mirror of
https://github.com/go-gitea/gitea.git
synced 2026-11-09 17:37:20 -06:00
b8b270bac95f311d019272035d05959f26287ad8
21985 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
GiteaBot
|
b8b270bac9 | [skip ci] Updated translations via Crowdin | ||
|
Alan Hsu
|
df4544a58b |
fix(web): handle TypeCastError when building form validation messages (#40212)
Fixes https://github.com/go-gitea/gitea/issues/40210 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
ede9ec3e10 |
fix: stop discarding file close and test setup errors (#39987)
- Fix https://github.com/go-gitea/gitea/security/quality/rules/go%2Funhandled-writable-file-close, ignored close errors hide failed flushes, which could lose rotated logs and truncate authorized_keys - Fix `TestProjects` fixture reset, from https://github.com/go-gitea/gitea/security/quality/ai-findings, `TruncateBeans` rejected the table names and the ignored error let the test run against fixture data |
||
|
silverwind
|
24700dca2a |
test(e2e): retry clipboard reads rejected by Firefox (#40155)
The Firefox mermaid e2e test fails intermittently with `Clipboard read operation is not allowed.`, for example in https://github.com/go-gitea/gitea/actions/runs/41281998298/job/124776072700. Firefox rejects `readText()` when it overlaps the page's still pending clipboard write, and `expect.poll` does not retry errors thrown by its callback, so one overlapping read fails the test. https://github.com/go-gitea/gitea/pull/39838 only removed the paste prompt, not this rejection. - A new `assertClipboardText` helper treats a rejected read as a mismatch so it is polled again - The bot token copy test had the same race and uses it too _Written by Claude (Opus 5.5)._ |
||
|
silverwind
|
7e18e81c7d |
refactor: remove duplicated and dead Go code (#40244)
Pure refactors with no behavior change, mostly reusing existing helpers and dropping duplicated or dead code. Net −222 lines. - Reuse existing helpers instead of inlined copies: `getIssueIndex`, `NewLabel`, `ToCommitUser`, `GetPackageFileDescriptors`, `util.SplitTrimSpace` - Merge copy-pasted blocks in review comment deletion, project deletion and the pre/post-receive hook templates - Drop dead code: an error `toStringKeys` never returned, impossible `bytes.Buffer` write errors, redundant nil-map branches, a `base64` wrapper - Use stdlib where it fits: `strings.Cut`, `bytes.IndexAny`, `cmp.Compare`, `min`/`max`, `slices.Concat`, map lookups instead of key scans |
||
|
Shivansh Garg
|
a5201dc427 |
feat(release): allow setting a release as the latest (#40214)
Gitea picks the latest release by commit date, while GitHub keeps an explicit pointer, so repositories migrated from GitHub could show a different latest release than their source. Fixes https://github.com/go-gitea/gitea/issues/35273. - Add a "Set as Latest Release" checkbox and GitHub's `make_latest` API option. Without them, the newest stable release by commit date stays the latest. - Migrations from GitHub and Gitea carry over the source's latest release. - Migrated releases are dated by their commit like native ones, and equally dated ones keep the source's order. <img width="355" height="122" alt="Set as Latest Release checkbox" src="https://github.com/user-attachments/assets/d35f5324-7ae0-4e9f-b73c-d3c90496fb00" /> --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Lazizbek Ergashev
|
98c937170f |
fix(repo): reject unparsable required approvals in branch protection (#40213)
Saving a branch protection rule with a "Required approvals" value that can't be parsed as an integer (like `99999999999999999999` or `abc`) showed the success message and stored 0, because the binding error was never checked. The form now uses `form-fetch-action` with `GetFetchActionForm`, so invalid input is rejected and nothing is saved. Dev mode still answers unparsable numbers with a 500 until `TypeCastError` gets a message, see https://github.com/go-gitea/gitea/pull/40212. - Validation errors show on the page and highlight the offending field, keeping the form input - Negative approvals are rejected before any rule lookup, and the input gets `min="0"` Fixes https://github.com/go-gitea/gitea/issues/40211 Assisted-by: Claude Code:claude-opus-5-5 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
09922e4ae1 |
ci: update giteabot to v1.5.1, label conflict-free backports (#40247)
Bump `giteabot` to [`v1.5.1`](https://github.com/go-gitea/giteabot/releases/tag/v1.5.1) to label PRs with a `backport/<version>` label that would cherry-pick cleanly onto the latest release branch with `backport/conflict-free`. The backport workflow's concurrency group is now per ref, so release branch pushes can't cancel a pending backport run from `main`. _Written by Claude (Opus 5.5)._ |
||
|
Basavaraj S m
|
8d14c9af20 |
fix(pull): enforce user blocks on pull request reviews (#40194)
