26 Commits

Author	SHA1	Message	Date
silverwind	fac8bf2eca	ci: install tools for renovate post-upgrade tasks (#38815) ... Renovate installs a toolchain only for the managers a branch actually updates. A branch without a gomod update therefore has no `go` on `PATH`, and `make tidy` [fails](https://github.com/go-gitea/gitea/pull/38813#issuecomment-5211013198). Fix by installing those tools. `node` is not needed because it comes with renovate. --------- Signed-off-by: silverwind <me@silverwind.io>	2026-08-09 10:04:14 +00:00
silverwind	d8c3a1afda	ci: pin containers to digest, enable more zizmor rules (#38779) ... Enable more strict "pedantic" zizmor rules and fix issues. Service containers are pinned to hash and renovate will update them. Enabled rules: - https://docs.zizmor.sh/audits/#excessive-permissions - https://docs.zizmor.sh/audits/#unpinned-images - https://docs.zizmor.sh/audits/#template-injection --------- Signed-off-by: silverwind <me@silverwind.io>	2026-08-06 05:16:07 +00:00
Giteabot	a954257fb1	chore(deps): update dependencies (#38757) ... Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-08-03 21:37:12 +08:00
silverwind	341caf8aa7	chore(ci): fix renovate custom manager regex (#38656) ... Make this regex compatible with https://github.com/uhop/node-re2 used by renovate and which does not support lookahead. `renovate-config-validator` which I had used earlier fails to run `re2` on node 26 because of missing prebuilt binary and falls back to JS regex which does support lookahead, giving incorrect validation results. Upstream bug report: https://github.com/renovatebot/renovate/discussions/44873 Fixes: https://github.com/go-gitea/gitea/issues/38648	2026-07-27 09:54:21 +00:00
silverwind	e75d583212	ci: match # renovate: markers that trail the value (#38640) ... The preset we extended only matches a `# renovate:` comment on the line above the `_VERSION` assignment. Ours trails the value, like the ones in the `Makefile`, so it never matched and the pin has sat at `43.141.5` since https://github.com/go-gitea/gitea/pull/37050. Co-authored-by: Claude (Opus 5) <noreply@anthropic.com>	2026-07-26 18:06:48 +00:00
silverwind	b4eb8c03c4	chore: generate codemirror languages from linguist-languages package (#38624) ... Replace the previous main-branch fetch with data from npm package [`linguist-languages`](https://github.com/ikatyang-collab/linguist-languages) and only run generate targets when actually needed. The removed `fileFilters` were leftovers from the nolyfill removal.	2026-07-26 10:19:53 +00:00
silverwind	ed5f254ee3	chore: separate go minimum and build toolchain (#38559) ... - split the go version in `go.mod` into `go` and `toolchain` again - add a workaround for https://github.com/golang/go/issues/75331 so `make tidy` never drops `toolchain` - configure renovate to bump `go` on minor releases and `toolchain` on every release - go and toolchain bumps land in a separate, fast-tracked PR, as both carry security fixes Replaces: https://github.com/go-gitea/gitea/pull/37846	2026-07-22 17:26:55 +00:00
silverwind	b8977eeb47	chore(renovate): group all dependency updates into one weekly PR (#38547) ... Group updates from all managers into a single `dependencies` group so monday produces one combined PR instead of one per manager, matching what is regularly done manually to reduce CI waiting time. The `gomod` and `npm` rules remain for their `postUpgradeTasks`, which run once on the combined branch. Also replace the all-day monday schedule with the `schedule:weekly` preset (monday 0-4 UTC) so updates whose `minimumReleaseAge` lapses later in the day wait for the next weekly batch instead of raising a new PR the same day, as happened in https://github.com/go-gitea/gitea/pull/38546. `vulnerabilityAlerts` and the go toolchain rule bypass the schedule as before.	2026-07-20 15:01:32 +00:00
silverwind	11363e2f0c	chore(renovate): bundle major updates, use chore commit type (#38470) ... 1. combine PRs for major/non-major, less PRs is less work with the fixups. 2. always set `chore`, more often than not, this is more correct then `fix`. --------- Signed-off-by: silverwind <me@silverwind.io>	2026-07-15 22:10:43 +02:00
Giteabot	c86eb7081b	fix(deps): update npm dependencies (#38431)	2026-07-15 07:14:50 +00:00
Giteabot	da5a004fc4	chore(deps): update npm dependencies (major) (#38432)	2026-07-14 13:04:08 +02:00
silverwind	535f791166	ci: regenerate codemirror languages on renovate npm updates (#38267) ... Adds `make generate-codemirror-languages` to the npm group's `postUpgradeTasks` in `renovate.json5`, so renovate regenerates `assets/codemirror-languages.json` whenever `@codemirror/language-data` (or any npm dep) updates — mirroring the existing `make svg` handling. Also reformats the `fileFilters` arrays multi-line and regenerates the asset to pick up current upstream linguist languages.	2026-06-29 22:59:08 +00:00
Giteabot	07b18467c0	fix: update npm dependencies, fix misc issues (#38257) ... Update all npm dependencies and fix discovered issues. Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-06-29 12:59:14 +02:00
Giteabot	798578115b	fix(deps): update npm dependencies, remove nolyfill (#37968) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@eslint-community/eslint-plugin-eslint-comments](https://redirect.github.com/eslint-community/eslint-plugin-eslint-comments) | [`4.7.1` → `4.7.2`](https://renovatebot.com/diffs/npm/@eslint-community%2feslint-plugin-eslint-comments/4.7.1/4.7.2) |  |  | | [@primer/octicons](https://primer.style/octicons) ([source](https://redirect.github.com/primer/octicons)) | [`19.26.0` → `19.27.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.26.0/19.27.0) |  |  | | [@typescript-eslint/parser](https://typescript-eslint.io/packages/parser) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser)) | [`8.59.4` → `8.60.0`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.59.4/8.60.0) |  |  | | [@vitest/eslint-plugin](https://redirect.github.com/vitest-dev/eslint-plugin-vitest) | [`1.6.17` → `1.6.18`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.17/1.6.18) |  |  | | [dayjs](https://day.js.org) ([source](https://redirect.github.com/iamkun/dayjs)) | [`1.11.20` → `1.11.21`](https://renovatebot.com/diffs/npm/dayjs/1.11.20/1.11.21) |  |  | | [katex](https://katex.org) ([source](https://redirect.github.com/KaTeX/KaTeX)) | [`0.16.47` → `0.17.0`](https://renovatebot.com/diffs/npm/katex/0.16.47/0.17.0) |  |  | | [material-icon-theme](https://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/main/README.md) ([source](https://redirect.github.com/material-extensions/vscode-material-icon-theme)) | [`5.34.0` → `5.35.0`](https://renovatebot.com/diffs/npm/material-icon-theme/5.34.0/5.35.0) |  |  | | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) | [`11.2.1` → `11.4.0`](https://renovatebot.com/diffs/npm/pnpm/11.2.1/11.4.0) |  |  | | [rolldown-license-plugin](https://redirect.github.com/silverwind/rolldown-license-plugin) | [`3.0.7` → `3.0.8`](https://renovatebot.com/diffs/npm/rolldown-license-plugin/3.0.7/3.0.8) |  |  | | [typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)) | [`8.59.4` → `8.60.0`](https://renovatebot.com/diffs/npm/typescript-eslint/8.59.4/8.60.0) |  |  | | [updates](https://redirect.github.com/silverwind/updates) | [`17.16.13` → `17.17.2`](https://renovatebot.com/diffs/npm/updates/17.16.13/17.17.2) |  |  | | [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.0.13` → `8.0.14`](https://renovatebot.com/diffs/npm/vite/8.0.13/8.0.14) |  |  | | [vue](https://vuejs.org/) ([source](https://redirect.github.com/vuejs/core)) | [`3.5.34` → `3.5.35`](https://renovatebot.com/diffs/npm/vue/3.5.34/3.5.35) |  |  | | [vue-tsc](https://redirect.github.com/vuejs/language-tools) ([source](https://redirect.github.com/vuejs/language-tools/tree/HEAD/packages/tsc)) | [`3.3.1` → `3.3.2`](https://renovatebot.com/diffs/npm/vue-tsc/3.3.1/3.3.2) |  |  | --- ### Release Notes <details> <summary>eslint-community/eslint-plugin-eslint-comments (@&#8203;eslint-community/eslint-plugin-eslint-comments)</summary> ### [`v4.7.2`](https://redirect.github.com/eslint-community/eslint-plugin-eslint-comments/releases/tag/v4.7.2) [Compare Source](https://redirect.github.com/eslint-community/eslint-plugin-eslint-comments/compare/v4.7.1...v4.7.2) ##### Bug Fixes - **deps:** pin `modern-monaco` version to 0.4.0 ([#&#8203;320](https://redirect.github.com/eslint-community/eslint-plugin-eslint-comments/issues/320)) ([62a2c3a](62a2c3a4ee)) - **docs:** use `modern-monaco` instead of `monaco-editor` ([#&#8203;311](https://redirect.github.com/eslint-community/eslint-plugin-eslint-comments/issues/311)) ([42919d0](42919d06d8)) </details> <details> <summary>primer/octicons (@&#8203;primer/octicons)</summary> ### [`v19.27.0`](https://redirect.github.com/primer/octicons/blob/HEAD/CHANGELOG.md#19270) [Compare Source](https://redirect.github.com/primer/octicons/compare/v19.26.0...v19.27.0) ##### Minor Changes - [#&#8203;1203](https://redirect.github.com/primer/octicons/pull/1203) [`a69618e4`](a69618e4b6) Thanks [@&#8203;ericwbailey](https://redirect.github.com/ericwbailey)! - Add flag icon ##### Patch Changes - [#&#8203;1212](https://redirect.github.com/primer/octicons/pull/1212) [`02bd1ef8`](02bd1ef8d1) Thanks [@&#8203;ericwbailey](https://redirect.github.com/ericwbailey)! - remove hardcoded fill from flag icon </details> <details> <summary>typescript-eslint/typescript-eslint (@&#8203;typescript-eslint/parser)</summary> ### [`v8.60.0`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8600-2026-05-25) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.59.4...v8.60.0) This was a version bump only for parser to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.0) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>vitest-dev/eslint-plugin-vitest (@&#8203;vitest/eslint-plugin)</summary> ### [`v1.6.18`](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/releases/tag/v1.6.18) [Compare Source](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/compare/v1.6.17...v1.6.18) #####    🐞 Bug Fixes - Correct `requiresTypeChecking` metadata for four rules  -  by [@&#8203;inglec-arista](https://redirect.github.com/inglec-arista) in [#&#8203;905](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/issues/905) [<samp>(e06a3)</samp>](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/commit/e06a3dc) #####     [View changes on GitHub](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/compare/v1.6.17...v1.6.18) </details> <details> <summary>iamkun/dayjs (dayjs)</summary> ### [`v1.11.21`](https://redirect.github.com/iamkun/dayjs/blob/HEAD/CHANGELOG.md#11121-2026-05-26) [Compare Source](https://redirect.github.com/iamkun/dayjs/compare/v1.11.20...v1.11.21) ##### Bug Fixes - preserve unsupported year tokens in format ([#&#8203;3015](https://redirect.github.com/iamkun/dayjs/issues/3015)) ([#&#8203;3016](https://redirect.github.com/iamkun/dayjs/issues/3016)) ([8fda602](8fda602bea)) </details> <details> <summary>KaTeX/KaTeX (katex)</summary> ### [`v0.17.0`](https://redirect.github.com/KaTeX/KaTeX/blob/HEAD/CHANGELOG.md#0170-2026-05-22) [Compare Source](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.47...v0.17.0) ##### Performance Improvements - simplify `defineFunction` to avoid destructuring, improve typing ([#&#8203;4222](https://redirect.github.com/KaTeX/KaTeX/issues/4222)) ([fb604e6](fb604e6ba6)) ##### BREAKING CHANGES - The internal API for `__defineFunction` changed: you should no longer wrap properties in `props`. #### [0.16.47](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.46...v0.16.47) (2026-05-16) ##### Bug Fixes - correct size of `[` big delimiter ([#&#8203;4217](https://redirect.github.com/KaTeX/KaTeX/issues/4217)) ([7ba0027](7ba0027d2f)), closes [#&#8203;4215](https://redirect.github.com/KaTeX/KaTeX/issues/4215) #### [0.16.46](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.45...v0.16.46) (2026-05-13) ##### Bug Fixes - preserve math font in some styling commands ([#&#8203;4214](https://redirect.github.com/KaTeX/KaTeX/issues/4214)) ([e9ee046](e9ee0464dd)), closes [#&#8203;4213](https://redirect.github.com/KaTeX/KaTeX/issues/4213) #### [0.16.45](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.44...v0.16.45) (2026-04-05) ##### Bug Fixes - wrap vcenter mpadded in mrow for valid MathML ([#&#8203;4193](https://redirect.github.com/KaTeX/KaTeX/issues/4193)) ([ee66b78](ee66b78d24)), closes [#&#8203;4078](https://redirect.github.com/KaTeX/KaTeX/issues/4078) #### [0.16.44](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.43...v0.16.44) (2026-03-27) ##### Bug Fixes - remove extra \jot space at bottom of align/gather/etc. ([#&#8203;4184](https://redirect.github.com/KaTeX/KaTeX/issues/4184)) ([3870ee9](3870ee913e)) #### [0.16.43](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.42...v0.16.43) (2026-03-26) ##### Bug Fixes - use makeEm() consistently to truncate long CSS decimals ([#&#8203;4181](https://redirect.github.com/KaTeX/KaTeX/issues/4181)) ([0967dcc](0967dcc027)) #### [0.16.42](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.41...v0.16.42) (2026-03-24) ##### Features - \underbracket and \overbracket ([#&#8203;4147](https://redirect.github.com/KaTeX/KaTeX/issues/4147)) ([5be9abb](5be9abb0b4)) #### [0.16.41](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.40...v0.16.41) (2026-03-24) ##### Bug Fixes - \sout in text mode ([#&#8203;4173](https://redirect.github.com/KaTeX/KaTeX/issues/4173)) ([e748578](e748578b63)) #### [0.16.40](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.39...v0.16.40) (2026-03-20) ##### Bug Fixes - **css:** specify position: relative for .katex ([#&#8203;4170](https://redirect.github.com/KaTeX/KaTeX/issues/4170)) ([020f0d8](020f0d8956)) #### [0.16.39](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.38...v0.16.39) (2026-03-19) ##### Bug Fixes - middle dot in text mode ([#&#8203;4169](https://redirect.github.com/KaTeX/KaTeX/issues/4169)) ([edb45b0](edb45b0b17)), closes [#&#8203;3641](https://redirect.github.com/KaTeX/KaTeX/issues/3641) #### [0.16.38](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.37...v0.16.38) (2026-03-08) ##### Bug Fixes - accent skew mixed with font specifiers ([#&#8203;4159](https://redirect.github.com/KaTeX/KaTeX/issues/4159)) ([aea3375](aea33758d6)), closes [#&#8203;4121](https://redirect.github.com/KaTeX/KaTeX/issues/4121) #### [0.16.37](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.36...v0.16.37) (2026-03-06) ##### Bug Fixes - negative-width `\hphantom` and symmetric `\smash` ([#&#8203;4153](https://redirect.github.com/KaTeX/KaTeX/issues/4153)) ([d4799ca](d4799cae58)) #### [0.16.36](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.35...v0.16.36) (2026-03-06) ##### Bug Fixes - contrib esm bloat ([#&#8203;4157](https://redirect.github.com/KaTeX/KaTeX/issues/4157)) ([2bde1ad](2bde1adab2)) #### [0.16.35](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.34...v0.16.35) (2026-03-05) ##### Bug Fixes - version number regression ([#&#8203;4155](https://redirect.github.com/KaTeX/KaTeX/issues/4155)) ([db26b73](db26b73380)) #### [0.16.34](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.33...v0.16.34) (2026-03-05) ##### Bug Fixes - emoji with variation selector ([#&#8203;4151](https://redirect.github.com/KaTeX/KaTeX/issues/4151)) ([c2606e5](c2606e5db9)) #### [0.16.33](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.32...v0.16.33) (2026-02-23) ##### Bug Fixes - **scss:** forward variables to fonts module ([#&#8203;4146](https://redirect.github.com/KaTeX/KaTeX/issues/4146)) ([9349a64](9349a64a05)) #### [0.16.32](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.31...v0.16.32) (2026-02-22) ##### Bug Fixes - italic separation in \mathnormal ([#&#8203;4143](https://redirect.github.com/KaTeX/KaTeX/issues/4143)) ([71305a0](71305a0514)) #### [0.16.31](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.30...v0.16.31) (2026-02-22) ##### Bug Fixes - `\*frac` sizing ([#&#8203;4137](https://redirect.github.com/KaTeX/KaTeX/issues/4137)) ([ef51f18](ef51f18ded)) #### [0.16.30](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.29...v0.16.30) (2026-02-22) ##### Bug Fixes - no line breaks after `\not` ([#&#8203;4140](https://redirect.github.com/KaTeX/KaTeX/issues/4140)) ([2d1ba86](2d1ba86143)) #### [0.16.29](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.28...v0.16.29) (2026-02-22) ##### Bug Fixes - `\imath` and other `\html@mathml` macros in arguments ([#&#8203;4139](https://redirect.github.com/KaTeX/KaTeX/issues/4139)) ([a850cce](a850cce7cc)) #### [0.16.28](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.27...v0.16.28) (2026-01-25) ##### Bug Fixes - **type:** add missing types definition path to package.json ([#&#8203;4125](https://redirect.github.com/KaTeX/KaTeX/issues/4125)) ([0ef8921](0ef8921d18)) #### [0.16.27](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.26...v0.16.27) (2025-12-07) ##### Features - support equals sign and surrounding whitespace in \htmlData attribute values ([#&#8203;4112](https://redirect.github.com/KaTeX/KaTeX/issues/4112)) ([c77aaec](c77aaec00c)) #### [0.16.26](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.25...v0.16.26) (2025-12-07) ##### Bug Fixes - \mathop followed by integral symbol ([6fbad18](6fbad18857)) #### [0.16.25](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.24...v0.16.25) (2025-10-13) ##### Features - **css:** provide `katex-swap.css` that uses `font-display: swap` ([#&#8203;3940](https://redirect.github.com/KaTeX/KaTeX/issues/3940)) ([b3f9ce6](b3f9ce691e)), closes [#&#8203;2242](https://redirect.github.com/KaTeX/KaTeX/issues/2242) #### [0.16.24](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.23...v0.16.24) (2025-10-12) ##### Features - support hex colors with alpha ([#&#8203;4090](https://redirect.github.com/KaTeX/KaTeX/issues/4090)) ([8c9b306](8c9b306396)), closes [#&#8203;4067](https://redirect.github.com/KaTeX/KaTeX/issues/4067) [#fA6](https://redirect.github.com/KaTeX/KaTeX/issues/fA6) [#fA6f1](https://redirect.github.com/KaTeX/KaTeX/issues/fA6f1) #### [0.16.23](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.22...v0.16.23) (2025-10-03) ##### Bug Fixes - Support `\def` with arguments via `macros` option ([#&#8203;4087](https://redirect.github.com/KaTeX/KaTeX/issues/4087)) ([80a8158](80a815856a)) #### [0.16.22](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.21...v0.16.22) (2025-04-09) ##### Bug Fixes - \relax in base or exponent of super/subscript ([#&#8203;4045](https://redirect.github.com/KaTeX/KaTeX/issues/4045)) ([1f43c84](1f43c84a17)) #### [0.16.21](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.20...v0.16.21) (2025-01-17) ##### Bug Fixes - escape \htmlData attribute name ([57914ad](57914ad91e)) #### [0.16.20](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.19...v0.16.20) (2025-01-12) ##### Bug Fixes - \providecommand does not overwrite existing macro ([#&#8203;4000](https://redirect.github.com/KaTeX/KaTeX/issues/4000)) ([6d30fe4](6d30fe47b0)), closes [#&#8203;3928](https://redirect.github.com/KaTeX/KaTeX/issues/3928) #### [0.16.19](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.18...v0.16.19) (2024-12-29) ##### Bug Fixes - **types:** improve `strict` function type ([#&#8203;4009](https://redirect.github.com/KaTeX/KaTeX/issues/4009)) ([4228b4e](4228b4eb52)) #### [0.16.18](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.17...v0.16.18) (2024-12-18) ##### Bug Fixes - Actually publish TypeScript type definitions ([#&#8203;4008](https://redirect.github.com/KaTeX/KaTeX/issues/4008)) ([629b873](629b87354f)) #### [0.16.17](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.16...v0.16.17) (2024-12-17) ##### Bug Fixes - MathML combines multidigit numbers with sup/subscript, comma separators, and multicharacter text when outputting to DOM ([#&#8203;3999](https://redirect.github.com/KaTeX/KaTeX/issues/3999)) ([7d79e22](7d79e220f4)), closes [#&#8203;3995](https://redirect.github.com/KaTeX/KaTeX/issues/3995) #### [0.16.16](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.15...v0.16.16) (2024-12-17) ##### Features - ESM exports, TypeScript types ([#&#8203;3992](https://redirect.github.com/KaTeX/KaTeX/issues/3992)) ([ea9c173](ea9c173a0d)) #### [0.16.15](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.14...v0.16.15) (2024-12-09) ##### Features - italic sans-serif in math mode via `\mathsfit` command ([#&#8203;3998](https://redirect.github.com/KaTeX/KaTeX/issues/3998)) ([2218901](22189018b6)) #### [0.16.14](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.13...v0.16.14) (2024-12-08) ##### Features - \dddot and \ddddot support ([#&#8203;3834](https://redirect.github.com/KaTeX/KaTeX/issues/3834)) ([bda35cd](bda35cdb0a)), closes [#&#8203;2744](https://redirect.github.com/KaTeX/KaTeX/issues/2744) #### [0.16.13](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.12...v0.16.13) (2024-12-08) ##### Bug Fixes - `\vdots` and `\rule` support in text mode ([#&#8203;3997](https://redirect.github.com/KaTeX/KaTeX/issues/3997)) ([0e08352](0e08352623)), closes [#&#8203;3990](https://redirect.github.com/KaTeX/KaTeX/issues/3990) #### [0.16.12](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.11...v0.16.12) (2024-12-08) ##### Features - **css:** configurable margin for display math ([#&#8203;3638](https://redirect.github.com/KaTeX/KaTeX/issues/3638)) ([3405001](3405001225)) #### [0.16.11](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.10...v0.16.11) (2024-07-02) ##### Features - add \emph ([#&#8203;3963](https://redirect.github.com/KaTeX/KaTeX/issues/3963)) ([9f34da4](9f34da4b3c)), closes [#&#8203;3566](https://redirect.github.com/KaTeX/KaTeX/issues/3566) #### [0.16.10](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.9...v0.16.10) (2024-03-24) ##### Bug Fixes - \edef bypassing maxExpand via exponential blowup ([e88b4c3](e88b4c357f)) - escape \includegraphics src and alt ([c5897fc](c5897fcd1f)) - force protocol to be lowercase for better protocol filtering ([fc5af64](fc5af64183)), closes [/datatracker.ietf.org/doc/html/rfc3986#section-3](https://redirect.github.com//datatracker.ietf.org/doc/html/rfc3986/issues/section-3) - maxExpand limit with Unicode sub/superscripts ([085e21b](085e21b5da)) #### [0.16.9](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.8...v0.16.9) (2023-10-02) ##### Features - Support bold Fraktur ([#&#8203;3777](https://redirect.github.com/KaTeX/KaTeX/issues/3777)) ([240d5ae](240d5aede9)) #### [0.16.8](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.7...v0.16.8) (2023-06-24) ##### Features - expose error length and raw error message on ParseError ([#&#8203;3820](https://redirect.github.com/KaTeX/KaTeX/issues/3820)) ([710774a](710774aaeb)) #### [0.16.7](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.6...v0.16.7) (2023-04-28) ##### Bug Fixes - **docs/support\_table.md:** delete redundant "varPsi" ([#&#8203;3814](https://redirect.github.com/KaTeX/KaTeX/issues/3814)) ([33a1b98](33a1b98710)) #### [0.16.6](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.5...v0.16.6) (2023-04-17) ##### Bug Fixes - Support `\let` via `macros` option ([#&#8203;3738](https://redirect.github.com/KaTeX/KaTeX/issues/3738)) ([bdb0be2](bdb0be2017)), closes [#&#8203;3737](https://redirect.github.com/KaTeX/KaTeX/issues/3737) [#&#8203;3737](https://redirect.github.com/KaTeX/KaTeX/issues/3737) #### [0.16.5](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.4...v0.16.5) (2023-04-17) ##### Features - \_\_defineFunction API exposing internal defineFunction ([#&#8203;3805](https://redirect.github.com/KaTeX/KaTeX/issues/3805)) ([c7b1f84](c7b1f84b78)), closes [#&#8203;3756](https://redirect.github.com/KaTeX/KaTeX/issues/3756) #### [0.16.4](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.3...v0.16.4) (2022-12-07) ##### Bug Fixes - space should prevent optional argument to \ ([#&#8203;3746](https://redirect.github.com/KaTeX/KaTeX/issues/3746)) ([a0deb34](a0deb3410f)), closes [#&#8203;3745](https://redirect.github.com/KaTeX/KaTeX/issues/3745) #### [0.16.3](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.2...v0.16.3) (2022-10-22) ##### Bug Fixes - \hline after \cr ([#&#8203;3735](https://redirect.github.com/KaTeX/KaTeX/issues/3735)) ([ebf6bf5](ebf6bf5b50)), closes [#&#8203;3734](https://redirect.github.com/KaTeX/KaTeX/issues/3734) #### [0.16.2](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.1...v0.16.2) (2022-08-29) ##### Bug Fixes - **auto-render:** concatenate content of successive text nodes ([#&#8203;3422](https://redirect.github.com/KaTeX/KaTeX/issues/3422)) ([4d3fdd8](4d3fdd8647)) - Implement \pmb via CSS text-shadow ([#&#8203;3505](https://redirect.github.com/KaTeX/KaTeX/issues/3505)) ([176552a](176552a691)) #### [0.16.1](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.0...v0.16.1) (2022-08-28) ##### Bug Fixes - Use SVGs for some stacked delims ([#&#8203;3686](https://redirect.github.com/KaTeX/KaTeX/issues/3686)) ([8a65a2e](8a65a2e1fd)) </details> <details> <summary>material-extensions/vscode-material-icon-theme (material-icon-theme)</summary> ### [`v5.35.0`](https://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/HEAD/CHANGELOG.md#v5350) [Compare Source](https://redirect.github.com/material-extensions/vscode-material-icon-theme/compare/v5.34.0...v5.35.0) [compare changes](https://redirect.github.com/material-extensions/vscode-material-icon-theme/compare/v5.34.0...v5.35.0) ##### 🚀 Enhancements - Add CAD file extensions to 3d icon mapping ([#&#8203;3436](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3436)) - Add tsdown icon ([#&#8203;3418](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3418)) - Add new icons for mrpack ([#&#8203;3439](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3439)) - Add support for vercel.ts icon (typed Vercel configuration) ([#&#8203;3441](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3441)) - Support jxl image file type ([#&#8203;3444](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3444)) - Add uiua file icon ([#&#8203;3408](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3408)) - Add folder associations for rust/cargo projects ([#&#8203;3447](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3447)) - **icon:** Add zed folder icon ([#&#8203;3442](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3442)) - **icon:** Add redis icon ([#&#8203;3450](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3450)) - Add more unit tests for writefile helper function ([9e4c98aa](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/9e4c98aa)) - Include language IDs into the file icons ([c9a9d2ed](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/c9a9d2ed)) - Update dependencies ([d7274c71](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/d7274c71)) ##### 🩹 Fixes - Add rootDir to tsconfig.declarations.json for TypeScript 6 ([4f7f49e9](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/4f7f49e9)) - Correct typos in CONTRIBUTING.md ([4de4acf7](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/4de4acf7)) ##### 💅 Refactors - **core:** Rewrite toTitleCase for clarity and add tests ([33c0e614](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/33c0e614)) - Remove duplicate toTitleCase, consolidate imports ([e247951d](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/e247951d)) ##### 🏡 Chore - Improve release process ([b959b483](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/b959b483)) ##### ✅ Tests - **core:** Add comprehensive tests for object helpers ([57f476c5](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/57f476c5)) ##### ❤️ Contributors - Philipp Kief ([@&#8203;PKief](https://redirect.github.com/PKief)) - Sayan Shankhari ([@&#8203;SayanShankhari](https://redirect.github.com/SayanShankhari)) - Tymon Marek ([@&#8203;TymonMarek](https://redirect.github.com/TymonMarek)) - Unteksi-ozar ([@&#8203;Unteksi-ozar](https://redirect.github.com/Unteksi-ozar)) - 锐冰 SharpIce ([@&#8203;SharpIceX](https://redirect.github.com/SharpIceX)) - El Mahdi Bennajah ([@&#8203;bennajah](https://redirect.github.com/bennajah)) - Glitch714 ([@&#8203;glitchplaysgames714](https://redirect.github.com/glitchplaysgames714)) - Andrin Haldner ([@&#8203;AHaldner](https://redirect.github.com/AHaldner)) - Kaden Gruizenga ([@&#8203;kgruiz](https://redirect.github.com/kgruiz)) </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.4.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1140) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.3.0...v11.4.0) ##### Minor Changes - Treat tarball-integrity mismatches against the lockfile as a hard failure by default. Previously, `pnpm install` (non-frozen) would log `ERR_PNPM_TARBALL_INTEGRITY`, silently re-resolve from the registry, and overwrite the locked integrity — which meant a compromised registry, proxy, or republished version could substitute attacker-controlled content on a clean machine even though the project shipped a committed lockfile. `pnpm install` now exits with `ERR_PNPM_TARBALL_INTEGRITY` and a hint pointing at the new opt-in flag. The only opt-in is **`pnpm install --update-checksums`** — narrowly scoped to refreshing the locked integrity values from what the registry currently serves. Mirrors yarn's flag of the same name. A warning still prints when the bypass takes effect so the operation is auditable. `--force` and `pnpm update` deliberately do **not** bypass the integrity check. They are routine refresh operations; silently overwriting a locked integrity in those flows would erase the protection a committed lockfile is supposed to provide. `--frozen-lockfile` behavior is unchanged. `--fix-lockfile` keeps its documented purpose (filling in missing lockfile entries) and is also not a bypass. - `pnpm runtime set <name> <version>` now saves the runtime to `devEngines.runtime` by default instead of `engines.runtime`. Pass `--save-prod` (or `-P`) to save it to `engines.runtime` instead [#&#8203;11948](https://redirect.github.com/pnpm/pnpm/issues/11948). ##### Patch Changes - Fix a credential disclosure issue where an unscoped `_authToken` (or `_auth`, or `username` + `_password`, or `tokenHelper`) defined in one source — `~/.npmrc`, `~/.config/pnpm/auth.ini`, a workspace `.npmrc`, CLI flags, etc. — would be sent as an `Authorization` header to whichever registry a different (potentially untrusted) source named. The same fix extends to client TLS credentials (`cert`, `key`) so they aren't presented to a registry their author didn't choose. pnpm now rewrites each unscoped per-registry setting (`_authToken`, `_auth`, `username`, `_password`, `tokenHelper`, `cert`, `key`) to its URL-scoped form at load time, using the `registry=` value declared in the same source (or the npmjs default registry if the source declares none). A later layer overriding `registry=` therefore cannot pull an unscoped credential along, because it is already pinned to the URL its author intended. `ca`/`cafile` are intentionally not rescoped — they're trust anchors, not credentials, and corporate MITM-proxy setups rely on them applying globally. Every rescope emits a deprecation warning telling the user where the setting was pinned and how to write it directly. npm has rejected unscoped credentials outright since `npm@9`, and pnpm intends to remove support in a future major release. To target a specific registry, write the setting URL-scoped (e.g. `//registry.example.com/:_authToken=...` or `//registry.example.com/:cert=...`). `@pnpm/network.auth-header`: removed the `defaultRegistry` parameter from `createGetAuthHeaderByURI` and `getAuthHeadersFromCreds`. Now that credentials are URL-scoped at load time, the merged `configByUri` never contains the empty-string "default registry" placeholder slot, so re-keying it onto the merged default registry is no longer needed. - Fix `pnpm deploy` crashing with `ENOENT: ... lstat '<deployDir>/node_modules'` when `configDependencies` declares pacquet (`pacquet` or `@pnpm/pacquet`). The deploy directory never installs config dependencies, so the install engine they designate isn't on disk to invoke; the nested install now skips them. - Reject git resolutions whose `commit` field is not a 40-character hexadecimal SHA before invoking `git`. A malicious lockfile could otherwise smuggle a value such as `--upload-pack=<command>` through `git fetch` / `git checkout`, which on SSH or local-file transports executes the supplied command. - Limit concurrent project manifest reads while listing large workspaces to avoid `EMFILE` errors. - Reject patch files whose `diff --git` headers reference paths outside the patched package directory. Previously a malicious `.patch` file added via a pull request could write, delete, or rename arbitrary files reachable by the user running `pnpm install`. - Improve the log message that pnpm prints after auto-adding entries to `minimumReleaseAgeExclude` when `minimumReleaseAge` is set without `minimumReleaseAgeStrict`. The message previously referred to the internal "loose mode" terminology, which wasn't searchable in the docs; it now tells the user to set `minimumReleaseAgeStrict` to `true` if they want these updates gated behind a prompt instead [#&#8203;11747](https://redirect.github.com/pnpm/pnpm/issues/11747). - Reject dependency aliases that contain path-traversal segments (such as `@x/../../../../../.git/hooks`) when reading them from a package manifest or symlinking them into `node_modules`. A malicious registry package could otherwise use a transitive dependency key to make `pnpm install` create symlinks at attacker-chosen paths outside the intended `node_modules` directory. - Reject `pnpm-lock.yaml` entries whose remote tarball `resolution:` block is missing the `integrity` field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips `integrity:`) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under `--frozen-lockfile`. pnpm now fails closed at lockfile-read time with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`. Git-hosted tarballs (`gitHosted: true` or a URL on codeload.github.com / bitbucket.org / gitlab.com) and `file:` tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes. - Validate `devEngines.runtime` and `engines.runtime` version ranges for `node`, `deno`, and `bun` when `onFail` is set to `error` or `warn`. Previously these settings only had an effect with `onFail: 'download'` — the `error` and `warn` modes silently did nothing [#&#8203;11818](https://redirect.github.com/pnpm/pnpm/issues/11818). Violations now throw `ERR_PNPM_BAD_RUNTIME_VERSION`. - Require provenance before treating trusted publisher metadata as the strongest trust evidence. ### [`v11.3.