v1.4.4

fogwall 1.4.4

A security patch for the SCM API's require-validated-head check. No default developer push workflow changes; operators running the SCM API proxy with pull/merge request head validation enabled should read the breaking-changes note below.

Breaking changes & upgrade notes

• require-validated-head now requires an approved or forwarded push record, not just any record — previously, a commit fogwall blocked and that was then pushed straight to the fork still satisfied head validation, because any push record for that SHA counted regardless of status. Only APPROVED or FORWARDED records count now. A PR whose head was only ever a blocked push will newly be refused — this is the intended fix, not a regression (#727). See docs/configuration/scm-api.md.

Security

• Fixed a require-validated-head bypass — a commit fogwall blocked, then pushed directly to the fork (bypassing the proxy), still validated its pull/merge request because fogwall only checked for the existence of a push record, not its outcome (#727).

Bug fixes

• Fixed pull/merge requests from differently-named forks being refused — require-validated-head looked up the head commit in <head-owner>/<upstream-name>, so a fork renamed from its upstream always failed validation. GitHub requests now resolve the head via GitHub's own compare; Gitea/Forgejo resolve it via the fork relationship, cached for 6 hours (#727).

Upgrade

1. Pull the new images — no config or database changes required.
2. If pull/merge requests are unexpectedly refused after upgrading, confirm the head commit's push record is APPROVED or FORWARDED rather than BLOCKED or another status — this is the corrected behavior, not a bug.

Full Changelog: v1.4.3...v1.4.4