Giteabot
e355c39e91
chore(deps): update dependency go to v1.26.7 ( #38987 )
2026-08-19 16:32:52 +00:00
wxiaoguang
f261adb53f
chore: form binding trim space ( #38978 )
...
Use "binding:TrimSpace" instead of fragile IsEmptyString
And fix a bug in locale's `HasKey`: it should also try the default
language if current language doesn't have the translation key, a new
test is added.
2026-08-19 12:50:06 +00:00
wxiaoguang
6904f6480c
refactor: http request binding ( #38971 )
...
Better than before, still not good enough (more work can be done in the
future)
And add the missing error handling in the PrivateContext "bind"
middleware.
By the way, picked some "TrimSpace" changes from "fix: trim whitespace
from SMTP address and port - #38934 " (fix #38926 )
2026-08-19 14:15:42 +08:00
Giteabot
e223c42ee6
fix(deps): update module golang.org/x/mod to v0.40.0 [security] ( #38914 )
2026-08-17 19:29:07 +00:00
Giteabot
596b7f7a25
chore(deps): update dependencies ( #38947 )
2026-08-17 15:10:17 +02:00
Giteabot
133a3b8567
fix(deps): update module golang.org/x/image to v0.45.0 [security] ( #38930 )
...
Co-authored-by: bircni <bircni@icloud.com >
2026-08-15 15:43:20 +02:00
Giteabot
5b7b00477a
chore(deps): update dependency go to v1.26.6 ( #38912 )
2026-08-14 10:28:00 -07:00
silverwind
e3ee28f15b
fix(avatar): use sha256 and inline the federated avatar lookup ( #38843 )
...
- Hash emails with sha256. Gravatar moved to sha256, and both it and
libravatar.org serve the same image for either hash.
- Drop `strk.kbt.io/projects/go/libravatar` for a 46 line inline SRV
lookup. It could not bound or cancel its DNS query and panicked on an
unexpected resolver error. The replacement carries the request context
and a 3s timeout.
- Fix federated avatars querying DNS for every avatar on every render.
`loadAvatarSetting` compared a cache field that was never assigned, so
each call rebuilt the resolver and dropped its cache. That cache is
gone, both settings are read where they are used.
- Migration 348 recreates `email_hash` with a 64 char hash column and a
`hash_type` column, so a later algorithm change can tell old rows apart.
The MD5 rows are unreachable and their `UNIQUE` email index would reject
the SHA256 replacements.
- Fix a re-saved avatar form replacing an uploaded avatar with a random
one.
- Remove the `duoshuo` `GRAVATAR_SOURCE` alias, that service shut down
in 2017.
- Remove dead i18n key.
Fixes: https://github.com/go-gitea/gitea/issues/34284
Fixes: https://github.com/go-gitea/gitea/issues/28110
Docs: https://gitea.com/gitea/docs/pulls/499
Signed-off-by: silverwind <me@silverwind.io >
2026-08-10 23:13:28 +00:00
Giteabot
a8fe401613
chore(deps): update dependencies ( #38851 )
2026-08-10 15:50:32 +02:00
silverwind
ecbef41c06
refactor: replace gliderlabs/ssh with golang.org/x/crypto/ssh ( #38837 )
...
Migrate away from this thin ssh wrapper module while adding more test
coverage.
Removes `sessionPartial`, which hand-copied the layout of a private
`gliderlabs/ssh` struct and reinterpreted a pointer to it via
`reflect.UnsafePointer` to reach the permissions of the authenticated
connection. The layout is unchecked, so an upstream field reorder would
mismatch silently.
The builtin server only needs the session channel with `exec` and
`shell`. Serving those on `x/crypto` drops the hack and the dependency,
since `PublicKeyCallback` returns permissions per key and `x/crypto`
assigns them only after verifying the signature.
Two benign behavior changes:
1. Internal session handler errors report exit status 1 rather than 0,
so a client no longer reads a failure as success.
1. An unusable host key is fatal at startup instead of being replaced by
an ephemeral one that would trigger an error at the client.
2026-08-09 11:32:50 +00:00
Lunny Xiao
2087d4a1a5
refactor: use the shared workflow model from actionslib ( #38768 )
...
Pairs with https://gitea.com/gitea/runner/pulls/1143 .
Gitea depends on `gitea.com/gitea/runner` for exactly two packages:
`act/model` and `act/exprparser`, the workflow model and the expression
evaluator it needs to parse workflows and to build the task payload the
runner consumes. Pulling the whole runner module in for that is heavy
and puts shared code in the repository of one of the two consumers.
Both packages now live in `gitea.dev/actionslib` (`pkg/model`,
`pkg/exprparser`), the module Gitea and the runner already share for the
runner API, so the dependency on the runner repository is dropped here.
### Changes
- `gitea.com/gitea/runner/act/model` ->
`gitea.dev/actionslib/pkg/model`, `.../act/exprparser` ->
`gitea.dev/actionslib/pkg/exprparser` (22 files, import paths only).
- `routers/api/actions/runner/interceptor.go` takes the `x-runner-uuid`
/ `x-runner-token` names from `gitea.dev/actionslib/pkg/protocol`
instead of repeating the literals the runner also has.
- `go.mod`: `gitea.com/gitea/runner` removed.
---------
Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com >
Co-authored-by: silverwind <me@silverwind.io >
Co-authored-by: Zettat123 <zettat123@gmail.com >
2026-08-07 20:56:40 -07:00
silverwind
42e0c9eca4
enhance(tls): use go's tls defaults ( #38687 )
...
The hardcoded cipher suites and curve preferences date from 2021 and no
longer match what Go ships. All four `SSL_*` are now unset by default
which means "use Go's default".
1. TLS 1.3 is now the default instead of TLS 1.2.
2. Post-quantum key exchange (`X25519MLKEM768`) works.
3. Four `ECDHE-*-CBC-SHA` suites become negotiable on TLS 1.2.
2026-08-05 21:34:46 +00:00
Giteabot
a954257fb1
chore(deps): update dependencies ( #38757 )
...
Co-authored-by: silverwind <me@silverwind.io >
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
2026-08-03 21:37:12 +08:00
Pascal Zimmermann
5672b1c4cf
feat: Add support for dynamic matrix evaluation in Gitea Actions workflows ( #36564 )
...
Adds dynamic matrix evaluation to Gitea Actions: a job's
`strategy.matrix` can be built from the outputs of the jobs it needs.
```yaml
jobs:
generate:
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set.outputs.result }}
steps:
- id: set
run: echo "result=[1,2,3]" >> $GITHUB_OUTPUT
build:
needs: [generate]
runs-on: ubuntu-latest
strategy:
matrix:
version: ${{ fromJson(needs.generate.outputs.matrix) }}
steps:
- run: echo "building ${{ matrix.version }}"
```
Such a matrix cannot be expanded at planning time, so the job is planned
as a single placeholder and expanded by the job emitter once its needs
finish. Each combination is then gated by `if:` and concurrency as
usual.
- A matrix that resolves to no combination fails the job, as on GitHub.
- Expansion is capped at `MaxJobNumPerRun`.
- Workflows without a needs-dependent matrix are unaffected.
Fixes https://github.com/go-gitea/gitea/issues/25179
---------
Signed-off-by: Pascal Zimmermann <pascal.zimmermann@theiotstudio.com >
Signed-off-by: ZPascal <pascal.zimmermann@theiotstudio.com >
Co-authored-by: Claude <claude-sonnet-4-5@anthropic.com >
Co-authored-by: silverwind <me@silverwind.io >
Co-authored-by: Claude (Opus 4.8) <noreply@anthropic.com >
Co-authored-by: bircni <bircni@icloud.com >
Co-authored-by: Zettat123 <zettat123@gmail.com >
2026-07-28 15:59:00 +00:00
Giteabot
94a2c3ec18
chore(deps): update dependencies ( #38660 )
...
Signed-off-by: silverwind <me@silverwind.io >
Co-authored-by: silverwind <me@silverwind.io >
2026-07-27 16:55:27 +00:00
mohammad rahimi
13d0f24423
feat: Replace SSE with WebSocket for UI notifications ( #36965 )
...
* Closes #36942
* Fixes #19265
Replaces the SSE-based push channel (`/user/events`) with a WebSocket
endpoint (`/-/ws`).
### What changes
- **New `/-/ws` endpoint** (authenticated). One WebSocket per origin,
shared across tabs via a single `SharedWorker`.
- **Pubsub broker** (`services/pubsub`) for fan-out by topic, behind a
`Broker` interface. `MemoryBroker` is the default (single process); a
Redis backend is available for multi-process setups, configured via
`[websocket].PUBSUB_TYPE` / `PUBSUB_CONN_STR`. The internal Gitea queue
was not usable here because it has FIFO/single-consumer semantics.
