cf89ecd887
refactor!: move go-chi/session into Gitea ( #39504 )
...
The `gitea.com/go-chi/session` package only exists for Gitea, so it
moves into `modules/session` to fix its bugs directly. Fixes the flake
in
https://github.com/go-gitea/gitea/actions/runs/36726154500/job/109923538400 .
- Sessions are only written back when changed, so a read-only request
can't revert a concurrent change or restore a logged-out session, like
https://github.com/go-macaron/session/commit/ae808a4a4660c802965c834299ab08f167effd12
- The session cookie is only set once a session holds data
- Every backend refreshes the expiry on load and file sessions are
written atomically
- Also fix https://github.com/go-gitea/gitea/issues/36176
## ⚠️ BREAKING ⚠️
* the `mysql`, `postgres`, `couchbase` and `memcache` session providers
are removed, use `file`, `db` or `redis` instead
* login-related cookies are renamed to `gitea_session` and
`gitea_remember`, if you'd like to use the old names, set `COOKIE_NAME`
and `COOKIE_REMEMBER_NAME` in app.ini
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
2026-10-02 21:08:14 +02:00
bea6fcaa84
refactor: move go-chi/cache into Gitea ( #39530 )
...
The `gitea.com/go-chi/cache` package only exists for Gitea, so it moves
into `modules/cache`.
- `ITEM_TTL = -1` disables caching as documented
- Sub-second TTLs round up instead of never expiring
- The Redis adapter no longer grows a `MacaronCache` hash
- Use two-queue cache for in-memory cache
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
2026-10-02 18:16:34 +02:00
873efed5a6
refactor: move go-chi/captcha into Gitea ( #39529 )
...
The `gitea.com/go-chi/captcha` package only exists for Gitea,
so it moves into `modules/imagecaptcha`.
- Reloading an expired challenge shows a new image instead of a broken one
- Every answer is consumed on its first check
- OpenID registration stops after a failed captcha
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
2026-10-02 22:21:41 +08:00
e6ffbea888
refactor: move go-chi/binding into Gitea ( #39528 )
...
The `gitea.com/go-chi/binding` package only exists for Gitea, so it
moves into `modules/web/binding` to fix its bugs directly. Split out of
https://github.com/go-gitea/gitea/pull/39504 .
- GET and HEAD always bind the query
- JSON `null` slice elements and nested `TrimSpace` fields bind
correctly
- Integer fields reject out-of-range values instead of wrapping
- An empty JSON body binds nothing and an unknown binding rule is an
error
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
Co-authored-by: bircni <bircni@icloud.com >
2026-10-02 15:37:41 +02:00
2f01ec38bd
fix: use READ COMMITTED transactions on MySQL and MariaDB ( #39506 )
...
MariaDB 11.6.2+ defaults `innodb_snapshot_isolation` to `ON`, which
fails REPEATABLE READ transactions with error 1020 when a row they write
changed after their first read. Gitea's background work like push
processing writes the same rows, so merges, issue closes and workflow
runs fail sporadically.
- Use READ COMMITTED on MySQL and MariaDB, like PostgreSQL and MSSQL
- Update xorm to v1.4.3
Replaces: https://github.com/go-gitea/gitea/pull/39494
Fixes: https://github.com/go-gitea/gitea/issues/39492
---------
Signed-off-by: silverwind <me@silverwind.io >
2026-10-01 19:55:58 +00:00
fba8d7eace
chore(deps): update dependencies ( #39462 )
2026-09-28 14:05:07 +02:00
f757631a47
feat(actions): update actionslib, support self:, misc fixes ( #39358 )
...
Updates actionslib to https://gitea.com/gitea/actionslib/releases/tag/v1.2.1 , moves workflow
parsing into it and aligns behaviour with GitHub.
1. `uses:` supports `self:` (Gitea-only feature) and `$/` paths.
1. `strategy`, `matrix`, `max-parallel` and `fail-fast` accept
expressions, including over `needs`. A job whose `name`, `runs-on` or
`continue-on-error` reads `needs` is resolved once they finish.
1. A job `if:` may only read `github`, `needs`, `vars` and `inputs` and
is decided before the matrix, as on github.com.
1. Matrix `fail-fast` cancels the other combinations, and `always()`
jobs keep running when a run is cancelled.
1. Invalid workflow files, including a malformed `on:` and unknown or
cyclic `needs`, show up on push as failed runs with the error.
1. A job whose `if:` or `concurrency:` fails to evaluate is skipped or
failed with the error, instead of staying blocked.
1. Reusable workflows: a missing and an unreadable repository fail
alike, public callers cannot use private workflows, nested jobs cannot
exceed the caller's token permissions.
1. Runner labels match case-insensitively, and `runs-on` accepts an
array from an expression.
Runner PR: https://gitea.com/gitea/runner/pulls/1247
Docs PR: https://gitea.com/gitea/docs/pulls/553
Fixes: https://github.com/go-gitea/gitea/issues/38990
Fixes: https://github.com/go-gitea/gitea/issues/39382
Fixes: https://github.com/go-gitea/gitea/issues/32364
Fixes: https://github.com/go-gitea/gitea/issues/36077
Fixes: https://github.com/go-gitea/gitea/issues/23277
Fixes: https://github.com/go-gitea/gitea/issues/29020
Co-authored-by: Claude (Opus 5) <noreply@anthropic.com >
Co-authored-by: Zettat123 <zettat123@gmail.com >
2026-09-25 00:06:42 +02:00
fc28937a8d
chore(deps): update dependencies ( #39367 )
2026-09-21 12:23:03 -04:00
afb7edef07
refactor: replace AWS SDK with a REST client for CodeCommit migration ( #39330 )
...
Replace `aws-sdk-go-v2` in the CodeCommit migration with a minimal REST
client for the four read-only API calls it uses. Binary shrinks by ~3.1
MB.
Mock data was recorded against live from a AWS CodeCommit repo and then
anonymized.
Also stop storing the repo description as the default branch which fixes
below issue. All comments in
https://github.com/go-gitea/gitea/issues/34627 are addressed, the merge
metadata was fixed earlier in
https://github.com/go-gitea/gitea/pull/34645 .
Fixes: https://github.com/go-gitea/gitea/issues/34627
2026-09-17 09:58:05 +00:00
c6c671e113
refactor: replace Azure Blob SDK with a REST client ( #39315 )
...
