openSUSE-SU-2026:21605-1

This update for forgejo-cli fixes the following issues:

Changes in forgejo-cli:

• Update vendored bytes crate to 1.12.1

  • CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529).

• update to 0.6.0:

  • Localization!
    • forgejo-cli has gained localization support! You can now use it in your preferred language, just like Forgejo itself. Currently de-DE and zh-Hans are included, with several more being in-progress. See the project on Codeberg Translate if you want to help out with any languages you know! https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/
  • Additions
    • (!586) fj issue/pr view assignees to see who is assigned to an issue or pull request
    • (!582) --avatar/--unset-avatar options on fj repo edit
    • (!554) fj repo star-status to check if you've starred a repo
    • (!547) --cwd option to set the working directory a command is run in
    • (!533, !561) Commands to watch and unwatch repos
    • (!462) Resolve SSH host names from SSH config
    • (!279, !464, !472, !489, !491, !513, !594) Localization
    • Added fj auth login support for the following instances:
      • v16.next.forgejo.org
      • v17.next.forgejo.org
    • Removed fj auth login support for the following instances that have shut down:
      • v7.next.forgejo.org
      • v12.next.forgejo.org
  • Changes
    • (!535) Added an error message when fj auth login fails to open the browser
    • (!523) fj auth add-key was renamed to fj auth add-token. An alias still exists to add-key, so this isn't a breaking change.
    • (!514) The --host flag can now be anywhere in the command, instead of only the beginning
    • (!504) fj auth add-token no longer takes a username argument.
  • Fixes
    • (!579) Fixed fj issue unassign incorrectly unassigning everyone except the intended users
    • (!569) Fixed display of labels failing when a label is marked as exclusive but does not contain a slash
    • (!542) Fixed parsing of SSH shorthand urls
    • (!510) Fixed fj pr checkout failing when the instance URL contained a port
    • (!437) Fixed incorrect parsing of activity info
  • Other
    • (!573) Use rust 2024 edition
    • (!560) Simplify determining repo owner
    • (!531) Fix clippy warnings
    • (!527) Remove unused dependencies, narrow tokio features
    • (!526) Replace crossterm with terminal_size
    • (!520) Optimize cargo release profile
    • (!469) Fix typo
    • (!449) Restricted file permissions at creation time
    • (!443) Add oneline helptext to 'repo migrate' command

• update to 0.5.0:

  • Additions
    • (!334) Support for managing labels on issues and repos.
    • (!349) repo edit and repo units for modifying settings on a repo and repo units.
    • (!373) Use the needed CLI flags for more editors when opening them.
    • (!385) Use the editor defined in git's core.editor config option by default (falling back to $EDITOR if it is not set).
    • (!414) Add commands to assign and unassign users to issues and PRs.
    • (!415) Support all README files in fj repo readme, regardless of case or extension.
    • (!416) Add the option to choose what repo to own the new repo to fj repo migrate.
    • (!419) Show a warning when viewing an archived repo.
    • (!420) Add a notice about git push --force not being supported on AGit PRs.
    • Added fj auth login support for the following instances:
      • v15.next.forgejo.org
      • codefloe.com
  • Fixes
    • (!393) Don't include pull requests in fj issues search.
    • (!407) Guarantee opening the browser in fj auth login doesn't block.
    • (!417) Prevent incorrectly reusing the refresh token when refreshing OAuth tokens.
  • Other
    • (!278) Improved "no repo info" error message.
    • (!403) Build aarch64 artifacts for new releases.

• update to 0.4.1:

  • Fixes
    • (!368) Generate the correct PKCE challenge verifier. This was preventing fj auth login from succeeding.

• Update to version 0.4.0:

  • Support for issue & pull request templates with fj issue/pr create --template
  • fj pr create --autofill, which will automatically populate the PR's title and body from the commit(s)
  • fj user key and fj user gpg commands for managing uploaded SSH and GPG keys
  • fj user repos --page, to select the page of results to view
  • fj issue/pr create/comment --body-from-file to use the contents of a file as the body
  • --identity-file/-I flag for selecting the SSH identity to use
  • fj tag to manage git tags
  • fj issue search --state all
  • --remote & --repo flags can now be at the end of the command with the rest of the flags

• update to 0.3.0:

  • Additions
    • Added fj completion to generate completion scripts for various shells
    • Added fj org for Organization commands.
    • Added fj actions for Forgejo Actions-related commands (thank you, @LordMZTE !)
    • OAuth client IDs for fj auth login can now be customized. See the wiki for more on the new features. https://codeberg.org/Cyborus/forgejo-cli/wiki/Organizations
  • Fixes
    • Keys file now has proper file permissions
    • Fixed incorrect help commands (thank you, @0ko !)
    • Always set user agent in requests

• update to 0.2.0:

  • Additions
    • pr create and issue create now have a --web flag that opens the creation page in your browser instead of creating it on the terminal.
    • pr --agit will create a pull request with agit flow, so you don't need to fork the repository.
    • pr status --wait will only exits once all PR checks finish.
    • repo migrate to migrate/mirror repositories from other hosts.
    • repo readme to print a repository's readme to the terminal.
    • version --verbose prints extra info useful for debugging
  • Fixes
    • Public endpoints can now be accessed without authenticating
    • The API will be accessed via the http url even when it differs from the ssh url and the local remote points to the ssh url.
    • browse commands will no long hang the terminal
    • Local repos will now be found even when in a subdirectory
    • SSH urls in repo remotes will now be parsed correctly
    • Improved pull request detection