- **Push-only event production.** Events are emitted by write-triggered
notifiers — `NotificationCountChange`, `PublishStopwatchesForUser`, and
the logout publisher — wired into the existing `notify.Notifier`
interface. No server-side pollers.
- **Typed pub/sub on the client.** `web_src/js/modules/worker.ts` is a
singleton transport; features subscribe per event type via
`onUserEvent('notification-count', cb)` instead of branching on
`event.data.type`.
- **Wire contract** (`UserEventType` union) is shared between the worker
and consumers via `web_src/js/types.ts`, kept in sync with
`services/websocket/events.go`.
- **Client-side periodic polling fallback** kicks in only when the
WebSocket cannot be established (e.g. proxy blocks WS, browser lacks
module-SharedWorker support).
### What's removed
- `modules/eventsource` (SSE manager, run loop, messenger).
- `/user/events` route and `tests/integration/eventsource_test.go`.
- All server-side polling for stopwatches and notification counts.
### Stopwatch multi-tab fix
The navbar stopwatch icon was previously rendered conditionally on `{{if
$activeStopwatch}}`, so tabs loaded before the timer started had no DOM
element to update. The icon and popup are now always rendered (toggled
with `tw-hidden`), and the start/stop/cancel handlers POST silently so
all open tabs reflect the change in real time.
### Deployment note
WebSocket needs the upgrade headers to pass through a reverse proxy,
e.g. for nginx:
```nginx
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
```
Without them the WebSocket cannot be established, and after 3
consecutive failed opens the shared worker signals `push-unavailable`:
the notification count and stopwatch fall back to periodic polling on
the existing `[ui.notification]` timeouts. Real-time push is lost, the
features keep working. The reverse-proxy docs need the same note (see
the `docs-update-needed` label).
---------
Co-authored-by: silverwind <me@silverwind.io >
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
Co-authored-by: Epid <rexmrj@gmail.com >
2026-07-27 07:46:00 +00:00
Giteabot
39cc4db4ba
fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] ( #38623 )
2026-07-24 22:14:44 +00:00
silverwind
ed5f254ee3
chore: separate go minimum and build toolchain ( #38559 )
...
- split the go version in `go.mod` into `go` and `toolchain` again
- add a workaround for https://github.com/golang/go/issues/75331 so
`make tidy` never drops `toolchain`
- configure renovate to bump `go` on minor releases and `toolchain` on
every release
- go and toolchain bumps land in a separate, fast-tracked PR, as both
carry security fixes
Replaces: https://github.com/go-gitea/gitea/pull/37846
2026-07-22 17:26:55 +00:00
Giteabot
bc3f63095b
fix(deps): update module google.golang.org/grpc to v1.82.1 [security] ( #38567 )
2026-07-22 16:47:29 +02:00
wxiaoguang
4af9156c36
refactor: implement mcaptcha client and add comments/tests ( #38561 )
...
End users still need it, so it's better to make it maintainable with
tests and OOM-safe.
---------
Co-authored-by: silverwind <me@silverwind.io >
2026-07-21 13:41:54 +00:00
Giteabot
2fec2affc4
chore(deps): update dependencies ( #38538 )
...
Also include:
chore(deps): update npm dependencies #38542
chore(deps): update action dependencies #38541
chore(deps): update module golang.org/x/vuln to v1.6.0 #38540
2026-07-20 09:27:21 +00:00
Giteabot
506075c480
fix(deps): update go dependencies ( #38429 )
2026-07-15 06:47:08 +00:00
Giteabot
ed9b02985a
fix(deps): update module github.com/google/go-github/v88 to v89 ( #38433 )
2026-07-14 08:48:58 +00:00
Giteabot
b96bd22372
fix(deps): update go dependencies ( #38346 )
2026-07-07 10:16:00 +00:00
Lunny Xiao
580cc26d63
chore: Upgrade xorm to 1.4.1 ( #38224 )
...
Fix #22275
Changelog: https://gitea.com/xorm/xorm/compare/v1.3.11..v1.4.1
2026-07-06 17:07:58 +00:00
Giteabot
6ae42ca9c4
fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.42.0 ( #38266 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
|
[gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go )
| `v2.40.1` → `v2.42.0` |
|
|
---
> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/37531) for more information.
---
### Release Notes
<details>
<summary>gitlab-org/api/client-go
(gitlab.com/gitlab-org/api/client-go/v2)</summary>
###
[`v2.42.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.42.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.41.0...v2.42.0 )
#### 2.42.0
##### 🚀 Features
- Add missing fields to project level jira integration
([!2925 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2925 ))
by [Heidi Berry](https://gitlab.com/heidi.berry )
###
[2.42.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.41.0...v2.42.0 )
(2026-06-24)
###
[`v2.41.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.41.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.40.1...v2.41.0 )
#### 2.41.0
##### 🚀 Features
- Add missing attributes and endpoints to group
([!2905 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2905 ))
by [Jimmy Spagnola](https://gitlab.com/jspagnola )
##### 🔄 Other Changes
- chore(deps): update docker docker tag to v29.5.3
([!2924 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2924 ))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot )
###
[2.41.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.40.1...v2.41.0 )
(2026-06-23)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Only on Monday (`* * * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-06-29 18:09:25 +02:00
Giteabot
5e5f5f3116
fix(deps): update go dependencies ( #38194 )
...
Update go deps and fix discovered issues
Co-authored-by: silverwind <me@silverwind.io >
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
2026-06-29 15:10:47 +00:00
Giteabot
b565f3e00a
fix(deps): update module golang.org/x/image to v0.43.0 [security] ( #38219 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [golang.org/x/image](https://pkg.go.dev/golang.org/x/image ) |
[`v0.42.0` →
`v0.43.0`](https://cs.opensource.google/go/x/image/+/refs/tags/v0.42.0...refs/tags/v0.43.0 )
|
|
|
---
### Panic on VP8 alpha channel size mismatch in x/image/webp in
golang.org/x/image
[CVE-2026-46601](https://nvd.nist.gov/vuln/detail/CVE-2026-46601 ) /
[GO-2026-5061](https://pkg.go.dev/vuln/GO-2026-5061 )
<details>
<summary>More information</summary>
#### Details
The webp decoder can panic when processing a VP8 chunk with dimensions
that do not match the canvas size.
#### Severity
Unknown
#### References
- [https://go.dev/cl/787681 ](https://go.dev/cl/787681 )
- [https://go.dev/issue/79869 ](https://go.dev/issue/79869 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5061 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Lack of limit on tile sizes in x/image/tiff in golang.org/x/image
[CVE-2026-46602](https://nvd.nist.gov/vuln/detail/CVE-2026-46602 ) /
[GO-2026-5062](https://pkg.go.dev/vuln/GO-2026-5062 )
<details>
<summary>More information</summary>
#### Details
The TIFF decoder does not set a limit on the size of tiles in tiled
images, permitting a malicious or corrupt image containing a very large
tile to cause unbounded memory consumption.
#### Severity
Unknown
#### References
- [https://go.dev/cl/788422 ](https://go.dev/cl/788422 )
- [https://go.dev/issue/79905 ](https://go.dev/issue/79905 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5062 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Panic decoding image with out-of-bounds strip offset in x/image/tiff
in golang.org/x/image
[CVE-2026-46604](https://nvd.nist.gov/vuln/detail/CVE-2026-46604 ) /
[GO-2026-5066](https://pkg.go.dev/vuln/GO-2026-5066 )
<details>
<summary>More information</summary>
#### Details
The TIFF decoder can panic when decoding an invalid image with an
out-of-bounds strip offset.
#### Severity
Unknown
#### References
- [https://go.dev/cl/788421 ](https://go.dev/cl/788421 )
- [https://go.dev/issue/80122 ](https://go.dev/issue/80122 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5066 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- ""
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-06-27 13:27:56 +02:00
metsw24-max
0eba0e371f
fix(packages): validate module version in goproxy ParsePackage ( #38104 )
...
**Unvalidated version in goproxy ParsePackage**
The module version is read straight from the zip directory path and
never checked, so a crafted upload can leave a newline in it;
`EnumeratePackageVersions` then writes each stored version on its own
line for the `@v/list` endpoint, letting a module advertise fabricated
versions to `go` clients. Validated the parsed version with
`semver.IsValid` inside the parser, matching the version checks the
other package parsers already do.
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com >
2026-06-15 19:14:14 +02:00
puni9869
6a7e232f1e
chore(deps): Update go to 1.26.4 and bump go dependencies ( #38023 )
...
New go version addressed multiple vulns as below.
