Banked: 2026-07-15, cycle324 (port-lag of CVE-2025-68937 to Gogs = WALK).
Web-check for the port-lag lead surfaced that Gogs is a disclosure minefield: - CVE-2025-8110 (symlink RCE via PutContents API, a bypass of CVE-2024-55947; 700+ compromised instances; fixed v0.13.4 Jan-2026). - CVE-2024-54148 (RCE via file editing), CVE-2026-26196 (info disclosure), CVE-2026-25242 (unauth file upload). - Rapid7 "authenticated RCE via argument injection - NOT FIXED"; theregister "no fix yet for critical RCE" (May-2026). - Slow-maintained (solo creator, no corp security team), swarmed by Wiz/Rapid7/ProjectDiscovery/CISA, actively exploited. Per the saturated-surface + poorly-maintained doctrine: Gogs is being actively mined by the whole industry AND leaves bugs unfixed = every finding is either a $0 dup or a wontfix. DO NOT hunt Gogs.
My port-lag hypothesis (Gogs has Gitea's CVE-2025-68937 template-symlink RCE unfixed) DID NOT hold: Gitea forked FROM Gogs years ago, and the two diverged - Gogs has its OWN symlink bugs (PutContents CVE-2025-8110), NOT the Gitea repo-TEMPLATE-generate one. So shared LINEAGE != shared VULNERABLE CODE. Before running a port-lag set-diff on a fork, confirm the fork actually contains the specific vulnerable feature/code path (the "verify-surface-exists-at-HEAD" discipline). Ancestor forks (Gogs<-Gitea) diverge most; sibling hard-forks that BATCH ports (Forgejo<-Gitea) share the most = highest port-lag EV. Ancestor/divergent forks = low port-lag EV.
HIGH: Forgejo<-Gitea (batches ports, shares code, active) = 12 gaps this session. LOW: OpenBao<-Vault (fast porter, cycle315), Gogs<-Gitea (divergent + saturated + unmaintained, cycle324). The best port-lag fork = shares code + lags ports + is maintained-enough-to-have-a-security-process-but-not-fast.