mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-05 00:09:33 +09:00
4d00ed2a1e2f4d32b66a71c3eecabc6d6703f6c0
251
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 silverwind
|
ce0da8a378 |
build: cross-compile in docker (#40136)
Building the backend under QEMU takes 46 to 54 minutes per foreign platform in the nightly image build, against 7 minutes natively. The backend stage now runs on the build platform and cross-compiles with `GOOS`/`GOARCH`/`GOARM`, so every platform builds at native speed. - `go generate` runs once instead of once per platform. - The PR docker dry run builds all three platforms in a single job, on any docker-related change. --------- Signed-off-by: silverwind <me@silverwind.io> |
||
 Giteabotandsilverwind
|
12b20c7c99 |
chore(deps): update dependencies (#40168)
> [!NOTE] > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | [@primer/octicons](https://primer.style/octicons) ([source](https://redirect.github.com/primer/octicons)) | [`19.41.0` → `19.42.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.41.0/19.42.0) |  |  | dependencies | minor | | | [@typescript-eslint/parser](https://typescript-eslint.io/packages/parser) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser)) | [`8.72.0` → `8.72.1`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.72.0/8.72.1) |  |  | devDependencies | patch | | | @​vitest/eslint-plugin | [`1.6.27` → `1.6.28`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.27/1.6.28) |  |  | devDependencies | patch | | | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | `v10.3.0` → `v10.3.2` |  |  | action | patch | `v10.3.3` | | [chart.js](https://www.chartjs.org) ([source](https://redirect.github.com/chartjs/Chart.js)) | [`4.5.1` → `4.6.1`](https://renovatebot.com/diffs/npm/chart.js/4.5.1/4.6.1) |  |  | dependencies | minor | | | [cli/cli](https://redirect.github.com/cli/cli) | `2.103.2` → `2.103.3` |  |  | | patch | | | [connectrpc.com/connect/v2](https://redirect.github.com/connectrpc/connect-go) | `v2.0.1` → `v2.0.2` |  |  | require | patch | | | [crowdin/github-action](https://redirect.github.com/crowdin/github-action) | `v3.4.0` → `v3.5.0` |  |  | action | minor | | | [djlint](https://redirect.github.com/djlint/djLint) | `==1.46.6` → `==1.47.1` |  |  | dependency-groups | minor | `1.49.2` (+4) | | [docker/login-action](https://redirect.github.com/docker/login-action) | `v4.6.0` → `v4.7.0` |  |  | action | minor | | | [elasticsearch](https://hub.docker.com/_/elasticsearch) ([source](https://redirect.github.com/elastic/dockerfiles)) | `3f4d63c` → `ef5cafd` | | | service | digest | | | [eslint-plugin-unicorn](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn) | [`78.0.0` → `79.0.0`](https://renovatebot.com/diffs/npm/eslint-plugin-unicorn/78.0.0/79.0.0) |  |  | devDependencies | major | | | [eslint-plugin-vue](https://eslint.vuejs.org) ([source](https://redirect.github.com/vuejs/eslint-plugin-vue)) | [`10.11.1` → `10.12.0`](https://renovatebot.com/diffs/npm/eslint-plugin-vue/10.11.1/10.12.0) |  |  | devDependencies | minor | | | [getmeili/meilisearch](https://redirect.github.com/meilisearch/meilisearch) | `c94e58c` → `1f578fa` | | | service | digest | | | [gitea.dev/sdk](https://gitea.com/gitea/go-sdk) | `v1.3.0` → `v1.5.0` |  |  | require | minor | `v1.5.1` | | [github.com/buildkite/terminal-to-html/v3](https://redirect.github.com/buildkite/terminal-to-html) | `v3.17.1` → `v3.17.3` |  |  | require | patch | | | [github.com/dlclark/regexp2/v2](https://redirect.github.com/dlclark/regexp2) | `v2.9.1` → `v2.11.0` |  |  | require | minor | `v2.12.0` | | [github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi) | `v0.151.0` → `v0.152.0` |  |  | require | minor | | | [github.com/go-co-op/gocron/v2](https://redirect.github.com/go-co-op/gocron) | `v2.22.0` → `v2.23.0` |  |  | require | minor | | | [github.com/go-redsync/redsync/v4](https://redirect.github.com/go-redsync/redsync) | `v4.18.0` → `v4.18.1` |  |  | require | patch | | | [github.com/google/pprof](https://redirect.github.com/google/pprof) | `1facf8f` → `dbd0ed3` |  |  | require | digest | | | [gitlab.com/gitlab-org/api/client-go/v3](https://gitlab.com/gitlab-org/api/client-go) | `v3.29.0` → `v3.39.1` |  |  | require | minor | `v3.40.2` (+3) | | [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) | `v1.84.0` → `v1.85.0` |  |  | require | minor | | | [katex](https://katex.org) ([source](https://redirect.github.com/KaTeX/KaTeX)) | [`0.19.0` → `0.19.1`](https://renovatebot.com/diffs/npm/katex/0.19.0/0.19.1) |  |  | dependencies | patch | | | [markdownlint-cli](https://redirect.github.com/igorshubovych/markdownlint-cli) | [`0.49.1` → `0.50.0`](https://renovatebot.com/diffs/npm/markdownlint-cli/0.49.1/0.50.0) |  |  | devDependencies | minor | | | [material-icon-theme](https://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/main/README.md) ([source](https://redirect.github.com/material-extensions/vscode-material-icon-theme)) | [`5.39.0` → `5.40.0`](https://renovatebot.com/diffs/npm/material-icon-theme/5.39.0/5.40.0) |  |  | devDependencies | minor | | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `v1.60.1` → `v1.61.0` |  |  | require | minor | `v1.61.1` | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`12.14.0` → `12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |  |  | packageManager | minor | | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`>= 12.14.0` → `>= 12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |  |  | engines | minor | | | [postcss](https://postcss.org/) ([source](https://redirect.github.com/postcss/postcss)) | [`8.5.31` → `8.5.32`](https://renovatebot.com/diffs/npm/postcss/8.5.31/8.5.32) |  |  | dependencies | patch | | | [renovate](https://renovatebot.com) ([source](https://redirect.github.com/renovatebot/renovate)) | [`44.172.2` → `44.190.1`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.172.2&to=44.190.1) |  |  | | minor | `44.200.0` (+21) | | [renovatebot/github-action](https://redirect.github.com/renovatebot/github-action) | `v46.3.9` → `v46.3.10` |  |  | action | patch | `v46.3.12` (+1) | | [typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)) | [`8.72.0` → `8.72.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.72.0/8.72.1) |  |  | devDependencies | patch | | | [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.3.4` → `8.3.5`](https://renovatebot.com/diffs/npm/vite/8.3.4/8.3.5) |  |  | dependencies | patch | | --- ### Release Notes <details> <summary>primer/octicons (@​primer/octicons)</summary> ### [`v19.42.0`](https://redirect.github.com/primer/octicons/releases/tag/%40primer/octicons%4019.42.0) [Compare Source](https://redirect.github.com/primer/octicons/compare/@primer/octicons@19.41.0...@primer/octicons@19.42.0) ##### Minor Changes - [#​1381](https://redirect.github.com/primer/octicons/pull/1381) [`d25ce68df9d08abd65431a8a48b45446432f1b45`](https://redirect.github.com/primer/octicons/commit/d25ce68df9d08abd65431a8a48b45446432f1b45) Thanks [@​edokoa](https://redirect.github.com/edokoa)! - Add the 16px `git-draft-agent`, `git-pull-request-agent`, `check-agent`, `git-que-merge-agent`, `git-closed-agent`, and `git-merge-agent` icons for agent-assisted draft, open, ready-to-merge, queued, closed, and merged pull request states. </details> <details> <summary>typescript-eslint/typescript-eslint (@​typescript-eslint/parser)</summary> ### [`v8.72.1`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8721-2026-10-26) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.72.0...v8.72.1) This was a version bump only for parser to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>astral-sh/setup-uv</summary> ### [`v10.3.2`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5 [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.1...v10.3.2) #### Changes #### 🧰 Maintenance - chore: update known checksums for 0.13.5 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1103](https://redirect.github.com/astral-sh/setup-uv/issues/1103)) #### 📚 Documentation - docs: update version references to v10.3.1 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1102](https://redirect.github.com/astral-sh/setup-uv/issues/1102)) ### [`v10.3.1`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.0...v10.3.1) #### Changes This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn `##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.