d25f7ae70da05e6a796eb72a2f0bc9feca9867c0
25119
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 GustedandGusted
|
d25f7ae70d |
feat: show progress of issues and PRs migrations (#12738)
These are by the far the longest time spent on during a migration. Indicate the progress of how many issues and PRs were migrated so far. Don't overwhelm the messenger, so they are only updated once a batch is migrated. Which is "slow" enough to see it's not stuck and still doing work. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12738 Reviewed-by: Ellen Εμίλια Άννα Zscheile <fogti@noreply.codeberg.org> Reviewed-by: 0ko <0ko@noreply.codeberg.org> |
||
|
oliverpooland0ko
|
68858a9de2 |
fix: enable "Add more..." unit hint for new users (#12565)
For new users, the `EnableRepoUnitHints` is set to false while I think that the original intent of #2221 was to set it to true (the migration set it to true for already existing users in `AddUserRepoUnitHintsSetting`). This PR sets its to true upon user creation.  Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12565 Reviewed-by: limiting-factor <limiting-factor@noreply.codeberg.org> Reviewed-by: 0ko <0ko@noreply.codeberg.org> |
||
|
oliverpooland0ko
|
fd283c80b7 |
feat: add hint to disable the "Enable more" units hint (#12747)
Following the feedback in #12565, this adds a hint to the units page when the "Enable more" hint is enabled:  Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12747 Reviewed-by: 0ko <0ko@noreply.codeberg.org> Reviewed-by: Robert Wolff <mahlzahn@posteo.de> Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
c8fa66d42c |
Update dependency clippie to v4.2.0 (forgejo) (#12618)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12618 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Mathieu FenniakandMathieu Fenniak
|
b18d28b3b5 |
fix: debian package cleanup failure due to xorm connection corruption (#12764)
Fixes #12645. Detailed analysis in [this comment](https://codeberg.org/forgejo/forgejo/issues/12645#issuecomment-15939122). New test case is verified to hit the bug -- the previous case just narrowly missed the problem because it ended up with an empty repository index. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12764 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|
|
7dea39659d |
Update module code.forgejo.org/forgejo/runner/v12 to v12.10.2 (forgejo) (#12759)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [code.forgejo.org/forgejo/runner/v12](https://code.forgejo.org/forgejo/runner) | `v12.10.1` → `v12.10.2` |  |  | --- ### Release Notes <details> <summary>forgejo/runner (code.forgejo.org/forgejo/runner/v12)</summary> ### [`v12.10.2`](https://code.forgejo.org/forgejo/runner/releases/tag/v12.10.2) [Compare Source](https://code.forgejo.org/forgejo/runner/compare/v12.10.1...v12.10.2) - [User guide](https://forgejo.org/docs/next/user/actions/overview/) - [Administrator guide](https://forgejo.org/docs/next/admin/actions/) - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions) Release Notes *** <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/forgejo/runner--> - bug fixes - [PR](https://code.forgejo.org/forgejo/runner/pulls/1523): <!--number 1523 --><!--line 0 --><!--description Zml4OiByZW1vdmUgY29udGFpbmVycyBhZnRlciBmYWlsZWQgc3RhcnQtdXA=-->fix: remove containers after failed start-up<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1519): <!--number 1519 --><!--line 0 --><!--description Zml4OiByZWplY3QgaW52YWxpZCBjcm9uIHNjaGVkdWxlcyB3aGlsZSBwYXJzaW5nIHdvcmtmbG93cw==-->fix: reject invalid cron schedules while parsing workflows<!--description--> - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/1532): <!--number 1532 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3JoeXNkL2FjdGlvbmxpbnQgdG8gdjEuNy4xMg==-->Update module github.com/rhysd/actionlint to v1.7.12<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1531): <!--number 1531 --><!--line 0 --><!--description UmVwbGFjZSBOb2RlLmpzIHdpdGggZGF0YS5mb3JnZWpvLm9yZy9vY2kvbm9kZSAyNC10cml4aWU=-->Replace Node.js with data.forgejo.org/oci/node 24-trixie<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1530): <!--number 1530 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Nhc2NhZGluZy1wciBhY3Rpb24gdG8gdjIuMy4y-->Update <https://data.forgejo.org/actions/cascading-pr> action to v2.3.2<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1522): <!--number 1522 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21vYnkvcGF0dGVybm1hdGNoZXIgdG8gdjAuNi4x-->Update module github.com/moby/patternmatcher to v0.6.1<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1529): <!--number 1529 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvc3lzIHRvIHYwLjQ0LjAgW1NFQ1VSSVRZXQ==-->Update module golang.org/x/sys to v0.44.0 \[SECURITY]<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1527): <!--number 1527 --><!--line 0 --><!--description dGVzdDogdXBkYXRlIGFwdCBjYWNoZSBiZWZvcmUgaW5zdGFsbGluZyBwYWNrYWdlcyBpbiBQb2RtYW4gam9i-->test: update apt cache before installing packages in Podman job<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1521): <!--number 1521 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL21hdHRuL2dvLWlzYXR0eSB0byB2MC4wLjIy-->Update module github.com/mattn/go-isatty to v0.0.22<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1520): <!--number 1520 --><!--line 0 --><!--description VXBkYXRlIGRhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9mb3JnZWpvIERvY2tlciB0YWcgdG8gdjExLjAuMTQ=-->Update data.forgejo.org/forgejo/forgejo Docker tag to v11.0.14<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1515): <!--number 1515 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBjb25uZWN0cnBjLmNvbS9jb25uZWN0IHRvIHYxLjE5LjI=-->Update module connectrpc.com/connect to v1.19.2<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1514): <!--number 1514 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMTE=-->Update <https://data.forgejo.org/actions/setup-forgejo> action to v3.1.11<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1513): <!--number 1513 --><!--line 0 --><!--description VXBkYXRlIGRhdGEuZm9yZ2Vqby5vcmcvZm9yZ2Vqby9mb3JnZWpvIERvY2tlciB0YWcgdG8gdjExLjAuMTM=-->Update data.forgejo.org/forgejo/forgejo Docker tag to v11.0.13<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1512): <!--number 1512 --><!--line 0 --><!--description VXBkYXRlIGdvIHRvb2xjaGFpbiBkaXJlY3RpdmUgdG8gdjEuMjUuMTA=-->Update go toolchain directive to v1.25.10<!--description--> - [PR](https://code.forgejo.org/forgejo/runner/pulls/1503): <!--number 1503 --><!--line 0 --><!--description cmVmYWN0b3I6IHJlcGxhY2UgYmFja2VuZCBpZGVudGl0eSBjaGVja3Mgd2l0aCBjYXBhYmlsaXR5IHF1ZXJpZXM=-->refactor: replace backend identity checks with capability queries<!--description--> <!--end release-notes-assistant--> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJydW4tZW5kLXRvLWVuZC10ZXN0cyIsInRlc3Qvbm90LW5lZWRlZCJdfQ==--> Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12759 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
