Repository navigation
Tags
Tags
* BREAKING * Fix(git)!: route Git network operations through an internal proxy and update egress settings ([#39426](#39426)) * Feat(actions)!: add RUN_RETENTION_DAYS to delete old action runs ([#38855](#38855)) * SECURITY * Fix(git): reject invalid and duplicate Git objects on push ([#39472](#39472)) * Fix(git)!: route Git network operations through an internal proxy and update egress settings ([#39426](#39426)) * Fix(ssh): identify presented public keys by fingerprint ([#39423](#39423)) * Fix(actions): keep cancelled and unapproved fork PR runs behind the approval gate ([#39399](#39399)) * Fix(deps): update golang.org/x/crypto SSH to address denial of service ([#39219](#39219)) * Fix(repo): enforce repository-scoped authorization for team access, deletion, and package unlinking ([#39063](#39063)) * FEATURES * Feat(actions): update actionslib, support `self:`, misc fixes ([#39358](#39358)) * Feat(api): list all packages for site administrators ([#38968](#38968)) * Feat: manage bot accounts from the admin UI, API and CLI ([#38966](#38966)) * Feat(user): Personal access tokens can be regenerated ([#38907](#38907)) * Feat(actions): support `$/` prefix in reusable workflow `uses:` ([#38822](#38822)) * Feat(actions): add force-cancel workflow run API ([#38756](#38756)) * Feat(licenses): support REUSE specification in licenses ([#38720](#38720)) * Feat(api): add project APIs ([#38691](#38691)) * Feat(webhook): fire repository event on repo rename ([#38641](#38641)) * Feat: admin impersonates a user ([#38614](#38614)) * Feat(actions): add build queue view ([#38585](#38585)) * Feat(setting): add shared [redis] section as default for redis-backed subsystems ([#38550](#38550)) * Feat(repo): prioritize well-known READMEs and optimize discovery ([#38532](#38532)) * Feat(actions): implement adaptive auto-refresh for workflow runs list ([#38329](#38329)) * Feat(auth): add `disable-2fa` command ([#38275](#38275)) * Feat: Add audit logging ([#38189](#38189)) * Feat(repo): add quick repository switcher to repo header ([#38188](#38188)) * Feat(repo): support file exclusion logic in .gitea/template in template generation ([#38064](#38064)) * Feat(web): Add org removal functionality to admin user details page ([#38013](#38013)) * Feat: add watch options ([#37571](#37571)) * Feat: add deploy tokens ([#37306](#37306)) * Feat(diff): Add search and extension filter to diff sidebar ([#37068](#37068)) * Feat: Replace SSE with WebSocket for UI notifications ([#36965](#36965)) * Feat(actions): Add artifact preview in Actions run view ([#36754](#36754)) * Feat(packages): add support for uploading helm provenance files ([#36695](#36695)) * Feat: Add support for dynamic matrix evaluation in Gitea Actions workflows ([#36564](#36564)) * Feat: Add max-parallel Support for Gitea Actions ([#36357](#36357)) * Feat(actions): Add Actions API endpoints for workflow run management and logs ([#35382](#35382)) * Feat: Add block on pending codeowner reviews branch protection ([#34995](#34995)) * ENHANCEMENTS * Enhance: allow auto-closing PRs from PRs ([#39393](#39393)) * Enhance(actions): add pending job status and align job statuses with GitHub ([#39376](#39376)) * Enhance(acme): add configurable ACME profile ([#39375](#39375)) * Enhance(emoji): update to Unicode 17, unify and lazy-load emoji data ([#39363](#39363)) * Enhance: improve issue-pattern capture groups and support both internal&external trackers enabled ([#39354](#39354)) * Enhance: update mermaid to v12 ([#39331](#39331)) * Enhance(notifications): mark current notification page as read ([#39294](#39294)) * Enhance: support `ETag` on streamed repository archives, support `If-None-Match: *` ([#39289](#39289)) * Enhance: truncate but show long lines in diffs ([#39279](#39279)) * Enhance(packages): implement npm single-version API and add per-version repository ([#39267](#39267)) * Enhance: move window.config to JSON, improve CSP format ([#39236](#39236)) * Enhance: improve commit page header ([#39229](#39229)) * Enhance: Improve validation errors for secrets/variables ([#39221](#39221)) * Enhance(repo): check full repo name for dangerous operations ([#39213](#39213)) * Enhance(web): hide attachment dropzone on preview tab in combo editor ([#39204](#39204)) * Enhance(web): show attachment URL and UUID in dropzone preview ([#39203](#39203)) * Enhance(actions): make workflow dispatch choice dropdown support search ([#39154](#39154)) * Enhance(repo): unify diff stats on commit pages, misc diff tweaks ([#39134](#39134)) * Enhance: use browser's locale to detect week's first day for the contribution map ([#38995](#38995)) * Enhance(ui): forced colors mode enhancements ([#38991](#38991)) * Enhance: user-friendly packages setup manual ([#38946](#38946)) * Enhance: inherit team access for all units ([#38938](#38938)) * Enhance(admin): show impersonation banner and keep password change with the user ([#38924](#38924)) * Enhance(ui): tint toast backgrounds by level ([#38919](#38919)) * Enhance(repo): add default object format setting ([#38877](#38877)) * Enhance(actions): set ref_protected in context ([#38852](#38852)) * Enhance(ui): restyle toasts ([#38842](#38842)) * Enhance: refine repo watching ([#38835](#38835)) * Enhance: fall back to DEFAULT_TEMPLATE.md when style-specific template is missing ([#38803](#38803)) * Enhance(api): add GitHub-compatible /repos/{owner}/{repo}/commits/{ref} endpoint ([#38770](#38770)) * Enhance(api): expose file mode in contents API response ([#38713](#38713)) * Enhance(tls): use go's tls defaults ([#38687](#38687)) * Enhance(ui): improve luminance calculations ([#38682](#38682)) * Enhance(api): add `tag_filter` query parameter to release list API ([#38681](#38681)) * Enhance(actions): replace `ansi_up` with first-party code ([#38619](#38619)) * Enhance: keep status check list scrolled on merge box reload ([#38597](#38597)) * Enhance(actions): action view enhancements ([#38594](#38594)) * Enhance(ui): tweak tooltip style and misc fixes ([#38524](#38524)) * Enhance: improve e-mail templates ([#38396](#38396)) * Enhance(webhook): add reviewer name to MS Teams review request notifications ([#38289](#38289)) * Enhance: extend <video> tag allowed attributes ([#38279](#38279)) * Enhance(packages/npm): expand version metadata and support npm deprecate ([#37890](#37890)) * PERFORMANCE * Perf(references): scan only the keyword window before a reference ([#39396](#39396)) * Perf(frontend): enable vite module preload ([#39332](#39332)) * Perf(gitdiff): optimize inline diff highlighting using cache ([#38706](#38706)) * BUGFIXES * Fix(actions): preserve admitted jobs and runs in their concurrency group ([#39461](#39461)) * Fix(api): commit tree SHA is the commit ID ([#39449](#39449)) * Fix: PR merge ([#39442](#39442)) * Fix(actions): evaluate job-level `if:` before concurrency check ([#39437](#39437)) * Fix(api): allow pending-inline-comment-only reviews ([#39433](#39433)) * Fix: sanitize external render command line arguments ([#39417](#39417)) * Fix(LFS): recalculate repo LFSSize after gc-lfs removes orphaned data ([#39406](#39406)) * Fix(indexer): index full file paths and real offsets in bleve ([#39405](#39405)) * Fix(git): keep leading dashes in git grep search patterns ([#39404](#39404)) * Fix: use clearer message for ldap auth failure ([#39392](#39392)) * Fix(repo): commit page fails to render unsigned commits with a different committer ([#39381](#39381)) * Fix: focus confirm button and use red for delete confirmations ([#39350](#39350)) * Fix(migrations): preserve SHA-256 pull request commit IDs ([#39343](#39343)) * Fix(ui): misc ui fixes ([#39336](#39336)) * Fix(actions): use gitea's clock for actions durations ([#39323](#39323)) * Fix(actions): never show negative running durations ([#39322](#39322)) * Fix: package registry keypair creation race ([#39319](#39319)) * Fix: add default timeout and handle errors for HaveIBeenPwned API ([#39316](#39316)) * Fix(user): unify email validation for registration and settings ([#39304](#39304)) * Fix(ui): use button elements for branch and tag dropdown tabs ([#39285](#39285)) * Fix(auth): fix ssh and gpg key verification on windows ([#39283](#39283)) * Fix(feed): use meaningful lines as comment excerpt ([#39276](#39276)) * Fix(projects): allow max columns to the limit ([#39272](#39272)) * Fix: pass merge commit messages to git via stdin ([#39269](#39269)) * Fix(repo): surface unrelated histories on Sync Fork ([#39258](#39258)) * Fix: avoid nil panic and refactor some trivial problems ([#39251](#39251)) * Fix: restore missing blob file when re-publishing a package ([#39239](#39239)) * Fix(automerge): validate head commit before merge ([#39235](#39235)) * Fix(httplib): prevent leaking localhost:3000 in public links ([#39217](#39217)) * Fix(setting): honor bare -1 for timeout settings ([#39181](#39181)) * Fix: correct repo/attatchment absolute url and release layout ([#39178](#39178)) * Fix(web): populate the reason for "cannot commit to branch" in web editor commit form ([#39155](#39155)) * Fix(process): reap entire process group on cmd.Cancel ([#39143](#39143)) * Fix: recognize linguist language aliases ([#39135](#39135)) * Fix(repo): preserve transfer recipient collaboration ([#39042](#39042)) * Fix(db): make paginated database reads always require "order" option ([#39017](#39017)) * Fix: make local queue PopItem can be notified ([#39011](#39011)) * Fix: classify git failures on stderr, restrict migration failure detail ([#39010](#39010)) * Fix: allow re-requesting uncounted review approvals ([#38988](#38988)) * Fix(actions): allow larger scheduled workflows ([#38985](#38985)) * Fix: resolve actions commit status permission per repository ([#38977](#38977)) * Fix(deps): update module golang.org/x/image to v0.45.0 [security] ([#38930](#38930)) * Fix(deps): update module golang.org/x/mod to v0.40.0 [security] ([#38914](#38914)) * Fix: dedupe issue cross-reference timeline entries ([#38881](#38881)) * Fix(server): set `ReadHeaderTimeout` on HTTP servers ([#38878](#38878)) * Fix(repo): avoid a repo-sized temp file for every bundle download ([#38863](#38863)) * Fix(lfs): ensure lock listing paginates with a total order ([#38850](#38850)) * Fix(avatar): use sha256 and inline the federated avatar lookup ([#38843](#38843)) * Fix(gitdiff): render exact-limit diffs and zero-limit comments ([#38838](#38838)) * Fix(deps): update dependency mermaid to v11.16.1 [security] ([#38813](#38813)) * Fix: misc fixes in pub/gpg/tests ([#38809](#38809)) * Fix: git diff blob excerpt ([#38808](#38808)) * Fix(packages): show error for duplicate cleanup rules #37820 ([#38786](#38786)) * Fix(actions): fix runner docs link ([#38783](#38783)) * Fix: git cache ([#38763](#38763)) * Fix(actions): evaluate each `${{ }}` part on its own ([#38754](#38754)) * Fix: don't report failed network requests as JavaScript errors ([#38732](#38732)) * Fix(gitdiff): prevent index out of range panic in GetLineTypeMarker ([#38728](#38728)) * Fix(api): document X-Total-Count instead of non-existent X-Total header ([#38717](#38717)) * Fix(actions): dynamic matrix expansion correctness fixes ([#38690](#38690)) * Fix(auth): record last sign-in on reverse proxy login ([#38672](#38672)) * Fix(api): accept fully-qualified refs in contents API ([#38650](#38650)) * Fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] ([#38623](#38623)) * Fix(deps): update dependency js-yaml to v5.2.2 [security] ([#38622](#38622)) * Fix: abort superseded issue suggestion requests ([#38620](#38620)) * Fix(issue): display error toast on batch action failures instead