubDate>Sun, 31 Mar 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;The monthly report is meant to provide a good overview of what has changed in Forgejo in the past month. If you would like to help, please get in touch in &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;the chatroom&lt;/a&gt; or participate in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions&quot;&gt;ongoing discussions&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Forgejo 7.0.0 release candidates are now available for testing at &lt;a href=&quot;https://v7.next.forgejo.org&quot;&gt;https://v7.next.forgejo.org&lt;/a&gt; or by downloading OCI images (&lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/7.0-test&quot;&gt;root&lt;/a&gt; / &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/7.0-test-rootless&quot;&gt;rootless&lt;/a&gt;) and &lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v7.0-test&quot;&gt;binaries&lt;/a&gt; that are updated updated daily.&lt;/p&gt; &lt;p&gt;The &lt;code&gt;7.0.0+LTS-gitea-1.22.0&lt;/code&gt; version is the first Long Term Support (LTS) release and will receive critical bug and security fixes until July 2025. It is an additional burden on Forgejo contributors and members of the release team. Individuals and organizations who need that kind of stability are kindly invited to contribute to this effort so it can be sustained in the long run.&lt;/p&gt; &lt;p&gt;New languages that got active translators and have reached a usable level of completion &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2724&quot;&gt;were added&lt;/a&gt; and are now visible to users: Bulgarian, Esperanto, Filipino and Slovenian.&lt;/p&gt; &lt;h2&gt;New release management&lt;/h2&gt; &lt;p&gt;Now that &lt;a href=&quot;https://forgejo.org/2024-02-forking-forward/&quot;&gt;Forgejo forked its own way forward&lt;/a&gt;, it became necessary to define when and how releases are published.&lt;/p&gt; &lt;h3&gt;Semantic versioning&lt;/h3&gt; &lt;p&gt;The first Forgejo version to be published with its own release management will be &lt;code&gt;7.0.0+LTS-gitea-1.22.0&lt;/code&gt; and the &lt;a href=&quot;https://forgejo.org/docs/v7.0/user/versions/&quot;&gt;documentation was updated&lt;/a&gt; to explain the new numbering scheme.&lt;/p&gt; &lt;h3&gt;Gitea API compatibility&lt;/h3&gt; &lt;p&gt;Tools that are developed for the Gitea API will keep working with the new Forgejo numbering scheme. They typically make assertions on the release number to unlock new functionalities and that logic will not be impacted by a bump in the release number. The proprietary version of Gitea has a different numbering scheme (v21.X.Y, v22.X.Y) and is in a similar situation.&lt;/p&gt; &lt;h3&gt;Forgejo 7.0 release candidates&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/v7.0/forgejo&quot;&gt;7.0/forgejo&lt;/a&gt; branch was cut 30 March 2024 and the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v8.0.0-dev&quot;&gt;v8.0.0-dev&lt;/a&gt; tag set to the development branch. While the release-critical bugs are being fixed so that the version can be published, &lt;a href=&quot;https://v7.next.forgejo.org&quot;&gt;https://v7.next.forgejo.org&lt;/a&gt; will keep being updated daily with a build of the latest commit, acting as a release candidate where anyone can safely try and break it. It can also be installed locally with:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;OCI images: &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/7.0-test&quot;&gt;root&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/7.0-test-rootless&quot;&gt;rootless&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v7.0-test&quot;&gt;Binaries&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Their name stays the same but they are replaced by a new build every day.&lt;/p&gt; &lt;h3&gt;Forgejo 7.0 LTS&lt;/h3&gt; &lt;p&gt;Now that Forgejo has given itself the mean to avoid most of the regressions that it suffered from in the past, it can provide support for releases during a longer period of time. The &lt;code&gt;7.0.0+LTS-gitea-1.22.0&lt;/code&gt; version is the first Long Term Support (LTS) release and will receive critical bug and security fixes until July 2025.&lt;/p&gt; &lt;h3&gt;Time based release schedule&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://forgejo.org/docs/v7.0/developer/release/#release-cycle&quot;&gt;time based release schedule&lt;/a&gt; was established to publish a release every three months. Patch releases will be published more frequently, depending on the severity of the bug or security fixes they contain. The exact number of the release cannot be known in advance because it will be determined by the features and breaking changes it contains, as specified by the &lt;a href=&quot;https://semver.org/spec/v2.0.0.html&quot;&gt;Semantic Versioning 2.0.0&lt;/a&gt; specifications.&lt;/p&gt; &lt;table&gt; &lt;thead&gt; &lt;tr&gt; &lt;th&gt;&lt;strong&gt;Date&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;Version&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;Release date&lt;/strong&gt;&lt;/th&gt; &lt;th&gt;&lt;strong&gt;End Of Life&lt;/strong&gt;&lt;/th&gt; &lt;/tr&gt; &lt;/thead&gt; &lt;tbody&gt;&lt;tr&gt; &lt;td&gt;2024 Q1&lt;/td&gt; &lt;td&gt;7.0.0+LTS-gitea-1.22.0&lt;/td&gt; &lt;td&gt;17 April 2024&lt;/td&gt; &lt;td&gt;&lt;strong&gt;16 July 2025&lt;/strong&gt;&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2024 Q2&lt;/td&gt; &lt;td&gt;X.Y.Z+gitea-A.B.C&lt;/td&gt; &lt;td&gt;17 July 2024&lt;/td&gt; &lt;td&gt;16 October 2024&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2024 Q3&lt;/td&gt; &lt;td&gt;X.Y.Z+gitea-A.B.C&lt;/td&gt; &lt;td&gt;16 October 2024&lt;/td&gt; &lt;td&gt;15 January 2025&lt;/td&gt; &lt;/tr&gt; &lt;tr&gt; &lt;td&gt;2024 Q4&lt;/td&gt; &lt;td&gt;X.Y.Z+gitea-A.B.C&lt;/td&gt; &lt;td&gt;15 January 2025&lt;/td&gt; &lt;td&gt;16 April 2025&lt;/td&gt; &lt;/tr&gt; &lt;/tbody&gt;&lt;/table&gt; &lt;h2&gt;Code&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo&quot;&gt;https://codeberg.org/forgejo/forgejo&lt;/a&gt;&lt;/p&gt; &lt;p&gt;Notable improvements and bug fixes:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2717&quot;&gt;Webhook refactor and addition of SourceHut builds&lt;/a&gt; is a series of 7 pull requests, 6 of which have been merged.&lt;/li&gt; &lt;li&gt;A number of localization improvements (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2828&quot;&gt;1&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2756&quot;&gt;2&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2644&quot;&gt;3&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2612&quot;&gt;4&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2610&quot;&gt;5&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2584&quot;&gt;6&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2492&quot;&gt;7&lt;/a&gt;, etc.)&lt;/li&gt; &lt;li&gt;Tests &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2657&quot;&gt;now fail instead of just displaying error logs&lt;/a&gt;. This should help catch missing translations and ensure that an error is logged only when an inconsistency is detected within Forgejo (which shouldn’t happen if the test is realistically setup).&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2520&quot;&gt;Recognize SSH signed tags in addition to OpenPGP&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2482&quot;&gt;Add S3 bucket lookup type&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/docs/pulls/465&quot;&gt;documentation&lt;/a&gt;.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?q=&amp;amp;type=all&amp;amp;sort=&amp;amp;state=closed&amp;amp;labels=&amp;amp;milestone=0&amp;amp;project=0&amp;amp;assignee=0&amp;amp;poster=0&quot;&gt;Read more&lt;/a&gt; in the pull requests.&lt;/p&gt; &lt;h2&gt;Backport automation&lt;/h2&gt; &lt;p&gt;When pull requests are merged, a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/.forgejo/workflows/backport.yml&quot;&gt;workflow will automatically open a backport&lt;/a&gt;. If the &lt;code&gt;backport/v1.21&lt;/code&gt; label is found, it will &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2827&quot;&gt;target the Forgejo v1.21 branch&lt;/a&gt;. If there are no conflicts and tests pass, it can be merged right away and save valuable time.&lt;/p&gt; &lt;p&gt;As Forgejo 7.0 enters the release candidate stage of its life cycle a significant number of backports are expected during the first few weeks and such an automation will have even more of an impact.&lt;/p&gt; &lt;h2&gt;Dependency Management&lt;/h2&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/.forgejo/workflows/renovate.yml&quot;&gt;dependency update detection&lt;/a&gt; cron job has been setup to automatically &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?state=closed&amp;amp;poster=165503&quot;&gt;open pull request proposing updates&lt;/a&gt; when new versions of Go or JavaScript packages, OCI images and more are available. It &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2800&quot;&gt;finds the release notes&lt;/a&gt;, adds them to the pull request description and Forgejo contributors can then conveniently decide whether an upgrade is necessary. This recurring observations of Forgejo dependencies is &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/renovate.json&quot;&gt;fine tuned by a configuration file&lt;/a&gt; that, among other things, ensures there are at most five pull requests proposed at all times.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?q=gitea%20week&amp;amp;state=closed&quot;&gt;weekly cherry-pick of commits from Gitea&lt;/a&gt; became a routine collectively managed by two Forgejo contributors. It is one of the improvements brought by the hard fork decision from last month. Rebasing was more involved and managed by a single person: an undesirable single point of failure. A &lt;a href=&quot;https://codeberg.org/forgejo/tools&quot;&gt;tool&lt;/a&gt; was created to automate the most tedious and error prone tasks.&lt;/p&gt; &lt;h2&gt;End to end tests&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;end-to-end tests&lt;/a&gt; were entirely refactored for unification and simplicity. They cover the following areas:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions&quot;&gt;actions&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/branch/main/packages&quot;&gt;packages&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/branch/main/upgrade&quot;&gt;upgrades&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/branch/main/storage&quot;&gt;storage&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;They can now all be run by adding the &lt;code&gt;run-end-to-end-test&lt;/code&gt; label to a pull request (see &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2465&quot;&gt;this example&lt;/a&gt;). Before the refactor, only Forgejo Actions tests were run.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;New languages that got active translators and have reached a usable level of completion &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2724&quot;&gt;were added&lt;/a&gt; and are now visible to users: Bulgarian, Esperanto, Filipino and Slovenian.&lt;/p&gt; &lt;p&gt;New contributors were onboarded (&lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/98&quot;&gt;1&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/108&quot;&gt;2&lt;/a&gt;) to the localization team.&lt;/p&gt; &lt;p&gt;The English source strings saw a lot of activity for unification and rewording. There were no notable conflicts with Gitea translations. There was one conflict caused by merged pull request in Forgejo that locked translations for about half of a day. Although Weblate owns all translated files and they are not to be modified in pull requests, there are exceptions. When mass modification can be automated, this can be done by a pull request and to save valuable translators&apos; time. But when it happens, care must be taken to avoid conflicts and &lt;a href=&quot;https://forgejo.org/docs/v1.21/developer/localization-admin/#merging-a-pull-request-that-changes-translations&quot;&gt;the required steps were documented&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The upside of this incident was to show that resolving such conflicts is as simple as reverting the faulty commit and opening a new pull request. It is not the most efficient way to go about it, but it is simple.&lt;/p&gt; &lt;h2&gt;Federation&lt;/h2&gt; &lt;p&gt;The pull request to implement &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;federated stars&lt;/a&gt; made progress. In the settings of a repository there is now a field allowing to define its federated repositories. Read &lt;a href=&quot;https://domaindrivenarchitecture.org/posts/2024-03-27-state-of-federation/&quot;&gt;more in the activity summary&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/59&quot;&gt;federation implementation task list&lt;/a&gt; was updated.&lt;/p&gt; &lt;h2&gt;Helm chart&lt;/h2&gt; &lt;p&gt;The Forgejo helm chart had &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-helm/releases&quot;&gt;one major updates&lt;/a&gt; because of a major bump of the postgresql dependencies.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-helm/releases&quot;&gt;https://codeberg.org/forgejo-contrib/forgejo-helm/releases&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Runner&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/RELEASE-NOTES.md#3-4-0&quot;&gt;Forgejo runner version 3.4.1&lt;/a&gt; was published and supports for the artifacts@v4 protocol when used with the development version of Forgejo 7.0, as &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions/example-artifacts-v4/.forgejo/workflows/test.yml&quot;&gt;demonstrated by the end-to-end tests&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;With the caveat that a forked version of the matching &lt;a href=&quot;https://code.forgejo.org/forgejo/download-artifact&quot;&gt;download&lt;/a&gt; and &lt;a href=&quot;https://code.forgejo.org/forgejo/upload-artifact&quot;&gt;upload&lt;/a&gt; actions must be used because they both assume a GitHub environment. Chasing such features is high maintenance and casts a doubt on its long term viability. The Forgejo runner makes no promise of compatibility with GitHub and an alternative action with the same interface but implemented differently may be, for example, a more sustainable choice.&lt;/p&gt; &lt;p&gt;References&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;https://code.forgejo.org/forgejo/runner&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/act&quot;&gt;https://code.forgejo.org/forgejo/act&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Governance&lt;/h2&gt; &lt;h3&gt;Sustainability&lt;/h3&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/144&quot;&gt;discussion started&lt;/a&gt; in an attempt to find an answer and make Forgejo durable for the next 10 years.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls/41&quot;&gt;grant proposal&lt;/a&gt; was drafted to support the development of Forgejo.&lt;/p&gt; &lt;p&gt;An additional &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls/42&quot;&gt;Request for Payment was sent&lt;/a&gt; to NLnet in the context of the &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls?labels=123038&quot;&gt;ongoing grant&lt;/a&gt; and the funds will go to Codeberg.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/0ko&quot;&gt;https://codeberg.org/0ko&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/6543&quot;&gt;https://codeberg.org/6543&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/abacabadabacaba&quot;&gt;https://codeberg.org/abacabadabacaba&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/airbreather&quot;&gt;https://codeberg.org/airbreather&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/algernon&quot;&gt;https://codeberg.org/algernon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Andre601&quot;&gt;https://codeberg.org/Andre601&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/antoyo&quot;&gt;https://codeberg.org/antoyo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/aral&quot;&gt;https://codeberg.org/aral&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/axd99&quot;&gt;https://codeberg.org/axd99&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/banaanihillo&quot;&gt;https://codeberg.org/banaanihillo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/captainepoch&quot;&gt;https://codeberg.org/captainepoch&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/con-f-use&quot;&gt;https://codeberg.org/con-f-use&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dasasd122311&quot;&gt;https://codeberg.org/dasasd122311&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dboerlage&quot;&gt;https://codeberg.org/dboerlage&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/defanor&quot;&gt;https://codeberg.org/defanor&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/denyskon&quot;&gt;https://codeberg.org/denyskon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Dirk&quot;&gt;https://codeberg.org/Dirk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/doomedguppy&quot;&gt;https://codeberg.org/doomedguppy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Drakon&quot;&gt;https://codeberg.org/Drakon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Edgarsons&quot;&gt;https://codeberg.org/Edgarsons&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ell1e&quot;&gt;https://codeberg.org/ell1e&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/eo&quot;&gt;https://codeberg.org/eo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Eveeifyeve&quot;&gt;https://codeberg.org/Eveeifyeve&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ezra&quot;&gt;https://codeberg.org/ezra&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/f00&quot;&gt;https://codeberg.org/f00&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fauxmight&quot;&gt;https://codeberg.org/fauxmight&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/flipreverse&quot;&gt;https://codeberg.org/flipreverse&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/foxy&quot;&gt;https://codeberg.org/foxy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GamePlayer-8&quot;&gt;https://codeberg.org/GamePlayer-8&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/HarryK&quot;&gt;https://codeberg.org/HarryK&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Haui&quot;&gt;https://codeberg.org/Haui&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hazy&quot;&gt;https://codeberg.org/hazy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hexa&quot;&gt;https://codeberg.org/hexa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/inference&quot;&gt;https://codeberg.org/inference&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/intelfx&quot;&gt;https://codeberg.org/intelfx&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jadeprime&quot;&gt;https://codeberg.org/jadeprime&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JakobDev&quot;&gt;https://codeberg.org/JakobDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/james2432&quot;&gt;https://codeberg.org/james2432&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jean-daricade&quot;&gt;https://codeberg.org/jean-daricade&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JeremyStarTM&quot;&gt;https://codeberg.org/JeremyStarTM&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jilen&quot;&gt;https://codeberg.org/jilen&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jmshrtn&quot;&gt;https://codeberg.org/jmshrtn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kallisti5&quot;&gt;https://codeberg.org/kallisti5&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kita&quot;&gt;https://codeberg.org/kita&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lampajr&quot;&gt;https://codeberg.org/lampajr&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Laxystem&quot;&gt;https://codeberg.org/Laxystem&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lyssieth&quot;&gt;https://codeberg.org/lyssieth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mai-Lapyst&quot;&gt;https://codeberg.org/Mai-Lapyst&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/maunzCache&quot;&gt;https://codeberg.org/maunzCache&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mishra&quot;&gt;https://codeberg.org/mishra&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mmarif&quot;&gt;https://codeberg.org/mmarif&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/MorsMortium&quot;&gt;https://codeberg.org/MorsMortium&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/msrd0&quot;&gt;https://codeberg.org/msrd0&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/neox&quot;&gt;https://codeberg.org/neox&lt;/a&gt;_&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nis&quot;&gt;https://codeberg.org/nis&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nmmr&quot;&gt;https://codeberg.org/nmmr&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/noth&quot;&gt;https://codeberg.org/noth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/OdinVex&quot;&gt;https://codeberg.org/OdinVex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/payas&quot;&gt;https://codeberg.org/payas&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Pi-Cla&quot;&gt;https://codeberg.org/Pi-Cla&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/popey&quot;&gt;https://codeberg.org/popey&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/pyfisch&quot;&gt;https://codeberg.org/pyfisch&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/RaptaG&quot;&gt;https://codeberg.org/RaptaG&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/realaravinth&quot;&gt;https://codeberg.org/realaravinth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rikh&quot;&gt;https://codeberg.org/rikh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sertonix&quot;&gt;https://codeberg.org/sertonix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SinTan1729&quot;&gt;https://codeberg.org/SinTan1729&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/skobkin&quot;&gt;https://codeberg.org/skobkin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SteffoSpieler&quot;&gt;https://codeberg.org/SteffoSpieler&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tampler&quot;&gt;https://codeberg.org/tampler&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Techwizz&quot;&gt;https://codeberg.org/Techwizz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tek256&quot;&gt;https://codeberg.org/tek256&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tengkuizdihar&quot;&gt;https://codeberg.org/tengkuizdihar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thefinn93&quot;&gt;https://codeberg.org/thefinn93&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thefox&quot;&gt;https://codeberg.org/thefox&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thepaperpilot&quot;&gt;https://codeberg.org/thepaperpilot&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/timmwille&quot;&gt;https://codeberg.org/timmwille&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tuxcoder&quot;&gt;https://codeberg.org/tuxcoder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/twenty-panda&quot;&gt;https://codeberg.org/twenty-panda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/uncomfyhalomacro&quot;&gt;https://codeberg.org/uncomfyhalomacro&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/VehementHam&quot;&gt;https://codeberg.org/VehementHam&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wangito33&quot;&gt;https://codeberg.org/wangito33&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wetneb&quot;&gt;https://codeberg.org/wetneb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wolfogre&quot;&gt;https://codeberg.org/wolfogre&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Wuzzy&quot;&gt;https://codeberg.org/Wuzzy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Xinayder&quot;&gt;https://codeberg.org/Xinayder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zareck&quot;&gt;https://codeberg.org/zareck&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zbolo-wd&quot;&gt;https://codeberg.org/zbolo-wd&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zotan&quot;&gt;https://codeberg.org/zotan&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/acioustick&quot;&gt;https://translate.codeberg.org/user/acioustick&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/be4zad&quot;&gt;https://translate.codeberg.org/user/be4zad&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/cherryb&quot;&gt;https://translate.codeberg.org/user/cherryb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/EOWNERDEAD&quot;&gt;https://translate.codeberg.org/user/EOWNERDEAD&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/EssGeeEich&quot;&gt;https://translate.codeberg.org/user/EssGeeEich&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Fjuro&quot;&gt;https://translate.codeberg.org/user/Fjuro&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/flactwin&quot;&gt;https://translate.codeberg.org/user/flactwin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/jadedctrl&quot;&gt;https://translate.codeberg.org/user/jadedctrl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ledyba&quot;&gt;https://translate.codeberg.org/user/ledyba&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/MatseVH&quot;&gt;https://translate.codeberg.org/user/MatseVH&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/maytha8&quot;&gt;https://translate.codeberg.org/user/maytha8&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/mondstern&quot;&gt;https://translate.codeberg.org/user/mondstern&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/mumulhl&quot;&gt;https://translate.codeberg.org/user/mumulhl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ormai&quot;&gt;https://translate.codeberg.org/user/ormai&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/salif&quot;&gt;https://translate.codeberg.org/user/salif&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/TheAwiteb&quot;&gt;https://translate.codeberg.org/user/TheAwiteb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/WithLithum&quot;&gt;https://translate.codeberg.org/user/WithLithum&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/yeziruo&quot;&gt;https://translate.codeberg.org/user/yeziruo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/zenobit&quot;&gt;https://translate.codeberg.org/user/zenobit&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Zughy&quot;&gt;https://translate.codeberg.org/user/Zughy&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Impact of CVE-2024-3094 on Forgejo</title><link>https://forgejo.org/2024-03-xz/</link><guid isPermaLink="true">https://forgejo.org/2024-03-xz/</guid><description>No direct impact of the xz backdoor (CVE-2024-3094) on Forgejo. The infrastructure that powers Forgejo is not impacted by this vulnerability. Forgejo itself is also not affected, however if you run an OpenSSH server for Git over SSH you could be affected by this CVE.</description><pubDate>Sun, 31 Mar 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;On 29 March 2024 &lt;a href=&quot;https://www.openwall.com/lists/oss-security/2024/03/29/4&quot;&gt;the details were shared&lt;/a&gt; of a backdoor in the &lt;code&gt;xz&lt;/code&gt; source code. This backdoor, according &lt;a href=&quot;https://www.openwall.com/lists/oss-security/2024/03/30/36&quot;&gt;to the latest reports&lt;/a&gt;, is capable of executing arbitrary code on affected machines which can lead to a full compromise of that machine.&lt;/p&gt; &lt;h2&gt;Impact on Forgejo&lt;/h2&gt; &lt;p&gt;Forgejo itself is not impacted by this backdoor, because it doesn&apos;t load the &lt;code&gt;liblzma&lt;/code&gt; library that contained the backdoor, Forgejo does import the &lt;a href=&quot;https://github.com/ulikunitz/xz&quot;&gt;xz&lt;/a&gt; library but this has no relation to the &lt;code&gt;liblzma&lt;/code&gt; library. Forgejo allows to use Git over SSH feature in two different ways.&lt;/p&gt; &lt;h3&gt;Builtin SSH server&lt;/h3&gt; &lt;p&gt;The builtin SSH server is integrated into every Forgejo binary, it uses an &lt;a href=&quot;https://github.com/gliderlabs/ssh&quot;&gt;SSH server library&lt;/a&gt; to provide an SSH server. It is written in Go and doesn&apos;t load the &lt;code&gt;liblzma&lt;/code&gt; library, therefore it is not affected.&lt;/p&gt; &lt;p&gt;Please read on if you&apos;re using Forgejo in a containerized environment such as Docker.&lt;/p&gt; &lt;h3&gt;OpenSSH server&lt;/h3&gt; &lt;p&gt;If you run an OpenSSH server that you installed independently of Forgejo, you could be affected by the backdoor. It depends on your distribution and configuration: the vulnerable &lt;code&gt;xz&lt;/code&gt; versions (&lt;code&gt;5.6.0&lt;/code&gt;, &lt;code&gt;5.6.1&lt;/code&gt;) could be in the package store and may have been installed. If you discover that your machine had it installed at any time, you should refer to your distribution&apos;s support or security advisories for more accurate information and to better understand the impact of this CVE on your installation.&lt;/p&gt; &lt;p&gt;If you deployed Forgejo using our official container images that also bundle an OpenSSH server, rest assured that these images &lt;strong&gt;never contained a vulnerable version&lt;/strong&gt;. There is no need for action, because the images were based on Alpine Linux 3.19, which is not affected as per &lt;a href=&quot;https://security.alpinelinux.org/vuln/CVE-2024-3094&quot;&gt;https://security.alpinelinux.org/vuln/CVE-2024-3094&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Impact on infrastructure&lt;/h2&gt; &lt;p&gt;The infrastructure that powers Forgejo consists of:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Forgejo&apos;s own hardware used to create and sign the releases.&lt;/li&gt; &lt;li&gt;Codeberg that hosts Forgejo&apos;s source code and the releases.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;These machines all run Debian GNU/Linux Bookworm, a stable version of Debian. &lt;a href=&quot;https://lists.debian.org/debian-security-announce/2024/msg00057.html&quot;&gt;The security advisory&lt;/a&gt; of Debian for this CVE clarified that no Debian stable versions were impacted by this backdoor. Additionally, the &lt;a href=&quot;https://www.openwall.com/lists/oss-security/2024/03/29/4/3&quot;&gt;public detection script&lt;/a&gt; was run on the Forgejo machines and confirmed that the vulnerable &lt;code&gt;liblzma&lt;/code&gt; library is not present on the machine.&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - February 2024</title><link>https://forgejo.org/2024-02-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2024-02-monthly-update/</guid><description>Forgejo started as a soft fork of Gitea, in reaction to governance changes within the project. Over time, it developed its own identity, adopted both development and governance practices - to ensure the stability, quality, and openness of the project - that made it more challenging to remain a soft fork. The decision was made to become a hard fork, and for Forgejo to forge its own path going forward.</description><pubDate>Thu, 29 Feb 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;The monthly report is meant to provide a high level view of what happened in Forgejo in the past month. If you would like to help, please get in touch in &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;the chatroom&lt;/a&gt; or participate in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions&quot;&gt;ongoing discussions&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Since its &lt;a href=&quot;../2022-12-15-hello-forgejo/&quot;&gt;inception&lt;/a&gt;, Forgejo has been a soft fork of Gitea. Over time, it developed its own identity, adopted both development and governance practices - to ensure the stability, quality, and openness of the project - that made it more challenging to remain a soft fork. The decision was made to become a hard fork, and for Forgejo to forge its own path going forward. Read more in the &lt;a href=&quot;../2024-02-forking-forward/&quot;&gt;blog post announcing the decision&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Forgejo reached &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/stars&quot;&gt;1,000 stars on Codeberg&lt;/a&gt; and it is heartwarming to see so much support. Each of these stars are more valuable than those loaned by proprietary forges: they really belong to Forgejo and come from developers who made an effort to register on Codeberg.&lt;/p&gt; &lt;h2&gt;Implementation of the hard fork&lt;/h2&gt; &lt;p&gt;The hard part was to make a decision, the implementation itself (as &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/58&quot;&gt;laid out in the decision&lt;/a&gt;) is comparatively simpler and is now in place.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Publish a blog post &lt;a href=&quot;../2024-02-forking-forward/&quot;&gt;explaining the decision&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;Switch from rebasing weekly (see &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/2293&quot;&gt;this rebase example&lt;/a&gt;) to cherry-picking weekly (see &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2478&quot;&gt;this cherry-pick example&lt;/a&gt;).&lt;/li&gt; &lt;li&gt;Update the &lt;a href=&quot;https://forgejo.org/docs/v1.21/developer/workflow/&quot;&gt;developer documentation&lt;/a&gt; to update the parts that are no longer needed.&lt;/li&gt; &lt;li&gt;Merge all feature branches and &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/123&quot;&gt;delete the branches&lt;/a&gt; that are no longer necessary.&lt;/li&gt; &lt;li&gt;Develop tools and procedures are in the design phase and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2478&quot;&gt;discussions mostly happen&lt;/a&gt; whenever cherry-picking from Gitea.&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Code&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo&quot;&gt;https://codeberg.org/forgejo/forgejo&lt;/a&gt;&lt;/p&gt; &lt;p&gt;Notable improvements and bug fixes:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1746&quot;&gt;Add colorblind theme variants&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1594&quot;&gt;Use &lt;code&gt;git grep&lt;/code&gt;&lt;/a&gt; to search repositories &lt;a href=&quot;https://forgejo.org/docs/v7.0/user/code-search/&quot;&gt;when the repository indexer is not configured&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;Improvement to the &lt;a href=&quot;https://forgejo.org/docs/v7.0/user/agit-support/&quot;&gt;Agit workflow&lt;/a&gt; (PRs &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2444&quot;&gt;1&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2386&quot;&gt;2&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2344&quot;&gt;3&lt;/a&gt;).&lt;/li&gt; &lt;li&gt;Fix error when marking outdated code reviews as resolved (PR &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2282&quot;&gt;1&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2306&quot;&gt;2&lt;/a&gt;).&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2445&quot;&gt;Allow instance-wide disabling of forking&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2466&quot;&gt;Improve display of 404/500 error pages&lt;/a&gt;.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?q=&amp;amp;type=all&amp;amp;sort=&amp;amp;state=closed&amp;amp;labels=&amp;amp;milestone=0&amp;amp;project=0&amp;amp;assignee=0&amp;amp;poster=0&quot;&gt;Read more&lt;/a&gt; in the pull requests.&lt;/p&gt; &lt;h3&gt;In flight pull requests&lt;/h3&gt; &lt;p&gt;Most &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?state=closed&quot;&gt;pull requests&lt;/a&gt; are opened and closed within a week. But some of them take a longer time, either because they are more complex or because they are taken care of by volunteers who can only occasionally work on them in their free time. This is a list of those that were updated since the last monthly report. If they are of interest to you, reviewing the changes or providing solutions would be appreciated.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2223&quot;&gt;Add initial layout support for right-to-left languages&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;Federated repository stars&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1445&quot;&gt;Implement external release assets&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1518&quot;&gt;Add optional pronoun field in user settings&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2465&quot;&gt;Implement remote user login source and promotion to regular user&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;Documentation&lt;/h3&gt; &lt;ul&gt; &lt;li&gt;Updates cherry-picked from the &lt;a href=&quot;https://docs.codeberg.org/&quot;&gt;Codeberg&lt;/a&gt; and &lt;a href=&quot;https://docs.gitea.com/&quot;&gt;Gitea&lt;/a&gt; documentation.&lt;/li&gt; &lt;li&gt;Newer &lt;a href=&quot;https://forgejo.org/docs/v7.0/user/agit-support/&quot;&gt;user guide on the AGit workflow&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;New section in the developer guide for &lt;a href=&quot;https://forgejo.org/docs/v7.0/developer/testing/&quot;&gt;testing strategies and requirements&lt;/a&gt;.&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;FOSDEM 2024&lt;/h2&gt; &lt;p&gt;Codeberg&apos;s stand at FOSDEM was a success and it appears to have &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/115&quot;&gt;also been a success for Forgejo&lt;/a&gt;. There was a notable amount of people who were still looking for a self-hosted option and were curious to learn about Forgejo instead of GitLab or Gitea. The transparent stickers did not work out very well, because the colours do not cover enough, so the result was unreadable on dark background. Still, many people were interested in Forgejo stickers: several hundred of them were distributed. The NLnet stand had a &lt;a href=&quot;https://nlnet.nl/project/Forgejo/&quot;&gt;different Forgejo sticker&lt;/a&gt; (hex variant) and probably used up their whole budget with distributing them. &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/115&quot;&gt;Read more in the FOSDEM 2024 discussion&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Discussions&lt;/h2&gt; &lt;p&gt;A significant number of discussions revolved around the hard fork decision and most of them are linked from the &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/58&quot;&gt;governance tracker&lt;/a&gt;. A few long term discussions are also worth mentioning and participation would be welcome.&lt;/p&gt; &lt;h3&gt;Monitoring forge features and its impact on forge federation&lt;/h3&gt; &lt;p&gt;GitLab and GitHub releases are being analysed to &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/120&quot;&gt;figure out which features are added to each release&lt;/a&gt;. These projects are driven by gigantic corporations and the rhythm at which features are added is intimidating. The idea is not for Forjego to compete on the same ground: this is a race that is already lost. However gaining and maintaining a good understanding of their features is key to the success of the implementation of federation in Forgejo.&lt;/p&gt; &lt;h3&gt;Gathering user feedback on accessibility&lt;/h3&gt; &lt;p&gt;User feedback is the most valuable resource for projects. Lowering the barrier for its collection helps to get much more insights, because there are a lot of problems where users don&apos;t bother opening an issue. &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/124&quot;&gt;Read more&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;(Scope of) Moderation of Forgejo instances&lt;/h3&gt; &lt;p&gt;A discussion &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/107&quot;&gt;started a month ago about how to develop effective moderation mechanisms&lt;/a&gt; within Forgejo while maintaining means of dynamically reacting to changing problems. It aims at collecting feedback. How much is in the scope for Forgejo? What kinds of moderation actions do Forgejo admins need to perform? This kind of user research is instrumental to understand existing best practices in order to figure out what problems needs to be resolved first.&lt;/p&gt; &lt;h2&gt;Federation&lt;/h2&gt; &lt;p&gt;The pull request to implement &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;federated stars&lt;/a&gt; made progress. Discussions happened on how a federated Person should be mapped to a local FederatedUser representation. Read &lt;a href=&quot;https://codeberg.org/meissa/forgejo/src/branch/forgejo-federated-star/docs/unsure-where-to-put/blog.md&quot;&gt;more in the activity summary&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The F3 Forgejo driver &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2388&quot;&gt;refactor is complete&lt;/a&gt;: it is back where it was about six month ago. The representation of a remote user &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2465&quot;&gt;was split out of the driver&lt;/a&gt; as it is generally useful for both data portability and federation.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/59&quot;&gt;federation implementation task list&lt;/a&gt; was updated.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;The Forgejo translations &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/104&quot;&gt;have been liberated&lt;/a&gt; and now &lt;a href=&quot;https://translate.codeberg.org/&quot;&gt;rely on a Free Software service&lt;/a&gt;. A localization team was bootstraped and their work can already be seen in the &lt;a href=&quot;https://next.forgejo.org&quot;&gt;experimental Forgejo instance&lt;/a&gt;. Translations for a few new languages began and will show when they are added to the Forgejo codebase. If you are fluent in another language and would like to help, please &lt;a href=&quot;https://forgejo.org/docs/v1.21/developer/localization/#joining-the-localization-team&quot;&gt;apply&lt;/a&gt; or join the &lt;a href=&quot;https://matrix.to/#/#forgejo-localization:matrix.org&quot;&gt;localization chatroom&lt;/a&gt; to figure out what it entails.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://forgejo.org/docs/next/developer/localization/&quot;&gt;https://forgejo.org/docs/next/developer/localization/&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Helm chart&lt;/h2&gt; &lt;p&gt;The Forgejo helm chart had &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-helm/releases&quot;&gt;three major updates&lt;/a&gt;. Two because of major bumps of the postgresql dependencies and one because of merging upstream changes from Gitea chart.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-helm/releases&quot;&gt;https://codeberg.org/forgejo-contrib/forgejo-helm/releases&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Alpine Package Registry&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://forgejo.org/docs/v1.21/user/packages/alpine/&quot;&gt;Alpine Package Registry&lt;/a&gt; now properly supports &lt;code&gt;noarch&lt;/code&gt; package files, maintaining compatibility with the official Alpine Linux package repositories.&lt;/p&gt; &lt;p&gt;The logic for uploading a package to the Alpine Registry stored architecture independent packages (&lt;code&gt;noarch&lt;/code&gt;) in their own architecture repository, instead of being available to all architectures available in the repository. Because of this, the Alpine Package Keeper wasn&apos;t able to locate the packages in the repository.&lt;/p&gt; &lt;p&gt;The architecture independent packages are now copied to all available architectures in the repository, and a fallback to &lt;code&gt;x86_64&lt;/code&gt; is used if the repository is brand new and doesn&apos;t contain any packages.&lt;/p&gt; &lt;h2&gt;Releases&lt;/h2&gt; &lt;p&gt;There has been &lt;a href=&quot;https://forgejo.org/releases/&quot;&gt;one security release&lt;/a&gt; in February 2024. Forgejo admins are encouraged to &lt;a href=&quot;https://codeberg.org/forgejo/security-announcements&quot;&gt;subscribe to security announcement&lt;/a&gt; so they can better plan their upgrades.&lt;/p&gt; &lt;p&gt;Test release were once published manually on a weekly basis and used to upgrade &lt;a href=&quot;https://next.forgejo.org&quot;&gt;https://next.forgejo.org&lt;/a&gt; upgraded. This &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/116&quot;&gt;process was automated&lt;/a&gt; and &lt;a href=&quot;https://forgejo.org/docs/v7.0/developer/release/#experimental-releases&quot;&gt;documented&lt;/a&gt; to happen daily. It runs the &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;end to end&lt;/a&gt; test suite before being upgraded which helps detect regressions early.&lt;/p&gt; &lt;p&gt;References&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/forgejo&quot;&gt;https://code.forgejo.org/forgejo/forgejo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;https://code.forgejo.org/forgejo/end-to-end&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://forgejo.org/releases/&quot;&gt;https://forgejo.org/releases/&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/security-announcements&quot;&gt;https://codeberg.org/forgejo/security-announcements&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Governance&lt;/h2&gt; &lt;h3&gt;Sustainability&lt;/h3&gt; &lt;p&gt;&lt;a href=&quot;https://prototypefund.de&quot;&gt;https://prototypefund.de&lt;/a&gt; is open to proposal in 2024 and there &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/38&quot;&gt;were discussions&lt;/a&gt; about applications around Forgejo and federation.&lt;/p&gt; &lt;h3&gt;Moderation&lt;/h3&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/MODERATION-PROCESS.md&quot;&gt;moderation action&lt;/a&gt; was carried out to put an end to an &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/91&quot;&gt;ad-hominem attack&lt;/a&gt;. A few days later it turned out the person responsible was someone banned from Forgejo space in 2023. The ban was enforced and extended to help prevent future misbehavior.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/governance&quot;&gt;https://codeberg.org/forgejo/governance&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/0ko&quot;&gt;https://codeberg.org/0ko&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/6543&quot;&gt;https://codeberg.org/6543&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/AdamGreenberg&quot;&gt;https://codeberg.org/AdamGreenberg&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/adrinux&quot;&gt;https://codeberg.org/adrinux&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/algernon&quot;&gt;https://codeberg.org/algernon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/andar1an&quot;&gt;https://codeberg.org/andar1an&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Andre601&quot;&gt;https://codeberg.org/Andre601&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/argrat&quot;&gt;https://codeberg.org/argrat&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/axd99&quot;&gt;https://codeberg.org/axd99&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bramh&quot;&gt;https://codeberg.org/bramh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/CactiChameleon9&quot;&gt;https://codeberg.org/CactiChameleon9&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/CodeDoctor&quot;&gt;https://codeberg.org/CodeDoctor&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Cyborus&quot;&gt;https://codeberg.org/Cyborus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/denyskon&quot;&gt;https://codeberg.org/denyskon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/domske&quot;&gt;https://codeberg.org/domske&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/douglasparker&quot;&gt;https://codeberg.org/douglasparker&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DraconicNEO&quot;&gt;https://codeberg.org/DraconicNEO&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/eNBeWe&quot;&gt;https://codeberg.org/eNBeWe&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fkooman&quot;&gt;https://codeberg.org/fkooman&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/flvffywvffy&quot;&gt;https://codeberg.org/flvffywvffy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fractalf&quot;&gt;https://codeberg.org/fractalf&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/goddess&quot;&gt;https://codeberg.org/goddess&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GottemHams&quot;&gt;https://codeberg.org/GottemHams&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/gwymor&quot;&gt;https://codeberg.org/gwymor&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/halibut&quot;&gt;https://codeberg.org/halibut&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hazy&quot;&gt;https://codeberg.org/hazy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hexaheximal&quot;&gt;https://codeberg.org/hexaheximal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/i9e1&quot;&gt;https://codeberg.org/i9e1&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/inference&quot;&gt;https://codeberg.org/inference&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ivanhercaz&quot;&gt;https://codeberg.org/ivanhercaz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JakobDev&quot;&gt;https://codeberg.org/JakobDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jilen&quot;&gt;https://codeberg.org/jilen&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jthvai&quot;&gt;https://codeberg.org/jthvai&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Kladky&quot;&gt;https://codeberg.org/Kladky&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KN4CK3R&quot;&gt;https://codeberg.org/KN4CK3R&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KOLANICH&quot;&gt;https://codeberg.org/KOLANICH&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/krumelmonster&quot;&gt;https://codeberg.org/krumelmonster&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lanodan&quot;&gt;https://codeberg.org/lanodan&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ledyba&quot;&gt;https://codeberg.org/ledyba&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lhinderberger&quot;&gt;https://codeberg.org/lhinderberger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lime360&quot;&gt;https://codeberg.org/lime360&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/maltejur&quot;&gt;https://codeberg.org/maltejur&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mathilde&quot;&gt;https://codeberg.org/mathilde&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mbateman&quot;&gt;https://codeberg.org/mbateman&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mjtimblin&quot;&gt;https://codeberg.org/mjtimblin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mokazemi&quot;&gt;https://codeberg.org/mokazemi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/moralpanic&quot;&gt;https://codeberg.org/moralpanic&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/msrd0&quot;&gt;https://codeberg.org/msrd0&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/neuhalje&quot;&gt;https://codeberg.org/neuhalje&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nykula&quot;&gt;https://codeberg.org/nykula&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oatbiscuits&quot;&gt;https://codeberg.org/oatbiscuits&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/PatchMixolydic&quot;&gt;https://codeberg.org/PatchMixolydic&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/PierreLannoy&quot;&gt;https://codeberg.org/PierreLannoy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/puzzle-it-nu&quot;&gt;https://codeberg.org/puzzle-it-nu&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/qwerty287&quot;&gt;https://codeberg.org/qwerty287&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/realaravinth&quot;&gt;https://codeberg.org/realaravinth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rpoovey&quot;&gt;https://codeberg.org/rpoovey&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/salif&quot;&gt;https://codeberg.org/salif&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Salt&quot;&gt;https://codeberg.org/Salt&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/santalet&quot;&gt;https://codeberg.org/santalet&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/seodisparate&quot;&gt;https://codeberg.org/seodisparate&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/silverwind&quot;&gt;https://codeberg.org/silverwind&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sininenkissa&quot;&gt;https://codeberg.org/sininenkissa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/skobkin&quot;&gt;https://codeberg.org/skobkin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/slatian&quot;&gt;https://codeberg.org/slatian&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thatonecoder&quot;&gt;https://codeberg.org/thatonecoder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thefinn93&quot;&gt;https://codeberg.org/thefinn93&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tuxcoder&quot;&gt;https://codeberg.org/tuxcoder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/VadZ&quot;&gt;https://codeberg.org/VadZ&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/voltagex&quot;&gt;https://codeberg.org/voltagex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wangito33&quot;&gt;https://codeberg.org/wangito33&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Werenter&quot;&gt;https://codeberg.org/Werenter&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wondercollective&quot;&gt;https://codeberg.org/wondercollective&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Wuzzy&quot;&gt;https://codeberg.org/Wuzzy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Xinayder&quot;&gt;https://codeberg.org/Xinayder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zareck&quot;&gt;https://codeberg.org/zareck&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Zip&quot;&gt;https://codeberg.org/Zip&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Application-Maker&quot;&gt;https://translate.codeberg.org/user/Application-Maker&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/b1nar10&quot;&gt;https://translate.codeberg.org/user/b1nar10&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/bart&quot;&gt;https://translate.codeberg.org/user/bart&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/bizdelnick&quot;&gt;https://translate.codeberg.org/user/bizdelnick&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Dirk&quot;&gt;https://translate.codeberg.org/user/Dirk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/dobrvlskyi&quot;&gt;https://translate.codeberg.org/user/dobrvlskyi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/esensar&quot;&gt;https://translate.codeberg.org/user/esensar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/ika&quot;&gt;https://translate.codeberg.org/user/ika&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/jadedctrl&quot;&gt;https://translate.codeberg.org/user/jadedctrl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/kikocorreoso&quot;&gt;https://translate.codeberg.org/user/kikocorreoso&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/meskobalazs&quot;&gt;https://translate.codeberg.org/user/meskobalazs&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/micash&quot;&gt;https://translate.codeberg.org/user/micash&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/mondstern&quot;&gt;https://translate.codeberg.org/user/mondstern&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Mormegil&quot;&gt;https://translate.codeberg.org/user/Mormegil&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/nebras&quot;&gt;https://translate.codeberg.org/user/nebras&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/nightm4re&quot;&gt;https://translate.codeberg.org/user/nightm4re&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/noureddin&quot;&gt;https://translate.codeberg.org/user/noureddin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/rmorettibr&quot;&gt;https://translate.codeberg.org/user/rmorettibr&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/rohandebsarkar&quot;&gt;https://translate.codeberg.org/user/rohandebsarkar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/sinsky&quot;&gt;https://translate.codeberg.org/user/sinsky&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/Squel&quot;&gt;https://translate.codeberg.org/user/Squel&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/tranzystorekk&quot;&gt;https://translate.codeberg.org/user/tranzystorekk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/xtex&quot;&gt;https://translate.codeberg.org/user/xtex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/yeziruo&quot;&gt;https://translate.codeberg.org/user/yeziruo&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo Security Release 1.21.6-0</title><link>https://forgejo.org/2024-02-release-v1-21-6-0/</link><guid isPermaLink="true">https://forgejo.org/2024-02-release-v1-21-6-0/</guid><description>The Forgejo v1.21.6-0 release contains a security fix for Cross-site scripting (XSS) vulnerabilities. It enabled attackers to inject client-side scripts into web pages displayed to Forgejo visitors.