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
2026-09-16 17:06:00 +02:00
13033827b1
chore(deps): update actionslib to v1.0.0 ( #39295 )
...
Co-authored-by: bircni <bircni@icloud.com >
2026-09-14 16:29:31 +02:00
cefb81a16f
chore(deps): update dependencies ( #39306 )
...
Co-authored-by: silverwind <me@silverwind.io >
2026-09-14 13:18:00 +00:00
cc6fc41723
chore(deps): update dependencies ( #39256 )
...
Co-authored-by: silverwind <me@silverwind.io >
2026-09-07 16:35:03 +02:00
1b2479b548
fix(deps): update module golang.org/x/crypto to v0.56.0 [security] ( #39219 )
2026-09-03 13:58:21 +02:00
535fc29ae8
chore(deps): update dependencies ( #39176 )
2026-08-31 12:34:15 +02:00
66c672d0b7
refactor: drop two unmaintained dependencies, rename the byte size helpers ( #39083 )
2026-08-27 15:31:20 +00:00
4c915ae0c2
chore(deps): update dependencies ( #39066 )
2026-08-24 17:05:31 +00:00
f261adb53f
chore: form binding trim space ( #38978 )
...
Use "binding:TrimSpace" instead of fragile IsEmptyString
And fix a bug in locale's `HasKey`: it should also try the default
language if current language doesn't have the translation key, a new
test is added.
2026-08-19 12:50:06 +00:00
6904f6480c
refactor: http request binding ( #38971 )
...
Better than before, still not good enough (more work can be done in the
future)
And add the missing error handling in the PrivateContext "bind"
middleware.
By the way, picked some "TrimSpace" changes from "fix: trim whitespace
from SMTP address and port - #38934 " (fix #38926 )
2026-08-19 14:15:42 +08:00
e223c42ee6
fix(deps): update module golang.org/x/mod to v0.40.0 [security] ( #38914 )
2026-08-17 19:29:07 +00:00
596b7f7a25
chore(deps): update dependencies ( #38947 )
2026-08-17 15:10:17 +02:00
133a3b8567
fix(deps): update module golang.org/x/image to v0.45.0 [security] ( #38930 )
...
Co-authored-by: bircni <bircni@icloud.com >
2026-08-15 15:43:20 +02:00
e3ee28f15b
fix(avatar): use sha256 and inline the federated avatar lookup ( #38843 )
...
- Hash emails with sha256. Gravatar moved to sha256, and both it and
libravatar.org serve the same image for either hash.
- Drop `strk.kbt.io/projects/go/libravatar` for a 46 line inline SRV
lookup. It could not bound or cancel its DNS query and panicked on an
unexpected resolver error. The replacement carries the request context
and a 3s timeout.
- Fix federated avatars querying DNS for every avatar on every render.
`loadAvatarSetting` compared a cache field that was never assigned, so
each call rebuilt the resolver and dropped its cache. That cache is
gone, both settings are read where they are used.
- Migration 348 recreates `email_hash` with a 64 char hash column and a
`hash_type` column, so a later algorithm change can tell old rows apart.
The MD5 rows are unreachable and their `UNIQUE` email index would reject
the SHA256 replacements.
- Fix a re-saved avatar form replacing an uploaded avatar with a random
one.
- Remove the `duoshuo` `GRAVATAR_SOURCE` alias, that service shut down
in 2017.
- Remove dead i18n key.
Fixes: https://github.com/go-gitea/gitea/issues/34284
Fixes: https://github.com/go-gitea/gitea/issues/28110
Docs: https://gitea.com/gitea/docs/pulls/499
Signed-off-by: silverwind <me@silverwind.io >
2026-08-10 23:13:28 +00:00
a8fe401613
chore(deps): update dependencies ( #38851 )
2026-08-10 15:50:32 +02:00
2087d4a1a5
refactor: use the shared workflow model from actionslib ( #38768 )
...
Pairs with https://gitea.com/gitea/runner/pulls/1143 .
Gitea depends on `gitea.com/gitea/runner` for exactly two packages:
`act/model` and `act/exprparser`, the workflow model and the expression
evaluator it needs to parse workflows and to build the task payload the
runner consumes. Pulling the whole runner module in for that is heavy
and puts shared code in the repository of one of the two consumers.
Both packages now live in `gitea.dev/actionslib` (`pkg/model`,
`pkg/exprparser`), the module Gitea and the runner already share for the
runner API, so the dependency on the runner repository is dropped here.
### Changes
- `gitea.com/gitea/runner/act/model` ->
`gitea.dev/actionslib/pkg/model`, `.../act/exprparser` ->
`gitea.dev/actionslib/pkg/exprparser` (22 files, import paths only).
- `routers/api/actions/runner/interceptor.go` takes the `x-runner-uuid`
/ `x-runner-token` names from `gitea.dev/actionslib/pkg/protocol`
instead of repeating the literals the runner also has.
- `go.mod`: `gitea.com/gitea/runner` removed.
---------
Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com >
Co-authored-by: silverwind <me@silverwind.io >
Co-authored-by: Zettat123 <zettat123@gmail.com >
2026-08-07 20:56:40 -07:00
a954257fb1
chore(deps): update dependencies ( #38757 )
...
Co-authored-by: silverwind <me@silverwind.io >
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
2026-08-03 21:37:12 +08:00
94a2c3ec18
chore(deps): update dependencies ( #38660 )
...
Signed-off-by: silverwind <me@silverwind.io >
Co-authored-by: silverwind <me@silverwind.io >
2026-07-27 16:55:27 +00:00
13d0f24423
feat: Replace SSE with WebSocket for UI notifications ( #36965 )
...
* Closes #36942
* Fixes #19265
Replaces the SSE-based push channel (`/user/events`) with a WebSocket
endpoint (`/-/ws`).
### What changes
- **New `/-/ws` endpoint** (authenticated). One WebSocket per origin,
shared across tabs via a single `SharedWorker`.
- **Pubsub broker** (`services/pubsub`) for fan-out by topic, behind a
`Broker` interface. `MemoryBroker` is the default (single process); a
Redis backend is available for multi-process setups, configured via
`[websocket].PUBSUB_TYPE` / `PUBSUB_CONN_STR`. The internal Gitea queue
was not usable here because it has FIFO/single-consumer semantics.
