Issues

• NuGet: a package whose end record names another disk for its central directory, or gives two different entry counts, is stored and listed though NuGet refuses it

  bug
  forgepkg/forge#818 · Filter by author schmitch opened on Nov 2, 2026 · Backlog

• Docker imports: a tag pushed to Forge while an import copies it is moved to the source's manifest, even with on_conflict skip

  bug
  forgepkg/forge#817 · Filter by author schmitch opened on Nov 2, 2026 · Backlog

• Retention screen: a protected tag glob with braces ({latest,stable}) is split at its comma, so the policy cannot be saved from the screen

  bug
  forgepkg/forge#816 · Filter by author schmitch opened on Nov 2, 2026 · Backlog

• apt uploads: a 40 KB .deb makes the control parser hold about 0.5 GiB, so a few concurrent uploads OOM-kill the instance

  bug
  forgepkg/forge#815 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• apt: one package with a malformed Depends (or another relationship field) is published as is, and apt-get update then fails on every client of the repository

  bug
  forgepkg/forge#814 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• Imports: a NuGet feed import never checks that a downloaded .nupkg is the id and version it fetched, so a feed can plant other packages and, with overwrite, replace them

  bug
  forgepkg/forge#813 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• Reader role: an administrator made on 2.2 through the user page or POST /admin/users holds admin alone, so an IdP or upstream demotion leaves them Roles only

  bug
  forgepkg/forge#812 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• apt: Forge reads the first control of a control.tar, while dpkg installs from the last one it extracts

  bug
  forgepkg/forge#807 · Filter by author schmitch opened on Nov 2, 2026 · Backlog

• apt proxies: after a remote_url change, the previous upstream's cached indexes and pool files are still served

  bug
  forgepkg/forge#806 · Filter by author schmitch opened on Nov 2, 2026 · Backlog

• Workload identity: an issuer-wide rule is accepted for multi-tenant issuers other than GitHub Actions and GitLab.com (Buildkite, Google, Terraform Cloud)

  enhancement
  forgepkg/forge#805 · Filter by author schmitch opened on Nov 2, 2026 · Backlog

• Device login docs: the scope example names the npm-all group, and a token scoped to a group reads nothing through it

  documentation
  forgepkg/forge#804 · Filter by author schmitch opened on Nov 2, 2026 · Backlog

• Device login: ten wrong codes from one network lock every user of that network out of /device, and a linked code counts without a click

  bug
  forgepkg/forge#803 · Filter by author schmitch opened on Nov 2, 2026 · Backlog

• Retention screen: a cron-scheduled policy whose min_run_interval_seconds is 0 cannot be saved, and the error is on a field the screen hides

  bug
  forgepkg/forge#802 · Filter by author schmitch opened on Nov 2, 2026 · Backlog

• Docker imports: every run, a dry run included, GETs every tag's manifest, and the path that decides an unchanged tag without fetching is never taken

  enhancement
  forgepkg/forge#801 · Filter by author schmitch opened on Nov 2, 2026 · Backlog

• Import docs: the password is said to go to the origins the source's documents name, but the code sends it to the source's origin only

  documentation
  forgepkg/forge#800 · Filter by author schmitch opened on Nov 2, 2026 · Backlog

• apt proxies: a pool path whose package cannot be named bypasses the reader's package selector

  bug
  forgepkg/forge#799 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• apt proxies: with an upstream that has no by-hash, InRelease and Packages from two generations are served together, and apt-get update fails with "Hash Sum mismatch"

  bug
  forgepkg/forge#798 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• apt: a writer's packages with 1 MiB control files make an index generation hold gigabytes, which OOM-kills the instance on every index request

  bug
  forgepkg/forge#797 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• Groups: a member scope makes every group search ask that proxy's upstream for 1,000 hits instead of a window

  bug
  forgepkg/forge#796 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• Client passwords: a local realm that accepts none counts each refused client password as a failed sign-in, so a user's old client locks them out of the browser login

  bug
  forgepkg/forge#795 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• Device login: concurrent polls of an approved code hold every database connection, and the instance stops answering

  bug
  forgepkg/forge#794 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• Docker groups: a member whose upstream breaks off or sends a wrong layer now fails the pull, and the group no longer falls back to the next member

  bug
  forgepkg/forge#791 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• Imports: a source URL with credentials in it is accepted, and the password is stored, returned and logged in plaintext (a proxy's remote_url refuses it)

  bug
  forgepkg/forge#790 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• Traffic: when the settings cannot be read, the worker falls back to the defaults, records client addresses that were turned off and prunes with 90-day retention

  bug
  forgepkg/forge#789 · Filter by author schmitch opened on Nov 2, 2026 · 2.3.0

• Flaky test: upstream_password_is_bound_to_the_remote_origin loses its repository to the encryption tests that empty the table

  bug
  forgepkg/forge#779 · Filter by author schmitch opened on Nov 2, 2026 · Backlog