of reloading page ([#38593](#38593)) * Fix(deps): update module google.golang.org/grpc to v1.82.1 [security] ([#38567](#38567)) * Fix(deps): update module github.com/google/go-github/v88 to v89 ([#38433](#38433)) * Fix(deps): update go dependencies ([#38429](#38429)) * Fix(deps): update go dependencies ([#38346](#38346)) * Fix(deps): update npm dependencies ([#38342](#38342)) * Fix(base): correct natural sort of numbers with leading zeros ([#38163](#38163)) * Fix(ui): avoid layout shifts in `overflow-menu` and repo filter ([#37818](#37818)) * Fix: make auth source group sync correctly handle team removal ([#37161](#37161)) * Fix(release): separate publication time from the release date ([#36761](#36761)) * TESTING * Test: stop tests from writing into `~/.ssh` ([#39348](#39348)) * Test(e2e): log out to switch users in pr-review test ([#39328](#39328)) * Test: release fixtures loader lock before database work ([#39263](#39263)) * Test: speed up tests, fix transaction bug ([#39030](#39030)) * Test: run frontend unit tests in browsers ([#38860](#38860)) * Test(pubsub): stop racing the Redis SUBSCRIBE ack ([#38661](#38661)) * Test(e2e): add pull request merge box test, update AGENTS.md ([#38576](#38576)) * Test(e2e): deterministically wait for event stream in logout propagation test ([#38535](#38535)) * BUILD * Refactor: fix `go vet` errors related to composite literals ([#39341](#39341)) * Build(gogit): disable gogit builds for stable releases ([#39324](#39324)) * Refactor: replace jquery.are-you-sure with first-party code ([#39233](#39233)) * Refactor: http request binding ([#38971](#38971)) * Refactor: clean up git repo and model migration packages ([#38564](#38564)) * Refactor: prepare to decouple the "model migration" package and "models" package ([#38533](#38533)) * Build: fix snapcraft release ([#38260](#38260)) * Build(release): use native golang toolchain for official release builds ([#37828](#37828)) * DOCS * Docs(webhook): review.type comment lists values the webhook never sends ([#39451](#39451)) * Docs(api): document verification and files on the compare endpoint ([#39440](#39440)) * Docs(api): name the unadopted-repository search parameter query ([#39370](#39370)) * Docs: remove unused COOKIE_USERNAME from app.example.ini ([#39365](#39365)) * Docs: document NOTICE_ON_SUCCESS for every cron task ([#39352](#39352)) * Docs: correct ALLOW_LOCALNETWORKS description in app.example.ini ([#39240](#39240)) * Docs: fix typo in README about app.ini restart ([#39223](#39223)) * Docs: fix dead localization doc link in the READMEs ([#39211](#39211)) * Docs: Update CHANGELOG for release 1.27.3 ([#39170](#39170)) * Docs: Update CHANGELOG for version 1.27.2 ([#38923](#38923)) * Docs: Update PGP key expiration date to July 23, 2027 ([#38747](#38747)) * Docs(api): document 401/403 responses for user key endpoints ([#38711](#38711)) * Docs: Update Changelog for release v1.27.1 ([#38670](#38670)) * Docs: Update Changelog for 1.27 ([#38440](#38440)) * Docs: Update Security docs ([#38422](#38422)) * MISC * Refactor: make git http respond error message ([#39390](#39390)) * Refactor(api): convert bot accounts through the admin user edit endpoint ([#39355](#39355)) * Refactor: replace AWS SDK with a REST client for CodeCommit migration ([#39330](#39330)) * Refactor: replace Azure Blob SDK with a REST client ([#39315](#39315)) * Refactor: npm route handlers ([#39275](#39275)) * Refactor: GetDiffShortStat and fix panic caused by inconsistent "changed file number" ([#39248](#39248)) * Refactor(templates): update djlint to 1.46.0 and resolve its new findings ([#39231](#39231)) * Refactor: pagination/pager ([#39162](#39162)) * Refactor: share package registry error status classification ([#39133](#39133)) * Refactor: drop two unmaintained dependencies, rename the byte size helpers ([#39083](#39083)) * Refactor(automerge): fix error handling, populate recent automerge tasks on restart ([#39001](#39001)) * Refactor: deploy key and private route handlers ([#38999](#38999)) * Refactor: wiki edit form ([#38918](#38918)) * Refactor: clean up form binding & validation ([#38873](#38873)) * Refactor: markup render ([#38864](#38864)) * Refactor: api token scope check ([#38862](#38862)) * Refactor: replace `gliderlabs/ssh` with `golang.org/x/crypto/ssh` ([#38837](#38837)) * Refactor: form binding validation ([#38832](#38832)) * Refactor: prepare vue components for vapor mode ([#38798](#38798)) * Refactor: use the shared workflow model from actionslib ([#38768](#38768)) * Refactor(modelmigration): thread context through migration functions ([#38758](#38758)) * Refactor: migrate remaining Vue components to `<script setup>` ([#38752](#38752)) * Refactor: introduce trString for frontend ([#38741](#38741)) * Refactor(diff): drive diff DOM init from the global selector observer ([#38740](#38740)) * Refactor(git): clarify GetBranch behavior to make it only gets an existing branch ([#38662](#38662)) * Refactor: replace debounce/throttle deps with first-party code ([#38610](#38610)) * Refactor: hide git repo path details from more packages ([#38601](#38601)) * Refactor: retry file remove/rename when a file is busy and clean up os detection ([#38588](#38588)) * Perf(emoji): optimize FindEmojiSubmatchIndex using slice-based Trie ([#38573](#38573)) * Refactor: implement mcaptcha client and add comments/tests ([#38561](#38561)) * Refactor: use WithRepo instead of WithDir for most git operations, clean up model migrations ([#38555](#38555)) * Refactor: remove Path field from git.Repository ([#38552](#38552)) * Refactor: make git package handle all git operations ([#38543](#38543)) * Refactor: remove unnecessary git command wrapper functions ([#38531](#38531)) * Refactor: git repo and relative path handling ([#38522](#38522)) * Refactor: clean up fragile diff render templates, use backend typed structs ([#38517](#38517)) * Refactor: correct git repo design and fix some legacy problems ([#38512](#38512)) * Refactor: fix legacy problems in cmd/serv.go ([#38505](#38505)) * Refactor: remove Ctx field from git.Repository ([#38500](#38500)) * Refactor: decouple git.Repository(ctx) from git.Commit & git.Tree ([#38464](#38464)) * Refactor: introduce ActivePageTimer to help to do partial page refresh ([#38372](#38372))
