mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-05 00:09:33 +09:00
f26a314636d00d3355e79902ecd4f5b8a94de619
514
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  silverwindandwxiaoguang
|
5c723ee0fd |
refactor(markdown): remove goldmark-highlighting (#39751)
Render fenced code blocks with Gitea's own code block renderer instead of `goldmark-highlighting`, using the managed lexer lookup from `modules/highlight`. Indented and fenced blocks now share one rendering path. Rendered output is unchanged. The trailing newline is stripped on copy in the frontend since https://github.com/go-gitea/gitea/pull/39755. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
 Giteabotandsilverwind
|
12b20c7c99 |
chore(deps): update dependencies (#40168)
> [!NOTE] > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | [@primer/octicons](https://primer.style/octicons) ([source](https://redirect.github.com/primer/octicons)) | [`19.41.0` → `19.42.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.41.0/19.42.0) |  |  | dependencies | minor | | | [@typescript-eslint/parser](https://typescript-eslint.io/packages/parser) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser)) | [`8.72.0` → `8.72.1`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.72.0/8.72.1) |  |  | devDependencies | patch | | | @​vitest/eslint-plugin | [`1.6.27` → `1.6.28`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.27/1.6.28) |  |  | devDependencies | patch | | | [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) | `v10.3.0` → `v10.3.2` |  |  | action | patch | `v10.3.3` | | [chart.js](https://www.chartjs.org) ([source](https://redirect.github.com/chartjs/Chart.js)) | [`4.5.1` → `4.6.1`](https://renovatebot.com/diffs/npm/chart.js/4.5.1/4.6.1) |  |  | dependencies | minor | | | [cli/cli](https://redirect.github.com/cli/cli) | `2.103.2` → `2.103.3` |  |  | | patch | | | [connectrpc.com/connect/v2](https://redirect.github.com/connectrpc/connect-go) | `v2.0.1` → `v2.0.2` |  |  | require | patch | | | [crowdin/github-action](https://redirect.github.com/crowdin/github-action) | `v3.4.0` → `v3.5.0` |  |  | action | minor | | | [djlint](https://redirect.github.com/djlint/djLint) | `==1.46.6` → `==1.47.1` |  |  | dependency-groups | minor | `1.49.2` (+4) | | [docker/login-action](https://redirect.github.com/docker/login-action) | `v4.6.0` → `v4.7.0` |  |  | action | minor | | | [elasticsearch](https://hub.docker.com/_/elasticsearch) ([source](https://redirect.github.com/elastic/dockerfiles)) | `3f4d63c` → `ef5cafd` | | | service | digest | | | [eslint-plugin-unicorn](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn) | [`78.0.0` → `79.0.0`](https://renovatebot.com/diffs/npm/eslint-plugin-unicorn/78.0.0/79.0.0) |  |  | devDependencies | major | | | [eslint-plugin-vue](https://eslint.vuejs.org) ([source](https://redirect.github.com/vuejs/eslint-plugin-vue)) | [`10.11.1` → `10.12.0`](https://renovatebot.com/diffs/npm/eslint-plugin-vue/10.11.1/10.12.0) |  |  | devDependencies | minor | | | [getmeili/meilisearch](https://redirect.github.com/meilisearch/meilisearch) | `c94e58c` → `1f578fa` | | | service | digest | | | [gitea.dev/sdk](https://gitea.com/gitea/go-sdk) | `v1.3.0` → `v1.5.0` |  |  | require | minor | `v1.5.1` | | [github.com/buildkite/terminal-to-html/v3](https://redirect.github.com/buildkite/terminal-to-html) | `v3.17.1` → `v3.17.3` |  |  | require | patch | | | [github.com/dlclark/regexp2/v2](https://redirect.github.com/dlclark/regexp2) | `v2.9.1` → `v2.11.0` |  |  | require | minor | `v2.12.0` | | [github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi) | `v0.151.0` → `v0.152.0` |  |  | require | minor | | | [github.com/go-co-op/gocron/v2](https://redirect.github.com/go-co-op/gocron) | `v2.22.0` → `v2.23.0` |  |  | require | minor | | | [github.com/go-redsync/redsync/v4](https://redirect.github.com/go-redsync/redsync) | `v4.18.0` → `v4.18.1` |  |  | require | patch | | | [github.com/google/pprof](https://redirect.github.com/google/pprof) | `1facf8f` → `dbd0ed3` |  |  | require | digest | | | [gitlab.com/gitlab-org/api/client-go/v3](https://gitlab.com/gitlab-org/api/client-go) | `v3.29.0` → `v3.39.1` |  |  | require | minor | `v3.40.2` (+3) | | [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) | `v1.84.0` → `v1.85.0` |  |  | require | minor | | | [katex](https://katex.org) ([source](https://redirect.github.com/KaTeX/KaTeX)) | [`0.19.0` → `0.19.1`](https://renovatebot.com/diffs/npm/katex/0.19.0/0.19.1) |  |  | dependencies | patch | | | [markdownlint-cli](https://redirect.github.com/igorshubovych/markdownlint-cli) | [`0.49.1` → `0.50.0`](https://renovatebot.com/diffs/npm/markdownlint-cli/0.49.1/0.50.0) |  |  | devDependencies | minor | | | [material-icon-theme](https://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/main/README.md) ([source](https://redirect.github.com/material-extensions/vscode-material-icon-theme)) | [`5.39.0` → `5.40.0`](https://renovatebot.com/diffs/npm/material-icon-theme/5.39.0/5.40.0) |  |  | devDependencies | minor | | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `v1.60.1` → `v1.61.0` |  |  | require | minor | `v1.61.1` | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`12.14.0` → `12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |  |  | packageManager | minor | | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`>= 12.14.0` → `>= 12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |  |  | engines | minor | | | [postcss](https://postcss.org/) ([source](https://redirect.github.com/postcss/postcss)) | [`8.5.31` → `8.5.32`](https://renovatebot.com/diffs/npm/postcss/8.5.31/8.5.32) |  |  | dependencies | patch | | | [renovate](https://renovatebot.com) ([source](https://redirect.github.com/renovatebot/renovate)) | [`44.172.2` → `44.190.1`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.172.2&to=44.190.1) |  |  | | minor | `44.200.0` (+21) | | [renovatebot/github-action](https://redirect.github.com/renovatebot/github-action) | `v46.3.9` → `v46.3.10` |  |  | action | patch | `v46.3.12` (+1) | | [typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)) | [`8.72.0` → `8.72.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.72.0/8.72.1) |  |  | devDependencies | patch | | | [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.3.4` → `8.3.5`](https://renovatebot.com/diffs/npm/vite/8.3.4/8.3.5) |  |  | dependencies | patch | | --- ### Release Notes <details> <summary>primer/octicons (@​primer/octicons)</summary> ### [`v19.42.0`](https://redirect.github.com/primer/octicons/releases/tag/%40primer/octicons%4019.42.0) [Compare Source](https://redirect.github.com/primer/octicons/compare/@primer/octicons@19.41.0...@primer/octicons@19.42.0) ##### Minor Changes - [#​1381](https://redirect.github.com/primer/octicons/pull/1381) [`d25ce68df9d08abd65431a8a48b45446432f1b45`](https://redirect.github.com/primer/octicons/commit/d25ce68df9d08abd65431a8a48b45446432f1b45) Thanks [@​edokoa](https://redirect.github.com/edokoa)! - Add the 16px `git-draft-agent`, `git-pull-request-agent`, `check-agent`, `git-que-merge-agent`, `git-closed-agent`, and `git-merge-agent` icons for agent-assisted draft, open, ready-to-merge, queued, closed, and merged pull request states. </details> <details> <summary>typescript-eslint/typescript-eslint (@​typescript-eslint/parser)</summary> ### [`v8.72.1`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8721-2026-10-26) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.72.0...v8.72.1) This was a version bump only for parser to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.72.1) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>astral-sh/setup-uv</summary> ### [`v10.3.2`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.2): 🌈 update known checksums for 0.13.5 [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.1...v10.3.2) #### Changes #### 🧰 Maintenance - chore: update known checksums for 0.13.5 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1103](https://redirect.github.com/astral-sh/setup-uv/issues/1103)) #### 📚 Documentation - docs: update version references to v10.3.1 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1102](https://redirect.github.com/astral-sh/setup-uv/issues/1102)) ### [`v10.3.1`](https://redirect.github.com/astral-sh/setup-uv/releases/tag/v10.3.1): 🌈 preserve cache error class names in save-cache bundle [Compare Source](https://redirect.github.com/astral-sh/setup-uv/compare/v10.3.0...v10.3.1) #### Changes This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn `##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.