Code review never checked user blocks, so a user blocked by the poster or repository owner could still post reviews, code comments and replies through the web, API and email. - `CreateCodeComment` and `SubmitReview` now check blocks, with the repo admin exemption issue comments have. - Official reviewers blocked only by the author can still review, so an author can't keep a maintainer from requesting changes. - Review requests are handled in https://github.com/go-gitea/gitea/pull/39296. --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
87ebf3b1ba |
feat(auth)!: remove support for obsolete OpenID 2.0 draft (#40231)
Remove OpenID 2.0 authentication. The spec is an obsolete draft, major providers dropped it years ago, and the code keeps needing security fixes like https://github.com/go-gitea/gitea/pull/39642. OpenID Connect and OAuth2 are unaffected. Docs: https://gitea.com/gitea/docs/pulls/633. - The `[openid]` settings, OpenID sign-in, sign-up and account association are gone - A migration drops the `user_open_id` table with all user OpenID URIs - Accounts registered via OpenID have a random password and regain access via password reset Fixes: https://github.com/go-gitea/gitea/issues/1310 Fixes: https://github.com/go-gitea/gitea/issues/3521 |
||
|
wxiaoguang
|
fd98ab5472 |
enhance(codeowners): support section / glob / file view display / skip review request (#40243)
Document: https://gitea.com/gitea/docs/pulls/634 ([doc PR
preview](
|
||
|
silverwind
|
0d59b737aa |
fix: upgrade Alpine base packages in Docker images (#40252)
The `alpine:3.24` base image lags behind fixes published to the Alpine repository. Both images now run `apk upgrade` before `apk add`. Packages from `apk add` are already current, so this only affects the preinstalled base packages. _Written by Claude (Opus 5.5)._ |
||
|
Giteabot
|
917badaae6 |
fix(deps): update module github.com/andybalholm/brotli to v1.2.7 [security] (#40246)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/andybalholm/brotli](https://redirect.github.com/andybalholm/brotli) | `v1.2.1` → `v1.2.7` |  |  | --- ### Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli BIT-brotli-2026-111497 / BIT-dotnet-2026-111497 / BIT-dotnet-sdk-2026-111497 / BIT-node-2026-111497 / BIT-node-min-2026-111497 / BIT-powershell-2026-111497 / [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497) / [GHSA-9v8h-qqgm-4m35](https://redirect.github.com/advisories/GHSA-9v8h-qqgm-4m35) / [GHSA-c9gr-gmg4-2vqv](https://redirect.github.com/advisories/GHSA-c9gr-gmg4-2vqv) / [GO-2026-6888](https://pkg.go.dev/vuln/GO-2026-6888) / PYSEC-2026-4322 / PYSEC-2026-4323 <details> <summary>More information</summary> #### Details In github.com/andybalholm/brotli before v1.2.7, the decompressor allocates memory for Huffman tables and block-type trees on every meta-block header without bounding the cumulative allocations relative to the input size. A small crafted brotli stream containing many empty meta-blocks with new Huffman trees can trigger hundreds of megabytes of allocations per kilobyte of input, leading to denial of service. #### Severity Unknown #### References - [https://github.com/andybalholm/brotli/security/advisories/GHSA-c9gr-gmg4-2vqv](https://redirect.github.com/andybalholm/brotli/security/advisories/GHSA-c9gr-gmg4-2vqv) - [ |
||
|
Lazizbek Ergashev
|
288d54951e |
fix(perm): keep read access for restricted collaborators on public repos (#40234)
Adding a restricted user as a read collaborator to a public repo gave them no access when the owner isn't fully public, like a limited org. Restricted users get no default read there, and `RecalculateUserAccess` dropped their read access row. - `RecalculateUserAccess` now keeps the same read rows as `refreshAccesses`, on org-owned repos and for restricted users. - Re-saving an unchanged collaborator permission recalculates access, repairing collaborators affected before this fix. Fixes https://github.com/go-gitea/gitea/issues/40233 Assisted-by: Claude Code:claude-opus-5-5 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
b81b50be55 |
fix(build): pass # test patterns to go test -run unchanged (#39977)
The `test-backend#` and `test-integration#` targets rewrote every `.` into `/`, because GNU make pattern rules never match goals containing `/`. That broke regexes like `make 'test-backend#TestA.*'`, which silently selected subtests instead. Static pattern rules built from the goals accept `/` directly, so the pattern reaches `go test -run` unchanged. Subtests are now selected like `make 'test-backend#TestA/sub'`, on GNU make 3.81 and 4.x. |
||
|
silverwind
|
c62db5b2a3 |
perf: reduce git processes and queries on pull request view (#40224)