` #### 🐛 Bug fixes - fix: preserve cache error class names in save-cache bundle [@​dannyward630](https://redirect.github.com/dannyward630) ([#​1093](https://redirect.github.com/astral-sh/setup-uv/issues/1093)) #### 🧰 Maintenance - chore: update known checksums for 0.13.4 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1099](https://redirect.github.com/astral-sh/setup-uv/issues/1099)) - chore: update known checksums for 0.13.2/0.13.3 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1098](https://redirect.github.com/astral-sh/setup-uv/issues/1098)) - chore: update known checksums for 0.13.1 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1094](https://redirect.github.com/astral-sh/setup-uv/issues/1094)) - Verify npm dependency signatures before builds [@​zaniebot](https://redirect.github.com/zaniebot) ([#​1027](https://redirect.github.com/astral-sh/setup-uv/issues/1027)) #### 📚 Documentation - docs: cache-dependency-glob matches relative to the working directory [@​flange-ipb](https://redirect.github.com/flange-ipb) ([#​1092](https://redirect.github.com/astral-sh/setup-uv/issues/1092)) - docs: update version references to v10.3.0 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1090](https://redirect.github.com/astral-sh/setup-uv/issues/1090)) #### ⬆️ Dependency updates - chore(deps): roll up Dependabot updates [@​eifinger](https://redirect.github.com/eifinger) ([#​1101](https://redirect.github.com/astral-sh/setup-uv/issues/1101)) </details> <details> <summary>chartjs/Chart.js (chart.js)</summary> ### [`v4.6.1`](https://redirect.github.com/chartjs/Chart.js/releases/tag/v4.6.1) [Compare Source](https://redirect.github.com/chartjs/Chart.js/compare/v4.5.1...v4.6.1) ### Essential Links - [npm](https://www.npmjs.com/package/chart.js) - [Migration guide](https://www.chartjs.org/docs/4.6.1/migration/v4-migration.html) - [Docs](https://www.chartjs.org/docs/4.6.1/) - [API](https://www.chartjs.org/docs/4.6.1/api/) - [Samples](https://www.chartjs.org/docs/4.6.1/samples/information.html) * [#​12355](https://redirect.github.com/chartjs/Chart.js/issues/12355) fix: trusted publishing fix + version 4.6.1 bump Thanks to [@​etimberg](https://redirect.github.com/etimberg) </details> <details> <summary>cli/cli</summary> ### [`v2.103.3`](https://redirect.github.com/cli/cli/releases/tag/v2.103.3): GitHub CLI 2.103.3 [Compare Source](https://redirect.github.com/cli/cli/compare/v2.103.2...v2.103.3) ##### What's Changed ##### 🐛 Fixes - fix(gh auth status): explain expired expiring tokens with `--no-refresh` by [@​babakks](https://redirect.github.com/babakks) in [#​14815](https://redirect.github.com/cli/cli/pull/14815) **Full Changelog**: <https://github.com/cli/cli/compare/v2.103.2...v2.103.3> </details> <details> <summary>connectrpc/connect-go (connectrpc.com/connect/v2)</summary> ### [`v2.0.2`](https://redirect.github.com/connectrpc/connect-go/releases/tag/v2.0.2) [Compare Source](https://redirect.github.com/connectrpc/connect-go/compare/v2.0.1...v2.0.2) #### What's Changed ##### Bugfixes - Fix data race reading ClientInfo after a cancelled call by [@​emcfarlane](https://redirect.github.com/emcfarlane) in [#​1036](https://redirect.github.com/connectrpc/connect-go/pull/1036) - List JSON charset variants in Accept-Post by [@​emcfarlane](https://redirect.github.com/emcfarlane) in [#​1037](https://redirect.github.com/connectrpc/connect-go/pull/1037) - Flush response headers in ServerStream.SendHeaders over HTTP by [@​raveesh-me](https://redirect.github.com/raveesh-me) in [#​1035](https://redirect.github.com/connectrpc/connect-go/pull/1035) - Stop reading oversized messages after rejecting them by [@​stefanvanburen](https://redirect.github.com/stefanvanburen) in [#​1039](https://redirect.github.com/connectrpc/connect-go/pull/1039) #### New Contributors - [@​raveesh-me](https://redirect.github.com/raveesh-me) made their first contribution in [#​1035](https://redirect.github.com/connectrpc/connect-go/pull/1035) **Full Changelog**: <https://github.com/connectrpc/connect-go/compare/v2.0.1...v2.0.2> </details> <details> <summary>crowdin/github-action</summary> ### [`v3.5.0`](https://redirect.github.com/crowdin/github-action/releases/tag/v3.5.0) [Compare Source](https://redirect.github.com/crowdin/github-action/compare/v3.4.0...v3.5.0) #### What's Changed - CLI [5.5.0](https://redirect.github.com/crowdin/crowdin-cli/releases/tag/5.5.0) by [@​andrii-bodnar](https://redirect.github.com/andrii-bodnar) **Full Changelog**: <https://github.com/crowdin/github-action/compare/v3.4.0...v3.5.0> </details> <details> <summary>djlint/djLint (djlint)</summary> ### [`v1.47.1`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1471---2026-10-26) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.47.0...v1.47.1) ##### Fix - `preserve-inline` in the `js` setting `brace_style` takes effect, so `{ bubbles: true }` stays on one line in a `<script>` or in an attribute formatted with `--format-attribute-js-json`. It used to be dropped before the code was formatted. - The json schema allows any option under `css` and `js`, so a strict validator such as Tombi no longer reports `indent_size` there. ### [`v1.47.0`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1470---2026-10-22) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.46.6...v1.47.0) ##### Feature - New option `--sort-load-tags` / `sort_load_tags` sorts the libraries in a `{% load %}` tag and drops the ones written twice, so `{% load static i18n %}` becomes `{% load i18n static %}`. In `{% load a b from library %}` the names before `from` are sorted. It is off by default: where two libraries define a tag or filter of the same name, the one loaded last wins, so sorting can change which one a template uses. - The formatter drops the spaces `H012` reports around an attribute's `=`, so `<div class = "a">` becomes `<div class="a">`. ##### Changed - `H010` reports the names the formatter lowercases, in any mix of case, so `Width="3"` is now reported. A framework binding such as `:itemID` or `@ID` and a longer name such as `data-ID` no longer are, since the formatter leaves their case alone. - `H018` is not reported under `--close-void-tags`, since the formatter then writes the `/>` ending the rule reports. `--ignore-case` already worked this way for `H009` and `H010`. ##### Fix - `H020` reports an empty pair whose end tag has whitespace before its `>`, such as `<div></div\n>`. - `H026` reports a `class` or `id` holding only whitespace, such as `class=" "`, and one written with spaces around the `=`. - `H033` reports an action padded at both ends once. It used to report it twice, unless an attribute before `action` happened to make the two reports look the same. - Markup written inside an attribute value, as in `<p title="<img src='a'>">`, is text, and `H005`, `H008`, `H010`, `H012`, `D018`, `J018`, `H024`, `H026`, `H029` and `H033` no longer report it. `H046` and `H051` read `tabindex` and `role` from the tag's own attributes, so `tabindex=1` written in a value or in the page text is not reported either. - `T001` and `T027` read a tag holding a dict, such as `{{ f({"a": {"b": 1}}) }}`, up to the `}}` that closes it rather than the first `}}` inside it. - `T032` steps over an escaped quote in a string, so the spaces in `{{ x|default:"a \"b c\"" }}` are not reported. - `H015` reports a heading followed by a tag on the same line anywhere in the file. It used to look only at the last line. - The rules that read a tag's attributes step over a template tag written in it, including a handlebars `{{{attrs}}}` and a dict as in `{{ {'class': 'x'}|xmlattr }}`, so `<img {{ attrs }} src='a'>` is reported by `H008`, which used to stop reading at the `{{`. - `T038` steps over a string in a block tag, so the `{%` in `{% with a="{%" %}` does not cut the tag short. ##### Performance - The rules that read a tag's attributes stop at a stray `<`, and `H015`, `H030`, `H036`, `T001`, `T027`, `T038` and `T039` no longer read the rest of the document again for each tag. A file holding thousands of unclosed tags or headings on one line is linted in a fraction of a second, where it used to take minutes. </details> <details> <summary>docker/login-action</summary> ### [`v4.7.0`](https://redirect.github.com/docker/login-action/releases/tag/v4.7.