Add changelog for 1.25.3 (#36182 )

Fix bugs when comparing and creating pull request (#36144 )
Backport #36166
2026-04-07 16:18:49 +00:00 · 2025-12-18 09:36:38 -08:00 · 2025-12-17 16:17:33 -08:00 · 2025-12-17 08:49:29 -08:00 · 2025-12-17 18:56:58 +08:00 · 2025-12-15 11:42:59 +02:00
2093 changed files with 123992 additions and 156374 deletions
--- a/.air.toml
+++ b/.air.toml
@@ -4,7 +4,7 @@ tmp_dir = ".air"
 [build]
 pre_cmd = ["killall -9 gitea 2>/dev/null || true"] # kill off potential zombie processes from previous runs
 cmd = "make --no-print-directory backend"
-entrypoint = ["./gitea"]
+bin = "gitea"
 delay = 2000
 include_ext = ["go", "tmpl"]
 include_file = ["main.go"]
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -13,13 +13,14 @@
    "ghcr.io/devcontainers/features/git-lfs:1.2.5": {},
    "ghcr.io/jsburckhardt/devcontainer-features/uv:1": {},
    "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.14"
+      "version": "3.13"
    },
    "ghcr.io/warrenbuckley/codespace-features/sqlite:1": {}
  },
  "customizations": {
    "vscode": {
      "settings": {},
+      // same extensions as Gitpod, should match /.gitpod.yml
      "extensions": [
        "editorconfig.editorconfig",
        "dbaeumer.vscode-eslint",
--- a/.dockerignore
+++ b/.dockerignore
@@ -74,9 +74,6 @@ cpu.out
 /VERSION
 /.air
 /.go-licenses
-/Dockerfile
-/Dockerfile.rootless
-/.venv

 # Files and folders that were previously generated
 /public/assets/img/webpack
--- a/.gitattributes
+++ b/.gitattributes
@@ -8,4 +8,3 @@
 /vendor/** -text -eol linguist-vendored
 /web_src/js/vendor/** -text -eol linguist-vendored
 Dockerfile.* linguist-language=Dockerfile
-Makefile.* linguist-language=Makefile
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,10 +0,0 @@
-version: 2
-
-updates:
-  - package-ecosystem: github-actions
-    labels: [modifies/dependencies]
-    directory: /
-    schedule:
-      interval: daily
-    cooldown:
-      default-days: 5
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -43,13 +43,15 @@ modifies/internal:
          - ".editorconfig"
          - ".eslintrc.cjs"
          - ".golangci.yml"
+          - ".gitpod.yml"
          - ".markdownlint.yaml"
          - ".spectral.yaml"
-          - "stylelint.config.*"
+          - "stylelint.config.js"
          - ".yamllint.yaml"
          - ".github/**"
          - ".gitea/**"
          - ".devcontainer/**"
+          - "build.go"
          - "build/**"
          - "contrib/**"

@@ -83,9 +85,9 @@ docs-update-needed:
 topic/code-linting:
  - changed-files:
      - any-glob-to-any-file:
+          - ".eslintrc.cjs"
          - ".golangci.yml"
          - ".markdownlint.yaml"
          - ".spectral.yaml"
          - ".yamllint.yaml"
-          - "eslint*.config.*"
-          - "stylelint.config.*"
+          - "stylelint.config.js"
--- a/.github/workflows/cron-flake-updater.yml
+++ b/.github/workflows/cron-flake-updater.yml
@@ -1,22 +0,0 @@
-name: cron-flake-updater
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 0 * * 0' # runs weekly on Sunday at 00:00
-
-jobs:
-  nix-flake-update:
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: DeterminateSystems/determinate-nix-action@v3
-      - uses: DeterminateSystems/update-flake-lock@main
-        with:
-          pr-title: "Update Nix flake"
-          pr-labels: |
-            dependencies
--- a/.github/workflows/cron-licenses.yml
+++ b/.github/workflows/cron-licenses.yml
@@ -9,10 +9,8 @@ jobs:
  cron-licenses:
    runs-on: ubuntu-latest
    if: github.repository == 'go-gitea/gitea'
-    permissions:
-      contents: write
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -20,7 +18,7 @@ jobs:
      - run: make generate-gitignore
        timeout-minutes: 40
      - name: push translations to repo
-        uses: appleboy/git-push-action@v1.2.0
+        uses: appleboy/git-push-action@v0.0.3
        with:
          author_email: "teabot@gitea.io"
          author_name: GiteaBot
--- a/.github/workflows/cron-translations.yml
+++ b/.github/workflows/cron-translations.yml
@@ -9,11 +9,9 @@ jobs:
  crowdin-pull:
    runs-on: ubuntu-latest
    if: github.repository == 'go-gitea/gitea'
-    permissions:
-      contents: write
    steps:
-      - uses: actions/checkout@v6
-      - uses: crowdin/github-action@v2
+      - uses: actions/checkout@v4
+      - uses: crowdin/github-action@v1
        with:
          upload_sources: true
          upload_translations: false
@@ -29,7 +27,7 @@ jobs:
      - name: update locales
        run: ./build/update-locales.sh
      - name: push translations to repo
-        uses: appleboy/git-push-action@v1.2.0
+        uses: appleboy/git-push-action@v0.0.3
        with:
          author_email: "teabot@gitea.io"
          author_name: GiteaBot
--- a/.github/workflows/files-changed.yml
+++ b/.github/workflows/files-changed.yml
@@ -19,15 +19,11 @@ on:
        value: ${{ jobs.detect.outputs.swagger }}
      yaml:
        value: ${{ jobs.detect.outputs.yaml }}
-      json:
-        value: ${{ jobs.detect.outputs.json }}

 jobs:
  detect:
    runs-on: ubuntu-latest
    timeout-minutes: 3
-    permissions:
-      contents: read
    outputs:
      backend: ${{ steps.changes.outputs.backend }}
      frontend: ${{ steps.changes.outputs.frontend }}
@@ -37,10 +33,9 @@ jobs:
      docker: ${{ steps.changes.outputs.docker }}
      swagger: ${{ steps.changes.outputs.swagger }}
      yaml: ${{ steps.changes.outputs.yaml }}
-      json: ${{ steps.changes.outputs.json }}
    steps:
-      - uses: actions/checkout@v6
-      - uses: dorny/paths-filter@v4
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
        id: changes
        with:
          filters: |
@@ -53,7 +48,7 @@ jobs:
              - "Makefile"
              - ".golangci.yml"
              - ".editorconfig"
-              - "options/locale/locale_en-US.json"
+              - "options/locale/locale_en-US.ini"

            frontend:
              - "*.js"
@@ -85,7 +80,6 @@ jobs:
              - "uv.lock"

            docker:
-              - ".github/workflows/pull-docker-dryrun.yml"
              - "Dockerfile"
              - "Dockerfile.rootless"
              - "docker/**"
@@ -104,6 +98,3 @@ jobs:
              - "**/*.yaml"
              - ".yamllint.yaml"
              - "pyproject.toml"
-
-            json:
-              - "**/*.json"
--- a/.github/workflows/pull-compliance.yml
+++ b/.github/workflows/pull-compliance.yml
@@ -10,17 +10,13 @@ concurrency:
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
-    permissions:
-      contents: read

  lint-backend:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -34,18 +30,14 @@ jobs:
    if: needs.files-changed.outputs.templates == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v8.0.0
-      - run: uv python install 3.14
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv python install 3.12
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-py
      - run: make deps-frontend
      - run: make lint-templates
@@ -54,44 +46,23 @@ jobs:
    if: needs.files-changed.outputs.yaml == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v8.0.0
-      - run: uv python install 3.14
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv python install 3.12
      - run: make deps-py
      - run: make lint-yaml

-  lint-json:
-    if: needs.files-changed.outputs.json == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v5
-        with:
-          node-version: 24
-      - run: make deps-frontend
-      - run: make lint-json
-
  lint-swagger:
    if: needs.files-changed.outputs.swagger == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend
      - run: make lint-swagger

@@ -99,10 +70,8 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true' || needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.templates == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -113,10 +82,8 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -132,10 +99,8 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -149,10 +114,8 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -164,16 +127,12 @@ jobs:
    if: needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend
      - run: make lint-frontend
      - run: make checks-frontend
@@ -184,10 +143,8 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -218,16 +175,12 @@ jobs:
    if: needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend
      - run: make lint-md

@@ -235,10 +188,8 @@ jobs:
    if: needs.files-changed.outputs.actions == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
--- a/.github/workflows/pull-db-tests.yml
+++ b/.github/workflows/pull-db-tests.yml
@@ -10,15 +10,11 @@ concurrency:
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
-    permissions:
-      contents: read

  test-pgsql:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    services:
      pgsql:
        image: postgres:14
@@ -42,7 +38,7 @@ jobs:
        ports:
          - "9000:9000"
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -63,39 +59,37 @@ jobs:
          RACE_ENABLED: true
          TEST_TAGS: gogit
          TEST_LDAP: 1
+          USE_REPO_TEST_DIR: 1

  test-sqlite:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          check-latest: true
      - run: make deps-backend
-      - run: GOEXPERIMENT='' make backend
+      - run: make backend
        env:
          TAGS: bindata gogit sqlite sqlite_unlock_notify
      - name: run migration tests
        run: make test-sqlite-migration
      - name: run tests
-        run: GOEXPERIMENT='' make test-sqlite
+        run: make test-sqlite
        timeout-minutes: 50
        env:
          TAGS: bindata gogit sqlite sqlite_unlock_notify
          RACE_ENABLED: true
          TEST_TAGS: gogit sqlite sqlite_unlock_notify
+          USE_REPO_TEST_DIR: 1

  test-unit:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    services:
      elasticsearch:
        image: elasticsearch:7.5.0
@@ -130,7 +124,7 @@ jobs:
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -148,7 +142,7 @@ jobs:
          RACE_ENABLED: true
          GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
      - name: unit-tests-gogit
-        run: GOEXPERIMENT='' make unit-test-coverage test-check
+        run: make unit-test-coverage test-check
        env:
          TAGS: bindata gogit
          RACE_ENABLED: true
@@ -158,8 +152,6 @@ jobs:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    services:
      mysql:
        # the bitnami mysql image has more options than the official one, it's easier to customize
@@ -185,7 +177,7 @@ jobs:
          - "587:587"
          - "993:993"
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -204,14 +196,13 @@ jobs:
        env:
          TAGS: bindata
          RACE_ENABLED: true
+          USE_REPO_TEST_DIR: 1
          TEST_INDEXER_CODE_ES_URL: "http://elastic:changeme@elasticsearch:9200"

  test-mssql:
    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    services:
      mssql:
        image: mcr.microsoft.com/mssql/server:2019-latest
@@ -226,7 +217,7 @@ jobs:
        ports:
          - 10000:10000
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
@@ -243,3 +234,4 @@ jobs:
        timeout-minutes: 50
        env:
          TAGS: bindata
+          USE_REPO_TEST_DIR: 1
--- a/.github/workflows/pull-docker-dryrun.yml
+++ b/.github/workflows/pull-docker-dryrun.yml
@@ -10,31 +10,26 @@ concurrency:
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
-    permissions:
-      contents: read

-  container:
-    if: needs.files-changed.outputs.docker == 'true'
+  regular:
+    if: needs.files-changed.outputs.docker == 'true' || needs.files-changed.outputs.actions == 'true'
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - name: Build regular container image
-        uses: docker/build-push-action@v7
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v5
        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: false
-          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
-      - name: Build rootless container image
-        uses: docker/build-push-action@v7
+          tags: gitea/gitea:linux-amd64
+
+  rootless:
+    if: needs.files-changed.outputs.docker == 'true' || needs.files-changed.outputs.actions == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    steps:
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v5
        with:
-          context: .
          push: false
-          platforms: linux/amd64,linux/arm64,linux/riscv64
          file: Dockerfile.rootless
-          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless
+          tags: gitea/gitea:linux-amd64
--- a/.github/workflows/pull-e2e-tests.yml
+++ b/.github/workflows/pull-e2e-tests.yml
@@ -10,34 +10,26 @@ concurrency:
 jobs:
  files-changed:
    uses: ./.github/workflows/files-changed.yml
-    permissions:
-      contents: read

  test-e2e:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true'
+    # the "test-e2e" won't pass, and it seems that there is no useful test, so skip
+    # if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.frontend == 'true' || needs.files-changed.outputs.actions == 'true'
+    if: false
    needs: files-changed
    runs-on: ubuntu-latest
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
-      - run: make deps-frontend
-      - run: make frontend
-      - run: make deps-backend
-      - run: make gitea-e2e
-      - run: make playwright
-      - run: make test-e2e
-        timeout-minutes: 10
+      - run: make deps-frontend frontend deps-backend
+      - run: pnpm exec playwright install --with-deps
+      - run: make test-e2e-sqlite
+        timeout-minutes: 40
        env:
-          FORCE_COLOR: 1
-          GITEA_TEST_E2E_DEBUG: 1
+          USE_REPO_TEST_DIR: 1
--- a/.github/workflows/pull-labeler.yml
+++ b/.github/workflows/pull-labeler.yml
@@ -15,6 +15,6 @@ jobs:
      contents: read
      pull-requests: write
    steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@v5
        with:
          sync-labels: true
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -11,10 +11,8 @@ concurrency:
 jobs:
  nightly-binary:
    runs-on: namespace-profile-gitea-release-binary
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
@@ -22,12 +20,10 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -35,7 +31,7 @@ jobs:
          TAGS: bindata sqlite sqlite_unlock_notify
      - name: import gpg key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -52,7 +48,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -60,76 +56,88 @@ jobs:
      - name: upload binaries to s3
        run: |
          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
-
-  nightly-container:
+  nightly-docker-rootful:
    runs-on: namespace-profile-gitea-release-docker
    permissions:
-      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
      - name: Get cleaned branch name
        id: clean_name
        run: |
          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@v6
-        id: meta
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          tags: |
-            type=raw,value=${{ steps.clean_name.outputs.branch }}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@v6
-        id: meta_rootless
-        with:
-          images: |-
-            gitea/gitea
-            ghcr.io/go-gitea/gitea
-          # each tag below will have the suffix of -rootless
-          flavor: |
-            suffix=-rootless
-          tags: |
-            type=raw,value=${{ steps.clean_name.outputs.branch }}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build regular docker image
-        uses: docker/build-push-action@v7
+      - name: fetch go modules
+        run: make vendor
+      - name: build rootful docker image
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
-          cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
+          tags: |-
+            gitea/gitea:${{ steps.clean_name.outputs.branch }}
+            ghcr.io/go-gitea/gitea:${{ steps.clean_name.outputs.branch }}
+  nightly-docker-rootless:
+    runs-on: namespace-profile-gitea-release-docker
+    permissions:
+      packages: write # to publish to ghcr.io
+    steps:
+      - uses: actions/checkout@v4
+      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
+      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
+      - run: git fetch --unshallow --quiet --tags --force
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - name: Get cleaned branch name
+        id: clean_name
+        run: |
+          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
+          echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GHCR using PAT
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: fetch go modules
+        run: make vendor
      - name: build rootless docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
+          platforms: linux/amd64,linux/arm64
          push: true
          file: Dockerfile.rootless
-          tags: ${{ steps.meta_rootless.outputs.tags }}
-          annotations: ${{ steps.meta_rootless.outputs.annotations }}
-          cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless
-          cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootless,mode=max
+          tags: |-
+            gitea/gitea:${{ steps.clean_name.outputs.branch }}-rootless
+            ghcr.io/go-gitea/gitea:${{ steps.clean_name.outputs.branch }}-rootless
--- a/.github/workflows/release-tag-rc.yml
+++ b/.github/workflows/release-tag-rc.yml
@@ -12,10 +12,8 @@ concurrency:
 jobs:
  binary:
    runs-on: namespace-profile-gitea-release-binary
-    permissions:
-      contents: read
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
@@ -23,12 +21,10 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -36,7 +32,7 @@ jobs:
          TAGS: bindata sqlite sqlite_unlock_notify
      - name: import gpg key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -53,7 +49,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -62,7 +58,7 @@ jobs:
        run: |
          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@v0.1.0
        with:
          gh-cli-version: 2.39.1
      - name: create github release
@@ -70,20 +66,18 @@ jobs:
          gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --draft --notes-from-tag dist/release/*
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-
-  container:
+  docker-rootful:
    runs-on: namespace-profile-gitea-release-docker
    permissions:
-      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/metadata-action@v6
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: |-
@@ -94,10 +88,38 @@ jobs:
          # 1.2.3-rc0
          tags: |
            type=semver,pattern={{version}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@v6
-        id: meta_rootless
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GHCR using PAT
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: build rootful docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/riscv64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+  docker-rootless:
+    runs-on: namespace-profile-gitea-release-docker
+    permissions:
+      packages: write # to publish to ghcr.io
+    steps:
+      - uses: actions/checkout@v4
+      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
+      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
+      - run: git fetch --unshallow --quiet --tags --force
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/metadata-action@v5
+        id: meta
        with:
          images: |-
            gitea/gitea
@@ -109,33 +131,23 @@ jobs:
          # 1.2.3-rc0
          tags: |
            type=semver,pattern={{version}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build regular container image
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-      - name: build rootless container image
-        uses: docker/build-push-action@v7
+      - name: build rootless docker image
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: true
          file: Dockerfile.rootless
-          tags: ${{ steps.meta_rootless.outputs.tags }}
-          annotations: ${{ steps.meta_rootless.outputs.annotations }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
--- a/.github/workflows/release-tag-version.yml
+++ b/.github/workflows/release-tag-version.yml
@@ -15,10 +15,9 @@ jobs:
  binary:
    runs-on: namespace-profile-gitea-release-binary
    permissions:
-      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
@@ -26,12 +25,10 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@v5
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v5
        with:
          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
      - run: make deps-frontend deps-backend
      # xgo build
      - run: make release
@@ -39,7 +36,7 @@ jobs:
          TAGS: bindata sqlite sqlite_unlock_notify
      - name: import gpg key
        id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v7
+        uses: crazy-max/ghaction-import-gpg@v6
        with:
          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
@@ -56,7 +53,7 @@ jobs:
          echo "Cleaned name is ${REF_NAME}"
          echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
      - name: configure aws
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -65,7 +62,7 @@ jobs:
        run: |
          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
      - name: Install GH CLI
-        uses: dev-hanz-ops/install-gh-cli-action@v0.2.1
+        uses: dev-hanz-ops/install-gh-cli-action@v0.1.0
        with:
          gh-cli-version: 2.39.1
      - name: create github release
@@ -73,20 +70,18 @@ jobs:
          gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --notes-from-tag dist/release/*
        env:
          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-
-  container:
+  docker-rootful:
    runs-on: namespace-profile-gitea-release-docker
    permissions:
-      contents: read
      packages: write # to publish to ghcr.io
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
      - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/metadata-action@v6
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: |-
@@ -101,10 +96,36 @@ jobs:
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}
            type=semver,pattern={{major}}.{{minor}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@v6
-        id: meta_rootless
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GHCR using PAT
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: build rootful docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/riscv64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+  docker-rootless:
+    runs-on: namespace-profile-gitea-release-docker
+    steps:
+      - uses: actions/checkout@v4
+      # fetch all commits instead of only the last as some branches are long lived and could have many between versions
+      # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
+      - run: git fetch --unshallow --quiet --tags --force
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/metadata-action@v5
+        id: meta
        with:
          images: |-
            gitea/gitea
@@ -121,33 +142,23 @@ jobs:
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}
            type=semver,pattern={{major}}.{{minor}}
-          annotations: |
-            org.opencontainers.image.authors="maintainers@gitea.io"
      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to GHCR using PAT
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: build regular container image
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/riscv64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          annotations: ${{ steps.meta.outputs.annotations }}
-      - name: build rootless container image
-        uses: docker/build-push-action@v7
+      - name: build rootless docker image
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/riscv64
          push: true
          file: Dockerfile.rootless
-          tags: ${{ steps.meta_rootless.outputs.tags }}
-          annotations: ${{ steps.meta_rootless.outputs.annotations }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
--- a/.gitignore
+++ b/.gitignore
@@ -25,9 +25,6 @@ __debug_bin*
 # Visual Studio
 /.vs/

-# mise version managment tool
-mise.toml
-
 *.cgo1.go
 *.cgo2.c
 _cgo_defun.c
@@ -55,7 +52,6 @@ cpu.out
 *.log.*.gz

 /gitea
-/gitea-e2e
 /gitea-vet
 /debug
 /integrations.test
@@ -68,9 +64,13 @@ cpu.out
 /indexers
 /log
 /public/assets/img/avatar
-/tests/e2e-output
 /tests/integration/gitea-integration-*
 /tests/integration/indexers-*
+/tests/e2e/gitea-e2e-*
+/tests/e2e/indexers-*
+/tests/e2e/reports
+/tests/e2e/test-artifacts
+/tests/e2e/test-snapshots
 /tests/*.ini
 /tests/**/*.git/**/*.sample
 /node_modules
@@ -79,7 +79,6 @@ cpu.out
 /yarn-error.log
 /npm-debug.log*
 /.pnpm-store
-/public/assets/.vite
 /public/assets/js
 /public/assets/css
 /public/assets/fonts
@@ -87,7 +86,10 @@ cpu.out
 /vendor
 /VERSION
 /.air
+/.go-licenses

+# Files and folders that were previously generated
+/public/assets/img/webpack

 # Snapcraft
 /gitea_a*.txt
@@ -116,10 +118,7 @@ prime/
 /.goosehints
 /.windsurfrules
 /.github/copilot-instructions.md
+/AGENT.md
+/CLAUDE.md
 /llms.txt

-# Ignore worktrees when working on multiple branches
-.worktrees/
-
-# A Makefile for custom make targets
-Makefile.local
--- a/.gitpod.yml
+++ b/.gitpod.yml
@@ -0,0 +1,51 @@
+tasks:
+  - name: Setup
+    init: |
+      cp -r contrib/ide/vscode .vscode
+      make deps
+      make build
+    command: |
+      gp sync-done setup
+      exit 0
+  - name: Run backend
+    command: |
+      gp sync-await setup
+
+      # Get the URL and extract the domain
+      url=$(gp url 3000)
+      domain=$(echo $url | awk -F[/:] '{print $4}')
+
+      if [ -f custom/conf/app.ini ]; then
+        sed -i "s|^ROOT_URL =.*|ROOT_URL = ${url}/|" custom/conf/app.ini
+        sed -i "s|^DOMAIN =.*|DOMAIN = ${domain}|" custom/conf/app.ini
+        sed -i "s|^SSH_DOMAIN =.*|SSH_DOMAIN = ${domain}|" custom/conf/app.ini
+        sed -i "s|^NO_REPLY_ADDRESS =.*|SSH_DOMAIN = noreply.${domain}|" custom/conf/app.ini
+      else
+        mkdir -p custom/conf/
+        echo -e "[server]\nROOT_URL = ${url}/" > custom/conf/app.ini
+        echo -e "\n[database]\nDB_TYPE = sqlite3\nPATH = $GITPOD_REPO_ROOT/data/gitea.db" >> custom/conf/app.ini
+      fi
+      export TAGS="sqlite sqlite_unlock_notify"
+      make watch-backend
+  - name: Run frontend
+    command: |
+      gp sync-await setup
+      make watch-frontend
+    openMode: split-right
+
+vscode:
+  extensions:
+    - editorconfig.editorconfig
+    - dbaeumer.vscode-eslint
+    - golang.go
+    - stylelint.vscode-stylelint
+    - DavidAnson.vscode-markdownlint
+    - Vue.volar
+    - ms-azuretools.vscode-docker
+    - vitest.explorer
+    - cweijan.vscode-database-client2
+    - GitHub.vscode-pull-request-github
+
+ports:
+  - name: Gitea
+    port: 3000
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -6,19 +6,15 @@ linters:
  default: none
  enable:
    - bidichk
-    - bodyclose
    - depguard
    - dupl
    - errcheck
    - forbidigo
-    - gocheckcompilerdirectives
    - gocritic
    - govet
    - ineffassign
    - mirror
-    - modernize
    - nakedret
-    - nilnil
    - nolintlint
    - perfsprint
    - revive
@@ -49,8 +45,6 @@ linters:
              desc: do not use the ini package, use gitea's config system instead
            - pkg: gitea.com/go-chi/cache
              desc: do not use the go-chi cache package, use gitea's cache system
-            - pkg: github.com/pkg/errors
-              desc: use builtin errors package instead
    nolintlint:
      allow-unused: false
      require-explanation: true
@@ -61,28 +55,38 @@ linters:
      disabled-checks:
        - ifElseChain
        - singleCaseSwitch # Every time this occurred in the code, there was no other way.
-        - deprecatedComment # conflicts with go-swagger comments
    revive:
      severity: error
      rules:
+        - name: atomic
+        - name: bare-return
        - name: blank-imports
        - name: constant-logical-expr
        - name: context-as-argument
        - name: context-keys-type
        - name: dot-imports
+        - name: duplicated-imports
        - name: empty-lines
+        - name: error-naming
        - name: error-return
        - name: error-strings
+        - name: errorf
        - name: exported
        - name: identical-branches
        - name: if-return
        - name: increment-decrement
+        - name: indent-error-flow
        - name: modifies-value-receiver
        - name: package-comments
+        - name: range
+        - name: receiver-naming
        - name: redefines-builtin-id
+        - name: string-of-int
        - name: superfluous-else
        - name: time-naming
+        - name: unconditional-recursion
        - name: unexported-return
+        - name: unreachable-code
        - name: var-declaration
        - name: var-naming
          arguments:
@@ -103,12 +107,6 @@ linters:
        - require-error
    usetesting:
      os-temp-dir: true
-    perfsprint:
-      concat-loop: false
-    govet:
-      enable:
-        - nilness
-        - unusedwrite
  exclusions:
    generated: lax
    presets:
@@ -120,12 +118,16 @@ linters:
      - linters:
          - dupl
          - errcheck
+          - gocyclo
+          - gosec
          - staticcheck
          - unparam
        path: _test\.go
      - linters:
          - dupl
          - errcheck
+          - gocyclo
+          - gosec
        path: models/migrations/v
      - linters:
          - forbidigo
@@ -137,8 +139,12 @@ linters:
          - gocritic
        text: (?i)`ID' should not be capitalized
      - linters:
+          - deadcode
          - unused
        text: (?i)swagger
+      - linters:
+          - staticcheck
+        text: (?i)argument x is overwritten before first use
      - linters:
          - gocritic
        text: '(?i)commentFormatting: put a space between `//` and comment text'
@@ -147,7 +153,6 @@ linters:
        text: '(?i)exitAfterDefer:'
    paths:
      - node_modules
-      - .venv
      - public
      - web_src
      - third_party$
@@ -167,7 +172,6 @@ formatters:
    generated: lax
    paths:
      - node_modules
-      - .venv
      - public
      - web_src
      - third_party$
--- a/.yamllint.yaml
+++ b/.yamllint.yaml
@@ -21,7 +21,9 @@ rules:
  comments-indentation:
    level: error

-  document-start: disable
+  document-start:
+    level: error
+    present: false

  document-end:
    present: false
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,11 +0,0 @@
- Use `make help` to find available development targets
- Run `make fmt` to format `.go` files, and run `make lint-go` to lint them
- Run `make lint-js` to lint `.ts` files
- Run `make tidy` after any `go.mod` changes
- Add the current year into the copyright header of new `.go` files
- Ensure no trailing whitespace in edited files
- Never force-push, amend, or squash unless asked. Use new commits and normal push for pull request updates
- Preserve existing code comments, do not remove or rewrite comments that are still relevant
- In TypeScript, use `!` (non-null assertion) instead of `?.`/`??` when a value is known to always exist
- Include authorship attribution in issue and pull request comments
- Add `Co-Authored-By` lines to all commits, indicating name and model used
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,86 +4,7 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).

-## [1.25.5](https://github.com/go-gitea/gitea/releases/tag/v1.25.5) - 2026-03-10
-
-* SECURITY
-  * Toolchain Update to Go 1.25.6 (#36480) (#36487)
-  * Adjust the toolchain version (#36537) (#36542)
-  * Update toolchain to 1.25.8 for v1.25 (#36888)
-  * Prevent redirect bypasses via backslash-encoded paths (#36660) (#36716)
-  * Fix get release draft permission check (#36659) (#36715)
-  * Fix a bug user could change another user's primary email (#36586) (#36607)
-  * Fix OAuth2 authorization code expiry and reuse handling (#36797) (#36851)
-  * Add validation constraints for repository creation fields (#36671) (#36757)
-  * Fix bug to check whether user can update pull request branch or rebase branch (#36465) (#36838)
-  * Add migration http transport for push/sync mirror lfs (#36665) (#36691)
-  * Fix track time list permission check (#36662) (#36744)
-  * Fix track time issue id (#36664) (#36689)
-  * Fix path resolving (#36734) (#36746)
-  * Fix dump release asset bug (#36799) (#36839)
-  * Fix org permission API visibility checks for hidden members and private orgs (#36798) (#36841)
-  * Fix forwarded proto handling for public URL detection (#36810) (#36836)
-  * Add a git grep search timeout (#36809) (#36835)
-  * Fix oauth2 s256 (#36462) (#36477)
-* ENHANCEMENTS
-  * Make `security-check` informational only (#36681) (#36852)
-  * Upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (#36840)
-  * Add some validation on values provided to USER_DISABLED_FEATURES and EXTERNAL_USER_DISABLED_FEATURES (#36688) (#36692)
-  * Upgrade gogit to 5.16.5 (#36687)
-  * Add wrap to runner label list (#36565) (#36574)
-  * Add dnf5 command for Fedora in RPM package instructions (#36527) (#36572)
-  * Allow scroll propagation outside code editor (#36502) (#36510)
-* BUGFIXES
-  * Fix non-admins unable to automerge PRs from forks (#36833) (#36843)
-  * Fix bug when pushing mirror with wiki (#36795) (#36807)
-  * Fix artifacts v4 backend upload problems (#36805) (#36834)
-  * Fix CRAN package version validation to allow more than 4 version components (#36813) (#36821)
-  * Fix force push time-line commit comments of pull request (#36653) (#36717)
-  * Fix SVG height calculation in diff viewer (#36748) (#36750)
-  * Fix push time bug (#36693) (#36713)
-  * Fix bug the protected branch rule name is conflicted with renamed branch name (#36650) (#36661)
-  * Fix bug when do LFS GC (#36500) (#36608)
-  * Fix focus lost bugs in the Monaco editor (#36609)
-  * Reprocess htmx content after loading more files (#36568) (#36577)
-  * Fix assignee sidebar links and empty placeholder (#36559) (#36563)
-  * Fix issues filter dropdown showing empty label scope section (#36535) (#36544)
-  * Fix various mermaid bugs (#36547) (#36552)
-  * Fix data race when uploading container blobs concurrently (#36524) (#36526)
-  * Correct spacing between username and bot label (#36473) (#36484)
-
-## [1.25.4](https://github.com/go-gitea/gitea/releases/tag/v1.25.4) - 2026-01-15
-
-* SECURITY
-  * Release attachments must belong to the intended repo (#36347) (#36375)
-  * Fix permission check on org project operations (#36318) (#36373)
-  * Clean watches when make a repository private and check permission when send release emails (#36319) (#36370)
-  * Add more check for stopwatch read or list (#36340) (#36368)
-  * Fix openid setting check (#36346) (#36361)
-  * Fix cancel auto merge bug (#36341) (#36356)
-  * Fix delete attachment check (#36320) (#36355)
-  * LFS locks must belong to the intended repo (#36344) (#36349)
-  * Fix bug on notification read (#36339) #36387
-* ENHANCEMENTS
-  * Add more routes to the "expensive" list (#36290)
-  * Make "commit statuses" API accept slashes in "ref" (#36264) (#36275)
-* BUGFIXES
-  * Fix git http service handling (#36396)
-  * Fix markdown newline handling during IME composition (#36421) (#36424)
-  * Fix missing repository id when migrating release attachments (#36389)
-  * Fix bug when compare in the pull request (#36363) (#36372)
-  * Fix incorrect text content detection (#36364) (#36369)
-  * Fill missing `has_code` in repository api (#36338) (#36359)
-  * Fix notifications pagination query parameters (#36351) (#36358)
-  * Fix some trivial problems (#36336) (#36337)
-  * Prevent panic when GitLab release has more links than sources (#36295) (#36305)
-  * Fix stats bug when syncing release (#36285) (#36294)
-  * Always honor user's choice for "delete branch after merge" (#36281) (#36286)
-  * Use the requested host for LFS links (#36242) (#36258)
-  * Fix panic when get editor config file (#36241) (#36247)
-  * Fix regression in writing authorized principals (#36213) (#36218)
-  * Fix WebAuthn error checking (#36219) (#36235)
-
-## [1.25.3](https://github.com/go-gitea/gitea/releases/tag/v1.25.3) - 2025-12-17
+## [1.25.3](https://github.com/go-gitea/gitea/releases/tag/1.25.3) - 2025-12-17

 * SECURITY
  * Bump toolchain to go1.25.5, misc fixes (#36082)
@@ -110,7 +31,7 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
  * Fix error handling in mailer and wiki services (#36041) (#36053)
  * Fix bugs when comparing and creating pull request (#36166) (#36144)

-## [1.25.2](https://github.com/go-gitea/gitea/releases/tag/v1.25.2) - 2025-11-23
+## [1.25.2](https://github.com/go-gitea/gitea/releases/tag/1.25.2) - 2025-11-23

 * SECURITY
  * Upgrade golang.org/x/crypto to 0.45.0 (#35985) (#35988)
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1 +0,0 @@
-@AGENTS.md
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -4,7 +4,6 @@

 - [Contribution Guidelines](#contribution-guidelines)
  - [Introduction](#introduction)
-  - [AI Contribution Policy](#ai-contribution-policy)
  - [Issues](#issues)
    - [How to report issues](#how-to-report-issues)
    - [Types of issues](#types-of-issues)
@@ -68,21 +67,6 @@ Sensitive security-related issues should be reported to [security@gitea.io](mail

 For configuring IDEs for Gitea development, see the [contributed IDE configurations](contrib/ide/).

-## AI Contribution Policy
-
-Contributions made with the assistance of AI tools are welcome, but contributors must use them responsibly and disclose that use clearly.
-
-1. Review AI-generated code closely before marking a pull request ready for review.
-2. Manually test the changes and add appropriate automated tests where feasible.
-3. Only use AI to assist in contributions that you understand well enough to explain, defend, and revise yourself during review.
-4. Disclose AI-assisted content clearly.
-5. Do not use AI to reply to questions about your issue or pull request. The questions are for you, not an AI model.
-6. AI may be used to help draft issues and pull requests, but contributors remain responsible for the accuracy, completeness, and intent of what they submit.
-
-Maintainers reserve the right to close pull requests and issues that do not disclose AI assistance, that appear to be low-quality AI-generated content, or where the contributor cannot explain or defend the proposed changes themselves.
-
-We welcome new contributors, but cannot sustain the effort of supporting contributors who primarily defer to AI rather than engaging substantively with the review process.
-
 ## Issues

 ### How to report issues
@@ -96,7 +80,7 @@ The more detailed and specific you are, the faster we can fix the issue. \
 It is really helpful if you can reproduce your problem on a site running on the latest commits, i.e. <https://demo.gitea.com>, as perhaps your problem has already been fixed on a current version. \
 Please follow the guidelines described in [How to Report Bugs Effectively](http://www.chiark.greenend.org.uk/~sgtatham/bugs.html) for your report.

-Please be kind—remember that Gitea comes at no cost to you, and you're getting free help.
+Please be kind, remember that Gitea comes at no cost to you, and you're getting free help.

