494 Commits

Author	SHA1	Message	Date
Giteabot	9d737a6400	fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.51.0` → `v0.52.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.51.0...refs/tags/v0.52.0) |  |  | --- ### Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent [CVE-2026-39833](https://nvd.nist.gov/vuln/detail/CVE-2026-39833) / [GO-2026-5005](https://pkg.go.dev/vuln/GO-2026-5005) <details> <summary>More information</summary> #### Details The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested. #### Severity Unknown #### References - [https://go.dev/issue/79436](https://go.dev/issue/79436) - [https://go.dev/cl/778640](https://go.dev/cl/778640) - [https://go.dev/cl/778641](https://go.dev/cl/778641) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5005) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent [CVE-2026-39832](https://nvd.nist.gov/vuln/detail/CVE-2026-39832) / [GO-2026-5006](https://pkg.go.dev/vuln/GO-2026-5006) <details> <summary>More information</summary> #### Details When adding a key to a remote agent constraint extensions such as restrict-destination-v00@&#8203;openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them. #### Severity Unknown #### References - [https://go.dev/issue/79435](https://go.dev/issue/79435) - [https://go.dev/cl/778642](https://go.dev/cl/778642) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5006) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh [CVE-2026-46597](https://nvd.nist.gov/vuln/detail/CVE-2026-46597) / [GO-2026-5013](https://pkg.go.dev/vuln/GO-2026-5013) <details> <summary>More information</summary> #### Details An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. #### Severity Unknown #### References - [https://go.dev/issue/79561](https://go.dev/issue/79561) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781620](https://go.dev/cl/781620) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5013) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh [CVE-2026-39828](https://nvd.nist.gov/vuln/detail/CVE-2026-39828) / [GO-2026-5014](https://pkg.go.dev/vuln/GO-2026-5014) <details> <summary>More information</summary> #### Details When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error. #### Severity Unknown #### References - [https://go.dev/issue/79562](https://go.dev/issue/79562) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781621](https://go.dev/cl/781621) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5014) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh [CVE-2026-39835](https://nvd.nist.gov/vuln/detail/CVE-2026-39835) / [GO-2026-5015](https://pkg.go.dev/vuln/GO-2026-5015) <details> <summary>More information</summary> #### Details SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil. #### Severity Unknown #### References - [https://go.dev/issue/79563](https://go.dev/issue/79563) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781660](https://go.dev/cl/781660) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5015) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh [CVE-2026-39827](https://nvd.nist.gov/vuln/detail/CVE-2026-39827) / [GO-2026-5016](https://pkg.go.dev/vuln/GO-2026-5016) <details> <summary>More information</summary> #### Details An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection. #### Severity Unknown #### References - [https://go.dev/issue/35127](https://go.dev/issue/35127) - [https://go.dev/cl/781320](https://go.dev/cl/781320) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5016) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh [CVE-2026-39830](https://nvd.nist.gov/vuln/detail/CVE-2026-39830) / [GO-2026-5017](https://pkg.go.dev/vuln/GO-2026-5017) <details> <summary>More information</summary> #### Details A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded. #### Severity Unknown #### References - [https://go.dev/issue/79564](https://go.dev/issue/79564) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781640](https://go.dev/cl/781640) - [https://go.dev/cl/781664](https://go.dev/cl/781664) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5017) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh [CVE-2026-39829](https://nvd.nist.gov/vuln/detail/CVE-2026-39829) / [GO-2026-5018](https://pkg.go.dev/vuln/GO-2026-5018) <details> <summary>More information</summary> #### Details The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2. #### Severity Unknown #### References - [https://go.dev/issue/79565](https://go.dev/issue/79565) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781641](https://go.dev/cl/781641) - [https://go.dev/cl/781661](https://go.dev/cl/781661) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5018) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh [CVE-2026-39831](https://nvd.nist.gov/vuln/detail/CVE-2026-39831) / [GO-2026-5019](https://pkg.go.dev/vuln/GO-2026-5019) <details> <summary>More information</summary> #### Details The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@&#8203;openssh.com, sk-ssh-ed25519@&#8203;openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback. #### Severity Unknown #### References - [https://go.dev/issue/79566](https://go.dev/issue/79566) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781662](https://go.dev/cl/781662) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5019) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh [CVE-2026-39834](https://nvd.nist.gov/vuln/detail/CVE-2026-39834) / [GO-2026-5020](https://pkg.go.dev/vuln/GO-2026-5020) <details> <summary>More information</summary> #### Details When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation. #### Severity Unknown #### References - [https://go.dev/issue/79567](https://go.dev/issue/79567) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781663](https://go.dev/cl/781663) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5020) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking auth bypass via unenforced @&#8203;revoked status in golang.org/x/crypto/ssh/knownhosts [CVE-2026-42508](https://nvd.nist.gov/vuln/detail/CVE-2026-42508) / [GO-2026-5021](https://pkg.go.dev/vuln/GO-2026-5021) <details> <summary>More information</summary> #### Details Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @&#8203;revoked. #### Severity Unknown #### References - [https://go.dev/issue/79568](https://go.dev/issue/79568) - [https://go.dev/cl/781220](https://go.dev/cl/781220) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5021) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh [CVE-2026-46595](https://nvd.nist.gov/vuln/detail/CVE-2026-46595) / [GO-2026-5023](https://pkg.go.dev/vuln/GO-2026-5023) <details> <summary>More information</summary> #### Details Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. #### Severity Unknown #### References - [https://go.dev/issue/79570](https://go.dev/issue/79570) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781642](https://go.dev/cl/781642) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5023) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent [CVE-2026-46598](https://nvd.nist.gov/vuln/detail/CVE-2026-46598) / [GO-2026-5033](https://pkg.go.dev/vuln/GO-2026-5033) <details> <summary>More information</summary> #### Details For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used. #### Severity Unknown #### References - [https://go.dev/issue/79596](https://go.dev/issue/79596) - [https://go.dev/cl/781360](https://go.dev/cl/781360) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5033) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->	2026-05-21 23:44:13 -07:00
Giteabot	42e167b054	fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://redirect.github.com/go-git/go-git) | `v5.19.0` → `v5.19.1` |  |  | --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->	2026-05-19 21:03:12 +00:00
Giteabot	0b7fc8a579	fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (#37771) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go) | `v2.25.0` → `v2.26.0` |  |  |	2026-05-19 04:37:42 +00:00
Giteabot	81b544c279	fix(deps): update module google.golang.org/grpc to v1.81.1 (#37762) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) | `v1.81.0` → `v1.81.1` |  |  | --- ### Release Notes <details> <summary>grpc/grpc-go (google.golang.org/grpc)</summary> ### [`v1.81.1`](https://redirect.github.com/grpc/grpc-go/releases/tag/v1.81.1): Release 1.81.1 [Compare Source](https://redirect.github.com/grpc/grpc-go/compare/v1.81.0...v1.81.1) ### Security - xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per [gRFC A41](https://redirect.github.com/grpc/proposal/blob/master/A41-xds-rbac.md). ([#&#8203;9111](https://redirect.github.com/grpc/grpc-go/issues/9111)) - Special Thanks: [@&#8203;al4an444](https://redirect.github.com/al4an444) ### Bug Fixes - otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. ([#&#8203;9081](https://redirect.github.com/grpc/grpc-go/issues/9081)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->	2026-05-18 17:52:59 +00:00
wxiaoguang	c37b5241d7	chore: fix tests (#37760) ... Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>	2026-05-18 15:47:24 +00:00
Giteabot	e60ca35d52	fix(deps): update go dependencies (#37752) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | code.gitea.io/sdk/gitea | `v0.25.0` → `v0.25.1` |  |  | require | patch | | | [gitea.com/gitea/runner](https://gitea.com/gitea/runner) | `v1.0.0` → `v1.0.3` |  |  | require | patch | `v1.0.4` | | [github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi) | `v0.137.0` → `v0.138.0` |  |  | require | minor | | | [github.com/go-co-op/gocron/v2](https://redirect.github.com/go-co-op/gocron) | `v2.21.1` → `v2.21.2` |  |  | require | patch | | | [github.com/go-webauthn/webauthn](https://redirect.github.com/go-webauthn/webauthn) | `v0.17.2` → `v0.17.3` |  |  | require | patch | | | [github.com/google/pprof](https://redirect.github.com/google/pprof) | `545e8a4` → `92041b7` |  |  | require | digest | | | [github.com/wneessen/go-mail](https://redirect.github.com/wneessen/go-mail) | `v0.7.2` → `v0.7.3` |  |  | require | patch | | | [gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go) | `v2.24.1` → `v2.25.0` |  |  | require | minor | `v2.27.0` (+2) | | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.50.0` → `v0.51.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.50.0...refs/tags/v0.51.0) |  |  | require | minor | | | [golang.org/x/image](https://pkg.go.dev/golang.org/x/image) | [`v0.39.0` → `v0.40.0`](https://cs.opensource.google/go/x/image/+/refs/tags/v0.39.0...refs/tags/v0.40.0) |  |  | require | minor | | | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.53.0` → `v0.54.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.53.0...refs/tags/v0.54.0) |  |  | require | minor | | | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.36.0` → `v0.37.