owen/gitocean
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
25,131 Commits 2 Branches 0 Tags
531a43a9a5ee53dd4e5e0c8f481a04cbbab7a52e
Commit Graph
25131 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andreas AhlenstorfandMathieu Fenniak 531a43a9a5 fix: cancel dependent jobs when rerunning jobs (#12756) 
When a single Forgejo Actions job should be rerun, its dependent jobs (those that have the job to be rerun in their `needs:`) might still be running. That means they cannot be rerun. Currently, Forgejo ignores and simply skips them. But that is wrong: their outcome is meaningless at best and wrong at worst because it depends on an outdated attempt of the job to be rerun. This is remedied by cancelling them before queueing them for a rerun, too.

Follow-up of https://codeberg.org/forgejo/forgejo/pulls/12141.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12756
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-29 04:46:57 +02:00
Mathieu FenniakandMathieu Fenniak de5f38c4ea feat: enable auth to raw resources, release downloads, & attachments via authorized integrations (#12776) 
A handful of routes, described in this PR as "mixed routes", are currently accessible by both web-based sessions and authenticated API users.  The goal of this PR is to allow access to these routes for Authorized Integrations as well, bringing them to full API compatibility (to my knowledge) with other authentication methods.  These routes are impacted:
- `/{username}/{repo}/raw/*`
- `/{username}/{repo}/archive/*`
- `/{username}/{repo}/releases/download/{vTag}/{fileName}`
- `/{username}/{repo}/attachments/{uuid}`
- `/attachments/{uuid}`

The major work in this PR was to refactoring the existing authentication methods so that "path based matching" that they were currently doing was no longer required, as I didn't want to introduce that into Authorized Integrations.  All the path based matching is removed in this PR, and authentication methods are enabled entirely by the middleware applied to their endpoints.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12776
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-29 02:11:43 +02:00
oliverpoolandGusted bd0b44d01d chore: use io.ReadFull instead of io.ReadAll for DataAsync (#12795) 
Since the final size is already known, no need to `ReadAll` a `LimitedReader`: directly `ReadFull` a properly sized buffer.

Tests are already present in `blob_test.go` (a failure can be triggered by creating a smaller `buf`).

`go test -run=TestBlob_Data -bench=Blob_Data -benchmem` before:
```
Benchmark_Blob_Data-18             43964             28727 ns/op            1373 B/op         11 allocs/op
```
After:
```
Benchmark_Blob_Data-18             41308             27679 ns/op             846 B/op         10 allocs/op
```

🎉 one allocation spared!

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12795
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-28 23:51:15 +02:00
Mathieu FenniakandMathieu Fenniak cdd35458a9 feat: enable auth to git LFS via authorized integrations (#12725) 
The goal is to enable access to Git LFS resources with Authorized Integrations JWTs.

Blocker that needed to be resolved is that adding the `AuthorizedIntegration` auth method would conflict with the LFS tokens, which are handed out during git ssh clones to allow access to LFS resources -- `AuthorizedIntegration` would mark these as `AuthenticationAttemptedIncorrectCredential`, and therefore the requests would 401 before they got to the LFS-specific token validation routines.  The fix is to move LFS token authentication into an authentication group so that it could be resolved at the same time as the authorized integration, rather than doing it inside the LFS server routines.

Refactors for LFS tokens are covered by refreshed test automation.  Authorized integrations LFS Access has been manually tested, and will be further covered in an end-to-end integration test (https://code.forgejo.org/forgejo/end-to-end/pulls/1954).

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [ ] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12725
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-28 23:20:58 +02:00
Renovate BotandMathieu Fenniak c37f5a96a9 Update google.golang.org/grpc (indirect) to v1.79.3 [SECURITY] (forgejo) (#12794) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `v1.75.0` → `v1.79.3` | ![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fgrpc/v1.79.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fgrpc/v1.75.0/v1.79.3?slim=true) |

---

### gRPC-Go has an authorization bypass via missing leading slash in :path
[CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) / [GHSA-p77j-4mvh-x3m3](https://github.com/advisories/GHSA-p77j-4mvh-x3m3) / [GO-2026-4762](https://pkg.go.dev/vuln/GO-2026-4762)

<details>
<summary>More information</summary>

#### Details
##### Impact
_What kind of vulnerability is it? Who is impacted?_

It is an **Authorization Bypass** resulting from **Improper Input Validation** of the HTTP/2 `:path` pseudo-header.

The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present.

**Who is impacted?**
This affects gRPC-Go servers that meet both of the following criteria:
1. They use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`.
2. Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule).

The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server.

##### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, the issue has been patched. The fix ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string.

Users should upgrade to the following versions (or newer):
* **v1.79.3**
* The latest **master** branch.

It is recommended that all users employing path-based authorization (especially `grpc/authz`) upgrade as soon as the patch is available in a tagged release.

##### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods:

##### 1. Use a Validating Interceptor (Recommended Mitigation)
Add an "outermost" interceptor to your server that validates the path before any other authorization logic runs:

```go
func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
    if info.FullMethod == "" || info.FullMethod[0] != '/' {
        return nil, status.Errorf(codes.Unimplemented, "malformed method name")
    }
    return handler(ctx, req)
}

// Ensure this is the FIRST interceptor in your chain
s := grpc.NewServer(
    grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor),
)
```

##### 2. Infrastructure-Level Normalization
If your gRPC server is behind a reverse proxy or load balancer (such as Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to enforce strict HTTP/2 compliance for pseudo-headers and reject or normalize requests where the `:path` header does not start with a leading slash.

##### 3. Policy Hardening
Switch to a "default deny" posture in your authorization policies (explicitly listing all allowed paths and denying everything else) to reduce the risk of bypasses via malformed inputs.

#### Severity
- CVSS Score: 9.1 / 10 (Critical)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

#### References
- [https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3](https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3)
- [https://nvd.nist.gov/vuln/detail/CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186)
- [https://github.com/grpc/grpc-go](https://github.com/grpc/grpc-go)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-p77j-4mvh-x3m3) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
[CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186) / [GHSA-p77j-4mvh-x3m3](https://github.com/advisories/GHSA-p77j-4mvh-x3m3) / [GO-2026-4762](https://pkg.go.dev/vuln/GO-2026-4762)

<details>
<summary>More information</summary>

#### Details
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc

#### Severity
Unknown

#### References
- [https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3](https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-4762) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Release Notes

<details>
<summary>grpc/grpc-go (google.golang.org/grpc)</summary>

### [`v1.79.3`](https://github.com/grpc/grpc-go/releases/tag/v1.79.3): Release 1.79.3

[Compare Source](https://github.com/grpc/grpc-go/compare/v1.79.2...v1.79.3)

### Security

- server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like `grpc/authz`. Any request with a non-canonical path is now immediately rejected with an `Unimplemented` error. ([#&#8203;8981](https://github.com/grpc/grpc-go/issues/8981))

### [`v1.79.2`](https://github.com/grpc/grpc-go/releases/tag/v1.79.2): Release 1.79.2

[Compare Source](https://github.com/grpc/grpc-go/compare/v1.79.1...v1.79.2)

### Bug Fixes

- stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. ([#&#8203;8874](https://github.com/grpc/grpc-go/pull/8874))

### [`v1.79.1`](https://github.com/grpc/grpc-go/releases/tag/v1.79.1): Release 1.79.1

[Compare Source](https://github.com/grpc/grpc-go/compare/v1.79.0...v1.79.1)

### Bug Fixes

- grpc: Remove the `-dev` suffix from the User-Agent header. ([#&#8203;8902](https://github.com/grpc/grpc-go/pull/8902))

