Merge branch 'main' into copilot/refactor-catbatchparsetreeentries

add more test cases
Update go js py dependencies (#37204 )
2026-04-14 11:36:16 +00:00 · 2026-04-14 19:33:06 +08:00 · 2026-04-14 19:29:21 +08:00 · 2026-04-14 12:45:54 +02:00 · 2026-04-14 15:57:55 +08:00 · 2026-04-14 15:38:13 +08:00
221 changed files with 3485 additions and 3877 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,385 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).

+## [1.26.0-rc0](https://github.com/go-gitea/gitea/releases/tag/v1.26.0-rc0) - 2026-04-07
+
+* BREAKING
+  * Correct swagger annotations for enums, status codes, and notification state (#37030)
+  * Remove GET API registration-token (#36801)
+  * Support Actions `concurrency` syntax (#32751)
+  * Make PUBLIC_URL_DETECTION default to "auto" (#36955)
+* SECURITY
+  * Bound PageSize in `ListUnadoptedRepositories` (#36884)
+* FEATURES
+  * Support Actions `concurrency` syntax (#32751)
+  * Add terraform state registry (#36710)
+  * Instance-wide (global) info banner and maintenance mode (#36571)
+  * Support rendering OpenAPI spec (#36449)
+  * Add keyboard shortcuts for repository file and code search (#36416)
+  * Add support for archive-upload rpc (#36391)
+  * Add ability to download subpath archive (#36371)
+  * Add workflow dependencies visualization (#26062) (#36248) & Restyle Workflow Graph (#36912)
+  * Automatic generation of release notes (#35977)
+  * Add "Go to file", "Delete Directory" to repo file list page (#35911)
+  * Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)
+  * Add button to re-run failed jobs in Actions (#36924)
+  * Support actions and reusable workflows from private repos (#32562)
+  * Add summary to action runs view (#36883)
+  * Add user badges (#36752)
+  * Add configurable permissions for Actions automatic tokens (#36173)
+  * Add per-runner “Disable/Pause”  (#36776)
+* PERFORMANCE
+  * WorkflowDispatch API optionally return runid (#36706)
+  * Add render cache for SVG icons (#36863)
+  * Load `mentionValues` asynchronously (#36739)
+  * Lazy-load some Vue components, fix heatmap chunk loading on every page (#36719)
+  * Load heatmap data asynchronously (#36622)
+  * Use prev/next pagination for user profile activities page to speed up (#36642)
+  * Refactor cat-file batch operations and support `--batch-command` approach (#35775)
+  * Use merge tree to detect conflicts when possible (#36400)
+* ENHANCEMENTS
+  * Adds option to force update new branch in contents routes (#35592)
+  * Add viewer controller for mermaid (zoom, drag) (#36557)
+  * Add code editor setting dropdowns (#36534)
+  * Add `elk` layout support to mermaid (#36486)
+  * Add resolve/unresolve review comment API endpoints (#36441)
+  * Allow configuring default PR base branch (fixes #36412) (#36425)
+  * Add support for RPM Errata (updateinfo.xml) (#37125)
+  * Require additional user confirmation for making repo private (#36959)
+  * Feature non-zipped actions artifacts (action v7 / nodejs / npm v6.2.0) (#36786)
+  * Add `actions.WORKFLOW_DIRS` setting (#36619)
+  * Avoid opening new tab when downloading actions logs (#36740)
+  * Implements OIDC RP-Initiated Logout (#36724)
+  * Show workflow link (#37070)
+  * Desaturate dark theme background colors (#37056)
+  * Refactor "org teams" page and help new users to "add member" to an org (#37051)
+  * Add webhook name field to improve webhook identification (#37025) (#37040)
+  * Make task list checkboxes clickable in the preview tab (#37010)
+  * Improve severity labels in Actions logs and tweak colors (#36993)
+  * Linkify URLs in Actions workflow logs (#36986)
+  * Allow text selection on checkbox labels (#36970)
+  * Support dark/light theme images in markdown (#36922)
+  * Enable native dark mode for swagger-ui (#36899)
+  * Rework checkbox styling, remove `input` border hover effect (#36870)
+  * Refactor storage content-type handling of ServeDirectURL (#36804)
