fix: add missing checks to several handlers and models (#39839 ) (#39847 )

Backport https://github.com/go-gitea/gitea/pull/39839 by @silverwind Several handlers and model helpers skipped checks that their siblings already perform. - Only match principal keys when looking up SSH certificate principals - Return no attachments for an unsaved issue instead of every issue-less one - Reject issue and comment attachments when adding release attachments - Share one permission check for editing, deleting and reacting to issue content and for comment attachments between the web UI and the API, refusing them on locked issues for users who can't write - Reject issue edits, deletion and label changes in archived repositories via the API - Apply cross-origin protection to the repository topics endpoint - Return 404 for the repositories tab of individual users and respect profile visibility for the heatmap * Fixes: https://github.com/go-gitea/gitea/issues/39226 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: bircni <bircni@icloud.com>
enhance: allow custom watches to bypass on-mention email restriction (#39652 ) (#39837 )
2026-10-21 09:06:46 +09:00 · 2026-10-18 19:50:36 +02:00 · 2026-10-18 12:45:52 +00:00 · 2026-10-18 12:28:08 +00:00 · 2026-10-18 11:03:40 +00:00 · 2026-10-18 03:24:11 -07:00
885 changed files with 16396 additions and 20850 deletions
@@ -63,6 +63,7 @@ cpu.out
 /public/assets/fonts
 /public/assets/img/avatar
 /vendor
+/VERSION
 /.air
 /.go-licenses
 /Dockerfile
@@ -34,7 +34,7 @@ runs:
      env:
        # pgsql is chosen to be the unlucky one to run with the slow "race detector", it is about 60% slower.
        GOTEST_FLAGS: -race -timeout=40m
-        TAGS: bindata
+        TAGS: bindata gogit
        TEST_LDAP: 1
        TEST_SHARD: ${{ inputs.shard }}
        TEST_TOTAL_SHARDS: ${{ inputs.total-shards }}
@@ -37,15 +37,22 @@ jobs:
      - uses: ./.github/actions/go-setup
      - run: make deps-backend deps-tools
      - run: TAGS="bindata" make backend
+      - run: TAGS="bindata gogit" make backend
      - name: warm test compile cache (bindata)
        env:
          TAGS: bindata
          GOTEST_FLAGS: -race -list=^$$ -count=1
        run: make test-backend
+      - name: warm test compile cache (bindata gogit)
+        env:
+          TAGS: bindata gogit
+          GOTEST_FLAGS: -race -list=^$$ -count=1
+        run: make test-backend
      - name: warm integration compile cache
        run: |
          TAGS="bindata" make test-integration-compile
-          TAGS="bindata" GOTEST_FLAGS="-race" make test-integration-compile
+          TAGS="bindata gogit" make test-integration-compile
+          TAGS="bindata gogit" GOTEST_FLAGS="-race" make test-integration-compile

  lint:
    runs-on: ubuntu-latest
@@ -9,7 +9,7 @@ concurrency:
  group: cron-renovate

 env:
-  RENOVATE_VERSION: 44.143.0 # renovate: datasource=npm depName=renovate
+  RENOVATE_VERSION: 44.109.1 # renovate: datasource=npm depName=renovate

 permissions:
  contents: read
@@ -21,7 +21,7 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: renovatebot/github-action@230ce922b08968d0a4f6f70f295601daff09ef1d # v46.3.7
+      - uses: renovatebot/github-action@9fea9f0fbf80401026d11d03911d62b1f70fef1f # v46.3.3
        with:
          renovate-version: ${{ env.RENOVATE_VERSION }}
          configurationFile: renovate.json5
@@ -15,7 +15,7 @@ jobs:
      contents: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: crowdin/github-action@9c23991700c0ec5256fd41089b9d9d7d540e424e # v3.3.0
+      - uses: crowdin/github-action@df474cdfb9f41d6ae777118749477c2cdf7cacc8 # v3.2.0
        with:
          upload_sources: true
          upload_translations: false
@@ -27,7 +27,6 @@ jobs:
      - run: TAGS="bindata" make generate-go lint-backend # lint-go can lint with "bindata" tags

  lint-on-demand:
-    if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true' || needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.swagger == 'true' || needs.files-changed.outputs.json == 'true' || needs.files-changed.outputs.shell == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
    steps:
@@ -39,6 +38,8 @@ jobs:
        with:
          cache: "false"

+      - run: make lint-spell
+
      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
        uses: ./.github/actions/python-setup
      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
@@ -92,13 +93,13 @@ jobs:
        env:
          GOOS: linux
          GOARCH: arm64
-          TAGS: bindata
+          TAGS: bindata gogit
      - name: build-backend-windows
        run: go build -ldflags '-s -w' -o gitea-windows
        env:
          GOOS: windows
          GOARCH: amd64
-          TAGS: bindata
+          TAGS: bindata gogit
      - name: build-backend-386
        run: go build -ldflags '-s -w' -o gitea-linux-386
        env:
@@ -25,8 +25,6 @@ jobs:
        env:
          POSTGRES_DB: test
          POSTGRES_PASSWORD: postgres
-        options: >-
-          --mount type=tmpfs,destination=/var/lib/postgresql/data
        ports:
          - "5432:5432"
      ldap:
@@ -63,8 +61,6 @@ jobs:
        env:
          POSTGRES_DB: test
          POSTGRES_PASSWORD: postgres
-        options: >-
-          --mount type=tmpfs,destination=/var/lib/postgresql/data
        ports:
          - "5432:5432"
      ldap:
@@ -99,17 +95,17 @@ jobs:
      - run: make deps-backend
      - run: make backend
        env:
-          TAGS: bindata
+          TAGS: bindata gogit
      - run: GITEA_TEST_DATABASE=sqlite make test-migration
        env:
-          TAGS: bindata
+          TAGS: bindata gogit
      - name: run tests
        run: GITEA_TEST_DATABASE=sqlite make test-integration
        timeout-minutes: 50
        env:
          # sqlite driver can contain large amount of Golang code, so don't use race detector for it, otherwise, extremely slow
          GOTEST_FLAGS: -timeout=40m
-          TAGS: bindata
+          TAGS: bindata gogit

  test-unit:
    if: needs.files-changed.outputs.backend == 'true'
@@ -117,7 +113,7 @@ jobs:
    runs-on: ubuntu-latest
    services:
      elasticsearch:
-        image: elasticsearch:8.19.23@sha256:8b1751877c984f3e4f59bafb15fc890e01969a744255fd5f6860c060b62cff36
+        image: elasticsearch:8.19.21@sha256:ae1f398ec8734a63eb7f719cecc2ea33e2bb46e23bdf24641dec86fd256bf594
        env:
          discovery.type: single-node
          xpack.security.enabled: false
@@ -167,6 +163,13 @@ jobs:
          GOTEST_FLAGS: -race -timeout=20m
          TAGS: bindata
          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
+      - name: unit-tests-gogit
+        run: make test-backend
+        env:
+          GOTEST_FLAGS: -race -timeout=20m
+          TAGS: bindata gogit
+          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
+          GITEA_TEST_CI_SKIP_EXTERNAL: true
      - run: make test-check

  test-mysql:
@@ -185,7 +188,7 @@ jobs:
        options: >-
          --mount type=tmpfs,destination=/bitnami/mysql/data
      elasticsearch:
-        image: elasticsearch:8.19.23@sha256:8b1751877c984f3e4f59bafb15fc890e01969a744255fd5f6860c060b62cff36
+        image: elasticsearch:8.19.21@sha256:ae1f398ec8734a63eb7f719cecc2ea33e2bb46e23bdf24641dec86fd256bf594
        env:
          discovery.type: single-node
          xpack.security.enabled: false
@@ -12,7 +12,6 @@
 - In `options/locale`, only edit `locale_en-US.json`, other locales are synced automatically
 - In TS, use `!` instead of `?.`/`??` when a value always exists
 - In Go, prefer to use modern language features wherever possible
- In Go, function-name prefixes in errors like `fmt.Errorf("Foo: %w", err)` must always name the function they are in
 - Write sizes as multiplications like `64 * 1024`, not bit shifts like `64 << 10`
 - Prefer `tw-*` utilities over inline `style` and `flex-*` helpers over per-child `tw-ml-*`/`tw-mr-*` margins, falling back to `tw-*` where specificity requires `!important`
 - Run `make fmt` after `.go` edits, `make tidy` after `go.mod` edits, `make generate-swagger` after API changes, and lint what changed with `make lint-go`, `lint-js`, `lint-css` or `lint-templates`
@@ -175,7 +175,7 @@ PR titles must follow the [Conventional Commits](https://www.conventionalcommits
 type(scope)!: subject
 ```

-The scope in parentheses is optional. A `!` immediately before the colon marks a [breaking change](https://www.conventionalcommits.org/en/v1.0.0/#summary): either `type!:` or `type(scope)!:` (not `type!(scope):`). Do not mark `build`, `chore`, `ci`, `docs`, `style`, or `test` as breaking.
+The scope in parentheses is optional. A `!` immediately before the colon marks a [breaking change](https://www.conventionalcommits.org/en/v1.0.0/#summary): either `type!:` or `type(scope)!:` (not `type!(scope):`).

 Use one of these types:

@@ -8,6 +8,7 @@ AIR_PACKAGE ?= github.com/air-verse/air@v1.67.4 # renovate: datasource=go
 EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v4/cmd/editorconfig-checker@v4.0.2 # renovate: datasource=go
 GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 # renovate: datasource=go
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.17 # renovate: datasource=go
+MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
 SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.36.6 # renovate: datasource=go
 GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.8.0 # renovate: datasource=go
 ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 # renovate: datasource=go
@@ -74,7 +75,8 @@ STORED_VERSION_FILE := VERSION
 GITHUB_REF_TYPE ?= branch
 GITHUB_REF_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)

-# VERSION: the name for the build and filenames, e.g.: "1.2.3" for tag "v1.2.3", "main-nightly" for branch "main"
+# VERSION: the branch name for the build and filenames, e.g.: "feature/foo-bar", "main"
+#          branch name "release/v1.27.2" is stripped to "1.27.2".
 # GITEA_VERSION: the Gitea's internal version for display, e.g. "1.28.0+dev-356-ge47d0b66ea"
 ifeq ($(GITHUB_REF_TYPE),tag)
 	# convert tag "v1.2.3" to "1.2.3"
@@ -99,6 +101,11 @@ else
 	$(error unsupported ref type $(GITHUB_REF_TYPE))
 endif

+# if version == "main" then add "-nightly" to the version for nightly builds: "main-nightly"
+ifeq ($(VERSION),main)
+	VERSION := main-nightly
+endif
+
 LDFLAGS := $(LDFLAGS) -X "main.Version=$(GITEA_VERSION)" -X "main.Tags=$(TAGS)"
 RELEASE_ENV = GO="$(GO)" TAGS="$(TAGS)" LDFLAGS="$(LDFLAGS)" DIST="$(DIST)" VERSION="$(VERSION)"

@@ -125,9 +132,11 @@ GO_LICENSE_FILE := assets/go-licenses.json
 TAR_EXCLUDES := .git data indexers queues log node_modules $(EXECUTABLE) $(DIST) $(MAKE_EVIDENCE_DIR) $(AIR_TMP_DIR)

 GO_DIRS := build cmd modelmigration models modules routers services tests tools
+WEB_DIRS := web_src/js web_src/css

 ESLINT_FILES := web_src/js tools *.ts tests/e2e
 STYLELINT_FILES := web_src/css web_src/js/components/*.vue
+SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) templates options/locale/locale_en-US.json .github $(wildcard *.go *.md *.yml *.yaml *.toml)
 EDITORCONFIG_FILES := templates .github/workflows options/locale/locale_en-US.json

 GO_SOURCES := $(wildcard *.go)
@@ -264,10 +273,10 @@ checks-frontend: lockfile-check svg-check ## check frontend files
 checks-backend: tidy-check swagger-check openapi3-check fmt-check swagger-validate security-check ## check backend files

 .PHONY: lint
-lint: lint-frontend lint-backend lint-templates lint-swagger lint-md lint-actions lint-json lint-yaml lint-shell ## lint everything
+lint: lint-frontend lint-backend lint-templates lint-swagger lint-spell lint-md lint-actions lint-json lint-yaml lint-shell ## lint everything

 .PHONY: lint-fix
-lint-fix: lint-frontend-fix lint-backend-fix ## lint everything and fix issues
+lint-fix: lint-frontend-fix lint-backend-fix lint-spell-fix ## lint everything and fix issues

 .PHONY: lint-frontend
 lint-frontend: lint-js lint-css ## lint frontend files
@@ -311,6 +320,14 @@ lint-md: node_modules ## lint markdown files
 lint-md-fix: node_modules ## lint markdown files and fix issues
 	pnpm exec markdownlint --fix *.md

+.PHONY: lint-spell
+lint-spell: ## lint spelling
+	@git ls-files $(SPELLCHECK_FILES) | xargs go run $(MISSPELL_PACKAGE) -dict assets/misspellings.csv -error
+
+.PHONY: lint-spell-fix
+lint-spell-fix: ## lint spelling and fix issues
+	@git ls-files $(SPELLCHECK_FILES) | xargs go run $(MISSPELL_PACKAGE) -dict assets/misspellings.csv -w
+
 .PHONY: lint-go
 lint-go: ## lint go files
 	GO=$(GO) GOLANGCI_LINT_PACKAGE=$(GOLANGCI_LINT_PACKAGE) $(GO) run ./tools/lint-go-all.go
@@ -539,7 +556,7 @@ release-compress: | $(DIST_DIRS)

 .PHONY: release-sources
 release-sources: | $(DIST_DIRS)
-	echo $(GITEA_VERSION) > $(STORED_VERSION_FILE)
+	echo $(VERSION) > $(STORED_VERSION_FILE)
 # bsdtar needs a ^ to prevent matching subdirectories
 	$(eval EXCL := --exclude=$(shell tar --help | grep -q bsdtar && echo "^")./)
 # use transform to a add a release-folder prefix; in bsdtar the transform parameter equivalent is -s
@@ -566,6 +583,7 @@ deps-tools: ## install tool dependencies
 	$(GO) install $(EDITORCONFIG_CHECKER_PACKAGE) & \
 	$(GO) install $(GOLANGCI_LINT_PACKAGE) & \
 	$(GO) install $(GXZ_PACKAGE) & \
+	$(GO) install $(MISSPELL_PACKAGE) & \
 	$(GO) install $(SWAGGER_PACKAGE) & \
 	$(GO) install $(GOVULNCHECK_PACKAGE) & \
 	$(GO) install $(ACTIONLINT_PACKAGE) & \
@@ -14,6 +14,26 @@
    "path": "filippo.io/edwards25519/LICENSE",
    "licenseText": "Copyright (c) 2009 The Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
  },
+  {
+    "name": "gitea.com/go-chi/binding",
+    "path": "gitea.com/go-chi/binding/LICENSE",
+    "licenseText": "Apache License\nVersion 2.0, January 2004\nhttp://www.apache.org/licenses/\n\nTERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n1. Definitions.\n\n\"License\" shall mean the terms and conditions for use, reproduction, and\ndistribution as defined by Sections 1 through 9 of this document.\n\n\"Licensor\" shall mean the copyright owner or entity authorized by the copyright\nowner that is granting the License.\n\n\"Legal Entity\" shall mean the union of the acting entity and all other entities\nthat control, are controlled by, or are under common control with that entity.\nFor the purposes of this definition, \"control\" means (i) the power, direct or\nindirect, to cause the direction or management of such entity, whether by\ncontract or otherwise, or (ii) ownership of fifty percent (50%) or more of the\noutstanding shares, or (iii) beneficial ownership of such entity.\n\n\"You\" (or \"Your\") shall mean an individual or Legal Entity exercising\npermissions granted by this License.\n\n\"Source\" form shall mean the preferred form for making modifications, including\nbut not limited to software source code, documentation source, and configuration\nfiles.\n\n\"Object\" form shall mean any form resulting from mechanical transformation or\ntranslation of a Source form, including but not limited to compiled object code,\ngenerated documentation, and conversions to other media types.\n\n\"Work\" shall mean the work of authorship, whether in Source or Object form, made\navailable under the License, as indicated by a copyright notice that is included\nin or attached to the work (an example is provided in the Appendix below).\n\n\"Derivative Works\" shall mean any work, whether in Source or Object form, that\nis based on (or derived from) the Work and for which the editorial revisions,\nannotations, elaborations, or other modifications represent, as a whole, an\noriginal work of authorship. For the purposes of this License, Derivative Works\nshall not include works that remain separable from, or merely link (or bind by\nname) to the interfaces of, the Work and Derivative Works thereof.\n\n\"Contribution\" shall mean any work of authorship, including the original version\nof the Work and any modifications or additions to that Work or Derivative Works\nthereof, that is intentionally submitted to Licensor for inclusion in the Work\nby the copyright owner or by an individual or Legal Entity authorized to submit\non behalf of the copyright owner. For the purposes of this definition,\n\"submitted\" means any form of electronic, verbal, or written communication sent\nto the Licensor or its representatives, including but not limited to\ncommunication on electronic mailing lists, source code control systems, and\nissue tracking systems that are managed by, or on behalf of, the Licensor for\nthe purpose of discussing and improving the Work, but excluding communication\nthat is conspicuously marked or otherwise designated in writing by the copyright\nowner as \"Not a Contribution.\"\n\n\"Contributor\" shall mean Licensor and any individual or Legal Entity on behalf\nof whom a Contribution has been received by Licensor and subsequently\nincorporated within the Work.\n\n2. Grant of Copyright License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable copyright license to reproduce, prepare Derivative Works of,\npublicly display, publicly perform, sublicense, and distribute the Work and such\nDerivative Works in Source or Object form.\n\n3. Grant of Patent License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable (except as stated in this section) patent license to make, have\nmade, use, offer to sell, sell, import, and otherwise transfer the Work, where\nsuch license applies only to those patent claims licensable by such Contributor\nthat are necessarily infringed by their Contribution(s) alone or by combination\nof their Contribution(s) with the Work to which such Contribution(s) was\nsubmitted. If You institute patent litigation against any entity (including a\ncross-claim or counterclaim in a lawsuit) alleging that the Work or a\nContribution incorporated within the Work constitutes direct or contributory\npatent infringement, then any patent licenses granted to You under this License\nfor that Work shall terminate as of the date such litigation is filed.\n\n4. Redistribution.\n\nYou may reproduce and distribute copies of the Work or Derivative Works thereof\nin any medium, with or without modifications, and in Source or Object form,\nprovided that You meet the following conditions:\n\nYou must give any other recipients of the Work or Derivative Works a copy of\nthis License; and\nYou must cause any modified files to carry prominent notices stating that YLine truncated
+  },
+  {
+    "name": "gitea.com/go-chi/cache",
+    "path": "gitea.com/go-chi/cache/LICENSE",
+    "licenseText": "Apache License\nVersion 2.0, January 2004\nhttp://www.apache.org/licenses/\n\nTERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n1. Definitions.\n\n\"License\" shall mean the terms and conditions for use, reproduction, and\ndistribution as defined by Sections 1 through 9 of this document.\n\n\"Licensor\" shall mean the copyright owner or entity authorized by the copyright\nowner that is granting the License.\n\n\"Legal Entity\" shall mean the union of the acting entity and all other entities\nthat control, are controlled by, or are under common control with that entity.\nFor the purposes of this definition, \"control\" means (i) the power, direct or\nindirect, to cause the direction or management of such entity, whether by\ncontract or otherwise, or (ii) ownership of fifty percent (50%) or more of the\noutstanding shares, or (iii) beneficial ownership of such entity.\n\n\"You\" (or \"Your\") shall mean an individual or Legal Entity exercising\npermissions granted by this License.\n\n\"Source\" form shall mean the preferred form for making modifications, including\nbut not limited to software source code, documentation source, and configuration\nfiles.\n\n\"Object\" form shall mean any form resulting from mechanical transformation or\ntranslation of a Source form, including but not limited to compiled object code,\ngenerated documentation, and conversions to other media types.\n\n\"Work\" shall mean the work of authorship, whether in Source or Object form, made\navailable under the License, as indicated by a copyright notice that is included\nin or attached to the work (an example is provided in the Appendix below).\n\n\"Derivative Works\" shall mean any work, whether in Source or Object form, that\nis based on (or derived from) the Work and for which the editorial revisions,\nannotations, elaborations, or other modifications represent, as a whole, an\noriginal work of authorship. For the purposes of this License, Derivative Works\nshall not include works that remain separable from, or merely link (or bind by\nname) to the interfaces of, the Work and Derivative Works thereof.\n\n\"Contribution\" shall mean any work of authorship, including the original version\nof the Work and any modifications or additions to that Work or Derivative Works\nthereof, that is intentionally submitted to Licensor for inclusion in the Work\nby the copyright owner or by an individual or Legal Entity authorized to submit\non behalf of the copyright owner. For the purposes of this definition,\n\"submitted\" means any form of electronic, verbal, or written communication sent\nto the Licensor or its representatives, including but not limited to\ncommunication on electronic mailing lists, source code control systems, and\nissue tracking systems that are managed by, or on behalf of, the Licensor for\nthe purpose of discussing and improving the Work, but excluding communication\nthat is conspicuously marked or otherwise designated in writing by the copyright\nowner as \"Not a Contribution.\"\n\n\"Contributor\" shall mean Licensor and any individual or Legal Entity on behalf\nof whom a Contribution has been received by Licensor and subsequently\nincorporated within the Work.\n\n2. Grant of Copyright License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable copyright license to reproduce, prepare Derivative Works of,\npublicly display, publicly perform, sublicense, and distribute the Work and such\nDerivative Works in Source or Object form.\n\n3. Grant of Patent License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable (except as stated in this section) patent license to make, have\nmade, use, offer to sell, sell, import, and otherwise transfer the Work, where\nsuch license applies only to those patent claims licensable by such Contributor\nthat are necessarily infringed by their Contribution(s) alone or by combination\nof their Contribution(s) with the Work to which such Contribution(s) was\nsubmitted. If You institute patent litigation against any entity (including a\ncross-claim or counterclaim in a lawsuit) alleging that the Work or a\nContribution incorporated within the Work constitutes direct or contributory\npatent infringement, then any patent licenses granted to You under this License\nfor that Work shall terminate as of the date such litigation is filed.\n\n4. Redistribution.\n\nYou may reproduce and distribute copies of the Work or Derivative Works thereof\nin any medium, with or without modifications, and in Source or Object form,\nprovided that You meet the following conditions:\n\nYou must give any other recipients of the Work or Derivative Works a copy of\nthis License; and\nYou must cause any modified files to carry prominent notices stating that YLine truncated
+  },
+  {
+    "name": "gitea.com/go-chi/captcha",
+    "path": "gitea.com/go-chi/captcha/LICENSE",
+    "licenseText": "Apache License\nVersion 2.0, January 2004\nhttp://www.apache.org/licenses/\n\nTERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n1. Definitions.\n\n\"License\" shall mean the terms and conditions for use, reproduction, and\ndistribution as defined by Sections 1 through 9 of this document.\n\n\"Licensor\" shall mean the copyright owner or entity authorized by the copyright\nowner that is granting the License.\n\n\"Legal Entity\" shall mean the union of the acting entity and all other entities\nthat control, are controlled by, or are under common control with that entity.\nFor the purposes of this definition, \"control\" means (i) the power, direct or\nindirect, to cause the direction or management of such entity, whether by\ncontract or otherwise, or (ii) ownership of fifty percent (50%) or more of the\noutstanding shares, or (iii) beneficial ownership of such entity.\n\n\"You\" (or \"Your\") shall mean an individual or Legal Entity exercising\npermissions granted by this License.\n\n\"Source\" form shall mean the preferred form for making modifications, including\nbut not limited to software source code, documentation source, and configuration\nfiles.\n\n\"Object\" form shall mean any form resulting from mechanical transformation or\ntranslation of a Source form, including but not limited to compiled object code,\ngenerated documentation, and conversions to other media types.\n\n\"Work\" shall mean the work of authorship, whether in Source or Object form, made\navailable under the License, as indicated by a copyright notice that is included\nin or attached to the work (an example is provided in the Appendix below).\n\n\"Derivative Works\" shall mean any work, whether in Source or Object form, that\nis based on (or derived from) the Work and for which the editorial revisions,\nannotations, elaborations, or other modifications represent, as a whole, an\noriginal work of authorship. For the purposes of this License, Derivative Works\nshall not include works that remain separable from, or merely link (or bind by\nname) to the interfaces of, the Work and Derivative Works thereof.\n\n\"Contribution\" shall mean any work of authorship, including the original version\nof the Work and any modifications or additions to that Work or Derivative Works\nthereof, that is intentionally submitted to Licensor for inclusion in the Work\nby the copyright owner or by an individual or Legal Entity authorized to submit\non behalf of the copyright owner. For the purposes of this definition,\n\"submitted\" means any form of electronic, verbal, or written communication sent\nto the Licensor or its representatives, including but not limited to\ncommunication on electronic mailing lists, source code control systems, and\nissue tracking systems that are managed by, or on behalf of, the Licensor for\nthe purpose of discussing and improving the Work, but excluding communication\nthat is conspicuously marked or otherwise designated in writing by the copyright\nowner as \"Not a Contribution.\"\n\n\"Contributor\" shall mean Licensor and any individual or Legal Entity on behalf\nof whom a Contribution has been received by Licensor and subsequently\nincorporated within the Work.\n\n2. Grant of Copyright License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable copyright license to reproduce, prepare Derivative Works of,\npublicly display, publicly perform, sublicense, and distribute the Work and such\nDerivative Works in Source or Object form.\n\n3. Grant of Patent License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable (except as stated in this section) patent license to make, have\nmade, use, offer to sell, sell, import, and otherwise transfer the Work, where\nsuch license applies only to those patent claims licensable by such Contributor\nthat are necessarily infringed by their Contribution(s) alone or by combination\nof their Contribution(s) with the Work to which such Contribution(s) was\nsubmitted. If You institute patent litigation against any entity (including a\ncross-claim or counterclaim in a lawsuit) alleging that the Work or a\nContribution incorporated within the Work constitutes direct or contributory\npatent infringement, then any patent licenses granted to You under this License\nfor that Work shall terminate as of the date such litigation is filed.\n\n4. Redistribution.\n\nYou may reproduce and distribute copies of the Work or Derivative Works thereof\nin any medium, with or without modifications, and in Source or Object form,\nprovided that You meet the following conditions:\n\nYou must give any other recipients of the Work or Derivative Works a copy of\nthis License; and\nYou must cause any modified files to carry prominent notices stating that YLine truncated
+  },
+  {
+    "name": "gitea.com/go-chi/session",
+    "path": "gitea.com/go-chi/session/LICENSE",
+    "licenseText": "Apache License\nVersion 2.0, January 2004\nhttp://www.apache.org/licenses/\n\nTERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n1. Definitions.\n\n\"License\" shall mean the terms and conditions for use, reproduction, and\ndistribution as defined by Sections 1 through 9 of this document.\n\n\"Licensor\" shall mean the copyright owner or entity authorized by the copyright\nowner that is granting the License.\n\n\"Legal Entity\" shall mean the union of the acting entity and all other entities\nthat control, are controlled by, or are under common control with that entity.\nFor the purposes of this definition, \"control\" means (i) the power, direct or\nindirect, to cause the direction or management of such entity, whether by\ncontract or otherwise, or (ii) ownership of fifty percent (50%) or more of the\noutstanding shares, or (iii) beneficial ownership of such entity.\n\n\"You\" (or \"Your\") shall mean an individual or Legal Entity exercising\npermissions granted by this License.\n\n\"Source\" form shall mean the preferred form for making modifications, including\nbut not limited to software source code, documentation source, and configuration\nfiles.\n\n\"Object\" form shall mean any form resulting from mechanical transformation or\ntranslation of a Source form, including but not limited to compiled object code,\ngenerated documentation, and conversions to other media types.\n\n\"Work\" shall mean the work of authorship, whether in Source or Object form, made\navailable under the License, as indicated by a copyright notice that is included\nin or attached to the work (an example is provided in the Appendix below).\n\n\"Derivative Works\" shall mean any work, whether in Source or Object form, that\nis based on (or derived from) the Work and for which the editorial revisions,\nannotations, elaborations, or other modifications represent, as a whole, an\noriginal work of authorship. For the purposes of this License, Derivative Works\nshall not include works that remain separable from, or merely link (or bind by\nname) to the interfaces of, the Work and Derivative Works thereof.\n\n\"Contribution\" shall mean any work of authorship, including the original version\nof the Work and any modifications or additions to that Work or Derivative Works\nthereof, that is intentionally submitted to Licensor for inclusion in the Work\nby the copyright owner or by an individual or Legal Entity authorized to submit\non behalf of the copyright owner. For the purposes of this definition,\n\"submitted\" means any form of electronic, verbal, or written communication sent\nto the Licensor or its representatives, including but not limited to\ncommunication on electronic mailing lists, source code control systems, and\nissue tracking systems that are managed by, or on behalf of, the Licensor for\nthe purpose of discussing and improving the Work, but excluding communication\nthat is conspicuously marked or otherwise designated in writing by the copyright\nowner as \"Not a Contribution.\"\n\n\"Contributor\" shall mean Licensor and any individual or Legal Entity on behalf\nof whom a Contribution has been received by Licensor and subsequently\nincorporated within the Work.\n\n2. Grant of Copyright License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable copyright license to reproduce, prepare Derivative Works of,\npublicly display, publicly perform, sublicense, and distribute the Work and such\nDerivative Works in Source or Object form.\n\n3. Grant of Patent License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable (except as stated in this section) patent license to make, have\nmade, use, offer to sell, sell, import, and otherwise transfer the Work, where\nsuch license applies only to those patent claims licensable by such Contributor\nthat are necessarily infringed by their Contribution(s) alone or by combination\nof their Contribution(s) with the Work to which such Contribution(s) was\nsubmitted. If You institute patent litigation against any entity (including a\ncross-claim or counterclaim in a lawsuit) alleging that the Work or a\nContribution incorporated within the Work constitutes direct or contributory\npatent infringement, then any patent licenses granted to You under this License\nfor that Work shall terminate as of the date such litigation is filed.\n\n4. Redistribution.\n\nYou may reproduce and distribute copies of the Work or Derivative Works thereof\nin any medium, with or without modifications, and in Source or Object form,\nprovided that You meet the following conditions:\n\nYou must give any other recipients of the Work or Derivative Works a copy of\nthis License; and\nYou must cause any modified files to carry prominent notices stating that YLine truncated
+  },
  {
    "name": "gitea.com/lunny/dingtalk_webhook",
    "path": "gitea.com/lunny/dingtalk_webhook/LICENSE",
@@ -54,6 +74,11 @@
    "path": "github.com/Azure/go-ntlmssp/LICENSE",
    "licenseText": "The MIT License (MIT)\n\nCopyright (c) 2016 Microsoft\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
  },
+  {
+    "name": "github.com/DataDog/zstd",
+    "path": "github.com/DataDog/zstd/LICENSE",
+    "licenseText": "Simplified BSD License\n\nCopyright (c) 2016, Datadog \u003cinfo@datadoghq.com\u003e\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n    * Redistributions of source code must retain the above copyright notice,\n      this list of conditions and the following disclaimer.\n    * Redistributions in binary form must reproduce the above copyright notice,\n      this list of conditions and the following disclaimer in the documentation\n      and/or other materials provided with the distribution.\n    * Neither the name of the copyright holder nor the names of its contributors\n      may be used to endorse or promote products derived from this software\n      without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
+  },
  {
    "name": "github.com/Necoro/html2text",
    "path": "github.com/Necoro/html2text/LICENSE",
@@ -309,6 +334,21 @@
    "path": "github.com/coder/websocket/LICENSE.txt",
    "licenseText": "Copyright (c) 2025 Coder\n\nPermission to use, copy, modify, and distribute this software for any\npurpose with or without fee is hereby granted, provided that the above\ncopyright notice and this permission notice appear in all copies.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\" AND THE AUTHOR DISCLAIMS ALL WARRANTIES\nWITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF\nMERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR\nANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES\nWHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN\nACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF\nOR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.\n"
  },
+  {
+    "name": "github.com/couchbase/go-couchbase",
+    "path": "github.com/couchbase/go-couchbase/LICENSE",
+    "licenseText": "Copyright (c) 2013  Couchbase, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies\nof the Software, and to permit persons to whom the Software is furnished to do\nso, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
+  },
+  {
+    "name": "github.com/couchbase/gomemcached",
+    "path": "github.com/couchbase/gomemcached/LICENSE",
+    "licenseText": "Copyright (c) 2013 Dustin Sallings\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
+  },
+  {
+    "name": "github.com/couchbase/goutils",
+    "path": "github.com/couchbase/goutils/LICENSE.txt",
+    "licenseText": "Source code in this repository is licensed under various licenses. The\nBusiness Source License 1.1 (BSL) is one such license. Each file indicates in\na section at the beginning of the file the name of the license that applies to\nit. All licenses used in this repository can be found in the top-level\nlicenses directory.\n"
+  },
  {
    "name": "github.com/cpuguy83/go-md2man/v2",
    "path": "github.com/cpuguy83/go-md2man/v2/LICENSE.md",
@@ -489,6 +529,11 @@
    "path": "github.com/golang/snappy/LICENSE",
    "licenseText": "Copyright (c) 2011 The Snappy-Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
  },
+  {
+    "name": "github.com/google/flatbuffers",
+    "path": "github.com/google/flatbuffers/LICENSE",
+    "licenseText": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under tLine truncated
+  },
  {
    "name": "github.com/google/go-github/v92",
    "path": "github.com/google/go-github/v92/LICENSE",
@@ -879,6 +924,11 @@
    "path": "github.com/santhosh-tekuri/jsonschema/v6/LICENSE",
    "licenseText": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under tLine truncated
  },
+  {
+    "name": "github.com/sassoftware/go-rpmutils",
+    "path": "github.com/sassoftware/go-rpmutils/LICENSE",
+    "licenseText": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under tLine truncated
+  },
  {
    "name": "github.com/sergi/go-diff",
    "path": "github.com/sergi/go-diff/LICENSE",
@@ -944,6 +994,11 @@
    "path": "github.com/ulikunitz/xz/LICENSE",
    "licenseText": "Copyright (c) 2014-2022  Ulrich Kunitz\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n  list of conditions and the following disclaimer.\n\n* Redistributions in binary form must reproduce the above copyright notice,\n  this list of conditions and the following disclaimer in the documentation\n  and/or other materials provided with the distribution.\n\n* My name, Ulrich Kunitz, may not be used to endorse or promote products\n  derived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
  },
+  {
+    "name": "github.com/unknwon/com",
+    "path": "github.com/unknwon/com/LICENSE",
+    "licenseText": "Apache License\nVersion 2.0, January 2004\nhttp://www.apache.org/licenses/\n\nTERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n1. Definitions.\n\n\"License\" shall mean the terms and conditions for use, reproduction, and\ndistribution as defined by Sections 1 through 9 of this document.\n\n\"Licensor\" shall mean the copyright owner or entity authorized by the copyright\nowner that is granting the License.\n\n\"Legal Entity\" shall mean the union of the acting entity and all other entities\nthat control, are controlled by, or are under common control with that entity.\nFor the purposes of this definition, \"control\" means (i) the power, direct or\nindirect, to cause the direction or management of such entity, whether by\ncontract or otherwise, or (ii) ownership of fifty percent (50%) or more of the\noutstanding shares, or (iii) beneficial ownership of such entity.\n\n\"You\" (or \"Your\") shall mean an individual or Legal Entity exercising\npermissions granted by this License.\n\n\"Source\" form shall mean the preferred form for making modifications, including\nbut not limited to software source code, documentation source, and configuration\nfiles.\n\n\"Object\" form shall mean any form resulting from mechanical transformation or\ntranslation of a Source form, including but not limited to compiled object code,\ngenerated documentation, and conversions to other media types.\n\n\"Work\" shall mean the work of authorship, whether in Source or Object form, made\navailable under the License, as indicated by a copyright notice that is included\nin or attached to the work (an example is provided in the Appendix below).\n\n\"Derivative Works\" shall mean any work, whether in Source or Object form, that\nis based on (or derived from) the Work and for which the editorial revisions,\nannotations, elaborations, or other modifications represent, as a whole, an\noriginal work of authorship. For the purposes of this License, Derivative Works\nshall not include works that remain separable from, or merely link (or bind by\nname) to the interfaces of, the Work and Derivative Works thereof.\n\n\"Contribution\" shall mean any work of authorship, including the original version\nof the Work and any modifications or additions to that Work or Derivative Works\nthereof, that is intentionally submitted to Licensor for inclusion in the Work\nby the copyright owner or by an individual or Legal Entity authorized to submit\non behalf of the copyright owner. For the purposes of this definition,\n\"submitted\" means any form of electronic, verbal, or written communication sent\nto the Licensor or its representatives, including but not limited to\ncommunication on electronic mailing lists, source code control systems, and\nissue tracking systems that are managed by, or on behalf of, the Licensor for\nthe purpose of discussing and improving the Work, but excluding communication\nthat is conspicuously marked or otherwise designated in writing by the copyright\nowner as \"Not a Contribution.\"\n\n\"Contributor\" shall mean Licensor and any individual or Legal Entity on behalf\nof whom a Contribution has been received by Licensor and subsequently\nincorporated within the Work.\n\n2. Grant of Copyright License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable copyright license to reproduce, prepare Derivative Works of,\npublicly display, publicly perform, sublicense, and distribute the Work and such\nDerivative Works in Source or Object form.\n\n3. Grant of Patent License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable (except as stated in this section) patent license to make, have\nmade, use, offer to sell, sell, import, and otherwise transfer the Work, where\nsuch license applies only to those patent claims licensable by such Contributor\nthat are necessarily infringed by their Contribution(s) alone or by combination\nof their Contribution(s) with the Work to which such Contribution(s) was\nsubmitted. If You institute patent litigation against any entity (including a\ncross-claim or counterclaim in a lawsuit) alleging that the Work or a\nContribution incorporated within the Work constitutes direct or contributory\npatent infringement, then any patent licenses granted to You under this License\nfor that Work shall terminate as of the date such litigation is filed.\n\n4. Redistribution.\n\nYou may reproduce and distribute copies of the Work or Derivative Works thereof\nin any medium, with or without modifications, and in Source or Object form,\nprovided that You meet the following conditions:\n\nYou must give any other recipients of the Work or Derivative Works a copy of\nthis License; and\nYou must cause any modified files to carry prominent notices stating that YLine truncated
+  },
  {
    "name": "github.com/urfave/cli-docs/v3",
    "path": "github.com/urfave/cli-docs/v3/LICENSE",
@@ -969,6 +1024,11 @@
    "path": "github.com/x448/float16/LICENSE",
    "licenseText": "MIT License\n\nCopyright (c) 2019 Montgomery Edwards⁴⁴⁸ and Faye Amacker\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n"
  },
+  {
+    "name": "github.com/xi2/xz",
+    "path": "github.com/xi2/xz/LICENSE",
+    "licenseText": "Licensing of github.com/xi2/xz\n==============================\n\n    This Go package is a modified version of\n\n        XZ Embedded  \u003chttp://tukaani.org/xz/embedded.html\u003e\n\n    The contents of the testdata directory are modified versions of\n    the test files from\n\n        XZ Utils  \u003chttp://tukaani.org/xz/\u003e\n\n    All the files in this package have been written by Michael Cross,\n    Lasse Collin and/or Igor PavLov. All these files have been put\n    into the public domain. You can do whatever you want with these\n    files.\n\n    This software is provided \"as is\", without any warranty.\n"
+  },
  {
    "name": "github.com/yohcop/openid-go",
    "path": "github.com/yohcop/openid-go/LICENSE",
@@ -0,0 +1,21 @@
+acounts,accounts
+canidate,candidate
+comfirm,confirm
+converage,coverage
+currrently,currently
+delimeter,delimiter
+differrent,different
+exclusing,excluding
+finshed,finished
+formated,formatted
+inderect,indirect
+insuficient,insufficient
+likly,likely
+mergable,mergeable
+overrided,overridden
+priortized,prioritized
+registeration,registration
+reuqest,request
+reviwer,reviewer
+superceded,superseded
+underlaying,underlying
@@ -13,11 +13,13 @@ import (

 	"gitea.dev/models/db"
 	"gitea.dev/modules/dump"
+	"gitea.dev/modules/json"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/storage"
 	"gitea.dev/modules/util"

+	"gitea.com/go-chi/session"
 	"github.com/urfave/cli/v3"
 )

@@ -247,8 +249,12 @@ func runDump(ctx context.Context, cmd *cli.Command) error {
 		log.Info("Packing data directory...%s", setting.AppDataPath)

 		var excludes []string
-		if setting.SessionConfig.Provider == "file" {
-			excludes = append(excludes, setting.SessionConfig.ProviderConfig)
+		if setting.SessionConfig.OriginalProvider == "file" {
+			var opts session.Options
+			if err = json.Unmarshal([]byte(setting.SessionConfig.ProviderConfig), &opts); err != nil {
+				return err
+			}
+			excludes = append(excludes, opts.ProviderConfig)
 		}

 		if cmd.IsSet("skip-index") && cmd.Bool("skip-index") {
@@ -169,6 +169,10 @@ func parseGitHookCommitRefLine(line string) (oldCommitID, newCommitID string, re
 }

 func runHookPreReceive(ctx context.Context, c *cli.Command) error {
+	if isInternal, _ := strconv.ParseBool(os.Getenv(repo_module.EnvIsInternal)); isInternal {
+		return nil
+	}
+
 	setup(ctx, c.Bool("debug"))

 	if len(os.Getenv("SSH_ORIGINAL_COMMAND")) == 0 {
@@ -209,6 +213,7 @@ Gitea or set your environment appropriately.`, "")
 	refFullNames := make([]git.RefName, hookBatchSize)
 	count := 0
 	total := 0
+	lastline := 0

 	out := io.Discard
 	if setting.Git.VerbosePush {
@@ -221,6 +226,8 @@ Gitea or set your environment appropriately.`, "")
 		}
 	}

+	supportProcReceive := git.DefaultFeatures().SupportProcReceive
+
 	for scanner.Scan() {
 		// TODO: support news feeds for wiki
 		if isWiki {
@@ -233,23 +240,37 @@ Gitea or set your environment appropriately.`, "")
 		}

 		total++
-		oldCommitIDs[count] = oldCommitID
-		newCommitIDs[count] = newCommitID
-		refFullNames[count] = refFullName
-		count++
-		fmt.Fprintf(out, "*")
+		lastline++

-		if count >= hookBatchSize {
-			fmt.Fprintf(out, " Checking %d references\n", count)
+		// If the ref is a branch or tag, check if it's protected
+		// if supportProcReceive all ref should be checked because
+		// permission check was delayed
+		if supportProcReceive || refFullName.IsBranch() || refFullName.IsTag() {
+			oldCommitIDs[count] = oldCommitID
+			newCommitIDs[count] = newCommitID
+			refFullNames[count] = refFullName
+			count++
+			fmt.Fprintf(out, "*")

-			hookOptions.OldCommitIDs = oldCommitIDs
-			hookOptions.NewCommitIDs = newCommitIDs
-			hookOptions.RefFullNames = refFullNames
-			extra := private.HookPreReceive(ctx, ownerName, repoName, hookOptions)
-			if extra.HasError() {
-				return fail(ctx, extra.UserMsg, "HookPreReceive(batch) failed: %v", extra.Error)
+			if count >= hookBatchSize {
+				fmt.Fprintf(out, " Checking %d references\n", count)
+
+				hookOptions.OldCommitIDs = oldCommitIDs
+				hookOptions.NewCommitIDs = newCommitIDs
+				hookOptions.RefFullNames = refFullNames
+				extra := private.HookPreReceive(ctx, ownerName, repoName, hookOptions)
+				if extra.HasError() {
+					return fail(ctx, extra.UserMsg, "HookPreReceive(batch) failed: %v", extra.Error)
+				}
+				count = 0
+				lastline = 0
 			}
-			count = 0
+		} else {
+			fmt.Fprintf(out, ".")
