

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7752) ([backported](https://codeberg.org/forgejo/forgejo/pulls/7754)): <!--number 7754 --><!--line 0 --><!--description Zml4KHNlYyk6IG9ubHkgZGVncmFkZSBwZXJtaXNzaW9uIGNoZWNrIGZvciBnaXQgcHVzaA==-->If [LFS](https://git-lfs.com/) is enabled on a Forgejo instance with `[server].LFS_START_SERVER = true` (this is not the default), it was possible for a registered user to upload LFS files to a repository to which they only had read access. It was not possible for an anonymous user to do the same, even if they had read access to a public repository. The permissions are now correctly enforced and uploading LFS files is only allowed for registered users with write permission to the associated repository. Files that were uploaded to LFS in this way will not be obtained when someone does a `git clone` or `git fetch` on the associated repository. It was also not possible to exploit the incorrect permission check to delete or override an existing LFS file. These are orphaned LFS files that can be removed from the `/settings/lfs` panel of the associated repository.<!--description-->
- Security features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7693) ([backported](https://codeberg.org/forgejo/forgejo/pulls/7757)): <!--number 7757 --><!--line 0 --><!--description Zml4KHNlYyk6IGNvbnNpZGVyIHdlYmF1dGhuIGZvciBleHRlcm5hbCBsb2dpbg==-->A user account with 2fa (two factor authentication) enrolled with a security key was not enforced when using an external account (e.g. Codeberg or GitHub). The security key is now required even when login in from an external account or linking a new external account to an existing local account, just as it is required when login in with a user and password. This problem did not exist with 2fa enrolled with [TOTP](https://en.wikipedia.org/wiki/Time-based_one-time_password).<!--description-->
- Included for completeness but not worth a release note
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7730): <!--number 7730 --><!--line 0 --><!--description Y2hvcmU6IHJlcGxhY2UgYGdpdGh1Yi5jb20vZ28tdGVzdGZpeHR1cmVzL3Rlc3RmaXh0dXJlc2A=-->chore: replace `github.com/go-testfixtures/testfixtures`<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7720) ([backported](https://codeberg.org/forgejo/forgejo/pulls/7724)): <!--number 7724 --><!--line 0 --><!--description Y2hvcmUocmVsZWFzZSk6IG5leHQtZGlnZXN0IG1vdmVkIHRvIGludmlzaWJsZS5mb3JnZWpvLm9yZw==-->chore(release): next-digest moved to invisible.forgejo.org<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/6458) ([backported](https://codeberg.org/forgejo/forgejo/pulls/7710)): <!--number 7710 --><!--line 0 --><!--description Zml4OiBkbyBub3Qgc2V0IEdPUFJPWFk9ZGlyZWN0IGluIERvY2tlcmZpbGUq-->fix: do not set GOPROXY=direct in Dockerfile*<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7676): <!--number 7676 --><!--line 0 --><!--description Y2hvcmU6IHJlbHkgb24gcmVub3ZhdGUgZm9yIHNlY3VyaXR5IGNoZWNrcw==-->chore: rely on renovate for security checks<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7368): <!--number 7368 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjM4LjAgKHY3LjAvZm9yZ2Vqbyk=-->Update module golang.org/x/net to v0.38.0 (v7.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7300): <!--number 7300 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvb2F1dGgyIHRvIHYwLjI3LjAgW1NFQ1VSSVRZXSAodjcuMC9mb3JnZWpvKQ==-->Update module golang.org/x/oauth2 to v0.27.0 [SECURITY] (v7.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7299): <!--number 7299 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvbmV0IHRvIHYwLjM2LjAgW1NFQ1VSSVRZXSAodjcuMC9mb3JnZWpvKQ==-->Update module golang.org/x/net to v0.36.0 [SECURITY] (v7.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7297): <!--number 7297 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvbGFuZy1qd3Qvand0L3Y1IHRvIHY1LjIuMiBbU0VDVVJJVFldICh2Ny4wL2Zvcmdlam8p-->Update module github.com/golang-jwt/jwt/v5 to v5.2.2 [SECURITY] (v7.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/7283): <!--number 7283 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3JlZGlzL2dvLXJlZGlzL3Y5IHRvIHY5LjcuMyAodjcuMC9mb3JnZWpvKQ==-->Update module github.com/redis/go-redis/v9 to v9.7.3 (v7.0/forgejo)<!--description-->
<!--end release-notes-assistant-->
