gitGost

Recent Commits

• dependabot[bot] (10 Jul 26)

  chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in the go_modules group across 1 directory (#102) Bumps the go_modules group with 1 update in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto). Updates `golang.org/x/crypto` from 0.51.0 to 0.52.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/a1c0d9929856c8aba2b31f079340f00578eda803"><code>a1c0d99</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/3c7c86938f4541c333d506f719388d9c42d4763d"><code>3c7c869</code></a> ssh: fix deadlock on unexpected channel responses</li> <li><a href="https://github.com/golang/crypto/commit/533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce"><code>533fb3f</code></a> ssh: fix source-address critical option bypass</li> <li><a href="https://github.com/golang/crypto/commit/abbc44d451a6f9236a2bbd26cbcd4d0fec473da3"><code>abbc44d</code></a> ssh: fix incorrect operator order</li> <li><a href="https://github.com/golang/crypto/commit/e052873987615dc96fe67607a9a6adb76311344f"><code>e052873</code></a> ssh: fix infinite loop on large channel writes due to integer overflow</li> <li><a href="https://github.com/golang/crypto/commit/b61cf853a89d82cad68da5e12a6beca2116f8456"><code>b61cf85</code></a> ssh: enforce user presence verification for security keys</li> <li><a href="https://github.com/golang/crypto/commit/9c2cd33e8d96a96133fd6ff732510ebba539c2bd"><code>9c2cd33</code></a> ssh: enforce strict limits on DSA key parameters</li> <li><a href="https://github.com/golang/crypto/commit/890731877d85f71cfdc9554e7a27fec4684fc4c4"><code>8907318</code></a> ssh: reject RSA keys with excessively large moduli</li> <li><a href="https://github.com/golang/crypto/commit/ffd87b4878fa98ca2908ec534e1a410bf095a35e"><code>ffd87b4</code></a> ssh: fix panic when authority callbacks are nil</li> <li><a href="https://github.com/golang/crypto/commit/4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946"><code>4e7a738</code></a> ssh: fix deadlock on unexpected global responses</li> <li>Additional commits viewable in <a href="https://github.com/golang/crypto/compare/v0.51.0...v0.52.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/livrasand/gitGost/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• livrasand (10 Jul 26)

  Add discussions and wiki support (#101) Add new navigation views for GitHub Discussions and Wiki pages: - Discussions: Query GitHub API for discussions with category badges and answer status - Wiki: Support both GitHub and GitLab wikis with page navigation - Remove Google Fonts links (blocked by content filters); fall back to system fonts - Add CSS styles for discussion categories and answer badges - Show/hide nav items based on repo capabilities (has_discussions, has_wiki)

• livrasand (09 Jul 26)

  Add GitLab commit APIs & commits UI (#100) Introduce GitLab proxy endpoints and a full commits UI. Server: add GitLab handlers (commit count with X-Total or binary-search fallback, avatar-by-email, commits list, commit detail that merges info + diff). Register routes and update CSP to allow esm.sh for client-side modules. Client/web: add commits view and commit detail UI, responsive styles for index/repo pages, Shiki-based async diff highlighting (fallback to multiple CDNs), gravatar/md5 helper, avatar prefetch via new API, and resolve relative image/link paths in rendered markdown. Also call loadCommitCount to populate sidebar. Minor icon and layout tweaks. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a Commits view for repositories, including commit counts, commit details, file changes, and diffs. * Added GitLab support for commit browsing, avatars, commit counts, and detailed changes. * Added syntax highlighting for commit diffs. * Improved handling of relative README links and images. * **UI Improvements** * Enhanced mobile and tablet layouts across repository, terminal, forms, and navigation views. * Replaced external-link text indicators with accessible icons. * **Bug Fixes** * Improved commit count loading and author avatar retrieval. <!-- end of auto-generated comment: release notes by coderabbit.ai -->

• Anonymous user (09 Jul 26)

  Fix clone/push URL construction (#98) Rename base -> host and separate the protocol from the host path. Explicitly prepend https:// for clone and remote-add commands so generated git URLs are consistent and correct. Updated web/repo.html. Co-authored-by: Livrädo Sandoval <[email protected]>

• livrasand (09 Jul 26)

  Update README with new logo and heading format (#96) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the README header branding to use a centered SVG logo and a prominent “gitGost” title. * Kept the existing tagline messaging intact while simplifying the top-of-page visual presentation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->

• livrasand (09 Jul 26)

  feat: simplify clone command to use anonymous auth with gitGost URL d… (#95) …irectly Eliminado el paso de clonar desde GitHub/GitLab y agregar remote 'gost' separadamente. Ahora el comando de clonación usa directamente la URL de gitGost con autenticación anónima (`anon:@`), simplificando el flujo de trabajo inicial. Co-authored-by: Anonymous user <[email protected]>

• livrasand (09 Jul 26)

  feat: update clone/push commands to use original repo URLs with gost … (#94) …remote Modificados los comandos de clonación para usar las URLs originales de GitHub/GitLab en lugar de las URLs de gitGost, agregando gitGost como remote adicional llamado 'gost'. Simplificado el comando de actualización para usar el mismo patrón de remote naming.