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.36.0...refs/tags/v0.37.0) |  |  | require | minor | | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `v1.50.0` → `v1.50.1` |  |  | require | patch | | --- ### Release Notes <details> <summary>gitea/runner (gitea.com/gitea/runner)</summary> ### [`v1.0.3`](https://gitea.com/gitea/runner/releases/tag/v1.0.3) [Compare Source](https://gitea.com/gitea/runner/compare/v1.0.2...v1.0.3) #### Changelog - fix: isolate per-task runner envs ([#&#8203;959](https://redirect.github.com/gitea/runner/issues/959)) - fix(deps): update module github.com/opencontainers/selinux to v1.14.1 ([#&#8203;955](https://redirect.github.com/gitea/runner/issues/955)) - fix(deps): update mergo to v1.0.2 (now `dario.cat/mergo`) ([#&#8203;954](https://redirect.github.com/gitea/runner/issues/954)) - fix: ensure `dbfs_data` is cleaned up after task completion ([#&#8203;952](https://redirect.github.com/gitea/runner/issues/952)) - fix(artifactcache): preserve cache key case to stop redundant uploads ([#&#8203;947](https://redirect.github.com/gitea/runner/issues/947)) - fix(deps): update module golang.org/x/term to v0.43.0 ([#&#8203;948](https://redirect.github.com/gitea/runner/issues/948)) ### [`v1.0.2`](https://gitea.com/gitea/runner/releases/tag/v1.0.2) [Compare Source](https://gitea.com/gitea/runner/compare/v1.0.1...v1.0.2) #### Changelog - fix: overwrite read-only files when copying action directories ([#&#8203;942](https://redirect.github.com/gitea/runner/issues/942)) - docs: add apparmor=rootlesskit in security\_opt ([#&#8203;937](https://redirect.github.com/gitea/runner/issues/937)) - fix: serialize action-cache reads to prevent worktree race ([#&#8203;938](https://redirect.github.com/gitea/runner/issues/938)) - feat: remove emojis from runner logging, add `Starting job container` group ([#&#8203;940](https://redirect.github.com/gitea/runner/issues/940)) ### [`v1.0.1`](https://gitea.com/gitea/runner/releases/tag/v1.0.1) [Compare Source](https://gitea.com/gitea/runner/compare/v1.0.0...v1.0.1) #### Changelog - [`dff63b3`](dff63b3ecc) fix(deps): update module github.com/go-git/go-git/v5 to v5.19.0 ([#&#8203;934](https://redirect.github.com/gitea/runner/issues/934)) - [`a5d9fe9`](a5d9fe9651) fix(deps): update module github.com/opencontainers/selinux to v1.14.0 ([#&#8203;928](https://redirect.github.com/gitea/runner/issues/928)) - [`d607f3b`](d607f3b342) test: clean up dead/stale fixtures and bump test container images ([#&#8203;932](https://redirect.github.com/gitea/runner/issues/932)) - [`5e59402`](5e59402fb2) fix: re-fetch cached reusable workflow on every run ([#&#8203;930](https://redirect.github.com/gitea/runner/issues/930)) - [`dfeb463`](dfeb463904) chore(deps): update docker docker tag to v29 ([#&#8203;924](https://redirect.github.com/gitea/runner/issues/924)) </details> <details> <summary>getkin/kin-openapi (github.com/getkin/kin-openapi)</summary> ### [`v0.138.0`](https://redirect.github.com/getkin/kin-openapi/releases/tag/v0.138.0) [Compare Source](https://redirect.github.com/getkin/kin-openapi/compare/v0.137.0...v0.138.0) #### What's Changed - openapi3gen: clear nullable on exported component bodies by [@&#8203;0-don](https://redirect.github.com/0-don) in [#&#8203;1164](https://redirect.github.com/getkin/kin-openapi/pull/1164) - openapi3: add test for issue [#&#8203;927](https://redirect.github.com/getkin/kin-openapi/issues/927) (nullable not respected on $ref schemas) by [@&#8203;fenollp](https://redirect.github.com/fenollp) in [#&#8203;1165](https://redirect.github.com/getkin/kin-openapi/pull/1165) - test: move public-API tests to external \_test packages by [@&#8203;fenollp](https://redirect.github.com/fenollp) in [#&#8203;1168](https://redirect.github.com/getkin/kin-openapi/pull/1168) - feat(openapi3): add per-type validation errors with cluster wrappers by [@&#8203;reuvenharrison](https://redirect.github.com/reuvenharrison) in [#&#8203;1166](https://redirect.github.com/getkin/kin-openapi/pull/1166) - feat(openapi3conv): canonicalization pass for 3.0 -> 3.x by [@&#8203;reuvenharrison](https://redirect.github.com/reuvenharrison) in [#&#8203;1162](https://redirect.github.com/getkin/kin-openapi/pull/1162) - openapi3conv: test Upgrade on many documents by [@&#8203;fenollp](https://redirect.github.com/fenollp) in [#&#8203;1169](https://redirect.github.com/getkin/kin-openapi/pull/1169) **Full Changelog**: <https://github.com/getkin/kin-openapi/compare/v0.137.0...v0.138.0> </details> <details> <summary>go-co-op/gocron (github.com/go-co-op/gocron/v2)</summary> ### [`v2.21.2`](https://redirect.github.com/go-co-op/gocron/releases/tag/v2.21.2) [Compare Source](https://redirect.github.com/go-co-op/gocron/compare/v2.21.1...v2.21.2) #### What's Changed - fix: defer WithLimitedRuns job removal until task completes ([#&#8203;925](https://redirect.github.com/go-co-op/gocron/issues/925)) by [@&#8203;SAY-5](https://redirect.github.com/SAY-5) in [#&#8203;926](https://redirect.github.com/go-co-op/gocron/pull/926) #### New Contributors - [@&#8203;SAY-5](https://redirect.github.com/SAY-5) made their first contribution in [#&#8203;926](https://redirect.github.com/go-co-op/gocron/pull/926) **Full Changelog**: <https://github.com/go-co-op/gocron/compare/v2.21.1...v2.21.2> </details> <details> <summary>go-webauthn/webauthn (github.com/go-webauthn/webauthn)</summary> ### [`v0.17.3`](https://redirect.github.com/go-webauthn/webauthn/blob/HEAD/CHANGELOG.md#v0173-2026-05-09) [Compare Source](https://redirect.github.com/go-webauthn/webauthn/compare/v0.17.2...v0.17.3) ##### Dependency Updates This release just contains updates to dependencies. </details> <details> <summary>wneessen/go-mail (github.com/wneessen/go-mail)</summary> ### [`v0.7.3`](https://redirect.github.com/wneessen/go-mail/releases/tag/v0.7.3): : Skippable UTF-8 support, improved Base64LineBreaker, binary size reducing, fixes and more [Compare Source](https://redirect.github.com/wneessen/go-mail/compare/v0.7.2...v0.7.3) Welcome to go-mail v0.7.3! 🎉 This release brings some cool improvements, new features, and fixes to go-mail. We hope you enjoy it! #### Notable changes/improvements/features/fixes ##### Deadline fix for connections to a TLS port without TLS PR [#&#8203;521](https://redirect.github.com/wneessen/go-mail/issues/521) fixes a missing deadline in the `Client` that could cause a deadlock for connections to a TLS port without TLS enabled. Thanks to [@&#8203;james-d-elliott](https://redirect.github.com/james-d-elliott) for finding and fixing this issue! ##### Preseve EHLO and HELO errors PR [#&#8203;528](https://redirect.github.com/wneessen/go-mail/issues/528) fixes an error for cases in which both the HELO and EHLO fail during a client connect. In this case the first error would be overwritten by the 2nd action, potentially deleting valuable information. In go-mail v0.7.3 both errors are now combined. Thanks to [@&#8203;Yanhu007](https://redirect.github.com/Yanhu007) for their contribution! ##### Improved Base64LineBreaker In PR [#&#8203;512](https://redirect.github.com/wneessen/go-mail/issues/512) [@&#8203;srpvpn](https://redirect.github.com/srpvpn) refactored the `Base64LineBreaker` type to be more performant and easier to read by removing the recursion. Thanks for your contribution! ##### Reduce binary size by making text/template and html/template support optional In PR [#&#8203;518](https://redirect.github.com/wneessen/go-mail/issues/518) [@&#8203;sblinch](https://redirect.github.com/sblinch) introduced a new compile time flag `gomailnotpl` which will make the `text/template` and `html/template` optional. Background is, that using `reflect.Value.Method` or `reflect.Value.MethodByName` prevents Go from performing full dead-code elimination because any exported method of any struct in the codebase could potentially be referenced at runtime. Unfortunately `text/template` and `html/template` do exactly this to allow method invocation from within templates. So in case your code does not need template support, you can use the new compile flag to remove the support for both packages completely and same some bytes in the resulting binary. Thanks for your contribution! ##### Fix nil pointer panic in partWriter PR [#&#8203;543](https://redirect.github.com/wneessen/go-mail/issues/543) fixes a potential nil pointer panic in the partWriter in case the underlying `io.Writer` returns an error during a multipart message write. Thanks to [@&#8203;UgurTheG](https://redirect.github.com/UgurTheG) for reporting and fixing the issue! ##### Provide access to HELO responses in the SMTP client PR [#&#8203;530](https://redirect.github.com/wneessen/go-mail/issues/530) adds support to access the HELO/EHLO responses via the `smtp.Client`. This feature is useful when using an SMTP servers pool behind a load balancer, to know which instance took the job. Thanks to [@&#8203;maxatome](https://redirect.github.com/maxatome) for submitting this feature! ##### Multiple addresses support in ReplyTo header PR [#&#8203;517](https://redirect.github.com/wneessen/go-mail/issues/517) adds support for multiple `Reply-To` addresses within a `Msg`, as permitted in RFC5322. Thanks to [@&#8203;christian-heusel](https://redirect.github.com/christian-heusel) for pointing this out and for comitting the PR! ##### Support to disable SMTPUTF8 in the MAIL FROM even if the server announces it PR [#&#8203;548](https://redirect.github.com/wneessen/go-mail/issues/548) adds support for skipping the `SMTPUTF8` extension to `MAIL FROM` commands. By default, when a server announces `SMTPUTF8` support in the EHLO, go-mail will add `SMTPUTF8` to the `MAIL FROM` command. As pointed out in [#&#8203;545](https://redirect.github.com/wneessen/go-mail/issues/545), some SMTP servers (e. g. specific MS Exchange versions) announce the SMTPUTF8 extension in the EHLO response but when adding the SMTPUTF8 to the MAIL FROM, they will fail with an error. The PR introduces a new `WithoutSMTPUTF8()` option for the `Client` which will make sure to skip the SMTPUTF8 extension in the MAIL FROM, even if the server announced it previously. Thanks [@&#8203;mkalus](https://redirect.github.com/mkalus) for reporting this issue and for their detailed analysis in [#&#8203;545](https://redirect.github.com/wneessen/go-mail/issues/545). #### What's Changed - minor fix for func ResetWithSMTPClient and DialAndSendWithContext by [@&#8203;sarff](https://redirect.github.com/sarff) in [#&#8203;500](https://redirect.github.com/wneessen/go-mail/pull/500) - Refactored `SendWithSMTPClient` to improve error handling and added test cases by [@&#8203;wneessen](https://redirect.github.com/wneessen) in [#&#8203;502](https://redirect.github.com/wneessen/go-mail/pull/502) - Refactored test and validation logic for message content checks by [@&#8203;wneessen](https://redirect.github.com/wneessen) in [#&#8203;503](https://redirect.github.com/wneessen/go-mail/pull/503) - Fix a docstring typo by [@&#8203;mitar](https://redirect.github.com/mitar) in [#&#8203;505](https://redirect.github.com/wneessen/go-mail/pull/505) - Upstream sync: prevent test failures due to expired test certificate by [@&#8203;wneessen](https://redirect.github.com/wneessen) in [#&#8203;522](https://redirect.github.com/wneessen/go-mail/pull/522) - fix: deadline not set for initial connection