ed30c7de456d081c53dbb293424ba39e53363bda
25101
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Renovate Bot
|
ed30c7de45 | Update renovate Docker tag to v43.195.1 (forgejo) (#12720) | ||
|
Renovate BotandGusted
|
8df8d2c776 |
Update dependency webpack to v5.107.1 (forgejo) (#12721)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12721 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
0ko
|
c400a3fac7 |
chore(i18n): May 2026 maintenence (#12718)
* remove two unused strings I identified while doing other things
* update two strings per request of @mahlzahn while avoiding a whole separate PR for this
* move 126 strings to JSON, some are remapped with a better structure
* previous migration: forgejo/forgejo!12280
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12718
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
|
||
|
0ko
|
bf2d4abda2 |
merge commit: i18n: translations update from Codeberg Translate (#12284)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12284 Reviewed-by: 0ko <0ko@noreply.codeberg.org> |
||
|
+38Codeberg Translate0ko0xAndrewBlackAindriú Mac Giolla EoinAndy CallistoAtalanttoreBenedikt StraubCyborusEduardo DobayFjuroGitea & Forgejo French translatorsGustedLanguages add-onLaurent FAVOLELaxystemLzebulonMCMattiaRicky-TiggSomeTrSteffoSystemDihTAGerritsenTamilTinWuzzyartnaybittinboogicirillacs-maxdynieceriktmgallegonovatohabilhhschen820jimkatsjustbispokdh8219kwootmmorariumoexiamimvahasteoscaroteroospalhpgmtxuniversishvmtjxtex |
3748242fac |
i18n: update of translations from Codeberg Translate
Co-authored-by: 0ko <0ko@noreply.codeberg.org> Co-authored-by: 0xAndrewBlack <0xandrewblack@noreply.codeberg.org> Co-authored-by: Aindriú Mac Giolla Eoin <aindriu80@noreply.codeberg.org> Co-authored-by: Andy Callisto <andycallisto@noreply.codeberg.org> Co-authored-by: Atalanttore <atalanttore@noreply.codeberg.org> Co-authored-by: Benedikt Straub <benedikt-straub@web.de> Co-authored-by: Codeberg Translate <translate@codeberg.org> Co-authored-by: Cyborus <cyborus@noreply.codeberg.org> Co-authored-by: Eduardo Dobay <edudobay@noreply.codeberg.org> Co-authored-by: Fjuro <fjuro@noreply.codeberg.org> Co-authored-by: Gitea & Forgejo French translators <user-5603@noreply.codeberg.org> Co-authored-by: Gusted <postmaster@gusted.xyz> Co-authored-by: Languages add-on <noreply-addon-languages@weblate.org> Co-authored-by: Laurent FAVOLE <laurentfavole03@gmail.com> Co-authored-by: Laxystem <the@laxla.quest> Co-authored-by: Lzebulon <lzebulon@noreply.codeberg.org> Co-authored-by: MCMattia <mcmattia@noreply.codeberg.org> Co-authored-by: Ricky-Tigg <ricky-tigg@noreply.codeberg.org> Co-authored-by: SomeTr <sometr@noreply.codeberg.org> Co-authored-by: Steffo <steffo@noreply.codeberg.org> Co-authored-by: SystemDih <systemdih@noreply.codeberg.org> Co-authored-by: TAGerritsen <tagerritsen@noreply.codeberg.org> Co-authored-by: Tamil <tamil@noreply.codeberg.org> Co-authored-by: Tin <hntin@noreply.codeberg.org> Co-authored-by: Wuzzy <wuzzy@disroot.org> Co-authored-by: artnay <artnay@noreply.codeberg.org> Co-authored-by: bittin <bittin@noreply.codeberg.org> Co-authored-by: boogi <boogi@noreply.codeberg.org> Co-authored-by: cirilla <cirilla@noreply.codeberg.org> Co-authored-by: cs-max <cs-max@noreply.codeberg.org> Co-authored-by: dyniec <dyniec@noreply.codeberg.org> Co-authored-by: edudobay <edudobay@noreply.codeberg.org> Co-authored-by: eriktm <eriktm@noreply.codeberg.org> Co-authored-by: gallegonovato <gallegonovato@noreply.codeberg.org> Co-authored-by: habil <habil@noreply.codeberg.org> Co-authored-by: hhschen820 <hhschen820@noreply.codeberg.org> Co-authored-by: jimkats <jimkats@noreply.codeberg.org> Co-authored-by: justbispo <justbispo@noreply.codeberg.org> Co-authored-by: kdh8219 <kdh8219@monamo.dev> Co-authored-by: kwoot <kwoot@noreply.codeberg.org> Co-authored-by: mmorariu <mmorariu@noreply.codeberg.org> Co-authored-by: moexiami <moexiami@noreply.codeberg.org> Co-authored-by: mvahaste <mvahaste@noreply.codeberg.org> Co-authored-by: oscarotero <oscarotero@noreply.codeberg.org> Co-authored-by: ospalh <ospalh@noreply.codeberg.org> Co-authored-by: pgmtx <pgmtx@noreply.codeberg.org> Co-authored-by: universish <universish@noreply.codeberg.org> Co-authored-by: vmtj <vmtj@noreply.codeberg.org> Co-authored-by: xtex <xtexchooser@duck.com> Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ca/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/cs/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/de/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/el/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/es/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/et/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/fi/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/fr/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/fr_CA/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ga/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/gl/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/hi/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/it/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/lt/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/nb_NO/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/nds/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/nl/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/pl/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/pt_PT/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ru/