+		}
+		if lastline >= hookBatchSize {
+			fmt.Fprintf(out, "\n")
+			lastline = 0
 		}
 	}
 	if err := scanner.Err(); err != nil {
@@ -267,6 +288,8 @@ Gitea or set your environment appropriately.`, "")
 		if extra.HasError() {
 			return fail(ctx, extra.UserMsg, "HookPreReceive(last) failed: %v", extra.Error)
 		}
+	} else if lastline > 0 {
+		fmt.Fprintf(out, "\n")
 	}

 	fmt.Fprintf(out, "Checked %d references in total\n", total)
@@ -276,6 +299,10 @@ Gitea or set your environment appropriately.`, "")
 // runHookUpdate avoid to do heavy operations on update hook because it will be
 // invoked for every ref update which does not like pre-receive and post-receive
 func runHookUpdate(_ context.Context, c *cli.Command) error {
+	if isInternal, _ := strconv.ParseBool(os.Getenv(repo_module.EnvIsInternal)); isInternal {
+		return nil
+	}
+
 	// Update is empty and is kept only for backwards compatibility
 	if len(os.Args) < 3 {
 		return nil
@@ -296,6 +323,11 @@ func runHookPostReceive(ctx context.Context, c *cli.Command) error {
 		return fmt.Errorf("failed to call 'git update-server-info': %w", err)
 	}

+	// Now if we're an internal don't do anything else
+	if isInternal, _ := strconv.ParseBool(os.Getenv(repo_module.EnvIsInternal)); isInternal {
+		return nil
+	}
+
 	if len(os.Getenv("SSH_ORIGINAL_COMMAND")) == 0 {
 		if setting.OnlyAllowPushIfGiteaEnvironmentSet {
 			return fail(ctx, `Rejecting changes as Gitea environment not set.
@@ -443,6 +475,10 @@ Gitea or set your environment appropriately.`, "")
 		return nil
 	}

+	if !git.DefaultFeatures().SupportProcReceive {
+		return fail(ctx, "No proc-receive support", "current git version doesn't support proc-receive.")
+	}
+
 	reader := bufio.NewReader(os.Stdin)
 	repoUser := os.Getenv(repo_module.EnvRepoUsername)
 	isWiki, _ := strconv.ParseBool(os.Getenv(repo_module.EnvRepoIsWiki))
@@ -195,10 +195,12 @@ func runServ(ctx context.Context, c *cli.Command) error {
 	}

 	if len(sshCmdArgs) < 2 {
-		// for AGit Flow
-		if cmd == "ssh_info" {
-			cprintf(c, "%s", agit.SshInfoJson)
-			return nil
+		if git.DefaultFeatures().SupportProcReceive {
+			// for AGit Flow
+			if cmd == "ssh_info" {
+				cprintf(c, "%s", agit.SshInfoJson)
+				return nil
+			}
 		}
 		return fail(ctx, "Too few arguments", "Too few arguments in cmd: %s", cmd)
 	}
@@ -155,7 +155,7 @@
 ;; Username to use for the builtin SSH server. If blank, then it is the value of RUN_USER.
 ;BUILTIN_SSH_SERVER_USER =
 ;;
-;; Domain name to be exposed in clone URL, defaults to the domain part of ROOT_URL
+;; Domain name to be exposed in clone URL, defaults to DOMAIN or the domain part of ROOT_URL
 ;SSH_DOMAIN =
 ;;
 ;; Port number to be exposed in clone URL.
@@ -198,7 +198,7 @@
 ;; For the built-in SSH server, choose the keypair to offer as the host key
 ;; The private key should be at SSH_SERVER_HOST_KEY and the public SSH_SERVER_HOST_KEY.pub
 ;; relative paths are made absolute relative to the APP_DATA_PATH
-;SSH_SERVER_HOST_KEYS=ssh/gitea.rsa, ssh/gitea.ed25519, ssh/gitea.ecdsa, ssh/gogs.rsa
+;SSH_SERVER_HOST_KEYS=ssh/gitea.rsa, ssh/gogs.rsa
 ;;
 ;; Enable SSH Authorized Key Backup when rewriting all keys, default is false
 ;SSH_AUTHORIZED_KEYS_BACKUP = false
@@ -237,7 +237,7 @@
 ;SSH_PER_WRITE_PER_KB_TIMEOUT = 30s
 ;;
 ;; Indicate whether to check minimum key size with corresponding type
-;MINIMUM_KEY_SIZE_CHECK = true
+;MINIMUM_KEY_SIZE_CHECK = false
 ;;
 ;; TLS Settings: Either ACME or manual
 ;; (Other common TLS configuration are found before)
@@ -459,7 +459,7 @@ INTERNAL_TOKEN =
 ;LOGIN_REMEMBER_DAYS = 31
 ;;
 ;; Name of cookie used to store authentication information.
-;COOKIE_REMEMBER_NAME = gitea_remember
+;COOKIE_REMEMBER_NAME = gitea_incredible
 ;;
 ;; URL or path that Gitea should redirect users to *after* performing its own logout.
 ;; Use this, if needed, when authentication is handled by a reverse proxy or SSO.
@@ -783,6 +783,8 @@ LEVEL = Info
 ;; Respond to pushes to a non-default branch with a URL for creating a Pull Request (if the repository has them enabled)
 ;PULL_REQUEST_PUSH_MESSAGE = true
 ;;
+;; (Go-Git only) Don't cache objects greater than this in memory. (Set to 0 to disable.)
+;LARGE_OBJECT_THRESHOLD = 1048576
 ;; Set to true to forcibly set core.protectNTFS=false
 ;DISABLE_CORE_PROTECT_NTFS=false
 ;; Disable the usage of using partial clones for git.
@@ -836,7 +838,7 @@ LEVEL = Info
 ;EMAIL_DOMAIN_BLOCKLIST =
 ;;
 ;; Disallow registration, only allow admins to create accounts.
-;DISABLE_REGISTRATION = true
+;DISABLE_REGISTRATION = false
 ;;
 ;; Allow registration only using gitea itself, it works only when DISABLE_REGISTRATION is false
 ;ALLOW_ONLY_INTERNAL_REGISTRATION = false
@@ -968,11 +970,12 @@ LEVEL = Info
 ;; Value for the domain part of the user's email address in the git log if user
 ;; has set KeepEmailPrivate to true. The user's email will be replaced with a
 ;; concatenation of the user name in lower case, "@" and NO_REPLY_ADDRESS. Default
-;; value is "noreply." + the domain part of ROOT_URL
-;NO_REPLY_ADDRESS =
+;; value is "noreply." + DOMAIN, where DOMAIN resolves to the value from server.DOMAIN
+;; Note: do not use the <DOMAIN> notation below
+;NO_REPLY_ADDRESS = ; noreply.<DOMAIN>
 ;;
-;; Show Registration button, defaults to true only if both DISABLE_REGISTRATION and ALLOW_ONLY_EXTERNAL_REGISTRATION are false
-;SHOW_REGISTRATION_BUTTON = false
+;; Show Registration button
+;SHOW_REGISTRATION_BUTTON = true
 ;;
 ;; Show milestones dashboard page - a view of all the user's milestones
 ;SHOW_MILESTONES_DASHBOARD_PAGE = true
@@ -1218,9 +1221,8 @@ LEVEL = Info
 ;; In default merge messages only include approvers who are official
 ;DEFAULT_MERGE_MESSAGE_OFFICIAL_APPROVERS_ONLY = true
 ;;
-;; Set default squash merge commit message body, valid options: PR_BODY (pull request description), COMMIT_MESSAGES (commit messages), BLANK (none)
-;; Repositories store the current value when created or when their settings are next saved, and can change it there.
-;DEFAULT_SQUASH_MERGE_MESSAGE = PR_BODY
+;; In default squash-merge messages include the commit message of all commits comprising the pull request.
+;POPULATE_SQUASH_COMMENT_WITH_COMMIT_MESSAGES = false
 ;;
 ;; Add co-authored-by and co-committed-by trailers if committer does not match author
 ;ADD_CO_COMMITTER_TRAILERS = true
@@ -1434,14 +1436,11 @@ LEVEL = Info
 ;; The icon theme for folders (basic/material)
 ;FOLDER_ICON_THEME = basic
 ;;
-;; All available reactions users can choose on issues, pull requests and comments.
+;; All available reactions users can choose on issues/prs and comments.
 ;; Values can be emoji alias (:smile:) or a unicode emoji.
 ;; For custom reactions, add a tightly cropped square image to public/assets/img/emoji/reaction_name.png
 ;REACTIONS = +1, -1, laugh, hooray, confused, heart, rocket, eyes
 ;;
-;; Reactions available for releases
-;;RELEASE_REACTIONS = +1, laugh, hooray, heart, rocket, eyes
-;;
 ;; Change the number of users that are displayed in reactions tooltip (triggered by mouse hover).
 ;REACTION_MAX_USER_NUM = 10
 ;;
@@ -1674,13 +1673,13 @@ LEVEL = Info
 ;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
-;; General queue type, currently support: level, channel, redis, dummy
-;; default to level
-;TYPE = level
+;; General queue queue type, currently support: persistable-channel, channel, level, redis, dummy
+;; default to persistable-channel
+;TYPE = persistable-channel
 ;;
-;; data-dir for storing level queues, individual queues will default to `queues/common` meaning the queue is shared.
+;; data-dir for storing persistable queues and level queues, individual queues will default to `queues/common` meaning the queue is shared.
 ;; Relative paths will be made absolute against "APP_DATA_PATH"
-;DATADIR = queues/common
+;DATADIR = queues/
 ;;
 ;; Default queue length before a channel queue will block
 ;LENGTH = 100000
@@ -1688,7 +1687,7 @@ LEVEL = Info
 ;; Batch size to send for batched queues
 ;BATCH_LENGTH = 20
 ;;
-;; When `TYPE` is `level`, this provides a directory for the underlying leveldb
+;; When `TYPE` is `persistable-channel`, this provides a directory for the underlying leveldb
 ;; or additional options of the form `leveldb://path/to/db?option=value&....`, and will override `DATADIR`.
 ;; When `TYPE` is `redis` and this is left empty, it falls back to the shared [redis] CONN_STR.
 ;CONN_STR =
@@ -1756,6 +1755,7 @@ LEVEL = Info
 ;ENABLE_OPENID_SIGNIN = false
 ;;
 ;; Whether to allow registering via OpenID
+;; Do not include to rely on rhw DISABLE_REGISTRATION setting
 ;;ENABLE_OPENID_SIGNUP = false
 ;;
 ;; Allowed URI patterns (POSIX regexp).
@@ -1986,7 +1986,7 @@ LEVEL = Info
 ;; Either "memory", "redis", "memcache", or "twoqueue". default is "memory"
 ;ADAPTER = memory
 ;;
-;; For "memory" and "twoqueue", GC interval in seconds, default is 60
+;; For "memory" only, GC interval in seconds, default is 60
 ;INTERVAL = 60
 ;;
 ;; For "redis" and "memcache", connection host address
@@ -2017,17 +2017,19 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
-;; Either "memory", "file", "redis" or "db", default is "file". "db" will reuse the configuration in [database]
-;PROVIDER = file
+;; Either "memory", "file", "redis", "db", "mysql", "couchbase", "memcache" or "postgres"
+;; Default is "memory". "db" will reuse the configuration in [database]
+;PROVIDER = memory
 ;;
 ;; Provider config options
 ;; memory: doesn't have any config yet
 ;; file: session file path, e.g. `data/sessions`, relative paths will be made absolute against _`AppWorkPath`_.
 ;; redis: default to [redis] CONN_STR
+;; mysql: go-sql-driver/mysql dsn config string, e.g. `root:password@/session_table`
 ;PROVIDER_CONFIG =
 ;;
 ;; Session cookie name
-;COOKIE_NAME = gitea_session
+;COOKIE_NAME = i_like_gitea
 ;;
 ;; If you use session in https only: true or false. If not set, it defaults to `true` if the ROOT_URL is an HTTPS URL.
 ;COOKIE_SECURE =
@@ -2053,8 +2055,7 @@ LEVEL = Info
 ;; How Gitea deals with missing repository avatars
 ;; none = no avatar will be displayed; random = random avatar will be displayed; image = default image will be used
 ;REPOSITORY_AVATAR_FALLBACK = none
-;; Image URL for the "image" fallback, used as-is, defaults to Gitea's builtin repository avatar
-;REPOSITORY_AVATAR_FALLBACK_IMAGE =
+;REPOSITORY_AVATAR_FALLBACK_IMAGE = /img/repo_default.png
 ;;
 ;; Max Width and Height of uploaded avatars.
 ;; This is to limit the amount of RAM used when resizing the image.
@@ -25,6 +25,7 @@ Depending on requirements, the following build tags can be included.
 - `bindata`: Build a single monolithic binary, with all assets included. Required for distribution and production build.
 - `pam`: Enable support for PAM (Linux Pluggable Authentication Modules).
  Can be used to authenticate local users or extend authentication to methods available to PAM.
+- `gogit`: (EXPERIMENTAL) Use go-git variants of Git commands.

 To include all assets, use the `bindata` tag:

@@ -32,6 +33,13 @@ To include all assets, use the `bindata` tag:
 TAGS="bindata" make build
 ```

+Tag `gogit` is used to try to resolve some Windows-specific performance problems, POSIX systems don't need it.
+You can build a Windows binary by:
+
+```bash
+GOOS=windows TAGS="bindata gogit" make build
+```
+
 ## Changing default paths

 Gitea will search for a number of things from the _`CustomPath`_.
@@ -48,10 +48,6 @@ Run a single integration test with the `#` selector:
 make test-integration#TestName
 ```

-Each run gets its own work directory under `tests/integration/` and random ports, so SQLite runs
-can execute in parallel. Runs against other databases still share the database and object storage.
-The work directory is removed after a passing run and kept after a failure.
-
 If you hit errors such as a mismatched database version or SSH push failures, try a
 clean rebuild first:

@@ -17,7 +17,6 @@ import unescapedHtmlLiteral from './tools/eslint-rules/unescaped-html-literal.ts

 const jsExts = ['js', 'mjs', 'cjs'] as const;
 const tsExts = ['ts', 'mts', 'cts'] as const;
-const vueExts = ['vue'] as const;

 const restrictedGlobals = [
  {name: 'localStorage', message: 'Use `modules/user-settings.ts` instead.'},
@@ -37,7 +36,7 @@ export default defineConfig([
    'public/assets/js',
  ]),
  {
-    files: [`**/*.{${[...jsExts, ...tsExts, ...vueExts].join(',')}}`],
+    files: [`**/*.{${[...jsExts, ...tsExts].join(',')}}`],
    ignores: ['dist/*'],
    languageOptions: {
      ecmaVersion: 'latest',
@@ -49,9 +48,7 @@ export default defineConfig([
        ecmaFeatures: {
          impliedStrict: true,
        },
-        parser: typescriptParser,
        project: true,
-        extraFileExtensions: vueExts.map((ext) => `.${ext}`),
      },
    },
    linterOptions: {
@@ -69,11 +66,8 @@ export default defineConfig([
      wc,
    },
    settings: {
-      'import-x/extensions': [...jsExts, ...tsExts, ...vueExts].map((ext) => `.${ext}`),
-      'import-x/parsers': {
-        '@typescript-eslint/parser': [...jsExts, ...tsExts].map((ext) => `.${ext}`),
-        'vue-eslint-parser': vueExts.map((ext) => `.${ext}`),
-      },
+      'import-x/extensions': [...jsExts, ...tsExts].map((ext) => `.${ext}`),
+      'import-x/parsers': {'@typescript-eslint/parser': [...jsExts, ...tsExts].map((ext) => `.${ext}`)},
      'import-x/resolver': {'typescript': true},
    },
    rules: {
@@ -239,7 +233,6 @@ export default defineConfig([
      '@typescript-eslint/no-unsafe-assignment': [0],
      '@typescript-eslint/no-unsafe-call': [0],
      '@typescript-eslint/no-unsafe-declaration-merging': [2],
-      '@typescript-eslint/no-unsafe-enum-assignment': [0],
      '@typescript-eslint/no-unsafe-enum-comparison': [0],
      '@typescript-eslint/no-unsafe-function-type': [2],
      '@typescript-eslint/no-unsafe-member-access': [0],
@@ -311,7 +304,6 @@ export default defineConfig([
      'func-names': [0],
      'func-style': [0],
      'getter-return': [2],
-      'gitea/unescaped-html-literal': [2],
      'grouped-accessor-pairs': [2],
      'guard-for-in': [0],
      'id-denylist': [0],
@@ -712,7 +704,6 @@ export default defineConfig([
      'unicorn/better-dom-traversing': [2],
      'unicorn/catch-error-name': [0],
      'unicorn/class-reference-in-static-methods': [2],
-      'unicorn/comma-spacing': [0], // only applies to json language
      'unicorn/comment-content': [0],
      'unicorn/consistent-arrow-return-style': [0],
      'unicorn/consistent-assert': [0],
@@ -743,10 +734,8 @@ export default defineConfig([
      'unicorn/filename-case': [0],
      'unicorn/id-match': [2],
      'unicorn/import-style': [0],
-      'unicorn/indent': [0], // only applies to json and css languages
      'unicorn/isolated-functions': [2, {functions: []}],
      'unicorn/iteration-fallback-style': [2, 'fallback'],
-      'unicorn/key-name-casing': [0], // only applies to json, yaml and toml languages
      'unicorn/logical-assignment-operators': [0],
      'unicorn/max-nested-calls': [0],
      'unicorn/name-replacements': [0],
@@ -779,20 +768,21 @@ export default defineConfig([
      'unicorn/no-chained-comparison': [2],
      'unicorn/no-collection-bracket-access': [2],
      'unicorn/no-computed-property-existence-check': [0],
-      'unicorn/no-conflicting-constraints': [2],
      'unicorn/no-confusing-array-splice': [2],
      'unicorn/no-confusing-array-with': [2],
      'unicorn/no-console-spaces': [0],
      'unicorn/no-constant-zero-expression': [2],
      'unicorn/no-declarations-before-early-exit': [0],
+      'unicorn/no-deprecated-css-features': [0],
      'unicorn/no-document-cookie': [2],
      'unicorn/no-double-comparison': [2],
+      'unicorn/no-duplicate-css-selectors': [0],
+      'unicorn/no-duplicate-font-family-names': [0],
      'unicorn/no-duplicate-if-branches': [2],
      'unicorn/no-duplicate-logical-operands': [2],
      'unicorn/no-duplicate-loops': [0],
      'unicorn/no-duplicate-set-values': [2],
      'unicorn/no-empty-file': [2],
-      'unicorn/no-empty-link-text': [0], // only applies to markdown language
      'unicorn/no-error-property-assignment': [2],
      'unicorn/no-exports-in-scripts': [2],
      'unicorn/no-for-each': [2],
@@ -800,34 +790,21 @@ export default defineConfig([
      'unicorn/no-global-object-property-assignment': [0],
      'unicorn/no-immediate-mutation': [0],
      'unicorn/no-impossible-length-comparison': [2],
-      'unicorn/no-incomplete-accessor-override': [2],
      'unicorn/no-incorrect-query-selector': [2],
      'unicorn/no-incorrect-template-string-interpolation': [0],
-      'unicorn/no-ineffective-csp-directives': [2],
      'unicorn/no-instanceof-builtins': [2],
      'unicorn/no-invalid-argument-count': [2],
-      'unicorn/no-invalid-boolean-attribute-value': [2],
      'unicorn/no-invalid-character-comparison': [2],
-      'unicorn/no-invalid-dom-token': [2],
      'unicorn/no-invalid-fetch-options': [2],
      'unicorn/no-invalid-file-input-accept': [2],
-      'unicorn/no-invalid-integrity': [2],
-      'unicorn/no-invalid-intl-options': [2],
-      'unicorn/no-invalid-property-descriptor': [2],
+      'unicorn/no-invalid-media-features': [0],
      'unicorn/no-invalid-remove-event-listener': [2],
-      'unicorn/no-invalid-response-options': [2],
-      'unicorn/no-invalid-style-set-property': [2],
-      'unicorn/no-invalid-temporal-arithmetic': [2],
-      'unicorn/no-invalid-url-protocol-comparison': [2],
      'unicorn/no-invalid-well-known-symbol-methods': [2],
-      'unicorn/no-javascript-url': [0], // only applies to markdown language
      'unicorn/no-keyword-prefix': [0],
      'unicorn/no-late-current-target-access': [2],
      'unicorn/no-late-event-control': [2],
-      'unicorn/no-leading-empty-lines': [0], // handled by @stylistic/no-multiple-empty-lines
      'unicorn/no-lonely-if': [2],
      'unicorn/no-loop-iterable-mutation': [2],
-      'unicorn/no-loss-of-precision': [0], // only applies to json, toml and css languages
      'unicorn/no-magic-array-flat-depth': [0],
      'unicorn/no-manually-wrapped-comments': [0], // too opinionated
      'unicorn/no-mismatched-map-key': [2],
@@ -840,6 +817,7 @@ export default defineConfig([
      'unicorn/no-negated-condition': [0],
      'unicorn/no-negation-in-equality-check': [2],
      'unicorn/no-nested-ternary': [0],
+      'unicorn/no-nesting-with-mixed-specificity': [0],
      'unicorn/no-new-array': [0],
      'unicorn/no-new-buffer': [2],
      'unicorn/no-non-function-verb-prefix': [0],
@@ -848,9 +826,9 @@ export default defineConfig([
      'unicorn/no-object-as-default-parameter': [0],
      'unicorn/no-object-methods-with-collections': [2],
      'unicorn/no-optional-chaining-on-undeclared-variable': [2],
-      'unicorn/no-prevent-default-in-passive-listener': [2],
      'unicorn/no-process-exit': [0],
      'unicorn/no-redundant-comparison': [2],
+      'unicorn/no-redundant-nested-style-rules': [0],
      'unicorn/no-return-array-push': [2],
      'unicorn/no-selector-as-dom-name': [2],
      'unicorn/no-shorthand-property-overrides': [0], // only applies to css language
@@ -866,6 +844,8 @@ export default defineConfig([
      'unicorn/no-typeof-undefined': [2],
      'unicorn/no-uncalled-method': [2],
      'unicorn/no-undeclared-class-members': [2],
+      'unicorn/no-unknown-css-annotations': [0],
+      'unicorn/no-unknown-pseudo-selectors': [0],
      'unicorn/no-unnecessary-array-flat-depth': [2],
      'unicorn/no-unnecessary-array-flat-map': [2],
      'unicorn/no-unnecessary-array-splice-count': [2],
@@ -874,7 +854,6 @@ export default defineConfig([
      'unicorn/no-unnecessary-fetch-options': [0],
      'unicorn/no-unnecessary-global-this': [0],
      'unicorn/no-unnecessary-nested-ternary': [2],
-      'unicorn/no-unnecessary-parameters': [0],
      'unicorn/no-unnecessary-polyfills': [2],
      'unicorn/no-unnecessary-slice-end': [2],
      'unicorn/no-unnecessary-splice': [2],
@@ -886,15 +865,14 @@ export default defineConfig([
      'unicorn/no-unreadable-object-destructuring': [0],
      'unicorn/no-unsafe-buffer-conversion': [2],
      'unicorn/no-unsafe-dom-html': [0],
-      'unicorn/no-unsafe-json-serialization': [2],
      'unicorn/no-unsafe-promise-all-settled-values': [2],
      'unicorn/no-unsafe-property-key': [0],
      'unicorn/no-unsafe-sqlite-interpolation': [2],
      'unicorn/no-unsafe-string-replacement': [2],
+      'unicorn/no-unscoped-css-nesting-selector': [0],
      'unicorn/no-unused-builtin-method-return': [2],
      'unicorn/no-unused-iterator-helper': [2],
      'unicorn/no-unused-properties': [2],
-      'unicorn/no-url-in-search-params': [2],
      'unicorn/no-useless-boolean-cast': [2],
      'unicorn/no-useless-coercion': [2],
      'unicorn/no-useless-collection-argument': [2],
@@ -931,12 +909,12 @@ export default defineConfig([
      'unicorn/prefer-array-find': [0], // handled by @typescript-eslint/prefer-find
      'unicorn/prefer-array-flat': [2],
      'unicorn/prefer-array-flat-map': [2],
-      'unicorn/prefer-array-from-async': [0], // Array.fromAsync requires ES2026
+      'unicorn/prefer-array-from-async': [2],
      'unicorn/prefer-array-from-map': [2],
      'unicorn/prefer-array-from-range': [2],
      'unicorn/prefer-array-index-of': [2],
      'unicorn/prefer-array-iterable-methods': [2],
-      'unicorn/prefer-array-last-methods': [0], // Array#findLast/findLastIndex requires ES2023
+      'unicorn/prefer-array-last-methods': [2],
      'unicorn/prefer-array-slice': [2],
      'unicorn/prefer-array-some': [2],
      'unicorn/prefer-at': [0],
@@ -953,7 +931,7 @@ export default defineConfig([
      'unicorn/prefer-date-now': [2],
      'unicorn/prefer-default-parameters': [0],
      'unicorn/prefer-direct-iteration': [2],
-      'unicorn/prefer-dispose': [0], // `using` requires ES2027
+      'unicorn/prefer-dispose': [2],
      'unicorn/prefer-dom-node-append': [2],
      'unicorn/prefer-dom-node-html-methods': [0],
      'unicorn/prefer-dom-node-remove': [2],
@@ -962,14 +940,14 @@ export default defineConfig([
      'unicorn/prefer-early-return': [0],
      'unicorn/prefer-else-if': [2],
      'unicorn/prefer-error-is-error': [0],
-      'unicorn/prefer-escaped-irregular-whitespace': [2],
      'unicorn/prefer-event-target': [2],
+      'unicorn/prefer-explicit-viewport-units': [0], // only applies to css language
      'unicorn/prefer-export-from': [0],
      'unicorn/prefer-flat-math-min-max': [2],
-      'unicorn/prefer-get-or-insert-computed': [0], // Map#getOrInsertComputed requires ES2026
+      'unicorn/prefer-get-or-insert-computed': [2],
      'unicorn/prefer-global-number-constants': [2],
      'unicorn/prefer-global-this': [0],
-      'unicorn/prefer-group-by': [0], // Object.groupBy/Map.groupBy requires ES2024
+      'unicorn/prefer-group-by': [2],
      'unicorn/prefer-has-check': [2],
      'unicorn/prefer-hoisting-branch-code': [2],
      'unicorn/prefer-https': [0], // false-positives on namespace and schema URIs
@@ -980,12 +958,11 @@ export default defineConfig([
      'unicorn/prefer-iterable-in-constructor': [2],
      'unicorn/prefer-iterator-concat': [0], // too opinionated
      'unicorn/prefer-iterator-helpers': [0],
-      'unicorn/prefer-iterator-to-array': [0], // Iterator#toArray requires ES2025
+      'unicorn/prefer-iterator-to-array': [2],
      'unicorn/prefer-iterator-to-array-at-end': [2],
      'unicorn/prefer-iterator-zip': [0],
      'unicorn/prefer-json-import': [0],
      'unicorn/prefer-keyboard-event-key': [2],
-      'unicorn/prefer-literal-ascii': [2],
      'unicorn/prefer-location-assign': [2],
      'unicorn/prefer-logical-operator-over-ternary': [0],
      'unicorn/prefer-map-from-entries': [0],
@@ -993,6 +970,7 @@ export default defineConfig([
      'unicorn/prefer-math-constants': [2],
      'unicorn/prefer-math-min-max': [2],
      'unicorn/prefer-math-trunc': [2],
+      'unicorn/prefer-media-feature-range-syntax': [0],
      'unicorn/prefer-minimal-ternary': [0],
      'unicorn/prefer-modern-dom-apis': [0],
      'unicorn/prefer-modern-math-apis': [2],
@@ -1011,9 +989,8 @@ export default defineConfig([
      'unicorn/prefer-optional-catch-binding': [2],
      'unicorn/prefer-path2d': [2],
      'unicorn/prefer-private-class-fields': [0],
-      'unicorn/prefer-promise-static-methods': [2],
-      'unicorn/prefer-promise-try': [0], // Promise.try requires ES2025
-      'unicorn/prefer-promise-with-resolvers': [0], // Promise.withResolvers requires ES2024
+      'unicorn/prefer-promise-try': [2],
+      'unicorn/prefer-promise-with-resolvers': [2],
      'unicorn/prefer-prototype-methods': [2],
      'unicorn/prefer-query-selector': [2],
      'unicorn/prefer-queue-microtask': [2],
@@ -1026,7 +1003,6 @@ export default defineConfig([
      'unicorn/prefer-set-methods': [0],
      'unicorn/prefer-set-size': [2],
      'unicorn/prefer-short-arrow-method': [2],
-      'unicorn/prefer-short-escape-sequences': [2],
      'unicorn/prefer-simple-condition-first': [0],
      'unicorn/prefer-simple-sort-comparator': [2],
      'unicorn/prefer-simplified-conditions': [2],
@@ -1048,7 +1024,7 @@ export default defineConfig([
      'unicorn/prefer-structured-clone': [2],
      'unicorn/prefer-switch': [0],
      'unicorn/prefer-temporal': [0],
-      'unicorn/prefer-temporal-conversion': [0], // Temporal requires ES2027
+      'unicorn/prefer-temporal-conversion': [2],
      'unicorn/prefer-ternary': [0],
      'unicorn/prefer-then-catch': [2],
      'unicorn/prefer-toggle-attribute': [2],
@@ -1074,7 +1050,6 @@ export default defineConfig([
      'unicorn/require-passive-events': [2],
      'unicorn/require-post-message-target-origin': [0],
      'unicorn/require-proxy-trap-boolean-return': [2],
-      'unicorn/require-text-decoder-streaming': [2],
      'unicorn/single-line-block-comment-style': [0],
      'unicorn/string-content': [0],
      'unicorn/switch-case-braces': [0],
@@ -1121,13 +1096,17 @@ export default defineConfig([
    },
  },
  {
-    files: vueExts.map((ext) => `**/*.${ext}`),
+    files: ['**/*.vue'],
+    languageOptions: {
+      parserOptions: {
+        parser: '@typescript-eslint/parser',
+      },
+    },
    extends: [
      vue.configs['flat/recommended'],
      vueScopedCss.configs.recommended,
    ],
    rules: {
-      '@typescript-eslint/no-redundant-type-constituents': [0], // types imported from .vue files resolve to any via typescript-eslint's *.vue shim
      'vue/attributes-order': [0],
      'vue/html-closing-bracket-spacing': [2, {startTag: 'never', endTag: 'never', selfClosingTag: 'never'}],
      'vue/max-attributes-per-line': [0],
@@ -1240,9 +1219,6 @@ export default defineConfig([
  {
    files: ['*', 'tools/**/*', 'tests/**/*'],
    languageOptions: {globals: globals.nodeBuiltin},
-    rules: {
-      'gitea/unescaped-html-literal': [0],
-    },
  },
  {
    files: ['web_src/**/*'],
@@ -2,36 +2,40 @@ module gitea.dev

 go 1.27

-toolchain go1.27.3
+toolchain go1.27.2

 require (
 	connectrpc.com/connect v1.21.0
+	gitea.com/go-chi/binding v0.0.0-20260819122636-082915a69981
+	gitea.com/go-chi/cache v0.2.1
+	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098
+	gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
-	gitea.dev/actionslib v1.4.0
-	gitea.dev/sdk v1.3.0
-	github.com/42wim/httpsig v1.3.0
+	gitea.dev/actionslib v1.2.1
+	gitea.dev/sdk v1.2.0
+	github.com/42wim/httpsig v1.2.4
 	github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432
 	github.com/Azure/go-ntlmssp v0.1.1
 	github.com/Necoro/html2text v0.0.0-20250804200300-7bf1ce1c7347
-	github.com/ProtonMail/go-crypto v1.5.2
+	github.com/ProtonMail/go-crypto v1.5.0
 	github.com/PuerkitoBio/goquery v1.13.0
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.10.0
 	github.com/alecthomas/chroma/v2 v2.27.0
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
 	github.com/blevesearch/bleve/v2 v2.6.1
 	github.com/bohde/codel v0.2.0
-	github.com/bradfitz/gomemcache v0.0.0-20260422231931-4d751bb6e37c
 	github.com/buildkite/terminal-to-html/v3 v3.17.1
-	github.com/caddyserver/certmagic v0.25.6
+	github.com/caddyserver/certmagic v0.25.4
 	github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260812203852-971c0284dc33
 	github.com/chi-middleware/proxy v1.1.1
 	github.com/coder/websocket v1.8.15
-	github.com/dlclark/regexp2/v2 v2.8.3
+	github.com/dlclark/regexp2/v2 v2.8.0
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707
 	github.com/dustin/go-humanize v1.1.0
 	github.com/editorconfig/editorconfig-core-go/v2 v2.6.5
 	github.com/emersion/go-imap v1.2.1
+	github.com/emirpasic/gods v1.18.1
 	github.com/felixge/fgprof v0.9.5
 	github.com/fsnotify/fsnotify v1.10.1
 	github.com/getkin/kin-openapi v0.149.0
@@ -39,6 +43,8 @@ require (
 	github.com/go-chi/cors v1.2.2
 	github.com/go-co-op/gocron/v2 v2.22.0
 	github.com/go-enry/go-enry/v2 v2.9.6
+	github.com/go-git/go-billy/v5 v5.9.1
+	github.com/go-git/go-git/v5 v5.19.2
 	github.com/go-ldap/ldap/v3 v3.4.14
 	github.com/go-redsync/redsync/v4 v4.18.0
 	github.com/go-sql-driver/mysql v1.10.1
@@ -53,10 +59,10 @@ require (
 	github.com/gorilla/sessions v1.4.0
 	github.com/hashicorp/go-version v1.9.0
 	github.com/hashicorp/golang-lru/v2 v2.0.7
-	github.com/huandu/xstrings v1.6.2
+	github.com/huandu/xstrings v1.6.1
 	github.com/jhillyerd/enmime/v2 v2.5.0
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/klauspost/compress v1.20.1
+	github.com/klauspost/compress v1.20.0
 	github.com/lib/pq v1.12.3
 	github.com/markbates/goth v1.82.0
 	github.com/mattn/go-isatty v0.0.24
@@ -73,33 +79,34 @@ require (
 	github.com/pquerna/otp v1.5.0
 	github.com/prometheus/client_golang v1.24.1
 	github.com/quasoft/websspi v1.1.2
-	github.com/redis/go-redis/v9 v9.23.0
+	github.com/redis/go-redis/v9 v9.22.0
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
+	github.com/sassoftware/go-rpmutils v0.4.0
 	github.com/sergi/go-diff v1.4.0
 	github.com/stretchr/testify v1.12.1
 	github.com/syndtr/goleveldb v1.0.0
 	github.com/ulikunitz/xz v0.5.17
 	github.com/urfave/cli-docs/v3 v3.1.0
-	github.com/urfave/cli/v3 v3.14.0
+	github.com/urfave/cli/v3 v3.13.0
 	github.com/wneessen/go-mail v0.8.1
 	github.com/yohcop/openid-go v1.0.1
 	github.com/yuin/goldmark v1.8.6
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	gitlab.com/gitlab-org/api/client-go/v3 v3.16.0
+	gitlab.com/gitlab-org/api/client-go/v3 v3.13.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.6.0.20261013184558-04dd63131525
 	golang.org/x/crypto v0.57.0
 	golang.org/x/image v0.46.0
 	golang.org/x/mod v0.41.0
 	golang.org/x/net v0.60.0
 	golang.org/x/oauth2 v0.37.0
-	golang.org/x/sync v0.24.0
-	golang.org/x/sys v0.49.0
+	golang.org/x/sync v0.23.0
+	golang.org/x/sys v0.48.0
 	golang.org/x/text v0.42.0
 	google.golang.org/grpc v1.84.0
 	google.golang.org/protobuf v1.36.12
 	gopkg.in/ini.v1 v1.67.3
-	modernc.org/sqlite v1.60.1
+	modernc.org/sqlite v1.59.0
 	mvdan.cc/xurls/v2 v2.6.0
 	xorm.io/builder v0.3.13
 	xorm.io/xorm v1.4.3
@@ -107,7 +114,10 @@ require (

 require (
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
+	dario.cat/mergo v1.0.2 // indirect
 	filippo.io/edwards25519 v1.2.0 // indirect