### [`v1.79.0`](https://github.com/grpc/grpc-go/releases/tag/v1.79.0): Release 1.79.0

[Compare Source](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.0)

### API Changes

- mem: Add experimental API `SetDefaultBufferPool` to change the default buffer pool. ([#&#8203;8806](https://github.com/grpc/grpc-go/issues/8806))
  - Special Thanks: [@&#8203;vanja-p](https://github.com/vanja-p)
- experimental/stats: Update `MetricsRecorder` to require embedding the new `UnimplementedMetricsRecorder` (a no-op struct) in all implementations for forward compatibility. ([#&#8203;8780](https://github.com/grpc/grpc-go/issues/8780))

### Behavior Changes

- balancer/weightedtarget: Remove handling of `Addresses` and only handle `Endpoints` in resolver updates. ([#&#8203;8841](https://github.com/grpc/grpc-go/issues/8841))

### New Features

- experimental/stats: Add support for asynchronous gauge metrics through the new `AsyncMetricReporter` and `RegisterAsyncReporter` APIs. ([#&#8203;8780](https://github.com/grpc/grpc-go/issues/8780))
- pickfirst: Add support for weighted random shuffling of endpoints, as described in [gRFC A113](https://github.com/grpc/proposal/pull/535).
  - This is enabled by default, and can be turned off using the environment variable `GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING`. ([#&#8203;8864](https://github.com/grpc/grpc-go/issues/8864))
- xds: Implement `:authority` rewriting, as specified in [gRFC A81](https://github.com/grpc/proposal/blob/master/A81-xds-authority-rewriting.md). ([#&#8203;8779](https://github.com/grpc/grpc-go/issues/8779))
- balancer/randomsubsetting: Implement the `random_subsetting` LB policy, as specified in [gRFC A68](https://github.com/grpc/proposal/blob/master/A68-random-subsetting.md). ([#&#8203;8650](https://github.com/grpc/grpc-go/issues/8650))
  - Special Thanks: [@&#8203;marek-szews](https://github.com/marek-szews)

### Bug Fixes

- credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. ([#&#8203;8726](https://github.com/grpc/grpc-go/issues/8726))
  - Special Thanks: [@&#8203;Atul1710](https://github.com/Atul1710)
- xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in `CONNECTING` state. ([#&#8203;8813](https://github.com/grpc/grpc-go/issues/8813))
- health: Fix a bug where health checks failed for clients using legacy compression options (`WithDecompressor` or `RPCDecompressor`). ([#&#8203;8765](https://github.com/grpc/grpc-go/issues/8765))
  - Special Thanks: [@&#8203;sanki92](https://github.com/sanki92)
- transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. ([#&#8203;8769](https://github.com/grpc/grpc-go/issues/8769))
  - Special Thanks: [@&#8203;joybestourous](https://github.com/joybestourous)
- server: Propagate status detail headers, if available, when terminating a stream during request header processing. ([#&#8203;8754](https://github.com/grpc/grpc-go/issues/8754))
  - Special Thanks: [@&#8203;joybestourous](https://github.com/joybestourous)

### Performance Improvements

- credentials/alts: Optimize read buffer alignment to reduce copies. ([#&#8203;8791](https://github.com/grpc/grpc-go/issues/8791))
- mem: Optimize pooling and creation of `buffer` objects.  ([#&#8203;8784](https://github.com/grpc/grpc-go/issues/8784))
- transport: Reduce slice re-allocations by reserving slice capacity. ([#&#8203;8797](https://github.com/grpc/grpc-go/issues/8797))

### [`v1.78.0`](https://github.com/grpc/grpc-go/releases/tag/v1.78.0): Release 1.78.0

[Compare Source](https://github.com/grpc/grpc-go/compare/v1.77.0...v1.78.0)

### Behavior Changes

- client: Align URL validation with Go 1.26+ to now reject target URLs with unbracketed colons in the hostname. ([#&#8203;8716](https://github.com/grpc/grpc-go/issues/8716))
  - Special Thanks: [@&#8203;neild](https://github.com/neild)
- transport/client : Return status code `Unknown` on malformed grpc-status. ([#&#8203;8735](https://github.com/grpc/grpc-go/issues/8735))
- - xds/resolver:
  - Drop previous route resources and report an error when no matching virtual host is found.
  - Only log LDS/RDS configuration errors following a successful update and retain the last valid resource to prevent transient failures. ([#&#8203;8711](https://github.com/grpc/grpc-go/issues/8711))

### New Features

- stats/otel: Add backend service label to weighted round robin metrics as part of A89. ([#&#8203;8737](https://github.com/grpc/grpc-go/issues/8737))
- stats/otel: Add subchannel metrics (without the disconnection reason) to eventually replace the pickfirst metrics. ([#&#8203;8738](https://github.com/grpc/grpc-go/issues/8738))
- client: Wait for all pending goroutines to complete when closing a graceful switch balancer. ([#&#8203;8746](https://github.com/grpc/grpc-go/issues/8746))
  - Special Thanks: [@&#8203;twz123](https://github.com/twz123)
- client: Add `experimental.AcceptCompressors` so callers can restrict the `grpc-accept-encoding` header advertised for a call. ([#&#8203;8718](https://github.com/grpc/grpc-go/issues/8718))
  - Special Thanks: [@&#8203;iblancasa](https://github.com/iblancasa)

### Bug Fixes

- xds: Fix a bug in `StringMatcher` where regexes would match incorrectly when ignore\_case is set to true. ([#&#8203;8723](https://github.com/grpc/grpc-go/issues/8723))
- client:
  - Change connectivity state to CONNECTING when creating the name resolver (as part of exiting IDLE).
  - Change connectivity state to TRANSIENT\_FAILURE if name resolver creation fails (as part of exiting IDLE).
  - Change connectivity state to IDLE after idle timeout expires even when current state is TRANSIENT\_FAILURE.
  - Fix a bug that resulted in `OnFinish` call option not being invoked for RPCs where stream creation failed. ([#&#8203;8710](https://github.com/grpc/grpc-go/issues/8710))
- xdsclient: Fix a race in the xdsClient that could lead to resource-not-found errors. ([#&#8203;8627](https://github.com/grpc/grpc-go/issues/8627))

### Performance Improvements

- mem: Round up to nearest 4KiB for pool allocations larger than 1MiB. ([#&#8203;8705](https://github.com/grpc/grpc-go/issues/8705))
  - Special Thanks: [@&#8203;cjc25](https://github.com/cjc25)

### [`v1.77.0`](https://github.com/grpc/grpc-go/releases/tag/v1.77.0): Release 1.77.0

[Compare Source](https://github.com/grpc/grpc-go/compare/v1.76.0...v1.77.0)

### API Changes

- mem: Replace the `Reader` interface with a struct for better performance and maintainability. ([#&#8203;8669](https://github.com/grpc/grpc-go/issues/8669))

### Behavior Changes

- balancer/pickfirst: Remove support for the old `pick_first` LB policy via the environment variable `GRPC_EXPERIMENTAL_ENABLE_NEW_PICK_FIRST=false`. The new `pick_first` has been the default since `v1.71.0`. ([#&#8203;8672](https://github.com/grpc/grpc-go/issues/8672))