<img width="1217" height="818" alt="image"
src="https://github.com/user-attachments/assets/f1738003-8b19-4fac-a200-6903d93f48ad "
/>
Dependencies affected:
```
gitea.com/gitea/runner - v1.0.6 → v1.0.8
gitea.dev/sdk - v1.0.1 → v1.1.0
github.com/Azure/azure-sdk-for-go/sdk/azcore - v1.20.0 → v1.22.0
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob - v1.6.3 → v1.7.0
github.com/alecthomas/chroma/v2 - v2.25.0 → v2.26.1
github.com/aws/aws-sdk-go-v2/credentials - v1.19.17 → v1.19.24
github.com/aws/aws-sdk-go-v2/service/codecommit - v1.33.14 → v1.34.4
github.com/dlclark/regexp2/v2 - v2.1.0 → v2.2.1
github.com/getkin/kin-openapi - v0.139.0 → v0.140.0
github.com/google/pprof - v0.0.0-20260507013755-92041b743c96 → v0.0.0-20260604005048-7023385849c0
github.com/jhillyerd/enmime/v2 - v2.4.0 → v2.4.1
github.com/mattn/go-sqlite3 - v1.14.44 → v1.14.45
github.com/meilisearch/meilisearch-go - v0.36.2 → v0.36.3
github.com/microsoft/go-mssqldb - v1.9.7 → v1.10.0
github.com/redis/go-redis/v9 - v9.19.0 → v9.20.0
github.com/urfave/cli/v3 - v3.9.0 → v3.9.1
gitlab.com/gitlab-org/api/client-go/v2 - v2.34.0 → v2.38.0
go.yaml.in/yaml/v4 - v4.0.0-rc.3 → v4.0.0-rc.5
golang.org/x/crypto - v0.52.0 → v0.53.0
golang.org/x/image - v0.41.0 → v0.42.0
golang.org/x/net - v0.55.0 → v0.56.0
golang.org/x/sync - v0.20.0 → v0.21.0
golang.org/x/sys - v0.45.0 → v0.46.0
golang.org/x/text - v0.37.0 → v0.38.0
golang.org/x/tools - v0.44.0 → v0.45.0
gopkg.in/ini.v1 - v1.67.2 → v1.67.3
modernc.org/sqlite - v1.50.1 → v1.52.0
```
---------
Signed-off-by: puni9869 <80308335+puni9869@users.noreply.github.com >
Co-authored-by: Nicolas <bircni@icloud.com >
2026-06-11 18:33:44 +00:00
bircni
bc2fbe77b1
refactor(actions): read runner capabilities from proto field ( #38068 )
...
[actions-proto-go v0.6.0](https://gitea.com/gitea/actions-proto-go ) adds
a
`capabilities` field to `RegisterRequest` and `DeclareRequest`. This
lets a
runner advertise the transitional `cancelling` capability directly in
the proto
message instead of through the out-of-band mechanism we used while the
proto
bump was pending.
This PR:
- Bumps `gitea.dev/actions-proto-go` to `v0.6.0`.
- Drops the forward-compat `capabilityGetter` type-assertion shim and
the
`runnerRequestHasCancellingCapability` helper, reading
`GetCapabilities()`
directly (now part of the `declareRequest` interface).
- Removes the "capability state unknown → preserve existing value"
branch.
## Why the behaviour change is correct
The shim and the `(hasSupport, known)` two-value return only existed
because the
old proto had no `capabilities` field, so we couldn't tell "runner
doesn't
support it" from "we can't see the field." With v0.6.0 the field is
always
present. Since proto3 repeated fields have no presence, "no capabilities
sent"
now unambiguously means the runner does not advertise the capability, so
a
runner that omits `cancelling` is correctly recorded as
`HasCancellingSupport =
false`.
There is no regression: prior to this bump Gitea was on `v0.5.0`, where
the
type assertion always failed and `HasCancellingSupport` was therefore
never set
from requests — so no runner relied on the preserved-unknown path.
## Compatibility
The change is wire-compatible in both directions of version skew,
because the
new field uses a previously unused field number (8 on `RegisterRequest`,
3 on
`DeclareRequest`) and the transport uses the binary protobuf codec:
- **Old runner → new Gitea:** the runner omits the field; it decodes to
an empty
capability list. Registration/declaration succeed; the runner simply
doesn't
get the cancelling feature.
- **New runner → old Gitea:** the runner sends the field; the old
server's
generated code doesn't know the field number and silently ignores it.
Registration/declaration succeed.
The feature only activates once both server and runner are on `v0.6.0`.
2026-06-11 09:18:31 +00:00
Giteabot
5fe77ad309
fix(deps): update go dependencies ( #37967 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [gitea.com/gitea/runner](https://gitea.com/gitea/runner ) | `v1.0.5` →
`v1.0.6` |
|
|
|
[github.com/aws/aws-sdk-go-v2/credentials](https://redirect.github.com/aws/aws-sdk-go-v2 )
| `v1.19.16` → `v1.19.17` |
|
|
|
[github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi )
| `v0.138.0` → `v0.139.0` |
|
|
| [github.com/go-chi/chi/v5](https://redirect.github.com/go-chi/chi ) |
`v5.2.5` → `v5.3.0` |
|
|
|
[github.com/go-webauthn/webauthn](https://redirect.github.com/go-webauthn/webauthn )
| `v0.17.3` → `v0.17.4` |
|
|
|
[github.com/minio/minio-go/v7](https://redirect.github.com/minio/minio-go )
| `v7.1.0` → `v7.2.0` |
|
|
|
[gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go )
| `v2.30.0` → `v2.34.0` |
|
|
---
### Release Notes
<details>
<summary>gitea/runner (gitea.com/gitea/runner)</summary>
### [`v1.0.6`](https://gitea.com/gitea/runner/releases/tag/v1.0.6 )
[Compare Source](https://gitea.com/gitea/runner/compare/v1.0.5...v1.0.6 )
#### Changelog
- fix(deps): update module github.com/opencontainers/selinux to v1.15.0
([#​990](https://redirect.github.com/gitea/runner/issues/990 ))
- chore: pin Docker base images to explicit versions
([#​992](https://redirect.github.com/gitea/runner/issues/992 ))
- chore(deps): update actions/setup-node action to v6
([#​991](https://redirect.github.com/gitea/runner/issues/991 ))
- test: make TestRunEvent integration suite runnable locally
([#​987](https://redirect.github.com/gitea/runner/issues/987 ))
- ci: add PR title linting against Conventional Commits
([#​988](https://redirect.github.com/gitea/runner/issues/988 ))
- fix: clean up job network and container when container start fails
([#​986](https://redirect.github.com/gitea/runner/issues/986 ))
</details>
<details>
<summary>getkin/kin-openapi (github.com/getkin/kin-openapi)</summary>
###
[`v0.139.0`](https://redirect.github.com/getkin/kin-openapi/releases/tag/v0.139.0 )
[Compare
Source](https://redirect.github.com/getkin/kin-openapi/compare/v0.138.0...v0.139.0 )
#### What's Changed
- feat(openapi3): batch-convert long-tail RequiredFieldError sites by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1170](https://redirect.github.com/getkin/kin-openapi/pull/1170 )
- feat(openapi3): typed validation error clusters (combined:
[#​1171](https://redirect.github.com/getkin/kin-openapi/issues/1171 )-[#​1179](https://redirect.github.com/getkin/kin-openapi/issues/1179 ))
by [@​reuvenharrison](https://redirect.github.com/reuvenharrison )
in
[#​1180](https://redirect.github.com/getkin/kin-openapi/pull/1180 )
- openapi3gen: skip component export for anonymous types by
[@​0-don](https://redirect.github.com/0-don ) in
[#​1163](https://redirect.github.com/getkin/kin-openapi/pull/1163 )
- feat: migrate to oasdiff/yaml v0.1.0 single Unmarshal API + enable
DisableTimestamps by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1181](https://redirect.github.com/getkin/kin-openapi/pull/1181 )
- openapi3: typed context errors for Validate() wrapper chain by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1183](https://redirect.github.com/getkin/kin-openapi/pull/1183 )
- openapi3: track Origin on the document root (T) by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1184](https://redirect.github.com/getkin/kin-openapi/pull/1184 )
- openapi3: tests flakiness corrected by
[@​fenollp](https://redirect.github.com/fenollp ) in
[#​1159](https://redirect.github.com/getkin/kin-openapi/pull/1159 )
- openapi3: aggregate independent validation errors via EnableMultiError
by [@​reuvenharrison](https://redirect.github.com/reuvenharrison )
in
[#​1185](https://redirect.github.com/getkin/kin-openapi/pull/1185 )
