mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-05 00:09:33 +09:00
d919301d36504d5fd79bb01b318b67befa3c7abc
21952
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  wxiaoguangandsilverwind
|
d919301d36 |
refactor: remove UnmarshalHandleDoubleEncode patch and fix repo unit TODO (#39998)
Remove the `UnmarshalHandleDoubleEncode` runtime workaround for an old xorm bug, and normalize legacy double-encoded JSON in `repo_unit.config` and `login_source.cfg` with a migration instead. - Config `FromDB` no longer fails on corrupted values. A broken auth source is deactivated, so admins can still fix it in the admin panel - Remove `ProjectsConfig.GetProjectsMode`, `FromDB` already defaults `ProjectsMode` Actually it doesn't need so many changes, just because AI thinks it should handle "corrupted database value" for auth sources. --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
 
|
666e6e2d17 |
fix(web): allow clearing the full name in profile settings (#40186)
Clearing "Full Name" in the profile settings shows success but keeps the old value: since #31959 it is only updated when non-empty, because the input is disabled (not submitted) when `change_full_name` is disabled. Use `*string` for the field, so a missing field keeps the value and an empty one clears it. With `change_full_name` disabled, any submitted value (including empty) is now rejected. Not `optional.Option[string]`, because `MaxSize` would count slice elements instead of characters. Fixes #40185 --- AI disclosure: written with Claude Code (claude-opus-5-5) and tested locally. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
 Jon Fullerandwxiaoguang
|
4d00ed2a1e |
fix(notifications): avoid deadlock when creating issue notifications concurrently (#40166)
Concurrent `notification-service` workers can deadlock in the transaction for-loop. The transaction is useless, so it is removed to avoid deadlock. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
ce0da8a378 |
build: cross-compile in docker (#40136)
Building the backend under QEMU takes 46 to 54 minutes per foreign platform in the nightly image build, against 7 minutes natively. The backend stage now runs on the build platform and cross-compiles with `GOOS`/`GOARCH`/`GOARM`, so every platform builds at native speed. - `go generate` runs once instead of once per platform. - The PR docker dry run builds all three platforms in a single job, on any docker-related change. --------- Signed-off-by: silverwind <me@silverwind.io> |
||
 Gaurav Dubeyandsilverwind
|
f26a314636 |
fix(api): keep wiki page name when editing with an empty title (#40153)
Match `PATCH /repos/{owner}/{repo}/wiki/page/{pageName}` document "leave
empty to keep unchanged"
Fixes #39179
---------
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
|
5c68ba3e0a |
fix(repo): avoid deadlock when updating language stats concurrently (#40167)
The `repo_stats_update` queue only deduplicates waiting items, so several workers can index the same repository at once, then `UpdateLanguageStats` can lead to transaction deadlock. Use a global lock to avoid concurrent updates, and also helps https://github.com/go-gitea/gitea/pull/39342 to avoid duplicate updates. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwindandwxiaoguang
|
78eb95ab19 |
fix: enable more djlint rules and improve keyboard navigation (#40081)
Enable djlint's [H018](https://djlint.com/docs/linter/#h018), [H046](https://djlint.com/docs/linter/#h046) and [H054](https://djlint.com/docs/linter/#h054) rules, fix their findings and the keyboard navigation problems around them. H054 found links nested in `<button>` dropdowns and radio inputs nested in links, both invalid HTML. - "Add File" and "More Operations" in the repo file list become `div` dropdowns, the disabled state stays unfocusable - The diff whitespace menu marks the current option with a check and `aria-current` instead of radios, which made our dropdown aria patch announce it as a combobox - Sign-in moves "Forgot password?" below "Sign In" and drops the positive tabindexes from https://github.com/go-gitea/gitea/pull/31689, so the tab order follows the DOM: username, password, remember, sign in, forgot - The focus ring on primary, red and green buttons is near-white on dark themes and near-black on light ones, the primary-colored ring was invisible on primary buttons <img width="500" alt="Whitespace menu, before and after" src="https://github.com/user-attachments/assets/d22a423d-95e5-434c-aec4-59264c7132b7" /> <img width="600" alt="Sign-in form, main and this PR" src="https://github.com/user-attachments/assets/d6780690-d906-4791-8a2b-8d80fb03067a" /> <img width="215" height="132" alt="Keyboard-focused primary and red buttons, dark and light theme" src="https://github.com/user-attachments/assets/a2400b18-4802-4383-8560-7e8267a7f02f" /> --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwindandwxiaoguang
|
5c723ee0fd |
refactor(markdown): remove goldmark-highlighting (#39751)
Render fenced code blocks with Gitea's own code block renderer instead of `goldmark-highlighting`, using the managed lexer lookup from `modules/highlight`. Indented and fenced blocks now share one rendering path. Rendered output is unchanged. The trailing newline is stripped on copy in the frontend since https://github.com/go-gitea/gitea/pull/39755. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
 Giteabotandsilverwind
|
12b20c7c99 |
chore(deps): update dependencies (#40168)
> [!NOTE] > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | [@primer/octicons](https://primer.style/octicons) ([source](https://redirect.github.com/primer/octicons)) | [`19.41.0` → `19.42.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.41.0/19.42.0) |  |  | dependencies | minor | | | [@typescript-eslint/parser](https://typescript-eslint.io/packages/parser) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser)) | [`8.72.0` → `8.72.1`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.72.0/8.72.1) |  |  | devDependencies | patch | | | @​vitest/eslint-plugin | [`1.6.27` → `1.6.28`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.27/1.6.28) |  |  | devDependencies | patch | | | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | `v10.3.0` → `v10.3.2` |  |  | action | patch | `v10.3.3` | | [chart.js](https://www.chartjs.org) ([source](https://redirect.github.com/chartjs/Chart.js)) | [`4.5.1` → `4.6.1`](https://renovatebot.com/diffs/npm/chart.js/4.5.1/4.6.1) |  |  | dependencies | minor | | | [cli/cli](https://redirect.github.com/cli/cli) | `2.103.2` → `2.103.3` |  |  | | patch | | | [connectrpc.com/connect/v2](https://redirect.github.com/connectrpc/connect-go) | `v2.0.1` → `v2.0.2` |  |  | require | patch | | | [crowdin/github-action](https://redirect.github.com/crowdin/github-action) | `v3.4.0` → `v3.5.0` |  |  | action | minor | | | [djlint](https://redirect.github.com/djlint/djLint) | `==1.46.6` → `==1.47.1` |  |  | dependency-groups | minor | `1.49.2` (+4) | | [docker/login-action](https://redirect.github.com/docker/login-action) | `v4.6.0` → `v4.7.0` |  |  | action | minor | | | [elasticsearch](https://hub.docker.com/_/elasticsearch) ([source](https://redirect.github.com/elastic/dockerfiles)) | `3f4d63c` → `ef5cafd` | | | service | digest | | | [eslint-plugin-unicorn](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn) | [`78.0.0` → `79.0.0`](https://renovatebot.com/diffs/npm/eslint-plugin-unicorn/78.0.0/79.0.0) |  |  | devDependencies | major | | | [eslint-plugin-vue](https://eslint.vuejs.org) ([source](https://redirect.github.com/vuejs/eslint-plugin-vue)) | [`10.11.1` → `10.12.0`](https://renovatebot.com/diffs/npm/eslint-plugin-vue/10.11.1/10.12.0) |  |  | devDependencies | minor | | | [getmeili/meilisearch](https://redirect.github.com/meilisearch/meilisearch) | `c94e58c` → `1f578fa` | | | service | digest | | | [gitea.dev/sdk](https://gitea.com/gitea/go-sdk) | `v1.3.0` → `v1.5.0` |  |  | require | minor | `v1.5.1` | | [github.com/buildkite/terminal-to-html/v3](https://redirect.github.com/buildkite/terminal-to-html) | `v3.17.1` → `v3.17.3` |  |  | require | patch | | | [github.com/dlclark/regexp2/v2](https://redirect.github.com/dlclark/regexp2) | `v2.9.1` → `v2.11.0` |  |  | require | minor | `v2.12.0` | | [github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi) | `v0.151.0` → `v0.152.0` |  |  | require | minor | | | [github.com/go-co-op/gocron/v2](https://redirect.github.com/go-co-op/gocron) | `v2.22.0` → `v2.23.0` |  |  | require | minor | | | [github.com/go-redsync/redsync/v4](https://redirect.github.com/go-redsync/redsync) | `v4.18.0` → `v4.18.1` |  |  | require | patch | | | [github.com/google/pprof](https://redirect.github.com/google/pprof) | `1facf8f` → `dbd0ed3` |  |  | require | digest | | | [gitlab.com/gitlab-org/api/client-go/v3](https://gitlab.com/gitlab-org/api/client-go) | `v3.29.0` → `v3.39.1` |  |  | require | minor | `v3.40.2` (+3) | | [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) | `v1.84.0` → `v1.85.0` |  |  | require | minor | | | [katex](https://katex.org) ([source](https://redirect.github.com/KaTeX/KaTeX)) | [`0.19.0` → `0.19.1`](https://renovatebot.com/diffs/npm/katex/0.19.0/0.19.1) |  |  | dependencies | patch | | | [markdownlint-cli](https://redirect.github.com/igorshubovych/markdownlint-cli) | [`0.49.1` → `0.50.0`](https://renovatebot.com/diffs/npm/markdownlint-cli/0.49.1/0.50.0) |  |  | devDependencies | minor | | | [material-icon-theme](https://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/main/README.md) ([source](https://redirect.github.com/material-extensions/vscode-material-icon-theme)) | [`5.39.0` → `5.40.0`](https://renovatebot.com/diffs/npm/material-icon-theme/5.39.0/5.40.0) |  |  | devDependencies | minor | | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `v1.60.1` → `v1.61.0` |  |  | require | minor | `v1.61.1` | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`12.14.0` → `12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |  |  | packageManager | minor | | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`>= 12.14.0` → `>= 12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |  |  | engines | minor | | | [postcss](https://postcss.org/) ([source](https://redirect.github.com/postcss/postcss)) | [`8.5.31` → `8.5.32`](https://renovatebot.com/diffs/npm/postcss/8.5.31/8.5.32) |  |  | dependencies | patch | | | [renovate](https://renovatebot.com) ([source](https://redirect.github.com/renovatebot/renovate)) | [`44.172.2` → `44.190.1`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.172.2&to=44.190.1) |  |  | | minor | `44.200.0` (+21) | | [renovatebot/github-action](https://redirect.github.com/renovatebot/github-action) | `v46.3.9` → `v46.3.10` |  |  | action | patch | `v46.3.12` (+1) | | [typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)) | [`8.72.0` → `8.72.