### Bug Fixes

- xdsclient: Fix a race condition in the ADS stream implementation that could result in `resource-not-found` errors, causing the gRPC client channel to move to `TransientFailure`. ([#&#8203;8605](https://github.com/grpc/grpc-go/issues/8605))
- client: Ignore HTTP status header for gRPC streams. ([#&#8203;8548](https://github.com/grpc/grpc-go/issues/8548))
- client: Set a read deadline when closing a transport to prevent it from blocking indefinitely on a broken connection. ([#&#8203;8534](https://github.com/grpc/grpc-go/issues/8534))
  - Special Thanks: [@&#8203;jgold2-stripe](https://github.com/jgold2-stripe)
- client: Fix a bug where default port 443 was not automatically added to addresses without a specified port when sent to a proxy.
  - Setting environment variable `GRPC_EXPERIMENTAL_ENABLE_DEFAULT_PORT_FOR_PROXY_TARGET=false` disables this change; please file a bug if any problems are encountered as we will remove this option soon. ([#&#8203;8613](https://github.com/grpc/grpc-go/issues/8613))
- balancer/pickfirst: Fix a bug where duplicate addresses were not being ignored as intended. ([#&#8203;8611](https://github.com/grpc/grpc-go/issues/8611))
- server: Fix a bug that caused overcounting of channelz metrics for successful and failed streams. ([#&#8203;8573](https://github.com/grpc/grpc-go/issues/8573))
  - Special Thanks: [@&#8203;hugehoo](https://github.com/hugehoo)
- balancer/pickfirst: When configured, shuffle addresses in resolver updates that lack endpoints. Since gRPC automatically adds endpoints to resolver updates, this bug only affects custom LB policies that delegate to `pick_first` but don't set endpoints. ([#&#8203;8610](https://github.com/grpc/grpc-go/issues/8610))
- mem: Clear large buffers before re-using. ([#&#8203;8670](https://github.com/grpc/grpc-go/issues/8670))

### Performance Improvements

- transport: Reduce heap allocations to reduce time spent in garbage collection. ([#&#8203;8624](https://github.com/grpc/grpc-go/issues/8624), [#&#8203;8630](https://github.com/grpc/grpc-go/issues/8630), [#&#8203;8639](https://github.com/grpc/grpc-go/issues/8639), [#&#8203;8668](https://github.com/grpc/grpc-go/issues/8668))
- transport: Avoid copies when reading and writing Data frames. ([#&#8203;8657](https://github.com/grpc/grpc-go/issues/8657), [#&#8203;8667](https://github.com/grpc/grpc-go/issues/8667))
- mem: Avoid clearing newly allocated buffers. ([#&#8203;8670](https://github.com/grpc/grpc-go/issues/8670))

### New Features

- outlierdetection: Add metrics specified in [gRFC A91](https://github.com/grpc/proposal/blob/master/A91-outlier-detection-metrics.md). ([#&#8203;8644](https://github.com/grpc/grpc-go/issues/8644))
  - Special Thanks: [@&#8203;davinci26](https://github.com/davinci26), [@&#8203;PardhuKonakanchi](https://github.com/PardhuKonakanchi)
- stats/opentelemetry: Add support for optional label `grpc.lb.backend_service` in per-call metrics ([#&#8203;8637](https://github.com/grpc/grpc-go/issues/8637))
- xds: Add support for JWT Call Credentials as specified in [gRFC A97](https://github.com/grpc/proposal/blob/master/A97-xds-jwt-call-creds.md). Set environment variable `GRPC_EXPERIMENTAL_XDS_BOOTSTRAP_CALL_CREDS=true` to enable this feature. ([#&#8203;8536](https://github.com/grpc/grpc-go/issues/8536))
  - Special Thanks: [@&#8203;dimpavloff](https://github.com/dimpavloff)
- experimental/stats: Add support for up/down counters. ([#&#8203;8581](https://github.com/grpc/grpc-go/issues/8581))

### [`v1.76.0`](https://github.com/grpc/grpc-go/releases/tag/v1.76.0): Release 1.76.0

[Compare Source](https://github.com/grpc/grpc-go/compare/v1.75.1...v1.76.0)

### Dependencies

- Minimum supported Go version is now 1.24 ([#&#8203;8509](https://github.com/grpc/grpc-go/issues/8509))
  - Special Thanks: [@&#8203;kevinGC](https://github.com/kevinGC)

### Bug Fixes

- client: Return status `INTERNAL` when a server sends zero response messages for a unary or client-streaming RPC. ([#&#8203;8523](https://github.com/grpc/grpc-go/issues/8523))
- client: Fail RPCs with status `INTERNAL` instead of `UNKNOWN` upon receiving http headers with status 1xx and  `END_STREAM` flag set. ([#&#8203;8518](https://github.com/grpc/grpc-go/issues/8518))
  - Special Thanks: [@&#8203;vinothkumarr227](https://github.com/vinothkumarr227)
- pick\_first: Fix race condition that could cause pick\_first to get stuck in `IDLE` state on backend address change. ([#&#8203;8615](https://github.com/grpc/grpc-go/issues/8615))

### New Features

- credentials: Add `credentials/jwt` package providing file-based JWT PerRPCCredentials (A97). ([#&#8203;8431](https://github.com/grpc/grpc-go/issues/8431))
  - Special Thanks: [@&#8203;dimpavloff](https://github.com/dimpavloff)

### Performance Improvements

- client: Improve HTTP/2 header size estimate to reduce re-allocations. ([#&#8203;8547](https://github.com/grpc/grpc-go/issues/8547))
- encoding/proto: Avoid redundant message size calculation when marshaling. ([#&#8203;8569](https://github.com/grpc/grpc-go/issues/8569))
  - Special Thanks: [@&#8203;rs-unity](https://github.com/rs-unity)

### [`v1.75.1`](https://github.com/grpc/grpc-go/releases/tag/v1.75.1): Release 1.75.1

[Compare Source](https://github.com/grpc/grpc-go/compare/v1.75.0...v1.75.1)

### Bug Fixes

- transport: Fix a data race while copying headers for stats handlers in the std lib http2 server transport. ([#&#8203;8519](https://github.com/grpc/grpc-go/issues/8519))
- xdsclient:
  - Fix a data race caused while reporting load to LRS. ([#&#8203;8483](https://github.com/grpc/grpc-go/pull/8483))
  - Fix regression preventing empty node IDs when creating an LRS client. ([#&#8203;8483](https://github.com/grpc/grpc-go/issues/8483))
- server: Fix a regression preventing streams from being cancelled or timed out when blocked on flow control. ([#&#8203;8528](https://github.com/grpc/grpc-go/issues/8528))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12794
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-28 22:15:59 +02:00
numenandGusted 427457946b feat(api): return created time in /org/{org} endpoint (#12633) 
closes #4126

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12633
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-28 21:25:41 +02:00
Alex619829GustedAleksandr Gamzin
 		e35880e7ac Add code search with zoekt support (#8827) 
This PR adds zoekt as a code search engine for forgejo. This Pull Request is a continuation of the discussion #8302.
The meilisearch search engine was not suitable, as it is not designed for searching by code. The zoekt project was proposed instead. Zoekt copes well with code indexing, but its operating principle differs from such search engines as elasticsearch.
While elasticsearch can return a result in a ready-made form (with pagination, ready-made snippets, etc.) and forgejo only needs to show this result in the interface with a little work with the data, zoekt works completely differently.

Zoekt finds matches in the repository index and returns a response. The response contains a line with the search word, its number from the file, and also a context, if specified in the request. This response is not suitable for Forgejo, so you need to assemble it yourself. To assemble the response from Zoekt into a form acceptable for Forgejo, I had to write some code and create a new function `searchZoektResult`, since the existing `searchResult` function is completely unsuitable for this search engine. I also had to write logic for pagination, highlighting, and correct display of lines in found snippets with a match, but this is a feature of Zoekt.
At the moment, Zoekt does not support deleting a repository index by repo_id, it only supports complete deletion of all repositories. But I still implemented the Delete function, which deletes a specific repository by its ID.

