Security update for forgejo-cli
This update for forgejo-cli fixes the following issues: Changes in forgejo-cli: - Update vendored bytes crate to 1.12.1 * CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529). - update to 0.6.0: * Localization! - forgejo-cli has gained localization support! You can now use it in your preferred language, just like Forgejo itself. Currently de-DE and zh-Hans are included, with several more being in-progress. See the project on Codeberg Translate if you want to help out with any languages you know! https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/ * Additions - (!586) fj issue/pr view assignees to see who is assigned to an issue or pull request - (!582) --avatar/--unset-avatar options on fj repo edit - (!554) fj repo star-status to check if you've starred a repo - (!547) --cwd option to set the working directory a command is run in - (!533, !561) Commands to watch and unwatch repos - (!462) Resolve SSH host names from SSH config - (!279, !464, !472, !489, !491, !513, !594) Localization - Added fj auth login support for the following instances: - v16.next.forgejo.org - v17.next.forgejo.org - Removed fj auth login support for the following instances that have shut down: - v7.next.forgejo.org - v12.next.forgejo.org * Changes - (!535) Added an error message when fj auth login fails to open the browser - (!523) fj auth add-key was renamed to fj auth add-token. An alias still exists to add-key, so this isn't a breaking change. - (!514) The --host flag can now be anywhere in the command, instead of only the beginning - (!504) fj auth add-token no longer takes a username argument. * Fixes - (!579) Fixed fj issue unassign incorrectly unassigning everyone except the intended users - (!569) Fixed display of labels failing when a label is marked as exclusive but does not contain a slash - (!542) Fixed parsing of SSH shorthand urls - (!510) Fixed fj pr checkout failing when the instance URL contained a port - (!437) Fixed incorrect parsing of activity info * Other - (!573) Use rust 2024 edition - (!560) Simplify determining repo owner - (!531) Fix clippy warnings - (!527) Remove unused dependencies, narrow tokio features - (!526) Replace crossterm with terminal_size - (!520) Optimize cargo release profile - (!469) Fix typo - (!449) Restricted file permissions at creation time - (!443) Add oneline helptext to 'repo migrate' command - update to 0.5.0: * Additions - (!334) Support for managing labels on issues and repos. - (!349) repo edit and repo units for modifying settings on a repo and repo units. - (!373) Use the needed CLI flags for more editors when opening them. - (!385) Use the editor defined in git's core.editor config option by default (falling back to $EDITOR if it is not set). - (!414) Add commands to assign and unassign users to issues and PRs. - (!415) Support all README files in fj repo readme, regardless of case or extension. - (!416) Add the option to choose what repo to own the new repo to fj repo migrate. - (!419) Show a warning when viewing an archived repo. - (!420) Add a notice about git push --force not being supported on AGit PRs. - Added fj auth login support for the following instances: - v15.next.forgejo.org - codefloe.com * Fixes - (!393) Don't include pull requests in fj issues search. - (!407) Guarantee opening the browser in fj auth login doesn't block. - (!417) Prevent incorrectly reusing the refresh token when refreshing OAuth tokens. * Other - (!278) Improved "no repo info" error message. - (!403) Build aarch64 artifacts for new releases. - update to 0.4.1: * Fixes - (!368) Generate the correct PKCE challenge verifier. This was preventing fj auth login from succeeding. - Update to version 0.4.0: * Support for issue & pull request templates with fj issue/pr create --template * fj pr create --autofill, which will automatically populate the PR's title and body from the commit(s) * fj user key and fj user gpg commands for managing uploaded SSH and GPG keys * fj user repos --page, to select the page of results to view * fj issue/pr create/comment --body-from-file to use the contents of a file as the body * --identity-file/-I flag for selecting the SSH identity to use * fj tag to manage git tags * fj issue search --state all * --remote & --repo flags can now be at the end of the command with the rest of the flags - update to 0.3.0: * Additions - Added fj completion to generate completion scripts for various shells - Added fj org for Organiz
Security update for forgejo-cli
Description