- **Push-only event production.** Events are emitted by write-triggered
notifiers — `NotificationCountChange`, `PublishStopwatchesForUser`, and
the logout publisher — wired into the existing `notify.Notifier`
interface. No server-side pollers.
- **Typed pub/sub on the client.** `web_src/js/modules/worker.ts` is a
singleton transport; features subscribe per event type via
`onUserEvent('notification-count', cb)` instead of branching on
`event.data.type`.
- **Wire contract** (`UserEventType` union) is shared between the worker
and consumers via `web_src/js/types.ts`, kept in sync with
`services/websocket/events.go`.
- **Client-side periodic polling fallback** kicks in only when the
WebSocket cannot be established (e.g. proxy blocks WS, browser lacks
module-SharedWorker support).
### What's removed
- `modules/eventsource` (SSE manager, run loop, messenger).
- `/user/events` route and `tests/integration/eventsource_test.go`.
- All server-side polling for stopwatches and notification counts.
### Stopwatch multi-tab fix
The navbar stopwatch icon was previously rendered conditionally on `{{if
$activeStopwatch}}`, so tabs loaded before the timer started had no DOM
element to update. The icon and popup are now always rendered (toggled
with `tw-hidden`), and the start/stop/cancel handlers POST silently so
all open tabs reflect the change in real time.
### Deployment note
WebSocket needs the upgrade headers to pass through a reverse proxy,
e.g. for nginx:
```nginx
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
```
Without them the WebSocket cannot be established, and after 3
consecutive failed opens the shared worker signals `push-unavailable`:
the notification count and stopwatch fall back to periodic polling on
the existing `[ui.notification]` timeouts. Real-time push is lost, the
features keep working. The reverse-proxy docs need the same note (see
the `docs-update-needed` label).
---------
Co-authored-by: silverwind <me@silverwind.io >
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
Co-authored-by: Epid <rexmrj@gmail.com >
2026-07-27 07:46:00 +00:00
39cc4db4ba
fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] ( #38623 )
2026-07-24 22:14:44 +00:00
bc3f63095b
fix(deps): update module google.golang.org/grpc to v1.82.1 [security] ( #38567 )
2026-07-22 16:47:29 +02:00
4af9156c36
refactor: implement mcaptcha client and add comments/tests ( #38561 )
...
End users still need it, so it's better to make it maintainable with
tests and OOM-safe.
---------
Co-authored-by: silverwind <me@silverwind.io >
2026-07-21 13:41:54 +00:00
2fec2affc4
chore(deps): update dependencies ( #38538 )
...
Also include:
chore(deps): update npm dependencies #38542
chore(deps): update action dependencies #38541
chore(deps): update module golang.org/x/vuln to v1.6.0 #38540
2026-07-20 09:27:21 +00:00
506075c480
fix(deps): update go dependencies ( #38429 )
2026-07-15 06:47:08 +00:00
ed9b02985a
fix(deps): update module github.com/google/go-github/v88 to v89 ( #38433 )
2026-07-14 08:48:58 +00:00
b96bd22372
fix(deps): update go dependencies ( #38346 )
2026-07-07 10:16:00 +00:00
580cc26d63
chore: Upgrade xorm to 1.4.1 ( #38224 )
...
Fix #22275
Changelog: https://gitea.com/xorm/xorm/compare/v1.3.11..v1.4.1
2026-07-06 17:07:58 +00:00
6ae42ca9c4
fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.42.0 ( #38266 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
|
[gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go )
| `v2.40.1` → `v2.42.0` |
|
|
---
> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/37531) for more information.
---
### Release Notes
<details>
<summary>gitlab-org/api/client-go
(gitlab.com/gitlab-org/api/client-go/v2)</summary>
###
[`v2.42.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.42.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.41.0...v2.42.0 )
#### 2.42.0
##### 🚀 Features
- Add missing fields to project level jira integration
([!2925 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2925 ))
by [Heidi Berry](https://gitlab.com/heidi.berry )
###
[2.42.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.41.0...v2.42.0 )
(2026-06-24)
###
[`v2.41.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.41.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.40.1...v2.41.0 )
#### 2.41.0
##### 🚀 Features
- Add missing attributes and endpoints to group
([!2905 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2905 ))
by [Jimmy Spagnola](https://gitlab.com/jspagnola )
##### 🔄 Other Changes
- chore(deps): update docker docker tag to v29.5.3
([!2924 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2924 ))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot )
###
[2.41.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.40.1...v2.41.0 )
(2026-06-23)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Only on Monday (`* * * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-06-29 18:09:25 +02:00
5e5f5f3116
fix(deps): update go dependencies ( #38194 )
...
Update go deps and fix discovered issues
Co-authored-by: silverwind <me@silverwind.io >
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
2026-06-29 15:10:47 +00:00
b565f3e00a
fix(deps): update module golang.org/x/image to v0.43.0 [security] ( #38219 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [golang.org/x/image](https://pkg.go.dev/golang.org/x/image ) |
[`v0.42.0` →
`v0.43.0`](https://cs.opensource.google/go/x/image/+/refs/tags/v0.42.0...refs/tags/v0.43.0 )
|
|
|
---
### Panic on VP8 alpha channel size mismatch in x/image/webp in
golang.org/x/image
[CVE-2026-46601](https://nvd.nist.gov/vuln/detail/CVE-2026-46601 ) /
[GO-2026-5061](https://pkg.go.dev/vuln/GO-2026-5061 )
<details>
<summary>More information</summary>
#### Details
The webp decoder can panic when processing a VP8 chunk with dimensions
that do not match the canvas size.
#### Severity
Unknown
#### References
- [https://go.dev/cl/787681 ](https://go.dev/cl/787681 )
- [https://go.dev/issue/79869 ](https://go.dev/issue/79869 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5061 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
[CVE-2026-46602](https://nvd.nist.gov/vuln/detail/CVE-2026-46602 ) /
[GO-2026-5062](https://pkg.go.dev/vuln/GO-2026-5062 )
<details>
<summary>More information</summary>
#### Details
The TIFF decoder does not set a limit on the size of tiles in tiled
images, permitting a malicious or corrupt image containing a very large
tile to cause unbounded memory consumption.