• livrasand (09 Jul 26)

  chore: expand CSP img-src to allow shields.io, trendshift.io, and sta… (#93) …r-history.com Agregados dominios de badges y gráficos externos (shields.io, trendshift.io, star-history.com) a la política de seguridad de contenido para permitir carga de imágenes desde estos servicios.

• livrasand (09 Jul 26)

  fix: simplify API base URL detection and relax CSP for localhost (#92) Eliminada lógica condicional de detección de puerto en favor de `window.location.origin`. Actualizado CSP para permitir conexiones a `http://localhost:*` durante desarrollo local.

• livrasand (09 Jul 26)

  chore(deps): bump golang base image from 1.22 to 1.25 in Dockerfile (#91)

• livrasand (09 Jul 26)

  changes for the coming soon v2 (#90) Implementados endpoints /api/search (búsqueda multi-provider con soporte para topics), /api/trending/:provider (repos trending/new de GitHub/GitLab), y /api/gl-notes/:owner/:repo/:number (proxy de comentarios de issues de GitLab sin requerir token del usuario). Actualizado CSP para permitir conexiones a APIs externas y recursos CDN. Agregado middleware localhostCORS para desarrollo local. Eliminados archivos HTML estáticos obsoletos (approach.html, guidelines.html, karma.html), <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added API endpoints for repository search, trending repositories, and issue notes proxying. - Search and trending results now support multiple providers with a shared response format. - **Bug Fixes** - Improved browser access during local development with relaxed CORS handling for localhost. - Expanded allowed security policy sources so external images and data connections load correctly. - **Refactor** - Removed several standalone informational pages and streamlined public routing. <!-- end of auto-generated comment: release notes by coderabbit.ai -->

• livrasand (08 Jul 26)

  Add PR/MR status tracking and on-demand check endpoint (#87) Implement tracking of PRs/MRs created through gitGost and add /api/pr/:hash/status endpoint to retrieve their current status, timeline events, and comments. Include action buttons in ntfy notifications for quick status checks. Extends both GitHub and GitLab providers with GetMRStatus method. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * PR status checks now show richer, more up-to-date information, including recent activity and comments. * Status checks can now be retried against tracked pull/merge requests after notification actions. * GitLab merge request IDs are now handled more reliably from links. * **Bug Fixes** * Improved retrieval of multi-page PR timelines. * Better handling of merged PR state detection. * Added request throttling for PR status checks to reduce overload. <!-- end of auto-generated comment: release notes by coderabbit.ai -->

• livrasand (08 Jul 26)

  Add anonymous appeal system for blocked hashes (#86) Implement an ephemeral in-memory appeal system allowing users to appeal blocked hashes using deterministic HMAC tokens. Add PR status tracking and on-demand checking via new /api/pr/:hash/status endpoint. Enhance ntfy notifications with action buttons for immediate PR status checks. Add security headers and security.txt policy file. Include new GitHub API functions for fetching PR timeline and metadata with ETag caching. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added an on-demand pull request status endpoint used by notification action links. * Enhanced notifications with an actionable “Check Status” button. * Introduced an anonymous appeal flow for blocked hashes with private ticket handling and tracking. * Added an admin appeals dashboard to review, resolve, and manage outcomes. * **Security** * Added stronger default HTTP security headers. * Published `/.well-known/security.txt` with contact and policy details. * **Bug Fixes** * Improved pull request change detection and metadata freshness using ETag-based timeline checks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

• dependabot[bot] (07 Jul 26)

  chore(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 in the go_modules group across 1 directory (#85) Bumps the go_modules group with 1 update in the / directory: [golang.org/x/net](https://github.com/golang/net). Updates `golang.org/x/net` from 0.53.0 to 0.55.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/7770ec48d03fec35e378665337b4faca93c38423"><code>7770ec4</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/4ece7b612ad44ad6c4d5e0d5d4df9c18cc211905"><code>4ece7b6</code></a> html: escape greater-than symbol in doctype identifiers</li> <li><a href="https://github.com/golang/net/commit/08be507abce89191d78cd49da60f4501fc910472"><code>08be507</code></a> html: improve Noah's Ark clause performance</li> <li><a href="https://github.com/golang/net/commit/a8fb2fe4f7378f816302b9f2f7b8290ce512e5dd"><code>a8fb2fe</code></a> html: properly render fostered elements in foreign content</li> <li><a href="https://github.com/golang/net/commit/0dc5b7a5f81d7155ade6d5e9db35992998679932"><code>0dc5b7a</code></a> html: properly check namespace in &quot;in body&quot; any other end tag</li> <li><a href="https://github.com/golang/net/commit/a452f3cc17168a60bc3f439a3ae0fcffc32eca0e"><code>a452f3c</code></a> html: ignore duplicate attributes during tokenization</li> <li><a href="https://github.com/golang/net/commit/f8651996b24ba47d89dd9eb97fd47758e6d1886f"><code>f865199</code></a> quic: fix appendMaxDataFrame erroneously accumulating sentLimit</li> <li><a href="https://github.com/golang/net/commit/210ed3cb901cb549818aefa04b71dadaf149d05d"><code>210ed3c</code></a> quic: establish a &quot;happened-before&quot; relationship between stream write and read</li> <li><a href="https://github.com/golang/net/commit/ad8140e0aa2ec41b37ea478b4525a423bcc21af9"><code>ad8140e</code></a> quic: fix buffer slicing when handling overlapping stream data</li> <li><a href="https://github.com/golang/net/commit/23ee2efe81a3ff183b4eca46c42f749af7efca45"><code>23ee2ef</code></a> http2: avoid API changes when built with go1.27</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.53.0...v0.55.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/livrasand/gitGost/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• livrasand (19 Jun 26)