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.72.0/8.72.1) |  |  | devDependencies | patch | | | [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.3.4` → `8.3.5`](https://renovatebot.com/diffs/npm/vite/8.3.4/8.3.5) |  |  | dependencies | patch | | --- ### Release Notes <details> <summary>primer/octicons (@​primer/octicons)</summary> ### [`v19.42.0`](https://redirect.github.com/primer/octicons/releases/tag/%40primer/octicons%4019.42.0) [Compare Source](https://redirect.github.com/primer/octicons/compare/@primer/octicons@19.41.0...@primer/octicons@19.42.0) ##### Minor Changes - [#​1381](https://redirect.github.com/primer/octicons/pull/1381) [`d25ce68df9d08abd65431a8a48b45446432f1b45`](https://redirect.github.com/primer/octicons/commit/d25ce68df9d08abd65431a8a48b45446432f1b45) Thanks [@​edokoa](https://redirect.github.com/edokoa)! - Add the 16px `git-draft-agent`, `git-pull-request-agent`, `check-agent`, `git-que-merge-agent`, `git-closed-agent`, and `git-merge-agent` icons for agent-assisted draft, open, ready-to-merge, queued, closed, and merged pull request states. </details> <details> <summary>typescript-eslint/typescript-eslint (@​typescript-eslint/parser)</summary> ### [`v8.72.1`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8721-2026-10-26) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.72.0...v8.72.1) This was a version bump only for parser to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>astral-sh/setup-uv</summary> ### [`v10.3.2`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5 [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.1...v10.3.2) #### Changes #### 🧰 Maintenance - chore: update known checksums for 0.13.5 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1103](https://redirect.github.com/astral-sh/setup-uv/issues/1103)) #### 📚 Documentation - docs: update version references to v10.3.1 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1102](https://redirect.github.com/astral-sh/setup-uv/issues/1102)) ### [`v10.3.1`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.0...v10.3.1) #### Changes This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn `##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.` #### 🐛 Bug fixes - fix: preserve cache error class names in save-cache bundle [@​dannyward630](https://redirect.github.com/dannyward630) ([#​1093](https://redirect.github.com/astral-sh/setup-uv/issues/1093)) #### 🧰 Maintenance - chore: update known checksums for 0.13.4 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1099](https://redirect.github.com/astral-sh/setup-uv/issues/1099)) - chore: update known checksums for 0.13.2/0.13.3 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1098](https://redirect.github.com/astral-sh/setup-uv/issues/1098)) - chore: update known checksums for 0.13.1 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1094](https://redirect.github.com/astral-sh/setup-uv/issues/1094)) - Verify npm dependency signatures before builds [@​zaniebot](https://redirect.github.com/zaniebot) ([#​1027](https://redirect.github.com/astral-sh/setup-uv/issues/1027)) #### 📚 Documentation - docs: cache-dependency-glob matches relative to the working directory [@​flange-ipb](https://redirect.github.com/flange-ipb) ([#​1092](https://redirect.github.com/astral-sh/setup-uv/issues/1092)) - docs: update version references to v10.3.0 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1090](https://redirect.github.com/astral-sh/setup-uv/issues/1090)) #### ⬆️ Dependency updates - chore(deps): roll up Dependabot updates [@​eifinger](https://redirect.github.com/eifinger) ([#​1101](https://redirect.github.com/astral-sh/setup-uv/issues/1101)) </details> <details> <summary>chartjs/Chart.js (chart.js)</summary> ### [`v4.6.1`](https://redirect.github.com/chartjs/Chart.js/releases/tag/v4.6.1) [Compare Source](https://redirect.github.com/chartjs/Chart.js/compare/v4.5.1...v4.6.1) ### Essential Links - [npm](https://www.npmjs.com/package/chart.js) - [Migration guide](https://www.chartjs.org/docs/4.6.1/migration/v4-migration.html) - [Docs](https://www.chartjs.org/docs/4.6.1/) - [API](https://www.chartjs.org/docs/4.6.1/api/) - [Samples](https://www.chartjs.org/docs/4.6.1/samples/information.html) * [#​12355](https://redirect.github.com/chartjs/Chart.js/issues/12355) fix: trusted publishing fix + version 4.6.1 bump Thanks to [@​etimberg](https://redirect.github.com/etimberg) </details> <details> <summary>cli/cli</summary> ### [`v2.103.3`](https://redirect.github.com/cli/cli/releases/tag/v2.103.3): GitHub CLI 2.103.3 [Compare Source](https://redirect.github.com/cli/cli/compare/v2.103.2...v2.103.3) ##### What's Changed ##### 🐛 Fixes - fix(gh auth status): explain expired expiring tokens with `--no-refresh` by [@​babakks](https://redirect.github.com/babakks) in [#​14815](https://redirect.github.com/cli/cli/pull/14815) **Full Changelog**: <https://github.com/cli/cli/compare/v2.103.2...v2.103.3> </details> <details> <summary>connectrpc/connect-go (connectrpc.com/connect/v2)</summary> ### [`v2.0.2`](https://redirect.github.com/connectrpc/connect-go/releases/tag/v2.0.2) [Compare Source](https://redirect.github.com/connectrpc/connect-go/compare/v2.0.1...v2.0.2) #### What's Changed ##### Bugfixes - Fix data race reading ClientInfo after a cancelled call by [@​emcfarlane](https://redirect.github.com/emcfarlane) in [#​1036](https://redirect.github.com/connectrpc/connect-go/pull/1036) - List JSON charset variants in Accept-Post by [@​emcfarlane](https://redirect.github.com/emcfarlane) in [#​1037](https://redirect.github.com/connectrpc/connect-go/pull/1037) - Flush response headers in ServerStream.SendHeaders over HTTP by [@​raveesh-me](https://redirect.github.com/raveesh-me) in [#​1035](https://redirect.github.com/connectrpc/connect-go/pull/1035) - Stop reading oversized messages after rejecting them by [@​stefanvanburen](https://redirect.github.com/stefanvanburen) in [#​1039](https://redirect.github.com/connectrpc/connect-go/pull/1039) #### New Contributors - [@​raveesh-me](https://redirect.github.com/raveesh-me) made their first contribution in [#​1035](https://redirect.github.com/connectrpc/connect-go/pull/1035) **Full Changelog**: <https://github.com/connectrpc/connect-go/compare/v2.0.1...v2.0.2> </details> <details> <summary>crowdin/github-action</summary> ### [`v3.5.0`](https://redirect.github.com/crowdin/github-action/releases/tag/v3.5.0) [Compare Source](https://redirect.github.com/crowdin/github-action/compare/v3.4.0...v3.5.0) #### What's Changed - CLI [5.5.0](https://redirect.github.com/crowdin/crowdin-cli/releases/tag/5.5.0) by [@​andrii-bodnar](https://redirect.github.com/andrii-bodnar) **Full Changelog**: <https://github.com/crowdin/github-action/compare/v3.4.0...v3.5.0> </details> <details> <summary>djlint/djLint (djlint)</summary> ### [`v1.47.1`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1471---2026-10-26) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.47.0...v1.47.1) ##### Fix - `preserve-inline` in the `js` setting `brace_style` takes effect, so `{ bubbles: true }` stays on one line in a `<script>` or in an attribute formatted with `--format-attribute-js-json`. It used to be dropped before the code was formatted. - The json schema allows any option under `css` and `js`, so a strict validator such as Tombi no longer reports `indent_size` there. ### [`v1.47.0`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1470---2026-10-22) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.46.6...v1.47.0) ##### Feature - New option `--sort-load-tags` / `sort_load_tags` sorts the libraries in a `{% load %}` tag and drops the ones written twice, so `{% load static i18n %}` becomes `{% load i18n static %}`. In `{% load a b from library %}` the names before `from` are sorted. It is off by default: where two libraries define a tag or filter of the same name, the one loaded last wins, so sorting can change which one a template uses. - The formatter drops the spaces `H012` reports around an attribute's `=`, so `<div class = "a">` becomes `<div