* SECURITY * fix(packages): restrict/limited/token-scope access (#39041, #39043, #39044, #39047, #39046) (#39058) * fix(attachments): enforce owning repository path (#39048) (#39077) * fix(markup): enforce same-repository issue access (#39045) (#39054) * fix(actions): verify raw artifact signatures first (#39049) (#39053) * fix(api): hide limited users from restricted viewers (#39004) (#39039) * fix(repo): limit gitignore template selections (#39027) (#39040) * fix(migrations): cancel GitLab version probes (#39023) (#39035) * fix(packages): limit Swift package manifests (#39025) (#39032) * fix(migrations): bound OneDev version responses (#39024) (#39033) * fix(packages): limit Maven checksum uploads (#39028) (#39031) * fix(packages): bound Alpine metadata entries (#39026) (#39029) * fix(actions): enforce fork pull request trust boundaries (#39005) (#39018) * fix(git): restrict hook permissions (#39008) (#39016) * fix(api): enforce repository creation token authorization (#39007) (#39014) * fix(api): enforce public-only scope for compare heads (#39006) (#39013) * fix(repo): hide repositories of hidden owners (#39009) (#39012) * fix: avoid enumerating every public repository in issue search (#38992) (#39000) * refactor: private endpoints (#38964) (#38965) * ENHANCEMENTS * enhance: add permalinks to pull request reviews (#38849) (#39036) * BUGFIXES * fix: add missing query parameters on runner list page (#39163) * fix(actions): keep step-level continue-on-error expressions unevaluated (#39141) (#39148) * fix(packages): preserve SemVer prerelease identifiers in Swift Registry (#39156) (#39158) * fix(repo): prevent MarkAsBrokenEmpty when repository is being migrated (#39091) (#39092) * fix(asymkey): do not verify OpenPGP signatures with an SSH instance key (#39073) (#39086) * fix(pull): keep the merged state in sync with git (#39062) (#39118) * fix(pull): name the head repository in default compare links (#39075) (#39079) * fix(git): parse co-author trailers that are not RFC 5322 addresses (#39076) (#39081) * fix(actions): show "Complete job" logs when the last step is skipped (#38939) (#39003) * fix(actions): Fix how jobs in matrixes are grouped (#38980) (#38998) * fix: resolve YAML anchors and aliases in Actions workflows (#38984) (#38996) * fix: honor environment variables during install (#38974) (#38976) * fix: grant limited-org unit read access to authenticated non-members (#38871) (#38963) * fix: allow anonymous theme switching when REQUIRE_SIGNIN_VIEW is set (#38956) (#38961) * fix(actions): drop wrapper span around the action status icon (#38957) (#38959) * fix(issues): sort scoped labels by exclusive order in dropdowns (#38893) (#38954) * fix(indexer): correct bleve indexer token filters (#38853) (#38951) * fix: make "login_name" field optional for API edit user (#38917) (#38945) * fix(actions): reject non-mapping matrix include/exclude (#38933) * fix(ui): respect FEED_PAGING_NUM on the dashboard feed (#38935) (#38936) * MISC * chore: repo compare link (#39088) (#39119) * ci: remove AWS S3 uploads from release workflows (#38928) (#38929) * chore: Pre-register a builtin OAuth2 application for the official Gitea mobile app (#38880) (#38922)
* SECURITY * Fix: update collaborator access mode and httpsign (#38894, #38862) (#38895) * Refactor: external render (#38885) (#38898) * Fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897) * Refactor: markup render (#38864) (#38869) * Fix(deps): update dependency mermaid to v11.16.1 (#38816) * Fix(auth): set WebAuthn user verification per request (#38805) (#38810) * Fix: render highlight language (#38793) (#38795) * ENHANCEMENTS * enhance: add missing npm package metadata properties (#38826) (#38831) * BUGFIXES * fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908) * fix(actions): let a rerun of selected jobs read the previous attempt's artifacts (#38857) (#38901) * fix(lfs): accept successful transfer responses (#38866) (#38875) * fix(packages): ignore nested Package.swift (#38788) (#38836) * fix: drop newline-bearing member names in arch ParsePackage (#38102) (#38830) * fix(storage): fix Azure Blob dump failing with file does not exist (#38814) (#38828) * fix(migration): migration deletion returned json redirection (#38796) (#38825) * fix(ui): change underlines to default browser style (#38819) (#38823) * fix(actions): allow cancelling runs without running jobs (#35842) (#38812) * fix(actions): evaluate each `${{ }}` part on its own (#38754) (#38797) * fix(actions): write an action task report in one transaction (#38792) (#38794) * fix: markup link (#38764) (#38765) * fix: set a minio part size when the content size is unknown (#38753) (#38755) * fix: bad path escape in subpath archive download (#38749) (#38750) * fix: remove the pull merge box from UI when the refreshed page doesn't contain it (#38742) (#38744) * fix(markdown): fix double strikethough on code (#38707) (#38729) * fix(lfs): failed upload deletes a concurrent upload's meta object (#38693) (#38722) * fix: correct full url when using sub-path (#38712) (#38716) * fix: avoid markup render panic (#38698) (#38703) * fix(ui): too many participants shown in commit avatar stacks (#38689) (#38700) * fix: support HEAD requests on Alpine registry APKINDEX.tar.gz (#38686) (#38688) * fix(migrations): use all configured GitHub tokens (#38841) (#38846)