Removes redundant work from the pull request conversation tab. - Base and head refs resolve through the `cat-file` batch of the git repos the callers already hold, instead of two `git rev-parse` processes, reducing the number of git processes from 9 to 7 per page, about 17 ms faster locally. - Sidebar reviewers are batch-loaded and code-review comments reuse their loaded poster, reducing the number of SQL queries from 387 to 358 on a PR with 169 timeline entries and 15 reviews. Also fixes the commit list of merged pull requests, which resolved the merge base as a branch name and returned 500. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Andrew Barnes
|
4a9d49bb46 |
fix(dump): --file extension is ignored when --type is not set (#40235)
`gitea dump -f backup.tar.gz` without `--type` wrote a zip archive under that name. Detecting the type from the file name was requested in https://github.com/go-gitea/gitea/issues/24622 and intended in https://github.com/go-gitea/gitea/pull/30240, but the check read the still-empty result instead of `--file`, so every name fell back to zip. A supported extension now selects the type, other names like `backup` or `gitea.bak` still default to zip. An explicit `--type` still wins, and its help text now mentions the detection. AI disclosure: written with Claude Code (claude-opus-5-5). --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
b7c1fb2a39 |
enhance: enable DEFAULT_DELETE_BRANCH_AFTER_MERGE by default for new repos (#39975)
Switch the `DEFAULT_DELETE_BRANCH_AFTER_MERGE` default from https://github.com/go-gitea/gitea/pull/36917 to `true`, saving users a click on merge for the most common action that deletes the PR branch on merge. Docs: https://gitea.com/gitea/docs/pulls/608 |
||
|
rafał przypek
|
3b9b8a8976 |
fix(packages): return empty Chef dependencies instead of null (#40237)
Fixes #40230 Cookbooks without dependencies are served with `"dependencies": null` from the universe and version metadata endpoints. This happens because `omitempty` drops the empty map when the metadata is stored. Chef clients iterate over this value and Policyfile resolution crashes. Supermarket returns `{}` for these cookbooks, Gitea now does too. The fix checks whether dependencies are `nil` while building response, returns an empty map if true. This way cookbooks that are already stored are covered without a re-upload. Tested with the Chef integration test and `chef-cli install`. Assisted by Claude Code (claude-opus-5-5). |
||
|
Lunny Xiao
|
565f1b7d52 |
fix(migrations): Do not fail Bitbucket Server migration when pull request activities cannot be loaded (#40205)
Bitbucket Server can answer 500 for `/pull-requests/{id}/activities` of
some pull requests. That error aborted the whole repository migration:
`bitbucket server API .../pull-requests/128/activities returned status
500`
Now a 500 is logged as a warning and that pull request's comments,
reviews and merge commit are skipped, cached so the endpoint is not hit
again. Other errors are still returned, so the migration retries them as
before.
---------
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
silverwind
|
e87ac3a0f4 |
chore(deps): update go.yaml.in/yaml/v4 to v4.0.0 (#40222)
Update go-yaml from the rc.6 pseudo-version to the stable v4.0.0 release, and actionslib to v1.5.2, which does the same in https://gitea.com/gitea/actionslib/pulls/32. The bump also brings in actionslib v1.5.1. v4 double-quotes the `on` key like yaml.v3 did, so one jobparser fixture changes. Runner counterpart: https://gitea.com/gitea/runner/pulls/1381. Fixes: https://github.com/go-gitea/gitea/issues/40145 |
||
|
GiteaBot
|
4477d47d07 | [skip ci] Updated translations via Crowdin | ||
|
Mark
|
bfbf8cd366 |
fix: fix missing accessible name on static Fomantic combobox dropdowns (#40163)
Fixes https://github.com/go-gitea/gitea/issues/40107 Static Fomantic dropdowns get `role="combobox"` or `role="menu"`, and neither role takes its accessible name from child contents (`nameFrom: author` only). Dropdowns like Filter and Sort on `/explore/repos` without `data-tooltip-content`, `aria-label` or `aria-labelledby` therefore had an empty accessible name. If the focusable element still has no `aria-label` or `aria-labelledby` after the tooltip check, link `aria-labelledby` to the dropdown's direct `.text` or `span` child. Selection dropdowns are skipped because their `.text` holds the current value, not a label. --------- Co-authored-by: Mark <14371969+malfunctionAI@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
dfe6db6149 |
fix(web): build issue popup request from parsed link (#40207)
The issue reference popup built its `/info` request from the raw link path, so a link ending in `/owner/repo/issues/N` queried an unrelated location. It now builds the request from the owner, repo, type and index parsed from the link, with `parseIssueHref` anchored to the pathname under `appSubUrl`. |
||
|
Lazizbek Ergashev
|
d1c980cf8b |