read by [@&#8203;james-d-elliott](https://redirect.github.com/james-d-elliott) in [#&#8203;521](https://redirect.github.com/wneessen/go-mail/pull/521) - Add deadlock test for client connections by [@&#8203;wneessen](https://redirect.github.com/wneessen) in [#&#8203;525](https://redirect.github.com/wneessen/go-mail/pull/525) - fix: preserve EHLO error when both EHLO and HELO fail by [@&#8203;Yanhu007](https://redirect.github.com/Yanhu007) in [#&#8203;528](https://redirect.github.com/wneessen/go-mail/pull/528) - refactor: remove recursion from base64LineBreaker.Write by [@&#8203;srpvpn](https://redirect.github.com/srpvpn) in [#&#8203;512](https://redirect.github.com/wneessen/go-mail/pull/512) - Make text/template support optional to allow dead-code elimination by [@&#8203;sblinch](https://redirect.github.com/sblinch) in [#&#8203;518](https://redirect.github.com/wneessen/go-mail/pull/518) - fix: prevent nil pointer panic in writeBody when partWriter is nil by [@&#8203;UgurTheG](https://redirect.github.com/UgurTheG) in [#&#8203;543](https://redirect.github.com/wneessen/go-mail/pull/543) - feat: add (\*smtp.Client).HelloResponse method to get EHLO/HELO response by [@&#8203;maxatome](https://redirect.github.com/maxatome) in [#&#8203;530](https://redirect.github.com/wneessen/go-mail/pull/530) - feat: add option to skip SMTPUTF8 in "MAIL FROM" commands by [@&#8203;wneessen](https://redirect.github.com/wneessen) in [#&#8203;548](https://redirect.github.com/wneessen/go-mail/pull/548) - Allow multiple Addresses in ReplyTo Header and add GetReplyTo() by [@&#8203;christian-heusel](https://redirect.github.com/christian-heusel) in [#&#8203;517](https://redirect.github.com/wneessen/go-mail/pull/517) #### CI/CD maintenance changes - Bump golang.org/x/text from 0.29.0 to 0.30.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;501](https://redirect.github.com/wneessen/go-mail/pull/501) - Bump golang.org/x/text from 0.30.0 to 0.31.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;506](https://redirect.github.com/wneessen/go-mail/pull/506) - Bump golang.org/x/text from 0.31.0 to 0.32.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;509](https://redirect.github.com/wneessen/go-mail/pull/509) - Bump Go and `golang.org/x/text` module versions by [@&#8203;wneessen](https://redirect.github.com/wneessen) in [#&#8203;526](https://redirect.github.com/wneessen/go-mail/pull/526) - Bump golang.org/x/text from 0.35.0 to 0.36.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;527](https://redirect.github.com/wneessen/go-mail/pull/527) - Updated `.golangci.toml` for linter exclusions on specific use cases by [@&#8203;wneessen](https://redirect.github.com/wneessen) in [#&#8203;523](https://redirect.github.com/wneessen/go-mail/pull/523) - Updated CI configuration for Go and OS versions in workflows by [@&#8203;wneessen](https://redirect.github.com/wneessen) in [#&#8203;524](https://redirect.github.com/wneessen/go-mail/pull/524) - Bump golangci/golangci-lint-action from 7.0.0 to 9.2.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;535](https://redirect.github.com/wneessen/go-mail/pull/535) - Bump ossf/scorecard-action from 2.4.0 to 2.4.3 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;534](https://redirect.github.com/wneessen/go-mail/pull/534) - Bump fsfe/reuse-action from 5.0.0 to 6.0.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;533](https://redirect.github.com/wneessen/go-mail/pull/533) - Bump vmactions/freebsd-vm from 1.1.5 to 1.4.5 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;532](https://redirect.github.com/wneessen/go-mail/pull/532) - Bump step-security/harden-runner from 2.10.2 to 2.19.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;531](https://redirect.github.com/wneessen/go-mail/pull/531) - Bump actions/dependency-review-action from 4.5.0 to 4.9.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;540](https://redirect.github.com/wneessen/go-mail/pull/540) - Bump actions/setup-go from 5.2.0 to 6.4.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;539](https://redirect.github.com/wneessen/go-mail/pull/539) - Bump codecov/codecov-action from 5.1.1 to 6.0.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;538](https://redirect.github.com/wneessen/go-mail/pull/538) - Bump actions/upload-artifact from 4.5.0 to 7.0.1 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;537](https://redirect.github.com/wneessen/go-mail/pull/537) - Bump github/codeql-action from 3.27.9 to 4.35.3 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;536](https://redirect.github.com/wneessen/go-mail/pull/536) - Bump step-security/harden-runner from 2.19.0 to 2.19.1 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;541](https://redirect.github.com/wneessen/go-mail/pull/541) - Bump golang.org/x/text from 0.36.0 to 0.37.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;547](https://redirect.github.com/wneessen/go-mail/pull/547) - Bump actions/dependency-review-action from 4.9.0 to 5.0.0 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;546](https://redirect.github.com/wneessen/go-mail/pull/546) - Bump github/codeql-action from 4.35.3 to 4.35.4 by [@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&#8203;544](https://redirect.github.com/wneessen/go-mail/pull/544) #### New Contributors - [@&#8203;mitar](https://redirect.github.com/mitar) made their first contribution in [#&#8203;505](https://redirect.github.com/wneessen/go-mail/pull/505) - [@&#8203;Yanhu007](https://redirect.github.com/Yanhu007) made their first contribution in [#&#8203;528](https://redirect.github.com/wneessen/go-mail/pull/528) - [@&#8203;srpvpn](https://redirect.github.com/srpvpn) made their first contribution in [#&#8203;512](https://redirect.github.com/wneessen/go-mail/pull/512) - [@&#8203;sblinch](https://redirect.github.com/sblinch) made their first contribution in [#&#8203;518](https://redirect.github.com/wneessen/go-mail/pull/518) - [@&#8203;UgurTheG](https://redirect.github.com/UgurTheG) made their first contribution in [#&#8203;543](https://redirect.github.com/wneessen/go-mail/pull/543) - [@&#8203;maxatome](https://redirect.github.com/maxatome) made their first contribution in [#&#8203;530](https://redirect.github.com/wneessen/go-mail/pull/530) - [@&#8203;christian-heusel](https://redirect.github.com/christian-heusel) made their first contribution in [#&#8203;517](https://redirect.github.com/wneessen/go-mail/pull/517) **Full Changelog**: <https://github.com/wneessen/go-mail/compare/v0.7.2...v0.7.3> </details> <details> <summary>gitlab-org/api/client-go (gitlab.com/gitlab-org/api/client-go/v2)</summary> ### [`v2.25.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.25.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.24.1...v2.25.0) #### 2.25.0 ##### 🚀 Features - feat: Add GraphQL API support for security attributes and categories ([!2856](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2856)) by [Caleb Madara](https://gitlab.com/calebmadara58) ##### 🔄 Other Changes - chore(deps): update dependency golangci-lint to v2.12.1 ([!2880](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2880)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - Resolve lint errors on `main` causing pipeline failures ([!2882](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2882)) by [Patrick Rice](https://gitlab.com/PatrickRice) - chore(deps): update dependency golangci-lint to v2.12.0 ([!2879](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2879)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.25.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.24.1...v2.25.0) (2026-05-11) ##### Features * Add GraphQL API support for security attributes and categories ([8496635](84966353d9)) </details> <details> <summary>cznic/sqlite (modernc.org/sqlite)</summary> ### [`v1.50.1`](https://gitlab.com/cznic/sqlite/compare/v1.50.0...v1.50.1) [Compare Source](https://gitlab.com/cznic/sqlite/compare/v1.50.0...v1.50.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: silverwind <me@silverwind.io>	2026-05-18 08:19:06 +00:00
Giteabot	3d95a2f028	fix(deps): update module github.com/google/go-github/v85 to v86 (#37754) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/google/go-github/v85](https://redirect.github.com/google/go-github) | `v85.0.0` → `v86.0.0` |  |  | --- ### Release Notes <details> <summary>google/go-github (github.com/google/go-github/v85)</summary> ### [`v86.0.0`](https://redirect.github.com/google/go-github/releases/tag/v86.0.0) [Compare Source](https://redirect.github.com/google/go-github/compare/v85.0.0...v86.0.0) This release contains the following breaking API changes: - feat!: Refactor request context ([#&#8203;4151](https://redirect.github.com/google/go-github/issues/4151)) BREAKING CHANGE: All internal calls now provide `Context` via the `Request` itself. - feat!: Add OIDC authentication support to `PrivateRegistries` ([#&#8203;4159](https://redirect.github.com/google/go-github/issues/4159)) BREAKING CHANGE: `PrivateRegistriesService` is updated to API version `2026-03-10` with struct and response changes. ...and the following additional changes: - chore: Bump version of `go-github` to `v86.0.0` ([#&#8203;4198](https://redirect.github.com/google/go-github/issues/4198)) - test: Fix invalid JSON payloads in actions workflow runs tests ([#&#8203;4197](https://redirect.github.com/google/go-github/issues/4197)) - feat: Add repo download contents sentinel errors ([#&#8203;4192](https://redirect.github.com/google/go-github/issues/4192)) - chore: Fix `otel` module name ([#&#8203;4187](https://redirect.github.com/google/go-github/issues/4187)) - feat: Add typed Copilot metrics download helpers ([#&#8203;4177](https://redirect.github.com/google/go-github/issues/4177)) - feat: Add `deploy_keys_enabled_for_repositories` and secret scanning custom link fields to `Organization` struct ([#&#8203;4188](https://redirect.github.com/google/go-github/issues/4188)) - refactor: Use `testJSONBody` helper for request body assertions in tests ([#&#8203;4183](https://redirect.github.com/google/go-github/issues/4183)) - build(deps): Bump github.com/getkin/kin-openapi from 0.135.0 to 0.137.0 in /tools ([#&#8203;4184](https://redirect.github.com/google/go-github/issues/4184)) - fix: Include `RetryAfter` in `AbuseRateLimitError.Error` output ([#&#8203;4181](https://redirect.github.com/google/go-github/issues/4181)) - fix: Handle string-typed reviewer `ID` in Ruleset API responses ([#&#8203;4178](https://redirect.github.com/google/go-github/issues/4178)) - feat: Add `ArchivedAt` field to `Organization` struct ([#&#8203;4179](https://redirect.github.com/google/go-github/issues/4179)) - feat: Add Copilot coding agent and content exclusion org endpoints ([#&#8203;4176](https://redirect.github.com/google/go-github/issues/4176)) - chore: Bump go-github from v84 to v85 in /scrape ([#&#8203;4174](https://redirect.github.com/google/go-github/issues/4174)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->	2026-05-18 06:18:58 +00:00