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1130) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.2.2...v11.3.0) ##### Minor Changes - Added `pnpm stage` with `publish`, `list`, `view`, `approve`, `reject`, and `download` subcommands for npm staged publishing. - Added a new setting `trustLockfile`. When `true`, `pnpm install` skips the supply-chain verification pass that re-applies `minimumReleaseAge` / `trustPolicy='no-downgrade'` to every entry in the loaded lockfile. The install treats the lockfile as already-trusted — useful for closed-source projects where every commit comes from a trusted author. Defaults to `false`; verification stays on by default. Set in `pnpm-workspace.yaml`. Also cut the memory footprint of the verification pass itself: the per-(registry, name) trust-meta cache previously retained the full packument — dependency graphs, scripts, README, and per-version manifests — for the entire install. On large workspaces (`~4k` lockfile entries with `minimumReleaseAge` + `trustPolicy: no-downgrade` enabled) this could OOM CI runners with a 2GB heap cap. The cache now stores only the fields the trust check actually reads (`time`, per-version `_npmUser.trustedPublisher`, `dist.attestations.provenance`). The abbreviated-metadata cache is similarly projected to just the package-level `modified` field and the set of currently-listed version names. Fixes [#&#8203;11860](https://redirect.github.com/pnpm/pnpm/issues/11860). - Implemented `pnpm pkg` command natively, following `npm pkg` standards. - Implemented `pnpm repo` command natively, following `npm repo` standards. - Implemented `pnpm set-script` (alias `ss`) natively. Adds or updates an entry in the `scripts` field of the project manifest, supporting `package.json`, `package.json5`, and `package.yaml` formats. - Add a `skip-manifest-obfuscation` option for `pnpm pack` and `pnpm publish`. When enabled, the original `packageManager` field and publish lifecycle scripts are kept in the packed/published manifest instead of being stripped. The pnpm-specific `pnpm` field continues to be omitted. ##### Patch Changes - Fixed `pnpm dlx` failing with `ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND` when the installed package's CAS slot is missing its `package.json`. Observed in the wild for `pnpm dlx node@runtime:<version>` when the GVS slot was populated without the synthesized manifest runtime archives need (they don't ship a `package.json` of their own, so the synthesized one is the only way it gets there; an existing slot from an earlier code path that skipped the synthesis stays incomplete). The bin link itself is wired up from the resolution and remains valid, so `dlx` now falls back to the scopeless package name when the slot's manifest is unreadable — for single-bin packages (the dlx common case, including every `runtime:` spec) this matches what `manifest.bin` would have named. Multi-bin packages already require `--package=<spec> <bin>` to disambiguate and don't enter this code path. - Fixed non-determinism in `pnpm dedupe` and `pnpm install` when a dependency graph contains packages with transitive peer dependencies on each other (e.g. `@aws-sdk/client-sts` and `@aws-sdk/client-sso-oidc`) and `auto-install-peers` is enabled. The lockfile no longer flips between two equally-valid forms across consecutive runs. The root cause was that `resolveDependencies` pushed onto its `pkgAddresses` / `postponedResolutionsQueue` arrays from inside `Promise.all`-spawned callbacks, so completion-order timing leaked into the array order and downstream cyclic-peer suffix assignment. Fixes [#&#8203;8155](https://redirect.github.com/pnpm/pnpm/issues/8155). - Fixed a regression introduced by [#&#8203;11711](https://redirect.github.com/pnpm/pnpm/pull/11711) where `pnpm add <github-shorthand>` (and any other wanted-dependency whose alias can't be parsed from the user-supplied spec, e.g. tarball URLs or `pnpm/test-git-fetch#sha`) was silently dropped from the manifest update and from `pendingBuilds`. The alias-keyed lookup added in that PR couldn't find a `wantedDependency` whose `alias` was `undefined` at parse time but resolved to a package name only after fetching, so the entry never made it into `specsToUpsert`. Restored the original index-based pairing between `directDependencies` and `wantedDependencies`; the catalog-protocol preservation that PR was originally fixing is unaffected because it's driven by `rdd.catalogLookup.userSpecifiedBareSpecifier`, not by the lookup. Fixes the three `rebuilds dependencies` / `rebuilds specific dependencies` / `rebuild with pending option` failures in `building/commands/test/build/index.ts`. - Fixed `pnpm add --config` leaving orphan entries in `pnpm-lock.env.yaml` (the optional subdependencies of the previously resolved version of the updated config dependency). ### [`v11.2.2`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1122) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.2.1...v11.2.2) ##### Patch Changes - When the install engine is delegated to pacquet via `configDependencies`, the user's CLI flags passed to `pnpm install` (e.g. `--no-runtime`, `--prod`, `--dev`, `--no-optional`, `--node-linker`, `--cpu`/`--os`/`--libc`, `--offline`, `--prefer-offline`) are now forwarded to pacquet's `install` subcommand verbatim. Previously pacquet was invoked with a fixed argument list, so flags like `--no-runtime` were silently dropped. Flag forwarding is gated on the command being `install`/`i`; `add`, `update`, and `dedupe` still don't forward (their flag surface doesn't line up with pacquet's `install`). - Fixed `pnpm up` (and `pnpm add` / `pnpm remove`) failing with `pacquet_package_manager::outdated_lockfile` when pacquet is declared in `configDependencies`. pnpm now passes `--ignore-manifest-check` to pacquet so its `--frozen-lockfile` check doesn't fire against the (pre-mutation) `package.json` pnpm hasn't written yet [#&#8203;11797](https://redirect.github.com/pnpm/pnpm/issues/11797). Requires a pacquet release that supports the flag — bump `PACQUET_VERSION` in the e2e tests once it ships. </details> <details> <summary>silverwind/rolldown-license-plugin (rolldown-license-plugin)</summary> ### [`v3.0.8`](https://redirect.github.com/silverwind/rolldown-license-plugin/releases/tag/3.0.8) [Compare Source](https://redirect.github.com/silverwind/rolldown-license-plugin/compare/3.0.7...3.0.8) - update deps (silverwind) - swap path.join for template concat in I/O hot paths (silverwind) - simplify license sort and allow-branch control flow (silverwind) </details> <details> <summary>typescript-eslint/typescript-eslint (typescript-eslint)</summary> ### [`v8.60.0`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/typescript-eslint/CHANGELOG.md#8600-2026-05-25) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.59.4...v8.60.0) This was a version bump only for typescript-eslint to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.0) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>silverwind/updates (updates)</summary> ### [`v17.17.2`](https://redirect.github.com/silverwind/updates/releases/tag/17.17.2) [Compare Source](https://redirect.github.com/silverwind/updates/compare/17.17.1...17.17.2) - Read github env tokens lazily instead of at import (silverwind) ### [`v17.17.1`](https://redirect.github.com/silverwind/updates/releases/tag/17.17.1) [Compare Source](https://redirect.github.com/silverwind/updates/compare/17.17.0...17.17.1) - Scope GitHub token fallback to GitHub hosts only (silverwind) ### [`v17.17.0`](https://redirect.github.com/silverwind/updates/releases/tag/17.17.0) [Compare Source](https://redirect.github.com/silverwind/updates/compare/17.16.13...17.17.0) - update deps (silverwind) - Add per-package `overrides` config option ([#&#8203;140](https://redirect.github.com/silverwind/updates/issues/140)) (silverwind) - fix three bugs in range/tag handling (silverwind) </details> <details> <summary>vitejs/vite (vite)</summary> ### [`v8.0.14`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-8014-2026-05-21-small) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v8.0.13...v8.0.14) ##### Features - update rolldown to 1.0.2 ([#&#8203;22484](https://redirect.github.com/vitejs/vite/issues/22484)) ([96efc88](96efc88570)) ##### Bug Fixes - **deps:** update all non-major dependencies ([#&#8203;22471](https://redirect.github.com/vitejs/vite/issues/22471)) ([98b8163](98b8163213)) - **dev:** handle errors when sending messages to vite server ([#&#8203;22450](https://redirect.github.com/vitejs/vite/issues/22450)) ([e8e9a34](e8e9a34dcf)) - **html:** handle trailing slash paths in transformIndexHtml ([#&#8203;22480](https://redirect.github.com/vitejs/vite/issues/22480)) ([5d94d1b](5d94d1bffd)) - **optimizer:** pass oxc jsx options to transformSync in dependency scan ([#&#8203;22342](https://redirect.github.com/vitejs/vite/issues/22342)) ([b3132da](b3132dacea)) ##### Miscellaneous Chores - **deps:** update rolldown-related dependencies ([#&#8203;22470](https://redirect.github.com/vitejs/vite/issues/22470)) ([7cb728e](7cb728eb62)) - remove irrelevant commits from changelog ([2c69495](2c69495f25)) ##### Code Refactoring - **glob:** do not rewrite import path for absolute base ([#&#8203;22310](https://redirect.github.com/vitejs/vite/issues/22310)) ([0ae2844](0ae2844ab6)) ##### Tests - **css:** sass does not use main field ([#&#8203;22449](https://redirect.github.com/vitejs/vite/issues/22449)) ([ebf39a0](ebf39a0432)) </details> <details> <summary>vuejs/core (vue)</summary> ### [`v3.5.35`](https://redirect.github.com/vuejs/core/blob/HEAD/CHANGELOG.md#3535-2026-05-27) [Compare Source](https://redirect.github.com/vuejs/core/compare/v3.5.34...v3.5.35) ##### Bug Fixes - **compiler-core:** avoid double processing v-for keys with v-memo ([#&#8203;14861](https://redirect.github.com/vuejs/core/issues/14861)) ([34a0ded](34a0ded4d2)), closes [#&#8203;14859](https://redirect.github.com/vuejs/core/issues/14859) - **compiler-sfc:** resolve top-level exports from files registered as global types ([#&#8203;14805](https://redirect.github.com/vuejs/core/issues/14805)) ([3d077f2](3d077f26e3)), closes [nuxt/nuxt#33694](https://redirect.github.com/nuxt/nuxt/issues/33694) - **runtime-core:** avoid repeated hydration mismatch checks ([#&#8203;14857](https://redirect.github.com/vuejs/core/issues/14857)) ([170fc95](170fc95eb6)), closes [#&#8203;14855](https://redirect.github.com/vuejs/core/issues/14855) - **runtime-core:** skip idle persisted transition hooks in keep-alive moves ([#&#8203;14865](https://redirect.github.com/vuejs/core/issues/14865)) ([80fc139](80fc139f90)), closes [#&#8203;14031](https://redirect.github.com/vuejs/core/issues/14031) - **server-renderer:** propagate sync errors from `ssrRenderSuspense` ([#&#8203;14804](https://redirect.github.com/vuejs/core/issues/14804)) ([4760997](47609975e2)), closes [nuxt/nuxt#28162](https://redirect.github.com/nuxt/nuxt/issues/28162) - **teleport:** skip child unmount when pending mount discarded ([#&#8203;14876](https://redirect.github.com/vuejs/core/issues/14876)) ([#&#8203;14877](https://redirect.github.com/vuejs/core/issues/14877)) ([584beb1](584beb1262)) ##### Performance Improvements - **reactivity:** skip type checks for cached proxies ([#&#8203;14860](https://redirect.github.com/vuejs/core/issues/14860)) ([5734fe9](5734fe97f6)) - **runtime-dom:** optimize array event handler dispatch ([#&#8203;14828](https://redirect.github.com/vuejs/core/issues/14828)) ([bb18dc8](bb18dc8e56)) - **server-renderer:** avoid materializing iterables in ssrRenderList ([#&#8203;14821](https://redirect.github.com/vuejs/core/issues/14821)) ([1b7a2cc](1b7a2cc15c)) </details> <details> <summary>vuejs/language-tools (vue-tsc)</summary> ### [`v3.3.2`](https://redirect.github.com/vuejs/language-tools/blob/HEAD/CHANGELOG.md#332-2026-05-25) [Compare Source](https://redirect.github.com/vuejs/language-tools/compare/v3.3.1...v3.3.2) ##### language-core - **feat:** preserve literal types for inline `v-for` sources ([#&#8203;6067](https://redirect.github.com/vuejs/language-tools/issues/6067)) - Thanks to [@&#8203;kkesidis](https://redirect.github.com/kkesidis)! - **fix:** align `v-bind` shorthand identifier skipping with interpolation - Thanks to [@&#8203;KazariEX](https://redirect.github.com/KazariEX)! ##### vscode - **feat:** transform tsserver content ([#&#8203;6062](https://redirect.github.com/vuejs/language-tools/issues/6062)) - Thanks to [@&#8203;KazariEX](https://redirect.github.com/KazariEX)! - **fix:** do not mark trailing slash in capitalized self-closing tags as invalid ([#&#8203;6065](https://redirect.github.com/vuejs/language-tools/issues/6065)) - Thanks to [@&#8203;suisanka](https://redirect.github.com/suisanka)! </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: silverwind <me@silverwind.io>	2026-06-02 07:18:20 +02:00