- openapi3: fix validation of duplicated path templates by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1189](https://redirect.github.com/getkin/kin-openapi/pull/1189 )
- openapi3: type the remaining bare-error validation sites by
[@​reuvenharrison](https://redirect.github.com/reuvenharrison ) in
[#​1187](https://redirect.github.com/getkin/kin-openapi/pull/1187 )
**Full Changelog**:
<https://github.com/getkin/kin-openapi/compare/v0.138.0...v0.139.0 >
</details>
<details>
<summary>go-chi/chi (github.com/go-chi/chi/v5)</summary>
###
[`v5.3.0`](https://redirect.github.com/go-chi/chi/releases/tag/v5.3.0 )
[Compare
Source](https://redirect.github.com/go-chi/chi/compare/v5.2.5...v5.3.0 )
#### What's Changed
- Use strings.ReplaceAll where applicable by
[@​JRaspass](https://redirect.github.com/JRaspass ) in
[#​1046](https://redirect.github.com/go-chi/chi/pull/1046 )
- Propagate inline middlewares across mounted subrouters by
[@​LukasJenicek](https://redirect.github.com/LukasJenicek ) in
[#​1049](https://redirect.github.com/go-chi/chi/pull/1049 )
- add go 1.26 to ci by
[@​pkieltyka](https://redirect.github.com/pkieltyka ) in
[#​1052](https://redirect.github.com/go-chi/chi/pull/1052 )
- Remove last uses of io/ioutil by
[@​JRaspass](https://redirect.github.com/JRaspass ) in
[#​1054](https://redirect.github.com/go-chi/chi/pull/1054 )
- Simplify chi.walk with slices.Concat by
[@​JRaspass](https://redirect.github.com/JRaspass ) in
[#​1053](https://redirect.github.com/go-chi/chi/pull/1053 )
- Apply the stringscutprefix modernizer by
[@​JRaspass](https://redirect.github.com/JRaspass ) in
[#​1051](https://redirect.github.com/go-chi/chi/pull/1051 )
- Bump minimum Go to 1.23, always use request.Pattern by
[@​JRaspass](https://redirect.github.com/JRaspass ) in
[#​1048](https://redirect.github.com/go-chi/chi/pull/1048 )
- middleware: fix httpFancyWriter.ReadFrom double-counting bytes with
Tee by [@​alliasgher](https://redirect.github.com/alliasgher ) in
[#​1085](https://redirect.github.com/go-chi/chi/pull/1085 )
- Fix typo in Route doc comment by
[@​gouwazi](https://redirect.github.com/gouwazi ) in
[#​1073](https://redirect.github.com/go-chi/chi/pull/1073 )
- fix: set Request.Pattern from RoutePattern() by
[@​leno23](https://redirect.github.com/leno23 ) in
[#​1097](https://redirect.github.com/go-chi/chi/pull/1097 )
- feat: middleware.ClientIP, a replacement for middleware.RealIP by
[@​VojtechVitek](https://redirect.github.com/VojtechVitek ) in
[#​967](https://redirect.github.com/go-chi/chi/pull/967 )
#### New Contributors
- [@​LukasJenicek](https://redirect.github.com/LukasJenicek ) made
their first contribution in
[#​1049](https://redirect.github.com/go-chi/chi/pull/1049 )
- [@​alliasgher](https://redirect.github.com/alliasgher ) made
their first contribution in
[#​1085](https://redirect.github.com/go-chi/chi/pull/1085 )
- [@​gouwazi](https://redirect.github.com/gouwazi ) made their
first contribution in
[#​1073](https://redirect.github.com/go-chi/chi/pull/1073 )
- [@​leno23](https://redirect.github.com/leno23 ) made their first
contribution in
[#​1097](https://redirect.github.com/go-chi/chi/pull/1097 )
#### SECURITY: middleware.ClientIP, a replacement for middleware.RealIP
[@​VojtechVitek](https://redirect.github.com/VojtechVitek )
submitted PR
[#​967](https://redirect.github.com/go-chi/chi/issues/967 ), which
introduces middleware.ClientIP — a replacement for middleware.RealIP
that closes the three open spoofing advisories:
-
[GHSA-9g5q-2w5x-hmxf](https://redirect.github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf )
— IP spoofing via XFF in `RemoteAddr` resolution (convto)
-
[GHSA-rjr7-jggh-pgcp](https://redirect.github.com/go-chi/chi/security/advisories/GHSA-rjr7-jggh-pgcp )
— RealIP allows IP spoofing via unvalidated XFF (rezmoss)
-
[GHSA-3fxj-6jh8-hvhx](https://redirect.github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx )
— IP spoofing in `middleware.RealIP` (Saku0512, Critical / 9.3)
It also addresses issues outlined at:
- [#​708](https://redirect.github.com/go-chi/chi/issues/708 )
- <https://adam-p.ca/blog/2022/03/x-forwarded-for/ >
- [#​711](https://redirect.github.com/go-chi/chi/issues/711 )
- [#​453](https://redirect.github.com/go-chi/chi/issues/453 )
- [#​908](https://redirect.github.com/go-chi/chi/pull/908 )
`middleware.RealIP` is deprecated in this PR with pointers to the new
API.
The deprecation only adds a `// Deprecated:` doc comment; the function
keeps working for backward compatibility.
##### Why a new middleware (not "fix RealIP in place")
`RealIP` has two unfixable design choices: it mutates `r.RemoteAddr`,
and it tries to be a one-size-fits-all default by walking a hard-coded
list of headers any client can supply. Per [adam-p's "The perils of the
'real' client IP"](https://adam-p.ca/blog/2022/03/x-forwarded-for/ )
(which calls chi out by name on this), there is no safe default — the
user must pick their trust source explicitly.
##### The new API
Four middlewares, two accessors. Pick exactly one middleware based on
your
infrastructure, read the result with one of the two accessors:
```go
// One of the four. There is no safe default — pick exactly one.
func ClientIPFromHeader(trustedHeader string) func(http.Handler) http.Handler
func ClientIPFromXFF(trustedIPPrefixes ...string) func(http.Handler) http.Handler
func ClientIPFromXFFTrustedProxies(numTrustedProxies int) func(http.Handler) http.Handler
func ClientIPFromRemoteAddr(h http.Handler) http.Handler
// Read the result.
func GetClientIP(ctx context.Context) string // for logs, rate-limit keys
func GetClientIPAddr(ctx context.Context) netip.Addr // for typed work
```
#### Example usage:
```go
// Pick a single ClientIP middleware based on your deployment
// Cloudflare.
r.Use(middleware.ClientIPFromHeader("CF-Connecting-IP"))
// Nginx with ngx_http_realip_module.
r.Use(middleware.ClientIPFromHeader("X-Real-IP"))
// Apache with mod_remoteip.
r.Use(middleware.ClientIPFromHeader("X-Client-IP"))
// AWS CloudFront, or any proxy fleet with known CIDRs.
r.Use(middleware.ClientIPFromXFF(
"13.32.0.0/15", // CloudFront IPv4
"52.46.0.0/18", // CloudFront IPv4
"2600:9000::/28", // CloudFront IPv6
))
// Behind exactly 2 trusted proxies with dynamic IPs (autoscaling pools,
// ephemeral containers, dynamic CDN edges).
r.Use(middleware.ClientIPFromXFFTrustedProxies(2))
// Server directly on the public internet, no proxy in front.
r.Use(middleware.ClientIPFromRemoteAddr)
```
And in your handler or downstream middleware:
```go
clientIP := middleware.GetClientIP(r.Context())
// log it, use it as a rate-limit key, etc.
```
***
Thanks to [@​adam-p](https://redirect.github.com/adam-p ),
[@​c2h5oh](https://redirect.github.com/c2h5oh ),
[@​rezmoss](https://redirect.github.com/rezmoss ),
[@​Saku0512](https://redirect.github.com/Saku0512 ),
[@​convto](https://redirect.github.com/convto ),
[@​Dirbaio](https://redirect.github.com/Dirbaio ),
[@​jawnsy](https://redirect.github.com/jawnsy ),
[@​lrstanley](https://redirect.github.com/lrstanley ),
[@​mfridman](https://redirect.github.com/mfridman ),
[@​n33pm](https://redirect.github.com/n33pm ),
[@​pkieltyka](https://redirect.github.com/pkieltyka ) for the prior
discussions, detailed reviews, advisory reports, and test contributions
that shaped this PR.
**Full Changelog**:
<https://github.com/go-chi/chi/compare/v5.2.5...v5.3.0 >
</details>
<details>
<summary>go-webauthn/webauthn
(github.com/go-webauthn/webauthn)</summary>
###
[`v0.17.4`](https://redirect.github.com/go-webauthn/webauthn/blob/HEAD/CHANGELOG.md#v0174-2026-05-22 )
[Compare
Source](https://redirect.github.com/go-webauthn/webauthn/compare/v0.17.3...v0.17.4 )
##### Dependency Updates
This release just contains updates to dependencies.