+	github.com/DataDog/zstd v1.5.7 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/RoaringBitmap/roaring/v2 v2.18.2 // indirect
 	github.com/STARRY-S/zip v0.2.3 // indirect
 	github.com/andybalholm/brotli v1.2.1 // indirect
@@ -133,18 +143,23 @@ require (
 	github.com/blevesearch/zapx/v15 v15.4.3 // indirect
 	github.com/blevesearch/zapx/v16 v16.3.4 // indirect
 	github.com/blevesearch/zapx/v17 v17.2.3 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.10.2 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
 	github.com/bodgit/sevenzip v1.6.4 // indirect
 	github.com/bodgit/windows v1.0.1 // indirect
 	github.com/boombuler/barcode v1.1.0 // indirect
-	github.com/caddyserver/zerossl v0.1.6 // indirect
+	github.com/bradfitz/gomemcache v0.0.0-20260422231931-4d751bb6e37c // indirect
+	github.com/caddyserver/zerossl v0.1.5 // indirect
 	github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/couchbase/go-couchbase v0.1.1 // indirect
+	github.com/couchbase/gomemcached v0.3.4 // indirect
+	github.com/couchbase/goutils v0.3.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
+	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/davidmz/go-pageant v1.0.2 // indirect
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
@@ -153,6 +168,7 @@ require (
 	github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
 	github.com/go-enry/go-oniguruma v1.2.1 // indirect
+	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-openapi/jsonpointer v0.23.1 // indirect
 	github.com/go-openapi/swag/jsonname v0.26.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
@@ -160,7 +176,9 @@ require (
 	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/snappy v1.0.0 // indirect
+	github.com/google/flatbuffers v25.12.19+incompatible // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
@@ -170,8 +188,10 @@ require (
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/inbucket/html2text v1.0.0 // indirect
+	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kevinburke/ssh_config v1.6.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
@@ -179,8 +199,8 @@ require (
 	github.com/markbates/going v1.0.3 // indirect
 	github.com/mattn/go-colorable v0.1.15 // indirect
 	github.com/mattn/go-runewidth v0.0.24 // indirect
-	github.com/mholt/acmez/v3 v3.1.7 // indirect
-	github.com/miekg/dns v1.1.73 // indirect
+	github.com/mholt/acmez/v3 v3.1.6 // indirect
+	github.com/miekg/dns v1.1.72 // indirect
 	github.com/mikelolasagasti/xz v1.0.1 // indirect
 	github.com/minio/crc64nvme v1.1.1 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
@@ -199,9 +219,9 @@ require (
 	github.com/olekukonko/ll v0.1.8 // indirect
 	github.com/olekukonko/tablewriter v1.1.4 // indirect
 	github.com/onsi/ginkgo v1.16.5 // indirect
-	github.com/onsi/gomega v1.34.1 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.27 // indirect
+	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
@@ -212,25 +232,30 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.10.2 // indirect
+	github.com/skeema/knownhosts v1.3.2 // indirect
 	github.com/sorairolake/lzip-go v0.3.8 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
 	github.com/stangelandcl/ppmd v0.1.1 // indirect
 	github.com/tinylib/msgp v1.6.4 // indirect
+	github.com/unknwon/com v1.0.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
+	github.com/xanzy/ssh-agent v0.3.3 // indirect
+	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
 	github.com/zeebo/xxh3 v1.1.0 // indirect
 	go.etcd.io/bbolt v1.4.3 // indirect
-	go.uber.org/atomic v1.12.0 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.28.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
-	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
 	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
-	modernc.org/libc v1.77.1 // indirect
+	gopkg.in/warnings.v0 v0.1.2 // indirect
+	modernc.org/libc v1.75.7 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect
 )
@@ -4,20 +4,30 @@ code.pfad.fr/check v1.1.0 h1:GWvjdzhSEgHvEHe2uJujDcpmZoySKuHQNrZMfzfO0bE=
 code.pfad.fr/check v1.1.0/go.mod h1:NiUH13DtYsb7xp5wll0U4SXx7KhXQVCtRgdC96IPfoM=
 connectrpc.com/connect v1.21.0 h1:LhqSJt7jHf5NJBo9Jq/t/9FjcYAideif0mg+qe2jCUs=
 connectrpc.com/connect v1.21.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+gitea.com/go-chi/binding v0.0.0-20260819122636-082915a69981 h1:LmdlwGbzgZFZA3bK3R1q8QrNabaSz3KpnOJBLmzhN6E=
+gitea.com/go-chi/binding v0.0.0-20260819122636-082915a69981/go.mod h1:q1SSPpkC9A0gfNnoqqZ3My6kEHIpKN6QsTI+Zx73B/o=
+gitea.com/go-chi/cache v0.2.1 h1:bfAPkvXlbcZxPCpcmDVCWoHgiBSBmZN/QosnZvEC0+g=
+gitea.com/go-chi/cache v0.2.1/go.mod h1:Qic0HZ8hOHW62ETGbonpwz8WYypj9NieU9659wFUJ8Q=
+gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098 h1:p2ki+WK0cIeNQuqjR98IP2KZQKRzJJiV7aTeMAFwaWo=
+gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098/go.mod h1:LjzIOHlRemuUyO7WR12fmm18VZIlCAaOt9L3yKw40pk=
+gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6 h1:YWzVGeC/8SZThrJS48ZmQYLkzssdeABxHPhbdnxPDIU=
+gitea.com/go-chi/session v0.0.0-20260708011333-ebced8a7a2d6/go.mod h1:KDvcfMUoXfATPHs2mbMoXFTXT45/FAFAS39waz9tPk0=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96 h1:+wWBi6Qfruqu7xJgjOIrKVQGiLUZdpKYCZewJ4clqhw=
 gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96/go.mod h1:VyMQP6ue6MKHM8UsOXfNfuMKD0oSAWZdXVcpHIN2yaY=
 gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4 h1:IFT+hup2xejHqdhS7keYWioqfmxdnfblFDTGoOwcZ+o=
 gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4/go.mod h1:HBqmLbz56JWpfEGG0prskAV97ATNRoj5LDmPicD22hU=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a h1:lSA0F4e9A2NcQSqGqTOXqu2aRi/XEQxDCBwM8yJtE6s=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a/go.mod h1:EXuID2Zs0pAQhH8yz+DNjUbjppKQzKFAn28TMYPB6IU=
-gitea.dev/actionslib v1.4.0 h1:k31smj22tnUZrrM5kkntXN8lKAe7dkoTEoiP1Fk5KJc=
-gitea.dev/actionslib v1.4.0/go.mod h1:svCefEsavx4jmn8vJ4wTG7Q0KBcGfrFmGUjrhxuNUAQ=
-gitea.dev/sdk v1.3.0 h1:4U95+Ou6WHCQiRPDEyAzvl1Q7cxg5RUTWkqmOXr5w4I=
-gitea.dev/sdk v1.3.0/go.mod h1:85EBqSAqUn1KlFCk40y3sTjWjBsB/KouL3slGXMA/2o=
-github.com/42wim/httpsig v1.3.0 h1:HK2bieeZ99X9IvOoc1ST6yrhLek0f4MqlEGES2JCP3g=
-github.com/42wim/httpsig v1.3.0/go.mod h1:lgC3Yrvp4lxi1odEF1ge3kQBu/VM+SRcZQu5YwiR3dU=
+gitea.dev/actionslib v1.2.1 h1:GL//K/0zIZV6h1OOksv1awvFVg0rg7fug2xWcG7mkG0=
+gitea.dev/actionslib v1.2.1/go.mod h1:1+gqOKGSEPn2IFHgY8S3GC5Ld+Hn8jF3OxiFHQ/fpx4=
+gitea.dev/sdk v1.2.0 h1:avRtJl/nKCGispgSalo9czoZM9Rto1awnE0caNAoXGo=
+gitea.dev/sdk v1.2.0/go.mod h1:rfh5oNdIK24cbCREwIn1tqWKQW+IICXFGWJyebuOAOE=
+github.com/42wim/httpsig v1.2.4 h1:mI5bH0nm4xn7K18fo1K3okNDRq8CCJ0KbBYWyA6r8lU=
+github.com/42wim/httpsig v1.2.4/go.mod h1:yKsYfSyTBEohkPik224QPFylmzEBtda/kjyIAJjh3ps=
 github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432 h1:3Fcz1QzlS7Jv4FT2KI3cHNSZL+KPN3dXxurn9f3YL/Y=
 github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432/go.mod h1:BLWe6Nol65Xxncvaw07yYMxiyk02We1lBrbRYsMYsjE=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 h1:zvXfGJCWvywnCA814d8ZiVyt+fm9nnTE8xSb99zRyfo=
@@ -34,10 +44,15 @@ github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDP
 github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 h1:Nljr4q1GRA/5vCrMONS+g4u4LRHNgOXVSh3O43J2CnI=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0/go.mod h1:Y33QHnf0FfdVewFFISOGe20mkZbxX4H839o955/PoeI=
+github.com/DataDog/zstd v1.5.7 h1:ybO8RBeh29qrxIhCA9E8gKY6xfONU9T6G6aP9DTKfLE=
+github.com/DataDog/zstd v1.5.7/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
+github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Necoro/html2text v0.0.0-20250804200300-7bf1ce1c7347 h1:3JhDl+JysaO8nhNU1XMaw35VSGjV4IEQAefaG4Lyok4=
 github.com/Necoro/html2text v0.0.0-20250804200300-7bf1ce1c7347/go.mod h1:2ErI0aycD43Ufr6CFK5lT/NrHGmoZuVbn1nlPThw69o=
-github.com/ProtonMail/go-crypto v1.5.2 h1:cucYnvqcY7UOXVD//mSyjeaPY0SSN3v5cDkYPxumINk=
-github.com/ProtonMail/go-crypto v1.5.2/go.mod h1:/RaSu30DaKO4RY+XdV/ACcCcZkGr7AhUIduq5sjzzCo=
+github.com/ProtonMail/go-crypto v1.5.0 h1:sKmuvjOgsnrtpMvZ+84MCnTJCpjxZ1qCFn076lz1yT0=
+github.com/ProtonMail/go-crypto v1.5.0/go.mod h1:/RaSu30DaKO4RY+XdV/ACcCcZkGr7AhUIduq5sjzzCo=
 github.com/PuerkitoBio/goquery v1.13.0 h1:mqHbjD7Jmnul4DTR24LKTjo1uUmHUh072kteGV+xpFM=
 github.com/PuerkitoBio/goquery v1.13.0/go.mod h1:Hip5mdBL8K2wEGKJdr27sRaNwIdDajmCwB/ExUPwW+g=
 github.com/RoaringBitmap/roaring/v2 v2.18.2 h1:oPq3Cgx//iDuJQVp6xSInAKW34J9CEwE5GmLI2z+Eic=
@@ -60,6 +75,10 @@ github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eT
 github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/andybalholm/cascadia v1.3.4 h1:vM2lgh0Vru9Vwyfm4cQqWP2HHMW0u0+2PAW7Q38Qufg=
 github.com/andybalholm/cascadia v1.3.4/go.mod h1:BLRmbRjpEtNKieZOCCvYj4RqN+KRA41GBe/5O+G93kM=
+github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
+github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -106,8 +125,8 @@ github.com/blevesearch/zapx/v16 v16.3.4 h1:hDAqA8qusZTNbPEL7//w5P65UZ2de6yhSeUaT
 github.com/blevesearch/zapx/v16 v16.3.4/go.mod h1:zqkPPqs9GS9FzVWzCO3Wf1X044yWAV17+4zb+FTiEHg=
 github.com/blevesearch/zapx/v17 v17.2.3 h1:UYYJPAt5b2tVxldx5h0jmv23RMsg8/UZKFVya7v92po=
 github.com/blevesearch/zapx/v17 v17.2.3/go.mod h1:r7mb4QWbDQSkbAnOjCb9iCfkcrzajB4yBdJpuBIo/fE=
-github.com/bmatcuk/doublestar/v4 v4.10.2 h1:eF7W7HWKg3z9NrWV9pTLnNeoXaqq3Tq9DNKXVMfoCnw=
-github.com/bmatcuk/doublestar/v4 v4.10.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs=
+github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bmizerany/perks v0.0.0-20141205001514-d9a9656a3a4b/go.mod h1:ac9efd0D1fsDb3EJvhqgXRbFx7bs2wqZ10HQPeU8U/Q=
 github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=
 github.com/bodgit/plumbing v1.3.0/go.mod h1:JOTb4XiRu5xfnmdnDJo6GmSbSbtSyufrsyZFByMtKEs=
@@ -128,10 +147,10 @@ github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/buildkite/terminal-to-html/v3 v3.17.1 h1:gs9WhKUwxK27YHf3hijj4tG4wuDLfCANYbRPd5ltMdI=
 github.com/buildkite/terminal-to-html/v3 v3.17.1/go.mod h1:0pv+Z75FC+NvIju2o+Cw+YHIDkueeudIoeyfVm8i8GQ=
-github.com/caddyserver/certmagic v0.25.6 h1:vHMtFSLKTa6kuZz6w0SnRMpQ388tSkww8ye355BgAM4=
-github.com/caddyserver/certmagic v0.25.6/go.mod h1:xq6cRNimqW+Tv91XNc5lNHs2XYTsLhQhYiH01H4AySs=
-github.com/caddyserver/zerossl v0.1.6 h1:1yrhTx5DWi43wOJPQ+Y4mVl++EPmSqqT/4REW//lsas=
-github.com/caddyserver/zerossl v0.1.6/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
+github.com/caddyserver/certmagic v0.25.4 h1:8eIXh0HC3MsGnNo8One+BCxMGTbe5zb/oz+2KsxBFQg=
+github.com/caddyserver/certmagic v0.25.4/go.mod h1:YVs43D5+H/Dckt4bTga1KSO/xYfFBfVZainGDywYPAA=
+github.com/caddyserver/zerossl v0.1.5 h1:dkvOjBAEEtY6LIGAHei7sw2UgqSD6TrWweXpV7lvEvE=
+github.com/caddyserver/zerossl v0.1.5/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a h1:MISbI8sU/PSK/ztvmWKFcI7UGb5/HQT7B+i3a2myKgI=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a/go.mod h1:2GxOXOlEPAMFPfp014mK1SWq8G8BN8o7/dfYqJrVGn8=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -154,8 +173,17 @@ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg
 github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
 github.com/coder/websocket v1.8.15 h1:6B2JPeOGlpff2Uz6vOEH1Vzpi0iUz20A+lPVhPHtNUA=
 github.com/coder/websocket v1.8.15/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
+github.com/couchbase/go-couchbase v0.1.1 h1:ClFXELcKj/ojyoTYbsY34QUrrYCBi/1G749sXSCkdhk=
+github.com/couchbase/go-couchbase v0.1.1/go.mod h1:+/bddYDxXsf9qt0xpDUtRR47A2GjaXmGGAqQ/k3GJ8A=
+github.com/couchbase/gomemcached v0.3.4 h1:VGdrZUJbt5lLyI/MXnyVCZKHKYXg/vaud08lJIAeZps=
+github.com/couchbase/gomemcached v0.3.4/go.mod h1:pISAjweI42vljCumsJIo7CVhqIMIIP9g3Wfhl1JJw68=
+github.com/couchbase/goutils v0.1.2/go.mod h1:h89Ek/tiOxxqjz30nPPlwZdQbdB8BwgnuBxeoUe/ViE=
+github.com/couchbase/goutils v0.3.0 h1:rsv72B6BDjW9jmwlfiDUrdu3EpNvPuo5WLULHzQ0DLE=
+github.com/couchbase/goutils v0.3.0/go.mod h1:7Gm+D3vXfV4HS+hQWvKfy6e6ILCptGXNqBKvQXhplhk=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
+github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -168,8 +196,8 @@ github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55k
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
 github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dlclark/regexp2/v2 v2.8.3 h1:4iBHVtmyAsQOOthVo+0v0RxktjLPDOTKx9Nuhf+PpD0=
-github.com/dlclark/regexp2/v2 v2.8.3/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
+github.com/dlclark/regexp2/v2 v2.8.0 h1:CekDhPLGfm+GAJmPVFIG+5dqMIQPkyHJll7BbdneDfw=
+github.com/dlclark/regexp2/v2 v2.8.0/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
@@ -177,6 +205,8 @@ github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2
 github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
 github.com/editorconfig/editorconfig-core-go/v2 v2.6.5 h1:MTcuJQkIFRLfNn9FfAvdO0p3FhNyaCf+IGTwy0TxX6E=
 github.com/editorconfig/editorconfig-core-go/v2 v2.6.5/go.mod h1:SizrS3EM1vFF0v/JZlJ5LfK6tXhwln2823YZwNh/vBE=
+github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
+github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/emersion/go-imap v1.2.1 h1:+s9ZjMEjOB8NzZMVTM3cCenz2JrQIGGo5j1df19WjTA=
 github.com/emersion/go-imap v1.2.1/go.mod h1:Qlx1FSx2FTxjnjWpIlVNEuX+ylerZQNFE5NsmKFSejY=
 github.com/emersion/go-message v0.15.0/go.mod h1:wQUEfE+38+7EW8p8aZ96ptg6bAb1iwdgej19uXASlE4=
@@ -184,6 +214,8 @@ github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21/go.mod h1:iL2twTe
 github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 h1:oP4q0fw+fOSWn3DfFi4EXdT+B+gTtzx8GC9xsc26Znk=
 github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
 github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594/go.mod h1:aqO8z8wPrjkscevZJFVE1wXJrLpC5LtJG7fqLOsPb2U=
+github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
+github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/fgprof v0.9.5 h1:8+vR6yu2vvSKn08urWyEuxx75NWPEvybbkBirEpsbVY=
@@ -198,6 +230,8 @@ github.com/getkin/kin-openapi v0.149.0 h1:ZbhmVJ4yq5RZDUsyP8lcBcGMsjsaTqXEFt6isd
 github.com/getkin/kin-openapi v0.149.0/go.mod h1:1+BHDzstro+P5CKtPy1X4PfofnFgmRe6uvMy9+r9fKY=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 h1:mtDjlmloH7ytdblogrMz1/8Hqua1y8B4ID+bh3rvod0=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1/go.mod h1:fenKRzpXDjNpsIBhuhUzvjCKlDjKam0boRAenTE0Q6A=
+github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
+github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=
 github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-chi/chi/v5 v5.0.1/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
@@ -211,6 +245,14 @@ github.com/go-enry/go-enry/v2 v2.9.6 h1:np63eOtMV56zfYDHnFVgpEVOk8fr2kmylcMnAZUD
 github.com/go-enry/go-enry/v2 v2.9.6/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
 github.com/go-enry/go-oniguruma v1.2.1 h1:k8aAMuJfMrqm/56SG2lV9Cfti6tC4x8673aHCcBk+eo=
 github.com/go-enry/go-oniguruma v1.2.1/go.mod h1:bWDhYP+S6xZQgiRL7wlTScFYBe023B6ilRZbCAD5Hf4=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
+github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
+github.com/go-git/go-billy/v5 v5.9.1 h1:8U73XiOTfINdItHVa6z4Gv7ToObcZ6grkqQbLryLCdA=
+github.com/go-git/go-billy/v5 v5.9.1/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
+github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
+github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
+github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-ldap/ldap/v3 v3.4.14 h1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=
@@ -255,6 +297,8 @@ github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0kt
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
 github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
@@ -270,6 +314,9 @@ github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
 github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/gomodule/redigo v1.9.3 h1:dNPSXeXv6HCq2jdyWfjgmhBdqnR6PRO3m/G05nvpPC8=
 github.com/gomodule/redigo v1.9.3/go.mod h1:KsU3hiK/Ay8U42qpaJk+kuNa3C+spxapWpM+ywhcgtw=
+github.com/google/flatbuffers v24.3.25+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/flatbuffers v25.12.19+incompatible h1:haMV2JRRJCe1998HeW/p0X9UaMTK6SDo0ffLn2+DbLs=
+github.com/google/flatbuffers v25.12.19+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
@@ -296,6 +343,8 @@ github.com/google/pprof v0.0.0-20260906184651-6331bc6350fe h1:QAinXoAFJdGQYztXn3
 github.com/google/pprof v0.0.0-20260906184651-6331bc6350fe/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e h1:JKmoR8x90Iww1ks85zJ1lfDGgIiMDuIptTOhJq+zKyg=
+github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/context v1.1.1 h1:AWwleXJkX/nhcU9bZSnZoi3h/qGYqQAGhq6zZe/aQW8=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
@@ -327,11 +376,13 @@ github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyf
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/huandu/xstrings v1.6.2 h1:+X5X6N46b40cmDw7FFJFU6Eoq0yJS8lbYigT2EFau4c=
-github.com/huandu/xstrings v1.6.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.6.1 h1:yYdKSd6Sjv3fNZt9BDjl1FDsPNfQEaYi19L5LzK2JKs=
+github.com/huandu/xstrings v1.6.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/ianlancetaylor/demangle v0.0.0-20230524184225-eabc099b10ab/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw=
 github.com/inbucket/html2text v1.0.0 h1:N5kza++4uBBDJ2Z3KUnTRyPNoBcW+YfOgNiNmNB+sgs=
 github.com/inbucket/html2text v1.0.0/go.mod h1:5TrhXQKGU+LXurODaSm55Y9eXoPBRnYiOz4x2XfUoJU=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
+github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
 github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
 github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
@@ -351,11 +402,16 @@ github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7X
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/jtolds/gls v4.2.1+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
+github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
+github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
-github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
+github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
+github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
@@ -376,8 +432,8 @@ github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+
 github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
 github.com/letsencrypt/challtestsrv v1.4.2 h1:0ON3ldMhZyWlfVNYYpFuWRTmZNnyfiL9Hh5YzC3JVwU=
 github.com/letsencrypt/challtestsrv v1.4.2/go.mod h1:GhqMqcSoeGpYd5zX5TgwA6er/1MbWzx/o7yuuVya+Wk=
-github.com/letsencrypt/pebble/v2 v2.10.1 h1:oKHx3lgN4e5Nno2LKTMrVx+b+NkDptkO9aDireiBDGE=
-github.com/letsencrypt/pebble/v2 v2.10.1/go.mod h1:KtYhQ4YTjT5MtoCZ6RTCXlbrrz6cKyXROCuTpIUDJFY=
+github.com/letsencrypt/pebble/v2 v2.10.0 h1:Wq6gYXlsY6ubqI3hhxsTzdyotvfdjFBxuwYqCLCnj/U=
+github.com/letsencrypt/pebble/v2 v2.10.0/go.mod h1:Sk8cmUIPcIdv2nINo+9PB4L+ZBhzY+F9A1a/h/xmWiQ=
 github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
 github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/libdns/libdns v1.1.1 h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
@@ -397,16 +453,16 @@ github.com/mattn/go-sqlite3 v1.14.52 h1:wVbm2Qnf4OXkqhBTSPuCRZDRnxfbVrrmiCEroVdo
 github.com/mattn/go-sqlite3 v1.14.52/go.mod h1:6JTjA44L93a0QCyJef5YvlPoKXntQPjzWv5gtm9sB6w=
 github.com/meilisearch/meilisearch-go v0.36.3 h1:Yx1aTY5jDgtbStPVkhJTDoLnZTy5sejQSPyjfNMy6e4=
 github.com/meilisearch/meilisearch-go v0.36.3/go.mod h1:hWcR0MuWLSzHfbz9GGzIr3s9rnXLm1jqkmHkJPbUSvM=
-github.com/mholt/acmez/v3 v3.1.7 h1:XTqpuUcRdRoIBuDoI+M4mCnRnPTPN4rqH3Mb723Rg4U=
-github.com/mholt/acmez/v3 v3.1.7/go.mod h1:Lwv6P/czh/AOq+c99tAzP68/VP92s+8y+hDs4FCgxvo=
+github.com/mholt/acmez/v3 v3.1.6 h1:eGVQNObP0pBN4sxqrXeg7MYqTOWyoiYpQqITVWlrevk=
+github.com/mholt/acmez/v3 v3.1.6/go.mod h1:5nTPosTGosLxF3+LU4ygbgMRFDhbAVpqMI4+a4aHLBY=
 github.com/mholt/archives v0.1.5 h1:Fh2hl1j7VEhc6DZs2DLMgiBNChUux154a1G+2esNvzQ=
 github.com/mholt/archives v0.1.5/go.mod h1:3TPMmBLPsgszL+1As5zECTuKwKvIfj6YcwWPpeTAXF4=
 github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/microsoft/go-mssqldb v1.11.2 h1:FCgeBIK8um2+X4tbun6Q71N1KsfyCDPKY41e1yGVjSE=
 github.com/microsoft/go-mssqldb v1.11.2/go.mod h1:CYgwG5AMXFojbjTg+GNP5G/y6uz1BhTyZaPqQWzkGnQ=
-github.com/miekg/dns v1.1.73 h1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=
-github.com/miekg/dns v1.1.73/go.mod h1:RW2Obtfd5NZHvOFe3zYG0W8koWOQtAzyHaLo8vASBuQ=
+github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
+github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
 github.com/mikelolasagasti/xz v1.0.1 h1:Q2F2jX0RYJUG3+WsM+FJknv+6eVjsjXNDV0KJXZzkD0=
 github.com/mikelolasagasti/xz v1.0.1/go.mod h1:muAirjiOUxPRXwm9HdDtB3uoRPrGnL85XHtokL9Hcgc=
 github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
@@ -470,6 +526,8 @@ github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
 github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk=
 github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
+github.com/pjbgf/sha1cd v0.6.0 h1:3WJ8Wz8gvDz29quX1OcEmkAlUg9diU4GxJHqs0/XiwU=
+github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -489,8 +547,8 @@ github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+
 github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
 github.com/quasoft/websspi v1.1.2 h1:/mA4w0LxWlE3novvsoEL6BBA1WnjJATbjkh1kFrTidw=
 github.com/quasoft/websspi v1.1.2/go.mod h1:HmVdl939dQ0WIXZhyik+ARdI03M6bQzaSEKcgpFmewk=
-github.com/redis/go-redis/v9 v9.23.0 h1:/TTVdJa8BRNsybwwGGnmiYktHNlUXtbOQxlWpHBPL3s=
-github.com/redis/go-redis/v9 v9.23.0/go.mod h1:EWP2UUk+XDaI1s5nQB5mablZN6vccXlmBQTyfnF87D0=
+github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=
+github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=
 github.com/redis/rueidis v1.0.77 h1:ZR41bgJcm7oRFb3aSDPrRhC0eonDSrPzjvvZvHIlNjM=
 github.com/redis/rueidis v1.0.77/go.mod h1:L8mnCQJJaSNL6I4pIR6Rz732HTGS9vmuXm0yT9dRvjo=
 github.com/redis/rueidis/rueidiscompat v1.0.77 h1:S1xiLQsFv8XQ46e0LelC8ihGqbDzVRocXXZLzVAeh64=
@@ -507,14 +565,24 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/sassoftware/go-rpmutils v0.4.0 h1:ojND82NYBxgwrV+mX1CWsd5QJvvEZTKddtCdFLPWhpg=
+github.com/sassoftware/go-rpmutils v0.4.0/go.mod h1:3goNWi7PGAT3/dlql2lv3+MSN5jNYPjT5mVcQcIsYzI=
 github.com/serenize/snaker v0.0.0-20171204205717-a683aaf2d516/go.mod h1:Yow6lPLSAXx2ifx470yD/nUe22Dv5vBvxK/UK9UUTVs=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
+github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
 github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q=
+github.com/skeema/knownhosts v1.3.2 h1:EDL9mgf4NzwMXCTfaxSD/o/a5fxDw/xL9nkU28JjdBg=
+github.com/skeema/knownhosts v1.3.2/go.mod h1:bEg3iQAuw+jyiw+484wwFJoKSLwcfd7fqRy+N0QTiow=
+github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304 h1:Jpy1PXuP99tXNrhbq2BaPz9B+jNAvH1JPQQpG/9GCXY=
+github.com/smartystreets/assertions v0.0.0-20190116191733-b6c0e53d7304/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v0.0.0-20181108003508-044398e4856c/go.mod h1:XDJAKZRPZ1CvBcN2aX5YOUTYGHki24fSF0Iv48Ibg0s=
+github.com/smartystreets/goconvey v0.0.0-20190731233626-505e41936337 h1:WN9BUFbdyOsSH/XohnWpXOlq9NBD5sGAB2FciQMUEe8=
+github.com/smartystreets/goconvey v0.0.0-20190731233626-505e41936337/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/sorairolake/lzip-go v0.3.8 h1:j5Q2313INdTA80ureWYRhX+1K78mUXfMoPZCw/ivWik=
 github.com/sorairolake/lzip-go v0.3.8/go.mod h1:JcBqGMV0frlxwrsE9sMWXDjqn3EeVf0/54YPsw66qkU=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
@@ -538,6 +606,7 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
@@ -550,14 +619,20 @@ github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77ro
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ulikunitz/xz v0.5.17 h1:flR0y/x1hgM8EGV1AW3Xll6T413G0glV8UfBwR617V4=
 github.com/ulikunitz/xz v0.5.17/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw=
+github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
+github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
-github.com/urfave/cli/v3 v3.14.0 h1:a8414NQlHJs0c/iBsulKLzlES0n/lEAskbL2LKpU4/s=
-github.com/urfave/cli/v3 v3.14.0/go.mod h1:vXn6HxPNccJSzQr2QvwVncOKrgYGIHU0HY5h8B2nQj4=
+github.com/urfave/cli/v3 v3.13.0 h1:Dr6jqMfIyyFsRVn7Nz5mqLsMY+ZMpfh3a0aMs+umPVY=
+github.com/urfave/cli/v3 v3.13.0/go.mod h1:vXn6HxPNccJSzQr2QvwVncOKrgYGIHU0HY5h8B2nQj4=
 github.com/wneessen/go-mail v0.8.1 h1:tVcncj02/QySVFw3zr/kXOzZcuFQqBNT6K+Rbgm/pcM=
 github.com/wneessen/go-mail v0.8.1/go.mod h1:dWZ61zadzCIyvB4y1/YzC5O7MrbbzBfPkARmbosdf8w=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
+github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
+github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
+github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
 github.com/yohcop/openid-go v1.0.1 h1:DPRd3iPO5F6O5zX2e62XpVAbPT6wV51cuucH0z9g3js=
@@ -577,12 +652,12 @@ github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-gitlab.com/gitlab-org/api/client-go/v3 v3.16.0 h1:LyxbaO5Pep+gREHptHoYDmYPs4dw9EzGTx6B29+kB7I=
-gitlab.com/gitlab-org/api/client-go/v3 v3.16.0/go.mod h1:975X4id//8WM4sQyh9kqODM3fHPHdIRb4Uag2+3GAo8=
+gitlab.com/gitlab-org/api/client-go/v3 v3.13.0 h1:CTUXvcL6OrGjYNafbws5C1lJwlXrxGJHWQGMF+hCdz0=
+gitlab.com/gitlab-org/api/client-go/v3 v3.13.0/go.mod h1:k7uYxRoIeuSqyWZSJfAPZlf0L32OH0lUBImAl4gWUFc=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
-go.uber.org/atomic v1.12.0 h1:BvcXdFKuviU4fTL/f+SxdQ5qJX/Jix8pAkgdUcb3XOE=
-go.uber.org/atomic v1.12.0/go.mod h1:I6c4cg+6HCxRjfjSsYtApoFILnpc0CGUdGkXVqbYVNk=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
@@ -606,6 +681,11 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
 golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
@@ -614,6 +694,10 @@ golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ=
 golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
 golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -622,8 +706,14 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
 golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
@@ -633,30 +723,50 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
-golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191010194322-b09406accb47/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
-golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
 golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
 golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -664,6 +774,11 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
 golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
@@ -672,8 +787,11 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU=
-golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -699,6 +817,8 @@ gopkg.in/ini.v1 v1.67.3 h1:iM9Lhz5MRSGhHVGGwCuzG9KO8PoirCXj/m/qTmOJJQw=
 gopkg.in/ini.v1 v1.67.3/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
+gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -708,10 +828,10 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/cc/v4 v4.29.7 h1:q+NXGJ0bK3b4TXFYQQVr9pYETGnmwFWkrUzJnMya/Tg=
-modernc.org/cc/v4 v4.29.7/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.36.1 h1:ZNIUZAryN0UgnJwtyxrdEzcFc3yD4Cu4AzjfPXsLsIE=
-modernc.org/ccgo/v4 v4.36.1/go.mod h1:rrtGc2QkS239nYb/mQNuBMyjq3/y3ZXWbBjPoV3wqzA=
+modernc.org/cc/v4 v4.29.2 h1:h6+9ciCnPKutf4I03CvheAvDLX7+IHlqR6Iy6J+cgd8=
+modernc.org/cc/v4 v4.29.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.35.0 h1:F+TUsmw09QxLzmi3aeYYGxjAXarmZaKgj3mKQHNaA8w=
+modernc.org/ccgo/v4 v4.35.0/go.mod h1:qrVGs9S3Sr2Ztcg9ve+kTAYMp5a3YvWjo+SoN06kJ5I=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
@@ -720,8 +840,8 @@ modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc=
 modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.77.1 h1:Ct8j47QtiZ1Enj2DtFXQtUqrPCAjdCmPjtCuvrYQ0Hs=
-modernc.org/libc v1.77.1/go.mod h1:87/pZ4L6nD1zqW4nItuS12YO7hN1igAah34xjnQo/W0=
+modernc.org/libc v1.75.7 h1:o3DTP9/0p9pKmY2WCKQaySW6wIiZhNM7wc2lUoyhfew=
+modernc.org/libc v1.75.7/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
@@ -730,8 +850,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.60.1 h1:/blz53O951KWFOso4QQvEs/Fq6cDBKLtMVrYNSeJVKw=
-modernc.org/sqlite v1.60.1/go.mod h1:1dIoEagfDE72QytD5scH1lxARtaUgKgHC/NuApA27r0=
+modernc.org/sqlite v1.59.0 h1:X1es1GpqBlS/5T+vbM4HLUdaa8OtQx468DF2vrx+38A=
+modernc.org/sqlite v1.59.0/go.mod h1:+paeT2A3iPRHkQDwG7oA6Tk0zQd5woMEI8q7orfry8k=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -518,20 +518,3 @@ func ModifyColumn(ctx context.Context, x EngineMigration, tableName string, col
 func Iterate[Bean any](ctx context.Context, cond builder.Cond, f func(ctx context.Context, bean *Bean) error) error {
 	return db.Iterate(ctx, cond, f)
 }
-
-func EngineTransaction(x EngineMigration, f func(Session) error) error {
-	sess := x.NewSession()
-	defer sess.Close()
-	if err := sess.Begin(); err != nil {
-		return err
-	}
-	err := f(sess)
-	if err != nil {
-		return err
-	}
-	return sess.Commit()
-}
-
-func IterateTableByColumn[Bean any](ctx context.Context, x EngineMigration, sess Session, colName string, cond builder.Cond, f func(ctx context.Context, bean *Bean) error) error {
-	return db.IterateTableByColumn(ctx, x, sess, colName, cond, f)
-}
@@ -431,15 +431,9 @@ func prepareMigrationTasks() []*migration {
 		newMigration(354, "Add Actions job queue indexes", v28.AddActionQueueIndexes),
 		newMigration(355, "Add AutoMerge merged_commit_id column", v28.AddAutoMergeMergedCommitID),
 		// Gitea 28.0.0 ends at migration ID number 355 (database version 356)
-
+		// HERE: 2 migrations from 29 are added since they don't change database structure
 		newMigration(356, "Add index on action_run commit_sha", v29.AddActionRunCommitSHAIndex),
 		newMigration(357, "Normalize legacy team authorize values", v29.NormalizeLegacyTeamAuthorize),
-		newMigration(358, "Track previous remember-me token hashes", v29.AddPreviousAuthTokenHash),
-		newMigration(359, "Add stage and number columns to action_task_step", v29.AddStageAndNumberToActionTaskStep),
-		newMigration(360, "Move branch protection settings to JSON", v29.MoveBranchProtectionConfigToJSON),
-		newMigration(361, "Drop legacy commit_id column from comment", v29.DropCommentCommitID),
-		newMigration(362, "Add reusable_workflow_ref column to action_run_job", v29.AddReusableWorkflowRefToActionRunJob),
-		newMigration(363, "Add release_id to reaction table", v29.AddReleaseIDToReaction),
 	}
 	return preparedMigrations
 }
@@ -105,7 +105,7 @@ func LoadTableSchemasMap(t *testing.T, x base.EngineMigration) map[string]*schem

 func mainTest(m *testing.M) int {
 	testlogger.Init()
-	workPath, err := setting.PrepareIntegrationTestConfig()
+	err := setting.PrepareIntegrationTestConfig()
 	if err != nil {
 		return testlogger.MainErrorf("Unable to prepare integration test config: %v", err)
 	}
@@ -117,11 +117,7 @@ func mainTest(m *testing.M) int {
 	setting.Database.SlowQueryThreshold = 0
 	setting.LoadDBSetting()
 	setting.InitLoggersForTest()
-	exitCode := m.Run()
-	if exitCode == 0 {
-		_ = os.RemoveAll(workPath)
-	}
-	return exitCode
+	return m.Run()
 }

 func MainTest(m *testing.M) {
@@ -11,7 +11,7 @@ import (

 // NormalizeLegacyTeamAuthorize sets leftover read/write authorize values to none.
 // https://github.com/go-gitea/gitea/pull/34128 made non-admin teams use team_unit (authorize=none).