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/sv/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/ta/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/tok/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/tr/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/uk/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/zh_Hans/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo-next/zh_Hant/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ca/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/cs/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/de/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/el/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/eo/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/es/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/fi/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/fr/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/fr_CA/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ga/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/he/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/hi/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/hu/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/it/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ko/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/kw/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/nb_NO/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/nds/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/nl/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/pl/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/pt_BR/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ro/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ru/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/ta/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/tok/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/tr/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/uk/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/vi/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/zh_Hans/ Translate-URL: https://translate.codeberg.org/projects/forgejo/forgejo/zh_Hant/ Translation: Forgejo/forgejo Translation: Forgejo/forgejo-next |
||
|
Andreas AhlenstorfandMathieu Fenniak
|
42618ba771 |
fix: update statuses in phases to prevent out of order updates from stalling workflows (#12685)
During workflow expansion, jobs are replaced or added. That means that their execution order does not necessarily match the order of their numeric IDs. For example, job 129 might depend on job 130. Unfortunately, Forgejo doesn't take this possibility into account and always examines and updates jobs by ascending ID. That means that while examining job 129, job 130 has still its old status, and, as a result, Forgejo won't schedule job 129 for execution because it's still waiting for job 130 to complete. This can lead to workflows getting stuck: ``` ...tions/job_emitter.go:48:jobEmitterQueueHandler() [E] checkJobsOfRun failed for RunID = 49: error in tryHandleIncompleteMatrix: jobStatusResolver attempted to tryHandleIncompleteMatrix for a job (id=129) with an incomplete 'needs' job (id=130) ``` This is caused by calculating all status changes recursively in memory before writing them to the database. For example, job A that was completed would unblock job B that depended on it. In that case, Forgejo would simultaneously mark job A as completed and B as waiting. However, that would not work if B had a lower ID than A. That is remedied by writing updates to the database before entering the next recursion. So, continuing the example, job A is marked as completed in the database before the next iteration detects that B is no longer blocked and writes that to the database. Resolves https://codeberg.org/forgejo/forgejo/issues/12641. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes (can be removed for JavaScript changes) - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Tests for JavaScript changes (can be removed for Go changes) - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. *The decision if the pull request will be shown in the release notes is up to the mergers / release team.* The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12685 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
numenandMathieu Fenniak
|
3650528262 |
fix: return API URL in the url field for pull requests using the API (#12643)
closes #10451 ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [ ] `make pr-go` before pushing ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. <!--start release-notes-assistant--> ## Release notes <!--URL:https://codeberg.org/forgejo/forgejo--> - Bug fixes - [PR](https://codeberg.org/forgejo/forgejo/pulls/12643): <!--number 12643 --><!--line 0 --><!--description cmV0dXJuIEFQSSBVUkwgaW4gdGhlIGB1cmxgIGZpZWxkIGZvciBwdWxsIHJlcXVlc3RzIHVzaW5nIHRoZSBBUEk=-->return API URL in the `url` field for pull requests using the API<!--description--> <!--end release-notes-assistant--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12643 Reviewed-by: Robert Wolff <mahlzahn@posteo.de> Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate BotandMathieu Fenniak
|
3ee2f718a3 |
Lock file maintenance (forgejo) (#12723)
This PR contains the following updates: | Update | Change | |---|---| | lockFileMaintenance | All locks refreshed | 🔧 This Pull Request updates lock files to use the latest dependency versions. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12723 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