  Document gitGost architecture and data flow (#82) Added comprehensive documentation on the architecture and data flow of gitGost, detailing the process of anonymization, data storage, and trust boundaries. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added comprehensive architecture documentation detailing system operations, commit anonymization processes, data retention and privacy policies, infrastructure setup, security boundaries, and reproducible verification procedures for build integrity. <!-- end of auto-generated comment: release notes by coderabbit.ai -->

• dependabot[bot] (19 Jun 26)

  chore(deps): bump the go_modules group across 1 directory with 5 updates (#80) Bumps the go_modules group with 1 update in the / directory: [github.com/go-git/go-git/v5](https://github.com/go-git/go-git). Updates `github.com/go-git/go-git/v5` from 5.12.0 to 5.19.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-git/releases">github.com/go-git/go-git/v5's releases</a>.</em></p> <blockquote> <h2>v5.19.1</h2> <h2>What's Changed</h2> <ul> <li>v5: plumbing: transport/ssh, Shell-quote path by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2068">go-git/go-git#2068</a></li> <li>v5: git: submodule, Fix relative URL resolution by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2070">go-git/go-git#2070</a></li> <li>v5: git: submodule, canonical remote for relative URLs by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2074">go-git/go-git#2074</a></li> <li>v5: git: submodule, error on remote without URLs by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2078">go-git/go-git#2078</a></li> <li>v5: plumbing: format/idxfile, Validate offset64 indices by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2084">go-git/go-git#2084</a></li> <li>v5: *: Reject malformed variable-length integers by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2092">go-git/go-git#2092</a></li> <li>v5: plumbing: format/packfile, Tighten delta validation by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2091">go-git/go-git#2091</a></li> <li>v5: Add <code>worktreeFilesystem</code> wrapper for worktree and hardening by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2100">go-git/go-git#2100</a></li> <li>v5: config: validate submodule names by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2082">go-git/go-git#2082</a></li> <li>build: Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2111">go-git/go-git#2111</a></li> <li>v5: git: Allow MkdirAll on worktree-root paths by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2117">go-git/go-git#2117</a></li> <li>v5: git: Stop validating symlink target paths by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2116">go-git/go-git#2116</a></li> <li>v5: plumbing: format decoder input bounds and contracts by <a href="https://github.com/hiddeco"><code>@​hiddeco</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2125">go-git/go-git#2125</a></li> <li>plumbing: format/packfile, cap delta chain depth in parser by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2137">go-git/go-git#2137</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1">https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1</a></p> <h2>v5.19.0</h2> <h2>What's Changed</h2> <ul> <li>build: Update module github.com/go-git/go-git/v5 to v5.18.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/2010">go-git/go-git#2010</a></li> <li>v5: Bump sha1cd and go-billy by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2060">go-git/go-git#2060</a></li> <li>v5: Align object encoding with upstream by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2065">go-git/go-git#2065</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0">https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0</a></p> <h2>v5.18.0</h2> <h2>What's Changed</h2> <ul> <li>plumbing: transport/http, Add support for followRedirects policy by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/2004">go-git/go-git#2004</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0">https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0</a></p> <h2>v5.17.2</h2> <h2>What's Changed</h2> <ul> <li>build: Update module github.com/go-git/go-git/v5 to v5.17.1 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1941">go-git/go-git#1941</a></li> <li>dotgit: skip writing pack files that already exist on disk by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1944">go-git/go-git#1944</a></li> </ul> <p>:warning: This release fixes a bug (<a href="https://redirect.github.com/go-git/go-git/issues/1942">go-git/go-git#1942</a>) that blocked some users from upgrading to <code>v5.17.1</code>. Thanks <a href="https://github.com/pskrbasu"><code>@​pskrbasu</code></a> for reporting it. :bow:</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2">https://github.com/go-git/go-git/compare/v5.17.1...v5.17.2</a></p> <h2>v5.17.1</h2> <h2>What's