oliverpooland0ko
|
1b1ede13f9 |
feat: add actionable message on lint-locale failure (#12748)
Before this PR:  After this PR:  Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12748 Reviewed-by: 0ko <0ko@noreply.codeberg.org> Reviewed-by: Michael Kriese <michael.kriese@gmx.de> Reviewed-by: Ellen Εμίλια Άννα Zscheile <fogti@noreply.codeberg.org> |
||
|
0ko
|
8a72b70f5f |
fix(ui): do not clip overflow in workflow dispatch menu (#12753)
Fixes forgejo/forgejo#12090 Fixes forgejo/forgejo#12228 Fixes forgejo/forgejo#12743 Partially revert https://codeberg.org/forgejo/forgejo/src/commit/b5988efc85ca54e39459323775aef0bc20f145be/web_src/css/actions.css#L91-L94 from forgejo/forgejo!10563. This will cause overly long lists to overflow the viewport [like in this image](https://codeberg.org/forgejo/forgejo/attachments/b335c5b8-ad1a-44fc-bbd2-99c975c2a5e5), but will make the branch selector and select inputs usable again. In essence, replacing a serious bug with a less serious one. Note: max-height limit wasn't effective since it was clipping inline (x) axis instead of block (y) axis. So the menu was still higher than 500 px. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12753 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|
Mathieu FenniakandMathieu Fenniak
|
dfdd9b2e2a |
fix: check quota in LFS uploads against the repository owner, not operating user (#12755)
Follow-up to the previously closed #12437; verifies git LFS quotas are checked against the repository owner not the current actor. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. <!--start release-notes-assistant--> ## Release notes <!--URL:https://codeberg.org/forgejo/forgejo--> - Bug fixes - [PR](https://codeberg.org/forgejo/forgejo/pulls/12755): <!--number 12755 --><!--line 0 --><!--description Y2hlY2sgcXVvdGEgaW4gTEZTIHVwbG9hZHMgYWdhaW5zdCB0aGUgcmVwb3NpdG9yeSBvd25lciwgbm90IG9wZXJhdGluZyB1c2Vy-->check quota in LFS uploads against the repository owner, not operating user<!--description--> <!--end release-notes-assistant--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12755 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|
Renovate Bot
|
e435233c7f | Update https://data.forgejo.org/actions/setup-forgejo action to v3.1.12 (forgejo) (#12763) | ||
|
nightfurysl2001andMathieu Fenniak
|
b58d8e20fd |
feat: Update Microsoft Teams webhook to use AdaptiveCard (#11704)
## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes (can be removed for JavaScript changes) - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [ ] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Closes #4517 <!--start release-notes-assistant--> ## Release notes <!--URL:https://codeberg.org/forgejo/forgejo--> - Features - [PR](https://codeberg.org/forgejo/forgejo/pulls/11704): <!--number 11704 --><!--line 0 --><!--description VXBkYXRlIE1pY3Jvc29mdCBUZWFtcyB3ZWJob29rIHRvIHVzZSBBZGFwdGl2ZUNhcmQ=-->Update Microsoft Teams webhook to use AdaptiveCard<!--description--> <!--end release-notes-assistant--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11704 Reviewed-by: oliverpool <oliverpool@noreply.codeberg.org> Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
CatherineandMathieu Fenniak
|
0c418d2c0e |
feat: add /api/v1/actions/run endpoint (#12727)
This endpoint returns the Actions run metadata for the automatic token, making it possible for external services to authenticate a specific workflow run and understand its security context (e.g. whether it is a pull request run and if yes what pull request it is). The concrete motivating case for this feature is safe pull request preview rendering. Currently, even Forgejo itself ([forgejo/docs](https://codeberg.org/forgejo/docs/src/branch/next/.forgejo/workflows/pr.yml), [forgejo/website](https://codeberg.org/forgejo/website/src/branch/main/.forgejo/workflows/pr.yml)) uses carefully managed `pull_request_target` workflows for this task. The `pull_request_target` workflow type coupled with intentionally cloning the merge head is widely recognized as insecure, including by Forgejo developers. However, right now there is no particularly good replacement for this approach: Forgejo doesn't expose enough metadata to grant an Actions run permissions to update a part of a website, and only that part (by whichever mechanism this would happen). I am one of the developers of [git-pages](https://codeberg.org/git-pages/git-pages), which is used as the new Codeberg Pages backend. I would like to implement native support for pull request previews that does not rely on carefully written but still fragile workflows that try to hide authorization tokens from untrusted code, but rather recognizes "pull request Actions run" as a unique kind of security context, and allow it to publish to a special "preview zone", segregated by the repository name and PR number. To do this I need to be able to authorize a specific workflow run. Right now there's no reasonable way to do this, but with the new endpoint it becomes trivial: actions/git-pages passes the automatic token to git-pages, git-pages asks Forgejo for metadata then forms an authorized site URL (e.g. `http://<reponame>-<username>-pr-<number>.preview.codeberg.page` though this is not the final format) to which this PR workflow may upload a site. The API endpoint implemented in this PR has been discussed in the Matrix room and I understood that this change would be uncontroversial, hence I'm sending this PR right away instead of opening a feature request first. It doesn't introduce new response types, only returns an `ActionRun` for the authorization token. The namespaced URL `/api/v1/actions/run` was chosen because there are a number of things one could conceivably want to retrieve (e.g. `/api/v1/actions/job`); this specific endpoint seems by far the most useful though. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [x] I did not document these changes and I do not expect someone else to do it. The new API endpint is surfaced in Swagger, which seems sufficient. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. *The decision if the pull request will be shown in the release notes is up to the mergers / release team.* The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12727 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> Reviewed-by: crystal <crystal@noreply.codeberg.org> Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Andreas AhlenstorfandMathieu Fenniak
|
761ed894c5 |
fix: workflow with pull_request trigger and path filter not run when merging (#12739)
Forgejo would not trigger Actions workflows `on: pull_request:` with `paths:` or `paths-ignore:` filters when the pull request was merged. The reason was that the triggers were evaluated after the PR was merged, but Forgejo still looked for changed files between the base branch and the PR's HEAD, which by then was already in the base branch. Resolves https://codeberg.org/forgejo/forgejo/issues/12585. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes (can be removed for JavaScript changes) - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Tests for JavaScript changes (can be removed for Go changes) - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. *The decision if the pull request will be shown in the release notes is up to the mergers / release team.* The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12739 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate Bot
|
2c7ce02da1 | Update dependency forgejo/release-notes-assistant to v1.7.1 (forgejo) (#12740) | ||
|
Renovate BotandGusted
|
e2c8c0d1f6 |
Update dependency katex to v0.17.0 (forgejo) (#12741)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12741 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Mathieu FenniakandMathieu Fenniak
|
c8d24ff06a |
feat: enable auth to git HTTP via authorized integrations (#12715)
Allow authentication to git HTTP & git LFS via an authorized integration. This is the first step in getting rid of OAuth, basic auth, etc.'s usage of [`isGitRawOrAttachPath(req)`](https://codeberg.org/forgejo/forgejo/src/commit/26f18a94ee80a5fd8972833b95b1df995ee92fc4/services/auth/method/basic.go#L38-L40). I don't want to follow that pattern of HTTP route matching in the authentication method, so I've broken the HTTP routes related to git functionality out to using a separate authentication middleware in the top-level `web.Routes` handler. As this approach is expanded to the other endpoints in order to add support to them for authorized integrations, eventually it will be possible to remove this URL matching completely and just rely on middleware installation. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12715 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Fabian WeikandGusted
|
af412159ce |
chore: re-enable nilnil lint for models/actions/run.go (#12507)
`GetRunByID` is now the primary function to get a action run. `GetRunBefore` now returns `util.ErrNotExist` to avoid the nilnil pattern. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12507 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
GustedandGusted
|
385c0db94f |
feat: fsck incoming objects (#12695)
Weirdly, git doesn't verify the consistency of objects when receiving new objects. Enable that git verifies this, so we don't allow a repository to get in a weird or even corrupt state. We've already dealt with a few cases of inconsistent objects, the most notable one being mode of objects (forgejo/forgejo!9161). This can be risky, as such ignore 3 consistency checks that are not harmful to ignore and is battle tested by Gitlab. bad timezone: https://gitlab.com/gitlab-org/gitaly/-/commit/692a0d3476a5fe5832ec78df5a6d9d5e1d780364 missing space: https://gitlab.com/gitlab-org/gitaly/-/commit/2da0b393998d394b743c70e7cf9cd0757a8f2733 non-zero padded filemode: https://gitlab.com/gitlab-org/gitaly/-/commit/db8f2e8da5e7ff9cf84a99195481303016cd2138 Typically we set these settings in `modules/git/git.go`, but that means a instance administrator wouldn't be able to override it. Given we don't strictly require these settings to be set. A instance admin could choose to disable the consistency checks or override our set of ignores this would allow them to do so via the `[git.config]` section. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12695 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> Reviewed-by: elle <0xllx0@noreply.codeberg.org> |
||
|
Renovate Bot
|
ed30c7de45 | Update renovate Docker tag to v43.195.1 (forgejo) (#12720) | ||
|
Renovate BotandGusted
|
8df8d2c776 |
Update dependency webpack to v5.107.1 (forgejo) (#12721)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12721 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
0ko
|
c400a3fac7 |
chore(i18n): May 2026 maintenence (#12718)
* remove two unused strings I identified while doing other things
* update two strings per request of @mahlzahn while avoiding a whole separate PR for this
* move 126 strings to JSON, some are remapped with a better structure
* previous migration: forgejo/forgejo!12280
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12718
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
|
||
|
0ko
|
bf2d4abda2 |
merge commit: i18n: translations update from Codeberg Translate (#12284)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12284 Reviewed-by: 0ko <0ko@noreply.codeberg.org> |
||
|