Co-authored-by: Aleksandr Gamzin <gamzin@altlinux.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8827
Reviewed-by: Shiny Nematoda <snematoda@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-28 20:52:34 +02:00
Shiny NematodaandGusted 6f5df4fae6 fix(ui): fix typo in issue sort dropdown; relevance was misnamed as relevency (#12771) 
closes #12769

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12771
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
 2026-05-28 20:48:25 +02:00
Robert WolffandGusted 44b93ff7cc fix: do not migrate confidential issues and internal notes from Gitlab (#12735) 
A dedicated test repository was added at https://gitlab.com/forgejo/test_repo-confidential with one "confidential issue" and two "internal notes".

Closes: #12688

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12735
Reviewed-by: oliverpool <oliverpool@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-28 20:45:24 +02:00
GustedandGusted 6c85dffb78 fix: load repo language for converting to api struct (#12737) 
Load the primary language of the repository when it's converted to a API struct. This is simpler than adding `LoadAttributes` to a lot of places.

Resolves forgejo/forgejo#12729

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12737
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-28 17:00:40 +02:00
Andreas AhlenstorfandMathieu Fenniak fa5a2501d0 fix: do not hide previous attempts without task for latest attempt (#12779) 
If a Forgejo Actions job was run more than once, Forgejo would not display previous attempts if no `ActionTask` existed for the latest attempt. That is the case when a job is cancelled or skipped before having been dispatched to a runner or while it is waiting for a runner. This is fixed by always loading all existing attempts.

Resolves #12626.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

*The decision if the pull request will be shown in the release notes is up to the mergers / release team.*

The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12779
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
 2026-05-28 15:16:48 +02:00
Mathieu FenniakandMathieu Fenniak 81a5b0d840 fix: remove default 'REVERSE_PROXY_TRUSTED_PROXIES = *' from docker config (#12782) 
Forgejo's docker containers had `REVERSE_PROXY_TRUSTED_PROXIES = *` configured in them by default.  In the event that the Forgejo sysadmin set the docker environment variable `FORGEJO__service__ENABLE_REVERSE_PROXY_AUTHENTICATION` to the value `true`, *and* an unauthorized user could access Forgejo without traversing a reverse proxy performing authentication, then an unauthorized user could use the `X-WebAuth-User` HTTP header to impersonate any user.  While this is an unlikely set of configuration settings, it seems more prudent for the Forgejo to require a sysadmin to choose an appropriate value for `REVERSE_PROXY_TRUSTED_PROXIES`.  Even in a containerized environment, this value can be used safely and set to reasonable values if firewall-level networking is in use (eg. using [Docker with iptables](https://docs.docker.com/engine/network/firewall-iptables/)), which is the common default for docker systems in 2026.

The intent of this PR is to change the default in Forgejo 16, and to mark it as a breaking change for highlighting in the release notes.  The risk of misconfiguration is not high enough to backport this breaking change to earlier Forgejo releases.

If a sysadmin wants to use the previous configuration, they can set the environment variable `FORGEJO__service__REVERSE_PROXY_TRUSTED_PROXIES` to the value `*`, but it would be recommended that they revise the setting to a narrower set of trusted IPs that they expect reverse proxy connections from.  See the [`[security]`](https://forgejo.org/docs/latest/admin/config-cheat-sheet/#security-security) config block for more information.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12782
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-28 13:52:03 +02:00
GustedandGusted d25f7ae70d feat: show progress of issues and PRs migrations (#12738) 
These are by the far the longest time spent on during a migration.
Indicate the progress of how many issues and PRs were migrated so far.
Don't overwhelm the messenger, so they are only updated once a batch is
migrated. Which is "slow" enough to see it's not stuck and still doing work.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12738
Reviewed-by: Ellen Εμίλια Άννα Zscheile <fogti@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
 2026-05-28 00:49:07 +02:00
oliverpooland0ko 68858a9de2 fix: enable "Add more..." unit hint for new users (#12565) 
For new users, the `EnableRepoUnitHints` is set to false while I think that the original intent of #2221 was to set it to true (the migration set it to true for already existing users in `AddUserRepoUnitHintsSetting`).

This PR sets its to true upon user creation.

![screenshot showing the `Add more...` hint - from the original PR](https://codeberg.org/forgejo/forgejo/attachments/dc654ddd-e7cb-4667-b0d3-3fac39776be3)

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12565
Reviewed-by: limiting-factor <limiting-factor@noreply.codeberg.org>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
 2026-05-27 20:44:44 +02:00
oliverpooland0ko fd283c80b7 feat: add hint to disable the "Enable more" units hint (#12747) 
Following the feedback in #12565, this adds a hint to the units page when the "Enable more" hint is enabled:

![image](/attachments/32dac116-9f25-498d-9ef0-8b18b06cfc53)

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12747
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-27 20:43:47 +02:00
Renovate BotandGusted c8fa66d42c Update dependency clippie to v4.2.0 (forgejo) (#12618) 
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12618
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-27 18:46:02 +02:00
Mathieu FenniakandMathieu Fenniak b18d28b3b5 fix: debian package cleanup failure due to xorm connection corruption (#12764) 
Fixes #12645.  Detailed analysis in [this comment](https://codeberg.org/forgejo/forgejo/issues/12645#issuecomment-15939122).  New test case is verified to hit the bug -- the previous case just narrowly missed the problem because it ended up with an empty repository index.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12764
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
 2026-05-27 17:47:11 +02:00
Renovate BotMathieu FenniakMathieu Fenniak
 		7dea39659d Update module code.forgejo.org/forgejo/runner/v12 to v12.10.2 (forgejo) (#12759) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [code.forgejo.org/forgejo/runner/v12](https://code.forgejo.org/forgejo/runner) | `v12.10.1` → `v12.10.2` | ![age](https://developer.mend.io/api/mc/badges/age/go/code.forgejo.org%2fforgejo%2frunner%2fv12/v12.10.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/code.forgejo.org%2fforgejo%2frunner%2fv12/v12.10.1/v12.10.2?slim=true) |

---

### Release Notes

<details>
<summary>forgejo/runner (code.forgejo.org/forgejo/runner/v12)</summary>

### [`v12.10.2`](https://code.forgejo.org/forgejo/runner/releases/tag/v12.10.2)

[Compare Source](https://code.forgejo.org/forgejo/runner/compare/v12.10.1...v12.10.2)

- [User guide](https://forgejo.org/docs/next/user/actions/overview/)
- [Administrator guide](https://forgejo.org/docs/next/admin/actions/)
- [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions)