</description><pubDate>Thu, 22 Feb 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.21.6-0&quot;&gt;Forgejo v1.21.6-0&lt;/a&gt; was released 22 February 2024.&lt;/p&gt; &lt;p&gt;This release contains &lt;em&gt;a security fix&lt;/em&gt; related to &lt;a href=&quot;https://en.wikipedia.org/wiki/Cross-site_scripting&quot;&gt;Cross-site scripting (XSS)&lt;/a&gt; vulnerabilities that can be exploited by registered Forgejo users.&lt;/p&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We &lt;em&gt;strongly recommend&lt;/em&gt; that all Forgejo installations are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;h3&gt;Cross-site scripting (XSS) vulnerability&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://en.wikipedia.org/wiki/Cross-site_scripting&quot;&gt;Cross-site scripting (XSS)&lt;/a&gt; vulnerabilities can be exploited by a registered Forgejo user.&lt;/p&gt; &lt;p&gt;In some situations where a repository or user name contains HTML scripts, those values are not always properly escaped, thus leading to an XSS attack. For instance when:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://docs.codeberg.org/advanced/migrating-repos/&quot;&gt;Migrating a repository&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://forgejo.org/docs/v1.21/user/wiki/&quot;&gt;Publishing content in the wiki&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://forgejo.org/docs/v1.21/user/push-to-create/&quot;&gt;Creating a repository on first push&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;It allows the attacker to inject a &lt;a href=&quot;https://en.wikipedia.org/wiki/Client-side_script&quot;&gt;client-side script&lt;/a&gt; targetting visitors browsing a repository being migrated, the repository settings or the wiki. Note that the repository settings are only visible to repository admins.&lt;/p&gt; &lt;h3&gt;Responsible disclosure to Gitea&lt;/h3&gt; &lt;p&gt;On 22 January 2024, the Forgejo security team identified multiple Cross-site scripting (XSS) vulnerabilities could be exploited by registered Forgejo users, and the Gitea security team was notified. A 30-day embargo was requested, after which a patch to the v1.21 point release could be published.&lt;/p&gt; &lt;p&gt;On 14 February 2024, Gitea &lt;a href=&quot;https://github.com/go-gitea/gitea/pull/29165&quot;&gt;published a pull request&lt;/a&gt; that fixes the vulnerability, before the end of the requested embargo. It is embedded in a large refactor and not labeled to be security related but to a trained eye, this does catch attention.&lt;/p&gt; &lt;p&gt;On 17 February 2024, the Gitea security team privately sent a patch that fixes an additional XSS vulnerability.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo forks its own path forward</title><link>https://forgejo.org/2024-02-forking-forward/</link><guid isPermaLink="true">https://forgejo.org/2024-02-forking-forward/</guid><description>Forgejo started as a soft fork of Gitea, in reaction to governance changes within the project. Over time, it developed its own identity, adopted both development and governance practices - to ensure the stability, quality, and openness of the project - that made it more challenging to remain a soft fork. In early 2024, a decision was made to become a hard fork, and for Forgejo to forge its own path going forward. This post explains the consequences this decision will have.</description><pubDate>Thu, 15 Feb 2024 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Since its &lt;a href=&quot;../2022-12-15-hello-forgejo/&quot;&gt;inception&lt;/a&gt;, Forgejo (a self-hosted git forge, like GitHub) has been a soft fork of Gitea. Upgrading to it was - and for the time being, remains to be - as simple as &lt;a href=&quot;../download/&quot;&gt;changing the URL from which the release is downloaded&lt;/a&gt;. Over time, the way Forgejo is governed and developed evolved. To be able to provide stable, secure, reliable releases, Forgejo requires a &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md&quot;&gt;reasonable effort made at writing tests&lt;/a&gt; for each change that goes into the code. This has worked out remarkably well, as it caught both regressions in imported code, and mistakes in proposed changes. Furthermore, Forgejo has accepted features and other changes that are not available in Gitea, and has &lt;a href=&quot;#the-hard-forking-process&quot;&gt;diverged&lt;/a&gt; in other ways already.&lt;/p&gt; &lt;p&gt;Today, Forgejo has a healthy number of people contributing to its main mission:&lt;/p&gt; &lt;blockquote&gt; &lt;ol&gt; &lt;li&gt;The community is in control, and ensures we develop to address community needs.&lt;/li&gt; &lt;li&gt;We will help liberate software development from the shackles of proprietary tools.&lt;/li&gt; &lt;/ol&gt; &lt;/blockquote&gt; &lt;p&gt;To continue living by that statement, a &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/58&quot;&gt;decision was made&lt;/a&gt; in early 2024 to become a hard fork. By doing so, Forgejo is no longer bound to Gitea, and can forge its own path going forward, allowing maintainers and contributors to reduce tech debt at a much higher pace, and implement changes - whether they&apos;re new features or bug fixes - that would otherwise have a high risk of conflicting with changes made in Gitea. Simply put, the governance and development models of Gitea and Forgejo diverged over time, and so did their goals. Becoming a hard fork is the culmination of that divergence.&lt;/p&gt; &lt;h2&gt;The hard forking process&lt;/h2&gt; &lt;p&gt;Forgejo has been, since its inception late 2022, a soft fork of Gitea which means it contains all of Gitea, both good and bad, with Forgejo having little control over what it is built on. However, some parts of Gitea were already &quot;hard-forked&quot; before:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Forgejo used &lt;a href=&quot;https://woodpecker-ci.org/&quot;&gt;Woodpecker&lt;/a&gt; first, then &lt;a href=&quot;../docs/v1.21/user/actions/&quot;&gt;Forgejo Actions&lt;/a&gt; as its continuous integration system.&lt;ul&gt; &lt;li&gt;In addition, the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;forgejo-runner&lt;/a&gt; is also a hard fork.&lt;/li&gt; &lt;/ul&gt; &lt;/li&gt; &lt;li&gt;Documentation has been &lt;a href=&quot;https://codeberg.org/forgejo/docs&quot;&gt;maintained independently&lt;/a&gt; for a good while now.&lt;/li&gt; &lt;li&gt;Stable releases are a &lt;a href=&quot;../docs/latest/developer/workflow/#stable-branches&quot;&gt;hard fork&lt;/a&gt; since &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-1-0&quot;&gt;v1.20&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;More recently, &lt;a href=&quot;../docs/v1.21/developer/localization/&quot;&gt;localization&lt;/a&gt; has been moved from Crowdin to Weblate.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Most of these steps were taken to liberate parts of the code base from proprietary solutions, to manage them with free software instead, and in the same process, make it simpler to manage Forgejo-specific changes. All while keeping the impact on the software itself minimal.&lt;/p&gt; &lt;h2&gt;Consequences of becoming a hard fork&lt;/h2&gt; &lt;p&gt;As of Forgejo v1.21, Forgejo contains all of Gitea, and that has the benefit of allowing Forgejo to be a drop-in replacement. With the decision to become a hard fork, this will no longer be guaranteed. It will remain possible to upgrade from the latest &lt;a href=&quot;https://github.com/go-gitea/gitea/releases/tag/v1.21.5&quot;&gt;Gitea version released&lt;/a&gt; at the time of the hard fork, but versions past that will not have such a guarantee.&lt;/p&gt; &lt;p&gt;As such, if you were considering upgrading to Forgejo, we encourage you to do that sooner rather than later, because as the projects naturally diverge further, doing so will become ever harder. It will not happen overnight, it may not even happen soon, but eventually, Forgejo will stop being a drop-in replacement.&lt;/p&gt; &lt;p&gt;The Forgejo API will strive to remain compatible with the Gitea API going forward, after the hard fork. Existing APIs at the time of the fork are public, and changing them is a breaking change, which has to be evaluated very carefully, and not done lightly. Future APIs should similarly be evaluated, and Forgejo will try to remain compatible with Gitea. However, Forgejo contributors shall also use their own judgement whether to implement an API or not, and how - with the previous goals in mind.&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - January 2024</title><link>https://forgejo.org/2024-01-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2024-01-monthly-update/</guid><description>Forgejo may become a hard fork of Gitea; user research is on the way to figure out the scope of moderation in Forgejo instances; a new requirement for tests was added to the development workflow; the &quot;You pushed on branch&quot; user experience was improved; the migration of translations to Weblate began.</description><pubDate>Sun, 28 Jan 2024 00:00:00 GMT</pubDate><content:encoded>&lt;ul&gt; &lt;li&gt;An &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/58&quot;&gt;agreement is discussed&lt;/a&gt; to make Forgejo a hard fork of Gitea.&lt;/li&gt; &lt;li&gt;User research is on the way regarding the &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/107&quot;&gt;(Scope of) moderation of Forgejo instances&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;A new &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/51&quot;&gt;requirement to the development workflow&lt;/a&gt; was added to contain the technical debt.&lt;/li&gt; &lt;li&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/104&quot;&gt;migration of Forgejo translations&lt;/a&gt; to &lt;a href=&quot;https://translate.codeberg.org&quot;&gt;the Codeberg instance of Weblate&lt;/a&gt; is on the way.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The monthly report is meant to provide a high level view of what happened in Forgejo in the past month. If you would like to help, please get in touch in &lt;a href=&quot;https://matrix.to/#/!JpOtsqTARyyfkoizCU:matrix.org&quot;&gt;the chatroom&lt;/a&gt; or participate in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions&quot;&gt;ongoing discussions&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Forgejo&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo&quot;&gt;https://codeberg.org/forgejo/forgejo&lt;/a&gt;&lt;/p&gt; &lt;p&gt;Notable improvements and bug fixes:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Repository administrators can &lt;a href=&quot;https://forgejo.org/docs/v7.0/user/wiki/#activation-and-permissions&quot;&gt;allow anyone to edit the wiki&lt;/a&gt; in the repository Settings. (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2001&quot;&gt;#2001&lt;/a&gt;)&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2222&quot;&gt;nuget api support serving package manifest&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2216&quot;&gt;Fix false positive in database migration&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2140&quot;&gt;Log SQL queries when the database return error&lt;/a&gt;&lt;/li&gt; &lt;li&gt;Instance administrators can enable &lt;a href=&quot;https://forgejo.org/docs/v7.0/user/readme-badges/&quot;&gt;repository badges&lt;/a&gt; in the &lt;a href=&quot;https://forgejo.org/docs/v7.0/admin/config-cheat-sheet/#badges-badges&quot;&gt;configuration file&lt;/a&gt;. This feature depends on a shield generator service such as shields.io, and is disabled by default. (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2070&quot;&gt;#2070&lt;/a&gt;)&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1900&quot;&gt;Allow viewing the latest Action on the web&lt;/a&gt;: a tiny little convenience route that allows linking to the latest action of a repository. Useful for READMEs and CI badges.&lt;/li&gt; &lt;li&gt;Forgejo now recognizes more &lt;a href=&quot;https://forgejo.org/docs/v7.0/user/language-detection/&quot;&gt;linguist attributes&lt;/a&gt;, making it possible to include documentation in the repository language statistics, for example. (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2088&quot;&gt;#2088&lt;/a&gt;)&lt;/li&gt; &lt;li&gt;Users who signed up, but have not activated their accounts yet, are now able to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1891&quot;&gt;change their email before activation&lt;/a&gt;. (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1891&quot;&gt;#1891&lt;/a&gt;)&lt;/li&gt; &lt;li&gt;The &quot;You pushed on branch ....&quot; banner user experience was improved (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2141&quot;&gt;#2141&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2195&quot;&gt;#2195&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2196&quot;&gt;#2196&lt;/a&gt;)&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?q=&amp;amp;type=all&amp;amp;sort=&amp;amp;state=closed&amp;amp;labels=&amp;amp;milestone=0&amp;amp;project=0&amp;amp;assignee=0&amp;amp;poster=0&quot;&gt;Read more&lt;/a&gt; in the pull requests.&lt;/p&gt; &lt;h3&gt;In flight pull requests&lt;/h3&gt; &lt;p&gt;Most &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?state=closed&quot;&gt;pull requests&lt;/a&gt; are opened and closed within a week. But some of them take a longer time, either because they are more complex or because they are taken care of by volunteers who can only occasionally work on them in their free time. This is a list of those that were updated since the last monthly report. If they are of interest to you, reviewing the changes or providing solutions would be appreciated.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2223&quot;&gt;Add initial layout support for right-to-left languages&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2231&quot;&gt;Refactor webhook logic in preparation for custom webhook&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;Federated repository stars&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1746&quot;&gt;Add colorblind theme variants&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;Documentation&lt;/h3&gt; &lt;ul&gt; &lt;li&gt;New section on &lt;a href=&quot;https://codeberg.org/forgejo/docs/pulls/371&quot;&gt;how repo language detection works&lt;/a&gt;&lt;/li&gt; &lt;li&gt;New section on &lt;a href=&quot;https://codeberg.org/forgejo/docs/pulls/358&quot;&gt;globally editable wikis&lt;/a&gt;&lt;/li&gt; &lt;li&gt;New setting &lt;a href=&quot;https://codeberg.org/forgejo/docs/pulls/357/files&quot;&gt;[repository].DOWNLOAD_OR_CLONE_METHODS&lt;/a&gt;&lt;/li&gt; &lt;li&gt;new section on &lt;a href=&quot;https://codeberg.org/forgejo/docs/pulls/356&quot;&gt;README badges feature&lt;/a&gt;&lt;/li&gt; &lt;li&gt;The &lt;a href=&quot;https://forgejo.org/docs/v1.21/user/actions&quot;&gt;Forgejo Actions&lt;/a&gt; reference guide was significantly improved. The &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions&quot;&gt;Forgejo Actions tests&lt;/a&gt; were refactored to capture the event payloads. For instance when a workflow is triggered from pushing a commit, the event will contain information about the repository, the SHA etc. The captured events are &lt;strong&gt;automatically used to &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/branch/main/.forgejo/workflows/actions.yml#L65-L82&quot;&gt;update the documentation&lt;/a&gt;&lt;/strong&gt;. The &lt;code&gt;event&lt;/code&gt; &lt;a href=&quot;https://forgejo.org/docs/v1.21/user/actions/#githubevent&quot;&gt;section of the Forgejo Actions documentation&lt;/a&gt; links to these examples and help figure out which fields are available depending on the type of event.&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;(Scope of) Moderation of Forgejo instances&lt;/h2&gt; &lt;p&gt;A discussion &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/107&quot;&gt;started about how to develop effective moderation mechanisms&lt;/a&gt; within Forgejo while maintaining means of dynamically reacting to changing problems. It aims at collecting feedback. How much is in the scope for Forgejo? What kinds of moderation actions do Forgejo admins need to perform? This kind of user research is instrumental to understand existing best practices in order to figure out what problems needs to be resolved first.&lt;/p&gt; &lt;h2&gt;Reducing the technical debt&lt;/h2&gt; &lt;p&gt;A discussion on &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/93&quot;&gt;defining expectations regarding tests in the development workflow&lt;/a&gt; was &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/51&quot;&gt;concluded&lt;/a&gt; with a new requirement &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md&quot;&gt;in the development workflow&lt;/a&gt; by which:&lt;/p&gt; &lt;blockquote&gt; &lt;ol&gt; &lt;li&gt;A reasonable effort has been made to test the change.&lt;/li&gt; &lt;/ol&gt; &lt;/blockquote&gt; &lt;p&gt;When developers do not perform tests (either automated or manual) end users experience bugs and regressions that &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/103&quot;&gt;are much more time consuming&lt;/a&gt; to diagnose and resolve.&lt;/p&gt; &lt;p&gt;Ideally Forgejo would have a hard commitment to only merge changes that are covered by automated tests. But there are many areas where the test infrastructure itself is still lacking (the web UI for instance) and &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/100&quot;&gt;manual tests are to be documented&lt;/a&gt; instead.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/Cyborus/forgejo-api&quot;&gt;draft implementation of a Rust based Forgejo SDK&lt;/a&gt; started using the &lt;a href=&quot;https://code.forgejo.org/swagger.v1.json&quot;&gt;Swagger file&lt;/a&gt; to generate code instead of manually implementing each API endpoint. Because the Forgejo Swagger file is currently manually maintained and only has a handful of recently added &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-manual-testing/issues&quot;&gt;manual tests&lt;/a&gt; verifying it actually reflects the implementation, the author discovered inconsistencies that were fixed (see &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2182&quot;&gt;this PR for instance&lt;/a&gt;). When complete this SDK could be integrated in the Forgejo testsuite to verify the Swagger specification consistency and guard against regressions.&lt;/p&gt; &lt;h2&gt;Federation&lt;/h2&gt; &lt;p&gt;The pull request to implement &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;federated stars&lt;/a&gt; made progress, replay attacks were analyzed and mitigated in k8s. Read &lt;a href=&quot;https://codeberg.org/meissa/forgejo/src/branch/forgejo-federated-star/docs/unsure-where-to-put/blog.md#2024-01-federated-staring-with-like-activity&quot;&gt;more in the activity summary&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The F3 reference implementation &lt;a href=&quot;https://lab.forgefriends.org/friendlyforgeformat/gof3&quot;&gt;was refactored&lt;/a&gt; and the old codebase &lt;a href=&quot;https://lab.forgefriends.org/friendlyforgeformat/gof3/-/tree/2023-main&quot;&gt;archived&lt;/a&gt;. Read more in the &lt;a href=&quot;https://forum.forgefriends.org/t/f3-monthly-update-january-2024/1007&quot;&gt;January 2024&lt;/a&gt; report. The F3 Forgejo driver &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/105&quot;&gt;refactor started&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/59&quot;&gt;federation implementation task list&lt;/a&gt; was updated.&lt;/p&gt; &lt;h2&gt;Localization&lt;/h2&gt; &lt;p&gt;The Forgejo translations are depending on Gitea translations which are trapped in a proprietary service. A strategy was put in place to workaround the problem in 2022 and it worked fine until now, the overhead and problems were close to non-existent. Back then nobody knew Forgejo and establishing a brand new translation team would have been difficult but things are different now. There are significantly more people aware of what Forgejo is and willing to help.&lt;/p&gt; &lt;p&gt;Plans &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/104&quot;&gt;were made&lt;/a&gt; to bootstrap a translation team on &lt;a href=&quot;https://translate.codeberg.org/&quot;&gt;Codeberg&apos;s Weblate instance&lt;/a&gt; and the implementation is well under way, with an initial localization team covering Arabic, Dutch, French, Russian, Hungarian, Greek and German. If you are fluent in another language and would like to help, please &lt;a href=&quot;https://forgejo.org/docs/v1.21/developer/localization/#joining-the-localization-team&quot;&gt;apply&lt;/a&gt; or join the &lt;a href=&quot;https://matrix.to/#/#forgejo-localization:matrix.org&quot;&gt;localization chatroom&lt;/a&gt; to figure out what it entails.&lt;/p&gt; &lt;h2&gt;Releases&lt;/h2&gt; &lt;p&gt;There has been &lt;a href=&quot;https://forgejo.org/releases/&quot;&gt;one minor security release&lt;/a&gt; in January 2024. Forgejo admins are encouraged to &lt;a href=&quot;https://codeberg.org/forgejo/security-announcements&quot;&gt;subscribe to security announcement&lt;/a&gt; so they can better plan their upgrades.&lt;/p&gt; &lt;p&gt;Codeberg &lt;a href=&quot;https://blog.codeberg.org/letter-from-codeberg-looking-into-the-new-year.html&quot;&gt;suffered a DDoS attack&lt;/a&gt; that brought it down during more than 24h. Forgejo&apos;s own infrastructure was not impacted because it is hosted elsewhere and could have been used as an alternative to download releases. Only it did not have a mirror of the Forgejo releases. A &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/98&quot;&gt;daily scheduled action&lt;/a&gt; was created and the releases are now also available at &lt;a href=&quot;https://code.forgejo.org/forgejo/forgejo/&quot;&gt;https://code.forgejo.org/forgejo/forgejo/&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;References&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/forgejo&quot;&gt;https://code.forgejo.org/forgejo/forgejo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://forgejo.org/releases/&quot;&gt;https://forgejo.org/releases/&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/security-announcements&quot;&gt;https://codeberg.org/forgejo/security-announcements&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;End-to-end tests&lt;/h2&gt; &lt;p&gt;Forgejo &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;end-to-end tests&lt;/a&gt; require running an actual Forgejo instance.&lt;/p&gt; &lt;p&gt;They were extended to include &lt;strong&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/pulls/71&quot;&gt;Alpine packages&lt;/a&gt;&lt;/strong&gt;, verifying a package built out of an Alpine container image can actually be installed.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://forgejo.org/docs/v1.21/user/packages/alpine&quot;&gt;https://forgejo.org/docs/v1.21/user/packages/alpine&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;https://code.forgejo.org/forgejo/end-to-end&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Governance&lt;/h2&gt; &lt;h3&gt;Hard fork&lt;/h3&gt; &lt;p&gt;A discussion started on the &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/96&quot;&gt;opportunity for Forgejo to become a hard fork of Gitea&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Over the past year a number of components have been developed in Forgejo independently of Gitea, they are already hard forks. The documentation, the release process, end-to-end tests, the Forgejo Runner etc. It even happened within the Forgejo codebase. For instance, the &lt;a href=&quot;https://forgejo.org/docs/v1.21/user/blocking-user/&quot;&gt;user blocking feature&lt;/a&gt; is independent from Gitea. It has its own database tables and migrations while being part of the same binary. However Forgejo still cherry-picks commits on top of the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/milestones?state=closed&amp;amp;q=furnace&quot;&gt;Gitea codebase on a weekly basis&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The discussion led to an &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/58&quot;&gt;agreement proposal&lt;/a&gt; where Forgejo community members expressed concerns that are addressed in accordance of the &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/DECISION-MAKING.md&quot;&gt;Forgejo decision making process&lt;/a&gt;. If an agreement is reached, the previous logic will be reversed and &lt;strong&gt;commits from Gitea will be cherry-picked on top of the Forgejo codebase&lt;/strong&gt;.&lt;/p&gt; &lt;p&gt;The discussions related to this agreement are:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/103&quot;&gt;Testing strategies and containing regressions&lt;/a&gt; to support the main benefit of a hard fork which is to shield Forgejo from endemic regressions introduced in Gitea due to insufficient testing.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/108&quot;&gt;Integration of the Gitea changes inside Forgejo&lt;/a&gt; should the agreement pass.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/99&quot;&gt;Explicitly encourage contributions to Forgejo&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/103&quot;&gt;Gitea is Open Core&lt;/a&gt; explains why, with links for fact checking.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/92&quot;&gt;cloud.gitea.com shared account&lt;/a&gt; shows some of the proprietary features of Gitea Cloud and the non-Free Software version of Gitea that it runs.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Unless new concerns emerge, the agreement may be finalized in February.&lt;/p&gt; &lt;h3&gt;Moderation&lt;/h3&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/MODERATION-PROCESS.md&quot;&gt;moderation action&lt;/a&gt; was carried out to put an end to &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/53&quot;&gt;ad-hominem attacks and harassment&lt;/a&gt;: the person responsible for this behavior was banned for a period of two years. They have since created half a dozen accounts in an attempt to circumvent the ban but all content was removed or redacted within 24h.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/governance&quot;&gt;https://codeberg.org/forgejo/governance&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/0ko&quot;&gt;https://codeberg.org/0ko&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/6543&quot;&gt;https://codeberg.org/6543&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/adz&quot;&gt;https://codeberg.org/adz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/algernon&quot;&gt;https://codeberg.org/algernon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/asandikci&quot;&gt;https://codeberg.org/asandikci&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/banaanihillo&quot;&gt;https://codeberg.org/banaanihillo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/basebuilder&quot;&gt;https://codeberg.org/basebuilder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/CanisHelix&quot;&gt;https://codeberg.org/CanisHelix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Crown0815&quot;&gt;https://codeberg.org/Crown0815&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Cwpute&quot;&gt;https://codeberg.org/Cwpute&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Cyborus&quot;&gt;https://codeberg.org/Cyborus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Fl1tzi&quot;&gt;https://codeberg.org/Fl1tzi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/foxy&quot;&gt;https://codeberg.org/foxy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GamePlayer-8&quot;&gt;https://codeberg.org/GamePlayer-8&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/gwymor&quot;&gt;https://codeberg.org/gwymor&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/halibut&quot;&gt;https://codeberg.org/halibut&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/houkime&quot;&gt;https://codeberg.org/houkime&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hwpplayer1&quot;&gt;https://codeberg.org/hwpplayer1&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jfinkhaeuser&quot;&gt;https://codeberg.org/jfinkhaeuser&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jornfranke&quot;&gt;https://codeberg.org/jornfranke&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kaffeeknecht&quot;&gt;https://codeberg.org/kaffeeknecht&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KOLANICH&quot;&gt;https://codeberg.org/KOLANICH&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lukawaay&quot;&gt;https://codeberg.org/lukawaay&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/macfanpl&quot;&gt;https://codeberg.org/macfanpl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mmarif&quot;&gt;https://codeberg.org/mmarif&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mokazemi&quot;&gt;https://codeberg.org/mokazemi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/moralpanic&quot;&gt;https://codeberg.org/moralpanic&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/msrd0&quot;&gt;https://codeberg.org/msrd0&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/neuhalje&quot;&gt;https://codeberg.org/neuhalje&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nevarr0&quot;&gt;https://codeberg.org/nevarr0&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oatbiscuits&quot;&gt;https://codeberg.org/oatbiscuits&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/OdinVex&quot;&gt;https://codeberg.org/OdinVex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/panos&quot;&gt;https://codeberg.org/panos&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rdwz&quot;&gt;https://codeberg.org/rdwz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Salt&quot;&gt;https://codeberg.org/Salt&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/santalet&quot;&gt;https://codeberg.org/santalet&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/spla&quot;&gt;https://codeberg.org/spla&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/swaggboi&quot;&gt;https://codeberg.org/swaggboi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thepaperpilot&quot;&gt;https://codeberg.org/thepaperpilot&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tuxcoder&quot;&gt;https://codeberg.org/tuxcoder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Visne&quot;&gt;https://codeberg.org/Visne&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/voltagex&quot;&gt;https://codeberg.org/voltagex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wackbyte&quot;&gt;https://codeberg.org/wackbyte&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Werenter&quot;&gt;https://codeberg.org/Werenter&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wetneb&quot;&gt;https://codeberg.org/wetneb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wolftune&quot;&gt;https://codeberg.org/wolftune&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Xinayder&quot;&gt;https://codeberg.org/Xinayder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zareck&quot;&gt;https://codeberg.org/zareck&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://translate.codeberg.org/user/walpo&quot;&gt;https://translate.codeberg.org/user/walpo&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - December 2023</title><link>https://forgejo.org/2023-12-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2023-12-monthly-update/</guid><description>Codeberg migrated to Forgejo v1.21, a long awaited forge comparison page was published, the Forgejo Helm Chart reached GA, end-to-end tests proved useful to fix Forgejo Actions bugs and two new machines were added to the infrastructure.</description><pubDate>Sat, 30 Dec 2023 00:00:00 GMT</pubDate><content:encoded>&lt;ul&gt; &lt;li&gt;Codeberg migrated to Forgejo v1.21 and suffered a downtime related to performance issues. Although it was quickly recovered, it shows work is still needed to improve scaling and stability.&lt;/li&gt; &lt;li&gt;A new &lt;a href=&quot;https://forgejo.org/compare/&quot;&gt;forge comparison&lt;/a&gt; page is available. Gitea turned Open Core this month and it articulates why Forgejo is a safe heaven for admins who want to escape this trap.&lt;/li&gt; &lt;li&gt;The &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-helm&quot;&gt;Forgejo Helm Chart&lt;/a&gt; reached general availability with version 1.0.0.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;Forgejo end-to-end testing&lt;/a&gt; can now be triggered from Forgejo pull requests by setting a label. For instance, they were &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/src/commit/d3bd171b6edeab58ea5cbb547a2b1af9c63196dd/actions/example-cron/run.sh#L3-L16&quot;&gt;used to verify&lt;/a&gt; a bug fix in how &lt;a href=&quot;https://forgejo.org/docs/v1.21/user/actions/#onschedule&quot;&gt;scheduled actions&lt;/a&gt; work by automatically running an actual Forgejo instance and a runner.&lt;/li&gt; &lt;li&gt;Two new machines were &lt;a href=&quot;https://forgejo.org/docs/next/developer/infrastructure/#hetzner0203&quot;&gt;added to the Forgejo infrastructure&lt;/a&gt; to service &lt;a href=&quot;https://code.forgejo.org&quot;&gt;https://code.forgejo.org&lt;/a&gt;, an instance dedicated to Forgejo development.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;As Forgejo grows, the format of this monthly report changed to distribute the workload among all Forgejo contributors. The summary is replaced with a bullet list of the highlights and the sections are written by the Forgejo contributors who have been active on a given subject. If you would like to help, please get in touch in &lt;a href=&quot;https://matrix.to/#/!JpOtsqTARyyfkoizCU:matrix.org&quot;&gt;the chatroom&lt;/a&gt; or participate in the &lt;a href=&quot;https://codeberg.org/forgejo/discussions&quot;&gt;ongoing discussions&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Forgejo&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo&quot;&gt;https://codeberg.org/forgejo/forgejo&lt;/a&gt;&lt;/p&gt; &lt;p&gt;Notable improvements or bug fixes:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1891&quot;&gt;Allow changing the email address before activation&lt;/a&gt;: In case someone accidentally registered with the wrong email address (made a typo, for example), with this PR, they will be able to change the email address, and request a new activation mail to be sent. This requires logging in, which &lt;em&gt;is&lt;/em&gt; possible, even while the account isn&apos;t activated yet. Previously, this required help from an instance administrator, now it can be self-serviced.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1900&quot;&gt;Allow viewing the latest Action on the web&lt;/a&gt;: a tiny little convenience route that allows linking to the latest action of a repository. Useful for READMEs and CI badges.&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;In flight pull requests&lt;/h3&gt; &lt;p&gt;Most &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?state=closed&quot;&gt;pull requests&lt;/a&gt; are opened and closed within a week. But some of them take a longer time, either because they are more complex or because they are taken care of by volunteers who can only occasionally work on them in their free time. This is a list of those that were updated since the last monthly report. If they are of interest to you, reviewing the changes or providing solutions would be appreciated.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1866&quot;&gt;Actions: Link to Workflow in View&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1992&quot;&gt;pulls: &quot;Edit File&quot; button in &quot;Files Changed&quot; tab&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;Federated repository stars&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1746&quot;&gt;Add colorblind theme variants&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;Federation&lt;/h3&gt; &lt;p&gt;The pull request to implement &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;federated stars&lt;/a&gt; can now be tested manually and &lt;a href=&quot;https://codeberg.org/meissa/forgejo/src/branch/forgejo-federated-star/docs/unsure-where-to-put/blog.md#2023-12-federated-staring-open-for-test&quot;&gt;an activity summary was published&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://lab.forgefriends.org/friendlyforgeformat/gof3/-/merge_requests/90/commits&quot;&gt;F3 refactor&lt;/a&gt; is making daily progress.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/59&quot;&gt;federation implementation task list&lt;/a&gt; was updated.&lt;/p&gt; &lt;h3&gt;Releases&lt;/h3&gt; &lt;p&gt;Forgejo &lt;a href=&quot;https://forgejo.org/docs/latest/admin/upgrade/#release-life-cycle&quot;&gt;maintains &lt;strong&gt;two&lt;/strong&gt; stable releases&lt;/a&gt; at any given time:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Stable (latest major version): receives full support, bugfixes and security fixes.&lt;/li&gt; &lt;li&gt;Old Stable (previous major version): receives only critical security support.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;There has been &lt;a href=&quot;https://forgejo.org/releases/&quot;&gt;one release a week&lt;/a&gt; in the past month, an unusually high frequency explained by a series of security vulnerabilities. They are labeled with a different color &lt;strong&gt;Stable&lt;/strong&gt; and &lt;strong&gt;Oldstable&lt;/strong&gt; to make it easier for the Forgejo admin to figure out which one applies to their instance.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49946&quot;&gt;CVE-2023-49946&lt;/a&gt; was created a week after the publication of the &lt;a href=&quot;https://forgejo.org/2023-11-release-v1-20-5-1/&quot;&gt;Forgejo v1.20.5-1 release that fixes this critical vulnerability&lt;/a&gt;. As a reminder the Forgejo v1.21 stable release already includes the associated security fixes and was never vulnerable.&lt;/p&gt; &lt;p&gt;Forgejo admins are encouraged to &lt;a href=&quot;https://codeberg.org/forgejo/security-announcements&quot;&gt;subscribe to security announcement&lt;/a&gt; so they can better plan their upgrades.&lt;/p&gt; &lt;p&gt;References&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://forgejo.org/releases/&quot;&gt;https://forgejo.org/releases/&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/security-announcements&quot;&gt;https://codeberg.org/forgejo/security-announcements&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;End-to-end testing&lt;/h2&gt; &lt;p&gt;Forgejo end-to-end tests require running an actual instance and were moved to &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;a dedicated repository&lt;/a&gt; which requires a significant number of manual steps to run them on a given Forgejo pull request. It was made simpler by triggering them with the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=159443&quot;&gt;&lt;code&gt;run-end-to-end-tests&lt;/code&gt;&lt;/a&gt; label. For instance, in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/2015&quot;&gt;this Forgejo pull request&lt;/a&gt; setting the label triggered &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/actions/runs/391/jobs/1&quot;&gt;this workflow in the end-to-end&lt;/a&gt; repository, using a binary &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/c98322ed9c877a9bf717f22c4035d3fc45a5ea54/.forgejo/workflows/cascade-setup-end-to-end.yml&quot;&gt;created with the pull request&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/actions/cascading-pr/&quot;&gt;https://code.forgejo.org/actions/cascading-pr/&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;https://code.forgejo.org/forgejo/end-to-end&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Forgejo helm&lt;/h2&gt; &lt;p&gt;Forgejo Helm Chart reached GA version 1.0.0 and is basically HA ready thanks to upstream Gitea Chart.&lt;/p&gt; &lt;p&gt;The only remaining issue is that all cron jobs are run on all instances because there&apos;s no leader elections yet.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-helm&quot;&gt;https://codeberg.org/forgejo-contrib/forgejo-helm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo-contrib/forgejo-renovate/&quot;&gt;https://code.forgejo.org/forgejo-contrib/forgejo-renovate/&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Codeberg&lt;/h2&gt; &lt;p&gt;Codeberg migrated to Forgejo v1.21 and despite preliminary testing and a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/1783&quot;&gt;curated list of potential regressions&lt;/a&gt;, a performance issue prevented it from running. It was quickly diagnosed and fixed but the root problem remains: there is a lack of performance tests in Forgejo. That could be mitigated if there were other Forgejo (or Gitea) instances running at the same scale (~100,000 users and projects, publicly available) as they would also run into the same problems. But in the past years the vast majority of performance issues were discovered in the context of Codeberg, which strongly suggests it is the largest instance in existence.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/Codeberg/Community/issues/1356&quot;&gt;priority list&lt;/a&gt; has been established so Forgejo contributors can quickly figure out which problems deserve their attention.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Codeberg/Community&quot;&gt;https://codeberg.org/Codeberg/Community&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Codeberg/Community/issues/1356&quot;&gt;https://codeberg.org/Codeberg/Community/issues/1356&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Forgejo runner&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/RELEASE-NOTES.md#3-3-0&quot;&gt;Forgejo runner 3.3.0&lt;/a&gt; was published and is now IPv6 capable. Unfortunately there is &lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers/issues/19&quot;&gt;a bug in Debian LXC support&lt;/a&gt; that limits the scope of tests it can support.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers&quot;&gt;https://code.forgejo.org/forgejo/lxc-helpers&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;https://code.forgejo.org/forgejo/runner&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Governance&lt;/h2&gt; &lt;h3&gt;Mergers team&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#contributors&quot;&gt;Contributors&lt;/a&gt; team has no permissions on &quot;Code&quot; which prevents members from merging pull requests although they have write permissions on &quot;PullRequests&quot; for the Forgejo repository. There is not much scrutiny to enter the contributors team because it bears almost no risk to the integrity of the Forgejo project. Being given permission to write the repository is a different matter. The new &quot;Mergers&quot; team is created &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/46&quot;&gt;and requires a formal application process&lt;/a&gt;. However light, it will make a difference that matters in terms of trust and commitment.&lt;/p&gt; &lt;h3&gt;Moderation&lt;/h3&gt; &lt;p&gt;Two &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/MODERATION-PROCESS.md&quot;&gt;moderation actions&lt;/a&gt; were carried out: one regarding an &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/45&quot;&gt;ad-hominem attack&lt;/a&gt; and another regarding the publication of &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/49&quot;&gt;private information&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/governance&quot;&gt;https://codeberg.org/forgejo/governance&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Professional services&lt;/h2&gt; &lt;p&gt;Forgejo, just like any other Free Software can be the base of commercial activity from service providers independent from the project itself. Forgejo exists under the umbrella of the Codeberg e.V. non profit which does not provide professional services so there is no competition and will never be.&lt;/p&gt; &lt;p&gt;Even if to address a handful of requests per year, it is convenient to have a place where people in need of professional services can meet service providers with the will and the skills to meet their needs. Here are some similar places in other Free Software projects:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Drupal &lt;a href=&quot;https://www.drupal.org/drupal-services&quot;&gt;https://www.drupal.org/drupal-services&lt;/a&gt;&lt;/li&gt; &lt;li&gt;OpenStack &lt;a href=&quot;https://www.openstack.org/marketplace/consulting/&quot;&gt;https://www.openstack.org/marketplace/consulting/&lt;/a&gt;&lt;/li&gt; &lt;li&gt;OSD &lt;a href=&quot;https://discourse.opensourcedesign.net/t/posting-jobs-read-this-first/3416&quot;&gt;https://discourse.opensourcedesign.net/t/posting-jobs-read-this-first/3416&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;It was &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/47&quot;&gt;decided&lt;/a&gt; to create a kind of job board which was bootstrapped as a &lt;a href=&quot;https://codeberg.org/forgejo/professional-services&quot;&gt;dedicated issue tracker&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/professional-services&quot;&gt;https://codeberg.org/forgejo/professional-services&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Hardware infrastructure&lt;/h2&gt; &lt;p&gt;Two new machines were &lt;a href=&quot;https://forgejo.org/docs/next/developer/infrastructure/#hetzner0203&quot;&gt;added to the Forgejo infrastructure&lt;/a&gt; and are now hosting &lt;code&gt;code.forgejo.org&lt;/code&gt; that was previously in an OpenStack virtual machine. It is faster (10 times more bandwidth) and also is IPv6 capable. The LXC containers are setup and maintained using &lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers/&quot;&gt;lxc-helpers&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A LXC container with extended capabilities required to run a nested k8s cluster was setup on an dedicated hardware for better isolation. Forgejo runners are installed for both &lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers&quot;&gt;lxc-helpers&lt;/a&gt; and &lt;a href=&quot;https://code.forgejo.org/forgejo-contrib/forgejo-helm&quot;&gt;forgejo-helm&lt;/a&gt; so they can &lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers/src/branch/main/.forgejo/workflows/test.yml#L13&quot;&gt;run workflows that depend on k8s&lt;/a&gt;. For instance, it helped detect regressions with the Forgejo Helm chart prior to version 1.0.0.&lt;/p&gt; &lt;p&gt;The &lt;code&gt;next.forgejo.org&lt;/code&gt; instance that is running the development branch of Forgejo (updated weekly) is now also hosted on this hardware. It was reset entirely on that occasion and displays a prominent reminder that there is no guarantee that any data will persist. It is only for experimental purposes.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers&quot;&gt;https://code.forgejo.org/forgejo/lxc-helpers&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://forgejo.org/docs/next/developer/next-forgejo-org/&quot;&gt;https://forgejo.org/docs/next/developer/next-forgejo-org/&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://forgejo.org/docs/next/developer/infrastructure/#hetzner0203&quot;&gt;https://forgejo.org/docs/next/developer/infrastructure/#hetzner0203&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;OCI mirrors&lt;/h2&gt; &lt;p&gt;Container images hosted at &lt;a href=&quot;https://hub.docker.com/&quot;&gt;https://hub.docker.com/&lt;/a&gt; are subject to rate limiting which can be disrupting, for instance when the CI is used intensively by multiple contributors.&lt;/p&gt; &lt;p&gt;Some of the most commonly used container images used by Forgejo were manually mirrored in a &lt;a href=&quot;https://code.forgejo.org/oci/-/packages&quot;&gt;dedicated organization&lt;/a&gt; to partially resolve that problem. Updating these images should be done automatically but there still is no script to do so.