624ffd18d4 |
Update dependency webpack to v5.107.0 (forgejo) (#12714)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12714 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
GustedandGusted
|
ebfac19123 |
chore: remove some git configuration options (#12681)
`ENABLE_AUTO_GIT_WIRE_PROTOCOL`: Its sole usage is to set `-c protocol.version=2` on each git command execution. The default value is already 2 since at least the minimum version of Git that Forgejo requires. When this setting was added, this was not the case. Thus, automatically defaulting to protocol v2 is already the case due to git themselves making it the default. And instances that want to use a older protocol already have to override the value like: ```ini [git.config] protocol.version=1 ``` --- `git.reflog` was deprecated in v1.21 warnings have been emitted. Remove it finally. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12681 Reviewed-by: limiting-factor <limiting-factor@noreply.codeberg.org> |
||
|
Renovate BotandMathieu Fenniak
|
26f18a94ee |
Replace Node.js with data.forgejo.org/oci/node 24-trixie (forgejo) (#12713)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [data.forgejo.org/oci/node](https://hub.docker.com/_/node) ([source](https://github.com/nodejs/docker-node)) | container | replacement | `24-bookworm` → `24-trixie` | This is a special PR that replaces `data.forgejo.org/oci/node` with the community suggested minimal stable replacement version. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12713 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
limiting-factorandMathieu Fenniak
|
5c61808014 |
fix: display the actions trust management panel on merged and closed pull requests (#12704)
It is possible for a user that is not trusted to run Forgejo Actions workflows on a repository to act on a pull request and trigger a workflow after it is merged or closed. For instance by modifying the title of the pull request or setting a label. Closes forgejo/forgejo#12576 ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes (can be removed for JavaScript changes) - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. <!--start release-notes-assistant--> ## Release notes <!--URL:https://codeberg.org/forgejo/forgejo--> - User Interface bug fixes - [PR](https://codeberg.org/forgejo/forgejo/pulls/12704): <!--number 12704 --><!--line 0 --><!--description ZGlzcGxheSB0aGUgYWN0aW9ucyB0cnVzdCBtYW5hZ2VtZW50IHBhbmVsIG9uIG1lcmdlZCBhbmQgY2xvc2VkIHB1bGwgcmVxdWVzdHM=-->display the actions trust management panel on merged and closed pull requests<!--description--> <!--end release-notes-assistant--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12704 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
0f449ff84f |
Update dependency postcss to v8.5.15 (forgejo) (#12693)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12693 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate BotandMathieu Fenniak
|
37b3b3a243 |
Update https://data.forgejo.org/actions/cascading-pr action to v2.3.2 (forgejo) (#12708)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://data.forgejo.org/actions/cascading-pr](https://code.forgejo.org/actions/cascading-pr) | action | patch | `v2.3.0` → `v2.3.2` | --- ### Release Notes <details> <summary>actions/cascading-pr (https://data.forgejo.org/actions/cascading-pr)</summary> ### [`v2.3.2`](https://code.forgejo.org/actions/cascading-pr/releases/tag/v2.3.2) [Compare Source](https://code.forgejo.org/actions/cascading-pr/compare/v2.3.1...v2.3.2) <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/actions/cascading-pr--> - bug fixes - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/58): <!--number 58 --><!--line 0 --><!--description Zml4OiBjb21wYXRpYmxpdHkgd2l0aCBvY2kvbm9kZToyNC10cml4aWUgaW1hZ2U=-->fix: compatiblity with oci/node:24-trixie image<!--description--> - other - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/57): <!--number 57 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTIuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.12.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/56): <!--number 56 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMTE=-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.11<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/55): <!--number 55 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuOA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.8<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/54): <!--number 54 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMw==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.3<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/53): <!--number 53 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.7<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/52): <!--number 52 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMg==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.2<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/50): <!--number 50 --><!--line 0 --><!--description VXBkYXRlIGFjdGlvbnMvY2hlY2tvdXQgYWN0aW9uIHRvIHY2-->Update actions/checkout action to v6<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/51): <!--number 51 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby1seGMgdG8gdjEz-->Update dependency forgejo-lxc to v13<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/49): <!--number 49 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/48): <!