-// Any positive authorize now means blanket access on every unit; migrating legacy read/write
+// authorize>=write now means blanket access on every unit; migrating legacy read/write
 // to none preserves their existing team_unit-scoped access.
 func NormalizeLegacyTeamAuthorize(_ context.Context, x base.EngineMigration) error {
 	// AccessModeNone=0, AccessModeRead=1, AccessModeWrite=2, AccessModeAdmin=3
@@ -1,25 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v29
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-	"gitea.dev/modules/timeutil"
-
-	"xorm.io/xorm"
-)
-
-func AddPreviousAuthTokenHash(_ context.Context, x base.EngineMigration) error {
-	type AuthToken struct {
-		PreviousTokenHash string
-		RotatedUnix       timeutil.TimeStamp
-	}
-	_, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreDropIndices: true,
-		IgnoreConstrains:  true,
-	}, new(AuthToken))
-	return err
-}
@@ -1,25 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v29
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-
-	"xorm.io/xorm"
-)
-
-func AddStageAndNumberToActionTaskStep(_ context.Context, x base.EngineMigration) error {
-	type ActionTaskStep struct {
-		Stage  int64 `xorm:"NOT NULL DEFAULT 0"`
-		Number int64 `xorm:"NOT NULL DEFAULT 0"`
-	}
-
-	_, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreConstrains:  true,
-		IgnoreDropIndices: true,
-	}, new(ActionTaskStep))
-	return err
-}
@@ -1,112 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v29
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-	"gitea.dev/modules/json"
-	"gitea.dev/modules/timeutil"
-	"gitea.dev/modules/util"
-
-	"xorm.io/xorm"
-)
-
-type protectedBranchConfigV358 struct {
-	CanPush                       bool     `xorm:"NOT NULL DEFAULT false" json:"can_push,omitzero"`
-	EnableWhitelist               bool     `json:"enable_whitelist,omitzero"`
-	WhitelistUserIDs              []int64  `xorm:"JSON TEXT" json:"whitelist_user_ids,omitzero"`
-	WhitelistTeamIDs              []int64  `xorm:"JSON TEXT" json:"whitelist_team_ids,omitzero"`
-	EnableMergeWhitelist          bool     `xorm:"NOT NULL DEFAULT false" json:"enable_merge_whitelist,omitzero"`
-	WhitelistDeployKeys           bool     `xorm:"NOT NULL DEFAULT false" json:"-"`
-	MergeWhitelistUserIDs         []int64  `xorm:"JSON TEXT" json:"merge_whitelist_user_ids,omitzero"`
-	MergeWhitelistTeamIDs         []int64  `xorm:"JSON TEXT" json:"merge_whitelist_team_ids,omitzero"`
-	EnableBypassAllowlist         bool     `xorm:"NOT NULL DEFAULT false" json:"enable_bypass_allowlist,omitzero"`
-	BypassAllowlistUserIDs        []int64  `xorm:"JSON TEXT" json:"bypass_allowlist_user_ids,omitzero"`
-	BypassAllowlistTeamIDs        []int64  `xorm:"JSON TEXT" json:"bypass_allowlist_team_ids,omitzero"`
-	CanForcePush                  bool     `xorm:"NOT NULL DEFAULT false" json:"can_force_push,omitzero"`
-	EnableForcePushAllowlist      bool     `xorm:"NOT NULL DEFAULT false" json:"enable_force_push_allowlist,omitzero"`
-	ForcePushAllowlistUserIDs     []int64  `xorm:"JSON TEXT" json:"force_push_allowlist_user_ids,omitzero"`
-	ForcePushAllowlistTeamIDs     []int64  `xorm:"JSON TEXT" json:"force_push_allowlist_team_ids,omitzero"`
-	ForcePushAllowlistDeployKeys  bool     `xorm:"NOT NULL DEFAULT false" json:"-"`
-	EnableStatusCheck             bool     `xorm:"NOT NULL DEFAULT false" json:"enable_status_check,omitzero"`
-	StatusCheckContexts           []string `xorm:"JSON TEXT" json:"status_check_contexts,omitzero"`
-	EnableApprovalsWhitelist      bool     `xorm:"NOT NULL DEFAULT false" json:"enable_approvals_whitelist,omitzero"`
-	ApprovalsWhitelistUserIDs     []int64  `xorm:"JSON TEXT" json:"approvals_whitelist_user_ids,omitzero"`
-	ApprovalsWhitelistTeamIDs     []int64  `xorm:"JSON TEXT" json:"approvals_whitelist_team_ids,omitzero"`
-	RequiredApprovals             int64    `xorm:"NOT NULL DEFAULT 0" json:"required_approvals,omitzero"`
-	BlockOnRejectedReviews        bool     `xorm:"NOT NULL DEFAULT false" json:"block_on_rejected_reviews,omitzero"`
-	BlockOnOfficialReviewRequests bool     `xorm:"NOT NULL DEFAULT false" json:"block_on_official_review_requests,omitzero"`
-	BlockOnCodeownerReviews       bool     `xorm:"NOT NULL DEFAULT false" json:"block_on_codeowner_reviews,omitzero"`
-	BlockOnOutdatedBranch         bool     `xorm:"NOT NULL DEFAULT false" json:"block_on_outdated_branch,omitzero"`
-	DismissStaleApprovals         bool     `xorm:"NOT NULL DEFAULT false" json:"dismiss_stale_approvals,omitzero"`
-	IgnoreStaleApprovals          bool     `xorm:"NOT NULL DEFAULT false" json:"ignore_stale_approvals,omitzero"`
-	RequireSignedCommits          bool     `xorm:"NOT NULL DEFAULT false" json:"require_signed_commits,omitzero"`
-	ProtectedFilePatterns         string   `xorm:"TEXT" json:"protected_file_patterns,omitzero"`
-	UnprotectedFilePatterns       string   `xorm:"TEXT" json:"unprotected_file_patterns,omitzero"`
-	BlockAdminMergeOverride       bool     `xorm:"NOT NULL DEFAULT false" json:"block_admin_merge_override,omitzero"`
-}
-
-type protectedBranchV358 struct {
-	ID          int64  `xorm:"pk autoincr"`
-	RepoID      int64  `xorm:"UNIQUE(s)"`
-	BranchName  string `xorm:"UNIQUE(s)"`
-	Priority    int64  `xorm:"NOT NULL DEFAULT 0"`
-	Config      string `xorm:"LONGTEXT"`
-	CreatedUnix timeutil.TimeStamp
-	UpdatedUnix timeutil.TimeStamp
-}
-
-func (protectedBranchV358) TableName() string { return "protected_branch" }
-
-type intermediateProtectedBranch struct {
-	ID        int64                     `xorm:"pk autoincr"`
-	NewConfig string                    `xorm:"LONGTEXT config"`
-	OldConfig protectedBranchConfigV358 `xorm:"extends"`
-}
-
-func (intermediateProtectedBranch) TableName() string { return "protected_branch" }
-
-func MoveBranchProtectionConfigToJSON(ctx context.Context, x base.EngineMigration) error {
-	if _, err := x.SyncWithOptions(xorm.SyncOptions{IgnoreDropIndices: true}, new(protectedBranchV358)); err != nil {
-		return err
-	}
-	exists, err := x.Dialect().IsColumnExist(x.DB(), ctx, "protected_branch", "can_push")
-	if err != nil || !exists {
-		return err
-	}
-
-	err = base.EngineTransaction(x, func(sess base.Session) error {
-		err := base.IterateTableByColumn(ctx, x, sess, "id", nil, func(ctx context.Context, pb *intermediateProtectedBranch) error {
-			if pb.NewConfig != "" {
-				return nil // skip the already migrated fields
-			}
-			const deployKeyUserID int64 = -3 // frozen user.DeployKeyUserID
-			if pb.OldConfig.WhitelistDeployKeys {
-				pb.OldConfig.WhitelistUserIDs = append(pb.OldConfig.WhitelistUserIDs, deployKeyUserID)
-			}
-			if pb.OldConfig.ForcePushAllowlistDeployKeys {
-				pb.OldConfig.ForcePushAllowlistUserIDs = append(pb.OldConfig.ForcePushAllowlistUserIDs, deployKeyUserID)
-			}
-			configJson, err := json.Marshal(pb.OldConfig)
-			util.MustNoError(err)
-			_, err = sess.ID(pb.ID).Cols("config").Update(&protectedBranchV358{Config: string(configJson)})
-			return err
-		})
-		if err != nil {
-			return err
-		}
-		legacyTableInfo, err := x.TableInfo(new(protectedBranchConfigV358))
-		if err != nil {
-			return err
-		}
-		return base.DropTableColumns(sess, "protected_branch", legacyTableInfo.ColumnsSeq()...)
-	})
-	if err != nil {
-		return err
-	}
-	// SQLite rebuilds the table when dropping columns, so restore its unique index.
-	return x.Sync(new(protectedBranchV358))
-}
@@ -1,116 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v29
-
-import (
-	"fmt"
-	"testing"
-
-	"gitea.dev/modelmigration/migrationtest"
-	"gitea.dev/modules/json"
-	"gitea.dev/modules/timeutil"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type protectedBranchBeforeV358 struct {
-	ID          int64  `xorm:"pk autoincr"`
-	RepoID      int64  `xorm:"UNIQUE(s)"`
-	BranchName  string `xorm:"UNIQUE(s)"`
-	Priority    int64
-	CreatedUnix timeutil.TimeStamp
-	UpdatedUnix timeutil.TimeStamp
-	Config      protectedBranchConfigV358 `xorm:"extends"`
-}
-
-func (protectedBranchBeforeV358) TableName() string { return "protected_branch" }
-
-func TestMoveBranchProtectionConfigToJSON(t *testing.T) {
-	x, deferrable := migrationtest.PrepareTestEnv(t, 0, new(protectedBranchBeforeV358))
-	defer deferrable()
-	if x == nil || t.Failed() {
-		return
-	}
-
-	const configJSON = `{
-"can_push":true,
-"enable_whitelist":true,
-"whitelist_user_ids":[2,4,-3],
-"whitelist_team_ids":[1,2],
-"enable_merge_whitelist":true,
-"merge_whitelist_user_ids":[3,5],
-"merge_whitelist_team_ids":[3,4],
-"enable_bypass_allowlist":true,
-"bypass_allowlist_user_ids":[6,7],
-"bypass_allowlist_team_ids":[5,6],
-"can_force_push":true,
-"enable_force_push_allowlist":true,
-"force_push_allowlist_user_ids":[8,9,-3],
-"force_push_allowlist_team_ids":[7,8],
-"enable_status_check":true,
-"status_check_contexts":["ci/*","lint"],
-"enable_approvals_whitelist":true,
-"approvals_whitelist_user_ids":[10,11],
-"approvals_whitelist_team_ids":[9,10],
-"required_approvals":2,
-"block_on_rejected_reviews":true,
-"block_on_official_review_requests":true,
-"block_on_codeowner_reviews":true,
-"block_on_outdated_branch":true,
-"dismiss_stale_approvals":true,
-"ignore_stale_approvals":true,
-"require_signed_commits":true,
-"protected_file_patterns":"*.go;*.md",
-"unprotected_file_patterns":"docs/**",
-"block_admin_merge_override":true
-}`
-	var config protectedBranchConfigV358
-	require.NoError(t, json.Unmarshal([]byte(configJSON), &config))
-	config.WhitelistUserIDs = []int64{2, 4}
-	config.ForcePushAllowlistUserIDs = []int64{8, 9}
-	config.WhitelistDeployKeys = true
-	config.ForcePushAllowlistDeployKeys = true
-	for i := range 101 {
-		branch := protectedBranchBeforeV358{RepoID: 1, BranchName: fmt.Sprintf("release-%d/*", i), Priority: int64(i), CreatedUnix: 123, UpdatedUnix: 456}
-		if i%2 == 0 {
-			branch.Config = config
-		} else if i == 1 {
-			branch.Config.StatusCheckContexts = []string{}
-		}
-		_, err := x.Insert(&branch)
-		require.NoError(t, err)
-	}
-	require.NoError(t, MoveBranchProtectionConfigToJSON(t.Context(), x))
-	// A retry must preserve the migrated configuration and its indexes.
-	require.NoError(t, MoveBranchProtectionConfigToJSON(t.Context(), x))
-
-	var branches []protectedBranchV358
-	require.NoError(t, x.Asc("id").Find(&branches))
-	require.Len(t, branches, 101)
-	for i, branch := range branches {
-		assert.EqualValues(t, i+1, branch.ID)
-		assert.EqualValues(t, 1, branch.RepoID)
-		assert.Equal(t, fmt.Sprintf("release-%d/*", i), branch.BranchName)
-		assert.EqualValues(t, i, branch.Priority)
-		assert.EqualValues(t, 123, branch.CreatedUnix)
-		assert.EqualValues(t, 456, branch.UpdatedUnix)
-		if i%2 == 0 {
-			assert.JSONEq(t, configJSON, branch.Config)
-		} else if i == 1 {
-			assert.JSONEq(t, `{"status_check_contexts":[]}`, branch.Config)
-		} else {
-			assert.JSONEq(t, "{}", branch.Config)
-		}
-	}
-	tables, err := x.DBMetas()
-	require.NoError(t, err)
-	for _, table := range tables {
-		if table.Name == "protected_branch" {
-			assert.ElementsMatch(t, []string{"id", "repo_id", "branch_name", "priority", "config", "created_unix", "updated_unix"}, table.ColumnsSeq())
-		}
-	}
-	_, err = x.Insert(&protectedBranchV358{RepoID: 1, BranchName: branches[0].BranchName})
-	require.Error(t, err, "the repository/rule unique constraint must survive the migration")
-}
@@ -1,21 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v29
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-)
-
-func DropCommentCommitID(ctx context.Context, x base.EngineMigration) error {
-	exists, err := x.Dialect().IsColumnExist(x.DB(), ctx, "comment", "commit_id")
-	if err != nil || !exists {
-		return err
-	}
-
-	return base.EngineTransaction(x, func(sess base.Session) error {
-		return base.DropTableColumns(sess, "comment", "commit_id")
-	})
-}
@@ -1,23 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v29
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-
-	"xorm.io/xorm"
-)
-
-func AddReusableWorkflowRefToActionRunJob(_ context.Context, x base.EngineMigration) error {
-	type ActionRunJob struct {
-		ReusableWorkflowRef string `xorm:"VARCHAR(512) NOT NULL DEFAULT ''"`
-	}
-	_, err := x.SyncWithOptions(xorm.SyncOptions{
-		IgnoreConstrains:  true,
-		IgnoreDropIndices: true,
-	}, new(ActionRunJob))
-	return err
-}
@@ -1,33 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package v29
-
-import (
-	"context"
-
-	"gitea.dev/modelmigration/base"
-	"gitea.dev/modules/timeutil"
-)
-
-func AddReleaseIDToReaction(_ctx context.Context, x base.EngineMigration) error {
-	// rows older than v123 can hold NULL, which the unique index doesn't treat as a duplicate of ''
-	if _, err := x.Exec("UPDATE reaction SET original_author = '' WHERE original_author IS NULL"); err != nil {
-		return err
-	}
-
-	type Reaction struct {
-		ID int64 `xorm:"pk autoincr"`
-
-		UserID           int64  `xorm:"UNIQUE(s) NOT NULL"` // first unique column implies INDEX
-		IssueID          int64  `xorm:"UNIQUE(s) INDEX(issue_comment) NOT NULL"`
-		CommentID        int64  `xorm:"UNIQUE(s) INDEX(issue_comment) INDEX NOT NULL"`
-		ReleaseID        int64  `xorm:"UNIQUE(s) INDEX NOT NULL DEFAULT(0)"`
-		OriginalAuthorID int64  `xorm:"UNIQUE(s) NOT NULL DEFAULT(0)"`
-		OriginalAuthor   string `xorm:"UNIQUE(s) NOT NULL DEFAULT('')"`
-		Type             string `xorm:"UNIQUE(s) NOT NULL"`
-
-		CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
-	}
-	return x.Sync(new(Reaction))
-}
@@ -1,28 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package actions
-
-// BelongingScope identifies the owner (user/org) or repository an Actions secret or variable belongs to.
-// Both zero values mean "global scope".
-// Always use the functions to create a BelongingScope, rather than creating one directly, to avoid accidentally creating an invalid scope.
-type BelongingScope struct {
-	internalOwnerID int64
-	internalRepoID  int64
-}
-
-func BelongingScopeOwner(ownerID int64) BelongingScope {
-	return BelongingScope{internalOwnerID: ownerID}
-}
-
-func BelongingScopeRepo(repoID int64) BelongingScope {
-	return BelongingScope{internalRepoID: repoID}
-}
-
-func BelongingScopeGlobal() BelongingScope {
-	return BelongingScope{}
-}
-
-func (scope BelongingScope) GetOwnerRepoIDs() (ownerID, repoID int64) {
-	return scope.internalOwnerID, scope.internalRepoID
-}
@@ -64,7 +64,7 @@ func (cfg *OwnerActionsConfig) GetMaxTokenPermissions() repo_model.ActionsTokenP
 		return *cfg.MaxTokenPermissions
 	}
 	// Default max is write for everything
-	return repo_model.MakeWriteAllActionsTokenPermissions()
+	return repo_model.MakeActionsTokenPermissions(perm.AccessModeWrite)
 }

 // ClampPermissions ensures that the given permissions don't exceed the maximum
@@ -15,7 +15,6 @@ import (
 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
 	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/container"
 	"gitea.dev/modules/git"
 	"gitea.dev/modules/json"
 	"gitea.dev/modules/log"
@@ -297,9 +296,7 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 }

 func GetRunsByRepoAndID(ctx context.Context, repoID int64, runIDs []int64) (runs []*ActionRun, err error) {
-	if len(runIDs) > 0 {
-		err = db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).OrderBy("id").Find(&runs)
-	}
+	err = db.GetEngine(ctx).In("id", runIDs).Where("repo_id=?", repoID).OrderBy("id").Find(&runs)
 	return runs, err
 }

@@ -409,27 +406,26 @@ func CancelPreviousJobsByRunConcurrency(ctx context.Context, attempt *ActionRunA
 		return nil, nil
 	}

+	var jobsToCancel []*ActionRunJob
+
 	attempts, jobs, err := getConcurrencyEntriesToReplace(ctx, attempt.RepoID, attempt.ConcurrencyGroup, attempt.ConcurrencyCancel)
 	if err != nil {
 		return nil, fmt.Errorf("find concurrent runs and jobs: %w", err)
 	}
 	jobs = slices.DeleteFunc(jobs, func(job *ActionRunJob) bool { return job.RunID == attempt.RunID })
+	jobsToCancel = append(jobsToCancel, jobs...)

 	// cancel runs in the same concurrency group
-	attempts = slices.DeleteFunc(attempts, func(concurrentAttempt *ActionRunAttempt) bool { return concurrentAttempt.RunID == attempt.RunID })
-	attemptJobs, err := getRunJobsByAttempts(ctx, attempts)
-	if err != nil {
-		return nil, fmt.Errorf("find concurrent attempt jobs: %w", err)
-	}
-	return CancelJobs(ctx, append(jobs, attemptJobs...), false)
-}
-
-func getRunJobsByAttempts(ctx context.Context, attempts []*ActionRunAttempt) (jobs []*ActionRunJob, _ error) {
-	for chunk := range slices.Chunk(attempts, db.DefaultMaxInSize) {
-		attemptIDs := container.FilterSlice(chunk, func(attempt *ActionRunAttempt) (int64, bool) { return attempt.ID, true })
-		if err := db.GetEngine(ctx).In("run_attempt_id", attemptIDs).Find(&jobs); err != nil {
-			return nil, err
+	for _, concurrentAttempt := range attempts {
+		if concurrentAttempt.RunID == attempt.RunID {
+			continue
 		}
+		jobs, err := GetRunJobsByRunAndAttemptID(ctx, concurrentAttempt.RunID, concurrentAttempt.ID)
+		if err != nil {
+			return nil, fmt.Errorf("find run %d attempt %d jobs: %w", concurrentAttempt.RunID, concurrentAttempt.ID, err)
+		}
+		jobsToCancel = append(jobsToCancel, jobs...)
 	}
-	return jobs, nil
+
+	return CancelJobs(ctx, jobsToCancel, false)
 }
@@ -179,7 +179,7 @@ func UpdateRunAttempt(ctx context.Context, attempt *ActionRunAttempt, cols ...st
 		return err
 	}
 	if run.LatestAttemptID != attempt.ID {
-		log.Warn("run %d cannot be updated by old attempt %d, latest attempt is %d", run.ID, attempt.ID, run.LatestAttemptID)
+		log.Warn("run %d cannot be updated by an old attempt %d", run.LatestAttemptID, attempt.ID)
 		return nil
 	}

@@ -110,8 +110,6 @@ type ActionRunJob struct {
 	// ReusableWorkflowContent is the content of the reusable workflow specified by "uses:".
 	// Only set when IsReusableCaller is true.
 	ReusableWorkflowContent []byte `xorm:"LONGBLOB"`
-	// ReusableWorkflowRef is the fully qualified ref, or the commit, that "uses:" resolved to when the content was loaded.
-	ReusableWorkflowRef string `xorm:"VARCHAR(512) NOT NULL DEFAULT ''"`
 	// CallSecrets encodes the reusable workflow caller's "secrets:" section:
 	//   - ""           : no "secrets:" section (children only see auto-generated tokens).
 	//   - "inherit"    : the caller wrote "secrets: inherit".
@@ -273,24 +271,6 @@ func GetLatestAttemptJobsByRun(ctx context.Context, run *ActionRun) (ActionJobLi
 	return jobs, nil
 }

-func GetLatestAttemptJobsByRuns(ctx context.Context, runs []*ActionRun) (map[int64]ActionJobList, error) {
-	result := make(map[int64]ActionJobList, len(runs))
-	if len(runs) == 0 {
-		return result, nil
-	}
-	attemptIDs := container.FilterSlice(runs, func(run *ActionRun) (int64, bool) { return run.LatestAttemptID, run.LatestAttemptID != 0 })
-	legacyRunIDs := container.FilterSlice(runs, func(run *ActionRun) (int64, bool) { return run.ID, run.LatestAttemptID == 0 })
-	cond := builder.In("run_attempt_id", attemptIDs).Or(builder.Eq{"run_attempt_id": 0}.And(builder.In("run_id", legacyRunIDs)))
-	var jobs []*ActionRunJob
-	if err := db.GetEngine(ctx).Where(cond).OrderBy("id").Find(&jobs); err != nil {
-		return nil, err
-	}
-	for _, job := range jobs {
-		result[job.RunID] = append(result[job.RunID], job)
-	}
-	return result, nil
-}
-
 // GetAllRunJobsByRepoAndRunID returns all jobs for a run across all attempts.
 func GetAllRunJobsByRepoAndRunID(ctx context.Context, repoID, runID int64) (ActionJobList, error) {
 	var jobs []*ActionRunJob
@@ -705,18 +685,43 @@ func hasFailFastMatrixFailure(jobs []*ActionRunJob) bool {
 // It's useful when a new run is triggered, and all previous runs needn't be continued anymore.
 func CancelPreviousJobs(ctx context.Context, repoID int64, ref, workflowID string, event webhook_module.HookEventType) ([]*ActionRunJob, error) {
 	// Find all runs in the specified repository, reference, and workflow with non-final status
-	runIDs := builder.Select("id").From("action_run").Where(FindRunOptions{
+	runs, total, err := db.FindAndCount[ActionRun](ctx, FindRunOptions{
 		RepoID:       repoID,
 		Ref:          ref,
 		WorkflowID:   workflowID,
 		TriggerEvent: event,
 		Status:       []Status{StatusRunning, StatusWaiting, StatusBlocked, StatusCancelling},
-	}.ToConds())
-	var jobs []*ActionRunJob
-	if err := db.GetEngine(ctx).Where(builder.In("run_id", runIDs)).Find(&jobs); err != nil {
+	})
+	if err != nil {
 		return nil, err
 	}
-	return CancelJobs(ctx, jobs, false)
+
+	// If there are no runs found, there's no need to proceed with cancellation, so return nil.
+	if total == 0 {
+		return nil, nil
+	}
+
+	cancelledJobs := make([]*ActionRunJob, 0, total)
+
+	// Iterate over each found run and cancel its associated jobs.
+	for _, run := range runs {
+		// Find all jobs associated with the current run.
+		jobs, err := db.Find[ActionRunJob](ctx, FindRunJobOptions{
+			RunID: run.ID,
+		})
+		if err != nil {
+			return cancelledJobs, err
+		}
+
+		cjs, err := CancelJobs(ctx, jobs, false)
+		if err != nil {
+			return cancelledJobs, err
+		}
+		cancelledJobs = append(cancelledJobs, cjs...)
+	}
+
+	// Return nil to indicate successful cancellation of all running and waiting jobs.
+	return cancelledJobs, nil
 }

 // GetAncestorCallerIDs returns the IDs of the reusable workflow callers the job is nested in.
@@ -733,7 +738,7 @@ func GetAncestorCallerIDs(ctx context.Context, job *ActionRunJob) (container.Set
 	return ids, nil
 }

-func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob) ([]*ActionRunJob, error) {
+func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob) (jobsToCancel []*ActionRunJob, _ error) {
 	if job.RawConcurrency == "" {
 		return nil, nil
 	}
@@ -753,14 +758,21 @@ func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob)
 		return nil, err
 	}
 	jobs = slices.DeleteFunc(jobs, func(j *ActionRunJob) bool { return j.ID == job.ID || callerIDs.Contains(j.ID) })
+	jobsToCancel = append(jobsToCancel, jobs...)

 	// cancel runs in the same concurrency group
-	attempts = slices.DeleteFunc(attempts, func(attempt *ActionRunAttempt) bool { return attempt.ID == job.RunAttemptID })
-	attemptJobs, err := getRunJobsByAttempts(ctx, attempts)
-	if err != nil {
-		return nil, fmt.Errorf("find concurrent attempt jobs: %w", err)
+	for _, attempt := range attempts {
+		if attempt.ID == job.RunAttemptID {
+			continue
+		}
+		jobs, err := GetRunJobsByRunAndAttemptID(ctx, attempt.RunID, attempt.ID)
+		if err != nil {
+			return nil, fmt.Errorf("find run %d attempt %d jobs: %w", attempt.RunID, attempt.ID, err)
+		}
+		jobsToCancel = append(jobsToCancel, jobs...)
 	}
-	return CancelJobs(ctx, append(jobs, attemptJobs...), false)
+
+	return CancelJobs(ctx, jobsToCancel, false)
 }

 // CancelJobs cancels every cancellable job it is given, force skipping the graceful cancelling
@@ -467,48 +467,3 @@ func TestCancelJobs_CallerWaitsForCancellingChild(t *testing.T) {
 	}
 	assert.Equal(t, StatusCancelled, unittest.AssertExistsAndLoadBean(t, &ActionRun{ID: run.ID}).Status)
 }
-
-func TestBatchLoadAndCancelRunJobs(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	ctx := t.Context()
-
-	legacyRun := &ActionRun{RepoID: 4, OwnerID: 1, Index: 9600, TriggerUserID: 1, Ref: "refs/heads/batch", Status: StatusRunning}
-	run := &ActionRun{RepoID: 4, OwnerID: 1, Index: 9601, TriggerUserID: 1, Ref: "refs/heads/batch", Status: StatusRunning}
-	require.NoError(t, db.Insert(ctx, legacyRun, run))
-	require.NoError(t, db.Insert(ctx, &ActionRunJob{RunID: legacyRun.ID, RepoID: legacyRun.RepoID, OwnerID: legacyRun.OwnerID}))
-	oldAttempt := &ActionRunAttempt{RepoID: run.RepoID, RunID: run.ID, Attempt: 1, TriggerUserID: 1}
-	latestAttempt := &ActionRunAttempt{RepoID: run.RepoID, RunID: run.ID, Attempt: 2, TriggerUserID: 2}
-	require.NoError(t, db.Insert(ctx, oldAttempt, latestAttempt))
-	for _, attemptID := range []int64{oldAttempt.ID, latestAttempt.ID, latestAttempt.ID} {
-		require.NoError(t, db.Insert(ctx, &ActionRunJob{RunID: run.ID, RunAttemptID: attemptID, RepoID: run.RepoID, OwnerID: run.OwnerID}))
-	}
-	run.LatestAttemptID = latestAttempt.ID
-	require.NoError(t, UpdateRun(ctx, run, "latest_attempt_id"))
-
-	runs := RunList{legacyRun, run}
-	jobsByRun, err := GetLatestAttemptJobsByRuns(ctx, runs)
-	require.NoError(t, err)
-	for _, listedRun := range runs {
-		expected, err := GetLatestAttemptJobsByRun(ctx, listedRun)
-		require.NoError(t, err)
-		require.NotEmpty(t, expected)
-		assert.Equal(t, expected, jobsByRun[listedRun.ID])
-	}
-
-	attempts, err := runs.GetLatestAttempts(ctx)
-	require.NoError(t, err)
-	require.Len(t, attempts, 1)
-	assert.EqualValues(t, 2, attempts[latestAttempt.ID].TriggerUser.ID)
-
-	chunkedAttempts := []*ActionRunAttempt{oldAttempt}
-	for i := range db.DefaultMaxInSize {
-		chunkedAttempts = append(chunkedAttempts, &ActionRunAttempt{ID: -int64(i + 1)})
-	}
-	attemptJobs, err := getRunJobsByAttempts(ctx, append(chunkedAttempts, latestAttempt))
-	require.NoError(t, err)
-	assert.Len(t, attemptJobs, 3)
-
-	cancelled, err := CancelPreviousJobs(ctx, run.RepoID, run.Ref, "", "")
-	require.NoError(t, err)
-	assert.Len(t, cancelled, 4)
-}
@@ -5,8 +5,6 @@ package actions

 import (
 	"context"
-	"maps"
-	"slices"

 	"gitea.dev/models/db"
 	repo_model "gitea.dev/models/repo"
@@ -44,21 +42,6 @@ func (runs RunList) LoadTriggerUser(ctx context.Context) error {
 	return nil
 }

-// GetLatestAttempts returns the latest attempts of the runs keyed by attempt ID
-func (runs RunList) GetLatestAttempts(ctx context.Context) (map[int64]*ActionRunAttempt, error) {
-	attemptIDs := container.FilterSlice(runs, func(run *ActionRun) (int64, bool) {
-		return run.LatestAttemptID, run.LatestAttemptID != 0
-	})
-	attempts := make(map[int64]*ActionRunAttempt, len(attemptIDs))
-	if len(attemptIDs) == 0 {
-		return attempts, nil
-	}
-	if err := db.GetEngine(ctx).In("id", attemptIDs).Find(&attempts); err != nil {
-		return nil, err
-	}
-	return attempts, ActionRunAttemptList(slices.Collect(maps.Values(attempts))).LoadTriggerUser(ctx)
-}
-
 func (runs RunList) LoadRepos(ctx context.Context) error {
 	repoIDs := container.FilterSlice(runs, func(run *ActionRun) (int64, bool) {
 		return run.RepoID, run.Repo == nil
@@ -200,21 +200,13 @@ func (r *ActionRunner) GenerateAndFillToken() {
 // CanMatchLabels checks whether the runner's labels can match a job's "runs-on"
 // See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idruns-on
 func (r *ActionRunner) CanMatchLabels(jobRunsOn []string) bool {
-	return len(jobRunsOn) > 0 && !slices.ContainsFunc(jobRunsOn, func(label string) bool { return !util.SliceContainsString(r.AgentLabels, label, true) })
+	return !slices.ContainsFunc(jobRunsOn, func(label string) bool { return !util.SliceContainsString(r.AgentLabels, label, true) })
 }

 func init() {
 	db.RegisterModel(&ActionRunner{})
 }

-func GetRunnersMapByIDs(ctx context.Context, ids []int64) (map[int64]*ActionRunner, error) {
-	runners := make(map[int64]*ActionRunner, len(ids))
-	if len(ids) == 0 {
-		return runners, nil
-	}
-	return runners, db.GetEngine(ctx).In("id", ids).Find(&runners)
-}
-
 // FindRunnerOptions
 // ownerID == 0 and repoID == 0 means any runner including global runners
 // repoID != 0 and WithAvailable == false means any runner for the given repo
@@ -86,5 +86,4 @@ func TestCanMatchLabelsCaseInsensitive(t *testing.T) {
 	runner := &ActionRunner{AgentLabels: []string{"self-hosted", "Linux", "X64"}}
 	assert.True(t, runner.CanMatchLabels([]string{"SELF-HOSTED", "linux"}))
 	assert.False(t, runner.CanMatchLabels([]string{"linux", "arm64"}))
-	assert.False(t, runner.CanMatchLabels(nil))
 }
@@ -5,7 +5,6 @@ package actions

 import (
 	"context"
-	"errors"
 	"fmt"

 	"gitea.dev/models/db"
@@ -120,12 +119,3 @@ func GetLatestRunnerToken(ctx context.Context, ownerID, repoID int64) (*ActionRu
 	}
 	return &runnerToken, nil
 }
-
-// GetOrCreateActiveRunnerToken returns the latest runner token, or a new one if there is none or it is no longer active
-func GetOrCreateActiveRunnerToken(ctx context.Context, ownerID, repoID int64) (*ActionRunnerToken, error) {
-	token, err := GetLatestRunnerToken(ctx, ownerID, repoID)
-	if errors.Is(err, util.ErrNotExist) || (token != nil && !token.IsActive) {
-		return NewRunnerToken(ctx, ownerID, repoID)
-	}
-	return token, err
-}
@@ -105,7 +105,7 @@ func CleanRepoScheduleTasks(ctx context.Context, repo *repo_model.Repository) ([
 	// If actions disabled when there is schedule task, this will remove the outdated schedule tasks
 	// There is no other place we can do this because the app.ini will be changed manually
 	if err := DeleteScheduleTaskByRepo(ctx, repo.ID); err != nil {
-		return nil, fmt.Errorf("CleanRepoScheduleTasks: %w", err)
+		return nil, fmt.Errorf("DeleteCronTaskByRepo: %v", err)
 	}
 	// cancel running cron jobs of this repository and delete old schedules
 	jobs, err := CancelPreviousJobs(
@@ -116,7 +116,7 @@ func CleanRepoScheduleTasks(ctx context.Context, repo *repo_model.Repository) ([
 		webhook_module.HookEventSchedule,
 	)
 	if err != nil {
-		return jobs, fmt.Errorf("CleanRepoScheduleTasks: %w", err)
+		return jobs, fmt.Errorf("CancelPreviousJobs: %v", err)
 	}
 	return jobs, nil
 }
@@ -59,6 +59,10 @@ func (s Status) HasRun() bool {
 	return s.In(StatusSuccess, StatusFailure)
 }

+func (s Status) IsUnknown() bool {
+	return s == StatusUnknown
+}
+
 func (s Status) IsSuccess() bool {
 	return s == StatusSuccess
 }
@@ -7,7 +7,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"slices"
 	"strings"
 	"time"

@@ -483,11 +482,6 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 	for _, v := range state.Steps {
 		stepStates[v.Id] = v
 	}
-	reportedSteps := state.ReportedSteps
-	if err := validateReportedSteps(reportedSteps); err != nil {
-		log.Warn("Ignore the steps reported for task %d: %v", state.Id, err)
-		reportedSteps = nil
-	}

 	// Only one request can update the task because the final state needs to be calculated with all job states.
 	// Otherwise, concurrent requests with transaction will make the SQL read stale job state and result in wrong final state.
@@ -544,14 +538,22 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 			return err
 		}

-		if len(reportedSteps) > 0 {
-			return updateReportedSteps(ctx, task, reportedSteps, now)
-		}
-		if slices.ContainsFunc(task.Steps, (*ActionTaskStep).IsReported) {
-			return nil // the indexes of the steps of the workflow file no longer match the stored steps
-		}
 		for _, step := range task.Steps {
-			step.applyState(stepStates[step.Index], now)
+			var result runnerv1.Result
+			if v, ok := stepStates[step.Index]; ok {
+				result = v.Result
+				step.LogIndex = v.LogIndex
+				step.LogLength = v.LogLength
+				if step.Started == 0 && v.StartedAt != nil {
+					step.Started = now
+				}
+			}
+			if result != runnerv1.Result_RESULT_UNSPECIFIED {
+				step.Status = StatusFromResult(result)
+				step.Stopped = util.IfZero(step.Stopped, now)
+			} else if step.Started != 0 {
+				step.Status = StatusRunning
+			}
 			if _, err := db.GetEngine(ctx).ID(step.ID).Update(step); err != nil {
 				return err
 			}
@@ -635,7 +637,13 @@ func StopTask(ctx context.Context, taskID int64, status Status) error {
 	}

 	for _, step := range task.Steps {
-		step.stop(status, now)
+		if !step.Status.IsDone() {
+			step.Status = status
+			if step.Started == 0 {
+				step.Started = now
+			}
+			step.Stopped = now
+		}
 		if _, err := e.ID(step.ID).Update(step); err != nil {
 			return err
 		}
@@ -9,7 +9,6 @@ import (
 	"gitea.dev/models/db"
 	"gitea.dev/modules/container"
 	"gitea.dev/modules/timeutil"
-	"gitea.dev/modules/util"

 	"xorm.io/builder"
 )
@@ -42,29 +41,6 @@ func (tasks TaskList) LoadJobs(ctx context.Context) error {
 	return jobsList.LoadAttributes(ctx, true)
 }

-func (tasks TaskList) LoadSteps(ctx context.Context) error {
-	taskIDs := container.FilterSlice(tasks, func(task *ActionTask) (int64, bool) {
-		return task.ID, task.Steps == nil
-	})
-	if len(taskIDs) == 0 {
-		return nil
-	}
-	var steps []*ActionTaskStep
-	if err := db.GetEngine(ctx).In("task_id", taskIDs).OrderBy("task_id, `index`").Find(&steps); err != nil {
-		return err
-	}
-	stepsByTask := make(map[int64][]*ActionTaskStep, len(taskIDs))
-	for _, step := range steps {
-		stepsByTask[step.TaskID] = append(stepsByTask[step.TaskID], step)
-	}
-	for _, task := range tasks {
-		if task.Steps == nil {
-			task.Steps = util.SliceNilAsEmpty(stepsByTask[task.ID])
-		}
-	}
-	return nil
-}
-
 func (tasks TaskList) LoadAttributes(ctx context.Context) error {
 	return tasks.LoadJobs(ctx)
 }
@@ -5,14 +5,10 @@ package actions

 import (
 	"context"
-	"fmt"
 	"time"

-	runnerv1 "gitea.dev/actionslib/runner/v1"
 	"gitea.dev/models/db"
-	"gitea.dev/modules/container"
 	"gitea.dev/modules/timeutil"
-	"gitea.dev/modules/util"
 )

 // ActionTaskStep represents a step of ActionTask
@@ -25,8 +21,6 @@ type ActionTaskStep struct {
 	Status    Status `xorm:"index"`
 	LogIndex  int64
 	LogLength int64
-	Stage     int64 `xorm:"NOT NULL DEFAULT 0"` // a runnerv1.StepStage, unspecified for the steps parsed from the workflow file instead of reported by the runner
-	Number    int64 `xorm:"NOT NULL DEFAULT 0"` // the index in the workflow file of the step a PRE, MAIN or POST stage belongs to
 	Started   timeutil.TimeStamp
 	Stopped   timeutil.TimeStamp
 	Created   timeutil.TimeStamp `xorm:"created"`
@@ -37,27 +31,6 @@ func (step *ActionTaskStep) Duration() time.Duration {
 	return calculateDuration(step.Started, step.Stopped, step.Status, step.Updated)
 }

-// StepStage returns the stored stage, which can be one added to the enum after this Gitea version
-func (step *ActionTaskStep) StepStage() runnerv1.StepStage {
-	return runnerv1.StepStage(step.Stage)
-}
-
-// IsReported reports whether the runner reported the step instead of Gitea parsing it from the workflow file.
-func (step *ActionTaskStep) IsReported() bool {
-	return step.StepStage() != runnerv1.StepStage_STEP_STAGE_UNSPECIFIED
-}
-
-// WorkflowStepIndex returns the index of the step in the workflow file, or -1 for a step that is not written there.
-func (step *ActionTaskStep) WorkflowStepIndex() int64 {
-	switch step.StepStage() {
-	case runnerv1.StepStage_STEP_STAGE_UNSPECIFIED:
-		return step.Index
-	case runnerv1.StepStage_STEP_STAGE_MAIN:
-		return step.Number
-	}
-	return -1
-}
-
 func init() {
 	db.RegisterModel(new(ActionTaskStep))
 }
@@ -66,120 +39,3 @@ func GetTaskStepsByTaskID(ctx context.Context, taskID int64) ([]*ActionTaskStep,
 	var steps []*ActionTaskStep
 	return steps, db.GetEngine(ctx).Where("task_id=?", taskID).OrderBy("`index` ASC").Find(&steps)
 }
-
-// applyState applies the state the runner reported for the step, nil meaning it reported none.