Changed</h2> <ul> <li>build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-git/pull/1930">go-git/go-git#1930</a></li> <li>[v5] plumbing: format/index, Improve v4 entry name validation by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1935">go-git/go-git#1935</a></li> <li>[v5] plumbing: format/idxfile, Fix version and fanout checks by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-git/pull/1937">go-git/go-git#1937</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-git/commit/3c3be601aa6c0fd0d536c0d1e4f898b4c60e65fe"><code>3c3be60</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2137">#2137</a> from go-git/validate-v5</li> <li><a href="https://github.com/go-git/go-git/commit/3fba897bd9e84b1aec170fa708b80e297b7d6cf6"><code>3fba897</code></a> plumbing: format/packfile, cap delta chain depth in parser</li> <li><a href="https://github.com/go-git/go-git/commit/a97d6601c85e017bb64c2b0f2e3169f6ef6a6709"><code>a97d660</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2125">#2125</a> from hiddeco/v5/format-input-bounds</li> <li><a href="https://github.com/go-git/go-git/commit/aeaa125c8af8e4c4c95b574c22c5633e97fc436e"><code>aeaa125</code></a> plumbing: format/objfile, require Header before Read</li> <li><a href="https://github.com/go-git/go-git/commit/1f38e171218526ea254a73187a52f0648253c1b8"><code>1f38e17</code></a> plumbing: format/packfile, bound inflate size</li> <li><a href="https://github.com/go-git/go-git/commit/f7545a02529e03998d6a7219140dc0e6644ad337"><code>f7545a0</code></a> plumbing: format/idxfile, bound nr by file size</li> <li><a href="https://github.com/go-git/go-git/commit/170b88181f385913a457a08b68c88956fb3f8e4f"><code>170b881</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2116">#2116</a> from pjbgf/symlink-v5</li> <li><a href="https://github.com/go-git/go-git/commit/7b6d994467f06630268904aa3c441b6de7248b31"><code>7b6d994</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-git/issues/2117">#2117</a> from hiddeco/v5/worktree-fs-mkdirall-root-noop</li> <li><a href="https://github.com/go-git/go-git/commit/f0709b32f8fbb87c16cd63c6762d2cd515f36541"><code>f0709b3</code></a> git: Stop validating symlink target paths</li> <li><a href="https://github.com/go-git/go-git/commit/776d00f11d336f26862d0f2bab987b217f3a7844"><code>776d00f</code></a> git: Allow MkdirAll on worktree-root paths</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-git/compare/v5.12.0...v5.19.1">compare view</a></li> </ul> </details> <br /> Updates `github.com/cloudflare/circl` from 1.3.7 to 1.6.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudflare/circl/releases">github.com/cloudflare/circl's releases</a>.</em></p> <blockquote> <h2>CIRCL v1.6.3</h2> <p>Fix a bug on ecc/p384 scalar multiplication.</p> <h3>What's Changed</h3> <ul> <li>sign/mldsa: Check opts for nil value by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/582">cloudflare/circl#582</a></li> <li>ecc/p384: Point addition must handle point doubling case. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/583">cloudflare/circl#583</a></li> <li>Release CIRCL v1.6.3 by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/584">cloudflare/circl#584</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.6.2...v1.6.3">https://github.com/cloudflare/circl/compare/v1.6.2...v1.6.3</a></p> <h2>CIRCL v1.6.2</h2> <ul> <li>New SLH-DSA, improvements in ML-DSA for arm64.</li> <li>Tested compilation on WASM.</li> </ul> <h2>What's Changed</h2> <ul> <li>Optimize pairing product computation by moving exponentiations to G1. by <a href="https://github.com/dfaranha"><code>@​dfaranha</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/547">cloudflare/circl#547</a></li> <li>sign: Adding SLH-DSA signature by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/512">cloudflare/circl#512</a></li> <li>Update code generators to CIRCL v1.6.1. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/548">cloudflare/circl#548</a></li> <li>ML-DSA: Add preliminary Wycheproof test vectors by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/552">cloudflare/circl#552</a></li> <li>go fmt by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/554">cloudflare/circl#554</a></li> <li>gz-compressing test vectors, use of HexBytes and ReadGzip functions. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/555">cloudflare/circl#555</a></li> <li>group: Removes use of elliptic Marshal and Unmarshal functions. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/556">cloudflare/circl#556</a></li> <li>Support encoding/decoding ML-DSA private keys (as long as they contain seeds) by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/559">cloudflare/circl#559</a></li> <li>Update to golangci-lint v2 by <a href="https://github.com/bwesterb"><code>@​bwesterb</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/560">cloudflare/circl#560</a></li> <li>Preparation for ARM64 Implementation of poly operations for dilithium package. by <a href="https://github.com/elementrics"><code>@​elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/562">cloudflare/circl#562</a></li> <li>prepare power2Round for custom implementations in assembly by <a href="https://github.com/elementrics"><code>@​elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/564">cloudflare/circl#564</a></li> <li>ARM64 implementation for poly.PackLe16 by <a href="https://github.com/elementrics"><code>@​elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/563">cloudflare/circl#563</a></li> <li>add arm64 version of polyMulBy2toD by <a href="https://github.com/elementrics"><code>@​elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/565">cloudflare/circl#565</a></li> <li>add arm64 version of polySub by <a href="https://github.com/elementrics"><code>@​elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/566">cloudflare/circl#566</a></li> <li>group: add byteLen method for short groups and RandomScalar uses rand.Int by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/568">cloudflare/circl#568</a></li> <li>add arm64 version of poly.Add/Sub by <a href="https://github.com/elementrics"><code>@​elementrics</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/572">cloudflare/circl#572</a></li> <li>group: Adding cryptobyte marshaling to scalars by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/569">cloudflare/circl#569</a></li> <li>Bumping up to Go1.25 by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/574">cloudflare/circl#574</a></li> <li>ci: Including WASM compilation. by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/577">cloudflare/circl#577</a></li> <li>Revert to using package-declared HPKE errors for shortkem instead of standard library errors by <a href="https://github.com/harshiniwho"><code>@​harshiniwho</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/578">cloudflare/circl#578</a></li> <li>Release v1.6.2 by <a href="https://github.com/armfazh"><code>@​armfazh</code></a> in <a href="https://redirect.github.com/cloudflare/circl/pull/579">cloudflare/circl#579</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dfaranha"><code>@​dfaranha</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/547">cloudflare/circl#547</a></li> <li><a href="https://github.com/elementrics"><code>@​elementrics</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/562">cloudflare/circl#562</a></li> <li><a href="https://github.com/harshiniwho"><code>@​harshiniwho</code></a> made their first contribution in <a href="https://redirect.github.com/cloudflare/circl/pull/578">cloudflare/circl#578</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.2">https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.2</a></p> <h2>CIRCL v1.6.1</h2> <ul> <li>Fixes some point checks on the FourQ curve.</li> <li>Hybrid KEM fails on low-order points.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cloudflare/circl/commit/24ae53c5d6f7fe18203adc125ba3ed76a38703e1"><code>24ae53c</code></a> Release CIRCL v1.6.3</li> <li><a href="https://github.com/cloudflare/circl/commit/581020bd4a836b8ce7bd4e414ba2884c07dbc906"><code>581020b</code></a> Rename method to oddMultiplesProjective.</li> <li><a href="https://github.com/cloudflare/circl/commit/12209a4566605692a8402594e367a5aed5148460"><code>12209a4</code></a> Removing unused cmov for jacobian points.</li> <li><a href="https://github.com/cloudflare/circl/commit/fcba359f4178645d2c9e50f29ab6966337da4b95"><code>fcba359</code></a> ecc/p384: use of complete projective formulas for scalar multiplication.</li> <li><a href="https://github.com/cloudflare/circl/commit/5e1bae8d8c2df4e717c2c5c2d5b5d60b629b2ac6"><code>5e1bae8</code></a> ecc/p384: handle point doubling in point addition with Jacobian coordinates.</li> <li><a href="https://github.com/cloudflare/circl/commit/341604685ff97e8f7440ae4b4711ba1c118c648c"><code>3416046</code></a> Check opts for nil value.</li> <li><a href="https://github.com/cloudflare/circl/commit/a763d47a6dce43d1f4f7b697d1d7810463a526f6"><code>a763d47</code></a> Release CIRCL v1.6.2</li> <li><a href="https://github.com/cloudflare/circl/commit/3c70bf9ad53b681fbe5ba6067e454a86549fee8a"><code>3c70bf9</code></a> Bump x/crypto x/sys dependencies.</li> <li><a href="https://github.com/cloudflare/circl/commit/3f0f15b2bfe67bad81a35e8aec81ae42ca78349d"><code>3f0f15b</code></a> Revert to using package-declared HPKE errors for shortkem instead of standard...</li> <li><a href="https://github.com/cloudflare/circl/commit/23491bd573cf29b6f567057a158203a2c9dfa30d"><code>23491bd</code></a> Adding generic Power2Round method.</li> <li>Additional commits viewable in <a href="https://github.com/cloudflare/circl/compare/v1.3.7...v1.6.3">compare view</a></li> </ul> </details> <br /> Updates `github.com/go-git/go-billy/v5` from 5.5.0 to 5.