Giteabot	510b729212	fix(deps): update go dependencies (major) (#37639) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/dlclark/regexp2](https://redirect.github.com/dlclark/regexp2) | `v1.12.0` → `v2.0.1` |  |  | | [github.com/google/go-github/v84](https://redirect.github.com/google/go-github) | `v84.0.0` → `v85.0.0` |  |  | | [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) | `v1.46.0` → `v2.24.1` |  |  | --- ### Release Notes <details> <summary>dlclark/regexp2 (github.com/dlclark/regexp2)</summary> ### [`v2.0.1`](https://redirect.github.com/dlclark/regexp2/compare/v2.0.0...v2.0.1) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.0.0...v2.0.1) ### [`v2.0.0`](https://redirect.github.com/dlclark/regexp2/compare/v1.12.0...v2.0.0) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v1.12.0...v2.0.0) </details> <details> <summary>google/go-github (github.com/google/go-github/v84)</summary> ### [`v85.0.0`](https://redirect.github.com/google/go-github/releases/tag/v85.0.0) [Compare Source](https://redirect.github.com/google/go-github/compare/v84.0.0...v85.0.0) This release contains the following breaking API changes: - fix!: Resolve inconsistent options for `create` and `update` on custom org role ([#&#8203;4075](https://redirect.github.com/google/go-github/issues/4075)) BREAKING CHANGE: `GetOrgRole`, `CreateCustomOrgRole`, and `UpdateCustomOrgRole` have new params and return values. - fix!: Change `id` from `int64` to `string` in `ActivityService.MarkThreadDone` ([#&#8203;4056](https://redirect.github.com/google/go-github/issues/4056)) BREAKING CHANGE: `ActivityService.MarkThreadDone` accepts `string` `id` instead of `int64`. ...and the following additional changes: - chore: Bump version of go-github to v85.0.0 ([#&#8203;4173](https://redirect.github.com/google/go-github/issues/4173)) - chore: Update `openapi_operations.yaml` ([#&#8203;4172](https://redirect.github.com/google/go-github/issues/4172)) - security: Reject cross-host redirects to prevent Authorization leak ([#&#8203;4171](https://redirect.github.com/google/go-github/issues/4171)) - chore: Improve GitHub Actions workflows lint and testing ([#&#8203;4169](https://redirect.github.com/google/go-github/issues/4169)) - chore: Switch legacy redirect handling to new pattern ([#&#8203;4161](https://redirect.github.com/google/go-github/issues/4161)) - feat: Add `CodeSecurity` to `SecurityAndAnalysis` ([#&#8203;4155](https://redirect.github.com/google/go-github/issues/4155)) - fix: Reject URL path segments containing ".." in all request methods ([#&#8203;4150](https://redirect.github.com/google/go-github/issues/4150)) - feat: Refactor repositories download contents ([#&#8203;4153](https://redirect.github.com/google/go-github/issues/4153)) - chore: Bump google.org/x/tools to v0.44.0 in /tools ([#&#8203;4168](https://redirect.github.com/google/go-github/issues/4168)) - docs: Fix broken blog post link ([#&#8203;4160](https://redirect.github.com/google/go-github/issues/4160)) - build(deps): Bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 in /example ([#&#8203;4156](https://redirect.github.com/google/go-github/issues/4156)) - chore: Update openapi\_operations.yaml ([#&#8203;4157](https://redirect.github.com/google/go-github/issues/4157)) - feat: Remove Google App Engine standard support ([#&#8203;4152](https://redirect.github.com/google/go-github/issues/4152)) - feat: Add `DownloadCopilotMetrics` helper method ([#&#8203;4149](https://redirect.github.com/google/go-github/issues/4149)) - docs: Add `apiVersion` to GitHub API link ([#&#8203;4147](https://redirect.github.com/google/go-github/issues/4147)) - chore: Simplify `redundantptr` custom linter ([#&#8203;4148](https://redirect.github.com/google/go-github/issues/4148)) - docs: Deprecate old Copilot metrics endpoints closed on April 2, 2026 ([#&#8203;4137](https://redirect.github.com/google/go-github/issues/4137)) - refactor: Remove redundant `github.Ptr` calls ([#&#8203;4145](https://redirect.github.com/google/go-github/issues/4145)) - fix: Add missing `User` fields ([#&#8203;4146](https://redirect.github.com/google/go-github/issues/4146)) - fix: Preserve `Marketplace.Stubbed` during client copy ([#&#8203;4144](https://redirect.github.com/google/go-github/issues/4144)) - refactor: Simplify array copying ([#&#8203;4143](https://redirect.github.com/google/go-github/issues/4143)) - build(deps): Bump golang.org/x/crypto from 0.49.0 to 0.50.0 in /example ([#&#8203;4141](https://redirect.github.com/google/go-github/issues/4141)) - build(deps): Bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 in /tools ([#&#8203;4142](https://redirect.github.com/google/go-github/issues/4142)) - build(deps): Bump golang.org/x/term from 0.41.0 to 0.42.0 in /example ([#&#8203;4140](https://redirect.github.com/google/go-github/issues/4140)) - build(deps): Bump golang.org/x/net from 0.52.0 to 0.53.0 in /scrape ([#&#8203;4139](https://redirect.github.com/google/go-github/issues/4139)) - build(deps): Bump go.opentelemetry.io/otel to v1.43.0 ([#&#8203;4135](https://redirect.github.com/google/go-github/issues/4135)) - fix: Expand `sanitizeURL` secrets redactions ([#&#8203;4126](https://redirect.github.com/google/go-github/issues/4126)) - build(deps): Bump github.com/alecthomas/kong from 1.14.0 to 1.15.0 in /tools ([#&#8203;4132](https://redirect.github.com/google/go-github/issues/4132)) - build(deps): Bump actions/setup-go from 6.3.0 to 6.4.0 in the actions group ([#&#8203;4131](https://redirect.github.com/google/go-github/issues/4131)) - feat: Add support for custom names and methods that return structs with multiple `[]*T` fields in `gen-iterators.go` ([#&#8203;4128](https://redirect.github.com/google/go-github/issues/4128)) - fix: Limit webhook payload size in `ValidatePayloadFromBody` ([#&#8203;4125](https://redirect.github.com/google/go-github/issues/4125)) - build(deps): Bump codecov/codecov-action from 5.5.3 to 6.0.0 ([#&#8203;4123](https://redirect.github.com/google/go-github/issues/4123)) - fix: Synchronize `requestCount` in rate limit tests ([#&#8203;4124](https://redirect.github.com/google/go-github/issues/4124)) - chore: Simplify `generate.sh` by removing `git worktree` and using generator-based check ([#&#8203;4120](https://redirect.github.com/google/go-github/issues/4120)) - docs: Improve comments in /examples ([#&#8203;4122](https://redirect.github.com/google/go-github/issues/4122)) - chore: Use `golangci-lint-action`; remove `newreposecretwithlibsodium` ([#&#8203;4119](https://redirect.github.com/google/go-github/issues/4119)) - feat: Add custom image endpoints for GitHub-hosted runners ([#&#8203;4101](https://redirect.github.com/google/go-github/issues/4101)) - chore: Cache custom golangci-lint binaries in GHA workflow ([#&#8203;4116](https://redirect.github.com/google/go-github/issues/4116)) - build(deps): Bump github.com/ProtonMail/go-crypto from 1.4.0 to 1.4.1 in /example ([#&#8203;4115](https://redirect.github.com/google/go-github/issues/4115)) - build(deps): Bump golang.org/x/tools from 0.29.0 to 0.43.0 in /tools/extraneous-new ([#&#8203;4114](https://redirect.github.com/google/go-github/issues/4114)) - build(deps): Bump codecov/codecov-action from 5.5.2 to 5.5.3 ([#&#8203;4112](https://redirect.github.com/google/go-github/issues/4112)) - build(deps): Bump github.com/golangci/plugin-module-register from 0.1.1 to 0.1.2 in /tools/extraneous-new ([#&#8203;4113](https://redirect.github.com/google/go-github/issues/4113)) - build(deps): Bump github.com/getkin/kin-openapi from 0.133.0 to 0.134.0 in /tools ([#&#8203;4111](https://redirect.github.com/google/go-github/issues/4111)) - build(deps): Bump github.com/PuerkitoBio/goquery from 1.11.0 to 1.12.0 in /scrape ([#&#8203;4110](https://redirect.github.com/google/go-github/issues/4110)) - chore: Upgrade deps for linters using dependabot ([#&#8203;4107](https://redirect.github.com/google/go-github/issues/4107)) - chore: Use `structfield.Settings` in `check-structfield-settings` ([#&#8203;4108](https://redirect.github.com/google/go-github/issues/4108)) - build(deps): Bump google.golang.org/grpc from 1.78.0 to 1.79.3 in /example ([#&#8203;4109](https://redirect.github.com/google/go-github/issues/4109)) - chore: Remove unnecessary use of `new` and `&SomeStruct{}` and add new `extraneousnew` custom linter ([#&#8203;4106](https://redirect.github.com/google/go-github/issues/4106)) - feat: Add `NetworkConfigurationID` and `HostedRunnersURL` to enterprise runner group types ([#&#8203;4099](https://redirect.github.com/google/go-github/issues/4099)) - feat: Generate accessors for all fields ([#&#8203;4105](https://redirect.github.com/google/go-github/issues/4105)) - feat: Add `ListRunnerGroupHostedRunners` for org runner groups ([#&#8203;4100](https://redirect.github.com/google/go-github/issues/4100)) - chore: Enable `default: none` linters; remove duplicated ([#&#8203;4097](https://redirect.github.com/google/go-github/issues/4097)) - fix: Use `Cursor` pagination for `*.ListHookDeliveriesIter` ([#&#8203;4096](https://redirect.github.com/google/go-github/issues/4096)) - chore: Remove duplicated formatters ([#&#8203;4094](https://redirect.github.com/google/go-github/issues/4094)) - chore: Fix typos in comments and tests ([#&#8203;4093](https://redirect.github.com/google/go-github/issues/4093)) - chore: Fix typo in CONTRIBUTING.md ([#&#8203;4092](https://redirect.github.com/google/go-github/issues/4092)) - chore: Update openapi\_operations.yaml ([#&#8203;4091](https://redirect.github.com/google/go-github/issues/4091)) - build(deps): Bump github.com/bradleyfalzon/ghinstallation/v2 from 2.17.0 to 2.18.0 in /example ([#&#8203;4084](https://redirect.github.com/google/go-github/issues/4084)) - chore: Bump go.opentelemetry.io/otel to v1.42.0 ([#&#8203;4090](https://redirect.github.com/google/go-github/issues/4090)) - build(deps): Bump golang.org/x/crypto from 0.48.0 to 0.49.0 in /example ([#&#8203;4081](https://redirect.github.com/google/go-github/issues/4081)) - build(deps): Bump golang.org/x/sync from 0.19.0 to 0.20.0 in /tools ([#&#8203;4078](https://redirect.github.com/google/go-github/issues/4078)) - build(deps): Bump golang.org/x/net from 0.51.0 to 0.52.0 in /scrape ([#&#8203;4079](https://redirect.github.com/google/go-github/issues/4079)) - test: Add fuzz test for `ParseWebHook` ([#&#8203;4076](https://redirect.github.com/google/go-github/issues/4076)) - feat: Add enterprise budgets API ([#&#8203;4069](https://redirect.github.com/google/go-github/issues/4069)) - feat: Add list organization fine-grained permissions ([#&#8203;4072](https://redirect.github.com/google/go-github/issues/4072)) - feat: Make `script/lint.sh` output simpler to read ([#&#8203;4073](https://redirect.github.com/google/go-github/issues/4073)) - chore: Speed up linting ([#&#8203;4071](https://redirect.github.com/google/go-github/issues/4071)) - build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.41.0 in /otel ([#&#8203;4065](https://redirect.github.com/google/go-github/issues/4065)) - build(deps): Bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 in /otel ([#&#8203;4068](https://redirect.github.com/google/go-github/issues/4068)) - build(deps): Bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.40.0 to 1.41.0 in /example ([#&#8203;4062](https://redirect.github.com/google/go-github/issues/4062)) - build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.41.0 in /example ([#&#8203;4064](https://redirect.github.com/google/go-github/issues/4064)) - build(deps): Bump github.com/ProtonMail/go-crypto from 1.3.0 to 1.4.0 in /example ([#&#8203;4063](https://redirect.github.com/google/go-github/issues/4063)) - feat: Add `client_id` field to `App` ([#&#8203;4060](https://redirect.github.com/google/go-github/issues/4060)) - test: Simplify `CopilotService` tests ([#&#8203;4058](https://redirect.github.com/google/go-github/issues/4058)) - test: Fix flaky `TestDo_rateLimit_abuseRateLimitError_xRateLimitReset` ([#&#8203;4057](https://redirect.github.com/google/go-github/issues/4057)) - feat: Add support for enterprise audit log streaming API ([#&#8203;4035](https://redirect.github.com/google/go-github/issues/4035)) - feat: Add repository-level immutable releases settings ([#&#8203;4039](https://redirect.github.com/google/go-github/issues/4039)) - chore: Add `SAS` as a common initialism to `structfield` ([#&#8203;4054](https://redirect.github.com/google/go-github/issues/4054)) - fix: Fix data race on Windows ([#&#8203;4051](https://redirect.github.com/google/go-github/issues/4051)) - docs: Fix grammar in `README.md` ([#&#8203;4053](https://redirect.github.com/google/go-github/issues/4053)) - chore: Simplify form value assertions in tests ([#&#8203;4048](https://redirect.github.com/google/go-github/issues/4048)) - chore: Bump go-github from v83 to v84 in /scrape ([#&#8203;4050](https://redirect.github.com/google/go-github/issues/4050)) </details> <details> <summary>gitlab-org/api/client-go (gitlab.com/gitlab-org/api/client-go)</summary> ### [`v2.24.1`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.24.1) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.24.0...v2.24.1) #### 2.24.1 ##### 🐛 Bug Fixes - fix: add FormattedText field to OrbitGraphStatus and OrbitStatus ([!2876](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2876)) by [Dmitry Gruzd](https://gitlab.com/dgruzd) #### [2.24.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.24.0...v2.24.1) (2026-05-05) ##### Bug Fixes * add FormattedText field to OrbitGraphStatus and OrbitStatus ([9457ddc](9457ddc690)) ### [`v2.24.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.24.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.23.0...v2.24.0) #### 2.24.0 ##### 🚀 Features - feat: Add search_type as attribute to search endpoints ([!2851](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2851)) by [Heidi Berry](https://gitlab.com/heidi.berry) ### [2.24.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.23.0...v2.24.0) (2026-05-04) ##### Features * Add search_type as attribute to search endpoints ([4d345e9](4d345e9f76)) ### [`v2.23.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.23.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.22.0...v2.23.0) #### 2.23.0 ##### 🚀 Features - feat: add OrbitService for Knowledge Graph endpoints ([!2870](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2870)) by [Dmitry Gruzd](https://gitlab.com/dgruzd) ##### 🔄 Other Changes - chore(deps): update module buf.build/go/protovalidate to v1.2.0 ([!2865](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2865)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.23.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.22.0...v2.23.0) (2026-05-04) ##### Features * add OrbitService for Knowledge Graph endpoints ([2ff460f](2ff460f3a8)) ### [`v2.22.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.22.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.21.0...v2.22.0) #### 2.22.0 ##### 🚀 Features - Add package pipeline data. ([!2834](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2834)) by [Jimmy Spagnola](https://gitlab.com/jspagnola) ##### 🔄 Other Changes - chore(deps): update module golang.org/x/text to v0.36.0 ([!2874](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2874)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update golang docker tag ([!2873](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2873)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update docker docker tag to v29.4.1 ([!2869](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2869)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - refactor(no-release): use HTTP status code constants ([!2868](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2868)) by [Oleksandr Redko](https://gitlab.com/alexandear) ### [2.22.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.21.0...v2.22.0) (2026-05-04) ### [`v2.21.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.21.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.1...v2.21.0) #### 2.21.0 ##### 🚀 Features - Add BulkImports API functions and tests ([!2846](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2846)) by [Kalyaan Kanugula](https://gitlab.com/kalyaan09) ##### 🔄 Other Changes - Add missing `URLVariables` attribute to group_hooks ([!2866](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2866)) by [Mark Nessen](https://gitlab.com/mness) - docs: fix incorrect phrase 'to that' -> 'so' ([!2861](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2861)) by [Bob Singh](https://gitlab.com/bobsingh.dev) - docs: fix missing 'of' in contributing guide ([!2860](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2860)) by [Bob Singh](https://gitlab.com/bobsingh.dev) - style: remove duplicated wording in Go version sentence ([!2859](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2859)) by [Bob Singh](https://gitlab.com/bobsingh.dev) ### [2.21.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.1...v2.21.0) (2026-04-27) ### [`v2.20.1`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#2210-2026-04-27) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.0...v2.20.1) #### 2.20.1 ##### 🐛 Bug Fixes - Fix potential panic in MergeRequest.UnmarshalJSON label detail loop ([!2858](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2858)) by [Zubeen](https://gitlab.com/syedzubeen) #### [2.20.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.0...v2.20.1) (2026-04-20) #### 2.20.0 ##### 🚀 Features - Add missing system hook api options ([!2847](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2847)) by [Zack Knight](https://gitlab.com/zachkknowbe4) ##### 🔄 Other Changes - chore(deps): update docker docker tag to v29.4.0 ([!2854](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2854)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update module github.com/google/cel-go to v0.28.0 ([!2855](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2855)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [`v2.20.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#2210-2026-04-27) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.19.0...v2.20.0) #### 2.20.1 ##### 🐛 Bug Fixes - Fix potential panic in MergeRequest.UnmarshalJSON label detail loop ([!2858](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2858)) by [Zubeen](https://gitlab.com/syedzubeen) #### [2.20.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.0...v2.20.1) (2026-04-20) #### 2.20.0 ##### 🚀 Features - Add missing system hook api options ([!2847](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2847)) by [Zack Knight](https://gitlab.com/zachkknowbe4) ##### 🔄 Other Changes - chore(deps): update docker docker tag to v29.4.0 ([!2854](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2854)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update module github.com/google/cel-go to v0.28.0 ([!2855](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2855)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [`v2.19.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.19.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.18.0...v2.19.0) #### 2.19.0 ##### 🚀 Features - feat: Add PackageRegistryAccessLevel to Project structs ([!2852](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2852)) by [Caleb Madara](https://gitlab.com/calebmadara58) ### [2.19.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.18.0...v2.19.0) (2026-04-15) ##### Features * Add PackageRegistryAccessLevel to Project structs ([4ce63da](4ce63da952)) ### [`v2.18.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.18.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.17.0...v2.18.0) #### 2.18.0 ##### 🚀 Features - Feat: Add support for application setting secret_push_protection_available ([!2849](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2849)) by [Rizart Dona](https://gitlab.com/rizart_d) ##### 🔄 Other Changes - fix: Correct Example Section in README ([!2850](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2850)) by [Jonathan Bowe](https://gitlab.com/boweflex) ### [2.18.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.17.0...v2.18.0) (2026-04-14) ##### Bug Fixes * Correct Example Section in README ([c0759d9](c0759d99b2)) ### [`v2.17.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.17.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.16.0...v2.17.0) #### 2.17.0 ##### 🚀 Features - Resolve "Add endpoint support for archiving/unarchiving groups" ([!2848](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2848)) by [Jonathan Bowe](https://gitlab.com/boweflex) ##### 🔄 Other Changes - chore(deps): update docker docker tag to v29.3.1 ([!2841](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2841)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(no-release): enable gocritic linter ([!2842](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2842)) by [Oleksandr Redko](https://gitlab.com/alexandear) - chore(deps): update module golang.org/x/oauth2 to v0.36.0 ([!2835](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2835)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update module golang.org/x/text to v0.35.0 ([!2837](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2837)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.17.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.16.0...v2.17.0) (2026-04-10) ### [`v2.16.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.16.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.15.0...v2.16.0) #### 2.16.0 ##### 🚀 Features - feat: Add PagesUniqueDomainDefaultEnabled to Settings API ([!2845](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2845)) by [Mohamed Mongy](https://gitlab.com/mohamedmongy96) ### [2.16.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.15.0...v2.16.0) (2026-04-04) ##### Features * Add PagesUniqueDomainDefaultEnabled to Settings API ([d27f3af](d27f3af69a)) ### [`v2.15.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.15.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.14.0...v2.15.0) #### 2.15.0 ##### 🚀 Features - feat: Add approved_at field in merge request approvals API ([!2844](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2844)) by [Mohamed Asan N](https://gitlab.com/hassyyy) ### [2.15.