class="a">`. ##### Changed - `H010` reports the names the formatter lowercases, in any mix of case, so `Width="3"` is now reported. A framework binding such as `:itemID` or `@ID` and a longer name such as `data-ID` no longer are, since the formatter leaves their case alone. - `H018` is not reported under `--close-void-tags`, since the formatter then writes the `/>` ending the rule reports. `--ignore-case` already worked this way for `H009` and `H010`. ##### Fix - `H020` reports an empty pair whose end tag has whitespace before its `>`, such as `<div></div\n>`. - `H026` reports a `class` or `id` holding only whitespace, such as `class=" "`, and one written with spaces around the `=`. - `H033` reports an action padded at both ends once. It used to report it twice, unless an attribute before `action` happened to make the two reports look the same. - Markup written inside an attribute value, as in `<p title="<img src='a'>">`, is text, and `H005`, `H008`, `H010`, `H012`, `D018`, `J018`, `H024`, `H026`, `H029` and `H033` no longer report it. `H046` and `H051` read `tabindex` and `role` from the tag's own attributes, so `tabindex=1` written in a value or in the page text is not reported either. - `T001` and `T027` read a tag holding a dict, such as `{{ f({"a": {"b": 1}}) }}`, up to the `}}` that closes it rather than the first `}}` inside it. - `T032` steps over an escaped quote in a string, so the spaces in `{{ x|default:"a \"b c\"" }}` are not reported. - `H015` reports a heading followed by a tag on the same line anywhere in the file. It used to look only at the last line. - The rules that read a tag's attributes step over a template tag written in it, including a handlebars `{{{attrs}}}` and a dict as in `{{ {'class': 'x'}|xmlattr }}`, so `<img {{ attrs }} src='a'>` is reported by `H008`, which used to stop reading at the `{{`. - `T038` steps over a string in a block tag, so the `{%` in `{% with a="{%" %}` does not cut the tag short. ##### Performance - The rules that read a tag's attributes stop at a stray `<`, and `H015`, `H030`, `H036`, `T001`, `T027`, `T038` and `T039` no longer read the rest of the document again for each tag. A file holding thousands of unclosed tags or headings on one line is linted in a fraction of a second, where it used to take minutes. </details> <details> <summary>docker/login-action</summary> ### [`v4.7.0`](https://redirect.github.com/docker/login-action/releases/tag/v4.7.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.6.0...v4.7.0) - Preserve explicit ECR settings in `registry-auth` by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1089](https://redirect.github.com/docker/login-action/pull/1089) - Use registry hosts for scoped credentials by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1088](https://redirect.github.com/docker/login-action/pull/1088) - Raise Docker Hub OIDC max expiry to 6 hours by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1068](https://redirect.github.com/docker/login-action/pull/1068) - Log Docker Hub OIDC token exchange progress by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1061](https://redirect.github.com/docker/login-action/pull/1061) - Bump [@​aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://redirect.github.com/aws-sdk/client-ecr-public) to 3.1154.0 in [#​1093](https://redirect.github.com/docker/login-action/pull/1093) - Bump [@​docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit) from 0.94.0 to 0.107.0 in [#​1100](https://redirect.github.com/docker/login-action/pull/1100) - Bump [@​humanfs/node](https://redirect.github.com/humanfs/node) from 0.16.7 to 0.16.8 in [#​1077](https://redirect.github.com/docker/login-action/pull/1077) - Bump csv-parse from 7.0.1 to 7.0.3 in [#​1078](https://redirect.github.com/docker/login-action/pull/1078) - Bump handlebars from 4.7.9 to 4.7.10 in [#​1091](https://redirect.github.com/docker/login-action/pull/1091) - Bump js-yaml from 5.2.2 to 5.5.0 in [#​1066](https://redirect.github.com/docker/login-action/pull/1066) - Bump postcss from 8.5.22 to 8.5.26 in [#​1071](https://redirect.github.com/docker/login-action/pull/1071) - Bump postcss-selector-parser from 7.1.1 to 7.1.6 in [#​1092](https://redirect.github.com/docker/login-action/pull/1092) - Bump source-map-js from 1.2.1 to 1.2.2 in [#​1090](https://redirect.github.com/docker/login-action/pull/1090) - Bump undici from 6.27.0 to 6.29.1 in [#​1085](https://redirect.github.com/docker/login-action/pull/1085) - Bump uuid from 14.0.1 to 14.0.3 in [#​1096](https://redirect.github.com/docker/login-action/pull/1096) **Full Changelog**: <https://github.com/docker/login-action/compare/v4.6.0...v4.7.0> </details> <details> <summary>sindresorhus/eslint-plugin-unicorn (eslint-plugin-unicorn)</summary> ### [`v79.0.0`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/releases/tag/v79.0.0) [Compare Source](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/compare/v78.0.0...v79.0.0) #### Breaking - `no-top-level-side-effects`: Focus on mutations of globals, and remove it from the `unopinionated` preset ([#​3915](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3915)) [`24abac4`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/24abac48) - Unknown calls are no longer reported by default. Enable the new [`checkUnknownCalls`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/blob/main/docs/rules/no-top-level-side-effects.md#checkunknowncalls) option for stricter checking. - Mutations of globals, like `document.title = 'x'` and `Object.assign(globalThis, …)`, are now reported, also in declarations and default exports. You may see new reports. #### Improvements - Infer types from JSDoc `@type`, `@param`, and `@returns` annotations in rules that use type information ([#​3941](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3941)) [`2b4bfab`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/2b4bfab0) - Handle template literals without expressions like strings in more rules ([#​3943](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3943)) [`8bd8c06`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/8bd8c063) - Autofix more code that contains comments, while keeping the comments ([#​3939](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3939)) [`87baf82`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/87baf82f) - Fix autofixes in many rules that could produce broken code or wrong parentheses ([#​3917](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3917)) [`fed7eac`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/fed7eac2) - Make autofixes safer in many rules - Fixes that can change behavior in rare cases are now suggestions, for example in `prefer-spread`, `prefer-math-min-max`, `prefer-modern-dom-apis`, and `prefer-switch`. - Improve performance [`175efaf`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/175efaf1) [`3dd8fd2`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3dd8fd28) - `comment-content`: Add [`ignore`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/blob/main/docs/rules/comment-content.md#ignore) option ([#​3950](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3950)) [`3fe046e`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3fe046e6) - `consistent-function-scoping`: Ignore functions in Vitest hoisted factories ([#​3905](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3905)) [`98912a9`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/98912a91) - `custom-error-definition`: Ignore abstract TypeScript classes ([#​3934](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3934)) [`ee3501f`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/ee3501fb) - `no-non-function-verb-prefix`: Ignore shorthand destructuring ([#​3926](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3926)) [`76e5760`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/76e5760b) - `no-top-level-side-effects`: Recognize more config helpers ([#​3916](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3916)) [`d459c51`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/d459c511) - `no-useless-coercion`: Preserve boolean return types in TypeScript ([#​3904](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3904)) [`bef1571`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/bef15714) - `prefer-array-some`: Check `.find()` results used as booleans ([#​3913](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3913)) [`c957bf3`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/c957bf3d) - `prefer-default-parameters`: Skip unsafe logical OR fallbacks ([#​3951](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3951)) [`bcec97a`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/bcec97a4) - `prefer-includes`: Skip incompatible TypeScript search values ([#​3927](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3927)) [`d66441a`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/d66441aa) - `prefer-includes-over-repeated-comparisons`: Report negated and typed loose comparisons ([#​3935](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3935)) [`6e21cb1`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/6e21cb1b) - `prefer-includes-over-repeated-comparisons`: Preserve TypeScript union narrowing ([#​3910](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3910)) [`b5c479d`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/b5c479d8) - `prefer-literal-ascii`: Preserve escaped trailing spaces in templates ([#​3911](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3911)) [`360094b`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/360094bb) - `prefer-minimal-ternary`: Skip minimizations that break types ([#​3892](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3892)) [`f022d6d`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/f022d6d1) - `prefer-modern-math-apis`: Use suggestions for changes that can affect numeric results ([#​3914](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3914)) [`8af7c17`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/8af7c172) - `prefer-simple-condition-first`: Improve `typeof` comparisons and guards ([#​3948](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3948)) [`ee3edf0`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/ee3edf06) - `prefer-simplified-conditions`: Handle equivalent logical expressions ([#​3938](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3938)) [`a0b2788`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/a0b2788b) - `prefer-simplified-conditions`: Factor common terms in longer chains and static templates ([#​3942](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3942)) [`0d8c8bc`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/0d8c8bcb) - `prefer-smaller-scope`: Check TypeScript type aliases ([#​3928](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3928)) [`290d922`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/290d922c) - `prefer-string-raw`: Preserve TypeScript literal types in autofixes ([#​3912](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3912)) [`0611546`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/06115464) - `prefer-ternary`: Preserve consecutive early-return guards ([#​3945](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3945)) [`3fa840f`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3fa840fe) - `require-post-message-target-origin`: Skip incompatible typed methods ([#​3925](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3925)) [`387194b`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/387194bd) - `throw-new-error`: Ignore calls that return functions ([#​3894](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3894)) [`5e35def`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/5e35def7) *** </details> <details> <summary>vuejs/eslint-plugin-vue (eslint-plugin-vue)</summary> ### [`v10.12.0`](https://redirect.github.com/vuejs/eslint-plugin-vue/blob/HEAD/CHANGELOG.md#10120) [Compare Source](https://redirect.github.com/vuejs/eslint-plugin-vue/compare/v10.11.1...v10.12.0) ##### New rules - Added new [`vue/no-content-outside-block`](https://eslint.vuejs.org/rules/no-content-outside-block.html) rule ([#​3119](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3119)) - Added new [`vue/no-define-model-default`](https://eslint.vuejs.org/rules/no-define-model-default.html) rule ([#​3146](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3146)) - Added new [`vue/no-props-shadow`](https://eslint.vuejs.org/rules/no-props-shadow.html) rule ([#​3118](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3118)) ##### New rule options - Added `required` option to [`vue/block-lang`](https://eslint.vuejs.org/rules/block-lang.html) to report components that omit a required block entirely ([#​3125](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3125)) - Added `ignoreMixins` option to [`vue/require-explicit-emits`](https://eslint.vuejs.org/rules/require-explicit-emits.html) rule ([#​3141](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3141)) ##### Fixed false negatives (may result in more lint issues) - Added support for refs detected by type information, such as refs returned from composables, to [`vue/no-ref-as-operand`](https://eslint.vuejs.org/rules/no-ref-as-operand.html) rule ([#​3144](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3144)) - Fixed [`vue/no-dupe-keys`](https://eslint.vuejs.org/rules/no-dupe-keys.html) not reporting `defineModel()` names that collide with a prop, another model, or a `<script setup>` variable ([#​3163](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3163)) - Fixed [`vue/no-dupe-keys`](https://eslint.vuejs.org/rules/no-dupe-keys.html) not reporting `<script setup>` variables that shadow a prop while aliasing a different one, such as `const foo = toRef(props, 'bar')` ([#​3124](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3124)) - Fixed [`vue/no-multi-spaces`](https://eslint.vuejs.org/rules/no-multi-spaces.html) not reporting multiple spaces in the tags of some top-level blocks, e.g. `<script setup>` ([#​3162](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3162)) - Fixed [`vue/no-ref-as-operand`](https://eslint.vuejs.org/rules/no-ref-as-operand.html) and [`vue/no-ref-object-reactivity-loss`](https://eslint.vuejs.org/rules/no-ref-object-reactivity-loss.html) to also check refs created with `useTemplateRef()` ([#​3154](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3154)) - Fixed [`vue/no-unused-properties`](https://eslint.vuejs.org/rules/no-unused-properties.html) not reporting unused non-props properties in components that use `$props` as a whole (e.g. `v-bind="$props"`) ([#​3161](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3161)) - Fixed [`vue/padding-lines-in-component-definition`](https://eslint.vuejs.org/rules/padding-lines-in-component-definition.html) to check every pair of adjacent properties, not only the first, when `withinOption` or `withinEach` is not set ([#​3155](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3155)) - Fixed [`vue/require-default-prop`](https://eslint.vuejs.org/rules/require-default-prop.html), [`vue/no-boolean-default`](https://eslint.vuejs.org/rules/no-boolean-default.html), [`vue/no-required-prop-with-default`](https://eslint.vuejs.org/rules/no-required-prop-with-default.html) and [`vue/require-valid-default-prop`](https://eslint.vuejs.org/rules/require-valid-default-prop.html) not handling defaults that are passed to `withDefaults()` by reference or spread instead of an inline object literal ([#​3114](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3114)) ##### Fixed false positives (may result in fewer lint issues) - Changed [`vue/singleline-html-element-content-newline`](https://eslint.vuejs.org/rules/singleline-html-element-content-newline.html) and [`vue/multiline-html-element-content-newline`](https://eslint.vuejs.org/rules/multiline-html-element-content-newline.html) rules to ignore `router-link` and `nuxt-link` elements by default ([#​3165](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3165)) - Fixed [`vue/no-undef-properties`](https://eslint.vuejs.org/rules/no-undef-properties.html) false positives for properties returned via `...toRefs(reactive({ ... }))` from `setup()` ([#​3134](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3134)) - Fixed [`vue/require-typed-ref`](https://eslint.vuejs.org/rules/require-typed-ref.html) false positives when an explicit type annotation already applies to the `ref()` call ([#​3123](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3123)) - Fixed [`vue/v-if-else-key`](https://eslint.vuejs.org/rules/v-if-else-key.html) false positive for components with a bound `:key` ([#​3150](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3150)) ##### Other changes - Removed Reactivity Transform support from [`vue/no-ref-object-reactivity-loss`](https://eslint.vuejs.org/rules/no-ref-object-reactivity-loss.html), since the Reactivity Transform proposal was dropped from Vue ([#​3126](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3126)) - Changed [`vue/html-self-closing`](https://eslint.vuejs.org/rules/html-self-closing.html) to treat Vue's special `<slot>` and `<template>` elements as components (`html.component` option) instead of normal HTML elements ([#​3164](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3164)) - Changed [`vue/attributes-order`](https://eslint.vuejs.org/rules/attributes-order.html) rule to provide a suggestion instead of an autofix when the fix would move a binding across `v-bind="object"` ([#​3145](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3145)) - Improved performance of [`vue/no-reserved-component-names`](https://eslint.vuejs.org/rules/no-reserved-component-names.html) by no longer rebuilding its reserved name sets for every file ([#​3147](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3147)) </details> <details> <summary>gitea/go-sdk (gitea.dev/sdk)</summary> ### [`v1.5.0`](https://gitea.com/gitea/go-sdk/releases/tag/v1.5.0) [Compare Source](https://gitea.com/gitea/go-sdk/compare/v1.4.0...v1.5.0) #### What's Changed - feat: allow PAT-authenticated clients to manage access tokens in [#​840](https://gitea.com/gitea/go-sdk/pulls/840) - fix(pull): surface the server's error when a merge is refused in [#​870](https://gitea.com/gitea/go-sdk/pulls/870) - feat(hook): add name option to webhooks in [#​867](https://gitea.com/gitea/go-sdk/pulls/867) - feat: cover the API options gitea-cli still calls raw in [#​862](https://gitea.com/gitea/go-sdk/pulls/862) - ci: implement gitea's cache-seeder in [#​866](https://gitea.com/gitea/go-sdk/pulls/866) - Add bitbucketserver and forgejo migration service types in [#​868](https://gitea.com/gitea/go-sdk/pulls/868) - chore(deps): update dependencies in [#​869](https://gitea.com/gitea/go-sdk/pulls/869) - chore: remove the Client wrapper generator in [#​865](https://gitea.com/gitea/go-sdk/pulls/865) - feat: add force push and stale approval fields to branch protections in [#​864](https://gitea.com/gitea/go-sdk/pulls/864) #### Contributors - [@​sedlund](https://redirect.github.com/sedlund) - [@​Svtter](https://redirect.github.com/Svtter) - [@​SudhanshuSingh](https://redirect.github.com/SudhanshuSingh) - [@​bircni](https://redirect.github.com/bircni) - [@​silverwind](https://redirect.github.com/silverwind) - [@​lunny](https://redirect.github.com/lunny) - [@​renovate-bot](https://redirect.github.com/renovate-bot) #### New Contributors - [@​Svtter](https://redirect.github.com/Svtter) made their first contribution in [#​870](https://gitea.com/gitea/go-sdk/pulls/870) - [@​bircni](https://redirect.github.com/bircni) made their first contribution in [#​862](https://gitea.com/gitea/go-sdk/pulls/862) - [@​SudhanshuSingh](https://redirect.github.com/SudhanshuSingh) made their first contribution in [#​864](https://gitea.com/gitea/go-sdk/pulls/864) **Full Changelog**: [v1.4.0...v1.5.0](https://gitea.com/gitea/go-sdk/compare/v1.4.0...v1.5.0) ### [`v1.4.0`](https://gitea.com/gitea/go-sdk/releases/tag/v1.4.0) [Compare Source](https://gitea.com/gitea/go-sdk/compare/v1.3.0...v1.4.0) #### What's Changed - fix: retry server version lookup after failure in [#​829](https://gitea.com/gitea/go-sdk/pulls/829) - chore(deps): update dependencies, adapt to Gitea 28 in [#​863](https://gitea.com/gitea/go-sdk/pulls/863) - chore: update golangci-lint for Go 1.27.2, exclude dagger from Renovate in [#​861](https://gitea.com/gitea/go-sdk/pulls/861) **Note**: Gitea skipped 1.28, so the project and workflow run approve/cancel/logs APIs are now gated on Gitea 28.0.0. Clients pinning `SetGiteaVersion("1.28.0")` must switch to `"28.0.0"`. #### Contributors - [@​noeljackson](https://redirect.github.com/noeljackson) - [@​silverwind](https://redirect.github.com/silverwind) - [@​renovate-bot](https://redirect.github.com/renovate-bot) **Full Changelog**: [v1.3.0...v1.4.0](https://gitea.com/gitea/go-sdk/compare/v1.3.0...v1.4.0) Written by Claude. </details> <details> <summary>buildkite/terminal-to-html (github.com/buildkite/terminal-to-html/v3)</summary> ### [`v3.17.3`](https://redirect.github.com/buildkite/terminal-to-html/releases/tag/v3.17.3) [Compare Source](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.2...v3.17.3) #### [v3.17.3](https://redirect.github.com/buildkite/terminal-to-html/tree/v3.17.3) [Full Changelog](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.2...v3.17.3) This release provides the Linux, macOS, and Windows binaries missing from v3.17.2. Apart from the version number, application code is unchanged from v3.17.2. ##### Changed - Prepare versioned binaries for v3.17.3. [#​293](https://redirect.github.com/buildkite/terminal-to-html/pull/293) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) - Document the draft-first binary release process, including artifact verification and immutable release restrictions. [#​292](https://redirect.github.com/buildkite/terminal-to-html/pull/292) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) ##### Included from v3.17.2 - Remove `html/template` from the rendering path to avoid a runtime trap when rendering with TinyGo, while preserving the generated HTML. [#​282](https://redirect.github.com/buildkite/terminal-to-html/pull/282) ([@​dannymidnight](https://redirect.github.com/dannymidnight)) - Raise the minimum supported Go version to **1.26.10** and update the development/CI Go Docker image. [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) - Bump `golang.org/x/sys` to 0.47.0. [#​280](https://redirect.github.com/buildkite/terminal-to-html/pull/280) ([@​dependabot](https://redirect.github.com/dependabot)\[bot]) ### [`v3.17.2`](https://redirect.github.com/buildkite/terminal-to-html/releases/tag/v3.17.2) [Compare Source](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.1...v3.17.2) #### [v3.17.2](https://redirect.github.com/buildkite/terminal-to-html/tree/v3.17.2) [Full Changelog](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.1...v3.17.2) ##### Fixed - Remove `html/template` from the rendering path to avoid a runtime trap when rendering with TinyGo, while preserving the generated HTML. [#​282](https://redirect.github.com/buildkite/terminal-to-html/pull/282) ([@​dannymidnight](https://redirect.github.com/dannymidnight)) ##### Changed - Raise the minimum supported Go version from 1.25.0 to 1.26.10. [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) ##### Dependency updates - Update the development/CI Go Docker image from 1.26.4 to 1.26.10. [#​281](https://redirect.github.com/buildkite/terminal-to-html/pull/281), [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) - Bump `golang.org/x/sys` from 0.46.0 to 0.47.0. [#​280](https://redirect.github.com/buildkite/terminal-to-html/pull/280) ([@​dependabot](https://redirect.github.com/dependabot)\[bot]) </details> <details> <summary>dlclark/regexp2 (github.com/dlclark/regexp2/v2)</summary> ### [`v2.11.0`](https://redirect.github.com/dlclark/regexp2/compare/v2.10.1...v2.11.0) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.10.1...v2.11.0) ### [`v2.10.1`](https://redirect.github.com/dlclark/regexp2/compare/v2.10.0...v2.10.1) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.10.0...v2.10.1) ### [`v2.10.0`](https://redirect.github.com/dlclark/regexp2/compare/v2.9.1...v2.10.0) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.9.1...v2.10.0) </details> <details> <summary>getkin/kin-openapi (github.com/getkin/kin-openapi)</summary> ### [`v0.152.0`](https://redirect.github.com/getkin/kin-openapi/releases/tag/v0.152.0) [Compare Source](https://redirect.github.com/getkin/kin-openapi/compare/v0.151.0...v0.152.0) #### What's Changed - openapi2conv: push path-level body/formData parameters into operations by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1340](https://redirect.github.com/getkin/kin-openapi/pull/1340) - fix(openapi3): resolve transitive component refs in JSON Schema 2020-12 validation by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1342](https://redirect.github.com/getkin/kin-openapi/pull/1342) - openapi3: honor readOnly/writeOnly from allOf schemas in required checks by [@​ybai08](https://redirect.github.com/ybai08) in [#​1343](https://redirect.github.com/getkin/kin-openapi/pull/1343) - openapi3: resolve $refs of Components.Links by [@​fenollp](https://redirect.github.com/fenollp) in [#​1344](https://redirect.github.com/getkin/kin-openapi/pull/1344) - openapi3: marshal a schema's empty type list as absent rather than null by [@​fenollp](https://redirect.github.com/fenollp) in [#​1345](https://redirect.github.com/getkin/kin-openapi/pull/1345) - openapi3: drop the Header dump from its content/schema error by [@​fenollp](https://redirect.github.com/fenollp) in [#​1346](https://redirect.github.com/getkin/kin-openapi/pull/1346) - openapi3gen: always propagate field tag by [@​phooijenga](https://redirect.github.com/phooijenga) in [#​1347](https://redirect.github.com/getkin/kin-openapi/pull/1347) - routers/gorillamux: return an error instead of panicking when registering routes by [@​fenollp](https://redirect.github.com/fenollp) in [#​1348](https://redirect.github.com/getkin/kin-openapi/pull/1348) - openapi3: report $refs to null nodes as unresolved instead of panicking by [@​fenollp](https://redirect.github.com/fenollp) in [#​1349](https://redirect.github.com/getkin/kin-openapi/pull/1349) - openapi3: validate null servers, server variables, tags and components without panicking by [@​fenollp](https://redirect.github.com/fenollp) in [#​1351](https://redirect.github.com/getkin/kin-openapi/pull/1351) - openapi2conv: fix FromV3Parameter panics on binary schema refs and value-less schemas by [@​fenollp](https://redirect.github.com/fenollp) in [#​1352](https://redirect.github.com/getkin/kin-openapi/pull/1352) - openapi3filter: parse integer values as base 10 by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1353](https://redirect.github.com/getkin/kin-openapi/pull/1353) - openapi3filter: decode spaceDelimited and pipeDelimited query objects by [@​ybai08](https://redirect.github.com/ybai08) in [#​1350](https://redirect.github.com/getkin/kin-openapi/pull/1350) - Case-sensitive usmarshalling with json/v2 by [@​fenollp](https://redirect.github.com/fenollp) in [#​1355](https://redirect.github.com/getkin/kin-openapi/pull/1355) - openapi3filter: decode deepObject and non-exploded form object properties of urlencoded bodies by [@​ybai08](https://redirect.github.com/ybai08) in [#​1354](https://redirect.github.com/getkin/kin-openapi/pull/1354) - openapi3: keep $ref siblings on a schema reached through a cycle by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1357](https://redirect.github.com/getkin/kin-openapi/pull/1357) - tests: go around encoding/json/v2's randomness in error message by [@​fenollp](https://redirect.github.com/fenollp) in [#​1361](https://redirect.github.com/getkin/kin-openapi/pull/1361) - tests: remove actual network calls from tests by [@​fenollp](https://redirect.github.com/fenollp) in [#​1362](https://redirect.github.com/getkin/kin-openapi/pull/1362) - tests: run more in parallel by [@​fenollp](https://redirect.github.com/fenollp) in [#​1363](https://redirect.github.com/getkin/kin-openapi/pull/1363) - openapi3: ignore reference siblings in OpenAPI 3.0 by [@​lucky798213](https://redirect.github.com/lucky798213) in [#​1268](https://redirect.github.com/getkin/kin-openapi/pull/1268) - openapi3: WalkSchemas and WalkParameters stop on a callback cycle by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1364](https://redirect.github.com/getkin/kin-openapi/pull/1364) - openapi3filter: validate response headers described with content by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1358](https://redirect.github.com/getkin/kin-openapi/pull/1358) - openapi3filter: honor ExcludeRequestQueryParams for path item parameters by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1365](https://redirect.github.com/getkin/kin-openapi/pull/1365) - openapi3: handle fields next to $ref as OpenAPI 3.0, 3.1 and 3.2 specify by [@​fenollp](https://redirect.github.com/fenollp) in [#​1371](https://redirect.github.com/getkin/kin-openapi/pull/1371) - changelog: fixup rebased messes by [@​fenollp](https://redirect.github.com/fenollp) in [#​1372](https://redirect.github.com/getkin/kin-openapi/pull/1372) #### New Contributors - [@​ybai08](https://redirect.github.com/ybai08) made their first contribution in [#​1343](https://redirect.github.com/getkin/kin-openapi/pull/1343) - [@​phooijenga](https://redirect.github.com/phooijenga) made their first contribution in [#​1347](https://redirect.github.com/getkin/kin-openapi/pull/1347) **Full Changelog**: <https://github.com/getkin/kin-openapi/compare/v0.151.0...v0.152.0> </details> <details> <summary>go-co-op/gocron (github.com/go-co-op/gocron/v2)</summary> ### [`v2.23.0`](https://redirect.github.com/go-co-op/gocron/releases/tag/v2.23.0) [Compare Source](https://redirect.github.com/go-co-op/gocron/compare/v2.22.0...v2.23.0) #### What's Changed - feat(scheduler): WithStartAtGrace opt-in tolerance for late first-run dispatch by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​945](https://redirect.github.com/go-co-op/gocron/pull/945) - fix(executor,scheduler): use injected clock for job timing and guard reschedule loop by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​946](https://redirect.github.com/go-co-op/gocron/pull/946) - fix(executor): attribute scheduling delay to the tick that actually fired by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​948](https://redirect.github.com/go-co-op/gocron/pull/948) - refactor(scheduler): extract shared first-run logic from selectNewJob/selectStart by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​947](https://redirect.github.com/go-co-op/gocron/pull/947) - build(deps): bump actions/setup-go from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​949](https://redirect.github.com/go-co-op/gocron/pull/949) - build(deps): bump actions/setup-python from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​950](https://redirect.github.com/go-co-op/gocron/pull/950) - ci: updating golangci-lint to 2.13.1 to support go 1.27 by [@​manuelarte](https://redirect.github.com/manuelarte) in [#​954](https://redirect.github.com/go-co-op/gocron/pull/954) - Exclude stable Go version in CI workflow by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​968](https://redirect.github.com/go-co-op/gocron/pull/968) - docs: removing retired go report badge by [@​manuelarte](https://redirect.github.com/manuelarte) in [#​952](https://redirect.github.com/go-co-op/gocron/pull/952) - build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​ > [!IMPORTANT] > ✂ PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzIuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
wxiaoguangandsilverwind
|
cdadd0c788 |
fix(actions): make Actions API work with repo admin permission (#40174)
The web route already uses "repo admin" for repo-level Actions management. * Fix #40173 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
 
|
2ed6a6f61b |
fix(web): read the wiki blob excerpt from the wiki repository (#40165)
The "load more lines" button in wiki diffs returned 404. `ExcerptBlob` loads the commit from the wiki repo but read the blob from `ctx.Repo.GitRepo`, a regression from https://github.com/go-gitea/gitea/pull/38464. Read the blob from the repo the commit was loaded from. --------- Co-authored-by: Abdel <hktitof@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
1f51d2c318 |
test: run e2e tests in WebKit on Linux (#40152)
WebKit was removed from the e2e tests in https://github.com/go-gitea/gitea/pull/37315 because Linux WebKit kept crashing. The crashes came from a use-after-free in the libsoup bundled with WebKit, which killed the network process and surfaced as `WebKit encountered an internal error`. macOS WebKit never had them because it does not use libsoup. Playwright 1.64 bundles libsoup 3.6.6 with the fix (https://github.com/microsoft/playwright/issues/42803), so WebKit now runs on all platforms. Builds on https://github.com/go-gitea/gitea/pull/40140. The e2e job ran 50 times on `ubuntu-latest` with WebKit enabled, and all runs passed without WebKit errors. The third browser adds about 1.5 to 2 minutes per run. 1. Playwright installs its system dependencies on GitHub runners too, which only come with the Chromium and Firefox libraries 1. The passkey test skips Linux WebKit, which has no WebAuthn, Playwright only stubs `PublicKeyCredential` there --------- Signed-off-by: silverwind <me@silverwind.io> |
||
 bircni
|
d3021b69ee |
enhance: replace tea CLI with gt (#40036)
tea has been replaced by [gitea-cli](https://gitea.com/gitea/cli) (`gt`), which reuses tea's OAuth2 client ID. - The repository clone panel now offers `gt repo clone owner/repo` under a "Gitea CLI" tab. - The built-in OAuth2 application is renamed from `tea` to `gitea-cli`. `tea` in `[oauth2] DEFAULT_APPLICATIONS` is still accepted as an alias, so existing configs keep working. - Instances that already registered the app keep its stored display name "tea". |
||
|
silverwindandwxiaoguang
|
c62e07f18a |
fix(projects): only require project write to move board cards (#40161)
Follow-up to https://github.com/go-gitea/gitea/pull/30205, per https://github.com/go-gitea/gitea/pull/30205#discussion_r4435046605. Moving a card on a project board is a project operation, so project write is enough again. Repository boards already show every card to project writers, who then got a 404 when moving one. The per-card archived check is removed too. The frontend sends every card of the target column, so one card from an archived repository rejected all drops and reorders into that column, silently. Project workflows already skip archived repositories, and an archived repository's own board is read-only. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
bircniandsilverwind
|
51368e1997 |
ci: use GitHub merge queue (#40130)
Requiring branches to be up to date reruns the full CI matrix on every waiting PR after each merge, which saturates our 20 concurrent jobs. A merge queue still tests against the latest `main`, but once per batch. This runs the PR workflows on `merge_group` and reports `giteabot/lgtm` on queue commits, since GiteaBot only sets it on PR heads. Mergers queue PRs with "Merge when ready" instead of `reviewed/wait-merge`, so giteabot no longer updates branches. Nothing changes until the `merge-queue` ruleset is enabled and "Require branches to be up to date" is turned off. Backport to `release/v28` before the ruleset covers it. --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
eba3a81c9a |
ci: build snap nightlies every 12 hours instead of on every push (#40150)
The snap nightly ran on every push to `main`, about 58 runs and 520 job minutes a week on GitHub-hosted runners, which share the concurrent job limit with PR CI. It now runs as a job in `release-nightly.yml`, reusing its 12-hourly check for new commits on `main`, like https://github.com/go-gitea/gitea/pull/40138 did for the other nightlies. A new release tag is still published by the first build after `main` changes. |
||
|
silverwind
|
2a5c34c379 |
fix(pull): reject pull requests without common history (#39872)
Pull requests between branches without a common history show no commits and can never be merged. The web form already rejects them, but the API and crafted `..` compare POSTs did not. The API compared with `..` since https://github.com/go-gitea/gitea/pull/36105, it now uses `...` again and returns 422 when there is no merge base. |
||
|
silverwind
|
91a49fadc1 |
fix(repo): don't get stuck generating contributor stats (#40125)
A failed contributor stats generation never released its lock, so after the cached error expired, the contributors and code frequency pages kept saying stats are being generated until a restart. A generation outlasting the 5 second wait also leaked its goroutine on an unread channel. The lock is now claimed atomically and released together with the completion signal when generation ends, and a cache miss after the wait counts as still generating. |
||
|
silverwind
|
db9d2944d8 |
fix(api): return language of starred and watched repositories (#40127)
The starred and watched repository API lists converted repositories without loading their attributes, so `language` was always empty. They are now loaded in one batch, owners included. Three of these handlers also continued after an internal error and wrote a second response body, they now return. |
||
 
|
da7b81d407 |
feat: add commitstatus access token scope (#40144)
Add `read:commitstatus` and `write:commitstatus` token scopes, so CI and
other integrations can report commit statuses without a token that
grants full repository access.