+  * Use "Enable Gravatar" but not "Disable" (#36771)
+  * Use case-insensitive matching for Git error "Not a valid object name" (#36728)
+  * Add “Copy Source” to markup comment menu (#36726)
+  * Change image transparency grid to CSS (#36711)
+  * Add "Run" prefix for unnamed action steps (#36624)
+  * Persist actions log time display settings in `localStorage` (#36623)
+  * Use first commit title for multi-commit PRs and fix auto-focus title field (#36606)
+  * Improve BuildCaseInsensitiveLike with lowercase (#36598)
+  * Improve diff highlighting (#36583)
+  * Exclude cancelled runs from failure-only email notifications (#36569)
+  * Use full-file highlighting for diff sections (#36561)
+  * Color command/error logs in Actions log (#36538)
+  * Add paging headers (#36521)
+  * Improve timeline entries for WIP prefix changes in pull requests (#36518)
+  * Add FOLDER_ICON_THEME configuration option (#36496)
+  * Normalize guessed languages for code highlighting (#36450)
+  * Add chunked transfer encoding support for LFS uploads (#36380)
+  * Indicate when only optional checks failed (#36367)
+  * Add 'allow_maintainer_edit' API option for creating a pull request (#36283)
+  * Support closing keywords with URL references (#36221)
+  * Improve diff file headers (#36215)
+  * Fix and enhance comment editor monospace toggle (#36181)
+  * Add git.DIFF_RENAME_SIMILARITY_THRESHOLD option (#36164)
+  * Add matching pair insertion to markdown textarea (#36121)
+  * Add sorting/filtering to admin user search API endpoint (#36112)
+  * Allow action user have read permission in public repo like other user (#36095)
+  * Disable matchBrackets in monaco (#36089)
+  * Use GitHub-style commit message for squash merge (#35987)
+  * Make composer registry support tar.gz and tar.bz2 and fix bugs (#35958)
+  * Add GITEA_PR_INDEX env variable to githooks (#35938)
+  * Add proper error message if session provider can not be created (#35520)
+  * Add button to copy file name in PR files (#35509)
+  * Move `X_FRAME_OPTIONS` setting from `cors` to `security` section (#30256)
+  * Add placeholder content for empty content page (#37114)
+  * Add `DEFAULT_DELETE_BRANCH_AFTER_MERGE` setting (#36917)
+  * Redirect to the only OAuth2 provider when no other login methods and fix various problems (#36901)
+  * Add admin badge to navbar avatar (#36790)
+  * Add `never` option to `PUBLIC_URL_DETECTION` configuration (#36785)
+  * Add background and run count to actions list page (#36707)
+  * Add icon to buttons "Close with Comment", "Close Pull Request", "Close Issue" (#36654)
+  * Add support for in_progress event in workflow_run webhook (#36979)
+  * Report commit status for pull_request_review events (#36589)
+  * Render merged pull request title as such in dashboard feed (#36479)
+  * Feature to be able to filter project boards by milestones (#36321)
+  * Use user id in noreply emails (#36550)
+  * Enable pagination on GiteaDownloader.getIssueReactions() (#36549)
+  * Remove striped tables in UI (#36509)
+  * Improve control char rendering and escape button styling (#37094)
+  * Support legacy run/job index-based URLs and refactor migration 326 (#37008)
+  * Add date to "No Contributions" tooltip (#36190)
+  * Show edit page confirmation dialog on tree view file change (#36130)
+  * Mention proc-receive in text for dashboard.resync_all_hooks func (#35991)
+  * Reuse selectable style for wiki (#35990)
+  * Support blue yellow colorblind theme (#35910)
+  * Support selecting theme on the footer (#35741)
+  * Improve online runner check (#35722)
+  * Add quick approve button on PR page (#35678)
+  * Enable commenting on expanded lines in PR diffs (#35662)
+  * Print PR-Title into tooltip for actions (#35579)
+  * Use explicit, stronger defaults for newly generated repo signing keys for Debian (#36236)
+  * Improve the compare page (#36261)
+  * Unify repo names in system notices (#36491)
