So not "Gitea is protected against both of these issues" but "Gitea fixed these issues earlier", which kind of feels like a less marketing-friendly version of what the Gitea employee said above.

Why people can't just talk clearly and not try to oversell whatever they're doing? It's a disease at this point.

i like how this is a side effect of a bunch of assorted changes in a commit and PR solely described as "Fix path resolving" making it hard for anyone running Gitea to even know this is a security fix

It is unfortunate nobody tipped anyone off downstream.