mirror of https://github.com/go-gitea/gitea.git synced 2026-05-23 05:42:33 +09:00

Go to file

Giteabot 9d737a6400 fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806 )

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) |
[`v0.51.0` →
`v0.52.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.51.0...refs/tags/v0.52.0)
|
![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fcrypto/v0.52.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fcrypto/v0.51.0/v0.52.0?slim=true)
|

---

### Invoking key constraints not enforced in
golang.org/x/crypto/ssh/agent
[CVE-2026-39833](https://nvd.nist.gov/vuln/detail/CVE-2026-39833) /
[GO-2026-5005](https://pkg.go.dev/vuln/GO-2026-5005)

<details>
<summary>More information</summary>

#### Details
The in-memory keyring returned by NewKeyring() silently accepted keys
with the ConfirmBeforeUse constraint but never enforced it. The key
would sign without any confirmation prompt, with no indication to the
caller that the constraint was not in effect. NewKeyring() now returns
an error when unsupported constraints are requested.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79436](https://go.dev/issue/79436)
- [https://go.dev/cl/778640](https://go.dev/cl/778640)
- [https://go.dev/cl/778641](https://go.dev/cl/778641)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5005) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking agent constraints dropped when forwarding keys in
golang.org/x/crypto/ssh/agent
[CVE-2026-39832](https://nvd.nist.gov/vuln/detail/CVE-2026-39832) /
[GO-2026-5006](https://pkg.go.dev/vuln/GO-2026-5006)

<details>
<summary>More information</summary>

#### Details
When adding a key to a remote agent constraint extensions such as
restrict-destination-v00@&#8203;openssh.com were not serialized in the
request. Destination restrictions were silently stripped when forwarding
keys, allowing unrestricted use of the key on the remote host. The
client now serializes all constraint extensions. Additionally, the
in-memory keyring returned by NewKeyring() now rejects keys with
unsupported constraint extensions instead of silently ignoring them.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79435](https://go.dev/issue/79435)
- [https://go.dev/cl/778642](https://go.dev/cl/778642)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5006) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking byte arithmetic causes underflow and panic in
golang.org/x/crypto/ssh
[CVE-2026-46597](https://nvd.nist.gov/vuln/detail/CVE-2026-46597) /
[GO-2026-5013](https://pkg.go.dev/vuln/GO-2026-5013)

<details>
<summary>More information</summary>

#### Details
An incorrectly placed cast from bytes to int allowed for server-side
panic in the AES-GCM packet decoder for well-crafted inputs.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79561](https://go.dev/issue/79561)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- [https://go.dev/cl/781620](https://go.dev/cl/781620)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5013) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking bypass of certificate restrictions in
golang.org/x/crypto/ssh
[CVE-2026-39828](https://nvd.nist.gov/vuln/detail/CVE-2026-39828) /
[GO-2026-5014](https://pkg.go.dev/vuln/GO-2026-5014)

<details>
<summary>More information</summary>

#### Details
When an SSH server authentication callback returned PartialSuccessError
with non-nil Permissions, those permissions were silently discarded,
potentially dropping certificate restrictions such as force-command
after a second factor succeeded. Returning non-nil Permissions with
PartialSuccessError now results in a connection error.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79562](https://go.dev/issue/79562)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- [https://go.dev/cl/781621](https://go.dev/cl/781621)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5014) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking server panic during CheckHostKey/Authenticate in
golang.org/x/crypto/ssh
[CVE-2026-39835](https://nvd.nist.gov/vuln/detail/CVE-2026-39835) /
[GO-2026-5015](https://pkg.go.dev/vuln/GO-2026-5015)

<details>
<summary>More information</summary>

#### Details
SSH servers which use CertChecker as a public key callback without
setting IsUserAuthority or IsHostAuthority could be caused to panic by a
client presenting a certificate. CertChecker now returns an error
instead of panicking when these callbacks are nil.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79563](https://go.dev/issue/79563)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- [https://go.dev/cl/781660](https://go.dev/cl/781660)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5015) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking memory leak when rejecting channels can lead to DoS in
golang.org/x/crypto/ssh
[CVE-2026-39827](https://nvd.nist.gov/vuln/detail/CVE-2026-39827) /
[GO-2026-5016](https://pkg.go.dev/vuln/GO-2026-5016)

<details>
<summary>More information</summary>

#### Details
An authenticated SSH client that repeatedly opened channels which were
rejected by the server caused unbounded memory growth, eventually
crashing the server process and affecting all connected users. Rejected
channels are now properly removed from the connection's internal state
and released for garbage collection.