+38Codeberg Translate0ko0xAndrewBlackAindriú Mac Giolla EoinAndy CallistoAtalanttoreBenedikt StraubCyborusEduardo DobayFjuroGitea & Forgejo French translatorsGustedLanguages add-onLaurent FAVOLELaxystemLzebulonMCMattiaRicky-TiggSomeTrSteffoSystemDihTAGerritsenTamilTinWuzzyartnaybittinboogicirillacs-maxdynieceriktmgallegonovatohabilhhschen820jimkatsjustbispokdh8219kwootmmorariumoexiamimvahasteoscaroteroospalhpgmtxuniversishvmtjxtex |
3748242fac |
i18n: update of translations from Codeberg Translate
Co-authored-by: 0ko <0ko@noreply.codeberg.org> Co-authored-by: 0xAndrewBlack <0xandrewblack@noreply.codeberg.org> Co-authored-by: Aindriú Mac Giolla Eoin <aindriu80@noreply.codeberg.org> Co-authored-by: Andy Callisto <andycallisto@noreply.codeberg.org> Co-authored-by: Atalanttore <atalanttore@noreply.codeberg.org> Co-authored-by: Benedikt Straub <benedikt-straub@web.de> Co-authored-by: Codeberg Translate <translate@codeberg.org> Co-authored-by: Cyborus <cyborus@noreply.codeberg.org> Co-authored-by: Eduardo Dobay <edudobay@noreply.codeberg.org> Co-authored-by: Fjuro <fjuro@noreply.codeberg.org> Co-authored-by: Gitea & Forgejo French translators <user-5603@noreply.codeberg.org> Co-authored-by: Gusted <postmaster@gusted.xyz> Co-authored-by: Languages add-on <noreply-addon-languages@weblate.org> Co-authored-by: Laurent FAVOLE <laurentfavole03@gmail.com> Co-authored-by: Laxystem <the@laxla.quest> Co-authored-by: Lzebulon <lzebulon@noreply.codeberg.org> Co-authored-by: MCMattia <mcmattia@noreply.codeberg.org> Co-authored-by: Ricky-Tigg <ricky-tigg@noreply.codeberg.org> Co-authored-by: SomeTr <sometr@noreply.codeberg.org> Co-authored-by: Steffo <steffo@noreply.codeberg.org> Co-authored-by: SystemDih <systemdih@noreply.codeberg.org> Co-authored-by: TAGerritsen <tagerritsen@noreply.codeberg.org> Co-authored-by: Tamil <tamil@noreply.codeberg.org> Co-authored-by: Tin <hntin@noreply.codeberg.org> Co-authored-by: Wuzzy <wuzzy@disroot.org> Co-authored-by: artnay <artnay@noreply.codeberg.org> Co-authored-by: bittin <bittin@noreply.codeberg.org> Co-authored-by: boogi <boogi@noreply.codeberg.org> Co-authored-by: cirilla <cirilla@noreply.codeberg.org> Co-authored-by: cs-max <cs-max@noreply.codeberg.org> Co-authored-by: dyniec <dyniec@noreply.codeberg.org> Co-authored-by: edudobay <edudobay@noreply.codeberg.org> Co-authored-by: eriktm <eriktm@noreply.codeberg.org> Co-authored-by: gallegonovato <gallegonovato@noreply.codeberg.org> Co-authored-by: habil <habil@noreply.codeberg.org> Co-authored-by: hhschen820 <hhschen820@noreply.codeberg.org> Co-authored-by: jimkats <jimkats@noreply.codeberg.org> Co-authored-by: justbispo <justbispo@noreply.codeberg.org> Co-authored-by: kdh8219 <kdh8219@monamo.dev> Co-authored-by: kwoot <kwoot@noreply.codeberg.org> Co-authored-by: mmorariu <mmorariu@noreply.codeberg.org> Co-authored-by: moexiami <moexiami@noreply.codeberg.org> Co-authored-by: mvahaste <mvahaste@noreply.codeberg.org> Co-authored-by: oscarotero <oscarotero@noreply.codeberg.org> Co-authored-by: ospalh <ospalh@noreply.codeberg.org> Co-authored-by: pgmtx <pgmtx@noreply.codeberg.org> Co-authored-by: universish <universish@noreply.codeberg.org> Co-authored-by: vmtj <vmtj@noreply.codeberg.org> Co-authored-by: xtex <xtexchooser@duck.com> Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ca/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/cs/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/de/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/el/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/es/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/et/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/fi/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/fr/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/fr_CA/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ga/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/gl/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/hi/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/it/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/lt/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/nb_NO/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/nds/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/nl/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/pl/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/pt_PT/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ru/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/sv/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ta/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/tok/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/tr/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/uk/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/zh_Hans/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/zh_Hant/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ca/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/cs/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/de/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/el/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/eo/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/es/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/fi/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/fr/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/fr_CA/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ga/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/he/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/hi/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/hu/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/it/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ko/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/kw/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/nb_NO/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/nds/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/nl/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/pl/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/pt_BR/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ro/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ru/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ta/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/tok/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/tr/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/uk/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/vi/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/zh_Hans/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/zh_Hant/ Translation: Forgejo/forgejo Translation: Forgejo/forgejo-next |