` #### 🐛 Bug fixes - fix: preserve cache error class names in save-cache bundle [@​dannyward630](https://redirect.github.com/dannyward630) ([#​1093](https://redirect.github.com/astral-sh/setup-uv/issues/1093)) #### 🧰 Maintenance - chore: update known checksums for 0.13.4 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1099](https://redirect.github.com/astral-sh/setup-uv/issues/1099)) - chore: update known checksums for 0.13.2/0.13.3 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1098](https://redirect.github.com/astral-sh/setup-uv/issues/1098)) - chore: update known checksums for 0.13.1 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1094](https://redirect.github.com/astral-sh/setup-uv/issues/1094)) - Verify npm dependency signatures before builds [@​zaniebot](https://redirect.github.com/zaniebot) ([#​1027](https://redirect.github.com/astral-sh/setup-uv/issues/1027)) #### 📚 Documentation - docs: cache-dependency-glob matches relative to the working directory [@​flange-ipb](https://redirect.github.com/flange-ipb) ([#​1092](https://redirect.github.com/astral-sh/setup-uv/issues/1092)) - docs: update version references to v10.3.0 @​[github-actions\[bot\]](https://redirect.github.com/apps/github-actions) ([#​1090](https://redirect.github.com/astral-sh/setup-uv/issues/1090)) #### ⬆️ Dependency updates - chore(deps): roll up Dependabot updates [@​eifinger](https://redirect.github.com/eifinger) ([#​1101](https://redirect.github.com/astral-sh/setup-uv/issues/1101)) </details> <details> <summary>chartjs/Chart.js (chart.js)</summary> ### [`v4.6.1`](https://redirect.github.com/chartjs/Chart.js/releases/tag/v4.6.1) [Compare Source](https://redirect.github.com/chartjs/Chart.js/compare/v4.5.1...v4.6.1) ### Essential Links - [npm](https://www.npmjs.com/package/chart.js) - [Migration guide](https://www.chartjs.org/docs/4.6.1/migration/v4-migration.html) - [Docs](https://www.chartjs.org/docs/4.6.1/) - [API](https://www.chartjs.org/docs/4.6.1/api/) - [Samples](https://www.chartjs.org/docs/4.6.1/samples/information.html) * [#​12355](https://redirect.github.com/chartjs/Chart.js/issues/12355) fix: trusted publishing fix + version 4.6.1 bump Thanks to [@​etimberg](https://redirect.github.com/etimberg) </details> <details> <summary>cli/cli</summary> ### [`v2.103.3`](https://redirect.github.com/cli/cli/releases/tag/v2.103.3): GitHub CLI 2.103.3 [Compare Source](https://redirect.github.com/cli/cli/compare/v2.103.2...v2.103.3) ##### What's Changed ##### 🐛 Fixes - fix(gh auth status): explain expired expiring tokens with `--no-refresh` by [@​babakks](https://redirect.github.com/babakks) in [#​14815](https://redirect.github.com/cli/cli/pull/14815) **Full Changelog**: <https://github.com/cli/cli/compare/v2.103.2...v2.103.3> </details> <details> <summary>connectrpc/connect-go (connectrpc.com/connect/v2)</summary> ### [`v2.0.2`](https://redirect.github.com/connectrpc/connect-go/releases/tag/v2.0.2) [Compare Source](https://redirect.github.com/connectrpc/connect-go/compare/v2.0.1...v2.0.2) #### What's Changed ##### Bugfixes - Fix data race reading ClientInfo after a cancelled call by [@​emcfarlane](https://redirect.github.com/emcfarlane) in [#​1036](https://redirect.github.com/connectrpc/connect-go/pull/1036) - List JSON charset variants in Accept-Post by [@​emcfarlane](https://redirect.github.com/emcfarlane) in [#​1037](https://redirect.github.com/connectrpc/connect-go/pull/1037) - Flush response headers in ServerStream.SendHeaders over HTTP by [@​raveesh-me](https://redirect.github.com/raveesh-me) in [#​1035](https://redirect.github.com/connectrpc/connect-go/pull/1035) - Stop reading oversized messages after rejecting them by [@​stefanvanburen](https://redirect.github.com/stefanvanburen) in [#​1039](https://redirect.github.com/connectrpc/connect-go/pull/1039) #### New Contributors - [@​raveesh-me](https://redirect.github.com/raveesh-me) made their first contribution in [#​1035](https://redirect.github.com/connectrpc/connect-go/pull/1035) **Full Changelog**: <https://github.com/connectrpc/connect-go/compare/v2.0.1...v2.0.2> </details> <details> <summary>crowdin/github-action</summary> ### [`v3.5.0`](https://redirect.github.com/crowdin/github-action/releases/tag/v3.5.0) [Compare Source](https://redirect.github.com/crowdin/github-action/compare/v3.4.0...v3.5.0) #### What's Changed - CLI [5.5.0](https://redirect.github.com/crowdin/crowdin-cli/releases/tag/5.5.0) by [@​andrii-bodnar](https://redirect.github.com/andrii-bodnar) **Full Changelog**: <https://github.com/crowdin/github-action/compare/v3.4.0...v3.5.0> </details> <details> <summary>djlint/djLint (djlint)</summary> ### [`v1.47.1`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1471---2026-10-26) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.47.0...v1.47.1) ##### Fix - `preserve-inline` in the `js` setting `brace_style` takes effect, so `{ bubbles: true }` stays on one line in a `<script>` or in an attribute formatted with `--format-attribute-js-json`. It used to be dropped before the code was formatted. - The json schema allows any option under `css` and `js`, so a strict validator such as Tombi no longer reports `indent_size` there. ### [`v1.47.0`](https://redirect.github.com/djlint/djLint/blob/HEAD/CHANGELOG.md#1470---2026-10-22) [Compare Source](https://redirect.github.com/djlint/djLint/compare/v1.46.6...v1.47.0) ##### Feature - New option `--sort-load-tags` / `sort_load_tags` sorts the libraries in a `{% load %}` tag and drops the ones written twice, so `{% load static i18n %}` becomes `{% load i18n static %}`. In `{% load a b from library %}` the names before `from` are sorted. It is off by default: where two libraries define a tag or filter of the same name, the one loaded last wins, so sorting can change which one a template uses. - The formatter drops the spaces `H012` reports around an attribute's `=`, so `<div class = "a">` becomes `<div class="a">`. ##### Changed - `H010` reports the names the formatter lowercases, in any mix of case, so `Width="3"` is now reported. A framework binding such as `:itemID` or `@ID` and a longer name such as `data-ID` no longer are, since the formatter leaves their case alone. - `H018` is not reported under `--close-void-tags`, since the formatter then writes the `/>` ending the rule reports. `--ignore-case` already worked this way for `H009` and `H010`. ##### Fix - `H020` reports an empty pair whose end tag has whitespace before its `>`, such as `<div></div\n>`. - `H026` reports a `class` or `id` holding only whitespace, such as `class=" "`, and one written with spaces around the `=`. - `H033` reports an action padded at both ends once. It used to report it twice, unless an attribute before `action` happened to make the two reports look the same. - Markup written inside an attribute value, as in `<p title="<img src='a'>">`, is text, and `H005`, `H008`, `H010`, `H012`, `D018`, `J018`, `H024`, `H026`, `H029` and `H033` no longer report it. `H046` and `H051` read `tabindex` and `role` from the tag's own attributes, so `tabindex=1` written in a value or in the page text is not reported either. - `T001` and `T027` read a tag holding a dict, such as `{{ f({"a": {"b": 1}}) }}`, up to the `}}` that closes it rather than the first `}}` inside it. - `T032` steps over an escaped quote in a string, so the spaces in `{{ x|default:"a \"b c\"" }}` are not reported. - `H015` reports a heading followed by a tag on the same line anywhere in the file. It used to look only at the last line. - The rules that read a tag's attributes step over a template tag written in it, including a handlebars `{{{attrs}}}` and a dict as in `{{ {'class': 'x'}|xmlattr }}`, so `<img {{ attrs }} src='a'>` is reported by `H008`, which used to stop reading at the `{{`. - `T038` steps over a string in a block tag, so the `{%` in `{% with a="{%" %}` does not cut the tag short. ##### Performance - The rules that read a tag's attributes stop at a stray `<`, and `H015`, `H030`, `H036`, `T001`, `T027`, `T038` and `T039` no longer read the rest of the document again for each tag. A file holding thousands of unclosed tags or headings on one line is linted in a fraction of a second, where it used to take minutes. </details> <details> <summary>docker/login-action</summary> ### [`v4.7.0`](https://redirect.github.com/docker/login-action/releases/tag/v4.7.0) [Compare Source](https://redirect.github.com/docker/login-action/compare/v4.6.0...v4.7.0) - Preserve explicit ECR settings in `registry-auth` by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1089](https://redirect.github.com/docker/login-action/pull/1089) - Use registry hosts for scoped credentials by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1088](https://redirect.github.com/docker/login-action/pull/1088) - Raise Docker Hub OIDC max expiry to 6 hours by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1068](https://redirect.github.com/docker/login-action/pull/1068) - Log Docker Hub OIDC token exchange progress by [@​crazy-max](https://redirect.github.com/crazy-max) in [#​1061](https://redirect.github.com/docker/login-action/pull/1061) - Bump [@​aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) and [@​aws-sdk/client-ecr-public](https://redirect.github.com/aws-sdk/client-ecr-public) to 3.1154.0 in [#​1093](https://redirect.github.com/docker/login-action/pull/1093) - Bump [@​docker/actions-toolkit](https://redirect.github.com/docker/actions-toolkit) from 0.94.0 to 0.107.0 in [#​1100](https://redirect.github.com/docker/login-action/pull/1100) - Bump [@​humanfs/node](https://redirect.github.com/humanfs/node) from 0.16.7 to 0.16.8 in [#​1077](https://redirect.github.com/docker/login-action/pull/1077) - Bump csv-parse from 7.0.1 to 7.0.3 in [#​1078](https://redirect.github.com/docker/login-action/pull/1078) - Bump handlebars from 4.7.9 to 4.7.10 in [#​1091](https://redirect.github.com/docker/login-action/pull/1091) - Bump js-yaml from 5.2.2 to 5.5.0 in [#​1066](https://redirect.github.com/docker/login-action/pull/1066) - Bump