+  * Move package settings to package instead of being tied to version (#37026)
+  * Add Actions API rerun endpoints for runs and jobs (#36768)
+  * Add branch_count to repository API (#35351) (#36743)
+  * Add created_by filter to SearchIssues (#36670)
+  * Allow admins to rename non-local users (#35970)
+  * Support updating branch via API (#35951)
+  * Add an option to automatically verify SSH keys from LDAP (#35927)
+  * Make "update file" API can create a new file when SHA is not set (#35738)
+  * Update issue.go with labels documentation (labels content, not ids) (#35522)
+  * Expose content_version for optimistic locking on issue and PR edits (#37035)
+  * Pass ServeHeaderOptions by value instead of pointer, fine tune httplib tests (#36982)
+* BUGFIXES
+  * Fix API not persisting pull request unit config when has_pull_requests is not set (#36718)
+  * Rename CSS variables and improve colorblind themes (#36353)
+  * Hide `add-matcher` and `remove-matcher` from actions job logs (#36520)
+  * Prevent navigation keys from triggering actions during IME composition (#36540)
+  * Fix vertical alignment of `.commit-sign-badge` children (#36570)
+  * Fix duplicate startup warnings in admin panel (#36641)
+  * Fix CODEOWNERS review request attribution using comment metadata (#36348)
+  * Fix HTML tags appearing in wiki table of contents (#36284)
+  * Fix various bugs (#37096)
+  * Fix various legacy problems (#37092)
+  * Fix RPM Registry 404 when package name contains 'package' (#37087)
+  * Merge some standalone Vite entries into index.js (#37085)
+  * Fix various problems (#37077)
+  * Fix issue label deletion with Actions tokens (#37013)
+  * Hide delete branch or tag buttons in mirror or archived repositories. (#37006)
+  * Fix org contact email not clearable once set (#36975)
+  * Fix a bug when forking a repository in an organization (#36950)
+  * Preserve sort order of exclusive labels from template repo (#36931)
+  * Make container registry support Apple Container (basic auth) (#36920)
+  * Fix the wrong push commits in the pull request when force push (#36914)
+  * Add class "list-header-filters" to the div for projects (#36889)
+  * Fix dbfs error handling (#36844)
+  * Fix incorrect viewed files counter if reverted change was viewed (#36819)
+  * Refactor avatar package, support default avatar fallback (#36788)
+  * Fix README symlink resolution in subdirectories like .github (#36775)
+  * Fix CSS stacking context issue in actions log (#36749)
+  * Add gpg signing for merge rebase and update by rebase (#36701)
+  * Delete non-exist branch should return 404 (#36694)
+  * Fix `TestActionsCollaborativeOwner` (#36657)
+  * Fix multi-arch Docker build SIGILL by splitting frontend stage (#36646)
+  * Fix linguist-detectable attribute being ignored for configuration files (#36640)
+  * Fix state desync in ComboMarkdownEditor (#36625)
+  * Unify DEFAULT_SHOW_FULL_NAME output in templates and dropdown (#36597)
+  * Pull Request Pusher should be the author of the merge (#36581)
+  * Fix various version parsing problems (#36553)
+  * Fix highlight diff result (#36539)
+  * Fix mirror sync parser and fix mirror messages (#36504)
+  * Fix bug when list pull request commits (#36485)
+  * Fix various bugs (#36446)
+  * Fix issue filter menu layout (#36426)
+  * Restrict branch naming when new change matches with protection rules (#36405)
+  * Fix link/origin referrer and login redirect (#36279)
+  * Generate IDs for HTML headings without id attribute (#36233)
+  * Use a migration test instead of a wrong test which populated the meta test repositories and fix a migration bug (#36160)
+  * Fix issue close timeline icon (#36138)
+  * Fix diff blob excerpt expansion (#35922)
+  * Fix external render (#35727)
+  * Fix review request webhook bug (#35339) (#35723)
+  * Fix shutdown waitgroup panic (#35676)
+  * Cleanup ActionRun creation (#35624)
+  * Fix possible bug when migrating issues/pull requests (#33487)