</details>
<details>
<summary>minio/minio-go (github.com/minio/minio-go/v7)</summary>
###
[`v7.2.0`](https://redirect.github.com/minio/minio-go/releases/tag/v7.2.0 )
[Compare
Source](https://redirect.github.com/minio/minio-go/compare/v7.1.0...v7.2.0 )
#### What's Changed
- Use go tool for ci-lint check by
[@​klauspost](https://redirect.github.com/klauspost ) in
[#​2229](https://redirect.github.com/minio/minio-go/pull/2229 )
- Rename github.com/go-ini/ini to gopkg.in/ini.v1 by
[@​ramondeklein](https://redirect.github.com/ramondeklein ) in
[#​2232](https://redirect.github.com/minio/minio-go/pull/2232 )
- Add RDMA / NVIDIA GPU Direct Storage support by
[@​harshavardhana](https://redirect.github.com/harshavardhana ) in
[#​2233](https://redirect.github.com/minio/minio-go/pull/2233 )
**Full Changelog**:
<https://github.com/minio/minio-go/compare/v7.1.0...v7.2.0 >
</details>
<details>
<summary>gitlab-org/api/client-go
(gitlab.com/gitlab-org/api/client-go/v2)</summary>
###
[`v2.34.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.34.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.33.0...v2.34.0 )
#### 2.34.0
##### 🚀 Features
- Extend DeploymentDeployablePipeline with web_url
([!2902 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2902 ))
by [Jan Berge Sommerdahl](https://gitlab.com/sommerdahl )
##### 🔄 Other Changes
- chore(deps): update docker docker tag to v29.5.1
([!2903 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2903 ))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot )
###
[2.34.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.33.0...v2.34.0 )
(2026-05-27)
###
[`v2.33.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.33.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.32.0...v2.33.0 )
#### 2.33.0
##### 🚀 Features
- feat(work-items): add ListWorkItemTypes to WorkItemsService
([!2864 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2864 ))
by [Emmanuel 326](https://gitlab.com/Emmanuel326 )
##### 🔄 Other Changes
- chore(deps): update module cel.dev/expr to v0.25.2
([!2881 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2881 ))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot )
###
[2.33.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.32.0...v2.33.0 )
(2026-05-27)
##### Features
* **work-items:** add ListWorkItemTypes to WorkItemsService
([e71cb99](e71cb99448https://gitlab.com/gitlab-org/api/client-go/tags/v2.32.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.31.0...v2.32.0 )
#### 2.32.0
##### 🚀 Features
- feat(ci-job-cancel): force cancel
([!2872 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2872 ))
by [Filip Aleksic](https://gitlab.com/faleksic )
###
[2.32.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.31.0...v2.32.0 )
(2026-05-23)
##### Features
* **ci-job-cancel:** force cancel
([aa46bd1](aa46bd1842https://gitlab.com/gitlab-org/api/client-go/tags/v2.31.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.30.0...v2.31.0 )
#### 2.31.0
##### 🚀 Features
- Adds project service accounts API
([!2899 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2899 ))
by [Jimmy Spagnola](https://gitlab.com/jspagnola )
- feat(gitlaboauth2): support ephemeral ports in CallbackServer
([!2877 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2877 ))
by [Raphael Rösch](https://gitlab.com/raphael.roesch )
###
[2.31.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.30.0...v2.31.0 )
(2026-05-22)
##### Features
* **gitlaboauth2:** support ephemeral ports in CallbackServer
([c8c388d](c8c388d566📅 **Schedule**: (UTC)
- Branch creation
- Only on Monday (`* * * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions ) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
---------
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com >
Co-authored-by: silverwind <me@silverwind.io >
2026-06-09 10:41:54 +00:00
Alexey Ivanov
aaf4b149fa
chore(deps): upgrade zstd seekable package ( #37988 )
...
Upgrade `github.com/SaveTheRbtz/zstd-seekable-format-go/pkg` from
`v0.8.3` to `v0.10.0`:
https://github.com/SaveTheRbtz/zstd-seekable-format-go/releases/tag/pkg%2Fv0.10.0
This keeps Gitea's seekable zstd wrapper on the stable v0.10 API while
preserving the existing public `modules/zstd` API.
API migration:
- update `SeekableWriter` and `SeekableReader` internals for the
concrete `*seekable.Writer` and `*seekable.Reader` types introduced by
SaveTheRbtz/zstd-seekable-format-go#264
- update generated dependency metadata after `go mod tidy` removed the
now-unused `github.com/google/btree` transitive dependency
- no Gitea call sites needed changes because `modules/zstd` still
exposes the same constructors and interfaces
Validation:
- `go test ./modules/zstd`
- `make --always-make checks-backend`
---------
Co-authored-by: Giteabot <teabot@gitea.io >
2026-06-04 13:38:56 +00:00
Giteabot
ab2a72fe04
fix(deps): update module github.com/google/go-github/v87 to v88 ( #37971 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
|
[github.com/google/go-github/v87](https://redirect.github.com/google/go-github )
| `v87.0.0` → `v88.0.0` |
|
|
---
### Release Notes
<details>
<summary>google/go-github (github.com/google/go-github/v87)</summary>
###
[`v88.0.0`](https://redirect.github.com/google/go-github/releases/tag/v88.0.0 )
[Compare
Source](https://redirect.github.com/google/go-github/compare/v87.0.0...v88.0.0 )
This release contains the following breaking API changes:
- refactor!: Change app installation `Find*` methods to `Get*`
([#​4243](https://redirect.github.com/google/go-github/issues/4243 ))
BREAKING CHANGE: App installation methods are renamed from `Find*` to
`Get*`.
...and the following additional changes:
- chore: Bump version of go-github to v88.0.0
([#​4245](https://redirect.github.com/google/go-github/issues/4245 ))
- chore: Update `openapi_operations.yaml`
([#​4242](https://redirect.github.com/google/go-github/issues/4242 ))
- feat: Add support for setting client URLs
([#​4240](https://redirect.github.com/google/go-github/issues/4240 ))
- refactor: Add constants for API versions
([#​4236](https://redirect.github.com/google/go-github/issues/4236 ))
- docs: Formatting and punctuation changes
([#​4235](https://redirect.github.com/google/go-github/issues/4235 ))
- feat: Add `GetParentIssue` for sub-issues
([#​4232](https://redirect.github.com/google/go-github/issues/4232 ))
- chore: Bump go-github from v86 to v87 in /scrape
([#​4234](https://redirect.github.com/google/go-github/issues/4234 ))
</details>
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-06-01 23:32:32 +00:00
silverwind
d0eba5e961
chore(deps): update urfave/cli/v3 to v3.9.0 ( #37863 )
...
Updates `github.com/urfave/cli/v3` to
[v3.9.0](https://github.com/urfave/cli/releases/tag/v3.9.0 ) and removes
the renovate pin now that
[urfave/cli#2319 ](https://github.com/urfave/cli/pull/2319 ) (the `-c`
help flag parsing fix) is merged.
v3.9.0 prepends the default command name to the root command's args,
which broke the old `Root().Args()` check in `isValidDefaultSubCommand`.
It now uses the command's own `Args()`.
Behavior change: `./gitea web <extra-positional-arg>` now errors with
`unknown command` instead of starting the web server and ignoring the
trailing arg. `web` takes no positional args, so this is stricter (and
arguably more correct) input handling. The intended `./gitea bad-cmd`
rejection is unchanged.
---
This PR was written with the help of Claude Opus 4.7
---------
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com >
Co-authored-by: Nicolas <bircni@icloud.com >
2026-05-30 20:56:16 +00:00
Giteabot
d07a42e777
fix(deps): update module golang.org/x/image to v0.41.0 [security] ( #37904 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [golang.org/x/image](https://pkg.go.dev/golang.org/x/image ) |
[`v0.40.0` →
`v0.41.0`](https://cs.opensource.google/go/x/image/+/refs/tags/v0.40.0...refs/tags/v0.41.0 )
|
|
|
---
### Panic when reading out of bound palette index in
golang.org/x/image/bmp
[CVE-2026-42500](https://nvd.nist.gov/vuln/detail/CVE-2026-42500 ) /
[GO-2026-5031](https://pkg.go.dev/vuln/GO-2026-5031 )
<details>
<summary>More information</summary>
#### Details
Decoding a paletted BMP file with an out-of-range palette index results
in a panic when accessing pixels in the invalid image.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79576 ](https://go.dev/issue/79576 )
-
[https://groups.google.com/g/golang-announce/c/uhYX90BlBvI ](https://groups.google.com/g/golang-announce/c/uhYX90BlBvI )
- [https://go.dev/cl/781500 ](https://go.dev/cl/781500 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5031 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Excessive resource consumption in PackBits decompression in
golang.org/x/image/tiff
[CVE-2026-46599](https://nvd.nist.gov/vuln/detail/CVE-2026-46599 ) /
[GO-2026-5032](https://pkg.go.dev/vuln/GO-2026-5032 )
<details>
<summary>More information</summary>
#### Details
The TIFF decoder does not place a limit on the size of
PackBits-compressed data. A maliciously-crafted image can exploit this
to cause a small image (both in terms of pixel width/height and encoded
size) to make the decoder decode large amounts of compressed data.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79577 ](https://go.dev/issue/79577 )
- [https://go.dev/cl/759960 ](https://go.dev/cl/759960 )
-
[https://groups.google.com/g/golang-announce/c/uhYX90BlBvI ](https://groups.google.com/g/golang-announce/c/uhYX90BlBvI )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5032 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- ""
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-05-30 00:04:40 +02:00
Pascal Zimmermann
ea723fe482
enhance: Migrate remaining gopkg.in/yaml.v3 usages to go.yaml.in/yaml/v4 ( #37866 )
...