#### Severity
Unknown
#### References
- [https://go.dev/cl/788422 ](https://go.dev/cl/788422 )
- [https://go.dev/issue/79905 ](https://go.dev/issue/79905 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5062 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Panic decoding image with out-of-bounds strip offset in x/image/tiff
in golang.org/x/image
[CVE-2026-46604](https://nvd.nist.gov/vuln/detail/CVE-2026-46604 ) /
[GO-2026-5066](https://pkg.go.dev/vuln/GO-2026-5066 )
<details>
<summary>More information</summary>
#### Details
The TIFF decoder can panic when decoding an invalid image with an
out-of-bounds strip offset.
#### Severity
Unknown
#### References
- [https://go.dev/cl/788421 ](https://go.dev/cl/788421 )
- [https://go.dev/issue/80122 ](https://go.dev/issue/80122 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5066 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- ""
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-06-27 13:27:56 +02:00
6a7e232f1e
chore(deps): Update go to 1.26.4 and bump go dependencies ( #38023 )
...
New go version addressed multiple vulns as below.
<img width="1217" height="818" alt="image"
src="https://github.com/user-attachments/assets/f1738003-8b19-4fac-a200-6903d93f48ad "
/>
Dependencies affected:
```
gitea.com/gitea/runner - v1.0.6 → v1.0.8
gitea.dev/sdk - v1.0.1 → v1.1.0
github.com/Azure/azure-sdk-for-go/sdk/azcore - v1.20.0 → v1.22.0
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob - v1.6.3 → v1.7.0
github.com/alecthomas/chroma/v2 - v2.25.0 → v2.26.1
github.com/aws/aws-sdk-go-v2/credentials - v1.19.17 → v1.19.24
github.com/aws/aws-sdk-go-v2/service/codecommit - v1.33.14 → v1.34.4
github.com/dlclark/regexp2/v2 - v2.1.0 → v2.2.1
github.com/getkin/kin-openapi - v0.139.0 → v0.140.0
github.com/google/pprof - v0.0.0-20260507013755-92041b743c96 → v0.0.0-20260604005048-7023385849c0
github.com/jhillyerd/enmime/v2 - v2.4.0 → v2.4.1
github.com/mattn/go-sqlite3 - v1.14.44 → v1.14.45
github.com/meilisearch/meilisearch-go - v0.36.2 → v0.36.3
github.com/microsoft/go-mssqldb - v1.9.7 → v1.10.0
github.com/redis/go-redis/v9 - v9.19.0 → v9.20.0
github.com/urfave/cli/v3 - v3.9.0 → v3.9.1
gitlab.com/gitlab-org/api/client-go/v2 - v2.34.0 → v2.38.0
go.yaml.in/yaml/v4 - v4.0.0-rc.3 → v4.0.0-rc.5
golang.org/x/crypto - v0.52.0 → v0.53.0
golang.org/x/image - v0.41.0 → v0.42.0
golang.org/x/net - v0.55.0 → v0.56.0
golang.org/x/sync - v0.20.0 → v0.21.0
golang.org/x/sys - v0.45.0 → v0.46.0
golang.org/x/text - v0.37.0 → v0.38.0
golang.org/x/tools - v0.44.0 → v0.45.0
gopkg.in/ini.v1 - v1.67.2 → v1.67.3
modernc.org/sqlite - v1.50.1 → v1.52.0
```
---------
Signed-off-by: puni9869 <80308335+puni9869@users.noreply.github.com >
Co-authored-by: Nicolas <bircni@icloud.com >
2026-06-11 18:33:44 +00:00
bc2fbe77b1
refactor(actions): read runner capabilities from proto field ( #38068 )
...
[actions-proto-go v0.6.0](https://gitea.com/gitea/actions-proto-go ) adds
a
`capabilities` field to `RegisterRequest` and `DeclareRequest`. This
lets a
runner advertise the transitional `cancelling` capability directly in
the proto
message instead of through the out-of-band mechanism we used while the
proto
bump was pending.
This PR:
- Bumps `gitea.dev/actions-proto-go` to `v0.6.0`.
- Drops the forward-compat `capabilityGetter` type-assertion shim and
the
`runnerRequestHasCancellingCapability` helper, reading
`GetCapabilities()`
directly (now part of the `declareRequest` interface).
- Removes the "capability state unknown → preserve existing value"
branch.
## Why the behaviour change is correct
The shim and the `(hasSupport, known)` two-value return only existed
because the
old proto had no `capabilities` field, so we couldn't tell "runner
doesn't
support it" from "we can't see the field." With v0.6.0 the field is
always
present. Since proto3 repeated fields have no presence, "no capabilities
sent"
now unambiguously means the runner does not advertise the capability, so
a
runner that omits `cancelling` is correctly recorded as
`HasCancellingSupport =
false`.
There is no regression: prior to this bump Gitea was on `v0.5.0`, where
the
type assertion always failed and `HasCancellingSupport` was therefore
never set
from requests — so no runner relied on the preserved-unknown path.
## Compatibility
The change is wire-compatible in both directions of version skew,
because the
new field uses a previously unused field number (8 on `RegisterRequest`,
3 on
`DeclareRequest`) and the transport uses the binary protobuf codec:
- **Old runner → new Gitea:** the runner omits the field; it decodes to
an empty
capability list. Registration/declaration succeed; the runner simply
doesn't
get the cancelling feature.
- **New runner → old Gitea:** the runner sends the field; the old
server's
generated code doesn't know the field number and silently ignores it.
Registration/declaration succeed.
The feature only activates once both server and runner are on `v0.6.0`.