+  * Various fixes (#36697)
+  * Apply notify/register mail flags during install load (#37120)
+  * Repair duration display for bad stopped timestamps (#37121)
+  * Fix(upgrade.sh): use HTTPS for GPG key import and restore SELinux context after upgrade (#36930)
+  * Fix various trivial problems (#36921)
+  * Fix various trivial problems (#36953)
+  * Fix NuGet package upload error handling (#37074)
+  * Fix CodeQL code scanning alerts (#36858)
+  * Refactor issue sidebar and fix various problems (#37045)
+  * Fix various problems (#37029)
+  * Fix relative-time RangeError (#37021)
+  * Fix chroma lexer mapping (#36629)
+  * Fix typos and grammar in English locale (#36751)
+  * Fix milestone/project text overflow in issue sidebar (#36741)
+  * Fix `no-content` message not rendering after comment edit (#36733)
+  * Fix theme loading in development (#36605)
+  * Fix workflow run jobs API returning null steps (#36603)
+  * Fix timeline event layout overflow with long content (#36595)
+  * Fix minor UI issues in runner edit page (#36590)
+  * Fix incorrect vendored detections (#36508)
+  * Fix editorconfig not respected in PR Conversation view (#36492)
+  * Don't create self-references in merged PRs (#36490)
+  * Fix potential incorrect runID in run status update (#36437)
+  * Fix file-tree ui error when adding files to repo without commits (#36312)
+  * Improve image captcha contrast for dark mode (#36265)
+  * Fix panic in blame view when a file has only a single commit (#36230)
+  * Fix spelling error in migrate-storage cmd utility (#36226)
+  * Fix code highlighting on blame page (#36157)
+  * Fix nilnil in onedev downloader (#36154)
+  * Fix actions lint (#36029)
+  * Fix oauth2 session gob register (#36017)
+  * Fix Arch repo pacman.conf snippet (#35825)
+  * Fix a number of `strictNullChecks`-related issues (#35795)
+  * Fix URLJoin, markup render link reoslving, sign-in/up/linkaccount page common data (#36861)
+  * Hide delete directory button for mirror or archive repository and disable the menu item if user have no permission (#36384)
+  * Update message severity colors, fix navbar double border (#37019)
+  * Inline and lazy-load EasyMDE CSS, fix border colors (#36714)
+  * Closed milestones with no issues now show as 100% completed (#36220)
+  * Add test for ExtendCommentTreePathLength migration and fix bugs (#35791)
+  * Only turn links to current instance into hash links (#36237)
+  * Fix typos in code comments: doesnt, dont, wont (#36890)
+* REFACTOR
+  * Replace Monaco with CodeMirror (#36764)
+  * Replace CSRF cookie with `CrossOriginProtection` (#36183)
+  * Replace index with id in actions routes (#36842)
+  * Remove unnecessary function parameter (#35765)
+  * Move jobparser from act repository to Gitea (#36699)
+  * Refactor compare router param parse (#36105)
+  * Optimize 'refreshAccesses' to perform update without removing then adding (#35702)
+  * Clean up checkbox cursor styles (#37016)
+  * Remove undocumented support of signing key in the repository git configuration file (#36143)
+  * Switch `cmd/` to use constructor functions. (#36962)
+  * Use `relative-time` to render absolute dates (#36238)
+  * Some refactors about GetMergeBase (#36186)
+  * Some small refactors (#36163)
+  * Use gitRepo as parameter instead of repopath when invoking sign functions (#36162)
+  * Move blame to gitrepo (#36161)
+  * Move some functions to gitrepo package to reduce RepoPath reference directly (#36126)
+  * Use gitrepo's clone and push when possible (#36093)
+  * Remove mermaid margin workaround (#35732)
+  * Move some functions to gitrepo package (#35543)
+  * Move GetDiverging functions to gitrepo (#35524)
+  * Use global lock instead of status pool for cron lock (#35507)
+  * Use explicit mux instead of DefaultServeMux (#36276)
+  * Use gitrepo's push function (#36245)
+  * Pass request context to generateAdditionalHeadersForIssue (#36274)