### Description
Replaces all remaining direct `gopkg.in/yaml.v3` imports with
`go.yaml.in/yaml/v4` across models, modules, routers, services, and
integration tests. `gopkg.in/yaml.v3` moves from a direct to an indirect
dependency in `go.mod`.
#### API compatibility
The yaml.Node type, node.Kind/node.Content traversal style
(modules/markup/markdown/convertyaml.go), and the
UnmarshalYAML(*yaml.Node) interface signature
(modules/optional/serialization.go) are all preserved in v4 — no
call-site changes were required beyond the import path.
**Related:**
- https://github.com/go-gitea/gitea/pull/36564#issuecomment-4526536805
---------
Co-authored-by: silverwind <me@silverwind.io >
Co-authored-by: Claude (Opus 4.8) <noreply@anthropic.com >
2026-05-29 01:12:11 +00:00
Lunny Xiao
0a3e7483a4
chore: Move gitea sdk from code.gitea.io/sdk/gitea -> gitea.dev/sdk ( #37855 )
...
- Use gitea.dev/sdk instead of code.gitea.io/sdk/gitea
- Use gitea.dev/actions-proto-def instead of
code.gitea.io/actions-proto-def
2026-05-27 16:23:44 -07:00
silverwind
f810e882a4
chore(deps): update chroma, regexp2 v2, replace dimiro1/reply ( #37858 )
...
- Update `github.com/alecthomas/chroma/v2` to `v2.25.0`.
- Migrate `github.com/dlclark/regexp2` to `/v2` (incorporates
https://github.com/go-gitea/gitea/pull/37664 ); drop the renovate pin.
- Replace the unmaintained `github.com/dimiro1/reply` (the last consumer
of `regexp2` v1 in our own code) with a small built-in reply parser for
incoming mail.
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com >
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com >
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
Co-authored-by: Giteabot <teabot@gitea.io >
Co-authored-by: Nicolas <bircni@icloud.com >
2026-05-27 23:39:57 +02:00
Chongyi Zheng
b7a3c7a3be
chore: remove mssql x509negativeserial workaround ( #37853 )
...
The following TLS handshake error is fixed by newer versions of mssql
(refer to
https://github.com/microsoft/mssql-docker/issues/895#issuecomment-2737646391 )
```
TLS Handshake failed: tls: failed to parse certificate from server: x509: negative serial number
```
Based on
https://github.com/microsoft/go-sqlcmd/issues/755#issuecomment-4491676993 ,
newer versions of mssql don't have this problem. And there're changes
going to mssql driver side to make this error more explicit
https://github.com/microsoft/go-mssqldb/pull/356 .
---------
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com >
Co-authored-by: Giteabot <teabot@gitea.io >
2026-05-27 08:51:16 +02:00
Lunny Xiao
61b1a39efe
chore: Move import path from code.gitea.io/gitea to gitea.dev ( #37873 )
2026-05-26 15:49:31 -07:00
Giteabot
5badd1bdee
fix(deps): update go dependencies ( #37851 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
|
[connectrpc.com/connect](https://redirect.github.com/connectrpc/connect-go )
| `v1.19.2` → `v1.20.0` |
|
|
| [gitea.com/gitea/runner](https://gitea.com/gitea/runner ) | `v1.0.4` →
`v1.0.5` |
|
|
|
[gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go )
| `v2.29.0` → `v2.30.0` |
|
|
---
### Release Notes
<details>
<summary>connectrpc/connect-go (connectrpc.com/connect)</summary>
###
[`v1.20.0`](https://redirect.github.com/connectrpc/connect-go/releases/tag/v1.20.0 )
[Compare
Source](https://redirect.github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0 )
#### What's Changed
##### Other changes
- Bump minimum supported Go version to 1.25 by
[@​jonbodner-buf](https://redirect.github.com/jonbodner-buf ) in
[#​922](https://redirect.github.com/connectrpc/connect-go/issues/922 )
- Update Unary-Get query parameter order to match spec recommendation by
[@​oliversun9](https://redirect.github.com/oliversun9 ) in
[#​926](https://redirect.github.com/connectrpc/connect-go/issues/926 )
#### New Contributors
- [@​jonbodner-buf](https://redirect.github.com/jonbodner-buf )
made their first contribution in
[#​922](https://redirect.github.com/connectrpc/connect-go/issues/922 )
**Full Changelog**:
<https://github.com/connectrpc/connect-go/compare/v1.19.2...v1.20.0 >
</details>
<details>
<summary>gitea/runner (gitea.com/gitea/runner)</summary>
### [`v1.0.5`](https://gitea.com/gitea/runner/releases/tag/v1.0.5 )
[Compare Source](https://gitea.com/gitea/runner/compare/v1.0.4...v1.0.5 )
#### Changelog
- fix(deps): update module connectrpc.com/connect to v1.20.0
([#​985](https://redirect.github.com/gitea/runner/issues/985 ))
- update docker cli to v29.5.2
([#​984](https://redirect.github.com/gitea/runner/issues/984 ))
- feat: add cache.offline\_mode to reuse cached actions
([#​966](https://redirect.github.com/gitea/runner/issues/966 ))
- Remove stale Gitea 1.20 compatibility shims
([#​978](https://redirect.github.com/gitea/runner/issues/978 ))
- fix(deps): update module github.com/docker/cli to v29.5.1+incompatible
([#​979](https://redirect.github.com/gitea/runner/issues/979 ))
- fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1
([#​980](https://redirect.github.com/gitea/runner/issues/980 ))
</details>
<details>
<summary>gitlab-org/api/client-go
(gitlab.com/gitlab-org/api/client-go/v2)</summary>
###
[`v2.30.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.30.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.29.0...v2.30.0 )
#### 2.30.0
##### 🚀 Features
- feat(orbit): add GetDsl for /api/v4/orbit/schema/dsl
([!2901 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2901 ))
by [Michael Angelo Rivera](https://gitlab.com/michaelangeloio )
###
[2.30.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.29.0...v2.30.0 )
(2026-05-20)
##### Features
* **orbit:** add GetDsl for /api/v4/orbit/schema/dsl
([530031c](530031c285https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-05-25 21:47:47 -07:00
Giteabot
821d3c4672
fix(deps): update module github.com/google/go-github/v86 to v87 ( #37845 )
2026-05-25 15:28:56 +00:00
Chongyi Zheng
0b3d7e2ba3
chore(deps): use maintained html2text package directly ( #37842 )
...
Currently unmaintained package `github.com/jaytaylor/html2text` is
replaced using `replace` directive. Instead, the correct package
`github.com/Necoro/html2text` should be referenced directly in code.