-func (step *ActionTaskStep) applyState(state *runnerv1.StepState, now timeutil.TimeStamp) {
-	var result runnerv1.Result
-	if state != nil {
-		result = state.Result
-		step.LogIndex = state.LogIndex
-		step.LogLength = state.LogLength
-		if step.Started == 0 && state.StartedAt != nil {
-			step.Started = now
-		}
-	}
-	if result != runnerv1.Result_RESULT_UNSPECIFIED {
-		step.Status = StatusFromResult(result)
-		step.Stopped = util.IfZero(step.Stopped, now)
-	} else if step.Started != 0 {
-		step.Status = StatusRunning
-	}
-}
-
-// stop finishes a step that had not finished when its task stopped
-func (step *ActionTaskStep) stop(status Status, now timeutil.TimeStamp) {
-	if step.Status.IsDone() {
-		return
-	}
-	step.Status = status
-	step.Started = util.IfZero(step.Started, now)
-	step.Stopped = now
-}
-
-// maxReportedSteps bounds the steps a runner can make Gitea store for one task.
-const maxReportedSteps = 1000
-
-type reportedStepKey struct {
-	stage  runnerv1.StepStage
-	number int64
-}
-
-func validateReportedSteps(steps []*runnerv1.StepState) error {
-	if len(steps) > maxReportedSteps {
-		return fmt.Errorf("%d steps exceed the limit of %d", len(steps), maxReportedSteps)
-	}
-	seen := make(container.Set[reportedStepKey], len(steps))
-	for i, v := range steps {
-		if v.Stage <= runnerv1.StepStage_STEP_STAGE_UNSPECIFIED { // a stage added later is shown by its name
-			return fmt.Errorf("step %d has invalid stage %d", i, v.Stage)
-		}
-		if v.Id != int64(i) || v.Number < 0 || v.LogIndex < 0 || v.LogLength < 0 {
-			return fmt.Errorf("step %d has invalid id %d, number %d or log range %d+%d", i, v.Id, v.Number, v.LogIndex, v.LogLength)
-		}
-		if !seen.Add(reportedStepKey{v.Stage, v.Number}) {
-			return fmt.Errorf("step %d duplicates stage %s of number %d", i, v.Stage, v.Number)
-		}
-	}
-	return nil
-}
-
-// updateReportedSteps replaces the steps of the task with the ones the runner reported.
-// A step keeps its times and status when the runner reports it again at another position.
-func updateReportedSteps(ctx context.Context, task *ActionTask, reported []*runnerv1.StepState, now timeutil.TimeStamp) error {
-	e := db.GetEngine(ctx)
-	sameLayout := len(task.Steps) == len(reported)
-	for i := 0; sameLayout && i < len(reported); i++ {
-		step := task.Steps[i]
-		sameLayout = step.IsReported() && reportedStepKey{step.StepStage(), step.Number} == reportedStepKey{reported[i].Stage, reported[i].Number}
-	}
-
-	if sameLayout {
-		for i, step := range task.Steps {
-			step.Name = util.EllipsisDisplayString(reported[i].Name, 255)
-			step.applyState(reported[i], now)
-			if task.Status.IsDone() {
-				step.stop(task.Status, now)
-			}
-			if _, err := e.ID(step.ID).Update(step); err != nil {
-				return err
-			}
-		}
-		return nil
-	}
-
-	known := make(map[reportedStepKey]*ActionTaskStep, len(task.Steps))
-	for _, step := range task.Steps {
-		if step.IsReported() {
-			known[reportedStepKey{step.StepStage(), step.Number}] = step
-		}
-	}
-	steps := make([]*ActionTaskStep, len(reported))
-	for i, v := range reported {
-		key := reportedStepKey{v.Stage, v.Number}
-		step := &ActionTaskStep{
-			Name:   util.EllipsisDisplayString(v.Name, 255),
-			TaskID: task.ID,
-			Index:  int64(i),
-			RepoID: task.RepoID,
-			Stage:  int64(key.stage),
-			Number: key.number,
-			Status: StatusWaiting,
-		}
-		if old, ok := known[key]; ok {
-			step.Status, step.Started, step.Stopped = old.Status, old.Started, old.Stopped
-		}
-		step.applyState(v, now)
-		if task.Status.IsDone() {
-			step.stop(task.Status, now)
-		}
-		steps[i] = step
-	}
-	if _, err := e.Delete(&ActionTaskStep{TaskID: task.ID}); err != nil {
-		return err
-	}
-	if _, err := e.Insert(steps); err != nil {
-		return err
-	}
-	task.Steps = steps
-	return nil
-}
@@ -407,114 +407,6 @@ func TestUpdateTaskByStateIsAtomic(t *testing.T) {
 	assert.GreaterOrEqual(t, unittest.AssertExistsAndLoadBean(t, &ActionTaskStep{TaskID: task.ID}).Started, before)
 }

-func TestUpdateTaskByStateReportedSteps(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	task, _ := newRunningTaskForCancelling(t, "reported-steps-job", true)
-	require.NoError(t, db.Insert(t.Context(), &ActionTaskStep{Name: "Run echo", TaskID: task.ID, RepoID: task.RepoID, Status: StatusWaiting}))
-
-	report := func(t *testing.T, steps []*runnerv1.StepState, reported ...*runnerv1.StepState) []*ActionTaskStep {
-		t.Helper()
-		_, err := UpdateTaskByState(t.Context(), task.RunnerID, &runnerv1.TaskState{Id: task.ID, Steps: steps, ReportedSteps: reported})
-		require.NoError(t, err)
-		got, err := GetTaskStepsByTaskID(t.Context(), task.ID)
-		require.NoError(t, err)
-		return got
-	}
-	started := timestamppb.Now()
-	setup := &runnerv1.StepState{Id: 0, Name: "Set up job", Stage: runnerv1.StepStage_STEP_STAGE_SETUP, StartedAt: started}
-	main := &runnerv1.StepState{Id: 1, Name: "Run echo", Stage: runnerv1.StepStage_STEP_STAGE_MAIN}
-	legacy := []*runnerv1.StepState{{Id: 0, StartedAt: started, LogLength: 3}}
-
-	t.Run("invalid reported steps fall back to the workflow steps", func(t *testing.T) {
-		got := report(t, legacy, setup, &runnerv1.StepState{Id: 1, Stage: runnerv1.StepStage_STEP_STAGE_SETUP})
-		require.Len(t, got, 1)
-		assert.False(t, got[0].IsReported())
-		assert.Equal(t, StatusRunning, got[0].Status)
-		assert.EqualValues(t, 3, got[0].LogLength)
-	})
-
-	t.Run("reported steps replace the workflow steps", func(t *testing.T) {
-		got := report(t, legacy, setup, main)
-		require.Len(t, got, 2)
-		assert.Equal(t, runnerv1.StepStage_STEP_STAGE_SETUP, got[0].StepStage())
-		assert.EqualValues(t, -1, got[0].WorkflowStepIndex())
-		assert.Equal(t, StatusRunning, got[0].Status)
-		assert.NotZero(t, got[0].Started)
-		assert.Equal(t, "Run echo", got[1].Name)
-		assert.Equal(t, StatusWaiting, got[1].Status)
-		assert.EqualValues(t, 0, got[1].WorkflowStepIndex())
-	})
-
-	t.Run("an inserted step keeps the state of the others", func(t *testing.T) {
-		before, err := GetTaskStepsByTaskID(t.Context(), task.ID)
-		require.NoError(t, err)
-		doneSetup := &runnerv1.StepState{Id: 0, Name: "Set up job", Stage: runnerv1.StepStage_STEP_STAGE_SETUP, StartedAt: started, Result: runnerv1.Result_RESULT_SUCCESS, LogLength: 4}
-		pre := &runnerv1.StepState{Id: 1, Name: "Pre Run checkout", Stage: runnerv1.StepStage_STEP_STAGE_PRE, StartedAt: started, LogIndex: 4, LogLength: 2}
-		movedMain := &runnerv1.StepState{Id: 2, Name: "Run echo", Stage: runnerv1.StepStage_STEP_STAGE_MAIN}
-		got := report(t, legacy, doneSetup, pre, movedMain)
-		require.Len(t, got, 3)
-		assert.Equal(t, StatusSuccess, got[0].Status)
-		assert.Equal(t, before[0].Started, got[0].Started)
-		assert.Equal(t, runnerv1.StepStage_STEP_STAGE_PRE, got[1].StepStage())
-		assert.Equal(t, StatusRunning, got[1].Status)
-		assert.EqualValues(t, 4, got[1].LogIndex)
-		assert.EqualValues(t, 2, got[2].Index)
-	})
-
-	t.Run("workflow steps no longer apply once reported", func(t *testing.T) {
-		before, err := GetTaskStepsByTaskID(t.Context(), task.ID)
-		require.NoError(t, err)
-		got := report(t, []*runnerv1.StepState{{Id: 0, Result: runnerv1.Result_RESULT_FAILURE}})
-		assert.Equal(t, before, got)
-	})
-
-	t.Run("unfinished steps stop with the task", func(t *testing.T) {
-		doneSetup := &runnerv1.StepState{Id: 0, Name: "Set up job", Stage: runnerv1.StepStage_STEP_STAGE_SETUP, StartedAt: started, Result: runnerv1.Result_RESULT_SUCCESS}
-		runningMain := &runnerv1.StepState{Id: 1, Name: "Run echo", Stage: runnerv1.StepStage_STEP_STAGE_MAIN, StartedAt: started}
-		cleanup := &runnerv1.StepState{Id: 2, Name: "Complete job", Stage: runnerv1.StepStage_STEP_STAGE_CLEANUP}
-		_, err := UpdateTaskByState(t.Context(), task.RunnerID, &runnerv1.TaskState{
-			Id: task.ID, Result: runnerv1.Result_RESULT_FAILURE,
-			ReportedSteps: []*runnerv1.StepState{doneSetup, runningMain, cleanup},
-		})
-		require.NoError(t, err)
-		got, err := GetTaskStepsByTaskID(t.Context(), task.ID)
-		require.NoError(t, err)
-		require.Len(t, got, 3)
-		assert.Equal(t, StatusSuccess, got[0].Status)
-		for _, step := range got[1:] {
-			assert.Equal(t, StatusFailure, step.Status, step.Name)
-			assert.NotZero(t, step.Started, step.Name)
-			assert.NotZero(t, step.Stopped, step.Name)
-		}
-	})
-}
-
-func TestValidateReportedSteps(t *testing.T) {
-	step := func(id int64, stage runnerv1.StepStage, number int64) *runnerv1.StepState {
-		return &runnerv1.StepState{Id: id, Stage: stage, Number: number}
-	}
-	assert.NoError(t, validateReportedSteps([]*runnerv1.StepState{
-		step(0, runnerv1.StepStage_STEP_STAGE_SETUP, 0),
-		step(1, runnerv1.StepStage_STEP_STAGE_PRE, 0),
-		step(2, runnerv1.StepStage_STEP_STAGE_MAIN, 0),
-		step(3, runnerv1.StepStage_STEP_STAGE_MAIN, 1),
-		step(4, runnerv1.StepStage_STEP_STAGE_CLEANUP, 0),
-		step(5, runnerv1.StepStage(100), 0), // a stage added later, with several steps told apart by number
-		step(6, runnerv1.StepStage(100), 1),
-	}))
-	for name, steps := range map[string][]*runnerv1.StepState{
-		"unspecified stage": {step(0, runnerv1.StepStage_STEP_STAGE_UNSPECIFIED, 0)},
-		"negative stage":    {step(0, runnerv1.StepStage(-1), 0)},
-		"id not position":   {step(1, runnerv1.StepStage_STEP_STAGE_SETUP, 0)},
-		"negative number":   {step(0, runnerv1.StepStage_STEP_STAGE_MAIN, -1)},
-		"duplicate main":    {step(0, runnerv1.StepStage_STEP_STAGE_MAIN, 0), step(1, runnerv1.StepStage_STEP_STAGE_MAIN, 0)},
-		"duplicate setup":   {step(0, runnerv1.StepStage_STEP_STAGE_SETUP, 0), step(1, runnerv1.StepStage_STEP_STAGE_SETUP, 0)},
-		"too many":          make([]*runnerv1.StepState, maxReportedSteps+1),
-	} {
-		assert.Error(t, validateReportedSteps(steps), name)
-	}
-}
-
 // newRunningTaskForCancelling inserts a running run/job/task assigned to a fresh runner,
 // which is the state every cancellation test starts from.
 func newRunningTaskForCancelling(t *testing.T, name string, hasCancellingSupport bool) (*ActionTask, *ActionRunJob) {
@@ -89,3 +89,22 @@ func calculateDuration(started, stopped timeutil.TimeStamp, status Status, fallb
 	}
 	return max(timeSince(s), 0).Truncate(time.Second)
 }
+
+// best effort function to convert an action schedule to action run, to be used in GenerateGiteaContext
+func (s *ActionSchedule) ToActionRun() *ActionRun {
+	return &ActionRun{
+		Title:         s.Title,
+		RepoID:        s.RepoID,
+		Repo:          s.Repo,
+		OwnerID:       s.OwnerID,
+		WorkflowID:    s.WorkflowID,
+		TriggerUserID: s.TriggerUserID,
+		TriggerUser:   s.TriggerUser,
+		Ref:           s.Ref,
+		CommitSHA:     s.CommitSHA,
+		Event:         s.Event,
+		EventPayload:  s.EventPayload,
+		Created:       s.Created,
+		Updated:       s.Updated,
+	}
+}
@@ -48,7 +48,13 @@ func init() {
 	db.RegisterModel(new(ActionVariable))
 }

-func InsertVariable(ctx context.Context, scope BelongingScope, name, data, description string) (*ActionVariable, error) {
+func InsertVariable(ctx context.Context, ownerID, repoID int64, name, data, description string) (*ActionVariable, error) {
+	if ownerID != 0 && repoID != 0 {
+		// It's trying to create a variable that belongs to a repository, but OwnerID has been set accidentally.
+		// Remove OwnerID to avoid confusion; it's not worth returning an error here.
+		ownerID = 0
+	}
+
 	if utf8.RuneCountInString(data) > VariableDataMaxLength {
 		return nil, util.NewInvalidArgumentErrorf("data too long")
 	}
@@ -56,8 +62,8 @@ func InsertVariable(ctx context.Context, scope BelongingScope, name, data, descr
 	description = util.TruncateRunes(description, VariableDescriptionMaxLength)

 	variable := &ActionVariable{
-		OwnerID:     scope.internalOwnerID,
-		RepoID:      scope.internalRepoID,
+		OwnerID:     ownerID,
+		RepoID:      repoID,
 		Name:        strings.ToUpper(name),
 		Data:        data,
 		Description: description,
@@ -67,10 +73,10 @@ func InsertVariable(ctx context.Context, scope BelongingScope, name, data, descr

 type FindVariablesOpts struct {
 	db.ListOptions
-	IDs  []int64
-	Name string
-
-	BelongingScope BelongingScope
+	IDs     []int64
+	RepoID  int64
+	OwnerID int64 // it will be ignored if RepoID is set
+	Name    string
 }

 func (opts FindVariablesOpts) ToOrders() string {
@@ -90,13 +96,12 @@ func (opts FindVariablesOpts) ToConds() builder.Cond {

 	// Since we now support instance-level variables,
 	// there is no need to check for null values for `owner_id` and `repo_id`
-	ownerID, repoID := opts.BelongingScope.GetOwnerRepoIDs()
-	cond = cond.And(builder.Eq{"repo_id": repoID})
-	if repoID != 0 { // if RepoID is set
+	cond = cond.And(builder.Eq{"repo_id": opts.RepoID})
+	if opts.RepoID != 0 { // if RepoID is set
 		// ignore OwnerID and treat it as 0
 		cond = cond.And(builder.Eq{"owner_id": 0})
 	} else {
-		cond = cond.And(builder.Eq{"owner_id": ownerID})
+		cond = cond.And(builder.Eq{"owner_id": opts.OwnerID})
 	}

 	if opts.Name != "" {
@@ -147,14 +152,14 @@ func GetVariablesOfRun(ctx context.Context, run *ActionRun) (map[string]string,
 	}

 	// Org / User level
-	ownerVariables, err := db.Find[ActionVariable](ctx, FindVariablesOpts{BelongingScope: BelongingScopeOwner(run.Repo.OwnerID)})
+	ownerVariables, err := db.Find[ActionVariable](ctx, FindVariablesOpts{OwnerID: run.Repo.OwnerID})
 	if err != nil {
 		log.Error("find variables of org: %d, error: %v", run.Repo.OwnerID, err)
 		return nil, err
 	}

 	// Repo level
-	repoVariables, err := db.Find[ActionVariable](ctx, FindVariablesOpts{BelongingScope: BelongingScopeRepo(run.RepoID)})
+	repoVariables, err := db.Find[ActionVariable](ctx, FindVariablesOpts{RepoID: run.RepoID})
 	if err != nil {
 		log.Error("find variables of repo: %d, error: %v", run.RepoID, err)
 		return nil, err
@@ -436,6 +436,12 @@ type GetFeedsOptions struct {
 	DontCount       bool                   // do counting in GetFeeds
 }

+func (opts *GetFeedsOptions) ApplyPublicOnly(publicOnly bool) {
+	if publicOnly {
+		opts.IncludePrivate = false
+	}
+}
+
 // ActivityReadable return whether doer can read activities of user
 func ActivityReadable(user, doer *user_model.User) bool {
 	return !user.KeepActivityPrivate ||
@@ -472,13 +478,13 @@ func ActivityQueryCondition(ctx context.Context, opts GetFeedsOptions) (builder.
 	}

 	// check activity visibility for actor ( similar to activityReadable() )
-	if !user_model.DoerCanViewPrivate(opts.Actor) {
+	if opts.Actor == nil {
 		cond = cond.And(builder.In("act_user_id",
 			builder.Select("`user`.id").Where(
 				builder.Eq{"keep_activity_private": false, "visibility": structs.VisibleTypePublic},
 			).From("`user`"),
 		))
-	} else if !user_model.DoerIsSiteAdminFullAccess(opts.Actor) {
+	} else if !opts.Actor.IsAdmin {
 		uidCond := builder.Select("`user`.id").From("`user`").Where(
 			builder.Eq{"keep_activity_private": false}.
 				And(builder.In("visibility", structs.VisibleTypePublic, structs.VisibleTypeLimited))).
@@ -503,7 +509,7 @@ func ActivityQueryCondition(ctx context.Context, opts GetFeedsOptions) (builder.
 	}

 	// check readable repositories by doer/actor
-	if !user_model.DoerIsSiteAdminFullAccess(opts.Actor) {
+	if opts.Actor == nil || !opts.Actor.IsAdmin {
 		cond = cond.And(builder.In("repo_id", repo_model.AccessibleRepoIDsQuery(opts.Actor)))
 	}

@@ -533,7 +539,7 @@ func ActivityQueryCondition(ctx context.Context, opts GetFeedsOptions) (builder.
 		}
 	}

-	if !opts.IncludePrivate || user_model.IsPublicOnlyDoer(opts.Actor) {
+	if !opts.IncludePrivate {
 		cond = cond.And(builder.Eq{"`action`.is_private": false})
 	}
 	if !opts.IncludeDeleted {
@@ -212,7 +212,7 @@ func GetFeeds(ctx context.Context, opts GetFeedsOptions) (ActionList, int64, err
 	var err error
 	var cond builder.Cond
 	// if the actor is the requested user or is an administrator, we can skip the ActivityQueryCondition
-	if opts.RequestedUser != nil && user_model.DoerCanViewPrivate(opts.Actor) && (user_model.DoerIsSiteAdminFullAccess(opts.Actor) || opts.Actor.ID == opts.RequestedUser.ID) {
+	if opts.Actor != nil && opts.RequestedUser != nil && (opts.Actor.IsAdmin || opts.Actor.ID == opts.RequestedUser.ID) {
 		cond = builder.Eq{
 			"user_id": opts.RequestedUser.ID,
 		}.And(
@@ -228,15 +228,30 @@ func (nl NotificationList) LoadRepos(ctx context.Context) (repo_model.Repository

 	repoIDs := nl.getPendingRepoIDs()
 	repos := make(map[int64]*repo_model.Repository, len(repoIDs))
-	err := db.QueryAndProcessByChunk(repoIDs, func(chunk []int64) (out []*repo_model.Repository, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(repo *repo_model.Repository) error {
-		repos[repo.ID] = repo
-		return nil
-	})
-	if err != nil {
-		return nil, nil, err
+	left := len(repoIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).
+			In("id", repoIDs[:limit]).
+			Rows(new(repo_model.Repository))
+		if err != nil {
+			return nil, nil, err
+		}
+
+		for rows.Next() {
+			var repo repo_model.Repository
+			err = rows.Scan(&repo)
+			if err != nil {
+				rows.Close()
+				return nil, nil, err
+			}
+
+			repos[repo.ID] = &repo
+		}
+		_ = rows.Close()
+
+		left -= limit
+		repoIDs = repoIDs[limit:]
 	}

 	failed := []int{}
@@ -284,15 +299,30 @@ func (nl NotificationList) LoadIssues(ctx context.Context) ([]int, error) {

 	issueIDs := nl.getPendingIssueIDs()
 	issues := make(map[int64]*issues_model.Issue, len(issueIDs))
-	err := db.QueryAndProcessByChunk(issueIDs, func(chunk []int64) (out []*issues_model.Issue, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(issue *issues_model.Issue) error {
-		issues[issue.ID] = issue
-		return nil
-	})
-	if err != nil {
-		return nil, err
+	left := len(issueIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).
+			In("id", issueIDs[:limit]).
+			Rows(new(issues_model.Issue))
+		if err != nil {
+			return nil, err
+		}
+
+		for rows.Next() {
+			var issue issues_model.Issue
+			err = rows.Scan(&issue)
+			if err != nil {
+				rows.Close()
+				return nil, err
+			}
+
+			issues[issue.ID] = &issue
+		}
+		_ = rows.Close()
+
+		left -= limit
+		issueIDs = issueIDs[limit:]
 	}

 	failures := []int{}
@@ -361,15 +391,30 @@ func (nl NotificationList) LoadUsers(ctx context.Context) ([]int, error) {

 	userIDs := nl.getUserIDs()
 	users := make(map[int64]*user_model.User, len(userIDs))
-	err := db.QueryAndProcessByChunk(userIDs, func(chunk []int64) (out []*user_model.User, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(user *user_model.User) error {
-		users[user.ID] = user
-		return nil
-	})
-	if err != nil {
-		return nil, err
+	left := len(userIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).
+			In("id", userIDs[:limit]).
+			Rows(new(user_model.User))
+		if err != nil {
+			return nil, err
+		}
+
+		for rows.Next() {
+			var user user_model.User
+			err = rows.Scan(&user)
+			if err != nil {
+				rows.Close()
+				return nil, err
+			}
+
+			users[user.ID] = &user
+		}
+		_ = rows.Close()
+
+		left -= limit
+		userIDs = userIDs[limit:]
 	}

 	failures := []int{}
@@ -394,15 +439,30 @@ func (nl NotificationList) LoadComments(ctx context.Context) ([]int, error) {

 	commentIDs := nl.getPendingCommentIDs()
 	comments := make(map[int64]*issues_model.Comment, len(commentIDs))
-	err := db.QueryAndProcessByChunk(commentIDs, func(chunk []int64) (out []*issues_model.Comment, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(comment *issues_model.Comment) error {
-		comments[comment.ID] = comment
-		return nil
-	})
-	if err != nil {
-		return nil, err
+	left := len(commentIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).
+			In("id", commentIDs[:limit]).
+			Rows(new(issues_model.Comment))
+		if err != nil {
+			return nil, err
+		}
+
+		for rows.Next() {
+			var comment issues_model.Comment
+			err = rows.Scan(&comment)
+			if err != nil {
+				rows.Close()
+				return nil, err
+			}
+
+			comments[comment.ID] = &comment
+		}
+		_ = rows.Close()
+
+		left -= limit
+		commentIDs = commentIDs[limit:]
 	}

 	failures := []int{}
@@ -15,7 +15,6 @@ import (
 	user_model "gitea.dev/models/user"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestCreateOrUpdateIssueNotifications(t *testing.T) {
@@ -110,71 +109,6 @@ func TestNotificationsForUser(t *testing.T) {
 	}
 }

-func TestNotificationListLoadAttributes(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	first := &activities_model.Notification{RepoID: 1, IssueID: 1, UserID: 1, CommentID: 2}
-	last := &activities_model.Notification{RepoID: 2, IssueID: 4, UserID: 2, CommentID: 8}
-	loaded := &activities_model.Notification{
-		RepoID: 1, IssueID: 1, UserID: 1, CommentID: 2,
-		Repository: &repo_model.Repository{ID: 1},
-		Issue:      &issues_model.Issue{ID: 1},
-		User:       &user_model.User{ID: 1},
-		Comment:    &issues_model.Comment{ID: 2},
-	}
-	saved := *loaded
-	list := activities_model.NotificationList{first}
-	var wantFailures []int
-	for i := range db.DefaultMaxInSize {
-		id := unittest.NonexistentID - int64(i)
-		wantFailures = append(wantFailures, len(list))
-		list = append(list, &activities_model.Notification{RepoID: id, IssueID: id, UserID: id, CommentID: id})
-	}
-	withoutIssue := &activities_model.Notification{RepoID: 1}
-	list = append(list, last, loaded, withoutIssue)
-
-	repos, failures, err := list.LoadRepos(t.Context())
-	require.NoError(t, err)
-	assert.Equal(t, wantFailures, failures)
-	require.Len(t, repos, 2)
-	assert.Equal(t, int64(1), repos[0].ID)
-	assert.Equal(t, int64(2), repos[1].ID)
-	failures, err = list.LoadIssues(t.Context())
-	require.NoError(t, err)
-	assert.Equal(t, wantFailures, failures)
-	failures, err = list.LoadUsers(t.Context())
-	require.NoError(t, err)
-	assert.Empty(t, failures)
-	failures, err = list.LoadComments(t.Context())
-	require.NoError(t, err)
-	assert.Empty(t, failures)
-
-	for _, notification := range []*activities_model.Notification{first, last} {
-		require.NotNil(t, notification.Repository)
-		assert.Equal(t, notification.RepoID, notification.Repository.ID)
-		require.NotNil(t, notification.Issue)
-		assert.Equal(t, notification.IssueID, notification.Issue.ID)
-		assert.Same(t, notification.Repository, notification.Issue.Repo)
-		require.NotNil(t, notification.User)
-		assert.Equal(t, notification.UserID, notification.User.ID)
-		require.NotNil(t, notification.Comment)
-		assert.Equal(t, notification.CommentID, notification.Comment.ID)
-		assert.Same(t, notification.Issue, notification.Comment.Issue)
-	}
-	assert.Same(t, saved.Repository, loaded.Repository)
-	assert.Same(t, saved.Issue, loaded.Issue)
-	assert.Same(t, saved.User, loaded.User)
-	assert.Same(t, saved.Comment, loaded.Comment)
-	for _, notification := range list[1 : db.DefaultMaxInSize+1] {
-		assert.Nil(t, notification.Repository)
-		assert.Nil(t, notification.Issue)
-		assert.Nil(t, notification.User)
-		assert.Nil(t, notification.Comment)
-	}
-	assert.Nil(t, withoutIssue.Issue)
-	assert.Nil(t, withoutIssue.User)
-	assert.Nil(t, withoutIssue.Comment)
-}
-
 func TestNotification_GetRepo(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	notf := unittest.AssertExistsAndLoadBean(t, &activities_model.Notification{RepoID: 1})
@@ -83,17 +83,23 @@ func GetActivityStats(ctx context.Context, repo *repo_model.Repository, timeFrom

 // GetActivityStatsTopAuthors returns top author stats for git commits for all branches
 func GetActivityStatsTopAuthors(ctx context.Context, repo *repo_model.Repository, timeFrom time.Time, count int) ([]*ActivityAuthorData, error) {
-	authors, err := git.GetCodeActivityAuthors(ctx, repo, timeFrom)
+	gitRepo, closer, err := git.RepositoryFromContextOrOpen(ctx, repo)
+	if err != nil {
+		return nil, fmt.Errorf("OpenRepository: %w", err)
+	}
+	defer closer.Close()
+
+	code, err := gitRepo.GetCodeActivityStats(ctx, timeFrom, "")
 	if err != nil {
 		return nil, fmt.Errorf("FillFromGit: %w", err)
 	}
-	if authors == nil {
+	if code.Authors == nil {
 		return nil, nil
 	}
 	users := make(map[int64]*ActivityAuthorData)
 	var unknownUserID int64
 	unknownUserAvatarLink := user_model.NewGhostUser().AvatarLink(ctx)
-	for _, v := range authors {
+	for _, v := range code.Authors {
 		if len(v.Email) == 0 {
 			continue
 		}
@@ -15,7 +15,6 @@ import (
 	"sync"

 	"gitea.dev/models/db"
-	"gitea.dev/modules/consts"
 	"gitea.dev/modules/log"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/util"
@@ -136,7 +135,7 @@ func appendAuthorizedKeysToFile(keys ...*PublicKey) error {
 	defer f.Close()

 	// Note: chmod command does not support in Windows.
-	if !consts.IsWindows {
+	if !setting.IsWindows {
 		fi, err := f.Stat()
 		if err != nil {
 			return err
@@ -84,7 +84,6 @@ var (
 	UserTwoFactorRegenerate         = define("user:twofactor:regenerate", "Regenerated two-factor authentication secret for user {scope}.")
 	UserTwoFactorDisable            = define("user:twofactor:disable", "Disabled two-factor authentication for user {scope}.")
 	UserWebAuthAdd                  = define("user:webauth:add", "Added WebAuthn key {credential} for user {scope}.")
-	UserWebAuthRename               = define("user:webauth:rename", "Renamed WebAuthn key {previous_credential} of user {scope} to {credential}.")
 	UserWebAuthRemove               = define("user:webauth:remove", "Removed WebAuthn key {credential} from user {scope}.")
 	UserExternalLoginAdd            = define("user:externallogin:add", "Added external login {external_id} for user {scope} using provider {provider}.")
 	UserExternalLoginRemove         = define("user:externallogin:remove", "Removed external login from authentication source {auth_source_id} for user {scope}.")
@@ -54,8 +54,7 @@ type AccessTokenScope string
 // for all categories, write implies read
 const (
 	AccessTokenScopeAll        AccessTokenScope = "all"
-	AccessTokenScopeNone       AccessTokenScope = "no-token-scope" // no token permission scopes, so no API permissions
-	AccessTokenScopePublicOnly AccessTokenScope = "public-only"    // limited to public orgs/repos
+	AccessTokenScopePublicOnly AccessTokenScope = "public-only" // limited to public orgs/repos

 	AccessTokenScopeReadActivityPub  AccessTokenScope = "read:activitypub"
 	AccessTokenScopeWriteActivityPub AccessTokenScope = "write:activitypub"
@@ -148,7 +147,6 @@ var allAccessTokenScopes = []AccessTokenScope{
 // allAccessTokenScopeBits contains all access token scopes.
 var allAccessTokenScopeBits = map[AccessTokenScope]accessTokenScopeBitmap{
 	AccessTokenScopeAll:               accessTokenScopeAllBits,
-	AccessTokenScopeNone:              0,
 	AccessTokenScopePublicOnly:        accessTokenScopePublicOnlyBits,
 	AccessTokenScopeReadActivityPub:   accessTokenScopeReadActivityPubBits,
 	AccessTokenScopeWriteActivityPub:  accessTokenScopeWriteActivityPubBits,
@@ -213,6 +211,11 @@ func GetRequiredScopes(level AccessTokenScopeLevel, scopeCategories ...AccessTok
 	return scopes
 }

+// ContainsCategory checks if a list of categories contains a specific category
+func ContainsCategory(categories []AccessTokenScopeCategory, category AccessTokenScopeCategory) bool {
+	return slices.Contains(categories, category)
+}
+
 // GetScopeLevelFromAccessMode converts permission access mode to scope level
 func GetScopeLevelFromAccessMode(mode perm.AccessMode) AccessTokenScopeLevel {
 	switch mode {
@@ -283,14 +286,12 @@ func (s AccessTokenScope) Normalize() (AccessTokenScope, error) {
 	if err != nil {
 		return "", err
 	}
-	if bitmap == 0 && slices.Contains(s.StringSlice(), string(AccessTokenScopeNone)) {
-		return AccessTokenScopeNone, nil
-	}
+
 	return bitmap.toScope(), nil
 }

 func (s AccessTokenScope) HasPermissionScope() bool {
-	return s != "" && s != AccessTokenScopeNone && s != AccessTokenScopePublicOnly
+	return s != "" && s != AccessTokenScopePublicOnly
 }

 // PublicOnly checks if this token scope is limited to public resources
@@ -18,14 +18,8 @@ type scopeTestNormalize struct {

 func TestAccessTokenScope_Normalize(t *testing.T) {
 	assert.Equal(t, []string{"activitypub", "admin", "issue", "misc", "notification", "organization", "package", "repository", "user"}, GetAccessTokenCategories())
-	assert.False(t, AccessTokenScopeNone.HasPermissionScope())
 	tests := []scopeTestNormalize{
 		{"", "", nil},
-		{"no-token-scope", "no-token-scope", nil},
-		{"no-token-scope,no-token-scope", "no-token-scope", nil},
-		{"no-token-scope,read:user", "read:user", nil},
-		{"no-token-scope,public-only", "public-only", nil},
-		{"no-token-scope,all", "all", nil},
 		{"write:misc,write:notification,read:package,write:notification,public-only", "public-only,write:misc,write:notification,read:package", nil},
 		{"all", "all", nil},
 		{"write:activitypub,write:admin,write:misc,write:notification,write:organization,write:package,write:issue,write:repository,write:user", "all", nil},
@@ -64,20 +58,10 @@ func TestAccessTokenScope_HasScope(t *testing.T) {
 		{"all", "write:package", true, nil},
 		{"write:package", "all", false, nil},
 		{"public-only", "read:issue", false, nil},
-		{"no-token-scope", "all", false, nil},
-		{"no-token-scope", "no-token-scope", true, nil},
 	}

 	for _, scope := range GetAccessTokenCategories() {
 		tests = append(tests,
-			scopeTestHasScope{
-				AccessTokenScopeNone,
-				AccessTokenScope("read:" + scope), false, nil,
-			},
-			scopeTestHasScope{
-				AccessTokenScopeNone,
-				AccessTokenScope("write:" + scope), false, nil,
-			},
 			scopeTestHasScope{
 				AccessTokenScope("read:" + scope),
 				AccessTokenScope("read:" + scope), true, nil,
@@ -20,9 +20,6 @@ type AuthToken struct { //nolint:revive // export stutter
 	TokenHash   string
 	UserID      int64              `xorm:"INDEX"`
 	ExpiresUnix timeutil.TimeStamp `xorm:"INDEX"`
-
-	PreviousTokenHash string             // Identifies stale cookies without authenticating them.
-	RotatedUnix       timeutil.TimeStamp // Bounds the grace window for stale cookies.
 }

 func init() {
@@ -49,7 +46,7 @@ func GetAuthTokenByID(ctx context.Context, id string) (*AuthToken, error) {

 func UpdateAuthTokenByID(ctx context.Context, t *AuthToken, oldHash string) (bool, error) {
 	affected, err := db.GetEngine(ctx).ID(t.ID).Where("token_hash = ?", oldHash).
-		Cols("token_hash", "expires_unix", "previous_token_hash", "rotated_unix").Update(t)
+		Cols("token_hash", "expires_unix").Update(t)
 	return affected == 1, err
 }

@@ -25,6 +25,7 @@ import (
 	"golang.org/x/crypto/bcrypt"
 	"golang.org/x/oauth2"
 	"xorm.io/builder"
+	"xorm.io/xorm"
 )

 // Authorization codes should expire within 10 minutes per https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2
@@ -596,17 +597,22 @@ func GetOAuth2GrantsByUserID(ctx context.Context, uid int64) ([]*OAuth2Grant, er
 		Grant       *OAuth2Grant       `xorm:"extends"`
 		Application *OAuth2Application `xorm:"extends"`
 	}
-	var joinedOAuth2Grants []*joinedOAuth2Grant
-	err := db.GetEngine(ctx).
+	var results *xorm.Rows
+	var err error
+	if results, err = db.GetEngine(ctx).
 		Table("oauth2_grant").
 		Where("user_id = ?", uid).
 		Join("INNER", "oauth2_application", "application_id = oauth2_application.id").