fix(web): inline the site manifest (#40198)
Inline the web app manifest as a `data:` URL instead of serving it from `/assets/site-manifest.json`. That endpoint has been linked through `STATIC_URL_PREFIX` since https://github.com/go-gitea/gitea/pull/37405 and fails to load when: 1. a reverse proxy checks auth on every request, because browsers fetch manifests without cookies 2. `STATIC_URL_PREFIX` serves the `public/` directory from disk, which has no such file 3. `STATIC_URL_PREFIX` is cross-origin, because the endpoint sends no CORS headers The manifest is built per request so `start_url` follows `PUBLIC_URL_DETECTION`. A reverse proxy that adds a stricter CSP must allow `manifest-src data:`. Fixes https://github.com/go-gitea/gitea/issues/40197 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
1152bc0cf2 |
fix(actions): evaluate job if: against needs finished in the same pass (#40126)
The job emitter resolves a dependency chain in several rounds in memory, but a job's `if:` reads its needs' results from the database, where a need skipped or failed earlier in the same pass was still blocked. A job with `if: always() && needs.build.result == 'skipped'` was therefore skipped instead of started. Finished statuses are now persisted at the end of each round, which also replaces the separate handling of skipped and failed reusable workflow callers. |
||
|
silverwind
|
159e6d7e75 |
test(actions): run repo Actions API tests as a non-owner repo admin (#40183)
The repo-level runner, secret and variable API tests ran as the repo owner, who bypasses the repo admin check. That's how the regression fixed in https://github.com/go-gitea/gitea/pull/40174 slipped through. As suggested in https://github.com/go-gitea/gitea/pull/40174#issuecomment-6591991824, they now run as an admin collaborator, which replaces the duplicate subtest added there. The tests are also trimmed to one case per status code, because `services/secrets/validation_test.go` already unit tests name validation. |
||
|
Paul van der lei
|
f29eedad83 |
fix(pull): code owner team is requested again after a member reviewed (#40187)
When a member of a CODEOWNERS team approves or rejects a pull request, `SubmitReview` removes the team's review request. On the next push, `PullRequestCodeOwnersReview` finds no request for that team and adds it again, so every team member except the author gets a new "Requested to review" mail. This happens even when the push doesn't change the PR's diff (for example, merging the base branch into the PR branch) and the approval is still valid. Individual code owners don't have this problem: they are skipped when they already have a review. This PR applies the same rule to teams. A team is not requested again while one of its members has an approve or reject review on the PR that hasn't been dismissed. If that review is dismissed (for example by "Dismiss stale approvals"), the team is requested again as before. Testing: `TestPullView_CodeOwnerTeamAnsweredByMember` creates an org repo with `README.md @org3/team1`, opens a PR, and checks three things: the team is requested; after a member approves, a code owner pass (what a push runs) doesn't request the team again; after the approval is dismissed, the team is requested again. The test fails without the change. `make lint-backend` and the `TestPull*` integration tests pass locally on SQLite. AI disclosure: I used Claude to help trace the cause and draft the change, test and description. I reviewed and tested it myself and can explain every line. Fixes #34884. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Basavaraj S m
|
e9c5804075 |
fix(issues): hide unreadable issue types in search and milestone views (#40192)
The repository issue search JSON route sits behind the issues reader check only, and the milestone page is open to anyone who can read either issues or pull requests, since the issue routes have to tolerate pull request permissions. Neither handler narrows the issue type to what the viewer may read: the search route takes `type=pulls` straight from the query or lists both types when it is absent, and the milestone page always lists both. A team member granted only the Issues unit on a private repository can therefore fetch every pull request's title and body as JSON and see pull requests on milestone pages, while a pull-requests-only reader sees issues there. I noticed it while comparing these routes with the API `ListIssues` handler and the web issue suggestions endpoint, which both already narrow the type. The narrowing now lives in one small helper used by all three handlers, with the search route answering 404 for a requested type the viewer cannot read, like the API does. A unit test covers both handlers with an issues-only permission. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Shivansh Garg
|
