{"full_name":"gogs/gogs","owner":"gogs","name":"gogs","url":"https://github.com/gogs/gogs","description":"The painless way to host your own Git service","homepage":"https://gogs.io","topics":[],"language":"Go","license":"MIT","avatar":"https://avatars.githubusercontent.com/u/6656686?v=4","created_at":"2014-02-12T01:57:08Z","pushed_at":"2026-11-10T04:09:57Z","metrics":{"stars":47926,"forks":5081,"watchers":1006,"issues":5217,"prs":2693,"releases":98,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":257},"growth":{"day":{"stars":1,"forks":-1,"base_day":"2026-11-09"}},"history":{"dates":["2026-11-09","2026-11-10"],"stars":[47925,47926],"forks":[5082,5081],"watchers":[1006,1006],"issues_open":[null,null],"prs_open":[null,null]},"boards":{},"same_owner":[],"issues":[{"number":13,"title":"Repository/user search (Code and Issues)","comments":88,"created_at":"2014-03-10T06:09:09Z"},{"number":936,"title":"Snippets, Gists, Etc. feature","comments":52,"created_at":"2015-02-11T04:44:03Z"},{"number":1692,"title":"REST API","comments":51,"created_at":"2015-09-25T18:32:16Z"},{"number":662,"title":"Organizations / groups from LDAP","comments":49,"created_at":"2014-11-24T06:23:14Z"},{"number":1644,"title":"Ability to comment on lines of code in a pull request","comments":46,"created_at":"2015-09-15T11:58:32Z"},{"number":144,"title":"Mobile specific UI","comments":46,"created_at":"2014-04-30T08:33:23Z"},{"number":2950,"title":"Private repos are created as world-readable","comments":41,"created_at":"2016-04-09T07:10:16Z"},{"number":1518,"title":"Slow repository browsing response times","comments":40,"created_at":"2015-08-20T13:01:05Z"}],"discussions":[{"number":8419,"title":"HTTP Security Headers","comments":0,"category":"General","created_at":"2026-09-17T12:24:43Z"},{"number":8418,"title":"Code review","comments":0,"category":"Q&A","created_at":"2026-09-17T08:26:10Z"},{"number":8417,"title":"Hey Guyz Idk This IP","comments":0,"category":"General","created_at":"2026-09-14T08:24:11Z"},{"number":8414,"title":"Gogs Pages, serving a repository's static files from a dedicated domain","comments":0,"category":"Proposal","created_at":"2026-09-08T19:29:25Z"},{"number":8383,"title":"Add OpenID Connect authentication","comments":1,"category":"Proposal","created_at":"2026-07-11T08:29:05Z"},{"number":8368,"title":"Customization","comments":1,"category":"Q&A","created_at":"2026-06-16T21:21:55Z"},{"number":8361,"title":"ccline — AI shell helper for Gogs self-hosters","comments":0,"category":"Show and tell","created_at":"2026-06-10T13:05:10Z"},{"number":8340,"title":"Gogs 0.14.3 has been released!","comments":0,"category":"Announcements","created_at":"2026-06-08T00:37:25Z"}],"latest_release":{"name":"0.14.3","tag":"v0.14.3","published_at":"2026-06-07T20:51:06Z","body":"### Fixed\n\n- _Security:_ Reverse proxy authentication header was honored from any remote address, allowing user impersonation when Gogs was reachable directly. The header is now only trusted from addresses listed in `[auth] TRUSTED_PROXY_IPS`. [#8264](https://github.com/gogs/gogs/pull/8264) - [GHSA-w6j9-vw59-27wv](https://github.com/gogs/gogs/security/advisories/GHSA-w6j9-vw59-27wv)\n- _Security:_ Server-side request forgery in webhook deliveries via HTTP redirects to local network addresses. [#8263](https://github.com/gogs/gogs/pull/8263) - [GHSA-c4v7-xg93-qf8g](https://github.com/gogs/gogs/security/advisories/GHSA-c4v7-xg93-qf8g)\n- _Security:_ Denial of service when rendering issue references against a malformed external issue tracker URL format. [#8312](https://github.com/gogs/gogs/pull/8312) - [GHSA-4j89-2c4f-44c6](https://github.com/gogs/gogs/security/advisories/GHSA-4j89-2c4f-44c6)\n- _Security:_ Stored XSS in Jupyter notebook (`.ipynb`) preview through Markdown links with `javascript:` URLs. [#8319](https://github.com/gogs/gogs/pull/8319) - [GHSA-jq8v-rmf6-65jw](https://github.com/gogs/gogs/security/advisories/GHSA-jq8v-rmf6-65jw)\n- _Security:_ Missing authorization check on the attachment download endpoint allowed anyone who knew (or guessed) an attachment UUID to download files belonging to private repositories. [#8320](https://github.com/gogs/gogs/pull/8320) - [GHSA-p9f5-h3rx-j5qw](https://github.com/gogs/gogs/security/advisories/GHSA-p9f5-h3rx-j5qw)\n- _Security:_ Organization team and member management actions accepted GET requests, allowing a logged-in owner to be tricked into adding an attacker to the Owners team via a crafted link. [#8321](https://github.com/gogs/gogs/pull/8321) - [GHSA-pwx3-qcgw-vh7h](https://github.com/gogs/gogs/security/advisories/GHSA-pwx3-qcgw-vh7h)\n- _Security:_ SSRF via mirror address update bypassing clone address validation. [#8225](https://github.com/gogs/gogs/pull/8225) - [GHSA-wv27-2vqp-j7g5](https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5)\n- _Security:_ Open redirect on login and other post-action flows via the `redirect_to` query parameter. [#8322](https://github.com/gogs/gogs/pull/8322) - [GHSA-xxhq-69mf-w8cr](https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr)\n- _Security:_ Privilege escalation to repository owner via collaboration access mode update. [#8227](https://github.com/gogs/gogs/pull/8227) - [GHSA-4565-r4x7-hg8j](https://github.com/gogs/gogs/security/advisories/GHSA-4565-r4x7-hg8j)\n- _Security:_ SSRF in repository migration and recurring mirror sync via HTTP redirects and stale host validation on stored mirror URLs. [#8324](https://github.com/gogs/gogs/pull/8324) - [GHSA-g2f5-gjr4-qjvm](https://github.com/gogs/gogs/security/advisories/GHSA-g2f5-gjr4-qjvm)\n- _Security:_ Remote command execution via pull request rebase merges with crafted branch names. [#8301](https://github.com/gogs/gogs/pull/8301) - [GHSA-qf6p-p7ww-cwr9](https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9)\n- _Security:_ Stored XSS in the milestone dropdown on the new issue page via crafted milestone names. [#8325](https://github.com/gogs/gogs/pull/8325) - [GHSA-vcm5-gvmp-78mp](https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp)\n- _Security:_ Stored XSS in Jupyter notebook (`.ipynb`) preview through `data:text/html` URIs that bypassed the sanitizer. [#8326](https://github.com/gogs/gogs/pull/8326) - [GHSA-3w28-36p9-w929](https://github.com/gogs/gogs/security/advisories/GHSA-3w28-36p9-w929)\n- _Security:_ Write-level collaborators could change admin-only repository settings (issue tracker, wiki, mirror sync) via API. [#8327](https://github.com/gogs/gogs/pull/8327) - [GHSA-268j-37xf-pp52](https://github.com/gogs/gogs/security/advisories/GHSA-268j-37xf-pp52)\n- _Security:_ Password reset tokens stayed valid for the account-activation lifetime, ignoring `[auth] RESET_PASSWORD_CODE_LIVES`. [#8328](https://github.com/gogs/gogs/pull/8328) - [GHS"},"readme":true,"readme_zh":false,"news":[],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}