&lt;/p&gt; &lt;p&gt;References:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/oci/-/packages&quot;&gt;https://code.forgejo.org/oci/-/packages&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/6543&quot;&gt;https://codeberg.org/6543&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/adrinux&quot;&gt;https://codeberg.org/adrinux&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/adz&quot;&gt;https://codeberg.org/adz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/algernon&quot;&gt;https://codeberg.org/algernon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/APoniatowski&quot;&gt;https://codeberg.org/APoniatowski&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Aqa-Ib&quot;&gt;https://codeberg.org/Aqa-Ib&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/asandikci&quot;&gt;https://codeberg.org/asandikci&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ashimokawa&quot;&gt;https://codeberg.org/ashimokawa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Cs137&quot;&gt;https://codeberg.org/Cs137&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dejan&quot;&gt;https://codeberg.org/dejan&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/delgh1&quot;&gt;https://codeberg.org/delgh1&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/foxy&quot;&gt;https://codeberg.org/foxy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Freso&quot;&gt;https://codeberg.org/Freso&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GamePlayer-8&quot;&gt;https://codeberg.org/GamePlayer-8&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/halibut&quot;&gt;https://codeberg.org/halibut&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hazy&quot;&gt;https://codeberg.org/hazy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/HexagonCDN&quot;&gt;https://codeberg.org/HexagonCDN&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JakobDev&quot;&gt;https://codeberg.org/JakobDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jfinkhaeuser&quot;&gt;https://codeberg.org/jfinkhaeuser&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/joeroe&quot;&gt;https://codeberg.org/joeroe&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jornfranke&quot;&gt;https://codeberg.org/jornfranke&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jthvai&quot;&gt;https://codeberg.org/jthvai&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KN4CK3R&quot;&gt;https://codeberg.org/KN4CK3R&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lmaotrigine&quot;&gt;https://codeberg.org/lmaotrigine&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/luca-pellegrini&quot;&gt;https://codeberg.org/luca-pellegrini&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/macfanpl&quot;&gt;https://codeberg.org/macfanpl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Miraha&quot;&gt;https://codeberg.org/Miraha&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oelmekki&quot;&gt;https://codeberg.org/oelmekki&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/realaravinth&quot;&gt;https://codeberg.org/realaravinth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Ryuno-Ki&quot;&gt;https://codeberg.org/Ryuno-Ki&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sachaz&quot;&gt;https://codeberg.org/sachaz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/schwarze&quot;&gt;https://codeberg.org/schwarze&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/sdolan99&quot;&gt;https://codeberg.org/sdolan99&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Septem9er&quot;&gt;https://codeberg.org/Septem9er&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SteffoSpieler&quot;&gt;https://codeberg.org/SteffoSpieler&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/teutat3s&quot;&gt;https://codeberg.org/teutat3s&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/twann&quot;&gt;https://codeberg.org/twann&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Weebull&quot;&gt;https://codeberg.org/Weebull&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wetneb&quot;&gt;https://codeberg.org/wetneb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Wild-Turtles&quot;&gt;https://codeberg.org/Wild-Turtles&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wolcen&quot;&gt;https://codeberg.org/wolcen&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/woofman420&quot;&gt;https://codeberg.org/woofman420&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Xinayder&quot;&gt;https://codeberg.org/Xinayder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xyhhx&quot;&gt;https://codeberg.org/xyhhx&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zareck&quot;&gt;https://codeberg.org/zareck&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo Security Release 1.21.2-1</title><link>https://forgejo.org/2023-12-release-v1-21-2-1/</link><guid isPermaLink="true">https://forgejo.org/2023-12-release-v1-21-2-1/</guid><description>The Forgejo v1.21.2-1 release contains an additional security fix related to permissions enforcement of API endpoints.</description><pubDate>Tue, 12 Dec 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.21.2-1&quot;&gt;Forgejo v1.21.2-1&lt;/a&gt; was released 12 December 2023.&lt;/p&gt; &lt;p&gt;This release contains &lt;em&gt;a security fix&lt;/em&gt; related to permissions enforcement of web endpoints.&lt;/p&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We &lt;em&gt;strongly recommend&lt;/em&gt; that all Forgejo installations are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;h3&gt;The project page of private users is publicly visible&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://forgejo.org/docs/v1.21/user/project/&quot;&gt;project page&lt;/a&gt; of a private user was missing a permission check and was visible publicly. The other pages (packages, repositories, etc.) of this user or even its existence are not visible publicly.&lt;/p&gt; &lt;h3&gt;Reminder of responsible disclosure&lt;/h3&gt; &lt;p&gt;On 11 December 2023 the project page vulnerability was &lt;a href=&quot;https://github.com/go-gitea/gitea/pull/28423&quot;&gt;revealed publicly&lt;/a&gt; in contradiction with the &lt;a href=&quot;https://github.com/go-gitea/gitea/blob/763938e889c233e82a1a046010b9d332abaa833f/SECURITY.md#reporting-a-vulnerability&quot;&gt;Gitea&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/CONTRIBUTING.md&quot;&gt;Forgejo&lt;/a&gt; security policies as well as the &lt;a href=&quot;https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure&quot;&gt;general principles of responsible disclosure&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;This unfortunate incident forced the immediate preparation of this Forgejo patch release. With no advance warning it only allowed for limited testing and there is a non negligible risk of a regression.&lt;/p&gt; &lt;p&gt;In such a situation the Forgejo admins and users are suffering the consequences, either because they are left unecessarily exposed to publicly known vulnerabilities or because their instance may run into regressions due to insufficient preparation time and testing.&lt;/p&gt; &lt;p&gt;If you discover a new vulnerability, you are &lt;strong&gt;urged to not reveal it publicly&lt;/strong&gt; but to &lt;a href=&quot;https://forgejo.org/.well-known/security.txt&quot;&gt;send an encrypted email&lt;/a&gt; to &lt;a href=&quot;mailto:security@forgejo.org&quot;&gt;security@forgejo.org&lt;/a&gt; so this situation does not happen again.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - November 2023</title><link>https://forgejo.org/2023-11-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2023-11-monthly-update/</guid><description>Forgejo is one year old and just published v1.21 its fourth major release. Developed in the interest of the general public it grew to become more secure, include more features while staying true to its commitment to only develop Free Software. Your help will make a difference and you are kindly invited to join the Forgejo contributors who work daily to implement federation.</description><pubDate>Thu, 30 Nov 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Forgejo was &lt;a href=&quot;https://forgejo.org/2022-12-15-hello-forgejo/&quot;&gt;created in October 2022&lt;/a&gt; after a for profit company took over the Gitea project. In the beginning they were almost identical, except for the name and the color. But in the past year, this difference in governance led to choices that made Forgejo significantly and durably different from Gitea.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;strong&gt;Better security&lt;/strong&gt;. Forgejo focuses on identifying and fixing security vulnerabilities as soon as they are discovered. Gitea is always notified in advance via encrypted channels (e.g. &lt;a href=&quot;https://forgejo.org/2023-11-release-v1-20-5-1/&quot;&gt;Forgejo v1.20.5-1&lt;/a&gt; or &lt;a href=&quot;https://forgejo.org/2023-10-release-v1-20-5-0/&quot;&gt;Forgejo v1.20.5-0&lt;/a&gt;).&lt;/li&gt; &lt;li&gt;&lt;strong&gt;More features&lt;/strong&gt;. Forgejo includes all of Gitea features and integrates new one as soon as they are available. It is a 100% compatible drop-in replacement with additional features, &lt;a href=&quot;https://forgejo.org/docs/v1.21/user/blocking-user/&quot;&gt;self moderation&lt;/a&gt; being the first one.&lt;/li&gt; &lt;li&gt;&lt;strong&gt;Better stability&lt;/strong&gt;. Forgejo relies on &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/&quot;&gt;end-to-end&lt;/a&gt; and upgrade tests. The upgrade tests were introduced to address an &lt;a href=&quot;https://forgejo.org/2023-08-release-v1-20-3-0/&quot;&gt;instability caused by a regression in the storage settings&lt;/a&gt;.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Since its inception Forgejo has been strongly committed to provide forge federation. This long term work &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/59&quot;&gt;keeps contributors busy daily&lt;/a&gt; and it will still be a while before it is complete. Your help will make a difference and you are kindly invited to &lt;a href=&quot;https://matrix.to/#/#forgejo-development:matrix.org&quot;&gt;join the team&lt;/a&gt;. Your work will not help build a startup chasing unicorns, it will benefit the general public and yourself. You will only use Free Software as Forgejo is developed with Forgejo on &lt;a href=&quot;https://codeberg.org&quot;&gt;Codeberg&lt;/a&gt; with a CI and releases powered by Forgejo Actions.&lt;/p&gt; &lt;h2&gt;Development&lt;/h2&gt; &lt;h3&gt;v1.21 release&lt;/h3&gt; &lt;p&gt;After eight release candidates over eight weeks, the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-21-1-0&quot;&gt;Forgejo v1.21 release&lt;/a&gt; was published and the &lt;a href=&quot;https://forgejo.org/2023-11-release-v1211-0/&quot;&gt;companion blog post&lt;/a&gt; provides a summary of the work it includes.&lt;/p&gt; &lt;h3&gt;In flight pull requests&lt;/h3&gt; &lt;p&gt;Most &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?state=closed&quot;&gt;pull requests&lt;/a&gt; are opened and closed within a week. But some of them take a longer time, either because they are more complex or because they are taken care of by volunteers who can only occasionally work on them in their free time. This is a list of those that were updated since the last monthly report. If they are of interest to you, reviewing the changes or providing solutions would be appreciated.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1790&quot;&gt;Avoid conflicts of issue and PR numbers in GitLab migration&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1841&quot;&gt;Mock HTTP calls in GitLab migration unit test &lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1746&quot;&gt;Add colorblind theme variants&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;Federated repository stars&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;End to end tests&lt;/h3&gt; &lt;p&gt;Forgejo contributors developed end to end tests which require running actual instances and realistic use cases. The proved particularly useful to fix and debug the &lt;a href=&quot;https://forgejo.org/2023-08-release-v1-20-3-0/#fixing-the-risk-of-data-loss-related-to-storage-sections&quot;&gt;regressions related to storage settings&lt;/a&gt; and verifying the workflows sent to the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;Forgejo runner&lt;/a&gt; succeed.&lt;/p&gt; &lt;p&gt;There were all moved into a &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end/&quot;&gt;dedicated repository&lt;/a&gt; where they can conveniently be run and developed rather than being scattered in the Forgejo repository itself or the &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo&quot;&gt;setup-forgejo&lt;/a&gt; action.&lt;/p&gt; &lt;h3&gt;Experimental releases&lt;/h3&gt; &lt;p&gt;Starting 25 November 2023, test releases including the latest developments &lt;a href=&quot;https://forgejo.org/docs/v1.21/developer/release/#experimental-release-process&quot;&gt;will be published&lt;/a&gt; on a regular basis, usually every week. They will be used to run &lt;a href=&quot;https://next.forgejo.org&quot;&gt;https://next.forgejo.org&lt;/a&gt;. It is not recommended to use them in production.&lt;/p&gt; &lt;h3&gt;Testing requirements&lt;/h3&gt; &lt;p&gt;As a rule changes introduced in Forgejo are associated with tests that verify they work. Without such tests they are prone to regressions over time and more difficult to review. However, it is sometime challenging to create a new test when the underlying codebase lacks the basic infrastructure to do so. It is the case, for instance, for the JavaScript parts of the frontend or more generally user interface changes in Forgejo. As an exception, some pull requests will be merged without tests and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?labels=167348&quot;&gt;tagged as such&lt;/a&gt; when they can be contributed back to the main author of the codebase and not burden Forgejo with the associated technical debt.&lt;/p&gt; &lt;h3&gt;Federation&lt;/h3&gt; &lt;p&gt;A new pull request was open to implement &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1680&quot;&gt;federated stars&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/meissa/forgejo/src/commit/d6c49675438fe5d5f84364e081ab1cb60ca42d75/docs/unsure-where-to-put/blog.md&quot;&gt;an activity summary was published&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://lab.forgefriends.org/friendlyforgeformat/gof3/-/merge_requests/90/commits&quot;&gt;F3 refactor&lt;/a&gt; is making daily progress.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/59&quot;&gt;task list&lt;/a&gt; created a year ago to track federation work is now updated monthly.&lt;/p&gt; &lt;h2&gt;Forgejo Actions&lt;/h2&gt; &lt;p&gt;With the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/RELEASE-NOTES.md#320&quot;&gt;3.2.0&lt;/a&gt; release of the Forgejo runner, the &lt;a href=&quot;https://forgejo.org/docs/v1.21/admin/actions/#lxc&quot;&gt;LXC backend&lt;/a&gt; was improved and can now be configured with capabilities to run k8s. It &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/issues/55#issuecomment-3332&quot;&gt;unblocked the work&lt;/a&gt; started a few months ago to verify a helm chart using Forgejo can run in a workflow.&lt;/p&gt; &lt;p&gt;Groundwork for &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/issues/119&quot;&gt;IPv6 support&lt;/a&gt; is done and needs testing before it can be released.&lt;/p&gt; &lt;h2&gt;Security releases&lt;/h2&gt; &lt;p&gt;Late October, the &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#security&quot;&gt;Forgejo security team&lt;/a&gt; discovered critical vulnerabilities and worked on fixes that were published as part of Forgejo v1.21 and &lt;a href=&quot;https://forgejo.org/2023-11-release-v1-20-5-1/&quot;&gt;backported to Forgejo v1.20.5-1&lt;/a&gt; after a 30-day embargo. To better prepare for such upgrades, Forgejo admins can now watch &lt;a href=&quot;https://codeberg.org/forgejo/security-announcements/issues&quot;&gt;a repository&lt;/a&gt; dedicated to security announcements or subscribe to the &lt;a href=&quot;https://codeberg.org/forgejo/security-announcements.rss&quot;&gt;associated RSS feed&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The severity of the vulnerabilities motivated security team members to &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/86&quot;&gt;write a post-mortem&lt;/a&gt; and ask for input and ideas in an open discussion.&lt;/p&gt; &lt;h2&gt;User research&lt;/h2&gt; &lt;p&gt;Although it is largely agreed that &lt;a href=&quot;https://jdittrich.github.io/userNeedResearchBook/&quot;&gt;user research&lt;/a&gt; is one of the areas where Forgejo needs more work, it has not seen significant progress in the past year. The effort has resumed, starting with &lt;a href=&quot;https://codeberg.org/forgejo/user-research/issues/20&quot;&gt;sorting issues into categories&lt;/a&gt;. The goal is to better understand Forgejo users.&lt;/p&gt; &lt;h2&gt;Hardware infrastructure&lt;/h2&gt; &lt;p&gt;As &lt;a href=&quot;https://code.forgejo.org&quot;&gt;https://code.forgejo.org&lt;/a&gt; keeps growing, &lt;a href=&quot;https://codeberg.org/forgejo/docs/pulls/262&quot;&gt;new hardware is being provisioned&lt;/a&gt; so it can move from the cloud and have more disk space, mostly.&lt;/p&gt; &lt;h2&gt;Governance and communication&lt;/h2&gt; &lt;p&gt;The moderation team is now composed of &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#moderation&quot;&gt;two members&lt;/a&gt;. A Forgejo contributor also &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/41&quot;&gt;applied&lt;/a&gt; to the security team.&lt;/p&gt; &lt;p&gt;A few &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/44&quot;&gt;new members&lt;/a&gt; were added to the contributors team and it &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#contributors&quot;&gt;does not require a formal application process&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/abyxcos&quot;&gt;https://codeberg.org/abyxcos&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/arkdae&quot;&gt;https://codeberg.org/arkdae&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/asandikci&quot;&gt;https://codeberg.org/asandikci&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bodsch&quot;&gt;https://codeberg.org/bodsch&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/cbn8krgm&quot;&gt;https://codeberg.org/cbn8krgm&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hazy&quot;&gt;https://codeberg.org/hazy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jfinkhaeuser&quot;&gt;https://codeberg.org/jfinkhaeuser&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jwildeboer&quot;&gt;https://codeberg.org/jwildeboer&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Korbs&quot;&gt;https://codeberg.org/Korbs&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/maltejur&quot;&gt;https://codeberg.org/maltejur&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/meaz&quot;&gt;https://codeberg.org/meaz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/moralpanic&quot;&gt;https://codeberg.org/moralpanic&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/msrd0&quot;&gt;https://codeberg.org/msrd0&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/realaravinth&quot;&gt;https://codeberg.org/realaravinth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rome-user&quot;&gt;https://codeberg.org/rome-user&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/s3lph&quot;&gt;https://codeberg.org/s3lph&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SteffoSpieler&quot;&gt;https://codeberg.org/SteffoSpieler&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/stevenroose&quot;&gt;https://codeberg.org/stevenroose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thepaperpilot&quot;&gt;https://codeberg.org/thepaperpilot&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/w8emv&quot;&gt;https://codeberg.org/w8emv&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wetneb&quot;&gt;https://codeberg.org/wetneb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xtex&quot;&gt;https://codeberg.org/xtex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xy&quot;&gt;https://codeberg.org/xy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xyhhx&quot;&gt;https://codeberg.org/xyhhx&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yoctozepto&quot;&gt;https://codeberg.org/yoctozepto&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zareck&quot;&gt;https://codeberg.org/zareck&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo Security Release 1.20.6-0</title><link>https://forgejo.org/2023-11-release-v1-20-6-0/</link><guid isPermaLink="true">https://forgejo.org/2023-11-release-v1-20-6-0/</guid><description>The Forgejo v1.20.6-0 release contains an additional security fix related to permissions enforcement of API endpoints.</description><pubDate>Tue, 28 Nov 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.20.6-0&quot;&gt;Forgejo v1.20.6-0&lt;/a&gt; was released 28 November 2023.&lt;/p&gt; &lt;p&gt;This release contains &lt;em&gt;a security fix&lt;/em&gt; related to permissions enforcement of API endpoints.&lt;/p&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We &lt;em&gt;strongly recommend&lt;/em&gt; that all Forgejo installations are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;h3&gt;API and web endpoint vulnerable to manually crafted identifiers&lt;/h3&gt; &lt;p&gt;See the &lt;a href=&quot;https://forgejo.org/2023-11-release-v1-20-5-1/#api-and-web-endpoint-vulnerable-to-manually-crafted-identifiers&quot;&gt;Forgejo v1.20.5-1 blog post&lt;/a&gt; for a detailed explanation on this kind of vulnerability.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;get the public key of a user&lt;/li&gt; &lt;li&gt;get a release or a release attachment&lt;/li&gt; &lt;li&gt;get OAuth2 applications (except for the secret)&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Fixes were written for the vulnerable endpoints but not thoroughly tested.&lt;/p&gt; &lt;h3&gt;Reminder of responsible disclosure&lt;/h3&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.20.5-1&quot;&gt;Forgejo v1.20.5-1&lt;/a&gt; was released 25 November 2023 after &lt;a href=&quot;https://forgejo.org/2023-11-release-v1-20-5-1/#responsible-disclosure-to-gitea&quot;&gt;a 30-day embargo&lt;/a&gt; that gave enough time to Gogs, Gitea and Forgejo to prepare and publish a patch release on 25 November 2025.&lt;/p&gt; &lt;p&gt;The complete list of identified vulnerabilities was communicated by the Forgejo security team to Gitea on 5 November 2023 and the final version of the patch fixing all of them was sent on 24 November 2023, via encrypted email. In addition, two PRs (for &lt;a href=&quot;https://github.com/go-gitea/gitea/pull/28211&quot;&gt;v1.20&lt;/a&gt; and &lt;a href=&quot;https://github.com/go-gitea/gitea/pull/28212&quot;&gt;v1.21&lt;/a&gt;) were sent to Gitea on 25 November 2023 prior to the announcement of the Forgejo release to help fast track a stable point release.&lt;/p&gt; &lt;p&gt;On 25 November 2023, shortly after the release, additional vulnerabilities were &lt;a href=&quot;https://github.com/go-gitea/gitea/pull/28213&quot;&gt;revealed publicly&lt;/a&gt; in contradiction with the &lt;a href=&quot;https://github.com/go-gitea/gitea/blob/763938e889c233e82a1a046010b9d332abaa833f/SECURITY.md#reporting-a-vulnerability&quot;&gt;Gitea&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/CONTRIBUTING.md&quot;&gt;Forgejo&lt;/a&gt; security policies as well as the &lt;a href=&quot;https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure&quot;&gt;general principles of responsible disclosure&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;This unfortunate incident forced the immediate preparation of this Forgejo patch release. With no advance warning it only allowed for limited testing and there is a non negligible risk of a regression.&lt;/p&gt; &lt;p&gt;In such a situation the Forgejo admins and users are suffering the consequences, either because they are left unecessarily exposed to publicly known vulnerabilities or because their instance may run into regressions due to insufficient preparation time and testing.&lt;/p&gt; &lt;p&gt;If you discover a new vulnerability, you are &lt;strong&gt;urged to not reveal it publicly&lt;/strong&gt; but to &lt;a href=&quot;https://forgejo.org/.well-known/security.txt&quot;&gt;send an encrypted email&lt;/a&gt; to &lt;a href=&quot;mailto:security@forgejo.org&quot;&gt;security@forgejo.org&lt;/a&gt; so this situation does not happen again.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo v1.21 is available</title><link>https://forgejo.org/2023-11-release-v1211-0/</link><guid isPermaLink="true">https://forgejo.org/2023-11-release-v1211-0/</guid><description>Forgejo v1.21 is available and comes with significant improvements to Forgejo Actions and the Forgejo runner. It also brings better user blocking, many documentation improvements, a shortcut button to open new PRs, mail notifications when new users are created and more. As always, make sure to carefully read the breaking changes from the release notes and make a full backup before upgrading.</description><pubDate>Sun, 26 Nov 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;/download/&quot;&gt;Forgejo v1.21.1-0&lt;/a&gt; is here and you will find the most interesting changes it introduces below. Before upgrading it is &lt;em&gt;strongly recommended&lt;/em&gt; to make a full backup as explained in the &lt;a href=&quot;/docs/v1.21/admin/upgrade/&quot;&gt;upgrade guide&lt;/a&gt; and carefully read &lt;em&gt;all breaking changes&lt;/em&gt; from the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-21-1-0&quot;&gt;release notes&lt;/a&gt;. If in doubt, do not hesitate to ask for help &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or in the &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;chat room&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v1.21/user/actions&quot;&gt;Actions&lt;/a&gt;&lt;/strong&gt;: server side, secrets can be managed via the API and the &lt;code&gt;pull_request_target&lt;/code&gt; makes it possible to securely run workflows on pull requests, even when they need to access secrets. A major version of the Forgejo runner was &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/RELEASE-NOTES.md#320&quot;&gt;also published&lt;/a&gt; and it is now capable of &lt;a href=&quot;/docs/v1.21/admin/actions/#labels-and-runs-on&quot;&gt;running actions on Docker, LXC or in a shell&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v1.21/user/blocking-user&quot;&gt;Blocking a user&lt;/a&gt;&lt;/strong&gt;: repository transfers originating from the blocked user are canceled and the blocked user is removed from the list of collaborators on repositories owned by the user doing the blocking. This self-moderation feature introduced in v1.20 is most useful on large Forgejo instances and was since deployed on Codeberg. It has been used a few times by the Forgejo moderation team in cases that did not require admin privileges.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v1.21&quot;&gt;Documentation&lt;/a&gt;&lt;/strong&gt;: new sections were added to the &lt;a href=&quot;/docs/v1.21/developer/&quot;&gt;developer guide&lt;/a&gt; such as the &lt;a href=&quot;/docs/v1.21/developer/customization/&quot;&gt;user interface customization&lt;/a&gt;, which is considered an internal detail and requires intimate knowledge of the codebase to be maintained. Every new feature listed in the release notes was matched with an update in the documentation because it is intended to become an exhaustive reference. The &lt;a href=&quot;https://codeberg.org/forgejo/docs/&quot;&gt;documentation repository&lt;/a&gt; was split out of the website repository and restructured to facilitate the &lt;a href=&quot;https://codeberg.org/forgejo/docs/src/branch/next/README.md#contributing&quot;&gt;maintenance and contribution workflow&lt;/a&gt;.&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v1.21/user/pull-requests-and-git-flow/#create-a-pull-request&quot;&gt;Shortcut to create a PR&lt;/a&gt;:&lt;/strong&gt; a button is automatically shown if you recently pushed to branch and will open a PR with the default branch as a base.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;New user mail notification&lt;/strong&gt;: When a Forgejo instance has open registration, it is occasionally subject to spam accounts. With the &lt;code&gt;SEND_NOTIFICATION_EMAIL_ON_NEW_USER = true&lt;/code&gt; setting, the Forgejo admin will receive a mail when a new account is created and can immediately act on it, instead of discovering a dozen of spam bots a much later.&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;Additional syntax highlighting&lt;/strong&gt;: for &lt;a href=&quot;https://github.com/alecthomas/chroma/pull/765&quot;&gt;Smali&lt;/a&gt;, &lt;a href=&quot;https://github.com/alecthomas/chroma/pull/772&quot;&gt;DHCP&lt;/a&gt;, &lt;a href=&quot;https://github.com/alecthomas/chroma/pull/776&quot;&gt;WebGPU Shading Language&lt;/a&gt;, &lt;a href=&quot;https://github.com/alecthomas/chroma/commit/4779f9035a3aaea3ec650f0923657c12e12dd35a&quot;&gt;AutoHotkey&lt;/a&gt;, &lt;a href=&quot;https://github.com/alecthomas/chroma/commit/029798b351baa9c3d0dd5ec16e87ab98486d843c&quot;&gt;AutoIt&lt;/a&gt;, &lt;a href=&quot;https://github.com/alecthomas/chroma/commit/e422a6286fdc61393deb09afd270293eb590d023&quot;&gt;tal (uxntal)&lt;/a&gt;, &lt;a href=&quot;https://github.com/alecthomas/chroma/pull/794&quot;&gt;ArangoDB Query Language (AQL)&lt;/a&gt;, &lt;a href=&quot;https://github.com/alecthomas/chroma/pull/796&quot;&gt;BIND DNS Zone&lt;/a&gt;, &lt;a href=&quot;https://github.com/alecthomas/chroma/pull/802&quot;&gt;Odin&lt;/a&gt;, &lt;a href=&quot;https://github.com/alecthomas/chroma/pull/804&quot;&gt;Sourcepawn&lt;/a&gt;, &lt;a href=&quot;https://github.com/alecthomas/chroma/pull/813&quot;&gt;CPP&lt;/a&gt;, &lt;a href=&quot;https://github.com/alecthomas/chroma/pull/815&quot;&gt;C&lt;/a&gt;.&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;&lt;strong&gt;Additional language detection&lt;/strong&gt;: &lt;a href=&quot;https://github.com/atom-haskell/language-haskell&quot;&gt;Bluespec BH&lt;/a&gt;, &lt;a href=&quot;https://github.com/terrastruct/d2-vscode&quot;&gt;D2&lt;/a&gt;, &lt;a href=&quot;https://github.com/golang/vscode-go&quot;&gt;Go Workspace&lt;/a&gt;, &lt;a href=&quot;https://github.com/nishtahir/language-kotlin&quot;&gt;Gradle Kotlin DSL&lt;/a&gt;, &lt;a href=&quot;https://github.com/Alhadis/language-etc&quot;&gt;Hosts File&lt;/a&gt;, &lt;a href=&quot;https://github.com/KrazIvan/LOLCODE-grammar-vscode&quot;&gt;LOLCODE&lt;/a&gt;, &lt;a href=&quot;https://github.com/wooorm/markdown-tm-language&quot;&gt;MDX&lt;/a&gt;, &lt;a href=&quot;https://github.com/BobDotCom/Nasal.tmbundle&quot;&gt;Nasal&lt;/a&gt;, &lt;a href=&quot;https://github.com/hustcer/nu-grammar&quot;&gt;Nushell&lt;/a&gt;, &lt;a href=&quot;https://github.com/kadena-io/pact-atom&quot;&gt;Pact&lt;/a&gt;, &lt;a href=&quot;https://github.com/soutaro/vscode-rbs-syntax&quot;&gt;RBS&lt;/a&gt;, &lt;a href=&quot;https://github.com/textmate/rez.tmbundle&quot;&gt;Rez&lt;/a&gt;, &lt;a href=&quot;https://github.com/textmate/sweave.tmbundle&quot;&gt;Sweave&lt;/a&gt;, &lt;a href=&quot;https://github.com/adamint/tlv-vscode&quot;&gt;TL-Verilog&lt;/a&gt;, &lt;a href=&quot;https://github.com/michidk/typst-grammar&quot;&gt;Typst&lt;/a&gt;, &lt;a href=&quot;https://github.com/broadinstitute/wdl-sublime-syntax-highlighter&quot;&gt;WDL&lt;/a&gt;, &lt;a href=&quot;https://github.com/wgsl-analyzer/wgsl-analyzer&quot;&gt;WGSL&lt;/a&gt;, &lt;a href=&quot;https://github.com/bytecodealliance/vscode-wit&quot;&gt;WebAssembly Interface Type&lt;/a&gt;&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Read more &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-21-1-0&quot;&gt;in the Forgejo v1.21.1-0 release notes&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Forgejo Actions&lt;/h3&gt; &lt;p&gt;Forgejo is only as stable and robust as the test infrastructure that verifies it works. Forgejo Actions is not just a feature, it is an integral part of what makes Forgejo whole. With v1.21 this self-sustainable ecosystem grew with more components such as &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;end to end testing&lt;/a&gt; and upgrade tests running older versions of Forgejo. Each repository is independent but it is not isolated from the others. Developers do not need to manually keep them in sync, they are &lt;a href=&quot;https://code.forgejo.org/actions/cascading-pr/#forgejo-dependencies&quot;&gt;bound together with tests&lt;/a&gt;. As more components are added, these tests will be the cement keeping them together, allowing developers to focus on what matters.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;Server side the most notable improvements are:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;The &lt;a href=&quot;/docs/v1.21/user/actions/#onpull_request_target&quot;&gt;&lt;code&gt;pull_request_target&lt;/code&gt; event&lt;/a&gt; is implemented and can securely access secrets because it runs using the workflows from the base branch instead of the pull request.&lt;/li&gt; &lt;li&gt;The API can now be used to manage secrets for &lt;a href=&quot;https://code.forgejo.org/api/swagger/#/user/updateUserSecret&quot;&gt;users&lt;/a&gt;, &lt;a href=&quot;https://code.forgejo.org/api/swagger/#/organization/orgListActionsSecrets&quot;&gt;organizations&lt;/a&gt; and &lt;a href=&quot;https://code.forgejo.org/api/swagger/#/repository/updateRepoSecret&quot;&gt;repositories&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;Registration tokens can &lt;a href=&quot;/docs/v1.21/admin/actions/#registration&quot;&gt;register multiple runners&lt;/a&gt; instead of a single one.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;/docs/v1.21/user/actions/#variables&quot;&gt;Variables can be used in addition to secrets&lt;/a&gt; to configure workflows when there is no need for secrecy.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;/docs/v1.21/user/actions/#onschedule&quot;&gt;Recurring actions similar to cron jobs&lt;/a&gt; can be defined in the main branch.&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;/docs/v1.21/user/actions/#artifacts&quot;&gt;Uploaded artifacts can be automatically cleaned up&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;When a new commit is pushed to a branch, the workflows triggered by previous commits are &lt;a href=&quot;/docs/v1.21/user/actions/#auto-cancelation-of-workflows&quot;&gt;automatically canceled&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;It is now possible to &lt;a href=&quot;/docs/v1.21/user/actions/#artifacts&quot;&gt;upload multiple artifacts&lt;/a&gt; instead of a single one.&lt;/li&gt; &lt;li&gt;The labels can be communicated to Forgejo from the runner when they connect &lt;a href=&quot;/docs/v1.21/admin/actions/#registration&quot;&gt;instead of just during registration&lt;/a&gt;.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;&lt;a href=&quot;/docs/v1.21/user/actions&quot;&gt;Forgejo Actions&lt;/a&gt; is however &lt;strong&gt;not yet production ready&lt;/strong&gt;, for the reasons explained in the &lt;a href=&quot;/2023-07-release-v1201-0/#forgejo-actions&quot;&gt;Forgejo v1.20&lt;/a&gt; blog post.&lt;/p&gt; &lt;p&gt;Client side, the newer version of the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/RELEASE-NOTES.md#320&quot;&gt;Forgejo runner&lt;/a&gt; that is responsible for running the workflows now comes in two flavors:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/runner/releases/tag/v3.2.0&quot;&gt;binary release&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/-/packages/container/runner/3.2.0&quot;&gt;container image&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;It is &lt;a href=&quot;https://code.forgejo.org/forgejo/end-to-end&quot;&gt;tested&lt;/a&gt; with itself to verify a new version does not introduce a trivial regression that would break Forgejo, using an &lt;a href=&quot;https://code.forgejo.org/actions/cascading-pr/&quot;&gt;action to cascade pull requests between repositories&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Read more about Forgejo actions &lt;a href=&quot;/docs/v1.21/user/actions/&quot;&gt;in the user guide&lt;/a&gt; and &lt;a href=&quot;/docs/v1.21/admin/actions/&quot;&gt;in the administrator guide&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;What is unique to Forgejo?&lt;/h3&gt; &lt;p&gt;Until recently all Forgejo commits could have been merged into Gitea overnight. But as of October 2023 Gitea &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/67&quot;&gt;requires a copyright assignment&lt;/a&gt; in addition to the MIT license. It means that the most significant contributions such as &lt;a href=&quot;/docs/v1.21/user/blocking-user&quot;&gt;blocking a user&lt;/a&gt; will not be merged into Gitea and are unique to Forgejo v1.21 and later.&lt;/p&gt; &lt;p&gt;Forgejo continues to include all of Gitea and guarantees a 100% drop-in replacement for Gitea admins. No action is required, it is enough to replace the Gitea binary or the container image with the equivalent Forgejo release and restart.&lt;/p&gt; &lt;p&gt;Such an upgrade may be motivated to benefit from security fixes that only exist in Forgejo, such as the &lt;a href=&quot;/2023-10-release-v1-20-5-0/#long-term-authentication-token&quot;&gt;Long-term authentication&lt;/a&gt; vulnerability which is fixed since Forgejo v1.20.5-0 and will also be in Gitea v1.22 early 2024.&lt;/p&gt; &lt;h3&gt;Federation&lt;/h3&gt; &lt;p&gt;Does &lt;code&gt;Forgejo&lt;/code&gt; support federation? Not yet. Was there progress? Yes.&lt;/p&gt; &lt;p&gt;The monthly reports &lt;a href=&quot;/tag/report/&quot;&gt;have details&lt;/a&gt; on these progress and the &lt;a href=&quot;https://forgefriends.org/blog/2023/06/21/2023-06-state-forge-federation/&quot;&gt;State of the Forge Federation: 2023 edition&lt;/a&gt; published in June 2023 explains how Forgejo fits in the big picture.&lt;/p&gt; &lt;p&gt;Forges have existed for over twenty years and none of them has achieved data portability let alone federation. Forgejo is yet to celebrate the publication of its first release and it will take it a little time to get there.&lt;/p&gt; &lt;h3&gt;Get Forgejo v1.21&lt;/h3&gt; &lt;p&gt;See the &lt;a href=&quot;/download&quot;&gt;download page&lt;/a&gt; for instructions on how to install Forgejo, and read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-21-1-0&quot;&gt;release notes&lt;/a&gt; for more information.&lt;/p&gt; &lt;h3&gt;Upgrading&lt;/h3&gt; &lt;p&gt;Carefully read &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-21-1-0&quot;&gt;the breaking changes&lt;/a&gt; section of the release notes.&lt;/p&gt; &lt;p&gt;The actual upgrade process is as simple as replacing the binary or container image with the corresponding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.21.1-0&quot;&gt;Forgejo binary&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.21.1-0&quot;&gt;container image&lt;/a&gt;. If you&apos;re using the container images, you can use the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.21&quot;&gt;&lt;code&gt;1.21&lt;/code&gt; tag&lt;/a&gt; to stay up to date with the latest &lt;code&gt;1.21.x&lt;/code&gt; point release automatically.&lt;/p&gt; &lt;p&gt;Make sure to check the &lt;a href=&quot;/docs/v1.21/admin/upgrade&quot;&gt;Forgejo upgrade documentation&lt;/a&gt; for recommendations on how to properly backup your instance before the upgrade. It also covers upgrading from Gitea, as far back as version 1.2.0. Forgejo includes all of Gitea v1.21.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo do not hold back, it is also your project. Open an issue in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;the issue tracker&lt;/a&gt; for feature requests or bug reports, reach out &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop into &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;the Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) and say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo Security Release 1.20.5-1</title><link>https://forgejo.org/2023-11-release-v1-20-5-1/</link><guid isPermaLink="true">https://forgejo.org/2023-11-release-v1-20-5-1/</guid><description>The Forgejo v1.20.5-1 release contains critical security fixes related to permissions enforcement of API endpoints.</description><pubDate>Sat, 25 Nov 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.20.5-1&quot;&gt;Forgejo v1.20.5-1&lt;/a&gt; was released 25 November 2023.&lt;/p&gt; &lt;p&gt;This release contains &lt;em&gt;critical security fixes&lt;/em&gt; related to permissions enforcement of API endpoints.&lt;/p&gt; &lt;p&gt;This release also contains bug fixes, as detailed &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-5-1&quot;&gt;in the release notes&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We &lt;em&gt;strongly recommend&lt;/em&gt; that all Forgejo installations are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;h3&gt;API and web endpoint vulnerable to manually crafted identifiers&lt;/h3&gt; &lt;p&gt;Some API endpoints, such as &lt;a href=&quot;https://code.forgejo.org/api/swagger#/issue/issuePostCommentReaction&quot;&gt;adding a reaction to a comment&lt;/a&gt;, rely on an identifier unique to an object (a comment in this example). There are similar cases for web endpoints which are used by the Forgejo web interface.&lt;/p&gt; &lt;p&gt;The permissions required for the user performing the action on the repository are properly enforced. But a check was missing to ensure that the object (a comment in the example) also belongs to the repository the permissions are checked against. Without this check it is possible both to perform destructive actions and to access information in repositories unrelated to the request, including private ones.&lt;/p&gt; &lt;p&gt;API and web endpoints have been analysed, and those that were missing such a verification can be exploited by a malicious actor to:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;delete releases and tags&lt;/li&gt; &lt;li&gt;delete and modify issues or pull requests comments&lt;/li&gt; &lt;li&gt;reveal the content of issues or pull requests comments from private repositories&lt;/li&gt; &lt;li&gt;perform other non-destructive actions such as creating issues, moving pinned issues, or obtaining deploy public keys&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The vulnerable endpoints were fixed and tests written to verify the fix is effective.&lt;/p&gt; &lt;h3&gt;docker login and 2FA&lt;/h3&gt; &lt;p&gt;When using &lt;code&gt;docker login&lt;/code&gt; to authenticate against a Forgejo instance using basic authentication, there needs to be an additional verification if 2FA is activated for the user. That verification was missing for the API endpoint used by &lt;code&gt;docker login&lt;/code&gt;, thus bypassing 2FA.&lt;/p&gt; &lt;h3&gt;Responsible disclosure to Gitea&lt;/h3&gt; &lt;p&gt;On 25 October 2023 the Forgejo security team identified that multiple API and web endpoints were not protected against manually crafted identifiers, and the Gitea security team was notified. A 30-day embargo was requested, after which a patch to the v1.20 point release could be published. Further research from both Gitea and Forgejo teams in the following days revealed more vulnerabilities. Initial fixes and tests verifying they are effective were exchanged, but after their last email on 31 October 2023 the Gitea security team stopped responding. Given the severity of the vulnerability, the Forgejo security team asked again for feedback on 16 November 2023, but did not get any reply. Having exhausted all options for cooperation, the Forgejo security team completed the security fix on its own. The resulting fix which is published in this release was sent to the Gitea security team encrypted in its final version on 24 November 2023. At the time of publication, there was still no response from the Gitea security team.&lt;/p&gt; &lt;h3&gt;Responsible disclosure to Gogs&lt;/h3&gt; &lt;p&gt;The Gogs developer was notified of the vulnerability on 25 October 2023. There is no encrypted channel and only a terse but unambiguous message was sent. There has been no response.&lt;/p&gt; &lt;h3&gt;Forgejo will give advance warning of security releases&lt;/h3&gt; &lt;p&gt;Similar to what is done when a Go release contains a security fix, Forgejo will now publish advance warning of security releases. They will not reveal the details of the vulnerability but will allow Forgejo admins to plan ahead and better secure their instance. Anyone can watch to the &lt;a href=&quot;https://codeberg.org/forgejo/security-announcements/&quot;&gt;dedicated tracker&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/security-announcements.rss&quot;&gt;subscribe to the RSS feed&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Gogs and Gitea upgrades to Forgejo&lt;/h3&gt; &lt;p&gt;Gitea admins are reminded that Forgejo is a 100% compatible drop-in replacement for Gitea. It is enough to replace the Gitea binary or the container image with Forgejo and restart. No configuration modification is necessary. They are encouraged to choose that option to get this security fix as soon as possible.&lt;/p&gt; &lt;p&gt;In the absence of a security fix for Gogs, it is also possible to try and upgrade Gogs to Forgejo. Note however that such an upgrade will require manual intervention and configuration changes because the upgrade path has not been tested.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - October 2023</title><link>https://forgejo.org/2023-10-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2023-10-monthly-update/</guid><description>A security issue related to Long-term Authentication was fixed for Forgejo v1.21 and backported to Forgejo v1.20.5-0. Four release candidates were published for Forgejo v1.21 and the documentation updated to cover the new functionalities. A service request was published to develop new functionalities for the benefit of German schools. Solutions were also identified for bootstrapping a fully Free Software hosting provider including Forgejo.</description><pubDate>Mon, 23 Oct 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;A security issue identified earlier this year was fixed for Forgejo v1.21 and backported to Forgejo v1.20. It was non trivial and involved a 90-day embargo as well as a database upgrade. Four release candidates for Forgejo v1.21 were published in the &lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases&quot;&gt;experimental organization&lt;/a&gt;. The improvements it contains for Forgejo Actions were documented and are now associated with end to end testing to guard against future regressions.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/28&quot;&gt;service request&lt;/a&gt; originating from German schools in need of additional Forgejo features was published. There are currently no known freelance or company providing Forgejo expertise and discussions happened about what to do with such requests. Solutions were also identified for bootstraping a fully Free Software hosting provider including Forgejo.&lt;/p&gt; &lt;h2&gt;Development&lt;/h2&gt; &lt;h3&gt;Refactor of Long-term Authentication&lt;/h3&gt; &lt;p&gt;When a user logs into Forgejo, they can click the &lt;strong&gt;Remember This Device&lt;/strong&gt; checkbox and their browser will store a &lt;strong&gt;Long-term authentication&lt;/strong&gt; token provided by the server, in a cookie that will allow them to stay logged in for a number of days as defined by the &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/config-cheat-sheet/#security-security&quot;&gt;&lt;code&gt;LOGIN_REMEMBER_DAYS&lt;/code&gt;&lt;/a&gt; setting.&lt;/p&gt; &lt;p&gt;Given a copy of the Forgejo database, a &lt;strong&gt;Long-term authentication&lt;/strong&gt; token could be constructed for any user and used to impersonate them. Such a token did not expire &lt;code&gt;LOGIN_REMEMBER_DAYS&lt;/code&gt; days after it was created and remained valid for as long as users did not change their password.&lt;/p&gt; &lt;p&gt;This security issue does not require brute force and was the most significant discovered this year. A fix was published by the &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#security&quot;&gt;Forgejo security team&lt;/a&gt; on &lt;a href=&quot;https://forgejo.org/2023-10-release-v1-20-5-0/&quot;&gt;6 October 2023&lt;/a&gt; after a &lt;a href=&quot;https://forgejo.org/2023-10-release-v1-20-5-0/#responsible-disclosure-to-gitea&quot;&gt;90-day embargo&lt;/a&gt; and was backported to &lt;a href=&quot;https://forgejo.org/2023-10-release-v1-20-5-0/&quot;&gt;Forgejo v1.20.5-0&lt;/a&gt; the same day.&lt;/p&gt; &lt;h3&gt;v1.21 release candidates&lt;/h3&gt; &lt;p&gt;The Forgejo v1.21 release candidate cycle is coming to an end, with &lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases&quot;&gt;four releases&lt;/a&gt;, published in the &lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases&quot;&gt;experimental organization&lt;/a&gt;. They are now used daily on the &lt;a href=&quot;https://code.forgejo.org&quot;&gt;https://code.forgejo.org&lt;/a&gt; and &lt;a href=&quot;https://next.forgejo.org&quot;&gt;https://next.forgejo.org&lt;/a&gt; instances and all the release blockers discovered so far were fixed.&lt;/p&gt; &lt;p&gt;Tests were conducted on a simulation of a Codeberg upgrade to verify the database migration was fast enough, despite some operations that were potentially expensive on large tables.&lt;/p&gt; &lt;p&gt;End-to-end testing for Forgejo v1.20 is part of the &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo&quot;&gt;setup-forgejo&lt;/a&gt; action testsuite. It was extended to &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo/src/branch/main/.forgejo/workflows/integration.yml#L14-L17&quot;&gt;include the Forgejo v1.21 release candidates&lt;/a&gt; and new tests for the Forgejo Actions features that did not exist in Forgejo v1.20.&lt;/p&gt; &lt;h3&gt;Federation&lt;/h3&gt; &lt;p&gt;&lt;a href=&quot;https://forgeflux.org/&quot;&gt;ForgeFlux&lt;/a&gt; is working towards providing compliance testing for the forge federation ecosystem using a tool called &lt;a href=&quot;https://docs.forgeflux.org/ftest/introduction&quot;&gt;&quot;ftest&quot;&lt;/a&gt;. The tool ran successfully against Forgejo and produced &lt;a href=&quot;https://docs.forgeflux.org/example/ftest/results/targets/forgejo/results&quot;&gt;this compliance report&lt;/a&gt; proving the correctness of Forgejo&apos;s work-in-progress implementation.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://f3.forgefriends.org/&quot;&gt;F3&lt;/a&gt; Forgejo driver is on pause while the &lt;a href=&quot;https://lab.forgefriends.org/friendlyforgeformat/gof3&quot;&gt;gof3&lt;/a&gt; package is undergoing a &lt;a href=&quot;https://lab.forgefriends.org/friendlyforgeformat/gof3/-/merge_requests/90/commits&quot;&gt;complete refactor&lt;/a&gt;. The API will be roughly the same and allow to copy data from one forge to another.&lt;/p&gt; &lt;h2&gt;Forgejo service providers&lt;/h2&gt; &lt;p&gt;Forgejo exists under the umbrella of Codeberg which is a non-profit organization. But it can be used by freelancers or for-profit companies to generate an income. Just like there are many service providers using Git which exists under the umbrella of &lt;a href=&quot;https://sfconservancy.org/projects/current/&quot;&gt;Software Freedom Conservancy&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Professional services&lt;/h3&gt; &lt;p&gt;When someone needs a Forgejo instance of their own but does not have the resources to maintain and improve upon it, they should be able to find help, for a fee. For instance the German state of &lt;a href=&quot;https://en.wikipedia.org/wiki/Baden-W%C3%BCrttemberg&quot;&gt;Baden-Württemberg&lt;/a&gt; needs &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/28&quot;&gt;additional features&lt;/a&gt; to deploy Forgejo in German schools next year. The new development could then be contributed back to Forgejo and be available for all.&lt;/p&gt; &lt;h3&gt;Hosting provider&lt;/h3&gt; &lt;p&gt;If someone is looking for a hosting provider where they can rent their own Forgejo instance and Forgejo runner without being bothered by upgrades, they currently have nowhere to go.&lt;/p&gt; &lt;p&gt;The easiest solution would be that Forgejo is part of the application portfolio of an existing hosting providers. But none of them is powered by Free Software and the Forgejo instance would be trapped: migrating to another hosting provider would require a significant effort.