be297b7e05 |
fix(webhook): fire repository event on repository transfer (#40200)
Transferring a repository fired no `repository` webhook. It now sends a `transferred` action shaped like GitHub's, with the previous owner in `changes.owner.from.user` or `changes.owner.from.organization`. Like GitHub, it goes to the new owner's webhooks, plus the repository's own and system webhooks. - Chat webhooks render "Repository transferred from <owner>". - Actions workflows are unaffected, no trigger matches `repository` events. Fixes https://github.com/go-gitea/gitea/issues/33584 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Lunny Xiao
|
fca64e7330 |
perf: reuse request-scoped git repo in pull request conversion (#40208)
Reuse the request-scoped base git repository in `ToAPIPullRequest`, `ToPayloadPullRequest` and `ToAPIPullRequests` instead of reopening it for each conversion, so conversions share the request's `cat-file` process. - Same-repo PRs reuse the base repository for the head instead of opening it a second time. - Drop a redundant second open of the base repository. - Fork head repositories stay opened per call. A request-cached fork keeps its `cat-file` running until the request ends, which blocks deleting the fork on Windows and keeps one process per fork alive in batch status changes. --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Myers Carpenter
|
58279e39fd |
fix(actions): match pull_request unlabeled on label removal (#40215)
Fixes https://github.com/go-gitea/gitea/issues/34317 Removing a label from a pull request still started workflows with `types: [labeled]` and never matched `types: [unlabeled]`. https://github.com/go-gitea/gitea/pull/34316 derived `labeled`/`unlabeled` from the added and removed labels for issues only, while pull requests kept mapping every `label_updated` to `labeled`. Both events now share one conversion, so they cannot drift apart again. Two other label changes also triggered the wrong workflows: - Clearing all labels started no `unlabeled` workflow, because the Actions notifier ignored it - Replacing labels reported every old label as removed, so a replace that kept a label also matched `unlabeled` AI disclosure: written with Claude Code (claude-opus-5-5), session https://claude.ai/code/session_01Kw9ySGNd4ynmyX9GcVdUfw --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Nico Schlömer
|
ab295e62e4 |
fix(markup): make heading anchors match GitHub for whitespace and combining marks (#40195)
Heading anchors now keep the same characters as GitHub: letters, marks, decimal and letter numbers, connector punctuation and alphabetic symbols, with ASCII spaces turned into `-`. The rule follows [github-slugger](https://github.com/Flet/github-slugger), whose fixtures are generated from real GitHub renders. - Other whitespace, including newlines in multi-line headings, is dropped instead of becoming `-`, so `1<em space>ab` gets `#1ab` - Combining marks are kept, so `हिन्दी` no longer becomes `हनद` - Other numbers like `²` and `①` are dropped Fixes https://github.com/go-gitea/gitea/issues/27754 This PR was written with Claude Code. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
wxiaoguang
|
d919301d36 |
refactor: remove UnmarshalHandleDoubleEncode patch and fix repo unit TODO (#39998)
Remove the `UnmarshalHandleDoubleEncode` runtime workaround for an old xorm bug, and normalize legacy double-encoded JSON in `repo_unit.config` and `login_source.cfg` with a migration instead. - Config `FromDB` no longer fails on corrupted values. A broken auth source is deactivated, so admins can still fix it in the admin panel - Remove `ProjectsConfig.GetProjectsMode`, `FromDB` already defaults `ProjectsMode` Actually it doesn't need so many changes, just because AI thinks it should handle "corrupted database value" for auth sources. --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Alan Hsu
|
666e6e2d17 |
fix(web): allow clearing the full name in profile settings (#40186)
Clearing "Full Name" in the profile settings shows success but keeps the old value: since #31959 it is only updated when non-empty, because the input is disabled (not submitted) when `change_full_name` is disabled. Use `*string` for the field, so a missing field keeps the value and an empty one clears it. With `change_full_name` disabled, any submitted value (including empty) is now rejected. Not `optional.Option[string]`, because `MaxSize` would count slice elements instead of characters. Fixes #40185 --- AI disclosure: written with Claude Code (claude-opus-5-5) and tested locally. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
Jon Fuller
|
4d00ed2a1e |
fix(notifications): avoid deadlock when creating issue notifications concurrently (#40166)
Concurrent `notification-service` workers can deadlock in the transaction for-loop. The transaction is useless, so it is removed to avoid deadlock. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