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.14.0...v2.15.0) (2026-04-04) ##### Features * Add approved_at field in merge request approvals API ([528ac9e](528ac9ea36)) ### [`v2.14.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.14.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.13.0...v2.14.0) #### 2.14.0 ##### 🚀 Features - feat: add support for DisablePasswordAuthenticationForUsersWithSSOIdentities... ([!2839](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2839)) by [Lorenz Vonlanthen](https://gitlab.com/loelu) ### [2.14.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.13.0...v2.14.0) (2026-04-03) ##### Features * add support for DisablePasswordAuthenticationForUsersWithSSOIdentities... ([6b88f05](6b88f05609)) ### [`v2.13.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.13.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.12.0...v2.13.0) #### 2.13.0 ##### 🚀 Features - feat: Added WithAuthSourceStrategy option to allow configuring multiple token source priority ([!2815](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2815)) by [Павлов Александр](https://gitlab.com/alexpts) ### [2.13.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.12.0...v2.13.0) (2026-04-01) ##### Features * Added WithAuthSourceStrategy option to allow configuring multiple token source priority ([2261c80](2261c80c28)) ### [`v2.12.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.12.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.11.0...v2.12.0) #### 2.12.0 ##### 🚀 Features - fix: update HostKey field name to FingerprintSHA256 for consistency ([!2840](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2840)) by [Oleksandr Redko](https://gitlab.com/alexandear) - Add push mirror host_keys to the go client. ([!2832](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2832)) by [Jimmy Spagnola](https://gitlab.com/jspagnola) ##### 🔄 Other Changes - Fix: improve URL validation warning logging context and correct typo ([!2830](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2830)) by [Bob Singh](https://gitlab.com/bobsingh.dev) - chore(no-release): fix typos in comments and unexported function ([!2831](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2831)) by [Oleksandr Redko](https://gitlab.com/alexandear) ### [2.12.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.11.0...v2.12.0) (2026-04-01) ##### Bug Fixes * update HostKey field name to FingerprintSHA256 for consistency ([1b7fcfb](1b7fcfb0ed)) ### [`v2.11.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.11.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.10.0...v2.11.0) #### 2.11.0 ##### 🚀 Features - Deprecate project approval password auth, add reauth to approve ([!2825](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2825)) by [Heidi Berry](https://gitlab.com/heidi.berry) ##### 🔄 Other Changes - Fix typo in UpdateLabel comment ([!2827](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2827)) by [Bob Singh](https://gitlab.com/bobsingh.dev) - Fix runner comment typo ([!2828](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2828)) by [Bob Singh](https://gitlab.com/bobsingh.dev) ### [2.11.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.10.0...v2.11.0) (2026-03-30) ### [`v2.10.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#1380-2026-02-19) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.9.0...v2.10.0) ##### Features - **events:** Add missing parameters for label operations and update documentation links ([11b9f08](11b9f08b37)) - **labels:** add missing params and edit links ([ec1b92b](ec1b92bff4)) #### 1.37.0 ##### 🚀 Features - Support system & system\_action fields for merge event attributes ([!2737](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2737)) by [Artem Mikheev](https://gitlab.com/renbou) ##### 🔄 Other Changes - Update links of geo\_sites.go ([!2782](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2782)) by [Mohamed Mongy](https://gitlab.com/mohamedmongy96) - chore(deps): update dependency golangci-lint to v2.10.1 ([!2770](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2770)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update golangci/golangci-lint docker tag to v2.10.1 ([!2771](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2771)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update golangci/golangci-lint docker tag to v2.10.0 ([!2769](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2769)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update dependency golangci-lint to v2.10.0 ([!2768](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2768)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [`v2.9.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#1330-2026-02-13) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.8.0...v2.9.0) #### 1.32.0 ##### 🚀 Features - Implement endpoints for runner controller scopes ([!2758](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2758)) by [Timo Furrer](https://gitlab.com/timofurrer) ##### 🔄 Other Changes - test(namespaces): Address test feedback to simplify the test ([!2744](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2744)) by [Patrick Rice](https://gitlab.com/PatrickRice) - chore(deps): update golangci/golangci-lint docker tag to v2.9.0 ([!2755](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2755)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update dependency golangci-lint to v2.9.0 ([!2754](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2754)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [`v2.8.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#1130-2026-01-12) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.7.0...v2.8.0) ##### Features - **groups:** add Active parameter to ListGroupProjects ([dec511a](dec511a199)) #### 1.12.0 ##### 🚀 Features - feat: add EmojiEvents field support to Project Webhooks ([!2653](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2653)) by [Yugan](https://gitlab.com/yugannkt) ##### 🔄 Other Changes - chore(deps): update dependency golangci-lint to v2.8.0 ([!2650](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2650)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - refactor(no-release): use errors.New instead of fmt.Errorf ([!2644](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2644)) by [Oleksandr Redko](https://gitlab.com/alexandear) ### [`v2.7.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#170-2025-12-06) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.6.0...v2.7.0) ##### Features - **users:** Add support for a user to see only one file diff per page ([e2a9e09](e2a9e09e79)) #### 1.6.0 ##### 🚀 Features - feat: add admin compliance policy settings API ([!2610](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2610)) by [Hannes Lange](https://gitlab.com/hlange4) ##### 🔄 Other Changes - doc: fix typo ([!2603](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2603)) by [Guilhem Bonnefille](https://gitlab.com/gbonnefille) - chore(deps): update golangci/golangci-lint docker tag to v2.7.1 ([!2611](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2611)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update docker docker tag to v29.1.2 ([!2609](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2609)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update golangci/golangci-lint docker tag to v2.7.0 ([!2608](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2608)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [`v2.6.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#01590-2025-11-04) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.5.0...v2.6.0) ##### Features - **integrations:** add group integration API endpoints for Jira ([09e18ee](09e18ee598)) #### 0.158.0 ##### 🚀 Features - Add support to send variables for GraphQL queries ([!2562](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2562)) by [rafasf](https://gitlab.com/rafasf) ##### 🔄 Other Changes - chore(deps): update module cel.dev/expr to v0.25.0 ([!2560](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2560)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(no-release): standardize GitLab name capitalization ([!2551](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2551)) by [Zubeen](https://gitlab.com/syedzubeen) - chore(deps): update golangci/golangci-lint docker tag to v2.6.0 ([!2558](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2558)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - refactor: moved comments to interface 2 ([!2557](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2557)) by [Zubeen](https://gitlab.com/syedzubeen) - refactor: moved comments to interface ([!2556](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2556)) by [Zubeen](https://gitlab.com/syedzubeen) - refactor(test): avoid panic in tests with goroutines ([!2553](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2553)) by [Oleksandr Redko](https://gitlab.com/alexandear) ### [`v2.5.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.5.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.4.0...v2.5.0) #### 2.5.0 ##### 🚀 Features - feat(workitems): Implement `UpdateWorkItem()` ([!2793](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2793)) by [Carlos Corona](https://gitlab.com/ccorona2) ##### 🔄 Other Changes - chore(deps): update dependency golangci-lint to v2.11.2 ([!2810](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2810)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - test(no-release): replace reflect.DeepEqual with testify ([!2809](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2809)) by [Oleksandr Redko](https://gitlab.com/alexandear) - feat: allow OAuth success callback page to self-close when possible ([!2808](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2808)) by [Case Taintor](https://gitlab.com/case.taintor) - chore(deps): update dependency golangci-lint to v2.11.1 ([!2806](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2806)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.5.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.4.0...v2.5.0) (2026-03-09) ##### Features * allow OAuth success callback page to self-close when possible ([dca2e12](dca2e12095)) * **workitems:** Implement `UpdateWorkItem()` ([b93a55e](b93a55e316)) ### [`v2.4.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.4.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.3.0...v2.4.0) #### 2.4.0 ##### 🚀 Features - Reflect latest runner controller API changes ([!2803](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2803)) by [Timo Furrer](https://gitlab.com/timofurrer) ##### 🔄 Other Changes - chore(deps): update docker docker tag to v29.3.0 ([!2804](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2804)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.4.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.3.0...v2.4.0) (2026-03-06) ### [`v2.3.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.3.