silverwind	d0eba5e961	chore(deps): update urfave/cli/v3 to v3.9.0 (#37863) ... Updates `github.com/urfave/cli/v3` to [v3.9.0](https://github.com/urfave/cli/releases/tag/v3.9.0) and removes the renovate pin now that [urfave/cli#2319](https://github.com/urfave/cli/pull/2319) (the `-c` help flag parsing fix) is merged. v3.9.0 prepends the default command name to the root command's args, which broke the old `Root().Args()` check in `isValidDefaultSubCommand`. It now uses the command's own `Args()`. Behavior change: `./gitea web <extra-positional-arg>` now errors with `unknown command` instead of starting the web server and ignoring the trailing arg. `web` takes no positional args, so this is stricter (and arguably more correct) input handling. The intended `./gitea bad-cmd` rejection is unchanged. --- This PR was written with the help of Claude Opus 4.7 --------- Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Nicolas <bircni@icloud.com>	2026-05-30 20:56:16 +00:00
silverwind	f810e882a4	chore(deps): update chroma, regexp2 v2, replace dimiro1/reply (#37858) ... - Update `github.com/alecthomas/chroma/v2` to `v2.25.0`. - Migrate `github.com/dlclark/regexp2` to `/v2` (incorporates https://github.com/go-gitea/gitea/pull/37664); drop the renovate pin. - Replace the unmaintained `github.com/dimiro1/reply` (the last consumer of `regexp2` v1 in our own code) with a small built-in reply parser for incoming mail. Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io> Co-authored-by: Nicolas <bircni@icloud.com>	2026-05-27 23:39:57 +02:00
silverwind	570173b409	ci: add shellcheck linter (#37682) ... - Adds `make lint-shell`. uses local `shellcheck` if its version matches, otherwise runs the pinned image via docker or podman - `.shellcheckrc` disables the most annoying rules - Fixes findings across existing scripts Fixes: #37648 Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: TheFox0x7 <thefox0x7@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com>	2026-05-22 20:22:04 +00:00
silverwind	b742fa7d6b	chore(renovate): enable dockerfile manager (#37719) ... Enables Renovate's `dockerfile` manager so the base images in `Dockerfile` and `Dockerfile.rootless` (`docker.io/library/golang:1.26-alpine3.23`, `docker.io/library/alpine:3.23`) get tracked alongside the other dependencies. Updates are grouped under "docker dependencies" and follow the existing weekly schedule. --- This PR was written with the help of Claude Opus 4.7 Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Nicolas <bircni@icloud.com>	2026-05-16 06:40:05 +00:00
Giteabot	8cd8291ed0	fix(deps): update npm dependencies (#37647) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | @&#8203;codemirror/autocomplete | [`6.20.1` → `6.20.2`](https://renovatebot.com/diffs/npm/@codemirror%2fautocomplete/6.20.1/6.20.2) |  |  | | @&#8203;codemirror/lint | [`6.9.5` → `6.9.6`](https://renovatebot.com/diffs/npm/@codemirror%2flint/6.9.5/6.9.6) |  |  | | @&#8203;codemirror/view | [`6.41.1` → `6.42.0`](https://renovatebot.com/diffs/npm/@codemirror%2fview/6.41.1/6.42.0) |  |  | | [vue](https://vuejs.org/) ([source](https://redirect.github.com/vuejs/core)) | [`3.5.33` → `3.5.34`](https://renovatebot.com/diffs/npm/vue/3.5.33/3.5.34) |  |  | --- ### Release Notes <details> <summary>vuejs/core (vue)</summary> ### [`v3.5.34`](https://redirect.github.com/vuejs/core/blob/HEAD/CHANGELOG.md#3534-2026-05-06) [Compare Source](https://redirect.github.com/vuejs/core/compare/v3.5.33...v3.5.34) ##### Bug Fixes - **compiler-sfc:** infer Vue ref wrapper types when source is unresolvable ([#&#8203;14758](https://redirect.github.com/vuejs/core/issues/14758)) ([7f46fd4](7f46fd411b)), closes [#&#8203;14729](https://redirect.github.com/vuejs/core/issues/14729) - **compiler-sfc:** preserve hash hrefs on `<image>` elements ([#&#8203;14756](https://redirect.github.com/vuejs/core/issues/14756)) ([090b2e3](090b2e3a51)) - **compiler-sfc:** resolve type re-exports inside declare global ([#&#8203;14766](https://redirect.github.com/vuejs/core/issues/14766)) ([acfffe3](acfffe34e7)) - **reactivity:** prevent orphan effect when created in a stopped scope ([#&#8203;14778](https://redirect.github.com/vuejs/core/issues/14778)) ([c8e2d4a](c8e2d4adc9)), closes [#&#8203;14777](https://redirect.github.com/vuejs/core/issues/14777) - **runtime-core:** avoid symbol coercion during props validation ([#&#8203;8539](https://redirect.github.com/vuejs/core/issues/8539)) ([23d4fb5](23d4fb5a6a)), closes [#&#8203;8487](https://redirect.github.com/vuejs/core/issues/8487) - **suspense:** avoid DOM leak with out-in transition in v-if fragment ([#&#8203;14762](https://redirect.github.com/vuejs/core/issues/14762)) ([9667e0d](9667e0d498)), closes [#&#8203;14761](https://redirect.github.com/vuejs/core/issues/14761) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>	2026-05-11 16:03:11 +00:00
Giteabot	7621b65403	chore(deps): update action dependencies (major) (#37638) ... This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [bitnamilegacy/minio](https://redirect.github.com/bitnami/containers) ([source](https://redirect.github.com/bitnami/containers/tree/HEAD/bitnami/minio)) | service | major | `2021.12.29` → `2025.7.23` | | [bitnamilegacy/minio](https://redirect.github.com/bitnami/containers) ([source](https://redirect.github.com/bitnami/containers/tree/HEAD/bitnami/minio)) | service | major | `2023.12.23` → `2025.7.23` | | [bitnamilegacy/mysql](https://redirect.github.com/bitnami/containers) ([source](https://redirect.github.com/bitnami/containers/tree/HEAD/bitnami/mysql)) | service | major | `8.4` → `9.4` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>	2026-05-11 12:18:05 +00:00
Giteabot	510b729212	fix(deps): update go dependencies (major) (#37639) ... This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/dlclark/regexp2](https://redirect.github.com/dlclark/regexp2) | `v1.12.0` → `v2.0.1` |  |  | | [github.com/google/go-github/v84](https://redirect.github.com/google/go-github) | `v84.0.0` → `v85.0.0` |  |  | | [gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go) | `v1.46.0` → `v2.24.1` |  |  | --- ### Release Notes <details> <summary>dlclark/regexp2 (github.com/dlclark/regexp2)</summary> ### [`v2.0.1`](https://redirect.github.com/dlclark/regexp2/compare/v2.0.0...v2.0.1) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v2.0.0...v2.0.1) ### [`v2.0.0`](https://redirect.github.com/dlclark/regexp2/compare/v1.12.0...v2.0.0) [Compare Source](https://redirect.github.com/dlclark/regexp2/compare/v1.12.0...v2.0.0) </details> <details> <summary>google/go-github (github.com/google/go-github/v84)</summary> ### [`v85.0.0`](https://redirect.github.com/google/go-github/releases/tag/v85.0.0) [Compare Source](https://redirect.github.com/google/go-github/compare/v84.0.0...v85.0.0) This release contains the following breaking API changes: - fix!: Resolve inconsistent options for `create` and `update` on custom org role ([#&#8203;4075](https://redirect.github.com/google/go-github/issues/4075)) BREAKING CHANGE: `GetOrgRole`, `CreateCustomOrgRole`, and `UpdateCustomOrgRole` have new params and return values. - fix!: Change `id` from `int64` to `string` in `ActivityService.MarkThreadDone` ([#&#8203;4056](https://redirect.github.com/google/go-github/issues/4056)) BREAKING CHANGE: `ActivityService.MarkThreadDone` accepts `string` `id` instead of `int64`. ...and the following additional changes: - chore: Bump version of go-github to v85.0.0 ([#&#8203;4173](https://redirect.github.com/google/go-github/issues/4173)) - chore: Update `openapi_operations.yaml` ([#&#8203;4172](https://redirect.github.com/google/go-github/issues/4172)) - security: Reject cross-host redirects to prevent Authorization leak ([#&#8203;4171](https://redirect.github.com/google/go-github/issues/4171)) - chore: Improve GitHub Actions workflows lint and testing ([#&#8203;4169](https://redirect.github.com/google/go-github/issues/4169)) - chore: Switch legacy redirect handling to new pattern ([#&#8203;4161](https://redirect.github.com/google/go-github/issues/4161)) - feat: Add `CodeSecurity` to `SecurityAndAnalysis` ([#&#8203;4155](https://redirect.github.com/google/go-github/issues/4155)) - fix: Reject URL path segments containing ".." in all request methods ([#&#8203;4150](https://redirect.github.com/google/go-github/issues/4150)) - feat: Refactor repositories download contents ([#&#8203;4153](https://redirect.github.com/google/go-github/issues/4153)) - chore: Bump google.org/x/tools to v0.44.0 in /tools ([#&#8203;4168](https://redirect.github.com/google/go-github/issues/4168)) - docs: Fix broken blog post link ([#&#8203;4160](https://redirect.github.com/google/go-github/issues/4160)) - build(deps): Bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 in /example ([#&#8203;4156](https://redirect.github.com/google/go-github/issues/4156)) - chore: Update openapi\_operations.yaml ([#&#8203;4157](https://redirect.github.com/google/go-github/issues/4157)) - feat: Remove Google App Engine standard support ([#&#8203;4152](https://redirect.github.com/google/go-github/issues/4152)) - feat: Add `DownloadCopilotMetrics` helper method ([#&#8203;4149](https://redirect.github.com/google/go-github/issues/4149)) - docs: Add `apiVersion` to GitHub API link ([#&#8203;4147](https://redirect.github.com/google/go-github/issues/4147)) - chore: Simplify `redundantptr` custom linter ([#&#8203;4148](https://redirect.github.com/google/go-github/issues/4148)) - docs: Deprecate old Copilot metrics endpoints closed on April 2, 2026 ([#&#8203;4137](https://redirect.github.com/google/go-github/issues/4137)) - refactor: Remove redundant `github.Ptr` calls ([#&#8203;4145](https://redirect.github.com/google/go-github/issues/4145)) - fix: Add missing `User` fields ([#&#8203;4146](https://redirect.github.com/google/go-github/issues/4146)) - fix: Preserve `Marketplace.Stubbed` during client copy ([#&#8203;4144](https://redirect.github.com/google/go-github/issues/4144)) - refactor: Simplify array copying ([#&#8203;4143](https://redirect.github.com/google/go-github/issues/4143)) - build(deps): Bump golang.org/x/crypto from 0.49.0 to 0.50.0 in /example ([#&#8203;4141](https://redirect.github.com/google/go-github/issues/4141)) - build(deps): Bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 in /tools ([#&#8203;4142](https://redirect.github.com/google/go-github/issues/4142)) - build(deps): Bump golang.org/x/term from 0.41.0 to 0.42.0 in /example ([#&#8203;4140](https://redirect.github.com/google/go-github/issues/4140)) - build(deps): Bump golang.org/x/net from 0.52.0 to 0.53.0 in /scrape ([#&#8203;4139](https://redirect.github.com/google/go-github/issues/4139)) - build(deps): Bump go.opentelemetry.io/otel to v1.43.0 ([#&#8203;4135](https://redirect.github.com/google/go-github/issues/4135)) - fix: Expand `sanitizeURL` secrets redactions ([#&#8203;4126](https://redirect.github.com/google/go-github/issues/4126)) - build(deps): Bump github.com/alecthomas/kong from 1.14.0 to 1.15.0 in /tools ([#&#8203;4132](https://redirect.github.com/google/go-github/issues/4132)) - build(deps): Bump actions/setup-go from 6.3.0 to 6.4.0 in the actions group ([#&#8203;4131](https://redirect.github.com/google/go-github/issues/4131)) - feat: Add support for custom names and methods that return structs with multiple `[]*T` fields