Release Notes

***

<!--start release-notes-assistant-->

<!--URL:https://code.forgejo.org/forgejo/runner-->

- bug fixes
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1523): <!--number 1523 --><!--line 0 --><!--description Zml4OiByZW1vdmUgY29udGFpbmVycyBhZnRlciBmYWlsZWQgc3RhcnQtdXA=-->fix: remove containers after failed start-up<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1519): <!--number 1519 --><!--line 0 --><!--description Zml4OiByZWplY3QgaW52YWxpZCBjcm9uIHNjaGVkdWxlcyB3aGlsZSBwYXJzaW5nIHdvcmtmbG93cw==-->fix: reject invalid cron schedules while parsing workflows<!--description-->
- other
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1532): <!--number 1532 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3JoeXNkL2FjdGlvbmxpbnQgdG8gdjEuNy4xMg==-->Update module github.com/rhysd/actionlint to v1.7.12<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1531): <!--number 1531 --><!--line 0 --><!--description UmVwbGFjZSBOb2RlLmpzIHdpdGggZGF0YS5mb3JnZWpvLm9yZy9vY2kvbm9kZSAyNC10cml4aWU=-->Replace Node.js with data.forgejo.org/oci/node 24-trixie<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1530): <!--number 1530 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Nhc2NhZGluZy1wciBhY3Rpb24gdG8gdjIuMy4y-->Update <https://data.forgejo.org/actions/cascading-pr> action to v2.3.2<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1522): <!--number 1522 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21vYnkvcGF0dGVybm1hdGNoZXIgdG8gdjAuNi4x-->Update module github.com/moby/patternmatcher to v0.6.1<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1529): <!--number 1529 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvc3lzIHRvIHYwLjQ0LjAgW1NFQ1VSSVRZXQ==-->Update module golang.org/x/sys to v0.44.0 \[SECURITY]<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1527): <!--number 1527 --><!--line 0 --><!--description dGVzdDogdXBkYXRlIGFwdCBjYWNoZSBiZWZvcmUgaW5zdGFsbGluZyBwYWNrYWdlcyBpbiBQb2RtYW4gam9i-->test: update apt cache before installing packages in Podman job<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1521): <!--number 1521 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21hdHRuL2dvLWlzYXR0eSB0byB2MC4wLjIy-->Update module github.com/mattn/go-isatty to v0.0.22<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1520): <!--number 1520 --><!--line 0 --><!--description VXBkYXRlIGRhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9mb3JnZWpvIERvY2tlciB0YWcgdG8gdjExLjAuMTQ=-->Update data.forgejo.org/forgejo/forgejo Docker tag to v11.0.14<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1515): <!--number 1515 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb25uZWN0cnBjLmNvbS9jb25uZWN0IHRvIHYxLjE5LjI=-->Update module connectrpc.com/connect to v1.19.2<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1514): <!--number 1514 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMTE=-->Update <https://data.forgejo.org/actions/setup-forgejo> action to v3.1.11<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1513): <!--number 1513 --><!--line 0 --><!--description VXBkYXRlIGRhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9mb3JnZWpvIERvY2tlciB0YWcgdG8gdjExLjAuMTM=-->Update data.forgejo.org/forgejo/forgejo Docker tag to v11.0.13<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1512): <!--number 1512 --><!--line 0 --><!--description VXBkYXRlIGdvIHRvb2xjaGFpbiBkaXJlY3RpdmUgdG8gdjEuMjUuMTA=-->Update go toolchain directive to v1.25.10<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1503): <!--number 1503 --><!--line 0 --><!--description cmVmYWN0b3I6IHJlcGxhY2UgYmFja2VuZCBpZGVudGl0eSBjaGVja3Mgd2l0aCBjYXBhYmlsaXR5IHF1ZXJpZXM=-->refactor: replace backend identity checks with capability queries<!--description-->

<!--end release-notes-assistant-->

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyIsInRlc3Qvbm90LW5lZWRlZCJdfQ==-->

Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12759
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-27 17:46:33 +02:00
oliverpooland0ko 1b1ede13f9 feat: add actionable message on lint-locale failure (#12748) 
Before this PR:
![image](/attachments/dd1a8f68-8b87-41e5-86e0-4ba59cedf4f4)

After this PR:
![image](/attachments/51007bbd-cf3c-4828-b5fc-9aecc9c958bd)

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12748
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Ellen Εμίλια Άννα Zscheile <fogti@noreply.codeberg.org>
 2026-05-27 11:48:07 +02:00
0ko 8a72b70f5f fix(ui): do not clip overflow in workflow dispatch menu (#12753) 
Fixes forgejo/forgejo#12090
Fixes forgejo/forgejo#12228
Fixes forgejo/forgejo#12743

Partially revert https://codeberg.org/forgejo/forgejo/src/commit/b5988efc85ca54e39459323775aef0bc20f145be/web_src/css/actions.css#L91-L94 from forgejo/forgejo!10563.

This will cause overly long lists to overflow the viewport [like in this image](https://codeberg.org/forgejo/forgejo/attachments/b335c5b8-ad1a-44fc-bbd2-99c975c2a5e5), but will make the branch selector and select inputs usable again. In essence, replacing a serious bug with a less serious one.

Note: max-height limit wasn't effective since it was clipping inline (x) axis instead of block (y) axis. So the menu was still higher than 500 px.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12753
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
 2026-05-27 05:46:21 +02:00
Mathieu FenniakandMathieu Fenniak dfdd9b2e2a fix: check quota in LFS uploads against the repository owner, not operating user (#12755) 
Follow-up to the previously closed #12437; verifies git LFS quotas are checked against the repository owner not the current actor.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12755): <!--number 12755 --><!--line 0 --><!--description Y2hlY2sgcXVvdGEgaW4gTEZTIHVwbG9hZHMgYWdhaW5zdCB0aGUgcmVwb3NpdG9yeSBvd25lciwgbm90IG9wZXJhdGluZyB1c2Vy-->check quota in LFS uploads against the repository owner, not operating user<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12755
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
 2026-05-27 04:31:09 +02:00
Renovate Bot e435233c7f Update https://data.forgejo.org/actions/setup-forgejo action to v3.1.12 (forgejo) (#12763) 2026-05-27 04:18:00 +02:00
nightfurysl2001andMathieu Fenniak b58d8e20fd feat: Update Microsoft Teams webhook to use AdaptiveCard (#11704) 
## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

(can be removed for JavaScript changes)

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [ ] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Closes #4517

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11704): <!--number 11704 --><!--line 0 --><!--description VXBkYXRlIE1pY3Jvc29mdCBUZWFtcyB3ZWJob29rIHRvIHVzZSBBZGFwdGl2ZUNhcmQ=-->Update Microsoft Teams webhook to use AdaptiveCard<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11704
Reviewed-by: oliverpool <oliverpool@noreply.codeberg.org>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-26 16:10:55 +02:00
CatherineandMathieu Fenniak 0c418d2c0e feat: add /api/v1/actions/run endpoint (#12727) 
This endpoint returns the Actions run metadata for the automatic token, making it possible for external services to authenticate a specific workflow run and understand its security context (e.g. whether it is a pull request run and if yes what pull request it is).

The concrete motivating case for this feature is safe pull request preview rendering. Currently, even Forgejo itself ([forgejo/docs](https://codeberg.org/forgejo/docs/src/branch/next/.forgejo/workflows/pr.yml), [forgejo/website](https://codeberg.org/forgejo/website/src/branch/main/.forgejo/workflows/pr.yml)) uses carefully managed `pull_request_target` workflows for this task. The `pull_request_target` workflow type coupled with intentionally cloning the merge head is widely recognized as insecure, including by Forgejo developers. However, right now there is no particularly good replacement for this approach: Forgejo doesn't expose enough metadata to grant an Actions run permissions to update a part of a website, and only that part (by whichever mechanism this would happen).

I am one of the developers of [git-pages](https://codeberg.org/git-pages/git-pages), which is used as the new Codeberg Pages backend. I would like to implement native support for pull request previews that does not rely on carefully written but still fragile workflows that try to hide authorization tokens from untrusted code, but rather recognizes "pull request Actions run" as a unique kind of security context, and allow it to publish to a special "preview zone", segregated by the repository name and PR number. To do this I need to be able to authorize a specific workflow run. Right now there's no reasonable way to do this, but with the new endpoint it becomes trivial: actions/git-pages passes the automatic token to git-pages, git-pages asks Forgejo for metadata then forms an authorized site URL (e.g. `http://<reponame>-<username>-pr-<number>.preview.codeberg.page` though this is not the final format) to which this PR workflow may upload a site.