#### Severity
Unknown

#### References
- [https://go.dev/issue/35127](https://go.dev/issue/35127)
- [https://go.dev/cl/781320](https://go.dev/cl/781320)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5016) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking client can cause server deadlock on unexpected responses in
golang.org/x/crypto/ssh
[CVE-2026-39830](https://nvd.nist.gov/vuln/detail/CVE-2026-39830) /
[GO-2026-5017](https://pkg.go.dev/vuln/GO-2026-5017)

<details>
<summary>More information</summary>

#### Details
A malicious SSH peer could send unsolicited global request responses to
fill an internal buffer, blocking the connection's read loop. The
blocked goroutine could not be released by calling Close(), resulting in
a resource leak per connection. Unsolicited global responses are now
discarded.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79564](https://go.dev/issue/79564)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- [https://go.dev/cl/781640](https://go.dev/cl/781640)
- [https://go.dev/cl/781664](https://go.dev/cl/781664)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5017) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking pathological RSA/DSA parameters may cause DoS in
golang.org/x/crypto/ssh
[CVE-2026-39829](https://nvd.nist.gov/vuln/detail/CVE-2026-39829) /
[GO-2026-5018](https://pkg.go.dev/vuln/GO-2026-5018)

<details>
<summary>More information</summary>

#### Details
The RSA and DSA public key parsers did not enforce size limits on key
parameters. A crafted public key with an excessively large modulus or
DSA parameter could cause several minutes of CPU consumption during
signature verification. This could be triggered by unauthenticated
clients during public key authentication. RSA moduli are now limited to
8192 bits, and DSA parameters are validated per FIPS 186-2.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79565](https://go.dev/issue/79565)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- [https://go.dev/cl/781641](https://go.dev/cl/781641)
- [https://go.dev/cl/781661](https://go.dev/cl/781661)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5018) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking bypass of FIDO/U2F security keys physical interaction in
golang.org/x/crypto/ssh
[CVE-2026-39831](https://nvd.nist.gov/vuln/detail/CVE-2026-39831) /
[GO-2026-5019](https://pkg.go.dev/vuln/GO-2026-5019)

<details>
<summary>More information</summary>

#### Details
The Verify() method for FIDO/U2F security key types
(sk-ecdsa-sha2-nistp256@&#8203;openssh.com,
sk-ssh-ed25519@&#8203;openssh.com) did not check the User Presence flag.
Signatures generated without physical touch were accepted, allowing
unattended use of a hardware security key. To restore the previous
behavior, return a "no-touch-required" extension in
Permissions.Extensions from PublicKeyCallback.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79566](https://go.dev/issue/79566)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- [https://go.dev/cl/781662](https://go.dev/cl/781662)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5019) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking infinite loop on large channel writes in
golang.org/x/crypto/ssh
[CVE-2026-39834](https://nvd.nist.gov/vuln/detail/CVE-2026-39834) /
[GO-2026-5020](https://pkg.go.dev/vuln/GO-2026-5020)

<details>
<summary>More information</summary>

#### Details
When writing data larger than 4GB in a single Write call on an SSH
channel, an integer overflow in the internal payload size calculation
caused the write loop to spin indefinitely, sending empty packets
without making progress. The size comparison now uses int64 to prevent
truncation.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79567](https://go.dev/issue/79567)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- [https://go.dev/cl/781663](https://go.dev/cl/781663)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5020) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking auth bypass via unenforced @&#8203;revoked status in
golang.org/x/crypto/ssh/knownhosts
[CVE-2026-42508](https://nvd.nist.gov/vuln/detail/CVE-2026-42508) /
[GO-2026-5021](https://pkg.go.dev/vuln/GO-2026-5021)