||
|
Andreas AhlenstorfandMathieu Fenniak
|
42618ba771 |
fix: update statuses in phases to prevent out of order updates from stalling workflows (#12685)
During workflow expansion, jobs are replaced or added. That means that their execution order does not necessarily match the order of their numeric IDs. For example, job 129 might depend on job 130. Unfortunately, Forgejo doesn't take this possibility into account and always examines and updates jobs by ascending ID. That means that while examining job 129, job 130 has still its old status, and, as a result, Forgejo won't schedule job 129 for execution because it's still waiting for job 130 to complete. This can lead to workflows getting stuck: ``` ...tions/job_emitter.go:48:jobEmitterQueueHandler() [E] checkJobsOfRun failed for RunID = 49: error in tryHandleIncompleteMatrix: jobStatusResolver attempted to tryHandleIncompleteMatrix for a job (id=129) with an incomplete 'needs' job (id=130) ``` This is caused by calculating all status changes recursively in memory before writing them to the database. For example, job A that was completed would unblock job B that depended on it. In that case, Forgejo would simultaneously mark job A as completed and B as waiting. However, that would not work if B had a lower ID than A. That is remedied by writing updates to the database before entering the next recursion. So, continuing the example, job A is marked as completed in the database before the next iteration detects that B is no longer blocked and writes that to the database. Resolves https://codeberg.org/forgejo/forgejo/issues/12641. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes (can be removed for JavaScript changes) - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Tests for JavaScript changes (can be removed for Go changes) - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. *The decision if the pull request will be shown in the release notes is up to the mergers / release team.* The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12685 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
numenandMathieu Fenniak
|
3650528262 |
fix: return API URL in the url field for pull requests using the API (#12643)
closes #10451 ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [ ] `make pr-go` before pushing ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. <!--start release-notes-assistant--> ## Release notes <!--URL:https://codeberg.org/forgejo/forgejo--> - Bug fixes - [PR](https://codeberg.org/forgejo/forgejo/pulls/12643): <!--number 12643 --><!--line 0 --><!--description cmV0dXJuIEFQSSBVUkwgaW4gdGhlIGB1cmxgIGZpZWxkIGZvciBwdWxsIHJlcXVlc3RzIHVzaW5nIHRoZSBBUEk=-->return API URL in the `url` field for pull requests using the API<!--description--> <!--end release-notes-assistant--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12643 Reviewed-by: Robert Wolff <mahlzahn@posteo.de> Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate BotandMathieu Fenniak
|
3ee2f718a3 |
Lock file maintenance (forgejo) (#12723)
This PR contains the following updates: | Update | Change | |---|---| | lockFileMaintenance | All locks refreshed | 🔧 This Pull Request updates lock files to use the latest dependency versions. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12723 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
624ffd18d4 |
Update dependency webpack to v5.107.0 (forgejo) (#12714)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12714 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
GustedandGusted
|
ebfac19123 |
chore: remove some git configuration options (#12681)
`ENABLE_AUTO_GIT_WIRE_PROTOCOL`: Its sole usage is to set `-c protocol.version=2` on each git command execution. The default value is already 2 since at least the minimum version of Git that Forgejo requires. When this setting was added, this was not the case. Thus, automatically defaulting to protocol v2 is already the case due to git themselves making it the default. And instances that want to use a older protocol already have to override the value like: ```ini [git.config] protocol.version=1 ``` --- `git.reflog` was deprecated in v1.21 warnings have been emitted. Remove it finally. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12681 Reviewed-by: limiting-factor <limiting-factor@noreply.codeberg.org> |
||
|
Renovate BotandMathieu Fenniak
|
26f18a94ee |
Replace Node.js with data.forgejo.org/oci/node 24-trixie (forgejo) (#12713)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [data.forgejo.org/oci/node](https://hub.docker.com/_/node) ([source](https://github.com/nodejs/docker-node)) | container | replacement | `24-bookworm` → `24-trixie` | This is a special PR that replaces `data.forgejo.org/oci/node` with the community suggested minimal stable replacement version. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12713 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
limiting-factorandMathieu Fenniak
|
5c61808014 |
fix: display the actions trust management panel on merged and closed pull requests (#12704)
It is possible for a user that is not trusted to run Forgejo Actions workflows on a repository to act on a pull request and trigger a workflow after it is merged or closed. For instance by modifying the title of the pull request or setting a label. Closes forgejo/forgejo#12576 ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes (can be removed for JavaScript changes) - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. <!--start release-notes-assistant--> ## Release notes <!--URL:https://codeberg.org/forgejo/forgejo--> - User Interface bug fixes - [PR](https://codeberg.org/forgejo/forgejo/pulls/12704): <!--number 12704 --><!--line 0 --><!--description ZGlzcGxheSB0aGUgYWN0aW9ucyB0cnVzdCBtYW5hZ2VtZW50IHBhbmVsIG9uIG1lcmdlZCBhbmQgY2xvc2VkIHB1bGwgcmVxdWVzdHM=-->display the actions trust management panel on merged and closed pull requests<!--description--> <!--end release-notes-assistant--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12704 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