2026-06-11 09:18:31 +00:00
5fe77ad309
fix(deps): update go dependencies ( #37967 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [gitea.com/gitea/runner](https://gitea.com/gitea/runner ) | `v1.0.5` →
`v1.0.6` |
|
|
|
[github.com/aws/aws-sdk-go-v2/credentials](https://redirect.github.com/aws/aws-sdk-go-v2 )
| `v1.19.16` → `v1.19.17` |
|
|
|
[github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi )
| `v0.138.0` → `v0.139.0` |
|
|
| [github.com/go-chi/chi/v5](https://redirect.github.com/go-chi/chi ) |
`v5.2.5` → `v5.3.0` |
|
|
|
[github.com/go-webauthn/webauthn](https://redirect.github.com/go-webauthn/webauthn )
| `v0.17.3` → `v0.17.4` |
|
|
|
[github.com/minio/minio-go/v7](https://redirect.github.com/minio/minio-go )
| `v7.1.0` → `v7.2.0` |
|
|
|
[gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go )
| `v2.30.0` → `v2.34.0` |
|
|
---
### Release Notes
<details>
<summary>gitea/runner (gitea.com/gitea/runner)</summary>
### [`v1.0.6`](https://gitea.com/gitea/runner/releases/tag/v1.0.6 )
[Compare Source](https://gitea.com/gitea/runner/compare/v1.0.5...v1.0.6 )
#### Changelog
- fix(deps): update module github.com/opencontainers/selinux to v1.15.0
([#​990](https://redirect.github.com/gitea/runner/issues/990 ))
- chore: pin Docker base images to explicit versions
([#​992](https://redirect.github.com/gitea/runner/issues/992 ))
- chore(deps): update actions/setup-node action to v6
([#​991](https://redirect.github.com/gitea/runner/issues/991 ))
- test: make TestRunEvent integration suite runnable locally
([#​987](https://redirect.github.com/gitea/runner/issues/987 ))
- ci: add PR title linting against Conventional Commits
([#​988](https://redirect.github.com/gitea/runner/issues/988 ))
- fix: clean up job network and container when container start fails
([#​986](https://redirect.github.com/gitea/runner/issues/986 ))
</details>
<details>
<summary>getkin/kin-openapi (github.com/getkin/kin-openapi)</summary>
###
[`v0.139.0`](https://redirect.github.com/getkin/kin-openapi/releases/tag/v0.139.0 )
[Compare
Source](https://redirect.github.com/getkin/kin-openapi/compare/v0.138.0...v0.139.0 )
#### What's Changed
- feat(openapi3): batch-convert long-tail RequiredFieldError sites by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1170](https://redirect.github.com/getkin/kin-openapi/pull/1170 )
- feat(openapi3): typed validation error clusters (combined:
[#​1171](https://redirect.github.com/getkin/kin-openapi/issues/1171 )-[#​1179](https://redirect.github.com/getkin/kin-openapi/issues/1179 ))
by [@​reuvenharrison](https://redirect.github.com/reuvenharrison )
in
[#​1180](https://redirect.github.com/getkin/kin-openapi/pull/1180 )
- openapi3gen: skip component export for anonymous types by
[@​0-don](https://redirect.github.com/0-don ) in
[#​1163](https://redirect.github.com/getkin/kin-openapi/pull/1163 )
- feat: migrate to oasdiff/yaml v0.1.0 single Unmarshal API + enable
DisableTimestamps by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1181](https://redirect.github.com/getkin/kin-openapi/pull/1181 )
- openapi3: typed context errors for Validate() wrapper chain by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1183](https://redirect.github.com/getkin/kin-openapi/pull/1183 )
- openapi3: track Origin on the document root (T) by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1184](https://redirect.github.com/getkin/kin-openapi/pull/1184 )
- openapi3: tests flakiness corrected by
[@​fenollp](https://redirect.github.com/fenollp ) in
[#​1159](https://redirect.github.com/getkin/kin-openapi/pull/1159 )
- openapi3: aggregate independent validation errors via EnableMultiError
by [@​reuvenharrison](https://redirect.github.com/reuvenharrison )
in
[#​1185](https://redirect.github.com/getkin/kin-openapi/pull/1185 )
- openapi3: fix validation of duplicated path templates by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1189](https://redirect.github.com/getkin/kin-openapi/pull/1189 )
- openapi3: type the remaining bare-error validation sites by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1187](https://redirect.github.com/getkin/kin-openapi/pull/1187 )
**Full Changelog**:
<https://github.com/getkin/kin-openapi/compare/v0.138.0...v0.139.0 >
</details>
<details>
<summary>go-chi/chi (github.com/go-chi/chi/v5)</summary>
###
[`v5.3.0`](https://redirect.github.com/go-chi/chi/releases/tag/v5.3.0 )
[Compare
Source](https://redirect.github.com/go-chi/chi/compare/v5.2.5...v5.3.0 )
#### What's Changed
- Use strings.ReplaceAll where applicable by
[@​JRaspass](https://redirect.github.com/JRaspass ) in
[#​1046](https://redirect.github.com/go-chi/chi/pull/1046 )
- Propagate inline middlewares across mounted subrouters by
[@​LukasJenicek](https://redirect.github.com/LukasJenicek ) in
[#​1049](https://redirect.github.com/go-chi/chi/pull/1049 )
- add go 1.26 to ci by
[@​pkieltyka](https://redirect.github.com/pkieltyka ) in
[#​1052](https://redirect.github.com/go-chi/chi/pull/1052 )
- Remove last uses of io/ioutil by
[@​JRaspass](https://redirect.github.com/JRaspass ) in
[#​1054](https://redirect.github.com/go-chi/chi/pull/1054 )
- Simplify chi.walk with slices.Concat by
[@​JRaspass](https://redirect.github.com/JRaspass ) in
[#​1053](https://redirect.github.com/go-chi/chi/pull/1053 )
- Apply the stringscutprefix modernizer by
[@​JRaspass](https://redirect.github.com/JRaspass ) in
[#​1051](https://redirect.github.com/go-chi/chi/pull/1051 )