<details>
<summary>More information</summary>

#### Details
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly
checked for revocation. Now, both the 'key' and 'key.SignatureKey' are
checked for @&#8203;revoked.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79568](https://go.dev/issue/79568)
- [https://go.dev/cl/781220](https://go.dev/cl/781220)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5021) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking VerifiedPublicKeyCallback permissions skip enforcement in
golang.org/x/crypto/ssh
[CVE-2026-46595](https://nvd.nist.gov/vuln/detail/CVE-2026-46595) /
[GO-2026-5023](https://pkg.go.dev/vuln/GO-2026-5023)

<details>
<summary>More information</summary>

#### Details
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh
server configurations; if any other type of callback is passed other
than public key, then the source-address validation would be skipped.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79570](https://go.dev/issue/79570)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
- [https://go.dev/cl/781642](https://go.dev/cl/781642)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5023) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Invoking pathological inputs can lead to client panic in
golang.org/x/crypto/ssh/agent
[CVE-2026-46598](https://nvd.nist.gov/vuln/detail/CVE-2026-46598) /
[GO-2026-5033](https://pkg.go.dev/vuln/GO-2026-5033)

<details>
<summary>More information</summary>

#### Details
For certain crafted inputs, a 'ed25519.PrivateKey' was created by
casting malformed wire bytes, leading to a panic when used.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79596](https://go.dev/issue/79596)
- [https://go.dev/cl/781360](https://go.dev/cl/781360)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5033) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

2026-05-21 23:44:13 -07:00

.devcontainer

chore: upgrade Go version in devcontainer image to 1.26 (#37374 )

2026-04-22 21:47:59 +02:00

.github

ci: shard tests and reduce redundant work (#37618 )

2026-05-21 06:58:41 +02:00

assets

fix(deps): update module github.com/google/go-github/v85 to v86 (#37754 )

2026-05-18 06:18:58 +00:00

build

chore: clean up "contrib" dir (#37690 )

2026-05-13 14:22:47 +00:00

cmd

chore(db): introduce db.Session and db.EngineMigration interfaces (#37746 )

2026-05-18 03:56:39 +08:00

contrib

chore: clean up "contrib" dir (#37690 )

2026-05-13 14:22:47 +00:00

custom/conf

chore: make DefaultTitleSource default to auto to match GitHub (#37767 )

2026-05-18 10:22:45 -07:00

docker

Fix various problems (#37129 )

2026-04-08 01:17:05 +08:00

docs

chore: Use giteabot instead of backporter (#37422 )

2026-05-18 05:46:52 +02:00

models

fix(markup): make RenderString never fail (#37779 )

2026-05-19 16:08:08 +00:00

modules

style: misc UI fixes (#37691 )

2026-05-21 07:02:05 +00:00

options

feat: add copy button to action step header, improve other copy buttons (#37744 )

2026-05-21 07:39:09 +00:00

public

Update go js py dependencies (#37525 )

2026-05-04 19:27:47 +00:00

routers

fix(actions): make artifact signature payloads unambiguous (#37707 )

2026-05-20 16:34:27 +00:00

services

fix: add natural sort to sortTreeViewNodes (#37772 )

2026-05-19 08:57:43 +00:00

snap

fix: snap build (main branch) (#37685 )

2026-05-13 17:31:47 -07:00

templates

feat: add copy button to action step header, improve other copy buttons (#37744 )

2026-05-21 07:39:09 +00:00

tests

style: misc UI fixes (#37691 )

2026-05-21 07:02:05 +00:00

tools

ci: shard tests and reduce redundant work (#37618 )

2026-05-21 06:58:41 +02:00

web_src

fix(build): swagger css import (#37801 )

2026-05-21 13:56:34 +00:00

.air.toml

Update JS deps, fix deprecations (#36040 )

2025-11-27 23:58:10 +00:00

.changelog.yml

Don't add useless labels which will bother changelog generation (#37267 )

2026-04-19 11:34:40 -07:00

.dockerignore

Refactor integration tests infrastructure (#37462 )

2026-04-29 16:37:38 +00:00

.editorconfig

Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038 )