- The commit status endpoints (`/statuses/{sha}`,
`/commits/{ref}/status` and `/commits/{ref}/statuses`) accept the new
scopes, and the repository scopes keep working as they include them
- Creating a status still requires code write permission on the
repository, the scope only narrows what the token may do
- `public-only` tokens still cannot reach private repositories
- `PathGroup` middlewares now run only for a matched path, so unrelated
methods and paths that fall back to the group are not rejected by its
scope check
Fixes: https://github.com/go-gitea/gitea/issues/32625
Ref: https://github.com/go-gitea/gitea/pull/35383
Docs: https://gitea.com/gitea/docs/pulls/622
Signed-off-by: Norbert Szulc <norbert@not7cd.net>
Co-authored-by: Aiden Scandella <git@sca.ndella.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
|
||
|
GiteaBot
|
b46b820cec | [skip ci] Updated translations via Crowdin | ||
|
silverwind
|
5d84bbd525 |
test: run e2e tests in WebKit on macOS (#40140)
WebKit was removed from the e2e tests in https://github.com/go-gitea/gitea/pull/37315 because Linux WebKit kept crashing. `make test-e2e` on macOS now also runs WebKit, which does not show these crashes there. CI stays on Linux, because macOS runners would need about an extra GB of cache storage. 1. The bot account test clicks the user type dropdown, Safari only moves Tab focus between text fields 1. On macOS, Playwright runs with a single libuv thread, concurrent `getaddrinfo` lookups of `localhost` there sporadically stall for 5s --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
59cbacc924 |
ci: build nightlies every 12 hours instead of on every push (#40138)
Building nightlies on every push to `main` and `release/v*` costs about 1000 runner minutes a day, a third of it in runs cancelled by the next push. Nightlies now run every 12 hours and only build branches with commits since the last successful run. --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
a4d1711777 |
fix(api): remove git remote when deleting a push mirror (#40049)
Fixes https://github.com/go-gitea/gitea/issues/40037 `DELETE /repos/{owner}/{repo}/push_mirrors/{name}` only deleted the `push_mirror` row and left the `remote_mirror_*` git remotes, which embed the mirror credentials, in the repository and wiki config. Each create/delete cycle through the API left more credentials behind. - Remove the git remotes before deleting the row and record it in the audit log, like the web settings handler. - Return 404 for an unknown name, as documented, instead of 204. - Ignore an already missing code remote, so the wiki remote is still removed and such mirrors can be deleted through both the API and the web settings. --- AI disclosure: I used an AI coding assistant to help write this change and the PR description. I reviewed the code and ran the tests myself. --------- Signed-off-by: sarankumar1325 <120080287+sarankumar1325@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
|
4ed6f89b60 |
fix(auth): only auto-link the account the external identity points to (#40121)
With `[oauth2_client].ACCOUNT_LINKING = auto`, submitting the link account sign-up form with a user name or email that already exists linked the external identity to that existing account and signed in as it, without checking that the external identity belongs to that account. Automatic linking now only happens when the existing user matches the external identity: its email equals the provider email, or its name equals the user name derived from the provider (per `[oauth2_client].USERNAME`, same as auto registration). Otherwise the linking login page is shown, which requires the existing account's password. Auto registration is unchanged, since the name and email there already come from the provider. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
wxiaoguang
|
723095e66d | docs: update contributing.md (#40129) | ||
 Lunny Xiaoandsilverwind
|
40507491f7 |
perf(pull): load the repository once for all commit statuses (#39930)
Pages showing commit statuses loaded the repository of every status separately, so a PR with ~75 statuses ran ~75 identical repository queries per merge box render (about 3.4s in a production trace). `statusRepoCanReadActions` only loaded the repository inside the permission cache loader, which never runs once `RepoAssignment` has published the permission. - `CommitStatus.loadRepository` resolves through the request context cache - `statusRepoCanReadActions` loads the repository before the permission lookup - `RepoAssignment` publishes its repository to the context cache next to the permission - `GetCommitActionsStatusMap` drops its own repository map Queries per request with 50 statuses (45 Actions, 5 external) on the head commit, SQLite: | Page | Repository queries | Total queries | |---|---|---| | PR view | 61 → 11 | 157 → 107 | | Commit | 6 → 5 | 24 → 23 | | Branches | 6 → 5 | 33 → 32 | | Commits | 6 → 5 | 23 → 22 | | Repo home | 8 → 7 | 35 → 34 | | `/pulls` | 15 → 15 | 37 → 37 | --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
bbb8ef8244 |
fix(actions): default-branch push discards a due schedule occurrence (#40073)
Default-branch pushes and Actions unit saves recreated the repository's schedules with `Next` recomputed from that moment, so a push between a cron's due minute and the scheduler's pass skipped the occurrence, and `@every` timers restarted. Re-registration now updates schedule rows in place and keeps the spec rows of unchanged crons, so their cursor survives and an in-flight scheduler pass still finds its schedule. Re-detection also clears schedules when no scheduled workflow remains. Fixes https://github.com/go-gitea/gitea/issues/40062 Written with AI assistance. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 5.5) <noreply@anthropic.com> |
||
 
|
7df657116c |
fix(api): honor label archive options (#40008)
Updating a label through the API without `is_archived`, for example to rename or recolor it, silently unarchived it. Creating an organization label also ignored `is_archived`. - Keep a label's archive state when a PATCH omits `is_archived`, for repository and organization labels - Honor `is_archived` when creating organization labels, as repository labels already do AI-assisted by Codex (GPT-6); prepared and tested by the assistant. --------- Co-authored-by: Hello-Liar <80651389+Hello-Liar@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
9cd06bf57f |
fix(migrations): wait out GitHub rate limits and tolerate failed patch downloads (#40012)
Large GitHub migrations failed once the API budget ran out. A rejected request never updated the downloader's rate state, so go-github refused every retry locally. - Record the rate limit from error responses too, so the next request waits for the reset - Retry repository-wide comment pages like the other downloader calls - Stop `waitAndPickClient` spinning when the rate refresh fails - Skip reaction requests when the reaction rollup reports none - Log a failed patch download instead of failing the migration --------- Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
|
680f2a2598 |
fix: don't roll back branches on out-of-order post-receive hooks (#40110)
The post-receive hook wrote each push's new commit into the branch table. Each push runs its own hook after the ref is updated, so with pushes in close succession, like CI pushing back or a quick force-push, a slower first hook can finish last. The table then keeps the older commit, or marks a re-created branch as deleted. - The sync reads each pushed branch's state from git under a repo-scoped lock - Deletions go through the same sync, so a re-created branch stays active - A branch that fails to sync is logged and skipped instead of aborting the batch --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
|
70d0f190a1 |
perf: speed up repository issue and pull request lists (#40114)
The repository issue and pull request lists filter `access` by `repo_id`, which no index covers, so every load scans the whole table. Issue counts on larger repositories merge three single-column indices, and the API pull request list loads the latest reviews with `id IN (SELECT max(id) ... GROUP BY ...)`, which MySQL runs as a scan of every review, about 1.1s on https://gitea.com/api/v1/repos/gitea/gitea-mcp/pulls?limit=1. - Index `access.repo_id` - Index `team_repo.repo_id` - Replace the single `repo_id`, `is_closed` and `is_pull` indices with one `issue` index on `(repo_id, is_closed, is_pull)` - Join the latest review ids instead of `id IN (subquery)` Median times in ms on MySQL 8.4 with tables sized like gitea.com (1M access rows, 500k issues, 200k reviews), for a copy of https://gitea.com/gitea/gitea-mcp and a repository with 9.7k issues: | Page | Before | After | |---|---|---| | `/{owner}/{repo}/issues` | 107 | 40 | | `/{owner}/{repo}/pulls` | 106 | 32 | | `/{owner}/{repo}/pulls?state=closed` | 153 | 35 | | `/{owner}/{repo}/issues/{index}` | 141 | 60 | | `/{owner}/{repo}/issues`, 9.7k issues | 303 | 53 | | `/api/v1/repos/{owner}/{repo}/pulls?limit=50` | 180 | 46 | | `/api/v1/repos/{owner}/{repo}/pulls?limit=1` | 137 | 16 | | `/api/v1/repos/{owner}/{repo}/issues`, 9.7k issues | 248 | 43 | --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
silverwindandGiteabot
|
d58be0bcff |
fix(pull): keep review body in sync when its comment is edited (#40058)