---------
Co-authored-by: Giteabot <teabot@gitea.io >
2026-05-25 11:39:10 +00:00
Giteabot
1b1113b509
fix(deps): update go dependencies ( #37841 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [gitea.com/gitea/runner](https://gitea.com/gitea/runner ) | `v1.0.3` →
`v1.0.4` |
|
|
|
[github.com/SaveTheRbtz/zstd-seekable-format-go/pkg](https://redirect.github.com/SaveTheRbtz/zstd-seekable-format-go )
| `v0.8.0` → `v0.8.3` |
|
|
|
[github.com/jhillyerd/enmime/v2](https://redirect.github.com/jhillyerd/enmime )
| `v2.3.0` → `v2.4.0` |
|
|
|
[gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go )
| `v2.26.0` → `v2.29.0` |
|
|
---
### Release Notes
<details>
<summary>gitea/runner (gitea.com/gitea/runner)</summary>
### [`v1.0.4`](https://gitea.com/gitea/runner/releases/tag/v1.0.4 )
[Compare Source](https://gitea.com/gitea/runner/compare/v1.0.3...v1.0.4 )
#### Changelog
- Fix token use with schemaless Gitea instance
([#​977](https://redirect.github.com/gitea/runner/issues/977 ))
- Add OCI `source` and `version` labels to images
([#​975](https://redirect.github.com/gitea/runner/issues/975 ))
- fix(parse\_env\_file): support env-file lines larger than 64 KiB
([#​974](https://redirect.github.com/gitea/runner/issues/974 ))
- Fix host cleanup, volume allowlist, cache upload, and action host edge
cases
([#​970](https://redirect.github.com/gitea/runner/issues/970 ))
- Remove dead code from `act/`
([#​971](https://redirect.github.com/gitea/runner/issues/971 ))
- fix: Return if executors length is zero in ParallelExecutor
([#​960](https://redirect.github.com/gitea/runner/issues/960 ))
- feat: make pseudo-TTY allocation opt-in
([#​961](https://redirect.github.com/gitea/runner/issues/961 ))
- fix(deps): update module github.com/docker/cli to v29.5.0+incompatible
([#​969](https://redirect.github.com/gitea/runner/issues/969 ))
- Simplify kubernetes dind example allowing for default docker config in
workflows
([#​709](https://redirect.github.com/gitea/runner/issues/709 ))
- chore(deps): bump `retry-go`, `golangci-lint`, `govulncheck`
([#​965](https://redirect.github.com/gitea/runner/issues/965 ))
- fix(deps): bump `docker` deps, switch to `moby/moby`
([#​943](https://redirect.github.com/gitea/runner/issues/943 ))
- fix: respect proxy env vars in runner client
([#​962](https://redirect.github.com/gitea/runner/issues/962 ))
</details>
<details>
<summary>jhillyerd/enmime (github.com/jhillyerd/enmime/v2)</summary>
###
[`v2.4.0`](https://redirect.github.com/jhillyerd/enmime/releases/tag/v2.4.0 )
[Compare
Source](https://redirect.github.com/jhillyerd/enmime/compare/v2.3.0...v2.4.0 )
#### What's Changed
- feat!: Refactor EnvelopeFromPart()'s scope by
[@​bgedney](https://redirect.github.com/bgedney ) in
[#​392](https://redirect.github.com/jhillyerd/enmime/pull/392 )
- chore: rm unused func by
[@​aleksandr4842](https://redirect.github.com/aleksandr4842 ) in
[#​393](https://redirect.github.com/jhillyerd/enmime/pull/393 )
- chore: bump Go (1.25.x) & deps by
[@​jhillyerd](https://redirect.github.com/jhillyerd ) in
[#​394](https://redirect.github.com/jhillyerd/enmime/pull/394 )
#### New Contributors
- [@​bgedney](https://redirect.github.com/bgedney ) made their
first contribution in
[#​392](https://redirect.github.com/jhillyerd/enmime/pull/392 )
- [@​aleksandr4842](https://redirect.github.com/aleksandr4842 )
made their first contribution in
[#​393](https://redirect.github.com/jhillyerd/enmime/pull/393 )
**Full Changelog**:
<https://github.com/jhillyerd/enmime/compare/v2.3.0...v2.4.0 >
</details>
<details>
<summary>gitlab-org/api/client-go
(gitlab.com/gitlab-org/api/client-go/v2)</summary>
###
[`v2.29.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.29.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.28.0...v2.29.0 )
#### 2.29.0
##### 🚀 Features
- Add support for project setting `protect_merge_request_pipelines`
([!2896 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2896 ))
by [Gatla Vishweshwar Reddy](https://gitlab.com/gatlavishweshwarreddy26 )
##### 🐛 Bug Fixes
- fix(orbit): add QueryRaw for streaming llm/GOON response body verbatim
([!2897 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2897 ))
by [Dmitry Gruzd](https://gitlab.com/dgruzd )
###
[2.29.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.28.0...v2.29.0 )
(2026-05-19)
##### Bug Fixes
* **orbit:** add QueryRaw for streaming llm/GOON response body verbatim
([a849302](a849302222https://gitlab.com/gitlab-org/api/client-go/tags/v2.28.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.27.1...v2.28.0 )
#### 2.28.0
##### 🚀 Features
- Add signing_token and related fields to group_hook and project_hook
([!2891 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2891 ))
by [Jimmy Spagnola](https://gitlab.com/jspagnola )
##### 🔄 Other Changes
- WithPath already escapes, escaping again causes bad requests
([!2898 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2898 ))
by [Jimmy Spagnola](https://gitlab.com/jspagnola )
###
[2.28.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.27.1...v2.28.0 )
(2026-05-18)
###
[`v2.27.1`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.27.1 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.27.0...v2.27.1 )
#### 2.27.1
##### 🐛 Bug Fixes
- fix: handle string-encoded and null durations in webhooks that happen
when Sidekiq runs in compress mode with large payloads
([!2862 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2862 ))
by [Emmanuel 326](https://gitlab.com/Emmanuel326 )
##### 🔄 Other Changes
- chore(deps): update module buf.build/go/protoyaml to v0.7.0
([!2894 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2894 ))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot )
####
[2.27.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.27.0...v2.27.1 )
(2026-05-18)
##### Bug Fixes
* handle string-encoded and null durations in webhooks that happen when
Sidekiq runs in compress mode with large payloads
([8bfe7d3](8bfe7d3effhttps://gitlab.com/gitlab-org/api/client-go/tags/v2.27.0 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.26.1...v2.27.0 )
#### 2.27.0
##### 🚀 Features
- feat(users): add SCIMIdentities field to User type
([!2888 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2888 ))
by [dragonrider.](https://gitlab.com/junevm )
##### 🔄 Other Changes
- chore(deps): update node docker tag to v26
([!2890 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2890 ))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot )
- chore(deps): update docker docker tag to v29.4.3
([!2892 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2892 ))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot )
###
[2.27.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.26.1...v2.27.0 )
(2026-05-18)
##### Features
* **users:** add SCIMIdentities field to User type
([ccb318d](ccb318dc53https://gitlab.com/gitlab-org/api/client-go/tags/v2.26.1 )
[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.26.0...v2.26.1 )
#### 2.26.1
##### 🐛 Bug Fixes
- Use a sentinel ErrorResponse for 404 errors, so both `Is()` and
`HasStatusCode` work properly
([!2884 ](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2884 ))
by [Jimmy Spagnola](https://gitlab.com/jspagnola )
####
[2.26.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.26.0...v2.26.1 )
(2026-05-15)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Only on Monday (`* * * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions ) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-05-25 10:45:20 +00:00
Giteabot
4c37f4dacb
fix(deps): update module golang.org/x/net to v0.55.0 [security] ( #37813 )
2026-05-22 17:28:54 +00:00
Giteabot
9d737a6400
fix(deps): update module golang.org/x/crypto to v0.52.0 [security] ( #37806 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto ) |
[`v0.51.0` →
`v0.52.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.51.0...refs/tags/v0.52.0 )
|
|
|
---
### Invoking key constraints not enforced in
golang.org/x/crypto/ssh/agent
[CVE-2026-39833](https://nvd.nist.gov/vuln/detail/CVE-2026-39833 ) /
[GO-2026-5005](https://pkg.go.dev/vuln/GO-2026-5005 )
<details>
<summary>More information</summary>
#### Details
The in-memory keyring returned by NewKeyring() silently accepted keys
with the ConfirmBeforeUse constraint but never enforced it. The key
would sign without any confirmation prompt, with no indication to the
caller that the constraint was not in effect. NewKeyring() now returns
an error when unsupported constraints are requested.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79436 ](https://go.dev/issue/79436 )
- [https://go.dev/cl/778640 ](https://go.dev/cl/778640 )
- [https://go.dev/cl/778641 ](https://go.dev/cl/778641 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5005 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking agent constraints dropped when forwarding keys in
golang.org/x/crypto/ssh/agent
[CVE-2026-39832](https://nvd.nist.gov/vuln/detail/CVE-2026-39832 ) /
[GO-2026-5006](https://pkg.go.dev/vuln/GO-2026-5006 )
<details>
<summary>More information</summary>
#### Details
When adding a key to a remote agent constraint extensions such as
restrict-destination-v00@​openssh.com were not serialized in the
request. Destination restrictions were silently stripped when forwarding
keys, allowing unrestricted use of the key on the remote host. The
client now serializes all constraint extensions. Additionally, the
in-memory keyring returned by NewKeyring() now rejects keys with
unsupported constraint extensions instead of silently ignoring them.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79435 ](https://go.dev/issue/79435 )
- [https://go.dev/cl/778642 ](https://go.dev/cl/778642 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5006 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking byte arithmetic causes underflow and panic in
golang.org/x/crypto/ssh
[CVE-2026-46597](https://nvd.nist.gov/vuln/detail/CVE-2026-46597 ) /
[GO-2026-5013](https://pkg.go.dev/vuln/GO-2026-5013 )
<details>
<summary>More information</summary>
#### Details
An incorrectly placed cast from bytes to int allowed for server-side
panic in the AES-GCM packet decoder for well-crafted inputs.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79561 ](https://go.dev/issue/79561 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
- [https://go.dev/cl/781620 ](https://go.dev/cl/781620 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5013 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking bypass of certificate restrictions in
golang.org/x/crypto/ssh
[CVE-2026-39828](https://nvd.nist.gov/vuln/detail/CVE-2026-39828 ) /
[GO-2026-5014](https://pkg.go.dev/vuln/GO-2026-5014 )
<details>
<summary>More information</summary>
#### Details
When an SSH server authentication callback returned PartialSuccessError
with non-nil Permissions, those permissions were silently discarded,
potentially dropping certificate restrictions such as force-command
after a second factor succeeded. Returning non-nil Permissions with
PartialSuccessError now results in a connection error.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79562 ](https://go.dev/issue/79562 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
- [https://go.dev/cl/781621 ](https://go.dev/cl/781621 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5014 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking server panic during CheckHostKey/Authenticate in
golang.org/x/crypto/ssh
[CVE-2026-39835](https://nvd.nist.gov/vuln/detail/CVE-2026-39835 ) /
[GO-2026-5015](https://pkg.go.dev/vuln/GO-2026-5015 )
<details>
<summary>More information</summary>
#### Details
SSH servers which use CertChecker as a public key callback without
setting IsUserAuthority or IsHostAuthority could be caused to panic by a
client presenting a certificate. CertChecker now returns an error
instead of panicking when these callbacks are nil.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79563 ](https://go.dev/issue/79563 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
- [https://go.dev/cl/781660 ](https://go.dev/cl/781660 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5015 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking memory leak when rejecting channels can lead to DoS in
golang.org/x/crypto/ssh
[CVE-2026-39827](https://nvd.nist.gov/vuln/detail/CVE-2026-39827 ) /
[GO-2026-5016](https://pkg.go.dev/vuln/GO-2026-5016 )
<details>
<summary>More information</summary>
#### Details
An authenticated SSH client that repeatedly opened channels which were
rejected by the server caused unbounded memory growth, eventually
crashing the server process and affecting all connected users. Rejected
channels are now properly removed from the connection's internal state
and released for garbage collection.