0f449ff84f |
Update dependency postcss to v8.5.15 (forgejo) (#12693)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12693 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate BotandMathieu Fenniak
|
37b3b3a243 |
Update https://data.forgejo.org/actions/cascading-pr action to v2.3.2 (forgejo) (#12708)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://data.forgejo.org/actions/cascading-pr](https://code.forgejo.org/actions/cascading-pr) | action | patch | `v2.3.0` → `v2.3.2` | --- ### Release Notes <details> <summary>actions/cascading-pr (https://data.forgejo.org/actions/cascading-pr)</summary> ### [`v2.3.2`](https://code.forgejo.org/actions/cascading-pr/releases/tag/v2.3.2) [Compare Source](https://code.forgejo.org/actions/cascading-pr/compare/v2.3.1...v2.3.2) <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/actions/cascading-pr--> - bug fixes - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/58): <!--number 58 --><!--line 0 --><!--description Zml4OiBjb21wYXRpYmxpdHkgd2l0aCBvY2kvbm9kZToyNC10cml4aWUgaW1hZ2U=-->fix: compatiblity with oci/node:24-trixie image<!--description--> - other - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/57): <!--number 57 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTIuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.12.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/56): <!--number 56 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMTE=-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.11<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/55): <!--number 55 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuOA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.8<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/54): <!--number 54 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMw==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.3<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/53): <!--number 53 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.7<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/52): <!--number 52 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMg==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.2<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/50): <!--number 50 --><!--line 0 --><!--description VXBkYXRlIGFjdGlvbnMvY2hlY2tvdXQgYWN0aW9uIHRvIHY2-->Update actions/checkout action to v6<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/51): <!--number 51 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby1seGMgdG8gdjEz-->Update dependency forgejo-lxc to v13<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/49): <!--number 49 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/48): <!--number 48 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNg==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.6<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/47): <!--number 47 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.4<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/46): <!--number 46 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTAuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.10.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/45): <!--number 45 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMQ==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.1<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/43): <!--number 43 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/39): <!--number 39 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjAuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.0.7<!--description--> <!--end release-notes-assistant--> ### [`v2.3.1`](https://code.forgejo.org/actions/cascading-pr/releases/tag/v2.3.1) [Compare Source](https://code.forgejo.org/actions/cascading-pr/compare/v2.3.0...v2.3.1) <!-- correcting for mislabeling v2.3.1 on first attempt --> - fix - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/58): fix: compatiblity with oci/node:24-trixie image <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/actions/cascading-pr--> - other - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/57): <!--number 57 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTIuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.12.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/56): <!--number 56 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMTE=-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.11<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/55): <!--number 55 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuOA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.8<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/54): <!--number 54 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMw==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.3<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/53): <!--number 53 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.7<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/52): <!--number 52 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMg==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.2<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/50): <!--number 50 --><!--line 0 --><!--description VXBkYXRlIGFjdGlvbnMvY2hlY2tvdXQgYWN0aW9uIHRvIHY2-->Update actions/checkout action to v6<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/51): <!--number 51 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby1seGMgdG8gdjEz-->Update dependency forgejo-lxc to v13<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/49): <!--number 49 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/48): <!--number 48 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNg==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.6<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/47): <!--number 47 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.4<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/46): <!--number 46 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTAuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.10.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/45): <!--number 45 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMQ==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.1<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/43): <!--number 43 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/39): <!--number 39 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjAuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.0.7<!--description--> <!--end release-notes-assistant--> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12708 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Mai-LapystandGusted