&lt;/p&gt; &lt;p&gt;There are two fully Free Software stacks providing &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/72&quot;&gt;a turnkey solution to setup a hosting service provider&lt;/a&gt;. One of them is unmaintained and &lt;a href=&quot;https://fossbilling.org/&quot;&gt;the other&lt;/a&gt; needs a Forgejo driver.&lt;/p&gt; &lt;h2&gt;Documentation&lt;/h2&gt; &lt;p&gt;The bulk of the documentation updates relate to the new Forgejo v1.21 features of Forgejo Action in the &lt;a href=&quot;https://forgejo.org/docs/v1.21/user/actions/&quot;&gt;user&lt;/a&gt; and &lt;a href=&quot;https://forgejo.org/docs/v1.21/user/actions/&quot;&gt;admin&lt;/a&gt; sections. They are associated with &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo/src/branch/main/testdata&quot;&gt;examples and tests&lt;/a&gt; that help understand how they actually work.&lt;/p&gt; &lt;p&gt;A round of updates was also done by harvesting documentation improvements &lt;a href=&quot;89c24509f03ea3fe1cbea866180dee8019e7e48f&quot;&gt;from Codeberg&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/docs/commit/0b81e66c45cc6a7a24306a948707e8ee01361876&quot;&gt;from Gitea&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Forgejo Actions&lt;/h2&gt; &lt;h3&gt;Runner 3.0.1&lt;/h3&gt; &lt;p&gt;A number of actions (e.g. &lt;a href=&quot;https://code.forgejo.org/actions/checkout/src/tag/v4&quot;&gt;checkout@v4&lt;/a&gt;) now depend on node 20 which was only recently supported by &lt;a href=&quot;https://code.forgejo.org/forgejo/act&quot;&gt;ACT&lt;/a&gt; on top of which the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;Forgejo runner&lt;/a&gt; is based. The &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/RELEASE-NOTES.md#301&quot;&gt;Forgejo runner 3.0.1&lt;/a&gt; contains that upgrade.&lt;/p&gt; &lt;h3&gt;The cascading-pr action&lt;/h3&gt; &lt;p&gt;Forgejo is not a mono-repository project. It is made up of several software projects that have their own release cycle in multiple repositories. Synchronizing them is sometimes challenging, as demonstrated by the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/tag/v3.0.0/README.md#hacking&quot;&gt;rather involved&lt;/a&gt; test instructions of the Forgejo runner.&lt;/p&gt; &lt;p&gt;To simplify the development workflow a new action was developed. &lt;a href=&quot;https://code.forgejo.org/actions/cascading-pr/&quot;&gt;cascading-pr&lt;/a&gt; can be used in the workflow of a repository to verify that a proposed change won&apos;t break anything when a dependent software upgrades. For instance, when a pull request is opened in the Forgejo runner, a &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/.forgejo/workflows/cascade-setup-forgejo.yml&quot;&gt;workflow&lt;/a&gt; will also &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo/pulls/68/files&quot;&gt;open a pull request&lt;/a&gt; in setup-forgejo.&lt;/p&gt; &lt;p&gt;If the CI passes on setup-forgejo, it is an additional confirmation that the proposed change in Forgejo runner does not contain a regression that would break setup-forgejo once released.&lt;/p&gt; &lt;h2&gt;Governance and communication&lt;/h2&gt; &lt;h3&gt;Gitea copyright assignment&lt;/h3&gt; &lt;p&gt;Code contributions to Gitea now &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/67&quot;&gt;require a copyright assignment&lt;/a&gt;. It does not impact the most trivial bug fixes because they are not subject to copyright. But it means that it is not enough for a contribution to be released under the MIT license, all copyright headers must also be removed.&lt;/p&gt; &lt;p&gt;This new requirement was discovered when the Forgejo security team contributed the fix for the Long-term Authentication security issue explained above. It contained files with a &lt;code&gt;Copyright Forgejo&lt;/code&gt; header in addition to the &lt;code&gt;Copyright Gitea&lt;/code&gt; header and was blocked for that reason. The author of the patch agreed under protest to remove their copyright headers for the sake of Gitea admin security.&lt;/p&gt; &lt;h3&gt;FOSDEM 2024&lt;/h3&gt; &lt;p&gt;Plans are made to organize a &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/65&quot;&gt;Forgejo and Codeberg presence&lt;/a&gt; at &lt;a href=&quot;https://fosdem.org/2024/&quot;&gt;FOSDEM 2024&lt;/a&gt;. If you would like to participate, feel free to reach out in the &lt;a href=&quot;https://matrix.to/#/#forgejo-development:matrix.org&quot;&gt;development chatroom&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Moderation&lt;/h3&gt; &lt;p&gt;The moderation team currently has just one person, which is problematic when they are involved in a moderation action. A new member &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/35&quot;&gt;proposed their participation&lt;/a&gt; to remedy this.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/BradBot1&quot;&gt;https://codeberg.org/BradBot1&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/buhtz&quot;&gt;https://codeberg.org/buhtz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DanielGibson&quot;&gt;https://codeberg.org/DanielGibson&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dikey0ficial&quot;&gt;https://codeberg.org/dikey0ficial&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ell1e&quot;&gt;https://codeberg.org/ell1e&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fasterthanlime&quot;&gt;https://codeberg.org/fasterthanlime&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fluzz&quot;&gt;https://codeberg.org/fluzz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/gmem&quot;&gt;https://codeberg.org/gmem&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/grisha&quot;&gt;https://codeberg.org/grisha&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hazy&quot;&gt;https://codeberg.org/hazy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KOLANICH&quot;&gt;https://codeberg.org/KOLANICH&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/leana8959&quot;&gt;https://codeberg.org/leana8959&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lm41&quot;&gt;https://codeberg.org/lm41&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/magicfelix&quot;&gt;https://codeberg.org/magicfelix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/maltejur&quot;&gt;https://codeberg.org/maltejur&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mikaela&quot;&gt;https://codeberg.org/Mikaela&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mlncn&quot;&gt;https://codeberg.org/mlncn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nezbednik&quot;&gt;https://codeberg.org/nezbednik&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/nyncral&quot;&gt;https://codeberg.org/nyncral&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/realaravinth&quot;&gt;https://codeberg.org/realaravinth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rome-user&quot;&gt;https://codeberg.org/rome-user&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ryan-distrust.co&quot;&gt;https://codeberg.org/ryan-distrust.co&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Sertonix&quot;&gt;https://codeberg.org/Sertonix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/smxi&quot;&gt;https://codeberg.org/smxi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/strypey&quot;&gt;https://codeberg.org/strypey&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tgy&quot;&gt;https://codeberg.org/tgy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xfix&quot;&gt;https://codeberg.org/xfix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xy&quot;&gt;https://codeberg.org/xy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zareck&quot;&gt;https://codeberg.org/zareck&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo Security Release 1.20.5-0</title><link>https://forgejo.org/2023-10-release-v1-20-5-0/</link><guid isPermaLink="true">https://forgejo.org/2023-10-release-v1-20-5-0/</guid><description>The Forgejo v1.20.5-0 release adds protection to prevent a malicious actor from impersonating Forgejo users by using a copy of the database.</description><pubDate>Fri, 06 Oct 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Today &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.20.5-0&quot;&gt;Forgejo v1.20.5-0&lt;/a&gt; was released.&lt;/p&gt; &lt;p&gt;This release contains an &lt;em&gt;important security fix&lt;/em&gt; that adds protection to prevent a malicious actor from impersonating Forgejo users by using a copy of the database, as described below.&lt;/p&gt; &lt;p&gt;This release also contains bug fixes, as detailed &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-5-0&quot;&gt;in the release notes&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We &lt;em&gt;strongly recommend&lt;/em&gt; that all Forgejo installations are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;h3&gt;Long term authentication token&lt;/h3&gt; &lt;p&gt;When a user logs into Forgejo, they can click the &lt;strong&gt;Remember This Device&lt;/strong&gt; checkbox and their browser will store a &lt;strong&gt;Long-term authentication&lt;/strong&gt; token provided by the server, in a cookie that will allow them to stay logged in for a number of days as defined by the &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/config-cheat-sheet/#security-security&quot;&gt;&lt;code&gt;LOGIN_REMEMBER_DAYS&lt;/code&gt;&lt;/a&gt; setting.&lt;/p&gt; &lt;h4&gt;Impersonation&lt;/h4&gt; &lt;p&gt;Given a copy of the Forgejo database, a &lt;strong&gt;Long-term authentication&lt;/strong&gt; token can be constructed for any user and used to impersonate them. Such a token does not expire &lt;code&gt;LOGIN_REMEMBER_DAYS&lt;/code&gt; days after it was created and remains valid for as long as users do not change their password.&lt;/p&gt; &lt;p&gt;The construction of such a token does not involve any kind of brute-force or cracking, it only requires the values as stored literally in the database.&lt;/p&gt; &lt;h4&gt;Protection&lt;/h4&gt; &lt;p&gt;The former implementation was inherently insecure, because it allowed the &lt;strong&gt;Long-term authentication&lt;/strong&gt; token to be constructed from the database alone. It is &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/51988ef52bc93b63184d28395d10bf3b76914ad0&quot;&gt;reworked&lt;/a&gt; to require additional information from the user cookie. The idea &lt;a href=&quot;https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies&quot;&gt;is derived from a 2015 blog post&lt;/a&gt; where it is explained in more detail.&lt;/p&gt; &lt;h3&gt;Responsible disclosure to Gitea&lt;/h3&gt; &lt;p&gt;On 6 July 2023 the &lt;a href=&quot;https://forgejo.org/.well-known/security.txt&quot;&gt;Forgejo security team&lt;/a&gt; notified the Gitea security team that the mechanism responsible for long-term authentication (the &apos;remember me&apos; cookie) uses a weak construction technique. A possible solution was suggested together with a more detailed explanation. We requested a 90 days embargo, after which a patch to the v1.20 point release could be published.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo v1.21 release candidates</title><link>https://forgejo.org/2023-09-release-v1210-0-rc0/</link><guid isPermaLink="true">https://forgejo.org/2023-09-release-v1210-0-rc0/</guid><description>The first Forgejo v1.21 release candidate is ready for testing. In addition to many improvements to `Forgejo Actions` it also includes an improved issue search, a hint to speed up the creation of newly pushed branches, the ability to archive labels and more.</description><pubDate>Fri, 22 Sep 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Today the first release candidate for the upcoming Forgejo v1.21 release &lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.21.0-0-rc0&quot;&gt;was published&lt;/a&gt;. It is meant for testing only: &lt;strong&gt;do not upgrade a production instance with it&lt;/strong&gt;.&lt;/p&gt; &lt;p&gt;Beside a number of improvements to &lt;code&gt;Forgejo Actions&lt;/code&gt; (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/35a653d7edbe0d693649604b8309bfc578dd988b&quot;&gt;variables&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/0d55f64e6cd3de2e1e5c0ee795605823efb14231&quot;&gt;cron&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/19872063a3c14256a1d89b2a104d63e7538a3a28&quot;&gt;disabling workflows&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/460a2b0edffe71d9e64633beaa1071fcf4a33369&quot;&gt;artifacts cleanup&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/44781f9f5c4ede618660d8cfe42437f0e8dc22a0&quot;&gt;auto-cancellation of concurrent jobs&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/f3d293d2bbe0b2eab047bdd403046069cffbc0c4&quot;&gt;multiple artifacts&lt;/a&gt; and more), the most prominent new features are:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/6375419468edc95fdfac94aac3b0e10b23743557&quot;&gt;Newly pushed branches show in the web UI with a link to create a PR&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;Improved &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/1e76a824bcd71acd59cdfb2c4547806bc34b3d86&quot;&gt;issue search&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;Admins can be notified via &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/7d2d9970115c94954dacb45684f9e3c16117ebfe&quot;&gt;email when a new user registers&lt;/a&gt; to help fight spam bots.&lt;/li&gt; &lt;li&gt;Labels that are no longer useful &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/cafce3b4b5afb3f254a48e87f1516d7b5dc209b6&quot;&gt;can be archived&lt;/a&gt;. They can no longer be selected but they remain on existing issues.&lt;/li&gt; &lt;li&gt;When a PR contains multiple commits, it is now &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/55532061c83d38d33ef48bdc5eeac0f652844e8a&quot;&gt;possible review to each commit independently&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;In addition to the cron jobs defined to cleanup packages, it is now &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/0c6ae61229bce9d9ad3d359cee927464968a2dd1&quot;&gt;also possible to trigger the cleanup manually&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;The &lt;code&gt;CODEOWNERS&lt;/code&gt; file is interpreted to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/3bdd48016f659c440d6e8bb57386fab7ad7b357b&quot;&gt;automatically set reviewers on PRs&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;To improve performances, branch information is &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/6e19484f4d3bf372212f2da462110a1a8c10cbf2&quot;&gt;now cached in a database table&lt;/a&gt;.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#draft-1-21-0-0&quot;&gt;draft release notes&lt;/a&gt; will be completed in the following weeks. Make sure to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md&quot;&gt;check the breaking changes&lt;/a&gt; and get your production instance ready for when the v1.21 release is available.&lt;/p&gt; &lt;p&gt;There also was progress regarding federation with the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commits/branch/forgejo-f3&quot;&gt;F3 driver and its CLI&lt;/a&gt; (an essential building block to synchronize forges with each other) but nothing is ready for experimenting yet.&lt;/p&gt; &lt;h3&gt;Try it out&lt;/h3&gt; &lt;p&gt;The release candidate is published in &lt;a href=&quot;https://codeberg.org/forgejo-experimental&quot;&gt;the dedicated &quot;experimental&quot; Forgejo organization&lt;/a&gt; and can be downloaded from:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Containers at &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/1.21&quot;&gt;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/1.21&lt;/a&gt;&lt;/li&gt; &lt;li&gt;Binaries at &lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.21.0-0-rc0&quot;&gt;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.21.0-0-rc0&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Check out the v1.21 documentation section for detailed &lt;a href=&quot;/docs/v1.21/admin/installation&quot;&gt;installation instructions&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;It will be updated based on your feedback until it becomes robust enough to be released.&lt;/p&gt; &lt;h3&gt;Help write good release notes&lt;/h3&gt; &lt;p&gt;The best release notes are meant to articulate the needs and benefits of new features and the actions recommended for breaking changes so Forgejo admins quickly know if it is of interest to them.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#draft-1-21-0-0&quot;&gt;current draft release notes&lt;/a&gt; are still incomplete. They will be finished by the time the release is published and you can help make them better.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;the issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;the Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - September 2023</title><link>https://forgejo.org/2023-09-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2023-09-monthly-update/</guid><description>The lifecycle of Forgejo v1.20 is coming to an end and v1.21 is entering the release candidate phase this week. There is every reason to believe this new release will go smoothly, but that should not hide the fact that there is a pressing need for more contributors. The storage settings regressions from v1.20.2-0 required more work but the issue is now resolved.</description><pubDate>Thu, 21 Sep 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;The lifecycle of Forgejo v1.20 is coming to an end and v1.21 is entering the release candidate phase this week. In addition to work on the codebase a lot also happened on the &lt;a href=&quot;https://codeberg.org/Forgejo/website&quot;&gt;website&lt;/a&gt;, the &lt;a href=&quot;https://codeberg.org/Forgejo/documentation&quot;&gt;documentation&lt;/a&gt; and the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;Forgejo runner&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Judging from the activity of Forgejo contributors, there is every reason to believe this new release will go smoothly. No-one is overworked or stressed, dependencies are up to date, features are added, the technical debt is kept in check and it looks like it could go on forever. But that should not hide the fact that there are &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/53&quot;&gt;many areas where progress could happen&lt;/a&gt; if only there were more contributors.&lt;/p&gt; &lt;p&gt;The past month was again dominated by the aftermath of the &lt;a href=&quot;https://forgejo.org/2023-08-release-v1-20-3-0&quot;&gt;storage settings regressions&lt;/a&gt; but this unfortunate episode is, at last, concluded. It was a lesson for everyone involved on how to manage bugs that require action from the Forgejo admins because they cannot be fixed with a new release and an unattended upgrade. The recipe is simple enough but also quite time consuming: understand the problem, write tests to verify the conclusions, clearly explain what happened and provide detailed recovery recommendations.&lt;/p&gt; &lt;h2&gt;Development&lt;/h2&gt; &lt;h3&gt;Fixing S3 configuration bugs and regressions&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/storage/&quot;&gt;storage configuration&lt;/a&gt; regressions fixed with the &lt;a href=&quot;https://forgejo.org/2023-08-release-v1-20-3-0/#fixing-the-risk-of-data-loss-related-to-storage-sections&quot;&gt;Forgejo v1.20.3-0&lt;/a&gt; release were verified with newly introduced &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/tag/v1.20.3-0/.forgejo/upgrades/test-upgrade.sh#L268-L271&quot;&gt;upgrade tests&lt;/a&gt;. They were focused on local storage and assumed S3 configuration was not subject to the same issues.&lt;/p&gt; &lt;p&gt;This assumption was not verified with any test and turned out to be wrong. A Forgejo instance setup to use &lt;a href=&quot;https://garagehq.deuxfleurs.fr/&quot;&gt;garage&lt;/a&gt; instead of MinIO faced two simultaneous issues blocking the upgrade: the storage unexpectedly went from being in the filesystem to S3, and the S3 backend failed to initialize. The failure to initialize was a rather simple error in the settings, hidden behind a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1365&quot;&gt;non human readable&lt;/a&gt; error message. With a configuration change, the Forgejo instance was upgraded successfully.&lt;/p&gt; &lt;p&gt;To help other Forgejo admins running into these bugs the storage documentation was &lt;a href=&quot;https://codeberg.org/forgejo/docs/pulls/100&quot;&gt;updated&lt;/a&gt; with examples and references. The recommendations in the &lt;a href=&quot;https://forgejo.org/2023-08-release-v1-20-3-0/#fixing-the-risk-of-data-loss-related-to-storage-sections&quot;&gt;Forgejo v1.20.3-0 blog post&lt;/a&gt; were also extensively updated to address both S3 and local storage. They were verified with &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/a4369782e1cfbbc6f588c0cda5776ee823b0e493/.forgejo/upgrades/test-upgrade.sh#L577-L588&quot;&gt;more upgrade tests&lt;/a&gt; that do the following for a variety of storage configurations:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;start an S3 server&lt;/li&gt; &lt;li&gt;start a Forgejo instance at a given version&lt;/li&gt; &lt;li&gt;upload objects into all subsystems (avatars, packages, attachments, etc.)&lt;/li&gt; &lt;li&gt;verify they are found where they are supposed to be&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The upgrade tests are run before each pull request is merged. They can also be extended to identify breaking changes between major Forgejo versions and verify the recommended actions to deal with them are accurate.&lt;/p&gt; &lt;h3&gt;Changing the update time of issues via the API&lt;/h3&gt; &lt;p&gt;The pull request to allow for setting the update times of issues and comments via the API &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/764&quot;&gt;was merged&lt;/a&gt;. It is one of the most fragile commits in Forgejo and was made significantly more robust with an extensive set of tests.&lt;/p&gt; &lt;p&gt;When upgrading Forgejo dependencies, Forgejo can be impacted in two ways:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;the API or the codebase changed and Forgejo won&apos;t compile&lt;/li&gt; &lt;li&gt;there is no conflict but the &lt;strong&gt;behavior&lt;/strong&gt; changed in an incompatible way, and Forgejo tests will fail&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The Forgejo codebase is organized in a set of about 100 commits (as of today) and heavily relies on tests during upgrades. It allows maintainers to focus on meaningful problems instead of spending their valuable time manually verifying, over and over, the same features keep working.&lt;/p&gt; &lt;h3&gt;User blocking&lt;/h3&gt; &lt;p&gt;When a user tries to transfer a repository to a user or organization that has blocked them, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1436&quot;&gt;that transfer is denied&lt;/a&gt;. Pre-existing transfer requests are also denied when the user is blocked. &lt;a href=&quot;https://forgejo.org/docs/v1.21/user/blocking-user/&quot;&gt;Read more in the moderation section of the documentation&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;See &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?state=closed&amp;amp;labels=120787&quot;&gt;all moderation pull requests&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Publishing development versions&lt;/h3&gt; &lt;p&gt;A few months ago it was &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/51&quot;&gt;proposed to publish Forgejo development versions&lt;/a&gt; on a weekly basis. This has happened in the past month and is what &lt;a href=&quot;https://next.forgejo.org&quot;&gt;https://next.forgejo.org&lt;/a&gt; is running. The version number is something like &lt;code&gt;vX.Y.Z-test&lt;/code&gt;, to clearly state it is not to be used for real.&lt;/p&gt; &lt;h3&gt;Federation&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://f3.forgefriends.org/&quot;&gt;F3&lt;/a&gt; Forgejo driver entered a new &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?state=closed&amp;amp;labels=114735&quot;&gt;development phase&lt;/a&gt;. It goes like this:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;code&gt;forgejo-cli f3 mirror&lt;/code&gt; is run for upload or download on an existing repository&lt;/li&gt; &lt;li&gt;a bug shows and is fixed either in:&lt;ul&gt; &lt;li&gt;the &lt;a href=&quot;https://lab.forgefriends.org/friendlyforgeformat/gof3&quot;&gt;gof3 package&lt;/a&gt;&lt;/li&gt; &lt;li&gt;the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo-f3/services/f3/driver&quot;&gt;Forgejo driver&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;/li&gt; &lt;li&gt;repeat&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;It is still experimental.&lt;/p&gt; &lt;p&gt;See &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?state=closed&amp;amp;labels=114735&quot;&gt;all F3 pull requests&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;CURL based Forgejo client&lt;/h3&gt; &lt;p&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/forgejo-curl&quot;&gt;forgejo-curl.sh&lt;/a&gt; is a new thin curl wrapper that helps with Forgejo authentication. Beyond that it does not provide anything. It is low maintenance because it only relies on the authentication logic and does not need updating when the REST API (or the web UI endpoints) change.&lt;/p&gt; &lt;h2&gt;Website and documentation&lt;/h2&gt; &lt;p&gt;&lt;a href=&quot;https://astro.build/&quot;&gt;Astro&lt;/a&gt; was &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/362&quot;&gt;upgraded to version 3&lt;/a&gt;, and further improvements were made to the file layout to further separate content from code.&lt;/p&gt; &lt;p&gt;A number of small improvements were made, including a &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/366&quot;&gt;switch to system fonts&lt;/a&gt; to improve performance and fix a layout issue which sometimes caused scroll anchors to misbehave.&lt;/p&gt; &lt;p&gt;The documentation content &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/331&quot;&gt;was moved&lt;/a&gt; to &lt;a href=&quot;https://codeberg.org/forgejo/docs&quot;&gt;its own dedicated repository&lt;/a&gt; to ease contribution and separate the content from the website code.&lt;/p&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/docs#contributing&quot;&gt;Detailed instructions&lt;/a&gt; are now provided for working locally on the documentation. Tooling is available to preview the results before sending a PR, and to fix linting errors. A Git hook helps to ensure badly-formatted content is not committed, and the Forgejo Actions CI helps to apply checks to the content before PRs are merged, as well as helping to backport changes to older versions of the docs where necessary.&lt;/p&gt; &lt;p&gt;Creating previews for documentation PRs without exposing secrets is not a trivial problem. Some CI have a setting to take the risk. But Forgejo Actions does not work that way and that &lt;a href=&quot;https://codeberg.org/forgejo/docs/issues/89&quot;&gt;requires a different&lt;/a&gt; strategy, similar to what is used when publishing Forgejo releases in order to protect the release signing key. It depends on a feature that will only be available in v1.21 and it needs more manual work in the meantime.&lt;/p&gt; &lt;h2&gt;Forgejo Actions&lt;/h2&gt; &lt;p&gt;The actions supporting the Forgejo runner release process are grouped into a new repository, &lt;a href=&quot;https://code.forgejo.org/forgejo/forgejo-build-publish/&quot;&gt;forgejo-build-publish&lt;/a&gt;. The &lt;a href=&quot;https://code.forgejo.org/forgejo/forgejo-build-publish/src/branch/main/build&quot;&gt;build phase&lt;/a&gt; and the &lt;a href=&quot;https://code.forgejo.org/forgejo/forgejo-build-publish/src/branch/main/publish&quot;&gt;publishing phase&lt;/a&gt;. They are not new actions, they were copy/pasted from the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/v1.20/forgejo/.forgejo/actions&quot;&gt;Forgejo main repository&lt;/a&gt;, generalized to also be usable for the runner and verified with &lt;a href=&quot;https://code.forgejo.org/forgejo/forgejo-build-publish/src/branch/main/.forgejo/workflows/build-publish-integration.yml&quot;&gt;integration tests&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/releases/tag/v3.0.0&quot;&gt;new version of the Forgejo runner&lt;/a&gt; that came out of this new release process has binaries named differently than before and unified with the Forgejo binary naming scheme.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://code.forgejo.org/forgejo/-/packages/container/runner/3.0.0&quot;&gt;container image&lt;/a&gt; already existed but was not supported or thought through. It is now &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/.forgejo/workflows/example-docker-compose.yml&quot;&gt;tested&lt;/a&gt; and documented with a standalone &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/examples/docker-compose&quot;&gt;docker-compose example&lt;/a&gt; that is verified to work.&lt;/p&gt; &lt;p&gt;The container image only contains the runner binary and does not run as root. The &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/examples/docker-compose&quot;&gt;docker-compose example&lt;/a&gt; shows there is no need for anything else, even when using &lt;code&gt;docker:dind&lt;/code&gt;.&lt;/p&gt; &lt;h2&gt;Infrastructure&lt;/h2&gt; &lt;p&gt;The infrastructure as well as the runner backends rely on &lt;a href=&quot;https://linuxcontainers.org/lxc/&quot;&gt;LXC system containers&lt;/a&gt; and use &lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers/&quot;&gt;lxc-helpers.sh&lt;/a&gt; to implement patterns common to Forgejo. Among other things, it sets the permissions of the container to run docker, nested LXC or libvirt but lacked flexibility to:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Add more permissions to run a kubernetes cluster&lt;/li&gt; &lt;li&gt;Restrict permissions for better isolation&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The new &lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers/#usage&quot;&gt;&lt;code&gt;--config&lt;/code&gt; option&lt;/a&gt; provides a range of pre-defined permissions to remedy that problem. It includes &lt;code&gt;k8s&lt;/code&gt; which is &lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers/src/branch/main/.forgejo/workflows/test.yml&quot;&gt;tested&lt;/a&gt; to work when &lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers/src/commit/e59af3f4257d6baff880b4cdbcaf9d1de1f28b60/lxc-helpers-lib-test.sh#L153-L171&quot;&gt;installing&lt;/a&gt; &lt;a href=&quot;https://www.rancher.com/products/k3s&quot;&gt;k3s&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;Governance and communication&lt;/h2&gt; &lt;h3&gt;Contributors team&lt;/h3&gt; &lt;p&gt;The Forgejo &quot;contributors&quot; team was created informally and liberally to grant permissions to label issue, manage CIs and pull requests etc. To make it official it was formally proposed &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/32&quot;&gt;in the governance repository&lt;/a&gt; to be decided according to the &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/DECISION-MAKING.md&quot;&gt;decision making process&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Debconf23&lt;/h3&gt; &lt;p&gt;There were discussions about Forgejo at &lt;a href=&quot;https://debconf23.debconf.org/&quot;&gt;Debconf23&lt;/a&gt; and a contributor to FreedomBox was interested in packaging Forgejo for Debian so that it can be distributed with FreedomBox. They could join the &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-deb&quot;&gt;forgejo-deb&lt;/a&gt; which already provides functional Debian GNU/Linux packages.&lt;/p&gt; &lt;h3&gt;Sustainability&lt;/h3&gt; &lt;p&gt;A new &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/53&quot;&gt;discussion started&lt;/a&gt; on how to absorb the workload from the Forgejo issue tracker. There is no conclusion or action planned and the problem unfortunately remains. However, Codeberg independently &lt;a href=&quot;https://codeberg.org/Codeberg/Contributing/issues/37&quot;&gt;sent a call for help&lt;/a&gt; to get help with handling their scaling issues and it will hopefully attract more contributors to Forgejo.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls/24&quot;&gt;second payment&lt;/a&gt; of the &lt;a href=&quot;https://codeberg.org/forgejo/sustainability#2023&quot;&gt;NLnet grant&lt;/a&gt; was received. In total 40% of &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/src/branch/main/2022-12-01-nlnet/2023-06-workplan.md&quot;&gt;the workplan&lt;/a&gt; approved for the grant in June 2023 was implemented.&lt;/p&gt; &lt;h3&gt;Moderation&lt;/h3&gt; &lt;p&gt;Earlier this year ad-hominem attacks were published in the Forgejo spaces. This goes against the Forgejo Code of Conduct and some of these messages were redacted. The author repeatedly refused to acknowledge this was not an acceptable behavior in Forgejo spaces and recently sent threats to publish more ad-hominem attacks. &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/31&quot;&gt;Read more in the moderation report&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Adrodoc&quot;&gt;https://codeberg.org/Adrodoc&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/alex19srv&quot;&gt;https://codeberg.org/alex19srv&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/alrs&quot;&gt;https://codeberg.org/alrs&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Andre601&quot;&gt;https://codeberg.org/Andre601&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/belette&quot;&gt;https://codeberg.org/belette&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/brainchild&quot;&gt;https://codeberg.org/brainchild&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/CSDUMMI&quot;&gt;https://codeberg.org/CSDUMMI&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/cyborus&quot;&gt;https://codeberg.org/cyborus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/daenney&quot;&gt;https://codeberg.org/daenney&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DanielGibson&quot;&gt;https://codeberg.org/DanielGibson&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DansLeRuSH&quot;&gt;https://codeberg.org/DansLeRuSH&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/firefly-cpp&quot;&gt;https://codeberg.org/firefly-cpp&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Fl1tzi&quot;&gt;https://codeberg.org/Fl1tzi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/flightkick&quot;&gt;https://codeberg.org/flightkick&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fluzz&quot;&gt;https://codeberg.org/fluzz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GamePlayer-8&quot;&gt;https://codeberg.org/GamePlayer-8&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/glts&quot;&gt;https://codeberg.org/glts&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/gmem&quot;&gt;https://codeberg.org/gmem&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jetsung&quot;&gt;https://codeberg.org/jetsung&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mainboarder&quot;&gt;https://codeberg.org/mainboarder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mctaylors&quot;&gt;https://codeberg.org/mctaylors&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/meyay&quot;&gt;https://codeberg.org/meyay&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mikaela&quot;&gt;https://codeberg.org/Mikaela&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/noisytoot&quot;&gt;https://codeberg.org/noisytoot&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/RaptaG&quot;&gt;https://codeberg.org/RaptaG&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/realaravinth&quot;&gt;https://codeberg.org/realaravinth&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rome-user&quot;&gt;https://codeberg.org/rome-user&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rrahl0&quot;&gt;https://codeberg.org/rrahl0&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Schoumi&quot;&gt;https://codeberg.org/Schoumi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thepaperpilot&quot;&gt;https://codeberg.org/thepaperpilot&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/therealpim&quot;&gt;https://codeberg.org/therealpim&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/valvin&quot;&gt;https://codeberg.org/valvin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wh0ami&quot;&gt;https://codeberg.org/wh0ami&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Wild-Turtles&quot;&gt;https://codeberg.org/Wild-Turtles&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xy&quot;&gt;https://codeberg.org/xy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yeziruo&quot;&gt;https://codeberg.org/yeziruo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yoctozepto&quot;&gt;https://codeberg.org/yoctozepto&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zareck&quot;&gt;https://codeberg.org/zareck&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo Security Release 1.20.3-0</title><link>https://forgejo.org/2023-08-release-v1-20-3-0/</link><guid isPermaLink="true">https://forgejo.org/2023-08-release-v1-20-3-0/</guid><description>Forgejo v1.20.3-0 stable release update prevents leaking emails via the API and includes a safeguard to avoid data loss in case `[storage*]` sections in the `app.ini` file do not pass sanity checks.</description><pubDate>Mon, 21 Aug 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Today &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.20.3-0&quot;&gt;Forgejo v1.20.3-0&lt;/a&gt; was released.&lt;/p&gt; &lt;p&gt;This release includes safeguards in case &lt;code&gt;[storage].PATH&lt;/code&gt; is set or conflicting storage sections are found in the &lt;code&gt;app.ini&lt;/code&gt; file. For instance if both &lt;code&gt;[storage.packages]&lt;/code&gt; and &lt;code&gt;[packages]&lt;/code&gt; exist, the directory in which the packages are stored may change after the upgrade. Forgejo will refuse to upgrade from &lt;code&gt;v1.20.2-0&lt;/code&gt; (or an earlier version) if the sanity checks fail and require manual intervention to avoid data loss, as described below.&lt;/p&gt; &lt;p&gt;It also contains a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/4fd8ac0653b95fc204eade4471734b23039bca13&quot;&gt;security fix that prevents leaking emails via the API&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Technical details of these bug fixes are available &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-3-0&quot;&gt;in the release notes&lt;/a&gt;.&lt;/p&gt; &lt;blockquote&gt; &lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt; this blog post was updated early September 2023 for Forgejo instances using S3 for storage. If you have read the previous version, please &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/364/files&quot;&gt;take a look at the diff&lt;/a&gt;.&lt;/p&gt; &lt;/blockquote&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;h3&gt;Fixing the risk of data loss related to &lt;code&gt;[storage*]&lt;/code&gt; sections&lt;/h3&gt; &lt;p&gt;A manual action is required to avoid the risk of losing data if:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;the &lt;code&gt;app.ini&lt;/code&gt; file contains one or more &lt;code&gt;[storage*]&lt;/code&gt; sections that are as follows:&lt;ul&gt; &lt;li&gt;&lt;code&gt;[storage].PATH&lt;/code&gt; is set&lt;/li&gt; &lt;li&gt;&lt;code&gt;[attachment]&lt;/code&gt; and &lt;code&gt;[storage.attachments]&lt;/code&gt; exist&lt;/li&gt; &lt;li&gt;&lt;code&gt;[lfs]&lt;/code&gt; and &lt;code&gt;[storage.lfs]&lt;/code&gt; exist&lt;/li&gt; &lt;li&gt;&lt;code&gt;[avatar]&lt;/code&gt; and &lt;code&gt;[storage.avatars]&lt;/code&gt; exist&lt;/li&gt; &lt;li&gt;&lt;code&gt;[repo-avatar]&lt;/code&gt; and &lt;code&gt;[storage.repo-avatars]&lt;/code&gt; exist&lt;/li&gt; &lt;li&gt;&lt;code&gt;[repo-archive]&lt;/code&gt; and &lt;code&gt;[storage.repo-archive]&lt;/code&gt; exist&lt;/li&gt; &lt;li&gt;&lt;code&gt;[packages]&lt;/code&gt; and &lt;code&gt;[storage.packages]&lt;/code&gt; exist&lt;/li&gt; &lt;/ul&gt; &lt;/li&gt; &lt;li&gt;the &lt;code&gt;app.ini&lt;/code&gt; file contains &lt;code&gt;STORAGE_TYPE = minio&lt;/code&gt;&lt;/li&gt; &lt;li&gt;you are currently currently running:&lt;ul&gt; &lt;li&gt;A Forgejo version lower than &lt;code&gt;v1.20.3-0&lt;/code&gt;&lt;/li&gt; &lt;li&gt;A Gitea version lower than &lt;code&gt;v1.21&lt;/code&gt;&lt;/li&gt; &lt;/ul&gt; &lt;/li&gt; &lt;/ul&gt; &lt;p&gt;If this is not the case this chapter does not concern you and can be skipped.&lt;/p&gt; &lt;h4&gt;Bug description&lt;/h4&gt; &lt;p&gt;The &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/storage/&quot;&gt;storage configuration&lt;/a&gt; in the &lt;code&gt;app.ini&lt;/code&gt; file was &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/d6dd6d641b593c54fe1a1041c153111ce81dbc20&quot;&gt;refactored in v1.20&lt;/a&gt; and bugs were introduced. There were also bugs in the previous implementation and all versions up to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-2-0&quot;&gt;Forgejo v1.20.2-0&lt;/a&gt; are impacted.&lt;/p&gt; &lt;p&gt;These bugs are best explained through an example. By default the files for each subsystems - Attachments, LFS, Avatars, Repository avatars, Repository archives, Packages - are stored in a dedicated directory. For instance if &lt;code&gt;APP_DATA_PATH&lt;/code&gt; is set to &lt;code&gt;/data&lt;/code&gt;, the directory layout looks like this:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;/data/attachments /data/lfs /data/avatars /data/repo-avatars /data/repo-archive /data/packages &lt;/code&gt;&lt;/pre&gt; &lt;p&gt;But if the &lt;code&gt;app.ini&lt;/code&gt; file contains the following section and no &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/storage/&quot;&gt;other storage related sections&lt;/a&gt;:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;[storage] PATH = /my/storage &lt;/code&gt;&lt;/pre&gt; &lt;p&gt;all subsystems will share &lt;code&gt;/my/storage&lt;/code&gt; instead of having their own directory. The attachments will be stored in the &lt;code&gt;/my/storage&lt;/code&gt; directory, together with the avatars, the repository archives, etc.&lt;/p&gt; &lt;h4&gt;Bug impact&lt;/h4&gt; &lt;h5&gt;Subsystems sharing a directory&lt;/h5&gt; &lt;p&gt;If &lt;code&gt;[storage].PATH&lt;/code&gt; exists in the &lt;code&gt;app.ini&lt;/code&gt; file it may cause some subsystems - Attachments, LFS, Avatars, Repository avatars, Repository archives, Packages - to share the same directory.&lt;/p&gt; &lt;p&gt;It may not create a problem immediately and can go unnoticed for an extended period of time. But since each subsystem was designed to have a dedicated directory it will eventually:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Create a name clash when one subsystem tries to use the same files as another subsystem&lt;/li&gt; &lt;li&gt;Permanently destroy data when one subsystems delete files from another subsystem&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;One example of permanent data loss is when clicking on &lt;strong&gt;Delete all repositories&apos; archives (ZIP, TAR.GZ, etc..)&lt;/strong&gt; in the system administration web page: it will not only delete the archives but also attachments, LFS files etc.&lt;/p&gt; &lt;h5&gt;Misplaced data&lt;/h5&gt; &lt;p&gt;When two sections related to a subsystem are found in the &lt;code&gt;app.ini&lt;/code&gt; file (for instance &lt;code&gt;[packages]&lt;/code&gt; and &lt;code&gt;[storage.packages]&lt;/code&gt;), the location in which the data is stored may change in an unpredictable way after the upgrade to &lt;code&gt;v1.20.3-0&lt;/code&gt;.&lt;/p&gt; &lt;p&gt;Prior to Forgejo v1.20, using &lt;code&gt;STORAGE_TYPE = minio&lt;/code&gt; in some contexts was ignored and the files were actually found in local storage (for instance the [&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/267967e81da01279808f527b1aad509a9dbd0c1a/.forgejo/upgrades/misplace-s3-app.ini&quot;&gt;repo-archive&lt;/a&gt;] section &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo-development/.forgejo/upgrades/test-upgrade.sh#L451-L469&quot;&gt;as demonstrated by this test&lt;/a&gt;).&lt;/p&gt; &lt;p&gt;The Forgejo instance will no longer find the files stored in the previous location and it will &lt;a href=&quot;https://github.com/go-gitea/gitea/issues/26864&quot;&gt;start populating the new location&lt;/a&gt;. As time passes there will be no way to reconcile the content of the two locations that diverged in this way.&lt;/p&gt; &lt;h5&gt;Relative paths inconsistencies&lt;/h5&gt; &lt;p&gt;When the path to a &lt;code&gt;local&lt;/code&gt; storage location does not start with a &lt;code&gt;/&lt;/code&gt;, it is interpreted to be relative to another path. Unfortunately the logic changed across versions, as demonstrated by &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/52ec2f30a4f7ead2acd0fdaa040662c65181fe35/.forgejo/upgrades/test-upgrade.sh#L211-L291&quot;&gt;an extensive set of tests&lt;/a&gt; going back to &lt;code&gt;Forgejo v1.18.5-0&lt;/code&gt;.&lt;/p&gt; &lt;p&gt;For instance if &lt;code&gt;app.ini&lt;/code&gt; contains &lt;code&gt;[storage.lfs].PATH = somedir&lt;/code&gt; it will end up in:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;code&gt;APP_DATA_PATH/lfs&lt;/code&gt; for &lt;code&gt;Forgejo v1.19.4-0&lt;/code&gt;&lt;/li&gt; &lt;li&gt;&lt;code&gt;WORK_PATH/somedir&lt;/code&gt; for &lt;code&gt;Forgejo v1.20.2-0&lt;/code&gt;&lt;/li&gt; &lt;li&gt;&lt;code&gt;APP_DATA_PATH/somedir&lt;/code&gt; for &lt;code&gt;Forgejo v1.20.3-0&lt;/code&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h4&gt;Recommended action&lt;/h4&gt; &lt;p&gt;Forgejo supports two storage backends: the file system (the default or when &lt;code&gt;STORAGE_TYPE = local&lt;/code&gt; is set) and S3 compatible storage (when &lt;code&gt;STORAGE_TYPE = minio&lt;/code&gt; is set). To figure out where each subsystem stores its files before the upgrade, &lt;code&gt;grep&lt;/code&gt; the Forgejo logs as shown in the following example:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;$ grep -e &apos;New.*Storage()&apos; -e &apos;Initialising.*storage&apos; &amp;lt; forgejo.log :initAttachments() [I] Initialising Attachment storage with type: NewLocalStorage() [I] Creating new Local Storage at /data/gitea/attachments :initAvatars() [I] Initialising Avatar storage with type: NewLocalStorage() [I] Creating new Local Storage at /data/gitea/avatars :initRepoAvatars() [I] Initialising Repository Avatar storage with type: NewLocalStorage() [I] Creating new Local Storage at /data/gitea/repo-avatars :initLFS() [I] Initialising LFS storage with type: minio NewMinioStorage() [I] Creating Minio storage at 127.0.0.1:9000:forgejo with base path lfs/ :initRepoArchives() [I] Initialising Repository Archive storage with type: NewLocalStorage() [I] Creating new Local Storage at /data/gitea/repo-archive :initPackages() [I] Initialising Packages storage with type: NewLocalStorage() [I] Creating new Local Storage at /data/gitea/packages :initActions() [I] Initialising Actions storage with type: minio NewMinioStorage() [I] Creating Minio storage at 127.0.0.1:9000:forgejo with base path actions_log/ :initActions() [I] Initialising ActionsArtifacts storage with type: minio NewMinioStorage() [I] Creating Minio storage at 127.0.0.1:9000:forgejo with base path actions_artifacts/ &lt;/code&gt;&lt;/pre&gt; &lt;blockquote&gt; &lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; when a &lt;a href=&quot;https://forgejo.org/docs/next/admin/installation/#installation-with-docker&quot;&gt;Forgejo container&lt;/a&gt; is configured using variables such as &lt;code&gt;-e FORGEJO__storage__PATH=/my/storage&lt;/code&gt;, it will create an &lt;code&gt;app.ini&lt;/code&gt; file that contains &lt;code&gt;[storage].PATH&lt;/code&gt;. Removing this variable will not remove the section from the &lt;code&gt;app.ini&lt;/code&gt; file, it has to be done manually.&lt;/p&gt; &lt;/blockquote&gt; &lt;p&gt;Follow the instructions below to update your &lt;code&gt;app.ini&lt;/code&gt; so that the storage locations stay the same. Keep in mind that some manifestations of these bugs are not covered by the sanity checks preventing an upgrade that may have an impact on the storage location. For instance when relative paths are used in the &lt;code&gt;app.ini&lt;/code&gt; file or other corner cases that have not been discovered yet.&lt;/p&gt; &lt;p&gt;If you have any doubt about the following steps or if you suspect the storage directories are merged together as described above, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;file an issue&lt;/a&gt; or reach out to &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;the chatroom&lt;/a&gt; to get help.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;p&gt;Before upgrading to Forgejo v1.20.3-0&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;Save the output of &lt;code&gt;grep -e &apos;New.*Storage()&apos; -e &apos;Initialising.*storage&apos;&lt;/code&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;For each &lt;code&gt;local&lt;/code&gt; storage, add a section to &lt;code&gt;app.ini&lt;/code&gt;, replacing the &lt;code&gt;PATH&lt;/code&gt; value with the absolute path of the directory for each subsystem. Check the &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/storage/&quot;&gt;table in the documentation&lt;/a&gt; to find the correspondance between the name of the subsystem displayed in the logs and the section in the &lt;code&gt;app.ini&lt;/code&gt; file. For instance, the subsystem &lt;code&gt;Attachment&lt;/code&gt; is associated with the &lt;code&gt;[attachment]&lt;/code&gt; section:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;[attachment] PATH = /my/storage/attachments &lt;/code&gt;&lt;/pre&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;For each &lt;code&gt;minio&lt;/code&gt; storage, add the following to &lt;code&gt;app.ini&lt;/code&gt;, replacing the &lt;code&gt;MINIO_BASE_PATH&lt;/code&gt; value with the base path found in the logs (see the grep example above). Check the &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/storage/&quot;&gt;table in the documentation&lt;/a&gt; for a correspondance between the name of the subsystem displayed in the logs and the section in the &lt;code&gt;app.ini&lt;/code&gt; file. For instance, &lt;code&gt;LFS&lt;/code&gt; needs:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;[lfs] STORAGE_TYPE = minio MINIO_BASE_PATH = mylfs/ MINIO_ENDPOINT = 127.0.0.1:9000 MINIO_ACCESS_KEY_ID = [redacted] MINIO_SECRET_ACCESS_KEY = [redacted] MINIO_BUCKET = forgejo MINIO_LOCATION = us-east-1 &lt;/code&gt;&lt;/pre&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;Remove the &lt;code&gt;[storage]&lt;/code&gt; section from &lt;code&gt;app.ini&lt;/code&gt;&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;Remove the &lt;code&gt;[server].LFS_CONTENT_PATH&lt;/code&gt; entry from &lt;code&gt;app.ini&lt;/code&gt; (it is the default for &lt;code&gt;[lfs].PATH&lt;/code&gt;)&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;Remove the &lt;code&gt;[picture].AVATAR_UPLOAD_PATH&lt;/code&gt; entry from &lt;code&gt;app.ini&lt;/code&gt; (it is the default for &lt;code&gt;[avatar].PATH&lt;/code&gt;)&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;Remove the &lt;code&gt;[picture].REPOSITORY_AVATAR_UPLOAD_PATH&lt;/code&gt; entry from &lt;code&gt;app.ini&lt;/code&gt; (it is the default for &lt;code&gt;[repo-avatar].PATH&lt;/code&gt;)&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;Merge the settings found in related sections together as follow:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;move the settings found in the &lt;code&gt;[storage.attachments]&lt;/code&gt; section into the &lt;code&gt;[attachment]&lt;/code&gt; section and remove it (one plural, the other singular)&lt;/li&gt; &lt;li&gt;move the settings found in the &lt;code&gt;[storage.lfs]&lt;/code&gt; section into the &lt;code&gt;[lfs]&lt;/code&gt; section and remove it&lt;/li&gt; &lt;li&gt;move the settings found in the &lt;code&gt;[storage.avatars]&lt;/code&gt; section into the &lt;code&gt;[avatar]&lt;/code&gt; section and remove it (one plural, the other singular)&lt;/li&gt; &lt;li&gt;move the settings found in the &lt;code&gt;[storage.repo-avatars]&lt;/code&gt; section into the &lt;code&gt;[repo-avatar]&lt;/code&gt; section and remove it (one plural, the other singular)&lt;/li&gt; &lt;li&gt;move the settings found in the &lt;code&gt;[storage.repo-archive]&lt;/code&gt; section into the &lt;code&gt;[repo-archive]&lt;/code&gt; section and remove it (both singular)&lt;/li&gt; &lt;li&gt;move the settings found in the &lt;code&gt;[storage.packages]&lt;/code&gt; section into the &lt;code&gt;[packages]&lt;/code&gt; section and remove it (both plural)&lt;/li&gt; &lt;/ul&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;Upgrade to &lt;code&gt;v1.20.3-0&lt;/code&gt; or a later version&lt;/p&gt; &lt;/li&gt; &lt;li&gt;&lt;p&gt;Verify each subsystem uses the expected storage with &lt;code&gt;grep -e &apos;New.