-		Find(&joinedOAuth2Grants)
-	if err != nil {
+		Rows(new(joinedOAuth2Grant)); err != nil {
 		return nil, err
 	}
+	defer results.Close()
 	grants := make([]*OAuth2Grant, 0)
-	for _, joinedGrant := range joinedOAuth2Grants {
+	for results.Next() {
+		joinedGrant := new(joinedOAuth2Grant)
+		if err := results.Scan(joinedGrant); err != nil {
+			return nil, err
+		}
 		joinedGrant.Grant.Application = joinedGrant.Application
 		grants = append(grants, joinedGrant.Grant)
 	}
@@ -5,6 +5,7 @@ package auth

 import (
 	"context"
+	"fmt"

 	"gitea.dev/models/db"
 	"gitea.dev/modules/timeutil"
@@ -12,46 +13,49 @@ import (
 	"xorm.io/builder"
 )

+// Session represents a session compatible for go-chi session
 type Session struct {
-	Key            string             `xorm:"pk CHAR(16)"` // the limit is from legacy go-chi/session
-	Data           []byte             `xorm:"BLOB"`        // on MySQL this has a maximum size of 64Kb
-	LastAccessTime timeutil.TimeStamp `xorm:"expiry"`      // last access time, the field name is from legacy go-chi/session, we don't want to change it at the moment
+	Key    string             `xorm:"pk CHAR(16)"` // has to be Key to match with go-chi/session
+	Data   []byte             `xorm:"BLOB"`        // on MySQL this has a maximum size of 64Kb - this may need to be increased
+	Expiry timeutil.TimeStamp // has to be Expiry to match with go-chi/session
 }

-const DbSessionLastAccessTime = "expiry" // maybe we can make a deeper clean up in the future, just keep this PR focused
-
 func init() {
 	db.RegisterModel(new(Session))
 }

-// UpdateSession stores the data of the session with provided id, creating the session only if create is set
-func UpdateSession(ctx context.Context, key string, data []byte, create bool) error {
-	session := &Session{Key: key, Data: data, LastAccessTime: timeutil.TimeStampNow()}
-	update := func() (int64, error) {
-		return db.GetEngine(ctx).ID(key).Cols("data", DbSessionLastAccessTime).Update(session)
-	}
-	if updated, err := update(); err != nil || updated > 0 || !create {
-		return err
-	}
-	insertErr := db.Insert(ctx, session)
-	if insertErr == nil {
-		return nil
-	}
-	// the row exists if a concurrent request inserted it, or if MySQL reported an unchanged row as not updated
-	if exist, err := db.Exist[Session](ctx, builder.Eq{"`key`": key}); err != nil || !exist {
-		return insertErr
-	}
-	_, err := update()
+// UpdateSession updates the session with provided id
+func UpdateSession(ctx context.Context, key string, data []byte) error {
+	_, err := db.GetEngine(ctx).ID(key).Update(&Session{
+		Data:   data,
+		Expiry: timeutil.TimeStampNow(),
+	})
 	return err
 }

-func UpdateSessionLastAccessTime(ctx context.Context, key string) error {
-	_, err := db.GetEngine(ctx).ID(key).Cols(DbSessionLastAccessTime).Update(&Session{LastAccessTime: timeutil.TimeStampNow()})
-	return err
+// ReadSession reads the data for the provided session
+func ReadSession(ctx context.Context, key string) (*Session, error) {
+	return db.WithTx2(ctx, func(ctx context.Context) (*Session, error) {
+		session, exist, err := db.Get[Session](ctx, builder.Eq{"`key`": key})
+		if err != nil {
+			return nil, err
+		} else if !exist {
+			session = &Session{
+				Key:    key,
+				Expiry: timeutil.TimeStampNow(),
+			}
+			if err := db.Insert(ctx, session); err != nil {
+				return nil, err
+			}
+		}
+
+		return session, nil
+	})
 }

-func GetSession(ctx context.Context, key string) (*Session, bool, error) {
-	return db.Get[Session](ctx, builder.Eq{"`key`": key})
+// ExistSession checks if a session exists
+func ExistSession(ctx context.Context, key string) (bool, error) {
+	return db.Exist[Session](ctx, builder.Eq{"`key`": key})
 }

 // DestroySession destroys a session
@@ -62,8 +66,47 @@ func DestroySession(ctx context.Context, key string) error {
 	return err
 }

+// RegenerateSession regenerates a session from the old id
+func RegenerateSession(ctx context.Context, oldKey, newKey string) (*Session, error) {
+	return db.WithTx2(ctx, func(ctx context.Context) (*Session, error) {
+		if has, err := db.Exist[Session](ctx, builder.Eq{"`key`": newKey}); err != nil {
+			return nil, err
+		} else if has {
+			return nil, fmt.Errorf("session Key: %s already exists", newKey)
+		}
+
+		if has, err := db.Exist[Session](ctx, builder.Eq{"`key`": oldKey}); err != nil {
+			return nil, err
+		} else if !has {
+			if err := db.Insert(ctx, &Session{
+				Key:    oldKey,
+				Expiry: timeutil.TimeStampNow(),
+			}); err != nil {
+				return nil, err
+			}
+		}
+
+		if _, err := db.Exec(ctx, "UPDATE `session` SET `key` = ? WHERE `key`=?", newKey, oldKey); err != nil {
+			return nil, err
+		}
+
+		s, _, err := db.Get[Session](ctx, builder.Eq{"`key`": newKey})
+		if err != nil {
+			// is not exist, it should be impossible
+			return nil, err
+		}
+
+		return s, nil
+	})
+}
+
+// CountSessions returns the number of sessions
+func CountSessions(ctx context.Context) (int64, error) {
+	return db.GetEngine(ctx).Count(&Session{})
+}
+
 // CleanupSessions cleans up expired sessions
 func CleanupSessions(ctx context.Context, maxLifetime int64) error {
-	_, err := db.GetEngine(ctx).Where(DbSessionLastAccessTime+" <= ?", timeutil.TimeStampNow().Add(-maxLifetime)).Delete(&Session{})
+	_, err := db.GetEngine(ctx).Where("expiry <= ?", timeutil.TimeStampNow().Add(-maxLifetime)).Delete(&Session{})
 	return err
 }
@@ -150,9 +150,9 @@ func GetWebAuthnCredentialByName(ctx context.Context, uid int64, name string) (*
 }

 // GetWebAuthnCredentialByID returns WebAuthn credential by id
-func GetWebAuthnCredentialByID(ctx context.Context, uid, id int64) (*WebAuthnCredential, error) {
+func GetWebAuthnCredentialByID(ctx context.Context, id int64) (*WebAuthnCredential, error) {
 	cred := new(WebAuthnCredential)
-	if found, err := db.GetEngine(ctx).Where("user_id = ?", uid).ID(id).Get(cred); err != nil {
+	if found, err := db.GetEngine(ctx).ID(id).Get(cred); err != nil {
 		return nil, err
 	} else if !found {
 		return nil, ErrWebAuthnCredentialNotExist{ID: id}
@@ -195,26 +195,8 @@ func CreateCredential(ctx context.Context, userID int64, name string, cred *weba
 	return c, nil
 }

-// RenameCredential renames the user's WebAuthnCredential, names are unique per user regardless of letter case
-func RenameCredential(ctx context.Context, uid, id int64, name string) (bool, error) {
-	used, err := db.GetEngine(ctx).Where("user_id = ? AND lower_name = ? AND id != ?", uid, strings.ToLower(name), id).Exist(&WebAuthnCredential{})
-	if err != nil {
-		return false, err
-	} else if used {
-		return false, util.ErrorWrapTranslatable(
-			util.NewAlreadyExistErrorf("WebAuthn credential name already exists [uid: %d, name: %s]", uid, name),
-			"settings.webauthn_nickname_been_used",
-		)
-	}
-	updated, err := db.GetEngine(ctx).ID(id).Where("user_id=? AND `name`<>?", uid, name).Cols("name", "lower_name").Update(&WebAuthnCredential{
-		Name:      name,
-		LowerName: strings.ToLower(name),
-	})
-	return updated > 0, err
-}
-
 // DeleteCredential will delete WebAuthnCredential
-func DeleteCredential(ctx context.Context, uid, id int64) (bool, error) {
-	had, err := db.GetEngine(ctx).ID(id).Where("user_id = ?", uid).Delete(&WebAuthnCredential{})
+func DeleteCredential(ctx context.Context, id, userID int64) (bool, error) {
+	had, err := db.GetEngine(ctx).ID(id).Where("user_id = ?", userID).Delete(&WebAuthnCredential{})
 	return had > 0, err
 }
@@ -16,15 +16,11 @@ import (
 func TestGetWebAuthnCredentialByID(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())

-	res, err := auth_model.GetWebAuthnCredentialByID(t.Context(), 32, 1)
+	res, err := auth_model.GetWebAuthnCredentialByID(t.Context(), 1)
 	assert.NoError(t, err)
 	assert.Equal(t, "WebAuthn credential", res.Name)

-	_, err = auth_model.GetWebAuthnCredentialByID(t.Context(), 99999, 1)
-	assert.Error(t, err)
-	assert.True(t, auth_model.IsErrWebAuthnCredentialNotExist(err))
-
-	_, err = auth_model.GetWebAuthnCredentialByID(t.Context(), 32, 99999)
+	_, err = auth_model.GetWebAuthnCredentialByID(t.Context(), 342432)
 	assert.Error(t, err)
 	assert.True(t, auth_model.IsErrWebAuthnCredentialNotExist(err))
 }
@@ -13,12 +13,8 @@ import (
 	"xorm.io/xorm/schemas"
 )

-type sqlTableInfoProvider interface {
-	TableInfo(bean any) (*schemas.Table, error)
-}
-
-func IterateTableByColumn[Bean any](ctx context.Context, tableInfo sqlTableInfoProvider, sess SQLSession, colName string, cond builder.Cond, f func(ctx context.Context, bean *Bean) error) error {
-	table, err := tableInfo.TableInfo(new(Bean))
+func iterateTableByColumn[Bean any](ctx context.Context, colName string, cond builder.Cond, f func(ctx context.Context, bean *Bean) error) error {
+	table, err := xormEngine.TableInfo(new(Bean))
 	if err != nil {
 		return err
 	}
@@ -40,7 +36,7 @@ func IterateTableByColumn[Bean any](ctx context.Context, tableInfo sqlTableInfoP
 		}

 		beans := make([]*Bean, 0, batchSize)
-		query := sess.Table(table.Name).Asc(colName)
+		query := GetEngine(ctx).Table(table.Name).Asc(colName)

 		batchCond := cond
 		if lastColValue != nil {
@@ -72,9 +68,9 @@ func IterateTableByColumn[Bean any](ctx context.Context, tableInfo sqlTableInfoP
 }

 func IterateByColumn[Bean any](ctx context.Context, colName string, cond builder.Cond, f func(ctx context.Context, bean *Bean) error) error {
-	return IterateTableByColumn(ctx, xormEngine, GetEngine(ctx), colName, cond, f)
+	return iterateTableByColumn(ctx, colName, cond, f)
 }

 func Iterate[Bean any](ctx context.Context, cond builder.Cond, f func(ctx context.Context, bean *Bean) error) error {
-	return IterateTableByColumn(ctx, xormEngine, GetEngine(ctx), "", cond, f)
+	return iterateTableByColumn(ctx, "", cond, f)
 }
@@ -5,7 +5,6 @@ package db

 import (
 	"context"
-	"slices"

 	"gitea.dev/modules/setting"

@@ -199,18 +198,3 @@ func FindAndCount[T any](ctx context.Context, opts FindOptions) ([]*T, int64, er
 	}
 	return objects, cnt, nil
 }
-
-func QueryAndProcessByChunk[IN, OUT any](in []IN, fnIn func(chunk []IN) ([]OUT, error), fnOut func(out OUT) error) error {
-	for chunkIn := range slices.Chunk(in, DefaultMaxInSize) {
-		chunkOut, err := fnIn(chunkIn)
-		if err != nil {
-			return err
-		}
-		for _, out := range chunkOut {
-			if err := fnOut(out); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
@@ -3,7 +3,7 @@
  uid: 1
  name: "Test"
  client_id: "da7da3ba-9a13-4167-856f-3899de0b0138"
-  client_secret: "$2a$04$fk.C0LyaUcmxOFLcfcXUDO084yIA9o0nRwkSHSZb/tvZkCzLZjRea" # bcrypt of "4MK8Na6R55smdCY0WuCCumZ6hjRPnGY5saWVRHHjJiA=
+  client_secret: "$2a$10$UYRgUSgekzBp6hYe8pAdc.cgB4Gn06QRKsORUnIYTYQADs.YR/uvi" # bcrypt of "4MK8Na6R55smdCY0WuCCumZ6hjRPnGY5saWVRHHjJiA=
  redirect_uris: '["https://example.com"]'
  created_unix: 1546869730
  updated_unix: 1546869730
@@ -13,7 +13,7 @@
  uid: 2
  name: "Test native app"
  client_id: "ce5a1322-42a7-11ed-b878-0242ac120002"
-  client_secret: "$2a$04$VvPoNpflYJB94T8seLcZnOCTtQtB3Q2wXw7ZgrWIi2Oix3VWL8s7i" # bcrypt of "4MK8Na6R55smdCY0WuCCumZ6hjRPnGY5saWVRHHjJiA=
+  client_secret: "$2a$10$UYRgUSgekzBp6hYe8pAdc.cgB4Gn06QRKsORUnIYTYQADs.YR/uvi" # bcrypt of "4MK8Na6R55smdCY0WuCCumZ6hjRPnGY5saWVRHHjJiA=
  redirect_uris: '["http://127.0.0.1"]'
  created_unix: 1546869730
  updated_unix: 1546869730
@@ -28,57 +28,50 @@ var ErrBranchIsProtected = util.ErrorWrap(util.ErrPermissionDenied, "branch is p

 // ProtectedBranch struct
 type ProtectedBranch struct {
-	ID                    int64                  `xorm:"pk autoincr"`
-	RepoID                int64                  `xorm:"UNIQUE(s)"`
-	Repo                  *repo_model.Repository `xorm:"-"`
-	RuleName              string                 `xorm:"'branch_name' UNIQUE(s)"` // a branch name or a glob match to branch name
-	Priority              int64                  `xorm:"NOT NULL DEFAULT 0"`
-	globRule              glob.Glob              `xorm:"-"`
-	isPlainName           bool                   `xorm:"-"`
-	ProtectedBranchConfig `xorm:"'config' JSON LONGTEXT"`
+	ID                            int64                  `xorm:"pk autoincr"`
+	RepoID                        int64                  `xorm:"UNIQUE(s)"`
+	Repo                          *repo_model.Repository `xorm:"-"`
+	RuleName                      string                 `xorm:"'branch_name' UNIQUE(s)"` // a branch name or a glob match to branch name
+	Priority                      int64                  `xorm:"NOT NULL DEFAULT 0"`
+	globRule                      glob.Glob              `xorm:"-"`
+	isPlainName                   bool                   `xorm:"-"`
+	CanPush                       bool                   `xorm:"NOT NULL DEFAULT false"`
+	EnableWhitelist               bool
+	WhitelistUserIDs              []int64  `xorm:"JSON TEXT"`
+	WhitelistTeamIDs              []int64  `xorm:"JSON TEXT"`
+	EnableMergeWhitelist          bool     `xorm:"NOT NULL DEFAULT false"`
+	WhitelistDeployKeys           bool     `xorm:"NOT NULL DEFAULT false"`
+	MergeWhitelistUserIDs         []int64  `xorm:"JSON TEXT"`
+	MergeWhitelistTeamIDs         []int64  `xorm:"JSON TEXT"`
+	EnableBypassAllowlist         bool     `xorm:"NOT NULL DEFAULT false"`
+	BypassAllowlistUserIDs        []int64  `xorm:"JSON TEXT"`
+	BypassAllowlistTeamIDs        []int64  `xorm:"JSON TEXT"`
+	CanForcePush                  bool     `xorm:"NOT NULL DEFAULT false"`
+	EnableForcePushAllowlist      bool     `xorm:"NOT NULL DEFAULT false"`
+	ForcePushAllowlistUserIDs     []int64  `xorm:"JSON TEXT"`
+	ForcePushAllowlistTeamIDs     []int64  `xorm:"JSON TEXT"`
+	ForcePushAllowlistDeployKeys  bool     `xorm:"NOT NULL DEFAULT false"`
+	EnableStatusCheck             bool     `xorm:"NOT NULL DEFAULT false"`
+	StatusCheckContexts           []string `xorm:"JSON TEXT"`
+	EnableApprovalsWhitelist      bool     `xorm:"NOT NULL DEFAULT false"`
+	ApprovalsWhitelistUserIDs     []int64  `xorm:"JSON TEXT"`
+	ApprovalsWhitelistTeamIDs     []int64  `xorm:"JSON TEXT"`
+	RequiredApprovals             int64    `xorm:"NOT NULL DEFAULT 0"`
+	BlockOnRejectedReviews        bool     `xorm:"NOT NULL DEFAULT false"`
+	BlockOnOfficialReviewRequests bool     `xorm:"NOT NULL DEFAULT false"`
+	BlockOnCodeownerReviews       bool     `xorm:"NOT NULL DEFAULT false"`
+	BlockOnOutdatedBranch         bool     `xorm:"NOT NULL DEFAULT false"`
+	DismissStaleApprovals         bool     `xorm:"NOT NULL DEFAULT false"`
+	IgnoreStaleApprovals          bool     `xorm:"NOT NULL DEFAULT false"`
+	RequireSignedCommits          bool     `xorm:"NOT NULL DEFAULT false"`
+	ProtectedFilePatterns         string   `xorm:"TEXT"`
+	UnprotectedFilePatterns       string   `xorm:"TEXT"`
+	BlockAdminMergeOverride       bool     `xorm:"NOT NULL DEFAULT false"`

 	CreatedUnix timeutil.TimeStamp `xorm:"created"`
 	UpdatedUnix timeutil.TimeStamp `xorm:"updated"`
 }

-// ProtectedBranchConfig stores protection settings in a single JSON column.
-type ProtectedBranchConfig struct {
-	CanPush                       bool     `json:"can_push,omitzero"`
-	EnableWhitelist               bool     `json:"enable_whitelist,omitzero"`
-	WhitelistUserIDs              []int64  `json:"whitelist_user_ids,omitzero"`
-	WhitelistTeamIDs              []int64  `json:"whitelist_team_ids,omitzero"`
-	EnableMergeWhitelist          bool     `json:"enable_merge_whitelist,omitzero"`
-	MergeWhitelistUserIDs         []int64  `json:"merge_whitelist_user_ids,omitzero"`
-	MergeWhitelistTeamIDs         []int64  `json:"merge_whitelist_team_ids,omitzero"`
-	EnableBypassAllowlist         bool     `json:"enable_bypass_allowlist,omitzero"`
-	BypassAllowlistUserIDs        []int64  `json:"bypass_allowlist_user_ids,omitzero"`
-	BypassAllowlistTeamIDs        []int64  `json:"bypass_allowlist_team_ids,omitzero"`
-	CanForcePush                  bool     `json:"can_force_push,omitzero"`
-	EnableForcePushAllowlist      bool     `json:"enable_force_push_allowlist,omitzero"`
-	ForcePushAllowlistUserIDs     []int64  `json:"force_push_allowlist_user_ids,omitzero"`
-	ForcePushAllowlistTeamIDs     []int64  `json:"force_push_allowlist_team_ids,omitzero"`
-	CanDelete                     bool     `json:"can_delete,omitzero"`
-	EnableDeletionAllowlist       bool     `json:"enable_deletion_allowlist,omitzero"`
-	DeletionAllowlistUserIDs      []int64  `json:"deletion_allowlist_user_ids,omitzero"`
-	DeletionAllowlistTeamIDs      []int64  `json:"deletion_allowlist_team_ids,omitzero"`
-	EnableStatusCheck             bool     `json:"enable_status_check,omitzero"`
-	StatusCheckContexts           []string `json:"status_check_contexts,omitzero"`
-	EnableApprovalsWhitelist      bool     `json:"enable_approvals_whitelist,omitzero"`
-	ApprovalsWhitelistUserIDs     []int64  `json:"approvals_whitelist_user_ids,omitzero"`
-	ApprovalsWhitelistTeamIDs     []int64  `json:"approvals_whitelist_team_ids,omitzero"`
-	RequiredApprovals             int64    `json:"required_approvals,omitzero"`
-	BlockOnRejectedReviews        bool     `json:"block_on_rejected_reviews,omitzero"`
-	BlockOnOfficialReviewRequests bool     `json:"block_on_official_review_requests,omitzero"`
-	BlockOnCodeownerReviews       bool     `json:"block_on_codeowner_reviews,omitzero"`
-	BlockOnOutdatedBranch         bool     `json:"block_on_outdated_branch,omitzero"`
-	DismissStaleApprovals         bool     `json:"dismiss_stale_approvals,omitzero"`
-	IgnoreStaleApprovals          bool     `json:"ignore_stale_approvals,omitzero"`
-	RequireSignedCommits          bool     `json:"require_signed_commits,omitzero"`
-	ProtectedFilePatterns         string   `json:"protected_file_patterns,omitzero"`
-	UnprotectedFilePatterns       string   `json:"unprotected_file_patterns,omitzero"`
-	BlockAdminMergeOverride       bool     `json:"block_admin_merge_override,omitzero"`
-}
-
 func init() {
 	db.RegisterModel(new(ProtectedBranch))
 }
@@ -184,36 +177,6 @@ func (protectBranch *ProtectedBranch) CanUserForcePush(ctx context.Context, user
 	return in && protectBranch.CanUserPush(ctx, user, permissionInRepo)
 }

-// CanUserDelete returns if some user could delete this protected branch.
-// Since deletion can be used to reset a branch, it also requires regular push access.
-func (protectBranch *ProtectedBranch) CanUserDelete(ctx context.Context, user *user_model.User, permissionInRepo access_model.Permission) bool {
-	if user == nil || !permissionInRepo.CanWrite(unit.TypeCode) {
-		return false
-	}
-	if !protectBranch.CanDelete || !protectBranch.CanUserPush(ctx, user, permissionInRepo) {
-		return false
-	}
-
-	if !protectBranch.EnableDeletionAllowlist {
-		return true
-	}
-
-	if slices.Contains(protectBranch.DeletionAllowlistUserIDs, user.ID) {
-		return true
-	}
-
-	if len(protectBranch.DeletionAllowlistTeamIDs) == 0 {
-		return false
-	}
-
-	in, err := organization.IsUserInTeams(ctx, user.ID, protectBranch.DeletionAllowlistTeamIDs)
-	if err != nil {
-		log.Error("IsUserInTeams: %v", err)
-		return false
-	}
-	return in
-}
-
 // IsUserMergeWhitelisted checks if some user is whitelisted to merge to this branch
 func IsUserMergeWhitelisted(ctx context.Context, protectBranch *ProtectedBranch, userID int64, permissionInRepo access_model.Permission) bool {
 	if !protectBranch.EnableMergeWhitelist {
@@ -398,9 +361,6 @@ type WhitelistOptions struct {
 	ForcePushUserIDs []int64
 	ForcePushTeamIDs []int64

-	DeletionUserIDs []int64
-	DeletionTeamIDs []int64
-
 	MergeUserIDs []int64
 	MergeTeamIDs []int64

@@ -437,12 +397,6 @@ func UpdateProtectBranch(ctx context.Context, repo *repo_model.Repository, prote
 	}
 	protectBranch.ForcePushAllowlistUserIDs = whitelist

-	whitelist, err = updateUserWhitelist(ctx, repo, protectBranch.DeletionAllowlistUserIDs, opts.DeletionUserIDs)
-	if err != nil {
-		return err
-	}
-	protectBranch.DeletionAllowlistUserIDs = whitelist
-
 	whitelist, err = updateUserWhitelist(ctx, repo, protectBranch.MergeWhitelistUserIDs, opts.MergeUserIDs)
 	if err != nil {
 		return err
@@ -474,12 +428,6 @@ func UpdateProtectBranch(ctx context.Context, repo *repo_model.Repository, prote
 	}
 	protectBranch.ForcePushAllowlistTeamIDs = whitelist

-	whitelist, err = updateTeamWhitelist(ctx, repo, protectBranch.DeletionAllowlistTeamIDs, opts.DeletionTeamIDs)
-	if err != nil {
-		return err
-	}
-	protectBranch.DeletionAllowlistTeamIDs = whitelist
-
 	whitelist, err = updateTeamWhitelist(ctx, repo, protectBranch.MergeWhitelistTeamIDs, opts.MergeTeamIDs)
 	if err != nil {
 		return err
@@ -577,17 +525,13 @@ func updateUserWhitelist(ctx context.Context, repo *repo_model.Repository, curre

 	whitelist = make([]int64, 0, len(newWhitelist))
 	for _, userID := range newWhitelist {
-		if userID == user_model.ActionsUserID || userID == user_model.DeployKeyUserID {
-			whitelist = append(whitelist, userID)
-			continue
-		}
 		user, err := user_model.GetUserByID(ctx, userID)
 		if err != nil {
-			return nil, fmt.Errorf("GetUserByID [user_id: %d, repo_id: %d]: %w", userID, repo.ID, err)
+			return nil, fmt.Errorf("GetUserByID [user_id: %d, repo_id: %d]: %v", userID, repo.ID, err)
 		}
 		perm, err := access_model.GetIndividualUserRepoPermission(ctx, repo, user)
 		if err != nil {
-			return nil, fmt.Errorf("GetIndividualUserRepoPermission [user_id: %d, repo_id: %d]: %w", userID, repo.ID, err)
+			return nil, fmt.Errorf("GetIndividualUserRepoPermission [user_id: %d, repo_id: %d]: %v", userID, repo.ID, err)
 		}

 		if !perm.CanWrite(unit.TypeCode) {
@@ -645,14 +589,13 @@ func DeleteProtectedBranch(ctx context.Context, repo *repo_model.Repository, id
 }

 // removeIDsFromProtectedBranch is a helper function to remove IDs from protected branch options
-func removeIDsFromProtectedBranch(ctx context.Context, p *ProtectedBranch, userID, teamID int64) error {
-	lenUserIDs, lenForcePushIDs, lenDeletionIDs, lenApprovalIDs, lenMergeIDs := len(p.WhitelistUserIDs), len(p.ForcePushAllowlistUserIDs), len(p.DeletionAllowlistUserIDs), len(p.ApprovalsWhitelistUserIDs), len(p.MergeWhitelistUserIDs)
-	lenTeamIDs, lenForcePushTeamIDs, lenDeletionTeamIDs, lenApprovalTeamIDs, lenMergeTeamIDs := len(p.WhitelistTeamIDs), len(p.ForcePushAllowlistTeamIDs), len(p.DeletionAllowlistTeamIDs), len(p.ApprovalsWhitelistTeamIDs), len(p.MergeWhitelistTeamIDs)
+func removeIDsFromProtectedBranch(ctx context.Context, p *ProtectedBranch, userID, teamID int64, columnNames []string) error {
+	lenUserIDs, lenForcePushIDs, lenApprovalIDs, lenMergeIDs := len(p.WhitelistUserIDs), len(p.ForcePushAllowlistUserIDs), len(p.ApprovalsWhitelistUserIDs), len(p.MergeWhitelistUserIDs)
+	lenTeamIDs, lenForcePushTeamIDs, lenApprovalTeamIDs, lenMergeTeamIDs := len(p.WhitelistTeamIDs), len(p.ForcePushAllowlistTeamIDs), len(p.ApprovalsWhitelistTeamIDs), len(p.MergeWhitelistTeamIDs)

 	if userID > 0 {
 		p.WhitelistUserIDs = util.SliceRemoveAll(p.WhitelistUserIDs, userID)
 		p.ForcePushAllowlistUserIDs = util.SliceRemoveAll(p.ForcePushAllowlistUserIDs, userID)
-		p.DeletionAllowlistUserIDs = util.SliceRemoveAll(p.DeletionAllowlistUserIDs, userID)
 		p.ApprovalsWhitelistUserIDs = util.SliceRemoveAll(p.ApprovalsWhitelistUserIDs, userID)
 		p.MergeWhitelistUserIDs = util.SliceRemoveAll(p.MergeWhitelistUserIDs, userID)
 	}
@@ -660,22 +603,19 @@ func removeIDsFromProtectedBranch(ctx context.Context, p *ProtectedBranch, userI
 	if teamID > 0 {
 		p.WhitelistTeamIDs = util.SliceRemoveAll(p.WhitelistTeamIDs, teamID)
 		p.ForcePushAllowlistTeamIDs = util.SliceRemoveAll(p.ForcePushAllowlistTeamIDs, teamID)
-		p.DeletionAllowlistTeamIDs = util.SliceRemoveAll(p.DeletionAllowlistTeamIDs, teamID)
 		p.ApprovalsWhitelistTeamIDs = util.SliceRemoveAll(p.ApprovalsWhitelistTeamIDs, teamID)
 		p.MergeWhitelistTeamIDs = util.SliceRemoveAll(p.MergeWhitelistTeamIDs, teamID)
 	}

 	if (lenUserIDs != len(p.WhitelistUserIDs) ||
 		lenForcePushIDs != len(p.ForcePushAllowlistUserIDs) ||
-		lenDeletionIDs != len(p.DeletionAllowlistUserIDs) ||
 		lenApprovalIDs != len(p.ApprovalsWhitelistUserIDs) ||
 		lenMergeIDs != len(p.MergeWhitelistUserIDs)) ||
 		(lenTeamIDs != len(p.WhitelistTeamIDs) ||
 			lenForcePushTeamIDs != len(p.ForcePushAllowlistTeamIDs) ||
-			lenDeletionTeamIDs != len(p.DeletionAllowlistTeamIDs) ||
 			lenApprovalTeamIDs != len(p.ApprovalsWhitelistTeamIDs) ||
 			lenMergeTeamIDs != len(p.MergeWhitelistTeamIDs)) {
-		if _, err := db.GetEngine(ctx).ID(p.ID).Cols("config").Update(p); err != nil {
+		if _, err := db.GetEngine(ctx).ID(p.ID).Cols(columnNames...).Update(p); err != nil {
 			return fmt.Errorf("updateProtectedBranches: %v", err)
 		}
 	}
@@ -684,18 +624,22 @@ func removeIDsFromProtectedBranch(ctx context.Context, p *ProtectedBranch, userI

 // RemoveUserIDFromProtectedBranch removes all user ids from protected branch options
 func RemoveUserIDFromProtectedBranch(ctx context.Context, p *ProtectedBranch, userID int64) error {
-	return removeIDsFromProtectedBranch(ctx, p, userID, 0)
+	columnNames := []string{
+		"whitelist_user_i_ds",
+		"force_push_allowlist_user_i_ds",
+		"merge_whitelist_user_i_ds",
+		"approvals_whitelist_user_i_ds",
+	}
+	return removeIDsFromProtectedBranch(ctx, p, userID, 0, columnNames)
 }

 // RemoveTeamIDFromProtectedBranch removes all team ids from protected branch options
 func RemoveTeamIDFromProtectedBranch(ctx context.Context, p *ProtectedBranch, teamID int64) error {
-	return removeIDsFromProtectedBranch(ctx, p, 0, teamID)
-}
-
-func (protectBranch *ProtectedBranch) HasDeployKeyPush() bool {
-	return slices.Contains(protectBranch.WhitelistUserIDs, user_model.DeployKeyUserID)
-}
-
-func (protectBranch *ProtectedBranch) HasDeployKeyForcePush() bool {
-	return slices.Contains(protectBranch.ForcePushAllowlistUserIDs, user_model.DeployKeyUserID)
+	columnNames := []string{
+		"whitelist_team_i_ds",
+		"force_push_allowlist_team_i_ds",
+		"merge_whitelist_team_i_ds",
+		"approvals_whitelist_team_i_ds",
+	}
+	return removeIDsFromProtectedBranch(ctx, p, 0, teamID, columnNames)
 }
@@ -7,15 +7,11 @@ import (
 	"testing"

 	"gitea.dev/models/db"
-	"gitea.dev/models/perm"
-	access_model "gitea.dev/models/perm/access"
 	repo_model "gitea.dev/models/repo"
-	"gitea.dev/models/unit"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestBranchRuleMatch(t *testing.T) {
@@ -206,73 +202,3 @@ func TestCanBypassBranchProtection(t *testing.T) {
 	// User does not bypass when not in allowlisted teams.
 	testBypass(t, false, pb, user, false)
 }
-
-func TestProtectedBranchConfig(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	ctx := t.Context()
-	pb := &ProtectedBranch{
-		RepoID: 1, RuleName: "config-test",
-		ProtectedBranchConfig: ProtectedBranchConfig{
-			CanDelete: true, EnableDeletionAllowlist: true,
-			DeletionAllowlistUserIDs: []int64{2, 4, user_model.ActionsUserID, user_model.DeployKeyUserID}, DeletionAllowlistTeamIDs: []int64{1, 2},
-			CanPush: true, WhitelistUserIDs: []int64{2, 4}, WhitelistTeamIDs: []int64{1, 2}, StatusCheckContexts: []string{},
-		},
-	}
-	require.NoError(t, db.Insert(ctx, pb))
-	loaded := unittest.AssertExistsAndLoadBean(t, &ProtectedBranch{ID: pb.ID})
-	assert.Equal(t, pb.ProtectedBranchConfig, loaded.ProtectedBranchConfig)
-	require.NoError(t, RemoveUserIDFromProtectedBranch(ctx, loaded, 2))
-	require.NoError(t, RemoveTeamIDFromProtectedBranch(ctx, loaded, 1))
-	loaded = unittest.AssertExistsAndLoadBean(t, &ProtectedBranch{ID: pb.ID})
-	assert.Equal(t, []int64{4}, loaded.WhitelistUserIDs)
-	assert.Equal(t, []int64{2}, loaded.WhitelistTeamIDs)
-	assert.True(t, loaded.CanPush)
-	assert.True(t, loaded.CanDelete)
-	assert.True(t, loaded.EnableDeletionAllowlist)
-	assert.Equal(t, []int64{4, user_model.ActionsUserID, user_model.DeployKeyUserID}, loaded.DeletionAllowlistUserIDs)
-	assert.Equal(t, []int64{2}, loaded.DeletionAllowlistTeamIDs)
-	loaded.ProtectedBranchConfig = ProtectedBranchConfig{}
-	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
-	require.NoError(t, UpdateProtectBranch(ctx, repo, loaded, WhitelistOptions{}))
-	loaded = unittest.AssertExistsAndLoadBean(t, &ProtectedBranch{ID: pb.ID})
-	assert.Equal(t, ProtectedBranchConfig{}, loaded.ProtectedBranchConfig)
-}
-
-func TestProtectedBranchCanUserDelete(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	writePermission := access_model.Permission{}
-	writePermission.SetUnitsWithDefaultAccessMode([]*repo_model.RepoUnit{{Type: unit.TypeCode}}, perm.AccessModeWrite)
-	readPermission := access_model.Permission{}
-	readPermission.SetUnitsWithDefaultAccessMode([]*repo_model.RepoUnit{{Type: unit.TypeCode}}, perm.AccessModeRead)
-
-	for _, user := range []*user_model.User{{ID: 2, Name: "user2"}, user_model.NewActionsUser(), user_model.NewDeployKeyUser()} {
-		t.Run(user.GetDisplayName(), func(t *testing.T) {
-			for _, tt := range []struct {
-				name   string
-				config ProtectedBranchConfig
-				want   bool
-			}{
-				{name: "disabled by default", config: ProtectedBranchConfig{CanPush: true}},
-				{name: "push disabled", config: ProtectedBranchConfig{CanDelete: true}},
-				{name: "unrestricted", config: ProtectedBranchConfig{CanPush: true, CanDelete: true}, want: true},
-				{name: "empty push allowlist", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableWhitelist: true}},
-				{name: "not in push allowlist", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableWhitelist: true, WhitelistUserIDs: []int64{1}}},
-				{name: "empty deletion allowlist", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableDeletionAllowlist: true}},
-				{name: "not in deletion allowlist", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableDeletionAllowlist: true, DeletionAllowlistUserIDs: []int64{1}}},
-				{name: "in both allowlists", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableWhitelist: true, WhitelistUserIDs: []int64{user.ID}, EnableDeletionAllowlist: true, DeletionAllowlistUserIDs: []int64{user.ID}}, want: true},
-				{name: "deletion allowlist does not grant push", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableWhitelist: true, EnableDeletionAllowlist: true, DeletionAllowlistUserIDs: []int64{user.ID}}},
-				{name: "team member", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableDeletionAllowlist: true, DeletionAllowlistTeamIDs: []int64{1}}, want: user.ID == 2},
-				{name: "push team member", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableWhitelist: true, WhitelistTeamIDs: []int64{1}}, want: user.ID == 2},
-				{name: "not in team", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableDeletionAllowlist: true, DeletionAllowlistTeamIDs: []int64{3}}},
-				{name: "user or team", config: ProtectedBranchConfig{CanPush: true, CanDelete: true, EnableDeletionAllowlist: true, DeletionAllowlistUserIDs: []int64{user.ID}, DeletionAllowlistTeamIDs: []int64{3}}, want: true},
-			} {
-				t.Run(tt.name, func(t *testing.T) {
-					pb := &ProtectedBranch{ProtectedBranchConfig: tt.config}
-					assert.Equal(t, tt.want, pb.CanUserDelete(t.Context(), user, writePermission))
-					assert.False(t, pb.CanUserDelete(t.Context(), user, readPermission))
-					assert.False(t, pb.CanUserDelete(t.Context(), nil, writePermission))
-				})
-			}
-		})
-	}
-}
@@ -188,5 +188,5 @@ func MakeIDsFromAPIAssigneesToAdd(ctx context.Context, oneAssignee string, multi
 	}

 	// Get the IDs of all assignees
-	return user_model.GetDoerUserIDsByNames(ctx, requestAssignees)
+	return user_model.GetUserIDsByNames(ctx, requestAssignees, false)
 }
@@ -65,7 +65,7 @@ type CommentType int
 const CommentTypeUndefined CommentType = -1

 const (
-	CommentTypeComment CommentType = iota // 0 Plain comment, can be associated with "commit_sha" and a non-zero "line"
+	CommentTypeComment CommentType = iota // 0 Plain comment, can be associated with a commit (CommitID > 0) and a line (LineNum > 0)

 	CommentTypeReopen // 1
 	CommentTypeClose  // 2
@@ -253,57 +253,46 @@ type CommentMetaData struct {

 // Comment represents a comment in commit and issue page.
 type Comment struct {
-	ID   int64 `xorm:"pk autoincr"`
-	Type CommentType
-
-	PosterID int64            `xorm:"INDEX"`
-	Poster   *user_model.User `xorm:"-"`
-
+	ID               int64            `xorm:"pk autoincr"`
+	Type             CommentType      `xorm:"INDEX"`
+	PosterID         int64            `xorm:"INDEX"`
+	Poster           *user_model.User `xorm:"-"`
 	OriginalAuthor   string
 	OriginalAuthorID int64
-
-	IssueID int64  `xorm:"INDEX"`
-	Issue   *Issue `xorm:"-"`
-
-	LabelID       int64
-	Label         *Label   `xorm:"-"`
-	AddedLabels   []*Label `xorm:"-"`
-	RemovedLabels []*Label `xorm:"-"`
-
-	OldProjectID int64
-	ProjectID    int64
-	OldProject   *project_model.Project `xorm:"-"`
-	Project      *project_model.Project `xorm:"-"`
-
-	OldMilestoneID int64
-	MilestoneID    int64
-	OldMilestone   *Milestone `xorm:"-"`
-	Milestone      *Milestone `xorm:"-"`
-
-	TimeID int64
-	Time   *TrackedTime `xorm:"-"`
-
-	AssigneeID      int64
-	RemovedAssignee bool
-	Assignee        *user_model.User   `xorm:"-"`
-	AssigneeTeamID  int64              `xorm:"NOT NULL DEFAULT 0"`
-	AssigneeTeam    *organization.Team `xorm:"-"`
-
-	ResolveDoerID int64
-	ResolveDoer   *user_model.User `xorm:"-"`
-
-	OldTitle string
-	NewTitle string
-	OldRef   string
-	NewRef   string
-
+	IssueID          int64  `xorm:"INDEX"`
+	Issue            *Issue `xorm:"-"`
+	LabelID          int64
+	Label            *Label   `xorm:"-"`
+	AddedLabels      []*Label `xorm:"-"`
+	RemovedLabels    []*Label `xorm:"-"`
+	OldProjectID     int64
+	ProjectID        int64
+	OldProject       *project_model.Project `xorm:"-"`
+	Project          *project_model.Project `xorm:"-"`
+	OldMilestoneID   int64
+	MilestoneID      int64
+	OldMilestone     *Milestone `xorm:"-"`
+	Milestone        *Milestone `xorm:"-"`
+	TimeID           int64
+	Time             *TrackedTime `xorm:"-"`
+	AssigneeID       int64
+	RemovedAssignee  bool
+	Assignee         *user_model.User   `xorm:"-"`
+	AssigneeTeamID   int64              `xorm:"NOT NULL DEFAULT 0"`
+	AssigneeTeam     *organization.Team `xorm:"-"`
+	ResolveDoerID    int64
+	ResolveDoer      *user_model.User `xorm:"-"`
+	OldTitle         string
+	NewTitle         string
+	OldRef           string
+	NewRef           string
 	DependentIssueID int64  `xorm:"index"` // This is used by issue_service.deleteIssue
 	DependentIssue   *Issue `xorm:"-"`

-	Line     int64  // - previous line / + proposed line
-	TreePath string `xorm:"VARCHAR(4000)"` // SQLServer only supports up to 4000
-	Content  string `xorm:"LONGTEXT"`
-
+	CommitID        int64
+	Line            int64         // - previous line / + proposed line
+	TreePath        string        `xorm:"VARCHAR(4000)"` // SQLServer only supports up to 4000
+	Content         string        `xorm:"LONGTEXT"`
 	ContentVersion  int           `xorm:"NOT NULL DEFAULT 0"`
 	RenderedContent template.HTML `xorm:"-"`

@@ -335,12 +324,12 @@ type Comment struct {
 	RefAction    references.XRefAction `xorm:"SMALLINT"` // What happens if RefIssueID resolves
 	RefIsPull    bool

+	CommentMetaData *CommentMetaData `xorm:"JSON TEXT"` // put all non-index metadata in a single field
+
 	RefRepo    *repo_model.Repository `xorm:"-"`
 	RefIssue   *Issue                 `xorm:"-"`
 	RefComment *Comment               `xorm:"-"`

-	CommentMetaData *CommentMetaData `xorm:"JSON TEXT"` // put all non-index metadata in a single field
-
 	Commits    []*git_model.SignCommitWithStatuses `xorm:"-"`
 	OldCommit  string                              `xorm:"-"`
 	NewCommit  string                              `xorm:"-"`
@@ -725,7 +714,10 @@ func (c *Comment) LoadReactions(ctx context.Context, repo *repo_model.Repository
 	if c.Reactions != nil {
 		return nil
 	}
-	c.Reactions, _, err = FindReactions(ctx, FindReactionsOptions{CommentID: c.ID})
+	c.Reactions, _, err = FindReactions(ctx, FindReactionsOptions{
+		IssueID:   c.IssueID,
+		CommentID: c.ID,
+	})
 	if err != nil {
 		return err
 	}
@@ -857,6 +849,7 @@ func CreateComment(ctx context.Context, opts *CreateCommentOptions) (_ *Comment,
 			RemovedAssignee:  opts.RemovedAssignee,
 			AssigneeID:       opts.AssigneeID,
 			AssigneeTeamID:   opts.AssigneeTeamID,
+			CommitID:         opts.CommitID,
 			CommitSHA:        opts.CommitSHA,
 			Line:             opts.LineNum,
 			Content:          opts.Content,
@@ -1022,6 +1015,7 @@ type CreateCommentOptions struct {
 	NewTitle           string
 	OldRef             string
 	NewRef             string
+	CommitID           int64
 	CommitSHA          string
 	Patch              string
 	LineNum            int64
@@ -1207,7 +1201,7 @@ func DeleteComment(ctx context.Context, comment *Comment) error {
 		return err
 	}

-	return DeleteCommentAllReactions(ctx, comment.ID)
+	return DeleteReaction(ctx, &ReactionOptions{CommentID: comment.ID})
 }

 // UpdateCommentsMigrationsByType updates comments' migrations information via given git service type and original id and poster id
@@ -1264,6 +1258,45 @@ func (c *Comment) GetExternalName() string { return c.OriginalAuthor }
 // GetExternalID ExternalUserRemappable interface
 func (c *Comment) GetExternalID() int64 { return c.OriginalAuthorID }

+// CountCommentTypeLabelWithEmptyLabel count label comments with empty label
+func CountCommentTypeLabelWithEmptyLabel(ctx context.Context) (int64, error) {
+	return db.GetEngine(ctx).Where(builder.Eq{"type": CommentTypeLabel, "label_id": 0}).Count(new(Comment))
+}
+
+// FixCommentTypeLabelWithEmptyLabel count label comments with empty label
+func FixCommentTypeLabelWithEmptyLabel(ctx context.Context) (int64, error) {
+	return db.GetEngine(ctx).Where(builder.Eq{"type": CommentTypeLabel, "label_id": 0}).Delete(new(Comment))
+}
+
+// CountCommentTypeLabelWithOutsideLabels count label comments with outside label
+func CountCommentTypeLabelWithOutsideLabels(ctx context.Context) (int64, error) {
+	return db.GetEngine(ctx).Where("comment.type = ? AND ((label.org_id = 0 AND issue.repo_id != label.repo_id) OR (label.repo_id = 0 AND label.org_id != repository.owner_id))", CommentTypeLabel).