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.1...v2.3.0) #### 2.3.0 ##### 🚀 Features - feat: add new endpoint for fetching all the runner manager information ([!2802](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2802)) by [Aayush](https://gitlab.com/Aayush-Saini) ### [2.3.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.1...v2.3.0) (2026-03-05) ##### Features * add new endpoint for fetching all the runner manager information ([d4755b7](d4755b7966)) ### [`v2.2.1`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#230-2026-03-05) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.0...v2.2.1) ##### Features - add new endpoint for fetching all the runner manager information ([d4755b7](d4755b7966)) #### 2.2.1 ##### 🐛 Bug Fixes - fix: Add `/v2` suffix to module path. ([!2801](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2801)) by [Florian Forster](https://gitlab.com/fforster) #### [2.2.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.0...v2.2.1) (2026-03-04) ##### Bug Fixes - Add `/v2` suffix to module path. ([4237f6a](4237f6aa29)), closes [#&#8203;2239](https://gitlab.com/gitlab-org/api/client-go/issues/2239) #### 2.2.0 ##### 🚀 Features - feat(workitems): Implement `CreateWorkItem()`. ([!2751](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2751)) by [Florian Forster](https://gitlab.com/fforster) ### [`v2.2.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#230-2026-03-05) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.1.0...v2.2.0) ##### Features - add new endpoint for fetching all the runner manager information ([d4755b7](d4755b7966)) #### 2.2.1 ##### 🐛 Bug Fixes - fix: Add `/v2` suffix to module path. ([!2801](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2801)) by [Florian Forster](https://gitlab.com/fforster) #### [2.2.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.0...v2.2.1) (2026-03-04) ##### Bug Fixes - Add `/v2` suffix to module path. ([4237f6a](4237f6aa29)), closes [#&#8203;2239](https://gitlab.com/gitlab-org/api/client-go/issues/2239) #### 2.2.0 ##### 🚀 Features - feat(workitems): Implement `CreateWorkItem()`. ([!2751](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2751)) by [Florian Forster](https://gitlab.com/fforster) ### [`v2.1.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.1.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.0.0...v2.1.0) #### 2.1.0 ##### 🚀 Features - feat(workitems): Add more fields to WorkItem ([!2795](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2795)) by [Florian Forster](https://gitlab.com/fforster) ##### 🔄 Other Changes - Implement body preserver to enable HTTP response body streaming ([!2746](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2746)) by [Timo Furrer](https://gitlab.com/timofurrer) ### [2.1.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.0.0...v2.1.0) (2026-03-03) ##### Features * **workitems:** Add more fields to WorkItem ([7088f6f](7088f6f229)) ### [`v2.0.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.0.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v1.46.0...v2.0.0) #### 2.0.0 ##### 💥 Breaking Changes - Release client-go 2.0 ([!2763](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2763)) by [Patrick Rice](https://gitlab.com/PatrickRice) ##### 🔄 Other Changes - Addtl 2 0 changes ([!2796](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2796)) by [Patrick Rice](https://gitlab.com/PatrickRice) ### [2.0.0](https://gitlab.com/gitlab-org/api/client-go/compare/v1.46.0...v2.0.0) (2026-03-02) * Release client-go 2.0 ([47b65ee](47b65ee907)) ##### Bug Fixes * **ci:** update gocover-cobertura to v1.4.0 for Go 1.24+ compatibility ([1d03b20](1d03b20802)) * **group_members:** using ISOTime instead of time.Time for BillableUserMembership.ExpiresAt ([e7e58c6](e7e58c69c1)) * package protection access level variable type ([5574bbb](5574bbbf2f)) * **workitems:** Handle absent status widget in `WorkItem`. ([859fb26](859fb26f28)) ##### Features * use Nullable[int64] for label priority ([096ed09](096ed098d1)) ##### BREAKING CHANGES * Release 2.0 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>	2026-05-11 07:00:29 +00:00
Giteabot	e1f0f9e896	fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0 (#37637) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | code.gitea.io/sdk/gitea | `v0.24.1` → `v0.25.0` |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->	2026-05-11 06:11:28 +02:00
techknowlogick	ef040c5fc4	chore(deps): bump go-git/go-git/v5 to 5.19.0 (#37608) ... Co-authored-by: Nicolas <bircni@icloud.com>	2026-05-08 19:11:13 +00:00
Giteabot	243c2d7146	chore(deps): update dependency go to v1.26.3 (#37601) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [go](https://go.dev/) ([source](https://redirect.github.com/golang/go)) | golang | patch | `1.26.2` → `1.26.3` | --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->	2026-05-08 05:27:24 +00:00
wxiaoguang	a39af1a829	refactor: use modernc sqlite driver as default (#37562) ... The mattn driver is still kept, can be enabled by TAGS="sqlite_mattn sqlite_unlock_notify" --------- Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>	2026-05-06 18:57:59 +00:00
Giteabot	35dfc6b9e1	fix(deps): update go dependencies (#37541) ... Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Nicolas <bircni@icloud.com>	2026-05-06 06:58:09 +00:00
silverwind	97211bf0c5	refactor(deps): migrate from nektos/act fork to gitea/runner (#37557) ... Migrate to https://gitea.com/gitea/runner/releases/tag/v1.0.0 which includes the `act` package directory previously referenced by `nektos/act`. Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-05-06 05:54:31 +02:00
Sebastian Ertz	89a49de0fd	Update go js py dependencies (#37525) ... | go | from | to | | --- | --- | --- | | connectrpc.com/connect | `1.19.1 ` | `1.19.2` | | github.com/Azure/go-ntlmssp | `0.1.0` | `0.1.1` | | github.com/alecthomas/chroma/v2 | `2.23.1` | `2.24.1` | | github.com/aws/aws-sdk-go-v2/credentials | `1.19.15` | `1.19.16` | | github.com/aws/aws-sdk-go-v2/service/codecommit | `1.33.13` | `1.33.14` | | github.com/blevesearch/bleve/v2 | `2.5.7` | `2.6.0` | | github.com/caddyserver/certmagic | `0.25.2` | `0.25.3` | | github.com/fsnotify/fsnotify | `1.9.0` | `1.10.1` | | github.com/getkin/kin-openapi | `0.134.0` | `0.137.0` | | github.com/go-co-op/gocron/v2 | `2.21.0` | `2.21.1` | | github.com/go-sql-driver/mysql | `1.9.3` | `1.10.0` | | github.com/go-webauthn/webauthn | `0.16.5` | `0.17.2` | | github.com/klauspost/compress | `1.18.5` | `1.18.6` | | github.com/mattn/go-isatty | `0.0.21` | `0.0.22` | | github.com/mattn/go-sqlite3 | `1.14.42` | `1.14.44` | | github.com/minio/minio-go/v7 | `7.0.100` | `7.1.0` | | github.com/redis/go-redis/v9 | `9.18.0` | `9.19.0` | | google.golang.org/grpc | `1.80.0` | `1.81.0` | | gopkg.in/ini.v1 | `1.67.1` | `1.67.2` | | js | from | to | | --- | --- | --- | | @codemirror/search | `6.6.0` | `6.7.0` | | @primer/octicons | `19.24.1` | `19.25.0` | | clippie | `4.1.14` | `4.1.15` | | easymde | `2.20.0` | `2.21.0` | | postcss | `8.5.10` | `8.5.13` | | rolldown-license-plugin | `3.0.1` | `3.0.4` | | swagger-ui-dist | `5.32.4` | `5.32.5` | | vite | `8.0.9` | `8.0.10` | | vite-string-plugin | `2.0.2` | `2.0.4` | | vue | `3.5.32` | `3.5.33` | | @typescript-eslint/parser | `8.59.0` | `8.59.1` | | eslint | `10.2.1` | `10.3.0` | | eslint-plugin-vue | `10.8.0` | `10.9.0` | | globals | `17.5.0` | `17.6.0` | | material-icon-theme | `5.33.1` | `5.34.0` | | spectral-cli-bundle | `1.0.7` | `1.0.8` | | stylelint | `17.8.0` | `17.10.0` | | typescript-eslint | `8.59.0` | `8.59.1` | | updates | `17.16.3` | `17.16.8` | | vitest | `4.1.4` | `4.1.5` | | vue-tsc | `3.2.7` | `3.2.8` | | pnpm | `10.33.0` | `10.33.2` | | py | from | to | | --- | --- | --- | | click | `8.3.2` | `8.3.3` | | pathspec | `1.0.4` | `1.1.1` | --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>	2026-05-04 19:27:47 +00:00
silverwind	abcfa53040	Replace olivere/elastic with REST API client, add OpenSearch support (#37411) ... Drops `github.com/olivere/elastic/v7` (unmaintained) and replaces it with a small in-house wrapper that speaks the Elasticsearch REST API directly via `net/http`. The subset used by Gitea (`_cluster/health`, `_bulk`, `_doc`, `_delete_by_query`, `_refresh`, `_search`, `HEAD`/`PUT` index) is stable across the targeted servers, so no client library is needed. **Targets tested** - Elasticsearch 7, 8, 9 - OpenSearch 1, 2, 3 **Why not `go-elasticsearch`?** The official client enforces an `X-Elastic-Product` server-identity check that OpenSearch deliberately fails, which would force shipping a transport shim to defeat it. Going direct over `net/http` removes that fight along with several MB of transitive deps (`elastic-transport-go`, `go.opentelemetry.io/otel{,/metric,/trace}`, `auto/sdk`, `easyjson`, `intern`, `logr`, `stdr`). Replaces: #30755 Fixes: https://github.com/go-gitea/gitea/issues/30752 --- This PR was written with the help of Claude Opus 4.7 --------- Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>	2026-05-02 00:12:54 +02:00
Myers Carpenter	9e031eb3df	Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038) ... Add a build-time conversion step that transforms the existing Swagger 2.0 spec into an OpenAPI 3.0 spec. The OAS3 spec is served alongside the existing Swagger 2.0 spec, enabling API clients that require OAS3 to generate code directly from Gitea's API. This is not to be an answer to how gitea handles OAS3 long term, but a way to use what we have to move a step forward. --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-29 20:47:52 +08:00
Sebastian Ertz	3f3bebda0d	Update go js dependencies (#37312) ... | go | from | to | | --- | --- | --- | | github.com/aws/aws-sdk-go-v2/credentials | `1.19.14` | `1.19.15` | | github.com/aws/aws-sdk-go-v2/service/codecommit | `1.33.12` | `1.33.13` | | github.com/dlclark/regexp2 | `1.11.5` | `1.12.0` | | github.com/go-co-op/gocron/v2 | `2.20.0` | `2.21.0` | | github.com/go-webauthn/webauthn | `0.16.4` | `0.16.5` | | js | from | to | | --- | --- | --- | | @codemirror/view | `6.41.0` | `6.41.1` | | @primer/octicons | `19.24.0` | `19.24.1` | | clippie | `4.1.10` | `4.1.14` | | postcss | `8.5.9` | `8.5.10` | | rolldown-license-plugin | `2.2.5` | `3.0.1` | | swagger-ui-dist | `5.32.2` | `5.32.4` | | vite | `8.0.8` | `8.0.9` | | @typescript-eslint/parser | `8.58.2` | `8.59.0` | | @vitest/eslint-plugin | `1.6.15` | `1.6.16` | | eslint | `10.2.0` | `10.2.1` | | eslint-plugin-playwright | `2.10.1` | `2.10.2` | | eslint-plugin-sonarjs | `4.0.2` | `4.0.3` | | happy-dom | `20.8.9` | `20.9.0` | | stylelint | `17.7.0` | `17.8.0` | | typescript | `6.0.2` | `6.0.3` | | typescript-eslint | `8.58.2` | `8.59.0` | | updates | `17.15.3` | `17.15.5` | | vue-tsc | `3.2.6` | `3.2.7` | Co-authored-by: Nicolas <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: silverwind <silv3rwind@gmail.com> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>	2026-04-20 22:32:45 +00:00
silverwind	98202110be	Upgrade go-git to v5.18.0 (#37268) ... Fixes GHSA-3xc5-wrhm-f963 (credential exposure on HTTP redirects). --- This PR was written with the help of Claude Opus 4.6 Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>	2026-04-18 08:49:40 +00:00