--number 48 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNg==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.6<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/47): <!--number 47 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.4<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/46): <!--number 46 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTAuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.10.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/45): <!--number 45 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMQ==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.1<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/43): <!--number 43 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/39): <!--number 39 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjAuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.0.7<!--description--> <!--end release-notes-assistant--> ### [`v2.3.1`](https://code.forgejo.org/actions/cascading-pr/releases/tag/v2.3.1) [Compare Source](https://code.forgejo.org/actions/cascading-pr/compare/v2.3.0...v2.3.1) <!-- correcting for mislabeling v2.3.1 on first attempt --> - fix - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/58): fix: compatiblity with oci/node:24-trixie image <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/actions/cascading-pr--> - other - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/57): <!--number 57 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTIuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.12.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/56): <!--number 56 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMTE=-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.11<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/55): <!--number 55 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuOA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.8<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/54): <!--number 54 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMw==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.3<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/53): <!--number 53 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.7<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/52): <!--number 52 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMg==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.2<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/50): <!--number 50 --><!--line 0 --><!--description VXBkYXRlIGFjdGlvbnMvY2hlY2tvdXQgYWN0aW9uIHRvIHY2-->Update actions/checkout action to v6<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/51): <!--number 51 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby1seGMgdG8gdjEz-->Update dependency forgejo-lxc to v13<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/49): <!--number 49 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTEuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.11.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/48): <!--number 48 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNg==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.6<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/47): <!--number 47 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.4<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/46): <!--number 46 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL2Zvcmdlam8tcmVsZWFzZSBhY3Rpb24gdG8gdjIuMTAuMA==-->Update <https://data.forgejo.org/actions/forgejo-release> action to v2.10.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/45): <!--number 45 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMQ==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.1<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/43): <!--number 43 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuMA==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.1.0<!--description--> - [PR](https://code.forgejo.org/actions/cascading-pr/pulls/39): <!--number 39 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vY29kZS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjAuNw==-->Update <https://code.forgejo.org/actions/setup-forgejo> action to v3.0.7<!--description--> <!--end release-notes-assistant--> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12708 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Mai-LapystandGusted
|
5704b305c1 |
fix: adds missing AppSubUrl to the webmanifest's location (#12702)
Closes #12251 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12702 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Mathieu FenniakandMathieu Fenniak
|
6d522ecba0 |
feat: add "Forgejo Actions (Local)" authorized integration UI (#12672)
Extracts the separate concepts for different UIs out of the original implementation, and then adds the new UI for Forgejo Actions (Local). Manual end-to-end testing was performed on all variations of the "workflow file", "git reference", and "event" filter options as well. They're covered by test automation, but not in an end-to-end manner. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Tests for JavaScript changes - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [x] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. - Documentation is next up after this change is complete. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12672 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|