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.6.0...v4.7.0) - Preserve explicit ECR settings in `registry-auth` by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1089](https://redirect.github.com/docker/login-action/pull/1089) - Use registry hosts for scoped credentials by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1088](https://redirect.github.com/docker/login-action/pull/1088) - Raise Docker Hub OIDC max expiry to 6 hours by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1068](https://redirect.github.com/docker/login-action/pull/1068) - Log Docker Hub OIDC token exchange progress by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1061](https://redirect.github.com/docker/login-action/pull/1061) - Bump [@​aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://redirect.github.com/aws-sdk/client-ecr-public) to 3.1154.0 in [#​1093](https://redirect.github.com/docker/login-action/pull/1093) - Bump [@​docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit) from 0.94.0 to 0.107.0 in [#​1100](https://redirect.github.com/docker/login-action/pull/1100) - Bump [@​humanfs/node](https://redirect.github.com/humanfs/node) from 0.16.7 to 0.16.8 in [#​1077](https://redirect.github.com/docker/login-action/pull/1077) - Bump csv-parse from 7.0.1 to 7.0.3 in [#​1078](https://redirect.github.com/docker/login-action/pull/1078) - Bump handlebars from 4.7.9 to 4.7.10 in [#​1091](https://redirect.github.com/docker/login-action/pull/1091) - Bump js-yaml from 5.2.2 to 5.5.0 in [#​1066](https://redirect.github.com/docker/login-action/pull/1066) - Bump postcss from 8.5.22 to 8.5.26 in [#​1071](https://redirect.github.com/docker/login-action/pull/1071) - Bump postcss-selector-parser from 7.1.1 to 7.1.6 in [#​1092](https://redirect.github.com/docker/login-action/pull/1092) - Bump source-map-js from 1.2.1 to 1.2.2 in [#​1090](https://redirect.github.com/docker/login-action/pull/1090) - Bump undici from 6.27.0 to 6.29.1 in [#​1085](https://redirect.github.com/docker/login-action/pull/1085) - Bump uuid from 14.0.1 to 14.0.3 in [#​1096](https://redirect.github.com/docker/login-action/pull/1096) **Full Changelog**: <https://github.com/docker/login-action/compare/v4.6.0...v4.7.0> </details> <details> <summary>sindresorhus/eslint-plugin-unicorn (eslint-plugin-unicorn)</summary> ### [`v79.0.0`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/releases/tag/v79.0.0) [Compare Source](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/compare/v78.0.0...v79.0.0) #### Breaking - `no-top-level-side-effects`: Focus on mutations of globals, and remove it from the `unopinionated` preset ([#​3915](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3915)) [`24abac4`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/24abac48) - Unknown calls are no longer reported by default. Enable the new [`checkUnknownCalls`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/blob/main/docs/rules/no-top-level-side-effects.md#checkunknowncalls) option for stricter checking. - Mutations of globals, like `document.title = 'x'` and `Object.assign(globalThis, …)`, are now reported, also in declarations and default exports. You may see new reports. #### Improvements - Infer types from JSDoc `@type`, `@param`, and `@returns` annotations in rules that use type information ([#​3941](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3941)) [`2b4bfab`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/2b4bfab0) - Handle template literals without expressions like strings in more rules ([#​3943](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3943)) [`8bd8c06`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/8bd8c063) - Autofix more code that contains comments, while keeping the comments ([#​3939](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3939)) [`87baf82`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/87baf82f) - Fix autofixes in many rules that could produce broken code or wrong parentheses ([#​3917](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3917)) [`fed7eac`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/fed7eac2) - Make autofixes safer in many rules - Fixes that can change behavior in rare cases are now suggestions, for example in `prefer-spread`, `prefer-math-min-max`, `prefer-modern-dom-apis`, and `prefer-switch`. - Improve performance [`175efaf`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/175efaf1) [`3dd8fd2`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3dd8fd28) - `comment-content`: Add [`ignore`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/blob/main/docs/rules/comment-content.md#ignore) option ([#​3950](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3950)) [`3fe046e`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3fe046e6) - `consistent-function-scoping`: Ignore functions in Vitest hoisted factories ([#​3905](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3905)) [`98912a9`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/98912a91) - `custom-error-definition`: Ignore abstract TypeScript classes ([#​3934](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3934)) [`ee3501f`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/ee3501fb) - `no-non-function-verb-prefix`: Ignore shorthand destructuring ([#​3926](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3926)) [`76e5760`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/76e5760b) - `no-top-level-side-effects`: Recognize more config helpers ([#​3916](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3916)) [`d459c51`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/d459c511) - `no-useless-coercion`: Preserve boolean return types in TypeScript ([#​3904](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3904)) [`bef1571`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/bef15714) - `prefer-array-some`: Check `.find()` results used as booleans ([#​3913](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3913)) [`c957bf3`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/c957bf3d) - `prefer-default-parameters`: Skip unsafe logical OR fallbacks ([#​3951](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3951)) [`bcec97a`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/bcec97a4) - `prefer-includes`: Skip incompatible TypeScript search values ([#​3927](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3927)) [`d66441a`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/d66441aa) - `prefer-includes-over-repeated-comparisons`: Report negated and typed loose comparisons ([#​3935](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3935)) [`6e21cb1`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/6e21cb1b) - `prefer-includes-over-repeated-comparisons`: Preserve TypeScript union narrowing ([#​3910](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3910)) [`b5c479d`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/b5c479d8) - `prefer-literal-ascii`: Preserve escaped trailing spaces in templates ([#​3911](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3911)) [`360094b`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/360094bb) - `prefer-minimal-ternary`: Skip minimizations that break types ([#​3892](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3892)) [`f022d6d`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/f022d6d1) - `prefer-modern-math-apis`: Use suggestions for changes that can affect numeric results ([#​3914](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3914)) [`8af7c17`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/8af7c172) - `prefer-simple-condition-first`: Improve `typeof` comparisons and guards ([#​3948](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3948)) [`ee3edf0`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/ee3edf06) - `prefer-simplified-conditions`: Handle equivalent logical expressions ([#​3938](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3938)) [`a0b2788`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/a0b2788b) - `prefer-simplified-conditions`: Factor common terms in longer chains and static templates ([#​3942](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3942)) [`0d8c8bc`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/0d8c8bcb) - `prefer-smaller-scope`: Check TypeScript type aliases ([#​3928](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3928)) [`290d922`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/290d922c) - `prefer-string-raw`: Preserve TypeScript literal types in autofixes ([#​3912](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3912)) [`0611546`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/06115464) - `prefer-ternary`: Preserve consecutive early-return guards ([#​3945](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3945)) [`3fa840f`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3fa840fe) - `require-post-message-target-origin`: Skip incompatible typed methods ([#​3925](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3925)) [`387194b`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/387194bd) - `throw-new-error`: Ignore calls that return functions ([#​3894](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3894)) [`5e35def`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/5e35def7) *** </details> <details> <summary>vuejs/eslint-plugin-vue (eslint-plugin-vue)</summary> ### [`v10.12.0`](https://redirect.github.com/vuejs/eslint-plugin-vue/blob/HEAD/CHANGELOG.md#10120) [Compare Source](https://redirect.github.com/vuejs/eslint-plugin-vue/compare/v10.11.1...v10.12.0) ##### New rules - Added new [`vue/no-content-outside-block`](https://eslint.vuejs.org/rules/no-content-outside-block.html) rule ([#​3119](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3119)) - Added new [`vue/no-define-model-default`](https://eslint.vuejs.org/rules/no-define-model-default.html) rule ([#​3146](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3146)) - Added new [`vue/no-props-shadow`](https://eslint.vuejs.org/rules/no-props-shadow.html) rule ([#​3118](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3118)) ##### New rule options - Added `required` option to [`vue/block-lang`](https://eslint.vuejs.org/rules/block-lang.html) to report components that omit a required block entirely ([#​3125](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3125)) - Added `ignoreMixins` option to [`vue/require-explicit-emits`](https://eslint.vuejs.org/rules/require-explicit-emits.html) rule ([#​3141](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3141)) ##### Fixed false negatives (may result in more lint issues) - Added support for refs detected by type information, such as refs returned from composables, to [`vue/no-ref-as-operand`](https://eslint.vuejs.org/rules/no-ref-as-operand.html) rule ([#​3144](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3144)) - Fixed [`vue/no-dupe-keys`](https://eslint.vuejs.org/rules/no-dupe-keys.html) not reporting `defineModel()` names that collide with a prop, another model, or a `<script setup>` variable ([#​3163](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3163)) - Fixed [`vue/no-dupe-keys`](https://eslint.vuejs.org/rules/no-dupe-keys.html) not reporting `<script setup>` variables that shadow a prop while aliasing a different one, such as `const foo = toRef(props, 'bar')` ([#​3124](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3124)) - Fixed [`vue/no-multi-spaces`](https://eslint.vuejs.org/rules/no-multi-spaces.html) not reporting multiple spaces in the tags of some top-level blocks, e.g. `<script setup>` ([#​3162](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3162)) - Fixed [`vue/no-ref-as-operand`](https://eslint.vuejs.org/rules/no-ref-as-operand.html) and [`vue/no-ref-object-reactivity-loss`](https://eslint.vuejs.org/rules/no-ref-object-reactivity-loss.html) to also check refs created with `useTemplateRef()` ([#​3154](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3154)) - Fixed [`vue/no-unused-properties`](https://eslint.vuejs.org/rules/no-unused-properties.html) not reporting unused non-props properties in components that use `$props` as a whole (e.g. `v-bind="$props"`) ([#​3161](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3161)) - Fixed [`vue/padding-lines-in-component-definition`](https://eslint.vuejs.org/rules/padding-lines-in-component-definition.html) to check every pair of adjacent properties, not only the first, when `withinOption` or `withinEach` is not set ([#​3155](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3155)) - Fixed [`vue/require-default-prop`](https://eslint.vuejs.org/rules/require-default-prop.html), [`vue/no-boolean-default`](https://eslint.vuejs.org/rules/no-boolean-default.html), [`vue/no-required-prop-with-default`](https://eslint.vuejs.org/rules/no-required-prop-with-default.html) and [`vue/require-valid-default-prop`](https://eslint.vuejs.org/rules/require-valid-default-prop.html) not handling defaults that are passed to `withDefaults()` by reference or spread instead of an inline object literal ([#​3114](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3114)) ##### Fixed false positives (may result in fewer lint issues) - Changed [`vue/singleline-html-element-content-newline`](https://eslint.vuejs.org/rules/singleline-html-element-content-newline.html) and [`vue/multiline-html-element-content-newline`](https://eslint.vuejs.org/rules/multiline-html-element-content-newline.html) rules to ignore `router-link` and `nuxt-link` elements by default ([#​3165](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3165)) - Fixed [`vue/no-undef-properties`](https://eslint.vuejs.org/rules/no-undef-properties.html) false positives for properties returned via `...toRefs(reactive({ ... }))` from `setup()` ([#​3134](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3134)) - Fixed [`vue/require-typed-ref`](https://eslint.vuejs.org/rules/require-typed-ref.html) false positives when an explicit type annotation already applies to the `ref()` call ([#​3123](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3123)) - Fixed [`vue/v-if-else-key`](https://eslint.vuejs.org/rules/v-if-else-key.html) false positive for components with a bound `:key` ([#​3150](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3150)) ##### Other changes - Removed Reactivity Transform support from [`vue/no-ref-object-reactivity-loss`](https://eslint.vuejs.org/rules/no-ref-object-reactivity-loss.html), since the Reactivity Transform proposal was dropped from Vue ([#​3126](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3126)) - Changed [`vue/html-self-closing`](https://eslint.vuejs.org/rules/html-self-closing.html) to treat Vue's special `<slot>` and `<template>` elements as components (`html.component` option) instead of normal HTML elements ([#​3164](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3164)) - Changed [`vue/attributes-order`](https://eslint.vuejs.org/rules/attributes-order.html) rule to provide a suggestion instead of an autofix when the fix would move a binding across `v-bind="object"` ([#​3145](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3145)) - Improved performance of [`vue/no-reserved-component-names`](https://eslint.vuejs.org/rules/no-reserved-component-names.html) by no longer rebuilding its reserved name sets for every file ([#​3147](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3147)) </details> <details> <summary>gitea/go-sdk (gitea.dev/sdk)</summary> ### [`v1.5.0`](https://gitea.com/gitea/go-sdk/releases/tag/v1.5.0) [Compare Source](https://gitea.com/gitea/go-sdk/compare/v1.4.0...v1.5.0) #### What's Changed - feat: allow PAT-authenticated clients to manage access tokens in [#​840](https://gitea.com/gitea/go-sdk/pulls/840) - fix(pull): surface the server's error when a merge is refused in [#​870](https://gitea.com/gitea/go-sdk/pulls/870) - feat(hook): add name option to webhooks in [#​867](https://gitea.com/gitea/go-sdk/pulls/867) - feat: cover the API options gitea-cli still calls raw in [#​862](https://gitea.com/gitea/go-sdk/pulls/862) - ci: implement gitea's cache-seeder in [#​866](https://gitea.com/gitea/go-sdk/pulls/866) - Add bitbucketserver and forgejo migration service types in [#​868](https://gitea.com/gitea/go-sdk/pulls/868) - chore(deps): update dependencies in [#​869](https://gitea.com/gitea/go-sdk/pulls/869) - chore: remove the Client wrapper generator in [#​865](https://gitea.com/gitea/go-sdk/pulls/865) - feat: add force push and stale approval fields to branch protections in [#​864](https://gitea.com/gitea/go-sdk/pulls/864) #### Contributors - [@​sedlund](https://redirect.github.com/sedlund) - [@​Svtter](https://redirect.github.com/Svtter) - [@​SudhanshuSingh](https://redirect.github.com/SudhanshuSingh) - [@​bircni](https://redirect.github.com/bircni) - [@​silverwind](https://redirect.github.com/silverwind) - [@​lunny](https://redirect.github.com/lunny) - [@​renovate-bot](https://redirect.github.com/renovate-bot) #### New Contributors - [@​Svtter](https://redirect.github.com/Svtter) made their first contribution in [#​870](https://gitea.com/gitea/go-sdk/pulls/870) - [@​bircni](https://redirect.github.com/bircni) made their first contribution in [#​862](https://gitea.com/gitea/go-sdk/pulls/862) - [@​SudhanshuSingh](https://redirect.github.com/SudhanshuSingh) made their first contribution in [#​864](https://gitea.com/gitea/go-sdk/pulls/864) **Full Changelog**: [v1.4.0...v1.5.0](https://gitea.com/gitea/go-sdk/compare/v1.4.0...v1.5.0) ### [`v1.4.0`](https://gitea.com/gitea/go-sdk/releases/tag/v1.4.0) [Compare Source](https://gitea.com/gitea/go-sdk/compare/v1.3.0...v1.4.0) #### What's Changed - fix: retry server version lookup after failure in [#​829](https://gitea.com/gitea/go-sdk/pulls/829) - chore(deps): update dependencies, adapt to Gitea 28 in [#​863](https://gitea.com/gitea/go-sdk/pulls/863) - chore: update golangci-lint for Go 1.27.2, exclude dagger from Renovate in [#​861](https://gitea.com/gitea/go-sdk/pulls/861) **Note**: Gitea skipped 1.28, so the project and workflow run approve/cancel/logs APIs are now gated on Gitea 28.0.0. Clients pinning `SetGiteaVersion("1.28.0")` must switch to `"28.0.0"`. #### Contributors - [@​noeljackson](https://redirect.github.com/noeljackson) - [@​silverwind](https://redirect.github.com/silverwind) - [@​renovate-bot](https://redirect.github.com/renovate-bot) **Full Changelog**: [v1.3.0...v1.4.0](https://gitea.com/gitea/go-sdk/compare/v1.3.0...v1.4.0) Written by Claude. </details> <details> <summary>buildkite/terminal-to-html (github.com/buildkite/terminal-to-html/v3)</summary> ### [`v3.17.3`](https://redirect.github.com/buildkite/terminal-to-html/releases/tag/v3.17.3) [Compare Source](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.2...v3.17.3) #### [v3.17.3](https://redirect.github.com/buildkite/terminal-to-html/tree/v3.17.3) [Full Changelog](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.2...v3.17.3) This release provides the Linux, macOS, and Windows binaries missing from v3.17.2. Apart from the version number, application code is unchanged from v3.17.2. ##### Changed - Prepare versioned binaries for v3.17.3. [#​293](https://redirect.github.com/buildkite/terminal-to-html/pull/293) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) - Document the draft-first binary release process, including artifact verification and immutable release restrictions. [#​292](https://redirect.github.com/buildkite/terminal-to-html/pull/292) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) ##### Included from v3.17.2 - Remove `html/template` from the rendering path to avoid a runtime trap when rendering with TinyGo, while preserving the generated HTML. [#​282](https://redirect.github.com/buildkite/terminal-to-html/pull/282) ([@​dannymidnight](https://redirect.github.com/dannymidnight)) - Raise the minimum supported Go version to **1.26.10** and update the development/CI Go Docker image. [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) - Bump `golang.org/x/sys` to 0.47.0. [#​280](https://redirect.github.com/buildkite/terminal-to-html/pull/280) ([@​dependabot](https://redirect.github.com/dependabot)\[bot]) ### [`v3.17.2`](https://redirect.github.com/buildkite/terminal-to-html/releases/tag/v3.17.2) [Compare Source](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.1...v3.17.2) #### [v3.17.2](https://redirect.github.com/buildkite/terminal-to-html/tree/v3.17.2) [Full Changelog](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.1...v3.17.2) ##### Fixed - Remove `html/template` from the rendering path to avoid a runtime trap when rendering with TinyGo, while preserving the generated HTML. [#​282](https://redirect.github.com/buildkite/terminal-to-html/pull/282) ([@​dannymidnight](https://redirect.github.com/dannymidnight)) ##### Changed - Raise the minimum supported Go version from 1.25.0 to 1.26.10. [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) ##### Dependency updates - Update the development/CI Go Docker image from 1.26.4 to 1.26.10. [#​281](https://redirect.github.com/buildkite/terminal-to-html/pull/281), [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) - Bump `golang.org/x/sys` from 0.46.0 to 0.47.0. [#​280](https://redirect.github.com/buildkite/terminal-to-html/pull/280) ([@​dependabot](https://redirect.github.com/dependabot)\[bot]) </details> <details> <summary>dlclark/regexp2 (github.com/dlclark/regexp2/v2)</summary> ### [`v2.11.0`](https://redirect.github.com/dlclark/regexp2/compare/v2.10.1...v2.11.0) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.10.1...v2.11.0) ### [`v2.10.1`](https://redirect.github.com/dlclark/regexp2/compare/v2.10.0...v2.10.1) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.10.0...v2.10.1) ### [`v2.10.0`](https://redirect.github.com/dlclark/regexp2/compare/v2.9.1...v2.10.0) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.9.1...v2.10.0) </details> <details> <summary>getkin/kin-openapi (github.com/getkin/kin-openapi)</summary> ### [`v0.152.0`](https://redirect.github.com/getkin/kin-openapi/releases/tag/v0.152.0) [Compare Source](https://redirect.github.com/getkin/kin-openapi/compare/v0.151.0...v0.152.0) #### What's Changed - openapi2conv: push path-level body/formData parameters into operations by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1340](https://redirect.github.com/getkin/kin-openapi/pull/1340) - fix(openapi3): resolve transitive component refs in JSON Schema 2020-12 validation by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1342](https://redirect.github.com/getkin/kin-openapi/pull/1342) - openapi3: honor readOnly/writeOnly from allOf schemas in required checks by [@​ybai08](https://redirect.github.com/ybai08) in [#​1343](https://redirect.github.com/getkin/kin-openapi/pull/1343) - openapi3: resolve $refs of Components.Links by [@​fenollp](https://redirect.github.com/fenollp) in [#​1344](https://redirect.github.com/getkin/kin-openapi/pull/1344) - openapi3: marshal a schema's empty type list as absent rather than null by [@​fenollp](https://redirect.github.com/fenollp) in [#​1345](https://redirect.github.com/getkin/kin-openapi/pull/1345) - openapi3: drop the Header dump from its content/schema error by [@​fenollp](https://redirect.github.com/fenollp) in [#​1346](https://redirect.github.com/getkin/kin-openapi/pull/1346) - openapi3gen: always propagate field tag by [@​phooijenga](https://redirect.github.com/phooijenga) in [#​1347](https://redirect.github.com/getkin/kin-openapi/pull/1347) - routers/gorillamux: return an error instead of panicking when registering routes by [@​fenollp](https://redirect.github.com/fenollp) in [#​1348](https://redirect.github.com/getkin/kin-openapi/pull/1348) - openapi3: report $refs to null nodes as unresolved instead of panicking by [@​fenollp](https://redirect.github.com/fenollp) in [#​1349](https://redirect.github.com/getkin/kin-openapi/pull/1349) - openapi3: validate null servers, server variables, tags and components without panicking by [@​fenollp](https://redirect.github.com/fenollp) in [#​1351](https://redirect.github.com/getkin/kin-openapi/pull/1351) - openapi2conv: fix FromV3Parameter panics on binary schema refs and value-less schemas by [@​fenollp](https://redirect.github.com/fenollp) in [#​1352](https://redirect.github.com/getkin/kin-openapi/pull/1352) - openapi3filter: parse integer values as base 10 by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1353](https://redirect.github.com/getkin/kin-openapi/pull/1353) - openapi3filter: decode spaceDelimited and pipeDelimited query objects by [@​ybai08](https://redirect.github.com/ybai08) in [#​1350](https://redirect.github.com/getkin/kin-openapi/pull/1350) - Case-sensitive