 ### Types of issues

@@ -182,32 +166,24 @@ Here's how to run the test suite:

 - code lint

-|                       |                                                                              |
-| :-------------------- | :--------------------------------------------------------------------------- |
+|                       |                                                                   |
+| :-------------------- | :---------------------------------------------------------------- |
 |``make lint``          | lint everything (not needed if you only change the front- **or** backend)    |
-|``make lint-frontend`` | lint frontend files                                                          |
-|``make lint-backend``  | lint backend files                                                           |
+|``make lint-frontend`` | lint frontend files  |
+|``make lint-backend``  | lint backend files   |

 - run tests (we suggest running them on Linux)

-|  Command                                    | Action                                                   |                                             |
-| :------------------------------------------ | :------------------------------------------------------- | ------------------------------------------- |
-|``make test[\#SpecificTestName]``            |  run unit test(s)                                        |                                             |
-|``make test-sqlite[\#SpecificTestName]``     |  run [integration](tests/integration) test(s) for SQLite | [More details](tests/integration/README.md) |
-|``make test-e2e``                            |  run [end-to-end](tests/e2e) test(s) using Playwright    |                                             |
-
- E2E test environment variables
-
-| Variable                          | Description                                                 |
-| :-------------------------------- | :---------------------------------------------------------- |
-| ``GITEA_TEST_E2E_DEBUG``          | When set, show Gitea server output                          |
-| ``GITEA_TEST_E2E_FLAGS``          | Additional flags passed to Playwright, for example ``--ui`` |
-| ``GITEA_TEST_E2E_TIMEOUT_FACTOR`` | Timeout multiplier (default: 3 on CI, 1 locally)            |
+|  Command                               | Action                                           |              |
+| :------------------------------------- | :----------------------------------------------- | ------------ |
+|``make test[\#SpecificTestName]``       |  run unit test(s)  | |
+|``make test-sqlite[\#SpecificTestName]``|  run [integration](tests/integration) test(s) for SQLite |[More details](tests/integration/README.md)  |
+|``make test-e2e-sqlite[\#SpecificTestName]``|  run [end-to-end](tests/e2e) test(s) for SQLite |[More details](tests/e2e/README.md)  |

 ## Translation

 All translation work happens on [Crowdin](https://translate.gitea.com).
-The only translation that is maintained in this repository is [the English translation](https://github.com/go-gitea/gitea/blob/main/options/locale/locale_en-US.json).
+The only translation that is maintained in this repository is [the English translation](https://github.com/go-gitea/gitea/blob/main/options/locale/locale_en-US.ini).
 It is synced regularly with Crowdin. \
 Other locales on main branch **should not** be updated manually as they will be overwritten with each sync. \
 Once a language has reached a **satisfactory percentage** of translated keys (~25%), it will be synced back into this repo and included in the next released version.
--- a/61
+++ b/61
@@ -1,15 +1,8 @@
-# syntax=docker/dockerfile:1
-# Build frontend on the native platform to avoid QEMU-related issues with nodejs ecosystem
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-alpine3.23 AS frontend-build
-RUN apk --no-cache add build-base git nodejs pnpm
-WORKDIR /src
-COPY package.json pnpm-lock.yaml .npmrc ./
-RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install --frozen-lockfile
-COPY --exclude=.git/ . .
-RUN make frontend
+# Build stage
+FROM docker.io/library/golang:1.25-alpine3.22 AS build-env

-# Build backend for each target platform
-FROM docker.io/library/golang:1.26-alpine3.23 AS build-env
+ARG GOPROXY
+ENV GOPROXY=${GOPROXY:-direct}

 ARG GITEA_VERSION
 ARG TAGS="sqlite sqlite_unlock_notify"
@@ -19,32 +12,37 @@ ARG CGO_EXTRA_CFLAGS
 # Build deps
 RUN apk --no-cache add \
    build-base \
-    git
+    git \
+    nodejs \
+    npm \
+    && npm install -g pnpm@10 \
+    && rm -rf /var/cache/apk/*

+# Setup repo
+COPY . ${GOPATH}/src/code.gitea.io/gitea
 WORKDIR ${GOPATH}/src/code.gitea.io/gitea
-COPY go.mod go.sum ./
-RUN go mod download
-# Use COPY instead of bind mount as read-only one breaks makefile state tracking and read-write one needs binary to be moved as it's discarded.
-# ".git" directory is mounted separately later only for version data extraction.
-COPY --exclude=.git/ . .
-COPY --from=frontend-build /src/public/assets public/assets

-# Build gitea, .git mount is required for version data
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    --mount=type=bind,source=".git/",target=".git/" \
-    make backend
+# Checkout version if set
+RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
+ && make clean-all build

+# Begin env-to-ini build
+RUN go build contrib/environment-to-ini/environment-to-ini.go
+
+# Copy local files
 COPY docker/root /tmp/local

-# Set permissions for builds that made under windows which strips the executable bit from file
+# Set permissions
 RUN chmod 755 /tmp/local/usr/bin/entrypoint \
-              /tmp/local/usr/local/bin/* \
+              /tmp/local/usr/local/bin/gitea \
              /tmp/local/etc/s6/gitea/* \
              /tmp/local/etc/s6/openssh/* \
              /tmp/local/etc/s6/.s6-svscan/* \
-              /go/src/code.gitea.io/gitea/gitea
+              /go/src/code.gitea.io/gitea/gitea \
+              /go/src/code.gitea.io/gitea/environment-to-ini

-FROM docker.io/library/alpine:3.23 AS gitea
+FROM docker.io/library/alpine:3.22
+LABEL maintainer="maintainers@gitea.io"

 EXPOSE 22 3000

@@ -59,7 +57,8 @@ RUN apk --no-cache add \
    s6 \
    sqlite \
    su-exec \
-    gnupg
+    gnupg \
+    && rm -rf /var/cache/apk/*

 RUN addgroup \
    -S -g 1000 \
@@ -73,14 +72,14 @@ RUN addgroup \
    git && \
  echo "git:*" | chpasswd -e

-COPY --from=build-env /tmp/local /
-COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
-
 ENV USER=git
 ENV GITEA_CUSTOM=/data/gitea

 VOLUME ["/data"]

-# HINT: HEALTH-CHECK-ENDPOINT: don't use HEALTHCHECK, search this hint keyword for more information
 ENTRYPOINT ["/usr/bin/entrypoint"]
 CMD ["/usr/bin/s6-svscan", "/etc/s6"]
+
+COPY --from=build-env /tmp/local /
+COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+COPY --from=build-env /go/src/code.gitea.io/gitea/environment-to-ini /usr/local/bin/environment-to-ini
--- a/Dockerfile.rootless
+++ b/Dockerfile.rootless
@@ -1,45 +1,46 @@
-# syntax=docker/dockerfile:1
-# Build frontend on the native platform to avoid QEMU-related issues with nodejs ecosystem
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-alpine3.23 AS frontend-build
-RUN apk --no-cache add build-base git nodejs pnpm
-WORKDIR /src
-COPY package.json pnpm-lock.yaml .npmrc ./
-RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install --frozen-lockfile
-COPY --exclude=.git/ . .
-RUN make frontend
+# Build stage
+FROM docker.io/library/golang:1.25-alpine3.22 AS build-env

-# Build backend for each target platform
-FROM docker.io/library/golang:1.26-alpine3.23 AS build-env
+ARG GOPROXY
+ENV GOPROXY=${GOPROXY:-direct}

 ARG GITEA_VERSION
 ARG TAGS="sqlite sqlite_unlock_notify"
 ENV TAGS="bindata timetzdata $TAGS"
 ARG CGO_EXTRA_CFLAGS

-# Build deps
+#Build deps
 RUN apk --no-cache add \
    build-base \
-    git
+    git \
+    nodejs \
+    npm \
+    && npm install -g pnpm@10 \
+    && rm -rf /var/cache/apk/*

+# Setup repo
+COPY . ${GOPATH}/src/code.gitea.io/gitea
 WORKDIR ${GOPATH}/src/code.gitea.io/gitea
-COPY go.mod go.sum ./
-RUN go mod download
-# See the comments in Dockerfile
-COPY --exclude=.git/ . .
-COPY --from=frontend-build /src/public/assets public/assets

-# Build gitea, .git mount is required for version data
-RUN --mount=type=cache,target="/root/.cache/go-build" \
-    --mount=type=bind,source=".git/",target=".git/" \
-    make backend
+# Checkout version if set
+RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
+ && make clean-all build

+# Begin env-to-ini build
+RUN go build contrib/environment-to-ini/environment-to-ini.go
+
+# Copy local files
 COPY docker/rootless /tmp/local

-# Set permissions for builds that made under windows which strips the executable bit from file
-RUN chmod 755 /tmp/local/usr/local/bin/* \
-              /go/src/code.gitea.io/gitea/gitea
+# Set permissions
+RUN chmod 755 /tmp/local/usr/local/bin/docker-entrypoint.sh \
+              /tmp/local/usr/local/bin/docker-setup.sh \
+              /tmp/local/usr/local/bin/gitea \
+              /go/src/code.gitea.io/gitea/gitea \
+              /go/src/code.gitea.io/gitea/environment-to-ini

-FROM docker.io/library/alpine:3.23 AS gitea-rootless
+FROM docker.io/library/alpine:3.22
+LABEL maintainer="maintainers@gitea.io"

 EXPOSE 2222 3000

@@ -51,7 +52,8 @@ RUN apk --no-cache add \
    git \
    curl \
    gnupg \
-    openssh-keygen
+    openssh-keygen \
+    && rm -rf /var/cache/apk/*

 RUN addgroup \
    -S -g 1000 \
@@ -69,6 +71,7 @@ RUN chown git:git /var/lib/gitea /etc/gitea

 COPY --from=build-env /tmp/local /
 COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/environment-to-ini /usr/local/bin/environment-to-ini

 # git:git
 USER 1000:1000
@@ -83,6 +86,5 @@ ENV HOME="/var/lib/gitea/git"
 VOLUME ["/var/lib/gitea", "/etc/gitea"]
 WORKDIR /var/lib/gitea

-# HINT: HEALTH-CHECK-ENDPOINT: don't use HEALTHCHECK, search this hint keyword for more information
 ENTRYPOINT ["/usr/bin/dumb-init", "--", "/usr/local/bin/docker-entrypoint.sh"]
 CMD []
--- a/1
+++ b/1
@@ -64,4 +64,3 @@ metiftikci <metiftikci@hotmail.com> (@metiftikci)
 Christopher Homberger <christopher.homberger@web.de> (@ChristopherHX)
 Tobias Balle-Petersen <tobiasbp@gmail.com> (@tobiasbp)
 TheFox <thefox0x7@gmail.com> (@TheFox0x7)
-Nicolas <bircni@icloud.com> (@bircni)
--- a/383
+++ b/383
@@ -1,9 +1,22 @@
+ifeq ($(USE_REPO_TEST_DIR),1)
+
+# This rule replaces the whole Makefile when we're trying to use /tmp repository temporary files
+location = $(CURDIR)/$(word $(words $(MAKEFILE_LIST)),$(MAKEFILE_LIST))
+self := $(location)
+
+%:
+	@tmpdir=`mktemp --tmpdir -d` ; \
+	echo Using temporary directory $$tmpdir for test repositories ; \
+	USE_REPO_TEST_DIR= $(MAKE) -f $(self) --no-print-directory REPO_TEST_DIR=$$tmpdir/ $@ ; \
+	STATUS=$$? ; rm -r "$$tmpdir" ; exit $$STATUS
+
+else
+
+# This is the "normal" part of the Makefile
+
 DIST := dist
 DIST_DIRS := $(DIST)/binaries $(DIST)/release
-
-# By default use go's 1.25 experimental json v2 library when building
-# TODO: remove when no longer experimental
-export GOEXPERIMENT ?= jsonv2
+IMPORT := code.gitea.io/gitea

 GO ?= go
 SHASUM ?= shasum -a 256
@@ -14,14 +27,17 @@ XGO_VERSION := go-1.25.x

 AIR_PACKAGE ?= github.com/air-verse/air@v1
 EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3
-GOFUMPT_PACKAGE ?= mvdan.cc/gofumpt@v0.9.2
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4
+GOFUMPT_PACKAGE ?= mvdan.cc/gofumpt@v0.9.1
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.4.0
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15
-MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.33.1
+MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.7.0
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@717e3cb29becaaf00e56953556c6d80f8a01b286
 XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
+GO_LICENSES_PACKAGE ?= github.com/google/go-licenses@v1
 GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1
-ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.11
+ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.8
+GOPLS_PACKAGE ?= golang.org/x/tools/gopls@v0.20.0
+GOPLS_MODERNIZE_PACKAGE ?= golang.org/x/tools/gopls/internal/analysis/modernize/cmd/modernize@v0.20.0

 DOCKER_IMAGE ?= gitea/gitea
 DOCKER_TAG ?= latest
@@ -53,11 +69,9 @@ endif
 ifeq ($(IS_WINDOWS),yes)
 	GOFLAGS := -v -buildmode=exe
 	EXECUTABLE ?= gitea.exe
-	EXECUTABLE_E2E ?= gitea-e2e.exe
 else
 	GOFLAGS := -v
 	EXECUTABLE ?= gitea
-	EXECUTABLE_E2E ?= gitea-e2e
 endif

 ifeq ($(shell sed --version 2>/dev/null | grep -q GNU && echo gnu),gnu)
@@ -68,6 +82,7 @@ endif

 EXTRA_GOFLAGS ?=

+MAKE_VERSION := $(shell "$(MAKE)" -v | cat | head -n 1)
 MAKE_EVIDENCE_DIR := .make_evidence

 GOTESTFLAGS ?=
@@ -81,6 +96,15 @@ STORED_VERSION_FILE := VERSION
 GITHUB_REF_TYPE ?= branch
 GITHUB_REF_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)

+# Enable typescript support in Node.js before 22.18
+# TODO: Remove this once we can raise the minimum Node.js version to 22.18 (alpine >= 3.23)
+NODE_VERSION := $(shell printf "%03d%03d%03d" $(shell node -v 2>/dev/null | cut -c2- | tr '.' ' '))
+ifeq ($(shell test "$(NODE_VERSION)" -lt "022018000"; echo $$?),0)
+	NODE_VARS := NODE_OPTIONS="--experimental-strip-types"
+else
+	NODE_VARS :=
+endif
+
 ifneq ($(GITHUB_REF_TYPE),branch)
 	VERSION ?= $(subst v,,$(GITHUB_REF_NAME))
 	GITEA_VERSION ?= $(VERSION)
@@ -104,18 +128,17 @@ ifeq ($(VERSION),main)
 	VERSION := main-nightly
 endif

-LDFLAGS := $(LDFLAGS) -X "main.Version=$(GITEA_VERSION)" -X "main.Tags=$(TAGS)"
+LDFLAGS := $(LDFLAGS) -X "main.MakeVersion=$(MAKE_VERSION)" -X "main.Version=$(GITEA_VERSION)" -X "main.Tags=$(TAGS)"

 LINUX_ARCHS ?= linux/amd64,linux/386,linux/arm-5,linux/arm-6,linux/arm64,linux/riscv64

-GO_TEST_PACKAGES ?= $(filter-out $(shell $(GO) list code.gitea.io/gitea/models/migrations/...) code.gitea.io/gitea/tests/integration/migration-test code.gitea.io/gitea/tests code.gitea.io/gitea/tests/integration,$(shell $(GO) list ./... | grep -v /vendor/))
+GO_TEST_PACKAGES ?= $(filter-out $(shell $(GO) list code.gitea.io/gitea/models/migrations/...) code.gitea.io/gitea/tests/integration/migration-test code.gitea.io/gitea/tests code.gitea.io/gitea/tests/integration code.gitea.io/gitea/tests/e2e,$(shell $(GO) list ./... | grep -v /vendor/))
 MIGRATE_TEST_PACKAGES ?= $(shell $(GO) list code.gitea.io/gitea/models/migrations/...)

-FRONTEND_SOURCES := $(shell find web_src/js web_src/css -type f)
-FRONTEND_CONFIGS := vite.config.ts tailwind.config.ts
-FRONTEND_DEST := public/assets/.vite/manifest.json
-FRONTEND_DEST_ENTRIES := public/assets/js public/assets/css public/assets/fonts public/assets/.vite
-FRONTEND_DEV_LOG_LEVEL ?= warn
+WEBPACK_SOURCES := $(shell find web_src/js web_src/css -type f)
+WEBPACK_CONFIGS := webpack.config.ts tailwind.config.ts
+WEBPACK_DEST := public/assets/js/index.js public/assets/css/index.css
+WEBPACK_DEST_ENTRIES := public/assets/js public/assets/css public/assets/fonts

 BINDATA_DEST_WILDCARD := modules/migration/bindata.* modules/public/bindata.* modules/options/bindata.* modules/templates/bindata.*

@@ -125,6 +148,7 @@ SVG_DEST_DIR := public/assets/img/svg

 AIR_TMP_DIR := .air

+GO_LICENSE_TMP_DIR := .go-licenses
 GO_LICENSE_FILE := assets/go-licenses.json

 TAGS ?=
@@ -133,21 +157,24 @@ TAGS_EVIDENCE := $(MAKE_EVIDENCE_DIR)/tags

 TEST_TAGS ?= $(TAGS_SPLIT) sqlite sqlite_unlock_notify

-TAR_EXCLUDES := .git data indexers queues log node_modules $(EXECUTABLE) $(DIST) $(MAKE_EVIDENCE_DIR) $(AIR_TMP_DIR)
+TAR_EXCLUDES := .git data indexers queues log node_modules $(EXECUTABLE) $(DIST) $(MAKE_EVIDENCE_DIR) $(AIR_TMP_DIR) $(GO_LICENSE_TMP_DIR)

-GO_DIRS := build cmd models modules routers services tests tools
+GO_DIRS := build cmd models modules routers services tests
 WEB_DIRS := web_src/js web_src/css

 ESLINT_FILES := web_src/js tools *.ts tests/e2e
 STYLELINT_FILES := web_src/css web_src/js/components/*.vue
-SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) templates options/locale/locale_en-US.json .github $(filter-out CHANGELOG.md, $(wildcard *.go *.md *.yml *.yaml *.toml))
-EDITORCONFIG_FILES := templates .github/workflows options/locale/locale_en-US.json
+SPELLCHECK_FILES := $(GO_DIRS) $(WEB_DIRS) templates options/locale/locale_en-US.ini .github $(filter-out CHANGELOG.md, $(wildcard *.go *.md *.yml *.yaml *.toml)) $(filter-out tools/misspellings.csv, $(wildcard tools/*))
+EDITORCONFIG_FILES := templates .github/workflows options/locale/locale_en-US.ini

 GO_SOURCES := $(wildcard *.go)
 GO_SOURCES += $(shell find $(GO_DIRS) -type f -name "*.go")
 GO_SOURCES += $(GENERATED_GO_DEST)

-ESLINT_CONCURRENCY ?= 2
+# Force installation of playwright dependencies by setting this flag
+ifdef DEPS_PLAYWRIGHT
+	PLAYWRIGHT_FLAGS += --with-deps
+endif

 SWAGGER_SPEC := templates/swagger/v1_json.tmpl
 SWAGGER_SPEC_INPUT := templates/swagger/v1_input.json
@@ -168,20 +195,26 @@ TEST_MSSQL_DBNAME ?= gitea
 TEST_MSSQL_USERNAME ?= sa
 TEST_MSSQL_PASSWORD ?= MwantsaSecurePassword1

-# Include local Makefile
-# Makefile.local is listed in .gitignore
-sinclude Makefile.local
-
 .PHONY: all
 all: build

 .PHONY: help
 help: Makefile ## print Makefile help information.
 	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m[TARGETS] default target: build\033[0m\n\n\033[35mTargets:\033[0m\n"} /^[0-9A-Za-z._-]+:.*?##/ { printf "  \033[36m%-45s\033[0m %s\n", $$1, $$2 }' Makefile #$(MAKEFILE_LIST)
-	@printf "  \033[36m%-46s\033[0m %s\n" "test-e2e" "test end to end using playwright"
+	@printf "  \033[36m%-46s\033[0m %s\n" "test-e2e[#TestSpecificName]" "test end to end using playwright"
 	@printf "  \033[36m%-46s\033[0m %s\n" "test[#TestSpecificName]" "run unit test"
 	@printf "  \033[36m%-46s\033[0m %s\n" "test-sqlite[#TestSpecificName]" "run integration test for sqlite"

+.PHONY: go-check
+go-check:
+	$(eval MIN_GO_VERSION_STR := $(shell grep -Eo '^go\s+[0-9]+\.[0-9]+' go.mod | cut -d' ' -f2))
+	$(eval MIN_GO_VERSION := $(shell printf "%03d%03d" $(shell echo '$(MIN_GO_VERSION_STR)' | tr '.' ' ')))
+	$(eval GO_VERSION := $(shell printf "%03d%03d" $(shell $(GO) version | grep -Eo '[0-9]+\.[0-9]+' | tr '.' ' ');))
+	@if [ "$(GO_VERSION)" -lt "$(MIN_GO_VERSION)" ]; then \
+		echo "Gitea requires Go $(MIN_GO_VERSION_STR) or greater to build. You can get it at https://go.dev/dl/"; \
+		exit 1; \
+	fi
+
 .PHONY: git-check
 git-check:
 	@if git lfs >/dev/null 2>&1 ; then : ; else \
@@ -189,24 +222,39 @@ git-check:
 		exit 1; \
 	fi

+.PHONY: node-check
+node-check:
+	$(eval MIN_NODE_VERSION_STR := $(shell grep -Eo '"node":.*[0-9.]+"' package.json | sed -n 's/.*[^0-9.]\([0-9.]*\)"/\1/p'))
+	$(eval MIN_NODE_VERSION := $(shell printf "%03d%03d%03d" $(shell echo '$(MIN_NODE_VERSION_STR)' | tr '.' ' ')))
+	$(eval PNPM_MISSING := $(shell hash pnpm > /dev/null 2>&1 || echo 1))
+	@if [ "$(NODE_VERSION)" -lt "$(MIN_NODE_VERSION)" ]; then \
+		echo "Gitea requires Node.js $(MIN_NODE_VERSION_STR) or greater to build. You can get it at https://nodejs.org/en/download/"; \
+		exit 1; \
+	fi
+	@if [ "$(PNPM_MISSING)" = "1" ]; then \
+		echo "Gitea requires pnpm to build. You can install it at https://pnpm.io/installation"; \
+		exit 1; \
+	fi
+
 .PHONY: clean-all
 clean-all: clean ## delete backend, frontend and integration files
-	rm -rf $(FRONTEND_DEST_ENTRIES) node_modules
+	rm -rf $(WEBPACK_DEST_ENTRIES) node_modules

 .PHONY: clean
 clean: ## delete backend and integration files
-	rm -rf $(EXECUTABLE) $(EXECUTABLE_E2E) $(DIST) $(BINDATA_DEST_WILDCARD) \
+	rm -rf $(EXECUTABLE) $(DIST) $(BINDATA_DEST_WILDCARD) \
 		integrations*.test \
+		e2e*.test \
 		tests/integration/gitea-integration-* \
 		tests/integration/indexers-* \
-		tests/sqlite.ini tests/mysql.ini tests/pgsql.ini tests/mssql.ini man/ \
+		tests/mysql.ini tests/pgsql.ini tests/mssql.ini man/ \
 		tests/e2e/gitea-e2e-*/ \
 		tests/e2e/indexers-*/ \
 		tests/e2e/reports/ tests/e2e/test-artifacts/ tests/e2e/test-snapshots/

 .PHONY: fmt
 fmt: ## format the Go and template code
-	@GOFUMPT_PACKAGE=$(GOFUMPT_PACKAGE) $(GO) run tools/code-batch-process.go gitea-fmt -w '{file-list}'
+	@GOFUMPT_PACKAGE=$(GOFUMPT_PACKAGE) $(GO) run build/code-batch-process.go gitea-fmt -w '{file-list}'
 	$(eval TEMPLATES := $(shell find templates -type f -name '*.tmpl'))
 	@# strip whitespace after '{{' or '(' and before '}}' or ')' unless there is only
 	@# whitespace before it
@@ -224,6 +272,19 @@ fmt-check: fmt
 	  exit 1; \
 	fi

+.PHONY: fix
+fix: ## apply automated fixes to Go code
+	$(GO) run $(GOPLS_MODERNIZE_PACKAGE) -fix ./...
+
+.PHONY: fix-check
+fix-check: fix
+	@diff=$$(git diff --color=always $(GO_SOURCES)); \
+	if [ -n "$$diff" ]; then \
+	  echo "Please run 'make fix' and commit the result:"; \
+	  printf "%s" "$${diff}"; \
+	  exit 1; \
+	fi
+
 .PHONY: $(TAGS_EVIDENCE)
 $(TAGS_EVIDENCE):
 	@mkdir -p $(MAKE_EVIDENCE_DIR)
@@ -263,7 +324,7 @@ checks: checks-frontend checks-backend ## run various consistency checks
 checks-frontend: lockfile-check svg-check ## check frontend files

 .PHONY: checks-backend
-checks-backend: tidy-check swagger-check fmt-check swagger-validate security-check ## check backend files
+checks-backend: tidy-check swagger-check fmt-check fix-check swagger-validate security-check ## check backend files

 .PHONY: lint
 lint: lint-frontend lint-backend lint-spell ## lint everything
@@ -278,48 +339,44 @@ lint-frontend: lint-js lint-css ## lint frontend files
 lint-frontend-fix: lint-js-fix lint-css-fix ## lint frontend files and fix issues

 .PHONY: lint-backend
-lint-backend: lint-go lint-go-gitea-vet lint-editorconfig ## lint backend files
+lint-backend: lint-go lint-go-gitea-vet lint-go-gopls lint-editorconfig ## lint backend files

 .PHONY: lint-backend-fix
 lint-backend-fix: lint-go-fix lint-go-gitea-vet lint-editorconfig ## lint backend files and fix issues

 .PHONY: lint-js
-lint-js: node_modules ## lint js and ts files
-	pnpm exec eslint --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY) $(ESLINT_FILES)
-	pnpm exec vue-tsc
+lint-js: node_modules ## lint js files
+	$(NODE_VARS) pnpm exec eslint --color --max-warnings=0 --flag unstable_native_nodejs_ts_config $(ESLINT_FILES)
+	$(NODE_VARS) pnpm exec vue-tsc

 .PHONY: lint-js-fix
-lint-js-fix: node_modules ## lint js and ts files and fix issues
-	pnpm exec eslint --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY) $(ESLINT_FILES) --fix
-	pnpm exec vue-tsc
+lint-js-fix: node_modules ## lint js files and fix issues
+	$(NODE_VARS) pnpm exec eslint --color --max-warnings=0 --flag unstable_native_nodejs_ts_config $(ESLINT_FILES) --fix
+	$(NODE_VARS) pnpm exec vue-tsc

 .PHONY: lint-css
 lint-css: node_modules ## lint css files
-	pnpm exec stylelint --color --max-warnings=0 $(STYLELINT_FILES)
+	$(NODE_VARS) pnpm exec stylelint --color --max-warnings=0 $(STYLELINT_FILES)

 .PHONY: lint-css-fix
 lint-css-fix: node_modules ## lint css files and fix issues
-	pnpm exec stylelint --color --max-warnings=0 $(STYLELINT_FILES) --fix
+	$(NODE_VARS) pnpm exec stylelint --color --max-warnings=0 $(STYLELINT_FILES) --fix

 .PHONY: lint-swagger
 lint-swagger: node_modules ## lint swagger files
-	pnpm exec spectral lint -q -F hint $(SWAGGER_SPEC)
+	$(NODE_VARS) pnpm exec spectral lint -q -F hint $(SWAGGER_SPEC)

 .PHONY: lint-md
 lint-md: node_modules ## lint markdown files
-	pnpm exec markdownlint *.md
-
-.PHONY: lint-md-fix
-lint-md-fix: node_modules ## lint markdown files and fix issues
-	pnpm exec markdownlint --fix *.md
+	$(NODE_VARS) pnpm exec markdownlint *.md

 .PHONY: lint-spell
 lint-spell: ## lint spelling
-	@git ls-files $(SPELLCHECK_FILES) | xargs go run $(MISSPELL_PACKAGE) -dict assets/misspellings.csv -error
+	@go run $(MISSPELL_PACKAGE) -dict tools/misspellings.csv -error $(SPELLCHECK_FILES)

 .PHONY: lint-spell-fix
 lint-spell-fix: ## lint spelling and fix issues
-	@git ls-files $(SPELLCHECK_FILES) | xargs go run $(MISSPELL_PACKAGE) -dict assets/misspellings.csv -w
+	@go run $(MISSPELL_PACKAGE) -dict tools/misspellings.csv -w $(SPELLCHECK_FILES)

 .PHONY: lint-go
 lint-go: ## lint go files
@@ -339,7 +396,13 @@ lint-go-windows:
 .PHONY: lint-go-gitea-vet
 lint-go-gitea-vet: ## lint go files with gitea-vet
 	@echo "Running gitea-vet..."
-	@$(GO) vet -vettool="$(shell GOOS= GOARCH= go tool -n gitea-vet)" ./...
+	@GOOS= GOARCH= $(GO) build code.gitea.io/gitea-vet
+	@$(GO) vet -vettool=gitea-vet ./...
+
+.PHONY: lint-go-gopls
+lint-go-gopls: ## lint go files with gopls
+	@echo "Running gopls check..."
+	@GO=$(GO) GOPLS_PACKAGE=$(GOPLS_PACKAGE) tools/lint-go-gopls.sh $(GO_SOURCES)

 .PHONY: lint-editorconfig
 lint-editorconfig:
@@ -359,24 +422,17 @@ lint-templates: .venv node_modules ## lint template files
 lint-yaml: .venv ## lint yaml files
 	@uv run --frozen yamllint -s .

-.PHONY: lint-json
-lint-json: node_modules ## lint json files
-	pnpm exec eslint -c eslint.json.config.ts --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY)
-
-.PHONY: lint-json-fix
-lint-json-fix: node_modules ## lint and fix json files
-	pnpm exec eslint -c eslint.json.config.ts --color --max-warnings=0 --concurrency $(ESLINT_CONCURRENCY) --fix
-
 .PHONY: watch
 watch: ## watch everything and continuously rebuild
 	@bash tools/watch.sh

 .PHONY: watch-frontend
-watch-frontend: node_modules ## start vite dev server for frontend
-	NODE_ENV=development pnpm exec vite --logLevel $(FRONTEND_DEV_LOG_LEVEL)
+watch-frontend: node-check node_modules ## watch frontend files and continuously rebuild
+	@rm -rf $(WEBPACK_DEST_ENTRIES)
+	NODE_ENV=development $(NODE_VARS) pnpm exec webpack --watch --progress --disable-interpret

 .PHONY: watch-backend
-watch-backend: ## watch backend files and continuously rebuild
+watch-backend: go-check ## watch backend files and continuously rebuild
 	GITEA_RUN_MODE=dev $(GO) run $(AIR_PACKAGE) -c .air.toml

 .PHONY: test
@@ -389,7 +445,7 @@ test-backend: ## test backend files

 .PHONY: test-frontend
 test-frontend: node_modules ## test frontend files
-	pnpm exec vitest
+	$(NODE_VARS) pnpm exec vitest

 .PHONY: test-check
 test-check:
@@ -412,7 +468,7 @@ test\#%:
 coverage:
 	grep '^\(mode: .*\)\|\(.*:[0-9]\+\.[0-9]\+,[0-9]\+\.[0-9]\+ [0-9]\+ [0-9]\+\)$$' coverage.out > coverage-bodged.out
 	grep '^\(mode: .*\)\|\(.*:[0-9]\+\.[0-9]\+,[0-9]\+\.[0-9]\+ [0-9]\+ [0-9]\+\)$$' integration.coverage.out > integration.coverage-bodged.out
-	$(GO) run tools/gocovmerge.go integration.coverage-bodged.out coverage-bodged.out > coverage.all
+	$(GO) run build/gocovmerge.go integration.coverage-bodged.out coverage-bodged.out > coverage.all

 .PHONY: unit-test-coverage
 unit-test-coverage:
@@ -442,20 +498,25 @@ tidy-check: tidy
 go-licenses: $(GO_LICENSE_FILE) ## regenerate go licenses

 $(GO_LICENSE_FILE): go.mod go.sum
-	GO=$(GO) $(GO) run build/generate-go-licenses.go $(GO_LICENSE_FILE)
+	@rm -rf $(GO_LICENSE_FILE)
+	$(GO) install $(GO_LICENSES_PACKAGE)
+	-GOOS=linux CGO_ENABLED=1 go-licenses save . --force --save_path=$(GO_LICENSE_TMP_DIR) 2>/dev/null
+	$(GO) run build/generate-go-licenses.go $(GO_LICENSE_TMP_DIR) $(GO_LICENSE_FILE)
+	@rm -rf $(GO_LICENSE_TMP_DIR)

 generate-ini-sqlite:
-	sed -e 's|{{WORK_PATH}}|$(CURDIR)/tests/$(or $(TEST_TYPE),integration)/gitea-$(or $(TEST_TYPE),integration)-sqlite|g' \
+	sed -e 's|{{REPO_TEST_DIR}}|${REPO_TEST_DIR}|g' \
 		-e 's|{{TEST_LOGGER}}|$(or $(TEST_LOGGER),test$(COMMA)file)|g' \
+		-e 's|{{TEST_TYPE}}|$(or $(TEST_TYPE),integration)|g' \
 			tests/sqlite.ini.tmpl > tests/sqlite.ini

 .PHONY: test-sqlite
 test-sqlite: integrations.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.sqlite.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./integrations.sqlite.test

 .PHONY: test-sqlite\#%
 test-sqlite\#%: integrations.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.sqlite.test -test.run $(subst .,/,$*)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./integrations.sqlite.test -test.run $(subst .,/,$*)

 .PHONY: test-sqlite-migration
 test-sqlite-migration:  migrations.sqlite.test migrations.individual.sqlite.test
@@ -465,17 +526,18 @@ generate-ini-mysql:
 		-e 's|{{TEST_MYSQL_DBNAME}}|${TEST_MYSQL_DBNAME}|g' \
 		-e 's|{{TEST_MYSQL_USERNAME}}|${TEST_MYSQL_USERNAME}|g' \
 		-e 's|{{TEST_MYSQL_PASSWORD}}|${TEST_MYSQL_PASSWORD}|g' \
-		-e 's|{{WORK_PATH}}|$(CURDIR)/tests/$(or $(TEST_TYPE),integration)/gitea-$(or $(TEST_TYPE),integration)-mysql|g' \
+		-e 's|{{REPO_TEST_DIR}}|${REPO_TEST_DIR}|g' \
 		-e 's|{{TEST_LOGGER}}|$(or $(TEST_LOGGER),test$(COMMA)file)|g' \
+		-e 's|{{TEST_TYPE}}|$(or $(TEST_TYPE),integration)|g' \
 			tests/mysql.ini.tmpl > tests/mysql.ini

 .PHONY: test-mysql
 test-mysql: integrations.mysql.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.mysql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./integrations.mysql.test

 .PHONY: test-mysql\#%
 test-mysql\#%: integrations.mysql.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.mysql.test -test.run $(subst .,/,$*)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./integrations.mysql.test -test.run $(subst .,/,$*)

 .PHONY: test-mysql-migration
 test-mysql-migration: migrations.mysql.test migrations.individual.mysql.test
@@ -487,17 +549,18 @@ generate-ini-pgsql:
 		-e 's|{{TEST_PGSQL_PASSWORD}}|${TEST_PGSQL_PASSWORD}|g' \
 		-e 's|{{TEST_PGSQL_SCHEMA}}|${TEST_PGSQL_SCHEMA}|g' \
 		-e 's|{{TEST_MINIO_ENDPOINT}}|${TEST_MINIO_ENDPOINT}|g' \
-		-e 's|{{WORK_PATH}}|$(CURDIR)/tests/$(or $(TEST_TYPE),integration)/gitea-$(or $(TEST_TYPE),integration)-pgsql|g' \
+		-e 's|{{REPO_TEST_DIR}}|${REPO_TEST_DIR}|g' \
 		-e 's|{{TEST_LOGGER}}|$(or $(TEST_LOGGER),test$(COMMA)file)|g' \
+		-e 's|{{TEST_TYPE}}|$(or $(TEST_TYPE),integration)|g' \
 			tests/pgsql.ini.tmpl > tests/pgsql.ini

 .PHONY: test-pgsql
 test-pgsql: integrations.pgsql.test generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini ./integrations.pgsql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./integrations.pgsql.test

 .PHONY: test-pgsql\#%
 test-pgsql\#%: integrations.pgsql.test generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini ./integrations.pgsql.test -test.run $(subst .,/,$*)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./integrations.pgsql.test -test.run $(subst .,/,$*)

 .PHONY: test-pgsql-migration
 test-pgsql-migration: migrations.pgsql.test migrations.individual.pgsql.test
@@ -507,53 +570,89 @@ generate-ini-mssql:
 		-e 's|{{TEST_MSSQL_DBNAME}}|${TEST_MSSQL_DBNAME}|g' \
 		-e 's|{{TEST_MSSQL_USERNAME}}|${TEST_MSSQL_USERNAME}|g' \
 		-e 's|{{TEST_MSSQL_PASSWORD}}|${TEST_MSSQL_PASSWORD}|g' \
-		-e 's|{{WORK_PATH}}|$(CURDIR)/tests/$(or $(TEST_TYPE),integration)/gitea-$(or $(TEST_TYPE),integration)-mssql|g' \
+		-e 's|{{REPO_TEST_DIR}}|${REPO_TEST_DIR}|g' \
 		-e 's|{{TEST_LOGGER}}|$(or $(TEST_LOGGER),test$(COMMA)file)|g' \
+		-e 's|{{TEST_TYPE}}|$(or $(TEST_TYPE),integration)|g' \
 			tests/mssql.ini.tmpl > tests/mssql.ini

 .PHONY: test-mssql
 test-mssql: integrations.mssql.test generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini ./integrations.mssql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./integrations.mssql.test

 .PHONY: test-mssql\#%
 test-mssql\#%: integrations.mssql.test generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini ./integrations.mssql.test -test.run $(subst .,/,$*)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./integrations.mssql.test -test.run $(subst .,/,$*)

 .PHONY: test-mssql-migration
 test-mssql-migration: migrations.mssql.test migrations.individual.mssql.test

 .PHONY: playwright
 playwright: deps-frontend
-	@# on GitHub Actions VMs, playwright's system deps are pre-installed
-	@pnpm exec playwright install $(if $(GITHUB_ACTIONS),,--with-deps) chromium firefox $(PLAYWRIGHT_FLAGS)
+	$(NODE_VARS) pnpm exec playwright install $(PLAYWRIGHT_FLAGS)
+
+.PHONY: test-e2e%
+test-e2e%: TEST_TYPE ?= e2e
+	# Clear display env variable. Otherwise, chromium tests can fail.
+	DISPLAY=

 .PHONY: test-e2e
-test-e2e: playwright $(EXECUTABLE_E2E)
-	@EXECUTABLE=$(EXECUTABLE_E2E) ./tools/test-e2e.sh $(GITEA_TEST_E2E_FLAGS)
+test-e2e: test-e2e-sqlite
+
+.PHONY: test-e2e-sqlite
+test-e2e-sqlite: playwright e2e.sqlite.test generate-ini-sqlite
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./e2e.sqlite.test
+
+.PHONY: test-e2e-sqlite\#%
+test-e2e-sqlite\#%: playwright e2e.sqlite.test generate-ini-sqlite
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./e2e.sqlite.test -test.run TestE2e/$*
+
+.PHONY: test-e2e-mysql
+test-e2e-mysql: playwright e2e.mysql.test generate-ini-mysql
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./e2e.mysql.test
+
+.PHONY: test-e2e-mysql\#%
+test-e2e-mysql\#%: playwright e2e.mysql.test generate-ini-mysql
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./e2e.mysql.test -test.run TestE2e/$*
+
+.PHONY: test-e2e-pgsql
+test-e2e-pgsql: playwright e2e.pgsql.test generate-ini-pgsql
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./e2e.pgsql.test
+
+.PHONY: test-e2e-pgsql\#%
+test-e2e-pgsql\#%: playwright e2e.pgsql.test generate-ini-pgsql
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./e2e.pgsql.test -test.run TestE2e/$*
+
+.PHONY: test-e2e-mssql
+test-e2e-mssql: playwright e2e.mssql.test generate-ini-mssql
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./e2e.mssql.test
+
+.PHONY: test-e2e-mssql\#%
+test-e2e-mssql\#%: playwright e2e.mssql.test generate-ini-mssql
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./e2e.mssql.test -test.run TestE2e/$*

 .PHONY: bench-sqlite
 bench-sqlite: integrations.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.sqlite.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./integrations.sqlite.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .

 .PHONY: bench-mysql
 bench-mysql: integrations.mysql.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.mysql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./integrations.mysql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .

 .PHONY: bench-mssql
 bench-mssql: integrations.mssql.test generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini ./integrations.mssql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./integrations.mssql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .

 .PHONY: bench-pgsql
 bench-pgsql: integrations.pgsql.test generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini ./integrations.pgsql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./integrations.pgsql.test -test.cpuprofile=cpu.out -test.run DontRunTests -test.bench .

 .PHONY: integration-test-coverage
 integration-test-coverage: integrations.cover.test generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini ./integrations.cover.test -test.coverprofile=integration.coverage.out
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./integrations.cover.test -test.coverprofile=integration.coverage.out

 .PHONY: integration-test-coverage-sqlite
 integration-test-coverage-sqlite: integrations.cover.sqlite.test generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini ./integrations.cover.sqlite.test -test.coverprofile=integration.coverage.out
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./integrations.cover.sqlite.test -test.coverprofile=integration.coverage.out

 integrations.mysql.test: git-check $(GO_SOURCES)
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration -o integrations.mysql.test
@@ -576,54 +675,66 @@ integrations.cover.sqlite.test: git-check $(GO_SOURCES)
 .PHONY: migrations.mysql.test
 migrations.mysql.test: $(GO_SOURCES) generate-ini-mysql
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.mysql.test
-	GITEA_TEST_CONF=tests/mysql.ini ./migrations.mysql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini ./migrations.mysql.test

 .PHONY: migrations.pgsql.test
 migrations.pgsql.test: $(GO_SOURCES) generate-ini-pgsql
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.pgsql.test
-	GITEA_TEST_CONF=tests/pgsql.ini ./migrations.pgsql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini ./migrations.pgsql.test

 .PHONY: migrations.mssql.test
 migrations.mssql.test: $(GO_SOURCES) generate-ini-mssql
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.mssql.test
-	GITEA_TEST_CONF=tests/mssql.ini ./migrations.mssql.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini ./migrations.mssql.test

 .PHONY: migrations.sqlite.test
 migrations.sqlite.test: $(GO_SOURCES) generate-ini-sqlite
 	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/integration/migration-test -o migrations.sqlite.test -tags '$(TEST_TAGS)'
-	GITEA_TEST_CONF=tests/sqlite.ini ./migrations.sqlite.test
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini ./migrations.sqlite.test

 .PHONY: migrations.individual.mysql.test
-migrations.individual.mysql.test: $(GO_SOURCES) generate-ini-mysql
-	GITEA_TEST_CONF=tests/mysql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
+migrations.individual.mysql.test: $(GO_SOURCES)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mysql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)

 .PHONY: migrations.individual.sqlite.test\#%
 migrations.individual.sqlite.test\#%: $(GO_SOURCES) generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*

 .PHONY: migrations.individual.pgsql.test
-migrations.individual.pgsql.test: $(GO_SOURCES) generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
+migrations.individual.pgsql.test: $(GO_SOURCES)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)

 .PHONY: migrations.individual.pgsql.test\#%
 migrations.individual.pgsql.test\#%: $(GO_SOURCES) generate-ini-pgsql
-	GITEA_TEST_CONF=tests/pgsql.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/pgsql.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*

 .PHONY: migrations.individual.mssql.test
 migrations.individual.mssql.test: $(GO_SOURCES) generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)

 .PHONY: migrations.individual.mssql.test\#%
 migrations.individual.mssql.test\#%: $(GO_SOURCES) generate-ini-mssql
-	GITEA_TEST_CONF=tests/mssql.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/mssql.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*

 .PHONY: migrations.individual.sqlite.test
 migrations.individual.sqlite.test: $(GO_SOURCES) generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags='$(TEST_TAGS)' -p 1 $(MIGRATE_TEST_PACKAGES)

 .PHONY: migrations.individual.sqlite.test\#%
 migrations.individual.sqlite.test\#%: $(GO_SOURCES) generate-ini-sqlite
-	GITEA_TEST_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
+	GITEA_ROOT="$(CURDIR)" GITEA_CONF=tests/sqlite.ini $(GO) test $(GOTESTFLAGS) -tags '$(TEST_TAGS)' code.gitea.io/gitea/models/migrations/$*
+
+e2e.mysql.test: $(GO_SOURCES)
+	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/e2e -o e2e.mysql.test
+
+e2e.pgsql.test: $(GO_SOURCES)
+	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/e2e -o e2e.pgsql.test
+
+e2e.mssql.test: $(GO_SOURCES)
+	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/e2e -o e2e.mssql.test
+
+e2e.sqlite.test: $(GO_SOURCES)
+	$(GO) test $(GOTESTFLAGS) -c code.gitea.io/gitea/tests/e2e -o e2e.sqlite.test -tags '$(TEST_TAGS)'

 .PHONY: check
 check: test
@@ -636,10 +747,10 @@ install: $(wildcard *.go)
 build: frontend backend ## build everything

 .PHONY: frontend
-frontend: $(FRONTEND_DEST) ## build frontend files
+frontend: $(WEBPACK_DEST) ## build frontend files

 .PHONY: backend
-backend: generate-backend $(EXECUTABLE) ## build backend files
+backend: go-check generate-backend $(EXECUTABLE) ## build backend files

 # We generate the backend before the frontend in case we in future we want to generate things in the frontend from generated files in backend
 .PHONY: generate
@@ -655,17 +766,14 @@ generate-go: $(TAGS_PREREQ)

 .PHONY: security-check
 security-check:
-	GOEXPERIMENT= go run $(GOVULNCHECK_PACKAGE) -show color ./... || true
+	go run $(GOVULNCHECK_PACKAGE) -show color ./...

 $(EXECUTABLE): $(GO_SOURCES) $(TAGS_PREREQ)
 ifneq ($(and $(STATIC),$(findstring pam,$(TAGS))),)
-  $(error pam support set via TAGS does not support static builds)
+  $(error pam support set via TAGS doesn't support static builds)
 endif
 	CGO_ENABLED="$(CGO_ENABLED)" CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) build $(GOFLAGS) $(EXTRA_GOFLAGS) -tags '$(TAGS)' -ldflags '-s -w $(EXTLDFLAGS) $(LDFLAGS)' -o $@

-$(EXECUTABLE_E2E): $(GO_SOURCES) $(FRONTEND_DEST)
-	CGO_ENABLED=1 $(GO) build $(GOFLAGS) $(EXTRA_GOFLAGS) -tags '$(TEST_TAGS)' -ldflags '-s -w $(EXTLDFLAGS) $(LDFLAGS)' -o $@
-
 .PHONY: release
 release: frontend generate release-windows release-linux release-darwin release-freebsd release-copy release-compress vendor release-sources release-check

@@ -736,12 +844,15 @@ deps-tools: ## install tool dependencies
 	$(GO) install $(MISSPELL_PACKAGE) & \
 	$(GO) install $(SWAGGER_PACKAGE) & \
 	$(GO) install $(XGO_PACKAGE) & \
+	$(GO) install $(GO_LICENSES_PACKAGE) & \
 	$(GO) install $(GOVULNCHECK_PACKAGE) & \
 	$(GO) install $(ACTIONLINT_PACKAGE) & \
+	$(GO) install $(GOPLS_PACKAGE) & \
+	$(GO) install $(GOPLS_MODERNIZE_PACKAGE) & \
 	wait

 node_modules: pnpm-lock.yaml
-	pnpm install --frozen-lockfile
+	$(NODE_VARS) pnpm install --frozen-lockfile
 	@touch node_modules

 .venv: uv.lock
@@ -749,41 +860,36 @@ node_modules: pnpm-lock.yaml
 	@touch .venv

 .PHONY: update
-update: update-go update-js update-py ## update dependencies
-
-.PHONY: update-go
-update-go: ## update go dependencies
-	$(GO) get -u ./...
-	$(MAKE) tidy
+update: update-js update-py ## update js and py dependencies

 .PHONY: update-js
-update-js: node_modules ## update js dependencies
-	pnpm exec updates -u -f package.json
+update-js: node-check | node_modules ## update js dependencies
+	$(NODE_VARS) pnpm exec updates -u -f package.json
 	rm -rf node_modules pnpm-lock.yaml
-	pnpm install
-	pnpm exec nolyfill install
-	pnpm install
+	$(NODE_VARS) pnpm install
+	$(NODE_VARS) pnpm exec nolyfill install
+	$(NODE_VARS) pnpm install
 	@touch node_modules

 .PHONY: update-py
-update-py: node_modules ## update py dependencies
-	pnpm exec updates -u -f pyproject.toml
+update-py: node-check | node_modules ## update py dependencies
+	$(NODE_VARS) pnpm exec updates -u -f pyproject.toml
 	rm -rf .venv uv.lock
 	uv sync
 	@touch .venv

-.PHONY: vite
-vite: $(FRONTEND_DEST) ## build vite files
+.PHONY: webpack
+webpack: $(WEBPACK_DEST) ## build webpack files

-$(FRONTEND_DEST): $(FRONTEND_SOURCES) $(FRONTEND_CONFIGS) pnpm-lock.yaml
-	@$(MAKE) -s node_modules
-	@rm -rf $(FRONTEND_DEST_ENTRIES)
-	@echo "Running vite build..."
-	@pnpm exec vite build
-	@touch $(FRONTEND_DEST)
+$(WEBPACK_DEST): $(WEBPACK_SOURCES) $(WEBPACK_CONFIGS) pnpm-lock.yaml
+	@$(MAKE) -s node-check node_modules
+	@rm -rf $(WEBPACK_DEST_ENTRIES)
+	@echo "Running webpack..."
+	@BROWSERSLIST_IGNORE_OLD_DATA=true $(NODE_VARS) pnpm exec webpack --disable-interpret
+	@touch $(WEBPACK_DEST)

 .PHONY: svg
-svg: node_modules ## build svg files
+svg: node-check | node_modules ## build svg files
 	rm -rf $(SVG_DEST_DIR)
 	node tools/generate-svg.ts

@@ -799,7 +905,7 @@ svg-check: svg

 .PHONY: lockfile-check
 lockfile-check:
-	pnpm install --frozen-lockfile
+	$(NODE_VARS) pnpm install --frozen-lockfile
 	@diff=$$(git diff --color=always pnpm-lock.yaml); \
 	if [ -n "$$diff" ]; then \
 		echo "pnpm-lock.yaml is inconsistent with package.json"; \
@@ -808,6 +914,16 @@ lockfile-check:
 		exit 1; \
 	fi

+.PHONY: update-translations
+update-translations:
+	mkdir -p ./translations
+	cd ./translations && curl -L https://crowdin.com/download/project/gitea.zip > gitea.zip && unzip gitea.zip
+	rm ./translations/gitea.zip
+	$(SED_INPLACE) -e 's/="/=/g' -e 's/"$$//g' ./translations/*.ini
+	$(SED_INPLACE) -e 's/\\"/"/g' ./translations/*.ini
+	mv ./translations/*.ini ./options/locale/
+	rmdir ./translations
+
 .PHONY: generate-gitignore
 generate-gitignore: ## update gitignore files
 	$(GO) run build/generate-gitignores.go
@@ -829,6 +945,9 @@ docker:
 	docker build --disable-content-trust=false -t $(DOCKER_REF) .
 # support also build args docker build --build-arg GITEA_VERSION=v1.2.3 --build-arg TAGS="bindata sqlite sqlite_unlock_notify"  .

+# This endif closes the if at the top of the file
+endif
+
 # Disable parallel execution because it would break some targets that don't
 # specify exact dependencies like 'backend' which does currently not depend
 # on 'frontend' to enable Node.js-less builds from source tarballs.
--- a/README.md
+++ b/README.md
@@ -8,6 +8,7 @@
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
 [![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
 [![](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT "License: MIT")
+[![Contribute with Gitpod](https://img.shields.io/badge/Contribute%20with-Gitpod-908a85?logo=gitpod&color=green)](https://gitpod.io/#https://github.com/go-gitea/gitea)
 [![](https://badges.crowdin.net/gitea/localized.svg)](https://translate.gitea.com "Crowdin")

 [繁體中文](./README.zh-tw.md) | [简体中文](./README.zh-cn.md)
--- a/README.zh-cn.md
+++ b/README.zh-cn.md
@@ -8,6 +8,7 @@
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
 [![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
 [![](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT "License: MIT")
+[![Contribute with Gitpod](https://img.shields.io/badge/Contribute%20with-Gitpod-908a85?logo=gitpod&color=green)](https://gitpod.io/#https://github.com/go-gitea/gitea)
 [![](https://badges.crowdin.net/gitea/localized.svg)](https://translate.gitea.com "Crowdin")

 [English](./README.md) | [繁體中文](./README.zh-tw.md)
@@ -45,7 +46,7 @@
 `build` 目标分为两个子目标：

 - `make backend` 需要 [Go Stable](https://go.dev/dl/)，所需版本在 [go.mod](/go.mod) 中定义。
- `make frontend` 需要 [Node.js LTS](https://nodejs.org/en/download/) 或更高版本以及 [pnpm](https://pnpm.io/installation)。
+- `make frontend` 需要 [Node.js LTS](https://nodejs.org/en/download/) 或更高版本。

 需要互联网连接来下载 go 和 npm 模块。从包含预构建前端文件的官方源代码压缩包构建时，不会触发 `frontend` 目标，因此可以在没有 Node.js 的情况下构建。

--- a/README.zh-tw.md
+++ b/README.zh-tw.md
@@ -8,6 +8,7 @@
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
 [![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
 [![](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT "License: MIT")
+[![Contribute with Gitpod](https://img.shields.io/badge/Contribute%20with-Gitpod-908a85?logo=gitpod&color=green)](https://gitpod.io/#https://github.com/go-gitea/gitea)
 [![](https://badges.crowdin.net/gitea/localized.svg)](https://translate.gitea.com "Crowdin")

 [English](./README.md) | [简体中文](./README.zh-cn.md)
@@ -45,7 +46,7 @@
 `build` 目標分為兩個子目標：

 - `make backend` 需要 [Go Stable](https://go.dev/dl/)，所需版本在 [go.mod](/go.mod) 中定義。
- `make frontend` 需要 [Node.js LTS](https://nodejs.org/en/download/) 或更高版本以及 [pnpm](https://pnpm.io/installation)。
+- `make frontend` 需要 [Node.js LTS](https://nodejs.org/en/download/) 或更高版本。

 需要互聯網連接來下載 go 和 npm 模塊。從包含預構建前端文件的官方源代碼壓縮包構建時，不會觸發 `frontend` 目標，因此可以在沒有 Node.js 的情況下構建。

--- a/assets/emoji.json
+++ b/assets/emoji.json
--- a/assets/go-licenses.json
+++ b/assets/go-licenses.json
--- a/build.go
+++ b/build.go
@@ -0,0 +1,14 @@
+// Copyright 2020 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build vendor
+
+package main
+
+// Libraries that are included to vendor utilities used during Makefile build.
+// These libraries will not be included in a normal compilation.
+
+import (
+	// for vet
+	_ "code.gitea.io/gitea-vet"
+)
--- a/build/backport-locales.go
+++ b/build/backport-locales.go
@@ -0,0 +1,115 @@
+// Copyright 2023 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build ignore
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"code.gitea.io/gitea/modules/container"
+	"code.gitea.io/gitea/modules/setting"
+)
+
+func main() {
+	if len(os.Args) != 2 {
+		println("usage: backport-locales <to-ref>")
+		println("eg: backport-locales release/v1.19")
+		os.Exit(1)
+	}
+
+	mustNoErr := func(err error) {
+		if err != nil {
+			panic(err)
+		}
+	}
+	collectInis := func(ref string) map[string]setting.ConfigProvider {
+		inis := map[string]setting.ConfigProvider{}
+		err := filepath.WalkDir("options/locale", func(path string, d os.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+			if d.IsDir() || !strings.HasSuffix(d.Name(), ".ini") {
+				return nil
+			}
+			cfg, err := setting.NewConfigProviderForLocale(path)
+			mustNoErr(err)
+			inis[path] = cfg
+			fmt.Printf("collecting: %s @ %s\n", path, ref)
+			return nil
+		})
+		mustNoErr(err)
+		return inis
+	}
+
+	// collect new locales from current working directory
+	inisNew := collectInis("HEAD")
+
+	// switch to the target ref, and collect the old locales
+	cmd := exec.Command("git", "checkout", os.Args[1])
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	mustNoErr(cmd.Run())
+	inisOld := collectInis(os.Args[1])
+
+	// use old en-US as the base, and copy the new translations to the old locales
+	enUsOld := inisOld["options/locale/locale_en-US.ini"]
+	brokenWarned := make(container.Set[string])
+	for path, iniOld := range inisOld {
+		if iniOld == enUsOld {
+			continue
+		}
+		iniNew := inisNew[path]
+		if iniNew == nil {
+			continue
+		}
+		for _, secEnUS := range enUsOld.Sections() {
+			secOld := iniOld.Section(secEnUS.Name())
+			secNew := iniNew.Section(secEnUS.Name())
+			for _, keyEnUs := range secEnUS.Keys() {
+				if secNew.HasKey(keyEnUs.Name()) {
+					oldStr := secOld.Key(keyEnUs.Name()).String()
+					newStr := secNew.Key(keyEnUs.Name()).String()
+					broken := oldStr != "" && strings.Count(oldStr, "%") != strings.Count(newStr, "%")
+					broken = broken || strings.Contains(oldStr, "\n") || strings.Contains(oldStr, "\n")
+					if broken {
+						brokenWarned.Add(secOld.Name() + "." + keyEnUs.Name())
+						fmt.Println("----")
+						fmt.Printf("WARNING: skip broken locale: %s , [%s] %s\n", path, secEnUS.Name(), keyEnUs.Name())
+						fmt.Printf("\told: %s\n", strings.ReplaceAll(oldStr, "\n", "\\n"))
+						fmt.Printf("\tnew: %s\n", strings.ReplaceAll(newStr, "\n", "\\n"))
+						continue
+					}
+					secOld.Key(keyEnUs.Name()).SetValue(newStr)
+				}
+			}
+		}
+		mustNoErr(iniOld.SaveTo(path))
+	}
+
+	fmt.Println("========")
+
+	for path, iniNew := range inisNew {
+		for _, sec := range iniNew.Sections() {
+			for _, key := range sec.Keys() {
+				str := sec.Key(key.Name()).String()
+				broken := strings.Contains(str, "\n")
+				broken = broken || strings.HasPrefix(str, "`") != strings.HasSuffix(str, "`")
+				broken = broken || strings.HasPrefix(str, "\"`")
+				broken = broken || strings.HasPrefix(str, "`\"")
+				broken = broken || strings.Count(str, `"`)%2 == 1
+				broken = broken || strings.Count(str, "`")%2 == 1
+				if broken && !brokenWarned.Contains(sec.Name()+"."+key.Name()) {
+					fmt.Printf("WARNING: found broken locale: %s , [%s] %s\n", path, sec.Name(), key.Name())
+					fmt.Printf("\tstr: %s\n", strings.ReplaceAll(str, "\n", "\\n"))
+					fmt.Println("----")
+				}
+			}
+		}
+	}
+}
--- a/build/code-batch-process.go
+++ b/build/code-batch-process.go
@@ -12,11 +12,10 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
-	"slices"
 	"strconv"
 	"strings"

-	"code.gitea.io/gitea/tools/codeformat"
+	"code.gitea.io/gitea/build/codeformat"
 )

 // Windows has a limitation for command line arguments, the size can not exceed 32KB.
@@ -218,6 +217,15 @@ func newFileCollectorFromMainOptions(mainOptions map[string]string) (fc *fileCol
 	return newFileCollector(fileFilter, batchSize)
 }

+func containsString(a []string, s string) bool {
+	for _, v := range a {
+		if v == s {
+			return true
+		}
+	}
+	return false
+}
+
 func giteaFormatGoImports(files []string, doWriteFile bool) error {
 	for _, file := range files {
 		if err := codeformat.FormatGoImports(file, doWriteFile); err != nil {
@@ -256,10 +264,10 @@ func main() {
 		logVerbose("batch cmd: %s %v", subCmd, substArgs)
 		switch subCmd {
 		case "gitea-fmt":
-			if slices.Contains(subArgs, "-d") {
+			if containsString(subArgs, "-d") {
 				log.Print("the -d option is not supported by gitea-fmt")
 			}
-			cmdErrors = append(cmdErrors, giteaFormatGoImports(files, slices.Contains(subArgs, "-w")))
+			cmdErrors = append(cmdErrors, giteaFormatGoImports(files, containsString(subArgs, "-w")))
 			cmdErrors = append(cmdErrors, passThroughCmd("gofmt", append([]string{"-w", "-r", "interface{} -> any"}, substArgs...)))
 			cmdErrors = append(cmdErrors, passThroughCmd("go", append([]string{"run", os.Getenv("GOFUMPT_PACKAGE"), "-extra"}, substArgs...)))
 		default:
--- a/build/codeformat/formatimports.go
+++ b/build/codeformat/formatimports.go
--- a/build/codeformat/formatimports_test.go
+++ b/build/codeformat/formatimports_test.go
--- a/build/generate-emoji.go
+++ b/build/generate-emoji.go
@@ -24,8 +24,8 @@ import (
 )

 const (
-	gemojiURL         = "https://raw.githubusercontent.com/rhysd/gemoji/537ff2d7e0496e9964824f7f73ec7ece88c9765a/db/emoji.json"
-	maxUnicodeVersion = 16
+	gemojiURL         = "https://raw.githubusercontent.com/github/gemoji/master/db/emoji.json"
+	maxUnicodeVersion = 15
 )

 var flagOut = flag.String("o", "modules/emoji/emoji_data.go", "out")
@@ -149,8 +149,8 @@ func generate() ([]byte, error) {
 	}

 	// write a JSON file to use with tribute (write before adding skin tones since we can't support them there yet)
-	file, _ := json.MarshalIndent(data, "", "  ")
-	_ = os.WriteFile("assets/emoji.json", append(file, '\n'), 0o644)
+	file, _ := json.Marshal(data)
+	_ = os.WriteFile("assets/emoji.json", file, 0o644)

 	// Add skin tones to emoji that support it
 	var (
--- a/build/generate-go-licenses.go
+++ b/build/generate-go-licenses.go
@@ -8,219 +8,99 @@ package main
 import (
 	"encoding/json"
 	"fmt"
+	"io/fs"
 	"os"
-	"os/exec"
+	"path"
 	"path/filepath"
 	"regexp"
-	"slices"
 	"sort"
 	"strings"
+
+	"code.gitea.io/gitea/modules/container"
 )

 // regexp is based on go-license, excluding README and NOTICE
 // https://github.com/google/go-licenses/blob/master/licenses/find.go
 var licenseRe = regexp.MustCompile(`^(?i)((UN)?LICEN(S|C)E|COPYING).*$`)

-// primaryLicenseRe matches exact primary license filenames without suffixes.
-// When a directory has both primary and variant files (e.g. LICENSE and
-// LICENSE.docs), only the primary files are kept.
-var primaryLicenseRe = regexp.MustCompile(`^(?i)(LICEN[SC]E|COPYING)$`)
-
-// ignoredNames are LicenseEntry.Name values to exclude from the output.
-var ignoredNames = map[string]bool{
-	"code.gitea.io/gitea":                 true,
-	"code.gitea.io/gitea/options/license": true,
-}
-
-var excludedExt = map[string]bool{
-	".gitignore": true,
-	".go":        true,
-	".mod":       true,
-	".sum":       true,
-	".toml":      true,
-	".yaml":      true,
-	".yml":       true,
-}
-
-type ModuleInfo struct {
-	Path    string
-	Dir     string
-	PkgDirs []string // directories of packages imported from this module
-}
-
 type LicenseEntry struct {
 	Name        string `json:"name"`
 	Path        string `json:"path"`
 	LicenseText string `json:"licenseText"`
 }

-// getModules returns all dependency modules with their local directory paths
-// and the package directories used from each module.
-func getModules(goCmd string) []ModuleInfo {
-	cmd := exec.Command(goCmd, "list", "-deps", "-f",
-		"{{if .Module}}{{.Module.Path}}\t{{.Module.Dir}}\t{{.Dir}}{{end}}", "./...")
-	cmd.Stderr = os.Stderr
-	// Use GOOS=linux with CGO to ensure we capture all platform-specific
-	// dependencies, matching the CI environment.
-	cmd.Env = append(os.Environ(), "GOOS=linux", "GOARCH=amd64", "CGO_ENABLED=1")
-	output, err := cmd.Output()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "failed to run 'go list -deps': %v\n", err)
+func main() {
+	if len(os.Args) != 3 {
+		fmt.Println("usage: go run generate-go-licenses.go <base-dir> <out-json-file>")
 		os.Exit(1)
 	}

-	var modules []ModuleInfo
-	seen := make(map[string]int) // module path -> index in modules
-	for _, line := range strings.Split(string(output), "\n") {
-		line = strings.TrimSpace(line)
-		if line == "" {
-			continue
-		}
-		parts := strings.Split(line, "\t")
-		if len(parts) != 3 {
-			continue
-		}
-		modPath, modDir, pkgDir := parts[0], parts[1], parts[2]
-		if idx, ok := seen[modPath]; ok {
-			modules[idx].PkgDirs = append(modules[idx].PkgDirs, pkgDir)
-		} else {
-			seen[modPath] = len(modules)
-			modules = append(modules, ModuleInfo{
-				Path:    modPath,
-				Dir:     modDir,
-				PkgDirs: []string{pkgDir},
-			})
-		}
-	}
-	return modules
-}
+	base, out := os.Args[1], os.Args[2]

-// findLicenseFiles scans a module's root directory and its used package
-// directories for license files. It also walks up from each package directory
-// to the module root, scanning intermediate directories. Subdirectory licenses
-// are only included if their text differs from the root license(s).
-func findLicenseFiles(mod ModuleInfo) []LicenseEntry {
-	var entries []LicenseEntry
-	seenTexts := make(map[string]bool)
+	// Add ext for excluded files because license_test.go will be included for some reason.
+	// And there are more files that should be excluded, check with:
+	//
+	// go run github.com/google/go-licenses@v1.6.0 save . --force --save_path=.go-licenses 2>/dev/null
+	// find .go-licenses -type f | while read FILE; do echo "${$(basename $FILE)##*.}"; done | sort -u
+	//    AUTHORS
+	//    COPYING
+	//    LICENSE
+	//    Makefile
+	//    NOTICE
+	//    gitignore
+	//    go
+	//    md
+	//    mod
+	//    sum
+	//    toml
+	//    txt
+	//    yml
+	//
+	// It could be removed once we have a better regex.
+	excludedExt := container.SetOf(".gitignore", ".go", ".mod", ".sum", ".toml", ".yml")

-	// First, collect root-level license files.
-	entries = append(entries, scanDirForLicenses(mod.Dir, mod.Path, "")...)
-	for _, e := range entries {
-		seenTexts[e.LicenseText] = true
-	}
-
-	// Then check each package directory and all intermediate parent directories
-	// up to the module root for license files with unique text.
-	seenDirs := map[string]bool{mod.Dir: true}
-	for _, pkgDir := range mod.PkgDirs {
-		for dir := pkgDir; dir != mod.Dir && strings.HasPrefix(dir, mod.Dir); dir = filepath.Dir(dir) {
-			if seenDirs[dir] {
-				continue
-			}
-			seenDirs[dir] = true
-			for _, e := range scanDirForLicenses(dir, mod.Path, mod.Dir) {
-				if !seenTexts[e.LicenseText] {
-					seenTexts[e.LicenseText] = true
-					entries = append(entries, e)
-				}
-			}
-		}
-	}
-	return entries
-}
-
-// scanDirForLicenses reads a single directory for license files and returns entries.
-// If moduleRoot is non-empty, paths are made relative to it.
-func scanDirForLicenses(dir, modulePath, moduleRoot string) []LicenseEntry {
-	dirEntries, err := os.ReadDir(dir)
-	if err != nil {
-		return nil
-	}
-
-	var entries []LicenseEntry
-	for _, entry := range dirEntries {
-		if entry.IsDir() {
-			continue
-		}
-		name := entry.Name()
-		if !licenseRe.MatchString(name) {
-			continue
-		}
-		if excludedExt[strings.ToLower(filepath.Ext(name))] {
-			continue
-		}
-
-		content, err := os.ReadFile(filepath.Join(dir, name))
+	var paths []string
+	err := filepath.WalkDir(base, func(path string, entry fs.DirEntry, err error) error {
 		if err != nil {
-			continue
+			return err
+		}
+		if entry.IsDir() || !licenseRe.MatchString(entry.Name()) || excludedExt.Contains(filepath.Ext(entry.Name())) {
+			return nil
+		}
+		paths = append(paths, path)
+		return nil
+	})
+	if err != nil {
+		panic(err)
+	}
+
+	sort.Strings(paths)
+
+	var entries []LicenseEntry
+	for _, filePath := range paths {
+		licenseText, err := os.ReadFile(filePath)
+		if err != nil {
+			panic(err)
 		}

-		entryName := modulePath
-		entryPath := modulePath + "/" + name
-		if moduleRoot != "" {
-			rel, _ := filepath.Rel(moduleRoot, dir)
-			if rel != "." {
-				relSlash := filepath.ToSlash(rel)
-				entryName = modulePath + "/" + relSlash
-				entryPath = modulePath + "/" + relSlash + "/" + name
-			}
+		pkgPath := filepath.ToSlash(filePath)
+		pkgPath = strings.TrimPrefix(pkgPath, base+"/")
+		pkgName := path.Dir(pkgPath)
+
+		// There might be a bug somewhere in go-licenses that sometimes interprets the
+		// root package as "." and sometimes as "code.gitea.io/gitea". Workaround by
+		// removing both of them for the sake of stable output.
+		if pkgName == "." || pkgName == "code.gitea.io/gitea" {
+			continue
 		}

 		entries = append(entries, LicenseEntry{
-			Name:        entryName,
-			Path:        entryPath,
-			LicenseText: string(content),
+			Name:        pkgName,
+			Path:        pkgPath,
+			LicenseText: string(licenseText),
 		})
 	}

-	// When multiple license files exist, prefer primary files (e.g. LICENSE)
-	// over variants with suffixes (e.g. LICENSE.docs, LICENSE-2.0.txt).
-	// If no primary file exists, keep only the first variant.
-	if len(entries) > 1 {
-		var primary []LicenseEntry
-		for _, e := range entries {
-			fileName := e.Path[strings.LastIndex(e.Path, "/")+1:]
-			if primaryLicenseRe.MatchString(fileName) {
-				primary = append(primary, e)
-			}
-		}
-		if len(primary) > 0 {
-			return primary
-		}
-		return entries[:1]
-	}
-
-	return entries
-}
-
-func main() {
-	if len(os.Args) != 2 {
-		fmt.Println("usage: go run generate-go-licenses.go <out-json-file>")
-		os.Exit(1)
-	}
-
-	out := os.Args[1]
-
-	goCmd := "go"
-	if env := os.Getenv("GO"); env != "" {
-		goCmd = env
-	}
-
-	modules := getModules(goCmd)
-
-	var entries []LicenseEntry
-	for _, mod := range modules {
-		entries = append(entries, findLicenseFiles(mod)...)
-	}
-
-	entries = slices.DeleteFunc(entries, func(e LicenseEntry) bool {
-		return ignoredNames[e.Name]
-	})
-
-	sort.Slice(entries, func(i, j int) bool {
-		return entries[i].Path < entries[j].Path
-	})
-
 	jsonBytes, err := json.MarshalIndent(entries, "", "  ")
 	if err != nil {
 		panic(err)
--- a/build/gocovmerge.go
+++ b/build/gocovmerge.go
--- a/build/test-echo.go
+++ b/build/test-echo.go
--- a/build/update-locales.sh
+++ b/build/update-locales.sh
@@ -1,22 +1,52 @@
 #!/bin/sh

 # this script runs in alpine image which only has `sh` shell
-if [ ! -f ./options/locale/locale_en-US.json ]; then
+
+set +e
+if sed --version 2>/dev/null | grep -q GNU; then
+  SED_INPLACE="sed -i"
+else
+  SED_INPLACE="sed -i ''"
+fi
+set -e
+
+if [ ! -f ./options/locale/locale_en-US.ini ]; then
  echo "please run this script in the root directory of the project"
  exit 1
 fi

-mv ./options/locale/locale_en-US.json ./options/
+mv ./options/locale/locale_en-US.ini ./options/
+
+# the "ini" library for locale has many quirks, its behavior is different from Crowdin.
+# see i18n_test.go for more details
+
+# this script helps to unquote the Crowdin outputs for the quirky ini library
+# * find all `key="...\"..."` lines
+# * remove the leading quote
+# * remove the trailing quote
+# * unescape the quotes
+# * eg: key="...\"..." => key=..."...
+$SED_INPLACE -r -e '/^[-.A-Za-z0-9_]+[ ]*=[ ]*".*"$/ {
+	s/^([-.A-Za-z0-9_]+)[ ]*=[ ]*"/\1=/
+	s/"$//
+	s/\\"/"/g
+	}' ./options/locale/*.ini
+
+# * if the escaped line is incomplete like `key="...` or `key=..."`, quote it with backticks
+# * eg: key="... => key=`"...`
+# * eg: key=..." => key=`..."`
+$SED_INPLACE -r -e 's/^([-.A-Za-z0-9_]+)[ ]*=[ ]*(".*[^"])$/\1=`\2`/' ./options/locale/*.ini
+$SED_INPLACE -r -e 's/^([-.A-Za-z0-9_]+)[ ]*=[ ]*([^"].*")$/\1=`\2`/' ./options/locale/*.ini