limiting-factorandMathieu Fenniak
|
03d336de44 |
chore: TestAPIInternalAndExternalIssueTracker uses the wrong repository (#12706)
Regression introduced by forgejo/forgejo!11356 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12706 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate BotandMathieu Fenniak
|
c749861d94 |
Update data.forgejo.org/oci/ci Docker tag to v2 (forgejo) (#12692)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [data.forgejo.org/oci/ci](https://code.forgejo.org/forgejo/ci-image-builder) | container | major | `1` → `2` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12692 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Renovate BotandMathieu Fenniak
|
1a108e8fbb |
Update module golang.org/x/net to v0.55.0 [SECURITY] (forgejo) (#12686)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.54.0` → `v0.55.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.54.0...refs/tags/v0.55.0) |  |  | --- ### Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html [CVE-2026-42506](https://nvd.nist.gov/vuln/detail/CVE-2026-42506) / [GO-2026-5025](https://pkg.go.dev/vuln/GO-2026-5025) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79571](https://go.dev/issue/79571) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781700](https://go.dev/cl/781700) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5025) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) / [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026) <details> <summary>More information</summary> #### Details The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". #### Severity Unknown #### References - [https://go.dev/cl/767220](https://go.dev/cl/767220) - [https://go.dev/issue/78760](https://go.dev/issue/78760) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5026) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html [CVE-2026-42502](https://nvd.nist.gov/vuln/detail/CVE-2026-42502) / [GO-2026-5027](https://pkg.go.dev/vuln/GO-2026-5027) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79572](https://go.dev/issue/79572) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781701](https://go.dev/cl/781701) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5027) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html [CVE-2026-25680](https://nvd.nist.gov/vuln/detail/CVE-2026-25680) / [GO-2026-5028](https://pkg.go.dev/vuln/GO-2026-5028) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. #### Severity Unknown #### References - [https://go.dev/cl/781702](https://go.dev/cl/781702) - [https://go.dev/issue/79573](https://go.dev/issue/79573) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5028) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html [CVE-2026-25681](https://nvd.nist.gov/vuln/detail/CVE-2026-25681) / [GO-2026-5029](https://pkg.go.dev/vuln/GO-2026-5029) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79574](https://go.dev/issue/79574) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781703](https://go.dev/cl/781703) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5029) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Invoking duplicate attributes can cause XSS in golang.org/x/net/html [CVE-2026-27136](https://nvd.nist.gov/vuln/detail/CVE-2026-27136) / [GO-2026-5030](https://pkg.go.dev/vuln/GO-2026-5030) <details> <summary>More information</summary> #### Details Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. #### Severity Unknown #### References - [https://go.dev/issue/79575](https://go.dev/issue/79575) - [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8) - [https://go.dev/cl/781685](https://go.dev/cl/781685) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5030) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12686 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
B0shandGusted
|
e49cb9e772 |
fix: emoji's should not render in inline code blocks in issue lists (#12644)
This fixes #12548. I used the `RenderRefIssueTitle` function so it wouldn't create issue or PR links from #<number> strings. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12644 Reviewed-by: Robert Wolff <mahlzahn@posteo.de> |
||
|
hwiplandGusted
|
1ea5605eae |
feat: add dynamic group mappings for OIDC (#11656)
Currently, Forgejo supports configuring static group team mappings for
an OIDC authentication source that map OIDC groups to Forgejo
organizations and teams. For example, the following mapping
```json
{"Developer": {"MyForgejoOrganization": ["MyForgejoTeam1", "MyForgejoTeam2"]}}
```
automatically adds a user in the OIDC group `Developer` to the teams
`MyForgejoTeam1` and `MyForgejoTeam2` in organization
`MyForgejoOrganization`.
In order to support more dynamic mappings and to avoid having to update
the mappings for new organizations and teams, add an additional
configuration option that supports mappings with placeholders like in
the following example:
```json
["group-{org}-{team}", "other:{org}/{team}"]
```
In this example, the mappings add a user in OIDC groups
`group-org1-team1`, `group-org2-team2`, and `other:org3/team3` to team
`team1` in organization `org1`, team `team2` in organization `org2`, and
to team `team3` in organization `org3`.
Additionally, this adds a configuration option to dynamically remove
users from organization teams. If enabled, a user is removed from all
teams that are not added via a static or dynamic mapping. Thus, users
are only in teams that are added via such a mapping and no other teams.