postcss from 8.5.22 to 8.5.26 in [#​1071](https://redirect.github.com/docker/login-action/pull/1071) - Bump postcss-selector-parser from 7.1.1 to 7.1.6 in [#​1092](https://redirect.github.com/docker/login-action/pull/1092) - Bump source-map-js from 1.2.1 to 1.2.2 in [#​1090](https://redirect.github.com/docker/login-action/pull/1090) - Bump undici from 6.27.0 to 6.29.1 in [#​1085](https://redirect.github.com/docker/login-action/pull/1085) - Bump uuid from 14.0.1 to 14.0.3 in [#​1096](https://redirect.github.com/docker/login-action/pull/1096) **Full Changelog**: <https://github.com/docker/login-action/compare/v4.6.0...v4.7.0> </details> <details> <summary>sindresorhus/eslint-plugin-unicorn (eslint-plugin-unicorn)</summary> ### [`v79.0.0`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/releases/tag/v79.0.0) [Compare Source](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/compare/v78.0.0...v79.0.0) #### Breaking - `no-top-level-side-effects`: Focus on mutations of globals, and remove it from the `unopinionated` preset ([#​3915](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3915)) [`24abac4`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/24abac48) - Unknown calls are no longer reported by default. Enable the new [`checkUnknownCalls`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/blob/main/docs/rules/no-top-level-side-effects.md#checkunknowncalls) option for stricter checking. - Mutations of globals, like `document.title = 'x'` and `Object.assign(globalThis, …)`, are now reported, also in declarations and default exports. You may see new reports. #### Improvements - Infer types from JSDoc `@type`, `@param`, and `@returns` annotations in rules that use type information ([#​3941](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3941)) [`2b4bfab`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/2b4bfab0) - Handle template literals without expressions like strings in more rules ([#​3943](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3943)) [`8bd8c06`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/8bd8c063) - Autofix more code that contains comments, while keeping the comments ([#​3939](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3939)) [`87baf82`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/87baf82f) - Fix autofixes in many rules that could produce broken code or wrong parentheses ([#​3917](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3917)) [`fed7eac`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/fed7eac2) - Make autofixes safer in many rules - Fixes that can change behavior in rare cases are now suggestions, for example in `prefer-spread`, `prefer-math-min-max`, `prefer-modern-dom-apis`, and `prefer-switch`. - Improve performance [`175efaf`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/175efaf1) [`3dd8fd2`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3dd8fd28) - `comment-content`: Add [`ignore`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/blob/main/docs/rules/comment-content.md#ignore) option ([#​3950](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3950)) [`3fe046e`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3fe046e6) - `consistent-function-scoping`: Ignore functions in Vitest hoisted factories ([#​3905](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3905)) [`98912a9`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/98912a91) - `custom-error-definition`: Ignore abstract TypeScript classes ([#​3934](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3934)) [`ee3501f`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/ee3501fb) - `no-non-function-verb-prefix`: Ignore shorthand destructuring ([#​3926](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3926)) [`76e5760`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/76e5760b) - `no-top-level-side-effects`: Recognize more config helpers ([#​3916](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3916)) [`d459c51`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/d459c511) - `no-useless-coercion`: Preserve boolean return types in TypeScript ([#​3904](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3904)) [`bef1571`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/bef15714) - `prefer-array-some`: Check `.find()` results used as booleans ([#​3913](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3913)) [`c957bf3`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/c957bf3d) - `prefer-default-parameters`: Skip unsafe logical OR fallbacks ([#​3951](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3951)) [`bcec97a`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/bcec97a4) - `prefer-includes`: Skip incompatible TypeScript search values ([#​3927](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3927)) [`d66441a`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/d66441aa) - `prefer-includes-over-repeated-comparisons`: Report negated and typed loose comparisons ([#​3935](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3935)) [`6e21cb1`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/6e21cb1b) - `prefer-includes-over-repeated-comparisons`: Preserve TypeScript union narrowing ([#​3910](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3910)) [`b5c479d`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/b5c479d8) - `prefer-literal-ascii`: Preserve escaped trailing spaces in templates ([#​3911](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3911)) [`360094b`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/360094bb) - `prefer-minimal-ternary`: Skip minimizations that break types ([#​3892](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3892)) [`f022d6d`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/f022d6d1) - `prefer-modern-math-apis`: Use suggestions for changes that can affect numeric results ([#​3914](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3914)) [`8af7c17`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/8af7c172) - `prefer-simple-condition-first`: Improve `typeof` comparisons and guards ([#​3948](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3948)) [`ee3edf0`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/ee3edf06) - `prefer-simplified-conditions`: Handle equivalent logical expressions ([#​3938](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3938)) [`a0b2788`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/a0b2788b) - `prefer-simplified-conditions`: Factor common terms in longer chains and static templates ([#​3942](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3942)) [`0d8c8bc`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/0d8c8bcb) - `prefer-smaller-scope`: Check TypeScript type aliases ([#​3928](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3928)) [`290d922`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/290d922c) - `prefer-string-raw`: Preserve TypeScript literal types in autofixes ([#​3912](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3912)) [`0611546`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/06115464) - `prefer-ternary`: Preserve consecutive early-return guards ([#​3945](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3945)) [`3fa840f`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/3fa840fe) - `require-post-message-target-origin`: Skip incompatible typed methods ([#​3925](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3925)) [`387194b`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/387194bd) - `throw-new-error`: Ignore calls that return functions ([#​3894](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/issues/3894)) [`5e35def`](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn/commit/5e35def7) *** </details> <details> <summary>vuejs/eslint-plugin-vue (eslint-plugin-vue)</summary> ### [`v10.12.0`](https://redirect.github.com/vuejs/eslint-plugin-vue/blob/HEAD/CHANGELOG.md#10120) [Compare Source](https://redirect.github.com/vuejs/eslint-plugin-vue/compare/v10.11.1...v10.12.0) ##### New rules - Added new [`vue/no-content-outside-block`](https://eslint.vuejs.org/rules/no-content-outside-block.html) rule ([#​3119](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3119)) - Added new [`vue/no-define-model-default`](https://eslint.vuejs.org/rules/no-define-model-default.html) rule ([#​3146](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3146)) - Added new [`vue/no-props-shadow`](https://eslint.vuejs.org/rules/no-props-shadow.html) rule ([#​3118](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3118)) ##### New rule options - Added `required` option to [`vue/block-lang`](https://eslint.vuejs.org/rules/block-lang.html) to report components that omit a required block entirely ([#​3125](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3125)) - Added `ignoreMixins` option to [`vue/require-explicit-emits`](https://eslint.vuejs.org/rules/require-explicit-emits.html) rule ([#​3141](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3141)) ##### Fixed false negatives (may result in more lint issues) - Added support for refs detected by type information, such as refs returned from composables, to [`vue/no-ref-as-operand`](https://eslint.vuejs.org/rules/no-ref-as-operand.html) rule ([#​3144](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3144)) - Fixed [`vue/no-dupe-keys`](https://eslint.vuejs.org/rules/no-dupe-keys.html) not reporting `defineModel()` names that collide with a prop, another model, or a `<script setup>` variable ([#​3163](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3163)) - Fixed [`vue/no-dupe-keys`](https://eslint.vuejs.org/rules/no-dupe-keys.html) not reporting `<script setup>` variables that shadow a prop while aliasing a different one, such as `const foo = toRef(props, 'bar')` ([#​3124](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3124)) - Fixed [`vue/no-multi-spaces`](https://eslint.vuejs.org/rules/no-multi-spaces.html) not reporting multiple spaces in the tags of some top-level blocks, e.g. `<script setup>` ([#​3162](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3162)) - Fixed [`vue/no-ref-as-operand`](https://eslint.vuejs.org/rules/no-ref-as-operand.html) and [`vue/no-ref-object-reactivity-loss`](https://eslint.vuejs.org/rules/no-ref-object-reactivity-loss.html) to also check refs created with `useTemplateRef()` ([#​3154](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3154)) - Fixed [`vue/no-unused-properties`](https://eslint.vuejs.org/rules/no-unused-properties.html) not reporting unused non-props properties in components that use `$props` as a whole (e.g. `v-bind="$props"`) ([#​3161](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3161)) - Fixed [`vue/padding-lines-in-component-definition`](https://eslint.vuejs.org/rules/padding-lines-in-component-definition.html) to check every pair of adjacent properties, not only the first, when `withinOption` or `withinEach` is not set ([#​3155](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3155)) - Fixed [`vue/require-default-prop`](https://eslint.vuejs.org/rules/require-default-prop.html), [`vue/no-boolean-default`](https://eslint.vuejs.org/rules/no-boolean-default.html), [`vue/no-required-prop-with-default`](https://eslint.vuejs.org/rules/no-required-prop-with-default.html) and [`vue/require-valid-default-prop`](https://eslint.vuejs.org/rules/require-valid-default-prop.html) not handling defaults that are passed to `withDefaults()` by reference or spread instead of an inline object literal ([#​3114](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3114)) ##### Fixed false positives (may result in fewer lint issues) - Changed [`vue/singleline-html-element-content-newline`](https://eslint.vuejs.org/rules/singleline-html-element-content-newline.html) and [`vue/multiline-html-element-content-newline`](https://eslint.vuejs.org/rules/multiline-html-element-content-newline.html) rules to ignore `router-link` and `nuxt-link` elements by default ([#​3165](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3165)) - Fixed [`vue/no-undef-properties`](https://eslint.vuejs.org/rules/no-undef-properties.html) false positives for properties returned via `...toRefs(reactive({ ... }))` from `setup()` ([#​3134](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3134)) - Fixed [`vue/require-typed-ref`](https://eslint.vuejs.org/rules/require-typed-ref.html) false positives when an explicit type annotation already applies to the `ref()` call ([#​3123](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3123)) - Fixed [`vue/v-if-else-key`](https://eslint.vuejs.org/rules/v-if-else-key.html) false positive for components with a bound `:key` ([#​3150](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3150)) ##### Other changes - Removed Reactivity Transform support from [`vue/no-ref-object-reactivity-loss`](https://eslint.vuejs.org/rules/no-ref-object-reactivity-loss.html), since the Reactivity Transform proposal was dropped from Vue ([#​3126](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3126)) - Changed [`vue/html-self-closing`](https://eslint.vuejs.org/rules/html-self-closing.html) to treat Vue's special `<slot>` and `<template>` elements as components (`html.component` option) instead of normal HTML elements ([#​3164](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3164)) - Changed [`vue/attributes-order`](https://eslint.vuejs.org/rules/attributes-order.html) rule to provide a suggestion instead of an autofix when the fix would move a binding across `v-bind="object"` ([#​3145](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3145)) - Improved performance of [`vue/no-reserved-component-names`](https://eslint.vuejs.org/rules/no-reserved-component-names.html) by no longer rebuilding its reserved name sets for every file ([#​3147](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3147)) </details> <details> <summary>gitea/go-sdk (gitea.dev/sdk)</summary> ### [`v1.5.0`](https://gitea.com/gitea/go-sdk/releases/tag/v1.5.0) [Compare Source](https://gitea.com/gitea/go-sdk/compare/v1.4.0...v1.5.0) #### What's Changed - feat: allow PAT-authenticated clients to manage access tokens in [#​840](https://gitea.com/gitea/go-sdk/pulls/840) - fix(pull): surface the server's error when a merge is refused in [#​870](https://gitea.com/gitea/go-sdk/pulls/870) - feat(hook): add name option to webhooks in [#​867](https://gitea.com/gitea/go-sdk/pulls/867) - feat: cover the API options gitea-cli still calls raw in [#​862](https://gitea.com/gitea/go-sdk/pulls/862) - ci: implement gitea's cache-seeder in [#​866](https://gitea.com/gitea/go-sdk/pulls/866) - Add bitbucketserver and forgejo migration service types in [#​868](https://gitea.com/gitea/go-sdk/pulls/868) - chore(deps): update dependencies in [#​869](https://gitea.com/gitea/go-sdk/pulls/869) - chore: remove the Client wrapper generator in [#​865](https://gitea.com/gitea/go-sdk/pulls/865) - feat: add force push and stale approval fields to branch protections in [#​864](https://gitea.com/gitea/go-sdk/pulls/864) #### Contributors - [@​sedlund](https://redirect.github.com/sedlund) - [@​Svtter](https://redirect.github.com/Svtter) - [@​SudhanshuSingh](https://redirect.github.com/SudhanshuSingh) - [@​bircni](https://redirect.github.com/bircni) - [@​silverwind](https://redirect.github.com/silverwind) - [@​lunny](https://redirect.github.com/lunny) - [@​renovate-bot](https://redirect.github.com/renovate-bot) #### New Contributors - [@​Svtter](https://redirect.github.com/Svtter) made their first contribution in [#​870](https://gitea.com/gitea/go-sdk/pulls/870) - [@​bircni](https://redirect.github.com/bircni) made their first contribution in [#​862](https://gitea.com/gitea/go-sdk/pulls/862) - [@​SudhanshuSingh](https://redirect.github.com/SudhanshuSingh) made their first contribution in [#​864](https://gitea.com/gitea/go-sdk/pulls/864) **Full Changelog**: [v1.4.0...v1.5.0](https://gitea.com/gitea/go-sdk/compare/v1.4.0...v1.5.0) ### [`v1.4.0`](https://gitea.com/gitea/go-sdk/releases/tag/v1.4.0) [Compare Source](https://gitea.com/gitea/go-sdk/compare/v1.3.0...v1.4.0) #### What's Changed - fix: retry server version lookup after failure in [#​829](https://gitea.com/gitea/go-sdk/pulls/829) - chore(deps): update dependencies, adapt to Gitea 28 in [#​863](https://gitea.com/gitea/go-sdk/pulls/863) - chore: update golangci-lint for Go 1.27.2, exclude dagger from Renovate in [#​861](https://gitea.com/gitea/go-sdk/pulls/861) **Note**: Gitea skipped 1.28, so the project and workflow run approve/cancel/logs APIs are now gated on Gitea 28.0.0. Clients pinning `SetGiteaVersion("1.28.0")` must switch to `"28.0.0"`. #### Contributors - [@​noeljackson](https://redirect.github.com/noeljackson) - [@​silverwind](https://redirect.github.com/silverwind) - [@​renovate-bot](https://redirect.github.com/renovate-bot) **Full Changelog**: [v1.3.0...v1.4.0](https://gitea.com/gitea/go-sdk/compare/v1.3.0...v1.4.0) Written by Claude. </details> <details> <summary>buildkite/terminal-to-html (github.com/buildkite/terminal-to-html/v3)</summary> ### [`v3.17.3`](https://redirect.github.com/buildkite/terminal-to-html/releases/tag/v3.17.3) [Compare Source](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.2...v3.17.3) #### [v3.17.3](https://redirect.github.com/buildkite/terminal-to-html/tree/v3.17.3) [Full Changelog](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.2...v3.17.3) This release provides the Linux, macOS, and Windows binaries missing from v3.17.2. Apart from the version number, application code is unchanged from v3.17.2. ##### Changed - Prepare versioned binaries for v3.17.3. [#​293](https://redirect.github.com/buildkite/terminal-to-html/pull/293) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) - Document the draft-first binary release process, including artifact verification and immutable release restrictions. [#​292](https://redirect.github.com/buildkite/terminal-to-html/pull/292) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) ##### Included from v3.17.2 - Remove `html/template` from the rendering path to avoid a runtime trap when rendering with TinyGo, while preserving the generated HTML. [#​282](https://redirect.github.com/buildkite/terminal-to-html/pull/282) ([@​dannymidnight](https://redirect.github.com/dannymidnight)) - Raise the minimum supported Go version to **1.26.10** and update the development/CI Go Docker image. [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) - Bump `golang.org/x/sys` to 