 # Remove translation under 25% of en_us
-baselines=$(cat "./options/locale_en-US.json" | wc -l)
+baselines=$(wc -l "./options/locale_en-US.ini" | cut -d" " -f1)
 baselines=$((baselines / 4))
-for filename in ./options/locale/*.json; do
-  lines=$(cat "$filename" | wc -l)
-  if [ "$lines" -lt "$baselines" ]; then
+for filename in ./options/locale/*.ini; do
+  lines=$(wc -l "$filename" | cut -d" " -f1)
+  if [ $lines -lt $baselines ]; then
    echo "Removing $filename: $lines/$baselines"
    rm "$filename"
  fi
 done

-mv ./options/locale_en-US.json ./options/locale/
+mv ./options/locale_en-US.ini ./options/locale/
--- a/cmd/actions.go
+++ b/cmd/actions.go
@@ -13,18 +13,17 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newActionsCommand() *cli.Command {
-	return &cli.Command{
+var (
+	// CmdActions represents the available actions sub-commands.
+	CmdActions = &cli.Command{
 		Name:  "actions",
 		Usage: "Manage Gitea Actions",
 		Commands: []*cli.Command{
-			newActionsGenerateRunnerTokenCommand(),
+			subcmdActionsGenRunnerToken,
 		},
 	}
-}

-func newActionsGenerateRunnerTokenCommand() *cli.Command {
-	return &cli.Command{
+	subcmdActionsGenRunnerToken = &cli.Command{
 		Name:    "generate-runner-token",
 		Usage:   "Generate a new token for a runner to use to register with the server",
 		Action:  runGenerateActionsRunnerToken,
@@ -38,7 +37,7 @@ func newActionsGenerateRunnerTokenCommand() *cli.Command {
 			},
 		},
 	}
-}
+)

 func runGenerateActionsRunnerToken(ctx context.Context, c *cli.Command) error {
 	setting.MustInstalled()
--- a/cmd/admin.go
+++ b/cmd/admin.go
@@ -18,41 +18,36 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newAdminCommand() *cli.Command {
-	return &cli.Command{
+var (
+	// CmdAdmin represents the available admin sub-command.
+	CmdAdmin = &cli.Command{
 		Name:  "admin",
 		Usage: "Perform common administrative operations",
 		Commands: []*cli.Command{
-			newUserCommand(),
-			newRepoSyncReleasesCommand(),
-			newRegenerateCommand(),
-			newAuthCommand(),
-			newSendMailCommand(),
+			subcmdUser,
+			subcmdRepoSyncReleases,
+			subcmdRegenerate,
+			subcmdAuth,
+			subcmdSendMail,
 		},
 	}
-}

-func newRepoSyncReleasesCommand() *cli.Command {
-	return &cli.Command{
+	subcmdRepoSyncReleases = &cli.Command{
 		Name:   "repo-sync-releases",
 		Usage:  "Synchronize repository releases with tags",
 		Action: runRepoSyncReleases,
 	}
-}

-func newRegenerateCommand() *cli.Command {
-	return &cli.Command{
+	subcmdRegenerate = &cli.Command{
 		Name:  "regenerate",
 		Usage: "Regenerate specific files",
 		Commands: []*cli.Command{
-			newRegenerateHooksCommand(),
-			newRegenerateKeysCommand(),
+			microcmdRegenHooks,
+			microcmdRegenKeys,
 		},
 	}
-}

-func newAuthCommand() *cli.Command {
-	return &cli.Command{
+	subcmdAuth = &cli.Command{
 		Name:  "auth",
 		Usage: "Modify external auth providers",
 		Commands: []*cli.Command{
@@ -64,14 +59,12 @@ func newAuthCommand() *cli.Command {
 			microcmdAuthUpdateLdapSimpleAuth(),
 			microcmdAuthAddSMTP(),
 			microcmdAuthUpdateSMTP(),
-			newAuthListCommand(),
-			newAuthDeleteCommand(),
+			microcmdAuthList,
+			microcmdAuthDelete,
 		},
 	}
-}

-func newSendMailCommand() *cli.Command {
-	return &cli.Command{
+	subcmdSendMail = &cli.Command{
 		Name:   "sendmail",
 		Usage:  "Send a message to all users",
 		Action: runSendMail,
@@ -93,7 +86,7 @@ func newSendMailCommand() *cli.Command {
 			},
 		},
 	}
-}
+)

 func idFlag() *cli.Int64Flag {
 	return &cli.Int64Flag{
@@ -128,7 +121,7 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 		}
 		log.Trace("Processing next %d repos of %d", len(repos), count)
 		for _, repo := range repos {
-			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RelativePath())
+			log.Trace("Synchronizing repo %s with path %s", repo.FullName(), repo.RepoPath())
 			gitRepo, err := gitrepo.OpenRepository(ctx, repo)
 			if err != nil {
 				log.Warn("OpenRepository: %v", err)
@@ -141,7 +134,7 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 			}
 			log.Trace(" currentNumReleases is %d, running SyncReleasesWithTags", oldnum)

-			if _, err = repo_module.SyncReleasesWithTags(ctx, repo, gitRepo); err != nil {
+			if err = repo_module.SyncReleasesWithTags(ctx, repo, gitRepo); err != nil {
 				log.Warn(" SyncReleasesWithTags: %v", err)
 				gitRepo.Close()
 				continue
@@ -154,7 +147,7 @@ func runRepoSyncReleases(ctx context.Context, _ *cli.Command) error {
 				continue
 			}

-			log.Trace("repo %s releases synchronized to tags: from %d to %d",
+			log.Trace(" repo %s releases synchronized to tags: from %d to %d",
 				repo.FullName(), oldnum, count)
 			gitRepo.Close()
 		}
--- a/cmd/admin_auth.go
+++ b/cmd/admin_auth.go
@@ -17,17 +17,14 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newAuthDeleteCommand() *cli.Command {
-	return &cli.Command{
+var (
+	microcmdAuthDelete = &cli.Command{
 		Name:   "delete",
 		Usage:  "Delete specific auth source",
 		Flags:  []cli.Flag{idFlag()},
 		Action: runDeleteAuth,
 	}
-}
-
-func newAuthListCommand() *cli.Command {
-	return &cli.Command{
+	microcmdAuthList = &cli.Command{
 		Name:   "list",
 		Usage:  "List auth sources",
 		Action: runListAuth,
@@ -58,7 +55,7 @@ func newAuthListCommand() *cli.Command {
 			},
 		},
 	}
-}
+)

 func runListAuth(ctx context.Context, c *cli.Command) error {
 	if err := initDB(ctx); err != nil {
--- a/cmd/admin_auth_ldap.go
+++ b/cmd/admin_auth_ldap.go
@@ -94,10 +94,6 @@ func commonLdapCLIFlags() []cli.Flag {
 			Name:  "public-ssh-key-attribute",
 			Usage: "The attribute of the user’s LDAP record containing the user’s public ssh key.",
 		},
-		&cli.BoolFlag{
-			Name:  "ssh-keys-are-verified",
-			Usage: "Set to true to automatically flag SSH keys in LDAP as verified.",
-		},
 		&cli.BoolFlag{
 			Name:  "skip-local-2fa",
 			Usage: "Set to true to skip local 2fa for users authenticated by this source",
@@ -298,9 +294,6 @@ func parseLdapConfig(c *cli.Command, config *ldap.Source) error {
 	if c.IsSet("public-ssh-key-attribute") {
 		config.AttributeSSHPublicKey = c.String("public-ssh-key-attribute")
 	}
-	if c.IsSet("ssh-keys-are-verified") {
-		config.SSHKeysAreVerified = c.Bool("ssh-keys-are-verified")
-	}
 	if c.IsSet("avatar-attribute") {
 		config.AttributeAvatar = c.String("avatar-attribute")
 	}
--- a/cmd/admin_auth_ldap_test.go
+++ b/cmd/admin_auth_ldap_test.go
@@ -233,7 +233,7 @@ func TestAddLdapBindDn(t *testing.T) {
 			},
 			getAuthSourceByID: func(ctx context.Context, id int64) (*auth.Source, error) {
 				assert.FailNow(t, "getAuthSourceByID called", "case %d: should not call getAuthSourceByID", n)
-				return nil, nil //nolint:nilnil // mock function covering improper behavior
+				return nil, nil
 			},
 		}

@@ -463,7 +463,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 			},
 			getAuthSourceByID: func(ctx context.Context, id int64) (*auth.Source, error) {
 				assert.FailNow(t, "getAuthSourceById called", "case %d: should not call getAuthSourceByID", n)
-				return nil, nil //nolint:nilnil // mock function covering improper behavior
+				return nil, nil
 			},
 		}

--- a/cmd/admin_regenerate.go
+++ b/cmd/admin_regenerate.go
@@ -13,21 +13,19 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newRegenerateHooksCommand() *cli.Command {
-	return &cli.Command{
+var (
+	microcmdRegenHooks = &cli.Command{
 		Name:   "hooks",
 		Usage:  "Regenerate git-hooks",
 		Action: runRegenerateHooks,
 	}
-}

-func newRegenerateKeysCommand() *cli.Command {
-	return &cli.Command{
+	microcmdRegenKeys = &cli.Command{
 		Name:   "keys",
 		Usage:  "Regenerate authorized_keys file",
 		Action: runRegenerateKeys,
 	}
-}
+)

 func runRegenerateHooks(ctx context.Context, _ *cli.Command) error {
 	if err := initDB(ctx); err != nil {
--- a/cmd/admin_user.go
+++ b/cmd/admin_user.go
@@ -7,17 +7,15 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newUserCommand() *cli.Command {
-	return &cli.Command{
-		Name:  "user",
-		Usage: "Modify users",
-		Commands: []*cli.Command{
-			microcmdUserCreate(),
-			newUserListCommand(),
-			microcmdUserChangePassword(),
-			microcmdUserDelete(),
-			newUserGenerateAccessTokenCommand(),
-			microcmdUserMustChangePassword(),
-		},
-	}
+var subcmdUser = &cli.Command{
+	Name:  "user",
+	Usage: "Modify users",
+	Commands: []*cli.Command{
+		microcmdUserCreate(),
+		microcmdUserList,
+		microcmdUserChangePassword(),
+		microcmdUserDelete(),
+		microcmdUserGenerateAccessToken,
+		microcmdUserMustChangePassword(),
+	},
 }
--- a/cmd/admin_user_create.go
+++ b/cmd/admin_user_create.go
@@ -151,7 +151,6 @@ func runCreateUser(ctx context.Context, c *cli.Command) error {
 		if err != nil {
 			return err
 		}
-		// codeql[disable-next-line=go/clear-text-logging]
 		fmt.Printf("generated random password is '%s'\n", password)
 	} else if userType == user_model.UserTypeIndividual {
 		return errors.New("must set either password or random-password flag")
--- a/cmd/admin_user_generate_access_token.go
+++ b/cmd/admin_user_generate_access_token.go
@@ -14,34 +14,32 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newUserGenerateAccessTokenCommand() *cli.Command {
-	return &cli.Command{
-		Name:  "generate-access-token",
-		Usage: "Generate an access token for a specific user",
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "username",
-				Aliases: []string{"u"},
-				Usage:   "Username",
-			},
-			&cli.StringFlag{
-				Name:    "token-name",
-				Aliases: []string{"t"},
-				Usage:   "Token name",
-				Value:   "gitea-admin",
-			},
-			&cli.BoolFlag{
-				Name:  "raw",
-				Usage: "Display only the token value",
-			},
-			&cli.StringFlag{
-				Name:  "scopes",
-				Value: "all",
-				Usage: `Comma separated list of scopes to apply to access token, examples: "all", "public-only,read:issue", "write:repository,write:user"`,
-			},
+var microcmdUserGenerateAccessToken = &cli.Command{
+	Name:  "generate-access-token",
+	Usage: "Generate an access token for a specific user",
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:    "username",
+			Aliases: []string{"u"},
+			Usage:   "Username",
 		},
-		Action: runGenerateAccessToken,
-	}
+		&cli.StringFlag{
+			Name:    "token-name",
+			Aliases: []string{"t"},
+			Usage:   "Token name",
+			Value:   "gitea-admin",
+		},
+		&cli.BoolFlag{
+			Name:  "raw",
+			Usage: "Display only the token value",
+		},
+		&cli.StringFlag{
+			Name:  "scopes",
+			Value: "all",
+			Usage: `Comma separated list of scopes to apply to access token, examples: "all", "public-only,read:issue", "write:repository,write:user"`,
+		},
+	},
+	Action: runGenerateAccessToken,
 }

 func runGenerateAccessToken(ctx context.Context, c *cli.Command) error {
--- a/cmd/admin_user_list.go
+++ b/cmd/admin_user_list.go
@@ -14,18 +14,16 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newUserListCommand() *cli.Command {
-	return &cli.Command{
-		Name:   "list",
-		Usage:  "List users",
-		Action: runListUsers,
-		Flags: []cli.Flag{
-			&cli.BoolFlag{
-				Name:  "admin",
-				Usage: "List only admin users",
-			},
+var microcmdUserList = &cli.Command{
+	Name:   "list",
+	Usage:  "List users",
+	Action: runListUsers,
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:  "admin",
+			Usage: "List only admin users",
 		},
-	}
+	},
 }

 func runListUsers(ctx context.Context, c *cli.Command) error {
--- a/cmd/admin_user_must_change_password.go
+++ b/cmd/admin_user_must_change_password.go
@@ -58,7 +58,6 @@ func runMustChangePassword(ctx context.Context, c *cli.Command) error {
 		return err
 	}

-	// codeql[disable-next-line=go/clear-text-logging]
 	fmt.Printf("Updated %d users setting MustChangePassword to %t\n", n, mustChangePassword)
 	return nil
 }
--- a/cmd/config.go
+++ b/cmd/config.go
@@ -1,156 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-
-	"code.gitea.io/gitea/modules/setting"
-
-	"github.com/urfave/cli/v3"
-)
-
-func cmdConfig() *cli.Command {
-	subcmdConfigEditIni := &cli.Command{
-		Name:  "edit-ini",
-		Usage: "Load an existing INI file, apply environment variables, keep specified keys, and output to a new INI file.",
-		Description: `
-Help users to edit the Gitea configuration INI file.
-
-# Keep Specified Keys
-
-If you need to re-create the configuration file with only a subset of keys,
-you can provide an INI template file for the kept keys and use the "--config-keep-keys" flag.
-For example, if a helm chart needs to reset the settings and only keep SECRET_KEY,
-it can use a template file (only keys take effect, values are ignored):
-
-  [security]
-  SECRET_KEY=
-
-$ ./gitea config edit-ini --config app-old.ini --config-keep-keys app-keys.ini --out app-new.ini
-
-# Map Environment Variables to INI Configuration
-
-Environment variables of the form "GITEA__section_name__KEY_NAME"
-will be mapped to the ini section "[section_name]" and the key
-"KEY_NAME" with the value as provided.
-
-Environment variables of the form "GITEA__section_name__KEY_NAME__FILE"
-will be mapped to the ini section "[section_name]" and the key
-"KEY_NAME" with the value loaded from the specified file.
-
-Environment variable keys can only contain characters "0-9A-Z_",
-if a section or key name contains dot ".", it needs to be escaped as _0x2E_.
-For example, to apply this config:
-
-	[git.config]
-	foo.bar=val
-
-$ export GITEA__git_0x2E_config__foo_0x2E_bar=val
-
-# Put All Together
-
-$ ./gitea config edit-ini --config app.ini --config-keep-keys app-keys.ini --apply-env {--in-place|--out app-new.ini}
-`,
-		Flags: []cli.Flag{
-			// "--config" flag is provided by global flags, and this flag is also used by "environment-to-ini" script wrapper
-			// "--in-place" is also used by "environment-to-ini" script wrapper for its old behavior: always overwrite the existing config file
-			&cli.BoolFlag{
-				Name:  "in-place",
-				Usage: "Output to the same config file as input. This flag will be ignored if --out is set.",
-			},
-			&cli.StringFlag{
-				Name:  "config-keep-keys",
-				Usage: "An INI template file containing keys for keeping. Only the keys defined in the INI template will be kept from old config. If not set, all keys will be kept.",
-			},
-			&cli.BoolFlag{
-				Name:  "apply-env",
-				Usage: "Apply all GITEA__* variables from the environment to the config.",
-			},
-			&cli.StringFlag{
-				Name:  "out",
-				Usage: "Destination config file to write to.",
-			},
-		},
-		Action: runConfigEditIni,
-	}
-
-	return &cli.Command{
-		Name:  "config",
-		Usage: "Manage Gitea configuration",
-		Commands: []*cli.Command{
-			subcmdConfigEditIni,
-		},
-	}
-}
-
-func runConfigEditIni(_ context.Context, c *cli.Command) error {
-	// the config system may change the environment variables, so get a copy first, to be used later
-	env := append([]string{}, os.Environ()...)
-
-	// don't use the guessed setting.CustomConf, instead, require the user to provide --config explicitly
-	if !c.IsSet("config") {
-		return errors.New("flag is required but not set: --config")
-	}
-	configFileIn := c.String("config")
-
-	cfgIn, err := setting.NewConfigProviderFromFile(configFileIn)
-	if err != nil {
-		return fmt.Errorf("failed to load config file %q: %v", configFileIn, err)
-	}
-
-	// determine output config file: use "--out" flag or use "--in-place" flag to overwrite input file
-	inPlace := c.Bool("in-place")
-	configFileOut := c.String("out")
-	if configFileOut == "" {
-		if !inPlace {
-			return errors.New("either --in-place or --out must be specified")
-		}
-		configFileOut = configFileIn // in-place edit
-	}
-
-	needWriteOut := configFileOut != configFileIn
-
-	cfgOut := cfgIn
-	configKeepKeys := c.String("config-keep-keys")
-	if configKeepKeys != "" {
-		needWriteOut = true
-		cfgOut, err = setting.NewConfigProviderFromFile(configKeepKeys)
-		if err != nil {
-			return fmt.Errorf("failed to load config-keep-keys template file %q: %v", configKeepKeys, err)
-		}
-
-		for _, secOut := range cfgOut.Sections() {
-			for _, keyOut := range secOut.Keys() {
-				secIn := cfgIn.Section(secOut.Name())
-				keyIn := setting.ConfigSectionKey(secIn, keyOut.Name())
-				if keyIn != nil {
-					keyOut.SetValue(keyIn.String())
-				} else {
-					secOut.DeleteKey(keyOut.Name())
-				}
-			}
-			if len(secOut.Keys()) == 0 {
-				cfgOut.DeleteSection(secOut.Name())
-			}
-		}
-	}
-
-	if c.Bool("apply-env") {
-		if setting.EnvironmentToConfig(cfgOut, env) {
-			needWriteOut = true
-		}
-	}
-
-	if needWriteOut {
-		err = cfgOut.SaveTo(configFileOut)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
--- a/cmd/config_test.go
+++ b/cmd/config_test.go
@@ -1,85 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package cmd
-
-import (
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestConfigEdit(t *testing.T) {
-	tmpDir := t.TempDir()
-	configOld := tmpDir + "/app-old.ini"
-	configTemplate := tmpDir + "/app-template.ini"
-	_ = os.WriteFile(configOld, []byte(`
-[sec]
-k1=v1
-k2=v2
-`), os.ModePerm)
-
-	_ = os.WriteFile(configTemplate, []byte(`
-[sec]
-k1=in-template
-
-[sec2]
-k3=v3
-`), os.ModePerm)
-
-	t.Setenv("GITEA__EnV__KeY", "val")
-
-	t.Run("OutputToNewWithEnv", func(t *testing.T) {
-		configNew := tmpDir + "/app-new.ini"
-		err := NewMainApp(AppVersion{}).Run(t.Context(), []string{
-			"./gitea", "--config", configOld,
-			"config", "edit-ini",
-			"--apply-env",
-			"--config-keep-keys", configTemplate,
-			"--out", configNew,
-		})
-		require.NoError(t, err)
-
-		// "k1" old value is kept because its key is in the template
-		// "k2" is removed because it isn't in the template
-		// "k3" isn't in new config because it isn't in the old config
-		// [env] is applied from environment variable
-		data, _ := os.ReadFile(configNew)
-		require.Equal(t, `[sec]
-k1 = v1
-
-[env]
-KeY = val
-`, string(data))
-	})
-
-	t.Run("OutputToExisting(environment-to-ini)", func(t *testing.T) {
-		// the legacy "environment-to-ini" (now a wrapper script) behavior:
-		// if no "--out", then "--in-place" must be used to overwrite the existing "--config" file
-		err := NewMainApp(AppVersion{}).Run(t.Context(), []string{
-			"./gitea", "config", "edit-ini",
-			"--apply-env",
-			"--config", configOld,
-		})
-		require.ErrorContains(t, err, "either --in-place or --out must be specified")
-
-		// simulate the "environment-to-ini" behavior with "--in-place"
-		err = NewMainApp(AppVersion{}).Run(t.Context(), []string{
-			"./gitea", "config", "edit-ini",
-			"--in-place",
-			"--apply-env",
-			"--config", configOld,
-		})
-		require.NoError(t, err)
-
-		data, _ := os.ReadFile(configOld)
-		require.Equal(t, `[sec]
-k1 = v1
-k2 = v2
-
-[env]
-KeY = val
-`, string(data))
-	})
-}
--- a/cmd/docs.go
+++ b/cmd/docs.go
@@ -13,24 +13,23 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newDocsCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "docs",
-		Usage:       "Output CLI documentation",
-		Description: "A command to output Gitea's CLI documentation, optionally to a file.",
-		Action:      runDocs,
-		Flags: []cli.Flag{
-			&cli.BoolFlag{
-				Name:  "man",
-				Usage: "Output man pages instead",
-			},
-			&cli.StringFlag{
-				Name:    "output",
-				Aliases: []string{"o"},
-				Usage:   "Path to output to instead of stdout (will overwrite if exists)",
-			},
+// CmdDocs represents the available docs sub-command.
+var CmdDocs = &cli.Command{
+	Name:        "docs",
+	Usage:       "Output CLI documentation",
+	Description: "A command to output Gitea's CLI documentation, optionally to a file.",
+	Action:      runDocs,
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:  "man",
+			Usage: "Output man pages instead",
 		},
-	}
+		&cli.StringFlag{
+			Name:    "output",
+			Aliases: []string{"o"},
+			Usage:   "Path to output to instead of stdout (will overwrite if exists)",
+		},
+	},
 }

 func runDocs(_ context.Context, cmd *cli.Command) error {
--- a/cmd/doctor.go
+++ b/cmd/doctor.go
@@ -24,77 +24,73 @@ import (
 	"xorm.io/xorm"
 )

-func newDoctorCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "doctor",
-		Usage:       "Diagnose and optionally fix problems, convert or re-create database tables",
-		Description: "A command to diagnose problems with the current Gitea instance according to the given configuration. Some problems can optionally be fixed by modifying the database or data storage.",
-		Commands: []*cli.Command{
-			newDoctorCheckCommand(),
-			newRecreateTableCommand(),
-			newDoctorConvertCommand(),
-		},
-	}
+// CmdDoctor represents the available doctor sub-command.
+var CmdDoctor = &cli.Command{
+	Name:        "doctor",
+	Usage:       "Diagnose and optionally fix problems, convert or re-create database tables",
+	Description: "A command to diagnose problems with the current Gitea instance according to the given configuration. Some problems can optionally be fixed by modifying the database or data storage.",
+
+	Commands: []*cli.Command{
+		cmdDoctorCheck,
+		cmdRecreateTable,
+		cmdDoctorConvert,
+	},
 }

-func newDoctorCheckCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "check",
-		Usage:       "Diagnose and optionally fix problems",
-		Description: "A command to diagnose problems with the current Gitea instance according to the given configuration. Some problems can optionally be fixed by modifying the database or data storage.",
-		Action:      runDoctorCheck,
-		Flags: []cli.Flag{
-			&cli.BoolFlag{
-				Name:  "list",
-				Usage: "List the available checks",
-			},
-			&cli.BoolFlag{
-				Name:  "default",
-				Usage: "Run the default checks (if neither --run or --all is set, this is the default behaviour)",
-			},
-			&cli.StringSliceFlag{
-				Name:  "run",
-				Usage: "Run the provided checks - (if --default is set, the default checks will also run)",
-			},
-			&cli.BoolFlag{
-				Name:  "all",
-				Usage: "Run all the available checks",
-			},
-			&cli.BoolFlag{
-				Name:  "fix",
-				Usage: "Automatically fix what we can",
-			},
-			&cli.StringFlag{
-				Name:  "log-file",
-				Usage: `Name of the log file (no verbose log output by default). Set to "-" to output to stdout`,
-			},
-			&cli.BoolFlag{
-				Name:    "color",
-				Aliases: []string{"H"},
-				Usage:   "Use color for outputted information",
-			},
+var cmdDoctorCheck = &cli.Command{
+	Name:        "check",
+	Usage:       "Diagnose and optionally fix problems",
+	Description: "A command to diagnose problems with the current Gitea instance according to the given configuration. Some problems can optionally be fixed by modifying the database or data storage.",
+	Action:      runDoctorCheck,
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:  "list",
+			Usage: "List the available checks",
 		},
-	}
+		&cli.BoolFlag{
+			Name:  "default",
+			Usage: "Run the default checks (if neither --run or --all is set, this is the default behaviour)",
+		},
+		&cli.StringSliceFlag{
+			Name:  "run",
+			Usage: "Run the provided checks - (if --default is set, the default checks will also run)",
+		},
+		&cli.BoolFlag{
+			Name:  "all",
+			Usage: "Run all the available checks",
+		},
+		&cli.BoolFlag{
+			Name:  "fix",
+			Usage: "Automatically fix what we can",
+		},
+		&cli.StringFlag{
+			Name:  "log-file",
+			Usage: `Name of the log file (no verbose log output by default). Set to "-" to output to stdout`,
+		},
+		&cli.BoolFlag{
+			Name:    "color",
+			Aliases: []string{"H"},
+			Usage:   "Use color for outputted information",
+		},
+	},
 }

-func newRecreateTableCommand() *cli.Command {
-	return &cli.Command{
-		Name:      "recreate-table",
-		Usage:     "Recreate tables from XORM definitions and copy the data.",
-		ArgsUsage: "[TABLE]... : (TABLEs to recreate - leave blank for all)",
-		Flags: []cli.Flag{
-			&cli.BoolFlag{
-				Name:  "debug",
-				Usage: "Print SQL commands sent",
-			},
+var cmdRecreateTable = &cli.Command{
+	Name:      "recreate-table",
+	Usage:     "Recreate tables from XORM definitions and copy the data.",
+	ArgsUsage: "[TABLE]... : (TABLEs to recreate - leave blank for all)",
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name:  "debug",
+			Usage: "Print SQL commands sent",
 		},
-		Description: `The database definitions Gitea uses change across versions, sometimes changing default values and leaving old unused columns.
+	},
+	Description: `The database definitions Gitea uses change across versions, sometimes changing default values and leaving old unused columns.

 This command will cause Xorm to recreate tables, copying over the data and deleting the old table.

 You should back-up your database before doing this and ensure that your database is up-to-date first.`,
-		Action: runRecreateTable,
-	}
+	Action: runRecreateTable,
 }

 func runRecreateTable(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/doctor_convert.go
+++ b/cmd/doctor_convert.go
@@ -14,13 +14,12 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newDoctorConvertCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "convert",
-		Usage:       "Convert the database",
-		Description: "A command to convert an existing MySQL database from utf8 to utf8mb4 or MSSQL database from varchar to nvarchar",
-		Action:      runDoctorConvert,
-	}
+// cmdDoctorConvert represents the available convert sub-command.
+var cmdDoctorConvert = &cli.Command{
+	Name:        "convert",
+	Usage:       "Convert the database",
+	Description: "A command to convert an existing MySQL database from utf8 to utf8mb4 or MSSQL database from varchar to nvarchar",
+	Action:      runDoctorConvert,
 }

 func runDoctorConvert(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/doctor_test.go
+++ b/cmd/doctor_test.go
@@ -23,7 +23,7 @@ func TestDoctorRun(t *testing.T) {
 		SkipDatabaseInitialization: true,
 	})
 	app := &cli.Command{
-		Commands: []*cli.Command{newDoctorCheckCommand()},
+		Commands: []*cli.Command{cmdDoctorCheck},
 	}
 	err := app.Run(t.Context(), []string{"./gitea", "check", "--run", "test-check"})
 	assert.NoError(t, err)
--- a/cmd/dump.go
+++ b/cmd/dump.go
@@ -23,79 +23,78 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newDumpCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "dump",
-		Usage:       "Dump Gitea files and database",
-		Description: `Dump compresses all related files and database into zip file. It can be used for backup and capture Gitea server image to send to maintainer`,
-		Action:      runDump,
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "file",
-				Aliases: []string{"f"},
-				Usage:   `Name of the dump file which will be created, default to "gitea-dump-{time}.zip". Supply '-' for stdout. See type for available types.`,
-			},
-			&cli.BoolFlag{
-				Name:    "verbose",
-				Aliases: []string{"V"},
-				Usage:   "Show process details",
-			},
-			&cli.BoolFlag{
-				Name:    "quiet",
-				Aliases: []string{"q"},
-				Usage:   "Only display warnings and errors",
-			},
-			&cli.StringFlag{
-				Name:    "tempdir",
-				Aliases: []string{"t"},
-				Value:   os.TempDir(),
-				Usage:   "Temporary dir path",
-			},
-			&cli.StringFlag{
-				Name:    "database",
-				Aliases: []string{"d"},
-				Usage:   "Specify the database SQL syntax: sqlite3, mysql, mssql, postgres",
-			},
-			&cli.BoolFlag{
-				Name:    "skip-repository",
-				Aliases: []string{"R"},
-				Usage:   "Skip the repository dumping",
-			},
-			&cli.BoolFlag{
-				Name:    "skip-log",
-				Aliases: []string{"L"},
-				Usage:   "Skip the log dumping",
-			},
-			&cli.BoolFlag{
-				Name:  "skip-custom-dir",
-				Usage: "Skip custom directory",
-			},
-			&cli.BoolFlag{
-				Name:  "skip-lfs-data",
-				Usage: "Skip LFS data",
-			},
-			&cli.BoolFlag{
-				Name:  "skip-attachment-data",
-				Usage: "Skip attachment data",
-			},
-			&cli.BoolFlag{
-				Name:  "skip-package-data",
-				Usage: "Skip package data",
-			},
-			&cli.BoolFlag{
-				Name:  "skip-index",
-				Usage: "Skip bleve index data",
-			},
-			&cli.BoolFlag{
-				Name:  "skip-db",
-				Usage: "Skip database",
-			},
-			&cli.StringFlag{
-				Name:  "type",
-				Usage: `Dump output format, default to "zip", supported types: ` + strings.Join(dump.SupportedOutputTypes, ", "),
-			},
+// CmdDump represents the available dump sub-command.
+var CmdDump = &cli.Command{
+	Name:        "dump",
+	Usage:       "Dump Gitea files and database",
+	Description: `Dump compresses all related files and database into zip file. It can be used for backup and capture Gitea server image to send to maintainer`,
+	Action:      runDump,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:    "file",
+			Aliases: []string{"f"},
+			Usage:   `Name of the dump file which will be created, default to "gitea-dump-{time}.zip". Supply '-' for stdout. See type for available types.`,
 		},
-	}
+		&cli.BoolFlag{
+			Name:    "verbose",
+			Aliases: []string{"V"},
+			Usage:   "Show process details",
+		},
+		&cli.BoolFlag{
+			Name:    "quiet",
+			Aliases: []string{"q"},
+			Usage:   "Only display warnings and errors",
+		},
+		&cli.StringFlag{
+			Name:    "tempdir",
+			Aliases: []string{"t"},
+			Value:   os.TempDir(),
+			Usage:   "Temporary dir path",
+		},
+		&cli.StringFlag{
+			Name:    "database",
+			Aliases: []string{"d"},
+			Usage:   "Specify the database SQL syntax: sqlite3, mysql, mssql, postgres",
+		},
+		&cli.BoolFlag{
+			Name:    "skip-repository",
+			Aliases: []string{"R"},
+			Usage:   "Skip the repository dumping",
+		},
+		&cli.BoolFlag{
+			Name:    "skip-log",
+			Aliases: []string{"L"},
+			Usage:   "Skip the log dumping",
+		},
+		&cli.BoolFlag{
+			Name:  "skip-custom-dir",
+			Usage: "Skip custom directory",
+		},
+		&cli.BoolFlag{
+			Name:  "skip-lfs-data",
+			Usage: "Skip LFS data",
+		},
+		&cli.BoolFlag{
+			Name:  "skip-attachment-data",
+			Usage: "Skip attachment data",
+		},
+		&cli.BoolFlag{
+			Name:  "skip-package-data",
+			Usage: "Skip package data",
+		},
+		&cli.BoolFlag{
+			Name:  "skip-index",
+			Usage: "Skip bleve index data",
+		},
+		&cli.BoolFlag{
+			Name:  "skip-db",
+			Usage: "Skip database",
+		},
+		&cli.StringFlag{
+			Name:  "type",
+			Usage: `Dump output format, default to "zip", supported types: ` + strings.Join(dump.SupportedOutputTypes, ", "),
+		},
+	},
 }

 func fatal(format string, args ...any) {
--- a/cmd/dump_repo.go
+++ b/cmd/dump_repo.go
@@ -22,62 +22,61 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newDumpRepositoryCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "dump-repo",
-		Usage:       "Dump the repository from git/github/gitea/gitlab",
-		Description: "This is a command for dumping the repository data.",
-		Action:      runDumpRepository,
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:  "git_service",
-				Value: "",
-				Usage: "Git service, git, github, gitea, gitlab. If clone_addr could be recognized, this could be ignored.",
-			},
-			&cli.StringFlag{
-				Name:    "repo_dir",
-				Aliases: []string{"r"},
-				Value:   "./data",
-				Usage:   "Repository dir path to store the data",
-			},
-			&cli.StringFlag{
-				Name:  "clone_addr",
-				Value: "",
-				Usage: "The URL will be clone, currently could be a git/github/gitea/gitlab http/https URL",
-			},
-			&cli.StringFlag{
-				Name:  "auth_username",
-				Value: "",
-				Usage: "The username to visit the clone_addr",
-			},
-			&cli.StringFlag{
-				Name:  "auth_password",
-				Value: "",
-				Usage: "The password to visit the clone_addr",
-			},
-			&cli.StringFlag{
-				Name:  "auth_token",
-				Value: "",
-				Usage: "The personal token to visit the clone_addr",
-			},
-			&cli.StringFlag{
-				Name:  "owner_name",
-				Value: "",
-				Usage: "The data will be stored on a directory with owner name if not empty",
-			},
-			&cli.StringFlag{
-				Name:  "repo_name",
-				Value: "",
-				Usage: "The data will be stored on a directory with repository name if not empty",
-			},
-			&cli.StringFlag{
-				Name:  "units",
-				Value: "",
-				Usage: `Which items will be migrated, one or more units should be separated as comma.
-wiki, issues, labels, releases, release_assets, milestones, pull_requests, comments are allowed. Empty means all units.`,
-			},
+// CmdDumpRepository represents the available dump repository sub-command.
+var CmdDumpRepository = &cli.Command{
+	Name:        "dump-repo",
+	Usage:       "Dump the repository from git/github/gitea/gitlab",
+	Description: "This is a command for dumping the repository data.",
+	Action:      runDumpRepository,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:  "git_service",
+			Value: "",
+			Usage: "Git service, git, github, gitea, gitlab. If clone_addr could be recognized, this could be ignored.",
 		},
-	}
+		&cli.StringFlag{
+			Name:    "repo_dir",
+			Aliases: []string{"r"},
+			Value:   "./data",
+			Usage:   "Repository dir path to store the data",
+		},
+		&cli.StringFlag{
+			Name:  "clone_addr",
+			Value: "",
+			Usage: "The URL will be clone, currently could be a git/github/gitea/gitlab http/https URL",
+		},
+		&cli.StringFlag{
+			Name:  "auth_username",
+			Value: "",
+			Usage: "The username to visit the clone_addr",
+		},
+		&cli.StringFlag{
+			Name:  "auth_password",
+			Value: "",
+			Usage: "The password to visit the clone_addr",
+		},
+		&cli.StringFlag{
+			Name:  "auth_token",
+			Value: "",
+			Usage: "The personal token to visit the clone_addr",
+		},
+		&cli.StringFlag{
+			Name:  "owner_name",
+			Value: "",
+			Usage: "The data will be stored on a directory with owner name if not empty",
+		},
+		&cli.StringFlag{
+			Name:  "repo_name",
+			Value: "",
+			Usage: "The data will be stored on a directory with repository name if not empty",
+		},
+		&cli.StringFlag{
+			Name:  "units",
+			Value: "",
+			Usage: `Which items will be migrated, one or more units should be separated as comma.
+wiki, issues, labels, releases, release_assets, milestones, pull_requests, comments are allowed. Empty means all units.`,
+		},
+	},
 }

 func runDumpRepository(ctx context.Context, cmd *cli.Command) error {
--- a/cmd/embedded.go
+++ b/cmd/embedded.go
@@ -23,23 +23,20 @@ import (
 	"github.com/urfave/cli/v3"
 )