in `gen-iterators.go` ([#&#8203;4128](https://redirect.github.com/google/go-github/issues/4128)) - fix: Limit webhook payload size in `ValidatePayloadFromBody` ([#&#8203;4125](https://redirect.github.com/google/go-github/issues/4125)) - build(deps): Bump codecov/codecov-action from 5.5.3 to 6.0.0 ([#&#8203;4123](https://redirect.github.com/google/go-github/issues/4123)) - fix: Synchronize `requestCount` in rate limit tests ([#&#8203;4124](https://redirect.github.com/google/go-github/issues/4124)) - chore: Simplify `generate.sh` by removing `git worktree` and using generator-based check ([#&#8203;4120](https://redirect.github.com/google/go-github/issues/4120)) - docs: Improve comments in /examples ([#&#8203;4122](https://redirect.github.com/google/go-github/issues/4122)) - chore: Use `golangci-lint-action`; remove `newreposecretwithlibsodium` ([#&#8203;4119](https://redirect.github.com/google/go-github/issues/4119)) - feat: Add custom image endpoints for GitHub-hosted runners ([#&#8203;4101](https://redirect.github.com/google/go-github/issues/4101)) - chore: Cache custom golangci-lint binaries in GHA workflow ([#&#8203;4116](https://redirect.github.com/google/go-github/issues/4116)) - build(deps): Bump github.com/ProtonMail/go-crypto from 1.4.0 to 1.4.1 in /example ([#&#8203;4115](https://redirect.github.com/google/go-github/issues/4115)) - build(deps): Bump golang.org/x/tools from 0.29.0 to 0.43.0 in /tools/extraneous-new ([#&#8203;4114](https://redirect.github.com/google/go-github/issues/4114)) - build(deps): Bump codecov/codecov-action from 5.5.2 to 5.5.3 ([#&#8203;4112](https://redirect.github.com/google/go-github/issues/4112)) - build(deps): Bump github.com/golangci/plugin-module-register from 0.1.1 to 0.1.2 in /tools/extraneous-new ([#&#8203;4113](https://redirect.github.com/google/go-github/issues/4113)) - build(deps): Bump github.com/getkin/kin-openapi from 0.133.0 to 0.134.0 in /tools ([#&#8203;4111](https://redirect.github.com/google/go-github/issues/4111)) - build(deps): Bump github.com/PuerkitoBio/goquery from 1.11.0 to 1.12.0 in /scrape ([#&#8203;4110](https://redirect.github.com/google/go-github/issues/4110)) - chore: Upgrade deps for linters using dependabot ([#&#8203;4107](https://redirect.github.com/google/go-github/issues/4107)) - chore: Use `structfield.Settings` in `check-structfield-settings` ([#&#8203;4108](https://redirect.github.com/google/go-github/issues/4108)) - build(deps): Bump google.golang.org/grpc from 1.78.0 to 1.79.3 in /example ([#&#8203;4109](https://redirect.github.com/google/go-github/issues/4109)) - chore: Remove unnecessary use of `new` and `&SomeStruct{}` and add new `extraneousnew` custom linter ([#&#8203;4106](https://redirect.github.com/google/go-github/issues/4106)) - feat: Add `NetworkConfigurationID` and `HostedRunnersURL` to enterprise runner group types ([#&#8203;4099](https://redirect.github.com/google/go-github/issues/4099)) - feat: Generate accessors for all fields ([#&#8203;4105](https://redirect.github.com/google/go-github/issues/4105)) - feat: Add `ListRunnerGroupHostedRunners` for org runner groups ([#&#8203;4100](https://redirect.github.com/google/go-github/issues/4100)) - chore: Enable `default: none` linters; remove duplicated ([#&#8203;4097](https://redirect.github.com/google/go-github/issues/4097)) - fix: Use `Cursor` pagination for `*.ListHookDeliveriesIter` ([#&#8203;4096](https://redirect.github.com/google/go-github/issues/4096)) - chore: Remove duplicated formatters ([#&#8203;4094](https://redirect.github.com/google/go-github/issues/4094)) - chore: Fix typos in comments and tests ([#&#8203;4093](https://redirect.github.com/google/go-github/issues/4093)) - chore: Fix typo in CONTRIBUTING.md ([#&#8203;4092](https://redirect.github.com/google/go-github/issues/4092)) - chore: Update openapi\_operations.yaml ([#&#8203;4091](https://redirect.github.com/google/go-github/issues/4091)) - build(deps): Bump github.com/bradleyfalzon/ghinstallation/v2 from 2.17.0 to 2.18.0 in /example ([#&#8203;4084](https://redirect.github.com/google/go-github/issues/4084)) - chore: Bump go.opentelemetry.io/otel to v1.42.0 ([#&#8203;4090](https://redirect.github.com/google/go-github/issues/4090)) - build(deps): Bump golang.org/x/crypto from 0.48.0 to 0.49.0 in /example ([#&#8203;4081](https://redirect.github.com/google/go-github/issues/4081)) - build(deps): Bump golang.org/x/sync from 0.19.0 to 0.20.0 in /tools ([#&#8203;4078](https://redirect.github.com/google/go-github/issues/4078)) - build(deps): Bump golang.org/x/net from 0.51.0 to 0.52.0 in /scrape ([#&#8203;4079](https://redirect.github.com/google/go-github/issues/4079)) - test: Add fuzz test for `ParseWebHook` ([#&#8203;4076](https://redirect.github.com/google/go-github/issues/4076)) - feat: Add enterprise budgets API ([#&#8203;4069](https://redirect.github.com/google/go-github/issues/4069)) - feat: Add list organization fine-grained permissions ([#&#8203;4072](https://redirect.github.com/google/go-github/issues/4072)) - feat: Make `script/lint.sh` output simpler to read ([#&#8203;4073](https://redirect.github.com/google/go-github/issues/4073)) - chore: Speed up linting ([#&#8203;4071](https://redirect.github.com/google/go-github/issues/4071)) - build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.41.0 in /otel ([#&#8203;4065](https://redirect.github.com/google/go-github/issues/4065)) - build(deps): Bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 in /otel ([#&#8203;4068](https://redirect.github.com/google/go-github/issues/4068)) - build(deps): Bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.40.0 to 1.41.0 in /example ([#&#8203;4062](https://redirect.github.com/google/go-github/issues/4062)) - build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.41.0 in /example ([#&#8203;4064](https://redirect.github.com/google/go-github/issues/4064)) - build(deps): Bump github.com/ProtonMail/go-crypto from 1.3.0 to 1.4.0 in /example ([#&#8203;4063](https://redirect.github.com/google/go-github/issues/4063)) - feat: Add `client_id` field to `App` ([#&#8203;4060](https://redirect.github.com/google/go-github/issues/4060)) - test: Simplify `CopilotService` tests ([#&#8203;4058](https://redirect.github.com/google/go-github/issues/4058)) - test: Fix flaky `TestDo_rateLimit_abuseRateLimitError_xRateLimitReset` ([#&#8203;4057](https://redirect.github.com/google/go-github/issues/4057)) - feat: Add support for enterprise audit log streaming API ([#&#8203;4035](https://redirect.github.com/google/go-github/issues/4035)) - feat: Add repository-level immutable releases settings ([#&#8203;4039](https://redirect.github.com/google/go-github/issues/4039)) - chore: Add `SAS` as a common initialism to `structfield` ([#&#8203;4054](https://redirect.github.com/google/go-github/issues/4054)) - fix: Fix data race on Windows ([#&#8203;4051](https://redirect.github.com/google/go-github/issues/4051)) - docs: Fix grammar in `README.md` ([#&#8203;4053](https://redirect.github.com/google/go-github/issues/4053)) - chore: Simplify form value assertions in tests ([#&#8203;4048](https://redirect.github.com/google/go-github/issues/4048)) - chore: Bump go-github from v83 to v84 in /scrape ([#&#8203;4050](https://redirect.github.com/google/go-github/issues/4050)) </details> <details> <summary>gitlab-org/api/client-go (gitlab.com/gitlab-org/api/client-go)</summary> ### [`v2.24.1`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.24.1) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.24.0...v2.24.1) #### 2.24.1 ##### 🐛 Bug Fixes - fix: add FormattedText field to OrbitGraphStatus and OrbitStatus ([!2876](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2876)) by [Dmitry Gruzd](https://gitlab.com/dgruzd) #### [2.24.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.24.0...v2.24.1) (2026-05-05) ##### Bug Fixes * add FormattedText field to OrbitGraphStatus and OrbitStatus ([9457ddc](9457ddc690)) ### [`v2.24.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.24.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.23.0...v2.24.0) #### 2.24.0 ##### 🚀 Features - feat: Add search_type as attribute to search endpoints ([!2851](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2851)) by [Heidi Berry](https://gitlab.com/heidi.berry) ### [2.24.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.23.0...v2.24.0) (2026-05-04) ##### Features * Add search_type as attribute to search endpoints ([4d345e9](4d345e9f76)) ### [`v2.23.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.23.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.22.0...v2.23.0) #### 2.23.0 ##### 🚀 Features - feat: add OrbitService for Knowledge Graph endpoints ([!2870](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2870)) by [Dmitry Gruzd](https://gitlab.com/dgruzd) ##### 🔄 Other Changes - chore(deps): update module buf.build/go/protovalidate to v1.2.0 ([!2865](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2865)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.23.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.22.0...v2.23.0) (2026-05-04) ##### Features * add OrbitService for Knowledge Graph endpoints ([2ff460f](2ff460f3a8)) ### [`v2.22.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.22.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.21.0...v2.22.0) #### 2.22.0 ##### 🚀 Features - Add package pipeline data. ([!2834](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2834)) by [Jimmy Spagnola](https://gitlab.com/jspagnola) ##### 🔄 Other Changes - chore(deps): update module golang.org/x/text to v0.36.0 ([!2874](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2874)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update golang docker tag ([!2873](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2873)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update docker docker tag to v29.4.1 ([!2869](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2869)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - refactor(no-release): use HTTP status code constants ([!2868](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2868)) by [Oleksandr Redko](https://gitlab.com/alexandear) ### [2.22.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.21.0...v2.22.0) (2026-05-04) ### [`v2.21.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.21.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.1...v2.21.0) #### 2.21.0 ##### 🚀 Features - Add BulkImports API functions and tests ([!2846](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2846)) by [Kalyaan Kanugula](https://gitlab.com/kalyaan09) ##### 🔄 Other Changes - Add missing `URLVariables` attribute to group_hooks ([!2866](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2866)) by [Mark Nessen](https://gitlab.com/mness) - docs: fix incorrect phrase 'to that' -> 'so' ([!2861](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2861)) by [Bob Singh](https://gitlab.com/bobsingh.dev) - docs: fix missing 'of' in contributing guide ([!2860](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2860)) by [Bob Singh](https://gitlab.com/bobsingh.dev) - style: remove duplicated wording in Go version sentence ([!2859](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2859)) by [Bob Singh](https://gitlab.com/bobsingh.dev) ### [2.21.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.1...v2.21.0) (2026-04-27) ### [`v2.20.1`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#2210-2026-04-27) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.0...v2.20.1) #### 2.20.1 ##### 🐛 Bug Fixes - Fix potential panic in MergeRequest.UnmarshalJSON label detail loop ([!2858](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2858)) by [Zubeen](https://gitlab.com/syedzubeen) #### [2.20.