+		Table("comment").
+		Join("inner", "label", "label.id = comment.label_id").
+		Join("inner", "issue", "issue.id = comment.issue_id ").
+		Join("inner", "repository", "issue.repo_id = repository.id").
+		Count()
+}
+
+// FixCommentTypeLabelWithOutsideLabels count label comments with outside label
+func FixCommentTypeLabelWithOutsideLabels(ctx context.Context) (int64, error) {
+	res, err := db.GetEngine(ctx).Exec(`DELETE FROM comment WHERE comment.id IN (
+		SELECT il_too.id FROM (
+			SELECT com.id
+				FROM comment AS com
+					INNER JOIN label ON com.label_id = label.id
+					INNER JOIN issue on issue.id = com.issue_id
+					INNER JOIN repository ON issue.repo_id = repository.id
+				WHERE
+					com.type = ? AND ((label.org_id = 0 AND issue.repo_id != label.repo_id) OR (label.repo_id = 0 AND label.org_id != repository.owner_id))
+	) AS il_too)`, CommentTypeLabel)
+	if err != nil {
+		return 0, err
+	}
+
+	return res.RowsAffected()
+}
+
 // HasOriginalAuthor returns if a comment was migrated and has an original author.
 func (c *Comment) HasOriginalAuthor() bool {
 	return c.OriginalAuthor != "" && c.OriginalAuthorID != 0
@@ -56,15 +56,28 @@ func (comments CommentList) loadLabels(ctx context.Context) error {
 		return nil
 	}
 	commentLabels := make(map[int64]*Label, len(labelIDs))
-	err := db.QueryAndProcessByChunk(labelIDs, func(chunk []int64) (out []*Label, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(label *Label) error {
-		commentLabels[label.ID] = label
-		return nil
-	})
-	if err != nil {
-		return err
+	left := len(labelIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).
+			In("id", labelIDs[:limit]).
+			Rows(new(Label))
+		if err != nil {
+			return err
+		}
+
+		for rows.Next() {
+			var label Label
+			err = rows.Scan(&label)
+			if err != nil {
+				_ = rows.Close()
+				return err
+			}
+			commentLabels[label.ID] = &label
+		}
+		_ = rows.Close()
+		left -= limit
+		labelIDs = labelIDs[limit:]
 	}

 	for _, comment := range comments {
@@ -90,15 +103,17 @@ func (comments CommentList) loadMilestones(ctx context.Context) error {
 	}

 	milestoneMaps := make(map[int64]*Milestone, len(milestoneIDs))
-	err := db.QueryAndProcessByChunk(milestoneIDs, func(chunk []int64) (out []*Milestone, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(milestone *Milestone) error {
-		milestoneMaps[milestone.ID] = milestone
-		return nil
-	})
-	if err != nil {
-		return err
+	left := len(milestoneIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		err := db.GetEngine(ctx).
+			In("id", milestoneIDs[:limit]).
+			Find(&milestoneMaps)
+		if err != nil {
+			return err
+		}
+		left -= limit
+		milestoneIDs = milestoneIDs[limit:]
 	}

 	for _, comment := range comments {
@@ -124,15 +139,17 @@ func (comments CommentList) loadOldMilestones(ctx context.Context) error {
 	}

 	milestoneMaps := make(map[int64]*Milestone, len(milestoneIDs))
-	err := db.QueryAndProcessByChunk(milestoneIDs, func(chunk []int64) (out []*Milestone, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(milestone *Milestone) error {
-		milestoneMaps[milestone.ID] = milestone
-		return nil
-	})
-	if err != nil {
-		return err
+	left := len(milestoneIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		err := db.GetEngine(ctx).
+			In("id", milestoneIDs[:limit]).
+			Find(&milestoneMaps)
+		if err != nil {
+			return err
+		}
+		left -= limit
+		milestoneIDs = milestoneIDs[limit:]
 	}

 	for _, issue := range comments {
@@ -157,15 +174,30 @@ func (comments CommentList) loadAssignees(ctx context.Context) error {
 		return nil
 	}
 	assignees := make(map[int64]*user_model.User, len(assigneeIDs))
-	err := db.QueryAndProcessByChunk(assigneeIDs, func(chunk []int64) (out []*user_model.User, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(user *user_model.User) error {
-		assignees[user.ID] = user
-		return nil
-	})
-	if err != nil {
-		return err
+	left := len(assigneeIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).
+			In("id", assigneeIDs[:limit]).
+			Rows(new(user_model.User))
+		if err != nil {
+			return err
+		}
+
+		for rows.Next() {
+			var user user_model.User
+			err = rows.Scan(&user)
+			if err != nil {
+				rows.Close()
+				return err
+			}
+
+			assignees[user.ID] = &user
+		}
+		_ = rows.Close()
+
+		left -= limit
+		assigneeIDs = assigneeIDs[limit:]
 	}

 	for _, comment := range comments {
@@ -214,15 +246,30 @@ func (comments CommentList) LoadIssues(ctx context.Context) error {

 	issueIDs := comments.getIssueIDs()
 	issues := make(map[int64]*Issue, len(issueIDs))
-	err := db.QueryAndProcessByChunk(issueIDs, func(chunk []int64) (out []*Issue, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(issue *Issue) error {
-		issues[issue.ID] = issue
-		return nil
-	})
-	if err != nil {
-		return err
+	left := len(issueIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).
+			In("id", issueIDs[:limit]).
+			Rows(new(Issue))
+		if err != nil {
+			return err
+		}
+
+		for rows.Next() {
+			var issue Issue
+			err = rows.Scan(&issue)
+			if err != nil {
+				rows.Close()
+				return err
+			}
+
+			issues[issue.ID] = &issue
+		}
+		_ = rows.Close()
+
+		left -= limit
+		issueIDs = issueIDs[limit:]
 	}

 	for _, comment := range comments {
@@ -247,20 +294,36 @@ func (comments CommentList) loadDependentIssues(ctx context.Context) error {
 		return nil
 	}

+	e := db.GetEngine(ctx)
 	issueIDs := comments.getDependentIssueIDs()
 	if len(issueIDs) == 0 {
 		return nil
 	}
 	issues := make(map[int64]*Issue, len(issueIDs))
-	err := db.QueryAndProcessByChunk(issueIDs, func(chunk []int64) (out []*Issue, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(issue *Issue) error {
-		issues[issue.ID] = issue
-		return nil
-	})
-	if err != nil {
-		return err
+	left := len(issueIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := e.
+			In("id", issueIDs[:limit]).
+			Rows(new(Issue))
+		if err != nil {
+			return err
+		}
+
+		for rows.Next() {
+			var issue Issue
+			err = rows.Scan(&issue)
+			if err != nil {
+				_ = rows.Close()
+				return err
+			}
+
+			issues[issue.ID] = &issue
+		}
+		_ = rows.Close()
+
+		left -= limit
+		issueIDs = issueIDs[limit:]
 	}

 	for _, comment := range comments {
@@ -313,15 +376,29 @@ func (comments CommentList) LoadAttachments(ctx context.Context) (err error) {

 	attachments := make(map[int64][]*repo_model.Attachment, len(comments))
 	commentsIDs := comments.getAttachmentCommentIDs()
-	err = db.QueryAndProcessByChunk(commentsIDs, func(chunk []int64) (out []*repo_model.Attachment, err error) {
-		err = db.GetEngine(ctx).In("comment_id", chunk).Find(&out)
-		return out, err
-	}, func(attachment *repo_model.Attachment) error {
-		attachments[attachment.CommentID] = append(attachments[attachment.CommentID], attachment)
-		return nil
-	})
-	if err != nil {
-		return err
+	left := len(commentsIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).
+			In("comment_id", commentsIDs[:limit]).
+			Rows(new(repo_model.Attachment))
+		if err != nil {
+			return err
+		}
+
+		for rows.Next() {
+			var attachment repo_model.Attachment
+			err = rows.Scan(&attachment)
+			if err != nil {
+				_ = rows.Close()
+				return err
+			}
+			attachments[attachment.CommentID] = append(attachments[attachment.CommentID], &attachment)
+		}
+
+		_ = rows.Close()
+		left -= limit
+		commentsIDs = commentsIDs[limit:]
 	}

 	for _, comment := range comments {
@@ -14,7 +14,6 @@ import (
 	user_model "gitea.dev/models/user"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestCreateComment(t *testing.T) {
@@ -60,62 +59,17 @@ func TestLoadAssigneeUserAndTeam_DeletedTeamBecomesGhostTeam(t *testing.T) {
 }

 func TestCommentListLoadAttributesMixedAssignees(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	first := &issues_model.Comment{
-		ID: 1, PosterID: 1, IssueID: 1, LabelID: 1, MilestoneID: 1, OldMilestoneID: 1, AssigneeID: 1, DependentIssueID: 2,
-	}
-	last := &issues_model.Comment{
-		ID: 2, PosterID: 2, IssueID: 4, LabelID: 2, MilestoneID: 3, OldMilestoneID: 3, AssigneeID: 2, DependentIssueID: 1,
-	}
+	assert.NoError(t, unittest.PrepareTestDatabase())
 	comments := issues_model.CommentList{
 		{AssigneeTeamID: 8},
 		{AssigneeID: 999999},
-		first,
 	}
-	for i := range db.DefaultMaxInSize {
-		id := unittest.NonexistentID - int64(i)
-		comments = append(comments, &issues_model.Comment{
-			ID: id, PosterID: id, IssueID: id, LabelID: id, MilestoneID: id, OldMilestoneID: id, AssigneeID: id, DependentIssueID: id,
-		})
-	}
-	comments = append(comments, last)

-	require.NoError(t, comments.LoadAttributes(t.Context()))
+	assert.NoError(t, comments.LoadAttributes(t.Context()))
 	assert.Nil(t, comments[0].Assignee)
 	assert.Zero(t, comments[0].AssigneeID)
 	assert.Equal(t, user_model.GhostUserID, comments[1].AssigneeID)
 	assert.Equal(t, user_model.GhostUserID, comments[1].Assignee.ID)
-	for _, comment := range []*issues_model.Comment{first, last} {
-		require.NotNil(t, comment.Poster)
-		assert.Equal(t, comment.PosterID, comment.Poster.ID)
-		require.NotNil(t, comment.Issue)
-		assert.Equal(t, comment.IssueID, comment.Issue.ID)
-		require.NotNil(t, comment.Label)
-		assert.Equal(t, comment.LabelID, comment.Label.ID)
-		require.NotNil(t, comment.Milestone)
-		assert.Equal(t, comment.MilestoneID, comment.Milestone.ID)
-		require.NotNil(t, comment.OldMilestone)
-		assert.Equal(t, comment.OldMilestoneID, comment.OldMilestone.ID)
-		require.NotNil(t, comment.Assignee)
-		assert.Equal(t, comment.AssigneeID, comment.Assignee.ID)
-		require.NotNil(t, comment.DependentIssue)
-		assert.Equal(t, comment.DependentIssueID, comment.DependentIssue.ID)
-		require.NotNil(t, comment.DependentIssue.Repo)
-		assert.Equal(t, comment.DependentIssue.RepoID, comment.DependentIssue.Repo.ID)
-		require.Len(t, comment.Attachments, 2)
-		for _, attachment := range comment.Attachments {
-			assert.Equal(t, comment.ID, attachment.CommentID)
-		}
-	}
-	missing := comments[3]
-	assert.Equal(t, user_model.GhostUserID, missing.Poster.ID)
-	assert.Equal(t, user_model.GhostUserID, missing.Assignee.ID)
-	assert.Nil(t, missing.Issue)
-	assert.Nil(t, missing.Label)
-	assert.Nil(t, missing.Milestone)
-	assert.Nil(t, missing.OldMilestone)
-	assert.Nil(t, missing.DependentIssue)
-	assert.Empty(t, missing.Attachments)
 }

 func Test_UpdateCommentAttachment(t *testing.T) {
@@ -225,11 +225,13 @@ func (issue *Issue) loadCommentsByType(ctx context.Context, tp CommentType) (err
 	return err
 }

-func (issue *Issue) loadAllReactions(ctx context.Context) (err error) {
+func (issue *Issue) loadReactions(ctx context.Context) (err error) {
 	if issue.Reactions != nil {
 		return nil
 	}
-	reactions, _, err := FindReactions(ctx, FindReactionsOptions{IssueIDWithComments: issue.ID})
+	reactions, _, err := FindReactions(ctx, FindReactionsOptions{
+		IssueID: issue.ID,
+	})
 	if err != nil {
 		return err
 	}
@@ -338,7 +340,7 @@ func (issue *Issue) LoadAttributes(ctx context.Context) (err error) {
 		}
 	}

-	return issue.loadAllReactions(ctx)
+	return issue.loadReactions(ctx)
 }

 // IsPinned returns if a Issue is pinned
@@ -282,6 +282,35 @@ func DeleteOrphanedIssueLabels(ctx context.Context) error {
 	return err
 }

+// CountIssueLabelWithOutsideLabels count label comments with outside label
+func CountIssueLabelWithOutsideLabels(ctx context.Context) (int64, error) {
+	return db.GetEngine(ctx).Where(builder.Expr("(label.org_id = 0 AND issue.repo_id != label.repo_id) OR (label.repo_id = 0 AND label.org_id != repository.owner_id)")).
+		Table("issue_label").
+		Join("inner", "label", "issue_label.label_id = label.id ").
+		Join("inner", "issue", "issue.id = issue_label.issue_id ").
+		Join("inner", "repository", "issue.repo_id = repository.id").
+		Count(new(IssueLabel))
+}
+
+// FixIssueLabelWithOutsideLabels fix label comments with outside label
+func FixIssueLabelWithOutsideLabels(ctx context.Context) (int64, error) {
+	res, err := db.GetEngine(ctx).Exec(`DELETE FROM issue_label WHERE issue_label.id IN (
+		SELECT il_too.id FROM (
+			SELECT il_too_too.id
+				FROM issue_label AS il_too_too
+					INNER JOIN label ON il_too_too.label_id = label.id
+					INNER JOIN issue on issue.id = il_too_too.issue_id
+					INNER JOIN repository on repository.id = issue.repo_id
+				WHERE
+					(label.org_id = 0 AND issue.repo_id != label.repo_id) OR (label.repo_id = 0 AND label.org_id != repository.owner_id)
+	) AS il_too )`)
+	if err != nil {
+		return 0, err
+	}
+
+	return res.RowsAffected()
+}
+
 // LoadLabels loads labels
 func (issue *Issue) LoadLabels(ctx context.Context) (err error) {
 	if !issue.isLabelsLoaded && issue.Labels == nil && issue.ID != 0 {
@@ -40,15 +40,17 @@ func (issues IssueList) LoadRepositories(ctx context.Context) (repo_model.Reposi

 	repoIDs := issues.getRepoIDs()
 	repoMaps := make(map[int64]*repo_model.Repository, len(repoIDs))
-	err := db.QueryAndProcessByChunk(repoIDs, func(chunk []int64) (out []*repo_model.Repository, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(repo *repo_model.Repository) error {
-		repoMaps[repo.ID] = repo
-		return nil
-	})
-	if err != nil {
-		return nil, fmt.Errorf("find repository: %w", err)
+	left := len(repoIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		err := db.GetEngine(ctx).
+			In("id", repoIDs[:limit]).
+			Find(&repoMaps)
+		if err != nil {
+			return nil, fmt.Errorf("find repository: %w", err)
+		}
+		left -= limit
+		repoIDs = repoIDs[limit:]
 	}

 	for _, issue := range issues {
@@ -109,20 +111,36 @@ func (issues IssueList) LoadLabels(ctx context.Context) error {

 	issueLabels := make(map[int64][]*Label, len(issues)*3)
 	issueIDs := issues.getIssueIDs()
-
-	err := db.QueryAndProcessByChunk(issueIDs, func(chunk []int64) (out []*LabelIssue, err error) {
-		err = db.GetEngine(ctx).Table("label").
+	left := len(issueIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).Table("label").
 			Join("LEFT", "issue_label", "issue_label.label_id = label.id").
-			In("issue_label.issue_id", chunk).
+			In("issue_label.issue_id", issueIDs[:limit]).
 			Asc("label.name").
-			Find(&out)
-		return out, err
-	}, func(out *LabelIssue) error {
-		issueLabels[out.IssueLabel.IssueID] = append(issueLabels[out.IssueLabel.IssueID], out.Label)
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("IssueList.LoadLabels: %w", err)
+			Rows(new(LabelIssue))
+		if err != nil {
+			return err
+		}
+
+		for rows.Next() {
+			var labelIssue LabelIssue
+			err = rows.Scan(&labelIssue)
+			if err != nil {
+				if err1 := rows.Close(); err1 != nil {
+					return fmt.Errorf("IssueList.LoadLabels: Close: %w", err1)
+				}
+				return err
+			}
+			issueLabels[labelIssue.IssueLabel.IssueID] = append(issueLabels[labelIssue.IssueLabel.IssueID], labelIssue.Label)
+		}
+		// When there are no rows left and we try to close it.
+		// Since that is not relevant for us, we can safely ignore it.
+		if err1 := rows.Close(); err1 != nil {
+			return fmt.Errorf("IssueList.LoadLabels: Close: %w", err1)
+		}
+		left -= limit
+		issueIDs = issueIDs[limit:]
 	}

 	for _, issue := range issues {
@@ -145,15 +163,17 @@ func (issues IssueList) LoadMilestones(ctx context.Context) error {
 	}

 	milestoneMaps := make(map[int64]*Milestone, len(milestoneIDs))
-	err := db.QueryAndProcessByChunk(milestoneIDs, func(chunk []int64) (out []*Milestone, err error) {
-		err = db.GetEngine(ctx).In("id", chunk).Find(&out)
-		return out, err
-	}, func(milestone *Milestone) error {
-		milestoneMaps[milestone.ID] = milestone
-		return nil
-	})
-	if err != nil {
-		return err
+	left := len(milestoneIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		err := db.GetEngine(ctx).
+			In("id", milestoneIDs[:limit]).
+			Find(&milestoneMaps)
+		if err != nil {
+			return err
+		}
+		left -= limit
+		milestoneIDs = milestoneIDs[limit:]
 	}

 	for _, issue := range issues {
@@ -166,27 +186,32 @@ func (issues IssueList) LoadMilestones(ctx context.Context) error {
 func (issues IssueList) LoadProjects(ctx context.Context) error {
 	issueIDs := issues.getIssueIDs()
 	issueProjectMaps := make(map[int64][]*project_model.Project, len(issues))
+	left := len(issueIDs)

 	type projectWithIssueID struct {
 		*project_model.Project `xorm:"extends"`
 		IssueID                int64
 	}

-	err := db.QueryAndProcessByChunk(issueIDs, func(chunk []int64) (out []*projectWithIssueID, err error) {
-		err = db.GetEngine(ctx).
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+
+		projects := make([]*projectWithIssueID, 0, limit)
+		err := db.GetEngine(ctx).
 			Table("project").
 			Select("project.*, project_issue.issue_id").
 			Join("INNER", "project_issue", "project.id = project_issue.project_id").
-			In("project_issue.issue_id", chunk).
+			In("project_issue.issue_id", issueIDs[:limit]).
 			OrderBy("project_issue.issue_id ASC, project.id ASC").
-			Find(&out)
-		return out, err
-	}, func(project *projectWithIssueID) error {
-		issueProjectMaps[project.IssueID] = append(issueProjectMaps[project.IssueID], project.Project)
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("IssueList.LoadProjects: %w", err)
+			Find(&projects)
+		if err != nil {
+			return err
+		}
+		for _, project := range projects {
+			issueProjectMaps[project.IssueID] = append(issueProjectMaps[project.IssueID], project.Project)
+		}
+		left -= limit
+		issueIDs = issueIDs[limit:]
 	}

 	for _, issue := range issues {
@@ -208,18 +233,34 @@ func (issues IssueList) LoadAssignees(ctx context.Context) error {

 	assignees := make(map[int64][]*user_model.User, len(issues))
 	issueIDs := issues.getIssueIDs()
-	err := db.QueryAndProcessByChunk(issueIDs, func(chunk []int64) (out []*AssigneeIssue, err error) {
-		err = db.GetEngine(ctx).Table("issue_assignees").
+	left := len(issueIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).Table("issue_assignees").
 			Join("INNER", "`user`", "`user`.id = `issue_assignees`.assignee_id").
-			In("`issue_assignees`.issue_id", chunk).OrderBy(user_model.GetOrderByName()).
-			Find(&out)
-		return out, err
-	}, func(assigneeIssue *AssigneeIssue) error {
-		assignees[assigneeIssue.IssueAssignee.IssueID] = append(assignees[assigneeIssue.IssueAssignee.IssueID], assigneeIssue.Assignee)
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("IssueList.LoadAssignees: %w", err)
+			In("`issue_assignees`.issue_id", issueIDs[:limit]).OrderBy(user_model.GetOrderByName()).
+			Rows(new(AssigneeIssue))
+		if err != nil {
+			return err
+		}
+
+		for rows.Next() {
+			var assigneeIssue AssigneeIssue
+			err = rows.Scan(&assigneeIssue)
+			if err != nil {
+				if err1 := rows.Close(); err1 != nil {
+					return fmt.Errorf("IssueList.loadAssignees: Close: %w", err1)
+				}
+				return err
+			}
+
+			assignees[assigneeIssue.IssueAssignee.IssueID] = append(assignees[assigneeIssue.IssueAssignee.IssueID], assigneeIssue.Assignee)
+		}
+		if err1 := rows.Close(); err1 != nil {
+			return fmt.Errorf("IssueList.loadAssignees: Close: %w", err1)
+		}
+		left -= limit
+		issueIDs = issueIDs[limit:]
 	}

 	for _, issue := range issues {
@@ -250,17 +291,32 @@ func (issues IssueList) LoadPullRequests(ctx context.Context) error {
 	}

 	pullRequestMaps := make(map[int64]*PullRequest, len(issuesIDs))
-	err := db.QueryAndProcessByChunk(issuesIDs, func(chunk []int64) (out []*PullRequest, err error) {
-		err = db.GetEngine(ctx).
-			In("issue_id", chunk).
-			Find(&out)
-		return out, err
-	}, func(pr *PullRequest) error {
-		pullRequestMaps[pr.IssueID] = pr
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("IssueList.LoadPullRequests: %w", err)
+	left := len(issuesIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).
+			In("issue_id", issuesIDs[:limit]).
+			Rows(new(PullRequest))
+		if err != nil {
+			return err
+		}
+
+		for rows.Next() {
+			var pr PullRequest
+			err = rows.Scan(&pr)
+			if err != nil {
+				if err1 := rows.Close(); err1 != nil {
+					return fmt.Errorf("IssueList.loadPullRequests: Close: %w", err1)
+				}
+				return err
+			}
+			pullRequestMaps[pr.IssueID] = &pr
+		}
+		if err1 := rows.Close(); err1 != nil {
+			return fmt.Errorf("IssueList.loadPullRequests: Close: %w", err1)
+		}
+		left -= limit
+		issuesIDs = issuesIDs[limit:]
 	}

 	for _, issue := range issues {
@@ -280,15 +336,32 @@ func (issues IssueList) LoadAttachments(ctx context.Context) (err error) {

 	attachments := make(map[int64][]*repo_model.Attachment, len(issues))
 	issuesIDs := issues.getIssueIDs()
-	err = db.QueryAndProcessByChunk(issuesIDs, func(chunk []int64) (out []*repo_model.Attachment, err error) {
-		err = db.GetEngine(ctx).In("issue_id", chunk).Find(&out)
-		return out, err
-	}, func(attachment *repo_model.Attachment) error {
-		attachments[attachment.IssueID] = append(attachments[attachment.IssueID], attachment)
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("IssueList.LoadAttachments: %w", err)
+	left := len(issuesIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).
+			In("issue_id", issuesIDs[:limit]).
+			Rows(new(repo_model.Attachment))
+		if err != nil {
+			return err
+		}
+
+		for rows.Next() {
+			var attachment repo_model.Attachment
+			err = rows.Scan(&attachment)
+			if err != nil {
+				if err1 := rows.Close(); err1 != nil {
+					return fmt.Errorf("IssueList.loadAttachments: Close: %w", err1)
+				}
+				return err
+			}
+			attachments[attachment.IssueID] = append(attachments[attachment.IssueID], &attachment)
+		}
+		if err1 := rows.Close(); err1 != nil {
+			return fmt.Errorf("IssueList.loadAttachments: Close: %w", err1)
+		}
+		left -= limit
+		issuesIDs = issuesIDs[limit:]
 	}

 	for _, issue := range issues {
@@ -305,20 +378,35 @@ func (issues IssueList) loadComments(ctx context.Context, cond builder.Cond) (er

 	comments := make(map[int64][]*Comment, len(issues))
 	issuesIDs := issues.getIssueIDs()
-	err = db.QueryAndProcessByChunk(issuesIDs, func(chunk []int64) (out []*Comment, err error) {
-		err = db.GetEngine(ctx).Table("comment").
+	left := len(issuesIDs)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+		rows, err := db.GetEngine(ctx).Table("comment").
 			Join("INNER", "issue", "issue.id = comment.issue_id").
-			In("issue.id", chunk).
+			In("issue.id", issuesIDs[:limit]).
 			Where(cond).
 			NoAutoCondition().
-			Find(&out)
-		return out, err
-	}, func(comment *Comment) error {
-		comments[comment.IssueID] = append(comments[comment.IssueID], comment)
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("IssueList.loadComments: %w", err)
+			Rows(new(Comment))
+		if err != nil {
+			return err
+		}
+
+		for rows.Next() {
+			var comment Comment
+			err = rows.Scan(&comment)
+			if err != nil {
+				if err1 := rows.Close(); err1 != nil {
+					return fmt.Errorf("IssueList.loadComments: Close: %w", err1)
+				}
+				return err
+			}
+			comments[comment.IssueID] = append(comments[comment.IssueID], &comment)
+		}
+		if err1 := rows.Close(); err1 != nil {
+			return fmt.Errorf("IssueList.loadComments: Close: %w", err1)
+		}
+		left -= limit
+		issuesIDs = issuesIDs[limit:]
 	}

 	for _, issue := range issues {
@@ -354,21 +442,37 @@ func (issues IssueList) loadTotalTrackedTimes(ctx context.Context) (err error) {
 		}
 	}

-	err = db.QueryAndProcessByChunk(ids, func(chunk []int64) (out []*totalTimesByIssue, err error) {
+	left := len(ids)
+	for left > 0 {
+		limit := min(left, db.DefaultMaxInSize)
+
 		// select issue_id, sum(time) from tracked_time where issue_id in (<issue ids in current page>) group by issue_id
-		err = db.GetEngine(ctx).Table("tracked_time").
+		rows, err := db.GetEngine(ctx).Table("tracked_time").
 			Where("deleted = ?", false).
 			Select("issue_id, sum(time) as time").
-			In("issue_id", chunk).
+			In("issue_id", ids[:limit]).
 			GroupBy("issue_id").
-			Find(&out)
-		return out, err
-	}, func(totalTime *totalTimesByIssue) error {
-		trackedTimes[totalTime.IssueID] = totalTime.Time
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("IssueList.loadTotalTrackedTimes: %w", err)
+			Rows(new(totalTimesByIssue))
+		if err != nil {
+			return err
+		}
+
+		for rows.Next() {
+			var totalTime totalTimesByIssue
+			err = rows.Scan(&totalTime)
+			if err != nil {
+				if err1 := rows.Close(); err1 != nil {
+					return fmt.Errorf("IssueList.loadTotalTrackedTimes: Close: %w", err1)
+				}
+				return err
+			}
+			trackedTimes[totalTime.IssueID] = totalTime.Time
+		}
+		if err1 := rows.Close(); err1 != nil {
+			return fmt.Errorf("IssueList.loadTotalTrackedTimes: Close: %w", err1)
+		}
+		left -= limit
+		ids = ids[limit:]
 	}

 	for _, issue := range issues {
@@ -6,11 +6,9 @@ package issues_test
 import (
 	"testing"

-	"gitea.dev/models/db"
 	issues_model "gitea.dev/models/issues"
 	"gitea.dev/models/unittest"
 	"gitea.dev/modules/setting"
-	"gitea.dev/modules/test"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -50,36 +48,18 @@ func TestIssueList_LoadIsRead(t *testing.T) {
 }

 func TestIssueList_LoadAttributes(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-	defer test.MockVariableValue(&setting.Service.EnableTimetracking, true)()
-	fixtureIssues := issues_model.IssueList{
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	setting.Service.EnableTimetracking = true
+	issueList := issues_model.IssueList{
 		unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 1}),
-		unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 2}),
 		unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 4}),
 	}
-	issueList := issues_model.IssueList{fixtureIssues[0]}
-	for i := range db.DefaultMaxInSize {
-		issueList = append(issueList, &issues_model.Issue{ID: int64(1000 + i), RepoID: 1, IsPull: true})
-	}
-	issueList = append(issueList, fixtureIssues[1:]...)

-	require.NoError(t, issueList.LoadAttributes(t.Context()))
-	require.NoError(t, issueList.LoadAttachments(t.Context()))
-	require.NoError(t, issueList.LoadComments(t.Context()))
-	assert.Len(t, fixtureIssues[0].Labels, 1)
-	assert.Len(t, fixtureIssues[1].Labels, 2)
-	assert.Len(t, fixtureIssues[0].Assignees, 1)
-	assert.Empty(t, fixtureIssues[1].Assignees)
-	assert.Len(t, fixtureIssues[0].Attachments, 1)
-	assert.Len(t, fixtureIssues[1].Attachments, 1)
-	assert.Len(t, fixtureIssues[2].Attachments, 2)
-	assert.Len(t, fixtureIssues[0].Comments, 3)
-	assert.Len(t, fixtureIssues[1].Comments, 4)
-	assert.Len(t, fixtureIssues[2].Comments, 1)
-	for _, issue := range fixtureIssues {
+	assert.NoError(t, issueList.LoadAttributes(t.Context()))
+	for _, issue := range issueList {
 		assert.Equal(t, issue.RepoID, issue.Repo.ID)
 		for _, label := range issue.Labels {
-			assert.Equal(t, unittest.AssertExistsAndLoadBean(t, &issues_model.Label{ID: label.ID}), label)
+			assert.Equal(t, issue.RepoID, label.RepoID)
 			unittest.AssertExistsAndLoadBean(t, &issues_model.IssueLabel{IssueID: issue.ID, LabelID: label.ID})
 		}
 		if issue.PosterID > 0 {
@@ -92,9 +72,7 @@ func TestIssueList_LoadAttributes(t *testing.T) {
 			assert.Equal(t, issue.MilestoneID, issue.Milestone.ID)
 		}
 		if issue.IsPull {
-			require.NotNil(t, issue.PullRequest)
 			assert.Equal(t, issue.ID, issue.PullRequest.IssueID)
-			assert.Same(t, issue, issue.PullRequest.Issue)
 		}
 		for _, attachment := range issue.Attachments {
 			assert.Equal(t, issue.ID, attachment.IssueID)
@@ -104,24 +82,10 @@ func TestIssueList_LoadAttributes(t *testing.T) {
 		}
 		if issue.ID == int64(1) {
 			assert.Equal(t, int64(400), issue.TotalTrackedTime)
-		}
-		if issue.ID == 1 || issue.ID == 2 {
-			require.Len(t, issue.Projects, 1)
+			assert.NotEmpty(t, issue.Projects)
 			assert.Equal(t, int64(1), issue.Projects[0].ID)
 		} else {
 			assert.Empty(t, issue.Projects)
 		}
 	}
-	assert.Equal(t, int64(3682), fixtureIssues[1].TotalTrackedTime)
-
-	require.NoError(t, issueList.LoadDiscussComments(t.Context()))
-	assert.Len(t, fixtureIssues[0].Comments, 2)
-	assert.Empty(t, fixtureIssues[1].Comments)
-	assert.Len(t, fixtureIssues[2].Comments, 1)
-	for _, issue := range fixtureIssues {
-		for _, comment := range issue.Comments {
-			assert.Equal(t, issue.ID, comment.IssueID)
-			assert.Equal(t, issues_model.CommentTypeComment, comment.Type)
-		}
-	}
 }
@@ -283,7 +283,6 @@ func applyConditions(sess db.Session, opts *IssuesOptions) {
 		sess.And(repo_model.UserOwnedRepoCond(opts.Owner.ID))
 	}

-	sess.And(repo_model.DoerTokenRepoCond(opts.Doer))
 	if opts.Doer != nil && !opts.Doer.IsAdmin {
 		sess.And(issuePullAccessibleRepoCond("issue.repo_id", opts.Doer.ID, opts.Owner, opts.Team, opts.IsPull.Value()))
 	}
@@ -16,7 +16,6 @@ import (
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"
 	user_model "gitea.dev/models/user"
-	"gitea.dev/modules/optional"
 	"gitea.dev/modules/setting"
 	"gitea.dev/modules/test"

@@ -151,8 +150,6 @@ func TestUpdateIssueCols(t *testing.T) {

 func TestIssues(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
-	publicOnlyUser2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
-	publicOnlyUser2.ExtDoerData = user_model.NewTokenExtDoerData(user_model.CredentialAccessToken, 1, "public-only,read:issue")
 	for _, test := range []struct {
 		Opts             issues_model.IssuesOptions
 		ExpectedIssueIDs []int64
@@ -207,15 +204,6 @@ func TestIssues(t *testing.T) {
 			},
 			[]int64{11, 5, 9, 8, 3, 2, 1},
 		},
-		{
-			issues_model.IssuesOptions{
-				RepoCond: builder.In("repo_id", 1, 2),
-				Doer:     publicOnlyUser2,
-				IsPull:   optional.Some(false),
-				SortType: "oldest",
-			},
-			[]int64{1, 5},
-		},
 	} {
 		issues, err := issues_model.Issues(t.Context(), &test.Opts)
 		assert.NoError(t, err)
@@ -429,13 +429,12 @@ func GetLabelsByRepoID(ctx context.Context, repoID int64, sortType string, listO
 	case "reversealphabetically":
 		sess.Desc("name")
 	case "leastissues":
-		sess.OrderBy("num_issues - num_closed_issues ASC")
+		sess.Asc("num_issues")
 	case "mostissues":
-		sess.OrderBy("num_issues - num_closed_issues DESC")
+		sess.Desc("num_issues")
 	default:
 		sess.Asc("name")
 	}
-	sess.Asc("id")

 	if listOptions.Page > 0 {
 		db.SetSessionPagination(sess, &listOptions)
@@ -505,13 +504,12 @@ func GetLabelsByOrgID(ctx context.Context, orgID int64, sortType string, listOpt
 	case "reversealphabetically":
 		sess.Desc("name")
 	case "leastissues":
-		sess.OrderBy("num_issues - num_closed_issues ASC")
+		sess.Asc("num_issues")
 	case "mostissues":
-		sess.OrderBy("num_issues - num_closed_issues DESC")
+		sess.Desc("num_issues")
 	default:
 		sess.Asc("name")
 	}
-	sess.Asc("id")

 	if listOptions.Page > 0 {
 		db.SetSessionPagination(sess, &listOptions)
@@ -191,8 +191,6 @@ func TestGetLabelsInRepoByIDs(t *testing.T) {

 func TestGetLabelsByRepoID(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
-	_, err := db.GetEngine(t.Context()).ID(2).Cols("num_issues", "num_closed_issues").Update(&issues_model.Label{NumIssues: 3, NumClosedIssues: 3})
-	assert.NoError(t, err)
 	testSuccess := func(repoID int64, sortType string, expectedIssueIDs []int64) {
 		labels, err := issues_model.GetLabelsByRepoID(t.Context(), repoID, sortType, db.ListOptions{})
 		assert.NoError(t, err)
@@ -260,8 +258,6 @@ func TestGetLabelsInOrgByIDs(t *testing.T) {

 func TestGetLabelsByOrgID(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
-	_, err := db.GetEngine(t.Context()).ID(3).Cols("num_issues", "num_closed_issues").Update(&issues_model.Label{NumIssues: 3, NumClosedIssues: 3})
-	assert.NoError(t, err)
 	testSuccess := func(orgID int64, sortType string, expectedIssueIDs []int64) {
 		labels, err := issues_model.GetLabelsByOrgID(t.Context(), orgID, sortType, db.ListOptions{})
 		assert.NoError(t, err)
@@ -275,7 +271,7 @@ func TestGetLabelsByOrgID(t *testing.T) {
 	testSuccess(3, "reversealphabetically", []int64{4, 3})
 	testSuccess(3, "default", []int64{3, 4})

-	_, err = issues_model.GetLabelsByOrgID(t.Context(), 0, "leastissues", db.ListOptions{})
+	_, err := issues_model.GetLabelsByOrgID(t.Context(), 0, "leastissues", db.ListOptions{})
 	assert.True(t, issues_model.IsErrOrgLabelNotExist(err))

 	_, err = issues_model.GetLabelsByOrgID(t.Context(), -1, "leastissues", db.ListOptions{})
@@ -113,29 +113,36 @@ func (milestones MilestoneList) LoadTotalTrackedTimes(ctx context.Context) error
 	trackedTimes := make(map[int64]int64, len(milestones))

 	// Get total tracked time by milestone_id
-	var totalTimesByMilestones []*totalTimesByMilestone
-	err := db.GetEngine(ctx).Table("issue").