-var matchedAssetFiles []assetFile
-
-func newEmbeddedCommand() *cli.Command {
-	return &cli.Command{
+// CmdEmbedded represents the available extract sub-command.
+var (
+	CmdEmbedded = &cli.Command{
 		Name:        "embedded",
 		Usage:       "Extract embedded resources",
 		Description: "A command for extracting embedded resources, like templates and images",
 		Commands: []*cli.Command{
-			newEmbeddedListCommand(),
-			newEmbeddedViewCommand(),
-			newEmbeddedExtractCommand(),
+			subcmdList,
+			subcmdView,
+			subcmdExtract,
 		},
 	}
-}

-func newEmbeddedListCommand() *cli.Command {
-	return &cli.Command{
+	subcmdList = &cli.Command{
 		Name:   "list",
 		Usage:  "List files matching the given pattern",
 		Action: runList,
@@ -51,10 +48,8 @@ func newEmbeddedListCommand() *cli.Command {
 			},
 		},
 	}
-}

-func newEmbeddedViewCommand() *cli.Command {
-	return &cli.Command{
+	subcmdView = &cli.Command{
 		Name:   "view",
 		Usage:  "View a file matching the given pattern",
 		Action: runView,
@@ -66,10 +61,8 @@ func newEmbeddedViewCommand() *cli.Command {
 			},
 		},
 	}
-}

-func newEmbeddedExtractCommand() *cli.Command {
-	return &cli.Command{
+	subcmdExtract = &cli.Command{
 		Name:   "extract",
 		Usage:  "Extract resources",
 		Action: runExtract,
@@ -98,7 +91,9 @@ func newEmbeddedExtractCommand() *cli.Command {
 			},
 		},
 	}
-}
+
+	matchedAssetFiles []assetFile
+)

 type assetFile struct {
 	fs   *assetfs.LayeredFS
--- a/cmd/generate.go
+++ b/cmd/generate.go
@@ -15,52 +15,45 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newGenerateCommand() *cli.Command {
-	return &cli.Command{
+var (
+	// CmdGenerate represents the available generate sub-command.
+	CmdGenerate = &cli.Command{
 		Name:  "generate",
 		Usage: "Generate Gitea's secrets/keys/tokens",
 		Commands: []*cli.Command{
-			newGenerateSecretCommand(),
+			subcmdSecret,
 		},
 	}
-}

-func newGenerateSecretCommand() *cli.Command {
-	return &cli.Command{
+	subcmdSecret = &cli.Command{
 		Name:  "secret",
 		Usage: "Generate a secret token",
 		Commands: []*cli.Command{
-			newGenerateInternalTokenCommand(),
-			newGenerateLfsJWTSecretCommand(),
-			newGenerateSecretKeyCommand(),
+			microcmdGenerateInternalToken,
+			microcmdGenerateLfsJwtSecret,
+			microcmdGenerateSecretKey,
 		},
 	}
-}

-func newGenerateInternalTokenCommand() *cli.Command {
-	return &cli.Command{
+	microcmdGenerateInternalToken = &cli.Command{
 		Name:   "INTERNAL_TOKEN",
 		Usage:  "Generate a new INTERNAL_TOKEN",
 		Action: runGenerateInternalToken,
 	}
-}

-func newGenerateLfsJWTSecretCommand() *cli.Command {
-	return &cli.Command{
+	microcmdGenerateLfsJwtSecret = &cli.Command{
 		Name:    "JWT_SECRET",
 		Aliases: []string{"LFS_JWT_SECRET"},
 		Usage:   "Generate a new JWT_SECRET",
 		Action:  runGenerateLfsJwtSecret,
 	}
-}

-func newGenerateSecretKeyCommand() *cli.Command {
-	return &cli.Command{
+	microcmdGenerateSecretKey = &cli.Command{
 		Name:   "SECRET_KEY",
 		Usage:  "Generate a new SECRET_KEY",
 		Action: runGenerateSecretKey,
 	}
-}
+)

 func runGenerateInternalToken(_ context.Context, c *cli.Command) error {
 	internalToken, err := generate.NewInternalToken()
@@ -78,7 +71,11 @@ func runGenerateInternalToken(_ context.Context, c *cli.Command) error {
 }

 func runGenerateLfsJwtSecret(_ context.Context, c *cli.Command) error {
-	_, jwtSecretBase64 := generate.NewJwtSecretWithBase64()
+	_, jwtSecretBase64, err := generate.NewJwtSecretWithBase64()
+	if err != nil {
+		return err
+	}
+
 	fmt.Printf("%s", jwtSecretBase64)

 	if isatty.IsTerminal(os.Stdout.Fd()) {
@@ -94,7 +91,6 @@ func runGenerateSecretKey(_ context.Context, c *cli.Command) error {
 		return err
 	}

-	// codeql[disable-next-line=go/clear-text-logging]
 	fmt.Printf("%s", secretKey)

 	if isatty.IsTerminal(os.Stdout.Fd()) {
--- a/cmd/hook.go
+++ b/cmd/hook.go
@@ -28,24 +28,23 @@ const (
 	hookBatchSize = 500
 )

-func newHookCommand() *cli.Command {
-	return &cli.Command{
+var (
+	// CmdHook represents the available hooks sub-command.
+	CmdHook = &cli.Command{
 		Name:        "hook",
 		Usage:       "(internal) Should only be called by Git",
 		Hidden:      true, // internal commands shouldn't be visible
 		Description: "Delegate commands to corresponding Git hooks",
 		Before:      PrepareConsoleLoggerLevel(log.FATAL),
 		Commands: []*cli.Command{
-			newHookPreReceiveCommand(),
-			newHookUpdateCommand(),
-			newHookPostReceiveCommand(),
-			newHookProcReceiveCommand(),
+			subcmdHookPreReceive,
+			subcmdHookUpdate,
+			subcmdHookPostReceive,
+			subcmdHookProcReceive,
 		},
 	}
-}

-func newHookPreReceiveCommand() *cli.Command {
-	return &cli.Command{
+	subcmdHookPreReceive = &cli.Command{
 		Name:        "pre-receive",
 		Usage:       "Delegate pre-receive Git hook",
 		Description: "This command should only be called by Git",
@@ -56,10 +55,7 @@ func newHookPreReceiveCommand() *cli.Command {
 			},
 		},
 	}
-}
-
-func newHookUpdateCommand() *cli.Command {
-	return &cli.Command{
+	subcmdHookUpdate = &cli.Command{
 		Name:        "update",
 		Usage:       "Delegate update Git hook",
 		Description: "This command should only be called by Git",
@@ -70,10 +66,7 @@ func newHookUpdateCommand() *cli.Command {
 			},
 		},
 	}
-}
-
-func newHookPostReceiveCommand() *cli.Command {
-	return &cli.Command{
+	subcmdHookPostReceive = &cli.Command{
 		Name:        "post-receive",
 		Usage:       "Delegate post-receive Git hook",
 		Description: "This command should only be called by Git",
@@ -84,11 +77,8 @@ func newHookPostReceiveCommand() *cli.Command {
 			},
 		},
 	}
-}
-
-// Note: new hook since git 2.29
-func newHookProcReceiveCommand() *cli.Command {
-	return &cli.Command{
+	// Note: new hook since git 2.29
+	subcmdHookProcReceive = &cli.Command{
 		Name:        "proc-receive",
 		Usage:       "Delegate proc-receive Git hook",
 		Description: "This command should only be called by Git",
@@ -99,7 +89,7 @@ func newHookProcReceiveCommand() *cli.Command {
 			},
 		},
 	}
-}
+)

 type delayWriter struct {
 	internal io.Writer
@@ -173,14 +163,6 @@ func (n *nilWriter) WriteString(s string) (int, error) {
 	return len(s), nil
 }

-func parseGitHookCommitRefLine(line string) (oldCommitID, newCommitID string, refFullName git.RefName, ok bool) {
-	fields := strings.Split(line, " ")
-	if len(fields) != 3 {
-		return "", "", "", false
-	}
-	return fields[0], fields[1], git.RefName(fields[2]), true
-}
-
 func runHookPreReceive(ctx context.Context, c *cli.Command) error {
 	if isInternal, _ := strconv.ParseBool(os.Getenv(repo_module.EnvIsInternal)); isInternal {
 		return nil
@@ -204,7 +186,7 @@ Gitea or set your environment appropriately.`, "")
 	userID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPusherID), 10, 64)
 	prID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPRID), 10, 64)
 	deployKeyID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvDeployKeyID), 10, 64)
-	actionsTaskID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvActionsTaskID), 10, 64)
+	actionPerm, _ := strconv.ParseInt(os.Getenv(repo_module.EnvActionPerm), 10, 64)

 	hookOptions := private.HookOptions{
 		UserID:                          userID,
@@ -214,8 +196,7 @@ Gitea or set your environment appropriately.`, "")
 		GitPushOptions:                  pushOptions(),
 		PullRequestID:                   prID,
 		DeployKeyID:                     deployKeyID,
-		ActionsTaskID:                   actionsTaskID,
-		IsWiki:                          isWiki,
+		ActionPerm:                      int(actionPerm),
 	}

 	scanner := bufio.NewScanner(os.Stdin)
@@ -247,11 +228,14 @@ Gitea or set your environment appropriately.`, "")
 			continue
 		}

-		oldCommitID, newCommitID, refFullName, ok := parseGitHookCommitRefLine(scanner.Text())
-		if !ok {
+		fields := bytes.Fields(scanner.Bytes())
+		if len(fields) != 3 {
 			continue
 		}

+		oldCommitID := string(fields[0])
+		newCommitID := string(fields[1])
+		refFullName := git.RefName(fields[2])
 		total++
 		lastline++

@@ -286,9 +270,6 @@ Gitea or set your environment appropriately.`, "")
 			lastline = 0
 		}
 	}
-	if err := scanner.Err(); err != nil {
-		return fail(ctx, "Hook failed: stdin read error", "scanner error: %v", err)
-	}

 	if count > 0 {
 		hookOptions.OldCommitIDs = oldCommitIDs[:count]
@@ -332,7 +313,7 @@ func runHookPostReceive(ctx context.Context, c *cli.Command) error {
 	setup(ctx, c.Bool("debug"))

 	// First of all run update-server-info no matter what
-	if err := gitcmd.NewCommand("update-server-info").RunWithStderr(ctx); err != nil {
+	if _, _, err := gitcmd.NewCommand("update-server-info").RunStdString(ctx, nil); err != nil {
 		return fmt.Errorf("failed to call 'git update-server-info': %w", err)
 	}

@@ -380,7 +361,6 @@ Gitea or set your environment appropriately.`, "")
 		GitPushOptions:                  pushOptions(),
 		PullRequestID:                   prID,
 		PushTrigger:                     repo_module.PushTrigger(os.Getenv(repo_module.EnvPushTrigger)),
-		IsWiki:                          isWiki,
 	}
 	oldCommitIDs := make([]string, hookBatchSize)
 	newCommitIDs := make([]string, hookBatchSize)
@@ -398,13 +378,16 @@ Gitea or set your environment appropriately.`, "")
 			continue
 		}

-		var ok bool
-		oldCommitIDs[count], newCommitIDs[count], refFullNames[count], ok = parseGitHookCommitRefLine(scanner.Text())
-		if !ok {
+		fields := bytes.Fields(scanner.Bytes())
+		if len(fields) != 3 {
 			continue
 		}

 		fmt.Fprintf(out, ".")
+		oldCommitIDs[count] = string(fields[0])
+		newCommitIDs[count] = string(fields[1])
+		refFullNames[count] = git.RefName(fields[2])
+
 		commitID, _ := git.NewIDFromString(newCommitIDs[count])
 		if refFullNames[count] == git.BranchPrefix+"master" && !commitID.IsZero() && count == total {
 			masterPushed = true
@@ -428,11 +411,6 @@ Gitea or set your environment appropriately.`, "")
 			count = 0
 		}
 	}
-	if err := scanner.Err(); err != nil {
-		_ = dWriter.Close()
-		hookPrintResults(results)
-		return fail(ctx, "Hook failed: stdin read error", "scanner error: %v", err)
-	}

 	if count == 0 {
 		if wasEmpty && masterPushed {
@@ -533,7 +511,6 @@ Gitea or set your environment appropriately.`, "")

 	reader := bufio.NewReader(os.Stdin)
 	repoUser := os.Getenv(repo_module.EnvRepoUsername)
-	isWiki, _ := strconv.ParseBool(os.Getenv(repo_module.EnvRepoIsWiki))
 	repoName := os.Getenv(repo_module.EnvRepoName)
 	pusherID, _ := strconv.ParseInt(os.Getenv(repo_module.EnvPusherID), 10, 64)
 	pusherName := os.Getenv(repo_module.EnvPusherName)
@@ -611,15 +588,14 @@ Gitea or set your environment appropriately.`, "")
 		UserName:       pusherName,
 		UserID:         pusherID,
 		GitPushOptions: make(map[string]string),
-		IsWiki:         isWiki,
 	}
 	hookOptions.OldCommitIDs = make([]string, 0, hookBatchSize)
 	hookOptions.NewCommitIDs = make([]string, 0, hookBatchSize)
 	hookOptions.RefFullNames = make([]git.RefName, 0, hookBatchSize)

 	for {
-		// note: pktLineTypeUnknown means pktLineTypeFlush and pktLineTypeData all allowed
-		rs, err = readPktLine(ctx, reader, pktLineTypeUnknown)
+		// note: pktLineTypeUnknow means pktLineTypeFlush and pktLineTypeData all allowed
+		rs, err = readPktLine(ctx, reader, pktLineTypeUnknow)
 		if err != nil {
 			return err
 		}
@@ -638,7 +614,7 @@ Gitea or set your environment appropriately.`, "")

 	if hasPushOptions {
 		for {
-			rs, err = readPktLine(ctx, reader, pktLineTypeUnknown)
+			rs, err = readPktLine(ctx, reader, pktLineTypeUnknow)
 			if err != nil {
 				return err
 			}
@@ -735,8 +711,8 @@ Gitea or set your environment appropriately.`, "")
 type pktLineType int64

 const (
-	// Unknown type
-	pktLineTypeUnknown pktLineType = 0
+	// UnKnow type
+	pktLineTypeUnknow pktLineType = 0
 	// flush-pkt "0000"
 	pktLineTypeFlush pktLineType = iota
 	// data line
--- a/cmd/hook_test.go
+++ b/cmd/hook_test.go
@@ -39,17 +39,3 @@ func TestPktLine(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, []byte("0007a\nb"), w.Bytes())
 }
-
-func TestParseGitHookCommitRefLine(t *testing.T) {
-	oldCommitID, newCommitID, refName, ok := parseGitHookCommitRefLine("a b c")
-	assert.True(t, ok)
-	assert.Equal(t, "a", oldCommitID)
-	assert.Equal(t, "b", newCommitID)
-	assert.Equal(t, "c", string(refName))
-
-	_, _, _, ok = parseGitHookCommitRefLine("a\tb\tc")
-	assert.False(t, ok)
-
-	_, _, _, ok = parseGitHookCommitRefLine("a b")
-	assert.False(t, ok)
-}
--- a/cmd/keys.go
+++ b/cmd/keys.go
@@ -15,42 +15,40 @@ import (
 	"github.com/urfave/cli/v3"
 )

-// NewKeysCommand returns the internal SSH key lookup sub-command.
-func NewKeysCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "keys",
-		Usage:       "(internal) Should only be called by SSH server",
-		Hidden:      true, // internal commands shouldn't be visible
-		Description: "Queries the Gitea database to get the authorized command for a given ssh key fingerprint",
-		Before:      PrepareConsoleLoggerLevel(log.FATAL),
-		Action:      runKeys,
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "expected",
-				Aliases: []string{"e"},
-				Value:   "git",
-				Usage:   "Expected user for whom provide key commands",
-			},
-			&cli.StringFlag{
-				Name:    "username",
-				Aliases: []string{"u"},
-				Value:   "",
-				Usage:   "Username trying to log in by SSH",
-			},
-			&cli.StringFlag{
-				Name:    "type",
-				Aliases: []string{"t"},
-				Value:   "",
-				Usage:   "Type of the SSH key provided to the SSH Server (requires content to be provided too)",
-			},
-			&cli.StringFlag{
-				Name:    "content",
-				Aliases: []string{"k"},
-				Value:   "",
-				Usage:   "Base64 encoded content of the SSH key provided to the SSH Server (requires type to be provided too)",
-			},
+// CmdKeys represents the available keys sub-command
+var CmdKeys = &cli.Command{
+	Name:        "keys",
+	Usage:       "(internal) Should only be called by SSH server",
+	Hidden:      true, // internal commands shouldn't be visible
+	Description: "Queries the Gitea database to get the authorized command for a given ssh key fingerprint",
+	Before:      PrepareConsoleLoggerLevel(log.FATAL),
+	Action:      runKeys,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:    "expected",
+			Aliases: []string{"e"},
+			Value:   "git",
+			Usage:   "Expected user for whom provide key commands",
 		},
-	}
+		&cli.StringFlag{
+			Name:    "username",
+			Aliases: []string{"u"},
+			Value:   "",
+			Usage:   "Username trying to log in by SSH",
+		},
+		&cli.StringFlag{
+			Name:    "type",
+			Aliases: []string{"t"},
+			Value:   "",
+			Usage:   "Type of the SSH key provided to the SSH Server (requires content to be provided too)",
+		},
+		&cli.StringFlag{
+			Name:    "content",
+			Aliases: []string{"k"},
+			Value:   "",
+			Usage:   "Base64 encoded content of the SSH key provided to the SSH Server (requires type to be provided too)",
+		},
+	},
 }

 func runKeys(ctx context.Context, c *cli.Command) error {
--- a/cmd/mailer.go
+++ b/cmd/mailer.go
@@ -17,10 +17,10 @@ func runSendMail(ctx context.Context, c *cli.Command) error {
 	setting.MustInstalled()

 	subject := c.String("title")
-	confirmSkipped := c.Bool("force")
+	confirmSkiped := c.Bool("force")
 	body := c.String("content")

-	if !confirmSkipped {
+	if !confirmSkiped {
 		if len(body) == 0 {
 			fmt.Print("warning: Content is empty")
 		}
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -112,36 +112,34 @@ func NewMainApp(appVer AppVersion) *cli.Command {
 			Usage:     "Set custom path (defaults to '{WorkPath}/custom')",
 		},
 	}
-	webCmd := newWebCommand()
 	// these sub-commands need to use a config file
 	subCmdWithConfig := []*cli.Command{
-		webCmd,
-		newServCommand(),
-		newHookCommand(),
-		NewKeysCommand(),
-		newDumpCommand(),
-		newAdminCommand(),
-		newMigrateCommand(),
-		newDoctorCommand(),
-		newManagerCommand(),
-		newEmbeddedCommand(),
-		newMigrateStorageCommand(),
-		newDumpRepositoryCommand(),
-		newRestoreRepositoryCommand(),
-		newActionsCommand(),
+		CmdWeb,
+		CmdServ,
+		CmdHook,
+		CmdKeys,
+		CmdDump,
+		CmdAdmin,
+		CmdMigrate,
+		CmdDoctor,
+		CmdManager,
+		CmdEmbedded,
+		CmdMigrateStorage,
+		CmdDumpRepository,
+		CmdRestoreRepository,
+		CmdActions,
 	}

 	// these sub-commands do not need the config file, and they do not depend on any path or environment variable.
 	subCmdStandalone := []*cli.Command{
-		cmdConfig(),
 		cmdCert(),
-		newGenerateCommand(),
-		newDocsCommand(),
+		CmdGenerate,
+		CmdDocs,
 	}

 	// TODO: we should eventually drop the default command,
 	// but not sure whether it would break Windows users who used to double-click the EXE to run.
-	app.DefaultCommand = webCmd.Name
+	app.DefaultCommand = CmdWeb.Name

 	app.Before = PrepareConsoleLoggerLevel(log.INFO)
 	for i := range subCmdWithConfig {
@@ -150,7 +148,7 @@ func NewMainApp(appVer AppVersion) *cli.Command {
 	app.Commands = append(app.Commands, subCmdWithConfig...)
 	app.Commands = append(app.Commands, subCmdStandalone...)

-	setting.UnsetUnnecessaryEnvVars()
+	setting.InitGiteaEnvVars()
 	return app
 }

--- a/cmd/main_test.go
+++ b/cmd/main_test.go
@@ -157,7 +157,6 @@ func TestCliCmd(t *testing.T) {

 	for _, c := range cases {
 		t.Run(c.cmd, func(t *testing.T) {
-			defer test.MockVariableValue(&setting.InstallLock, false)()
 			app := newTestApp(cli.Command{
 				Action: func(ctx context.Context, cmd *cli.Command) error {
 					_, _ = fmt.Fprint(cmd.Root().Writer, makePathOutput(setting.AppWorkPath, setting.CustomPath, setting.CustomConf))
@@ -171,10 +170,7 @@ func TestCliCmd(t *testing.T) {
 			r, err := runTestApp(app, args...)
 			assert.NoError(t, err, c.cmd)
 			assert.NotEmpty(t, c.exp, c.cmd)
-			if !assert.Contains(t, r.Stdout, c.exp, c.cmd) {
-				t.Log("Full output:\n" + r.Stdout)
-				t.Log("Expected:\n" + c.exp)
-			}
+			assert.Contains(t, r.Stdout, c.exp, c.cmd)
 		})
 	}
 }
--- a/cmd/manager.go
+++ b/cmd/manager.go
@@ -13,24 +13,22 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newManagerCommand() *cli.Command {
-	return &cli.Command{
+var (
+	// CmdManager represents the manager command
+	CmdManager = &cli.Command{
 		Name:        "manager",
 		Usage:       "Manage the running gitea process",
 		Description: "This is a command for managing the running gitea process",
 		Commands: []*cli.Command{
-			newShutdownCommand(),
-			newRestartCommand(),
-			newReloadTemplatesCommand(),
-			newFlushQueuesCommand(),
-			newLoggingCommand(),
-			newProcessesCommand(),
+			subcmdShutdown,
+			subcmdRestart,
+			subcmdReloadTemplates,
+			subcmdFlushQueues,
+			subcmdLogging,
+			subCmdProcesses,
 		},
 	}
-}
-
-func newShutdownCommand() *cli.Command {
-	return &cli.Command{
+	subcmdShutdown = &cli.Command{
 		Name:  "shutdown",
 		Usage: "Gracefully shutdown the running process",
 		Flags: []cli.Flag{
@@ -40,10 +38,7 @@ func newShutdownCommand() *cli.Command {
 		},
 		Action: runShutdown,
 	}
-}
-
-func newRestartCommand() *cli.Command {
-	return &cli.Command{
+	subcmdRestart = &cli.Command{
 		Name:  "restart",
 		Usage: "Gracefully restart the running process - (not implemented for windows servers)",
 		Flags: []cli.Flag{
@@ -53,10 +48,7 @@ func newRestartCommand() *cli.Command {
 		},
 		Action: runRestart,
 	}
-}
-
-func newReloadTemplatesCommand() *cli.Command {
-	return &cli.Command{
+	subcmdReloadTemplates = &cli.Command{
 		Name:  "reload-templates",
 		Usage: "Reload template files in the running process",
 		Flags: []cli.Flag{
@@ -66,10 +58,7 @@ func newReloadTemplatesCommand() *cli.Command {
 		},
 		Action: runReloadTemplates,
 	}
-}
-
-func newFlushQueuesCommand() *cli.Command {
-	return &cli.Command{
+	subcmdFlushQueues = &cli.Command{
 		Name:   "flush-queues",
 		Usage:  "Flush queues in the running process",
 		Action: runFlushQueues,
@@ -88,10 +77,7 @@ func newFlushQueuesCommand() *cli.Command {
 			},
 		},
 	}
-}
-
-func newProcessesCommand() *cli.Command {
-	return &cli.Command{
+	subCmdProcesses = &cli.Command{
 		Name:   "processes",
 		Usage:  "Display running processes within the current process",
 		Action: runProcesses,
@@ -121,7 +107,7 @@ func newProcessesCommand() *cli.Command {
 			},
 		},
 	}
-}
+)

 func runShutdown(ctx context.Context, c *cli.Command) error {
 	setup(ctx, c.Bool("debug"))
--- a/cmd/manager_logging.go
+++ b/cmd/manager_logging.go
@@ -15,8 +15,8 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func defaultLoggingFlags() []cli.Flag {
-	return []cli.Flag{
+var (
+	defaultLoggingFlags = []cli.Flag{
 		&cli.StringFlag{
 			Name:  "logger",
 			Usage: `Logger name - will default to "default"`,
@@ -57,10 +57,8 @@ func defaultLoggingFlags() []cli.Flag {
 			Name: "debug",
 		},
 	}
-}

-func newLoggingCommand() *cli.Command {
-	return &cli.Command{
+	subcmdLogging = &cli.Command{
 		Name:  "logging",
 		Usage: "Adjust logging commands",
 		Commands: []*cli.Command{
@@ -111,7 +109,7 @@ func newLoggingCommand() *cli.Command {
 					{
 						Name:  "file",
 						Usage: "Add a file logger",
-						Flags: append(defaultLoggingFlags(), []cli.Flag{
+						Flags: append(defaultLoggingFlags, []cli.Flag{
 							&cli.StringFlag{
 								Name:    "filename",
 								Aliases: []string{"f"},
@@ -152,7 +150,7 @@ func newLoggingCommand() *cli.Command {
 					}, {
 						Name:  "conn",
 						Usage: "Add a net conn logger",
-						Flags: append(defaultLoggingFlags(), []cli.Flag{
+						Flags: append(defaultLoggingFlags, []cli.Flag{
 							&cli.BoolFlag{
 								Name:    "reconnect-on-message",
 								Aliases: []string{"R"},
@@ -193,7 +191,7 @@ func newLoggingCommand() *cli.Command {
 			},
 		},
 	}
-}
+)

 func runRemoveLogger(ctx context.Context, c *cli.Command) error {
 	setup(ctx, c.Bool("debug"))
--- a/cmd/migrate.go
+++ b/cmd/migrate.go
@@ -14,13 +14,12 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newMigrateCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "migrate",
-		Usage:       "Migrate the database",
-		Description: `This is a command for migrating the database, so that you can run "gitea admin create user" before starting the server.`,
-		Action:      runMigrate,
-	}
+// CmdMigrate represents the available migrate sub-command.
+var CmdMigrate = &cli.Command{
+	Name:        "migrate",
+	Usage:       "Migrate the database",
+	Description: `This is a command for migrating the database, so that you can run "gitea admin create user" before starting the server.`,
+	Action:      runMigrate,
 }

 func runMigrate(ctx context.Context, c *cli.Command) error {
--- a/cmd/migrate_storage.go
+++ b/cmd/migrate_storage.go
@@ -25,108 +25,107 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newMigrateStorageCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "migrate-storage",
-		Usage:       "Migrate the storage",
-		Description: "Copies stored files from storage configured in app.ini to parameter-configured storage",
-		Action:      runMigrateStorage,
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "type",
-				Aliases: []string{"t"},
-				Value:   "",
-				Usage:   "Type of stored files to copy.  Allowed types: 'attachments', 'lfs', 'avatars', 'repo-avatars', 'repo-archivers', 'packages', 'actions-log', 'actions-artifacts'",
-			},
-			&cli.StringFlag{
-				Name:    "storage",
-				Aliases: []string{"s"},
-				Value:   "",
-				Usage:   "New storage type: local (default), minio or azureblob",
-			},
-			&cli.StringFlag{
-				Name:    "path",
-				Aliases: []string{"p"},
-				Value:   "",
-				Usage:   "New storage placement if store is local (leave blank for default)",
-			},
-			// Minio Storage special configurations
-			&cli.StringFlag{
-				Name:  "minio-endpoint",
-				Value: "",
-				Usage: "Minio storage endpoint",
-			},
-			&cli.StringFlag{
-				Name:  "minio-access-key-id",
-				Value: "",
-				Usage: "Minio storage accessKeyID",
-			},
-			&cli.StringFlag{
-				Name:  "minio-secret-access-key",
-				Value: "",
-				Usage: "Minio storage secretAccessKey",
-			},
-			&cli.StringFlag{
-				Name:  "minio-bucket",
-				Value: "",
-				Usage: "Minio storage bucket",
-			},
-			&cli.StringFlag{
-				Name:  "minio-location",
-				Value: "",
-				Usage: "Minio storage location to create bucket",
-			},
-			&cli.StringFlag{
-				Name:  "minio-base-path",
-				Value: "",
-				Usage: "Minio storage base path on the bucket",
-			},
-			&cli.BoolFlag{
-				Name:  "minio-use-ssl",
-				Usage: "Enable SSL for minio",
-			},
-			&cli.BoolFlag{
-				Name:  "minio-insecure-skip-verify",
-				Usage: "Skip SSL verification",
-			},
-			&cli.StringFlag{
-				Name:  "minio-checksum-algorithm",
-				Value: "",
-				Usage: "Minio checksum algorithm (default/md5)",
-			},
-			&cli.StringFlag{
-				Name:  "minio-bucket-lookup-type",
-				Value: "",
-				Usage: "Minio bucket lookup type",
-			},
-			// Azure Blob Storage special configurations
-			&cli.StringFlag{
-				Name:  "azureblob-endpoint",
-				Value: "",
-				Usage: "Azure Blob storage endpoint",
-			},
-			&cli.StringFlag{
-				Name:  "azureblob-account-name",
-				Value: "",
-				Usage: "Azure Blob storage account name",
-			},
-			&cli.StringFlag{
-				Name:  "azureblob-account-key",
-				Value: "",
-				Usage: "Azure Blob storage account key",
-			},
-			&cli.StringFlag{
-				Name:  "azureblob-container",
-				Value: "",
-				Usage: "Azure Blob storage container",
-			},
-			&cli.StringFlag{
-				Name:  "azureblob-base-path",
-				Value: "",
-				Usage: "Azure Blob storage base path",
-			},
+// CmdMigrateStorage represents the available migrate storage sub-command.
+var CmdMigrateStorage = &cli.Command{
+	Name:        "migrate-storage",
+	Usage:       "Migrate the storage",
+	Description: "Copies stored files from storage configured in app.ini to parameter-configured storage",
+	Action:      runMigrateStorage,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:    "type",
+			Aliases: []string{"t"},
+			Value:   "",
+			Usage:   "Type of stored files to copy.  Allowed types: 'attachments', 'lfs', 'avatars', 'repo-avatars', 'repo-archivers', 'packages', 'actions-log', 'actions-artifacts",
 		},
-	}
+		&cli.StringFlag{
+			Name:    "storage",
+			Aliases: []string{"s"},
+			Value:   "",
+			Usage:   "New storage type: local (default), minio or azureblob",
+		},
+		&cli.StringFlag{
+			Name:    "path",
+			Aliases: []string{"p"},
+			Value:   "",
+			Usage:   "New storage placement if store is local (leave blank for default)",
+		},
+		// Minio Storage special configurations
+		&cli.StringFlag{
+			Name:  "minio-endpoint",
+			Value: "",
+			Usage: "Minio storage endpoint",
+		},
+		&cli.StringFlag{
+			Name:  "minio-access-key-id",
+			Value: "",
+			Usage: "Minio storage accessKeyID",
+		},
+		&cli.StringFlag{
+			Name:  "minio-secret-access-key",
+			Value: "",
+			Usage: "Minio storage secretAccessKey",
+		},
+		&cli.StringFlag{
+			Name:  "minio-bucket",
+			Value: "",
+			Usage: "Minio storage bucket",
+		},
+		&cli.StringFlag{
+			Name:  "minio-location",
+			Value: "",
+			Usage: "Minio storage location to create bucket",
+		},
+		&cli.StringFlag{
+			Name:  "minio-base-path",
+			Value: "",
+			Usage: "Minio storage base path on the bucket",
+		},
+		&cli.BoolFlag{
+			Name:  "minio-use-ssl",
+			Usage: "Enable SSL for minio",
+		},
+		&cli.BoolFlag{
+			Name:  "minio-insecure-skip-verify",
+			Usage: "Skip SSL verification",
+		},
+		&cli.StringFlag{
+			Name:  "minio-checksum-algorithm",
+			Value: "",
+			Usage: "Minio checksum algorithm (default/md5)",
+		},
+		&cli.StringFlag{
+			Name:  "minio-bucket-lookup-type",
+			Value: "",
+			Usage: "Minio bucket lookup type",
+		},
+		// Azure Blob Storage special configurations
+		&cli.StringFlag{
+			Name:  "azureblob-endpoint",
+			Value: "",
+			Usage: "Azure Blob storage endpoint",
+		},
+		&cli.StringFlag{
+			Name:  "azureblob-account-name",
+			Value: "",
+			Usage: "Azure Blob storage account name",
+		},
+		&cli.StringFlag{
+			Name:  "azureblob-account-key",
+			Value: "",
+			Usage: "Azure Blob storage account key",
+		},
+		&cli.StringFlag{
+			Name:  "azureblob-container",
+			Value: "",
+			Usage: "Azure Blob storage container",
+		},
+		&cli.StringFlag{
+			Name:  "azureblob-base-path",
+			Value: "",
+			Usage: "Azure Blob storage base path",
+		},
+	},
 }

 func migrateAttachments(ctx context.Context, dstStorage storage.ObjectStorage) error {
--- a/cmd/restore_repo.go
+++ b/cmd/restore_repo.go
@@ -13,41 +13,40 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newRestoreRepositoryCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "restore-repo",
-		Usage:       "Restore the repository from disk",
-		Description: "This is a command for restoring the repository data.",
-		Action:      runRestoreRepository,
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "repo_dir",
-				Aliases: []string{"r"},
-				Value:   "./data",
-				Usage:   "Repository dir path to restore from",
-			},
-			&cli.StringFlag{
-				Name:  "owner_name",
-				Value: "",
-				Usage: "Restore destination owner name",
-			},
-			&cli.StringFlag{
-				Name:  "repo_name",
-				Value: "",
-				Usage: "Restore destination repository name",
-			},
-			&cli.StringFlag{
-				Name:  "units",
-				Value: "",
-				Usage: `Which items will be restored, one or more units should be separated as comma.
-wiki, issues, labels, releases, release_assets, milestones, pull_requests, comments are allowed. Empty means all units.`,
-			},
-			&cli.BoolFlag{
-				Name:  "validation",
-				Usage: "Sanity check the content of the files before trying to load them",
-			},
+// CmdRestoreRepository represents the available restore a repository sub-command.
+var CmdRestoreRepository = &cli.Command{
+	Name:        "restore-repo",
+	Usage:       "Restore the repository from disk",
+	Description: "This is a command for restoring the repository data.",
+	Action:      runRestoreRepository,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:    "repo_dir",
+			Aliases: []string{"r"},
+			Value:   "./data",
+			Usage:   "Repository dir path to restore from",
 		},
-	}
+		&cli.StringFlag{
+			Name:  "owner_name",
+			Value: "",
+			Usage: "Restore destination owner name",
+		},
+		&cli.StringFlag{
+			Name:  "repo_name",
+			Value: "",
+			Usage: "Restore destination repository name",
+		},
+		&cli.StringFlag{
+			Name:  "units",
+			Value: "",
+			Usage: `Which items will be restored, one or more units should be separated as comma.
+wiki, issues, labels, releases, release_assets, milestones, pull_requests, comments are allowed. Empty means all units.`,
+		},
+		&cli.BoolFlag{
+			Name:  "validation",
+			Usage: "Sanity check the content of the files before trying to load them",
+		},
+	},
 }

 func runRestoreRepository(ctx context.Context, c *cli.Command) error {
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -35,23 +35,22 @@ import (
 	"github.com/urfave/cli/v3"
 )

-func newServCommand() *cli.Command {
-	return &cli.Command{
-		Name:        "serv",
-		Usage:       "(internal) Should only be called by SSH shell",
-		Description: "Serv provides access auth for repositories",
-		Hidden:      true, // Internal commands shouldn't be visible in help
-		Before:      PrepareConsoleLoggerLevel(log.FATAL),
-		Action:      runServ,
-		Flags: []cli.Flag{
-			&cli.BoolFlag{
-				Name: "enable-pprof",
-			},
-			&cli.BoolFlag{
-				Name: "debug",
-			},
+// CmdServ represents the available serv sub-command.
+var CmdServ = &cli.Command{
+	Name:        "serv",
+	Usage:       "(internal) Should only be called by SSH shell",
+	Description: "Serv provides access auth for repositories",
+	Hidden:      true, // Internal commands shouldn't be visible in help
+	Before:      PrepareConsoleLoggerLevel(log.FATAL),
+	Action:      runServ,
+	Flags: []cli.Flag{
+		&cli.BoolFlag{
+			Name: "enable-pprof",
 		},
-	}
+		&cli.BoolFlag{
+			Name: "debug",
+		},
+	},
 }

 func setup(ctx context.Context, debug bool) {
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -8,13 +8,14 @@ import (
 	"fmt"
 	"net"
 	"net/http"
-	"net/http/pprof"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"time"

+	_ "net/http/pprof" // Used for debugging if enabled and a web server is running
+
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/gtprof"
@@ -22,7 +23,6 @@ import (
 	"code.gitea.io/gitea/modules/process"
 	"code.gitea.io/gitea/modules/public"
 	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/routers"
 	"code.gitea.io/gitea/routers/install"
@@ -34,43 +34,42 @@ import (
 // PIDFile could be set from build tag
 var PIDFile = "/run/gitea.pid"

-func newWebCommand() *cli.Command {
-	return &cli.Command{
-		Name:  "web",
-		Usage: "Start Gitea web server",
-		Description: `Gitea web server is the only thing you need to run,
+// CmdWeb represents the available web sub-command.
+var CmdWeb = &cli.Command{
+	Name:  "web",
+	Usage: "Start Gitea web server",
+	Description: `Gitea web server is the only thing you need to run,
 and it takes care of all the other things for you`,
-		Before: PrepareConsoleLoggerLevel(log.INFO),
-		Action: runWeb,
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "port",
-				Aliases: []string{"p"},
-				Value:   "3000",
-				Usage:   "Temporary port number to prevent conflict",
-			},
-			&cli.StringFlag{
-				Name:  "install-port",
-				Value: "3000",
-				Usage: "Temporary port number to run the install page on to prevent conflict",
-			},
-			&cli.StringFlag{
-				Name:    "pid",
-				Aliases: []string{"P"},
-				Value:   PIDFile,
-				Usage:   "Custom pid file path",
-			},
-			&cli.BoolFlag{
-				Name:    "quiet",
-				Aliases: []string{"q"},
-				Usage:   "Only display Fatal logging errors until logging is set-up",
-			},
-			&cli.BoolFlag{
-				Name:  "verbose",
-				Usage: "Set initial logging to TRACE level until logging is properly set-up",
-			},
+	Before: PrepareConsoleLoggerLevel(log.INFO),
+	Action: runWeb,
+	Flags: []cli.Flag{
+		&cli.StringFlag{
+			Name:    "port",
+			Aliases: []string{"p"},
+			Value:   "3000",
+			Usage:   "Temporary port number to prevent conflict",
 		},
-	}
+		&cli.StringFlag{
+			Name:  "install-port",
+			Value: "3000",
+			Usage: "Temporary port number to run the install page on to prevent conflict",
+		},
+		&cli.StringFlag{
+			Name:    "pid",
+			Aliases: []string{"P"},
+			Value:   PIDFile,
+			Usage:   "Custom pid file path",
+		},
+		&cli.BoolFlag{
+			Name:    "quiet",
+			Aliases: []string{"q"},
+			Usage:   "Only display Fatal logging errors until logging is set-up",
+		},
+		&cli.BoolFlag{
+			Name:  "verbose",
+			Usage: "Set initial logging to TRACE level until logging is properly set-up",
+		},
+	},
 }

 func runHTTPRedirector() {
@@ -157,6 +156,7 @@ func serveInstall(cmd *cli.Command) error {
 	case <-graceful.GetManager().IsShutdown():
 		<-graceful.GetManager().Done()
 		log.Info("PID: %d Gitea Web Finished", os.Getpid())
+		log.GetManager().Close()
 		return err
 	default:
 	}
@@ -164,6 +164,8 @@ func serveInstall(cmd *cli.Command) error {
 }

 func serveInstalled(c *cli.Command) error {
+	setting.InitCfgProvider(setting.CustomConf)
+	setting.LoadCommonSettings()
 	setting.MustInstalled()

 	showWebStartupMessage("Prepare to run web server")
@@ -229,26 +231,27 @@ func serveInstalled(c *cli.Command) error {
 	err := listen(webRoutes, true)
 	<-graceful.GetManager().Done()
 	log.Info("PID: %d Gitea Web Finished", os.Getpid())
+	log.GetManager().Close()
 	return err
 }

 func servePprof() {
-	mux := http.NewServeMux()
-	mux.HandleFunc("/debug/pprof/", pprof.Index)
-	mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
-	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
-	mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
-	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
-	mux.Handle("/debug/fgprof", fgprof.Handler())
-	// FIXME: it should use a proper context
+	// FIXME: it shouldn't use the global DefaultServeMux, and it should use a proper context
+	http.DefaultServeMux.Handle("/debug/fgprof", fgprof.Handler())
 	_, _, finished := process.GetManager().AddTypedContext(context.TODO(), "Web: PProf Server", process.SystemProcessType, true)
 	// The pprof server is for debug purpose only, it shouldn't be exposed on public network. At the moment, it's not worth introducing a configurable option for it.
 	log.Info("Starting pprof server on localhost:6060")
-	log.Info("Stopped pprof server: %v", http.ListenAndServe("localhost:6060", mux))
+	log.Info("Stopped pprof server: %v", http.ListenAndServe("localhost:6060", nil))
 	finished()
 }

 func runWeb(ctx context.Context, cmd *cli.Command) error {
+	defer func() {
+		if panicked := recover(); panicked != nil {
+			log.Fatal("PANIC: %v\n%s", panicked, log.Stack(2))
+		}
+	}()
+
 	if subCmdName, valid := isValidDefaultSubCommand(cmd); !valid {
 		return fmt.Errorf("unknown command: %s", subCmdName)
 	}
@@ -268,10 +271,6 @@ func runWeb(ctx context.Context, cmd *cli.Command) error {
 		createPIDFile(cmd.String("pid"))
 	}

-	// init the HTML renderer and load templates, if error happens, it will report the error immediately and exit with error log
-	// in dev mode, it won't exit, but watch the template files for changes
-	_ = templates.PageRenderer()
-
 	if !setting.InstallLock {
 		if err := serveInstall(cmd); err != nil {
 			return err
--- a/cmd/web_acme.go
+++ b/cmd/web_acme.go
@@ -7,7 +7,6 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
-	"net"
 	"net/http"
 	"os"
 	"strconv"
@@ -125,8 +124,8 @@ func runACME(listenAddr string, m http.Handler) error {
 			defer finished()

 			log.Info("Running Let's Encrypt handler on %s", setting.HTTPAddr+":"+setting.PortToRedirect)
-			// all traffic coming into HTTP will be redirected to HTTPS automatically (LE HTTP-01 validation happens here)
-			err := runHTTP("tcp", net.JoinHostPort(setting.HTTPAddr, setting.PortToRedirect), "Let's Encrypt HTTP Challenge", myACME.HTTPChallengeHandler(http.HandlerFunc(runLetsEncryptFallbackHandler)), setting.RedirectorUseProxyProtocol)
+			// all traffic coming into HTTP will be redirect to HTTPS automatically (LE HTTP-01 validation happens here)
+			err := runHTTP("tcp", setting.HTTPAddr+":"+setting.PortToRedirect, "Let's Encrypt HTTP Challenge", myACME.HTTPChallengeHandler(http.HandlerFunc(runLetsEncryptFallbackHandler)), setting.RedirectorUseProxyProtocol)
 			if err != nil {
 				log.Fatal("Failed to start the Let's Encrypt handler on port %s: %v", setting.PortToRedirect, err)
 			}
--- a/contrib/backport/backport.go
+++ b/contrib/backport/backport.go
@@ -16,7 +16,7 @@ import (
 	"strconv"
 	"strings"

-	"github.com/google/go-github/v84/github"
+	"github.com/google/go-github/v74/github"
 	"github.com/urfave/cli/v3"
 	"gopkg.in/yaml.v3"
 )
--- a/contrib/environment-to-ini/README
+++ b/contrib/environment-to-ini/README
@@ -0,0 +1,47 @@
+Environment To Ini
+==================
+
+Multiple docker users have requested that the Gitea docker is changed
+to permit arbitrary configuration via environment variables.
+
+Gitea needs to use an ini file for configuration because the running
+environment that starts the docker may not be the same as that used
+by the hooks. An ini file also gives a good default and means that
+users do not have to completely provide a full environment.
+
+With those caveats above, this command provides a generic way of
+converting suitably structured environment variables into any ini
+value.
+
+To use the command is very simple just run it and the default gitea
+app.ini will be rewritten to take account of the variables provided,
+however there are various options to give slightly different
+behavior and these can be interrogated with the `-h` option.
+
+The environment variables should be of the form:
+
+	GITEA__SECTION_NAME__KEY_NAME
+
+Note, SECTION_NAME in the notation above is case-insensitive.
+
+Environment variables are usually restricted to a reduced character
+set "0-9A-Z_" - in order to allow the setting of sections with
+characters outside of that set, they should be escaped as following:
+"_0X2E_" for "." and "_0X2D_" for "-". The entire section and key names 
+can be escaped as a UTF8 byte string if necessary. E.g. to configure:
+
+	"""
+	...
+	[log.console]
+	COLORIZE=false
+	STDERR=true
+	...
+	"""
+
+You would set the environment variables: "GITEA__LOG_0x2E_CONSOLE__COLORIZE=false"
+and "GITEA__LOG_0x2E_CONSOLE__STDERR=false". Other examples can be found
+on the configuration cheat sheet.
+
+To build locally, run:
+
+	go build contrib/environment-to-ini/environment-to-ini.go
--- a/contrib/environment-to-ini/environment-to-ini.go
+++ b/contrib/environment-to-ini/environment-to-ini.go
@@ -0,0 +1,112 @@
+// Copyright 2019 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package main
+
+import (
+	"context"
+	"os"
+
+	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/setting"
+
+	"github.com/urfave/cli/v3"
+)
+
+func main() {
+	app := cli.Command{}
+	app.Name = "environment-to-ini"
+	app.Usage = "Use provided environment to update configuration ini"
+	app.Description = `As a helper to allow docker users to update the gitea configuration
+	through the environment, this command allows environment variables to
+	be mapped to values in the ini.
+
+	Environment variables of the form "GITEA__SECTION_NAME__KEY_NAME"
+	will be mapped to the ini section "[section_name]" and the key
+	"KEY_NAME" with the value as provided.
+
+	Environment variables of the form "GITEA__SECTION_NAME__KEY_NAME__FILE"
+	will be mapped to the ini section "[section_name]" and the key
+	"KEY_NAME" with the value loaded from the specified file.
+
+	Environment variables are usually restricted to a reduced character
+	set "0-9A-Z_" - in order to allow the setting of sections with
+	characters outside of that set, they should be escaped as following:
+	"_0X2E_" for ".". The entire section and key names can be escaped as
+	a UTF8 byte string if necessary. E.g. to configure:
+
+		"""
+		...
+		[log.console]
+		COLORIZE=false
+		STDERR=true
+		...
+		"""
+
+	You would set the environment variables: "GITEA__LOG_0x2E_CONSOLE__COLORIZE=false"
+	and "GITEA__LOG_0x2E_CONSOLE__STDERR=false". Other examples can be found
+	on the configuration cheat sheet.`
+	app.Flags = []cli.Flag{
+		&cli.StringFlag{
+			Name:    "custom-path",
+			Aliases: []string{"C"},
+			Value:   setting.CustomPath,
+			Usage:   "Custom path file path",
+		},
+		&cli.StringFlag{
+			Name:    "config",
+			Aliases: []string{"c"},
+			Value:   setting.CustomConf,
+			Usage:   "Custom configuration file path",
+		},
+		&cli.StringFlag{
+			Name:    "work-path",
+			Aliases: []string{"w"},
+			Value:   setting.AppWorkPath,
+			Usage:   "Set the gitea working path",
+		},
+		&cli.StringFlag{
+			Name:    "out",
+			Aliases: []string{"o"},
+			Value:   "",
+			Usage:   "Destination file to write to",
+		},
+	}
+	app.Action = runEnvironmentToIni
+	err := app.Run(context.Background(), os.Args)
+	if err != nil {
+		log.Fatal("Failed to run app with %s: %v", os.Args, err)
+	}
+}
+
+func runEnvironmentToIni(_ context.Context, c *cli.Command) error {
+	// the config system may change the environment variables, so get a copy first, to be used later
+	env := append([]string{}, os.Environ()...)
+	setting.InitWorkPathAndCfgProvider(os.Getenv, setting.ArgWorkPathAndCustomConf{
+		WorkPath:   c.String("work-path"),
+		CustomPath: c.String("custom-path"),
+		CustomConf: c.String("config"),
+	})
+
+	cfg, err := setting.NewConfigProviderFromFile(setting.CustomConf)
+	if err != nil {
+		log.Fatal("Failed to load custom conf '%s': %v", setting.CustomConf, err)
+	}
+
+	changed := setting.EnvironmentToConfig(cfg, env)
+
+	// try to save the config file
+	destination := c.String("out")
+	if len(destination) == 0 {
+		destination = setting.CustomConf
+	}
+	if destination != setting.CustomConf || changed {
+		log.Info("Settings saved to: %q", destination)
+		err = cfg.SaveTo(destination)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
--- a/contrib/upgrade.sh
+++ b/contrib/upgrade.sh
@@ -108,9 +108,7 @@ curl --connect-timeout 10 --silent --show-error --fail --location -O "$binurl{,.
 sha256sum -c "${binname}.xz.sha256"
 if [[ -z "${ignore_gpg:-}" ]]; then
  require gpg
-  # try to use curl first, it uses standard tcp 443 port and works better behind strict firewall rules
-  curl -fsSL --connect-timeout 10 "https://keys.openpgp.org/vks/v1/by-fingerprint/7C9E68152594688862D62AF62D9AE806EC1592E2" | gpg --import \
-    || gpg --keyserver keys.openpgp.org --recv 7C9E68152594688862D62AF62D9AE806EC1592E2
+  gpg --keyserver keys.openpgp.org --recv 7C9E68152594688862D62AF62D9AE806EC1592E2
  gpg --verify "${binname}.xz.asc" "${binname}.xz" || { echo 'Signature does not match'; exit 1; }
 fi
 rm "${binname}".xz.{sha256,asc}
@@ -129,8 +127,6 @@ echo "Creating backup in $giteahome"
 giteacmd dump $backupopts
 echo "Updating binary at $giteabin"
 cp -f "$giteabin" "$giteabin.bak" && mv -f "$binname" "$giteabin"
-# Restore SELinux context if applicable (e.g. RHEL/Fedora)
-command -v restorecon &>/dev/null && restorecon -v "$giteabin" || true
 $service_start
 $service_status

--- a/crowdin.yml
+++ b/crowdin.yml
@@ -4,9 +4,9 @@ base_path: "."
 base_url: "https://api.crowdin.com"
 preserve_hierarchy: true
 files:
-  - source: "/options/locale/locale_en-US.json"
-    translation: "/options/locale/locale_%locale%.json"
-    type: "json"
+  - source: "/options/locale/locale_en-US.ini"
+    translation: "/options/locale/locale_%locale%.ini"
+    type: "ini"
    skip_untranslated_strings: true
    export_only_approved: true
    update_option: "update_as_unapproved"
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -69,12 +69,12 @@ RUN_USER = ; git
 ;; Most users should set it to the real website URL of their Gitea instance when there is a reverse proxy.
 ;ROOT_URL =
 ;;
-;; Controls how to detect the public URL. Most instances should use the "auto" behavior,
+;; Controls how to detect the public URL.
+;; Although it defaults to "legacy" (to avoid breaking existing users), most instances should use the "auto" behavior,
 ;; especially when the Gitea instance needs to be accessed in a container network.
-;; * legacy: (default <= 1.25) detect the public URL from "Host" header if "X-Forwarded-Proto" header exists, otherwise use "ROOT_URL".
-;; * auto: (default >= 1.26) always use "Host" header, and also use "X-Forwarded-Proto" header if it exists. If no "Host" header, use "ROOT_URL".
-;; * never: always use "ROOT_URL", never detect from request headers.
-;PUBLIC_URL_DETECTION = auto
+;; * legacy: detect the public URL from "Host" header if "X-Forwarded-Proto" header exists, otherwise use "ROOT_URL".
+;; * auto: always use "Host" header, and also use "X-Forwarded-Proto" header if it exists. If no "Host" header, use "ROOT_URL".
+;PUBLIC_URL_DETECTION = legacy
 ;;
 ;; For development purpose only. It makes Gitea handle sub-path ("/sub-path/owner/repo/...") directly when debugging without a reverse proxy.
 ;; DO NOT USE IT IN PRODUCTION!!!
@@ -238,6 +238,9 @@ RUN_USER = ; git
 ;; Indicate whether to check minimum key size with corresponding type
 ;MINIMUM_KEY_SIZE_CHECK = false
 ;;
+;; Disable CDN even in "prod" mode
+;OFFLINE_MODE = true
+;;
 ;; TLS Settings: Either ACME or manual
 ;; (Other common TLS configuration are found before)
 ;ENABLE_ACME = false
@@ -500,6 +503,9 @@ INTERNAL_TOKEN =
 ;; Password Hash algorithm, either "argon2", "pbkdf2", "scrypt" or "bcrypt"
 ;PASSWORD_HASH_ALGO = pbkdf2
 ;;
+;; Set false to allow JavaScript to read CSRF cookie
+;CSRF_COOKIE_HTTP_ONLY = true
+;;
 ;; Validate against https://haveibeenpwned.com/Passwords to see if a password has been exposed
 ;PASSWORD_CHECK_PWN = false
 ;;
@@ -518,9 +524,6 @@ INTERNAL_TOKEN =
 ;; Set the two-factor auth behavior.
 ;; Set to "enforced", to force users to enroll into Two-Factor Authentication, users without 2FA have no access to repositories via API or web.
 ;TWO_FACTOR_AUTH =
-;;
-;; The value of the X-Frame-Options HTTP header for HTML responses. Use "unset" to remove the header.
-;X_FRAME_OPTIONS = SAMEORIGIN

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -730,15 +733,15 @@ LEVEL = Info
 ;DISABLE_CORE_PROTECT_NTFS=false
 ;; Disable the usage of using partial clones for git.
 ;DISABLE_PARTIAL_CLONE = false
-;; Set the similarity threshold passed to git commands via `--find-renames=<threshold>`.
-;; Default is 50%, the same as git. Must be a integer percentage between 0% and 100%.
-;DIFF_RENAME_SIMILARITY_THRESHOLD = 50%

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Git Operation timeout in seconds
 ;[git.timeout]
+;DEFAULT = 360
 ;MIGRATE = 600
 ;MIRROR = 300
+;CLONE = 300
+;PULL = 300
 ;GC = 60

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1152,15 +1155,15 @@ LEVEL = Info
 ;; Add co-authored-by and co-committed-by trailers if committer does not match author
 ;ADD_CO_COMMITTER_TRAILERS = true
 ;;
+;; In addition to testing patches using the three-way merge method, re-test conflicting patches with git apply
+;TEST_CONFLICTING_PATCHES_WITH_GIT_APPLY = false
+;;
 ;; Retarget child pull requests to the parent pull request branch target on merge of parent pull request. It only works on merged PRs where the head and base branch target the same repo.
 ;RETARGET_CHILDREN_ON_MERGE = true
 ;;
 ;; Delay mergeable check until page view or API access, for pull requests that have not been updated in the specified days when their base branches get updated.
 ;; Use "-1" to always check all pull requests (old behavior). Use "0" to always delay the checks.
 ;DELAY_CHECK_FOR_INACTIVE_DAYS = 7
-;;
-;; Set the default value for "Delete pull request branch after merge by default" for new repositories
-;DEFAULT_DELETE_BRANCH_AFTER_MERGE = false

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1180,15 +1183,7 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types.
 ;ALLOWED_TYPES =
-;;
-;; Number of releases that are displayed on release page
 ;DEFAULT_PAGING_NUM = 10
-;;
-;; Max size of each file in megabytes. Defaults to 2GB
-;FILE_MAX_SIZE = 2048
-;;
-;; Max number of files per upload. Defaults to 5
-;MAX_FILES =  5

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1290,6 +1285,9 @@ LEVEL = Info
 ;;
 ;; headers to permit
 ;HEADERS = Content-Type,User-Agent
+;;
+;; set X-FRAME-OPTIONS header
+;X_FRAME_OPTIONS = SAMEORIGIN

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1334,12 +1332,9 @@ LEVEL = Info
 ;; Leave it empty to allow users to select any theme from "{CustomPath}/public/assets/css/theme-*.css"
 ;THEMES =
 ;;
-;; The icon theme for files (basic/material)
+;; The icons for file list (basic/material), this is a temporary option which will be replaced by a user setting in the future.
 ;FILE_ICON_THEME = material
 ;;
-;; The icon theme for folders (basic/material)
-;FOLDER_ICON_THEME = basic
-;;
 ;; All available reactions users can choose on issues/prs and comments.
 ;; Values can be emoji alias (:smile:) or a unicode emoji.
 ;; For custom reactions, add a tightly cropped square image to public/assets/img/emoji/reaction_name.png
@@ -1980,12 +1975,12 @@ LEVEL = Info
 ;; or a custom avatar source, like: http://cn.gravatar.com/avatar/
 ;GRAVATAR_SOURCE = gravatar
 ;;
-;; Deprecated, see Web UI Admin Panel -> Config -> Settings
+;; This value will always be true in offline mode.
 ;DISABLE_GRAVATAR = false
 ;;
 ;; Federated avatar lookup uses DNS to discover avatar associated
 ;; with emails, see https://www.libravatar.org
-;; Deprecated, see Web UI Admin Panel -> Config -> Settings
+;; This value will always be false in offline mode or when Gravatar is disabled.
 ;ENABLE_FEDERATED_AVATAR = false

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2000,8 +1995,8 @@ LEVEL = Info
 ;; Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types.
 ;ALLOWED_TYPES = .avif,.cpuprofile,.csv,.dmp,.docx,.fodg,.fodp,.fods,.fodt,.gif,.gz,.jpeg,.jpg,.json,.jsonc,.log,.md,.mov,.mp4,.odf,.odg,.odp,.ods,.odt,.patch,.pdf,.png,.pptx,.svg,.tgz,.txt,.webm,.webp,.xls,.xlsx,.zip
 ;;
-;; Max size of each file. Defaults to 100MB
-;MAX_SIZE = 100
+;; Max size of each file. Defaults to 2048MB
+;MAX_SIZE = 2048
 ;;
 ;; Max number of files per upload. Defaults to 5
 ;MAX_FILES = 5
@@ -2276,22 +2271,6 @@ LEVEL = Info
 ;; Unreferenced blobs created more than OLDER_THAN ago are subject to deletion
 ;OLDER_THAN = 24h

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Synchronize repository licenses
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[cron.sync_repo_licenses]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Whether to enable the job
-;ENABLED = false
-;; Whether to always run at least once at start up time (if ENABLED)
-;RUN_AT_START = false
-;; Whether to emit notice on successful execution too
-;NOTICE_ON_SUCCESS = false
-;; Time interval for job to run
-;SCHEDULE = @annually
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2355,19 +2334,7 @@ LEVEL = Info

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Update the '.ssh/authorized_principals' file
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[cron.resync_all_sshprincipals]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;ENABLED = false
-;RUN_AT_START = false
-;NOTICE_ON_SUCCESS = false
-;SCHEDULE = @every 72h
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Resynchronize git hooks of all repositories (pre-receive, update, post-receive, proc-receive, ...)
+;; Resynchronize pre-receive, update and post-receive hooks of all repositories.
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;[cron.resync_all_hooks]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2473,70 +2440,6 @@ LEVEL = Info
 ;Check at least this proportion of LFSMetaObjects per repo. (This may cause all stale LFSMetaObjects to be checked.)
 ;PROPORTION_TO_CHECK_PER_REPO = 0.6

-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Rebuild issue index
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[cron.rebuild_issue_indexer]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;ENABLED = false
-;RUN_AT_START = false
-;NO_SUCCESS_NOTICE = false
-;SCHEDULE = @annually
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Actions cron tasks
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Stop running tasks which haven't been updated for a long time
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[cron.stop_zombie_tasks]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;ENABLED = true
-;RUN_AT_START = true
-;NO_SUCCESS_NOTICE = false
-;SCHEDULE = @every 5m
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Stop running tasks which have running status and continuous updates but don't end for a long time
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[cron.stop_endless_tasks]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;ENABLED = true
-;RUN_AT_START = true
-;NO_SUCCESS_NOTICE = false
-;SCHEDULE = @every 30m
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Cancel jobs which haven't been picked up for a long time
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[cron.cancel_abandoned_jobs]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;ENABLED = true
-;RUN_AT_START = false
-;NO_SUCCESS_NOTICE = false
-;SCHEDULE = @every 6h
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Start cron based actions
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[cron.start_schedule_tasks]
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;ENABLED = true
-;RUN_AT_START = false
-;NO_SUCCESS_NOTICE = false
-;SCHEDULE = @every 1m
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;[mirror]
@@ -2585,9 +2488,8 @@ LEVEL = Info
 ;[highlight.mapping]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; Extension mapping to highlight class, for example:
-;; .toml = ini
-;; .my-js = JavaScript
+;; Extension mapping to highlight class
+;; e.g. .toml=ini

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2790,8 +2692,6 @@ LEVEL = Info
 ;LIMIT_SIZE_SWIFT = -1
 ;; Maximum size of a Vagrant upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
 ;LIMIT_SIZE_VAGRANT = -1
-;; Maximum size of a Terraform state upload (`-1` means no limits, format `1000`, `1 MB`, `1 GiB`)
-;LIMIT_SIZE_TERRAFORM_STATE = -1
 ;; Enable RPM re-signing by default. (It will overwrite the old signature ,using v4 format, not compatible with CentOS 6 or older)
 ;DEFAULT_RPM_SIGN_ENABLED  = false
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2957,9 +2857,6 @@ LEVEL = Info
 ;ABANDONED_JOB_TIMEOUT = 24h
 ;; Strings committers can place inside a commit message or PR title to skip executing the corresponding actions workflow
 ;SKIP_WORKFLOW_STRINGS = [skip ci],[ci skip],[no ci],[skip actions],[actions skip]
-;; Comma-separated list of workflow directories, the first one to exist
-;; in a repo is used to find Actions workflow files
-;WORKFLOW_DIRS = .gitea/workflows,.github/workflows

 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
--- a/docker/root/usr/local/bin/environment-to-ini
+++ b/docker/root/usr/local/bin/environment-to-ini
@@ -1,2 +0,0 @@
-#!/bin/bash
-exec /app/gitea/gitea config edit-ini --in-place --apply-env "$@"
--- a/docker/rootless/usr/local/bin/environment-to-ini
+++ b/docker/rootless/usr/local/bin/environment-to-ini
@@ -1,2 +0,0 @@
-#!/bin/bash
-exec /app/gitea/gitea config edit-ini --in-place --apply-env "$@"
--- a/eslint.config.ts
+++ b/eslint.config.ts
@@ -1,9 +1,9 @@
 import arrayFunc from 'eslint-plugin-array-func';
 import comments from '@eslint-community/eslint-plugin-eslint-comments';
-import deMorgan from 'eslint-plugin-de-morgan';
 import github from 'eslint-plugin-github';
 import globals from 'globals';
 import importPlugin from 'eslint-plugin-import-x';
+import noUseExtendNative from 'eslint-plugin-no-use-extend-native';
 import playwright from 'eslint-plugin-playwright';
 import regexp from 'eslint-plugin-regexp';
 import sonarjs from 'eslint-plugin-sonarjs';
@@ -16,22 +16,10 @@ import vue from 'eslint-plugin-vue';
 import vueScopedCss from 'eslint-plugin-vue-scoped-css';
 import wc from 'eslint-plugin-wc';
 import {defineConfig, globalIgnores} from 'eslint/config';
-import type {ESLint} from 'eslint';

 const jsExts = ['js', 'mjs', 'cjs'] as const;
 const tsExts = ['ts', 'mts', 'cts'] as const;
-
-const restrictedGlobals = [
-  {name: 'localStorage', message: 'Use `modules/user-settings.ts` instead.'},
-  {name: 'fetch', message: 'Use `modules/fetch.ts` instead.'},
-];
-
-const restrictedProperties = [
-  {object: 'window', property: 'localStorage', message: 'Use `modules/user-settings.ts` instead.'},
-  {object: 'globalThis', property: 'localStorage', message: 'Use `modules/user-settings.ts` instead.'},
-  {object: 'window', property: 'fetch', message: 'Use `modules/fetch.ts` instead.'},
-  {object: 'globalThis', property: 'fetch', message: 'Use `modules/fetch.ts` instead.'},
-];
+const restrictedSyntax = ['WithStatement', 'ForInStatement', 'LabeledStatement', 'SequenceExpression'];

