Following these steps it was found that a group repository could have all its members removed:
- Create a group repository with some member repositories.
- PUT an update request for the group repository that contains a member that doesn't exist. To reproduce, the update request must have the ordering of the non-existant member before other existing members. The existing members that are after are the ones that will be removed.
- Modify and save any other repository (doesn't have to be in the group).
- Your group repository will now have lost the members following the non-existant one.
This seems boundless so could be 1 or thousands of repositories affected.