+  * Move assign project when creating pull request to the same database transaction (#36244)
+  * Move catfile batch to a sub package of git module (#36232)
+  * Use gitrepo.Repository instead of wikipath (#35398)
+  * Use experimental go json v2 library (#35392)
+  * Refactor template render (#36438)
+  * Refactor GetRepoRawDiffForFile to avoid unnecessary pipe or goroutine (#36434)
+  * Refactor text utility classes to Tailwind CSS (#36703)
+  * Refactor git command stdio pipe (#36422)
+  * Refactor git command context & pipeline (#36406)
+  * Refactor git command stdio pipe (#36393)
+  * Remove unused functions (#36672)
+  * Refactor Actions Token Access (#35688)
+  * Move commit related functions to gitrepo package (#35600)
+  * Move archive function to repo_model and gitrepo (#35514)
+  * Move some functions to gitrepo package (#35503)
+  * Use git model to detect whether branch exist instead of gitrepo method (#35459)
+  * Some refactor for repo path (#36251)
+  * Extract helper functions from SearchIssues (#36158)
+  * Refactor merge conan and container auth preserve actions taskID (#36560)
+  * Refactor Nuget Auth to reuse Basic Auth Token Validation (#36558)
+  * Refactor ActionsTaskID (#36503)
+  * Refactor auth middleware (#36848)
+  * Refactor code render and render control chars (#37078)
+  * Clean up AppURL, remove legacy origin-url webcomponent (#37090)
+  * Remove `util.URLJoin` and replace all callers with direct path concatenation (#36867)
+  * Replace legacy tw-flex utility classes with flex-text-block/inline (#36778)
+  * Mark unused&immature activitypub as "not implemented" (#36789)
+* TESTING
+  * Add e2e tests for server push events (#36879)
+  * Rework e2e tests (#36634)
+  * Add e2e reaction test, improve accessibility, enable parallel testing (#37081)
+  * Increase e2e test timeouts on CI to fix flaky tests (#37053)
+* BUILD
+  * Convert locale files from ini to json format (#35489)
+  * Bump golangci-lint to 2.7.2, enable modernize stringsbuilder (#36180)
+  * Port away from `flake-utils` (#35675)
+  * Remove nolint (#36252)
+  * Update the Unlicense copy to latest version (#36636)
+  * Update to go 1.26.0 and golangci-lint 2.9.0 (#36588)
+  * Replace `google/go-licenses` with custom generation (#36575)
+  * Update go dependencies (#36548)
+  * Bump appleboy/git-push-action from 1.0.0 to 1.2.0 (#36306)
+  * Remove fomantic form module (#36222)
+  * Bump setup-node to v6, re-enable cache (#36207)
+  * Bump crowdin/github-action from 1 to 2 (#36204)
+  * Revert "Bump alpine to 3.23 (#36185)" (#36202)
+  * Update chroma to v2.21.1 (#36201)
+  * Bump astral-sh/setup-uv from 6 to 7 (#36198)
+  * Bump docker/build-push-action from 5 to 6 (#36197)
+  * Bump aws-actions/configure-aws-credentials from 4 to 5 (#36196)
+  * Bump dev-hanz-ops/install-gh-cli-action from 0.1.0 to 0.2.1 (#36195)
+  * Add JSON linting (#36192)
+  * Enable dependabot for actions (#36191)
+  * Bump alpine to 3.23 (#36185)
+  * Update chroma to v2.21.0 (#36171)
+  * Update JS deps and eslint enhancements (#36147)
+  * Update JS deps (#36091)
+  * update golangci-lint to v2.7.0 (#36079)
+  * Update JS deps, fix deprecations (#36040)
+  * Update JS deps (#35978)
+  * Add toolchain directive to go.mod (#35901)
+  * Move `gitea-vet` to use `go tool` (#35878)
+  * Update to go 1.25.4 (#35877)
+  * Enable TypeScript `strictNullChecks` (#35843)
+  * Enable `vue/require-typed-ref` eslint rule (#35764)
+  * Update JS dependencies (#35759)
+  * Move `codeformat` folder to tools (#35758)
+  * Update dependencies (#35733)
+  * Bump happy-dom from 20.0.0 to 20.0.2 (#35677)
+  * Bump setup-go to v6 (#35660)
+  * Update JS deps, misc tweaks (#35643)
+  * Bump happy-dom from 19.0.2 to 20.0.0 (#35625)
+  * Use bundled version of spectral (#35573)
+  * Update JS and PY deps (#35565)
+  * Bump github.com/wneessen/go-mail from 0.6.2 to 0.7.1 (#35557)
+  * Migrate from webpack to vite (#37002)
+  * Update JS dependencies and misc tweaks (#37064)