*Storage()&apos; -e &apos;Initialising.*storage&lt;/code&gt;&lt;/p&gt; &lt;/li&gt; &lt;/ul&gt; &lt;h4&gt;Bug fix and data recovery&lt;/h4&gt; &lt;p&gt;After &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/88f6f7579cdaa557333bc86b3e45bf6458d889b6&quot;&gt;upgrading to v1.20.3-0&lt;/a&gt; the storage settings can be used as &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/storage/&quot;&gt;explained in the documentation&lt;/a&gt;. But there is unfortunately &lt;strong&gt;no way to automatically repair an existing instance impacted by these bugs during the upgrade&lt;/strong&gt;.&lt;/p&gt; &lt;p&gt;To address this problem:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;code&gt;v1.20.3-0&lt;/code&gt; and later will &lt;strong&gt;refuse to upgrade&lt;/strong&gt; from &lt;code&gt;v1.20.2-0&lt;/code&gt; (or an earlier version) if the sanity checks fail. Upgrading without manual verification would be taking the risk of silently changing the location in which a subsystem expects to find its files. The data would not be lost because it would still exist in the former location, but Forgejo will not find it any more. The new location will start being populated in a way that may be impossible to reconcile with the content of the former location.&lt;/li&gt; &lt;li&gt;&lt;code&gt;v1.20&lt;/code&gt; point releases from &lt;code&gt;v1.20.3-0&lt;/code&gt; and later will &lt;strong&gt;refuse to downgrade&lt;/strong&gt; to &lt;code&gt;v1.20.1-0&lt;/code&gt; or &lt;code&gt;v1.20.2-0&lt;/code&gt;. Although it is usually possible to downgrade from a point release to a lower point release, it is forbidden in this case to protect the Forgejo instance from any risk of data loss.&lt;/li&gt; &lt;/ul&gt; &lt;blockquote&gt; &lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; A recovery strategy to separate directories that were previously merged together can be to duplicate the merged data into the target directories. There can still be name clashes and it only works for &lt;code&gt;local&lt;/code&gt; storage if the amount of data is not too large.&lt;/p&gt; &lt;/blockquote&gt; &lt;h3&gt;Get Forgejo v1.20&lt;/h3&gt; &lt;p&gt;See the &lt;a href=&quot;/download&quot;&gt;download page&lt;/a&gt; for instructions on how to install Forgejo, and read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-3-0&quot;&gt;release notes&lt;/a&gt; for more information.&lt;/p&gt; &lt;h3&gt;Upgrading&lt;/h3&gt; &lt;p&gt;Carefully read &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-3-0&quot;&gt;the breaking changes&lt;/a&gt; section of the release notes.&lt;/p&gt; &lt;p&gt;The actual upgrade process is as simple as replacing the binary or container image with the corresponding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.20.3-0&quot;&gt;Forgejo binary&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.20.3-0&quot;&gt;container image&lt;/a&gt;. If you&apos;re using the container images, you can use the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.20&quot;&gt;&lt;code&gt;1.20&lt;/code&gt; tag&lt;/a&gt; to stay up to date with the latest &lt;code&gt;1.20.x&lt;/code&gt; point release automatically.&lt;/p&gt; &lt;p&gt;Make sure to check the &lt;a href=&quot;/docs/v1.20/admin/upgrade&quot;&gt;Forgejo upgrade documentation&lt;/a&gt; for recommendations on how to properly backup your instance before the upgrade. It also covers upgrading from Gitea, as far back as version 1.2.0. Forgejo includes all of Gitea v1.20.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo do not hold back, it is also your project. Open an issue in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;the issue tracker&lt;/a&gt; for feature requests or bug reports, reach out &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop into &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;the Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) and say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo summer update - July &amp; August 2023</title><link>https://forgejo.org/2023-08-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2023-08-monthly-update/</guid><description>A new major release, Forgejo v1.20, was published. It has some interesting new features and was 100% built with Forgejo Actions. Codeberg was upgraded a few days ago and discovered an unexpected issue. It was fortunately resolved within hours and a fix will be integrated in the next point release. Meanwhile development continued on the code, the website, the documentaion etc. All signs of a healthy project that needs your help to keep going in the long run.</description><pubDate>Thu, 17 Aug 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;https://forgejo.org/2023-07-release-v1201-0/&quot;&gt;Publishing Forgejo v1.20&lt;/a&gt; was the highlight of these past few weeks and also required more time than the previous major releases. The new features are the most attractive part of the announcement but most of the work went into listing and explaining the breaking changes in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-1-0&quot;&gt;the release notes&lt;/a&gt;. They have to be as clear as possible for Forgejo admins asking themselves: does it matter to me? What should I do then? Unfortunately a few issues were missed and one of them caused a downtime when upgrading Codeberg. A robust and durable solution was developed as a followup.&lt;/p&gt; &lt;p&gt;Meanwhile the development quietly went on, a project to produce Debian packages entered the Forgejo contrib organization, the website was reorganized internally, new documentation chapters were created, the hardware infrastructure did not cause any trouble and the Codeberg moderation dealt with spam bots efficiently. Are these signs that Forgejo is a healthy project? Definitely. Does this mean someone willing to help would be turned down because there is nothing else to do? Absolutely not! If you are serious about creating a world where Free Software can be developed with Free Software, step in, your help is needed.&lt;/p&gt; &lt;h3&gt;Forgejo v1.20&lt;/h3&gt; &lt;p&gt;&lt;a href=&quot;https://forgejo.org/2023-07-release-v1201-0/&quot;&gt;Forgejo v1.20&lt;/a&gt; was published 24 July 2023 and there are reasons to be happy about the new features described in the blog post. And also by the fact that the entire release process is now based on Forgejo Actions. It is a challenging release for Forgejo admins because there are &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-1-0&quot;&gt;many breaking changes&lt;/a&gt;. A lot of attention went into ensuring a seamless experience when upgrading from any Gitea version, v1.20 included, and there has been no report of failed upgrades so far.&lt;/p&gt; &lt;p&gt;Codeberg was successfully upgraded to Forgejo v1.20.2-0 on 10 August 2023 after a few tests of database upgrades. In the days prior to the upgrade, Forgejo contributors and Codeberg volunteers worked together to figure out the potential issues and prepare the ground. A &lt;a href=&quot;https://blog.codeberg.org/the-permissions-for-your-scoped-access-tokens-might-change-on-thursday.html&quot;&gt;mail was sent&lt;/a&gt; to all users a few days before, warning them to re-create their personal access tokens in order to ensure their scope were not unexpectedly modified. This was the most prominent breaking change since it required all users to be aware of its impact.&lt;/p&gt; &lt;p&gt;Shortly after the upgrade all &lt;a href=&quot;https://forgejo.org/docs/v1.20/user/packages/&quot;&gt;packages&lt;/a&gt; became unexpectedly unavailable and the feature was disabled while investigating. It turned out to be a regression caused by conflicting storage settings in the &lt;code&gt;app.ini&lt;/code&gt; file and the problem was fixed a few hours later. The lesson was learned and the Forgejo v1.20.3-0 release will include a safeguard against that particular issue. Other bugs (with less impact) were discovered and some of them were fixed right away (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1240&quot;&gt;profile rendering&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1241&quot;&gt;auth icons ratio&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1242&quot;&gt;dropzone filename hidden&lt;/a&gt;, ...).&lt;/p&gt; &lt;h3&gt;Development&lt;/h3&gt; &lt;p&gt;In addition to the development areas discussed below, it is worth mentioning there has been an unprecedented amount of pull requests proposed and merged to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls?q=&amp;amp;type=all&amp;amp;state=closed&amp;amp;labels=78137&amp;amp;milestone=0&amp;amp;assignee=0&amp;amp;poster=26734&quot;&gt;fix bugs&lt;/a&gt; or implement features such as &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1076&quot;&gt;OpenStreetMap links in profiles&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/676&quot;&gt;banning dots in usernames&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1126&quot;&gt;unifying project views&lt;/a&gt;. A number of these changes were &lt;a href=&quot;https://github.com/go-gitea/gitea/pulls?q=is%3Apr+author%3Aearl-warren+is%3Aclosed&quot;&gt;contributed back&lt;/a&gt; to Forgejo dependencies to keep the Forgejo codebase size to a minimum.&lt;/p&gt; &lt;h4&gt;Federation&lt;/h4&gt; &lt;p&gt;A pull request &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/764&quot;&gt;started a few months ago&lt;/a&gt; to allow for setting the update times of issues and comments via the API is now two tests away from being merged. It matters to federation because mirroring an issue from one forge to another so it can be displayed requires the dates are preserved which is not currently possible.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/services/f3/driver&quot;&gt;F3&lt;/a&gt; driver for Forgejo &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/cmd/forgejo/f3.go&quot;&gt;now relies&lt;/a&gt; on the &lt;a href=&quot;https://lab.forgefriends.org/friendlyforgeformat/gof3&quot;&gt;gof3 CLI&lt;/a&gt; instead of implementing its own. It was made possible by a &lt;a href=&quot;https://lab.forgefriends.org/friendlyforgeformat/gof3/-/merge_requests/63/diffs&quot;&gt;refactor of gof3&lt;/a&gt; that uses &lt;a href=&quot;https://pkg.go.dev/github.com/urfave/cli/v2&quot;&gt;urfave/v2&lt;/a&gt; to be compatible with Forgejo. This kind of factorization reduces the redundant work required to maintain independent projects and keeps their combined codebases &lt;a href=&quot;https://en.wikipedia.org/wiki/Don%27t_repeat_yourself&quot;&gt;DRY&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The new &lt;code&gt;forgejo-cli f3 mirror&lt;/code&gt; subcommand will do what it suggests: mirrors projects, issues, pull requests, etc. from one forge to the other. The implementation is not complete but &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1191/files&quot;&gt;made progress together with tests&lt;/a&gt;.&lt;/p&gt; &lt;h4&gt;Storage settings regressions&lt;/h4&gt; &lt;p&gt;Around 6 August work started to deal with a difficult problem regarding storage settings (see &lt;a href=&quot;https://codeberg.org/forgejo/website/src/commit/fb78c664e841dd97b1cb0de9c13c44c8af1d63c8/src/content/blog/2023-08-release-v1-20-3-0.md&quot;&gt;the final draft blog post&lt;/a&gt; if you are reading this before it is published). There are multiple cascading issues:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;The bug is found in all Forgejo releases&lt;/li&gt; &lt;li&gt;Upgrading to a release fixing the bug requires manual intervention&lt;/li&gt; &lt;li&gt;Implementing a safeguard has to be done before the database upgrade and after loading the settings but there is no logic to do that&lt;/li&gt; &lt;li&gt;The safeguard has to prevent downgrading from a point release but the information about the previously running Forgejo instance is not available&lt;/li&gt; &lt;li&gt;Testing the safeguard can only be done reliably with automated upgrade tests which do not exist&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A solution for those issues was &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1225/commits&quot;&gt;implemented&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1220&quot;&gt;backported to v1.20&lt;/a&gt;. It was almost done when the Codeberg upgrade to v1.20 happened on 10 August and discovered one manifestation of the bug that was overlooked (conflicting &lt;code&gt;[packages]&lt;/code&gt; and &lt;code&gt;[storage.packages]&lt;/code&gt; sections). It was an unfortunate oversight but had the benefit of improving the fix to be released in v1.20.3-0.&lt;/p&gt; &lt;p&gt;Codeberg hit the issue shortly after &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1225#issuecomment-1037223&quot;&gt;extensive manual upgrade testing&lt;/a&gt; was conducted. All of which had to be repeated after fixing the newly found issue. It was a great example of why manual testing is generally a bad idea and eventually more time consuming than writing automated tests. Instead of running the upgrade tests manually again, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/884ca63738cc2e2c7cde31c649e9fa77cd590044&quot;&gt;automated upgrade tests were implemented&lt;/a&gt;. Although they launch multiple versions of Forgejo a dozen times, they run under five minutes.&lt;/p&gt; &lt;h4&gt;Semantic Version&lt;/h4&gt; &lt;p&gt;The Forgejo semantic version was used when &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/197177510980db4d237d4f7979497622a97e1562/services/forgejo/sanity_v1TOv5_0_1Included.go&quot;&gt;implementing the storage setting sanity checks&lt;/a&gt;. It is not yet used for releases or public facing Forgejo version numbering. But it can be used internally.&lt;/p&gt; &lt;h4&gt;Moderation&lt;/h4&gt; &lt;p&gt;When a user is blocked and is also a collaborator on a repository that the blocker owns, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/1151&quot;&gt;that collaboration is removed&lt;/a&gt;.&lt;/p&gt; &lt;h4&gt;Publishing development versions&lt;/h4&gt; &lt;p&gt;It was &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/51&quot;&gt;proposed to publish Forgejo development versions&lt;/a&gt; on a weekly basis. Although this was done as a byproduct of the weekly Forgejo rebase &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/milestones?sort=furthestduedate&amp;amp;state=closed&amp;amp;q=rebase&quot;&gt;in August&lt;/a&gt;, the discussion is still ongoing. They are only for experimentation and could be used to run &lt;a href=&quot;https://next.forgejo.org&quot;&gt;https://next.forgejo.org&lt;/a&gt; which is meant to help figure out if a bug is happening in the most recent development branch.&lt;/p&gt; &lt;h3&gt;Forgejo contrib&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo-contrib/&quot;&gt;forgejo-contrib&lt;/a&gt; organization is where projects related to Forgejo can find a home while they are being developed or when the long term maintenance is uncertain.&lt;/p&gt; &lt;h4&gt;Debian packages for Forgejo&lt;/h4&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-deb&quot;&gt;Debian packages for Forgejo&lt;/a&gt; project moved to &lt;code&gt;forgejo-contrib&lt;/code&gt;. The packages &lt;a href=&quot;https://code.forgejo.org/forgejo-contrib/-/packages&quot;&gt;it provides&lt;/a&gt; use the &lt;a href=&quot;https://forgejo.org/docs/v1.20/user/packages/debian/&quot;&gt;Debian package&lt;/a&gt; registry that was introduced in Forgejo v1.20.&lt;/p&gt; &lt;h4&gt;Helm chart for forgejo&lt;/h4&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-helm/pulls/165&quot;&gt;pull request was proposed&lt;/a&gt; to the &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-helm&quot;&gt;Helm chart for forgejo&lt;/a&gt; to deploy the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;Forgejo runner&lt;/a&gt; alongside Forgejo. The &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/actions/#offline-registration&quot;&gt;offline registration&lt;/a&gt; implemented in Forgejo and the runner were designed to help that particular use case.&lt;/p&gt; &lt;h3&gt;Website and Documentation&lt;/h3&gt; &lt;p&gt;The website &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/323&quot;&gt;was restructured&lt;/a&gt; to use &lt;a href=&quot;https://docs.astro.build/en/guides/content-collections/&quot;&gt;Astro content collections&lt;/a&gt; to better separate content from the source and improve maintainability over the ad-hoc system previously in use. There also were smaller changes such as &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/329&quot;&gt;custom 404 pages&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Now that v1.20 was published, the &lt;a href=&quot;https://codeberg.org/forgejo/docs/src/branch/next&quot;&gt;v1.21 documentation&lt;/a&gt; was created to receive updates that are not relevant to v1.20 such as the &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/335/files&quot;&gt;new moderation features&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/292&quot;&gt;table of content&lt;/a&gt; was added to help navigate large pages and preparations were made to &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/331&quot;&gt;move the documentation into a separate repository&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;New workflow for stable releases&lt;/h3&gt; &lt;p&gt;The Forgejo development branch is &lt;a href=&quot;https://forgejo.org/docs/v1.21/developer/workflow/&quot;&gt;rebased weekly&lt;/a&gt; and that worked out nicely for almost a year. The same was done until last month for stable branches. It also worked well but had one confusing side effect: the tags of the stable versions could not be found in the stable version branch. For instance the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/tag/v1.19.0-3&quot;&gt;v1.93.3-0 tag&lt;/a&gt; is not on a commit found in the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/v1.19/forgejo&quot;&gt;forgejo/v1.19&lt;/a&gt; branch. Although it did not seem to create any actual problems, it is unusual and cause for confusion.&lt;/p&gt; &lt;p&gt;Early July a &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/296&quot;&gt;proposal was made&lt;/a&gt; for a different workflow to address this issue. It has been adopted when the first v1.20 release was published and the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/tag/v1.20.1-0&quot;&gt;v1.20.1-0&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/tag/v1.20.2-0&quot;&gt;v1.20.2-0&lt;/a&gt; are now both found in the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/v1.20/forgejo&quot;&gt;forgejo/v1.20&lt;/a&gt; branch.&lt;/p&gt; &lt;h2&gt;Infrastructure&lt;/h2&gt; &lt;p&gt;There &lt;strong&gt;has been no issue&lt;/strong&gt; with any of the &lt;a href=&quot;https://forgejo.org/docs/v1.20/developer/infrastructure/&quot;&gt;hardware in the Forgejo infrastructure&lt;/a&gt;. It is worth mentioning resources used daily for the CI and the releases did not cause trouble.&lt;/p&gt; &lt;p&gt;This kind of stability is taken for granted when relying on cloud providers but it does not happen magically. Their staff is hard at work to maintain a stable environment over time. Forgejo chose to rely on Free Software only and runs its own hardware. Part of the infrastructure is using an &lt;a href=&quot;https://www.openstack.org/&quot;&gt;OpenStack&lt;/a&gt; provider, similar to AWS but based on a Free Software stack and API. The rest is running on dedicated &lt;a href=&quot;https://linuxcontainers.org/lxc/&quot;&gt;LXC&lt;/a&gt; hypervisors.&lt;/p&gt; &lt;p&gt;Being independent from cloud providers running proprietary software means more work for Forgejo community members. But since Free Software is &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/MISSION.md#values&quot;&gt;one of the core values&lt;/a&gt; of Forgejo, it is also a requirement. The promise is to deliver a Free Software codebase but also to ensure it can be developed and released in a Free Software environment. The big question is: can the Forgejo devops team durably maintain a reliable and secure infrastructure? It is too early to tell but over four weeks of uninterrupted and stable service is a very positive sign.&lt;/p&gt; &lt;h2&gt;Governance and communication&lt;/h2&gt; &lt;h3&gt;Wikidata&lt;/h3&gt; &lt;p&gt;&lt;a href=&quot;https://www.wikidata.org/&quot;&gt;Wikidata&lt;/a&gt; acts as central storage for the structured data of its Wikimedia sister projects including Wikipedia, Wikivoyage, Wiktionary, Wikisource, and others. Forgejo &lt;a href=&quot;https://www.wikidata.org/wiki/Q115962387&quot;&gt;has an entry&lt;/a&gt; which was thoroughly updated. The Forgejo releases are also listed and &lt;a href=&quot;https://www.wikidata.org/w/index.php?title=Q115962387&amp;amp;action=history&quot;&gt;updated by Wikidata editors&lt;/a&gt; when they are published.&lt;/p&gt; &lt;h3&gt;Sustainability&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/sustainability#2023&quot;&gt;NLnet grant&lt;/a&gt; is progressing and some tasks related to the release process were completed. A &quot;Requests for Payment&quot; was &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls/22&quot;&gt;approved&lt;/a&gt; and another &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/pulls/24&quot;&gt;is pending&lt;/a&gt;. The relationship between NLnet and Forgejo is not a contract in the traditional sense and a &quot;Request for Payment&quot; is the equivalent of an invoice, only it is payed to the beneficiary as a charitable donation. In this case the payment will go to Codeberg e.V.&lt;/p&gt; &lt;p&gt;Time is as valuable as funding and Forgejo durability heavily depends on how much time volunteers are willing to devote to moderation, sorting bugs, fixing them etc. It is, in fact, arguably the most precious resource any Free Software project has. The time spent by &lt;a href=&quot;https://codeberg.org/forgejo/sustainability#2023&quot;&gt;one volunteer&lt;/a&gt; was added to the sustainability repository to account for that. It is not a requirement and each volunteer decides whether or not they want their time to be accounted for in this way.&lt;/p&gt; &lt;h3&gt;Moderation&lt;/h3&gt; &lt;p&gt;With the upgrade to Forgejo v1.20, the &lt;a href=&quot;https://forgejo.org/docs/v1.20/user/blocking-user/&quot;&gt;self-moderation features&lt;/a&gt; are available on Codeberg and were used to &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/16&quot;&gt;enforce the ban&lt;/a&gt; decided on 17 March 2023 for a period of one year.&lt;/p&gt; &lt;p&gt;Two spam bots posted a dozen messages that have been sent via email to people watching the Forgejo repositories. The bots were removed by the Codeberg moderation team before the incident was even noticed by the Forgejo moderation team.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/29&quot;&gt;moderation report was published&lt;/a&gt; and reminds Forgejo community members that &quot;nobody can, under any circumstances, unilaterally decide to reveal private information in Forgejo spaces. It does not only go against one of the core values of Forgejo, it also goes against the most basic expectation for privacy of every person entering Forgejo spaces&quot;.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/alex19srv&quot;&gt;https://codeberg.org/alex19srv&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Andre601&quot;&gt;https://codeberg.org/Andre601&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/aral&quot;&gt;https://codeberg.org/aral&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Beowulf&quot;&gt;https://codeberg.org/Beowulf&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/brainchild&quot;&gt;https://codeberg.org/brainchild&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/chrysn&quot;&gt;https://codeberg.org/chrysn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/commonism&quot;&gt;https://codeberg.org/commonism&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Cyborus&quot;&gt;https://codeberg.org/Cyborus&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DanielGibson&quot;&gt;https://codeberg.org/DanielGibson&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/diem&quot;&gt;https://codeberg.org/diem&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Dirk&quot;&gt;https://codeberg.org/Dirk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Eragon&quot;&gt;https://codeberg.org/Eragon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/f00&quot;&gt;https://codeberg.org/f00&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/f0sh&quot;&gt;https://codeberg.org/f0sh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fasterthanlime&quot;&gt;https://codeberg.org/fasterthanlime&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Fl1tzi&quot;&gt;https://codeberg.org/Fl1tzi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/flamenco687&quot;&gt;https://codeberg.org/flamenco687&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fluzz&quot;&gt;https://codeberg.org/fluzz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fr33domlover&quot;&gt;https://codeberg.org/fr33domlover&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/g2px1&quot;&gt;https://codeberg.org/g2px1&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/galambborong&quot;&gt;https://codeberg.org/galambborong&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/gmem&quot;&gt;https://codeberg.org/gmem&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GreenImp&quot;&gt;https://codeberg.org/GreenImp&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jb_wisemo&quot;&gt;https://codeberg.org/jb_wisemo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jklippel&quot;&gt;https://codeberg.org/jklippel&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jmshrtn&quot;&gt;https://codeberg.org/jmshrtn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/link2xt&quot;&gt;https://codeberg.org/link2xt&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/louis9902&quot;&gt;https://codeberg.org/louis9902&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/lucajunge&quot;&gt;https://codeberg.org/lucajunge&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/MagicLike&quot;&gt;https://codeberg.org/MagicLike&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/mainboarder&quot;&gt;https://codeberg.org/mainboarder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/melroy89&quot;&gt;https://codeberg.org/melroy89&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/neveraskedtoexist&quot;&gt;https://codeberg.org/neveraskedtoexist&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oscarcp&quot;&gt;https://codeberg.org/oscarcp&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/PatchMixolydic&quot;&gt;https://codeberg.org/PatchMixolydic&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/pierreprinetti&quot;&gt;https://codeberg.org/pierreprinetti&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/RaptaG&quot;&gt;https://codeberg.org/RaptaG&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rome-user&quot;&gt;https://codeberg.org/rome-user&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/snematoda&quot;&gt;https://codeberg.org/snematoda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SteffoSpieler&quot;&gt;https://codeberg.org/SteffoSpieler&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thatonecalculator&quot;&gt;https://codeberg.org/thatonecalculator&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/update.freak&quot;&gt;https://codeberg.org/update.freak&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/vintprox&quot;&gt;https://codeberg.org/vintprox&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/vladh&quot;&gt;https://codeberg.org/vladh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wetneb&quot;&gt;https://codeberg.org/wetneb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xy&quot;&gt;https://codeberg.org/xy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/yverry&quot;&gt;https://codeberg.org/yverry&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo v1.20 is available</title><link>https://forgejo.org/2023-07-release-v1201-0/</link><guid isPermaLink="true">https://forgejo.org/2023-07-release-v1201-0/</guid><description>Forgejo v1.20 is available and comes with an integrated CI, still in alpha stage but robust enough to build this release and verify all Forgejo pull requests. This release also brings customizable user profiles, a simpler Markdown editor, user blocking for self moderation, pinned issues, six more registries and many new API endpoints. As always, make sure to carefully read the breaking changes from the release notes and make a full backup before upgrading.</description><pubDate>Mon, 24 Jul 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;https://forgejo.org/download/&quot;&gt;Forgejo v1.20.1-0&lt;/a&gt; is here and you will find the most interesting changes it introduces below. Before upgrading it is &lt;strong&gt;strongly recommended&lt;/strong&gt; to make a full backup as explained in the &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/upgrade/&quot;&gt;upgrade guide&lt;/a&gt; and carefully read &lt;strong&gt;all breaking changes&lt;/strong&gt; from the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-1-0&quot;&gt;release notes&lt;/a&gt;. If in doubt, do not hesitate to ask for help &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or in the &lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;chat room&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v1.20/user/actions&quot;&gt;Actions&lt;/a&gt;&lt;/strong&gt;: the internal CI graduated from &lt;strong&gt;experimental&lt;/strong&gt; to &lt;strong&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Software_release_life_cycle#Alpha&quot;&gt;alpha&lt;/a&gt;&lt;/strong&gt; and is now used by Forgejo to verify pull requests and to create releases, including this one. It comes with a &lt;a href=&quot;/docs/v1.20/user/actions&quot;&gt;user&lt;/a&gt; documentation that includes examples and an extensive &lt;a href=&quot;/docs/v1.20/admin/actions&quot;&gt;administrator&lt;/a&gt; guide to set it up. &lt;/li&gt; &lt;li&gt;&lt;strong&gt;User profile&lt;/strong&gt;: the Forgejo home page for a user &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/c090f87a8db5b51e0aa9c7278b38ddc862c048ac&quot;&gt;can now be a Markdown file&lt;/a&gt; instead of the list of repositories they own. &lt;/li&gt; &lt;li&gt;&lt;strong&gt;New markdown editor&lt;/strong&gt;: the editor used when creating issues, adding comments, etc. is now &lt;a href=&quot;https://github.com/github/markdown-toolbar-element&quot;&gt;GitHub markdown&lt;/a&gt;. &lt;/li&gt; &lt;li&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v1.20/user/blocking-user/&quot;&gt;Blocking users&lt;/a&gt;:&lt;/strong&gt; is a new self-moderation tool a user or an organization can use to prevent users from interacting with the repositories they own. &lt;/li&gt; &lt;li&gt;&lt;strong&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/aaa109466350c531b9238a61115b2877daca57d3&quot;&gt;Pinned issues&lt;/a&gt;&lt;/strong&gt;: it is now possible to select issues and pull requests to show on top of the list. &lt;/li&gt; &lt;li&gt;&lt;strong&gt;Registries:&lt;/strong&gt; additional registries are now available for &lt;a href=&quot;https://forgejo.org/docs/v1.20/user/packages/swift&quot;&gt;SWIFT&lt;/a&gt;, &lt;a href=&quot;https://forgejo.org/docs/v1.20/user/packages/debian&quot;&gt;debian&lt;/a&gt;, &lt;a href=&quot;https://forgejo.org/docs/v1.20/user/packages/rpm&quot;&gt;RPM&lt;/a&gt;, &lt;a href=&quot;https://forgejo.org/docs/v1.20/user/packages/alpine&quot;&gt;alpine&lt;/a&gt;, &lt;a href=&quot;https://forgejo.org/docs/v1.20/user/packages/go&quot;&gt;Go&lt;/a&gt; and &lt;a href=&quot;https://forgejo.org/docs/v1.20/user/packages/cran&quot;&gt;CRAN&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;&lt;strong&gt;API endpoints:&lt;/strong&gt; new API endpoints are now available for &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/d56bb7420184c0c2f451f4bcaa96c9b3b00c393d&quot;&gt;email&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/03591f0f95823a0b1dcca969d2a3ed505c7e6d73&quot;&gt;renaming a user&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/3cab9c6b0c050bfcb9f2f067e7dc1b0242875254&quot;&gt;issue dependencies management&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/6b0df6d8da76d77a9b5c42dcfa78dbfe197fd56d&quot;&gt;activity feeds&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/fb37eefa282543fd8ce63c361cd4cf0dfac9943c&quot;&gt;license templates&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/36a5d4c2f3b5670e5e921034cd5d25817534a6d4&quot;&gt;gitignore templates&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/cf465b472166ccf6d3e001e3043e4bf43e16e6b3&quot;&gt;uploading files to an empty repository&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/cd9a13ebb47d32f46b38439a524e3b2e0c619490&quot;&gt;creating a branch directly from commit&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/25dc1556cd70b567a4920beb002a0addfbfd6ef2&quot;&gt;label templates&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/275d4b7e3f4595206e5c4b1657d4f6d6969d9ce2&quot;&gt;changing/creating/deleting multiple files&lt;/a&gt;.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Read more &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-1-0&quot;&gt;in the Forgejo v1.20.1-0 release notes&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Forgejo Actions&lt;/h3&gt; &lt;p&gt;Although &lt;a href=&quot;/docs/v1.20/user/actions&quot;&gt;Forgejo Actions&lt;/a&gt; is &lt;strong&gt;not yet production ready&lt;/strong&gt;, it became good enough for Forgejo itself to use in production. It &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/actions&quot;&gt;verifies pull requests&lt;/a&gt; (see also the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/60b10cd66051ffd4cbdbae9a4aa63aa0f55b2e8d/.forgejo/workflows/testing.yml&quot;&gt;testing workflow&lt;/a&gt;), &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/.forgejo/workflows/build-release.yml&quot;&gt;builds&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/.forgejo/workflows/publish-release.yml&quot;&gt;publishes&lt;/a&gt; releases (this one and the release candidates before it).&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;It is still considered &lt;strong&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Software_release_life_cycle#Alpha&quot;&gt;alpha&lt;/a&gt;&lt;/strong&gt; stage because:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;Forgejo runner&lt;/a&gt; is &lt;strong&gt;not secure enough&lt;/strong&gt;&lt;/li&gt; &lt;li&gt;a single &lt;code&gt;Forgejo runner&lt;/code&gt; will poll &lt;code&gt;Forgejo&lt;/code&gt; every two seconds by default which is not scalable&lt;/li&gt; &lt;li&gt;some errors only show in the &lt;code&gt;Forgejo runner&lt;/code&gt; logs and not in the &lt;code&gt;Forgejo&lt;/code&gt; user interface which is not a good user experience&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;The potential security bugs are a concern and &lt;code&gt;Forgejo&lt;/code&gt; took the following precautions to reduce the risks in its own infrastructure.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;strong&gt;Do not trust any web application with secrets.&lt;/strong&gt; The &lt;code&gt;Forgejo&lt;/code&gt; release process needs a GPG private key to sign the binaries before they are &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases&quot;&gt;uploaded&lt;/a&gt;. A web application with a large attack surface such as &lt;code&gt;Forgejo&lt;/code&gt; or &lt;code&gt;GitLab&lt;/code&gt; must not be trusted to keep such a secret safe. Instead a &lt;code&gt;Forgejo&lt;/code&gt; instance dedicated to signing the releases was installed behind a VPN.&lt;/li&gt; &lt;li&gt;&lt;strong&gt;LXC containers confinement.&lt;/strong&gt; All &lt;code&gt;Forgejo runners&lt;/code&gt; are deployed in &lt;a href=&quot;/docs/v1.20/developer/infrastructure/#installing-forgejo-runners&quot;&gt;dedicated LXC containers&lt;/a&gt; and re-installed from scratch from time to time.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;In addition, the &lt;a href=&quot;/docs/v1.20/user/actions/#pull-request-actions-are-moderated&quot;&gt;required pull request approval&lt;/a&gt; prevents unknown users from triggering a task that would include a malicious workflow.&lt;/p&gt; &lt;h3&gt;User profile&lt;/h3&gt; &lt;p&gt;By default the profile page of a user is the list of repositories they own. It is possible to customize it with a short description that shows to the left, under their avatar. It can now be fully personalized with a markdown file that is displayed instead of the list of repositories.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;&lt;a href=&quot;/docs/v1.20/user/profile/&quot;&gt;Read more user profile customization&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;New markdown editor&lt;/h3&gt; &lt;p&gt;The web editor used when creating issues, adding comments, etc. &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/5cc0801de90d16b4d528e62de11c9b525be5d122&quot;&gt;changed&lt;/a&gt; from &lt;a href=&quot;https://github.com/Ionaru/easy-markdown-editor&quot;&gt;EasyMDE&lt;/a&gt; to &lt;a href=&quot;https://github.com/github/markdown-toolbar-element&quot;&gt;GitHub markdown&lt;/a&gt;. To help with the transition it is still possible to switch back to using EasyMDE with the double arrow button in the menubar.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;This new markdown editor does not provide any WYSIWIG features. As &lt;a href=&quot;https://github.github.com/markdown-toolbar-element/examples/&quot;&gt;shown in the demo&lt;/a&gt; it is merely a helper for users who are not familiar with &lt;a href=&quot;https://en.wikipedia.org/wiki/Markdown&quot;&gt;markdown&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;Want to add a list? Click on the list menu item and see that a star is inserted for you. Select a word and click the bold button so it is surrounded by two stars. Nothing fancier. By comparison the &lt;a href=&quot;https://github.com/Ionaru/easy-markdown-editor&quot;&gt;EasyMDE&lt;/a&gt; editor has more features such as showing in bold the word that is surrounded by two stars.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;Unfortunately it is no longer actively maintained and enough has long standing bugs to justify a replacement.&lt;/p&gt; &lt;h3&gt;Blocking users&lt;/h3&gt; &lt;p&gt;On large Forgejo instances with ten of thousands of users it may be challenging for the moderation team to properly address all requests. The most common one being a malicious user spamming issues with advertisements or unwanted noise. It will be immediately noticed by the repository owner and it may take a while for the moderation team to act.&lt;/p&gt; &lt;p&gt;The owner of a repository or an organization can now block a user as soon as they notice an undesirable interaction. When they go to the profile page of the user, a new &lt;strong&gt;Block&lt;/strong&gt; button shows on the left.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;After confirmation the user will be added to the list of blocked users.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;From the &lt;strong&gt;Blocked Users&lt;/strong&gt; tab in their profile, the user can unblock them when the relationship gets better.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;The user being blocked is not notified and does not see any difference until they try to participate in a repository from which they are blocked. Their action will fail with a message informing them they have been blocked.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;p&gt;&lt;a href=&quot;/docs/v1.20/user/blocking-user/&quot;&gt;Read more about blocking users&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Pin issues&lt;/h3&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/aaa109466350c531b9238a61115b2877daca57d3&quot;&gt;Issues and pull requests can be pinned&lt;/a&gt; and will show on top of the list of issues (or pull requests). They can be re-arranged by dragging them.&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;h3&gt;Theming and custom templates&lt;/h3&gt; &lt;p&gt;The themes and templates changed a lot in this release and there is no documentation explaining how and why. The hope is that the users will discover the changes and not be overly confused.&lt;/p&gt; &lt;p&gt;This is also a reminder that Forgejo considers themes and templates to be a part of the internals and require an understanding of the source codebase to be modified and adapted after each release. In other words, if a Forgejo admin extracted templates and modified them on a v1.19 instance they will need to read the source code to figure out how they need to be modified to keep working with v1.20.&lt;/p&gt; &lt;h3&gt;Federation&lt;/h3&gt; &lt;p&gt;Does &lt;code&gt;Forgejo&lt;/code&gt; support federation? Not yet. Was there progress? Yes.&lt;/p&gt; &lt;p&gt;The monthly report &lt;a href=&quot;https://forgejo.org/tag/report/&quot;&gt;has details&lt;/a&gt; on these progress and the &lt;a href=&quot;https://forgefriends.org/blog/2023/06/21/2023-06-state-forge-federation/&quot;&gt;State of the Forge Federation: 2023 edition&lt;/a&gt; published last month explains how Forgejo fits in the big picture.&lt;/p&gt; &lt;p&gt;Forges have existed for twenty years and none of them has achieved data portability let alone federation. Forgejo is yet to celebrate its first birthday and it will take it a little time to get there. One thing is for sure: at this point no other forge is doing concrete work in this direction.&lt;/p&gt; &lt;h3&gt;Get Forgejo v1.20&lt;/h3&gt; &lt;p&gt;See the &lt;a href=&quot;/download&quot;&gt;download page&lt;/a&gt; for instructions on how to install Forgejo, and read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-1-0&quot;&gt;release notes&lt;/a&gt; for more information.&lt;/p&gt; &lt;h3&gt;Upgrading&lt;/h3&gt; &lt;p&gt;Carefully read &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-1-0&quot;&gt;the breaking changes&lt;/a&gt; section of the release notes.&lt;/p&gt; &lt;p&gt;The actual upgrade process is as simple as replacing the binary or container image with the corresponding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.20.1-0&quot;&gt;Forgejo binary&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.20.1-0&quot;&gt;container image&lt;/a&gt;. If you&apos;re using the container images, you can use the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.20&quot;&gt;&lt;code&gt;1.20&lt;/code&gt; tag&lt;/a&gt; to stay up to date with the latest &lt;code&gt;1.20.x&lt;/code&gt; point release automatically.&lt;/p&gt; &lt;p&gt;Make sure to check the &lt;a href=&quot;/docs/v1.20/admin/upgrade&quot;&gt;Forgejo upgrade documentation&lt;/a&gt; for recommendations on how to properly backup your instance before the upgrade. It also covers upgrading from Gitea, as far back as version 1.2.0. Forgejo includes all of Gitea v1.20.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo do not hold back, it is also your project. Open an issue in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;the issue tracker&lt;/a&gt; for feature requests or bug reports, reach out &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop into &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;the Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) and say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - June 2023</title><link>https://forgejo.org/2023-06-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2023-06-monthly-update/</guid><description>Forgejo v1.20 is around the corner. Release candidates were published and most of the activity went into testing it, updating the documentation and rebuilding the release process. Forgejo Actions is now used for all Forgejo development and releases in a spirit of dogfooding. A hardware failure and a Denial of Service (DoS) attack disrupted the work during a week but did not break anything.</description><pubDate>Fri, 07 Jul 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Forgejo v1.20 is around the corner: &lt;a href=&quot;../2023-06-10-release-v1/&quot;&gt;release candidates&lt;/a&gt; were published and most of the activity went into testing them, updating the documentation and rebuilding the release process. Although &lt;code&gt;Forgejo Actions&lt;/code&gt; is not yet considered production ready, it proved stable enough to be used for all Forgejo development and releases. It did not always go smoothly and there were challenging times when a hardware failure and a Denial of Service (DoS) attack disrupted the work during a week.&lt;/p&gt; &lt;p&gt;Forgejo does not do much of anything in terms of communication but &lt;a href=&quot;https://de.wikipedia.org/wiki/Forgejo&quot;&gt;got its first Wikipedia page&lt;/a&gt; and was mentioned in the &lt;a href=&quot;https://forgefriends.org/blog/2023/06/21/2023-06-state-forge-federation/&quot;&gt;State of the Forge Federation: 2023 edition&lt;/a&gt;. There is a great need for contributors who have strong skills that do not involve writing code, even beyond spreading the word about Forgejo, such as writing documentation, organizing video-conferences, etc. &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/9#issuecomment-956394&quot;&gt;Codeberg allocated funds&lt;/a&gt; to Forgejo that could be used to compensate contributors willing to help but who cannot afford to be volunteers.&lt;/p&gt; &lt;h3&gt;Development&lt;/h3&gt; &lt;h4&gt;Forgejo v1.20&lt;/h4&gt; &lt;p&gt;The first &lt;a href=&quot;../2023-06-10-release-v1/&quot;&gt;release candidates&lt;/a&gt; for Forgejo v1.20 were published. The highlights are:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;The &lt;a href=&quot;/docs/v1.20/user/actions&quot;&gt;internal CI/CD&lt;/a&gt; known as &lt;code&gt;Forgejo Actions&lt;/code&gt; is now used by &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/.forgejo/workflows&quot;&gt;Forgejo itself&lt;/a&gt; and the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/.forgejo/workflows&quot;&gt;Forgejo Runner&lt;/a&gt; for testing pull requests and publishing releases. It is still in beta stage and disabled by default but it is stable and secure enough to be activated on &lt;a href=&quot;https://code.forgejo.org&quot;&gt;Forgejo&apos;s own instance&lt;/a&gt;. An extensive &lt;a href=&quot;/docs/v1.20/admin/actions&quot;&gt;admin&lt;/a&gt; and &lt;a href=&quot;/docs/v1.20/user/actions&quot;&gt;user&lt;/a&gt; documentation is available.&lt;/li&gt; &lt;li&gt;The User Interface (UI) and User eXperience (UX) changed significantly and will require some adjustment from users who will have to adapt to a different layout. And admins who created their own templates and styles will need to figure out, by reading the sources, how it evolved.&lt;/li&gt; &lt;li&gt;New API endpoints were added (activity feeds, renaming users, uploading file, retrieving commits, etc.).&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#draft-1-20-0-0&quot;&gt;draft release notes&lt;/a&gt; are mostly complete but they still work and contributions would be most welcome.&lt;/p&gt; &lt;p&gt;Publishing one of the release candidates was made specially difficult because Codeberg suffered from a hardware failure that was followed by a DoS attack. It took about a week instead of a few hours. A similar situation happened in the early days of Forgejo, when the first release was only half published because the process unexpectedly broke at the wrong time. The release process was refactored on that occasion to be resilient to network and hardware failures. This effort paid off this time around, when the release process had to be restarted no less than a dozen times over three days until it finally succeeded.&lt;/p&gt; &lt;h3&gt;Moderation&lt;/h3&gt; &lt;p&gt;An &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/827&quot;&gt;API was implemented&lt;/a&gt; to manage blocked users in organizations and user accounts.&lt;/p&gt; &lt;h3&gt;Federation&lt;/h3&gt; &lt;p&gt;When artifacts (repositories, issues, etc.) are imported in Forgejo, they are now associated with a user &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/943&quot;&gt;that acts as a placeholder if it does not already exists&lt;/a&gt;. If that same user authenticate themselves on Forgejo via OAuth at a later time, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/934&quot;&gt;this placeholder will be promoted to a real user&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;In other words, if a repository that belongs to Jane Doe is federated from GitLab to a Forgejo instance, she will be able to reclaim it as soon as she registers via OAuth2 on the Forgejo instance. The OAuth2 authorization from GitLab is proof enough that she is the legitimate owner of this repository.&lt;/p&gt; &lt;h3&gt;Documentation&lt;/h3&gt; &lt;p&gt;The Forgejo documentation is a patchwork from various sources (Codeberg, Gitea, etc.) as well as content authored by Forgejo contributors. To improve the documentation for the Forgejo v1.20 release a full pass was done to get relevant updates from these sources. In addition a new section was created with &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/recommendations/&quot;&gt;Recommended Settings and Tips&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The &lt;code&gt;Forgejo Actions&lt;/code&gt; &lt;a href=&quot;https://forgejo.org/docs/v1.20/admin/actions/&quot;&gt;admin&lt;/a&gt; guide is complete and the &lt;a href=&quot;https://forgejo.org/docs/v1.20/user/actions/&quot;&gt;user&lt;/a&gt; guide got better but still requires a significant work to be finished. An effort is made to include &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo/src/branch/main/testdata&quot;&gt;examples&lt;/a&gt; that are part of the CI of actively maintained repositories so they can be verified to work.&lt;/p&gt; &lt;h3&gt;Forgejo Actions&lt;/h3&gt; &lt;p&gt;A &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/releases/tag/v2.1.0&quot;&gt;new version of the Forgejo runner&lt;/a&gt; was published to fix bugs and security issues. Although it is stable and runs for weeks uninterrupted, it is best confined on an isolated machine that is reset on a regular basis for security reasons.&lt;/p&gt; &lt;p&gt;There has been no report of security issues when enabling actions in Forgejo v1.19 and &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/36#issuecomment-935435&quot;&gt;Codeberg decided to enable it&lt;/a&gt;. That allowed for a simpler release process based on Forgejo Actions for both Forgejo and the &lt;code&gt;Forgejo runner&lt;/code&gt; to be &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/230&quot;&gt;implemented&lt;/a&gt;. It was used to publish all release candidates in the &lt;a href=&quot;https://codeberg.org/forgejo-experimental/&quot;&gt;experimental&lt;/a&gt; organization and helped fine tune it.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/v1.19/forgejo/releases&quot;&gt;Woodpecker CI release process&lt;/a&gt; was still used to publish the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.19.4-0&quot;&gt;latest v1.19.4-0&lt;/a&gt; release. It was retired and &lt;a href=&quot;https://codeberg.org/forgejo-contrib/forgejo-ci-woodpecker&quot;&gt;moved to its own repository&lt;/a&gt; as of Forgejo v1.20.&lt;/p&gt; &lt;h2&gt;Governance and communication&lt;/h2&gt; &lt;h3&gt;Wikipedia&lt;/h3&gt; &lt;p&gt;Earlier than expected, &lt;a href=&quot;https://de.wikipedia.org/wiki/Forgejo&quot;&gt;Forgejo got its first Wikipedia page&lt;/a&gt;. It still needs secondary sources to be inserted to durably establish its notoriety but it has not yet been challenged and those can easily be added.