The API endpoint implemented in this PR has been discussed in the Matrix room and I understood that this change would be uncontroversial, hence I'm sending this PR right away instead of opening a feature request first. It doesn't introduce new response types, only returns an `ActionRun` for the authorization token. The namespaced URL `/api/v1/actions/run` was chosen because there are a number of things one could conceivably want to retrieve (e.g. `/api/v1/actions/job`); this specific endpoint seems by far the most useful though.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

- I added test coverage for Go changes...
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [x] I did not document these changes and I do not expect someone else to do it.
  The new API endpint is surfaced in Swagger, which seems sufficient.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.

*The decision if the pull request will be shown in the release notes is up to the mergers / release team.*

The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12727
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Reviewed-by: crystal <crystal@noreply.codeberg.org>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-26 16:03:21 +02:00
Andreas AhlenstorfandMathieu Fenniak 761ed894c5 fix: workflow with pull_request trigger and path filter not run when merging (#12739) 
Forgejo would not trigger Actions workflows `on: pull_request:` with `paths:` or `paths-ignore:` filters when the pull request was merged. The reason was that the triggers were evaluated after the PR was merged, but Forgejo still looked for changed files between the base branch and the PR's HEAD, which by then was already in the base branch.

Resolves https://codeberg.org/forgejo/forgejo/issues/12585.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

(can be removed for JavaScript changes)

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Tests for JavaScript changes

(can be removed for Go changes)

- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

*The decision if the pull request will be shown in the release notes is up to the mergers / release team.*

The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12739
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-26 03:45:09 +02:00
Renovate Bot 2c7ce02da1 Update dependency forgejo/release-notes-assistant to v1.7.1 (forgejo) (#12740) 2026-05-26 01:50:01 +02:00
Renovate BotandGusted e2c8c0d1f6 Update dependency katex to v0.17.0 (forgejo) (#12741) 
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12741
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-26 01:01:55 +02:00
Mathieu FenniakandMathieu Fenniak c8d24ff06a feat: enable auth to git HTTP via authorized integrations (#12715) 
Allow authentication to git HTTP & git LFS via an authorized integration.

This is the first step in getting rid of OAuth, basic auth, etc.'s usage of [`isGitRawOrAttachPath(req)`](https://codeberg.org/forgejo/forgejo/src/commit/26f18a94ee80a5fd8972833b95b1df995ee92fc4/services/auth/method/basic.go#L38-L40).  I don't want to follow that pattern of HTTP route matching in the authentication method, so I've broken the HTTP routes related to git functionality out to using a separate authentication middleware in the top-level `web.Routes` handler.  As this approach is expanded to the other endpoints in order to add support to them for authorized integrations, eventually it will be possible to remove this URL matching completely and just rely on middleware installation.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12715
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-25 19:33:36 +02:00
Fabian WeikandGusted af412159ce chore: re-enable nilnil lint for models/actions/run.go (#12507) 
`GetRunByID` is now the primary function to get a action run. `GetRunBefore` now returns `util.ErrNotExist` to avoid the nilnil pattern.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12507
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-25 14:52:57 +02:00
GustedandGusted 385c0db94f feat: fsck incoming objects (#12695) 
Weirdly, git doesn't verify the consistency of objects when receiving
new objects. Enable that git verifies this, so we don't allow a
repository to get in a weird or even corrupt state.

We've already dealt with a few cases of inconsistent objects, the most
notable one being mode of objects (forgejo/forgejo!9161). This can be
risky, as such ignore 3 consistency checks that are not harmful to
ignore and is battle tested by Gitlab.

bad timezone:
https://gitlab.com/gitlab-org/gitaly/-/commit/692a0d3476a5fe5832ec78df5a6d9d5e1d780364

missing space:
https://gitlab.com/gitlab-org/gitaly/-/commit/2da0b393998d394b743c70e7cf9cd0757a8f2733

non-zero padded filemode:
https://gitlab.com/gitlab-org/gitaly/-/commit/db8f2e8da5e7ff9cf84a99195481303016cd2138

Typically we set these settings in `modules/git/git.go`, but that means
a instance administrator wouldn't be able to override it. Given we don't
strictly require these settings to be set. A instance admin could
choose to disable the consistency checks or override our set of ignores
this would allow them to do so via the `[git.config]` section.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12695
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Reviewed-by: elle <0xllx0@noreply.codeberg.org>
 2026-05-25 14:51:04 +02:00
Renovate Bot ed30c7de45 Update renovate Docker tag to v43.195.1 (forgejo) (#12720) 2026-05-25 13:01:57 +02:00
Renovate BotandGusted 8df8d2c776 Update dependency webpack to v5.107.1 (forgejo) (#12721) 
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12721
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-25 12:35:44 +02:00
0ko c400a3fac7 chore(i18n): May 2026 maintenence (#12718) 
* remove two unused strings I identified while doing other things
* update two strings per request of @mahlzahn while avoiding a whole separate PR for this
* move 126 strings to JSON, some are remapped with a better structure
    * previous migration: forgejo/forgejo!12280