A review's text is stored on both the review and its timeline comment, but editing it in the web UI or through the issue comment API only updated the comment. The reviews API kept returning the old body afterwards. Extracted out of https://github.com/go-gitea/gitea/pull/39865. *Written by Claude.* Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
36ea65a1df |
fix(projects): hide linked pull requests the viewer cannot read (#40016)
Project board cards list the pull requests that reference their issue, but loaded them without checking the viewer's access. A private pull request mentioning a public issue showed its title, number and state on that issue's board to anyone who can view the board, anonymous visitors included. Repository and organization boards now skip linked pull requests in repositories where the viewer cannot read pull requests, matching how the issue page already hides such references. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: Giteabot <teabot@gitea.io> |
||
 TheFox0x7
|
4144d4ed5b |
docs: update contributing.md (#39988)
Given recent weeks of fully LLM authored closures and mass replies in PRs with LLMs I find this entry hypocritical. |
||
|
silverwind
|
fc4d490b35 |
fix(ssh): let pushes finish when the client disconnects early (#40105)
With the built-in SSH server, closing the client connection cancelled the `gitea serv` process tree. go-git based clients close it right after the push report, so post-receive was killed and branches, pull requests, webhooks and Actions were not updated. The command now runs under the server's hammer context like with OpenSSH, where it ends once its pipes close or at shutdown. |
||
|
Lunny Xiaoandsilverwind
|
bd5fbcfb29 |
feat(migrations): add repository migration from bitbucket.org (#38607)
Adds migration from bitbucket.org as the Cloud variant of the Bitbucket entry, in the web UI and via `POST /repos/migrate` with `service=bitbucket`. It migrates the repository and pull requests with their comments and reviews. Bitbucket Cloud has no releases, and Atlassian removed its issues and wikis on 2026-08-20 (https://community.atlassian.com/forums/Bitbucket-articles/Announcing-sunset-of-Bitbucket-Issues-and-Wikis/ba-p/3193882). - Private repositories need an API or access token, which also raises the rate limit. - Rate-limited requests back off and retry, Bitbucket sends no `Retry-After`. - Tests replay recorded responses, set `BITBUCKET_READ_TOKEN` to re-record. Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
cc20c4c11b |
fix(actions): don't pick up jobs of repos with Actions disabled (#40106)
Repository-level and instance-level runners still picked up waiting jobs of repositories with Actions disabled. https://github.com/go-gitea/gitea/pull/30331 only covered owner-level runners, by filtering them out in SQL. Pickup now checks the Actions unit of each job it is about to claim, for every runner scope, and cancels the job instead when Actions is disabled, also honoring `DISABLED_REPO_UNITS`. Disabling Actions therefore cancels its queued jobs once a matching runner polls, instead of leaving them waiting until `ABANDONED_JOB_TIMEOUT`. |
||
 Lazizbek Ergashev
|
8465bed994 |
fix(pull): respect max approvers in default merge message (#40118)
The approver limit was checked before writing each `Reviewed-by:` line but compared with `>`, so the default merge message got one more trailer than `DEFAULT_MERGE_MESSAGE_MAX_APPROVERS` allows (2 with a limit of 1, 11 with the default 10). It now stops once the limit is reached. Fixes https://github.com/go-gitea/gitea/issues/40116 Assisted-by: Claude Code:claude-opus-5-5 |
||
|
silverwind
|
b89fcf7496 |
fix(actions): run review-triggered workflows on the pull request head (#40099)
Runs triggered by pull request reviews took their ref and commit from the review's `commit_id` instead of the pull request. They now use the pull request head like other pull request events, and their commit status is set on the commit that ran. |
||
|
405ba258a8 |
fix: list bot users in gitea admin user list and admin users API (#40060)
Fixes https://github.com/go-gitea/gitea/issues/40056 Signed-off-by: Soujas K <kudchadkarsoujas@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
|
6782d0a37d |
fix: harden context user access scope (#39945)
API tokens and Actions task tokens could see data beyond their scope
through user-scoped API routes and web profile pages.
- Actions task tokens authenticate as a shared system user with a
negative ID, which org, project and SSH/GPG key filters treated as "no
owner filter". These filters now check `!= 0`, so system users own
nothing. The `/api/v1/user` routes except `GET /api/v1/user` only accept
individual and bot accounts, and repo search no longer skips access
checks for the owner.
- `/{username}` only accepts tokens for RSS/Atom feeds. HTML profile and
org pages render as anonymous for token requests.
- User and org feeds require `read:user` or `read:organization` from
tokens, the same way repo feeds require `read:repository`.
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
|
||
 Shivansh Gargandsilverwind
|
365cb2bd5e |
enhance(admin): allow regenerating access tokens for bot accounts (#40109)
Bot accounts cannot sign in, so admins manage their access tokens, but the regenerate button was hidden for them. This adds an admin route to regenerate a bot's token. Token regeneration is now also recorded in the audit log. Fixes: https://github.com/go-gitea/gitea/issues/40074 Co-authored-by: silverwind <me@silverwind.io> |
||
 Jacky
|
08c5fcafd3 |
fix(mail): preserve outer spacing in notification emails (#40104)
Remove the `body {margin: 0; padding: 0}` reset from
https://github.com/go-gitea/gitea/pull/38396, which left HTML mails
flush against the edge in Apple Mail and Thunderbird. The devtest
preview stops injecting its own padding, so it matches delivered mails.
These clients render the mail as a document and apply the default 8px
body margin again, as with GitHub and GitLab notifications. Webmail
clients replace `<body>` and keep their own inset.
Fixes https://github.com/go-gitea/gitea/issues/40103
Assisted-by: Codex:GPT-6.1, Claude:Opus 5.5
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
GiteaBot
|
ae0136acd2 | [skip ci] Updated translations via Crowdin | ||
|
ab434f4b38 |
enhance(actions): list workflow_call-only workflows in their own sidebar group (#40030)
A workflow whose only trigger is `workflow_call` never runs on its own, so its sidebar entry always showed an empty run list and a "Disable workflow" action that has no effect. Following the discussion with @bircni and @Zettat123, these workflows are now listed in a separate collapsed "Reusable workflows" group. Their page shows "This workflow can only be called by other workflows." instead of "no runs", and "Disable workflow" and "Create status badge" are hidden. A workflow disabled before it became `workflow_call`-only keeps its label and "Enable workflow". "Other workflows" again only lists workflows whose file is gone. Fixes: https://github.com/go-gitea/gitea/issues/39385 Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
|
1aff9b8cd6 |
fix(api): answer 409 when repository files already exist on disk (#40095)
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Signed-off-by: hktitof <hktitof@users.noreply.github.com> Co-authored-by: hktitof <hktitof@users.noreply.github.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
fa41fc94d4 |
feat(pulls): support per-commit review (#39326)
Opening a single commit of a PR let you look, but not review. The Review button was disabled and there was no way to reach the next or previous commit. This finishes https://github.com/go-gitea/gitea/pull/37475, which only reached the head commit. - Reviews can be submitted from a single commit, a commit range stays disabled - A bar above a single-commit diff shows the commit, its position in the PR and prev/next buttons - The commit dropdown marks the commits on screen - Timeline commits open the PR's commit view, commits force-pushed out of the PR redirect to the repository commit page Assisted-by: Claude Code (Fable 5.1) Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
|
cbb563b080 |
fix(api): edit and delete repository labels by name (#39974)
Repo and org label endpoints accepted a label name for GET but only a
numeric ID for PATCH and DELETE, which breaks label-sync style tools.
- PATCH and DELETE on `/repos/{owner}/{repo}/labels/{id}` and
`/orgs/{org}/labels/{id}` accept a label name when the value is not
numeric, numeric values stay IDs
- A name shared by several labels returns 400 instead of acting on an
arbitrary one
- Deleting a missing label returns 404 instead of 204
- The swagger `id` parameter of these endpoints is now a string
Fixes: https://github.com/go-gitea/gitea/issues/34937
Co-authored-by: Hello-Liar <80651389+Hello-Liar@users.noreply.github.com>
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
silverwind
|
2a2fb86ca0 |
ci: update toolchains and let renovate update action inputs (#40092)
- Let renovate update hyphenated action inputs like `python-version` - Python 3.14 → 3.15 in CI - Download gh 2.103.2 directly in the release workflow instead of using `install-gh-cli-action` with 2.39.1 - Devcontainer Go image 1.26 → 1.27 - Snap build toolchains Go 1.26 → 1.27 and Node 24 → 26 |