0.47.0. [#​280](https://redirect.github.com/buildkite/terminal-to-html/pull/280) ([@​dependabot](https://redirect.github.com/dependabot)\[bot]) ### [`v3.17.2`](https://redirect.github.com/buildkite/terminal-to-html/releases/tag/v3.17.2) [Compare Source](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.1...v3.17.2) #### [v3.17.2](https://redirect.github.com/buildkite/terminal-to-html/tree/v3.17.2) [Full Changelog](https://redirect.github.com/buildkite/terminal-to-html/compare/v3.17.1...v3.17.2) ##### Fixed - Remove `html/template` from the rendering path to avoid a runtime trap when rendering with TinyGo, while preserving the generated HTML. [#​282](https://redirect.github.com/buildkite/terminal-to-html/pull/282) ([@​dannymidnight](https://redirect.github.com/dannymidnight)) ##### Changed - Raise the minimum supported Go version from 1.25.0 to 1.26.10. [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) ([@​wolfeidau](https://redirect.github.com/wolfeidau)) ##### Dependency updates - Update the development/CI Go Docker image from 1.26.4 to 1.26.10. [#​281](https://redirect.github.com/buildkite/terminal-to-html/pull/281), [#​290](https://redirect.github.com/buildkite/terminal-to-html/pull/290) - Bump `golang.org/x/sys` from 0.46.0 to 0.47.0. [#​280](https://redirect.github.com/buildkite/terminal-to-html/pull/280) ([@​dependabot](https://redirect.github.com/dependabot)\[bot]) </details> <details> <summary>dlclark/regexp2 (github.com/dlclark/regexp2/v2)</summary> ### [`v2.11.0`](https://redirect.github.com/dlclark/regexp2/compare/v2.10.1...v2.11.0) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.10.1...v2.11.0) ### [`v2.10.1`](https://redirect.github.com/dlclark/regexp2/compare/v2.10.0...v2.10.1) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.10.0...v2.10.1) ### [`v2.10.0`](https://redirect.github.com/dlclark/regexp2/compare/v2.9.1...v2.10.0) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.9.1...v2.10.0) </details> <details> <summary>getkin/kin-openapi (github.com/getkin/kin-openapi)</summary> ### [`v0.152.0`](https://redirect.github.com/getkin/kin-openapi/releases/tag/v0.152.0) [Compare Source](https://redirect.github.com/getkin/kin-openapi/compare/v0.151.0...v0.152.0) #### What's Changed - openapi2conv: push path-level body/formData parameters into operations by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1340](https://redirect.github.com/getkin/kin-openapi/pull/1340) - fix(openapi3): resolve transitive component refs in JSON Schema 2020-12 validation by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1342](https://redirect.github.com/getkin/kin-openapi/pull/1342) - openapi3: honor readOnly/writeOnly from allOf schemas in required checks by [@​ybai08](https://redirect.github.com/ybai08) in [#​1343](https://redirect.github.com/getkin/kin-openapi/pull/1343) - openapi3: resolve $refs of Components.Links by [@​fenollp](https://redirect.github.com/fenollp) in [#​1344](https://redirect.github.com/getkin/kin-openapi/pull/1344) - openapi3: marshal a schema's empty type list as absent rather than null by [@​fenollp](https://redirect.github.com/fenollp) in [#​1345](https://redirect.github.com/getkin/kin-openapi/pull/1345) - openapi3: drop the Header dump from its content/schema error by [@​fenollp](https://redirect.github.com/fenollp) in [#​1346](https://redirect.github.com/getkin/kin-openapi/pull/1346) - openapi3gen: always propagate field tag by [@​phooijenga](https://redirect.github.com/phooijenga) in [#​1347](https://redirect.github.com/getkin/kin-openapi/pull/1347) - routers/gorillamux: return an error instead of panicking when registering routes by [@​fenollp](https://redirect.github.com/fenollp) in [#​1348](https://redirect.github.com/getkin/kin-openapi/pull/1348) - openapi3: report $refs to null nodes as unresolved instead of panicking by [@​fenollp](https://redirect.github.com/fenollp) in [#​1349](https://redirect.github.com/getkin/kin-openapi/pull/1349) - openapi3: validate null servers, server variables, tags and components without panicking by [@​fenollp](https://redirect.github.com/fenollp) in [#​1351](https://redirect.github.com/getkin/kin-openapi/pull/1351) - openapi2conv: fix FromV3Parameter panics on binary schema refs and value-less schemas by [@​fenollp](https://redirect.github.com/fenollp) in [#​1352](https://redirect.github.com/getkin/kin-openapi/pull/1352) - openapi3filter: parse integer values as base 10 by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1353](https://redirect.github.com/getkin/kin-openapi/pull/1353) - openapi3filter: decode spaceDelimited and pipeDelimited query objects by [@​ybai08](https://redirect.github.com/ybai08) in [#​1350](https://redirect.github.com/getkin/kin-openapi/pull/1350) - Case-sensitive usmarshalling with json/v2 by [@​fenollp](https://redirect.github.com/fenollp) in [#​1355](https://redirect.github.com/getkin/kin-openapi/pull/1355) - openapi3filter: decode deepObject and non-exploded form object properties of urlencoded bodies by [@​ybai08](https://redirect.github.com/ybai08) in [#​1354](https://redirect.github.com/getkin/kin-openapi/pull/1354) - openapi3: keep $ref siblings on a schema reached through a cycle by [@​Yi-111-a](https://redirect.github.com/Yi-111-a) in [#​1357](https://redirect.github.com/getkin/kin-openapi/pull/1357) - tests: go around encoding/json/v2's randomness in error message by [@​fenollp](https://redirect.github.com/fenollp) in [#​1361](https://redirect.github.com/getkin/kin-openapi/pull/1361) - tests: remove actual network calls from tests by [@​fenollp](https://redirect.github.com/fenollp) in [#​1362](https://redirect.github.com/getkin/kin-openapi/pull/1362) - tests: run more in parallel by [@​fenollp](https://redirect.github.com/fenollp) in [#​1363](https://redirect.github.com/getkin/kin-openapi/pull/1363) - openapi3: ignore reference siblings in OpenAPI 3.0 by [@​lucky798213](https://redirect.github.com/lucky798213) in [#​1268](https://redirect.github.com/getkin/kin-openapi/pull/1268) - openapi3: WalkSchemas and WalkParameters stop on a callback cycle by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1364](https://redirect.github.com/getkin/kin-openapi/pull/1364) - openapi3filter: validate response headers described with content by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1358](https://redirect.github.com/getkin/kin-openapi/pull/1358) - openapi3filter: honor ExcludeRequestQueryParams for path item parameters by [@​LuisFigueroaG](https://redirect.github.com/LuisFigueroaG) in [#​1365](https://redirect.github.com/getkin/kin-openapi/pull/1365) - openapi3: handle fields next to $ref as OpenAPI 3.0, 3.1 and 3.2 specify by [@​fenollp](https://redirect.github.com/fenollp) in [#​1371](https://redirect.github.com/getkin/kin-openapi/pull/1371) - changelog: fixup rebased messes by [@​fenollp](https://redirect.github.com/fenollp) in [#​1372](https://redirect.github.com/getkin/kin-openapi/pull/1372) #### New Contributors - [@​ybai08](https://redirect.github.com/ybai08) made their first contribution in [#​1343](https://redirect.github.com/getkin/kin-openapi/pull/1343) - [@​phooijenga](https://redirect.github.com/phooijenga) made their first contribution in [#​1347](https://redirect.github.com/getkin/kin-openapi/pull/1347) **Full Changelog**: <https://github.com/getkin/kin-openapi/compare/v0.151.0...v0.152.0> </details> <details> <summary>go-co-op/gocron (github.com/go-co-op/gocron/v2)</summary> ### [`v2.23.0`](https://redirect.github.com/go-co-op/gocron/releases/tag/v2.23.0) [Compare Source](https://redirect.github.com/go-co-op/gocron/compare/v2.22.0...v2.23.0) #### What's Changed - feat(scheduler): WithStartAtGrace opt-in tolerance for late first-run dispatch by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​945](https://redirect.github.com/go-co-op/gocron/pull/945) - fix(executor,scheduler): use injected clock for job timing and guard reschedule loop by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​946](https://redirect.github.com/go-co-op/gocron/pull/946) - fix(executor): attribute scheduling delay to the tick that actually fired by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​948](https://redirect.github.com/go-co-op/gocron/pull/948) - refactor(scheduler): extract shared first-run logic from selectNewJob/selectStart by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​947](https://redirect.github.com/go-co-op/gocron/pull/947) - build(deps): bump actions/setup-go from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​949](https://redirect.github.com/go-co-op/gocron/pull/949) - build(deps): bump actions/setup-python from 6 to 7 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​950](https://redirect.github.com/go-co-op/gocron/pull/950) - ci: updating golangci-lint to 2.13.1 to support go 1.27 by [@​manuelarte](https://redirect.github.com/manuelarte) in [#​954](https://redirect.github.com/go-co-op/gocron/pull/954) - Exclude stable Go version in CI workflow by [@​JohnRoesler](https://redirect.github.com/JohnRoesler) in [#​968](https://redirect.github.com/go-co-op/gocron/pull/968) - docs: removing retired go report badge by [@​manuelarte](https://redirect.github.com/manuelarte) in [#​952](https://redirect.github.com/go-co-op/gocron/pull/952) - build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​ > [!IMPORTANT] > ✂ PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzIuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE3Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