 export default defineConfig([
  globalIgnores([
@@ -45,6 +33,10 @@ export default defineConfig([
    languageOptions: {
      ecmaVersion: 'latest',
      sourceType: 'module',
+      globals: {
+        ...globals.browser,
+        ...globals.node,
+      },
      parser: typescriptParser,
      parserOptions: {
        sourceType: 'module',
@@ -57,19 +49,24 @@ export default defineConfig([
    },
    linterOptions: {
      reportUnusedDisableDirectives: 2,
-      reportUnusedInlineConfigs: 2,
    },
    plugins: {
      '@eslint-community/eslint-comments': comments,
+      // @ts-expect-error
      '@stylistic': stylistic,
      '@typescript-eslint': typescriptPlugin.plugin,
      'array-func': arrayFunc,
-      'de-morgan': deMorgan,
-      'import-x': importPlugin as unknown as ESLint.Plugin, // https://github.com/un-ts/eslint-plugin-import-x/issues/203
+      // @ts-expect-error -- https://github.com/un-ts/eslint-plugin-import-x/issues/203
+      'import-x': importPlugin,
+      'no-use-extend-native': noUseExtendNative,
+      // @ts-expect-error
      regexp,
+      // @ts-expect-error
      sonarjs,
+      // @ts-expect-error
      unicorn,
      github,
+      // @ts-expect-error
      wc,
    },
    settings: {
@@ -78,7 +75,7 @@ export default defineConfig([
      'import-x/resolver': {'typescript': true},
    },
    rules: {
-      '@eslint-community/eslint-comments/disable-enable-pair': [0],
+      '@eslint-community/eslint-comments/disable-enable-pair': [2],
      '@eslint-community/eslint-comments/no-aggregating-enable': [2],
      '@eslint-community/eslint-comments/no-duplicate-disable': [2],
      '@eslint-community/eslint-comments/no-restricted-disable': [0],
@@ -158,11 +155,11 @@ export default defineConfig([
      '@typescript-eslint/adjacent-overload-signatures': [0],
      '@typescript-eslint/array-type': [0],
      '@typescript-eslint/await-thenable': [2],
-      '@typescript-eslint/ban-ts-comment': [2, {'ts-expect-error': true, 'ts-ignore': true, 'ts-nocheck': false, 'ts-check': false}],
+      '@typescript-eslint/ban-ts-comment': [2, {'ts-expect-error': false, 'ts-ignore': true, 'ts-nocheck': false, 'ts-check': false}],
      '@typescript-eslint/ban-tslint-comment': [0],
      '@typescript-eslint/class-literal-property-style': [0],
      '@typescript-eslint/class-methods-use-this': [0],
-      '@typescript-eslint/consistent-generic-constructors': [2, 'constructor'],
+      '@typescript-eslint/consistent-generic-constructors': [0],
      '@typescript-eslint/consistent-indexed-object-style': [0],
      '@typescript-eslint/consistent-return': [0],
      '@typescript-eslint/consistent-type-assertions': [2, {assertionStyle: 'as', objectLiteralTypeAssertions: 'allow'}],
@@ -181,7 +178,7 @@ export default defineConfig([
      '@typescript-eslint/naming-convention': [0],
      '@typescript-eslint/no-array-constructor': [2],
      '@typescript-eslint/no-array-delete': [2],
-      '@typescript-eslint/no-base-to-string': [2],
+      '@typescript-eslint/no-base-to-string': [0],
      '@typescript-eslint/no-confusing-non-null-assertion': [2],
      '@typescript-eslint/no-confusing-void-expression': [0],
      '@typescript-eslint/no-deprecated': [2],
@@ -213,7 +210,7 @@ export default defineConfig([
      '@typescript-eslint/no-non-null-asserted-nullish-coalescing': [0],
      '@typescript-eslint/no-non-null-asserted-optional-chain': [2],
      '@typescript-eslint/no-non-null-assertion': [0],
-      '@typescript-eslint/no-redeclare': [2],
+      '@typescript-eslint/no-redeclare': [0],
      '@typescript-eslint/no-redundant-type-constituents': [2],
      '@typescript-eslint/no-require-imports': [2],
      '@typescript-eslint/no-restricted-imports': [0],
@@ -224,7 +221,7 @@ export default defineConfig([
      '@typescript-eslint/no-unnecessary-condition': [0],
      '@typescript-eslint/no-unnecessary-qualifier': [0],
      '@typescript-eslint/no-unnecessary-template-expression': [0],
-      '@typescript-eslint/no-unnecessary-type-arguments': [2],
+      '@typescript-eslint/no-unnecessary-type-arguments': [0],
      '@typescript-eslint/no-unnecessary-type-assertion': [2],
      '@typescript-eslint/no-unnecessary-type-constraint': [2],
      '@typescript-eslint/no-unnecessary-type-conversion': [2],
@@ -237,12 +234,10 @@ export default defineConfig([
      '@typescript-eslint/no-unsafe-member-access': [0],
      '@typescript-eslint/no-unsafe-return': [0],
      '@typescript-eslint/no-unsafe-unary-minus': [2],
-      '@typescript-eslint/no-unused-expressions': [2],
-      '@typescript-eslint/no-unused-private-class-members': [2],
+      '@typescript-eslint/no-unused-expressions': [0],
      '@typescript-eslint/no-unused-vars': [2, {vars: 'all', args: 'all', caughtErrors: 'all', ignoreRestSiblings: false, argsIgnorePattern: '^_', varsIgnorePattern: '^_', caughtErrorsIgnorePattern: '^_', destructuredArrayIgnorePattern: '^_'}],
      '@typescript-eslint/no-use-before-define': [2, {functions: false, classes: true, variables: true, allowNamedExports: true, typedefs: false, enums: false, ignoreTypeReferences: true}],
      '@typescript-eslint/no-useless-constructor': [0],
-      '@typescript-eslint/no-useless-default-assignment': [2],
      '@typescript-eslint/no-useless-empty-export': [0],
      '@typescript-eslint/no-wrapper-object-types': [2],
      '@typescript-eslint/non-nullable-type-assertion-style': [0],
@@ -256,10 +251,10 @@ export default defineConfig([
      '@typescript-eslint/prefer-function-type': [2],
      '@typescript-eslint/prefer-includes': [2],
      '@typescript-eslint/prefer-literal-enum-member': [0],
-      '@typescript-eslint/prefer-namespace-keyword': [2],
+      '@typescript-eslint/prefer-namespace-keyword': [0],
      '@typescript-eslint/prefer-nullish-coalescing': [0],
      '@typescript-eslint/prefer-optional-chain': [2, {requireNullish: true}],
-      '@typescript-eslint/prefer-promise-reject-errors': [2],
+      '@typescript-eslint/prefer-promise-reject-errors': [0],
      '@typescript-eslint/prefer-readonly': [0],
      '@typescript-eslint/prefer-readonly-parameter-types': [0],
      '@typescript-eslint/prefer-reduce-type-parameter': [0],
@@ -270,10 +265,9 @@ export default defineConfig([
      '@typescript-eslint/require-array-sort-compare': [0],
      '@typescript-eslint/require-await': [0],
      '@typescript-eslint/restrict-plus-operands': [2],
-      '@typescript-eslint/restrict-template-expressions': [2],
+      '@typescript-eslint/restrict-template-expressions': [0],
      '@typescript-eslint/return-await': [0],
      '@typescript-eslint/strict-boolean-expressions': [0],
-      '@typescript-eslint/strict-void-return': [0],
      '@typescript-eslint/switch-exhaustiveness-check': [0],
      '@typescript-eslint/triple-slash-reference': [2],
      '@typescript-eslint/typedef': [0],
@@ -297,8 +291,6 @@ export default defineConfig([
      'consistent-this': [0],
      'constructor-super': [2],
      'curly': [0],
-      'de-morgan/no-negated-conjunction': [2],
-      'de-morgan/no-negated-disjunction': [2],
      'default-case-last': [2],
      'default-case': [0],
      'default-param-last': [0],
@@ -329,7 +321,7 @@ export default defineConfig([
      'github/no-innerText': [2],
      'github/no-then': [2],
      'github/no-useless-passive': [2],
-      'github/prefer-observers': [0],
+      'github/prefer-observers': [2],
      'github/require-passive-events': [2],
      'github/unescaped-html-literal': [2],
      'grouped-accessor-pairs': [2],
@@ -346,7 +338,7 @@ export default defineConfig([
      'import-x/first': [2],
      'import-x/group-exports': [0],
      'import-x/max-dependencies': [0],
-      'import-x/named': [0],
+      'import-x/named': [2],
      'import-x/namespace': [0],
      'import-x/newline-after-import': [0],
      'import-x/no-absolute-path': [0],
@@ -374,7 +366,7 @@ export default defineConfig([
      'import-x/no-self-import': [2],
      'import-x/no-unassigned-import': [0],
      'import-x/no-unresolved': [2, {commonjs: true, ignore: ['\\?.+$']}],
-      'import-x/no-unused-modules': [0], // incompatible with eslint 9
+      // 'import-x/no-unused-modules': [2, {unusedExports: true}], // not compatible with eslint 9
      'import-x/no-useless-path-segments': [2, {commonjs: true}],
      'import-x/no-webpack-loader-syntax': [2],
      'import-x/order': [0],
@@ -441,7 +433,7 @@ export default defineConfig([
      'no-import-assign': [2],
      'no-inline-comments': [0],
      'no-inner-declarations': [2],
-      'no-invalid-regexp': [0], // handled by regexp/no-invalid-regexp
+      'no-invalid-regexp': [2],
      'no-invalid-this': [0],
      'no-irregular-whitespace': [2],
      'no-iterator': [2],
@@ -555,7 +547,7 @@ export default defineConfig([
      'no-new-func': [0], // handled by @typescript-eslint/no-implied-eval
      'no-new-native-nonconstructor': [2],
      'no-new-object': [2],
-      'no-new-symbol': [0], // handled by no-new-native-nonconstructor
+      'no-new-symbol': [2],
      'no-new-wrappers': [2],
      'no-new': [0],
      'no-nonoctal-decimal-escape': [2],
@@ -570,14 +562,9 @@ export default defineConfig([
      'no-redeclare': [0], // must be disabled for typescript overloads
      'no-regex-spaces': [2],
      'no-restricted-exports': [0],
-      'no-restricted-globals': [2, ...restrictedGlobals],
-      'no-restricted-properties': [2, ...restrictedProperties],
-      'no-restricted-imports': [2, {paths: [
-        {name: 'jquery', message: 'Use the global $ instead', allowTypeImports: true},
-        {name: 'htmx.org', message: 'Use the global htmx instead', allowTypeImports: true},
-        {name: 'idiomorph/htmx', message: 'Loaded in globals.ts', allowTypeImports: true},
-      ]}],
-      'no-restricted-syntax': [2, 'WithStatement', 'ForInStatement', 'LabeledStatement', 'SequenceExpression'],
+      'no-restricted-globals': [2, 'addEventListener', 'blur', 'close', 'closed', 'confirm', 'defaultStatus', 'defaultstatus', 'error', 'event', 'external', 'find', 'focus', 'frameElement', 'frames', 'history', 'innerHeight', 'innerWidth', 'isFinite', 'isNaN', 'length', 'locationbar', 'menubar', 'moveBy', 'moveTo', 'name', 'onblur', 'onerror', 'onfocus', 'onload', 'onresize', 'onunload', 'open', 'opener', 'opera', 'outerHeight', 'outerWidth', 'pageXOffset', 'pageYOffset', 'parent', 'print', 'removeEventListener', 'resizeBy', 'resizeTo', 'screen', 'screenLeft', 'screenTop', 'screenX', 'screenY', 'scroll', 'scrollbars', 'scrollBy', 'scrollTo', 'scrollX', 'scrollY', 'status', 'statusbar', 'stop', 'toolbar', 'top'],
+      'no-restricted-imports': [0],
+      'no-restricted-syntax': [2, ...restrictedSyntax, {selector: 'CallExpression[callee.name="fetch"]', message: 'use modules/fetch.ts instead'}],
      'no-return-assign': [0],
      'no-script-url': [2],
      'no-self-assign': [2, {props: true}],
@@ -590,11 +577,10 @@ export default defineConfig([
      'no-template-curly-in-string': [2],
      'no-ternary': [0],
      'no-this-before-super': [2],
-      'no-throw-literal': [0], // handled by @typescript-eslint/only-throw-error
+      'no-throw-literal': [2],
      'no-undef-init': [2],
      'no-undef': [2], // it is still needed by eslint & IDE to prompt undefined names in real time
      'no-undefined': [0],
-      'no-unassigned-vars': [2],
      'no-underscore-dangle': [0],
      'no-unexpected-multiline': [2],
      'no-unmodified-loop-condition': [2],
@@ -603,13 +589,13 @@ export default defineConfig([
      'no-unreachable': [2],
      'no-unsafe-finally': [2],
      'no-unsafe-negation': [2],
-      'no-unused-expressions': [0], // handled by @typescript-eslint/no-unused-expressions
+      'no-unused-expressions': [2],
      'no-unused-labels': [2],
-      'no-unused-private-class-members': [0], // handled by @typescript-eslint/no-unused-private-class-members
+      'no-unused-private-class-members': [2],
      'no-unused-vars': [0], // handled by @typescript-eslint/no-unused-vars
      'no-use-before-define': [0], // handled by @typescript-eslint/no-use-before-define
-      'no-useless-assignment': [2],
-      'no-useless-backreference': [0], // handled by regexp/no-useless-backreference
+      'no-use-extend-native/no-use-extend-native': [2],
+      'no-useless-backreference': [2],
      'no-useless-call': [2],
      'no-useless-catch': [2],
      'no-useless-computed-key': [2],
@@ -617,7 +603,7 @@ export default defineConfig([
      'no-useless-constructor': [2],
      'no-useless-escape': [2],
      'no-useless-rename': [2],
-      'no-useless-return': [0], // handled by sonarjs/no-redundant-jump
+      'no-useless-return': [2],
      'no-var': [2],
      'no-void': [2],
      'no-warning-comments': [0],
@@ -626,7 +612,7 @@ export default defineConfig([
      'one-var-declaration-per-line': [0],
      'one-var': [0],
      'operator-assignment': [2, 'always'],
-      'operator-linebreak': [0], // handled by @stylistic/operator-linebreak
+      'operator-linebreak': [2, 'after'],
      'prefer-arrow-callback': [2, {allowNamedFunctions: true, allowUnboundThis: true}],
      'prefer-const': [2, {destructuring: 'all', ignoreReadBeforeAssign: true}],
      'prefer-destructuring': [0],
@@ -635,20 +621,19 @@ export default defineConfig([
      'prefer-numeric-literals': [2],
      'prefer-object-has-own': [2],
      'prefer-object-spread': [2],
-      'prefer-promise-reject-errors': [0], // handled by @typescript-eslint/prefer-promise-reject-errors
+      'prefer-promise-reject-errors': [2, {allowEmptyReject: false}],
      'prefer-regex-literals': [2],
      'prefer-rest-params': [2],
      'prefer-spread': [2],
      'prefer-template': [2],
-      'preserve-caught-error': [0],
-      'radix': [0],
+      'radix': [2, 'as-needed'],
      'regexp/confusing-quantifier': [2],
      'regexp/control-character-escape': [2],
      'regexp/hexadecimal-escape': [0],
      'regexp/letter-case': [0],
      'regexp/match-any': [2],
      'regexp/negation': [2],
-      'regexp/no-contradiction-with-assertion': [2],
+      'regexp/no-contradiction-with-assertion': [0],
      'regexp/no-control-character': [0],
      'regexp/no-dupe-characters-character-class': [2],
      'regexp/no-dupe-disjunctions': [2],
@@ -664,8 +649,8 @@ export default defineConfig([
      'regexp/no-invisible-character': [2],
      'regexp/no-lazy-ends': [2],
      'regexp/no-legacy-features': [2],
-      'regexp/no-misleading-capturing-group': [2],
-      'regexp/no-misleading-unicode-character': [2],
+      'regexp/no-misleading-capturing-group': [0],
+      'regexp/no-misleading-unicode-character': [0],
      'regexp/no-missing-g-flag': [2],
      'regexp/no-non-standard-flag': [2],
      'regexp/no-obscure-range': [2],
@@ -707,7 +692,7 @@ export default defineConfig([
      'regexp/prefer-question-quantifier': [2],
      'regexp/prefer-range': [2],
      'regexp/prefer-regexp-exec': [2],
-      'regexp/prefer-regexp-test': [0], // handled by unicorn/prefer-regexp-test
+      'regexp/prefer-regexp-test': [2],
      'regexp/prefer-result-array-groups': [0],
      'regexp/prefer-set-operation': [2],
      'regexp/prefer-star-quantifier': [2],
@@ -737,7 +722,7 @@ export default defineConfig([
      'sonarjs/no-empty-collection': [2],
      'sonarjs/no-extra-arguments': [2],
      'sonarjs/no-gratuitous-expressions': [2],
-      'sonarjs/no-identical-conditions': [0], // handled by no-dupe-else-if
+      'sonarjs/no-identical-conditions': [2],
      'sonarjs/no-identical-expressions': [2],
      'sonarjs/no-identical-functions': [2, 5],
      'sonarjs/no-ignored-return': [2],
@@ -750,7 +735,7 @@ export default defineConfig([
      'sonarjs/no-small-switch': [0],
      'sonarjs/no-unused-collection': [2],
      'sonarjs/no-use-of-empty-return-value': [2],
-      'sonarjs/no-useless-catch': [0], // handled by no-useless-catch
+      'sonarjs/no-useless-catch': [2],
      'sonarjs/non-existent-operator': [2],
      'sonarjs/prefer-immediate-return': [0],
      'sonarjs/prefer-object-literal': [0],
@@ -766,7 +751,6 @@ export default defineConfig([
      'unicorn/catch-error-name': [0],
      'unicorn/consistent-destructuring': [2],
      'unicorn/consistent-empty-array-spread': [2],
-      'unicorn/consistent-template-literal-escape': [2],
      'unicorn/consistent-existence-index-check': [0],
      'unicorn/consistent-function-scoping': [0],
      'unicorn/custom-error-definition': [0],
@@ -778,7 +762,6 @@ export default defineConfig([
      'unicorn/filename-case': [0],
      'unicorn/import-index': [0],
      'unicorn/import-style': [0],
-      'unicorn/isolated-functions': [2, {functions: []}],
      'unicorn/new-for-builtins': [2],
      'unicorn/no-abusive-eslint-disable': [0],
      'unicorn/no-anonymous-default-export': [0],
@@ -794,7 +777,6 @@ export default defineConfig([
      'unicorn/no-empty-file': [2],
      'unicorn/no-for-loop': [0],
      'unicorn/no-hex-escape': [0],
-      'unicorn/no-immediate-mutation': [0],
      'unicorn/no-instanceof-array': [0],
      'unicorn/no-invalid-fetch-options': [2],
      'unicorn/no-invalid-remove-event-listener': [2],
@@ -818,11 +800,9 @@ export default defineConfig([
      'unicorn/no-unnecessary-await': [2],
      'unicorn/no-unnecessary-polyfills': [2],
      'unicorn/no-unreadable-array-destructuring': [0],
-      'unicorn/no-unreadable-iife': [0],
+      'unicorn/no-unreadable-iife': [2],
      'unicorn/no-unused-properties': [2],
-      'unicorn/no-useless-collection-argument': [2],
      'unicorn/no-useless-fallback-in-spread': [2],
-      'unicorn/no-useless-iterator-to-array': [2],
      'unicorn/no-useless-length-check': [2],
      'unicorn/no-useless-promise-resolve-reject': [2],
      'unicorn/no-useless-spread': [2],
@@ -832,9 +812,9 @@ export default defineConfig([
      'unicorn/number-literal-case': [0],
      'unicorn/numeric-separators-style': [0],
      'unicorn/prefer-add-event-listener': [2],
-      'unicorn/prefer-array-find': [0], // handled by @typescript-eslint/prefer-find
-      'unicorn/prefer-array-flat': [2],
+      'unicorn/prefer-array-find': [2],
      'unicorn/prefer-array-flat-map': [2],
+      'unicorn/prefer-array-flat': [2],
      'unicorn/prefer-array-index-of': [2],
      'unicorn/prefer-array-some': [2],
      'unicorn/prefer-at': [0],
@@ -849,7 +829,7 @@ export default defineConfig([
      'unicorn/prefer-event-target': [2],
      'unicorn/prefer-export-from': [0],
      'unicorn/prefer-global-this': [0],
-      'unicorn/prefer-includes': [0], // handled by @typescript-eslint/prefer-includes
+      'unicorn/prefer-includes': [2],
      'unicorn/prefer-json-parse-buffer': [0],
      'unicorn/prefer-keyboard-event-key': [2],
      'unicorn/prefer-logical-operator-over-ternary': [2],
@@ -869,15 +849,13 @@ export default defineConfig([
      'unicorn/prefer-query-selector': [2],
      'unicorn/prefer-reflect-apply': [0],
      'unicorn/prefer-regexp-test': [2],
-      'unicorn/prefer-response-static-json': [2],
      'unicorn/prefer-set-has': [0],
      'unicorn/prefer-set-size': [2],
-      'unicorn/prefer-simple-condition-first': [0],
      'unicorn/prefer-spread': [0],
      'unicorn/prefer-string-raw': [0],
      'unicorn/prefer-string-replace-all': [0],
      'unicorn/prefer-string-slice': [0],
-      'unicorn/prefer-string-starts-ends-with': [0], // handled by @typescript-eslint/prefer-string-starts-ends-with
+      'unicorn/prefer-string-starts-ends-with': [2],
      'unicorn/prefer-string-trim-start-end': [2],
      'unicorn/prefer-structured-clone': [2],
      'unicorn/prefer-switch': [0],
@@ -891,7 +869,6 @@ export default defineConfig([
      'unicorn/require-post-message-target-origin': [0],
      'unicorn/string-content': [0],
      'unicorn/switch-case-braces': [0],
-      'unicorn/switch-case-break-position': [2],
      'unicorn/template-indent': [2],
      'unicorn/text-encoding-identifier-case': [0],
      'unicorn/throw-new-error': [2],
@@ -923,12 +900,12 @@ export default defineConfig([
      'yoda': [2, 'never'],
    },
  },
+  // @ts-expect-error
  {
    ...playwright.configs['flat/recommended'],
-    files: ['tests/e2e/**/*.test.ts'],
+    files: ['tests/e2e/**'],
    rules: {
      ...playwright.configs['flat/recommended'].rules,
-      'playwright/expect-expect': [0],
    },
  },
  {
@@ -939,19 +916,27 @@ export default defineConfig([
      },
    },
    extends: [
+      // @ts-expect-error
      vue.configs['flat/recommended'],
-      vueScopedCss.configs.recommended as any,
+      // @ts-expect-error
+      vueScopedCss.configs['flat/recommended'],
    ],
    rules: {
      'vue/attributes-order': [0],
      'vue/html-closing-bracket-spacing': [2, {startTag: 'never', endTag: 'never', selfClosingTag: 'never'}],
      'vue/max-attributes-per-line': [0],
      'vue/singleline-html-element-content-newline': [0],
-      'vue/require-typed-ref': [2],
+    },
+  },
+  {
+    files: ['web_src/js/modules/fetch.ts', 'web_src/js/standalone/**/*'],
+    rules: {
+      'no-restricted-syntax': [2, ...restrictedSyntax],
    },
  },
  {
    files: ['**/*.test.ts', 'web_src/js/test/setup.ts'],
+    // @ts-expect-error - https://github.com/vitest-dev/eslint-plugin-vitest/issues/737
    plugins: {vitest},
    languageOptions: {globals: globals.vitest},
    rules: {
@@ -975,7 +960,6 @@ export default defineConfig([
      'vitest/no-interpolation-in-snapshots': [0],
      'vitest/no-large-snapshots': [0],
      'vitest/no-mocks-import': [0],
-      'vitest/no-importing-vitest-globals': [2],
      'vitest/no-restricted-matchers': [0],
      'vitest/no-restricted-vi-methods': [0],
      'vitest/no-standalone-expect': [0],
@@ -1004,24 +988,42 @@ export default defineConfig([
      'vitest/require-to-throw-message': [0],
      'vitest/require-top-level-describe': [0],
      'vitest/valid-describe-callback': [2],
-      'vitest/valid-expect': [2, {maxArgs: 2}],
-      'vitest/valid-expect-in-promise': [2],
+      'vitest/valid-expect': [2],
      'vitest/valid-title': [2],
    },
  },
+  {
+    files: ['web_src/js/types.ts'],
+    rules: {
+      'import-x/no-unused-modules': [0],
+    },
+  },
  {
    files: ['**/*.d.ts'],
    rules: {
+      'import-x/no-unused-modules': [0],
      '@typescript-eslint/consistent-type-definitions': [0],
      '@typescript-eslint/consistent-type-imports': [0],
    },
  },
  {
-    files: ['*', 'tools/**/*', 'tests/**/*'],
-    languageOptions: {globals: globals.nodeBuiltin},
+    files: ['*.config.*'],
+    rules: {
+      'import-x/no-unused-modules': [0],
+    },
+  },
+  {
+    files: ['web_src/**/*', 'docs/**/*'],
+    languageOptions: {globals: globals.browser},
  },
  {
    files: ['web_src/**/*'],
-    languageOptions: {globals: {...globals.browser, ...globals.jquery, htmx: false}},
+    languageOptions: {
+      globals: {
+        ...globals.browser,
+        __webpack_public_path__: true,
+        process: false, // https://github.com/webpack/webpack/issues/15833
+      },
+    },
  },
 ]);
--- a/eslint.json.config.ts
+++ b/eslint.json.config.ts
@@ -1,30 +0,0 @@
-import {defineConfig, globalIgnores} from 'eslint/config';
-import json from '@eslint/json';
-
-export default defineConfig([
-  globalIgnores([
-    '**/.venv',
-    '**/node_modules',
-    '**/public',
-  ]),
-  {
-    files: ['**/*.json'],
-    plugins: {json},
-    language: 'json/json',
-    extends: ['json/recommended'],
-  },
-  {
-    files: [
-      'tsconfig.json',
-      '.devcontainer/*.json',
-      '.vscode/*.json',
-      'contrib/ide/vscode/*.json',
-    ],
-    plugins: {json},
-    language: 'json/jsonc',
-    languageOptions: {
-      allowTrailingCommas: true,
-    },
-    extends: ['json/recommended'],
-  },
-]);
--- a/flake.lock
+++ b/flake.lock
@@ -1,12 +1,30 @@
 {
  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1775036866,
-        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
+        "lastModified": 1755186698,
+        "narHash": "sha256-wNO3+Ks2jZJ4nTHMuks+cxAiVBGNuEBXsT29Bz6HASo=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
+        "rev": "fbcf476f790d8a217c3eab4e12033dc4a0f6d23c",
        "type": "github"
      },
      "original": {
@@ -18,8 +36,24 @@
    },
    "root": {
      "inputs": {
+        "flake-utils": "flake-utils",
        "nixpkgs": "nixpkgs"
      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
    }
  },
  "root": "root",
--- a/flake.nix
+++ b/flake.nix
@@ -1,94 +1,73 @@
 {
  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
  };
  outputs =
-    { nixpkgs, ... }:
-    let
-      supportedSystems = [
-        "aarch64-darwin"
-        "aarch64-linux"
-        "x86_64-darwin"
-        "x86_64-linux"
-      ];
-
-      forEachSupportedSystem =
-        f:
-        nixpkgs.lib.genAttrs supportedSystems (
-          system:
+    { nixpkgs, flake-utils, ... }:
+    flake-utils.lib.eachDefaultSystem (
+      system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+      in
+      {
+        devShells.default =
+          with pkgs;
          let
-            pkgs = import nixpkgs {
-              inherit system;
+            # only bump toolchain versions here
+            go = go_1_25;
+            nodejs = nodejs_24;
+            python3 = python312;
+            pnpm = pnpm_10;
+
+            # Platform-specific dependencies
+            linuxOnlyInputs = lib.optionals pkgs.stdenv.isLinux [
+              glibc.static
+            ];
+
+            linuxOnlyEnv = lib.optionalAttrs pkgs.stdenv.isLinux {
+              CFLAGS = "-I${glibc.static.dev}/include";
+              LDFLAGS = "-L ${glibc.static}/lib";
            };
          in
-          f { inherit pkgs; }
-        );
-    in
-    {
-      devShells = forEachSupportedSystem (
-        { pkgs, ... }:
-        {
-          default =
-            let
-              inherit (pkgs) lib;
+          pkgs.mkShell (
+            {
+              buildInputs = [
+                # generic
+                git
+                git-lfs
+                gnumake
+                gnused
+                gnutar
+                gzip
+                zip

-              # only bump toolchain versions here
-              go = pkgs.go_1_26;
-              nodejs = pkgs.nodejs_24;
-              python3 = pkgs.python314;
-              pnpm = pkgs.pnpm_10;
+                # frontend
+                nodejs
+                pnpm
+                cairo
+                pixman
+                pkg-config

-              # Platform-specific dependencies
-              linuxOnlyInputs = lib.optionals pkgs.stdenv.isLinux [
-                pkgs.glibc.static
-              ];
+                # linting
+                python3
+                uv

-              linuxOnlyEnv = lib.optionalAttrs pkgs.stdenv.isLinux {
-                CFLAGS = "-I${pkgs.glibc.static.dev}/include";
-                LDFLAGS = "-L ${pkgs.glibc.static}/lib";
-              };
-            in
-            pkgs.mkShell {
-              packages =
-                with pkgs;
-                [
-                  # generic
-                  git
-                  git-lfs
-                  gnumake
-                  gnused
-                  gnutar
-                  gzip
-                  zip
+                # backend
+                go
+                gofumpt
+                sqlite
+              ]
+              ++ linuxOnlyInputs;

-                  # frontend
-                  nodejs
-                  pnpm
-                  cairo
-                  pixman
-                  pkg-config
+              GO = "${go}/bin/go";
+              GOROOT = "${go}/share/go";

-                  # linting
-                  python3
-                  uv
-
-                  # backend
-                  go
-                  gofumpt
-                  sqlite
-                ]
-                ++ linuxOnlyInputs;
-
-              env = {
-                GO = "${go}/bin/go";
-                GOROOT = "${go}/share/go";
-
-                TAGS = "sqlite sqlite_unlock_notify";
-                STATIC = "true";
-              }
-              // linuxOnlyEnv;
-            };
-        }
-      );
-    };
+              TAGS = "sqlite sqlite_unlock_notify";
+              STATIC = "true";
+            }
+            // linuxOnlyEnv
+          );
+      }
+    );
 }
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,8 @@
 module code.gitea.io/gitea

-go 1.26.1
+go 1.25.0
+
+toolchain go1.25.5

 // rfc5280 said: "The serial number is an integer assigned by the CA to each certificate."
 // But some CAs use negative serial number, just relax the check. related:
@@ -9,201 +11,208 @@ godebug x509negativeserial=1

 require (
 	code.gitea.io/actions-proto-go v0.4.1
-	code.gitea.io/sdk/gitea v0.24.1
+	code.gitea.io/gitea-vet v0.2.3
+	code.gitea.io/sdk/gitea v0.22.0
 	codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570
-	connectrpc.com/connect v1.19.1
+	connectrpc.com/connect v1.18.1
 	gitea.com/go-chi/binding v0.0.0-20240430071103-39a851e106ed
 	gitea.com/go-chi/cache v0.2.1
 	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098
-	gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e
+	gitea.com/go-chi/session v0.0.0-20240316035857-16768d98ec96
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
-	github.com/42wim/httpsig v1.2.4
-	github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432
+	github.com/42wim/httpsig v1.2.3
+	github.com/42wim/sshsig v0.0.0-20250502153856-5100632e8920
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.0
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.2
-	github.com/Azure/go-ntlmssp v0.1.0
-	github.com/ProtonMail/go-crypto v1.4.1
-	github.com/PuerkitoBio/goquery v1.12.0
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358
+	github.com/ProtonMail/go-crypto v1.3.0
+	github.com/PuerkitoBio/goquery v1.10.3
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.0
-	github.com/alecthomas/chroma/v2 v2.23.1
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.13
-	github.com/aws/aws-sdk-go-v2/service/codecommit v1.33.12
+	github.com/alecthomas/chroma/v2 v2.20.0
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.10
+	github.com/aws/aws-sdk-go-v2/service/codecommit v1.32.2
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
-	github.com/blevesearch/bleve/v2 v2.5.7
+	github.com/blevesearch/bleve/v2 v2.5.3
 	github.com/bohde/codel v0.2.0
 	github.com/buildkite/terminal-to-html/v3 v3.16.8
-	github.com/caddyserver/certmagic v0.25.2
+	github.com/caddyserver/certmagic v0.24.0
 	github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20251013092601-6327009efd21
 	github.com/chi-middleware/proxy v1.1.1
 	github.com/dimiro1/reply v0.0.0-20200315094148-d0136a4c9e21
-	github.com/dlclark/regexp2 v1.11.5
+	github.com/djherbis/buffer v1.2.0
+	github.com/djherbis/nio/v3 v3.0.1
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707
 	github.com/dustin/go-humanize v1.0.1
-	github.com/editorconfig/editorconfig-core-go/v2 v2.6.4
+	github.com/editorconfig/editorconfig-core-go/v2 v2.6.3
 	github.com/emersion/go-imap v1.2.1
 	github.com/emirpasic/gods v1.18.1
 	github.com/ethantkoenig/rupture v1.0.1
 	github.com/felixge/fgprof v0.9.5
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/gliderlabs/ssh v0.3.8
-	github.com/go-chi/chi/v5 v5.2.5
+	github.com/go-ap/activitypub v0.0.0-20250810115208-cb73b20a1742
+	github.com/go-ap/jsonld v0.0.0-20221030091449-f2a191312c73
+	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-chi/cors v1.2.2
-	github.com/go-co-op/gocron/v2 v2.19.1
-	github.com/go-enry/go-enry/v2 v2.9.5
-	github.com/go-git/go-billy/v5 v5.8.0
-	github.com/go-git/go-git/v5 v5.17.2
-	github.com/go-ldap/ldap/v3 v3.4.13
-	github.com/go-redsync/redsync/v4 v4.16.0
+	github.com/go-co-op/gocron v1.37.0
+	github.com/go-enry/go-enry/v2 v2.9.2
+	github.com/go-git/go-billy/v5 v5.6.2
+	github.com/go-git/go-git/v5 v5.16.3
+	github.com/go-ldap/ldap/v3 v3.4.11
+	github.com/go-redsync/redsync/v4 v4.13.0
 	github.com/go-sql-driver/mysql v1.9.3
-	github.com/go-webauthn/webauthn v0.16.1
-	github.com/goccy/go-json v0.10.6
+	github.com/go-webauthn/webauthn v0.13.4
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
-	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/google/go-github/v84 v84.0.0
+	github.com/golang-jwt/jwt/v5 v5.3.0
+	github.com/google/go-github/v74 v74.0.0
 	github.com/google/licenseclassifier/v2 v2.0.0
-	github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc
+	github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/feeds v1.2.0
 	github.com/gorilla/sessions v1.4.0
-	github.com/hashicorp/go-version v1.9.0
+	github.com/hashicorp/go-version v1.7.0
 	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/huandu/xstrings v1.5.0
 	github.com/jaytaylor/html2text v0.0.0-20230321000545-74c2419ad056
-	github.com/jhillyerd/enmime/v2 v2.3.0
+	github.com/jhillyerd/enmime v1.3.0
+	github.com/json-iterator/go v1.1.12
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/klauspost/compress v1.18.5
+	github.com/klauspost/compress v1.18.0
 	github.com/klauspost/cpuid/v2 v2.3.0
-	github.com/lib/pq v1.12.1
+	github.com/lib/pq v1.10.9
 	github.com/markbates/goth v1.82.0
 	github.com/mattn/go-isatty v0.0.20
-	github.com/mattn/go-sqlite3 v1.14.38
-	github.com/meilisearch/meilisearch-go v0.36.1
-	github.com/mholt/archives v0.1.5
+	github.com/mattn/go-sqlite3 v1.14.32
+	github.com/meilisearch/meilisearch-go v0.33.2
+	github.com/mholt/archives v0.1.5-0.20251009205813-e30ac6010726
 	github.com/microcosm-cc/bluemonday v1.0.27
-	github.com/microsoft/go-mssqldb v1.9.6
-	github.com/minio/minio-go/v7 v7.0.99
-	github.com/msteinert/pam/v2 v2.1.0
+	github.com/microsoft/go-mssqldb v1.9.3
+	github.com/minio/minio-go/v7 v7.0.95
+	github.com/msteinert/pam v1.2.0
 	github.com/nektos/act v0.2.63
 	github.com/niklasfasching/go-org v1.9.1
 	github.com/olivere/elastic/v7 v7.0.32
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
+	github.com/pkg/errors v0.9.1
 	github.com/pquerna/otp v1.5.0
-	github.com/prometheus/client_golang v1.23.2
+	github.com/prometheus/client_golang v1.23.0
 	github.com/quasoft/websspi v1.1.2
-	github.com/redis/go-redis/v9 v9.18.0
+	github.com/redis/go-redis/v9 v9.12.1
 	github.com/robfig/cron/v3 v3.0.1
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
+	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
 	github.com/sassoftware/go-rpmutils v0.4.0
 	github.com/sergi/go-diff v1.4.0
 	github.com/stretchr/testify v1.11.1
 	github.com/syndtr/goleveldb v1.0.0
 	github.com/tstranex/u2f v1.0.0
 	github.com/ulikunitz/xz v0.5.15
-	github.com/urfave/cli-docs/v3 v3.1.0
+	github.com/urfave/cli-docs/v3 v3.0.0-alpha6
 	github.com/urfave/cli/v3 v3.4.1
 	github.com/wneessen/go-mail v0.7.2
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/yohcop/openid-go v1.0.1
-	github.com/yuin/goldmark v1.8.2
+	github.com/yuin/goldmark v1.7.13
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	gitlab.com/gitlab-org/api/client-go v1.46.0
-	go.yaml.in/yaml/v4 v4.0.0-rc.3
-	golang.org/x/crypto v0.49.0
-	golang.org/x/image v0.38.0
-	golang.org/x/net v0.52.0
-	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.20.0
-	golang.org/x/sys v0.42.0
-	golang.org/x/text v0.35.0
-	google.golang.org/grpc v1.79.3
-	google.golang.org/protobuf v1.36.11
-	gopkg.in/ini.v1 v1.67.1
+	github.com/yuin/goldmark-meta v1.1.0
+	gitlab.com/gitlab-org/api/client-go v0.142.4
+	golang.org/x/crypto v0.45.0
+	golang.org/x/image v0.30.0
+	golang.org/x/net v0.47.0
+	golang.org/x/oauth2 v0.30.0
+	golang.org/x/sync v0.18.0
+	golang.org/x/sys v0.38.0
+	golang.org/x/text v0.31.0
+	google.golang.org/grpc v1.75.0
+	google.golang.org/protobuf v1.36.8
+	gopkg.in/ini.v1 v1.67.0
 	gopkg.in/yaml.v3 v3.0.1
 	mvdan.cc/xurls/v2 v2.6.0
-	strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab
+	strk.kbt.io/projects/go/libravatar v0.0.0-20191008002943-06d1c002b251
 	xorm.io/builder v0.3.13
-	xorm.io/xorm v1.3.11
+	xorm.io/xorm v1.3.10
 )

 require (
-	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	code.gitea.io/gitea-vet v0.2.3 // indirect
+	cloud.google.com/go/compute/metadata v0.8.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
-	filippo.io/edwards25519 v1.2.0 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
+	git.sr.ht/~mariusor/go-xsd-duration v0.0.0-20220703122237-02e73435a078 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/DataDog/zstd v1.5.7 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/RoaringBitmap/roaring/v2 v2.16.0 // indirect
+	github.com/RoaringBitmap/roaring/v2 v2.10.0 // indirect
 	github.com/STARRY-S/zip v0.2.3 // indirect
-	github.com/andybalholm/brotli v1.2.1 // indirect
+	github.com/andybalholm/brotli v1.2.0 // indirect
 	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
-	github.com/aws/smithy-go v1.24.2 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.38.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6 // indirect
+	github.com/aws/smithy-go v1.23.0 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bits-and-blooms/bitset v1.24.4 // indirect
-	github.com/blevesearch/bleve_index_api v1.3.7 // indirect
-	github.com/blevesearch/geo v0.2.5 // indirect
-	github.com/blevesearch/go-faiss v1.0.30 // indirect
+	github.com/bits-and-blooms/bitset v1.24.0 // indirect
+	github.com/blevesearch/bleve_index_api v1.2.9 // indirect
+	github.com/blevesearch/geo v0.2.4 // indirect
+	github.com/blevesearch/go-faiss v1.0.25 // indirect
 	github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
 	github.com/blevesearch/gtreap v0.1.1 // indirect
-	github.com/blevesearch/mmap-go v1.2.0 // indirect
-	github.com/blevesearch/scorch_segment_api/v2 v2.4.5 // indirect
+	github.com/blevesearch/mmap-go v1.0.4 // indirect
+	github.com/blevesearch/scorch_segment_api/v2 v2.3.11 // indirect
 	github.com/blevesearch/segment v0.9.1 // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
-	github.com/blevesearch/vellum v1.2.0 // indirect
-	github.com/blevesearch/zapx/v11 v11.4.3 // indirect
-	github.com/blevesearch/zapx/v12 v12.4.3 // indirect
-	github.com/blevesearch/zapx/v13 v13.4.3 // indirect
-	github.com/blevesearch/zapx/v14 v14.4.3 // indirect
-	github.com/blevesearch/zapx/v15 v15.4.3 // indirect
-	github.com/blevesearch/zapx/v16 v16.3.2 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
+	github.com/blevesearch/vellum v1.1.0 // indirect
+	github.com/blevesearch/zapx/v11 v11.4.2 // indirect
+	github.com/blevesearch/zapx/v12 v12.4.2 // indirect
+	github.com/blevesearch/zapx/v13 v13.4.2 // indirect
+	github.com/blevesearch/zapx/v14 v14.4.2 // indirect
+	github.com/blevesearch/zapx/v15 v15.4.2 // indirect
+	github.com/blevesearch/zapx/v16 v16.2.4 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.9.1 // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
 	github.com/bodgit/sevenzip v1.6.1 // indirect
 	github.com/bodgit/windows v1.0.1 // indirect
 	github.com/boombuler/barcode v1.1.0 // indirect
 	github.com/bradfitz/gomemcache v0.0.0-20250403215159-8d39553ac7cf // indirect
-	github.com/caddyserver/zerossl v0.1.5 // indirect
+	github.com/caddyserver/zerossl v0.1.3 // indirect
 	github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/clipperhouse/displaywidth v0.11.0 // indirect
-	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/couchbase/go-couchbase v0.1.1 // indirect
-	github.com/couchbase/gomemcached v0.3.4 // indirect
-	github.com/couchbase/goutils v0.3.0 // indirect
+	github.com/couchbase/gomemcached v0.3.3 // indirect
+	github.com/couchbase/goutils v0.1.2 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
-	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/davidmz/go-pageant v1.0.2 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
-	github.com/fatih/color v1.19.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 // indirect
+	github.com/go-ap/errors v0.0.0-20250527110557-c8db454e53fd // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-enry/go-oniguruma v1.2.1 // indirect
 	github.com/go-fed/httpsig v1.1.1-0.20201223112313-55836744818e // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/go-webauthn/x v0.2.2 // indirect
+	github.com/go-webauthn/x v0.1.24 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v1.0.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/flatbuffers v25.12.19+incompatible // indirect
-	github.com/google/go-querystring v1.2.0 // indirect
-	github.com/google/go-tpm v0.9.8 // indirect
+	github.com/google/flatbuffers v25.2.10+incompatible // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/go-tpm v0.9.5 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
@@ -211,56 +220,53 @@ require (
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
-	github.com/inbucket/html2text v1.0.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
-	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kevinburke/ssh_config v1.6.0 // indirect
-	github.com/klauspost/crc32 v1.3.0 // indirect
+	github.com/kevinburke/ssh_config v1.4.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/libdns/libdns v1.1.1 // indirect
-	github.com/mailru/easyjson v0.9.2 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/markbates/going v1.0.3 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-runewidth v0.0.21 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
-	github.com/mholt/acmez/v3 v3.1.6 // indirect
-	github.com/miekg/dns v1.1.72 // indirect
+	github.com/mholt/acmez/v3 v3.1.2 // indirect
+	github.com/miekg/dns v1.1.68 // indirect
 	github.com/mikelolasagasti/xz v1.0.1 // indirect
 	github.com/minio/crc64nvme v1.1.1 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
-	github.com/minio/minlz v1.1.0 // indirect
+	github.com/minio/minlz v1.0.1 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450 // indirect
 	github.com/mschoch/smat v0.2.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nwaples/rardecode/v2 v2.2.2 // indirect
-	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
-	github.com/olekukonko/errors v1.2.0 // indirect
-	github.com/olekukonko/ll v0.1.8 // indirect
-	github.com/olekukonko/tablewriter v1.1.4 // indirect
+	github.com/nwaples/rardecode/v2 v2.2.0 // indirect
+	github.com/olekukonko/cat v0.0.0-20250817074551-3280053e4e00 // indirect
+	github.com/olekukonko/errors v1.1.0 // indirect
+	github.com/olekukonko/ll v0.1.0 // indirect
+	github.com/olekukonko/tablewriter v1.0.9 // indirect
 	github.com/onsi/ginkgo v1.16.5 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
-	github.com/pierrec/lz4/v4 v4.1.26 // indirect
-	github.com/pjbgf/sha1cd v0.5.0 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pierrec/lz4/v4 v4.1.22 // indirect
+	github.com/pjbgf/sha1cd v0.4.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
-	github.com/rhysd/actionlint v1.7.12 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
+	github.com/rhysd/actionlint v1.7.7 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/sirupsen/logrus v1.9.4 // indirect
-	github.com/skeema/knownhosts v1.3.2 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/sorairolake/lzip-go v0.3.8 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
-	github.com/tinylib/msgp v1.6.3 // indirect
+	github.com/tinylib/msgp v1.4.0 // indirect
 	github.com/unknwon/com v1.0.1 // indirect
+	github.com/valyala/fastjson v1.6.4 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
@@ -271,17 +277,16 @@ require (
 	go.etcd.io/bbolt v1.4.3 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.1 // indirect
+	go.uber.org/zap v1.27.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
-	golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b // indirect
-	golang.org/x/mod v0.34.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401020348-3a24fdc17823 // indirect
+	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
+	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
+	golang.org/x/mod v0.29.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
 )

 ignore (
@@ -289,22 +294,18 @@ ignore (
 	./node_modules
 )