&lt;/p&gt; &lt;h3&gt;State of the Forge Federation: 2023 edition&lt;/h3&gt; &lt;p&gt;In the &lt;a href=&quot;https://forgefriends.org/blog/2023/06/21/2023-06-state-forge-federation/&quot;&gt;State of the Forge Federation: 2023 edition&lt;/a&gt; published 21 June Forgejo plays a central role.&lt;/p&gt; &lt;blockquote&gt; &lt;p&gt;Late 2022 Forgejo, a new forge with a focus on federation was created. Dozens of people contributed to its making and it is now used in production by ten of thousands of users at Codeberg, Disroot, etc. This large and unforeseen undertaking diverted the energy of most contributors set to work on federation features [...]. [...] the foundations on which forge federation is being built have shifted and there is reason to hope it was for the best.&lt;/p&gt; &lt;/blockquote&gt; &lt;h3&gt;Matrix archive bot&lt;/h3&gt; &lt;p&gt;The privacy expectations of people visiting the &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;Forgejo chatrooms&lt;/a&gt; is not high: they are fully aware they are publicly available and that anyone can visit them.&lt;/p&gt; &lt;p&gt;But even in this context the sudden appearance of an archive bot from Matrix.org surprised a number of active participants. The bot was banned while &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/37&quot;&gt;the situation was discussed&lt;/a&gt;. A few weeks later &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/37#issuecomment-953680&quot;&gt;Matrix.org shut down this service&lt;/a&gt;. Forgejo community members were likely not the only ones to protest.&lt;/p&gt; &lt;h3&gt;Governance&lt;/h3&gt; &lt;p&gt;There has been some discussions about how teams are useful and why but no significant progress was made on governance otherwise.&lt;/p&gt; &lt;h2&gt;Hardware&lt;/h2&gt; &lt;p&gt;In addition to the hosting provided by Codeberg, Forgejo needs a very secure hardware to host the cryptographic keys used to sign releases as well as the most sensitive work of the security team. It also occasionally needs to run resource consuming Continuous Integration jobs, for instance when performing end to end testing to verify a release can actually be used in a production environment. Or when hardware emulation is required to verify multi-architecture binaries run as expected.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://www.hetzner.com/dedicated-rootserver/ex101&quot;&gt;new hardware&lt;/a&gt; was acquired and is being configured. It suffered intermittent failures that took significant time to figure out during the first week and was eventually replaced. These investigations were an opportunity to confirm that the stack on which Forgejo hardware is deployed is solid (Debian GNU/Linux and LXC). There was little doubt about it since Codeberg uses the same. But when a machine reboots randomly multiple times per day for not apparent reason and all hardware tests confirm it should not, it is a motivation to doubt about everything.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#security&quot;&gt;security team&lt;/a&gt; now uses resources hosted behind a VPN at &lt;code&gt;octopuce.forgejo.org&lt;/code&gt; to work together in a secure environment.&lt;/p&gt; &lt;h2&gt;Roadmap&lt;/h2&gt; &lt;p&gt;Forgejo is still in the process of &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/17&quot;&gt;defining its roadmap&lt;/a&gt;, a concrete strategy to move forward with federation, scaling and robustness.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/1&quot;&gt;NLnet grant&lt;/a&gt; that was awarded last month demanded a &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/src/branch/main/2022-12-01-nlnet/2023-06-workplan.md&quot;&gt;workplan&lt;/a&gt;. This provides some clarity about what the beneficiaries are set to accomplish in the following areas:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;UI and accessibility improvements&lt;/li&gt; &lt;li&gt;DNS-Update-Checker RFC&lt;/li&gt; &lt;li&gt;Cleaner Webhook system&lt;/li&gt; &lt;li&gt;A new continuous integration agent&lt;/li&gt; &lt;li&gt;Tools to produce a source distribution and multi-architecture Forgejo binaries&lt;/li&gt; &lt;li&gt;An integrated release pipeline based on Forgejo&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;It is not a roadmap just yet, but it can help create one.&lt;/p&gt; &lt;h2&gt;Funding&lt;/h2&gt; &lt;p&gt;During its General Assembly, Codeberg decided to &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/9#issuecomment-956394&quot;&gt;allocate funds to Forgejo&lt;/a&gt; and ideas are welcome to decide how they should be spent.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/13&quot;&gt;funding opportunity was discovered&lt;/a&gt; to raise as much as 600K€ with an amount of administrative work well suited for small companies. No application was sent by the deadline (6 July). However there is &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/14&quot;&gt;another opportunity&lt;/a&gt;, with a 31 July deadline.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/alex19srv&quot;&gt;https://codeberg.org/alex19srv&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Beowulf&quot;&gt;https://codeberg.org/Beowulf&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/circlebuilder&quot;&gt;https://codeberg.org/circlebuilder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/cmonty14&quot;&gt;https://codeberg.org/cmonty14&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DanielGibson&quot;&gt;https://codeberg.org/DanielGibson&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DansLeRuSH&quot;&gt;https://codeberg.org/DansLeRuSH&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Dirk&quot;&gt;https://codeberg.org/Dirk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dumblob&quot;&gt;https://codeberg.org/dumblob&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Fl1tzi&quot;&gt;https://codeberg.org/Fl1tzi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fluzz&quot;&gt;https://codeberg.org/fluzz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fr33domlover&quot;&gt;https://codeberg.org/fr33domlover&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GamePlayer-8&quot;&gt;https://codeberg.org/GamePlayer-8&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/grosmanal&quot;&gt;https://codeberg.org/grosmanal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/helge&quot;&gt;https://codeberg.org/helge&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/hrnz&quot;&gt;https://codeberg.org/hrnz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JohnWalkerx&quot;&gt;https://codeberg.org/JohnWalkerx&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/linos&quot;&gt;https://codeberg.org/linos&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/macfanpl&quot;&gt;https://codeberg.org/macfanpl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/maralorn&quot;&gt;https://codeberg.org/maralorn&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/meaz&quot;&gt;https://codeberg.org/meaz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mikaela&quot;&gt;https://codeberg.org/Mikaela&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Nulo&quot;&gt;https://codeberg.org/Nulo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oewbgoieqwb&quot;&gt;https://codeberg.org/oewbgoieqwb&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/RaptaG&quot;&gt;https://codeberg.org/RaptaG&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/samrland&quot;&gt;https://codeberg.org/samrland&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/update.freak&quot;&gt;https://codeberg.org/update.freak&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xy&quot;&gt;https://codeberg.org/xy&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo v1.20 release candidates</title><link>https://forgejo.org/2023-06-10-release-v1200-0-rc0/</link><guid isPermaLink="true">https://forgejo.org/2023-06-10-release-v1200-0-rc0/</guid><description>The first Forgejo v1.20 release candidate is ready for testing. Discover a more stable and secure internal CI/CD with its documentation, new API features, numerous UI/UX changes and user blocking for self-moderation.</description><pubDate>Sat, 10 Jun 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Today the first release candidate for the upcoming Forgejo v1.20 release &lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.20.0-0-rc0&quot;&gt;was published&lt;/a&gt; and the &lt;a href=&quot;/docs/v1.20&quot;&gt;documentation&lt;/a&gt; updated. It is meant for testing only: &lt;strong&gt;do not upgrade a production instance with it&lt;/strong&gt;.&lt;/p&gt; &lt;p&gt;The highlights are:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;The &lt;a href=&quot;/docs/v1.20/user/actions&quot;&gt;internal CI/CD&lt;/a&gt; known as &lt;code&gt;Forgejo Actions&lt;/code&gt; is now used by Forgejo for &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/.forgejo/workflows&quot;&gt;testing and releasing&lt;/a&gt; the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/&quot;&gt;Forgejo Runner&lt;/a&gt;. It is still in its infancy and disabled by default but it is stable and secure enough to be activated on &lt;a href=&quot;https://code.forgejo.org&quot;&gt;Forgejo&apos;s own instance&lt;/a&gt;. The documentation was updated to explain how to &lt;a href=&quot;/docs/v1.20/admin/actions&quot;&gt;install&lt;/a&gt; and &lt;a href=&quot;/docs/v1.20/user/actions&quot;&gt;use&lt;/a&gt; it.&lt;/li&gt; &lt;li&gt;The User Interface (UI) and User eXperience (UX) changed significantly and will require some adjustment from users and admins who created their own customized templates.&lt;/li&gt; &lt;li&gt;New API features and endpoints were added (activity feeds, renaming users, uploading file, retrieving commits, etc.).&lt;/li&gt; &lt;li&gt;Essential sub-systems were refactored (the queue system that handles background tasks such as checking pull requests, the logger used to display Forgejo&apos;s logs, ...). In theory these changes are transparent to the Forgejo user and admin but the risk of subtle regressions is real: do not hesitate to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;reach out&lt;/a&gt; if you suspect anything.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#draft-1-20-0-0&quot;&gt;draft release notes&lt;/a&gt; have a categorized list of the most significant changes:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;code&gt;[A11Y]&lt;/code&gt; accessibility of the web interface.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[API]&lt;/code&gt; REST API.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[AUTH]&lt;/code&gt; authentication.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[CI]&lt;/code&gt; Forgejo&apos;s own Continuous Integration.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[MODERATION]&lt;/code&gt; moderation tools.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[PACKAGES]&lt;/code&gt; package registries.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[REFACTOR]&lt;/code&gt; internal refactors.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[RSS]&lt;/code&gt; display and creation of RSS feeds.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[TEMPLATES]&lt;/code&gt; templating system used to create web pages, issues, mails, etc.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[TIME]&lt;/code&gt; time localization and readability.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[UI / UX]&lt;/code&gt; User Interface and User eXperience.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[WEBHOOK]&lt;/code&gt; webhooks and notifications triggered when something happens in Forgejo.&lt;/li&gt; &lt;li&gt;&lt;code&gt;[WIKI]&lt;/code&gt; wiki features.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Make sure to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#draft-1-20-0-0&quot;&gt;check the breaking changes&lt;/a&gt; (look for the string &lt;code&gt;BREAKING&lt;/code&gt;) and get your production instance ready for when the v1.20 release is available.&lt;/p&gt; &lt;p&gt;There was progress regarding federation with the integration of the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commits/branch/forgejo-f3&quot;&gt;F3 driver&lt;/a&gt; in the codebase (an essential building block to synchronize forges with each other) but nothing is ready for experimenting yet.&lt;/p&gt; &lt;h3&gt;Try it out&lt;/h3&gt; &lt;p&gt;The release candidate is published in &lt;a href=&quot;https://codeberg.org/forgejo-experimental&quot;&gt;the dedicated &quot;experimental&quot; Forgejo organization&lt;/a&gt; and can be downloaded from:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Containers at &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/1.20&quot;&gt;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/1.20&lt;/a&gt;&lt;/li&gt; &lt;li&gt;Binaries at &lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.20.0-0-rc0&quot;&gt;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.20.0-0-rc0&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Checkout the v1.20 documentation section for detailed &lt;a href=&quot;/docs/v1.20/admin/installation&quot;&gt;installation instructions&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;It will be updated based on your feedback until it becomes robust enough to be released.&lt;/p&gt; &lt;h3&gt;Help write good release notes&lt;/h3&gt; &lt;p&gt;The best release notes are meant to articulate the needs and benefits of new features and the actions recommended for breaking changes so Forgejo admins quickly know if it is of interest to them.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#draft-1-20-0-0&quot;&gt;current draft release notes&lt;/a&gt; are still incomplete. They will be finished by the time the release is published and you can help make them better.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;the issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;the Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - May 2023</title><link>https://forgejo.org/2023-05-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2023-05-monthly-update/</guid><description>NLnet awarded a grant to Forgejo to develop its release process and additional features, starting June 2023. User blocking was implemented to protect repositories you own from unwanted interactions, an essential self-service moderation tool. An extended installation section was added to the documentation as well as a user and admin documentation for Forgejo Actions.</description><pubDate>Wed, 07 Jun 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Forgejo was &lt;a href=&quot;https://nlnet.nl/project/Forgejo/&quot;&gt;awarded grant&lt;/a&gt; from &lt;a href=&quot;https://nlnet.nl/&quot;&gt;https://nlnet.nl/&lt;/a&gt; which will allow Codeberg e.V. and community members to get funding for improving the Forgejo release process and develop additional features, starting June 2023. It complements the on-going grant dedicated to federation: the features it will provide can only be deployed if releases are published and tested to work in a secure environment.&lt;/p&gt; &lt;p&gt;The Codeberg moderation team is facing daily challenges that are a heavy burden. A new feature was implemented to allow &lt;a href=&quot;/docs/v1.20/user/blocking-user&quot;&gt;users to block someone&lt;/a&gt; in the repositories they own, allowing them to mitigate some of the most common problems. This not only helps relieve the pressure on the moderation team of any public Forgejo instance, it also is an essential building block for federation because it creates more opportunities for unwanted attention.&lt;/p&gt; &lt;h2&gt;Development&lt;/h2&gt; &lt;p&gt;Forgejo depends on Gitea and over a hundred other Go packages. But Gitea is not provided or designed as a package and that creates unique challenges when upgrading, which is done on a weekly basis. Forgejo developed &lt;a href=&quot;/docs/v1.20/developer/WORKFLOW&quot;&gt;workflows&lt;/a&gt; since its inception to reduce the workload.&lt;/p&gt; &lt;p&gt;Every automated test reduces the scrutiny required from Forgejo contributors when upgrading Gitea. This is specially challenging when dealing with the authentication system because it has almost no test coverage. A mechanism to allow for &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/8030&quot;&gt;dependency injection&lt;/a&gt; in integration tests was added as well as a simple OAuth2 test to demonstrate how to use it.&lt;/p&gt; &lt;p&gt;When upgrading Forgejo, database migrations are applied using a set of files and a sequential numbering to ensure their consistency. Forgejo specific database modifications &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/32&quot;&gt;cannot conveniently be inserted in that sequence&lt;/a&gt;. Instead, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/795&quot;&gt;a separate migration directory&lt;/a&gt; was created and manages a set of tables prefixed with &lt;code&gt;forgejo_&lt;/code&gt;. It was used in the implementation of the user blocking feature.&lt;/p&gt; &lt;h3&gt;User moderation feature&lt;/h3&gt; &lt;p&gt;Moderation features now &lt;a href=&quot;/docs/v1.20/developer/WORKFLOW#moderation&quot;&gt;have their dedicated feature branch&lt;/a&gt;. It will contain tools that fall in two categories: self-service to help users in the simpler cases and helpers for a dedicated moderation team with admin privileges who take care of the entire Forgejo instance.&lt;/p&gt; &lt;p&gt;The first to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/540&quot;&gt;land&lt;/a&gt; was &lt;a href=&quot;/docs/v1.20/user/blocking-user&quot;&gt;user blocking&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/802&quot;&gt;organization level blocking&lt;/a&gt; is in progress. Blocking another user is desirable if they are acting maliciously or are spamming your repository.&lt;/p&gt; &lt;h3&gt;Documentation&lt;/h3&gt; &lt;p&gt;A new section was added to the documentation with a very detailed explanation of how to &lt;a href=&quot;/docs/v1.20/admin/installation#installation-from-binary&quot;&gt;install and setup Forgejo using a binary&lt;/a&gt;. And also minimal install instructions for &lt;a href=&quot;/docs/v1.20/admin/installation#installation-with-docker&quot;&gt;container images&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Two other sections were also added for the &lt;a href=&quot;/docs/v1.20/admin/actions&quot;&gt;admin&lt;/a&gt; and &lt;a href=&quot;/docs/v1.20/user/actions&quot;&gt;user&lt;/a&gt; documentation of Forgejo Actions. It is still work in progress but provides the basics to &lt;a href=&quot;/docs/v1.20/user/actions#quick-start&quot;&gt;get started&lt;/a&gt; and replaces the &lt;a href=&quot;/2023-02-27-forgejo-actions&quot;&gt;older blog post&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Forgejo Actions&lt;/h3&gt; &lt;p&gt;A CI configuration for Forgejo was &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/.forgejo/workflows&quot;&gt;created based on Forgejo Actions&lt;/a&gt;. Although it has been tested to work, the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/.woodpecker&quot;&gt;Woodpecker CI&lt;/a&gt; is still used to validate pull requests. It will be run in parallel as soon as &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/36&quot;&gt;Codeberg enables Forgejo Actions&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Forgejo extensively uses &lt;a href=&quot;https://linuxcontainers.org/lxc/&quot;&gt;LXC&lt;/a&gt; in the Forgejo runner. A set of shell scripts &lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers/&quot;&gt;named lxc-helpers&lt;/a&gt; were developed, &lt;a href=&quot;https://code.forgejo.org/forgejo/lxc-helpers/actions?workflow=&amp;amp;state=closed&quot;&gt;tested&lt;/a&gt; (with Forgejo Actions) and documented in a separate repository. They are now used in various other contexts (the &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo&quot;&gt;setup-forgejo&lt;/a&gt; action or the &lt;a href=&quot;https://lab.enough.community/main/infrastructure/-/tree/master/playbooks/forgejo&quot;&gt;Ansible playbooks&lt;/a&gt; used to deploy Forgejo hardware).&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;Forgejo runner&lt;/a&gt; saw &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/releases&quot;&gt;more releases&lt;/a&gt; and is turning more secure (releases are now GPG signed), stable and configurable.&lt;/p&gt; &lt;h3&gt;Simpler and more secure release process&lt;/h3&gt; &lt;p&gt;The release process was &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/230&quot;&gt;revisited&lt;/a&gt;, taking the opportunity of the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;brand new Forgejo runner&lt;/a&gt; to do so. In a nutshell it is a set of &lt;a href=&quot;/docs/v1.20/user/actions&quot;&gt;Forgejo Actions&lt;/a&gt; workflows that behave differently depending on the variables/secrets that are available. The repository is automatically mirrored in different organizations (experimental, integration, release) that have different variables/secrets to perform their expected role.&lt;/p&gt; &lt;p&gt;Here is how it goes for the Forgejo runner:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;when in the &lt;code&gt;forgejo-integration&lt;/code&gt; organization, &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/.forgejo/workflows/build-release.yml&quot;&gt;build the release&lt;/a&gt;&lt;/li&gt; &lt;li&gt;when in the &lt;code&gt;forgejo-release&lt;/code&gt; organization, safely hosted behind a VPN, use the GPG release key &amp;amp; secrets to sign and copy the release that was created in the &lt;code&gt;forgejo-integration&lt;/code&gt; organization to &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/.forgejo/workflows/publish-binary.yml&quot;&gt;publish the binary release&lt;/a&gt; and &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/.forgejo/workflows/publish-container-image.yml&quot;&gt;the container image&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;Hardware&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#devops&quot;&gt;devops team&lt;/a&gt; completed the deployment of the new hardware at &lt;code&gt;octopuce.forgejo.org&lt;/code&gt;. It is now in production and part of the &lt;a href=&quot;https://codeberg.org/forgejo/website/pulls/230&quot;&gt;new release process&lt;/a&gt; that was used to produce the latest releases of the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/releases&quot;&gt;Forgejo runner&lt;/a&gt;. It provides a VPN for the release team to secure the last step which involves a workflow to sign the binaries.&lt;/p&gt; &lt;h2&gt;Funding&lt;/h2&gt; &lt;p&gt;The NLnet grant application focused on producing quality Forgejo releases that are essential for federation to happen was &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/1#issuecomment-921831&quot;&gt;granted&lt;/a&gt;. It will provide funding to Codeberg e.V., &lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt; for their work starting in June 2023. It complements the on-going grant that provides funding for developing moderation features.&lt;/p&gt; &lt;p&gt;The general assembly of Codeberg e.V. renewed its support to Forgejo and decided to allocate funding in 2023 to further Forgejo.&lt;/p&gt; &lt;h2&gt;Reconciliation and Moderation&lt;/h2&gt; &lt;p&gt;The &lt;code&gt;archive@matrix.org&lt;/code&gt; bot entered the Forgejo chatrooms and started operating. Some Forgejo community members did not approve and asked the &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#moderation&quot;&gt;moderation team&lt;/a&gt; to ban it. A &lt;a href=&quot;https://codeberg.org/forgejo/discussions/issues/37&quot;&gt;discussion began&lt;/a&gt; and will be concluded by a decision to accept or reject this bot.&lt;/p&gt; &lt;p&gt;A few months ago a chatroom was created and is dedicated to the reconciliation of Forgejo community members. Making peace after a dispute is not easy but it happened and sets an example that will hopefully inspire more reconciliations. Until that happens the moderation team offers to act as a buffer between community members so they can contribute to Forgejo, working side by side without being forced into stressful interactions.&lt;/p&gt; &lt;h2&gt;Licensing&lt;/h2&gt; &lt;p&gt;Following the decision that &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/20&quot;&gt;Forgejo will accept copylefted contributions&lt;/a&gt;, a blog post was &lt;a href=&quot;/2023-06-copyleft&quot;&gt;published to explain&lt;/a&gt; the reasoning. The next step is an agreement to &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/24&quot;&gt;accept contributions compatible with GPLv3-or-later&lt;/a&gt;.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/buhtz&quot;&gt;https://codeberg.org/buhtz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/circlebuilder&quot;&gt;https://codeberg.org/circlebuilder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/CleoMenezesJr&quot;&gt;https://codeberg.org/CleoMenezesJr&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DanielGibson&quot;&gt;https://codeberg.org/DanielGibson&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/eagle_idea&quot;&gt;https://codeberg.org/eagle_idea&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/editfund-founder&quot;&gt;https://codeberg.org/editfund-founder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ekaitz-zarraga&quot;&gt;https://codeberg.org/ekaitz-zarraga&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fluzz&quot;&gt;https://codeberg.org/fluzz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fr33domlover&quot;&gt;https://codeberg.org/fr33domlover&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GamePlayer-8&quot;&gt;https://codeberg.org/GamePlayer-8&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/greenpete&quot;&gt;https://codeberg.org/greenpete&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/gwymor&quot;&gt;https://codeberg.org/gwymor&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/JakobDev&quot;&gt;https://codeberg.org/JakobDev&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kryptonian&quot;&gt;https://codeberg.org/kryptonian&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/macfanpl&quot;&gt;https://codeberg.org/macfanpl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/matiaslavik&quot;&gt;https://codeberg.org/matiaslavik&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mikaela&quot;&gt;https://codeberg.org/Mikaela&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/paintgoblin&quot;&gt;https://codeberg.org/paintgoblin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/prcek&quot;&gt;https://codeberg.org/prcek&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Sevichecc&quot;&gt;https://codeberg.org/Sevichecc&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/testserver22&quot;&gt;https://codeberg.org/testserver22&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tgy&quot;&gt;https://codeberg.org/tgy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thatonecalculator&quot;&gt;https://codeberg.org/thatonecalculator&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/timmwille&quot;&gt;https://codeberg.org/timmwille&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wxiaoguang&quot;&gt;https://codeberg.org/wxiaoguang&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xy&quot;&gt;https://codeberg.org/xy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zander&quot;&gt;https://codeberg.org/zander&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo welcomes copyleft contributions</title><link>https://forgejo.org/2023-06-copyleft/</link><guid isPermaLink="true">https://forgejo.org/2023-06-copyleft/</guid><description>The world of Free Software includes copylefted software and Git is one of the most widely known example. Distributing Forgejo under a permissive license means that all copyleft authors and software are excluded from participating in its development. The community made a decision to change that status quo and welcome copyleft contributions, just like Git.</description><pubDate>Tue, 06 Jun 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Developers who choose to publish their work under a copyleft license are excluded from participating in software that is published under a permissive license. That is at the opposite of the &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/MISSION.md#values&quot;&gt;core values&lt;/a&gt; of the Forgejo project and &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/20&quot;&gt;it was decided to also accept copylefted&lt;/a&gt; contributions. Will this change anything for Forgejo users? Not a thing since they already use and install one of the most successful copyleft software alongside Forgejo: Git. Will this change anything for Forgejo developers? Not a thing since they can keep contributing under the license of their choice. &lt;strong&gt;Just like Git, Forgejo will be copyleft.&lt;/strong&gt;&lt;/p&gt; &lt;h2&gt;Forgejo users already welcome copyleft&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;a href=&quot;https://en.wikipedia.org/wiki/Forge_(software)&quot;&gt;software forge&lt;/a&gt;, an online development environment, based on &lt;a href=&quot;https://en.wikipedia.org/wiki/Git&quot;&gt;Git&lt;/a&gt;. &lt;strong&gt;Both Forgejo and Git must be installed together&lt;/strong&gt;, either as individual binaries or bundled into the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.19-rootless&quot;&gt;official container images&lt;/a&gt;. The license of Git is &lt;a href=&quot;https://git-scm.com/about/free-and-open-source&quot;&gt;GNU GPLv2&lt;/a&gt; which is a &lt;a href=&quot;https://www.gnu.org/licenses/copyleft.html&quot;&gt;copyleft license&lt;/a&gt;. Although the Forgejo codebase includes basic support for &lt;a href=&quot;https://github.com/go-git/go-git&quot;&gt;go-git&lt;/a&gt;, a Go package distributed under a permissive license that can be used in place of Git, it is not supported or packaged because it is &lt;a href=&quot;https://github.com/go-git/go-git/blob/master/COMPATIBILITY.md&quot;&gt;not fully compatible&lt;/a&gt; and could corrupt Git repositories.&lt;/p&gt; &lt;p&gt;There are legal obligations attached to copyleft software which are, in a nutshell, to offer the source code with the binary under the same license. For instance, if an employee was to distribute a Git binary to someone else, the organization they work for can be required to also provide the &lt;a href=&quot;https://sfconservancy.org/copyleft-compliance/glossary.html&quot;&gt;complete and corresponding source&lt;/a&gt;. And if they fail to do so, they may loose all their rights under the license, at least until the copyright holders agree to grant them back. For this reason some organizations exclude copyelfted software entirely. However, &lt;strong&gt;when they use Git, it means the legal counsel has no objection to copylefted software.&lt;/strong&gt;&lt;/p&gt; &lt;h2&gt;What will change in Forgejo?&lt;/h2&gt; &lt;p&gt;The license of Forgejo will change to be copyleft when a copylefted work is merged. The most likely candidate is, for instance, when a Go package is discovered that provides an interesting functionality.&lt;/p&gt; &lt;p&gt;Before it happens a decision will be made by the community to choose a copyleft license, in accordance to the &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/DECISION-MAKING.md&quot;&gt;Forgejo decision making process&lt;/a&gt;. The chosen license will apply to Forgejo as a whole (binary and sources) but each file within the codebase will retain its own license. This is nothing new as Forgejo &lt;a href=&quot;https://code.forgejo.org/assets/js/licenses.txt&quot;&gt;already includes various licenses&lt;/a&gt; and contributors are expected to agree to the &lt;a href=&quot;/docs/v1.20/developer/DCO&quot;&gt;Developer Certificate of Origin&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Developers who feel strongly about exclusively publishing their work under a permissive license can keep doing so when working on Forgejo. By the terms of this permissive license, they accept that their work can be sublicensed and redistributed under a proprietary license. And they also accept that it can be sublicensed and redistributed as part of Forgejo, under a copyleft license.&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - April 2023</title><link>https://forgejo.org/2023-04-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2023-04-monthly-update/</guid><description>Codeberg upgraded to Forgejo v1.19 and, as can be expected from the largest instance in existence, hit a performance issue which was dealt with quickly. The security of Forgejo actions and the release process was a focus with solutions being found that involve LXC and a VPN. Federation is taking a step forward with the F3 driver entering the Forgejo development branch.</description><pubDate>Sat, 20 May 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Codeberg upgraded to Forgejo v1.19 and, as can be expected from the largest instance in existence, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/680&quot;&gt;hit a performance issue&lt;/a&gt; which was dealt with quickly.&lt;/p&gt; &lt;p&gt;The security of Forgejo actions and the release process was a strong focus. It is critical for Forgejo actions to be used in production safely: a random Codeberg user must be able to rely on the CI by submitting a pull request without putting the underlying infrastructure at risk. A solution based on &lt;a href=&quot;https://linuxcontainers.org/lxc/&quot;&gt;LXC&lt;/a&gt; is implemented. To improve the security of the release pipeline, the devops team is deploying a Forgejo instance and runner on a dedicated hardware behind a VPN to sign the binaries.&lt;/p&gt; &lt;p&gt;There also are noteworthy activities in the &lt;a href=&quot;https://codeberg.org/forgejo-contrib/delightful-forgejo&quot;&gt;wider Forgejo community&lt;/a&gt; not covered in this update.&lt;/p&gt; &lt;h3&gt;Forgejo v1.19 point releases&lt;/h3&gt; &lt;p&gt;Three point releases were published (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-19-1-0&quot;&gt;1.19.1-0&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-19-2-0&quot;&gt;1.19.2-0&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-19-3-0&quot;&gt;1.19.3-0&lt;/a&gt;).&lt;/p&gt; &lt;p&gt;Codeberg.org waited until Forgejo v1.19 proved to be stable enough to upgrade. It did not go smoothly because of a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/680&quot;&gt;performance issue&lt;/a&gt;. However, a diagnostic and a workaround were found and applied within 24h. This problem impacts all Forgejo v1.19 instances but was only noticed in Codeberg.org because of its scale. It will be properly fixed in the next point release.&lt;/p&gt; &lt;p&gt;To make them easier to digest for the Forgejo administrators and users, the release notes now have detailed explanations of the most prominent changes. This is specially useful for security fixes to better understand their impact and evaluate the urgency of the update on a case by case basis.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;/docs/v1.19/user/semver&quot;&gt;Forgejo semantic version&lt;/a&gt; is included in the release notes as a reminder that it can be used for scripting to automatically identify a release that includes a breaking change and avoid unexpected downtime.&lt;/p&gt; &lt;h3&gt;A step towards federation&lt;/h3&gt; &lt;p&gt;For federation to happen, Forgejo instances must be able to mirror each other. It is different from being able to migrate a project from one instance to another. The &lt;a href=&quot;https://forum.forgefriends.org/t/about-the-friendly-forge-format-f3/681&quot;&gt;F3&lt;/a&gt; reference &lt;a href=&quot;https://lab.forgefriends.org/friendlyforgeformat/gof3&quot;&gt;implementation&lt;/a&gt;, which is still in development stage, will allow for mirroring a single issue as well as an entire project.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commits/branch/forgejo-f3&quot;&gt;F3 driver&lt;/a&gt; was developed for Forgejo and merged into the development branch. It is not ready for experimenting but it passes some integration tests and will be part of the weekly round of rebase together with the other Forgejo feature branches.&lt;/p&gt; &lt;h3&gt;Forgejo actions progress&lt;/h3&gt; &lt;p&gt;As an experimental feature, &lt;a href=&quot;/2023-02-27-forgejo-actions&quot;&gt;Forgejo actions&lt;/a&gt; keeps improving. The &lt;a href=&quot;https://codeberg.org/forgejo/runner&quot;&gt;Forgejo runner&lt;/a&gt; saw a few more releases, &lt;a href=&quot;https://codeberg.org/forgejo/runner/src/branch/main/.forgejo/workflows/release.yml&quot;&gt;using itself&lt;/a&gt; in a nicely recursive way.&lt;/p&gt; &lt;p&gt;It is developed on &lt;a href=&quot;https://code.forgejo.org/&quot;&gt;code.forgejo.org&lt;/a&gt; which runs Forgejo v1.19 and includes a CLI that allows it to obtain a registration token: &lt;code&gt;forgejo actions generate-runner-token&lt;/code&gt;. It was not documented or advertised which led to confusion when it was changed to match the Gitea implementation that came later. It is fine when a feature is experimental. But it was a reminder that care must be taken when introducing new features in Forgejo so they do not conflict with Gitea and other dependencies.&lt;/p&gt; &lt;p&gt;&lt;a href=&quot;https://linuxcontainers.org/lxc/&quot;&gt;LXC&lt;/a&gt; is confirmed to be a good option for job isolation. The runner is based on &lt;a href=&quot;https://github.com/nektos/act/&quot;&gt;ACT&lt;/a&gt; which is designed to run jobs on a local machine and assumes its user is trusted. When running a job from a pull request authored by less trusted users, their ability to use docker as a mean to access files from the host becomes problematic. One option is to spawn a &lt;a href=&quot;https://hub.docker.com/_/docker/tags?page=1&amp;amp;name=dind&quot;&gt;dind&lt;/a&gt; on every job. Another is to run the job in LXC.&lt;/p&gt; &lt;h3&gt;Hardware infrastructure&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#devops&quot;&gt;devops team&lt;/a&gt; was &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/21&quot;&gt;appointed&lt;/a&gt; in accordance to the &lt;a href=&quot;https://codeberg.org/forgejo-contrib/governance/src/branch/main/DECISION-MAKING.md&quot;&gt;decision making process&lt;/a&gt;. It is responsible for the day to day operations of &lt;a href=&quot;https://code.forgejo.org&quot;&gt;https://code.forgejo.org&lt;/a&gt;, &lt;a href=&quot;https://next.forgejo.org&quot;&gt;https://next.forgejo.org&lt;/a&gt; and &lt;a href=&quot;https://forgejo-ci.codeberg.org&quot;&gt;https://forgejo-ci.codeberg.org&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;A new hardware at &lt;code&gt;octopuce.forgejo.org&lt;/code&gt; is being deployed and provides a VPN for the release team to secure the last step which involves a pipeline to sign the binaries. It reduces the &lt;a href=&quot;https://en.wikipedia.org/wiki/Attack_surface&quot;&gt;attack surface&lt;/a&gt; compared to using a public facing Forgejo instance to do the same. It will first be used for releasing the Forgejo runner and, when stabilized, Forgejo itself.&lt;/p&gt; &lt;h2&gt;Grant applications&lt;/h2&gt; &lt;p&gt;The NLnet grant application focused on producing quality Forgejo releases that are essential for federation to happen was &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/1#issuecomment-911709&quot;&gt;accepted to the next step&lt;/a&gt;. This is the last one and it will few weeks before the final decision is known.&lt;/p&gt; &lt;h2&gt;Moderation team&lt;/h2&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#moderation&quot;&gt;moderation team&lt;/a&gt; now has &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/23&quot;&gt;one member&lt;/a&gt;. All moderation actions are &lt;a href=&quot;https://codeberg.org/forgejo/governance/src/branch/main/MODERATION-PROCESS.md&quot;&gt;bound to the moderation process&lt;/a&gt; for transparency and audit by the Forgejo community.&lt;/p&gt; &lt;h2&gt;Licensing&lt;/h2&gt; &lt;p&gt;It was decided on principle that &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/20&quot;&gt;Forgejo would accept copylefted contributions&lt;/a&gt;. Before it happens a decision will need be made on the choice of a license. Until then the licensing terms of Forgejo are not modified.&lt;/p&gt; &lt;h2&gt;We Forge&lt;/h2&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bat&quot;&gt;https://codeberg.org/bat&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/borega&quot;&gt;https://codeberg.org/borega&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/braydofficial&quot;&gt;https://codeberg.org/braydofficial&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/carlokok&quot;&gt;https://codeberg.org/carlokok&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/circlebuilder&quot;&gt;https://codeberg.org/circlebuilder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DanielGibson&quot;&gt;https://codeberg.org/DanielGibson&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fluzz&quot;&gt;https://codeberg.org/fluzz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fr33domlover&quot;&gt;https://codeberg.org/fr33domlover&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kuhnchris&quot;&gt;https://codeberg.org/kuhnchris&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/LordMZTE&quot;&gt;https://codeberg.org/LordMZTE&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Lvceo&quot;&gt;https://codeberg.org/Lvceo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/msrd0&quot;&gt;https://codeberg.org/msrd0&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/NextFire&quot;&gt;https://codeberg.org/NextFire&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/silverwind&quot;&gt;https://codeberg.org/silverwind&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/soas&quot;&gt;https://codeberg.org/soas&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/spooky-overwrite&quot;&gt;https://codeberg.org/spooky-overwrite&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Valenoern&quot;&gt;https://codeberg.org/Valenoern&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/WRMSR&quot;&gt;https://codeberg.org/WRMSR&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wxiaoguang&quot;&gt;https://codeberg.org/wxiaoguang&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xtex&quot;&gt;https://codeberg.org/xtex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xy&quot;&gt;https://codeberg.org/xy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zander&quot;&gt;https://codeberg.org/zander&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - March 2023</title><link>https://forgejo.org/2023-03-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2023-03-monthly-update/</guid><description>Forgejo v1.19, the first major upgrade, was published by the release team. Although still experimental, Forgejo Actions is now used daily to develop and maintain the runner. The `setup-forgejo` action was created to spawn a Forgejo instance for the duration of a test.</description><pubDate>Mon, 10 Apr 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.19.0-2&quot;&gt;Forgejo v1.19&lt;/a&gt; was published. It is the first major upgrade and was a critical milestone to verify the development strategy of the soft fork actually works. The release team was &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues?q=application%20to%20release%20team&amp;amp;type=all&amp;amp;sort=&amp;amp;state=closed&amp;amp;labels=&amp;amp;milestone=0&amp;amp;assignee=0&amp;amp;poster=0&quot;&gt;legitimized by the community&lt;/a&gt; in accordance to the &lt;a href=&quot;https://codeberg.org/forgejo-contrib/governance/src/branch/main/DECISION-MAKING.md&quot;&gt;decision making process&lt;/a&gt;, as promised when Forgejo was created.&lt;/p&gt; &lt;p&gt;Forgejo Actions, the experimental integrated CI, now runs on the new Forgejo infrastructure which includes two instance. One &lt;a href=&quot;https://next.forgejo.org&quot;&gt;for experimenting and debugging&lt;/a&gt; and another dedicated to &lt;a href=&quot;https://code.forgejo.org&quot;&gt;Forgejo development&lt;/a&gt;. In a spirit of dogfooding, the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;Forgejo runner&lt;/a&gt; that spawns CI jobs is now &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/.forgejo/workflows/release.yml&quot;&gt;released using Forgejo Actions&lt;/a&gt;. A new action, &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo&quot;&gt;setup-forgejo&lt;/a&gt; was also created to conveniently spawn a Forgejo instance for the duration of a test.&lt;/p&gt; &lt;p&gt;There also are noteworthy activities in the &lt;a href=&quot;https://codeberg.org/forgejo-contrib/delightful-forgejo&quot;&gt;wider Forgejo community&lt;/a&gt; not covered in this update.&lt;/p&gt; &lt;h3&gt;Forgejo v1.19 release&lt;/h3&gt; &lt;p&gt;On 21 March 2023 &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.19.0-2&quot;&gt;Forgejo v1.19&lt;/a&gt; was &lt;a href=&quot;/2023-03-release-v1&quot;&gt;released&lt;/a&gt;. It was challenging to figure out how &lt;a href=&quot;/docs/v1.19&quot;&gt;the new documentation&lt;/a&gt; and additional binaries required for &lt;a href=&quot;/2023-02-27-forgejo-actions&quot;&gt;Forgejo Actions&lt;/a&gt; fit in.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;The documentation is versioned and maintained in a directory that has the same name as the Forgejo release&lt;/li&gt; &lt;li&gt;The &lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;Forgejo runner&lt;/a&gt; is released independently and tested to be compatibility with existing Forgejo releases&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Forgejo v1.19 includes all of Gitea v1.19 and the upgrade went smoothly. If Gitea was a Go package with a documented API it would be as easy as upgrading one of the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/4c132e77ea2cba9a1161f4cfc18b82b9e2e1b35f/go.mod&quot;&gt;other Forgejo dependencies&lt;/a&gt;. But it is not and that&apos;s where the difficulty of a soft fork resides.&lt;/p&gt; &lt;p&gt;The Forgejo strategy, since its inception, is to rebase &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/milestones?state=closed&amp;amp;q=rebase&quot;&gt;on top of Gitea weekly&lt;/a&gt;. The Forgejo commit series are kept to a minimum (for instance by &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/590&quot;&gt;squashing related commits&lt;/a&gt;) and conflicts, if any, are resolved (for instance &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/pulls/552&quot;&gt;changing from less to css&lt;/a&gt; required reworking the commit implementing the Forgejo themes). It turns out to be sustainable and the associated maintenance work stays the same over time. Considering that hundreds of commits have been merged in Forgejo over the past four months, there were many opportunities for a rebase to go wrong and get stuck because of conflicts. The absence of problems during the Forgejo v1.19 release is a sign that this strategy is working.&lt;/p&gt; &lt;p&gt;When Forgejo started, people stepped up to create the releases. There was no decision making process at the time and no clear way for the community to agree that they could be trusted with this role. They were part of &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/commit/f46d4279c7b562648bbc17afedfe044b774185ac/CONTRIBUTING/GOVERNANCE.md#interim-forgejo-governance&quot;&gt;an interim governance&lt;/a&gt; and pledged to resign as soon as a governance was in place. They fulfilled this promise 2 March 2023 by &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues?q=application%20to%20release%20team&amp;amp;type=all&amp;amp;sort=&amp;amp;state=closed&amp;amp;labels=&amp;amp;milestone=0&amp;amp;assignee=0&amp;amp;poster=0&quot;&gt;applying&lt;/a&gt; to become legitimate members of the Forgejo release team in accordance to the &lt;a href=&quot;https://codeberg.org/forgejo-contrib/governance/src/branch/main/DECISION-MAKING.md&quot;&gt;decision making process&lt;/a&gt;. They got an agreement a few weeks later and there now is a Forgejo release team agreed upon by the Forgejo community.&lt;/p&gt; &lt;h3&gt;A dedicated Forgejo infrastructure&lt;/h3&gt; &lt;h4&gt;next.forgejo.org&lt;/h4&gt; &lt;p&gt;A volatile Forgejo v1.19 instance dedicated to trying new features and demonstrate bugs is now running at &lt;a href=&quot;https://next.forgejo.org&quot;&gt;https://next.forgejo.org&lt;/a&gt;. It is &lt;a href=&quot;/&quot;&gt;linked from the website&lt;/a&gt; and in the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/new?template=.gitea%2fISSUE_TEMPLATE%2fbug-report.md&quot;&gt;bug report template&lt;/a&gt;.&lt;/p&gt; &lt;h4&gt;code.forgejo.org&lt;/h4&gt; &lt;p&gt;The experimental integrated CI that comes with Forgejo v1.19 is not just a new feature, it also depends on:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;a new binary, &lt;a href=&quot;https://code.forgejo.org/forgejo/runner&quot;&gt;Forgejo runner&lt;/a&gt;, that is responsible for running the CI jobs&lt;/li&gt; &lt;li&gt;a repository of &lt;a href=&quot;https://code.forgejo.org/actions&quot;&gt;reusable Free Software Actions&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;They both need to be tested and it would be convenient if Forgejo Actions was enabled on Codeberg. There would be no need for Codeberg to provide a runner: it can be run and connected independently, using a token specific to a given repository. Forgejo would spawn a runner and it would work without requiring any resource from Codeberg. However, there are at least two reasons for waiting until Forgejo v1.20 or v1.21 before enabling this feature on Codeberg, even without providing runners to Codeberg users:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;it is still experimental and fragile&lt;/li&gt; &lt;li&gt;it may have security issues&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;To solve that problem an instance of Forgejo was installed at &lt;a href=&quot;https://code.forgejo.org&quot;&gt;https://code.forgejo.org&lt;/a&gt;. It has a registration open to Codeberg users and is dedicated to Forgejo related development. It has Actions enabled and provides a runner to selected repositories.&lt;/p&gt; &lt;h4&gt;The devops team&lt;/h4&gt; &lt;p&gt;These machines need devops and &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues?type=all&amp;amp;state=open&amp;amp;labels=&amp;amp;milestone=0&amp;amp;assignee=0&amp;amp;poster=0&amp;amp;q=devops+team&quot;&gt;applications to the devops team&lt;/a&gt; are in progress. Their role is, in a nutshell, to keep all machines Forgejo depends on in a healthy state. That includes the &lt;a href=&quot;https://codeberg.org/forgejo/sustainability#hardware&quot;&gt;new machine&lt;/a&gt; made available to the Forgejo project, which could be used to host code.forgejo.org.&lt;/p&gt; &lt;h3&gt;Dogfooding Forgejo Actions&lt;/h3&gt; &lt;p&gt;Forgejo provides some essential Actions in a &lt;a href=&quot;https://code.forgejo.org/actions&quot;&gt;dedicated organization&lt;/a&gt;. As one can expect of any function in Go or Python, Actions are not immune to typos, regressions or subtle misbehavior, just like the software they are designed to test. Testing is even more important in a distributed environment where each Action is maintained by different groups of people and have their own lifecycle.&lt;/p&gt; &lt;p&gt;The CI of the &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/&quot;&gt;Forgejo Runner&lt;/a&gt; itself relies on workflows that use actions for:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Running &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/.forgejo/workflows/test.yml&quot;&gt;unit tests&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/.forgejo/workflows/release.yml&quot;&gt;Publishing&lt;/a&gt; its own &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/releases&quot;&gt;releases&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://code.forgejo.org/forgejo/runner/src/branch/main/.forgejo/workflows/release.yml&quot;&gt;Integration testing&lt;/a&gt; to verify it performs as intended with a live Forgejo instance&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The Forgejo Runner integration tests &lt;a href=&quot;https://codeberg.org/forgejo/runner/src/commit/bcd6096e5b0fb701eca85a391c0dafb0f606fc85/.forgejo/workflows/integration.yml#L16-L21&quot;&gt;uses&lt;/a&gt; a new &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo&quot;&gt;setup-forgejo action&lt;/a&gt;. It runs a Forgejo instance for the duration of the test, very much like a MySQL or PostgreSQL service. It can conveniently be used by software that depends on Forgejo, for instance to test interactions with the Forgejo API instead of relying on mocks.