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12718
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
 2026-05-25 10:59:49 +02:00
0ko bf2d4abda2 merge commit: i18n: translations update from Codeberg Translate (#12284) 
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12284
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
 2026-05-25 10:05:19 +02:00
+38
Codeberg Translate0ko0xAndrewBlackAindriú Mac Giolla EoinAndy CallistoAtalanttoreBenedikt StraubCyborusEduardo DobayFjuroGitea & Forgejo French translatorsGustedLanguages add-onLaurent FAVOLELaxystemLzebulonMCMattiaRicky-TiggSomeTrSteffoSystemDihTAGerritsenTamilTinWuzzyartnaybittinboogicirillacs-maxdynieceriktmgallegonovatohabilhhschen820jimkatsjustbispokdh8219kwootmmorariumoexiamimvahasteoscaroteroospalhpgmtxuniversishvmtjxtex
 		3748242fac i18n: update of translations from Codeberg Translate 
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: 0xAndrewBlack <0xandrewblack@noreply.codeberg.org>
Co-authored-by: Aindriú Mac Giolla Eoin <aindriu80@noreply.codeberg.org>
Co-authored-by: Andy Callisto <andycallisto@noreply.codeberg.org>
Co-authored-by: Atalanttore <atalanttore@noreply.codeberg.org>
Co-authored-by: Benedikt Straub <benedikt-straub@web.de>
Co-authored-by: Codeberg Translate <translate@codeberg.org>
Co-authored-by: Cyborus <cyborus@noreply.codeberg.org>
Co-authored-by: Eduardo Dobay <edudobay@noreply.codeberg.org>
Co-authored-by: Fjuro <fjuro@noreply.codeberg.org>
Co-authored-by: Gitea & Forgejo French translators <user-5603@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-authored-by: Languages add-on <noreply-addon-languages@weblate.org>
Co-authored-by: Laurent FAVOLE <laurentfavole03@gmail.com>
Co-authored-by: Laxystem <the@laxla.quest>
Co-authored-by: Lzebulon <lzebulon@noreply.codeberg.org>
Co-authored-by: MCMattia <mcmattia@noreply.codeberg.org>
Co-authored-by: Ricky-Tigg <ricky-tigg@noreply.codeberg.org>
Co-authored-by: SomeTr <sometr@noreply.codeberg.org>
Co-authored-by: Steffo <steffo@noreply.codeberg.org>
Co-authored-by: SystemDih <systemdih@noreply.codeberg.org>
Co-authored-by: TAGerritsen <tagerritsen@noreply.codeberg.org>
Co-authored-by: Tamil <tamil@noreply.codeberg.org>
Co-authored-by: Tin <hntin@noreply.codeberg.org>
Co-authored-by: Wuzzy <wuzzy@disroot.org>
Co-authored-by: artnay <artnay@noreply.codeberg.org>
Co-authored-by: bittin <bittin@noreply.codeberg.org>
Co-authored-by: boogi <boogi@noreply.codeberg.org>
Co-authored-by: cirilla <cirilla@noreply.codeberg.org>
Co-authored-by: cs-max <cs-max@noreply.codeberg.org>
Co-authored-by: dyniec <dyniec@noreply.codeberg.org>
Co-authored-by: edudobay <edudobay@noreply.codeberg.org>
Co-authored-by: eriktm <eriktm@noreply.codeberg.org>
Co-authored-by: gallegonovato <gallegonovato@noreply.codeberg.org>
Co-authored-by: habil <habil@noreply.codeberg.org>
Co-authored-by: hhschen820 <hhschen820@noreply.codeberg.org>
Co-authored-by: jimkats <jimkats@noreply.codeberg.org>
Co-authored-by: justbispo <justbispo@noreply.codeberg.org>
Co-authored-by: kdh8219 <kdh8219@monamo.dev>
Co-authored-by: kwoot <kwoot@noreply.codeberg.org>
Co-authored-by: mmorariu <mmorariu@noreply.codeberg.org>
Co-authored-by: moexiami <moexiami@noreply.codeberg.org>
Co-authored-by: mvahaste <mvahaste@noreply.codeberg.org>
Co-authored-by: oscarotero <oscarotero@noreply.codeberg.org>
Co-authored-by: ospalh <ospalh@noreply.codeberg.org>
Co-authored-by: pgmtx <pgmtx@noreply.codeberg.org>
Co-authored-by: universish <universish@noreply.codeberg.org>
Co-authored-by: vmtj <vmtj@noreply.codeberg.org>
Co-authored-by: xtex <xtexchooser@duck.com>
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ca/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/cs/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/de/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/el/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/es/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/et/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/fi/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/fr/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/fr_CA/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ga/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/gl/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/hi/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/it/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/lt/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/nb_NO/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/nds/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/nl/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/pl/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/pt_PT/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ru/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/sv/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ta/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/tok/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/tr/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/uk/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/zh_Hans/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/zh_Hant/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ca/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/cs/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/de/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/el/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/eo/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/es/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/fi/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/fr/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/fr_CA/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ga/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/he/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/hi/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/hu/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/it/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ko/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/kw/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/nb_NO/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/nds/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/nl/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/pl/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/pt_BR/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ro/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ru/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ta/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/tok/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/tr/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/uk/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/vi/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/zh_Hans/
Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/zh_Hant/
Translation: Forgejo/forgejo
Translation: Forgejo/forgejo-next
 2026-05-25 07:17:41 +00:00
Andreas AhlenstorfandMathieu Fenniak 42618ba771 fix: update statuses in phases to prevent out of order updates from stalling workflows (#12685) 
During workflow expansion, jobs are replaced or added. That means that their execution order does not necessarily match the order of their numeric IDs. For example, job 129 might depend on job 130. Unfortunately, Forgejo doesn't take this possibility into account and always examines and updates jobs by ascending ID. That means that while examining job 129, job 130 has still its old status, and, as a result, Forgejo won't schedule job 129 for execution because it's still waiting for job 130 to complete. This can lead to workflows getting stuck:

```
...tions/job_emitter.go:48:jobEmitterQueueHandler() [E] checkJobsOfRun failed for RunID = 49: error in tryHandleIncompleteMatrix: jobStatusResolver attempted to tryHandleIncompleteMatrix for a job (id=129) with an incomplete 'needs' job (id=130)
```

This is caused by calculating all status changes recursively in memory before writing them to the database. For example, job A that was completed would unblock job B that depended on it. In that case, Forgejo would simultaneously mark job A as completed and B as waiting. However, that would not work if B had a lower ID than A. That is remedied by writing updates to the database before entering the next recursion. So, continuing the example, job A is marked as completed in the database before the next iteration detects that B is no longer blocked and writes that to the database.

Resolves https://codeberg.org/forgejo/forgejo/issues/12641.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

(can be removed for JavaScript changes)

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Tests for JavaScript changes

(can be removed for Go changes)

- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

*The decision if the pull request will be shown in the release notes is up to the mergers / release team.*

The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12685
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-25 05:20:23 +02:00
numenandMathieu Fenniak 3650528262 fix: return API URL in the url field for pull requests using the API (#12643) 
closes #10451

### Tests for Go changes

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [ ] `make pr-go` before pushing

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12643): <!--number 12643 --><!--line 0 --><!--description cmV0dXJuIEFQSSBVUkwgaW4gdGhlIGB1cmxgIGZpZWxkIGZvciBwdWxsIHJlcXVlc3RzIHVzaW5nIHRoZSBBUEk=-->return API URL in the `url` field for pull requests using the API<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12643
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-25 04:01:17 +02:00
Renovate BotandMathieu Fenniak 3ee2f718a3 Lock file maintenance (forgejo) (#12723) 
This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12723
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-25 02:33:11 +02:00
Renovate BotandGusted 624ffd18d4 Update dependency webpack to v5.107.0 (forgejo) (#12714) 
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12714
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-24 12:38:12 +02:00
GustedandGusted ebfac19123 chore: remove some git configuration options (#12681) 
`ENABLE_AUTO_GIT_WIRE_PROTOCOL`:

Its sole usage is to set `-c protocol.version=2` on each git command
execution. The default value is already 2 since at least the minimum
version of Git that Forgejo requires. When this setting was added, this
was not the case.

Thus, automatically defaulting to protocol v2 is already the case due to
git themselves making it the default. And instances that want to use a
older protocol already have to override the value like:

```ini
[git.config]
protocol.version=1
```

---

`git.reflog` was deprecated in v1.21 warnings have been emitted. Remove it finally.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12681
Reviewed-by: limiting-factor <limiting-factor@noreply.codeberg.org>
 2026-05-24 12:34:59 +02:00
Renovate BotandMathieu Fenniak 26f18a94ee Replace Node.js with data.forgejo.org/oci/node 24-trixie (forgejo) (#12713) 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [data.forgejo.org/oci/node](https://hub.docker.com/_/node) ([source](https://github.com/nodejs/docker-node)) | container | replacement | `24-bookworm` → `24-trixie` |

This is a special PR that replaces `data.forgejo.org/oci/node` with the community suggested minimal stable replacement version.

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12713
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-24 01:16:58 +02:00
limiting-factorandMathieu Fenniak 5c61808014 fix: display the actions trust management panel on merged and closed pull requests (#12704) 
It is possible for a user that is not trusted to run Forgejo Actions workflows on a repository to act on a pull request and trigger a workflow after it is merged or closed. For instance by modifying the title of the pull request or setting a label.

