mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-05 00:09:33 +09:00
d919301d36504d5fd79bb01b318b67befa3c7abc
3365
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  Giteabotandsilverwind
|
12b20c7c99 |
chore(deps): update dependencies (#40168)
> [!NOTE] > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | [@primer/octicons](https://primer.style/octicons) ([source](https://redirect.github.com/primer/octicons)) | [`19.41.0` → `19.42.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.41.0/19.42.0) |  |  | dependencies | minor | | | [@typescript-eslint/parser](https://typescript-eslint.io/packages/parser) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser)) | [`8.72.0` → `8.72.1`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.72.0/8.72.1) |  |  | devDependencies | patch | | | @​vitest/eslint-plugin | [`1.6.27` → `1.6.28`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.27/1.6.28) |  |  | devDependencies | patch | | | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | `v10.3.0` → `v10.3.2` |  |  | action | patch | `v10.3.3` | | [chart.js](https://www.chartjs.org) ([source](https://redirect.github.com/chartjs/Chart.js)) | [`4.5.1` → `4.6.1`](https://renovatebot.com/diffs/npm/chart.js/4.5.1/4.6.1) |  |  | dependencies | minor | | | [cli/cli](https://redirect.github.com/cli/cli) | `2.103.2` → `2.103.3` |  |  | | patch | | | [connectrpc.com/connect/v2](https://redirect.github.com/connectrpc/connect-go) | `v2.0.1` → `v2.0.2` |  |  | require | patch | | | [crowdin/github-action](https://redirect.github.com/crowdin/github-action) | `v3.4.0` → `v3.5.0` |  |  | action | minor | | | [djlint](https://redirect.github.com/djlint/djLint) | `==1.46.6` → `==1.47.1` |  |  | dependency-groups | minor | `1.49.2` (+4) | | [docker/login-action](https://redirect.github.com/docker/login-action) | `v4.6.0` → `v4.7.0` |  |  | action | minor | | | [elasticsearch](https://hub.docker.com/_/elasticsearch) ([source](https://redirect.github.com/elastic/dockerfiles)) | `3f4d63c` → `ef5cafd` | | | service | digest | | | [eslint-plugin-unicorn](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn) | [`78.0.0` → `79.0.0`](https://renovatebot.com/diffs/npm/eslint-plugin-unicorn/78.0.0/79.0.0) |  |  | devDependencies | major | | | [eslint-plugin-vue](https://eslint.vuejs.org) ([source](https://redirect.github.com/vuejs/eslint-plugin-vue)) | [`10.11.1` → `10.12.0`](https://renovatebot.com/diffs/npm/eslint-plugin-vue/10.11.1/10.12.0) |  |  | devDependencies | minor | | | [getmeili/meilisearch](https://redirect.github.com/meilisearch/meilisearch) | `c94e58c` → `1f578fa` | | | service | digest | | | [gitea.dev/sdk](https://gitea.com/gitea/go-sdk) | `v1.3.0` → `v1.5.0` |  |  | require | minor | `v1.5.1` | | [github.com/buildkite/terminal-to-html/v3](https://redirect.github.com/buildkite/terminal-to-html) | `v3.17.1` → `v3.17.3` |  |  | require | patch | | | [github.com/dlclark/regexp2/v2](https://redirect.github.com/dlclark/regexp2) | `v2.9.1` → `v2.11.0` |  |  | require | minor | `v2.12.0` | | [github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi) | `v0.151.0` → `v0.152.0` |  |  | require | minor | | | [github.com/go-co-op/gocron/v2](https://redirect.github.com/go-co-op/gocron) | `v2.22.0` → `v2.23.0` |  |  | require | minor | | | [github.com/go-redsync/redsync/v4](https://redirect.github.com/go-redsync/redsync) | `v4.18.0` → `v4.18.1` |  |  | require | patch | | | [github.com/google/pprof](https://redirect.github.com/google/pprof) | `1facf8f` → `dbd0ed3` |  |  | require | digest | | | [gitlab.com/gitlab-org/api/client-go/v3](https://gitlab.com/gitlab-org/api/client-go) | `v3.29.0` → `v3.39.1` |  |  | require | minor | `v3.40.2` (+3) | | [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) | `v1.84.0` → `v1.85.0` |  |  | require | minor | | | [katex](https://katex.org) ([source](https://redirect.github.com/KaTeX/KaTeX)) | [`0.19.0` → `0.19.1`](https://renovatebot.com/diffs/npm/katex/0.19.0/0.19.1) |  |  | dependencies | patch | | | [markdownlint-cli](https://redirect.github.com/igorshubovych/markdownlint-cli) | [`0.49.1` → `0.50.0`](https://renovatebot.com/diffs/npm/markdownlint-cli/0.49.1/0.50.0) |  |  | devDependencies | minor | | | [material-icon-theme](https://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/main/README.md) ([source](https://redirect.github.com/material-extensions/vscode-material-icon-theme)) | [`5.39.0` → `5.40.0`](https://renovatebot.com/diffs/npm/material-icon-theme/5.39.0/5.40.0) |  |  | devDependencies | minor | | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `v1.60.1` → `v1.61.0` |  |  | require | minor | `v1.61.1` | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`12.14.0` → `12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |  |  | packageManager | minor | | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`>= 12.14.0` → `>= 12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |  |  | engines | minor | | | [postcss](https://postcss.org/) ([source](https://redirect.github.com/postcss/postcss)) | [`8.5.31` → `8.5.32`](https://renovatebot.com/diffs/npm/postcss/8.5.31/8.5.32) |  |  | dependencies | patch | | | [renovate](https://renovatebot.com) ([source](https://redirect.github.com/renovatebot/renovate)) | [`44.172.2` → `44.190.1`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.172.2&to=44.190.1) |  |  | | minor | `44.200.0` (+21) | | [renovatebot/github-action](https://redirect.github.com/renovatebot/github-action) | `v46.3.9` → `v46.3.10` |  |  | action | patch | `v46.3.12` (+1) | | [typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)) | [`8.72.0` → `8.72.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.72.0/8.72.1) |  |  | devDependencies | patch | | | [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.3.4` → `8.3.5`](https://renovatebot.com/diffs/npm/vite/8.3.4/8.3.5) |  |  | dependencies | patch | | --- ### Release Notes <details> <summary>primer/octicons (@​primer/octicons)</summary> ### [`v19.42.0`](https://redirect.github.com/primer/octicons/releases/tag/%40primer/octicons%4019.42.0) [Compare Source](https://redirect.github.com/primer/octicons/compare/@primer/octicons@19.41.0...@primer/octicons@19.42.0) ##### Minor Changes - [#​1381](https://redirect.github.com/primer/octicons/pull/1381) [`d25ce68df9d08abd65431a8a48b45446432f1b45`](https://redirect.github.com/primer/octicons/commit/d25ce68df9d08abd65431a8a48b45446432f1b45) Thanks [@​edokoa](https://redirect.github.com/edokoa)! - Add the 16px `git-draft-agent`, `git-pull-request-agent`, `check-agent`, `git-que-merge-agent`, `git-closed-agent`, and `git-merge-agent` icons for agent-assisted draft, open, ready-to-merge, queued, closed, and merged pull request states. </details> <details> <summary>typescript-eslint/typescript-eslint (@​typescript-eslint/parser)</summary> ### [`v8.72.1`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8721-2026-10-26) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.72.0...v8.72.1) This was a version bump only for parser to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>astral-sh/setup-uv</summary> ### [`v10.3.2`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5 [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.1...v10.3.2) #### Changes #### 🧰 Maintenance - chore: update known checksums for 0.13.5 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1103](https://redirect.github.com/astral-sh/setup-uv/issues/1103)) #### 📚 Documentation - docs: update version references to v10.3.1 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1102](https://redirect.github.com/astral-sh/setup-uv/issues/1102)) ### [`v10.3.1`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.0...v10.3.1) #### Changes This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn `##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.