&lt;/p&gt; &lt;p&gt;The &lt;code&gt;setup-forgejo&lt;/code&gt; action uses itself, recursively, for &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo/src/branch/main/.forgejo/workflows/integration.yml&quot;&gt;integration testing&lt;/a&gt; with two levels of nesting:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Forgejo 0: &lt;a href=&quot;https://code.forgejo.org&quot;&gt;https://code.forgejo.org&lt;/a&gt; is a Forgejo instance that hosts &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo&quot;&gt;setup-forgejo&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;Forgejo 1: when a pull request is proposed &lt;code&gt;setup-forgejo&lt;/code&gt;, the CI job creates a brand new Forgejo instance with a runner to experiment with the proposed change.&lt;/li&gt; &lt;li&gt;Forgejo 2: The &lt;a href=&quot;https://code.forgejo.org/actions/setup-forgejo/src/branch/main/testdata/sanity-checks/.forgejo/workflows/test.yml&quot;&gt;experiment&lt;/a&gt; consists of running &lt;code&gt;setup-forgejo&lt;/code&gt; and verify the Forgejo instance it creates actually works as expected.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;This is &lt;a href=&quot;https://code.forgejo.org/forgejo/act/commit/bc24ebba1bceacf5c2d890caef9ad824ad9d2f80&quot;&gt;made possible&lt;/a&gt; by enabling &lt;a href=&quot;https://linuxcontainers.org/&quot;&gt;LXC&lt;/a&gt; system containers in the runner. With the additional benefit of allowing &lt;code&gt;systemd&lt;/code&gt; to run, installing &lt;code&gt;docker&lt;/code&gt; instead of &lt;code&gt;dind&lt;/code&gt; etc.&lt;/p&gt; &lt;h3&gt;The Forgejo Community is healing&lt;/h3&gt; &lt;p&gt;In February 2023 someone new (who wasn&apos;t a contributor that the project is relying on) joined the chat and issue tracker, spoke repeatedly in ways that was hurtful/painful to Forgejo community members, and did not seem to have capacity to speak more sensitively, despite offers for support and repeated requests. It was eventually decided to &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/8&quot;&gt;remove this person from the project&lt;/a&gt; during a year. But the tension they created did not dissipate instantly. In March 2023 it distracted community members from productive and important work on governance, strategy and development. Some community members went silent, others were on edge and &lt;a href=&quot;https://codeberg.org/forgejo/governance/issues/16&quot;&gt;more moderation actions were taken&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;It is in the nature of inclusive communities to be subject to that sort of trouble in their infancy, when they are still fragile. Some can be destroyed for good, others may choose to be less inclusive to better protect the members of their inner circles. Something different is happening in Forgejo. Late March it went back to be the quiet and productive space it once was. Community members who were silent during the troubles came back. A &lt;a href=&quot;https://codeberg.org/forgejo/governance/pulls/17/files&quot;&gt;moderation process&lt;/a&gt; was proposed and was field tested. It is a little early to be sure but it appears the community is healing and is now better protected from negative influence, without sacrificing on inclusiveness.&lt;/p&gt; &lt;h3&gt;Grant applications&lt;/h3&gt; &lt;p&gt;As a followup to questions sent by NLnet on &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/1&quot;&gt;a grant application&lt;/a&gt; to create a Forgejo distribution, potential beneficiaries worked on a &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/1#issuecomment-855819&quot;&gt;detailed project plan&lt;/a&gt;. It was sent late March and it will take a few weeks before a reply is received to determine if it is allowed to proceed to the next step.&lt;/p&gt; &lt;p&gt;Another &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/4#issuecomment-840994&quot;&gt;grant application focused on improving Forgejo UI/UX&lt;/a&gt; was declined.&lt;/p&gt; &lt;h3&gt;We Forge&lt;/h3&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/aral&quot;&gt;https://codeberg.org/aral&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/circlebuilder&quot;&gt;https://codeberg.org/circlebuilder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/cweiske&quot;&gt;https://codeberg.org/cweiske&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/delvh&quot;&gt;https://codeberg.org/delvh&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Eragon&quot;&gt;https://codeberg.org/Eragon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fr33domlover&quot;&gt;https://codeberg.org/fr33domlover&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fsologureng&quot;&gt;https://codeberg.org/fsologureng&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/GamePlayer-8&quot;&gt;https://codeberg.org/GamePlayer-8&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Gusted&quot;&gt;https://codeberg.org/Gusted&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jan_x7&quot;&gt;https://codeberg.org/jan_x7&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jerger&quot;&gt;https://codeberg.org/jerger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KOLANICH&quot;&gt;https://codeberg.org/KOLANICH&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/NextFire&quot;&gt;https://codeberg.org/NextFire&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/redwerkz&quot;&gt;https://codeberg.org/redwerkz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Ryuno-Ki&quot;&gt;https://codeberg.org/Ryuno-Ki&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SHuRiKeN&quot;&gt;https://codeberg.org/SHuRiKeN&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tallship&quot;&gt;https://codeberg.org/tallship&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/TheEvilSkeleton&quot;&gt;https://codeberg.org/TheEvilSkeleton&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/trymeout&quot;&gt;https://codeberg.org/trymeout&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/uda&quot;&gt;https://codeberg.org/uda&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/wxiaoguang&quot;&gt;https://codeberg.org/wxiaoguang&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xtex&quot;&gt;https://codeberg.org/xtex&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xy&quot;&gt;https://codeberg.org/xy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zander&quot;&gt;https://codeberg.org/zander&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo v1.19 is available</title><link>https://forgejo.org/2023-03-release-v1190-2/</link><guid isPermaLink="true">https://forgejo.org/2023-03-release-v1190-2/</guid><description>Forgejo v1.19 is available and comes with an extensive documentation, an experimental CI, incoming emails, scoped access tokens, registries for Cargo, Chef &amp; Conda and more.</description><pubDate>Tue, 21 Mar 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.19.0-2&quot;&gt;Forgejo v1.19.0-2&lt;/a&gt; was released. It comes with an extensive &lt;a href=&quot;/docs/v1.19/user&quot;&gt;user guide&lt;/a&gt;, derived for the most part from the &lt;a href=&quot;https://docs.codeberg.org/&quot;&gt;Codeberg documentation&lt;/a&gt;. The new &lt;a href=&quot;/docs/v1.19/admin&quot;&gt;admin guide&lt;/a&gt; covers upgrades and configuration of Forgejo instances.&lt;/p&gt; &lt;p&gt;The most prominent new features are:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;strong&gt;&lt;a href=&quot;/2023-02-27-forgejo-actions&quot;&gt;Actions&lt;/a&gt;&lt;/strong&gt;: an experimental CI/CD, although not ready for real world usage, is present and &lt;a href=&quot;/2023-02-27-forgejo-actions&quot;&gt;can be used to run a demo&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v1.19/admin/incoming-email&quot;&gt;Incoming emails&lt;/a&gt;&lt;/strong&gt;: you can now set up Forgejo to receive incoming emails. When enabled, it is possible to reply to an email notification from Forgejo and (i) add a comment to an issue or a pull request, (ii) unsubscribe to notifications.&lt;/li&gt; &lt;li&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v1.19/user/oauth2-provider#scoped-tokens&quot;&gt;Scoped access tokens&lt;/a&gt;&lt;/strong&gt;: Forgejo access token, used with the &lt;a href=&quot;/docs/v1.19/user/api-usage&quot;&gt;API&lt;/a&gt;, can now have a &quot;scope&quot; that limits what it can access.&lt;/li&gt; &lt;li&gt;&lt;strong&gt;&lt;a href=&quot;/docs/v1.19/user/packages&quot;&gt;Package registries&lt;/a&gt;&lt;/strong&gt; now support &lt;a href=&quot;/docs/v1.19/user/packages/cargo&quot;&gt;Cargo&lt;/a&gt;, &lt;a href=&quot;/docs/v1.19/user/packages/conda&quot;&gt;Conda&lt;/a&gt; and &lt;a href=&quot;/docs/v1.19/user/packages/chef&quot;&gt;Chef&lt;/a&gt;.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Read more &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-19-0-2&quot;&gt;in the Forgejo v1.19.0-2 release notes&lt;/a&gt;&lt;/p&gt; &lt;h3&gt;Get Forgejo v1.19&lt;/h3&gt; &lt;p&gt;See the &lt;a href=&quot;/download&quot;&gt;download page&lt;/a&gt; for instructions on how to install Forgejo, and read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-19-0-2&quot;&gt;release notes&lt;/a&gt; for more information.&lt;/p&gt; &lt;h3&gt;Upgrading&lt;/h3&gt; &lt;p&gt;Carefully read &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-19-0-2&quot;&gt;the breaking changes&lt;/a&gt; section of the release notes.&lt;/p&gt; &lt;p&gt;The actual upgrade process is as simple as replacing the binary or container image with the corresponding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.19.0-2&quot;&gt;Forgejo binary&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.19.0-2&quot;&gt;container image&lt;/a&gt;. If you&apos;re using the container images, you can use the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.19&quot;&gt;&lt;code&gt;1.19&lt;/code&gt; tag&lt;/a&gt; to stay up to date with the latest &lt;code&gt;1.19.x&lt;/code&gt; point release automatically.&lt;/p&gt; &lt;p&gt;Make sure to check the &lt;a href=&quot;/docs/v1.19/admin/upgrade&quot;&gt;Forgejo upgrade documentation&lt;/a&gt; for recommendations on how to properly backup your instance before the upgrade. It also covers upgrading from Gitea, as far back as version 1.2.0. Forgejo includes all of Gitea v1.19, with improvements.&lt;/p&gt; &lt;p&gt;The Forgejo instances &lt;a href=&quot;/2023-02-12-tags&quot;&gt;built from an incorrect tag&lt;/a&gt; can safely be upgraded.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports, find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop into &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) and say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo gets an integrated CI named Actions</title><link>https://forgejo.org/2023-02-27-forgejo-actions/</link><guid isPermaLink="true">https://forgejo.org/2023-02-27-forgejo-actions/</guid><description>With the release of Forgejo v1.19 comes an experimental integrated CI similar to GitHub. It aims at being easier to configure than an external CI and is controled via the Forgejo web interface.</description><pubDate>Mon, 27 Feb 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Prior to Forgejo v1.19 running CI jobs required a third party software such as Woodpecker CI. It has its own web interface, relies on webhooks to be notified something changed in a repository and relies on the Forgejo API to figure out user permissions or access to private repositories. When it is finished, the error or success is also sent back to Forgejo via the API, with a link the user needs to click to get more details. It works well enough and Forgejo has been using Woodpecker CI from day one, for &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/.woodpecker&quot;&gt;testing pull requests&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/releases&quot;&gt;publishing releases&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;With v1.19 comes an experimental CI (not ready for production just yet) integrated in Forgejo. The CI jobs are configured with a syntax that is similar to GitHub Actions:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;# .forgejo/workflows/demo.yaml name: Demo run-name: ${{ github.actor }} is testing on: [push] jobs: Explore-CI: runs-on: ubuntu-latest steps: - run: echo &quot;The job was automatically triggered by a ${{ github.event_name }} event.&quot; - run: echo &quot;This job is now running on a ${{ runner.os }} server.&quot; - run: echo &quot;The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}.&quot; - name: Check out repository code uses: actions/checkout@v3 - run: echo &quot;The ${{ github.repository }} repository has been cloned to the runner.&quot; - run: echo &quot;The workflow is now ready to test your code on the runner.&quot; - name: List files in the repository run: | ls ${{ github.workspace }} - run: echo &quot;This job&apos;s status is ${{ job.status }}.&quot; &lt;/code&gt;&lt;/pre&gt; &lt;p&gt;And the results are displayed in the Forgejo web interface:&lt;/p&gt; &lt;p&gt;&lt;/p&gt; &lt;h3&gt;Try it out&lt;/h3&gt; &lt;p&gt;&lt;em&gt;WARNING: The following procedure was effective for setting up a test instance when early versions of the Forgejo runner were under development, but the details are now outdated. Precompiled &lt;a href=&quot;https://code.forgejo.org/forgejo/runner/releases&quot;&gt;runner binaries&lt;/a&gt; are available and you should refer to the &lt;a href=&quot;https://forgejo.org/docs/latest/admin/actions/&quot;&gt;Forgejo Actions administrator documentation&lt;/a&gt; for runner setup instructions.&lt;/em&gt;&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Create a Forgejo v1.19 instance with the user root password admin1234&lt;pre&gt;&lt;code&gt;docker run --name forgejo -e FORGEJO__security__INSTALL_LOCK=true -e FORGEJO__actions__ENABLED=true -d codeberg.org/forgejo-experimental/forgejo:1.19 docker exec --user 1000 forgejo forgejo admin user create --admin --username root --password admin1234 --email root@example.com &lt;/code&gt;&lt;/pre&gt; &lt;/li&gt; &lt;li&gt;Get the IP of the Forgejo instance (172.17.0.2 in the following)&lt;pre&gt;&lt;code&gt;docker exec --user 1000 forgejo ip a &lt;/code&gt;&lt;/pre&gt; &lt;/li&gt; &lt;li&gt;Login at &lt;a href=&quot;http://172.17.0.2:3000/&quot;&gt;http://172.17.0.2:3000/&lt;/a&gt; with user root password admin1234&lt;/li&gt; &lt;li&gt;Create a test project and activate actions in the settings &lt;/li&gt; &lt;li&gt;Get the runner token from the runner tab in the &lt;code&gt;Site administration&lt;/code&gt; (&lt;code&gt;mytoken&lt;/code&gt; in the following) &lt;/li&gt; &lt;li&gt;Register and start the runner&lt;pre&gt;&lt;code&gt;git clone https://codeberg.org/forgejo/runner cd runner git checkout v1.1.0 make build ./forgejo-runner register --name myrunner --no-interactive --instance http://172.17.0.2:3000 --token mytoken ./forgejo-runner daemon &lt;/code&gt;&lt;/pre&gt; &lt;/li&gt; &lt;li&gt;Add the &lt;code&gt;.forgejo/workflows/demo.yaml&lt;/code&gt; file above to the test repository, via the web interface&lt;/li&gt; &lt;li&gt;Go to the &lt;code&gt;Actions&lt;/code&gt; tab of the project and watch it run to completion &lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;How does it work?&lt;/h3&gt; &lt;p&gt;The &lt;code&gt;forgejo-runner&lt;/code&gt; creates a docker container and runs the job inside it. It can be shell commands (e.g. &lt;code&gt;ls ${{ github.workspace }}&lt;/code&gt;) or &lt;code&gt;actions&lt;/code&gt; (e.g. &lt;code&gt;uses: actions/checkout@v3&lt;/code&gt;). The actions are references to repositories that are cloned and executed. For instance &lt;code&gt;actions/checkout&lt;/code&gt; will clone &lt;a href=&quot;https://codeberg.org/actions/checkout&quot;&gt;https://codeberg.org/actions/checkout&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The container image used to run the container is specified by &lt;code&gt;runs-on: ubuntu-latest&lt;/code&gt; but it may not contain all the tools required to complete the job. Reason why some actions are allowed to create a new container based on other images. In the end a single job may involve running multiple containers and they are all terminated when the job completes.&lt;/p&gt; &lt;h3&gt;Limitations&lt;/h3&gt; &lt;p&gt;The implementation is very new and has many limitations which makes it unfit for production.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;There is no support to run services such as a Postgres database&lt;/li&gt; &lt;li&gt;The container running the job is not systemd capable&lt;/li&gt; &lt;li&gt;There is no guarantee of compatibility with GitHub Actions, although the syntax of the files and the terminology is similar&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;Under the hood&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/runner&quot;&gt;Forgejo runner&lt;/a&gt; is a new addition to the Forgejo dependencies (git &amp;amp; ssh) and is not yet packaged, it must be built from sources as explained above. It is a thin layer on top of &lt;a href=&quot;https://github.com/nektos/act&quot;&gt;ACT&lt;/a&gt; which implements the core of the logic to interpret and run the jobs. A &lt;a href=&quot;https://codeberg.org/forgejo/act&quot;&gt;soft fork of ACT&lt;/a&gt; is used and contains commits that are not yet submitted or accepted upstream.&lt;/p&gt; </content:encoded></item><item><title>Forgejo v1.19 release candidates</title><link>https://forgejo.org/2023-02-27-release-v1190-0-rc0/</link><guid isPermaLink="true">https://forgejo.org/2023-02-27-release-v1190-0-rc0/</guid><description>The first Forgejo v1.19 release candidate is ready for testing. Checkout the release notes for a preview of the new features.</description><pubDate>Mon, 27 Feb 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Today &lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.19.0-0-rc0&quot;&gt;Forgejo v1.19.0-0-rc0&lt;/a&gt; was released. It is meant for testing only: do not upgrade a production instance with it.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#draft-1-19-0-0&quot;&gt;draft release notes&lt;/a&gt; contain a summary of the new features. The highlights are:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/fc037b4b825f0501a1489e10d7c822435d825cb7&quot;&gt;Incoming emails&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/6221a6fd5&quot;&gt;Scoped labels&lt;/a&gt;&lt;/li&gt; &lt;li&gt;Package registries now support for &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/df789d962&quot;&gt;Cargo&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/6ba9ff7b4&quot;&gt;Conda&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/d987ac6bf&quot;&gt;Chef&lt;/a&gt;. They also have new &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/32db62515&quot;&gt;cleanup rules&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/20674dd05&quot;&gt;quota limits&lt;/a&gt;.&lt;/li&gt; &lt;li&gt;Any webhook can now &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/commit/b6e81357bd6fb80f8ba94c513f89a210beb05313&quot;&gt;specify an &lt;code&gt;Authorization&lt;/code&gt; header&lt;/a&gt; to be sent along every request.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The &lt;a href=&quot;/2023-02-27-forgejo-actions&quot;&gt;Actions experimental CI/CD&lt;/a&gt;, although not ready for real world usage, is also present and &lt;a href=&quot;/2023-02-27-forgejo-actions&quot;&gt;can be used to run a demo&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Make sure to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#draft-1-19-0-0&quot;&gt;check the breaking changes&lt;/a&gt; and get your production instance ready for when the v1.19 release is available.&lt;/p&gt; &lt;h3&gt;Try it out&lt;/h3&gt; &lt;p&gt;The release candidate is published in &lt;a href=&quot;https://codeberg.org/forgejo-experimental&quot;&gt;the dedicated &quot;experimental&quot; Forgejo organization&lt;/a&gt; and can be downloaded from:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Containers at &lt;a href=&quot;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/1.19&quot;&gt;https://codeberg.org/forgejo-experimental/-/packages/container/forgejo/1.19&lt;/a&gt;&lt;/li&gt; &lt;li&gt;Binaries at &lt;a href=&quot;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.19.0-0-rc0&quot;&gt;https://codeberg.org/forgejo-experimental/forgejo/releases/tag/v1.19.0-0-rc0&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;They will be updated based on your feedback until they become robust enough to be released.&lt;/p&gt; &lt;h3&gt;Help write good release notes&lt;/h3&gt; &lt;p&gt;The best release notes are meant to articulate the needs and benefits of new features and the actions recommended for breaking changes so Forgejo admins quickly know if it is of interest to them.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#draft-1-19-0-0&quot;&gt;current draft release notes&lt;/a&gt; contain a complete inventory but the descriptions are still incomplete. They will be finished by the time the release is published and you can help make them better.&lt;/p&gt; &lt;p&gt;Please submit your own descriptions and comments in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/new/choose?milestone=3489&quot;&gt;our issue tracker&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo Security Release 1.18.5-0</title><link>https://forgejo.org/2023-02-23-release-v1185-0/</link><guid isPermaLink="true">https://forgejo.org/2023-02-23-release-v1185-0/</guid><description>The Forgejo v1.18.5-0 release sets the resistance to brute force protection to match industry standards.</description><pubDate>Thu, 23 Feb 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Today &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.5-0&quot;&gt;Forgejo v1.18.5-0&lt;/a&gt; was released.&lt;/p&gt; &lt;p&gt;This release contains an &lt;strong&gt;important security fix&lt;/strong&gt; for Forgejo to raise the protection against brute force attack on hashed passwords stored in the database to match industry standards, as described below.&lt;/p&gt; &lt;p&gt;This release also contains bug fixes, as detailed &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-18-5-0&quot;&gt;in the release notes&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We &lt;strong&gt;strongly recommend&lt;/strong&gt; that all Forgejo installations are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;p&gt;If &lt;code&gt;PASSWORD_HASH_ALGO&lt;/code&gt; is explicitly set in app.in, comment it out so that the stronger algorithm is used instead.&lt;/p&gt; &lt;p&gt;All password hashes stored with another algorithm will be updated to the new algorithm on the next usage of this password (e.g. a user provides the password to the Forgejo server when they login). It does not require manual intervention.&lt;/p&gt; &lt;h3&gt;High CPU usage after the upgrade&lt;/h3&gt; &lt;p&gt;The default password hashing in Forgejo now takes 32 times more CPU time. If the CPU usage is too high after the upgrade, the easiest workaround is to revert to the previous hash algorithm by adding the following in &lt;code&gt;app.ini&lt;/code&gt;:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;[security] PASSWORD_HASH_ALGO = pbkdf2_v1 &lt;/code&gt;&lt;/pre&gt; &lt;p&gt;The real solution is to reduce the use of passwords in &lt;code&gt;git&lt;/code&gt; commands or API calls and switch back to the default hash algorithm for better protection.&lt;/p&gt; &lt;h3&gt;Reducing the performance impact&lt;/h3&gt; &lt;p&gt;Codeberg hosts ~60,000 projects for ~50,000 users and provided real world data to evaluate the performance impact of using a hash algorithm that requires 32 times more CPU than before.&lt;/p&gt; &lt;p&gt;Password hashing happens when users login, sign up or reset their passwords. Even on a busy instance such as Codeberg it does not happen frequently enough to cause performance problems.&lt;/p&gt; &lt;p&gt;It is also possible that passwords are used in other contexts:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;git commands, e.g. &lt;code&gt;git clone https://user:password@forgejo.example.com/owner/repo/&lt;/code&gt;&lt;/li&gt; &lt;li&gt;API calls, e.g. &lt;code&gt;curl https://user:password@forgejo.example.com/api/v1/version&lt;/code&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;They can be replaced by alternative authentication methods:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;git commands can use SSH keys, e.g. &lt;code&gt;git clone git@forgejo.example.com:owner/repo&lt;/code&gt;&lt;/li&gt; &lt;li&gt;API calls can use access tokens, e.g. &lt;code&gt;curl -H &apos;Authorization: token xyz&apos; https://forgejo.example.com/api/v1/version&lt;/code&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;It will be faster for the user because the hashing adds a delay. And it will significantly reduce the CPU usage on the Forgejo server.&lt;/p&gt; &lt;h3&gt;Understanding password hashes&lt;/h3&gt; &lt;h4&gt;Brute force attacks&lt;/h4&gt; &lt;p&gt;The user provided passwords are hashed before they are stored so they are not readable in case a copy of the database is leaked. The hash value stored in the database cannot be translated into the original password. But there exists large databases of common passwords and a program can patiently try to hash them one after the other, hoping to find a match. If the hash algorithm is fast, this brute force attack may succeed quickly. If the hash algorithm is expensive to run, it may take so long and use so much resources that it is not worth a try.&lt;/p&gt; &lt;p&gt;In other words, if a malicious person gets a copy of a Forgejo database, the complexity of the hash algorithm is the only thing preventing them from brute forcing it.&lt;/p&gt; &lt;h4&gt;Industry standards&lt;/h4&gt; &lt;p&gt;The industry adapt the &lt;a href=&quot;https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html&quot;&gt;recommendations for the hash algorithms&lt;/a&gt; as new hardware provide more processing power and make it easier to brute force. The default algorithm for Forgejo is &lt;code&gt;PBKDF2-HMAC-SHA256&lt;/code&gt; and the &lt;a href=&quot;https://web.archive.org/web/20221223105926/https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html&quot;&gt;OWASP recommendations in December 2022&lt;/a&gt; were:&lt;/p&gt; &lt;blockquote&gt; &lt;p&gt;use PBKDF2 with a work factor of 310,000 or more and set with an internal hash function of HMAC-SHA-256.&lt;/p&gt; &lt;/blockquote&gt; &lt;p&gt;This security upgrade sets the iterations (work factor) to 320,000 and will be revised on a regular basis. Although the default for Forgejo is &lt;code&gt;PBKDF2&lt;/code&gt; and the upgrade consists of modifying its parameters, other algorithms such as &lt;code&gt;argon2id&lt;/code&gt; may be preferred in the future.&lt;/p&gt; &lt;h4&gt;Access tokens&lt;/h4&gt; &lt;p&gt;In order for a brute force attack on a password hash to succeed, there must be a match in a database of common passwords. Since the access tokens are randomly generated by the Forgejo server, they are highly unlikely to be in such databases. That makes them, by nature, very resistant to brute force attacks.&lt;/p&gt; &lt;h3&gt;Responsible disclosure to Gitea&lt;/h3&gt; &lt;p&gt;On 8 February 2023 the &lt;a href=&quot;https://forgejo.org/.well-known/security.txt&quot;&gt;Forgejo security team&lt;/a&gt; notified the Gitea security team that the default hash algorithm was significantly weaker than the industry standard, explained the associated risks and provided a patch to upgrade the hash algorithm to 320,000 iterations. An embargo was then negotiated until 16 February 2023, after which the v1.18 point release could be prepared.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo Security Release 1.18.3-2</title><link>https://forgejo.org/2023-02-17-release-v1-18-3-2/</link><guid isPermaLink="true">https://forgejo.org/2023-02-17-release-v1-18-3-2/</guid><description>Forgejo v1.18.3-2 stable release update fixes CVE-2023-22490 and CVE-2023-23946 and bug fixes</description><pubDate>Fri, 17 Feb 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Today &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.3-2&quot;&gt;Forgejo v1.18.3-2&lt;/a&gt; was released.&lt;/p&gt; &lt;p&gt;This release contains a security fix for Forgejo container images, as described below. When Forgejo runs from a binary, recommendations to upgrade the &lt;code&gt;git&lt;/code&gt; version installed alongside it are also provided.&lt;/p&gt; &lt;p&gt;This release also contains bug fixes as detailed &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-18-3-2&quot;&gt;in the release notes&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;When using a Forgejo binary: upgrade the &lt;code&gt;git&lt;/code&gt; package to a version greater or equal to v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7 or v2.30.8&lt;/li&gt; &lt;li&gt;When using a Forgejo container image: &lt;code&gt;docker pull codeberg.org/forgejo/forgejo:1.18.3-2&lt;/code&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;Security issues in Git&lt;/h3&gt; &lt;p&gt;Git &lt;a href=&quot;https://github.blog/2023-02-14-git-security-vulnerabilities-announced-3/&quot;&gt;recently announced&lt;/a&gt; new versions to address two CVEs (&lt;a href=&quot;https://cve.circl.lu/cve/CVE-2023-22490&quot;&gt;CVE-2023-22490&lt;/a&gt;, &lt;a href=&quot;https://cve.circl.lu/cve/CVE-2023-23946&quot;&gt;CVE-2023-23946&lt;/a&gt;). On 14 February 2023, Git published the maintenance release v2.39.2, together with releases for older maintenance tracks v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;/.well-known/security.txt&quot;&gt;Forgejo security team&lt;/a&gt; analyzed both CVE and concluded that they &lt;strong&gt;cannot be exploited via Forgejo&lt;/strong&gt;. It is however recommended to upgrade &lt;code&gt;git&lt;/code&gt; as a precaution.&lt;/p&gt; &lt;h3&gt;Fixing Git when using a Forgejo binary&lt;/h3&gt; &lt;p&gt;When installed as a binary &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.3-2&quot;&gt;downloaded from the Forjego releases&lt;/a&gt; repository, it is the responsibility of the Forgejo admin to install &lt;code&gt;git&lt;/code&gt; independently. Upgrading to a patched &lt;code&gt;git&lt;/code&gt; package (with a version greater or equal to v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7 or v2.30.8) is therefore enough to fix the problem, even if Forgejo is not upgraded.&lt;/p&gt; &lt;h3&gt;Fixing Git when using a Forgejo container image&lt;/h3&gt; &lt;p&gt;When installed as an image &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/versions&quot;&gt;downloaded from the Forgejo registry&lt;/a&gt;, the container includes both the Forgejo binary and the &lt;code&gt;git&lt;/code&gt; binary, as obtained from &lt;a href=&quot;https://pkgs.alpinelinux.org/packages?name=git&amp;amp;branch=v3.16&quot;&gt;Alpine 3.16&lt;/a&gt;. &lt;code&gt;Forgejo 1.18.3-1&lt;/code&gt; contains a vulnerable &lt;code&gt;git&lt;/code&gt; binary:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;$ docker run --rm codeberg.org/forgejo/forgejo:1.18.3-1 git --version git version 2.36.4 &lt;/code&gt;&lt;/pre&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/versions&quot;&gt;Forgejo 1.18.3-2 images&lt;/a&gt; were built shortly after the patched &lt;code&gt;git&lt;/code&gt; binary was upgraded in &lt;code&gt;Alpine 3.16&lt;/code&gt; and is not vulnerable:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;$ docker run --rm codeberg.org/forgejo/forgejo:1.18.3-2 git --version git version 2.36.5 &lt;/code&gt;&lt;/pre&gt; &lt;p&gt;In this case it is necessary to upgrade Forgejo to &lt;code&gt;1.18.3-2&lt;/code&gt; to get the fixed &lt;code&gt;git&lt;/code&gt; binary. The &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.18-rootless&quot;&gt;rootless&lt;/a&gt; variant of Forgejo also includes the &lt;code&gt;git&lt;/code&gt; binary and can be upgraded in the same way.&lt;/p&gt; &lt;h3&gt;Forgejo installation instructions&lt;/h3&gt; &lt;p&gt;See the &lt;a href=&quot;/download&quot;&gt;download page&lt;/a&gt; for instructions for installation instructions. If you are upgrading from &lt;code&gt;Forgejo 1.18.3-1&lt;/code&gt; (or &lt;code&gt;Gitea 1.18&lt;/code&gt;) no manual action is required. If you&apos;re on &lt;code&gt;Gitea v1.17.x&lt;/code&gt; or older please read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-18-0-1&quot;&gt;release notes&lt;/a&gt; carefully, and in particular check out the &lt;a href=&quot;https://blog.gitea.io/2022/12/gitea-1.18.0-is-released/#breaking-changes&quot;&gt;breaking changes&lt;/a&gt; section of Gitea&apos;s blog post.&lt;/p&gt; &lt;p&gt;The actual upgrade process is as simple as replacing the Gitea binary or container image with the corresponding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.3-2&quot;&gt;Forgejo binary&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.18.3-2&quot;&gt;container image&lt;/a&gt;. If you&apos;re using the container images, you can use the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.18&quot;&gt;&lt;code&gt;1.18&lt;/code&gt;&lt;/a&gt; tag to stay up to date with the latest &lt;code&gt;1.18.x&lt;/code&gt; point release automatically.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Source tree tags v1.18.1-0, v1.18.2-0, v1.18.2-1, v1.18.3-0 and v1.18.3-1 were fixed</title><link>https://forgejo.org/2023-02-12-tags/</link><guid isPermaLink="true">https://forgejo.org/2023-02-12-tags/</guid><description>A Forgejo binary built from sources by checking out one of the tags before 11 February 2023 will be running the development branch v1.19 instead of the expected v1.18 branch. Some packages, such as the official Arch Linux package, are also built from the tags and therefore contain Forgejo v1.19 instead of Forgejo v1.18.</description><pubDate>Mon, 13 Feb 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;TL;DR: Skip this blog if you run a Forgejo instance using the binaries or container images downloaded from &lt;a href=&quot;https://codeberg.org/forgejo&quot;&gt;https://codeberg.org/forgejo&lt;/a&gt;&lt;/p&gt; &lt;h2&gt;The symptoms&lt;/h2&gt; &lt;p&gt;A Forgejo instance is:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;unexpectedly running v1.19 despite the version string indicating v1.18&lt;/li&gt; &lt;li&gt;refusing to start after upgrading the package (Arch, etc.) to version &amp;gt;= v1.18.3-1&lt;/li&gt; &lt;/ul&gt; &lt;h2&gt;The problem before 11 February 2023&lt;/h2&gt; &lt;ul&gt; &lt;li&gt;The v1.18.1-0, v1.18.2-0, v1.18.2-1, v1.18.3-0 and v1.18.3-1 &lt;strong&gt;binaries and container images are v1.18 as advertised&lt;/strong&gt;&lt;/li&gt; &lt;li&gt;The v1.18.1-0, v1.18.2-0, v1.18.2-1, v1.18.3-0 and v1.18.3-1 &lt;strong&gt;tags did not match and were actually set on the development branch&lt;/strong&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Because of a bug in the release process, the tag of each release was actually set to the tip of the Forgejo development branch at the time of the release. Because Forgejo is a soft-fork, it matched the latest Gitea development branch and had all the Forgejo improvements on top of it. But the Forgejo binaries and container images were created using the v1.18 stable branch.&lt;/p&gt; &lt;h2&gt;The problem is fixed on 11 February 2023&lt;/h2&gt; &lt;p&gt;The problem &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/344&quot;&gt;was fixed 11 February 2023 ~7am UTC&lt;/a&gt; by force pushing the v1.18.1-0, v1.18.2-0, v1.18.2-1, v1.18.3-0 and v1.18.3-1 tags and nothing else. The binaries and container images were good and remain the same.&lt;/p&gt; &lt;h2&gt;The consequences&lt;/h2&gt; &lt;p&gt;A Forgejo binary built from sources by checking out one of the tags before 11 February 2023 will be running the development branch v1.19 instead of the expected v1.18 branch. Some packages, such as the official Arch Linux package, are also built from the tags and therefore contain Forgejo v1.19 instead of Forgejo v1.18.&lt;/p&gt; &lt;p&gt;The version displayed at the bottom left of the home page will incorrectly be &lt;code&gt;v1.18*&lt;/code&gt; instead of &lt;code&gt;v1.19*&lt;/code&gt; because it is created at build time using the name of the tag. But there is one difference in the home page that allows you to distinguish them, on the large logo in the center:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;On &lt;code&gt;v1.19&lt;/code&gt; there is an &lt;code&gt;alt=&quot;logo&quot;&lt;/code&gt; attribute&lt;/li&gt; &lt;li&gt;On &lt;code&gt;v1.18&lt;/code&gt; there is no such attribute&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A v1.19 Forgejo instance cannot be downgraded to v1.18. It will refuse to start because there is no safe downgrade path.&lt;/p&gt; &lt;h2&gt;Recommended actions&lt;/h2&gt; &lt;h3&gt;Forgejo admins: wait for v1.19&lt;/h3&gt; &lt;p&gt;If your current instance unexpectedly runs v1.19, the recommendation is to not upgrade and wait.&lt;/p&gt; &lt;p&gt;Forgejo v1.19 will be released in a few months and the easiest workaround for a Forgejo admin running an instance built from source or installed from a package built from source is to wait until then before upgrading.&lt;/p&gt; &lt;h4&gt;Forgejo instances installed from Arch package &amp;lt; v1.18.3.1-1&lt;/h4&gt; &lt;p&gt;For those running Arch Linux (or a derivative such as Manjaro or Arch Linux ARM), our current recommendation is to add &lt;code&gt;forgejo&lt;/code&gt; to the &lt;code&gt;IgnorePkg&lt;/code&gt; list in &lt;code&gt;/etc/pacman.conf&lt;/code&gt; until v1.19 is released.&lt;/p&gt; &lt;p&gt;For those who have already upgraded, we recommended downgrading your package to &lt;code&gt;v1.18.3.0-1&lt;/code&gt; as this is the latest version that exhibited this issue. You may be able to find the package for this version in your &lt;a href=&quot;https://wiki.archlinux.org/title/downgrading_packages#Using_the_pacman_cache&quot;&gt;pacman cache&lt;/a&gt;. If the file is not in your pacman cache, it can be downloaded from the &lt;a href=&quot;https://archive.archlinux.org/packages/f/forgejo/&quot;&gt;Arch Linux archive&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;Alternatively, the &lt;a href=&quot;https://aur.archlinux.org/packages/downgrade&quot;&gt;&lt;code&gt;downgrade&lt;/code&gt; utility from the AUR&lt;/a&gt; can help with installing an older version and adding Forgejo to &lt;code&gt;IgnorePkg&lt;/code&gt;. This tool automates the process above with one command.&lt;/p&gt; &lt;p&gt;When Forgejo v1.19.0-0 is released, you should remove &lt;code&gt;forgejo&lt;/code&gt; from &lt;code&gt;IgnorePkg&lt;/code&gt; in &lt;code&gt;/etc/pacman.conf&lt;/code&gt; and take the upgrade.&lt;/p&gt; &lt;p&gt;If you installed the package after &lt;code&gt;v1.18.3.1-1&lt;/code&gt; was released, your installation is not affected by this issue.&lt;/p&gt; &lt;h3&gt;Package authors: (re)build v1.18.3-1&lt;/h3&gt; &lt;p&gt;If a package was built using one of the tags above, build (or rebuild if the build happened before 11 February 2023) based on the current tag v1.18.3-1 with hash &lt;code&gt;4e5be58493&lt;/code&gt; so that future installations are not affected by the problem.&lt;/p&gt; &lt;p&gt;It also means the existing installations will not be able to upgrade. Forgejo will refuse to start because they were really running v1.19 before upgrading. The package should be labeled as such with link to this blog post in the changelog to explain why it happens.&lt;/p&gt; &lt;h2&gt;Get in touch, you will get help&lt;/h2&gt; &lt;p&gt;If none of the recommended actions work for you, please get in touch at &lt;a href=&quot;mailto:contact@forgejo.org&quot;&gt;contact@forgejo.org&lt;/a&gt; or in the &lt;a href=&quot;https://matrix.to/#/#forgejo-development:matrix.org&quot;&gt;development chatrooom&lt;/a&gt; to get help. This was a bug and you deserve all the help you can get. Getting in touch will also help us improve this blog post if needed.&lt;/p&gt; </content:encoded></item><item><title>Forgejo monthly update - January 2023</title><link>https://forgejo.org/2023-01-31-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2023-01-31-monthly-update/</guid><description>The first Forgejo releases were published and proved to be secure and reliable for day to day operations. The Forgejo community blossomed and is working on defining its own governance. A wide range of skills contributed to the improvement of Forgejo itself but mostly to the larger Free Software ecosystem it depends on.</description><pubDate>Tue, 31 Jan 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-18-0-1&quot;&gt;Forgejo 1.18.0-1&lt;/a&gt;, the first release, was published 29 December 2022, followed by patch releases which included security fixes. There were no reports of failed installations or upgrades. The &lt;a href=&quot;/2022-12-15-hello-forgejo&quot;&gt;15 December 2022&lt;/a&gt; announcement made a promise and a lot of work went into fulfilling it. A release is more than uploading a file and hoping for the best, users deserve reliable distribution channels and it requires dedicated people and proper tooling. &lt;strong&gt;Forgejo proved to be a product that users can rely on for their day to day operations&lt;/strong&gt;, from large instances such as &lt;a href=&quot;https://codeberg.org&quot;&gt;Codeberg&lt;/a&gt; to personal ones running on low-end hardware.&lt;/p&gt; &lt;p&gt;What goes into each Forgejo release is a snapshot taken from an constantly evolving patchwork of Free Software components carefully assembled together. It is based on &lt;code&gt;Gitea&lt;/code&gt;, which is itself built on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/go.mod&quot;&gt;one hundred packages&lt;/a&gt;, and when digging deeper it amounts to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/go.sum&quot;&gt;almost a thousand&lt;/a&gt;. But wait, there&apos;s more: container images include &lt;code&gt;git&lt;/code&gt;, &lt;code&gt;ssh&lt;/code&gt; and rely on &lt;code&gt;Docker&lt;/code&gt;. The CI runs on Woodpecker with &lt;code&gt;LXC&lt;/code&gt; and Debian GNU/Linux. This is why adding a feature or fixing a bug in Forgejo often means contributing to one of its many dependencies. This is the healthy way to grow the global Free Software ecosystem. For instance, an &lt;code&gt;LXC&lt;/code&gt; backend was contributed to Woodpecker to improve the Forgejo release process. If a proprietary CI was used, such a contribution would not be possible and progress would be blocked. Another example is the accessibility improvements that were contributed to &lt;code&gt;Gitea&lt;/code&gt;.&lt;/p&gt; &lt;p&gt;The Forgejo community is made of people who are citizens of the larger Free Software ecosystem. They may identify themselves as members of the Forgejo community because they like that it furthers the interest of the general public. Or because they enjoy participating in a democratically led community. Or when they write a piece of code somewhere in the thousands of Forgejo dependencies. It is not an elite community, it is not an affinity group; it is an inclusive and fluid group of people who share values and visions. It is engaged in work to define its governance, make sensible decisions and preserve a safe space in accordance to its &lt;a href=&quot;https://codeberg.org/forgejo/code-of-conduct&quot;&gt;Code of Conduct&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Forgejo 1.18&lt;/h3&gt; &lt;p&gt;From a technical point of view, Forgejo is a &lt;a href=&quot;/download&quot;&gt;drop-in replacement for &lt;code&gt;Gitea&lt;/code&gt;&lt;/a&gt;: it can be used without any modification by simply replacing the &lt;code&gt;Gitea&lt;/code&gt; binary (or container image). On 29 December 2022 Forgejo v1.18.0-0 was released and had just a little glitch: the version number started with a &lt;strong&gt;w&lt;/strong&gt; instead of a &lt;strong&gt;v&lt;/strong&gt;. The same day &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.0-1&quot;&gt;Forgejo v1.18.0-1&lt;/a&gt; was published to fix that mistake.&lt;/p&gt; &lt;p&gt;This typo was the tip of the iceberg: the release process had to be redesigned. Back then, it took more than one hour for the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/CONTRIBUTING/RELEASE.md&quot;&gt;Forgejo release process&lt;/a&gt; to complete. Furthermore it could be interrupted when a release was partially published, throwing the rest away. Unfortunately, that happened while releasing v1.18.0-0 and a clever workaround to resume with a version starting with a &lt;strong&gt;w&lt;/strong&gt; created an artifact. That could have been problematic, or at the very least raise an eyebrow from Forgejo admins.&lt;/p&gt; &lt;p&gt;In the following weeks, a two-phase process was created wherein the releases are first built in the &lt;a href=&quot;https://codeberg.org/forgejo-integration&quot;&gt;Forgejo integration organization&lt;/a&gt; and published there as drafts, to be thrown away if anything goes wrong. This is the most time-consuming step and also the one that is most likely to fail because something was overlooked by the Forgejo developers or because of an unexpected environmental failure. The second phase is copying the release to its final destination; although it is not atomic, the window of opportunity for a half published release is significantly smaller.&lt;/p&gt; &lt;h3&gt;Security releases&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;/.well-known/security.txt&quot;&gt;security team&lt;/a&gt; was quickly put to the test and had to prepare two Forgejo releases (&lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.1-0&quot;&gt;Forgejo v1.18.1-0, 18 January&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.2-1&quot;&gt;Forgejo v1.18.2-1, 22 January&lt;/a&gt;). The problems were explained in plain English for Forgejo admins to quickly understand their impact and assess the urgency of an upgrade. Handling security issues responsibly is a heavy burden and while the process in place proved to work effectively on those two occasions, it will require a continuous effort for as long as Forgejo exists.&lt;/p&gt; &lt;p&gt;Although it did not put Forgejo users at risk, there were problems during the making of these security releases, as can be expected for any newly formed team. The expectations were not clearly laid out, the &lt;code&gt;security@forgejo.org&lt;/code&gt; mail was a redirection that revealed the recipients under some circumstances, unencrypted messages were exchanged, security issues were not always reported responsibly and embargo requests were overlooked. Although it worked out fine in the end and all these issues were properly addressed, it speaks to the challenges of bootstrapping a security team.&lt;/p&gt; &lt;h3&gt;Accessibility&lt;/h3&gt; &lt;p&gt;Accessibility in Forgejo needs a lot of work and it was difficult to figure out where to start. The &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/TEAMS.md#accessibility&quot;&gt;accessibility team&lt;/a&gt; works in multiple issue trackers (&lt;a href=&quot;https://codeberg.org/forgejo/meta/issues?labels=81029&quot;&gt;meta&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues?q=&amp;amp;type=all&amp;amp;state=open&amp;amp;labels=81214&amp;amp;milestone=0&amp;amp;assignee=0&amp;amp;poster=0&quot;&gt;forgejo&lt;/a&gt;, &lt;a href=&quot;https://codeberg.org/forgejo/user-research/pulls?q=&amp;amp;type=all&amp;amp;sort=&amp;amp;state=closed&amp;amp;labels=92050&amp;amp;milestone=0&amp;amp;assignee=0&amp;amp;poster=0&quot;&gt;user research&lt;/a&gt;, etc). The discussions started in a dedicated Matrix room, which turned out to not be very accessible, so &lt;a href=&quot;https://floss.social/tags/forgejoaccessibility&quot;&gt;a Fediverse hashtag &lt;code&gt;#ForgejoAccessibility&lt;/code&gt;&lt;/a&gt; was created as an alternative to experiment with.&lt;/p&gt; &lt;p&gt;Despite the shortcomings of the current Forgejo UI framework, &lt;a href=&quot;https://github.com/go-gitea/gitea/pulls/fsologureng&quot;&gt;concrete&lt;/a&gt; &lt;a href=&quot;https://github.com/go-gitea/gitea/pulls/Menelion&quot;&gt;changes&lt;/a&gt; were made to the codebase to get things moving. The challenge is to guard them against regressions &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/284&quot;&gt;because there are no automated tests&lt;/a&gt;. Since the community impacted is small, the chance that accessibility improvements are broken is high.&lt;/p&gt; &lt;h3&gt;Federation&lt;/h3&gt; &lt;p&gt;&lt;a href=&quot;/2023-01-10-answering-forgejo-federation-questions/&quot;&gt;Federation development&lt;/a&gt; has been progressing slowly. Most of the time was spent on refactoring &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo-federation&quot;&gt;the current code&lt;/a&gt;, working on the &lt;a href=&quot;https://forgefed.org&quot;&gt;ForgeFed&lt;/a&gt; vocabulary and the &lt;a href=&quot;https://forum.forgefriends.org/t/about-the-friendly-forge-format-f3/681&quot;&gt;F3&lt;/a&gt; schemas.&lt;/p&gt; &lt;h3&gt;Forgejo CI&lt;/h3&gt; &lt;p&gt;Since it started out on Woodpecker instances provided by individuals due to performance issues with the database integration tests on &lt;a href=&quot;https://ci.codeberg.org&quot;&gt;Codeberg-CI&lt;/a&gt;, the work on centralizing / unifying the CI has been ongoing. Codeberg solved part of the problem by &lt;a href=&quot;https://forgejo-ci.codeberg.org&quot;&gt;dedicating hardware resources to Forgejo&lt;/a&gt;: using a RAM disk to workaround the slow HDD performances, it runs fast without thrashing short-lived SSDs, reducing ecologically problematic ewaste. The Forgejo &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/TEAMS.md#devops&quot;&gt;devOps team&lt;/a&gt; weren&apos;t used to working with LXC containers (which is what Codeberg is built upon), so there was (and still is) a learning curve to work on.&lt;/p&gt; &lt;p&gt;To allow for better safeguarding of the CI against malicious PRs and to better protect the secrets (signing keys, upload credentials) used to actually release Forgejo, &lt;a href=&quot;https://forgejo-ci.codeberg.org&quot;&gt;forgejo-ci.codeberg.org&lt;/a&gt; has no secrets at all. This was also necessary due to some hardware limitations: there is not enough disk space to build a Forgejo release. Another Woodpecker CI instance is used instead and its access is restricted to better protect the release signing keys.&lt;/p&gt; &lt;h3&gt;End-to-end testing&lt;/h3&gt; &lt;p&gt;The key to a robust release process is the ability to run tests verifying that it works as expected. Not just unit tests that are routinely run by the Forgejo CI or integration tests included in the codebase. End-to-end tests deploy the release itself and are required to run scenarios that resemble what users would do. The alternative is to ask human beings to run these tests manually, but it is error prone and gets boring very quickly.&lt;/p&gt; &lt;p&gt;The Forgejo release is published in the &lt;a href=&quot;https://codeberg.org/forgejo-experimental&quot;&gt;Forgejo experimental organization&lt;/a&gt; and then used to &lt;a href=&quot;https://codeberg.org/Codeberg-Infrastructure/scripted-configuration/src/branch/main/.woodpecker.yml&quot;&gt;run tests&lt;/a&gt; that do something along these lines:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Deploy Woodpecker&lt;/li&gt; &lt;li&gt;Deploy Forgejo&lt;/li&gt; &lt;li&gt;Create a user and repository in Forgejo&lt;/li&gt; &lt;li&gt;Submit a job to Woodpecker by pushing to the repository&lt;/li&gt; &lt;li&gt;Verify the outcome of the job is as expected&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;Because Forgejo is small, it takes around two minutes for this test to complete. It is now run against every release, and while verification by human beings is still needed, they can focus on what matters instead of trivial mistakes.&lt;/p&gt; &lt;h3&gt;Contributions to Woodpecker&lt;/h3&gt; &lt;p&gt;Running end-to-end tests is technically challenging, there&apos;s a reason it is still not common practice. Although it would be possible to use Docker, it&apos;s a stretch (see &lt;a href=&quot;https://github.com/woodpecker-ci/woodpecker/pull/1543/files#diff-129523b702d10d3da7d9245312d535609bffee1458a3f3f82d82fb5d314c6df8&quot;&gt;this example&lt;/a&gt;). The ideal situation is when the test can begin on a freshly provisioned operating system that will be disposed of when the test completes, cleaning up all the left overs even in the event of a catastrophic failure.