Closes forgejo/forgejo#12576

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

(can be removed for JavaScript changes)

- I added test coverage for Go changes...
  - [ ] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- User Interface bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12704): <!--number 12704 --><!--line 0 --><!--description ZGlzcGxheSB0aGUgYWN0aW9ucyB0cnVzdCBtYW5hZ2VtZW50IHBhbmVsIG9uIG1lcmdlZCBhbmQgY2xvc2VkIHB1bGwgcmVxdWVzdHM=-->display the actions trust management panel on merged and closed pull requests<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12704
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-23 18:21:21 +02:00
Renovate BotandGusted 0f449ff84f Update dependency postcss to v8.5.15 (forgejo) (#12693) 
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12693
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-23 18:12:24 +02:00
Renovate BotandMathieu Fenniak 37b3b3a243 Update https://data.forgejo.org/actions/cascading-pr action to v2.3.2 (forgejo) (#12708) 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [https://data.forgejo.org/actions/cascading-pr](https://code.forgejo.org/actions/cascading-pr) | action | patch | `v2.3.0` → `v2.3.2` |

---

### Release Notes

<details>
<summary>actions/cascading-pr (https://data.forgejo.org/actions/cascading-pr)</summary>

### [`v2.3.2`](https://code.forgejo.org/actions/cascading-pr/releases/tag/v2.3.2)

[Compare Source](https://code.forgejo.org/actions/cascading-pr/compare/v2.3.1...v2.3.2)

<!--start release-notes-assistant-->

<!--URL:https://code.forgejo.org/actions/cascading-pr-->

- bug fixes
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/58): <!--number 58 --><!--line 0 --><!--description Zml4OiBjb21wYXRpYmxpdHkgd2l0aCBvY2kvbm9kZToyNC10cml4aWUgaW1hZ2U=-->fix: compatiblity with oci/node:24-trixie image<!--description-->
- other
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/57): <!--number 57 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTIuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.12.0<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/56): <!--number 56 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMTE=-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.11<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/55): <!--number 55 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuOA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.8<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/54): <!--number 54 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMw==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.3<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/53): <!--number 53 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.7<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/52): <!--number 52 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMg==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.2<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/50): <!--number 50 --><!--line 0 --><!--description VXBkYXRlIGFjdGlvbnMvY2hlY2tvdXQgYWN0aW9uIHRvIHY2-->Update actions/checkout action to v6<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/51): <!--number 51 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby1seGMgdG8gdjEz-->Update dependency forgejo-lxc to v13<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/49): <!--number 49 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.0<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/48): <!--number 48 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNg==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.6<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/47): <!--number 47 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.4<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/46): <!--number 46 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTAuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.10.0<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/45): <!--number 45 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMQ==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.1<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/43): <!--number 43 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.0<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/39): <!--number 39 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjAuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.0.7<!--description-->

<!--end release-notes-assistant-->

### [`v2.3.1`](https://code.forgejo.org/actions/cascading-pr/releases/tag/v2.3.1)

[Compare Source](https://code.forgejo.org/actions/cascading-pr/compare/v2.3.0...v2.3.1)

<!-- correcting for mislabeling v2.3.1 on first attempt -->

- fix
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/58): fix: compatiblity with oci/node:24-trixie image

<!--start release-notes-assistant-->

<!--URL:https://code.forgejo.org/actions/cascading-pr-->

- other
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/57): <!--number 57 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTIuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.12.0<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/56): <!--number 56 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMTE=-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.11<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/55): <!--number 55 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuOA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.8<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/54): <!--number 54 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMw==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.3<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/53): <!--number 53 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.7<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/52): <!--number 52 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMg==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.2<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/50): <!--number 50 --><!--line 0 --><!--description VXBkYXRlIGFjdGlvbnMvY2hlY2tvdXQgYWN0aW9uIHRvIHY2-->Update actions/checkout action to v6<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/51): <!--number 51 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby1seGMgdG8gdjEz-->Update dependency forgejo-lxc to v13<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/49): <!--number 49 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.0<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/48): <!--number 48 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNg==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.6<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/47): <!--number 47 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.4<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/46): <!--number 46 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTAuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.10.0<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/45): <!--number 45 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMQ==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.1<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/43): <!--number 43 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.0<!--description-->
  - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/39): <!--number 39 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjAuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.0.7<!--description-->

<!--end release-notes-assistant-->

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12708
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-23 17:54:42 +02:00
Mai-LapystandGusted 5704b305c1 fix: adds missing AppSubUrl to the webmanifest's location (#12702) 
Closes #12251

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12702
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
 2026-05-23 16:33:32 +02:00
Mathieu FenniakandMathieu Fenniak 6d522ecba0 feat: add "Forgejo Actions (Local)" authorized integration UI (#12672) 
Extracts the separate concepts for different UIs out of the original implementation, and then adds the new UI for Forgejo Actions (Local).  Manual end-to-end testing was performed on all variations of the "workflow file", "git reference", and "event" filter options as well.  They're covered by test automation, but not in an end-to-end manner.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Tests for JavaScript changes

- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [x] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.
    - Documentation is next up after this change is complete.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12672
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
 2026-05-23 16:26:28 +02:00
limiting-factorandMathieu Fenniak 03d336de44 chore: TestAPIInternalAndExternalIssueTracker uses the wrong repository (#12706) 
Regression introduced by forgejo/forgejo!11356

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12706
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-23 15:18:38 +02:00
Renovate BotandMathieu Fenniak c749861d94 Update data.forgejo.org/oci/ci Docker tag to v2 (forgejo) (#12692) 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [data.forgejo.org/oci/ci](https://code.forgejo.org/forgejo/ci-image-builder) | container | major | `1` → `2` |

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12692
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-23 03:00:43 +02:00
Renovate BotandMathieu Fenniak 1a108e8fbb Update module golang.org/x/net to v0.55.0 [SECURITY] (forgejo) (#12686) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.54.0` → `v0.55.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.54.0...refs/tags/v0.55.0) | ![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.55.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.54.0/v0.55.0?slim=true) |

---

### Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
[CVE-2026-42506](https://nvd.nist.gov/vuln/detail/CVE-2026-42506) / [GO-2026-5025](https://pkg.go.dev/vuln/GO-2026-5025)

<details>
<summary>More information</summary>

#### Details
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79571](https://go.dev/issue/79571)
- [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8)
- [https://go.dev/cl/781700](https://go.dev/cl/781700)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5025) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
[CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) / [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026)

<details>
<summary>More information</summary>

#### Details
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

#### Severity
Unknown

#### References
- [https://go.dev/cl/767220](https://go.dev/cl/767220)
- [https://go.dev/issue/78760](https://go.dev/issue/78760)
- [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5026) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
[CVE-2026-42502](https://nvd.nist.gov/vuln/detail/CVE-2026-42502) / [GO-2026-5027](https://pkg.go.dev/vuln/GO-2026-5027)

<details>
<summary>More information</summary>

#### Details
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79572](https://go.dev/issue/79572)
- [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8)
- [https://go.dev/cl/781701](https://go.dev/cl/781701)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5027) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
[CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) / [GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028)

<details>
<summary>More information</summary>

#### Details
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

#### Severity
Unknown

#### References
- [https://go.dev/cl/781702](https://go.dev/cl/781702)
- [https://go.dev/issue/79573](https://go.dev/issue/79573)
- [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5028) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
[CVE-2026-25681](https://nvd.nist.gov/vuln/detail/CVE-2026-25681) / [GO-2026-5029](https://pkg.go.dev/vuln/GO-2026-5029)

<details>
<summary>More information</summary>

#### Details
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79574](https://go.dev/issue/79574)
- [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8)
- [https://go.dev/cl/781703](https://go.dev/cl/781703)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5029) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Invoking duplicate attributes can cause XSS in golang.org/x/net/html
[CVE-2026-27136](https://nvd.nist.gov/vuln/detail/CVE-2026-27136) / [GO-2026-5030](https://pkg.go.dev/vuln/GO-2026-5030)

<details>
<summary>More information</summary>

#### Details
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79575](https://go.dev/issue/79575)
- [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8)
- [https://go.dev/cl/781685](https://go.dev/cl/781685)

This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5030) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)).
</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12686
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
 2026-05-22 20:00:56 +02:00
B0shandGusted e49cb9e772 fix: emoji's should not render in inline code blocks in issue lists (#12644) 
This fixes #12548. I used the `RenderRefIssueTitle` function so it wouldn't create issue or PR links from #<number> strings.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12644
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
 2026-05-22 13:20:42 +02:00