9cacca6f65 |
fix(deps): update module golang.org/x/net to v0.62.0 [security] (#40050)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.61.0` → `v0.62.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.61.0...refs/tags/v0.62.0) |  |  | --- ### Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net [CVE-2026-78661](https://nvd.nist.gov/vuln/detail/CVE-2026-78661) / [GO-2026-6860](https://pkg.go.dev/vuln/GO-2026-6860) <details> <summary>More information</summary> #### Details When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse. #### References - [https://go.dev/cl/849365](https://go.dev/cl/849365) - [https://go.dev/issue/82224](https://go.dev/issue/82224) - [https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs](https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6860) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net [CVE-2026-97045](https://nvd.nist.gov/vuln/detail/CVE-2026-97045) / [GO-2026-6866](https://pkg.go.dev/vuln/GO-2026-6866) <details> <summary>More information</summary> #### Details In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text. #### References - [https://go.dev/cl/855121](https://go.dev/cl/855121) - [https://go.dev/issue/82622](https://go.dev/issue/82622) - [https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs](https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6866) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> |
||
|
Giteabotandsilverwind
|
f0bb283a17 |
chore(deps): update dependencies (#40020)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
5e4ed4d508 |
fix: correctly parse and validate forwarded client IPs and remove unmaintained chi-middleware/proxy (#39190)
Replace the unmaintained `chi-middleware/proxy` with an in-tree handler that detects client IPs correctly behind common reverse proxies. 1. Handle repeated header lines and comma-separated proxy hops. 2. Accept and normalize IPs, including `ip:port`. 3. Keep the client port from the header value or `X-Real-Port` instead of logging port 0. 4. Prefer the last `X-Real-IP` line. 5. Keep the proxy's address when the selected value is invalid. 6. Read `Forwarded` only when `X-Forwarded-For` is absent. Docs PR: https://gitea.com/gitea/docs/pulls/560 Fixes: https://github.com/go-gitea/gitea/issues/35682 Fixes: https://github.com/go-gitea/gitea/issues/36814 Co-authored-by: bircni <bircni@icloud.com> |
||
|
Giteabotandsilverwind
|
7e164fe61a |
chore(deps): update dependencies, migrate to connectrpc.com/connect v2 (#39854)
Co-authored-by: silverwind <me@silverwind.io> |
||
  
|
42b1f95261 |
fix: optimize packages upload memory (#39366)
Bound the memory used when parsing uploaded packages, so instances with low memory limits survive non-standard packages. 1. Metadata files are read through a size-limited reader, archives themselves stay unbounded so large payloads keep working 2. zstd decoding caps the window at 128 MiB, the zstd CLI default 3. RPM headers go through a first-party reader with rpmlib's size and array count limits that allocates only what the upload contains, until https://github.com/sassoftware/go-rpmutils/pull/44 is released. Signing still verifies the payload digest, and its signature header matches rpmsign's byte for byte 4. Swift and NuGet read the zip entry they size-checked, a duplicate name could stand in for it before 5. Terraform states check `LIMIT_SIZE_TERRAFORM_STATE` before parsing, NuGet symbol PDBs share a 256 MiB budget 6. Oversized container configs are rejected instead of stored without metadata, invalid Vagrant boxes answer 400 instead of 500 Signed-off-by: techknowlogick <git@tklk.dev> Co-authored-by: techknowlogick <git@tklk.dev> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: techknowlogick <techknowlogick@gitea.com> |
||
 Lunny Xiao
|
c1ae4ec29e |
fix(actions): keep folded block scalars intact across serialization (#39787)
Folded (`>`) scalars in workflows gained blank lines and had spaces turned into newlines every time Gitea re-serialized a job. This bumps go-yaml to its main branch and drops our workarounds. The runner gets the same change in https://gitea.com/gitea/runner/pulls/1321. - go-yaml main fixes the accumulating blank lines (https://github.com/yaml/go-yaml/pull/366) and the block scalar indentation indicators (https://github.com/yaml/go-yaml/pull/414), so `BlockSafeString` and the folded scalar requoting go away - The job encoder no longer wraps lines, because go-yaml still wraps more-indented lines of folded scalars and turns a space into a newline - The fix applies to folded scalars anywhere in a workflow, including workflow-level `env` Fixes https://github.com/go-gitea/gitea/issues/39775 Co-authored-by: silverwind <me@silverwind.io> |
||
 bircni
|
4b5f1f46de |
enhance(actions): show the steps the runner reports (#39720)
Gitea derives the steps of a job from the workflow file, so the `pre` and `post` steps of actions only show up inside "Set up job" and "Complete job". Fixes https://github.com/go-gitea/gitea/issues/24604. A runner can now report the steps it actually runs, and Gitea shows those instead. Runners that don't report them keep the current view, and older Gitea versions ignore them. Related: - Proto: https://gitea.com/gitea/actions-proto-def/pulls/19 - Runner: https://gitea.com/gitea/runner/pulls/1293 |
||
|
Giteabot
|
0eb0126fa2 | chore(deps): update dependencies (#39742) | ||
|
Giteabot
|
2f94380222 |
fix(deps): update module golang.org/x/net to v0.60.0 [security] (#39695)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.59.0` → `v0.60.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.59.0...refs/tags/v0.60.0) |  |  | --- ### HTTP/2 server memory exhaustion due to Trailer headers in net/http [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) / [GO-2026-6603](https://pkg.go.dev/vuln/GO-2026-6603) <details> <summary>More information</summary> #### Details When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently. #### Severity Unknown #### References - [https://go.dev/cl/847185](https://go.dev/cl/847185) - [https://go.dev/cl/847314](https://go.dev/cl/847314) - [https://go.dev/issue/81857](https://go.dev/issue/81857) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6603) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### HTTP/2 transport accepts malformed framing-related headers in net/http [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) / [GO-2026-6610](https://pkg.go.dev/vuln/GO-2026-6610) <details> <summary>More information</summary> #### Details Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling. #### Severity Unknown #### References - [https://go.dev/cl/835145](https://go.dev/cl/835145) - [https://go.dev/cl/836385](https://go.dev/cl/836385) - [https://go.dev/issue/81115](https://go.dev/issue/81115) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6610) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Excessive CPU consumption from repeated initial window changes in net/http [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) / [GO-2026-6611](https://pkg.go.dev/vuln/GO-2026-6611) <details> <summary>More information</summary> #### Details A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. #### Severity Unknown #### References - [https://go.dev/cl/847186](https://go.dev/cl/847186) - [https://go.dev/cl/847308](https://go.dev/cl/847308) - [https://go.dev/issue/81742](https://go.dev/issue/81742) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6611) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Double flow control refund on HTTP/2 server streams in net/http [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) / [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) <details> <summary>More information</summary> #### Details The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control. #### Severity Unknown #### References - [https://go.dev/cl/847187](https://go.dev/cl/847187) - [https://go.dev/cl/847310](https://go.dev/cl/847310) - [https://go.dev/issue/81743](https://go.dev/issue/81743) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6612) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### HTTP/2 server crash due to HPACK encoder race in net/http [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) / [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617) <details> <summary>More information</summary> #### Details HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server. #### Severity Unknown #### References - [https://go.dev/cl/847188](https://go.dev/cl/847188) - [https://go.dev/cl/847313](https://go.dev/cl/847313) - [https://go.dev/issue/81867](https://go.dev/issue/81867) - [https://groups.google.com/g/golang-announce/c/U2fTuyDJznI](https://groups.google.com/g/golang-announce/c/U2fTuyDJznI) - [https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs](https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-6617) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjEuNCIsInVwZGF0ZWRJblZlciI6IjQ0LjEyMS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> |
||
|
64f4b5856a |
enhance(actions): improve matrix job titles, bump actionslib (#39485)
Bump actionslib to v1.3.0 and format matrix job titles like GitHub.
