• v0.5.6 aae7b16336

    v0.5.6 Stable

    gitea_admin released this 2026-07-01 13:49:05 +00:00 | 55 commits to main since this release

    Fixed

    • HTTP client: bound the success-path (HTTP 200/201) JSON response decoders with
      io.LimitReader(maxResponseBodySize), matching the guard already applied on the
      error paths. A hostile or malfunctioning Kratos admin API could otherwise stream
      an unbounded response body into json.Decode, exhausting operator memory; the
      success paths are now capped identically to the error paths.
    Downloads