* SECURITY * fix(oauth2): enforce mandatory 2FA policy on OAuth2 authorize/grant endpoints (#38591) (#38606) * API * fix(api): align Swagger schemas for UserSettings and TopicListResponse (#38590) (#38592) * ENHANCEMENTS * enhance: improve diff contrast in light and dark themes (#37477) (#38574) * BUGFIXES * fix: skip OIDC end-session after password login for OAuth2 users (#38439) (#38666) * fix: make Actions log parser support multiple line message encoding (#38659) (#38664) * fix(actions): use base branch ref for pull_request_target context (#38636) (#38657) * fix(actions): skip already-approved runs in `ApproveRuns` (#38653) (#38654) * fix: orgmode render include path (#38642) (#38645) * fix(actions): cancel tasks immediately when the runner stopped reporting (#38616) (#38644) * fix(issues): fix label bulk-load key and reduce log noise in LoadLabel (#38632) (#38643) * fix(actions): improve runner list status sorting, labels and task job links (#38586) (#38633) * fix(actions): correctness and hardening fixes (#38518) (#38631) * fix(repo): prevent double-write redirect collisions on dependency errors, fix ui (#38627) (#38628) * fix: delete repo-scoped rows of seven more tables when deleting a repository (#38534) (#38618) * fix(webhook): remove slack channel name check (#38608) (#38612) * fix: download dropdown menu clipped on the branches page (#38604) (#38609) * fix(project): prevent database mutations on invalid MoveIssues payload (#38600) (#38602) * fix(actions): make SingleWorkflow.Marshal round-trip multi-line run blocks (stop silent job stranding) (#38520) (#38599) * fix(file-tree): handle submodule links and missing view container (#38033) (#38589) * fix(actions): fail unexpandable reusable workflow callers and decouple the job emitter's cross-run processing (#38565) (#38587) * fix: keep serving valid ACME cert when renewal fails at startup (#38554) (#38583) * fix: branch protection user list (#38570) (#38584) * fix(pulls): respect diff.orderFile in diff file tree (#38566) (#38578) * fix(issue): make issue action (issue list batch operation) elements have correct attributes (#38575) (#38580) * fix(actions): support `matrix` when evaluating workflow `if` expression (#38474) (#38557) * fix(actions): align status icon span for Safari rendering (#38558) (#38562) * fix: revert git clone http redirection forbidden (#38530) (#38545) * fix: clean up orphaned user-keyed tables in deleteUser (#38511) (#38514) * fix(actions): coerce workflow_dispatch boolean inputs to native types (#38472) (#38521) * fix: make the merge box button red if some checks fail (#38508) (#38516) * fix(pull): sign the commit when updating a branch by merge (#38441) (#38499) * fix: make commit message merge correctly (#38490) (#38502) * fix(actions): explain why a blocked or waiting job has not started (#38476) (#38498) * fix(actions): make `cancelled()` work in job `if` evaluation (#38495) (#38497) * fix(actions): show retention info on hover for expired artifacts (#38477) (#38493) * fix(actions): group reusable-workflow matrix legs in the workflow graph (#38475) (#38492) * fix: full file highlighting for git diff with CR char (#38484) (#38491) * fix(packages): serve noarch Alpine index for any requested architecture (#38479) (#38486) * fix: 500 error when updating user visibility (#38480) (#38483) * fix(actions): make job list item fully clickable (#38462) (#38471) * fix: mail template for push event (#38467) (#38468) * fix: make "test push webhook" always work (#38425) (#38455) * fix(actions): prevent bulk actions from affecting all runners (#38453) (#38457) * fix(org): align follow button and wrap description (#38448) (#38454) * fix(actions): populate `github.event` for scheduled runs (#38446) (#38452) * MISC * refactor: git patch apply (#38637) (#38638)
* BREAKING * Feat(actions)!: improve support for reusable workflows (#37478) * Use Content-Security-Policy: script nonce (#37232) * SECURITY * Fix: various security fixes (#38406) (#38426) * Fix(security): harden access checks and migration validation (#38324) (#38400) * Fix: enforce public-only token scope and harden push options / locale parsing (#38323) (#38399) * Fix(pull): re-evaluate review official flag on target branch change (#38319) (#38402) * Fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390) * Fix(lfs): require proof of possession for cross-repo objects (#38322) (#38389) * Fix(mirror): disable HTTP redirects on pull mirror sync (#38320) (#38367) * Fix: golang html template url escaping (#38363) (#38369) * Fix(release): validate web attachment renames against allowed types (#38314) (#38328) * Fix(release): gate draft release attachments on web download endpoints (#38318) (#38325) * Fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786) * Fix(oauth): restrict introspection to the token's client (#38042) * Fix(api): don't expose private org membership via public_members (#38145) * Fix(actions): deny fork-PR cross-repo access via collaborative owner (#38214) * Fix(migrations): prevent path traversal in repository restore (#38215) * FEATURES * Feat(actions): add workflow status badge modal (#38196) * Feat(actions): support owner-level and global scoped workflows (#38154) * Feat(api): support ref suffixes in compare (#38148) * Feat(actions): implement `jobs.