|
5704b305c1 |
fix: adds missing AppSubUrl to the webmanifest's location (#12702)
Closes #12251 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12702 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Mathieu FenniakandMathieu Fenniak
|
6d522ecba0 |
feat: add "Forgejo Actions (Local)" authorized integration UI (#12672)
Extracts the separate concepts for different UIs out of the original implementation, and then adds the new UI for Forgejo Actions (Local). Manual end-to-end testing was performed on all variations of the "workflow file", "git reference", and "event" filter options as well. They're covered by test automation, but not in an end-to-end manner. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Tests for JavaScript changes - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [x] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. - Documentation is next up after this change is complete. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12672 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|
limiting-factorandMathieu Fenniak
|
03d336de44 |
chore: TestAPIInternalAndExternalIssueTracker uses the wrong repository (#12706)
Regression introduced by forgejo/forgejo!11356 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12706 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate BotandMathieu Fenniak
|
c749861d94 |
Update data.forgejo.org/oci/ci Docker tag to v2 (forgejo) (#12692)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [data.forgejo.org/oci/ci](https://code.forgejo.org/forgejo/ci-image-builder) | container | major | `1` → `2` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12692 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate BotandMathieu Fenniak
|
1a108e8fbb |
Update module golang.org/x/net to v0.55.0 [SECURITY] (forgejo) (#12686)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.54.0` → `v0.55.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.54.0...refs/tags/v0.55.0) |  |  | --- ### Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html [CVE-2026-42506](https://nvd.nist.gov/vuln/detail/CVE-2026-42506) / [GO-2026-5025](https://pkg.go.dev/vuln/GO-2026-5025) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79571](https://go.dev/issue/79571) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781700](https://go.dev/cl/781700) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5025) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) / [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026) <details> <summary>More information</summary> #### Details The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". #### Severity Unknown #### References - [https://go.dev/cl/767220](https://go.dev/cl/767220) - [https://go.dev/issue/78760](https://go.dev/issue/78760) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5026) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html [CVE-2026-42502](https://nvd.nist.gov/vuln/detail/CVE-2026-42502) / [GO-2026-5027](https://pkg.go.dev/vuln/GO-2026-5027) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79572](https://go.dev/issue/79572) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781701](https://go.dev/cl/781701) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5027) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html [CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) / [GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. #### Severity Unknown #### References - [https://go.dev/cl/781702](https://go.dev/cl/781702) - [https://go.dev/issue/79573](https://go.dev/issue/79573) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5028) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html [CVE-2026-25681](https://nvd.nist.gov/vuln/detail/CVE-2026-25681) / [GO-2026-5029](https://pkg.go.dev/vuln/GO-2026-5029) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79574](https://go.dev/issue/79574) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781703](https://go.dev/cl/781703) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5029) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking duplicate attributes can cause XSS in golang.org/x/net/html [CVE-2026-27136](https://nvd.nist.gov/vuln/detail/CVE-2026-27136) / [GO-2026-5030](https://pkg.go.dev/vuln/GO-2026-5030) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79575](https://go.dev/issue/79575) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781685](https://go.dev/cl/781685) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5030) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12686 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
B0shandGusted
|
e49cb9e772 |
fix: emoji's should not render in inline code blocks in issue lists (#12644)
This fixes #12548. I used the `RenderRefIssueTitle` function so it wouldn't create issue or PR links from #<number> strings. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12644 Reviewed-by: Robert Wolff <mahlzahn@posteo.de> |
||
|
hwiplandGusted
|
1ea5605eae |
feat: add dynamic group mappings for OIDC (#11656)
Currently, Forgejo supports configuring static group team mappings for
an OIDC authentication source that map OIDC groups to Forgejo
organizations and teams. For example, the following mapping
```json
{"Developer": {"MyForgejoOrganization": ["MyForgejoTeam1", "MyForgejoTeam2"]}}
```
automatically adds a user in the OIDC group `Developer` to the teams
`MyForgejoTeam1` and `MyForgejoTeam2` in organization
`MyForgejoOrganization`.