usmarshalling with json/v2 by [@​fenollp](https://redirect.github.com/fenollp) in [#​1355](https://redirect.github.com/getkin/kin-openapi/pull/1355) - openapi3filter: decode deepObject and non-exploded form object properties of urlencoded bodies by [@​ybai08](https://redirect.github.com/ybai08) in [#​1354](https://redirect.github.com/getkin/kin-openapi/pull/1354) - openapi3: keep $ref siblings on a schema reached through a cycle by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1357](https://redirect.github.com/getkin/kin-openapi/pull/1357) - tests: go around encoding/json/v2's randomness in error message by [@​fenollp](https://redirect.github.com/fenollp) in [#​1361](https://redirect.github.com/getkin/kin-openapi/pull/1361) - tests: remove actual network calls from tests by [@​fenollp](https://redirect.github.com/fenollp) in [#​1362](https://redirect.github.com/getkin/kin-openapi/pull/1362) - tests: run more in parallel by [@​fenollp](https://redirect.github.com/fenollp) in [#​1363](https://redirect.github.com/getkin/kin-openapi/pull/1363) - openapi3: ignore reference siblings in OpenAPI 3.0 by [@​lucky798213](https://redirect.github.com/lucky798213) in [#​1268](https://redirect.github.com/getkin/kin-openapi/pull/1268) - openapi3: WalkSchemas and WalkParameters stop on a callback cycle by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1364](https://redirect.github.com/getkin/kin-openapi/pull/1364) - openapi3filter: validate response headers described with content by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1358](https://redirect.github.com/getkin/kin-openapi/pull/1358) - openapi3filter: honor ExcludeRequestQueryParams for path item parameters by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1365](https://redirect.github.com/getkin/kin-openapi/pull/1365) - openapi3: handle fields next to $ref as OpenAPI 3.0, 3.1 and 3.2 specify by [@​fenollp](https://redirect.github.com/fenollp) in [#​1371](https://redirect.github.com/getkin/kin-openapi/pull/1371) - changelog: fixup rebased messes by [@​fenollp](https://redirect.github.com/fenollp) in [#​1372](https://redirect.github.com/getkin/kin-openapi/pull/1372) #### New Contributors - [@​ybai08](https://redirect.github.com/ybai08) made their first contribution in [#​1343](https://redirect.github.com/getkin/kin-openapi/pull/1343) - [@​phooijenga](https://redirect.github.com/phooijenga) made their first contribution in [#​1347](https://redirect.github.com/getkin/kin-openapi/pull/1347) **Full Changelog**: <https://github.com/getkin/kin-openapi/compare/v0.151.0...v0.152.0> </details> <details> <summary>go-co-op/gocron (github.com/go-co-op/gocron/v2)</summary> ### [`v2.23.0`](https://redirect.github.com/go-co-op/gocron/releases/tag/v2.23.0) [Compare Source](https://redirect.github.com/go-co-op/gocron/compare/v2.22.0...v2.23.0) #### What's Changed - feat(scheduler): WithStartAtGrace opt-in tolerance for late first-run dispatch by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​945](https://redirect.github.com/go-co-op/gocron/pull/945) - fix(executor,scheduler): use injected clock for job timing and guard reschedule loop by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​946](https://redirect.github.com/go-co-op/gocron/pull/946) - fix(executor): attribute scheduling delay to the tick that actually fired by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​948](https://redirect.github.com/go-co-op/gocron/pull/948) - refactor(scheduler): extract shared first-run logic from selectNewJob/selectStart by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​947](https://redirect.github.com/go-co-op/gocron/pull/947) - build(deps): bump actions/setup-go from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​949](https://redirect.github.com/go-co-op/gocron/pull/949) - build(deps): bump actions/setup-python from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​950](https://redirect.github.com/go-co-op/gocron/pull/950) - ci: updating golangci-lint to 2.13.1 to support go 1.27 by [@​manuelarte](https://redirect.github.com/manuelarte) in [#​954](https://redirect.github.com/go-co-op/gocron/pull/954) - Exclude stable Go version in CI workflow by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​968](https://redirect.github.com/go-co-op/gocron/pull/968) - docs: removing retired go report badge by [@​manuelarte](https://redirect.github.com/manuelarte) in [#​952](https://redirect.github.com/go-co-op/gocron/pull/952) - build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​ > [!IMPORTANT] > ✂ PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzIuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> --------- Co-authored-by: silverwind <me@silverwind.io> |
||
 bircniandsilverwind
|
51368e1997 |
ci: use GitHub merge queue (#40130)
Requiring branches to be up to date reruns the full CI matrix on every waiting PR after each merge, which saturates our 20 concurrent jobs. A merge queue still tests against the latest `main`, but once per batch. This runs the PR workflows on `merge_group` and reports `giteabot/lgtm` on queue commits, since GiteaBot only sets it on PR heads. Mergers queue PRs with "Merge when ready" instead of `reviewed/wait-merge`, so giteabot no longer updates branches. Nothing changes until the `merge-queue` ruleset is enabled and "Require branches to be up to date" is turned off. Backport to `release/v28` before the ruleset covers it. --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
eba3a81c9a |
ci: build snap nightlies every 12 hours instead of on every push (#40150)
The snap nightly ran on every push to `main`, about 58 runs and 520 job minutes a week on GitHub-hosted runners, which share the concurrent job limit with PR CI. It now runs as a job in `release-nightly.yml`, reusing its 12-hourly check for new commits on `main`, like https://github.com/go-gitea/gitea/pull/40138 did for the other nightlies. A new release tag is still published by the first build after `main` changes. |
||
|
silverwind
|
59cbacc924 |
ci: build nightlies every 12 hours instead of on every push (#40138)
Building nightlies on every push to `main` and `release/v*` costs about 1000 runner minutes a day, a third of it in runs cancelled by the next push. Nightlies now run every 12 hours and only build branches with commits since the last successful run. --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
2a2fb86ca0 |
ci: update toolchains and let renovate update action inputs (#40092)
- Let renovate update hyphenated action inputs like `python-version` - Python 3.14 → 3.15 in CI - Download gh 2.103.2 directly in the release workflow instead of using `install-gh-cli-action` with 2.39.1 - Devcontainer Go image 1.26 → 1.27 - Snap build toolchains Go 1.26 → 1.27 and Node 24 → 26 |
||
|
silverwind
|
ac11887b02 |
ci(renovate): fix docker image updates with over 1000 tags (#40077)
Docker Hub refuses anonymous tag pages past 1000 tags, and Renovate then drops every release date it fetched (https://github.com/renovatebot/renovate/issues/46925). The 5-day `minimumReleaseAge` then holds digest updates of `postgres`, `redis` and `getmeili/meilisearch` back forever. Stopping at 10 pages keeps the dates of the newest 1000 tags. |
||
 
|
1ebeade2c1 |
fix(indexer): search code as case-insensitive literal substrings (#40028)
Code search now matches case-insensitive literal substrings like GitHub, in every script. Word tokenizers can't do this: the ES pattern dropped every non-ASCII word, and the `standard` tokenizer keeps `console.log` as one token. - Elasticsearch indexes positional trigrams, plus 1-2 grams for short terms - Bleve indexes distinct 1-3 grams as a candidate filter and verifies candidates against the content before paging, because phrase queries over trigrams are quadratic in repeated grams - Snippet offsets come from the original content, so `<em>` in sources and width-changing lowercase no longer misplace them - `search_mode=fuzzy` requests behave like Words, the UI never offered fuzzy for code search - The ES code indexer test now runs in CI, it was skipped before There are no UI changes. Both code indexes rebuild after upgrade. Fixes: https://github.com/go-gitea/gitea/issues/40027 Fixes: https://github.com/go-gitea/gitea/issues/16158 Fixes: https://github.com/go-gitea/gitea/issues/21359 --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Giteabotandsilverwind
|
f0bb283a17 |
chore(deps): update dependencies (#40020)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
8cd7721deb |
ci(release): stop creating deployments for release tags (#39966)
Each `release-create-tag` run created a deployment record, which makes GitHub show a useless "This branch has not been deployed" box on every PR: <img width="819" height="113" alt="image" src="https://github.com/user-attachments/assets/129c8348-1d70-46b9-8996-8872c84a11f2" /> With `deployment: false`, the `release-signing` approval and branch policy still apply. |
||
|
silverwind
|
5f85a5157d |
ci: update giteabot to v1.3.1 (#39947)
Bump `giteabot` to [`v1.3.1`](https://github.com/go-gitea/giteabot/releases/tag/v1.3.1) in both workflows. It fixes `reviewed/wait-merge` PRs that the merge queue left behind their base, like https://github.com/go-gitea/gitea/pull/39854 and https://github.com/go-gitea/gitea/pull/39928, and stops the lgtm sweep from re-posting unchanged statuses (https://github.com/go-gitea/giteabot/pull/30). |
||
|
Giteabotandsilverwind
|
7e164fe61a |
chore(deps): update dependencies, migrate to connectrpc.com/connect v2 (#39854)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
ecae91132b | ci: update giteabot to v1.3.0 (#39910) | ||
|
silverwind
|
1031e34987 |
test: run integration tests on random ports and speed up slow tests (#39842)
Integration test processes now get their own work directory, config file and random ports, so several runs can execute in parallel on one machine. The slowest tests also lose fixed sleeps and needlessly expensive setup, with their assertions kept. - Batch PostgreSQL sequence resets, the main per-test fixture cost there - Cheap hashing params in hash and OAuth2 fixture tests, full-cost vectors stay - Single fetch for negative Actions runner assertions instead of 1s polls - Queue flushes and backdated timestamps instead of sleeps - In-memory SQLite test journal, tmpfs for PostgreSQL in CI - E2E instance writes SSH keys into its work directory instead of `~/.ssh/authorized_keys` |
||
|
silverwindandGiteabot
|
b0ae5890cf |
chore: remove misspell (#39829)
Remove the misspell spell checker along with its `lint-spell` and `lint-spell-fix` make targets, its CI step and its custom dictionary. `make lint` and `make lint-fix` no longer run a spell check. Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
silverwind
|
078198d38d |
ci: update giteabot to v1.2.1 (#39815)
Bump `giteabot` from `v1.1.0` to [`v1.2.1`](https://github.com/go-gitea/giteabot/releases/tag/v1.2.1). It now runs on the `node24` action runtime instead of setting up Deno (https://github.com/go-gitea/giteabot/pull/23), and a reviewer who requested changes can lift `lgtm/blocked` by re-requesting their own review (https://github.com/go-gitea/giteabot/pull/24). |
||
|
Giteabot
|
0eb0126fa2 | chore(deps): update dependencies (#39742) | ||
|
bircni
|
8a553332f7 |
ci: skip reverted commits in release notes, publish tagged snaps to stable (#39657)
Release notes: revert commits and the commits they revert are now left out of the git-cliff changelog. A step before git-cliff finds commits whose subject starts with "revert", reads the PR numbers on their revert lines, and writes both SHAs to `.cliffignore`. Snap: since the move from Launchpad to GitHub Actions, every build was uploaded to `latest/edge`, including the stable-grade build that `part-gitea-pull.sh` makes for an unreleased tag. Launchpad used to release those builds to candidate and stable automatically. Without that, v28.0.0 had to be promoted by hand and v28.1.0 stayed in edge. Stable-grade snaps now go to `latest/stable` and `latest/candidate`; main builds still go to edge. Candidate has to be updated too because the pull script compares against it. --------- Signed-off-by: bircni <bircni@icloud.com> |
||
|
43fedd662a |
ci(release): automate signed release tags and release notes (#39544)
Automate release tagging as proposed in https://github.com/go-gitea/gitea/pull/39544#issuecomment-5955939142, part of https://github.com/go-gitea/gitea/issues/39550. A maintainer selects a release branch and version in the `release-create-tag` workflow. After approval through the `release-signing` environment, it pushes a GPG-signed tag. The tag starts the existing release build, which generates GitHub release notes with git-cliff from commits since the previous release, skipping `chore` and `ci` commits. `CHANGELOG.md` and release-candidate releases are removed. The workflow reuses the existing `GPGSIGN_KEY`, `GPGSIGN_PASSPHRASE`, and `RELEASE_TOKEN` repository secrets. Closes https://github.com/go-gitea/gitea/issues/39550 --------- Co-authored-by: bircni <bircni@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Giteabotandsilverwind
|
27d876e311 |
chore(deps): update dependencies, add new lint rules, fix lint (#39601)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwindandwxiaoguang
|
ad38b60983 |
refactor!: remove go-git backend (#39487)
Removes the go-git backend so every build uses the git CLI backend. Its Windows performance advantage is gone, it lacks SHA-256 support, and it breaks repositories on Windows. The performance changes moved to https://github.com/go-gitea/gitea/pull/39526. Fixes https://github.com/go-gitea/gitea/issues/38359 Fixes https://github.com/go-gitea/gitea/issues/34694 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
3932624947 |
ci: relay fork PR reviews to giteabot through workflow_run (#39546)
`pull_request_review` runs on fork PRs, which includes all backport PRs, get a read-only token and no secrets, so giteabot cannot write lgtm labels and statuses there. A no-op `giteabot-review` workflow now triggers giteabot through `workflow_run`, which gets both. This allows retiring the legacy fly.io webhook bot. Part of https://github.com/go-gitea/giteabot/issues/15 |
||
|
bircni
|
e0095af8c3 | ci: Also release for other versions than 1 majors (#39475) | ||
 silverwindandClaude
|
9c715c0f9d |
chore: update giteabot to v1.0.7 (#39470)
Bump `giteabot` to [`v1.0.7`](https://github.com/go-gitea/giteabot/releases/tag/v1.0.7), which supports backport branch names in major-only format `release/v28` (https://github.com/go-gitea/giteabot/pull/14). Co-authored-by: Claude (Opus 5.5) <noreply@anthropic.com> |
||
|
Giteabot
|
fba8d7eace | chore(deps): update dependencies (#39462) | ||
|
|
64f31d9b70 |
enhance(emoji): update to Unicode 17, unify and lazy-load emoji data (#39363)
Generate emoji data from Unicode 17's `emoji-test.txt`, keeping existing aliases. `public/assets/emoji.json` is now the single emoji data file, also loaded by the backend. Rendered emoji drop their `aria-label`, the dark theme inverts key on a new `data-alias` attribute instead. Skin tone variants and their Gitea-only aliases are removed, GitHub has none either. Emoji autocompletion is now lazy-loaded with the markdown editor, shrinking the index JS chunk from 653KB to 563KB. --------- Signed-off-by: silverwind <me@silverwind.io> Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: bircni <bircni@icloud.com> |
||
|
Giteabot
|
fc28937a8d | chore(deps): update dependencies (#39367) | ||
|
Giteabotandsilverwind
|
cefb81a16f |
chore(deps): update dependencies (#39306)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
Giteabotandsilverwind
|
cc6fc41723 |
chore(deps): update dependencies (#39256)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
535fc29ae8 | chore(deps): update dependencies (#39176) | ||
|
silverwind
|
fbdeea0af7 | ci(snap): pack snaps without an LXD container (#39152) | ||
|
Giteabot
|
4c915ae0c2 | chore(deps): update dependencies (#39066) | ||
|
wxiaoguang
|
51b8da8b01 |
chore: update Go to v1.27 (#39068)
Only made some necessary changes:
1. remove `GOEXPERIMENT`, only use jsonv2
1. `make fmt`
* `SigningKey` and `Signature` were affected due to some bugs in the
toolchain, so rewrote them
1. remove or fix fragile magic numbers and strings
* the outputs of image/gzip/zlib packages are different
1. update "nolint" comments for the changed lint behaviors
1. add `tls.MLKEM1024`
|
||
|
|
66d6f74cb0 |
test: speed up tests, fix transaction bug (#39030)
Speed up tests: `make test-backend` 103s to 37s, `make test-integration` 908s to 852s. Most of it is a detached system notice insert blocking on the SQLite write lock until the busy timeout expired, and `ExternalServiceHTTP` re-probing on every call with an untimed `http.Get`. - fixed one correctness bug with nested transactions: files were deleted while the outer transaction was open, so a later failure could roll the database back with the files gone - git push branch counts were far above the hook batch size - Fix makefile dependencies so running tests and lint work in fresh worktrees. --------- Co-authored-by: Giteabot <teabot@gitea.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
 Lunny Xiaoandwxiaoguang
|
cce2360846 |
build(release): use native golang toolchain for official release builds (#37828)
Official releases are built by Golang toolchain with CGO disabled. For packagers who need to cross-compile with CGO, use "build" target with proper TAGS/LDFLAGS/CGO_CFLAGS to make "$(EXECUTABLE)" target run the "go build" command. By the way, drop i386 arch support --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
83af7aa92e |
ci: improve caching (#38958)
- only `cache-seeder` writes caches, every other workflow restores. Saves were being rejected once the repo went over its cache budget, leaving main's caches stale and PR runs building cold - seed the pnpm store and uv caches next to the go ones, so PRs warm-start on them rather than installing from scratch - prune keeps a single generation per key, including across go versions, where a toolchain bump leaves the previous build cache unusable. Reclaims ~2.6 GB immediately - prune runs every 6h instead of daily and trims to 6 GB, since CodeQL writes ~200 MB per push to main from outside this repo's workflows - pull requests and release branches no longer write pnpm, uv and binfmt caches, whose ref-scoped copies are never read again --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
df71d5f5e2 |
test: run frontend unit tests in browsers (#38860)
Run them in headless [vitest browser mode](https://vitest.dev/guide/browser/) in chromium and firefox. Similar UX than current tests, it's about 5 times as slow (goes from 1s to 5s on my machine), but definitely worth it as it removes all happy-dom problems. --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
596b7f7a25 | chore(deps): update dependencies (#38947) | ||
|
Lunny Xiao
|
07843086c2 |
ci: remove AWS S3 uploads from release workflows (#38928)
Release binaries and downloads have been served from Cloudflare R2 for a while now, so the AWS S3 upload is redundant. This removes the `configure aws` and `upload binaries to s3` steps from the nightly, RC and version release workflows. Since `configure-aws-credentials` no longer runs in those jobs, the `AWS_REGION: auto` workaround in the R2 step can be dropped as well. The `AWS_*` secrets for S3 can be removed from the repository settings afterwards. |
||
|
Giteabot
|
a8fe401613 | chore(deps): update dependencies (#38851) | ||
|
silverwind
|
d8c3a1afda |
ci: pin containers to digest, enable more zizmor rules (#38779)
Enable more strict "pedantic" zizmor rules and fix issues. Service containers are pinned to hash and renovate will update them. Enabled rules: - https://docs.zizmor.sh/audits/#excessive-permissions - https://docs.zizmor.sh/audits/#unpinned-images - https://docs.zizmor.sh/audits/#template-injection --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
|
a954257fb1 |
chore(deps): update dependencies (#38757)
Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
b87fdd5da4 |
ci: fix jq broken pipe in cache-prune (#38734)
Fix minor issue: `cache-prune` logs `jq: error: writing output failed: Broken pipe` when it has nothing to delete, because the loop stops reading as soon as it is under the limit while `jq` still has output pending. Reading from a here-string removes the pipe. --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
4f363d2748 |
ci: improve go caches (#38730)
Cache saves have been rejected since June because the repo sat above its 10 GB allowance, so every PR run fell back to a cache built with an older toolchain and rebuilt the backend from scratch. - go version in the `gobuild` and `golint` keys and `restore-keys` - seeder triggers on `go.mod` and gained `workflow_dispatch` - single writer for the `gomod` cache, the two were racing - new daily `cache-prune` workflow holding the total under a limit - `cache: false` for `setup-go` in release and cron workflows, it held 815 MB - add `workflow_dispatch` so the cache workflows can be triggered on-demand Assisted-by: Claude Code:claude-opus-5 |
||
|
|
f0a95eebe3 |
refactor: serve the api specs as plain json (#38715)
The api specs were Go templates whose committed form was not a valid swagger document, so `swagger-validate`, `generate-openapi.go` and `.spectral.yaml` each worked around it. They are now plain json, substituted at serve time. Renaming them off `.tmpl` also stops `make fmt` rewriting them, which used to bump their mtime and silently skip the next `make generate-swagger`. Also enables stricter spectral linting: extends `lint-swagger` to the OpenAPI 3 spec, turns on `openapi-tags`, `operation-singular-tag` and `operation-tag-defined`, adds a top-level `tags` array with descriptions to the swagger input, and drops the redundant `repository` tag from `POST /user/repos`. --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
Giteabotandsilverwind
|
94a2c3ec18 |
chore(deps): update dependencies (#38660)
Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Lunny Xiao
|
559aa89ca7 |
ci: set AWS_REGION for Cloudflare R2 upload steps (#38658)
The `configure-aws-credentials` step earlier in the same job exports **both** `AWS_DEFAULT_REGION` and `AWS_REGION` into `$GITHUB_ENV` (verified in `exportRegion()` at the pinned SHA `517a711`), so `secrets.AWS_REGION` (the real AWS region) stays set for every later step in that job. The AWS CLI v2 region resolution order is `--region` > `AWS_REGION` > `AWS_DEFAULT_REGION`. The R2 step only set `AWS_DEFAULT_REGION: auto`, so the leaked `AWS_REGION` won and R2 rejected it, since R2 only accepts `wnam`, `enam`, `weur`, `eeur`, `apac`, `oc` or `auto`. The failure log shows both `AWS_DEFAULT_REGION: auto` and `AWS_REGION: ***` in the step env, which confirms the leak. ### Fix Set `AWS_REGION: auto` explicitly in the R2 upload step env of all three release workflows. Step-level `env:` is applied after `GITHUB_ENV`-derived variables, so this reliably overrides the leaked value. No other variable leaks from `configure-aws-credentials` matter here: `AWS_SESSION_TOKEN` is only exported when a session token exists, and these workflows use static access keys without `role-to-assume`; `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are already overridden in the R2 step. Consolidating the three duplicated upload steps into a composite action remains a follow-up, as noted in #38635. |
||
|
Lunny Xiao
|
230e7bdf91 |
chore(build): upload release to Cloudflare R2 (#38635)
The download site’s bandwidth costs are growing rapidly, while Cloudflare R2 does not charge egress fees. Therefore, we would like to migrate the download site from S3 to R2. To ensure a smooth transition, we will keep the existing S3 upload process temporarily and remove it after the migration is complete. The upload steps are currently duplicated in three places. They could be consolidated into a composite action in a separate PR. |
||
|
silverwindandGiteabot
|
29b99de940 |
ci: derive topic labels from PR title (#38595)
Derives topic labels from the PR title scope: `enhance(actions): ...` gets `topic/gitea-actions`. Scopes map to `topic/<scope>`, with aliases for names that differ (`oauth` → `topic/authentication`). Labels stay in sync with the title, while ones applied by hand are left alone. Scopes with no matching label on the repo are ignored, so no new labels get created. --------- Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
Giteabot
|
2fec2affc4 |
chore(deps): update dependencies (#38538)
Also include: chore(deps): update npm dependencies #38542 chore(deps): update action dependencies #38541 chore(deps): update module golang.org/x/vuln to v1.6.0 #38540 |