- Matrix values are listed in declaration order, nested arrays and
objects are flattened, null and empty values are skipped
- Expression-evaluated names are trimmed and fall back to the job ID
when blank
- Matrix `include` and `exclude` match keys case-insensitively and
coerce numbers like GitHub
| Matrix | Before | After |
|---|---|---|
| `v: ["a,b"]` | `job (a,b)` | `job (a,b)` |
| `v: ["a, b"]` | `job (a, b)` | `job (a, b)` |
| `v: [[a, b]]` | `job ([a b])` | `job (a, b)` |
| `os: [x], arch: [y]` | `job (y, x)` | `job (x, y)` |
| `v: [{t: a, p: "b,c"}]` | `job (map[p:b,c t:a])` | `job (a, b,c)` |
| `v: [{t: a, p: [b, c]}]` | `job (map[p:[b c] t:a])` | `job (a, b, c)`
|
---------
Co-authored-by: Zettat123 <zettat123@gmail.com>
Co-authored-by: bircni <bircni@icloud.com>
|
||
|
Giteabotandsilverwind
|
27d876e311 |
chore(deps): update dependencies, add new lint rules, fix lint (#39601)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwindandwxiaoguang
|
ad38b60983 |
refactor!: remove go-git backend (#39487)
Removes the go-git backend so every build uses the git CLI backend. Its Windows performance advantage is gone, it lacks SHA-256 support, and it breaks repositories on Windows. The performance changes moved to https://github.com/go-gitea/gitea/pull/39526. Fixes https://github.com/go-gitea/gitea/issues/38359 Fixes https://github.com/go-gitea/gitea/issues/34694 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwindandwxiaoguang
|
cf89ecd887 |
refactor!: move go-chi/session into Gitea (#39504)
The `gitea.com/go-chi/session` package only exists for Gitea, so it moves into `modules/session` to fix its bugs directly. Fixes the flake in https://github.com/go-gitea/gitea/actions/runs/36726154500/job/109923538400. - Sessions are only written back when changed, so a read-only request can't revert a concurrent change or restore a logged-out session, like https://github.com/go-macaron/session/commit/ae808a4a4660c802965c834299ab08f167effd12 - The session cookie is only set once a session holds data - Every backend refreshes the expiry on load and file sessions are written atomically - Also fix https://github.com/go-gitea/gitea/issues/36176 ## ⚠️ BREAKING ⚠️ * the `mysql`, `postgres`, `couchbase` and `memcache` session providers are removed, use `file`, `db` or `redis` instead * login-related cookies are renamed to `gitea_session` and `gitea_remember`, if you'd like to use the old names, set `COOKIE_NAME` and `COOKIE_REMEMBER_NAME` in app.ini --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwindandwxiaoguang
|
bea6fcaa84 |
refactor: move go-chi/cache into Gitea (#39530)
The `gitea.com/go-chi/cache` package only exists for Gitea, so it moves into `modules/cache`. - `ITEM_TTL = -1` disables caching as documented - Sub-second TTLs round up instead of never expiring - The Redis adapter no longer grows a `MacaronCache` hash - Use two-queue cache for in-memory cache Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwindandwxiaoguang
|
873efed5a6 |
refactor: move go-chi/captcha into Gitea (#39529)
The `gitea.com/go-chi/captcha` package only exists for Gitea, so it moves into `modules/imagecaptcha`. - Reloading an expired challenge shows a new image instead of a broken one - Every answer is consumed on its first check - OpenID registration stops after a failed captcha --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
|
e6ffbea888 |
refactor: move go-chi/binding into Gitea (#39528)
The `gitea.com/go-chi/binding` package only exists for Gitea, so it moves into `modules/web/binding` to fix its bugs directly. Split out of https://github.com/go-gitea/gitea/pull/39504. - GET and HEAD always bind the query - JSON `null` slice elements and nested `TrimSpace` fields bind correctly - Integer fields reject out-of-range values instead of wrapping - An empty JSON body binds nothing and an unknown binding rule is an error Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: bircni <bircni@icloud.com> |
||
|
silverwind
|
2f01ec38bd |
fix: use READ COMMITTED transactions on MySQL and MariaDB (#39506)
MariaDB 11.6.2+ defaults `innodb_snapshot_isolation` to `ON`, which fails REPEATABLE READ transactions with error 1020 when a row they write changed after their first read. Gitea's background work like push processing writes the same rows, so merges, issue closes and workflow runs fail sporadically. - Use READ COMMITTED on MySQL and MariaDB, like PostgreSQL and MSSQL - Update xorm to v1.4.3 Replaces: https://github.com/go-gitea/gitea/pull/39494 Fixes: https://github.com/go-gitea/gitea/issues/39492 --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
fba8d7eace | chore(deps): update dependencies (#39462) | ||
|
silverwind
|
f757631a47 |
feat(actions): update actionslib, support self:, misc fixes (#39358)
Updates actionslib to https://gitea.com/gitea/actionslib/releases/tag/v1.2.1, moves workflow parsing into it and aligns behaviour with GitHub. 1. `uses:` supports `self:` (Gitea-only feature) and `$/` paths. 1. `strategy`, `matrix`, `max-parallel` and `fail-fast` accept expressions, including over `needs`. A job whose `name`, `runs-on` or `continue-on-error` reads `needs` is resolved once they finish. 1. A job `if:` may only read `github`, `needs`, `vars` and `inputs` and is decided before the matrix, as on github.com. 1. Matrix `fail-fast` cancels the other combinations, and `always()` jobs keep running when a run is cancelled. 1. Invalid workflow files, including a malformed `on:` and unknown or cyclic `needs`, show up on push as failed runs with the error. 1. A job whose `if:` or `concurrency:` fails to evaluate is skipped or failed with the error, instead of staying blocked. 1. Reusable workflows: a missing and an unreadable repository fail alike, public callers cannot use private workflows, nested jobs cannot exceed the caller's token permissions. 1. Runner labels match case-insensitively, and `runs-on` accepts an array from an expression. Runner PR: https://gitea.com/gitea/runner/pulls/1247 Docs PR: https://gitea.com/gitea/docs/pulls/553 Fixes: https://github.com/go-gitea/gitea/issues/38990 Fixes: https://github.com/go-gitea/gitea/issues/39382 Fixes: https://github.com/go-gitea/gitea/issues/32364 Fixes: https://github.com/go-gitea/gitea/issues/36077 Fixes: https://github.com/go-gitea/gitea/issues/23277 Fixes: https://github.com/go-gitea/gitea/issues/29020 Co-authored-by: Claude (Opus 5) <noreply@anthropic.com> Co-authored-by: Zettat123 <zettat123@gmail.com> |
||
|
Giteabot
|
fc28937a8d | chore(deps): update dependencies (#39367) | ||
|
silverwind
|
afb7edef07 |
refactor: replace AWS SDK with a REST client for CodeCommit migration (#39330)
Replace `aws-sdk-go-v2` in the CodeCommit migration with a minimal REST client for the four read-only API calls it uses. Binary shrinks by ~3.1 MB. Mock data was recorded against live from a AWS CodeCommit repo and then anonymized. Also stop storing the repo description as the default branch which fixes below issue. All comments in https://github.com/go-gitea/gitea/issues/34627 are addressed, the merge metadata was fixed earlier in https://github.com/go-gitea/gitea/pull/34645. Fixes: https://github.com/go-gitea/gitea/issues/34627 |
||
|
silverwindandwxiaoguang
|
c6c671e113 |
refactor: replace Azure Blob SDK with a REST client (#39315)
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwindandbircni
|
13033827b1 |
chore(deps): update actionslib to v1.0.0 (#39295)
Co-authored-by: bircni <bircni@icloud.com> |
||
|
Giteabotandsilverwind
|
cefb81a16f |
chore(deps): update dependencies (#39306)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
Giteabotandsilverwind
|
cc6fc41723 |
chore(deps): update dependencies (#39256)
Co-authored-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
1b2479b548 | fix(deps): update module golang.org/x/crypto to v0.56.0 [security] (#39219) | ||
|
Giteabot
|
