forgejo/release-notes
Shivaram Lingamneni 878c236f49 cherry-pick OIDC changes from gitea (#4724)
These are the three conflicted changes from #4716:

* https://github.com/go-gitea/gitea/pull/31632
* https://github.com/go-gitea/gitea/pull/31688
* https://github.com/go-gitea/gitea/pull/31706

cc @earl-warren; as per discussion on https://github.com/go-gitea/gitea/pull/31632 this involves a small compatibility break (OIDC introspection requests now require a valid client ID and secret, instead of a valid OIDC token)

## Checklist

The [developer guide](https://forgejo.org/docs/next/developer/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [ ] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] I do not want this change to show in the release notes.
- [ ] I want the title to show in the release notes with a link to this pull request.
- [ ] I want the content of the `release-notes/<pull request number>.md` to be be used for the release notes instead of the title.

<!--start release-notes-assistant-->

## Draft release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Breaking features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/4724): <!--number 4724 --><!--line 0 --><!--description T0lEQyBpbnRlZ3JhdGlvbnMgdGhhdCBQT1NUIHRvIGAvbG9naW4vb2F1dGgvaW50cm9zcGVjdGAgd2l0aG91dCBzZW5kaW5nIEhUVFAgYmFzaWMgYXV0aGVudGljYXRpb24gd2lsbCBub3cgZmFpbCB3aXRoIGEgNDAxIEhUVFAgVW5hdXRob3JpemVkIGVycm9yLiBUbyBmaXggdGhlIGVycm9yLCB0aGUgY2xpZW50IG11c3QgYmVnaW4gc2VuZGluZyBIVFRQIGJhc2ljIGF1dGhlbnRpY2F0aW9uIHdpdGggYSB2YWxpZCBjbGllbnQgSUQgYW5kIHNlY3JldC4gVGhpcyBlbmRwb2ludCB3YXMgcHJldmlvdXNseSBhdXRoZW50aWNhdGVkIHZpYSB0aGUgaW50cm9zcGVjdGlvbiB0b2tlbiBpdHNlbGYsIHdoaWNoIGlzIGxlc3Mgc2VjdXJlLg==-->OIDC integrations that POST to `/login/oauth/introspect` without sending HTTP basic authentication will now fail with a 401 HTTP Unauthorized error. To fix the error, the client must begin sending HTTP basic authentication with a valid client ID and secret. This endpoint was previously authenticated via the introspection token itself, which is less secure.<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/4724
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Shivaram Lingamneni <slingamn@cs.stanford.edu>
Co-committed-by: Shivaram Lingamneni <slingamn@cs.stanford.edu>
2024-08-08 06:32:14 +00:00
..
3139.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3285.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3307.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3334.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3337.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3363.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
3383.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3414.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3430.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3434.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3442.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3642.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3654.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3723.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3724.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3729.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
3752.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
3791.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3808.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3811.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3830.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3836.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3838.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3847.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
3870.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3886.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3917.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
3922.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3934.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3985.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3989.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
4026.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4027.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4072.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
4083.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
4095.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4134.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4136.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4139.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
4143.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4145.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
4160.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4189.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4201.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4212.md feat(quota): Add a terse release not about quotas 2024-08-02 11:10:34 +02:00
4218.md docs(release-notes): fix artifact range requests 2024-07-10 08:52:06 +02:00
4222.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4240.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4253.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4262.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4266.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4291.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4367.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4375.md docs(release-notes): for pull requests #4400, #4375 [skip ci] (#4442) 2024-07-10 05:14:16 +00:00
4400.md docs(release-notes): for pull requests #4400, #4375 [skip ci] (#4442) 2024-07-10 05:14:16 +00:00
4427.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4429.md docs(release-notes): display URLs in .sh-session files 2024-07-09 08:24:46 +02:00
4439.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4506.md [CHORE] Use github.com/ProtonMail/go-crypto 2024-07-15 17:27:37 +02:00
4547.md [UI] Convert milestone to HTMX 2024-07-17 14:52:00 +02:00
4595.md added release notes for pr 4595 2024-07-23 18:47:42 +02:00
4605.md feat: allow .webp attachments by default 2024-07-21 13:01:08 +05:00
4607.md Add a release note for cherry-picked features 2024-07-22 15:46:01 +02:00
4635.md [SECURITY] Notify users about account security changes 2024-07-23 18:31:47 +02:00
4716.md chore(release-notes): weekly cherry-pick week 2024-31 2024-07-28 09:00:29 +02:00
4724.md cherry-pick OIDC changes from gitea (#4724) 2024-08-08 06:32:14 +00:00
4801.md chore(release-notes): weekly cherry-pick week 2024-32 2024-08-04 18:24:10 +02:00