<job_id>.continue-on-error` (#38100) * Feat(actions): show run status on browser tab favicon (#38071) * Feat(api): add token introspection and self-deletion endpoint (#37995) * Feat(api): add q parameter to list branches API for server-side filtering (#37982) * Feat(repo): split repository creation limit into user and org scopes (#37872) * Feat(actions): bulk delete, disable and enable runners in admin UI (#37869) * Feat(actions): List workflows that were executed once but got removed from the default branch (#37835) * Feat(org): add team visibility so org members can discover teams (#37680) * Feat: add raw diff/patch endpoint for repository comparisons (#37632) * Feat: Add avatar stacks (#37594) * Feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500) * Feat(web): Add Jupyter Notebook (.ipynb) Rendering Support (#37433) * Support for Custom URI Schemes in OAuth2 Redirect URIs (#37356) * Feat(orgs): Add search bar for organization members tab page (#37347) * Feat(api): Add assignees APIs (#37330) * Feat(api): Add GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs (#37196) * Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038) * Add project column picker to issue and pull request sidebar (#37037) * Allow multiple projects per issue and pull requests (#36784) * Feat(ui): add "follow rename" to file commit history list (#34994) * Feat(ssh): auto generate additional ssh keys (#33974) * ENHANCEMENTS * Enhance(actions): only create filtered-out workflow commit status for required contexts (#38371) (#38385) * Enhance: allow builtin default git config options to be overridden (#38172) * Enhance: allow MathML core elements (#38034) * Enhance(markup): improve issue title rendering (#37908) * Enhance(actions): set descriptive browser tab title on run view (#37870) * Enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 (#37866) * Enhance(actions): show workflow name from YAML instead of filename (#37833) * Feat(actions): add before/after to PR synchronize event payload (#37827) * Enhance(actions): add branch filters to run list (#37826) * Enhance(actions): Make Summary UI more beautiful with more infos (#37824) * Feat: add copy button to action step header, improve other copy buttons (#37744) * Fix(icon): use repo-forked icon to display forks count (#37731) * Feat(api): add sort and order query parameters to job list endpoints (#37672) * Feat(api): add last_sync to repository API (#37566) * Enhance: Adjust Workflow Graph styling (#37497) * Improve code editor text selection and clean up lint enablement (#37474) * Add mirror auth updates to repo edit API and settings (#37468) * Replace `olivere/elastic` with REST API client, add OpenSearch support (#37411) * Feat: Add default PR branch update style setting (#37410) * Fix inconsistent disabled styling on logged-out repo header buttons (#37406) * Allow fast-forward-only merge when signed commits are required (#37335) * Enhance styling in actions page (#37323) * Fix: improve actions status icons and texts (#37206) * Make Markdown fenced code block work with more syntaxes (#37154) * Fix: Sort action run jobs by JobID and Name with matrix examples (#37046) * Add API endpoint to reply to pull request review comments (#36683) * PERFORMANCE * Perf(actions): debounce runner heartbeat writes and throttle task picks (#38281) (#38368) * Perf(web): sort the action_run query by a repo-scoped index when possible (#38155) * Perf: Various performance regression fixes (#38078) * Perf: extend action `c_u` index to include `created_unix` for faster dashboard feeds (#38076) * Batch-load related data in actions run, job, and task API endpoints (#37032) * BUGFIXES * Fix(util): reject invalid characters between time-estimate units (#38416) (#38423) * Fix: represent a deleted assignee team as a Ghost team (#38413) (#38419) * Fix(turnstile): route CAPTCHA verification through the configured proxy (#38412) (#38420) * Fix: refresh pull request merge box when the commit status is pending (#38410) (#38411) * Fix: actions task state concurrent update (#38405) (#38409) * Fix(actions): keep workflow run trailing on one row with long branch names (#38382) (#38403) * Fix(web): use locale-aware date formatting for contribution calendar tooltips (#38398) (#38401) * Fix: co-author detection (#38392) (#38397) * Fix: incorrect co-author detection on commit page (#38386) (#38387) * Fix(ui): restore commits table column widths (#38379) (#38383) * Fix: minio init check (#38355) (#38361) * Fix: org project view assignee list (#38357) (#38360) * Fix(actions): release claimed task if context is cancelled during `FetchTask` (#38343) (#38347) * Fix(actions): make runner list pagination order deterministic (#38313) (#38327) * Fix: Improve since/until when counting commits for X-Total-Count (#38243) (#38304) * Fix(actions): prevent chevron overlap with log text when timestamps are enabled (#38227) (#38307) * Fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237) (#38302) * Fix(oauth2): persist linkAccountData during auto-link 2FA flow (#38274) (#38295) * Fix(actions): allow Actions bot to push to protected branches (#38284) (#38293) * Fix(actions): include all aggregable run statuses in status filter (#38280) (#38287) * Fix(archiver): use serializable repo-archive queue payload (#38273) (#38283) * Fix: update npm dependencies, fix misc issues (#38257) * Fix(api): respect since/until when counting commits for X-Total-Count (#38204) * Fix: codemirror regressions (#38248) * Fix(api): support HEAD requests on all API GET endpoints (#38245) * Fix(actions): Cleanup workflow status badge code (#38241) * Fix(web): Correctly align the "disabled" label on larger workflow names (#38240) * Fix(actions): don't swallow HTML entities into linkified URLs (#38239) * Fix(packages): accept npm "repository" and "bin" in string form (#38236) * Fix(actions): fix 500 error when canceling a canceling task (#38223) * Fix(deps): update module golang.org/x/image to v0.43.0 [security] (#38219) * Fix(mssql): convert legacy DATETIME columns to DATETIME2 (#38216) * Fix(api): deny private org member enumeration via /members (#38213) * Fix(actions): ensure all waiting jobs get runners in large workflows (#38200) * Fix(deps): update go dependencies (#38194) * Fix(deps): update npm dependencies (#38193) * Fix(cli): default must-change-password to false for bot users (#38175) * Fix(actions): show run index in run view and fix summary graph height (#38165) * Fix: csp (#38162) * Fix(deps): update npm dependencies (#38123) * Fix(mssql): expand legacy issue and comment long-text columns (#38120) * Fix(packages): validate debian distribution and component names (#38116) * Fix(packages): validate module version in goproxy ParsePackage (#38104) * Fix(deps): update dependency esbuild to v0.28.1 [security] (#38097) * Fix: git push hook post receive (#38089) * Fix(ui): prevent commit status popup overflowing its row (#38081) * Fix: validate gem name in rubygems parseMetadataFile (#38061) * Fix: commit display name (#38057) * Fix: csp regressions (#38047) * Fix: api error message (#38031) * Fix(deps): update npm dependencies (#38029) * Fix: pgsql lint (#38022) * Fix(indexer): fix assignee filters in issue search (#38021) * Fix: various dropdown problems (#38020) * Fix: refactor git error handling and make archive streaming handle non-existing commit id (#38007) * Fix: raise git required version to 2.13 (#37996) * Fix: remove "no-transfrom" from the cache-control header (#37985) * Fix(deps): update module github.com/google/go-github/v87 to v88 (#37971) * Fix: use committer time where ever possible as default (#37969) * Fix(deps): update npm dependencies, remove nolyfill (#37968) * Fix(deps): update go dependencies (#37967) * Fix(pull): preserve squash message trailers and additional commit messages (#37954) * Fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904) * Fix: support ##[command] log prefix in action run UI (#37882) * Fix(deps): update module github.com/google/go-github/v86 to v87 (#37845) * Fix(deps): update npm dependencies (#37844) * Fix(deps): update go dependencies (#37841) * Fix(frontend): resolve Vite assets by manifest source path (#37836) * Fix(locales): Replace hardcoded strings (#37788) * Fix(packages): render markdown links relative to linked repo (#37676) * Fix: persist mirror repository metadata (#37519) * Fix cmd tests by mocking builtin paths (#37369) * Add `form-fetch-action` to some forms, fix "fetch action" resp bug (#37305) * Feat: execute post run cleanup when workflow is cancelled (#37275) * Fix `relative-time` error and improve global error handler (#37241) * Refactor flash message and remove SanitizeHTML template func (#37179) * TESTING * Test(e2e): fix race in pdf file render test (#38380) (#38381) * Test: compare key file contents instead of `FileInfo` in `TestInitKeys` (#38330) (#38331) * Test: speed up two tests (#37905) * Test: Fix random failure test (#37887) * Test: fix flaky `issue-comment` close test (#37880) * Test: enable WAL for sqlite integration tests (#37861) * Test: fix flaky `TestResourceIndex` and reduce its runtime (#37847) * Test: run `TestAPIRepoMigrate` offline via a local clone source (#37817) * Ci: shard tests and reduce redundant work (#37618) * Test(e2e): run playwright via container (#37300) * Remove external service dependencies in migration tests (#36866) * BUILD * Fix(actions): authenticate snapcraft before nightly remote build (#38252) * Ci: cap Elasticsearch heap in db-tests (#37816) * Build(snap): publish nightly version to snapcraft via actions (#37814) * Ci: split pgsql shards into plain jobs, dedupe setup actions (#37802) * Ci: narrow files-changed frontend filter (#37749) * Ci: add `zizmor` to `lint-actions` (#37720) * Chore: clean up "contrib" dir (#37690) * Fix: snap build (main branch) (#37685) * Ci: Also lint json5 files (#37659) * Feat(editor): broaden language detection in web code editor (#37619) * Build: update pnpm to v11 (#37591) * Refactor(deps): migrate from `nektos/act` fork to `gitea/runner` (#37557) * Refactor: lint bare `fill`/`stroke` colors, add vars for git graph color series (#37543) * Update go js py dependencies (#37525) * Ci: lint PR titles with commitlint (#37498) * Chore: upgrade Go version in devcontainer image to 1.26 (#37374) * Update GitHub Actions to latest major versions (#37313) * Update go js dependencies (#37312) * Fail vite build on rolldown warnings via NODE_ENV=test (#37270) * Remove htmx (#37224) * Replace custom Go formatter with `golangci-lint fmt` (#37194) * Refactor htmx and fetch-action related code (#37186) * Integrate renovate bot for all dependency updates (#37050) * Build(sign): move to sigstore (#38250) * DOCS * Docs: update changelog for 1.26.3 & 1.26.4 (#38178) * Docs: fix duplicated word in foreachref doc comment (#38161) * Docs: Clarify criteria for becoming a merger (#38113) * Docs: Publish TOC Election Result 2026 (#38111) * Docs: mark openapi3 as autogenerated in attributes (#37963) * Docs: add development setup guide (#37960) * MISC * Revert(sign): restore gpg (#38251) * Refactor: replace legacy `delete-button` with `link-action` (#38143) * Refactor(actions): read runner capabilities from proto field (#38068) * Refactor(api): clarify APIError message usage and fix legacy lint error (#38012) * Refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977) * Fix(deps): update go dependencies (#37851) * Ci: Fix sync PR labels from the conventional-commit title (#37784) (#37825) * Ci: tweak `files-changed`, add `free-disk-space` (#37819) * Fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806) * Test(e2e): add comment, release, star, PR and fork tests (#37800) * Chore: simplify issue and pull request templates (#37799) * Chore: Update giteabot to fix failure when backport (#37789) * Fix(api): handle partial failures in push mirror synchronization gracefully (#37782) * Fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (#37771) * Ci: split giteabot workflow (#37770) * Fix(deps): update npm dependencies (#37768) * Refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go (#37764) * Fix(deps): update