- Bump minimum Go to 1.23, always use request.Pattern by
[@​JRaspass](https://redirect.github.com/JRaspass ) in
[#​1048](https://redirect.github.com/go-chi/chi/pull/1048 )
- middleware: fix httpFancyWriter.ReadFrom double-counting bytes with
Tee by [@​alliasgher](https://redirect.github.com/alliasgher ) in
[#​1085](https://redirect.github.com/go-chi/chi/pull/1085 )
- Fix typo in Route doc comment by
[@​gouwazi](https://redirect.github.com/gouwazi ) in
[#​1073](https://redirect.github.com/go-chi/chi/pull/1073 )
- fix: set Request.Pattern from RoutePattern() by
[@​leno23](https://redirect.github.com/leno23 ) in
[#​1097](https://redirect.github.com/go-chi/chi/pull/1097 )
- feat: middleware.ClientIP, a replacement for middleware.RealIP by
[@​VojtechVitek](https://redirect.github.com/VojtechVitek ) in
[#​967](https://redirect.github.com/go-chi/chi/pull/967 )
#### New Contributors
- [@​LukasJenicek](https://redirect.github.com/LukasJenicek ) made
their first contribution in
[#​1049](https://redirect.github.com/go-chi/chi/pull/1049 )
- [@​alliasgher](https://redirect.github.com/alliasgher ) made
their first contribution in
[#​1085](https://redirect.github.com/go-chi/chi/pull/1085 )
- [@​gouwazi](https://redirect.github.com/gouwazi ) made their
first contribution in
[#​1073](https://redirect.github.com/go-chi/chi/pull/1073 )
- [@​leno23](https://redirect.github.com/leno23 ) made their first
contribution in
[#​1097](https://redirect.github.com/go-chi/chi/pull/1097 )
#### SECURITY: middleware.ClientIP, a replacement for middleware.RealIP
[@​VojtechVitek](https://redirect.github.com/VojtechVitek )
submitted PR
[#​967](https://redirect.github.com/go-chi/chi/issues/967 ), which
introduces middleware.ClientIP — a replacement for middleware.RealIP
that closes the three open spoofing advisories:
-
[GHSA-9g5q-2w5x-hmxf](https://redirect.github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf )
— IP spoofing via XFF in `RemoteAddr` resolution (convto)
-
[GHSA-rjr7-jggh-pgcp](https://redirect.github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp )
— RealIP allows IP spoofing via unvalidated XFF (rezmoss)
-
[GHSA-3fxj-6jh8-hvhx](https://redirect.github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx )
— IP spoofing in `middleware.RealIP` (Saku0512, Critical / 9.3)
It also addresses issues outlined at:
- [#​708](https://redirect.github.com/go-chi/chi/issues/708 )
- <https://adam-p.ca/blog/2022/03/x-forwarded-for/ >
- [#​711](https://redirect.github.com/go-chi/chi/issues/711 )
- [#​453](https://redirect.github.com/go-chi/chi/issues/453 )
- [#​908](https://redirect.github.com/go-chi/chi/pull/908 )
`middleware.RealIP` is deprecated in this PR with pointers to the new
API.
The deprecation only adds a `// Deprecated:` doc comment; the function
keeps working for backward compatibility.
##### Why a new middleware (not "fix RealIP in place")
`RealIP` has two unfixable design choices: it mutates `r.RemoteAddr`,
and it tries to be a one-size-fits-all default by walking a hard-coded
list of headers any client can supply. Per [adam-p's "The perils of the
'real' client IP"](https://adam-p.ca/blog/2022/03/x-forwarded-for/ )
(which calls chi out by name on this), there is no safe default — the
user must pick their trust source explicitly.
##### The new API
Four middlewares, two accessors. Pick exactly one middleware based on
your
infrastructure, read the result with one of the two accessors:
```go
// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler
// Read the result.
func GetClientIP(ctx context.Context) string // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work
```
#### Example usage:
```go
// Pick a single ClientIP middleware based on your deployment
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))
// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))
// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))
// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
"13.32.0.0/15", // CloudFront IPv4
"52.46.0.0/18", // CloudFront IPv4
"2600:9000::/28", // CloudFront IPv6
))
// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))
// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)
```
And in your handler or downstream middleware:
```go
clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.
```
***
Thanks to [@​adam-p](https://redirect.github.com/adam-p ),
[@​c2h5oh](https://redirect.github.com/c2h5oh ),
[@​rezmoss](https://redirect.github.com/rezmoss ),
[@​Saku0512](https://redirect.github.com/Saku0512 ),
[@​convto](https://redirect.github.com/convto ),
[@​Dirbaio](https://redirect.github.com/Dirbaio ),
[@​jawnsy](https://redirect.github.com/jawnsy ),
[@​lrstanley](https://redirect.github.com/lrstanley ),
[@​mfridman](https://redirect.github.com/mfridman ),
[@​n33pm](https://redirect.github.com/n33pm ),
[@​pkieltyka](https://redirect.github.com/pkieltyka ) for the prior
discussions, detailed reviews, advisory reports, and test contributions
that shaped this PR.
**Full Changelog**:
<https://github.com/go-chi/chi/compare/v5.2.5...v5.3.0 >
</details>
<details>
<summary>go-webauthn/webauthn
(github.com/go-webauthn/webauthn)</summary>
###
[`v0.17.4`](https://redirect.github.com/go-webauthn/webauthn/blob/HEAD/CHANGELOG.md#v0174-2026-05-22 )
[Compare
Source](https://redirect.github.com/go-webauthn/webauthn/compare/v0.17.3...v0.17.4 )
##### Dependency Updates
This release just contains updates to dependencies.