Docs: forgejo/docs!1950
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11656
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
|
||
|
Renovate BotandGusted
|
7054075be5 |
Update Node.js to v24.16.0 (forgejo) (#12675)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12675 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
ede3bbe670 |
Update module golang.org/x/image to v0.41.0 (forgejo) (#12673)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12673 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Maxim CournoyerandGusted
|
8dd01fa861 |
chore: add delve Go debugger to Guix manifest (#12662)
I did some research and experiments to get a working `delve` debugger using Guix, which could step Forgejo and inspect variables/call procedures. This suggested change captures the details in the Guix manifest to make that knowledge easier for others to reuse. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12662 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
GustedandGusted
|
4131cc4159 |
ench: use GET for lastcommit route (#12670)
When it was introduced the route did receive for which entries it should get the last commit for. It was refactored in
|
||
|
Renovate BotandMathieu Fenniak
|
294952b774 |
Update module golang.org/x/crypto to v0.52.0 (forgejo) (#12676)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.51.0` → `v0.52.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.51.0...refs/tags/v0.52.0) |  |  | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12676 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Shiny NematodaandGusted
|
9ba57d5879 |
fix(issue-search): drop all labels ids if no label (0) is present (#12665)
Previously, only an exact "0" was considered as no label. This however, lead to inconsistent results when label ids were added manually to the query string. Such as, "?labels=100,0" or "?labels=0,100". closes #12649 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12665 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
guillermodotnandGusted
|
93638e11cc |
fix: return 404 instead of 500 for non-existing SHA in commit status endpoint (#12476)
API consumers will see a different HTTP status code (404 instead of 500) for invalid SHAs. Fixes: #12239 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12476 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
famfoandGusted
|
b87dfe1370 |
chore(cmd): re-enable nilnil lint (#12489)
For #11261 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12489 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Robert WolffandGusted
|
96b31a9a9f |
chore(ci): cancel concurrent jobs of merge reqirements workflow [skip ci] (#12668)
See https://matrix.to/#/!UndOSerw9sggsJfEMj-iAoyi0CW27FHG4tLaEx7LaJk/$0T5xu2xuYZ272VWG9RDmQC8v8i2L6r-Tz8CG4jwaBRQ?via=schinas.net&via=matrix.org&via=tchncs.de Related: #11025 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12668 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Reviewed-by: crystal <crystal@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
7d0bac4b75 |
Update dependency katex to v0.16.47 (forgejo) (#12617)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12617 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Reviewed-by: Robert Wolff <mahlzahn@posteo.de> |
||
|
Renovate BotandGusted
|
f4c319db0b |
Update module code.forgejo.org/forgejo/levelqueue to v1.1.0 (forgejo) (#12630)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12630 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
0ko
|
9a2ae75a43 |
feat(ui): provide ability to add a warning message to the registration/login screens (#12597)
Example for how that would look like on code.forgejo.org:  Login screen examples: ||| |-|-| Many instances would benefit from being able to communicate such information before a user signs up or logs in after a long break. ## Testing Disabled unless admin explicitly decides to create a template override, nothing to test. In theory CSS could break but IDK how to test against that given the custom template requirement. Also need to know that template customizations are provided as-is and shift all accountability of maintaining them to admins. ## Documentation https://codeberg.org/forgejo/docs/pulls/1945 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12597 Reviewed-by: Robert Wolff <mahlzahn@posteo.de> Reviewed-by: Beowulf <beowulf@beocode.eu> Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate BotandMathieu Fenniak
|
6fd667dcd8 |
Update module connectrpc.com/connect to v1.20.0 (forgejo) (#12654)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [connectrpc.com/connect](https://github.com/connectrpc/connect-go) | `v1.19.2` → `v1.20.0` |  |  | --- ### Release Notes <details> <summary>connectrpc/connect-go (connectrpc.com/connect)</summary> ### [`v1.20.0`](https://github.com/connectrpc/connect-go/releases/tag/v1.20.0) [Compare Source](https://github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0) #### What's Changed ##### Other changes - Bump minimum supported Go version to 1.25 by [@​jonbodner-buf](https://github.com/jonbodner-buf) in [#​922](https://github.com/connectrpc/connect-go/issues/922) - Update Unary-Get query parameter order to match spec recommendation by [@​oliversun9](https://github.com/oliversun9) in [#​926](https://github.com/connectrpc/connect-go/issues/926) #### New Contributors - [@​jonbodner-buf](https://github.com/jonbodner-buf) made their first contribution in [#​922](https://github.com/connectrpc/connect-go/issues/922) **Full Changelog**: <https://github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoiZm9yZ2VqbyIsImxhYmVscyI6WyJkZXBlbmRlbmN5LXVwZ3JhZGUiLCJ0ZXN0L25vdC1uZWVkZWQiXX0=--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12654 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Mathieu FenniakandMathieu Fenniak
|
6244e333b1 |
fix: improve visibility of mismatched repository & package visibility (#12627)