` #### 🐛 Bug fixes - fix: preserve cache error class names in save-cache bundle [@​dannyward630](https://redirect.github.com/dannyward630) ([#​1093](https://redirect.github.com/astral-sh/setup-uv/issues/1093)) #### 🧰 Maintenance - chore: update known checksums for 0.13.4 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1099](https://redirect.github.com/astral-sh/setup-uv/issues/1099)) - chore: update known checksums for 0.13.2/0.13.3 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1098](https://redirect.github.com/astral-sh/setup-uv/issues/1098)) - chore: update known checksums for 0.13.1 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1094](https://redirect.github.com/astral-sh/setup-uv/issues/1094)) - Verify npm dependency signatures before builds [@​zaniebot](https://redirect.github.com/zaniebot) ([#​1027](https://redirect.github.com/astral-sh/setup-uv/issues/1027)) #### 📚 Documentation - docs: cache-dependency-glob matches relative to the working directory [@​flange-ipb](https://redirect.github.com/flange-ipb) ([#​1092](https://redirect.github.com/astral-sh/setup-uv/issues/1092)) - docs: update version references to v10.3.0 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1090](https://redirect.github.com/astral-sh/setup-uv/issues/1090)) #### ⬆️ Dependency updates - chore(deps): roll up Dependabot updates [@​eifinger](https://redirect.github.com/eifinger) ([#​1101](https://redirect.github.com/astral-sh/setup-uv/issues/1101)) </details> <details> <summary>chartjs/Chart.js (chart.js)</summary> ### [`v4.6.1`](https://redirect.github.com/chartjs/Chart.js/releases/tag/v4.6.1) [Compare Source](https://redirect.github.com/chartjs/Chart.js/compare/v4.5.1...v4.6.1) ### Essential Links - [npm](https://www.npmjs.com/package/chart.js) - [Migration guide](https://www.chartjs.org/docs/4.6.1/migration/v4-migration.html) - [Docs](https://www.chartjs.org/docs/4.6.1/) - [API](https://www.chartjs.org/docs/4.6.1/api/) - [Samples](https://www.chartjs.org/docs/4.6.1/samples/information.html) * [#​12355](https://redirect.github.com/chartjs/Chart.js/issues/12355) fix: trusted publishing fix + version 4.6.1 bump Thanks to [@​etimberg](https://redirect.github.com/etimberg) </details> <details> <summary>cli/cli</summary> ### [`v2.103.3`](https://redirect.github.com/cli/cli/releases/tag/v2.103.3): GitHub CLI 2.103.3 [Compare Source](https://redirect.github.com/cli/cli/compare/v2.103.2...v2.103.3) ##### What's Changed ##### 🐛 Fixes - fix(gh auth status): explain expired expiring tokens with `--no-refresh` by [@​babakks](https://redirect.github.com/babakks) in [#​14815](https://redirect.github.com/cli/cli/pull/14815) **Full Changelog**: <https://github.com/cli/cli/compare/v2.103.2...v2.103.3> </details> <details> <summary>connectrpc/connect-go (connectrpc.com/connect/v2)</summary> ### [`v2.0.2`](https://redirect.github.com/connectrpc/connect-go/releases/tag/v2.0.2) [Compare Source](https://redirect.github.com/connectrpc/connect-go/compare/v2.0.1...v2.0.2) #### What's Changed ##### Bugfixes - Fix data race reading ClientInfo after a cancelled call by [@​emcfarlane](https://redirect.github.com/emcfarlane) in [#​1036](https://redirect.github.com/connectrpc/connect-go/pull/1036) - List JSON charset variants in Accept-Post by [@​emcfarlane](https://redirect.github.com/emcfarlane) in [#​1037](https://redirect.github.com/connectrpc/connect-go/pull/1037) - Flush response headers in ServerStream.SendHeaders over HTTP by [@​raveesh-me](https://redirect.github.com/raveesh-me) in [#​1035](https://redirect.github.com/connectrpc/connect-go/pull/1035) - Stop reading oversized messages after rejecting them by [@​stefanvanburen](https://redirect.github.com/stefanvanburen) in [#​1039](https://redirect.github.com/connectrpc/connect-go/pull/1039) #### New Contributors - [@​raveesh-me](https://redirect.github.com/raveesh-me) made their first contribution in [#​1035](https://redirect.github.com/connectrpc/connect-go/pull/1035) **Full Changelog**: <https://github.com/connectrpc/connect-go/compare/v2.0.1...v2.0.2> </details> <details> <summary>crowdin/github-action</summary> ### [`v3.5.0`](https://redirect.github.com/crowdin/github-action/releases/tag/v3.5.0) [Compare Source](https://redirect.github.com/crowdin/github-action/compare/v3.4.0...v3.5.0) #### What's Changed - CLI [5.5.0](https://redirect.github.com/crowdin/crowdin-cli/releases/tag/5.5.0) by [@​andrii-bodnar](https://redirect.github.com/andrii-bodnar) **Full Changelog**: <https://github.com/crowdin/github-action/compare/v3.4.0...v3.5.0> </details> <details> <summary>djlint/djLint (djlint)</summary> ### [`v1.47.1`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1471---2026-10-26) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.47.0...v1.47.1) ##### Fix - `preserve-inline` in the `js` setting `brace_style` takes effect, so `{ bubbles: true }` stays on one line in a `<script>` or in an attribute formatted with `--format-attribute-js-json`. It used to be dropped before the code was formatted. - The json schema allows any option under `css` and `js`, so a strict validator such as Tombi no longer reports `indent_size` there. ### [`v1.47.0`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1470---2026-10-22) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.46.6...v1.47.0) ##### Feature - New option `--sort-load-tags` / `sort_load_tags` sorts the libraries in a `{% load %}` tag and drops the ones written twice, so `{% load static i18n %}` becomes `{% load i18n static %}`. In `{% load a b from library %}` the names before `from` are sorted. It is off by default: where two libraries define a tag or filter of the same name, the one loaded last wins, so sorting can change which one a template uses. - The formatter drops the spaces `H012` reports around an attribute's `=`, so `<div class = "a">` becomes `<div class="a">`. ##### Changed - `H010` reports the names the formatter lowercases, in any mix of case, so `Width="3"` is now reported. A framework binding such as `:itemID` or `@ID` and a longer name such as `data-ID` no longer are, since the formatter leaves their case alone. - `H018` is not reported under `--close-void-tags`, since the formatter then writes the `/>` ending the rule reports. `--ignore-case` already worked this way for `H009` and `H010`. ##### Fix - `H020` reports an empty pair whose end tag has whitespace before its `>`, such as `<div></div\n>`. - `H026` reports a `class` or `id` holding only whitespace, such as `class=" "`, and one written with spaces around the `=`. - `H033` reports an action padded at both ends once. It used to report it twice, unless an attribute before `action` happened to make the two reports look the same. - Markup written inside an attribute value, as in `<p title="<img src='a'>">`, is text, and `H005`, `H008`, `H010`, `H012`, `D018`, `J018`, `H024`, `H026`, `H029` and `H033` no longer report it. `H046` and `H051` read `tabindex` and `role` from the tag's own attributes, so `tabindex=1` written in a value or in the page text is not reported either. - `T001` and `T027` read a tag holding a dict, such as `{{ f({"a": {"b": 1}}) }}`, up to the `}}` that closes it rather than the first `}}` inside it. - `T032` steps over an escaped quote in a string, so the spaces in `{{ x|default:"a \"b c\"" }}` are not reported. - `H015` reports a heading followed by a tag on the same line anywhere in the file. It used to look only at the last line. - The rules that read a tag's attributes step over a template tag written in it, including a handlebars `{{{attrs}}}` and a dict as in `{{ {'class': 'x'}|xmlattr }}`, so `<img {{ attrs }} src='a'>` is reported by `H008`, which used to stop reading at the `{{`. - `T038` steps over a string in a block tag, so the `{%` in `{% with a="{%" %}` does not cut the tag short. ##### Performance - The rules that read a tag's attributes stop at a stray `<`, and `H015`, `H030`, `H036`, `T001`, `T027`, `T038` and `T039` no longer read the rest of the document again for each tag. A file holding thousands of unclosed tags or headings on one line is linted in a fraction of a second, where it used to take minutes. </details> <details> <summary>docker/login-action</summary> ### [`v4.7.0`](https://redirect.github.com/docker/login-action/releases/tag/v4.7.