ce0da8a378 |
build: cross-compile in docker (#40136)
Building the backend under QEMU takes 46 to 54 minutes per foreign platform in the nightly image build, against 7 minutes natively. The backend stage now runs on the build platform and cross-compiles with `GOOS`/`GOARCH`/`GOARM`, so every platform builds at native speed. - `go generate` runs once instead of once per platform. - The PR docker dry run builds all three platforms in a single job, on any docker-related change. --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
Gaurav Dubey
|
f26a314636 |
fix(api): keep wiki page name when editing with an empty title (#40153)
Match `PATCH /repos/{owner}/{repo}/wiki/page/{pageName}` document "leave
empty to keep unchanged"
Fixes #39179
---------
Co-authored-by: silverwind <me@silverwind.io>
|
||
|
Jon Fuller
|
5c68ba3e0a |
fix(repo): avoid deadlock when updating language stats concurrently (#40167)
The `repo_stats_update` queue only deduplicates waiting items, so several workers can index the same repository at once, then `UpdateLanguageStats` can lead to transaction deadlock. Use a global lock to avoid concurrent updates, and also helps https://github.com/go-gitea/gitea/pull/39342 to avoid duplicate updates. --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
78eb95ab19 |
fix: enable more djlint rules and improve keyboard navigation (#40081)
Enable djlint's [H018](https://djlint.com/docs/linter/#h018), [H046](https://djlint.com/docs/linter/#h046) and [H054](https://djlint.com/docs/linter/#h054) rules, fix their findings and the keyboard navigation problems around them. H054 found links nested in `<button>` dropdowns and radio inputs nested in links, both invalid HTML. - "Add File" and "More Operations" in the repo file list become `div` dropdowns, the disabled state stays unfocusable - The diff whitespace menu marks the current option with a check and `aria-current` instead of radios, which made our dropdown aria patch announce it as a combobox - Sign-in moves "Forgot password?" below "Sign In" and drops the positive tabindexes from https://github.com/go-gitea/gitea/pull/31689, so the tab order follows the DOM: username, password, remember, sign in, forgot - The focus ring on primary, red and green buttons is near-white on dark themes and near-black on light ones, the primary-colored ring was invisible on primary buttons <img width="500" alt="Whitespace menu, before and after" src="https://github.com/user-attachments/assets/d22a423d-95e5-434c-aec4-59264c7132b7" /> <img width="600" alt="Sign-in form, main and this PR" src="https://github.com/user-attachments/assets/d6780690-d906-4791-8a2b-8d80fb03067a" /> <img width="215" height="132" alt="Keyboard-focused primary and red buttons, dark and light theme" src="https://github.com/user-attachments/assets/a2400b18-4802-4383-8560-7e8267a7f02f" /> --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
silverwind
|
5c723ee0fd |
refactor(markdown): remove goldmark-highlighting (#39751)
Render fenced code blocks with Gitea's own code block renderer instead of `goldmark-highlighting`, using the managed lexer lookup from `modules/highlight`. Indented and fenced blocks now share one rendering path. Rendered output is unchanged. The trailing newline is stripped on copy in the frontend since https://github.com/go-gitea/gitea/pull/39755. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Giteabot
|
12b20c7c99 |
chore(deps): update dependencies (#40168)
> [!NOTE]
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) | Type |
Update | Pending |
|---|---|---|---|---|---|---|
| [@primer/octicons](https://primer.style/octicons)
([source](https://redirect.github.com/primer/octicons)) | [`19.41.0` →
`19.42.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.41.0/19.42.0)
|
|
| dependencies | minor | |
|
[@typescript-eslint/parser](https://typescript-eslint.io/packages/parser)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser))
| [`8.72.0` →
`8.72.1`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.72.0/8.72.1)
|
|
| devDependencies | patch | |
| @​vitest/eslint-plugin | [`1.6.27` →
`1.6.28`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.27/1.6.28)
|
|
| devDependencies | patch | |
| [astral-sh/setup-uv](https://redirect.github.com/astral-sh/setup-uv) |
`v10.3.0` → `v10.3.2` |
|
| action | patch | `v10.3.3` |
| [chart.js](https://www.chartjs.org)
([source](https://redirect.github.com/chartjs/Chart.js)) | [`4.5.1` →
`4.6.1`](https://renovatebot.com/diffs/npm/chart.js/4.5.1/4.6.1) |
|
| dependencies | minor | |
| [cli/cli](https://redirect.github.com/cli/cli) | `2.103.2` → `2.103.3`
|
|
| | patch | |
|
[connectrpc.com/connect/v2](https://redirect.github.com/connectrpc/connect-go)
| `v2.0.1` → `v2.0.2` |
|