In order to support more dynamic mappings and to avoid having to update
the mappings for new organizations and teams, add an additional
configuration option that supports mappings with placeholders like in
the following example:
```json
["group-{org}-{team}", "other:{org}/{team}"]
```
In this example, the mappings add a user in OIDC groups
`group-org1-team1`, `group-org2-team2`, and `other:org3/team3` to team
`team1` in organization `org1`, team `team2` in organization `org2`, and
to team `team3` in organization `org3`.
Additionally, this adds a configuration option to dynamically remove
users from organization teams. If enabled, a user is removed from all
teams that are not added via a static or dynamic mapping. Thus, users
are only in teams that are added via such a mapping and no other teams.
Docs: forgejo/docs!1950
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11656
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
|
||
|
Renovate BotandGusted
|
7054075be5 |
Update Node.js to v24.16.0 (forgejo) (#12675)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12675 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
ede3bbe670 |
Update module golang.org/x/image to v0.41.0 (forgejo) (#12673)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12673 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Maxim CournoyerandGusted
|
8dd01fa861 |
chore: add delve Go debugger to Guix manifest (#12662)
I did some research and experiments to get a working `delve` debugger using Guix, which could step Forgejo and inspect variables/call procedures. This suggested change captures the details in the Guix manifest to make that knowledge easier for others to reuse. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12662 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
GustedandGusted
|
4131cc4159 |
ench: use GET for lastcommit route (#12670)
When it was introduced the route did receive for which entries it should get the last commit for. It was refactored in
|
||
|
Renovate BotandMathieu Fenniak
|
294952b774 |
Update module golang.org/x/crypto to v0.52.0 (forgejo) (#12676)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.51.0` → `v0.52.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.51.0...refs/tags/v0.52.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12676 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Shiny NematodaandGusted
|
9ba57d5879 |
fix(issue-search): drop all labels ids if no label (0) is present (#12665)
Previously, only an exact "0" was considered as no label. This however, lead to inconsistent results when label ids were added manually to the query string. Such as, "?labels=100,0" or "?labels=0,100". closes #12649 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12665 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
guillermodotnandGusted
|
93638e11cc |
fix: return 404 instead of 500 for non-existing SHA in commit status endpoint (#12476)
API consumers will see a different HTTP status code (404 instead of 500) for invalid SHAs. Fixes: #12239 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12476 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
famfoandGusted
|
b87dfe1370 |
chore(cmd): re-enable nilnil lint (#12489)
For #11261 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12489 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Robert WolffandGusted
|
96b31a9a9f |
chore(ci): cancel concurrent jobs of merge reqirements workflow [skip ci] (#12668)
See https://matrix.to/#/!UndOSerw9sggsJfEMj-iAoyi0CW27FHG4tLaEx7LaJk/$0T5xu2xuYZ272VWG9RDmQC8v8i2L6r-Tz8CG4jwaBRQ?via=schinas.net&via=matrix.org&via=tchncs.de Related: #11025 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12668 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Reviewed-by: crystal <crystal@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
7d0bac4b75 |
Update dependency katex to v0.16.47 (forgejo) (#12617)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12617 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Reviewed-by: Robert Wolff <mahlzahn@posteo.de> |
||
|
Renovate BotandGusted
|
f4c319db0b |
Update module code.forgejo.org/forgejo/levelqueue to v1.1.0 (forgejo) (#12630)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12630 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |