Gist: A critical vulnerability in Gogs enables silent file overwrite and supply-chain compromise through shared LFS storage and missing hash verification. A patch is available, and users should restrict uploads and add integrity checks until upgrading.
Signal reason: It announces a new patched version addressing the vulnerability.