+	rows, err := db.GetEngine(ctx).Table("issue").
 		Join("INNER", "milestone", "issue.milestone_id = milestone.id").
 		Join("LEFT", "tracked_time", "tracked_time.issue_id = issue.id").
 		Where("tracked_time.deleted = ?", false).
 		Select("milestone_id, sum(time) as time").
 		In("milestone_id", milestones.getMilestoneIDs()).
 		GroupBy("milestone_id").
-		Find(&totalTimesByMilestones)
+		Rows(new(totalTimesByMilestone))
 	if err != nil {
 		return err
 	}

-	for _, totalTime := range totalTimesByMilestones {
+	defer rows.Close()
+
+	for rows.Next() {
+		var totalTime totalTimesByMilestone
+		err = rows.Scan(&totalTime)
+		if err != nil {
+			return err
+		}
 		trackedTimes[totalTime.MilestoneID] = totalTime.Time
 	}
+
 	for _, milestone := range milestones {
 		milestone.TotalTrackedTime = trackedTimes[milestone.ID]
 	}
 	return nil
 }

-// CountMilestonesMap map from repo conditions and the keyword of milestones' name to number of milestones matching the options`
+// CountMilestonesByRepoCondAndKw map from repo conditions and the keyword of milestones' name to number of milestones matching the options`
 func CountMilestonesMap(ctx context.Context, opts FindMilestoneOptions) (map[int64]int64, error) {
 	sess := db.GetEngine(ctx).Where(opts.ToConds())

@@ -58,20 +58,17 @@ func (err ErrReactionAlreadyExist) Unwrap() error {
 	return util.ErrAlreadyExist
 }

-// Reaction represents a reaction on an issue, comment or release.
+// Reaction represents a reactions on issues and comments.
 type Reaction struct {
-	ID int64 `xorm:"pk autoincr"`
-
-	UserID           int64  `xorm:"UNIQUE(s) NOT NULL"` // first unique column implies INDEX
-	IssueID          int64  `xorm:"UNIQUE(s) INDEX(issue_comment) NOT NULL"`
-	CommentID        int64  `xorm:"UNIQUE(s) INDEX(issue_comment) INDEX NOT NULL"`
-	ReleaseID        int64  `xorm:"UNIQUE(s) INDEX NOT NULL DEFAULT(0)"`
-	OriginalAuthorID int64  `xorm:"UNIQUE(s) NOT NULL DEFAULT(0)"`
-	OriginalAuthor   string `xorm:"UNIQUE(s) NOT NULL DEFAULT('')"`
-	Type             string `xorm:"UNIQUE(s) NOT NULL"`
-
-	User        *user_model.User   `xorm:"-"`
-	CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
+	ID               int64              `xorm:"pk autoincr"`
+	Type             string             `xorm:"INDEX UNIQUE(s) NOT NULL"`
+	IssueID          int64              `xorm:"INDEX UNIQUE(s) NOT NULL"`
+	CommentID        int64              `xorm:"INDEX UNIQUE(s)"`
+	UserID           int64              `xorm:"INDEX UNIQUE(s) NOT NULL"`
+	OriginalAuthorID int64              `xorm:"INDEX UNIQUE(s) NOT NULL DEFAULT(0)"`
+	OriginalAuthor   string             `xorm:"INDEX UNIQUE(s)"`
+	User             *user_model.User   `xorm:"-"`
+	CreatedUnix      timeutil.TimeStamp `xorm:"INDEX created"`
 }

 // LoadUser load user of reaction
@@ -111,48 +108,53 @@ func init() {
 // FindReactionsOptions describes the conditions to Find reactions
 type FindReactionsOptions struct {
 	db.ListOptions
-	IssueIDOnly         int64
-	IssueIDWithComments int64
-	CommentID           int64
-	ReleaseID           int64
-	UserID              int64
+	IssueID   int64
+	CommentID int64
+	UserID    int64
+	Reaction  string
 }

 func (opts *FindReactionsOptions) toConds() builder.Cond {
 	// If Issue ID is set add to Query
 	cond := builder.NewCond()
-	if opts.IssueIDOnly > 0 {
-		cond = cond.And(builder.Eq{"reaction.issue_id": opts.IssueIDOnly}).And(builder.Expr("reaction.comment_id = 0"))
-	}
-	if opts.IssueIDWithComments > 0 {
-		cond = cond.And(builder.Eq{"reaction.issue_id": opts.IssueIDWithComments})
+	if opts.IssueID > 0 {
+		cond = cond.And(builder.Eq{"reaction.issue_id": opts.IssueID})
 	}
+	// If CommentID is > 0 add to Query
+	// If it is 0 Query ignore CommentID to select
+	// If it is -1 it explicit search of Issue Reactions where CommentID = 0
 	if opts.CommentID > 0 {
 		cond = cond.And(builder.Eq{"reaction.comment_id": opts.CommentID})
-	}
-	if opts.ReleaseID > 0 {
-		cond = cond.And(builder.Eq{"reaction.release_id": opts.ReleaseID})
+	} else if opts.CommentID == -1 {
+		cond = cond.And(builder.Eq{"reaction.comment_id": 0})
 	}
 	if opts.UserID > 0 {
-		cond = cond.And(builder.Eq{"reaction.user_id": opts.UserID, "reaction.original_author_id": 0})
+		cond = cond.And(builder.Eq{
+			"reaction.user_id":            opts.UserID,
+			"reaction.original_author_id": 0,
+		})
 	}
-	if !cond.IsValid() {
-		setting.PanicInDevOrTesting("FindReactionsOptions.toConds: no conditions specified")
-		cond = cond.And(builder.Expr("1=0"))
+	if opts.Reaction != "" {
+		cond = cond.And(builder.Eq{"reaction.type": opts.Reaction})
 	}
+
 	return cond
 }

-// FindCommentReactions returns a ReactionList of all reactions from a comment
-func FindCommentReactions(ctx context.Context, commentID int64) (ReactionList, int64, error) {
-	return FindReactions(ctx, FindReactionsOptions{CommentID: commentID})
+// FindCommentReactions returns a ReactionList of all reactions from an comment
+func FindCommentReactions(ctx context.Context, issueID, commentID int64) (ReactionList, int64, error) {
+	return FindReactions(ctx, FindReactionsOptions{
+		IssueID:   issueID,
+		CommentID: commentID,
+	})
 }

 // FindIssueReactions returns a ReactionList of all reactions from an issue
 func FindIssueReactions(ctx context.Context, issueID int64, listOptions db.ListOptions) (ReactionList, int64, error) {
 	return FindReactions(ctx, FindReactionsOptions{
 		ListOptions: listOptions,
-		IssueIDOnly: issueID,
+		IssueID:     issueID,
+		CommentID:   -1,
 	})
 }

@@ -175,14 +177,37 @@ func FindReactions(ctx context.Context, opts FindReactionsOptions) (ReactionList
 	return reactions, count, err
 }

-func FindReleaseReactions(ctx context.Context, releaseIDs ...int64) (ReactionList, error) {
-	reactions := make(ReactionList, 0, 10)
-	err := db.GetEngine(ctx).
-		In("release_id", releaseIDs).
-		In("`type`", setting.UI.ReleaseReactions).
-		Asc("created_unix", "id").
-		Find(&reactions)
-	return reactions, err
+func createReaction(ctx context.Context, opts *ReactionOptions) (*Reaction, error) {
+	reaction := &Reaction{
+		Type:      opts.Type,
+		UserID:    opts.DoerID,
+		IssueID:   opts.IssueID,
+		CommentID: opts.CommentID,
+	}
+	findOpts := FindReactionsOptions{
+		IssueID:   opts.IssueID,
+		CommentID: opts.CommentID,
+		Reaction:  opts.Type,
+		UserID:    opts.DoerID,
+	}
+	if findOpts.CommentID == 0 {
+		// explicit search of Issue Reactions where CommentID = 0
+		findOpts.CommentID = -1
+	}
+
+	existingR, _, err := FindReactions(ctx, findOpts)
+	if err != nil {
+		return nil, err
+	}
+	if len(existingR) > 0 {
+		return existingR[0], ErrReactionAlreadyExist{Reaction: opts.Type}
+	}
+
+	if err := db.Insert(ctx, reaction); err != nil {
+		return nil, err
+	}
+
+	return reaction, nil
 }

 // ReactionOptions defines options for creating or deleting reactions
@@ -191,63 +216,56 @@ type ReactionOptions struct {
 	DoerID    int64
 	IssueID   int64
 	CommentID int64
-	ReleaseID int64
 }

-// CreateReaction creates reaction for issue, comment or release.
-func CreateReaction(ctx context.Context, allowed container.Set[string], opts *ReactionOptions) (*Reaction, error) {
-	if !allowed.Contains(opts.Type) {
+// CreateReaction creates reaction for issue or comment.
+func CreateReaction(ctx context.Context, opts *ReactionOptions) (*Reaction, error) {
+	if !setting.UI.ReactionsLookup.Contains(opts.Type) {
 		return nil, ErrForbiddenIssueReaction{opts.Type}
 	}

+	return db.WithTx2(ctx, func(ctx context.Context) (*Reaction, error) {
+		return createReaction(ctx, opts)
+	})
+}
+
+// DeleteReaction deletes reaction for issue or comment.
+func DeleteReaction(ctx context.Context, opts *ReactionOptions) error {
 	reaction := &Reaction{
 		Type:      opts.Type,
 		UserID:    opts.DoerID,
 		IssueID:   opts.IssueID,
 		CommentID: opts.CommentID,
-		ReleaseID: opts.ReleaseID,
 	}

-	err := db.Insert(ctx, reaction)
-	if err != nil {
-		if has, _ := db.GetEngine(ctx).Get(reaction); has {
-			return reaction, ErrReactionAlreadyExist{Reaction: opts.Type}
-		}
-		return nil, err
+	sess := db.GetEngine(ctx).Where("original_author_id = 0")
+	if opts.CommentID == -1 {
+		reaction.CommentID = 0
+		sess.MustCols("comment_id")
 	}
-	return reaction, nil
+
+	_, err := sess.Delete(reaction)
+	return err
 }

+// DeleteIssueReaction deletes a reaction on issue.
 func DeleteIssueReaction(ctx context.Context, doerID, issueID int64, content string) error {
-	// here and below: the migration reactions have unrelated user_id (might be the doer?)
-	// so skip the deletion if the reaction is from an external user (original_author_id != 0)
-	sess := db.GetEngine(ctx).Where("issue_id = ? AND comment_id = 0 AND user_id = ? AND original_author_id = 0 AND `type` = ?", issueID, doerID, content)
-	_, err := sess.Delete(&Reaction{})
-	return err
+	return DeleteReaction(ctx, &ReactionOptions{
+		Type:      content,
+		DoerID:    doerID,
+		IssueID:   issueID,
+		CommentID: -1,
+	})
 }

+// DeleteCommentReaction deletes a reaction on comment.
 func DeleteCommentReaction(ctx context.Context, doerID, issueID, commentID int64, content string) error {
-	sess := db.GetEngine(ctx).Where("issue_id = ? AND comment_id = ? AND user_id = ? AND original_author_id = 0 AND `type` = ?", issueID, commentID, doerID, content)
-	_, err := sess.Delete(&Reaction{})
-	return err
-}
-
-func DeleteCommentAllReactions(ctx context.Context, commentID int64) error {
-	sess := db.GetEngine(ctx).Where("comment_id = ?", commentID)
-	_, err := sess.Delete(&Reaction{})
-	return err
-}
-
-func DeleteUserReactions(ctx context.Context, userID int64) error {
-	sess := db.GetEngine(ctx).Where("user_id = ?", userID)
-	_, err := sess.Delete(&Reaction{})
-	return err
-}
-
-func DeleteReleaseReaction(ctx context.Context, doerID, releaseID int64, content string) error {
-	sess := db.GetEngine(ctx).Where("release_id = ? AND user_id = ? AND `type` = ?", releaseID, doerID, content)
-	_, err := sess.Delete(&Reaction{})
-	return err
+	return DeleteReaction(ctx, &ReactionOptions{
+		Type:      content,
+		DoerID:    doerID,
+		IssueID:   issueID,
+		CommentID: commentID,
+	})
 }

 // ReactionList represents list of reactions
@@ -284,15 +302,23 @@ func (list ReactionList) getUserIDs() []int64 {
 	})
 }

+func valuesUser(m map[int64]*user_model.User) []*user_model.User {
+	values := make([]*user_model.User, 0, len(m))
+	for _, v := range m {
+		values = append(values, v)
+	}
+	return values
+}
+
 // newMigrationOriginalUser creates and returns a fake user for external user
 func newMigrationOriginalUser(name string) *user_model.User {
 	return &user_model.User{ID: 0, Name: name, LowerName: strings.ToLower(name)}
 }

 // LoadUsers loads reactions' all users
-func (list ReactionList) LoadUsers(ctx context.Context, repo *repo_model.Repository) (map[int64]*user_model.User, error) {
+func (list ReactionList) LoadUsers(ctx context.Context, repo *repo_model.Repository) ([]*user_model.User, error) {
 	if len(list) == 0 {
-		return map[int64]*user_model.User{}, nil
+		return nil, nil
 	}

 	userIDs := list.getUserIDs()
@@ -313,7 +339,7 @@ func (list ReactionList) LoadUsers(ctx context.Context, repo *repo_model.Reposit
 			reaction.User = user_model.NewGhostUser()
 		}
 	}
-	return userMaps, nil
+	return valuesUser(userMaps), nil
 }

 // GetFirstUsers returns first reacted user display names separated by comma
@@ -324,7 +350,7 @@ func (list ReactionList) GetFirstUsers() string {
 		if buffer.Len() > 0 {
 			buffer.WriteString(", ")
 		}
-		buffer.WriteString(reaction.User.DisplayNameWithFullName())
+		buffer.WriteString(reaction.User.Name)
 		if rem--; rem == 0 {
 			break
 		}
@@ -428,6 +428,9 @@ func CreateReview(ctx context.Context, opts CreateReviewOptions) (*Review, error

 // GetCurrentReview returns the current pending review of reviewer for given issue
 func GetCurrentReview(ctx context.Context, reviewer *user_model.User, issue *Issue) (*Review, error) {
+	if reviewer == nil {
+		return nil, nil //nolint:nilnil // return nil when reviewer is nil
+	}
 	reviews, err := FindReviews(ctx, FindReviewOptions{
 		Types:      []ReviewType{ReviewTypePending},
 		IssueID:    issue.ID,
@@ -439,10 +442,9 @@ func GetCurrentReview(ctx context.Context, reviewer *user_model.User, issue *Iss
 	if len(reviews) == 0 {
 		return nil, ErrReviewNotExist{}
 	}
-	pendingReview := reviews[0]
-	pendingReview.Reviewer = reviewer
-	pendingReview.Issue = issue
-	return pendingReview, nil
+	reviews[0].Reviewer = reviewer
+	reviews[0].Issue = issue
+	return reviews[0], nil
 }

 // ReviewExists returns whether a review exists for a particular line of code in the PR
@@ -433,7 +433,7 @@ func TestRecalculateReviewsOfficial(t *testing.T) {

 	// Once the reviewer is whitelisted, re-evaluating restores the official flag.
 	rule.ApprovalsWhitelistUserIDs = []int64{2, reviewer.ID}
-	_, err = db.GetEngine(t.Context()).ID(rule.ID).Cols("config").Update(rule)
+	_, err = db.GetEngine(t.Context()).ID(rule.ID).Cols("approvals_whitelist_user_i_ds").Update(rule)
 	assert.NoError(t, err)

 	assert.NoError(t, issues_model.RecalculateReviewsOfficial(t.Context(), issue))
@@ -178,7 +178,7 @@ type FindOrgMembersOpts struct {
 }

 func (opts FindOrgMembersOpts) PublicOnly() bool {
-	return !user_model.DoerCanViewPrivate(opts.Doer) || !(opts.IsDoerMember || user_model.DoerIsSiteAdminFullAccess(opts.Doer))
+	return opts.Doer == nil || !(opts.IsDoerMember || opts.Doer.IsAdmin)
 }

 // applyKeywordFilter adds keyword search conditions to session
@@ -456,8 +456,8 @@ func ownerVisibilitySatisfiesDoer(orgOrUser, user *user_model.User) bool {

 // HasOrgOrUserVisible tells if the given user can see the given org or user
 func HasOrgOrUserVisible(ctx context.Context, owner, doer *user_model.User) bool {
-	return user_model.DoerTokenAllowsOwner(doer, owner) && (ownerVisibilitySatisfiesDoer(owner, doer) ||
-		(doer != nil && OrgFromUser(owner).HasMemberWithUserID(ctx, doer.ID)))
+	return ownerVisibilitySatisfiesDoer(owner, doer) ||
+		(doer != nil && OrgFromUser(owner).HasMemberWithUserID(ctx, doer.ID))
 }

 // HasOrgsVisible tells if the given user can see at least one of the orgs provided
@@ -54,6 +54,12 @@ type FindOrgOptions struct {
 	IncludeVisibility structs.VisibleType
 }

+func (opts *FindOrgOptions) ApplyPublicOnly(publicOnly bool) {
+	if publicOnly {
+		opts.IncludeVisibility = structs.VisibleTypePublic
+	}
+}
+
 func queryUserOrgIDs(userID int64, includePrivate bool) *builder.Builder {
 	cond := builder.Eq{"uid": userID}
 	if !includePrivate {
@@ -77,7 +83,7 @@ func (opts FindOrgOptions) ToOrders() string {
 }

 func DoerViewOtherVisibility(doer, other *user_model.User) structs.VisibleType {
-	if other == nil || !user_model.DoerCanViewPrivate(doer) {
+	if doer == nil || other == nil {
 		return structs.VisibleTypePublic
 	}
 	if doer.IsAdmin || doer.ID == other.ID {
@@ -58,30 +58,18 @@ func (opts *SearchOptions) toConds() builder.Cond {
 	return cond
 }

-func SearchLatestVersions(ctx context.Context, opts *SearchOptions) (latest []*packages.PackageVersion, err error) {
-	var allPkgVers []*packages.PackageVersion
-	err = db.GetEngine(ctx).
+func SearchLatestVersions(ctx context.Context, opts *SearchOptions) ([]*packages.PackageVersion, error) {
+	sess := db.GetEngine(ctx).
 		Table("package_version").
 		Select("package_version.*").
+		Join("LEFT", "package_version pv2", builder.Expr("package_version.package_id = pv2.package_id AND pv2.is_internal = ? AND (package_version.created_unix < pv2.created_unix OR (package_version.created_unix = pv2.created_unix AND package_version.id < pv2.id))", false)).
 		Join("INNER", "package", "package.id = package_version.package_id").
 		Join("INNER", "package_file", "package_file.version_id = package_version.id").
-		Where(opts.toConds()).
-		Asc("package.name", "package.id").
-		Find(&allPkgVers)
-	if err != nil {
-		return nil, err
-	}
+		Where(opts.toConds().And(builder.Expr("pv2.id IS NULL"))).
+		Asc("package.name")

-	// SQL can't order R version strings, so pick the highest version per package here
-	for _, pv := range allPkgVers {
-		curIdx := len(latest) - 1
-		if curIdx == -1 || latest[curIdx].PackageID != pv.PackageID {
-			latest = append(latest, pv) // start a new package version
-		} else if cran_module.CompareVersions(pv.Version, latest[curIdx].Version) > 0 {
-			latest[curIdx] = pv // replace with a higher version
-		}
-	}
-	return latest, nil
+	pvs := make([]*packages.PackageVersion, 0, 10)
+	return pvs, sess.Find(&pvs)
 }

 func SearchFile(ctx context.Context, opts *SearchOptions) (*packages.PackageFile, error) {
@@ -123,7 +123,7 @@ func GetTotalUnreferencedBlobSize(ctx context.Context) (int64, error) {

 // IsBlobAccessibleForUser tests if the user has access to the blob
 func IsBlobAccessibleForUser(ctx context.Context, blobID int64, user *user_model.User) (bool, error) {
-	if user_model.DoerIsSiteAdminFullAccess(user) {
+	if user.IsAdmin {
 		return true, nil
 	}
 	ownerVisibilities := []structs.VisibleType{structs.VisibleTypePublic}
@@ -153,9 +153,6 @@ func IsBlobAccessibleForUser(ctx context.Context, blobID int64, user *user_model
 			Or(builder.Eq{"`user`.type": user_model.UserTypeOrganization}.
 				And(builder.Lte{strconv.Itoa(int(perm.AccessModeRead)): maxTeamAuthorize}.Or(builder.Lte{strconv.Itoa(int(perm.AccessModeRead)): maxTeamUnitAccessMode}))),
 	)
-	if !user_model.DoerCanViewPrivate(user) {
-		cond = cond.And(builder.Eq{"`user`.visibility": structs.VisibleTypePublic})
-	}

 	return db.GetEngine(ctx).
 		Table("package_blob").
@@ -424,9 +424,6 @@ func GetDoerRepoPermission(ctx context.Context, repo *repo_model.Repository, use
 // In most request paths, callers should use GetDoerRepoPermission instead.
 // Unlike GetDoerRepoPermission, this helper does not resolve Actions task users.
 func GetIndividualUserRepoPermission(ctx context.Context, repo *repo_model.Repository, user *user_model.User) (perm Permission, err error) {
-	if !repo_model.DoerTokenAllowsRepo(ctx, user, repo) {
-		return PermissionNoAccess(), nil
-	}
 	defer func() {
 		if err == nil {
 			finalProcessRepoUnitPermission(user, &perm)
@@ -678,14 +675,10 @@ func PermissionNoAccess() Permission {
 // permission on a repository. Producers and consumers must agree on it, so it lives here.
 func RepoUserPermissionCacheKey(repoID int64, doer *user_model.User) string {
 	var doerID int64
-	var doerExtData string
 	if doer != nil {
 		doerID = doer.ID
-		if doer.ExtDoerData != nil {
-			doerExtData = doer.ExtDoerData.EncodeToString()
-		}
 	}
-	return fmt.Sprintf("%d-%d-%s", repoID, doerID, doerExtData)
+	return fmt.Sprintf("%d-%d", repoID, doerID)
 }

 // CanReadWorkflowCrossRepo checks whether the run can read workflow files from targetRepo.
@@ -272,21 +272,4 @@ func testGetDoerRepoPermission(t *testing.T) {
 	individualPerm, err := GetIndividualUserRepoPermission(ctx, repo1, regularUser)
 	require.NoError(t, err)
 	assert.Equal(t, individualPerm, doerPerm)
-
-	t.Run("PublicOnlyTokenReachesOnlyPublicReposOfPublicOwners", func(t *testing.T) {
-		publicOnlyUser := *regularUser
-		publicOnlyUser.ExtDoerData = user_model.NewTokenExtDoerData(user_model.CredentialAccessToken, 1, "public-only,write:repository")
-		publicOnlyAdmin := *unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-		publicOnlyAdmin.ExtDoerData = publicOnlyUser.ExtDoerData
-		for _, repoID := range []int64{2, 38} {
-			perm, err := GetDoerRepoPermission(ctx, unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: repoID}), &publicOnlyAdmin)
-			require.NoError(t, err)
-			assert.False(t, perm.HasAnyUnitAccessOrPublicAccess(), "repo %d", repoID)
-		}
-
-		perm, err := GetDoerRepoPermission(ctx, repo1, &publicOnlyUser)
-		require.NoError(t, err)
-		assert.True(t, perm.CanWrite(unit.TypeCode))
-		assert.NotEqual(t, RepoUserPermissionCacheKey(repo1.ID, regularUser), RepoUserPermissionCacheKey(repo1.ID, &publicOnlyUser))
-	})
 }
@@ -50,7 +50,7 @@ func (c *commitChecker) IsCommitIDExisting(commitID string) bool {
 		c.gitRepo, c.gitRepoCloser = r, closer
 	}

-	exist = c.gitRepo.IsReferenceExist(c.ctx, commitID)
+	exist = c.gitRepo.IsReferenceExist(c.ctx, commitID) // Don't use IsObjectExist since it doesn't support short hashes with gogit edition.
 	c.commitCache[commitID] = exist
 	return exist
 }
@@ -260,17 +260,15 @@ func DeleteAttachmentsByRelease(ctx context.Context, releaseID int64) error {
 	return err
 }

-func sqlOrphanedAttachmentsWhereCond() string {
-	return "(issue_id > 0 and issue_id not in (select id from `issue`))" +
-		" or (release_id > 0 and release_id not in (select id from `release`))" +
-		" or (comment_id > 0 and comment_id not in (select id from `comment`))"
-}
-
+// CountOrphanedAttachments returns the number of bad attachments
 func CountOrphanedAttachments(ctx context.Context) (int64, error) {
-	return db.GetEngine(ctx).Where(sqlOrphanedAttachmentsWhereCond()).Count(new(Attachment))
+	return db.GetEngine(ctx).Where("(issue_id > 0 and issue_id not in (select id from issue)) or (release_id > 0 and release_id not in (select id from `release`))").
+		Count(new(Attachment))
 }

+// DeleteOrphanedAttachments delete all bad attachments
 func DeleteOrphanedAttachments(ctx context.Context) error {
-	_, err := db.GetEngine(ctx).Where(sqlOrphanedAttachmentsWhereCond()).Delete(new(Attachment))
+	_, err := db.GetEngine(ctx).Where("(issue_id > 0 and issue_id not in (select id from issue)) or (release_id > 0 and release_id not in (select id from `release`))").
+		Delete(new(Attachment))
 	return err
 }
@@ -6,13 +6,10 @@ package repo_test
 import (
 	"testing"

-	"gitea.dev/models/db"
-	issues_model "gitea.dev/models/issues"
 	repo_model "gitea.dev/models/repo"
 	"gitea.dev/models/unittest"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestIncreaseDownloadCount(t *testing.T) {
@@ -76,34 +73,6 @@ func TestGetAttachmentByID(t *testing.T) {
 	assert.Equal(t, "a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11", attach.UUID)
 }

-func TestDeleteOrphanedAttachments(t *testing.T) {
-	require.NoError(t, unittest.PrepareTestDatabase())
-
-	issue := &issues_model.Issue{}
-	release := &repo_model.Release{}
-	comment := &issues_model.Comment{}
-	require.NoError(t, db.Insert(t.Context(), issue, release, comment))
-	require.NoError(t, db.Insert(t.Context(), []*repo_model.Attachment{
-		{UUID: "valid-issue", IssueID: issue.ID},
-		{UUID: "valid-release", ReleaseID: release.ID},
-		{UUID: "valid-comment", CommentID: comment.ID},
-		{UUID: "unlinked"},
-		{UUID: "orphaned-issue", IssueID: unittest.NonexistentID},
-		{UUID: "orphaned-release", ReleaseID: unittest.NonexistentID},
-		{UUID: "orphaned-comment", IssueID: issue.ID, CommentID: unittest.NonexistentID},
-	}))
-
-	require.NoError(t, repo_model.DeleteOrphanedAttachments(t.Context()))
-
-	unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{UUID: "valid-issue"})
-	unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{UUID: "valid-release"})
-	unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{UUID: "valid-comment"})
-	unittest.AssertExistsAndLoadBean(t, &repo_model.Attachment{UUID: "unlinked"})
-	unittest.AssertNotExistsBean(t, &repo_model.Attachment{UUID: "orphaned-issue"})
-	unittest.AssertNotExistsBean(t, &repo_model.Attachment{UUID: "orphaned-release"})
-	unittest.AssertNotExistsBean(t, &repo_model.Attachment{UUID: "orphaned-comment"})
-}
-
 func TestAttachment_DownloadURL(t *testing.T) {
 	attach := &repo_model.Attachment{
 		UUID: "a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11",
@@ -39,19 +39,6 @@ const (
 	UpdateStyleRebase UpdateStyle = "rebase"
 )

-// SquashMergeMessage is the source of the default squash merge commit message body, values match GitHub's squash_merge_commit_message: https://docs.github.com/en/rest/repos/repos#update-a-repository
-type SquashMergeMessage string
-
-const (
-	SquashMergeMessageBlank          SquashMergeMessage = "BLANK"
-	SquashMergeMessageCommitMessages SquashMergeMessage = "COMMIT_MESSAGES"
-	SquashMergeMessagePRBody         SquashMergeMessage = "PR_BODY"
-)
-
-func (m SquashMergeMessage) IsValid() bool {
-	return m == SquashMergeMessageBlank || m == SquashMergeMessageCommitMessages || m == SquashMergeMessagePRBody
-}
-
 // UpdateDefaultBranch updates the default branch
 func UpdateDefaultBranch(ctx context.Context, repo *Repository) error {
 	_, err := db.GetEngine(ctx).ID(repo.ID).Cols("default_branch").Update(repo)
@@ -31,7 +31,8 @@ func GetOrgRepositoryIDs(ctx context.Context, orgID int64) (repoIDs []int64, _ e
 type SearchTeamRepoOptions struct {
 	db.ListOptions
 	TeamID int64
-	Actor  *user_model.User
+	// PublicOnly restricts the result (and count) to non-private repositories.
+	PublicOnly bool
 }

 func (opts *SearchTeamRepoOptions) toCond() builder.Cond {
@@ -43,7 +44,10 @@ func (opts *SearchTeamRepoOptions) toCond() builder.Cond {
 				Where(builder.Eq{"team_id": opts.TeamID}),
 		))
 	}
-	return cond.And(DoerTokenRepoCond(opts.Actor))
+	if opts.PublicOnly {
+		cond = cond.And(builder.Eq{"is_private": false})
+	}
+	return cond
 }

 // GetTeamRepositories returns paginated repositories in team of organization.
@@ -78,13 +78,13 @@ func (m *PushMirror) GetRemoteName() string {
 	return m.RemoteName
 }

-// UpdatePushMirrorSyncStatus updates the sync status (last update time and last error) of the push-mirror
-func UpdatePushMirrorSyncStatus(ctx context.Context, m *PushMirror) error {
-	_, err := db.GetEngine(ctx).ID(m.ID).Cols("last_update", "last_error").Update(m)
+// UpdatePushMirror updates the push-mirror
+func UpdatePushMirror(ctx context.Context, m *PushMirror) error {
+	_, err := db.GetEngine(ctx).ID(m.ID).AllCols().Update(m)
 	return err
 }

-// UpdatePushMirrorInterval updates the sync interval of the push-mirror
+// UpdatePushMirrorInterval updates the push-mirror
 func UpdatePushMirrorInterval(ctx context.Context, m *PushMirror) error {
 	_, err := db.GetEngine(ctx).ID(m.ID).Cols("interval").Update(m)
 	return err
@@ -212,6 +212,13 @@ type SearchRepoOptions struct {
 	OnlyShowRelevant bool
 }

+func (opts *SearchRepoOptions) ApplyPublicOnly(publicOnly bool) {
+	if publicOnly {
+		opts.Private = false
+		opts.AllLimited = false
+	}
+}
+
 // UserOwnedRepoCond returns user ownered repositories
 func UserOwnedRepoCond(userID int64) builder.Cond {
 	return builder.Eq{
@@ -363,9 +370,6 @@ func UserOrgPublicUnitRepoCond(userID, orgID int64) builder.Cond {

 // SearchRepositoryCondition creates a query condition according search repository options
 func SearchRepositoryCondition(opts SearchRepoOptions) builder.Cond {
-	if user_model.IsPublicOnlyDoer(opts.Actor) {
-		opts.Private, opts.AllLimited = false, false
-	}
 	cond := builder.NewCond()

 	if opts.Private {
@@ -659,9 +663,6 @@ func userAllPublicRepoCond(cond builder.Cond, ownerVisibilityLimit []structs.Vis

 // AccessibleRepositoryCondition takes a user a returns a condition for checking if a repository is accessible
 func AccessibleRepositoryCondition(user *user_model.User, unitType unit.Type) builder.Cond {
-	if user_model.IsPublicOnlyDoer(user) && !user.IsRestricted {
-		return PublicRepoUnderPublicOwnerCond()
-	}
 	cond := builder.NewCond()

 	if user == nil || !user.IsRestricted || user.ID <= 0 {
@@ -699,7 +700,8 @@ func AccessibleRepositoryCondition(user *user_model.User, unitType unit.Type) bu
 			cond = userAllPublicRepoCond(cond, orgVisibilityLimit)
 		}
 	}
-	return cond.And(DoerTokenRepoCond(user))
+
+	return cond
 }

 // SearchRepositoryByName takes keyword and part of repository name to search,
@@ -764,20 +766,6 @@ func PublicRepoUnderPublicOwnerCond() builder.Cond {
 	)
 }

-func DoerTokenAllowsRepo(ctx context.Context, doer *user_model.User, repo *Repository) bool {
-	if !user_model.IsPublicOnlyDoer(doer) {
-		return true
-	}
-	return !repo.IsPrivate && repo.LoadOwner(ctx) == nil && repo.Owner.Visibility.IsPublic()
-}
-
-func DoerTokenRepoCond(doer *user_model.User) builder.Cond {
-	if user_model.IsPublicOnlyDoer(doer) {
-		return PublicRepoUnderPublicOwnerCond()
-	}
-	return builder.NewCond()
-}
-
 // NotPublicRepoUnderPublicOwnerCond complements PublicRepoUnderPublicOwnerCond. Spelled positively so
 // the owner subquery hashes the limited/private minority, not every public user.
 func NotPublicRepoUnderPublicOwnerCond() builder.Cond {
@@ -792,21 +780,23 @@ func NotPublicRepoUnderPublicOwnerCond() builder.Cond {
 //   - owner_id = ownerID: only that owner's repos.
 //   - AccessibleRepositoryCondition(user, TypeActions): only repos whose Actions the user can read
 //     (admin/owner teams are handled inside it; a site admin is not, callers must skip the filter for one).
-func UserActionsAccessibleOwnerRepoCond(ownerID int64, user *user_model.User) builder.Cond {
-	return builder.And(
+//   - publicOnly (a public-only token): additionally limit to public repos under a public owner.
+func UserActionsAccessibleOwnerRepoCond(ownerID int64, user *user_model.User, publicOnly bool) builder.Cond {
+	cond := builder.NewCond().And(
 		builder.Eq{"`repository`.owner_id": ownerID},
 		AccessibleRepositoryCondition(user, unit.TypeActions),
 	)
+	if publicOnly {
+		cond = cond.And(PublicRepoUnderPublicOwnerCond())
+	}
+	return cond
 }

 // FindUserActionsAccessibleOwnerRepoIDsSubQuery returns a subquery selecting the repository IDs the user
-// can see for the given owner, nil if unrestricted. Callers embed it in an `IN (...)` condition so that a large owner does not
+// can see for the given owner. Callers embed it in an `IN (...)` condition so that a large owner does not
 // materialize every repo ID into the SQL statement, which could exceed database parameter limits.
-func FindUserActionsAccessibleOwnerRepoIDsSubQuery(ownerID int64, user *user_model.User) *builder.Builder {
-	if ownerID <= 0 || user_model.DoerIsSiteAdminFullAccess(user) {
-		return nil
-	}
-	return builder.Select("id").From("repository").Where(UserActionsAccessibleOwnerRepoCond(ownerID, user))
+func FindUserActionsAccessibleOwnerRepoIDsSubQuery(ownerID int64, user *user_model.User, publicOnly bool) *builder.Builder {
+	return builder.Select("id").From("repository").Where(UserActionsAccessibleOwnerRepoCond(ownerID, user, publicOnly))
 }

 // GetUserRepositories returns a list of repositories of given user.
@@ -816,10 +806,10 @@ func GetUserRepositories(ctx context.Context, opts SearchRepoOptions) (Repositor
 	}

 	cond := builder.NewCond()
-	if opts.OwnerID == 0 {
-		return nil, 0, util.NewInvalidArgumentErrorf("GetUserRepositories: OwnerID is needed but not given")
+	if opts.Actor == nil {
+		return nil, 0, util.NewInvalidArgumentErrorf("GetUserRepositories: Actor is needed but not given")
 	}
-	cond = cond.And(builder.Eq{"owner_id": opts.OwnerID}, DoerTokenRepoCond(opts.Actor))
+	cond = cond.And(builder.Eq{"owner_id": opts.Actor.ID})
 	if !opts.Private {
 		cond = cond.And(builder.Eq{"is_private": false})
 	}
@@ -493,21 +493,14 @@ func TestFindUserActionsAccessibleOwnerRepoIDs(t *testing.T) {
 	// org3 is a public org owning repo3 (private) and repo32 (public), both with the actions unit
 	const orgID = 3

-	all, err := repo_model.SearchRepositoryIDsByCondition(t.Context(), repo_model.UserActionsAccessibleOwnerRepoCond(orgID, user))
+	all, err := repo_model.SearchRepositoryIDsByCondition(t.Context(), repo_model.UserActionsAccessibleOwnerRepoCond(orgID, user, false))
 	require.NoError(t, err)
 	assert.Contains(t, all, int64(3), "without public-only the private repo's actions are listed")

-	scopedUser := *user
-	scopedUser.ExtDoerData = user_model.NewTokenExtDoerData(user_model.CredentialAccessToken, 1, "public-only,read:repository")
-	publicOnly, err := repo_model.SearchRepositoryIDsByCondition(t.Context(), repo_model.UserActionsAccessibleOwnerRepoCond(orgID, &scopedUser))
+	publicOnly, err := repo_model.SearchRepositoryIDsByCondition(t.Context(), repo_model.UserActionsAccessibleOwnerRepoCond(orgID, user, true))
 	require.NoError(t, err)
 	assert.NotContains(t, publicOnly, int64(3), "a public-only token must not list a private repo's actions")
 	assert.Contains(t, publicOnly, int64(32), "a public repo under a public owner stays listed")
-
-	admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
-	assert.Nil(t, repo_model.FindUserActionsAccessibleOwnerRepoIDsSubQuery(orgID, admin))
-	admin.ExtDoerData = scopedUser.ExtDoerData
-	assert.NotNil(t, repo_model.FindUserActionsAccessibleOwnerRepoIDsSubQuery(orgID, admin))
 }

 // TestUserOrgUnitRepoCondTeamAuthorize pins team.authorize vs team_unit.access_mode
@@ -131,7 +131,6 @@ type PullRequestsConfig struct {
 	DefaultUpdateStyle            UpdateStyle
 	DefaultDeleteBranchAfterMerge bool
 	DefaultMergeStyle             MergeStyle
-	DefaultSquashMergeMessage     SquashMergeMessage
 	DefaultAllowMaintainerEdit    bool
 	DefaultTargetBranch           string
 }
@@ -151,7 +150,6 @@ func DefaultPullRequestsConfig() *PullRequestsConfig {
 	cfg.DefaultDeleteBranchAfterMerge = setting.Repository.PullRequest.DefaultDeleteBranchAfterMerge
 	cfg.DefaultMergeStyle = MergeStyle(setting.Repository.PullRequest.DefaultMergeStyle)
 	cfg.DefaultMergeStyle = util.IfZero(cfg.DefaultMergeStyle, MergeStyleMerge)
-	cfg.DefaultSquashMergeMessage = SquashMergeMessage(setting.Repository.PullRequest.DefaultSquashMergeMessage)
 	return cfg
 }