Forgejo 7.0.0 → 8.0.0

• Container image upgrades

In the Forgejo v7.0.3 container images, the Git version was upgraded to 2.43.4 which includes fixes for multiple vulnerabilities. However, the vulnerabilities with a high impact can be exploited when Git is used in an environment (or Operating Systems) which is different from the Forgejo OCI image.

• regreSSHion

Recommended action when running Forgejo from a:

• binary - upgrade the OpenSSH server that was installed independently.
• root OCI image - upgrade to Forgejo 7.0.5.
• rootless OCI image - no upgrade is necessary.

CVE-2024-6387 also known as regreSSHion is an Unauthenticated Remote Code Execution (RCE) vulnerability in OpenSSH’s server (sshd) on glibc-based Linux systems. It is strongly recommended that an OpenSSH server installed independently of Forgejo is upgraded as soon as possible.

All Forgejo OCI root images, including 7.0.5 contain an OpenSSH server. They are based on https://alpinelinux.org/ which relies on https://musl.libc.org/ and not https://en.wikipedia.org/wiki/Glibc. As a precaution the Forgejo v7.0.5 root OCI image contains an updated OpenSSH server patched for CVE-2024-6387.

The Forgejo OCI rootless images, including 7.0.5, do not contain an OpenSSH server, they rely on the internal Forgejo implementation of the SSH protocol.

• Two frontend features were removed because a license incompatibility was discovered. Read more in the companion blog post.
• PR (backported from): Mermaid rendering: %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% will now fail because ELK is no longer included.
• PR (backported from): Repository citation: Removed the ability to export citations in APA format.

A companion blog post provides additional context on this release. In addition to the pull requests listed below, you will find a complete list in the v8.0 milestone.

• Two frontend features were removed because a license incompatibility was discovered. Read more in the dedicated blog post.
• PR: Mermaid rendering: %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% will now fail because ELK is no longer included.
• PR: Repository citation: Removed the ability to export citations in APA format.

• PR: remove Microsoft SQL Server support see the discussion.