-// When doing "go get -u ./...", Golang will try to update all dependencies
-// But not all latest versions of dependencies are compatible with other packages or our codebase, so we need to pin some dependencies to specific versions
-// Need to regularly maintain this list to try to update them to latest versions, especially the TODO ones
+replace github.com/jaytaylor/html2text => github.com/Necoro/html2text v0.0.0-20250804200300-7bf1ce1c7347

-replace github.com/jaytaylor/html2text => github.com/Necoro/html2text v0.0.0-20250804200300-7bf1ce1c7347 // jaytaylor/html2text is unmaintained
+replace github.com/hashicorp/go-version => github.com/6543/go-version v1.3.1

-replace github.com/nektos/act => gitea.com/gitea/act v0.261.10 // gitea maintains its own package
+replace github.com/nektos/act => gitea.com/gitea/act v0.261.7-0.20251003180512-ac6e4b751763

-replace github.com/urfave/cli/v3 => github.com/urfave/cli/v3 v3.4.1 // v3.6.2 breaks -c flag parsing in help commands
+replace git.sr.ht/~mariusor/go-xsd-duration => gitea.com/gitea/go-xsd-duration v0.0.0-20220703122237-02e73435a078

-replace go.yaml.in/yaml/v4 => go.yaml.in/yaml/v4 v4.0.0-rc.3 // rc.4 changes block scalar serialization, wait for stable release
+exclude github.com/gofrs/uuid v3.2.0+incompatible

-replace github.com/Azure/azure-sdk-for-go/sdk/azcore => github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.0 // v1.21.0+ uses API version unsupported by Azurite in CI
+exclude github.com/gofrs/uuid v4.0.0+incompatible

-replace github.com/Azure/azure-sdk-for-go/sdk/storage/azblob => github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.2 // v1.6.4+ uses API version unsupported by Azurite in CI
+exclude github.com/goccy/go-json v0.4.11

-replace github.com/microsoft/go-mssqldb => github.com/microsoft/go-mssqldb v1.9.7 // downgraded with Azure SDK
-
-tool code.gitea.io/gitea-vet
+exclude github.com/satori/go.uuid v1.2.0
--- a/go.sum
+++ b/go.sum
--- a/main.go
+++ b/main.go
@@ -26,8 +26,9 @@ import (

 // these flags will be set by the build flags
 var (
-	Version = "development" // program version for this build
-	Tags    = ""            // the Golang build tags
+	Version     = "development" // program version for this build
+	Tags        = ""            // the Golang build tags
+	MakeVersion = ""            // "make" program version if built with make
 )

 func init() {
@@ -43,12 +44,14 @@ func main() {
 	}
 	app := cmd.NewMainApp(cmd.AppVersion{Version: Version, Extra: formatBuiltWith()})
 	_ = cmd.RunMainApp(app, os.Args...) // all errors should have been handled by the RunMainApp
-	// flush the queued logs before exiting, it is a MUST, otherwise there will be log loss
 	log.GetManager().Close()
 }

 func formatBuiltWith() string {
 	version := runtime.Version()
+	if len(MakeVersion) > 0 {
+		version = MakeVersion + ", " + runtime.Version()
+	}
 	if len(Tags) == 0 {
 		return " built with " + version
 	}
--- a/models/actions/artifact.go
+++ b/models/actions/artifact.go
@@ -53,11 +53,6 @@ func init() {
 	db.RegisterModel(new(ActionArtifact))
 }

-const (
-	ContentEncodingV3Gzip = "gzip"
-	ContentTypeZip        = "application/zip"
-)
-
 // ActionArtifact is a file that is stored in the artifact storage.
 type ActionArtifact struct {
 	ID                 int64 `xorm:"pk autoincr"`
@@ -66,26 +61,16 @@ type ActionArtifact struct {
 	RepoID             int64 `xorm:"index"`
 	OwnerID            int64
 	CommitSHA          string
-	StoragePath        string // The path to the artifact in the storage
-	FileSize           int64  // The size of the artifact in bytes
-	FileCompressedSize int64  // The size of the artifact in bytes after gzip compression
-
-	// The content encoding or content type of the artifact
-	// * empty or null: legacy (v3) uncompressed content
-	// * magic string "gzip" (ContentEncodingV3Gzip): v3 gzip compressed content
-	//   * requires gzip decoding before storing in a zip for download
-	//   * requires gzip content-encoding header when downloaded single files within a workflow
-	// * mime type for "Content-Type":
-	//   * "application/zip" (ContentTypeZip), seems to be an abuse, fortunately there is no conflict, and it won't cause problems?
-	//   * "application/pdf", "text/html", etc.: real content type of the artifact
-	ContentEncodingOrType string `xorm:"content_encoding"`
-
-	ArtifactPath string             `xorm:"index unique(runid_name_path)"` // The path to the artifact when runner uploads it
-	ArtifactName string             `xorm:"index unique(runid_name_path)"` // The name of the artifact when runner uploads it
-	Status       ArtifactStatus     `xorm:"index"`                         // The status of the artifact, uploading, expired or need-delete
-	CreatedUnix  timeutil.TimeStamp `xorm:"created"`
-	UpdatedUnix  timeutil.TimeStamp `xorm:"updated index"`
-	ExpiredUnix  timeutil.TimeStamp `xorm:"index"` // The time when the artifact will be expired
+	StoragePath        string             // The path to the artifact in the storage
+	FileSize           int64              // The size of the artifact in bytes
+	FileCompressedSize int64              // The size of the artifact in bytes after gzip compression
+	ContentEncoding    string             // The content encoding of the artifact
+	ArtifactPath       string             `xorm:"index unique(runid_name_path)"` // The path to the artifact when runner uploads it
+	ArtifactName       string             `xorm:"index unique(runid_name_path)"` // The name of the artifact when runner uploads it
+	Status             ArtifactStatus     `xorm:"index"`                         // The status of the artifact, uploading, expired or need-delete
+	CreatedUnix        timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix        timeutil.TimeStamp `xorm:"updated index"`
+	ExpiredUnix        timeutil.TimeStamp `xorm:"index"` // The time when the artifact will be expired
 }

 func CreateArtifact(ctx context.Context, t *ActionTask, artifactName, artifactPath string, expiredDays int64) (*ActionArtifact, error) {
@@ -171,8 +156,7 @@ func (opts FindArtifactsOptions) ToConds() builder.Cond {
 	}
 	if opts.FinalizedArtifactsV4 {
 		cond = cond.And(builder.Eq{"status": ArtifactStatusUploadConfirmed}.Or(builder.Eq{"status": ArtifactStatusExpired}))
-		// see the comment of ActionArtifact.ContentEncodingOrType: "*/*" means the field is a content type
-		cond = cond.And(builder.Like{"content_encoding", "%/%"})
+		cond = cond.And(builder.Eq{"content_encoding": "application/zip"})
 	}

 	return cond
@@ -186,10 +170,10 @@ type ActionArtifactMeta struct {
 }

 // ListUploadedArtifactsMeta returns all uploaded artifacts meta of a run
-func ListUploadedArtifactsMeta(ctx context.Context, repoID, runID int64) ([]*ActionArtifactMeta, error) {
+func ListUploadedArtifactsMeta(ctx context.Context, runID int64) ([]*ActionArtifactMeta, error) {
 	arts := make([]*ActionArtifactMeta, 0, 10)
 	return arts, db.GetEngine(ctx).Table("action_artifact").
-		Where("repo_id=? AND run_id=? AND (status=? OR status=?)", repoID, runID, ArtifactStatusUploadConfirmed, ArtifactStatusExpired).
+		Where("run_id=? AND (status=? OR status=?)", runID, ArtifactStatusUploadConfirmed, ArtifactStatusExpired).
 		GroupBy("artifact_name").
 		Select("artifact_name, sum(file_size) as file_size, max(status) as status").
 		Find(&arts)
--- a/models/actions/config.go
+++ b/models/actions/config.go
@@ -1,74 +0,0 @@
-// Copyright 2026 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package actions
-
-import (
-	"context"
-
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
-
-	"xorm.io/xorm/convert"
-)
-
-// OwnerActionsConfig defines the Actions configuration for a user or organization
-type OwnerActionsConfig struct {
-	// TokenPermissionMode defines the default permission mode (permissive, restricted)
-	TokenPermissionMode repo_model.ActionsTokenPermissionMode `json:"token_permission_mode,omitempty"`
-
-	// MaxTokenPermissions defines the absolute maximum permissions any token can have in this context.
-	MaxTokenPermissions *repo_model.ActionsTokenPermissions `json:"max_token_permissions,omitempty"`
-
-	// AllowedCrossRepoIDs is a list of specific repo IDs that can be accessed cross-repo
-	AllowedCrossRepoIDs []int64 `json:"allowed_cross_repo_ids,omitempty"`
-}
-
-var _ convert.ConversionFrom = (*OwnerActionsConfig)(nil)
-
-func (cfg *OwnerActionsConfig) FromDB(bytes []byte) error {
-	_ = json.Unmarshal(bytes, cfg)
-	cfg.TokenPermissionMode, _ = util.EnumValue(cfg.TokenPermissionMode)
-	return nil
-}
-
-// GetOwnerActionsConfig loads the OwnerActionsConfig for a user or organization from user settings
-// It returns a default config if no setting is found
-func GetOwnerActionsConfig(ctx context.Context, userID int64) (ret OwnerActionsConfig, err error) {
-	return user_model.GetUserSettingJSON(ctx, userID, user_model.SettingsKeyActionsConfig, ret)
-}
-
-// SetOwnerActionsConfig saves the OwnerActionsConfig for a user or organization to user settings
-func SetOwnerActionsConfig(ctx context.Context, userID int64, cfg OwnerActionsConfig) error {
-	return user_model.SetUserSettingJSON(ctx, userID, user_model.SettingsKeyActionsConfig, cfg)
-}
-
-// GetDefaultTokenPermissions returns the default token permissions by its TokenPermissionMode.
-func (cfg *OwnerActionsConfig) GetDefaultTokenPermissions() repo_model.ActionsTokenPermissions {
-	switch cfg.TokenPermissionMode {
-	case repo_model.ActionsTokenPermissionModeRestricted:
-		return repo_model.MakeRestrictedPermissions()
-	case repo_model.ActionsTokenPermissionModePermissive:
-		return repo_model.MakeActionsTokenPermissions(perm.AccessModeWrite)
-	default:
-		return repo_model.MakeActionsTokenPermissions(perm.AccessModeNone)
-	}
-}
-
-// GetMaxTokenPermissions returns the maximum allowed permissions
-func (cfg *OwnerActionsConfig) GetMaxTokenPermissions() repo_model.ActionsTokenPermissions {
-	if cfg.MaxTokenPermissions != nil {
-		return *cfg.MaxTokenPermissions
-	}
-	// Default max is write for everything
-	return repo_model.MakeActionsTokenPermissions(perm.AccessModeWrite)
-}
-
-// ClampPermissions ensures that the given permissions don't exceed the maximum
-func (cfg *OwnerActionsConfig) ClampPermissions(perms repo_model.ActionsTokenPermissions) repo_model.ActionsTokenPermissions {
-	maxPerms := cfg.GetMaxTokenPermissions()
-	return repo_model.ClampActionsTokenPermissions(perms, maxPerms)
-}
--- a/models/actions/run.go
+++ b/models/actions/run.go
@@ -16,13 +16,13 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
 	webhook_module "code.gitea.io/gitea/modules/webhook"

+	"github.com/nektos/act/pkg/jobparser"
 	"xorm.io/builder"
 )

@@ -30,7 +30,7 @@ import (
 type ActionRun struct {
 	ID                int64
 	Title             string
-	RepoID            int64                  `xorm:"unique(repo_index) index(repo_concurrency)"`
+	RepoID            int64                  `xorm:"index unique(repo_index)"`
 	Repo              *repo_model.Repository `xorm:"-"`
 	OwnerID           int64                  `xorm:"index"`
 	WorkflowID        string                 `xorm:"index"`                    // the name of workflow file
@@ -49,9 +49,6 @@ type ActionRun struct {
 	TriggerEvent      string                       // the trigger event defined in the `on` configuration of the triggered workflow
 	Status            Status                       `xorm:"index"`
 	Version           int                          `xorm:"version default 0"` // Status could be updated concomitantly, so an optimistic lock is needed
-	RawConcurrency    string                       // raw concurrency
-	ConcurrencyGroup  string                       `xorm:"index(repo_concurrency) NOT NULL DEFAULT ''"`
-	ConcurrencyCancel bool                         `xorm:"NOT NULL DEFAULT FALSE"`
 	// Started and Stopped is used for recording last run time, if rerun happened, they will be reset to 0
 	Started timeutil.TimeStamp
 	Stopped timeutil.TimeStamp
@@ -70,14 +67,14 @@ func (run *ActionRun) HTMLURL() string {
 	if run.Repo == nil {
 		return ""
 	}
-	return fmt.Sprintf("%s/actions/runs/%d", run.Repo.HTMLURL(), run.ID)
+	return fmt.Sprintf("%s/actions/runs/%d", run.Repo.HTMLURL(), run.Index)
 }

 func (run *ActionRun) Link() string {
 	if run.Repo == nil {
 		return ""
 	}
-	return fmt.Sprintf("%s/actions/runs/%d", run.Repo.Link(), run.ID)
+	return fmt.Sprintf("%s/actions/runs/%d", run.Repo.Link(), run.Index)
 }

 func (run *ActionRun) WorkflowLink() string {
@@ -105,15 +102,6 @@ func (run *ActionRun) PrettyRef() string {
 	return refName.ShortName()
 }

-// RefTooltip return a tooltop of run's ref. For pull request, it's the title of the PR, otherwise it's the ShortName.
-func (run *ActionRun) RefTooltip() string {
-	payload, err := run.GetPullRequestEventPayload()
-	if err == nil && payload != nil && payload.PullRequest != nil {
-		return payload.PullRequest.Title
-	}
-	return git.RefName(run.Ref).ShortName()
-}
-
 // LoadAttributes load Repo TriggerUser if not loaded
 func (run *ActionRun) LoadAttributes(ctx context.Context) error {
 	if run == nil {
@@ -153,11 +141,7 @@ func (run *ActionRun) LoadRepo(ctx context.Context) error {
 }

 func (run *ActionRun) Duration() time.Duration {
-	d := calculateDuration(run.Started, run.Stopped, run.Status, run.Updated) + run.PreviousDuration
-	if d < 0 {
-		return 0
-	}
-	return d
+	return calculateDuration(run.Started, run.Stopped, run.Status) + run.PreviousDuration
 }

 func (run *ActionRun) GetPushEventPayload() (*api.PushPayload, error) {
@@ -172,7 +156,7 @@ func (run *ActionRun) GetPushEventPayload() (*api.PushPayload, error) {
 }

 func (run *ActionRun) GetPullRequestEventPayload() (*api.PullRequestPayload, error) {
-	if run.Event.IsPullRequest() || run.Event.IsPullRequestReview() {
+	if run.Event.IsPullRequest() {
 		var payload api.PullRequestPayload
 		if err := json.Unmarshal([]byte(run.EventPayload), &payload); err != nil {
 			return nil, err
@@ -197,8 +181,7 @@ func (run *ActionRun) IsSchedule() bool {
 	return run.ScheduleID > 0
 }

-// UpdateRepoRunsNumbers updates the number of runs and closed runs of a repository.
-func UpdateRepoRunsNumbers(ctx context.Context, repo *repo_model.Repository) error {
+func updateRepoRunsNumbers(ctx context.Context, repo *repo_model.Repository) error {
 	_, err := db.GetEngine(ctx).ID(repo.ID).
 		NoAutoTime().
 		Cols("num_action_runs", "num_closed_action_runs").
@@ -256,62 +239,116 @@ func CancelPreviousJobs(ctx context.Context, repoID int64, ref, workflowID strin
 			return cancelledJobs, err
 		}

-		cjs, err := CancelJobs(ctx, jobs)
-		if err != nil {
-			return cancelledJobs, err
+		// Iterate over each job and attempt to cancel it.
+		for _, job := range jobs {
+			// Skip jobs that are already in a terminal state (completed, cancelled, etc.).
+			status := job.Status
+			if status.IsDone() {
+				continue
+			}
+
+			// If the job has no associated task (probably an error), set its status to 'Cancelled' and stop it.
+			if job.TaskID == 0 {
+				job.Status = StatusCancelled
+				job.Stopped = timeutil.TimeStampNow()
+
+				// Update the job's status and stopped time in the database.
+				n, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": 0}, "status", "stopped")
+				if err != nil {
+					return cancelledJobs, err
+				}
+
+				// If the update affected 0 rows, it means the job has changed in the meantime, so we need to try again.
+				if n == 0 {
+					return cancelledJobs, errors.New("job has changed, try again")
+				}
+
+				cancelledJobs = append(cancelledJobs, job)
+				// Continue with the next job.
+				continue
+			}
+
+			// If the job has an associated task, try to stop the task, effectively cancelling the job.
+			if err := StopTask(ctx, job.TaskID, StatusCancelled); err != nil {
+				return cancelledJobs, err
+			}
+			cancelledJobs = append(cancelledJobs, job)
 		}
-		cancelledJobs = append(cancelledJobs, cjs...)
 	}

 	// Return nil to indicate successful cancellation of all running and waiting jobs.
 	return cancelledJobs, nil
 }

-func CancelJobs(ctx context.Context, jobs []*ActionRunJob) ([]*ActionRunJob, error) {
-	cancelledJobs := make([]*ActionRunJob, 0, len(jobs))
-	// Iterate over each job and attempt to cancel it.
-	for _, job := range jobs {
-		// Skip jobs that are already in a terminal state (completed, cancelled, etc.).
-		status := job.Status
-		if status.IsDone() {
-			continue
-		}
-
-		// If the job has no associated task (probably an error), set its status to 'Cancelled' and stop it.
-		if job.TaskID == 0 {
-			job.Status = StatusCancelled
-			job.Stopped = timeutil.TimeStampNow()
-
-			// Update the job's status and stopped time in the database.
-			n, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": 0}, "status", "stopped")
-			if err != nil {
-				return cancelledJobs, err
-			}
-
-			// If the update affected 0 rows, it means the job has changed in the meantime
-			if n == 0 {
-				log.Error("Failed to cancel job %d because it has changed", job.ID)
-				continue
-			}
-
-			cancelledJobs = append(cancelledJobs, job)
-			// Continue with the next job.
-			continue
-		}
-
-		// If the job has an associated task, try to stop the task, effectively cancelling the job.
-		if err := StopTask(ctx, job.TaskID, StatusCancelled); err != nil {
-			return cancelledJobs, err
-		}
-		updatedJob, err := GetRunJobByRunAndID(ctx, job.RunID, job.ID)
+// InsertRun inserts a run
+// The title will be cut off at 255 characters if it's longer than 255 characters.
+func InsertRun(ctx context.Context, run *ActionRun, jobs []*jobparser.SingleWorkflow) error {
+	return db.WithTx(ctx, func(ctx context.Context) error {
+		index, err := db.GetNextResourceIndex(ctx, "action_run_index", run.RepoID)
 		if err != nil {
-			return cancelledJobs, fmt.Errorf("get job: %w", err)
+			return err
 		}
-		cancelledJobs = append(cancelledJobs, updatedJob)
-	}
+		run.Index = index
+		run.Title = util.EllipsisDisplayString(run.Title, 255)

-	// Return nil to indicate successful cancellation of all running and waiting jobs.
-	return cancelledJobs, nil
+		if err := db.Insert(ctx, run); err != nil {
+			return err
+		}
+
+		if run.Repo == nil {
+			repo, err := repo_model.GetRepositoryByID(ctx, run.RepoID)
+			if err != nil {
+				return err
+			}
+			run.Repo = repo
+		}
+
+		if err := updateRepoRunsNumbers(ctx, run.Repo); err != nil {
+			return err
+		}
+
+		runJobs := make([]*ActionRunJob, 0, len(jobs))
+		var hasWaiting bool
+		for _, v := range jobs {
+			id, job := v.Job()
+			needs := job.Needs()
+			if err := v.SetJob(id, job.EraseNeeds()); err != nil {
+				return err
+			}
+			payload, _ := v.Marshal()
+			status := StatusWaiting
+			if len(needs) > 0 || run.NeedApproval {
+				status = StatusBlocked
+			} else {
+				hasWaiting = true
+			}
+			job.Name = util.EllipsisDisplayString(job.Name, 255)
+			runJobs = append(runJobs, &ActionRunJob{
+				RunID:             run.ID,
+				RepoID:            run.RepoID,
+				OwnerID:           run.OwnerID,
+				CommitSHA:         run.CommitSHA,
+				IsForkPullRequest: run.IsForkPullRequest,
+				Name:              job.Name,
+				WorkflowPayload:   payload,
+				JobID:             id,
+				Needs:             needs,
+				RunsOn:            job.RunsOn(),
+				Status:            status,
+			})
+		}
+		if err := db.Insert(ctx, runJobs); err != nil {
+			return err
+		}
+
+		// if there is a job in the waiting status, increase tasks version.
+		if hasWaiting {
+			if err := IncreaseTaskVersion(ctx, run.OwnerID, run.RepoID); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
 }

 func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, error) {
@@ -326,16 +363,16 @@ func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, er
 	return &run, nil
 }

-func GetRunByRepoAndIndex(ctx context.Context, repoID, runIndex int64) (*ActionRun, error) {
+func GetRunByIndex(ctx context.Context, repoID, index int64) (*ActionRun, error) {
 	run := &ActionRun{
 		RepoID: repoID,
-		Index:  runIndex,
+		Index:  index,
 	}
 	has, err := db.GetEngine(ctx).Get(run)
 	if err != nil {
 		return nil, err
 	} else if !has {
-		return nil, fmt.Errorf("run with repo_id %d and index %d: %w", repoID, runIndex, util.ErrNotExist)
+		return nil, fmt.Errorf("run with index %d %d: %w", repoID, index, util.ErrNotExist)
 	}

 	return run, nil
@@ -396,7 +433,7 @@ func UpdateRun(ctx context.Context, run *ActionRun, cols ...string) error {
 		if err = run.LoadRepo(ctx); err != nil {
 			return err
 		}
-		if err := UpdateRepoRunsNumbers(ctx, run.Repo); err != nil {
+		if err := updateRepoRunsNumbers(ctx, run.Repo); err != nil {
 			return err
 		}
 	}
@@ -405,59 +442,3 @@ func UpdateRun(ctx context.Context, run *ActionRun, cols ...string) error {
 }

 type ActionRunIndex db.ResourceIndex
-
-func GetConcurrentRunsAndJobs(ctx context.Context, repoID int64, concurrencyGroup string, status []Status) ([]*ActionRun, []*ActionRunJob, error) {
-	runs, err := db.Find[ActionRun](ctx, &FindRunOptions{
-		RepoID:           repoID,
-		ConcurrencyGroup: concurrencyGroup,
-		Status:           status,
-	})
-	if err != nil {
-		return nil, nil, fmt.Errorf("find runs: %w", err)
-	}
-
-	jobs, err := db.Find[ActionRunJob](ctx, &FindRunJobOptions{
-		RepoID:           repoID,
-		ConcurrencyGroup: concurrencyGroup,
-		Statuses:         status,
-	})
-	if err != nil {
-		return nil, nil, fmt.Errorf("find jobs: %w", err)
-	}
-
-	return runs, jobs, nil
-}
-
-func CancelPreviousJobsByRunConcurrency(ctx context.Context, actionRun *ActionRun) ([]*ActionRunJob, error) {
-	if actionRun.ConcurrencyGroup == "" {
-		return nil, nil
-	}
-
-	var jobsToCancel []*ActionRunJob
-
-	statusFindOption := []Status{StatusWaiting, StatusBlocked}
-	if actionRun.ConcurrencyCancel {
-		statusFindOption = append(statusFindOption, StatusRunning)
-	}
-	runs, jobs, err := GetConcurrentRunsAndJobs(ctx, actionRun.RepoID, actionRun.ConcurrencyGroup, statusFindOption)
-	if err != nil {
-		return nil, fmt.Errorf("find concurrent runs and jobs: %w", err)
-	}
-	jobsToCancel = append(jobsToCancel, jobs...)
-
-	// cancel runs in the same concurrency group
-	for _, run := range runs {
-		if run.ID == actionRun.ID {
-			continue
-		}
-		jobs, err := db.Find[ActionRunJob](ctx, FindRunJobOptions{
-			RunID: run.ID,
-		})
-		if err != nil {
-			return nil, fmt.Errorf("find run %d jobs: %w", run.ID, err)
-		}
-		jobsToCancel = append(jobsToCancel, jobs...)
-	}
-
-	return CancelJobs(ctx, jobsToCancel)
-}
--- a/models/actions/run_job.go
+++ b/models/actions/run_job.go
@@ -11,60 +11,34 @@ import (

 	"code.gitea.io/gitea/models/db"
 	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/actions/jobparser"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"

 	"xorm.io/builder"
 )

-// MaxJobNumPerRun is the maximum number of jobs in a single run.
-// https://docs.github.com/en/actions/reference/limits#existing-system-limits
-// TODO: check this limit when creating jobs
-const MaxJobNumPerRun = 256
-
 // ActionRunJob represents a job of a run
 type ActionRunJob struct {
 	ID                int64
 	RunID             int64                  `xorm:"index"`
 	Run               *ActionRun             `xorm:"-"`
-	RepoID            int64                  `xorm:"index(repo_concurrency)"`
+	RepoID            int64                  `xorm:"index"`
 	Repo              *repo_model.Repository `xorm:"-"`
 	OwnerID           int64                  `xorm:"index"`
 	CommitSHA         string                 `xorm:"index"`
 	IsForkPullRequest bool
 	Name              string `xorm:"VARCHAR(255)"`
 	Attempt           int64
-
-	// WorkflowPayload is act/jobparser.SingleWorkflow for act/jobparser.Parse
-	// it should contain exactly one job with global workflow fields for this model
-	WorkflowPayload []byte
-
-	JobID  string   `xorm:"VARCHAR(255)"` // job id in workflow, not job's id
-	Needs  []string `xorm:"JSON TEXT"`
-	RunsOn []string `xorm:"JSON TEXT"`
-	TaskID int64    // the latest task of the job
-	Status Status   `xorm:"index"`
-
-	RawConcurrency string // raw concurrency from job YAML's "concurrency" section
-
-	// IsConcurrencyEvaluated is only valid/needed when this job's RawConcurrency is not empty.
-	// If RawConcurrency can't be evaluated (e.g. depend on other job's outputs or have errors), this field will be false.
-	// If RawConcurrency has been successfully evaluated, this field will be true, ConcurrencyGroup and ConcurrencyCancel are also set.
-	IsConcurrencyEvaluated bool
-
-	ConcurrencyGroup  string `xorm:"index(repo_concurrency) NOT NULL DEFAULT ''"` // evaluated concurrency.group
-	ConcurrencyCancel bool   `xorm:"NOT NULL DEFAULT FALSE"`                      // evaluated concurrency.cancel-in-progress
-
-	// TokenPermissions stores the explicit permissions from workflow/job YAML (no org/repo clamps applied).
-	// Org/repo clamps are enforced when the token is used at runtime.
-	// It is JSON-encoded repo_model.ActionsTokenPermissions and may be empty if not specified.
-	TokenPermissions *repo_model.ActionsTokenPermissions `xorm:"JSON TEXT"`
-
-	Started timeutil.TimeStamp
-	Stopped timeutil.TimeStamp
-	Created timeutil.TimeStamp `xorm:"created"`
-	Updated timeutil.TimeStamp `xorm:"updated index"`
+	WorkflowPayload   []byte
+	JobID             string   `xorm:"VARCHAR(255)"` // job id in workflow, not job's id
+	Needs             []string `xorm:"JSON TEXT"`
+	RunsOn            []string `xorm:"JSON TEXT"`
+	TaskID            int64    // the latest task of the job
+	Status            Status   `xorm:"index"`
+	Started           timeutil.TimeStamp
+	Stopped           timeutil.TimeStamp
+	Created           timeutil.TimeStamp `xorm:"created"`
+	Updated           timeutil.TimeStamp `xorm:"updated index"`
 }

 func init() {
@@ -72,7 +46,7 @@ func init() {
 }

 func (job *ActionRunJob) Duration() time.Duration {
-	return calculateDuration(job.Started, job.Stopped, job.Status, job.Updated)
+	return calculateDuration(job.Started, job.Stopped, job.Status)
 }

 func (job *ActionRunJob) LoadRun(ctx context.Context) error {
@@ -110,43 +84,13 @@ func (job *ActionRunJob) LoadAttributes(ctx context.Context) error {
 	return job.Run.LoadAttributes(ctx)
 }

-// ParseJob parses the job structure from the ActionRunJob.WorkflowPayload
-func (job *ActionRunJob) ParseJob() (*jobparser.Job, error) {
-	// job.WorkflowPayload is a SingleWorkflow created from an ActionRun's workflow, which exactly contains this job's YAML definition.
-	// Ideally it shouldn't be called "Workflow", it is just a job with global workflow fields + trigger
-	parsedWorkflows, err := jobparser.Parse(job.WorkflowPayload)
-	if err != nil {
-		return nil, fmt.Errorf("job %d single workflow: unable to parse: %w", job.ID, err)
-	} else if len(parsedWorkflows) != 1 {
-		return nil, fmt.Errorf("job %d single workflow: not single workflow", job.ID)
-	}
-	_, workflowJob := parsedWorkflows[0].Job()
-	if workflowJob == nil {
-		// it shouldn't happen, and since the callers don't check nil, so return an error instead of nil
-		return nil, util.ErrorWrap(util.ErrNotExist, "job %d single workflow: payload doesn't contain a job", job.ID)
-	}
-	return workflowJob, nil
-}
-
-func GetRunJobByRepoAndID(ctx context.Context, repoID, jobID int64) (*ActionRunJob, error) {
+func GetRunJobByID(ctx context.Context, id int64) (*ActionRunJob, error) {
 	var job ActionRunJob
-	has, err := db.GetEngine(ctx).Where("id=? AND repo_id=?", jobID, repoID).Get(&job)
+	has, err := db.GetEngine(ctx).Where("id=?", id).Get(&job)
 	if err != nil {
 		return nil, err
 	} else if !has {
-		return nil, fmt.Errorf("run job with id %d: %w", jobID, util.ErrNotExist)
-	}
-
-	return &job, nil
-}
-
-func GetRunJobByRunAndID(ctx context.Context, runID, jobID int64) (*ActionRunJob, error) {
-	var job ActionRunJob
-	has, err := db.GetEngine(ctx).Where("id=? AND run_id=?", jobID, runID).Get(&job)
-	if err != nil {
-		return nil, err
-	} else if !has {
-		return nil, fmt.Errorf("run job with id %d: %w", jobID, util.ErrNotExist)
+		return nil, fmt.Errorf("run job with id %d: %w", id, util.ErrNotExist)
 	}

 	return &job, nil
@@ -181,7 +125,7 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 		return affected, nil
 	}

-	if slices.Contains(cols, "status") && job.Status.IsWaiting() {
+	if affected != 0 && slices.Contains(cols, "status") && job.Status.IsWaiting() {
 		// if the status of job changes to waiting again, increase tasks version.
 		if err := IncreaseTaskVersion(ctx, job.OwnerID, job.RepoID); err != nil {
 			return 0, err
@@ -190,7 +134,7 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col

 	if job.RunID == 0 {
 		var err error
-		if job, err = GetRunJobByRepoAndID(ctx, job.RepoID, job.ID); err != nil {
+		if job, err = GetRunJobByID(ctx, job.ID); err != nil {
 			return 0, err
 		}
 	}
@@ -253,39 +197,3 @@ func AggregateJobStatus(jobs []*ActionRunJob) Status {
 		return StatusUnknown // it shouldn't happen
 	}
 }
-
-func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob) (jobsToCancel []*ActionRunJob, _ error) {
-	if job.RawConcurrency == "" {
-		return nil, nil
-	}
-	if !job.IsConcurrencyEvaluated {
-		return nil, nil
-	}
-	if job.ConcurrencyGroup == "" {
-		return nil, nil
-	}
-
-	statusFindOption := []Status{StatusWaiting, StatusBlocked}
-	if job.ConcurrencyCancel {
-		statusFindOption = append(statusFindOption, StatusRunning)
-	}
-	runs, jobs, err := GetConcurrentRunsAndJobs(ctx, job.RepoID, job.ConcurrencyGroup, statusFindOption)
-	if err != nil {
-		return nil, fmt.Errorf("find concurrent runs and jobs: %w", err)
-	}
-	jobs = slices.DeleteFunc(jobs, func(j *ActionRunJob) bool { return j.ID == job.ID })
-	jobsToCancel = append(jobsToCancel, jobs...)
-
-	// cancel runs in the same concurrency group
-	for _, run := range runs {
-		jobs, err := db.Find[ActionRunJob](ctx, FindRunJobOptions{
-			RunID: run.ID,
-		})
-		if err != nil {
-			return nil, fmt.Errorf("find run %d jobs: %w", run.ID, err)
-		}
-		jobsToCancel = append(jobsToCancel, jobs...)
-	}
-
-	return CancelJobs(ctx, jobsToCancel)
-}
--- a/models/actions/run_job_list.go
+++ b/models/actions/run_job_list.go
@@ -69,13 +69,12 @@ func (jobs ActionJobList) LoadAttributes(ctx context.Context, withRepo bool) err

 type FindRunJobOptions struct {
 	db.ListOptions
-	RunID            int64
-	RepoID           int64
-	OwnerID          int64
-	CommitSHA        string
-	Statuses         []Status
-	UpdatedBefore    timeutil.TimeStamp
-	ConcurrencyGroup string
+	RunID         int64
+	RepoID        int64
+	OwnerID       int64
+	CommitSHA     string
+	Statuses      []Status
+	UpdatedBefore timeutil.TimeStamp
 }

 func (opts FindRunJobOptions) ToConds() builder.Cond {
@@ -95,12 +94,6 @@ func (opts FindRunJobOptions) ToConds() builder.Cond {
 	if opts.UpdatedBefore > 0 {
 		cond = cond.And(builder.Lt{"`action_run_job`.updated": opts.UpdatedBefore})
 	}
-	if opts.ConcurrencyGroup != "" {
-		if opts.RepoID == 0 {
-			panic("Invalid FindRunJobOptions: repo_id is required")
-		}
-		cond = cond.And(builder.Eq{"`action_run_job`.concurrency_group": opts.ConcurrencyGroup})
-	}
 	return cond
 }

--- a/Show More
+++ b/Show More