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.6.0...v4.7.0) - Preserve explicit ECR settings in `registry-auth` by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1089](https://redirect.github.com/docker/login-action/pull/1089) - Use registry hosts for scoped credentials by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1088](https://redirect.github.com/docker/login-action/pull/1088) - Raise Docker Hub OIDC max expiry to 6 hours by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1068](https://redirect.github.com/docker/login-action/pull/1068) - Log Docker Hub OIDC token exchange progress by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1061](https://redirect.github.com/docker/login-action/pull/1061) - Bump [@​aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://redirect.github.com/aws-sdk/client-ecr-public) to 3.1154.0 in [#​1093](https://redirect.github.com/docker/login-action/pull/1093) - Bump [@​docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit) from 0.94.0 to 0.107.0 in [#​1100](https://redirect.github.com/docker/login-action/pull/1100) - Bump [@​humanfs/node](https://redirect.github.com/humanfs/node) from 0.16.7 to 0.16.8 in [#​1077](https://redirect.github.com/docker/login-action/pull/1077) - Bump csv-parse from 7.0.1 to 7.0.3 in [#​1078](https://redirect.github.com/docker/login-action/pull/1078) - Bump handlebars from 4.7.9 to 4.7.10 in [#​1091](https://redirect.github.com/docker/login-action/pull/1091) - Bump js-yaml from 5.2.2 to 5.5.0 in [#​1066](https://redirect.github.com/docker/login-action/pull/1066) - Bump postcss from 8.5.22 to 8.5.26 in [#​1071](https://redirect.github.com/docker/login-action/pull/1071) - Bump postcss-selector-parser from 7.1.1 to 7.1.6 in [#​1092](https://redirect.github.com/docker/login-action/pull/1092) - Bump source-map-js from 1.2.1 to 1.2.2 in [#​1090](https://redirect.github.com/docker/login-action/pull/1090) - Bump undici from 6.27.0 to 6.29.1 in [#​1085](https://redirect.github.com/docker/login-action/pull/1085) - Bump uuid from 14.0.1 to 14.0.3 in [#​1096](https://redirect.github.com/docker/login-action/pull/1096) **Full Changelog**: <https://github.com/docker/login-action/compare/v4.6.0...v4.7.0> </details> <details> <summary>sindresorhus/eslint-plugin-unicorn (eslint-plugin-unicorn)</summary> ### [`v79.0.0`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/releases/tag/v79.0.0) [Compare Source](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/compare/v78.0.0...v79.0.0) #### Breaking - `no-top-level-side-effects`: Focus on mutations of globals, and remove it from the `unopinionated` preset ([#​3915](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3915)) [`24abac4`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/24abac48) - Unknown calls are no longer reported by default. Enable the new [`checkUnknownCalls`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/blob/main/docs/rules/no-top-level-side-effects.md#checkunknowncalls) option for stricter checking. - Mutations of globals, like `document.title = 'x'` and `Object.assign(globalThis, …)`, are now reported, also in declarations and default exports. You may see new reports. #### Improvements - Infer types from JSDoc `@type`, `@param`, and `@returns` annotations in rules that use type information ([#​3941](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3941)) [`2b4bfab`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/2b4bfab0) - Handle template literals without expressions like strings in more rules ([#​3943](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3943)) [`8bd8c06`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/8bd8c063) - Autofix more code that contains comments, while keeping the comments ([#​3939](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3939)) [`87baf82`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/87baf82f) - Fix autofixes in many rules that could produce broken code or wrong parentheses ([#​3917](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3917)) [`fed7eac`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/fed7eac2) - Make autofixes safer in many rules - Fixes that can change behavior in rare cases are now suggestions, for example in `prefer-spread`, `prefer-math-min-max`, `prefer-modern-dom-apis`, and `prefer-switch`. - Improve performance [`175efaf`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/175efaf1) [`3dd8fd2`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3dd8fd28) - `comment-content`: Add [`ignore`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/blob/main/docs/rules/comment-content.md#ignore) option ([#​3950](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3950)) [`3fe046e`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3fe046e6) - `consistent-function-scoping`: Ignore functions in Vitest hoisted factories ([#​3905](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3905)) [`98912a9`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/98912a91) - `custom-error-definition`: Ignore abstract TypeScript classes ([#​3934](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3934)) [`ee3501f`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/ee3501fb) - `no-non-function-verb-prefix`: Ignore shorthand destructuring ([#​3926](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3926)) [`76e5760`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/76e5760b) - `no-top-level-side-effects`: Recognize more config helpers ([#​3916](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3916)) [`d459c51`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/d459c511) - `no-useless-coercion`: Preserve boolean return types in TypeScript ([#​3904](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3904)) [`bef1571`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/bef15714) - `prefer-array-some`: Check `.find()` results used as booleans ([#​3913](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3913)) [`c957bf3`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/c957bf3d) - `prefer-default-parameters`: Skip unsafe logical OR fallbacks ([#​3951](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3951)) [`bcec97a`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/bcec97a4) - `prefer-includes`: Skip incompatible TypeScript search values ([#​3927](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3927)) [`d66441a`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/d66441aa) - `prefer-includes-over-repeated-comparisons`: Report negated and typed loose comparisons ([#​3935](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3935)) [`6e21cb1`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/6e21cb1b) - `prefer-includes-over-repeated-comparisons`: Preserve TypeScript union narrowing ([#​3910](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3910)) [`b5c479d`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/b5c479d8) - `prefer-literal-ascii`: Preserve escaped trailing spaces in templates ([#​3911](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3911)) [`360094b`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/360094bb) - `prefer-minimal-ternary`: Skip minimizations that break types ([#​3892](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3892)) [`f022d6d`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/f022d6d1) - `prefer-modern-math-apis`: Use suggestions for changes that can affect numeric results ([#​3914](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3914)) [`8af7c17`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/8af7c172) - `prefer-simple-condition-first`: Improve `typeof` comparisons and guards ([#​3948](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3948)) [`ee3edf0`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/ee3edf06) - `prefer-simplified-conditions`: Handle equivalent logical expressions ([#​3938](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3938)) [`a0b2788`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/a0b2788b) - `prefer-simplified-conditions`: Factor common terms in longer chains and static templates ([#​3942](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3942)) [`0d8c8bc`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/0d8c8bcb) - `prefer-smaller-scope`: Check TypeScript type aliases ([#​3928](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3928)) [`290d922`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/290d922c) - `prefer-string-raw`: Preserve TypeScript literal types in autofixes ([#​3912](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3912)) [`0611546`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/06115464) - `prefer-ternary`: Preserve consecutive early-return guards ([#​3945](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3945)) [`3fa840f`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3fa840fe) - `require-post-message-target-origin`: Skip incompatible typed methods ([#​3925](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3925)) [`387194b`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/387194bd) - `throw-new-error`: Ignore calls that return functions ([#​3894](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3894)) [`5e35def`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/5e35def7) *** </details> <details> <summary>vuejs/eslint-plugin-vue (eslint-plugin-vue)</summary> ### [`v10.12.0`](https://redirect.github.com/vuejs/eslint-plugin-vue/blob/HEAD/CHANGELOG.md#10120) [Compare Source](https://redirect.github.com/vuejs/eslint-plugin-vue/compare/v10.11.1...v10.12.0) ##### New rules - Added new [`vue/no-content-outside-block`](https://eslint.vuejs.org/rules/no-content-outside-block.html) rule ([#​3119](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3119)) - Added new [`vue/no-define-model-default`](https://eslint.vuejs.org/rules/no-define-model-default.html) rule ([#​3146](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3146)) - Added new [`vue/no-props-shadow`](https://eslint.vuejs.org/rules/no-props-shadow.html) rule ([#​3118](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3118)) ##### New rule options - Added `required` option to [`vue/block-lang`](https://eslint.vuejs.org/rules/block-lang.html) to report components that omit a required block entirely ([#​3125](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3125)) - Added `ignoreMixins` option to [`vue/require-explicit-emits`](https://eslint.vuejs.org/rules/require-explicit-emits.html) rule ([#​3141](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3141)) ##### Fixed false negatives (may result in more lint issues) - Added support for refs detected by type information, such as refs returned from composables, to [`vue/no-ref-as-operand`](https://eslint.vuejs.org/rules/no-ref-as-operand.html) rule ([#​3144](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3144)) - Fixed [`vue/no-dupe-keys`](https://eslint.vuejs.org/rules/no-dupe-keys.html) not reporting `defineModel()` names that collide with a prop, another model, or a `<script setup>` variable ([#​3163](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3163)) - Fixed [`vue/no-dupe-keys`](https://eslint.vuejs.org/rules/no-dupe-keys.html) not reporting `<script setup>` variables that shadow a prop while aliasing a different one, such as `const foo = toRef(props, 'bar')` ([#​3124](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3124)) - Fixed [`vue/no-multi-spaces`](https://eslint.vuejs.org/rules/no-multi-spaces.html) not reporting multiple spaces in the tags of some top-level blocks, e.g. `<script setup>` ([#​3162](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3162)) - Fixed [`vue/no-ref-as-operand`](https://eslint.vuejs.org/rules/no-ref-as-operand.html) and [`vue/no-ref-object-reactivity-loss`](https://eslint.vuejs.org/rules/no-ref-object-reactivity-loss.html) to also check refs created with `useTemplateRef()` ([#​3154](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3154)) - Fixed [`vue/no-unused-properties`](https://eslint.vuejs.org/rules/no-unused-properties.html) not reporting unused non-props properties in components that use `$props` as a whole (e.g. `v-bind="$props"`) ([#​3161](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3161)) - Fixed [`vue/padding-lines-in-component-definition`](https://eslint.vuejs.org/rules/padding-lines-in-component-definition.html) to check every pair of adjacent properties, not only the first, when `withinOption` or `withinEach` is not set ([#​3155](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3155)) - Fixed [`vue/require-default-prop`](https://eslint.vuejs.org/rules/require-default-prop.html), [`vue/no-boolean-default`](https://eslint.vuejs.org/rules/no-boolean-default.html), [`vue/no-required-prop-with-default`](https://eslint.vuejs.org/rules/no-required-prop-with-default.html) and [`vue/require-valid-default-prop`](https://eslint.vuejs.org/rules/require-valid-default-prop.html) not handling defaults that are passed to `withDefaults()` by reference or spread instead of an inline object literal ([#​3114](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3114)) ##### Fixed false positives (may result in fewer lint issues) - Changed [`vue/singleline-html-element-content-newline`](https://eslint.vuejs.org/rules/singleline-html-element-content-newline.html) and [`vue/multiline-html-element-content-newline`](https://eslint.vuejs.org/rules/multiline-html-element-content-newline.html) rules to ignore `router-link` and `nuxt-link` elements by default ([#​3165](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3165)) - Fixed [`vue/no-undef-properties`](https://eslint.vuejs.org/rules/no-undef-properties.html) false positives for properties returned via `...toRefs(reactive({ ... }))` from `setup()` ([#​3134](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3134)) - Fixed [`vue/require-typed-ref`](https://eslint.vuejs.org/rules/require-typed-ref.html) false positives when an explicit type annotation already applies to the `ref()` call ([#​3123](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3123)) - Fixed [`vue/v-if-else-key`](https://eslint.vuejs.org/rules/v-if-else-key.html) false positive for components with a bound `:key` ([#​3150](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3150)) ##### Other changes - Removed Reactivity Transform support from [`vue/no-ref-object-reactivity-loss`](https://eslint.vuejs.org/rules/no-ref-object-reactivity-loss.html), since the Reactivity Transform proposal was dropped from Vue ([#​3126](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3126)) - Changed [`vue/html-self-closing`](https://eslint.vuejs.org/rules/html-self-closing.html) to treat Vue's special `<slot>` and `<template>` elements as components (`html.component` option) instead of normal HTML elements ([#​3164](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3164)) - Changed [`vue/attributes-order`](https://eslint.vuejs.org/rules/attributes-order.html) rule to provide a suggestion instead of an autofix when the fix would move a binding across `v-bind="object"` ([#​3145](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3145)) - Improved performance of [`vue/no-reserved-component-names`](https://eslint.vuejs.org/rules/no-reserved-component-names.html) by no longer rebuilding its reserved name sets for every file ([#​3147](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3147)) </details> <details> <summary>gitea/go-sdk (gitea.dev/sdk)</summary> ### [`v1.5.0`](https://gitea.com/gitea/go-sdk/releases/tag/v1.5.0) [Compare Source](https://gitea.com/gitea/go-sdk/compare/v1.4.0...v1.5.0) #### What's Changed - feat: allow PAT-authenticated clients to manage access tokens in [#​840](https://gitea.com/gitea/go-sdk/pulls/840) - fix(pull): surface the server's error when a merge is refused in [#​870](https://gitea.com/gitea/go-sdk/pulls/870) - feat(hook): add name option to webhooks in [#​867](https://gitea.com/gitea/go-sdk/pulls/867) - feat: cover the API options gitea-cli still calls raw in [#​862](https://gitea.com/gitea/go-sdk/pulls/862) - ci: implement gitea's cache-seeder in [#​866](https://gitea.com/gitea/go-sdk/pulls/866) - Add bitbucketserver and forgejo migration service types in [#​868](https://gitea.com/gitea/go-sdk/pulls/868) - chore(deps): update dependencies in [#​869](https://gitea.com/gitea/go-sdk/pulls/869) - chore: remove the Client wrapper generator in [#​865](https://gitea.com/gitea/go-sdk/pulls/865) - feat: add force push and stale approval fields to branch protections in [#​864](https://gitea.com/gitea/go-sdk/pulls/864) #### Contributors - [@​sedlund](https://redirect.github.com/sedlund) - [@​Svtter](https://redirect.github.com/Svtter) - [@​SudhanshuSingh](https://redirect.github.com/SudhanshuSingh) - [@​bircni](https://redirect.github.com/bircni) - [@​silverwind](https://redirect.github.com/silverwind) - [@​lunny](https://redirect.github.com/lunny) - [@​renovate-bot](https://redirect.github.com/renovate-bot) #### New Contributors - [@​Svtter](https://redirect.github.com/Svtter) made their first contribution in [#​870](https://gitea.com/gitea/go-sdk/pulls/870) - [@​bircni](https://redirect.github.com/bircni) made their first contribution in [#​862](https://gitea.com/gitea/go-sdk/pulls/862) - [@​SudhanshuSingh](https://redirect.github.com/SudhanshuSingh) made their first contribution in [#​864](https://gitea.com/gitea/go-sdk/pulls/864) **Full Changelog**: [v1.4.0...v1.5.0](https://gitea.com/gitea/go-sdk/compare/v1.4.0...v1.5.0) ### [`v1.4.0`](https://gitea.com/gitea/go-sdk/releases/tag/v1.4.0) [Compare Source](https://gitea.com/gitea/go-sdk/compare/v1.3.0...v1.4.0) #### What's Changed - fix: retry server version lookup after failure in [#​829](https://gitea.com/gitea/go-sdk/pulls/829) - chore(deps): update dependencies, adapt to Gitea 28 in [#​863](https://gitea.com/gitea/go-sdk/pulls/863) - chore: update golangci-lint for Go 1.27.2, exclude dagger from Renovate in [#​861](https://gitea.com/gitea/go-sdk/pulls/861) **Note**: Gitea skipped 1.28, so the project and workflow run approve/cancel/logs APIs are now gated on Gitea 28.0.0. Clients pinning `SetGiteaVersion("1.28.0")` must switch to `"28.0.0"`. #### Contributors - [@​noeljackson](https://redirect.github.com/noeljackson) - [@​silverwind](https://redirect.github.com/silverwind) - [@​renovate-bot](https://redirect.github.com/renovate-bot) **Full Changelog**: [v1.3.0...v1.4.0](https://gitea.com/gitea/go-sdk/compare/v1.3.0...v1.4.0) Written by Claude. </details> <details> <summary>buildkite/terminal-to-html (github.com/buildkite/terminal-to-html/v3)</summary> ### [`v3.17.3`](https://redirect.github.com/buildkite/terminal-to-html/releases/tag/v3.17.3) [Compare Source](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.2...v3.17.3) #### [v3.17.3](https://redirect.github.com/buildkite/terminal-to-html/tree/v3.17.3) [Full Changelog](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.2...v3.17.3) This release provides the Linux, macOS, and Windows binaries missing from v3.17.2. Apart from the version number, application code is unchanged from v3.17.2. ##### Changed - Prepare versioned binaries for v3.17.3. [#​293](https://redirect.github.com/buildkite/terminal-to-html/pull/293) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) - Document the draft-first binary release process, including artifact verification and immutable release restrictions. [#​292](https://redirect.github.com/buildkite/terminal-to-html/pull/292) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) ##### Included from v3.17.2 - Remove `html/template` from the rendering path to avoid a runtime trap when rendering with TinyGo, while preserving the generated HTML. [#​282](https://redirect.github.com/buildkite/terminal-to-html/pull/282) ([@​dannymidnight](https://redirect.github.com/dannymidnight)) - Raise the minimum supported Go version to **1.26.10** and update the development/CI Go Docker image. [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) - Bump `golang.org/x/sys` to 0.47.0. [#​280](https://redirect.github.com/buildkite/terminal-to-html/pull/280) ([@​dependabot](https://redirect.github.com/dependabot)\[bot]) ### [`v3.17.2`](https://redirect.github.com/buildkite/terminal-to-html/releases/tag/v3.17.2) [Compare Source](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.1...v3.17.2) #### [v3.17.2](https://redirect.github.com/buildkite/terminal-to-html/tree/v3.17.2) [Full Changelog](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.1...v3.17.2) ##### Fixed - Remove `html/template` from the rendering path to avoid a runtime trap when rendering with TinyGo, while preserving the generated HTML. [#​282](https://redirect.github.com/buildkite/terminal-to-html/pull/282) ([@​dannymidnight](https://redirect.github.com/dannymidnight)) ##### Changed - Raise the minimum supported Go version from 1.25.0 to 1.26.10. [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) ##### Dependency updates - Update the development/CI Go Docker image from 1.26.4 to 1.26.10. [#​281](https://redirect.github.com/buildkite/terminal-to-html/pull/281), [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) - Bump `golang.org/x/sys` from 0.46.0 to 0.47.0. [#​280](https://redirect.github.com/buildkite/terminal-to-html/pull/280) ([@​dependabot](https://redirect.github.com/dependabot)\[bot]) </details> <details> <summary>dlclark/regexp2 (github.com/dlclark/regexp2/v2)</summary> ### [`v2.11.0`](https://redirect.github.com/dlclark/regexp2/compare/v2.10.1...v2.11.0) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.10.1...v2.11.0) ### [`v2.10.1`](https://redirect.github.com/dlclark/regexp2/compare/v2.10.0...v2.10.1) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.10.0...v2.10.1) ### [`v2.10.0`](https://redirect.github.com/dlclark/regexp2/compare/v2.9.1...v2.10.0) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.9.1...v2.10.0) </details> <details> <summary>getkin/kin-openapi (github.com/getkin/kin-openapi)</summary> ### [`v0.152.0`](https://redirect.github.com/getkin/kin-openapi/releases/tag/v0.152.0) [Compare Source](https://redirect.github.com/getkin/kin-openapi/compare/v0.151.0...v0.152.0) #### What's Changed - openapi2conv: push path-level body/formData parameters into operations by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1340](https://redirect.github.com/getkin/kin-openapi/pull/1340) - fix(openapi3): resolve transitive component refs in JSON Schema 2020-12 validation by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1342](https://redirect.github.com/getkin/kin-openapi/pull/1342) - openapi3: honor readOnly/writeOnly from allOf schemas in required checks by [@​ybai08](https://redirect.github.com/ybai08) in [#​1343](https://redirect.github.com/getkin/kin-openapi/pull/1343) - openapi3: resolve $refs of Components.Links by [@​fenollp](https://redirect.github.com/fenollp) in [#​1344](https://redirect.github.com/getkin/kin-openapi/pull/1344) - openapi3: marshal a schema's empty type list as absent rather than null by [@​fenollp](https://redirect.github.com/fenollp) in [#​1345](https://redirect.github.com/getkin/kin-openapi/pull/1345) - openapi3: drop the Header dump from its content/schema error by [@​fenollp](https://redirect.github.com/fenollp) in [#​1346](https://redirect.github.com/getkin/kin-openapi/pull/1346) - openapi3gen: always propagate field tag by [@​phooijenga](https://redirect.github.com/phooijenga) in [#​1347](https://redirect.github.com/getkin/kin-openapi/pull/1347) - routers/gorillamux: return an error instead of panicking when registering routes by [@​fenollp](https://redirect.github.com/fenollp) in [#​1348](https://redirect.github.com/getkin/kin-openapi/pull/1348) - openapi3: report $refs to null nodes as unresolved instead of panicking by [@​fenollp](https://redirect.github.com/fenollp) in [#​1349](https://redirect.github.com/getkin/kin-openapi/pull/1349) - openapi3: validate null servers, server variables, tags and components without panicking by [@​fenollp](https://redirect.github.com/fenollp) in [#​1351](https://redirect.github.com/getkin/kin-openapi/pull/1351) - openapi2conv: fix FromV3Parameter panics on binary schema refs and value-less schemas by [@​fenollp](https://redirect.github.com/fenollp) in [#​1352](https://redirect.github.com/getkin/kin-openapi/pull/1352) - openapi3filter: parse integer values as base 10 by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1353](https://redirect.github.com/getkin/kin-openapi/pull/1353) - openapi3filter: decode spaceDelimited and pipeDelimited query objects by [@​ybai08](https://redirect.github.com/ybai08) in [#​1350](https://redirect.github.com/getkin/kin-openapi/pull/1350) - Case-sensitive usmarshalling with json/v2 by [@​fenollp](https://redirect.github.com/fenollp) in [#​1355](https://redirect.github.com/getkin/kin-openapi/pull/1355) - openapi3filter: decode deepObject and non-exploded form object properties of urlencoded bodies by [@​ybai08](https://redirect.github.com/ybai08) in [#​1354](https://redirect.github.com/getkin/kin-openapi/pull/1354) - openapi3: keep $ref siblings on a schema reached through a cycle by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1357](https://redirect.github.com/getkin/kin-openapi/pull/1357) - tests: go around encoding/json/v2's randomness in error message by [@​fenollp](https://redirect.github.com/fenollp) in [#​1361](https://redirect.github.com/getkin/kin-openapi/pull/1361) - tests: remove actual network calls from tests by [@​fenollp](https://redirect.github.com/fenollp) in [#​1362](https://redirect.github.com/getkin/kin-openapi/pull/1362) - tests: run more in parallel by [@​fenollp](https://redirect.github.com/fenollp) in [#​1363](https://redirect.github.com/getkin/kin-openapi/pull/1363) - openapi3: ignore reference siblings in OpenAPI 3.0 by [@​lucky798213](https://redirect.github.com/lucky798213) in [#​1268](https://redirect.github.com/getkin/kin-openapi/pull/1268) - openapi3: WalkSchemas and WalkParameters stop on a callback cycle by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1364](https://redirect.github.com/getkin/kin-openapi/pull/1364) - openapi3filter: validate response headers described with content by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1358](https://redirect.github.com/getkin/kin-openapi/pull/1358) - openapi3filter: honor ExcludeRequestQueryParams for path item parameters