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.0...v2.20.1) (2026-04-20) #### 2.20.0 ##### 🚀 Features - Add missing system hook api options ([!2847](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2847)) by [Zack Knight](https://gitlab.com/zachkknowbe4) ##### 🔄 Other Changes - chore(deps): update docker docker tag to v29.4.0 ([!2854](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2854)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update module github.com/google/cel-go to v0.28.0 ([!2855](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2855)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [`v2.20.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#2210-2026-04-27) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.19.0...v2.20.0) #### 2.20.1 ##### 🐛 Bug Fixes - Fix potential panic in MergeRequest.UnmarshalJSON label detail loop ([!2858](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2858)) by [Zubeen](https://gitlab.com/syedzubeen) #### [2.20.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.0...v2.20.1) (2026-04-20) #### 2.20.0 ##### 🚀 Features - Add missing system hook api options ([!2847](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2847)) by [Zack Knight](https://gitlab.com/zachkknowbe4) ##### 🔄 Other Changes - chore(deps): update docker docker tag to v29.4.0 ([!2854](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2854)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update module github.com/google/cel-go to v0.28.0 ([!2855](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2855)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [`v2.19.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.19.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.18.0...v2.19.0) #### 2.19.0 ##### 🚀 Features - feat: Add PackageRegistryAccessLevel to Project structs ([!2852](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2852)) by [Caleb Madara](https://gitlab.com/calebmadara58) ### [2.19.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.18.0...v2.19.0) (2026-04-15) ##### Features * Add PackageRegistryAccessLevel to Project structs ([4ce63da](4ce63da952)) ### [`v2.18.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.18.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.17.0...v2.18.0) #### 2.18.0 ##### 🚀 Features - Feat: Add support for application setting secret_push_protection_available ([!2849](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2849)) by [Rizart Dona](https://gitlab.com/rizart_d) ##### 🔄 Other Changes - fix: Correct Example Section in README ([!2850](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2850)) by [Jonathan Bowe](https://gitlab.com/boweflex) ### [2.18.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.17.0...v2.18.0) (2026-04-14) ##### Bug Fixes * Correct Example Section in README ([c0759d9](c0759d99b2)) ### [`v2.17.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.17.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.16.0...v2.17.0) #### 2.17.0 ##### 🚀 Features - Resolve "Add endpoint support for archiving/unarchiving groups" ([!2848](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2848)) by [Jonathan Bowe](https://gitlab.com/boweflex) ##### 🔄 Other Changes - chore(deps): update docker docker tag to v29.3.1 ([!2841](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2841)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(no-release): enable gocritic linter ([!2842](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2842)) by [Oleksandr Redko](https://gitlab.com/alexandear) - chore(deps): update module golang.org/x/oauth2 to v0.36.0 ([!2835](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2835)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update module golang.org/x/text to v0.35.0 ([!2837](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2837)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.17.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.16.0...v2.17.0) (2026-04-10) ### [`v2.16.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.16.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.15.0...v2.16.0) #### 2.16.0 ##### 🚀 Features - feat: Add PagesUniqueDomainDefaultEnabled to Settings API ([!2845](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2845)) by [Mohamed Mongy](https://gitlab.com/mohamedmongy96) ### [2.16.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.15.0...v2.16.0) (2026-04-04) ##### Features * Add PagesUniqueDomainDefaultEnabled to Settings API ([d27f3af](d27f3af69a)) ### [`v2.15.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.15.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.14.0...v2.15.0) #### 2.15.0 ##### 🚀 Features - feat: Add approved_at field in merge request approvals API ([!2844](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2844)) by [Mohamed Asan N](https://gitlab.com/hassyyy) ### [2.15.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.14.0...v2.15.0) (2026-04-04) ##### Features * Add approved_at field in merge request approvals API ([528ac9e](528ac9ea36)) ### [`v2.14.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.14.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.13.0...v2.14.0) #### 2.14.0 ##### 🚀 Features - feat: add support for DisablePasswordAuthenticationForUsersWithSSOIdentities... ([!2839](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2839)) by [Lorenz Vonlanthen](https://gitlab.com/loelu) ### [2.14.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.13.0...v2.14.0) (2026-04-03) ##### Features * add support for DisablePasswordAuthenticationForUsersWithSSOIdentities... ([6b88f05](6b88f05609)) ### [`v2.13.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.13.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.12.0...v2.13.0) #### 2.13.0 ##### 🚀 Features - feat: Added WithAuthSourceStrategy option to allow configuring multiple token source priority ([!2815](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2815)) by [Павлов Александр](https://gitlab.com/alexpts) ### [2.13.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.12.0...v2.13.0) (2026-04-01) ##### Features * Added WithAuthSourceStrategy option to allow configuring multiple token source priority ([2261c80](2261c80c28)) ### [`v2.12.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.12.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.11.0...v2.12.0) #### 2.12.0 ##### 🚀 Features - fix: update HostKey field name to FingerprintSHA256 for consistency ([!2840](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2840)) by [Oleksandr Redko](https://gitlab.com/alexandear) - Add push mirror host_keys to the go client. ([!2832](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2832)) by [Jimmy Spagnola](https://gitlab.com/jspagnola) ##### 🔄 Other Changes - Fix: improve URL validation warning logging context and correct typo ([!2830](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2830)) by [Bob Singh](https://gitlab.com/bobsingh.dev) - chore(no-release): fix typos in comments and unexported function ([!2831](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2831)) by [Oleksandr Redko](https://gitlab.com/alexandear) ### [2.12.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.11.0...v2.12.0) (2026-04-01) ##### Bug Fixes * update HostKey field name to FingerprintSHA256 for consistency ([1b7fcfb](1b7fcfb0ed)) ### [`v2.11.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.11.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.10.0...v2.11.0) #### 2.11.0 ##### 🚀 Features - Deprecate project approval password auth, add reauth to approve ([!2825](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2825)) by [Heidi Berry](https://gitlab.com/heidi.berry) ##### 🔄 Other Changes - Fix typo in UpdateLabel comment ([!2827](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2827)) by [Bob Singh](https://gitlab.com/bobsingh.dev) - Fix runner comment typo ([!2828](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2828)) by [Bob Singh](https://gitlab.com/bobsingh.dev) ### [2.11.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.10.0...v2.11.0) (2026-03-30) ### [`v2.10.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#1380-2026-02-19) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.9.0...v2.10.0) ##### Features - **events:** Add missing parameters for label operations and update documentation links ([11b9f08](11b9f08b37)) - **labels:** add missing params and edit links ([ec1b92b](ec1b92bff4)) #### 1.37.0 ##### 🚀 Features - Support system & system\_action fields for merge event attributes ([!2737](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2737)) by [Artem Mikheev](https://gitlab.com/renbou) ##### 🔄 Other Changes - Update links of geo\_sites.go ([!2782](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2782)) by [Mohamed Mongy](https://gitlab.com/mohamedmongy96) - chore(deps): update dependency golangci-lint to v2.10.1 ([!2770](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2770)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update golangci/golangci-lint docker tag to v2.10.1 ([!2771](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2771)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update golangci/golangci-lint docker tag to v2.10.0 ([!2769](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2769)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update dependency golangci-lint to v2.10.0 ([!2768](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2768)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [`v2.9.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#1330-2026-02-13) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.8.0...v2.9.0) #### 1.32.0 ##### 🚀 Features - Implement endpoints for runner controller scopes ([!2758](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2758)) by [Timo Furrer](https://gitlab.com/timofurrer) ##### 🔄 Other Changes - test(namespaces): Address test feedback to simplify the test ([!2744](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2744)) by [Patrick Rice](https://gitlab.com/PatrickRice) - chore(deps): update golangci/golangci-lint docker tag to v2.9.0 ([!2755](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2755)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update dependency golangci-lint to v2.9.0 ([!2754](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2754)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [`v2.8.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#1130-2026-01-12) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.7.0...v2.8.0) ##### Features - **groups:** add Active parameter to ListGroupProjects ([dec511a](dec511a199)) #### 1.12.0 ##### 🚀 Features - feat: add EmojiEvents field support to Project Webhooks ([!2653](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2653)) by [Yugan](https://gitlab.com/yugannkt) ##### 🔄 Other Changes - chore(deps): update dependency golangci-lint to v2.8.0 ([!2650](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2650)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - refactor(no-release): use errors.New instead of fmt.Errorf ([!2644](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2644)) by [Oleksandr Redko](https://gitlab.com/alexandear) ### [`v2.7.