silverwind	a9108ab6aa	Replace custom Go formatter with golangci-lint fmt (#37194) ... Use `golangci-lint fmt` to format code, replacing the previous custom formatter tool. https://github.com/daixiang0/gci is used to order the imports. `make fmt` performs ~13% faster while consuming ~57% less cpu while formatting for me. `GOFUMPT_PACKAGE` is gone because it's using the builtin package from golangci-lint. Co-authored-by: Claude (claude-opus-4-6) <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-17 17:45:22 +00:00
wxiaoguang	b9961e193d	Fix corrupted JSON caused by goccy library (#37214) ... Fix #37211	2026-04-14 14:00:20 +00:00
Sebastian Ertz	b55528b1a2	Update go js py dependencies (#37204) ... | go | from | to | | --- | --- | --- | | github.com/go-webauthn/webauthn | `0.16.3` | `0.16.4` | | github.com/meilisearch/meilisearch-go | `0.36.1` | `0.36.2` | | golang.org/x/crypto | `0.49.0` | `0.50.0` | | golang.org/x/image | `0.38.0` | `0.39.0` | | golang.org/x/net | `0.52.0` | `0.53.0` | | golang.org/x/text | `0.35.0` | `0.36.0` | | js | from | to | | --- | --- | --- | | @primer/octicons | `19.23.1` | `19.24.0` | | @vitejs/plugin-vue | `6.0.5` | `6.0.6` | | rolldown-license-plugin | `2.2.0` | `2.2.5` | | vite | `8.0.7` | `8.0.8` | | @types/node | `25.5.2` | `25.6.0` | | @typescript-eslint/parser | `8.58.1` | `8.58.2` | | @vitest/eslint-plugin | `1.6.14` | `1.6.15` | | globals | `17.4.0` | `17.5.0` | | stylelint | `17.6.0` | `17.7.0` | | typescript-eslint | `8.58.1` | `8.58.2` | | updates | `17.13.5` | `17.15.3` | | vitest | `4.1.3` | `4.1.4` | | py | from | to | | --- | --- | --- | | click | `8.3.1` | `8.3.2` | | json5 | `0.13.0` | `0.14.0` | | regex | `2026.2.19` | `2026.4.4` | | tomli | `2.4.0` | `2.4.1` |	2026-04-14 12:45:54 +02:00
Sebastian Ertz	dfd495f823	Update go dependencies (#37141) ... | | from | to | | --- | ---- | --- | | github.com/aws/aws-sdk-go-v2/credentials | `v1.19.13` | `v1.19.14` | | github.com/go-co-op/gocron/v2 | `v2.19.1` | `v2.20.0` | | github.com/go-enry/go-enry/v2 | `v2.9.5` | `v2.9.6` | | github.com/go-webauthn/webauthn | `v0.16.1` | `v0.16.3` | | github.com/google/pprof | `v0.0.0-20260302011040-a15ffb7f9dcc` | `v0.0.0-20260402051712-545e8a4df936` | | github.com/lib/pq | `v1.12.1` | `v1.12.3` | | github.com/mattn/go-isatty | `v0.0.20` | `v0.0.21` | | github.com/mattn/go-sqlite3 | `v1.14.38` | `v1.14.42` | | github.com/minio/minio-go/v7 | `v7.0.99` | `v7.0.100` | | golang.org/x/sys | `v0.42.0` | `v0.43.0` | | google.golang.org/grpc | `v1.79.3` | `v1.80.0` |	2026-04-08 19:07:17 +00:00
silverwind	d600968aaf	Bump min go version to 1.26.2 (#37139) ... Update Go from 1.26.1 to 1.26.2 to fix 6 stdlib vulnerabilities: - GO-2026-4947: `crypto/x509` chain building - GO-2026-4946: `crypto/x509` policy validation - GO-2026-4870: `crypto/tls` KeyUpdate DoS - GO-2026-4869: `archive/tar` unbounded allocation - GO-2026-4866: `crypto/x509` name constraints bypass - GO-2026-4865: `html/template` XSS Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>	2026-04-08 17:56:06 +02:00
wxiaoguang	74060bb849	Fix various legacy problems (#37092) ... 1. Fix #36439 2. Fix #37089 3. Fix incorrect layout of admin auth oidc page 4. Fix #35866 5. Fix #35800 6. Fix #36243	2026-04-03 12:19:04 +00:00
silverwind	a20e182067	Update Go dependencies (#36781) ... Update all non-locked Go dependencies and pin incompatible ones. --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-01 11:26:52 +08:00
silverwind	0df3213766	Upgrade go-git to v5.17.2 (#37060) ... Upgrades `github.com/go-git/go-git/v5` from v5.16.5 to v5.17.2. Fixes https://github.com/go-gitea/gitea/security/dependabot/188 Fixes https://github.com/go-gitea/gitea/security/dependabot/187 --- This PR was written with the help of Claude Opus 4.6 Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>	2026-03-31 22:21:24 +00:00
silverwind	b20b0ed372	Upgrade golang.org/x/image to v0.38.0 (#37054) ... Result of `go get -u golang.org/x/image && make tidy`. Fixes https://github.com/go-gitea/gitea/security/dependabot/186	2026-03-31 15:12:22 +00:00
Lunny Xiao	6288c87181	Upgrade yaml (#37015) ... Upgrade go.yaml.in/yaml/v4 v4.0.0-rc.2 to go.yaml.in/yaml/v4 v4.0.0-rc.4. Fix some workflow yaml files parse problems. --------- Co-authored-by: silverwind <me@silverwind.io>	2026-03-29 09:52:00 +00:00
wxiaoguang	18c65965ab	Fix various trivial problems (#36921) ... * Fix #36915 * Fix #36919 * Close #36600 * Close #36601 * Fix incorrect oauth2 error message display	2026-03-19 07:13:55 +08:00
Nicolas	8d06a9425e	Update minimum go version to 1.26.1, golangci-lint to 2.11.2, fix test style (#36876) ... Hey, I bumped Go to 1.26.1 and fixed a couple of things I ran into while poking around. ### Changes - Bump go.mod from 1.26.0 to 1.26.1 (security patch) - Bump golangci-lint from v2.10.1 to v2.11.2 - Run make tidy, fmt, lint-go --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>	2026-03-10 06:26:52 +00:00
Lunny Xiao	9c2c9c5a00	upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (#36837)	2026-03-05 13:42:47 -08:00
wxiaoguang	1592576fa5	Mark unused&immature activitypub as "not implemented" (#36789) ... After many years, "activitypub" is still "in progress" and no real progress for end users. So it is not mature. Temporarily mark the endpoints as "501 not implemented", and wait until the whole design is stable and usable.	2026-03-01 12:59:49 +00:00
Lunny Xiao	ad9850391d	Move jobparser from act repository to Gitea (#36699) ... The jobparser sub package in act is only used by Gitea. Move it to Gitea to make it more easier to maintain. --------- Co-authored-by: Christopher Homberger <christopher.homberger@web.de>	2026-02-22 19:33:01 +00:00
Lunny Xiao	d59df34a7d	Upgrade gogit to 5.16.5 (#36680)	2026-02-20 18:01:50 +00:00
silverwind	45ee571693	Update to go 1.26.0 and golangci-lint 2.9.0 (#36588)	2026-02-11 18:37:13 +01:00
Sebastian Ertz	36ced5dc8c	Enable pagination on GiteaDownloader.getIssueReactions() (#36549) ... And update code.gitea.io/sdk/gitea to v0.23.2 --------- Co-authored-by: Giteabot <teabot@gitea.io>	2026-02-09 15:49:05 +01:00
wxiaoguang	08b7a30867	Fix various version parsing problems (#36553) ... 1. handle non-release git verions (not semver) 2. fix rubygems version "0" handling (only ">=" can be omitted) 3. lazy compile the regexp to improve performance 4. make test data maintainable, use origin source code instead of compressed binary	2026-02-08 20:25:30 +00:00
Sebastian Ertz	daf0483ef2	Update go dependencies (#36548)	2026-02-08 12:01:37 +00:00
Pascal Zimmermann	50fdd2d49a	[SECURITY] fix: Adjust the toolchain version (#36537) ... # Summary: - Adjust the toolchain version to fix the security issues ```log Vulnerability #1: GO-2026-4337 Unexpected session resumption in crypto/tls More info: https://pkg.go.dev/vuln/GO-2026-4337 Standard library Found in: crypto/tls@go1.25.6 Fixed in: crypto/tls@go1.25.7 Example traces found: ``` Signed-off-by: Pascal Zimmermann <pascal.zimmermann@theiotstudio.com>	2026-02-06 00:27:53 +01:00
silverwind	de829c7821	Update some go dependencies (#36489) ... I verified the `.env.local` syntax added in https://github.com/alecthomas/chroma/pull/1197 works as expected.	2026-01-30 11:25:30 +01:00
Pascal Zimmermann	1adf8b3773	[SECURITY] Toolchain Update to Go 1.25.6 (#36480) ... ## Overview This PR updates the Go toolchain version from `1.25.5` to `1.25.6` for the Gitea project. ## Changes ### Toolchain Update - **Go Toolchain**: Updated from `go1.25.5` to `go1.25.6` This is a minor toolchain version bump that ensures the project uses the latest patch release of Go 1.25. ## Security Improvements While this PR primarily addresses the toolchain update, the project maintains a strong security posture through: ### Current Security Measures ```log Vulnerability #1: GO-2026-4342 Excessive CPU consumption when building archive index in archive/zip More info: https://pkg.go.dev/vuln/GO-2026-4342 Standard library Found in: archive/zip@go1.25.5 Fixed in: archive/zip@go1.25.6 Example traces found: #1: modules/packages/nuget/metadata.go:217:25: nuget.ParseNuspecMetaData calls zip.Reader.Open Vulnerability #2: GO-2026-4341 Memory exhaustion in query parameter parsing in net/url More info: https://pkg.go.dev/vuln/GO-2026-4341 Standard library Found in: net/url@go1.25.5 Fixed in: net/url@go1.25.6 Example traces found: #1: modules/storage/minio.go:284:34: storage.MinioStorage.URL calls url.ParseQuery #2: routers/api/v1/repo/action.go:1640:29: repo.DownloadArtifactRaw calls url.URL.Query Vulnerability #3: GO-2026-4340 Handshake messages may be processed at the incorrect encryption level in crypto/tls More info: https://pkg.go.dev/vuln/GO-2026-4340 Standard library Found in: crypto/tls@go1.25.5 Fixed in: crypto/tls@go1.25.6 Example traces found: #1: services/auth/source/ldap/source_search.go:129:25: ldap.dial calls ldap.Conn.StartTLS, which calls tls.Conn.Handshake #2: modules/graceful/server.go:156:14: graceful.Server.Serve calls http.Server.Serve, which eventually calls tls.Conn.HandshakeContext #3: modules/lfs/content_store.go:132:27: lfs.hashingReader.Read calls tls.Conn.Read #4: modules/proxyprotocol/conn.go:91:21: proxyprotocol.Conn.Write calls tls.Conn.Write #5: modules/session/virtual.go:168:39: session.VirtualStore.Release calls couchbase.CouchbaseProvider.Exist, which eventually calls tls.Dial #6: services/auth/source/ldap/source_search.go:120:22: ldap.dial calls ldap.DialTLS, which calls tls.DialWithDialer #7: services/migrations/gogs.go:114:34: migrations.client calls http.Transport.RoundTrip, which eventually calls tls.Dialer.DialContext ``` ## Breaking Changes None expected. This is a minor toolchain patch update.	2026-01-29 07:23:11 +01:00
wxiaoguang	3a09d7aa8d	Refactor git command stdio pipe (#36422) ... Most potential deadlock problems should have been fixed, and new code is unlikely to cause new problems with the new design. Also raise the minimum Git version required to 2.6.0 (released in 2015)	2026-01-22 06:04:26 +00:00
Sebastian Ertz	111c822a30	Update chroma to v2.23.0 (#36423)	2026-01-21 23:55:24 +00:00
TheFox0x7	69c5921d71	Add ability to download subpath archive (#36371) ... closes: https://github.com/go-gitea/gitea/issues/4478 --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-01-16 09:31:12 +00:00
Sebastian Ertz	8319d8f381	Update chroma to v2.22.0 (#36342) ... https://github.com/alecthomas/chroma/releases/tag/v2.22.0	2026-01-10 20:12:59 +00:00
Sebastian Ertz	18c393419f	Update goldmark to v1.7.16 (#36343) ... https://github.com/yuin/goldmark/releases/tag/v1.7.16	2026-01-10 11:42:02 -08:00
Sebastian Ertz	a9a4457dc3	Update chroma to v2.21.1 (#36201) ... https://github.com/alecthomas/chroma/releases/tag/v2.21.1	2025-12-18 23:26:18 +00:00
Sebastian Ertz	14911d4293	Update chroma to v2.21.0 (#36171) ... https://github.com/alecthomas/chroma/releases/tag/v2.21.0	2025-12-17 01:07:44 +00:00
silverwind	9f268edd2f	Update go toolchain to 1.25.5 (#36074) ... Fixes: https://pkg.go.dev/vuln/GO-2025-4155	2025-12-03 00:26:07 +01:00