by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1365](https://redirect.github.com/getkin/kin-openapi/pull/1365) - openapi3: handle fields next to $ref as OpenAPI 3.0, 3.1 and 3.2 specify by [@​fenollp](https://redirect.github.com/fenollp) in [#​1371](https://redirect.github.com/getkin/kin-openapi/pull/1371) - changelog: fixup rebased messes by [@​fenollp](https://redirect.github.com/fenollp) in [#​1372](https://redirect.github.com/getkin/kin-openapi/pull/1372) #### New Contributors - [@​ybai08](https://redirect.github.com/ybai08) made their first contribution in [#​1343](https://redirect.github.com/getkin/kin-openapi/pull/1343) - [@​phooijenga](https://redirect.github.com/phooijenga) made their first contribution in [#​1347](https://redirect.github.com/getkin/kin-openapi/pull/1347) **Full Changelog**: <https://github.com/getkin/kin-openapi/compare/v0.151.0...v0.152.0> </details> <details> <summary>go-co-op/gocron (github.com/go-co-op/gocron/v2)</summary> ### [`v2.23.0`](https://redirect.github.com/go-co-op/gocron/releases/tag/v2.23.0) [Compare Source](https://redirect.github.com/go-co-op/gocron/compare/v2.22.0...v2.23.0) #### What's Changed - feat(scheduler): WithStartAtGrace opt-in tolerance for late first-run dispatch by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​945](https://redirect.github.com/go-co-op/gocron/pull/945) - fix(executor,scheduler): use injected clock for job timing and guard reschedule loop by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​946](https://redirect.github.com/go-co-op/gocron/pull/946) - fix(executor): attribute scheduling delay to the tick that actually fired by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​948](https://redirect.github.com/go-co-op/gocron/pull/948) - refactor(scheduler): extract shared first-run logic from selectNewJob/selectStart by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​947](https://redirect.github.com/go-co-op/gocron/pull/947) - build(deps): bump actions/setup-go from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​949](https://redirect.github.com/go-co-op/gocron/pull/949) - build(deps): bump actions/setup-python from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​950](https://redirect.github.com/go-co-op/gocron/pull/950) - ci: updating golangci-lint to 2.13.1 to support go 1.27 by [@​manuelarte](https://redirect.github.com/manuelarte) in [#​954](https://redirect.github.com/go-co-op/gocron/pull/954) - Exclude stable Go version in CI workflow by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​968](https://redirect.github.com/go-co-op/gocron/pull/968) - docs: removing retired go report badge by [@​manuelarte](https://redirect.github.com/manuelarte) in [#​952](https://redirect.github.com/go-co-op/gocron/pull/952) - build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​ > [!IMPORTANT] > ✂ PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzIuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> --------- Co-authored-by: silverwind <me@silverwind.io> |
||
  
|
da7b81d407 |
feat: add commitstatus access token scope (#40144)
Add `read:commitstatus` and `write:commitstatus` token scopes, so CI and
other integrations can report commit statuses without a token that
grants full repository access.
- The commit status endpoints (`/statuses/{sha}`,
`/commits/{ref}/status` and `/commits/{ref}/statuses`) accept the new
scopes, and the repository scopes keep working as they include them
- Creating a status still requires code write permission on the
repository, the scope only narrows what the token may do
- `public-only` tokens still cannot reach private repositories
- `PathGroup` middlewares now run only for a matched path, so unrelated
methods and paths that fall back to the group are not rejected by its
scope check
Fixes: https://github.com/go-gitea/gitea/issues/32625
Ref: https://github.com/go-gitea/gitea/pull/35383
Docs: https://gitea.com/gitea/docs/pulls/622
Signed-off-by: Norbert Szulc <norbert@not7cd.net>
Co-authored-by: Aiden Scandella <git@sca.ndella.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
|
||
|
GiteaBot
|
b46b820cec | [skip ci] Updated translations via Crowdin | ||
 Lunny Xiaoandsilverwind
|
bd5fbcfb29 |
feat(migrations): add repository migration from bitbucket.org (#38607)
Adds migration from bitbucket.org as the Cloud variant of the Bitbucket entry, in the web UI and via `POST /repos/migrate` with `service=bitbucket`. It migrates the repository and pull requests with their comments and reviews. Bitbucket Cloud has no releases, and Atlassian removed its issues and wikis on 2026-08-20 (https://community.atlassian.com/forums/Bitbucket-articles/Announcing-sunset-of-Bitbucket-Issues-and-Wikis/ba-p/3193882). - Private repositories need an API or access token, which also raises the rate limit. - Rate-limited requests back off and retry, Bitbucket sends no `Retry-After`. - Tests replay recorded responses, set `BITBUCKET_READ_TOKEN` to re-record. Co-authored-by: silverwind <me@silverwind.io> |
||
|
GiteaBot
|
ae0136acd2 | [skip ci] Updated translations via Crowdin | ||
 
|
ab434f4b38 |
enhance(actions): list workflow_call-only workflows in their own sidebar group (#40030)
A workflow whose only trigger is `workflow_call` never runs on its own, so its sidebar entry always showed an empty run list and a "Disable workflow" action that has no effect. Following the discussion with @bircni and @Zettat123, these workflows are now listed in a separate collapsed "Reusable workflows" group. Their page shows "This workflow can only be called by other workflows." instead of "no runs", and "Disable workflow" and "Create status badge" are hidden. A workflow disabled before it became `workflow_call`-only keeps its label and "Enable workflow". "Other workflows" again only lists workflows whose file is gone. Fixes: https://github.com/go-gitea/gitea/issues/39385 Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
fa41fc94d4 |
feat(pulls): support per-commit review (#39326)
Opening a single commit of a PR let you look, but not review. The Review button was disabled and there was no way to reach the next or previous commit. This finishes https://github.com/go-gitea/gitea/pull/37475, which only reached the head commit. - Reviews can be submitted from a single commit, a commit range stays disabled - A bar above a single-commit diff shows the commit, its position in the PR and prev/next buttons - The commit dropdown marks the commits on screen - Timeline commits open the PR's commit view, commits force-pushed out of the PR redirect to the repository commit page Assisted-by: Claude Code (Fable 5.1) Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
GiteaBot
|
b2ce7efd3b | [skip ci] Updated translations via Crowdin | ||
|
GiteaBot
|
a4ff1dcac7 | [skip ci] Updated translations via Crowdin | ||
|
GiteaBot
|
f35c67bd79 | [skip ci] Updated translations via Crowdin | ||
|
GiteaBot
|
1657036ba6 | [skip ci] Updated translations via Crowdin | ||
|
silverwindandbircni
|
fc49368845 |
feat: Improve Gitea-compatible forge migrations, fix many migration bugs (#39424)
Supports migrating from Gitea-compatible forges like Forgejo and fixes many migration bugs. 1. Pre-release and `+gitea-` suffixed server versions no longer drop reviews, reactions and pagination. 2. Review states, dismissals, scoped and archived labels and merge bases are migrated. 3. Disabled units, external trackers, unavailable release assets, and GitLab confidential issues and internal notes are skipped. 4. Credentials are only sent to the source host, and `Retry-After` rate limits are waited out. 5. GitHub migrations of only issues or pull requests, basic auth clones and dismissed reviews work again. 6. The API returns 404 for releases of a disabled unit and shows migrated authors as mannequins, replacing the never populated `original_author` and `original_author_id` fields. Fixes: https://github.com/go-gitea/gitea/issues/19533 Fixes: https://github.com/go-gitea/gitea/issues/35885 Fixes: https://github.com/go-gitea/gitea/issues/18275 Fixes: https://github.com/go-gitea/gitea/issues/35069 Fixes: https://github.com/go-gitea/gitea/issues/17763 Fixes: https://github.com/go-gitea/gitea/issues/39548 Co-authored-by: bircni <bircni@icloud.com> |
||
|
GiteaBot
|
7c91252be3 | [skip ci] Updated translations via Crowdin | ||
|
Lunny Xiaoandbircni
|
a2da5cd7b5 |
feat(migrations): add migration from Bitbucket Server (Data Center) (#39913)
Add migration from Bitbucket Server (Data Center). It has no issues, wiki, milestones or releases, so those are not offered. Migrated: git data with tags and LFS, and pull requests with state, draft flag, merge commit/base, comments, approvals and inline code comments including resolved threads. Multi-line ranges become a `Lines a-b:` text prefix, as Gitea anchors code comments to one line. Auth is an HTTP access token (personal, project or repository) or username/password; 429 responses are retried. Changes outside the downloader: - `ReviewComment.Resolved`, applied by the uploader. - The uploader creates a fork PR's head branch from its head commit when already in the repository, instead of fetching the fork (Bitbucket keeps it in `refs/pull-requests/<id>/from`; private forks need credentials). Tested with unit tests, responses recorded from Bitbucket 10.5.1, and an end-to-end migration. Independent of https://github.com/go-gitea/gitea/pull/38607 (Bitbucket Cloud); the service type enum value needs adjusting for whichever lands second. --------- Co-authored-by: bircni <bircni@icloud.com> |
||
|
Lunny Xiao
|
c45af635e4 |
feat: Allow automatic project actions on events (#30205)
This PR introduces project workflows, allowing users to configure event-based automations directly from the UI. Users can define filters and actions for each workflow event, and duplicate existing events when needed. ### Concepts Every workflow is composed of `event`, `filters`, and `actions`. - **Event** - An Event defines when a workflow should be triggered. It represents specific activities such as an issue being added to the project, a pull request being merged, or a project column being changed. - **Filter** - A Filter refines when an event should take effect. It allows users to specify conditions like issue type, labels, or project columns to ensure actions only run in targeted scenarios. - **Action** - An Action defines what happens when the event and filters match. It performs operations such as adding labels, moving issues between columns, or changing the issue or pull request state. ### Available Events Currently, the following eight events are supported: - On issues/pull requests closed - On issues/pull requests reopened - On issues/pull requests was added to the project, including when created in it - On issues/pull requests was removed from the project - On issues/pull requests' column was changed - On code changes requested - On code review approved - On pull request merged Each event type supports its own set of filters and actions. ### Available Filters There are four types of filters that can be configured for an event: - **Apply to** - Specify the target type: `issues only`, `pull requests only`, or `issues and pull requests`. - **Labels** - Trigger the event only if the issue or pull request contains one or more specified labels. - **Move from column** - Filter events based on the original project column. - **Move to column** - Filter events based on the destination project column. ### Available Actions There are four types of actions that can be executed when an event is triggered: - **Add labels** - Automatically add one or more labels to the issue or pull request. - **Remove labels** - Remove one or more specified labels. - **Move to column** - Move the issue or pull request to a designated project column. - **Issue state** - Close or reopen the issue. Pull requests can only be closed. ### Enable/Disable an event workflow Each event workflow can be individually enabled or disabled. When disabled, the workflow will be ignored even if the event occurs. This feature is useful when you want to temporarily stop certain automated actions without deleting the workflow configuration. Workflows of closed projects don't run either. ### Clone an event workflow When you need multiple workflows for the same event, you can clone an existing event to create a new one with different filters and actions. This allows you to customize how the same event behaves under different conditions, making workflows more flexible and powerful. ### Permissions Permissions are checked when workflows are managed, not when they run: - Viewing a project's workflows needs read access to the project - Managing them needs write access to the project plus write access to both issues and pull requests of a repository project's repository, being an owner of an organization project's organization or a site administrator, or being the user of a user project. Tokens limited to public repositories can't manage owner-level projects' workflows - A workflow runs when its event happens to an item of an open project that can hold the item's repository, unless that repository is archived, no matter who caused the event, and applies its actions without further permission checks. Pull requests are never reopened - Changes show as made by "Project workflow" on behalf of the user who triggered the event and don't trigger other workflows - Only users who can read an item can put it on a board or move its card The management rule is also documented on `CanManageWorkflows` in `services/projects/workflow.go`. Fixes: #14359 Fixes: #26704 Fixes: #27990 Replaces: #28745 Documentation PR: https://gitea.com/gitea/docs/pulls/308 Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Giteabot <teabot@gitea.io> |
||
|
GiteaBot
|
a17f326c17 | [skip ci] Updated translations via Crowdin | ||
|
silverwind
|
f41cc4cd8d |
docs: clarify that the team packages permission covers all org packages (#39953)
The Packages row in the team settings read "Manage repository packages.", but packages belong to the owner, so a team's Packages permission applies to every package of the organization, regardless of the team's repositories. Reword it to say so. The docs get the same clarification in https://gitea.com/gitea/docs/pulls/605. |
||
|
GiteaBot
|
ef55965d98 | [skip ci] Updated translations via Crowdin | ||
|
GiteaBot
|
bb58160aed | [skip ci] Updated translations via Crowdin | ||
|
GiteaBot
|
f8dd2dd4cc | [skip ci] Updated translations via Crowdin | ||
|
bircniandsilverwind
|
ba4f8fa246 |
enhance(pull)!: add per-repository default squash merge commit message (#39816)
Adds a repository setting for the default squash merge commit message body with GitHub's options `PR_BODY`, `COMMIT_MESSAGES` and `BLANK`, also settable via `squash_merge_commit_message` in the API. The commit title stays the pull request title. 1. Breaking: API squash merges without `merge_message_field` now get the same default message as the web merge box instead of a title-only commit, which affects clients sending only `Do` like Renovate. An empty value keeps title-only. 2. Breaking: `[repository.pull-request] DEFAULT_SQUASH_MERGE_MESSAGE` replaces `POPULATE_SQUASH_COMMENT_WITH_COMMIT_MESSAGES`, which still works as a deprecated fallback. Repositories store the default when created or next saved. 3. Deprecated app.ini keys now migrate through one table instead of per-loader fallbacks, which also fixes the ignored `[mailer] CERT_FILE` and `KEY_FILE` fallbacks. Deprecation warnings no longer claim a removal version. <img width="1891" height="571" alt="grafik" src="https://github.com/user-attachments/assets/0fdcde13-1f11-4156-b598-d80eb0d04cbe" /> --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
GiteaBot
|
458eda0f1d | [skip ci] Updated translations via Crowdin | ||
|
13ddad6e07 |
enhance: allow custom watches to bypass on-mention email restriction (#39652)
Users with "Only Email on Mention" can now still receive email for the events they picked in a custom repository watch, covering issues, pull requests and releases. The setting is renamed to "Only Email on Mention and Custom Watches" to make this explicit, matching GitHub's "Participating, @mentions and custom". "All activity" watches don't bypass the setting, because they are also created automatically by `AUTO_WATCH_NEW_REPOS` for repository creators and team members. To keep picking every event distinct from "All activity", the custom watch dialog now stores a new `WatchModeCustom`. Existing custom watches keep working without a migration. ## Screenshots ### Before <img width="1650" height="675" alt="grafik" src="https://github.com/user-attachments/assets/ecc56e20-cd05-41e9-a840-607b352c50a8" /> ### After <img width="1657" height="671" alt="grafik" src="https://github.com/user-attachments/assets/a406db94-3ac4-4587-b840-0cd472b135c5" /> Addresses https://github.com/openSUSE/openSUSE-git/issues/183 Ref: https://github.com/go-gitea/gitea/issues/35492 --------- Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: Giteabot <teabot@gitea.io> |
||
 Max P.