#### Severity
Unknown
#### References
- [https://go.dev/issue/35127 ](https://go.dev/issue/35127 )
- [https://go.dev/cl/781320 ](https://go.dev/cl/781320 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5016 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking client can cause server deadlock on unexpected responses in
golang.org/x/crypto/ssh
[CVE-2026-39830](https://nvd.nist.gov/vuln/detail/CVE-2026-39830 ) /
[GO-2026-5017](https://pkg.go.dev/vuln/GO-2026-5017 )
<details>
<summary>More information</summary>
#### Details
A malicious SSH peer could send unsolicited global request responses to
fill an internal buffer, blocking the connection's read loop. The
blocked goroutine could not be released by calling Close(), resulting in
a resource leak per connection. Unsolicited global responses are now
discarded.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79564 ](https://go.dev/issue/79564 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
- [https://go.dev/cl/781640 ](https://go.dev/cl/781640 )
- [https://go.dev/cl/781664 ](https://go.dev/cl/781664 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5017 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking pathological RSA/DSA parameters may cause DoS in
golang.org/x/crypto/ssh
[CVE-2026-39829](https://nvd.nist.gov/vuln/detail/CVE-2026-39829 ) /
[GO-2026-5018](https://pkg.go.dev/vuln/GO-2026-5018 )
<details>
<summary>More information</summary>
#### Details
The RSA and DSA public key parsers did not enforce size limits on key
parameters. A crafted public key with an excessively large modulus or
DSA parameter could cause several minutes of CPU consumption during
signature verification. This could be triggered by unauthenticated
clients during public key authentication. RSA moduli are now limited to
8192 bits, and DSA parameters are validated per FIPS 186-2.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79565 ](https://go.dev/issue/79565 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
- [https://go.dev/cl/781641 ](https://go.dev/cl/781641 )
- [https://go.dev/cl/781661 ](https://go.dev/cl/781661 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5018 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking bypass of FIDO/U2F security keys physical interaction in
golang.org/x/crypto/ssh
[CVE-2026-39831](https://nvd.nist.gov/vuln/detail/CVE-2026-39831 ) /
[GO-2026-5019](https://pkg.go.dev/vuln/GO-2026-5019 )
<details>
<summary>More information</summary>
#### Details
The Verify() method for FIDO/U2F security key types
(sk-ecdsa-sha2-nistp256@​openssh.com,
sk-ssh-ed25519@​openssh.com) did not check the User Presence flag.
Signatures generated without physical touch were accepted, allowing
unattended use of a hardware security key. To restore the previous
behavior, return a "no-touch-required" extension in
Permissions.Extensions from PublicKeyCallback.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79566 ](https://go.dev/issue/79566 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
- [https://go.dev/cl/781662 ](https://go.dev/cl/781662 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5019 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking infinite loop on large channel writes in
golang.org/x/crypto/ssh
[CVE-2026-39834](https://nvd.nist.gov/vuln/detail/CVE-2026-39834 ) /
[GO-2026-5020](https://pkg.go.dev/vuln/GO-2026-5020 )
<details>
<summary>More information</summary>
#### Details
When writing data larger than 4GB in a single Write call on an SSH
channel, an integer overflow in the internal payload size calculation
caused the write loop to spin indefinitely, sending empty packets
without making progress. The size comparison now uses int64 to prevent
truncation.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79567 ](https://go.dev/issue/79567 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
- [https://go.dev/cl/781663 ](https://go.dev/cl/781663 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5020 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking auth bypass via unenforced @​revoked status in
golang.org/x/crypto/ssh/knownhosts
[CVE-2026-42508](https://nvd.nist.gov/vuln/detail/CVE-2026-42508 ) /
[GO-2026-5021](https://pkg.go.dev/vuln/GO-2026-5021 )
<details>
<summary>More information</summary>
#### Details
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly
checked for revocation. Now, both the 'key' and 'key.SignatureKey' are
checked for @​revoked.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79568 ](https://go.dev/issue/79568 )
- [https://go.dev/cl/781220 ](https://go.dev/cl/781220 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5021 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking VerifiedPublicKeyCallback permissions skip enforcement in
golang.org/x/crypto/ssh
[CVE-2026-46595](https://nvd.nist.gov/vuln/detail/CVE-2026-46595 ) /
[GO-2026-5023](https://pkg.go.dev/vuln/GO-2026-5023 )
<details>
<summary>More information</summary>
#### Details
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh
server configurations; if any other type of callback is passed other
than public key, then the source-address validation would be skipped.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79570 ](https://go.dev/issue/79570 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
- [https://go.dev/cl/781642 ](https://go.dev/cl/781642 )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5023 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
### Invoking pathological inputs can lead to client panic in
golang.org/x/crypto/ssh/agent
[CVE-2026-46598](https://nvd.nist.gov/vuln/detail/CVE-2026-46598 ) /
[GO-2026-5033](https://pkg.go.dev/vuln/GO-2026-5033 )
<details>
<summary>More information</summary>
#### Details
For certain crafted inputs, a 'ed25519.PrivateKey' was created by
casting malformed wire bytes, leading to a panic when used.
#### Severity
Unknown
#### References
- [https://go.dev/issue/79596 ](https://go.dev/issue/79596 )
- [https://go.dev/cl/781360 ](https://go.dev/cl/781360 )
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI ](https://groups.google.com/g/golang-announce/c/a082jnz-LvI )
This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5033 ) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb )
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license )).
</details>
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-05-21 23:44:13 -07:00
Giteabot
42e167b054
fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] ( #37786 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
|
[github.com/go-git/go-git/v5](https://redirect.github.com/go-git/go-git )
| `v5.19.0` → `v5.19.1` |
|
|
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-05-19 21:03:12 +00:00
Giteabot
0b7fc8a579
fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 ( #37771 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
|
[gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go )
| `v2.25.0` → `v2.26.0` |
|
|
2026-05-19 04:37:42 +00:00
Giteabot
81b544c279
fix(deps): update module google.golang.org/grpc to v1.81.1 ( #37762 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go ) |
`v1.81.0` → `v1.81.1` |
|
|
---
### Release Notes
<details>
<summary>grpc/grpc-go (google.golang.org/grpc)</summary>
###
[`v1.81.1`](https://redirect.github.com/grpc/grpc-go/releases/tag/v1.81.1 ):
Release 1.81.1
[Compare
Source](https://redirect.github.com/grpc/grpc-go/compare/v1.81.0...v1.81.1 )
### Security
- xds/rbac: Fix a potential authorization bypass caused by incorrectly
falling through URI/DNS SANs to Subject Distinguished Name (DN) when
matching the authenticated principal name. With this fix, only the first
non-empty identity source will be used, as per [gRFC
A41](https://redirect.github.com/grpc/proposal/blob/master/A41-xds-rbac.md ).
([#​9111](https://redirect.github.com/grpc/grpc-go/issues/9111 ))
- Special Thanks:
[@​al4an444](https://redirect.github.com/al4an444 )
### Bug Fixes
- otel: Segregate client and server RPC information used for metrics and
traces, to avoid one overwriting the other.
([#​9081](https://redirect.github.com/grpc/grpc-go/issues/9081 ))
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Only on Monday (`* * * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-05-18 17:52:59 +00:00
