openSUSE security update: security update for forgejo-cli
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:21605-1
Rating: important
References:
* bsc#1242683
* bsc#1248047
* bsc#1274529
Cross-References:
* CVE-2025-3416
* CVE-2025-55159
* CVE-2026-25541
CVSS scores:
* CVE-2025-3416 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-3416 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-55159 ( SUSE ): 5.8 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
* CVE-2025-55159 ( SUSE ): 5.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
* CVE-2026-25541 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-25541 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 3 vulnerabilities and has 3 bug fixes can now be installed.
Description:
This update for forgejo-cli fixes the following issues:
Changes in forgejo-cli:
- Update vendored bytes crate to 1.12.1
* CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could
corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529).
- update to 0.6.0:
* Localization!
- forgejo-cli has gained localization support!
You can now use it in your preferred language, just like
Forgejo itself.
Currently de-DE and zh-Hans are included, with several more
being in-progress.
See the project on Codeberg Translate if you want to help out
with any languages you know!
https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/
* Additions
- (!586) fj issue/pr view assignees to see who is assigned to
an issue or pull request
- (!582) --avatar/--unset-avatar options on fj repo edit
- (!554) fj repo star-status to check if you've starred a repo
- (!547) --cwd option to set the working directory a command is
run in
- (!533, !561) Commands to watch and unwatch repos
- (!462) Resolve SSH host names from SSH config
- (!279, !464, !472, !489, !491, !513, !594) Localization
- Added fj auth login support for the following instances:
- v16.next.forgejo.org
- v17.next.forgejo.org
- Removed fj auth login support for the following instances
that have shut down:
- v7.next.forgejo.org
- v12.next.forgejo.org
* Changes
- (!535) Added an error message when fj auth login fails to
open the browser
- (!523) fj auth add-key was renamed to fj auth add-token. An
alias still exists to add-key, so this isn't a breaking
change.
- (!514) The --host flag can now be anywhere in the command,
instead of only the beginning
- (!504) fj auth add-token no longer takes a username argument.
* Fixes
- (!579) Fixed fj issue unassign incorrectly unassigning
everyone except the intended users
- (!569) Fixed display of labels failing when a label is marked
as exclusive but does not contain a slash
- (!542) Fixed parsing of SSH shorthand urls
- (!510) Fixed fj pr checkout failing when the instance URL
contained a port
- (!437) Fixed incorrect parsing of activity info
* Other
- (!573) Use rust 2024 edition
- (!560) Simplify determining repo owner
- (!531) Fix clippy warnings
- (!527) Remove unused dependencies, narrow tokio features
- (!526) Replace crossterm with terminal_size
- (!520) Optimize cargo release profile
- (!469) Fix typo
- (!449) Restricted file permissions at creation time
- (!443) Add oneline helptext to 'repo migrate' command
- update to 0.5.0:
* Additions
- (!334) Support for managing labels on issues and repos.
- (!349) repo edit and repo units for modifying settings on a
repo and repo units.
- (!373) Use the needed CLI flags for more editors when opening
them.
- (!385) Use the editor defined in git's core.editor config
option by default (falling back to $EDITOR if it is not set).
- (!414) Add commands to assign and unassign users to issues
and PRs.
- (!415) Support all README files in fj repo readme, regardless
of case or extension.
- (!416) Add the option to choose what repo to own the new repo
to fj repo migrate.
- (!419) Show a warning when viewing an archived repo.
- (!420) Add a notice about git push --force not being
supported on AGit PRs.
- Added fj auth login support for the following instances:
- v15.next.forgejo.org
- codefloe.com
* Fixes
- (!393) Don't include pull requests in fj issues search.
- (!407) Guarantee opening the browser in fj auth login doesn't
block.
- (!417) Prevent incorrectly reusing the refresh token when
refreshing OAuth tokens.
* Other
- (!278) Improved "no repo info" error message.
- (!403) Build aarch64 artifacts for new releases.
- update to 0.4.1:
* Fixes
- (!368) Generate the correct PKCE challenge verifier. This was
preventing fj auth login from succeeding.
- Update to version 0.4.0:
* Support for issue & pull request templates with fj issue/pr create
--template
* fj pr create --autofill, which will automatically populate the PR's title
and body from the commit(s)
* fj user key and fj user gpg commands for managing uploaded SSH and GPG keys
* fj user repos --page, to select the page of results to view
* fj issue/pr create/comment --body-from-file to use the contents of a file
as the body
* --identity-file/-I flag for selecting the SSH identity to use
* fj tag to manage git tags
* fj issue search --state all
* --remote & --repo flags can now be at the end of the command with the rest
of the flags
- update to 0.3.0:
* Additions
- Added fj completion to generate completion scripts for various
shells
- Added fj org for Organization commands.
- Added fj actions for Forgejo Actions-related commands (thank
you, @LordMZTE !)
- OAuth client IDs for fj auth login can now be customized.
See the wiki for more on the new features.
https://codeberg.org/Cyborus/forgejo-cli/wiki/Organizations
* Fixes
- Keys file now has proper file permissions
- Fixed incorrect help commands (thank you, @0ko !)
- Always set user agent in requests
- update to 0.2.0:
* Additions
- pr create and issue create now have a --web flag that opens
the creation page in your browser instead of creating it on
the terminal.
- pr --agit will create a pull request with agit flow, so you
don't need to fork the repository.
- pr status --wait will only exits once all PR checks finish.
- repo migrate to migrate/mirror repositories from other hosts.
- repo readme to print a repository's readme to the terminal.
- version --verbose prints extra info useful for debugging
* Fixes
- Public endpoints can now be accessed without authenticating
- The API will be accessed via the http url even when it
differs from the ssh url and the local remote points to the
ssh url.
- browse commands will no long hang the terminal
- Local repos will now be found even when in a subdirectory
- SSH urls in repo remotes will now be parsed correctly
- Improved pull request detection
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-packagehub-506=1
Package List:
- openSUSE Leap 16.0:
forgejo-cli-0.6.0-bp160.1.1
References:
* https://www.suse.com/security/cve/CVE-2025-3416.html
* https://www.suse.com/security/cve/CVE-2025-55159.html
* https://www.suse.com/security/cve/CVE-2026-25541.html
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.