|
a4908d4af4 |
enhance(actions): add OIDC workload identity support (#39052)
Adds OpenID Connect workload identity to Gitea Actions: jobs declaring `id-token: write` can request short-lived tokens to authenticate to cloud providers and other services without stored secrets. Tokens follow GitHub's format, so clients like `@actions/core` and existing trust policies carry over. - Issuer at `/api/actions/oidc` with discovery and JWKS, signed with a dedicated RS256 key - GitHub's claims, including `workflow_ref`, `job_workflow_ref` and the immutable `repo:owner@id/repo@id:ref:...` subject - `id-token: write` or `write-all` grant it, default permissions and fork pull requests never get it, owner and repository maximum permissions can disable it - Reusable workflows record the exact ref they were loaded from, and dispatch rejects refs that only resolve through a same-named tag - Generated signing keys are written atomically, and generated ES384 and ES512 OAuth2 keys use their own curves instead of P-256 - `github.ref_type` is `branch` for pull request runs, like on GitHub Fixes https://github.com/go-gitea/gitea/issues/26383 Fixes https://github.com/go-gitea/gitea/issues/33681 Docs: https://gitea.com/gitea/docs/pulls/526 Assisted-by: ChatGPT:gpt-5.6-sol, Claude Code:claude-opus-5-5 Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
GiteaBot
|
8d6b3e48d3 | [skip ci] Updated translations via Crowdin | ||
 
|
b015cd67e2 |
feat(repo): allow deleting protected branches (#39243)
This adds a Branch Deletion setting with three modes: disabled by default, anyone with push access, or a restricted user/team/deploy-key allowlist. The policy applies to Git pushes, API/UI deletion, and post-merge cleanup; the default branch and the pull request target branch remain undeletable. Closes https://github.com/go-gitea/gitea/issues/33305 --------- Co-authored-by: Enoque Duarte <12515551+enoquefcd@users.noreply.github.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
GiteaBot
|
f0434cd8f2 | [skip ci] Updated translations via Crowdin | ||
|
GiteaBot
|
bd28f254fa | [skip ci] Updated translations via Crowdin | ||
|
Giteabot
|
0eb0126fa2 | chore(deps): update dependencies (#39742) | ||
 wxiaoguangandTheFox0x7
|
01fe36985d |
chore: update license files with line wrapping (#39726)
fix #28960 --------- Co-authored-by: TheFox0x7 <thefox0x7@gmail.com> |
||
|
GiteaBot
|
437ca2dc6f | [skip ci] Updated translations via Crowdin | ||
|
GiteaBot
|
89ec271d9c | [skip ci] Updated translations via Crowdin | ||
|
GiteaBot
|
6e7de91f99 | [skip ci] Updated translations via Crowdin | ||
|
|
d16b20b972 |
feat(user): allow renaming security keys (webauthn/passkey) (#39413)
Closes https://github.com/go-gitea/gitea/issues/39287 Security key nicknames could only be set at registration, so a skipped nickname left an auto-generated hex name until the key was re-registered. Each key now has a Rename button opening a dialog with the current nickname. A nickname used by another of the user's keys (case-insensitive) or a blank nickname is rejected. Renames are recorded as `user:webauth:rename` audit events. Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
GiteaBot
|
b576f5bb34 | [skip ci] Updated translations via Crowdin | ||
|
GiteaBot
|
daaed0d7f4 | [skip ci] Updated translations via Crowdin | ||
|
|
e6ffbea888 |
refactor: move go-chi/binding into Gitea (#39528)
The `gitea.com/go-chi/binding` package only exists for Gitea, so it moves into `modules/web/binding` to fix its bugs directly. Split out of https://github.com/go-gitea/gitea/pull/39504. - GET and HEAD always bind the query - JSON `null` slice elements and nested `TrimSpace` fields bind correctly - Integer fields reject out-of-range values instead of wrapping - An empty JSON body binds nothing and an unknown binding rule is an error Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: bircni <bircni@icloud.com> |
||
|
fc68608603 |
fix(oauth2): allow users to approve scope changes (#38942)
Lets users approve an OAuth2 scope change on an existing grant instead of failing with `a grant exists with different scope`. - Approving a different scope updates the existing grant. Issued tokens follow immediately, since their scope is read from the grant. - Confidential and trusted apps show the consent page when the scope set changes, instead of silently reusing the old grant. - An omitted `scope` reuses the existing grant's scope, like GitHub. - The consent page lists newly added scopes. Fixes: https://github.com/go-gitea/gitea/issues/38940 Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: Giteabot <teabot@gitea.io> Co-authored-by: silverwind <me@silverwind.io> |
||
|
GiteaBot
|
f81a2ab69a | [skip ci] Updated translations via Crowdin | ||
|
GiteaBot
|
1ab2358d92 | [skip ci] Updated translations via Crowdin | ||
|
|
1b1274486c |
fix(git)!: use internal proxy for all git operations (#39426)
Introduces gitproxy module which spawns a small forward proxy as scanner for git calls Replaces hostmatcher with matchlist which supports port rules Deprecates ALLOWED_DOMAINS/BLOCKED_DOMAINS and ALLOW_LOCALNETWORKS settings in migration in favor of full names we have in security configs. Removes `external` preset in favor of lax/strict modes, strict mode requiring explicit ports if they aren't standard http/s ones. Breaking changes: - `external` preset no longer works as deny rule. To enforce that, use `strict` mode and allow ranges to connect to - Wildcards are no longer accepted in IP addresses - `*` is no longer allowed as entry in lists - domain rules now use curl like syntax `*.example.com` matching subdomains but not `example.com`, `example.com` matching itself and all subdomains. `example.*` is not a valid rule - In the default `lax` mode, `[security] ALLOWED_HOST_LIST` no longer restricts public hosts, set `EGRESS_MODE = strict` to keep an exclusive list. A startup warning flags this - Invalid list entries are logged at startup, invalid `BLOCKED_HOST_LIST`/`BLOCKED_DOMAINS` entries stop it Docs: https://gitea.com/gitea/docs/pulls/557 Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
GiteaBot
|
47529e225c | [skip ci] Updated translations via Crowdin | ||
|
silverwind
|
9e7b302bd3 | enhance(actions): add pending job status and align job statuses with GitHub (#39376) | ||
|
GiteaBot
|
3c5d2d1b63 | [skip ci] Updated translations via Crowdin | ||
|
3875db1974 |
feat(actions): add build queue view (#38585)
Adds a read-only Actions job queue: running jobs first, then waiting jobs in the order a runner picks them up. It is shown instance-wide in the admin Actions section with owner, repository and status filters, and per repository in the Actions tab. Both lists refresh in place. Pending work is currently only visible per repository and newest-first, so nothing shows what is queued, in which order, or what occupies the runners. Reordering the queue will be proposed separately. A migration adds indexes for the runner pickup query and repository-scoped status lookups. * Fix #34198 <img width="1345" height="451" alt="image" src="https://github.com/user-attachments/assets/7d52ff76-81b4-44e8-b583-d7d89c9dffcd" /> <img width="1809" height="1134" alt="image" src="https://github.com/user-attachments/assets/4d56c0cb-bae7-4ce2-8f3c-75163b2bc7f4" /> --------- Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
|
5a56e118e4 |
feat(actions): Add artifact preview in Actions run view (#36754)
Closes https://github.com/go-gitea/gitea/issues/33579. Adds browser previews for Actions artifacts. Selecting an artifact opens its file browser; selecting a file renders it in the same tab. The ZIP download remains available separately. Previews require sign-in and read access to the run. Text, image and PDF files are supported; rendered HTML and JavaScript run in a sandboxed frame and are labeled as automatically generated. The frame loads files from a signed link that expires after an hour, because its requests carry no session cookie. `[actions] ARTIFACT_PREVIEW_MAX_SIZE` limits total previewable artifact size (`0` disables previews; `-1` removes the limit); individual files also follow `[ui] MAX_DISPLAY_FILE_SIZE`. <img width="1803" height="913" alt="image" src="https://github.com/user-attachments/assets/a38fd704-2244-44fa-9181-c695ecbe0276" /> Docs: https://gitea.com/gitea/docs/pulls/533 --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Zettat123 <zettat123@gmail.com> |
||
|
GiteaBot
|
27d787d70a | [skip ci] Updated translations via Crowdin | ||
|
GiteaBot
|
2177969aba | [skip ci] Updated translations via Crowdin | ||
|
wxiaoguang
|
f14cedc4fa |
refactor: "install" page (#39400)
1. remove useless options 2. set AppDataPath instead of repo root path 3. make "disable self-registration" default enabled 4. avoid writing corrupted ini file 5. avoid auto-sign-in the existing admin user |
||
|
GiteaBot
|
de5913d647 | [skip ci] Updated translations via Crowdin |