This update for forgejo-cli fixes the following issues: Changes in forgejo-cli: - Update vendored bytes crate to 1.12.1 * CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529). - update to 0.6.0: * Localization! - forgejo-cli has gained localization support! You can now use it in your preferred language, just like Forgejo itself. Currently de-DE and zh-Hans are included, with several more being in-progress. See the project on Codeberg Translate if you want to help out with any languages you know! https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/ * Additions - (!586) fj issue/pr view assignees to see who is assigned to an issue or pull request - (!582) --avatar/--unset-avatar options on fj repo edit - (!554) fj repo star-status to check if you've starred a repo - (!547) --cwd option to set the working directory a command is run in - (!533, !561) Commands to watch and unwatch repos - (!462) Resolve SSH host names from SSH config - (!279, !464, !472, !489, !491, !513, !594) Localization - Added fj auth login support for the following instances: - v16.next.forgejo.org - v17.next.forgejo.org - Removed fj auth login support for the following instances that have shut down: - v7.next.forgejo.org - v12.next.forgejo.org * Changes - (!535) Added an error message when fj auth login fails to open the browser - (!523) fj auth add-key was renamed to fj auth add-token. An alias still exists to add-key, so this isn't a breaking change. - (!514) The --host flag can now be anywhere in the command, instead of only the beginning - (!504) fj auth add-token no longer takes a username argument. * Fixes - (!579) Fixed fj issue unassign incorrectly unassigning everyone except the intended users - (!569) Fixed display of labels failing when a label is marked as exclusive but does not contain a slash - (!542) Fixed parsing of SSH shorthand urls - (!510) Fixed fj pr checkout failing when the instance URL contained a port - (!437) Fixed incorrect parsing of activity info * Other - (!573) Use rust 2024 edition - (!560) Simplify determining repo owner - (!531) Fix clippy warnings - (!527) Remove unused dependencies, narrow tokio features - (!526) Replace crossterm with terminal_size - (!520) Optimize cargo release profile - (!469) Fix typo - (!449) Restricted file permissions at creation time - (!443) Add oneline helptext to 'repo migrate' command - update to 0.5.0: * Additions - (!334) Support for managing labels on issues and repos. - (!349) repo edit and repo units for modifying settings on a repo and repo units. - (!373) Use the needed CLI flags for more editors when opening them. - (!385) Use the editor defined in git's core.editor config option by default (falling back to $EDITOR if it is not set). - (!414) Add commands to assign and unassign users to issues and PRs. - (!415) Support all README files in fj repo readme, regardless of case or extension. - (!416) Add the option to choose what repo to own the new repo to fj repo migrate. - (!419) Show a warning when viewing an archived repo. - (!420) Add a notice about git push --force not being supported on AGit PRs. - Added fj auth login support for the following instances: - v15.next.forgejo.org - codefloe.com * Fixes - (!393) Don't include pull requests in fj issues search. - (!407) Guarantee opening the browser in fj auth login doesn't block. - (!417) Prevent incorrectly reusing the refresh token when refreshing OAuth tokens. * Other - (!278) Improved "no repo info" error message. - (!403) Build aarch64 artifacts for new releases. - update to 0.4.1: * Fixes - (!368) Generate the correct PKCE challenge verifier. This was preventing fj auth login from succeeding. - Update to version 0.4.0: * Support for issue & pull request templates with fj issue/pr create --template * fj pr create --autofill, which will automatically populate the PR's title and body from the commit(s) * fj user key and fj user gpg commands for managing uploaded SSH and GPG keys * fj user repos --page, to select the page of results to view * fj issue/pr create/comment --body-from-file to use the contents of a file as the body * --identity-file/-I flag for selecting the SSH identity to use * fj tag to manage git tags * fj issue search --state all * --remote & --repo flags can now be at the end of the command with the rest of the flags - update to 0.3.0: * Additions - Added fj completion to generate completion scripts for various shells - Added fj org for Organiz
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- SUSE Product Security Team
- Advisory Id
- openSUSE-SU-2026:21605-1
- Cve Count
- 3
- Additional Cves
- ["CVE-2025-55159","CVE-2026-25541"]
Threat ID: 6aab496155bf5e2cf5990b01
Added to database: 09/17/2026, 01:58:57 UTC
Last updated: 09/17/2026, 01:58:57 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.