535fc29ae8 | chore(deps): update dependencies (#39176) | ||
|
silverwind
|
66c672d0b7 | refactor: drop two unmaintained dependencies, rename the byte size helpers (#39083) | ||
|
Giteabot
|
4c915ae0c2 | chore(deps): update dependencies (#39066) | ||
|
wxiaoguang
|
f261adb53f |
chore: form binding trim space (#38978)
Use "binding:TrimSpace" instead of fragile IsEmptyString And fix a bug in locale's `HasKey`: it should also try the default language if current language doesn't have the translation key, a new test is added. |
||
|
wxiaoguang
|
6904f6480c |
refactor: http request binding (#38971)
Better than before, still not good enough (more work can be done in the future) And add the missing error handling in the PrivateContext "bind" middleware. By the way, picked some "TrimSpace" changes from "fix: trim whitespace from SMTP address and port - #38934" (fix #38926) |
||
|
Giteabot
|
e223c42ee6 | fix(deps): update module golang.org/x/mod to v0.40.0 [security] (#38914) | ||
|
Giteabot
|
596b7f7a25 | chore(deps): update dependencies (#38947) | ||
|
Giteabotandbircni
|
133a3b8567 |
fix(deps): update module golang.org/x/image to v0.45.0 [security] (#38930)
Co-authored-by: bircni <bircni@icloud.com> |
||
|
silverwind
|
e3ee28f15b |
fix(avatar): use sha256 and inline the federated avatar lookup (#38843)
- Hash emails with sha256. Gravatar moved to sha256, and both it and libravatar.org serve the same image for either hash. - Drop `strk.kbt.io/projects/go/libravatar` for a 46 line inline SRV lookup. It could not bound or cancel its DNS query and panicked on an unexpected resolver error. The replacement carries the request context and a 3s timeout. - Fix federated avatars querying DNS for every avatar on every render. `loadAvatarSetting` compared a cache field that was never assigned, so each call rebuilt the resolver and dropped its cache. That cache is gone, both settings are read where they are used. - Migration 348 recreates `email_hash` with a 64 char hash column and a `hash_type` column, so a later algorithm change can tell old rows apart. The MD5 rows are unreachable and their `UNIQUE` email index would reject the SHA256 replacements. - Fix a re-saved avatar form replacing an uploaded avatar with a random one. - Remove the `duoshuo` `GRAVATAR_SOURCE` alias, that service shut down in 2017. - Remove dead i18n key. Fixes: https://github.com/go-gitea/gitea/issues/34284 Fixes: https://github.com/go-gitea/gitea/issues/28110 Docs: https://gitea.com/gitea/docs/pulls/499 Signed-off-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
a8fe401613 | chore(deps): update dependencies (#38851) | ||
|
|
2087d4a1a5 |
refactor: use the shared workflow model from actionslib (#38768)
Pairs with https://gitea.com/gitea/runner/pulls/1143. Gitea depends on `gitea.com/gitea/runner` for exactly two packages: `act/model` and `act/exprparser`, the workflow model and the expression evaluator it needs to parse workflows and to build the task payload the runner consumes. Pulling the whole runner module in for that is heavy and puts shared code in the repository of one of the two consumers. Both packages now live in `gitea.dev/actionslib` (`pkg/model`, `pkg/exprparser`), the module Gitea and the runner already share for the runner API, so the dependency on the runner repository is dropped here. ### Changes - `gitea.com/gitea/runner/act/model` -> `gitea.dev/actionslib/pkg/model`, `.../act/exprparser` -> `gitea.dev/actionslib/pkg/exprparser` (22 files, import paths only). - `routers/api/actions/runner/interceptor.go` takes the `x-runner-uuid` / `x-runner-token` names from `gitea.dev/actionslib/pkg/protocol` instead of repeating the literals the runner also has. - `go.mod`: `gitea.com/gitea/runner` removed. --------- Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Zettat123 <zettat123@gmail.com> |
||
|
|
a954257fb1 |
chore(deps): update dependencies (#38757)
Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Giteabotandsilverwind
|
94a2c3ec18 |
chore(deps): update dependencies (#38660)
Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: silverwind <me@silverwind.io> |
||
 
|
13d0f24423 |
feat: Replace SSE with WebSocket for UI notifications (#36965)
* Closes #36942 * Fixes #19265 Replaces the SSE-based push channel (`/user/events`) with a WebSocket endpoint (`/-/ws`). ### What changes - **New `/-/ws` endpoint** (authenticated). One WebSocket per origin, shared across tabs via a single `SharedWorker`. - **Pubsub broker** (`services/pubsub`) for fan-out by topic, behind a `Broker` interface. `MemoryBroker` is the default (single process); a Redis backend is available for multi-process setups, configured via `[websocket].PUBSUB_TYPE` / `PUBSUB_CONN_STR`. The internal Gitea queue was not usable here because it has FIFO/single-consumer semantics. - **Push-only event production.** Events are emitted by write-triggered notifiers — `NotificationCountChange`, `PublishStopwatchesForUser`, and the logout publisher — wired into the existing `notify.Notifier` interface. No server-side pollers. - **Typed pub/sub on the client.** `web_src/js/modules/worker.ts` is a singleton transport; features subscribe per event type via `onUserEvent('notification-count', cb)` instead of branching on `event.data.type`. - **Wire contract** (`UserEventType` union) is shared between the worker and consumers via `web_src/js/types.ts`, kept in sync with `services/websocket/events.go`. - **Client-side periodic polling fallback** kicks in only when the WebSocket cannot be established (e.g. proxy blocks WS, browser lacks module-SharedWorker support). ### What's removed - `modules/eventsource` (SSE manager, run loop, messenger). - `/user/events` route and `tests/integration/eventsource_test.go`. - All server-side polling for stopwatches and notification counts. ### Stopwatch multi-tab fix The navbar stopwatch icon was previously rendered conditionally on `{{if $activeStopwatch}}`, so tabs loaded before the timer started had no DOM element to update. The icon and popup are now always rendered (toggled with `tw-hidden`), and the start/stop/cancel handlers POST silently so all open tabs reflect the change in real time. ### Deployment note WebSocket needs the upgrade headers to pass through a reverse proxy, e.g. for nginx: ```nginx proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; ``` Without them the WebSocket cannot be established, and after 3 consecutive failed opens the shared worker signals `push-unavailable`: the notification count and stopwatch fall back to periodic polling on the existing `[ui.notification]` timeouts. Real-time push is lost, the features keep working. The reverse-proxy docs need the same note (see the `docs-update-needed` label). --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Epid <rexmrj@gmail.com> |
||
|
Giteabot
|
39cc4db4ba | fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] (#38623) | ||
|
Giteabot
|
bc3f63095b | fix(deps): update module google.golang.org/grpc to v1.82.1 [security] (#38567) | ||
|
wxiaoguangandsilverwind
|
4af9156c36 |
refactor: implement mcaptcha client and add comments/tests (#38561)
End users still need it, so it's better to make it maintainable with tests and OOM-safe. --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Giteabot
|
2fec2affc4 |
chore(deps): update dependencies (#38538)
Also include: chore(deps): update npm dependencies #38542 chore(deps): update action dependencies #38541 chore(deps): update module golang.org/x/vuln to v1.6.0 #38540 |
||
|
Giteabot
|
506075c480 | fix(deps): update go dependencies (#38429) | ||
|
Giteabot
|
ed9b02985a | fix(deps): update module github.com/google/go-github/v88 to v89 (#38433) | ||
|
Giteabot
|
b96bd22372 | fix(deps): update go dependencies (#38346) | ||
|
Lunny Xiao
|
580cc26d63 |
chore: Upgrade xorm to 1.4.1 (#38224)
Fix #22275 Changelog: https://gitea.com/xorm/xorm/compare/v1.3.11..v1.4.1 |