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#170-2025-12-06) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.6.0...v2.7.0) ##### Features - **users:** Add support for a user to see only one file diff per page ([e2a9e09](e2a9e09e79)) #### 1.6.0 ##### 🚀 Features - feat: add admin compliance policy settings API ([!2610](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2610)) by [Hannes Lange](https://gitlab.com/hlange4) ##### 🔄 Other Changes - doc: fix typo ([!2603](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2603)) by [Guilhem Bonnefille](https://gitlab.com/gbonnefille) - chore(deps): update golangci/golangci-lint docker tag to v2.7.1 ([!2611](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2611)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update docker docker tag to v29.1.2 ([!2609](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2609)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(deps): update golangci/golangci-lint docker tag to v2.7.0 ([!2608](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2608)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [`v2.6.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#01590-2025-11-04) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.5.0...v2.6.0) ##### Features - **integrations:** add group integration API endpoints for Jira ([09e18ee](09e18ee598)) #### 0.158.0 ##### 🚀 Features - Add support to send variables for GraphQL queries ([!2562](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2562)) by [rafasf](https://gitlab.com/rafasf) ##### 🔄 Other Changes - chore(deps): update module cel.dev/expr to v0.25.0 ([!2560](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2560)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - chore(no-release): standardize GitLab name capitalization ([!2551](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2551)) by [Zubeen](https://gitlab.com/syedzubeen) - chore(deps): update golangci/golangci-lint docker tag to v2.6.0 ([!2558](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2558)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - refactor: moved comments to interface 2 ([!2557](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2557)) by [Zubeen](https://gitlab.com/syedzubeen) - refactor: moved comments to interface ([!2556](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2556)) by [Zubeen](https://gitlab.com/syedzubeen) - refactor(test): avoid panic in tests with goroutines ([!2553](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2553)) by [Oleksandr Redko](https://gitlab.com/alexandear) ### [`v2.5.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.5.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.4.0...v2.5.0) #### 2.5.0 ##### 🚀 Features - feat(workitems): Implement `UpdateWorkItem()` ([!2793](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2793)) by [Carlos Corona](https://gitlab.com/ccorona2) ##### 🔄 Other Changes - chore(deps): update dependency golangci-lint to v2.11.2 ([!2810](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2810)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - test(no-release): replace reflect.DeepEqual with testify ([!2809](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2809)) by [Oleksandr Redko](https://gitlab.com/alexandear) - feat: allow OAuth success callback page to self-close when possible ([!2808](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2808)) by [Case Taintor](https://gitlab.com/case.taintor) - chore(deps): update dependency golangci-lint to v2.11.1 ([!2806](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2806)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.5.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.4.0...v2.5.0) (2026-03-09) ##### Features * allow OAuth success callback page to self-close when possible ([dca2e12](dca2e12095)) * **workitems:** Implement `UpdateWorkItem()` ([b93a55e](b93a55e316)) ### [`v2.4.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.4.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.3.0...v2.4.0) #### 2.4.0 ##### 🚀 Features - Reflect latest runner controller API changes ([!2803](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2803)) by [Timo Furrer](https://gitlab.com/timofurrer) ##### 🔄 Other Changes - chore(deps): update docker docker tag to v29.3.0 ([!2804](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2804)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.4.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.3.0...v2.4.0) (2026-03-06) ### [`v2.3.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.3.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.1...v2.3.0) #### 2.3.0 ##### 🚀 Features - feat: add new endpoint for fetching all the runner manager information ([!2802](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2802)) by [Aayush](https://gitlab.com/Aayush-Saini) ### [2.3.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.1...v2.3.0) (2026-03-05) ##### Features * add new endpoint for fetching all the runner manager information ([d4755b7](d4755b7966)) ### [`v2.2.1`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#230-2026-03-05) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.0...v2.2.1) ##### Features - add new endpoint for fetching all the runner manager information ([d4755b7](d4755b7966)) #### 2.2.1 ##### 🐛 Bug Fixes - fix: Add `/v2` suffix to module path. ([!2801](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2801)) by [Florian Forster](https://gitlab.com/fforster) #### [2.2.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.0...v2.2.1) (2026-03-04) ##### Bug Fixes - Add `/v2` suffix to module path. ([4237f6a](4237f6aa29)), closes [#&#8203;2239](https://gitlab.com/gitlab-org/api/client-go/issues/2239) #### 2.2.0 ##### 🚀 Features - feat(workitems): Implement `CreateWorkItem()`. ([!2751](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2751)) by [Florian Forster](https://gitlab.com/fforster) ### [`v2.2.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#230-2026-03-05) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.1.0...v2.2.0) ##### Features - add new endpoint for fetching all the runner manager information ([d4755b7](d4755b7966)) #### 2.2.1 ##### 🐛 Bug Fixes - fix: Add `/v2` suffix to module path. ([!2801](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2801)) by [Florian Forster](https://gitlab.com/fforster) #### [2.2.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.0...v2.2.1) (2026-03-04) ##### Bug Fixes - Add `/v2` suffix to module path. ([4237f6a](4237f6aa29)), closes [#&#8203;2239](https://gitlab.com/gitlab-org/api/client-go/issues/2239) #### 2.2.0 ##### 🚀 Features - feat(workitems): Implement `CreateWorkItem()`. ([!2751](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2751)) by [Florian Forster](https://gitlab.com/fforster) ### [`v2.1.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.1.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.0.0...v2.1.0) #### 2.1.0 ##### 🚀 Features - feat(workitems): Add more fields to WorkItem ([!2795](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2795)) by [Florian Forster](https://gitlab.com/fforster) ##### 🔄 Other Changes - Implement body preserver to enable HTTP response body streaming ([!2746](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2746)) by [Timo Furrer](https://gitlab.com/timofurrer) ### [2.1.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.0.0...v2.1.0) (2026-03-03) ##### Features * **workitems:** Add more fields to WorkItem ([7088f6f](7088f6f229)) ### [`v2.0.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.0.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v1.46.0...v2.0.0) #### 2.0.0 ##### 💥 Breaking Changes - Release client-go 2.0 ([!2763](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2763)) by [Patrick Rice](https://gitlab.com/PatrickRice) ##### 🔄 Other Changes - Addtl 2 0 changes ([!2796](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2796)) by [Patrick Rice](https://gitlab.com/PatrickRice) ### [2.0.0](https://gitlab.com/gitlab-org/api/client-go/compare/v1.46.0...v2.0.0) (2026-03-02) * Release client-go 2.0 ([47b65ee](47b65ee907)) ##### Bug Fixes * **ci:** update gocover-cobertura to v1.4.0 for Go 1.24+ compatibility ([1d03b20](1d03b20802)) * **group_members:** using ISOTime instead of time.Time for BillableUserMembership.ExpiresAt ([e7e58c6](e7e58c69c1)) * package protection access level variable type ([5574bbb](5574bbbf2f)) * **workitems:** Handle absent status widget in `WorkItem`. ([859fb26](859fb26f28)) ##### Features * use Nullable[int64] for label priority ([096ed09](096ed098d1)) ##### BREAKING CHANGES * Release 2.0 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>	2026-05-11 07:00:29 +00:00
silverwind	b29af98a36	ci(renovate): update Go import paths on major bumps (#37641) ... Enable `gomodUpdateImportPaths` so Renovate rewrites import paths (e.g. `foo/v2` → `foo/v3`) across the repo when bumping Go modules across major versions. --- This PR was written with the help of Claude Opus 4.7 Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Nicolas <bircni@icloud.com>	2026-05-11 06:35:48 +00:00
silverwind	b4085c7e3c	build: update pnpm to v11 (#37591) ... Update to https://github.com/pnpm/pnpm/releases/tag/v11.0.0 - move all pnpm settings to `pnpm-workspace.yaml`, pnpm v11 only reads that file - drop redundant or no-op settings - disable `strictDepBuilds` to avoid having to manually specify deps with build scripts, this is equivalent to v10 where it will not execute and warn. - add workarounds for https://github.com/SukkaW/nolyfill/issues/119 - remove dead eslintrc entry --- This PR was written with the help of Claude Opus 4.7 --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-05-08 04:17:20 +00:00
silverwind	bba748e8b5	chore(renovate): detect Makefile tools, enable go bumps (#37595) ... - fix detection of Makefile tools and group them separately - Enable `go.mod` `go` directive bumps, schedule it at any time and exempt it from the release-age delay Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>	2026-05-08 03:44:10 +00:00
silverwind	762154cbd7	fix: Fix nolyfill for renovate (#37537) ... Run `nolyfill` as a renovate post-upgrade step alongside `make svg`, so npm dep bumps keep `pnpm.overrides` in sync. --- This PR was written with the help of Claude Opus 4.7 --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>	2026-05-04 21:39:20 +00:00
silverwind	99cd4f6b22	Integrate renovate bot for all dependency updates (#37050) ... Replaces Dependabot with Renovate. The new setup: - One PR per ecosystem (GitHub Actions, Go modules + Makefile go-tool pins, npm, Python via uv, Nix flake), opened weekly on Mondays with a 5-day release-age cooldown. Vulnerability PRs ship next-day via daily cron + Renovate's `vulnerabilityAlerts` schedule bypass. - All `uses:` action refs SHA-pinned with patch-level version comments (same format as #36971, which this supersedes); `helpers:pinGitHubActionDigests` keeps future bumps in that format. - `renovatebot/github-action` runtime image pinned via the upstream-recommended `RENOVATE_VERSION` env + magic comment + `customManagers:githubActionsVersions` preset, so Renovate keeps the pin updated. - Custom regex manager tracks the `*_PACKAGE ?= <import-path>@<version>` lines in `Makefile` (golangci-lint, swagger, actionlint, etc.) and groups them into the same Go PR via `matchDatasources: ["go"]`. - Post-upgrade tasks regenerate `assets/go-licenses.json` (`make tidy`) and the SVG sprite (`make svg`), gated by an env-level command allowlist. - Replaces the standalone `cron-flake-updater` workflow — Renovate's nix manager tracks `flake.nix` inputs and produces the same `flake.lock` bump PRs on the regular weekly schedule. - npm and gomod-replace pins live in `renovate.json5` only; `updates@17.16.3` reads them from there too, so the standalone `updates.config.ts` is gone and one source of truth covers both tools. Fixes: https://github.com/go-gitea/gitea/issues/33386 Signed-off-by: silverwind <me@silverwind.io> Signed-off-by: TheFox0x7 <thefox0x7@gmail.com> Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com> Co-authored-by: TheFox0x7 <thefox0x7@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> Co-authored-by: Giteabot <teabot@gitea.io>	2026-04-26 14:25:22 +00:00