</details>
<details>
<summary>minio/minio-go (github.com/minio/minio-go/v7)</summary>
###
[`v7.2.0`](https://redirect.github.com/minio/minio-go/releases/tag/v7.2.0 )
[Compare
Source](https://redirect.github.com/minio/minio-go/compare/v7.1.0...v7.2.0 )
#### What's Changed
- Use go tool for ci-lint check by
[@​klauspost](https://redirect.github.com/klauspost ) in
[#​2229](https://redirect.github.com/minio/minio-go/pull/2229 )
- Rename github.com/go-ini/ini to gopkg.in/ini.v1 by
[@​ramondeklein](https://redirect.github.com/ramondeklein ) in
[#​2232](https://redirect.github.com/minio/minio-go/pull/2232 )
- Add RDMA / NVIDIA GPU Direct Storage support by
[@​harshavardhana](https://redirect.github.com/harshavardhana ) in
[#​2233](https://redirect.github.com/minio/minio-go/pull/2233 )
**Full Changelog**:
<https://github.com/minio/minio-go/compare/v7.1.0...v7.2.0 >
</details>
<details>
<summary>gitlab-org/api/client-go
(gitlab.com/gitlab-org/api/client-go/v2)</summary>
###
[`v2.34.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.34.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.33.0...v2.34.0 )
#### 2.34.0
##### 🚀 Features
- Extend DeploymentDeployablePipeline with web_url
([!2902 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2902 ))
by [Jan Berge Sommerdahl](https://gitlab.com/sommerdahl )
##### 🔄 Other Changes
- chore(deps): update docker docker tag to v29.5.1
([!2903 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2903 ))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot )
###
[2.34.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.33.0...v2.34.0 )
(2026-05-27)
###
[`v2.33.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.33.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.32.0...v2.33.0 )
#### 2.33.0
##### 🚀 Features
- feat(work-items): add ListWorkItemTypes to WorkItemsService
([!2864 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2864 ))
by [Emmanuel 326](https://gitlab.com/Emmanuel326 )
##### 🔄 Other Changes
- chore(deps): update module cel.dev/expr to v0.25.2
([!2881 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2881 ))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot )
###
[2.33.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.32.0...v2.33.0 )
(2026-05-27)
##### Features
* **work-items:** add ListWorkItemTypes to WorkItemsService
([e71cb99](https://gitlab.com/gitlab-org/api/client-go/commit/e71cb994482aa882eb8eb9fc4140ca1e4aac25ab ))
###
[`v2.32.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.32.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.31.0...v2.32.0 )
#### 2.32.0
##### 🚀 Features
- feat(ci-job-cancel): force cancel
([!2872 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2872 ))
by [Filip Aleksic](https://gitlab.com/faleksic )
###
[2.32.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.31.0...v2.32.0 )
(2026-05-23)
##### Features
* **ci-job-cancel:** force cancel
([aa46bd1](https://gitlab.com/gitlab-org/api/client-go/commit/aa46bd18428834eebdb42622f2523c64686021e8 ))
###
[`v2.31.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.31.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.30.0...v2.31.0 )
#### 2.31.0
##### 🚀 Features
- Adds project service accounts API
([!2899 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2899 ))
by [Jimmy Spagnola](https://gitlab.com/jspagnola )
- feat(gitlaboauth2): support ephemeral ports in CallbackServer
([!2877 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2877 ))
by [Raphael Rösch](https://gitlab.com/raphael.roesch )
###
[2.31.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.30.0...v2.31.0 )
(2026-05-22)
##### Features
* **gitlaboauth2:** support ephemeral ports in CallbackServer
([c8c388d](https://gitlab.com/gitlab-org/api/client-go/commit/c8c388d56663a8f2e27b4c74f1323d3671a6bbaf ))
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Only on Monday (`* * * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions ) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
---------
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com >
Co-authored-by: silverwind <me@silverwind.io >
2026-06-09 10:41:54 +00:00
aaf4b149fa
chore(deps): upgrade zstd seekable package ( #37988 )
...
Upgrade `github.com/SaveTheRbtz/zstd-seekable-format-go/pkg` from
`v0.8.3` to `v0.10.0`:
https://github.com/SaveTheRbtz/zstd-seekable-format-go/releases/tag/pkg%2Fv0.10.0
This keeps Gitea's seekable zstd wrapper on the stable v0.10 API while
preserving the existing public `modules/zstd` API.
API migration:
- update `SeekableWriter` and `SeekableReader` internals for the
concrete `*seekable.Writer` and `*seekable.Reader` types introduced by
SaveTheRbtz/zstd-seekable-format-go#264
- update generated dependency metadata after `go mod tidy` removed the
now-unused `github.com/google/btree` transitive dependency
- no Gitea call sites needed changes because `modules/zstd` still
exposes the same constructors and interfaces
Validation:
- `go test ./modules/zstd`
- `make --always-make checks-backend`
---------
Co-authored-by: Giteabot <teabot@gitea.io >
2026-06-04 13:38:56 +00:00
ab2a72fe04
fix(deps): update module github.com/google/go-github/v87 to v88 ( #37971 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
|
[github.com/google/go-github/v87](https://redirect.github.com/google/go-github )
| `v87.0.0` → `v88.0.0` |
|
|
---
### Release Notes
<details>
<summary>google/go-github (github.com/google/go-github/v87)</summary>
###
[`v88.0.0`](https://redirect.github.com/google/go-github/releases/tag/v88.0.0 )
[Compare
Source](https://redirect.github.com/google/go-github/compare/v87.0.0...v88.0.0 )
This release contains the following breaking API changes:
- refactor!: Change app installation `Find*` methods to `Get*`
([#​4243](https://redirect.github.com/google/go-github/issues/4243 ))
BREAKING CHANGE: App installation methods are renamed from `Find*` to
`Get*`.
...and the following additional changes:
- chore: Bump version of go-github to v88.0.0
([#​4245](https://redirect.github.com/google/go-github/issues/4245 ))
- chore: Update `openapi_operations.yaml`
([#​4242](https://redirect.github.com/google/go-github/issues/4242 ))
- feat: Add support for setting client URLs
([#​4240](https://redirect.github.com/google/go-github/issues/4240 ))
- refactor: Add constants for API versions
([#​4236](https://redirect.github.com/google/go-github/issues/4236 ))
- docs: Formatting and punctuation changes
([#​4235](https://redirect.github.com/google/go-github/issues/4235 ))
- feat: Add `GetParentIssue` for sub-issues
([#​4232](https://redirect.github.com/google/go-github/issues/4232 ))
- chore: Bump go-github from v86 to v87 in /scrape
([#​4234](https://redirect.github.com/google/go-github/issues/4234 ))
</details>
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-06-01 23:32:32 +00:00
d0eba5e961
chore(deps): update urfave/cli/v3 to v3.9.0 ( #37863 )
...
Updates `github.com/urfave/cli/v3` to
[v3.9.0](https://github.com/urfave/cli/releases/tag/v3.9.0 ) and removes
the renovate pin now that
[urfave/cli#2319 ](https://github.com/urfave/cli/pull/2319 ) (the `-c`
help flag parsing fix) is merged.
v3.9.0 prepends the default command name to the root command's args,
which broke the old `Root().Args()` check in `isValidDefaultSubCommand`.
It now uses the command's own `Args()`.
Behavior change: `./gitea web <extra-positional-arg>` now errors with
`unknown command` instead of starting the web server and ignoring the
trailing arg. `web` takes no positional args, so this is stricter (and
arguably more correct) input handling. The intended `./gitea bad-cmd`
rejection is unchanged.