A concern has been raised to the security team that Forgejo users can be confused by the visibility of packages in Forgejo being linked to the owner of the package, and not the repository that a package may be linked to. While future feature requests may change how package visibility works, an immediately actionable response is to ensure that this is clearer to end-users. This PR adds a warning on the Settings -> Unit page of a private repository, and the Packages tab of a private repository, if the owner of the repository is public. It also renames the unit "Enable repository package registry" to "Enable package linking", to better reflect the fact that enabling packages on a repository does not create some repository-level registry. **Before**:  **After**:  **On repository's Packages tab**:  ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12627 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|
Mathieu FenniakandMathieu Fenniak
|
29eddd311b |
chore: upgrade to https://code.forgejo.org/xorm/xorm v1.4.0 (#12639)
Upgrade Forgejo to our forked [xorm v1.4.0](https://code.forgejo.org/xorm/xorm/compare/v1.3.9-forgejo.12...v1.4.0), which is now named `code.forgejo.org/xorm/xorm` to reflect the current expectation that it is a permanent fork. A small number of API changes were made recently in https://code.forgejo.org/xorm/xorm/issues/120 which are accounted for in this PR, in addition to the module rename. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12639 Reviewed-by: Otto <otto@codeberg.org> |
||
|
steven.guiheuxandMathieu Fenniak
|
0ef80f6b0f |
feat: expose access token creation date in API responses (#12620)
## Checklist Following the previous contribution that added admin-level management of user access tokens (particularly useful for bot/service accounts), this change exposes the created_at field in the API response when listing or retrieving access tokens. This information is needed to implement token rotation policies for these users — knowing when a token was created allows administrators to identify and revoke stale tokens. ### Tests for Go changes - I added test coverage for Go changes... - [X] in their respective `*_test.go` for unit tests. - [X] `make pr-go` before pushing ### Documentation - [X] I did not document these changes and I do not expect someone else to do it. ### Release notes - [X] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. <!--start release-notes-assistant--> ## Release notes <!--URL:https://codeberg.org/forgejo/forgejo--> - Features - [PR](https://codeberg.org/forgejo/forgejo/pulls/12620): <!--number 12620 --><!--line 0 --><!--description ZXhwb3NlIGFjY2VzcyB0b2tlbiBjcmVhdGlvbiBkYXRlIGluIEFQSSByZXNwb25zZXM=-->expose access token creation date in API responses<!--description--> <!--end release-notes-assistant--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12620 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|
vini sdlandMathieu Fenniak
|
aec047c7b5 |
fix(ui): fix and simplify org invite template view (#12580)
This fixes #12119 while simplifying the page a bit. It also drops dependency on `/web_src/css/modules/card.css` module. Only the profile page still relies on it. As an observation, I find the text "Please click the button below..." quite inadequate as web copy, but I decided to keep it as-is in this pull request. In the `org.css` changes, I also removed references to two `.organization.invite #invite-box` selectors, since I couldn't find it anywhere in the source code. Screenshot:  ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes (can be removed for JavaScript changes) - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [ ] `make pr-go` before pushing ### Tests for JavaScript changes (can be removed for Go changes) - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. *The decision if the pull request will be shown in the release notes is up to the mergers / release team.* The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12580 Reviewed-by: Antonin Delpeuch <wetneb@noreply.codeberg.org> |
||
|
steven.guiheuxandMathieu Fenniak
|
6574dba902 |
fix(ui): handle non-JSON error responses in form-fetch-action (#12635)
### Problem When a user clicks the merge button on a pull request and their quota is exceeded, the UI displays ( cf screenshot ): > Network error SyntaxError: Unexpected token 'Q', "Quota exceeded." is not valid JSON ### Fix Read the response body as text first with `resp.text()`, then attempt `JSON.parse()`. If parsing succeeds, use the existing `errorMessage` logic. If it fails, display the raw text directly in the error toast. This is the same approach already used by Dropzone for attachment uploads, where the `error` event handler passes the response body directly to `showErrorToast`. ( cf screenshot ) ### Tests for JavaScript changes The function is not exported, I cannot create a unit test. Do you want me to export all the logic in an exported function ? ### Release notes - [X] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12635 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Mathieu FenniakandMathieu Fenniak
|
cd5a1173d5 |
feat: web UI to delete authorized integration (#12632)
Adds a "Delete" option to the authorized integration list. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Tests for JavaScript changes (can be removed for Go changes) - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [x] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12632 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|
John BerthelsandMathieu Fenniak
|
08949c518a |
fix: expose API fields for ssh keys (#12517) (#12625)