| require | patch | |
|
[crowdin/github-action](https://redirect.github.com/crowdin/github-action)
| `v3.4.0` → `v3.5.0` |
|
| action | minor | |
| [djlint](https://redirect.github.com/djlint/djLint) | `==1.46.6` →
`==1.47.1` |
|
| dependency-groups | minor | `1.49.2` (+4) |
| [docker/login-action](https://redirect.github.com/docker/login-action)
| `v4.6.0` → `v4.7.0` |
|
| action | minor | |
| [elasticsearch](https://hub.docker.com/_/elasticsearch)
([source](https://redirect.github.com/elastic/dockerfiles)) | `3f4d63c`
→ `ef5cafd` | | | service | digest | |
|
[eslint-plugin-unicorn](https://redirect.github.com/sindresorhus/eslint-plugin-unicorn)
| [`78.0.0` →
`79.0.0`](https://renovatebot.com/diffs/npm/eslint-plugin-unicorn/78.0.0/79.0.0)
|
|
| devDependencies | major | |
| [eslint-plugin-vue](https://eslint.vuejs.org)
([source](https://redirect.github.com/vuejs/eslint-plugin-vue)) |
[`10.11.1` →
`10.12.0`](https://renovatebot.com/diffs/npm/eslint-plugin-vue/10.11.1/10.12.0)
|
|
| devDependencies | minor | |
|
[getmeili/meilisearch](https://redirect.github.com/meilisearch/meilisearch)
| `c94e58c` → `1f578fa` | | | service | digest | |
| [gitea.dev/sdk](https://gitea.com/gitea/go-sdk) | `v1.3.0` → `v1.5.0`
|
|
| require | minor | `v1.5.1` |
|
[github.com/buildkite/terminal-to-html/v3](https://redirect.github.com/buildkite/terminal-to-html)
| `v3.17.1` → `v3.17.3` |
|
| require | patch | |
|
[github.com/dlclark/regexp2/v2](https://redirect.github.com/dlclark/regexp2)
| `v2.9.1` → `v2.11.0` |
|
| require | minor | `v2.12.0` |
|
[github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi)
| `v0.151.0` → `v0.152.0` |
|
| require | minor | |
|
[github.com/go-co-op/gocron/v2](https://redirect.github.com/go-co-op/gocron)
| `v2.22.0` → `v2.23.0` |
|
| require | minor | |
|
[github.com/go-redsync/redsync/v4](https://redirect.github.com/go-redsync/redsync)
| `v4.18.0` → `v4.18.1` |
|
| require | patch | |
| [github.com/google/pprof](https://redirect.github.com/google/pprof) |
`1facf8f` → `dbd0ed3` |
|
| require | digest | |
|
[gitlab.com/gitlab-org/api/client-go/v3](https://gitlab.com/gitlab-org/api/client-go)
| `v3.29.0` → `v3.39.1` |
|
| require | minor | `v3.40.2` (+3) |
| [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) |
`v1.84.0` → `v1.85.0` |
|
| require | minor | |
| [katex](https://katex.org)
([source](https://redirect.github.com/KaTeX/KaTeX)) | [`0.19.0` →
`0.19.1`](https://renovatebot.com/diffs/npm/katex/0.19.0/0.19.1) |
|
| dependencies | patch | |
|
[markdownlint-cli](https://redirect.github.com/igorshubovych/markdownlint-cli)
| [`0.49.1` →
`0.50.0`](https://renovatebot.com/diffs/npm/markdownlint-cli/0.49.1/0.50.0)
|
|
| devDependencies | minor | |
|
[material-icon-theme](https://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/main/README.md)
([source](https://redirect.github.com/material-extensions/vscode-material-icon-theme))
| [`5.39.0` →
`5.40.0`](https://renovatebot.com/diffs/npm/material-icon-theme/5.39.0/5.40.0)
|
|
| devDependencies | minor | |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `v1.60.1` →
`v1.61.0` |
|
| require | minor | `v1.61.1` |
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`12.14.0` →
`12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |
|
| packageManager | minor | |
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm))
| [`>= 12.14.0` → `>=
12.16.1`](https://renovatebot.com/diffs/npm/pnpm/12.14.0/12.16.1) |
|
| engines | minor | |
| [postcss](https://postcss.org/)
([source](https://redirect.github.com/postcss/postcss)) | [`8.5.31` →
`8.5.32`](https://renovatebot.com/diffs/npm/postcss/8.5.31/8.5.32) |
|
| dependencies | patch | |
| [renovate](https://renovatebot.com)
([source](https://redirect.github.com/renovatebot/renovate)) |
[`44.172.2` →
`44.190.1`](https://octochangelog.com/compare?repo=renovatebot%2Frenovate&from=44.172.2&to=44.190.1)
|
|
| | minor | `44.200.0` (+21) |
|
[renovatebot/github-action](https://redirect.github.com/renovatebot/github-action)
| `v46.3.9` → `v46.3.10` |
|
| action | patch | `v46.3.12` (+1) |
|
[typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint))
| [`8.72.0` →
`8.72.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.72.0/8.72.1)
|
|
| devDependencies | patch | |
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`8.3.4` →
`8.3.5`](https://renovatebot.com/diffs/npm/vite/8.3.4/8.3.5) |
|
| dependencies | patch | |
---
### Release Notes
<details>
<summary>primer/octicons (@​primer/octicons)</summary>
###
[`v19.42.0`](https://redirect.github.com/primer/octicons/releases/tag/%40primer/octicons%4019.42.0)
[Compare
Source](https://redirect.github.com/primer/octicons/compare/@primer/octicons@19.41.0...@primer/octicons@19.42.0)
##### Minor Changes
- [#​1381](https://redirect.github.com/primer/octicons/pull/1381)
[`d25ce68df9d08abd65431a8a48b45446432f1b45`](