&lt;/p&gt; &lt;p&gt;An &lt;a href=&quot;https://github.com/woodpecker-ci/woodpecker/pull/1565&quot;&gt;LXC backend&lt;/a&gt; was developed for Woodpecker to provide such an environment. Woodpecker container images are &lt;a href=&quot;https://codeberg.org/forgejo-contrib/-/packages/container/woodpecker-forgejo-server/versions&quot;&gt;published&lt;/a&gt; for internal use by Forgejo, but are not supported.&lt;/p&gt; &lt;p&gt;It is common practice to use a patched version of some software while waiting for pull requests to be accepted. The risk is to forget to do the work to get the changes accepted upstream, accumulating the associated technical debt. The patched version of Woodpecker is published in a &lt;a href=&quot;https://codeberg.org/forgejo-contrib/woodpecker-forgejo/commits/branch/main&quot;&gt;dedicated repository&lt;/a&gt; as a reminder and each commit is labelled with the corresponding upstream pull request.&lt;/p&gt; &lt;h3&gt;Forgejo contrib&lt;/h3&gt; &lt;p&gt;Over the past few months, people who rely on Forgejo came to expect a certain quality of work as well as long term maintenance. When someone has a great idea and lots of energy, they may not be willing to match those expectations right away. Sharing a clever hack, bootstrapping documentation, creating a list of resources related to Forgejo and temporarily distributing Woodpecker container images are but a few examples.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo-contrib&quot;&gt;Forgejo contrib organization&lt;/a&gt; was created as a space where projects related to Forgejo can exist without being subject to high expectations. It is fine to create a repository that will be abandoned a few weeks later. It is fine to engage in a project that is not agreed upon by other Forgejo community members. The only requirement (and it&apos;s a serious one) is to behave in a way that does not go against the &lt;a href=&quot;https://codeberg.org/forgejo/code-of-conduct&quot;&gt;Code of Conduct&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;&lt;a href=&quot;https://codeberg.org/forgejo-contrib/delightful-forgejo&quot;&gt;A curated list of delightful Forgejo-related projects and resources&lt;/a&gt; was created there and quickly became a useful reference. If you&apos;re working on a Forgejo-related project, &lt;a href=&quot;https://codeberg.org/forgejo-contrib/delightful-forgejo/pulls&quot;&gt;feel free to submit it for inclusion on the list&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Well-Being &amp;amp; Code of Conduct&lt;/h3&gt; &lt;p&gt;Forgejo created a &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/TEAMS.md#well-being&quot;&gt;Well-Being team&lt;/a&gt; and adopted a &lt;a href=&quot;https://codeberg.org/forgejo/code-of-conduct&quot;&gt;Code of Conduct&lt;/a&gt; from day one because tensions are bound to happen in such an inclusive environment. And with over three hundred people in the chat room, it happened a few times in the past weeks. When someone uses coarse language and engages in a heated discussion, it has a chilling effect and silently drives people away. To help prevent that, the &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/TEAMS.md#well-being&quot;&gt;Well-Being team&lt;/a&gt; does its best to intervene in a gentle way before it escalates to a point where the Code of Conduct would have to be enforced. There were only two instances where a reminder of the Code of Conduct had to be mentioned: there is zero tolerance for calling another community member names or making derogatory comments towards an ethnic community.&lt;/p&gt; &lt;p&gt;Obviously it would be better if no such comments had been made at all, but it is hoped that the actions taken will alleviate any fears that any intolerance would be permitted. Hopefully any affected individuals will be encouraged to continue to participate in discussions as endeavors are made to ensure this is a safe space for all community members.&lt;/p&gt; &lt;h3&gt;Governance&lt;/h3&gt; &lt;h4&gt;Decision process&lt;/h4&gt; &lt;p&gt;As expected, the process to &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/19&quot;&gt;define the governance&lt;/a&gt; is taking its time. The need for a decision-making progress emerged during the last two meetings on &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/2022-12-23-videoconference-governance.mp3&quot;&gt;23 December&lt;/a&gt; and 27 January (&lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/2023-01-27-videoconference-governance-part1.mp3&quot;&gt;part 1&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/2023-01-27-videoconference-governance-part2.mp3&quot;&gt;part 2&lt;/a&gt;) and was partially &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/DECISION-MAKING.md&quot;&gt;formalized&lt;/a&gt;. The general idea is that a decision leads to an agreement that is documented so that Forgejo community members can conveniently refer to it when needed. The &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/AGREEMENTS.md&quot;&gt;list of agreements&lt;/a&gt; has just one item at the moment related to branding (name, logo, etc).&lt;/p&gt; &lt;h4&gt;The first decisions&lt;/h4&gt; &lt;p&gt;Meanwhile, this ongoing governance work inspired community members to move forward, and a few discussions that may lead to decisions are ongoing. Topics include very concrete aspects of development such as the &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/124&quot;&gt;criteria in order to define how a PR should be approved&lt;/a&gt; which was followed by a &lt;a href=&quot;https://codeberg.org/forgejo/meta/pulls/129/files&quot;&gt;pull request to document the agreement&lt;/a&gt;. Additionally, there are very high level and much longer discussions such as &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/86&quot;&gt;licensing Forgejo under copyleft&lt;/a&gt;. It&apos;s still blurry but something is emerging. It boils down to:&lt;/p&gt; &lt;ol&gt; &lt;li&gt;Discussing&lt;/li&gt; &lt;li&gt;Proposing an agreement&lt;/li&gt; &lt;li&gt;Documenting the agreement&lt;/li&gt; &lt;/ol&gt; &lt;h4&gt;Agreements for team members&lt;/h4&gt; &lt;p&gt;As time passes, the need to replace the &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/TEAMS.md&quot;&gt;teams that have been in place&lt;/a&gt; since Forgejo started becomes more pressing. For instance, given how critical their work is, members of the security team must be agreed upon by the community. It was suggested during the last governance meeting that the procedure goes as follows:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;strong&gt;Discussion&lt;/strong&gt;: people willing to participate in the security team send a formal and public application (see &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/123&quot;&gt;this application for the release team for an example&lt;/a&gt;)&lt;/li&gt; &lt;li&gt;&lt;strong&gt;Proposing an agreement&lt;/strong&gt;: if the discussion about the applicant seems to meet the approval of the Forgejo community, a pull request to modify the &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/TEAMS.md#security&quot;&gt;security team&lt;/a&gt; is proposed&lt;/li&gt; &lt;li&gt;&lt;strong&gt;Documenting the agreement&lt;/strong&gt;: if the pull request is approved, it is merged and the agreement is published in the &lt;a href=&quot;https://codeberg.org/forgejo/meta/&quot;&gt;meta repository&lt;/a&gt;.&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;We Forge&lt;/h3&gt; &lt;p&gt;Forgejo is a &lt;strong&gt;community of people&lt;/strong&gt; who contribute in an inclusive environment. We forge on an equal footing, by reporting a bug, voicing an idea in the chatroom or implementing a new feature. The following list of contributors is meant to reflect this diversity and acknowledge all contributions since the last monthly report was published. If you are missing, please &lt;a href=&quot;https://codeberg.org/forgejo/website/issues/new&quot;&gt;ask for an update&lt;/a&gt;.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Amolith&quot;&gt;https://codeberg.org/Amolith&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Andre601&quot;&gt;https://codeberg.org/Andre601&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/AnselmF&quot;&gt;https://codeberg.org/AnselmF&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/aral&quot;&gt;https://codeberg.org/aral&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/azmeuk&quot;&gt;https://codeberg.org/azmeuk&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bartavi&quot;&gt;https://codeberg.org/bartavi&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/bitbat&quot;&gt;https://codeberg.org/bitbat&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/braydofficial&quot;&gt;https://codeberg.org/braydofficial&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/caesar&quot;&gt;https://codeberg.org/caesar&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/chizutan5&quot;&gt;https://codeberg.org/chizutan5&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/circlebuilder&quot;&gt;https://codeberg.org/circlebuilder&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/copyrights&quot;&gt;https://codeberg.org/copyrights&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/crystal&quot;&gt;https://codeberg.org/crystal&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dachary&quot;&gt;https://codeberg.org/dachary&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Daeraxa&quot;&gt;https://codeberg.org/Daeraxa&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/das-g&quot;&gt;https://codeberg.org/das-g&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/dataCobra&quot;&gt;https://codeberg.org/dataCobra&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/DiamonC&quot;&gt;https://codeberg.org/DiamonC&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/duxsco&quot;&gt;https://codeberg.org/duxsco&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earl-warren&quot;&gt;https://codeberg.org/earl-warren&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/earthjasonlin&quot;&gt;https://codeberg.org/earthjasonlin&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/erkinalp&quot;&gt;https://codeberg.org/erkinalp&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/f0x&quot;&gt;https://codeberg.org/f0x&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/faust&quot;&gt;https://codeberg.org/faust&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fnetX&quot;&gt;https://codeberg.org/fnetX&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fr33domlover&quot;&gt;https://codeberg.org/fr33domlover&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/fsologureng&quot;&gt;https://codeberg.org/fsologureng&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/gapodo&quot;&gt;https://codeberg.org/gapodo&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/h3xx&quot;&gt;https://codeberg.org/h3xx&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Infinidoge&quot;&gt;https://codeberg.org/Infinidoge&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/jamie&quot;&gt;https://codeberg.org/jamie&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/johanneskastl&quot;&gt;https://codeberg.org/johanneskastl&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/KaKi87&quot;&gt;https://codeberg.org/KaKi87&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/kytta&quot;&gt;https://codeberg.org/kytta&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/MagicLike&quot;&gt;https://codeberg.org/MagicLike&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/MB175&quot;&gt;https://codeberg.org/MB175&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mikaela&quot;&gt;https://codeberg.org/Mikaela&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Mylloon&quot;&gt;https://codeberg.org/Mylloon&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/n0toose&quot;&gt;https://codeberg.org/n0toose&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/ocdtrekkie&quot;&gt;https://codeberg.org/ocdtrekkie&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/oliverpool&quot;&gt;https://codeberg.org/oliverpool&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/om&quot;&gt;https://codeberg.org/om&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/polettix&quot;&gt;https://codeberg.org/polettix&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/redwerkz&quot;&gt;https://codeberg.org/redwerkz&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/rudolphfroger&quot;&gt;https://codeberg.org/rudolphfroger&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/Ryuno-Ki&quot;&gt;https://codeberg.org/Ryuno-Ki&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/SamWhited&quot;&gt;https://codeberg.org/SamWhited&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/steko&quot;&gt;https://codeberg.org/steko&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tallship&quot;&gt;https://codeberg.org/tallship&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/thatonecalculator&quot;&gt;https://codeberg.org/thatonecalculator&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/TheEvilSkeleton&quot;&gt;https://codeberg.org/TheEvilSkeleton&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/till&quot;&gt;https://codeberg.org/till&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tuxracer&quot;&gt;https://codeberg.org/tuxracer&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/tyman&quot;&gt;https://codeberg.org/tyman&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/viceice&quot;&gt;https://codeberg.org/viceice&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/vwbusguy&quot;&gt;https://codeberg.org/vwbusguy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/xy&quot;&gt;https://codeberg.org/xy&lt;/a&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&quot;https://codeberg.org/zander&quot;&gt;https://codeberg.org/zander&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;A &lt;strong&gt;minority of Forgejo contributors earn a living&lt;/strong&gt; by implementing the roadmap co-created by the Forgejo community, see &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;the sustainability repository&lt;/a&gt; for the details.&lt;/p&gt; </content:encoded></item><item><title>Forgejo Security Release 1.18.2-1</title><link>https://forgejo.org/2023-01-22-release-v1-18-2-1/</link><guid isPermaLink="true">https://forgejo.org/2023-01-22-release-v1-18-2-1/</guid><description>Forgejo v1.18.2-1 stable release update fixes a bug that made it possible to reveal hidden user email addresses.</description><pubDate>Mon, 23 Jan 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Today &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.2-1&quot;&gt;Forgejo v1.18.2-1&lt;/a&gt; was released.&lt;/p&gt; &lt;p&gt;This stable release &lt;strong&gt;includes a security fix&lt;/strong&gt;. It was possible to reveal a user&apos;s email address, which is problematic because users can choose to hide their email address from everyone. This was possible because the notification email for a repository transfer request to an organization included every user&apos;s email address in the owner team. This has been fixed by sending individual emails instead and the code was refactored to prevent it from happening again.&lt;/p&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We &lt;strong&gt;strongly recommend&lt;/strong&gt; that all installations are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;h3&gt;Forgejo installation instructions&lt;/h3&gt; &lt;p&gt;See the &lt;a href=&quot;/download&quot;&gt;download page&lt;/a&gt; for instructions for installation instructions. If you are upgrading from &lt;code&gt;Forgejo 1.18.X-N&lt;/code&gt; (or &lt;code&gt;Gitea 1.18&lt;/code&gt;) no manual action is required. If you&apos;re on &lt;code&gt;Gitea v1.17.X&lt;/code&gt; or older please read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-18-0-1&quot;&gt;release notes&lt;/a&gt; carefully, and in particular check out the &lt;a href=&quot;https://blog.gitea.io/2022/12/gitea-1.18.0-is-released/#breaking-changes&quot;&gt;breaking changes&lt;/a&gt; section of Gitea&apos;s blog post.&lt;/p&gt; &lt;p&gt;The actual upgrade process is as simple as replacing the Gitea binary or container image with the corresponding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.2-1&quot;&gt;Forgejo binary&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.18.2-1&quot;&gt;container image&lt;/a&gt;. If you&apos;re using the container images, you can use the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.18&quot;&gt;&lt;code&gt;1.18&lt;/code&gt;&lt;/a&gt; tag to stay up to date with the latest &lt;code&gt;1.18.x&lt;/code&gt; point release automatically.&lt;/p&gt; &lt;h3&gt;Codeberg is not vulnerable&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;/.well-known/security.txt&quot;&gt;Forgejo security team&lt;/a&gt; is a joint effort with &lt;a href=&quot;https://codeberg.org&quot;&gt;Codeberg&lt;/a&gt; which already runs a Forgejo version that includes the security fix.&lt;/p&gt; &lt;h3&gt;Responsible disclosure to Gitea&lt;/h3&gt; &lt;p&gt;On 21 January 2023, as soon as the &lt;a href=&quot;/.well-known/security.txt&quot;&gt;Forgejo security team&lt;/a&gt; confirmed the vulnerability, the detailed conclusions were communicated to the Gitea security team. The corresponding bug fix was published &lt;a href=&quot;https://github.com/go-gitea/gitea/pull/22569&quot;&gt;22 January 2023&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Forgejo Critical Security Release 1.18.1-0</title><link>https://forgejo.org/2023-01-18-release-v1-18-1-0/</link><guid isPermaLink="true">https://forgejo.org/2023-01-18-release-v1-18-1-0/</guid><description>Forgejo v1.18.1-0 stable release update fixes CVE-2022-41903 and CVE-2022-23521, includes a robust release process and branding improvements.</description><pubDate>Wed, 18 Jan 2023 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Today &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.1-0&quot;&gt;Forgejo v1.18.1-0&lt;/a&gt; was released.&lt;/p&gt; &lt;p&gt;This release contains an &lt;strong&gt;important security fix&lt;/strong&gt; for Forgejo container images, as described below. When Forgejo runs from a binary, recommendations to upgrade the &lt;code&gt;git&lt;/code&gt; version installed alongside it are also provided.&lt;/p&gt; &lt;p&gt;This release also contains branding improvements (webhooks, headers, etc.) and includes a more robust release process, as detailed &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-18-1-0&quot;&gt;in the release notes&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Recommended Action&lt;/h3&gt; &lt;p&gt;We &lt;strong&gt;strongly recommend&lt;/strong&gt; that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.&lt;/p&gt; &lt;ul&gt; &lt;li&gt;When using a Forgejo binary: upgrade the &lt;code&gt;git&lt;/code&gt; package to a version greater or equal to v2.39.1, v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6, v2.33.6, v2.32.5, v2.31.6, or v2.30.7&lt;/li&gt; &lt;li&gt;When using a Forgejo container image: &lt;code&gt;docker pull codeberg.org/forgejo/forgejo:1.18.1-0&lt;/code&gt;&lt;/li&gt; &lt;/ul&gt; &lt;h3&gt;Critical security issues in Git&lt;/h3&gt; &lt;p&gt;Git &lt;a href=&quot;https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2/&quot;&gt;recently announced&lt;/a&gt; new versions to address two CVEs (&lt;a href=&quot;https://cve.circl.lu/cve/CVE-2022-23521&quot;&gt;CVE-2022-23521&lt;/a&gt;, &lt;a href=&quot;https://cve.circl.lu/cve/CVE-2022-41903&quot;&gt;CVE-2022-41903&lt;/a&gt;). On 17 January 2023, Git published the maintenance release v2.39.1, together with releases for older maintenance tracks v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6, v2.33.6, v2.32.5, v2.31.6, and v2.30.7. All major GNU/Linux distributions also provide updated packages via their security update channels.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;/.well-known/security.txt&quot;&gt;Forgejo security team&lt;/a&gt; analyzed both CVE and confirmed that Forgejo can be used as an intermediary by an attacker to reach a vulnerable &lt;code&gt;git&lt;/code&gt; version. The Forgejo codebase itself is not at fault and has no way to mitigate the problem: the only solution is to upgrade the &lt;code&gt;git&lt;/code&gt; binary.&lt;/p&gt; &lt;h3&gt;Fixing Git when using a Forgejo binary&lt;/h3&gt; &lt;p&gt;When installed as a binary &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.1-0&quot;&gt;downloaded from the Forjego releases&lt;/a&gt; repository, it is the responsibility of the Forgejo admin to install &lt;code&gt;git&lt;/code&gt; independently. Upgrading to a patched &lt;code&gt;git&lt;/code&gt; package (with a version greater or equal to v2.39.1, v2.38.3, v2.37.5, v2.36.4, v2.35.6, v2.34.6, v2.33.6, v2.32.5, v2.31.6, and v2.30.7) is therefore enough to fix the problem, even if Forgejo is not upgraded. Note that some distributions (such as Ubuntu) may backport security fixes to older &lt;code&gt;git&lt;/code&gt; versions instead of upgrading, and it is worth looking at the changelog for confirmation. If a package is older than 17 January 2023, it will NOT contain the security fix because it was only made public on that date.&lt;/p&gt; &lt;h3&gt;Fixing Git when using a Forgejo container image&lt;/h3&gt; &lt;p&gt;When installed as an image &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/versions&quot;&gt;downloaded from the Forgejo registry&lt;/a&gt;, the container includes both the Forgejo binary and the &lt;code&gt;git&lt;/code&gt; binary, as obtained from &lt;a href=&quot;https://pkgs.alpinelinux.org/packages?name=git&amp;amp;branch=v3.16&quot;&gt;Alpine 3.16&lt;/a&gt;. &lt;code&gt;Forgejo 1.18.0-1&lt;/code&gt; contains a vulnerable &lt;code&gt;git&lt;/code&gt; binary:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;$ docker run --rm codeberg.org/forgejo/forgejo:1.18.0-1 git --version git version 2.36.3 &lt;/code&gt;&lt;/pre&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/versions&quot;&gt;Forgejo 1.18.1-0 images&lt;/a&gt; were built shortly after the patched &lt;code&gt;git&lt;/code&gt; binary was upgraded in &lt;code&gt;Alpine 3.16&lt;/code&gt; and is not vulnerable:&lt;/p&gt; &lt;pre&gt;&lt;code&gt;$ docker run --rm codeberg.org/forgejo/forgejo:1.18.1-0 git --version git version 2.36.4 &lt;/code&gt;&lt;/pre&gt; &lt;p&gt;In this case it is necessary to upgrade Forgejo to &lt;code&gt;1.18.1-0&lt;/code&gt; to get the fixed &lt;code&gt;git&lt;/code&gt; binary. The &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.18-rootless&quot;&gt;rootless&lt;/a&gt; variant of Forgejo also includes the &lt;code&gt;git&lt;/code&gt; binary and can be upgraded in the same way.&lt;/p&gt; &lt;h3&gt;Forgejo installation instructions&lt;/h3&gt; &lt;p&gt;See the &lt;a href=&quot;/download&quot;&gt;download page&lt;/a&gt; for instructions for installation instructions. If you are upgrading from &lt;code&gt;Forgejo 1.18.0-1&lt;/code&gt; (or &lt;code&gt;Gitea 1.18&lt;/code&gt;) no manual action is required. If you&apos;re on &lt;code&gt;Gitea v1.17.x&lt;/code&gt; or older please read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-18-0-1&quot;&gt;release notes&lt;/a&gt; carefully, and in particular check out the &lt;a href=&quot;https://blog.gitea.io/2022/12/gitea-1.18.0-is-released/#breaking-changes&quot;&gt;breaking changes&lt;/a&gt; section of Gitea&apos;s blog post.&lt;/p&gt; &lt;p&gt;The actual upgrade process is as simple as replacing the Gitea binary or container image with the corresponding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.1-0&quot;&gt;Forgejo binary&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.18.1-0&quot;&gt;container image&lt;/a&gt;. If you&apos;re using the container images, you can use the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.18&quot;&gt;&lt;code&gt;1.18&lt;/code&gt;&lt;/a&gt; tag to stay up to date with the latest &lt;code&gt;1.18.x&lt;/code&gt; point release automatically.&lt;/p&gt; &lt;h3&gt;Codeberg is not vulnerable&lt;/h3&gt; &lt;p&gt;The &lt;a href=&quot;/.well-known/security.txt&quot;&gt;Forgejo security team&lt;/a&gt; is a joint effort with &lt;a href=&quot;https://codeberg.org&quot;&gt;Codeberg&lt;/a&gt; which already runs a &lt;code&gt;git&lt;/code&gt; version that is not vulnerable.&lt;/p&gt; &lt;h3&gt;Responsible disclosure to Gitea&lt;/h3&gt; &lt;p&gt;As soon as the &lt;a href=&quot;/.well-known/security.txt&quot;&gt;Forgejo security team&lt;/a&gt; confirmed the vulnerability, the conclusions were communicated to the Gitea security team. Forgejo recommended a rebuild of the Gitea container images for &lt;code&gt;1.18.1&lt;/code&gt;, that were created shortly before the proper Alpine package version was available.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports. You can also find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop by &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) to say hi!&lt;/p&gt; </content:encoded></item><item><title>Answering Forgejo federation questions</title><link>https://forgejo.org/2023-01-10-answering-forgejo-federation-questions/</link><guid isPermaLink="true">https://forgejo.org/2023-01-10-answering-forgejo-federation-questions/</guid><description>This post answers some commonly asked questions about Forgejo federation.</description><pubDate>Tue, 10 Jan 2023 00:00:00 GMT</pubDate><content:encoded>&lt;h3&gt;What is federation?&lt;/h3&gt; &lt;p&gt;Federation is about creating open protocols so that different servers can communicate with each other. Once Forgejo gains federation support via the &lt;a href=&quot;https://forgefed.org/&quot;&gt;ForgeFed&lt;/a&gt; protocol, you&apos;ll be able to do things like create issues for projects on other Forgejo instances without creating an account on that instance. But federation doesn&apos;t just solve the problem of having to create many Forgejo accounts. The power of federation comes from building an interoperable ecosystem, since any other code collaboration site or development tool can also add ForgeFed support. Just look at GitHub: it&apos;s the epicenter of a giant ecosystem of apps and integrations and tools that cements GitHub&apos;s position. It&apos;s a textbook example of a walled garden. We want to create something similar, but in an open ecosystem where everything speaks the ForgeFed protocol, so you&apos;re never locked-in by which forge or code collaboration software that you use.&lt;/p&gt; &lt;h3&gt;Is Forgejo federation development being worked on right now?&lt;/h3&gt; &lt;p&gt;Yes. You can find an up-to-date task list &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues/59&quot;&gt;here&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;When will federation be released?&lt;/h3&gt; &lt;p&gt;Forgejo federation will be merged into mainline Forgejo through two (or more) pull requests. The first pull request, which will be submitted later this month, includes backend support for some basic federation features like following remote users, opening issues on remote repositories, and blocking instances. A second pull request will include a UI for federation, more moderation features, and backend support for federating all of Forgejo&apos;s features, such as adding remote users as repository collaborators. Federation will most likely be included in Forgejo 1.19, which will be released in a few months.&lt;/p&gt; &lt;h3&gt;Will Gitea also gain federation?&lt;/h3&gt; &lt;p&gt;Most likely yes. We want as many forges as possible to be federated, so we will contribute the federation code upstream to Gitea.&lt;/p&gt; &lt;h3&gt;What&apos;s F3 and how does it relate to federation?&lt;/h3&gt; &lt;p&gt;A lot of difficult and seemingly unrelated problems like migrating projects, federated pull requests, and mirroring issues actually have the same solution. A project&apos;s code is stored using Git and can be easily migrated, but the issues, pull requests, and project metadata are stored in the database. If only we had a common format for representing all the various components of a project and code to serve and store project components using this format... then mirroring issues would be as easy as fetching remote issues in this format and storing them on our instance. I know, &lt;a href=&quot;https://xkcd.com/927/&quot;&gt;let&apos;s make our own format&lt;/a&gt;!&lt;/p&gt; &lt;p&gt;And that&apos;s why &lt;a href=&quot;https://forum.forgefriends.org/t/about-the-friendly-forge-format-f3/681&quot;&gt;F3&lt;/a&gt; was created. It&apos;s a JSON format closely based on how projects are internally stored in Forgejo&apos;s database. Although it has a similar semantics, it is different from the &lt;a href=&quot;https://forgefed.org/vocabulary.html&quot;&gt;ForgeFed vocabulary&lt;/a&gt;. Since the rest of Forgejo federation uses ForgeFed, we&apos;re working on unifying F3 and the ForgeFed vocabulary so they can use the same codebase.&lt;/p&gt; &lt;h3&gt;Further reading&lt;/h3&gt; &lt;p&gt;If you think this post was helpful, you should read &lt;a href=&quot;https://a.exozy.me/posts/forge-federation-myths/&quot;&gt;Forge Federation Myths&lt;/a&gt;. Note that it predates Forgejo, so you might want to mentally substitute &lt;code&gt;s/Gitea/Forgejo/g&lt;/code&gt; while reading it.&lt;/p&gt; </content:encoded></item><item><title>Forgejo v1.18 stable is released</title><link>https://forgejo.org/2022-12-29-release-v1-18-0/</link><guid isPermaLink="true">https://forgejo.org/2022-12-29-release-v1-18-0/</guid><description>The first stable release of Forgejo was published, based on Gitea v1.18.0.</description><pubDate>Thu, 29 Dec 2022 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Today &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.0-1&quot;&gt;Forgejo v1.18.0-1&lt;/a&gt; was released. This is the first stable release of Forgejo, and is based on &lt;a href=&quot;https://blog.gitea.io/2022/12/gitea-1.18.0-is-released/&quot;&gt;Gitea v1.18.0&lt;/a&gt; which was also released today.&lt;/p&gt; &lt;h3&gt;Get Forgejo v1.18&lt;/h3&gt; &lt;p&gt;See the &lt;a href=&quot;/download&quot;&gt;download page&lt;/a&gt; for instructions on how to install Forgejo, and read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-18-0-1&quot;&gt;release notes&lt;/a&gt; for more information on what&apos;s new.&lt;/p&gt; &lt;h4&gt;Upgrading from Gitea&lt;/h4&gt; &lt;p&gt;This is the moment you have been waiting for. This stable release offers an upgrade and a transition path from Gitea to Forgejo. If you&apos;re on &lt;code&gt;v1.17.x&lt;/code&gt; or older please read the &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-18-0-1&quot;&gt;release notes&lt;/a&gt; carefully, and in particular check out the &lt;a href=&quot;https://blog.gitea.io/2022/12/gitea-1.18.0-is-released/#breaking-changes&quot;&gt;breaking changes&lt;/a&gt; section of Gitea&apos;s blog post.&lt;/p&gt; &lt;p&gt;The actual upgrade process is as simple as replacing the Gitea binary or container image with the corresponding &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.0-1&quot;&gt;Forgejo binary&lt;/a&gt; or &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.18.0-1&quot;&gt;container image&lt;/a&gt;. If you&apos;re using the container images, you can use the &lt;a href=&quot;https://codeberg.org/forgejo/-/packages/container/forgejo/1.18&quot;&gt;&lt;code&gt;1.18&lt;/code&gt; tag&lt;/a&gt; to stay up to date with the latest &lt;code&gt;1.18.x&lt;/code&gt; point release automatically.&lt;/p&gt; &lt;h3&gt;Contribute to Forgejo&lt;/h3&gt; &lt;p&gt;If you have any feedback or suggestions for Forgejo, we&apos;d love to hear from you! Open an issue on &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues&quot;&gt;our issue tracker&lt;/a&gt; for feature requests or bug reports, find us &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;on the Fediverse&lt;/a&gt;, or drop into &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;our Matrix space&lt;/a&gt; (&lt;a href=&quot;https://matrix.to/#/#forgejo-chat:matrix.org&quot;&gt;main chat room&lt;/a&gt;) and say hi!&lt;/p&gt; </content:encoded></item><item><title>First forgejo monthly update - December 2022</title><link>https://forgejo.org/2022-12-26-monthly-update/</link><guid isPermaLink="true">https://forgejo.org/2022-12-26-monthly-update/</guid><description>Forgejo was announced 15 December 2022, here is how it happened.</description><pubDate>Mon, 26 Dec 2022 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;Forgejo was &lt;a href=&quot;/2022-12-15-hello-forgejo&quot;&gt;announced in December 2022&lt;/a&gt; and this report explains how it happened. It is the creation of a collective of people from diverse backgrounds united towards a common goal: enabling Free Software contributors with Free Software tools. The software forge it provides can be downloaded and used right away and it has a unique non-technical feature: the community that drives its roadmap can be trusted to put the interest of the general public first. Forging Free Software is not just about writing code, it is a &lt;a href=&quot;https://coding.social/&quot;&gt;social construct&lt;/a&gt; that involves everyone in a continuous loop.&lt;/p&gt; &lt;p&gt;This first monthly report is meant to provide a high-level update of what happened in Forgejo, for people who want to follow its progress from a distance. Fact checking is made easy with links to the issue trackers or chat rooms where the action happened: everything in Forgejo since its inception has been 100% transparent. Video conferences are also &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/36&quot;&gt;organized monthly&lt;/a&gt; for Forgejo community members to ask questions.&lt;/p&gt; &lt;h3&gt;Bootstrap&lt;/h3&gt; &lt;p&gt;After &lt;a href=&quot;https://gitea-open-letter.coding.social/#gitea-ltd-confirms-its-takeover-of-the-gitea-project&quot;&gt;Gitea Ltd confirmed the takeover of the Gitea project&lt;/a&gt; on 30 October 2022, a group of people proposed that &lt;a href=&quot;https://docs.codeberg.org/getting-started/what-is-codeberg/#what-is-codeberg-e.v.%3F&quot;&gt;Codeberg e.V.&lt;/a&gt; should become the custodian of a fork of Gitea. The proposal was &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/3#issuecomment-688648&quot;&gt;accepted 16 November 2022&lt;/a&gt;:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;Codeberg e.V. is in control of the domains and the trademarks (if any)&lt;/li&gt; &lt;li&gt;Forgejo contributors are a self-governed group of people (a &quot;gremium&quot; in the Codeberg e.V. parlance)&lt;/li&gt; &lt;li&gt;The Codeberg e.V. general assembly reviews if Forgejo is aligned with its mission on a yearly basis, based on the monthly reports Forgejo publishes&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;The essential conditions for a fork to succeed were met and Forgejo was able to be bootstrapped in a sustainable way:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;A well-known and trusted organization agreed to support and use Forgejo&lt;/li&gt; &lt;li&gt;A group of people with the right skills and stamina committed to provide a long-term effort&lt;/li&gt; &lt;li&gt;The strategy to create a soft fork was a good match for the Forgejo contributors workforce&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;It took another month for the bootstrap to complete and Forgejo was &lt;a href=&quot;/2022-12-15-hello-forgejo&quot;&gt;announced 15 December 2022&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Development and Distribution&lt;/h3&gt; &lt;p&gt;From a technical point of view, Forgejo is a &lt;a href=&quot;/download&quot;&gt;drop-in replacement for Gitea&lt;/a&gt;: it can be used without any modification by simply replacing the Gitea binary (or container image).&lt;/p&gt; &lt;p&gt;The first technical work that was done was to replace the Drone (which is not Free Software) release pipeline used by Gitea with a pipeline based on &lt;a href=&quot;https://woodpecker-ci.org/&quot;&gt;Woodpecker CI&lt;/a&gt;. It produced a release candidate &lt;a href=&quot;/releases&quot;&gt;for Forgejo 1.18.0-rc1-1&lt;/a&gt; and is ready for the 1.18 release that will include:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;binaries for GNU/Linux amd64, arm64 and armv6 (which can also be used on armv7)&lt;/li&gt; &lt;li&gt;container images for amd64 and arm64, either running as root or rootless&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;It will include some &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/CONTRIBUTING/WORKFLOW.md#branding&quot;&gt;Forgejo branding changes&lt;/a&gt; and default settings to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/CONTRIBUTING/WORKFLOW.md#privacy&quot;&gt;enhance privacy&lt;/a&gt;. And more importantly, it provides a non-technical feature: trust in a sustainable non-profit community to further the interest of the general public.&lt;/p&gt; &lt;p&gt;The forge federation features is a focus of Forgejo. Although it is not ready to be released with version 1.18, active development started to &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/CONTRIBUTING/WORKFLOW.md#federation-https-codeberg-org-forgejo-forgejo-issues-labels-79349&quot;&gt;support ActivityPub and F3&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;User Centric Roadmap&lt;/h3&gt; &lt;p&gt;Already within a few days &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/issues?labels=78139&quot;&gt;dozens of ideas for improving Forgejo&lt;/a&gt; were submitted. They express the needs and preferences of Free Software contributors with regards to how they forge their software. This raw material is input to the roadmap and will lead Forgejo on a path that is unique and different than what corporate forges like Github and Gitlab have to offer. Forgejo will place the community firmly in control of project direction.&lt;/p&gt; &lt;p&gt;How can Forgejo go from an unsorted pile of ideas to an exciting roadmap? What innovations will inspire contributors? And how do these ideas transform into concrete features that will be implemented, instead of lingering as open issues on the backlog? To address people&apos;s needs and be most beneficial for the commons and public interest, Forgejo will follow a structured method of &lt;a href=&quot;https://jdittrich.github.io/userNeedResearchBook/&quot;&gt;User Research&lt;/a&gt;, align with &lt;a href=&quot;https://coding.social/&quot;&gt;Social Coding Movement&lt;/a&gt;, and contribute back insights about Free Software development to evolve the movement&apos;s best-practices.&lt;/p&gt; &lt;p&gt;A &lt;a href=&quot;https://codeberg.org/forgejo/user-research&quot;&gt;repository was created&lt;/a&gt; to bootstrap that effort. It requires a kind of skill that is rare but Forgejo is in a lucky position and &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/20&quot;&gt;benefits from mentoring&lt;/a&gt; and &lt;a href=&quot;https://lab.forgefriends.org/fedeproxy/ux/-/wikis/2021-06-user-research-report&quot;&gt;past examples related to forge federation&lt;/a&gt;. Some Forgejo contributors also intend to participate in the &lt;a href=&quot;https://discourse.opensourcedesign.net/t/fosdem-2023/3093&quot;&gt;OSD devroom&lt;/a&gt; early 2023 during &lt;a href=&quot;https://fosdem.org/2023/&quot;&gt;FOSDEM&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/TEAMS.md#accessibility&quot;&gt;Forgejo accessibility team was created&lt;/a&gt; and just &lt;a href=&quot;https://codeberg.org/forgejo/user-research/src/branch/master/accessibility&quot;&gt;began User Research&lt;/a&gt; to figure out what matters most to people who struggle with Forgejo because of its accessibility shortcomings.&lt;/p&gt; &lt;h3&gt;Governance&lt;/h3&gt; &lt;p&gt;The Forgejo &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/41&quot;&gt;domains&lt;/a&gt; are owned by &lt;a href=&quot;https://codeberg.org/Codeberg/org/src/branch/main/en/bylaws.md&quot;&gt;Codeberg e.V.&lt;/a&gt;. Forgejo is therefore ultimately under the control of Codeberg e.V. and its governance. However, although Codeberg e.V. is committed to use and host Forgejo, it is expected that Forgejo defines its own governance.&lt;/p&gt; &lt;p&gt;The process to &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/19&quot;&gt;define the governance&lt;/a&gt; is in progress and expected to take weeks if not months. The first two meetings happened (&lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/19#issuecomment-694460&quot;&gt;24 November&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/19#issuecomment-711201&quot;&gt;10 December&lt;/a&gt;). Discussions followed to &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/19#issuecomment-722095&quot;&gt;define how decisions are proposed and enacted&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;While the governance is being defined, there was a need to establish an interim Forgejo governance for safeguarding credentials, enforcing the Code of Conduct and ensuring security vulnerabilities are handled responsibly for the Forgejo releases. All people with a role in the interim Forgejo governance pledge to resign as soon as the Forgejo governance is in place. The people and teams that are part of the interim governance are &lt;a href=&quot;https://codeberg.org/forgejo/meta/src/branch/readme/TEAMS.md&quot;&gt;listed publicly&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Branding&lt;/h3&gt; &lt;p&gt;The support for theming in Gitea is brittle and rebranding is a challenge.&lt;/p&gt; &lt;p&gt;The easy part was the choice of the Forgejo name, which started &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/1&quot;&gt;6 November&lt;/a&gt; and took ten days, with multiple rounds of discussion. The forgejo.org domain was &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/35&quot;&gt;then acquired&lt;/a&gt; and &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/41#issuecomment-726673&quot;&gt;Codeberg e.V. has control over the registrar account&lt;/a&gt;. A logo was then &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/23#issuecomment-693408&quot;&gt;created&lt;/a&gt; as well as &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/56&quot;&gt;a mascot&lt;/a&gt;.&lt;/p&gt; &lt;p&gt;The more substantial work then started in &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/CONTRIBUTING/WORKFLOW.md#branding&quot;&gt;a dedicated branch&lt;/a&gt;. The rebranding touches many areas and needs to be done in such a way that it is transparent for people upgrading from Gitea. It involves filenames, environment variables, configuration settings, web templates, ... Not only is it tedious, it is also subject to conflicts when rebasing on top of Gitea.&lt;/p&gt; &lt;h3&gt;Localization&lt;/h3&gt; &lt;p&gt;The Gitea codebase is internationalized in a way that follows the expected standards. But the localization (i.e. the translations in various languages) relies on a proprietary service that has the translation community locked in. Since Forgejo is committed to exclusively use Free Software dependencies and services, it has to use an alternative.&lt;/p&gt; &lt;p&gt;Fortunately, &lt;a href=&quot;https://weblate.org/&quot;&gt;Weblate&lt;/a&gt; is a quality self-hostable translation platform and an instance &lt;a href=&quot;https://translate.codeberg.org/&quot;&gt;is provided by Codeberg&lt;/a&gt;. Initial work started in a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/CONTRIBUTING/WORKFLOW.md#internationalization-https-codeberg-org-forgejo-forgejo-issues-labels-82637&quot;&gt;dedicated branch&lt;/a&gt;, for the technical part.&lt;/p&gt; &lt;p&gt;The most difficult part will be to bootstrap a community of translator working on Weblate instead of the proprietary platform that Gitea depends on. Ideas on how to achieve that in an incremental way are &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/72&quot;&gt;most welcome&lt;/a&gt;.&lt;/p&gt; &lt;h3&gt;Communication and Code of Conduct&lt;/h3&gt; &lt;p&gt;As a new project Forgejo had to create new communication channels:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;a static website at &lt;a href=&quot;https://forgejo.org&quot;&gt;https://forgejo.org&lt;/a&gt; built by a CI pipeline from &lt;a href=&quot;https://codeberg.org/Forgejo/website&quot;&gt;a repository&lt;/a&gt; for collaborative editing.&lt;/li&gt; &lt;li&gt;a social account at &lt;a href=&quot;https://floss.social/@forgejo&quot;&gt;https://floss.social/@forgejo&lt;/a&gt; where content is either published after a consensus is reached from the Forgejo community or signed by the author trusted with access to the account.&lt;/li&gt; &lt;li&gt;a &lt;a href=&quot;https://matrix.to/#/#forgejo:matrix.org&quot;&gt;Matrix space&lt;/a&gt; where the main room welcomes Forgejo users to answer any question they may have and development rooms where technical discussions happen between people actively working.&lt;/li&gt; &lt;li&gt;all other communications happen on the forge itself, in a spirit of dogfooding. For instance, although it may be more convenient to use a forum such as Discourse for informal discussions or a task manager to organize the work, the issue tracker is used instead.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;All communication happens in public, transparently, so a newcomer can immediately get up to speed by reading the backlog. A &lt;a href=&quot;https://codeberg.org/forgejo/code-of-conduct&quot;&gt;Code of Conduct&lt;/a&gt; was adopted &lt;a href=&quot;https://codeberg.org/forgejo/meta/issues/13&quot;&gt;very early on&lt;/a&gt; and applies to all spaces under the responsibility of the Forgejo community. It is essential to create an inclusive environment where everyone can feel safe and a &lt;a href=&quot;https://codeberg.org/forgejo/forgejo/src/branch/forgejo/CONTRIBUTING/COC.md&quot;&gt;Well Being&lt;/a&gt; team is here to help if needed.&lt;/p&gt; &lt;p&gt;A particular effort was made when drafting the &lt;a href=&quot;/2022-12-15-hello-forgejo&quot;&gt;Forgejo announcement&lt;/a&gt; and the &lt;a href=&quot;https://blog.codeberg.org/codeberg-launches-forgejo.html&quot;&gt;Codeberg blog post&lt;/a&gt; to explain that Forgejo is meant to reunite the community. It does not compete with Gitea, it builds upon it.&lt;/p&gt; &lt;h3&gt;Sustainability&lt;/h3&gt; &lt;p&gt;The ideal Free Software project is sustainable because it involves many independent individuals who have the means to work for the interest of the general public, in the long run. It is unhealthy when it relies heavily on overworked volunteers who eventually burn out. It is also unhealthy when it is exclusively under the control of a single for-profit organization that works for the benefit of its shareholders.&lt;/p&gt; &lt;p&gt;Forgejo is set to create a healthy balance that involves:&lt;/p&gt; &lt;ul&gt; &lt;li&gt;A majority of independent volunteers who are in control of Forgejo via a governance that empowers them. They are representatives of the general public and ultimately the only ones who legitimate to make decisions.&lt;/li&gt; &lt;li&gt;A minority of people who earn a living by implementing a roadmap co-created by the Forgejo community.&lt;/li&gt; &lt;/ul&gt; &lt;p&gt;As of today there are just a handful of &lt;a href=&quot;https://codeberg.org/forgejo/sustainability&quot;&gt;people paid for their work&lt;/a&gt; and an order of magnitude more who volunteer. A grant application was &lt;a href=&quot;https://codeberg.org/forgejo/sustainability/issues/1&quot;&gt;submitted December 1st&lt;/a&gt; while &lt;a href=&quot;https://forum.forgefriends.org/t/nlnet-grant-application-for-federation-in-gitea-deadline-august-1st-2022/823&quot;&gt;another is ongoing&lt;/a&gt; and already funds some of the work towards forge federation.&lt;/p&gt; &lt;p&gt;It is unclear if Forgejo will manage to be sustainable while so many other Free Software projects struggle. But maybe it will because it does something unique: being transparent about its funding. Not translucent: transparent.&lt;/p&gt; </content:encoded></item><item><title>Beyond coding. We forge.</title><link>https://forgejo.org/2022-12-15-hello-forgejo/</link><guid isPermaLink="true">https://forgejo.org/2022-12-15-hello-forgejo/</guid><description>After many days of hard work and preparation, we are proud to announce that the Forgejo project is now live.</description><pubDate>Thu, 15 Dec 2022 00:00:00 GMT</pubDate><content:encoded>&lt;p&gt;After many days of hard work and preparation by a team of former Gitea maintainers and enthusiasts from the FOSS community, we are proud to announce that the Forgejo project is now live.&lt;/p&gt; &lt;p&gt;&lt;strong&gt;Forgejo&lt;/strong&gt; (&lt;a href=&quot;/static/forgejo.mp4&quot;&gt;/forˈd͡ʒe.jo/&lt;/a&gt; – inspired by &lt;i&gt;forĝejo&lt;/i&gt;, the Esperanto word for forge) is a community-driven Free Software project that develops a code forge platform similar to GitHub, and that is a drop-in replacement for Gitea. We started Forgejo in reaction to control of Gitea being taken away from the community by the newly-formed for-profit company Gitea Ltd without prior community consultation, and after an &lt;a href=&quot;https://gitea-open-letter.coding.social/&quot;&gt;Open Letter&lt;/a&gt; to the Gitea project owners remained unanswered. The Forgejo project has two major objectives that drive our development and road map:&lt;/p&gt; &lt;ol&gt; &lt;li&gt;The community is in control, and ensures we develop to address community needs.&lt;/li&gt; &lt;li&gt;We will help liberate software development from the shackles of proprietary tools.&lt;/li&gt; &lt;/ol&gt; &lt;h3&gt;We are people in control of our future&lt;/h3&gt; &lt;p&gt;The first objective relates to how we are organized as a project. It is crucial for Forgejo to guarantee that our product will remain Free Software forever, under the guidance of an open and inclusive community. Forgejo will provide a healthy project governance, so that it can truly focus on the needs of all those people that use our software on a daily basis.&lt;/p&gt; &lt;p&gt;To this end we are very proud that Codeberg e.V. has decided to become our project’s custodian. Codeberg e.V. is a non-profit organization with a stellar reputation, that is dedicated to the success of the Free Software movement. They provide software development services to FOSS projects at Codeberg.org. They are rapidly growing and hosting more than 50,000 code repositories for about 40,000 people. Not only will Codeberg take care of the Forgejo domain names and trademarks, but the organization will use Forgejo as the basis for their own services, instead of Gitea.&lt;/p&gt; &lt;p&gt;Forgejo&apos;s code base is of course hosted on Codeberg, and by using Woodpecker CI instead of Drone and Matrix instead of Discord, we exclusively rely on Free Software tools.&lt;/p&gt; &lt;h3&gt;We will help liberate software development&lt;/h3&gt; &lt;p&gt;Our second objective relates to the product that we deliver. Free Software projects are in general heavily focused on coding. But development of quality software also involves work in many other areas. For the long-term sustainability of any Free Software, project many aspects must be taken into account. Successful software products involve collaboration between many people with different skill sets.&lt;/p&gt; &lt;p&gt;Forgejo&apos;s vision is to make software development accessible to everyone – bringing true inclusion and diversity to a field traditionally dominated by technical-skilled people, and where many of the tools used are proprietary services with companies dictating who has access, and who does not.&lt;/p&gt; &lt;p&gt;Our vision offers our community a very exciting path forward. For our development road map we will consider the entirety of the Free Software Development Lifecycle (FSDL) and gradually unlock it to the world. We intend to be part of a growing ecosystem of collaborating Free Software projects that dedicate to this same vision. We see &lt;a href=&quot;https://forgefriends.org/blog/2022/06/30/2022-06-state-forge-federation/&quot;&gt;forge federation&lt;/a&gt; as a means to open up the development process, and it is here that we will innovate.&lt;/p&gt; &lt;h3&gt;Join our adventure&lt;/h3&gt; &lt;p&gt;Help make coding social. Join us in our quest, be part of our adventure. Forgejo is not just a code forge. We go beyond coding. &lt;strong&gt;Together we forge Free Software!&lt;/strong&gt;&lt;/p&gt; &lt;p&gt;&lt;em&gt;Stay tuned to our blog. The coming period we will provide you with many updates about our project organization.&lt;/em&gt;&lt;/p&gt; </content:encoded></item></channel></rss>