---
This PR was written with the help of Claude Opus 4.7
---------
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com >
Co-authored-by: Nicolas <bircni@icloud.com >
2026-05-30 20:56:16 +00:00
d07a42e777
fix(deps): update module golang.org/x/image to v0.41.0 [security] ( #37904 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [golang.org/x/image](https://pkg.go.dev/golang.org/x/image ) |
[`v0.40.0` →
`v0.41.0`](https://cs.opensource.google/go/x/image/+/refs/tags/v0.40.0...refs/tags/v0.41.0 )
|
|
|
---
### Panic when reading out of bound palette index in
golang.org/x/image/bmp
[CVE-2026-42500](https://nvd.nist.gov/vuln/detail/CVE-2026-42500 ) /
[GO-2026-5031](https://pkg.go.dev/vuln/GO-2026-5031 )
<details>
<summary>More information</summary>
#### Details
Decoding a paletted BMP file with an out-of-range palette index results
in a panic when accessing pixels in the invalid image.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79576 ](https://go.dev/issue/79576 )
-
[https://groups.google.com/g/golang-announce/c/uhYX90BlBvI ](https://groups.google.com/g/golang-announce/c/uhYX90BlBvI )
- [https://go.dev/cl/781500 ](https://go.dev/cl/781500 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5031 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Excessive resource consumption in PackBits decompression in
golang.org/x/image/tiff
[CVE-2026-46599](https://nvd.nist.gov/vuln/detail/CVE-2026-46599 ) /
[GO-2026-5032](https://pkg.go.dev/vuln/GO-2026-5032 )
<details>
<summary>More information</summary>
#### Details
The TIFF decoder does not place a limit on the size of
PackBits-compressed data. A maliciously-crafted image can exploit this
to cause a small image (both in terms of pixel width/height and encoded
size) to make the decoder decode large amounts of compressed data.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79577 ](https://go.dev/issue/79577 )
- [https://go.dev/cl/759960 ](https://go.dev/cl/759960 )
-
[https://groups.google.com/g/golang-announce/c/uhYX90BlBvI ](https://groups.google.com/g/golang-announce/c/uhYX90BlBvI )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5032 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- ""
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-05-30 00:04:40 +02:00
0a3e7483a4
chore: Move gitea sdk from code.gitea.io/sdk/gitea -> gitea.dev/sdk ( #37855 )
...
- Use gitea.dev/sdk instead of code.gitea.io/sdk/gitea
- Use gitea.dev/actions-proto-def instead of
code.gitea.io/actions-proto-def
2026-05-27 16:23:44 -07:00
f810e882a4
chore(deps): update chroma, regexp2 v2, replace dimiro1/reply ( #37858 )
...
- Update `github.com/alecthomas/chroma/v2` to `v2.25.0`.
- Migrate `github.com/dlclark/regexp2` to `/v2` (incorporates
https://github.com/go-gitea/gitea/pull/37664 ); drop the renovate pin.
- Replace the unmaintained `github.com/dimiro1/reply` (the last consumer
of `regexp2` v1 in our own code) with a small built-in reply parser for
incoming mail.
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com >
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com >
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
Co-authored-by: Giteabot <teabot@gitea.io >
Co-authored-by: Nicolas <bircni@icloud.com >
2026-05-27 23:39:57 +02:00
5badd1bdee
fix(deps): update go dependencies ( #37851 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
|
[connectrpc.com/connect](https://redirect.github.com/connectrpc/connect-go )
| `v1.19.2` → `v1.20.0` |
|
|
| [gitea.com/gitea/runner](https://gitea.com/gitea/runner ) | `v1.0.4` →
`v1.0.5` |
|
|
|
[gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go )
| `v2.29.0` → `v2.30.0` |
|
|
---
### Release Notes
<details>
<summary>connectrpc/connect-go (connectrpc.com/connect)</summary>
###
[`v1.20.0`](https://redirect.github.com/connectrpc/connect-go/releases/tag/v1.20.0 )
[Compare
Source](https://redirect.github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0 )
#### What's Changed
##### Other changes
- Bump minimum supported Go version to 1.25 by
[@​jonbodner-buf](https://redirect.github.com/jonbodner-buf ) in
[#​922](https://redirect.github.com/connectrpc/connect-go/issues/922 )
- Update Unary-Get query parameter order to match spec recommendation by
[@​oliversun9](https://redirect.github.com/oliversun9 ) in
[#​926](https://redirect.github.com/connectrpc/connect-go/issues/926 )
#### New Contributors
- [@​jonbodner-buf](https://redirect.github.com/jonbodner-buf )
made their first contribution in
[#​922](https://redirect.github.com/connectrpc/connect-go/issues/922 )
**Full Changelog**:
<https://github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0 >
</details>
<details>
<summary>gitea/runner (gitea.com/gitea/runner)</summary>
### [`v1.0.5`](https://gitea.com/gitea/runner/releases/tag/v1.0.5 )
[Compare Source](https://gitea.com/gitea/runner/compare/v1.0.4...v1.0.5 )
#### Changelog
- fix(deps): update module connectrpc.com/connect to v1.20.0
([#​985](https://redirect.github.com/gitea/runner/issues/985 ))
- update docker cli to v29.5.2
([#​984](https://redirect.github.com/gitea/runner/issues/984 ))
- feat: add cache.offline\_mode to reuse cached actions
([#​966](https://redirect.github.com/gitea/runner/issues/966 ))
- Remove stale Gitea 1.20 compatibility shims
([#​978](https://redirect.github.com/gitea/runner/issues/978 ))
- fix(deps): update module github.com/docker/cli to v29.5.1+incompatible
([#​979](https://redirect.github.com/gitea/runner/issues/979 ))
- fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1
([#​980](https://redirect.github.com/gitea/runner/issues/980 ))
</details>
<details>
<summary>gitlab-org/api/client-go
(gitlab.com/gitlab-org/api/client-go/v2)</summary>
###
[`v2.30.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.30.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.29.0...v2.30.0 )
#### 2.30.0
##### 🚀 Features
- feat(orbit): add GetDsl for /api/v4/orbit/schema/dsl
([!2901 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2901 ))
by [Michael Angelo Rivera](https://gitlab.com/michaelangeloio )
###
[2.30.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.29.0...v2.30.0 )
(2026-05-20)
##### Features
* **orbit:** add GetDsl for /api/v4/orbit/schema/dsl
([530031c](https://gitlab.com/gitlab-org/api/client-go/commit/530031c2854b05d05f69815ea3a7ca8fb65341a5 ))
</details>
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-05-25 21:47:47 -07:00
821d3c4672
fix(deps): update module github.com/google/go-github/v86 to v87 ( #37845 )
2026-05-25 15:28:56 +00:00
silverwind