|
||
|
wxiaoguang
|
cdadd0c788 |
fix(actions): make Actions API work with repo admin permission (#40174)
The web route already uses "repo admin" for repo-level Actions management. * Fix #40173 --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
Abdellatif Anaflous
|
2ed6a6f61b |
fix(web): read the wiki blob excerpt from the wiki repository (#40165)
The "load more lines" button in wiki diffs returned 404. `ExcerptBlob` loads the commit from the wiki repo but read the blob from `ctx.Repo.GitRepo`, a regression from https://github.com/go-gitea/gitea/pull/38464. Read the blob from the repo the commit was loaded from. --------- Co-authored-by: Abdel <hktitof@users.noreply.github.com> Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
1f51d2c318 |
test: run e2e tests in WebKit on Linux (#40152)
WebKit was removed from the e2e tests in https://github.com/go-gitea/gitea/pull/37315 because Linux WebKit kept crashing. The crashes came from a use-after-free in the libsoup bundled with WebKit, which killed the network process and surfaced as `WebKit encountered an internal error`. macOS WebKit never had them because it does not use libsoup. Playwright 1.64 bundles libsoup 3.6.6 with the fix (https://github.com/microsoft/playwright/issues/42803), so WebKit now runs on all platforms. Builds on https://github.com/go-gitea/gitea/pull/40140. The e2e job ran 50 times on `ubuntu-latest` with WebKit enabled, and all runs passed without WebKit errors. The third browser adds about 1.5 to 2 minutes per run. 1. Playwright installs its system dependencies on GitHub runners too, which only come with the Chromium and Firefox libraries 1. The passkey test skips Linux WebKit, which has no WebAuthn, Playwright only stubs `PublicKeyCredential` there --------- Signed-off-by: silverwind <me@silverwind.io> |
||
|
bircni
|
d3021b69ee |
enhance: replace tea CLI with gt (#40036)
tea has been replaced by [gitea-cli](https://gitea.com/gitea/cli) (`gt`), which reuses tea's OAuth2 client ID. - The repository clone panel now offers `gt repo clone owner/repo` under a "Gitea CLI" tab. - The built-in OAuth2 application is renamed from `tea` to `gitea-cli`. `tea` in `[oauth2] DEFAULT_APPLICATIONS` is still accepted as an alias, so existing configs keep working. - Instances that already registered the app keep its stored display name "tea". |
||
|
silverwind
|
c62e07f18a |
fix(projects): only require project write to move board cards (#40161)
Follow-up to https://github.com/go-gitea/gitea/pull/30205, per https://github.com/go-gitea/gitea/pull/30205#discussion_r4435046605. Moving a card on a project board is a project operation, so project write is enough again. Repository boards already show every card to project writers, who then got a 404 when moving one. The per-card archived check is removed too. The frontend sends every card of the target column, so one card from an archived repository rejected all drops and reorders into that column, silently. Project workflows already skip archived repositories, and an archived repository's own board is read-only. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
bircni
|
51368e1997 |
ci: use GitHub merge queue (#40130)
Requiring branches to be up to date reruns the full CI matrix on every waiting PR after each merge, which saturates our 20 concurrent jobs. A merge queue still tests against the latest `main`, but once per batch. This runs the PR workflows on `merge_group` and reports `giteabot/lgtm` on queue commits, since GiteaBot only sets it on PR heads. Mergers queue PRs with "Merge when ready" instead of `reviewed/wait-merge`, so giteabot no longer updates branches. Nothing changes until the `merge-queue` ruleset is enabled and "Require branches to be up to date" is turned off. Backport to `release/v28` before the ruleset covers it. --------- Co-authored-by: silverwind <me@silverwind.io> |
||
|
silverwind
|
eba3a81c9a |
ci: build snap nightlies every 12 hours instead of on every push (#40150)
The snap nightly ran on every push to `main`, about 58 runs and 520 job minutes a week on GitHub-hosted runners, which share the concurrent job limit with PR CI. It now runs as a job in `release-nightly.yml`, reusing its 12-hourly check for new commits on `main`, like https://github.com/go-gitea/gitea/pull/40138 did for the other nightlies. A new release tag is still published by the first build after `main` changes. |
||
|
silverwind
|
2a5c34c379 |
fix(pull): reject pull requests without common history (#39872)
Pull requests between branches without a common history show no commits and can never be merged. The web form already rejects them, but the API and crafted `..` compare POSTs did not. The API compared with `..` since https://github.com/go-gitea/gitea/pull/36105, it now uses `...` again and returns 422 when there is no merge base. |