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-git/go-billy/releases">github.com/go-git/go-billy/v5's releases</a>.</em></p> <blockquote> <h2>v5.9.0</h2> <h2>What's Changed</h2> <ul> <li>Use path.Clean instead of filepath.Clean in iofs.Open by <a href="https://github.com/puerco"><code>@​puerco</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/197">go-git/go-billy#197</a></li> <li>Deprecate ChrootOS in favour of BoundOS by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/201">go-git/go-billy#201</a></li> <li>General Improvements by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/203">go-git/go-billy#203</a></li> <li>osfs: ChrootOS eval baseDir on creation by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/205">go-git/go-billy#205</a></li> <li>Run go-git tests as part of integration tests by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/206">go-git/go-billy#206</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-billy/compare/v5.8.0...v5.9.0">https://github.com/go-git/go-billy/compare/v5.8.0...v5.9.0</a></p> <h2>v5.8.0</h2> <h2>What's Changed</h2> <ul> <li>build: Update module golang.org/x/net to v0.45.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-billy/pull/183">go-git/go-billy#183</a></li> <li>v5: Ensure Chmod behaviour across BoundOS and ChrootOS by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/187">go-git/go-billy#187</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-billy/compare/v5.7.0...v5.8.0">https://github.com/go-git/go-billy/compare/v5.7.0...v5.8.0</a></p> <h2>v5.7.0</h2> <h2>What's Changed</h2> <ul> <li>Add support for Chmod on billy.Filesystem by <a href="https://github.com/bitfehler"><code>@​bitfehler</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/171">go-git/go-billy#171</a></li> <li>build: Update module golang.org/x/net to v0.38.0 [SECURITY] (releases/v5.x) by <a href="https://github.com/go-git-renovate"><code>@​go-git-renovate</code></a>[bot] in <a href="https://redirect.github.com/go-git/go-billy/pull/177">go-git/go-billy#177</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-billy/compare/v5.6.2...v5.7.0">https://github.com/go-git/go-billy/compare/v5.6.2...v5.7.0</a></p> <h2>v5.6.2</h2> <h2>What's Changed</h2> <ul> <li>Enable the <code>iofs</code> adapter to also return other interfaces from <code>io/fs</code> by <a href="https://github.com/JAORMX"><code>@​JAORMX</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/102">go-git/go-billy#102</a></li> <li>build: Bump dependencies by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/103">go-git/go-billy#103</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/JAORMX"><code>@​JAORMX</code></a> made their first contribution in <a href="https://redirect.github.com/go-git/go-billy/pull/102">go-git/go-billy#102</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-billy/compare/v5.6.1...v5.6.2">https://github.com/go-git/go-billy/compare/v5.6.1...v5.6.2</a></p> <h2>v5.6.1</h2> <h2>What's Changed</h2> <ul> <li>build: bump github/codeql-action from 3.26.11 to 3.27.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/88">go-git/go-billy#88</a></li> <li>build: bump github/codeql-action from 3.27.0 to 3.27.1 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/89">go-git/go-billy#89</a></li> <li>build: bump github/codeql-action from 3.27.1 to 3.27.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/90">go-git/go-billy#90</a></li> <li>build: bump github/codeql-action from 3.27.4 to 3.27.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/91">go-git/go-billy#91</a></li> <li>Bump dependencies and build housekeeping by <a href="https://github.com/pjbgf"><code>@​pjbgf</code></a> in <a href="https://redirect.github.com/go-git/go-billy/pull/95">go-git/go-billy#95</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-git/go-billy/compare/v5.6.0...v5.6.1">https://github.com/go-git/go-billy/compare/v5.6.0...v5.6.1</a></p> <h2>v5.6.0</h2> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-git/go-billy/commit/237e529bb8de61704047f71a5ab1c8e6676492f1"><code>237e529</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-billy/issues/206">#206</a> from pjbgf/v5-improvements</li> <li><a href="https://github.com/go-git/go-billy/commit/04edb394b39979b5cbdec30ded6abdcb9f7786c5"><code>04edb39</code></a> build: Add go-git integration test</li> <li><a href="https://github.com/go-git/go-billy/commit/d8efefd33b2e8eeea1030e317bb0d71c5e918270"><code>d8efefd</code></a> osfs: preserve empty ChrootOS base</li> <li><a href="https://github.com/go-git/go-billy/commit/07f2a0bf50e42d438d1d9d263c3c8a22598985b8"><code>07f2a0b</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-billy/issues/205">#205</a> from pjbgf/v5-improvements</li> <li><a href="https://github.com/go-git/go-billy/commit/25207c8468f1af656953cb5db7030aad5df1fe99"><code>25207c8</code></a> build: Bump