2026-04-29 20:47:52 +08:00

.envrc

Enable direnv (#31672 )

2024-07-23 12:07:41 +00:00

.gitattributes

Add ability for local makefile with personal customizations that wouldnt affect remote repo (#35836 )

2025-11-08 20:23:55 +00:00

.gitignore

Allow multiple projects per issue and pull requests (#36784 )

2026-04-30 22:38:05 +08:00

.golangci.yml

perf: replace goheader linter with custom check (#37599 )

2026-05-08 23:39:35 +02:00

.ignore

Clean bindata (#34728 )

2025-06-16 12:03:51 +00:00

.mailmap

[chore] add git mailmap for proper attribution of authorship (#33612 )

2025-02-16 20:49:28 +08:00

.markdownlint.yaml

Enable markdownlint no-trailing-punctuation and no-blanks-blockquote (#29214 )

2024-02-17 13:18:05 +00:00

.spectral.yaml

Add spectral linter for Swagger (#20321 )

2022-07-11 18:07:16 -05:00

.yamllint.yaml

Move jobparser from act repository to Gitea (#36699 )

2026-02-22 19:33:01 +00:00

AGENTS.md

chore: Conventional adjustments (#37677 )

2026-05-17 20:21:01 +00:00

BSDmakefile

Fix build errors on BSD (in BSDMakefile) (#27594 )

2023-10-13 15:38:27 +00:00

CHANGELOG-archived.md

Fix changelog (main) (#30582 )

2024-04-19 06:08:30 +00:00

CHANGELOG.md

chore: Update 1.26.2 changelog in main (#37796 )

2026-05-20 16:04:42 -07:00

CLAUDE.md

Improve timeline entries for WIP prefix changes in pull requests (#36518 )

2026-02-05 05:57:08 +00:00

CODE_OF_CONDUCT.md

Fixed minor typos in two files #HSFDPMUW (#34944 )

2025-07-06 09:27:26 -07:00

CONTRIBUTING.md

chore: Conventional adjustments (#37677 )

2026-05-17 20:21:01 +00:00

crowdin.yml

Convert locale files from ini to json format (#35489 )

2025-12-19 09:50:48 -08:00

DCO

Remove address from DCO (#22595 )

2023-01-24 18:52:38 +00:00

Dockerfile

build: update pnpm to v11 (#37591 )

2026-05-08 04:17:20 +00:00

Dockerfile.rootless

build: update pnpm to v11 (#37591 )

2026-05-08 04:17:20 +00:00

eslint.config.ts

feat(editor): broaden language detection in web code editor (#37619 )

2026-05-10 04:51:46 +00:00

eslint.json.config.ts

chore: clean up "contrib" dir (#37690 )

2026-05-13 14:22:47 +00:00

flake.lock

Update Nix flake (#37425 )

2026-04-26 11:46:48 +02:00

flake.nix

refactor: use modernc sqlite driver as default (#37562 )

2026-05-06 18:57:59 +00:00

go.mod

fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806 )

2026-05-21 23:44:13 -07:00

go.sum

fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806 )

2026-05-21 23:44:13 -07:00

LICENSE

Fix typo

2016-11-08 08:42:05 +01:00

main_timezones.go

add timetzdata build tag to binary releases (#33463 )

2025-02-05 04:17:08 +00:00

main.go

Clean up Makefile, tests and legacy code (#36638 )

2026-02-19 01:23:32 +00:00

MAINTAINERS

Apply as maintainer (#36947 )

2026-03-22 08:18:42 -07:00

Makefile

ci: shard tests and reduce redundant work (#37618 )

2026-05-21 06:58:41 +02:00

package.json

fix(deps): update npm dependencies (#37768 )

2026-05-19 06:28:06 +00:00

playwright.config.ts

Revert "Add WebKit to e2e test matrix (#37298 )" (#37315 )

2026-04-20 19:49:38 +00:00

pnpm-lock.yaml

fix(deps): update npm dependencies (#37768 )

2026-05-19 06:28:06 +00:00

pnpm-workspace.yaml

fix(deps): update npm dependencies (#37636 )

2026-05-11 05:01:34 +00:00

pyproject.toml

ci: add zizmor to lint-actions (#37720 )

2026-05-16 10:38:46 +02:00

README.md

refactor: use modernc sqlite driver as default (#37562 )

2026-05-06 18:57:59 +00:00

README.zh-cn.md

refactor: use modernc sqlite driver as default (#37562 )

2026-05-06 18:57:59 +00:00

README.zh-tw.md

refactor: use modernc sqlite driver as default (#37562 )

2026-05-06 18:57:59 +00:00

renovate.json5

chore(renovate): enable dockerfile manager (#37719 )

2026-05-16 06:40:05 +00:00

SECURITY.md

Upgrade security public key (#34956 )

2025-07-05 10:11:41 -04:00

stylelint.config.ts

refactor: lint bare fill/stroke colors, add vars for git graph color series (#37543 )

2026-05-07 21:18:23 +00:00

tailwind.config.ts

Fix UI regression (#37218 )

2026-04-14 23:24:44 +08:00

tsconfig.json

Enable strict TypeScript, add errorMessage helper (#37292 )

2026-04-20 07:22:05 +00:00

types.d.ts

Remove htmx (#37224 )

2026-04-15 17:26:26 +00:00

uv.lock

ci: add zizmor to lint-actions (#37720 )

2026-05-16 10:38:46 +02:00

vite.config.ts

Fail vite build on rolldown warnings via NODE_ENV=test (#37270 )

2026-04-21 18:11:07 +00:00

vitest.config.ts

Enable concurrent vitest execution (#36998 )

2026-03-30 16:17:16 +00:00

README.md

Gitea

繁體中文 | 简体中文

Purpose

The goal of this project is to make the easiest, fastest, and most painless way of setting up a self-hosted Git service.

As Gitea is written in Go, it works across all the platforms and architectures that are supported by Go, including Linux, macOS, and Windows on x86, amd64, ARM and PowerPC architectures. This project has been forked from Gogs since November of 2016, but a lot has changed.

For online demonstrations, you can visit demo.gitea.com.

For accessing free Gitea service (with a limited number of repositories), you can visit gitea.com.

To quickly deploy your own dedicated Gitea instance on Gitea Cloud, you can start a free trial at cloud.gitea.com.

Documentation

You can find comprehensive documentation on our official documentation website.

It includes installation, administration, usage, development, contributing guides, and more to help you get started and explore all features effectively.

If you have any suggestions or would like to contribute to it, you can visit the documentation repository

Building

From the root of the source tree, run:

TAGS="bindata" make build

The build target is split into two sub-targets:

make backend which requires Go Stable, the required version is defined in go.mod.
make frontend which requires Node.js LTS or greater and pnpm.

Internet connectivity is required to download the go and npm modules. When building from the official source tarballs which include pre-built frontend files, the frontend target will not be triggered, making it possible to build without Node.js.

More info: https://docs.gitea.com/installation/install-from-source

Using

After building, a binary file named gitea will be generated in the root of the source tree by default. To run it, use:

./gitea web

Note

If you're interested in using our APIs, we have experimental support with documentation.

Contributing

Expected workflow is: Fork -> Patch -> Push -> Pull Request

Note

YOU MUST READ THE CONTRIBUTORS GUIDE BEFORE STARTING TO WORK ON A PULL REQUEST.

If you have found a vulnerability in the project, please write privately to security@gitea.io. Thanks!

Translating

Translations are done through Crowdin. If you want to translate to a new language, ask one of the managers in the Crowdin project to add a new language there.

You can also just create an issue for adding a language or ask on Discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord. For general translation questions there is a section in the docs. Currently a bit empty, but we hope to fill it as questions pop up.

Get more information from documentation.

Official and Third-Party Projects

We provide an official go-sdk, a CLI tool called tea and an action runner for Gitea Action.

We maintain a list of Gitea-related projects at gitea/awesome-gitea, where you can discover more third-party projects, including SDKs, plugins, themes, and more.

Communication

If you have questions that are not covered by the documentation, you can get in contact with us on our Discord server or create a post in the discourse forum.