The original issue only mentions 'Verified', but 'Updated' was also missing and so is also included. The integration test only covers the initial `false` state. Attempting to cover the flip to true seemed to introduce more problems than benefits (as outlined in `tests/integration/api_keys_test.go`) Manual testing was performed to check that verifying the key in the web ui caused the return value to change from false to true in the API response (using `curl`). ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes (can be removed for JavaScript changes) - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Tests for JavaScript changes (can be removed for Go changes) - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12625 Reviewed-by: Cyborus <cyborus@disroot.org> Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Mathieu FenniakandMathieu Fenniak
|
8d50e7b25e |
feat: create new authorized integration in web UI (#12613)
Extends work completed in #12601 to enable creating new authorized integrations in the web UI. This UI is identical to the edit experience, except: "Audience" is only presented once the object is saved, "Save authorized integration is changed to "Create authorized integration", and performing the create redirects to the completed object to access the audience rather than redirecting the list page. A drop-down menu is used for the "UI" of the new authorized integration, even though only the generic "write your own rule" UI is currently implemented. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Tests for JavaScript changes - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [x] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). - e2e tests here are for complete experience, but aren't for "JavaScript changes" as noted here. ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. - Documentation coming soon. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12613 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
0af02256ae |
Update dependency postcss to v8.5.14 (forgejo) (#12459)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12459 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
c3820b3bf7 |
Update renovate Docker tag to v43.182.1 (forgejo) (#12610)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12610 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
3d4569b01b |
Lock file maintenance (forgejo) (#12515)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12515 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Renovate BotandGusted
|
3e077889e8 |
Update dependency @codemirror/view to v6.43.0 (forgejo) (#12611)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12611 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
|
d130e1ee94 |
feat: add option to use preferred_username claim when registering users via oauth2 (#12504)
This is a continuation of #3346 based on the advise of https://codeberg.org/forgejo/forgejo/issues/1452#issuecomment-14591307. fixes: #1452 docs: https://codeberg.org/forgejo/docs/pulls/1938 Extends the `oauth2_client` `USERNAME` setting to be able to use the `preferred_username` claim. Co-authored-by: thepaperpilot <thepaperpilot@gmail.com> Co-authored-by: Anthony Lawn <thepaperpilot@gmail.com> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12504 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |
||
|
Mathieu FenniakandMathieu Fenniak
|
cf087a2f12 |
feat: ability to edit authorized integration in web UI (#12601)
Extends the UI introduced in #12558 to have edit capabilities. (not in scope: "Add" for a new Authorized Integration will be the next update to this UI; `create-authorized-integration` CLI is still the only way to create a new record) This PR includes a few refactoring steps. The goal of these steps is to have `services/auth` be a single entrypoint for validating, inserting, or updating an authorized integration. Some logic is moved out of `services/authz` because it is not authorization related, and some is moved out of `services/auth/method` to allow it to be reused during validation without creating a cyclical module dependency. This PR also adds comprehensive validation to the more complex fields in the authorized integration, such as the issuer and claim rules. This validation applies to the `forgejo admin user create-authorized-integration` CLI as well. The visible UI is the same as #12558, but with a "Save" button, and the ability to display errors:  ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Tests for JavaScript changes - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [x] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. - Documentation is on my TODO list and will be completed before release. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12601 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> |
||
|
Andreas AhlenstorfandMathieu Fenniak
|
8a1021e2a0 |
feat: mark skipped checks as skipped (#12606)
A separate commit status is introduced for skipped checks. That enables marking them as such in the UI instead of successful, which could be misleading. Resolves https://codeberg.org/forgejo/forgejo/issues/10138. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes (can be removed for JavaScript changes) - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Tests for JavaScript changes (can be removed for Go changes) - I added test coverage for JavaScript changes... - [ ] in `web_src/js/*.test.js` if it can be unit tested. - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)). ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. *The decision if the pull request will be shown in the release notes is up to the mergers / release team.* The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12606 Reviewed-by: Cyborus <cyborus@disroot.org> Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> |
||
|
Shiny NematodaandGusted
|
4ecb25a549 |
enh(issue-search): support filtering by project in user/org listing (#12596)
Support filtering `/issue` & `/pulls` (and corresponding org paths) by a project ID. Closes #12559 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12596 Reviewed-by: Gusted <gusted@noreply.codeberg.org> |