Go versions in workflows</li> <li><a href="https://github.com/go-git/go-billy/commit/2fda229d9ac0cb5ba654ebc824cfbb90248f82d9"><code>2fda229</code></a> osfs: ChrootOS eval baseDir on creation</li> <li><a href="https://github.com/go-git/go-billy/commit/427b27f32f22de11498a682c65cd5060a01ec168"><code>427b27f</code></a> Merge pull request <a href="https://redirect.github.com/go-git/go-billy/issues/203">#203</a> from pjbgf/v5-improvements</li> <li><a href="https://github.com/go-git/go-billy/commit/7d5a23ece03edc171c1f63c8fa73f84c8428bf17"><code>7d5a23e</code></a> chroot: Reject symlink loops</li> <li><a href="https://github.com/go-git/go-billy/commit/2c2287a233d2ee1e6cdce8956141f6d10505f3bf"><code>2c2287a</code></a> util: avoid following symlinks in RemoveAll fallback</li> <li><a href="https://github.com/go-git/go-billy/commit/cbd88e9a9a2d7fe1065bbe083d8bf0c5fd7290de"><code>cbd88e9</code></a> Fix mount path handling</li> <li>Additional commits viewable in <a href="https://github.com/go-git/go-billy/compare/v5.5.0...v5.9.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/crypto` from 0.23.0 to 0.50.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/03ca0dcccbd37ba6be80adf74dde8d78a4d72817"><code>03ca0dc</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/8400f4a938077a7a7817ab7d163d148e371b320b"><code>8400f4a</code></a> ssh: respect signer's algorithm preference in pickSignatureAlgorithm</li> <li><a href="https://github.com/golang/crypto/commit/81c6cb34a8fc386ed53293cd79e3c0c232ee7366"><code>81c6cb3</code></a> ssh: swap cbcMinPaddingSize to cbcMinPacketSize to get encLength</li> <li><a href="https://github.com/golang/crypto/commit/982eaa62dfb7273603b97fc1835561450096f3bd"><code>982eaa6</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/159944f128e9b3fdeb5a5b9b102a961904601a87"><code>159944f</code></a> ssh,acme: clean up tautological/impossible nil conditions</li> <li><a href="https://github.com/golang/crypto/commit/a408498e55412f2ae2a058336f78889fb1ba6115"><code>a408498</code></a> acme: only require prompt if server has terms of service</li> <li><a href="https://github.com/golang/crypto/commit/cab0f718548e8a858701b7b48161f44748532f58"><code>cab0f71</code></a> all: upgrade go directive to at least 1.25.0 [generated]</li> <li><a href="https://github.com/golang/crypto/commit/2f26647a795e74e712b3aebc2655bca60b2686f9"><code>2f26647</code></a> x509roots/fallback: update bundle</li> <li><a href="https://github.com/golang/crypto/commit/e08b06753d6a72f1fe375b6e0fefefb39917c165"><code>e08b067</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/7d0074ccc6f17acbf2ebb10db06d492e08f887dc"><code>7d0074c</code></a> scrypt: fix panic on parameters &lt;= 0</li> <li>Additional commits viewable in <a href="https://github.com/golang/crypto/compare/v0.23.0...v0.50.0">compare view</a></li> </ul> </details> <br /> Updates `golang.org/x/net` from 0.25.0 to 0.53.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/net/commit/a8d1fc14d9e33e1f6842ab78a0127d42cd8fff44"><code>a8d1fc1</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/net/commit/056ac742146af742aa760d690269c02fa238cc7a"><code>056ac74</code></a> quic: avoid depending on golang.org/x/sys/unix</li> <li><a href="https://github.com/golang/net/commit/c85f61116e47b1523036c3005f8b2923b661eb64"><code>c85f611</code></a> http3: add http3 package for testing in std</li> <li><a href="https://github.com/golang/net/commit/805fc81a196b95c3c00f02e135ffb8a8d5582bdf"><code>805fc81</code></a> http2: add transport API tests</li> <li><a href="https://github.com/golang/net/commit/e63b894ab3cd38a1d05396530dccde7ffa3f68d0"><code>e63b894</code></a> http2: support testing via net/http.Transport.RoundTrip</li> <li><a href="https://github.com/golang/net/commit/9ee1e484e5aab0d95b3babbc6f1384d03f4f9e22"><code>9ee1e48</code></a> http2/hpack: prevent HeaderField from escaping during encoding</li> <li><a href="https://github.com/golang/net/commit/1e71bd86e4a302b4e731bc06da6eb51679c7bd49"><code>1e71bd8</code></a> http2: prevent hanging Transport due to bad SETTINGS frame</li> <li><a href="https://github.com/golang/net/commit/7bca15042b9d2bda1402cb42232a9c6ddbae6212"><code>7bca150</code></a> internal/http3: respect net/http Server Shutdown context when shutting down</li> <li><a href="https://github.com/golang/net/commit/44c41bee5028537e64410b1583e8ae329ceac284"><code>44c41be</code></a> internal/http3: prevent server from holding mutex when sleeping during shutdown</li> <li><a href="https://github.com/golang/net/commit/228a67a374710bff77fc490e7f538b317c34e247"><code>228a67a</code></a> internal/http3: add CloseIdleConnections support in transport</li> <li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.25.0...v0.53.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/livrasand/gitGost/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• livrasand (19 Jun 26)

  Expand legal terms with liability and indemnification clauses (#81) Added sections on service operator liability limitation, no guarantee of anonymity, and indemnification to clarify user responsibilities and limitations of liability. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated Terms of Service with expanded liability limitation and indemnification provisions * Clarified operator responsibility boundaries for transmitted content * Added explicit notice that anonymity, privacy, and security are best-effort protections only * Defined user indemnification obligations for submitted content and service misuse <!-- end of auto-generated comment: release notes by coderabbit.ai -->

• livrasand (17 Jun 26)

  Add GitHub Actions workflow for vote ranking (#78)

• livrasand (04 Jun 26)

  docs: update platform badges to reflect GitLab availability and add Gitea badge (#77) Actualizado badge de GitLab de "Coming Soon" a "Available" con color brightgreen. Agregado nuevo badge para Gitea con estado "Coming Soon".

• livrasand (04 Jun 26)

  feat: add GitLab provider support with unified multi-platform architcture (#76) Agregado soporte completo para GitLab mediante arquitectura de providers unificada. Creada interfaz provider.Provider en internal/provider/provider.go con métodos ForkRepo, CreateMR, GetRefs, GetExistingMR, CloseMRByURL, GetRepoPolicy, IsRepoVerified, CloneURL, PushURL, TokenEnvVar, Name, CreateAnonymousIssue, CreateAnonymousComment y CreateAnonymousPRComment. Implementados adapters GitHubProvider (internal/provider/github/) y GitLabProvider (internal/provider/gitlab/) con lógica específ

• livrasand (03 Jun 26)

  chore: remove FUNDING.yml and add exiftool metadata stripping guide (#75) Eliminado .github/FUNDING.yml. Agregada sección "Strip metadata from binary files before committing" en README con instalación de exiftool (Debian/Ubuntu/Arch/macOS/Windows), comandos de verificación y stripping recursivo. Agregada pestaña "Strip Metadata" en web/index.html con sub-tabs Linux/macOS y Windows, ejemplos de terminal con detección de GPS/Author y flujo completo de limpieza antes de commit/push anónimo.

• livrasand (03 Jun 26)

  feat: add repository opt-out mechanism with DENY_ALL policy in .gitgost.yml (#74) Agregado sistema de opt-out para repositorios mediante DENY_ALL: true en .gitgost.yml. Implementadas funciones GetRepoPolicy y RepoPolicy struct en internal/github/pr.go con decodificación base64 y parsing YAML. Integrada validación en ReceivePackHandler que rechaza push antes de crear fork/PR con mensaje sideband informativo. Actualizado README con sección "Repository Opt-Out" y ejemplo de uso. Agregados comentarios explic

• livrasand (03 Jun 26)

  chore: migrate service URLs from Leapcell to Fly.io and add git to Docker image (#73) Actualizado SERVICE_URL por defecto de gitgost.leapcell.app a gitgost.fly.dev en .env.example, internal/github/ntfy.go, README.md, .github/workflows/release.yml y templates HTML. Agregado git al Dockerfile con apk add. Implementada tabla comments en schema.sql con políticas RLS. Agregados métodos InsertComment y GetTotalComments en database/supabase.go. Integrado tracking de comentarios en CreateAnonymousCommentHandler y CreateAnonymou <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added anonymous comments functionality with persistent storage * Enhanced UI with Tor access tab and animated PR/comment counters * Updated terminal usage examples * **Documentation** * Updated all documentation and examples to reflect new service URL * **Chores** * Migrated service infrastructure to new hosting provider * Added Git dependency to Docker image <!-- end of auto-generated comment: release notes by coderabbit.ai -->

• livrasand (14 May 26)

  Add web directory to Docker image (#70) afinando compatibilidad con fly.io para el mirror

• livrasand (14 May 26)

  New files from Fly.io Launch (#69) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Added containerization configuration for the application. * Added deployment configuration for cloud infrastructure. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/livrasand/gitGost/pull/69) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Fly.io <[email protected]>

• Livrädo Sandoval (29 Mar 26)

  Update action versions in release workflow (#66)

• Livrädo Sandoval (29 Mar 26)

  Update action versions in release workflow (#65) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated CI/CD infrastructure for improved build reliability and security. <!-- end of auto-generated comment: release notes by coderabbit.ai -->

• Livrädo Sandoval (29 Mar 26)

  feat: add build attestation documentation and dynamic repo URL support, and clean up codebase comments (#64) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added "Audit & transparency" section with build verification command and transparency links in the web interface. * **Improvements** * Enhanced build information detection with multiple automatic fallback strategies. * Verification URLs now dynamically use the configured repository instead of fixed values. * **Chores** * Updated build provenance workflow to the latest version. <!-- end of auto-generated comment: release notes by coderabbit.ai -->

• Livrädo Sandoval (03 Mar 26)

  feat: add panic button, rate limiting, and admin rollback system for … (#63) …abuse mitigation Agregado sistema de panic button con endpoints /admin/panic y /admin/rollback para suspender servicio y cerrar PRs masivos. Implementado rate limiting de 5 PRs/hora por IP con detección de burst patterns cross-IP y alertas ntfy admin con action buttons de un solo uso (10 min TTL). Agregadas variables de entorno PANIC_PASSWORD, NTFY_ADMIN_TOPIC y SERVICE_URL en .env.example. Incluida documentación de administ <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Panic button to suspend/restore the service with admin controls, single‑use action tokens, per‑IP rate limits, global burst detection, admin alerts, service status endpoint, UI suspended banner, and PR rollback to close abusive PRs. * **Documentation** * README updated with Service Administration, panic endpoints, usage examples, and clarified privacy wording. * **Chores** * Added example environment variables for service URL, panic password, and admin alert topic. <!-- end of auto-generated comment: release notes by coderabbit.ai -->

• Livrädo Sandoval (03 Mar 26)

  Update readme (#62) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added one-liner demo and comparison matrix highlighting feature differences with alternative tools * **Improvements** * Streamlined push endpoint processing flow <!-- end of auto-generated comment: release notes by coderabbit.ai -->