module google.golang.org/grpc to v1.81.1 (#37762) * Ci: fix cache-related issues (#37761) * Chore: fix tests (#37760) * Fix(deps): update module github.com/google/go-github/v85 to v86 (#37754) * Fix(deps): update npm dependencies (#37753) * Fix(deps): update go dependencies (#37752) * Chore(deps): update action dependencies (#37751) * Fix(markup): wrap indented code blocks for the code-copy button (#37748) * Chore(db): introduce db.Session and db.EngineMigration interfaces (#37746) * Feat(web): also display PR counts in repo list (#37739) * Refactor(glob): use strings.Builder for regexp compilation (#37730) * Chore(doctor): remove four obsolete doctor check implementations (#37728) * Refactor(org): simplify owner-team org repo creation logic (#37727) * Refactor: move `workflowpattern` into `modules/actions` (#37717) * Chore: clean up tests (#37715) * Style: misc UI fixes (#37691) * Ci: add shellcheck linter (#37682) * Fix: catch and fix more lint problems (#37674) * Fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662) * Fix(deps): update npm dependencies (#37647) * Ci(renovate): update Go import paths on major bumps (#37641) * Fix(deps): update go dependencies (major) (#37639) * Chore(deps): update action dependencies (major) (#37638) * Fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0 (#37637) * Fix(deps): update npm dependencies (#37636) * Refactor(log): replace log.Critical with log.Error (#37624) * Build(deps): bump fast-uri from 3.1.0 to 3.1.2 (#37616) * Feat(oauth): Support AWS Cognito OAuth2 provider (#37607) * Chore(deps): update action dependencies (#37603) * Ci: allow `chore` type in PR title lint (#37575) * Refactor: only reset a database table when the table's data was changed (#37573) * Ci: increase renovate frequency and fix RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS (#37565) * Refactor: use modernc sqlite driver as default (#37562) * Docs: fix 4 typos in CHANGELOG.md (#37549) * Fix(deps): update go dependencies (#37541) * Chore(deps): update action dependencies (#37540) * Refactor pull request view (6) (#37522) * Fix: redirect early CLI console logger to stderr (#37507) * Refactor "flex-list" to "flex-divided-list" (#37505) * Refactor compare diff/pull page (1) (#37481) * Refactor pull request view (4) (#37451) * Update 1.26.1 changelog in main (#37442) * Refactor: use named `Permission` field in `Repository` struct instead of anonymous embedding (#37441) * Refactor: serve site manifest via `/assets/site-manifest.json` endpoint (#37405) * Remove IsValidExternalURL/IsAPIURL and use IsValidURL at call sites (#37364) * Update `Block a user` form (#37359) * Move review request functions to a standalone file (#37358) * Feat(security): set X-Content-Type-Options: nosniff by default (#37354) * Enable strict TypeScript, add `errorMessage` helper (#37292) * Refactor frontend `tw-justify-between` layouts to `flex-left-right` (#37291) * Update Nix flake (#37284) * Fix Repository transferring page (#37277) * Remove `SubmitEvent` polyfill (#37276) * Remove dead code identified by `deadcode` tool (#37271) * Upgrade go-git to v5.18.0 (#37268) * Don't add useless labels which will bother changelog generation (#37267) * Move heatmap to first-party code (#37262) * Tests/integration: simplify code (#37249) * Add pagination and search box to org teams list (#37245) * Remove error returns from crypto random helpers and callers (#37240) * Add `ExternalIDClaim` option for OAuth2 OIDC auth source (#37229) * Refactor: simplify ParseCatFileTreeLine and catBatchParseTreeEntries (#37210) * Refactor "htmx" to "fetch action" (#37208) * Update go js py dependencies (#37204) * Add comment for the design of "user activity time" (#37195) * Remove outdated RunUser logic (#37180) * Models/fixtures: add "DO NOT add more test data" comment to all yml fixture files (#37150) * Update javascript dependencies (#37142) * Update go dependencies (#37141) * Frontport changelog of v1.26.0-rc0 (#37138) * Introduce `ActionRunAttempt` to represent each execution of a run (#37119) * Workflow Artifact Info Hover (#37100) * Extend issue context popup beyond markdown content (#36908) * Add bulk repository deletion for organizations (#36763) * Feat: Add bypass allowlist for branch protection (#36514)
fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2… ….42.0 (#38266) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go) | `v2.40.1` → `v2.42.0` |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/37531) for more information. --- ### Release Notes <details> <summary>gitlab-org/api/client-go (gitlab.com/gitlab-org/api/client-go/v2)</summary> ### [`v2.42.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.42.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.41.0...v2.42.0) #### 2.42.0 ##### 🚀 Features - Add missing fields to project level jira integration ([!2925](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2925)) by [Heidi Berry](https://gitlab.com/heidi.berry) ### [2.42.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.41.0...v2.42.0) (2026-06-24) ### [`v2.41.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.41.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.40.1...v2.41.0) #### 2.41.0 ##### 🚀 Features - Add missing attributes and endpoints to group ([!2905](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2905)) by [Jimmy Spagnola](https://gitlab.com/jspagnola) ##### 🔄 Other Changes - chore(deps): update docker docker tag to v29.5.3 ([!2924](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2924)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.41.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.40.1...v2.41.0) (2026-06-23) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Au 3F51 tomerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
PreviousNext