+  * Update to eslint 10 (#36925)
+  * Optimize Docker build with dependency layer caching (#36864)
+  * Update JS deps (#36850)
+  * Update tool dependencies and fix new lint issues (#36702)
+  * Remove redundant linter rules (#36658)
+  * Move Fomantic dropdown CSS to custom module (#36530)
+  * Remove and forbid `@ts-expect-error` (#36513)
+  * Refactor git command stderr handling (#36402)
+  * Enable gocheckcompilerdirectives linter (#36156)
+  * Replace `lint-go-gopls` with additional `govet` linters (#36028)
+  * Update golangci-lint to v2.6.0 (#35801)
+  * Misc tool tweaks (#35734)
+  * Add cache to container build (#35697)
+  * Upgrade vite (#37126)
+  * Update `setup-uv` to v8.0.0 (#37101)
+  * Upgrade `go-git` to v5.17.2 and related dependencies (#37060)
+  * Raise minimum Node.js version to 22.18.0 (#37058)
+  * Upgrade `golang.org/x/image` to v0.38.0 (#37054)
+  * Update minimum go version to 1.26.1, golangci-lint to 2.11.2, fix test style (#36876)
+  * Enable eslint concurrency (#36878)
+  * Vendor relative-time-element as local web component (#36853)
+  * Update material-icon-theme v5.32.0 (#36832)
+  * Update Go dependencies (#36781)
+  * Upgrade minimatch (#36760)
+  * Remove i18n backport tool at the moment because of translation format changed (#36643)
+  * Update emoji data for Unicode 16 (#36596)
+  * Update JS dependencies, adjust webpack config, misc fixes (#36431)
+  * Update material-icon-theme to v5.31.0 (#36427)
+  * Update JS and PY deps (#36383)
+  * Bump alpine to 3.23, add platforms to `docker-dryrun` (#36379)
+  * Update JS deps (#36354)
+  * Update goldmark to v1.7.16 (#36343)
+  * Update chroma to v2.22.0 (#36342)
+* DOCS
+  * Update AI Contribution Policy (#37022)
+  * Update AGENTS.md with additional guidelines (#37018)
+  * Add missing cron tasks to example ini (#37012)
+  * Add AI Contribution Policy to CONTRIBUTING.md (#36651)
+  * Minor punctuation improvement in CONTRIBUTING.md (#36291)
+  * Add documentation for markdown anchor post-processing (#36443)
+* MISC
+  * Correct spelling (#36783)
+  * Update Nix flake (#37110)
+  * Update Nix flake (#37024)
+  * Add valid github scopes (#36977)
+  * Update Nix flake (#36943)
+  * Update Nix flake (#36902)
+  * Update Nix flake (#36857)
+  * Update Nix flake (#36787)
+
 ## [1.25.5](https://github.com/go-gitea/gitea/releases/tag/v1.25.5) - 2026-03-10

 * SECURITY
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,5 +1,14 @@
 # Contribution Guidelines

+This document explains how to contribute changes to the Gitea project. Topic-specific guides live in separate files so the essentials are easier to find.
+
+| Topic | Document |
+| :---- | :------- |
+| Backend (Go modules, API v1) | [docs/guideline-backend.md](docs/guideline-backend.md) |
+| Frontend (npm, UI guidelines) | [docs/guideline-frontend.md](docs/guideline-frontend.md) |
+| Maintainers, TOC, labels, merge queue, commit format for mergers | [docs/community-governance.md](docs/community-governance.md) |
+| Release cycle, backports, tagging releases | [docs/release-management.md](docs/release-management.md) |
+
 <details><summary>Table of Contents</summary>

 - [Contribution Guidelines](#contribution-guidelines)
@@ -11,10 +20,6 @@
    - [Discuss your design before the implementation](#discuss-your-design-before-the-implementation)
    - [Issue locking](#issue-locking)
  - [Building Gitea](#building-gitea)
-  - [Dependencies](#dependencies)
-    - [Backend](#backend)
-    - [Frontend](#frontend)
-  - [Design guideline](#design-guideline)
  - [Styleguide](#styleguide)
  - [Copyright](#copyright)
  - [Testing](#testing)
@@ -22,47 +27,19 @@
  - [Code review](#code-review)
    - [Pull request format](#pull-request-format)
    - [PR title and summary](#pr-title-and-summary)
-    - [Milestone](#milestone)
-    - [Labels](#labels)
    - [Breaking PRs](#breaking-prs)
      - [What is a breaking PR?](#what-is-a-breaking-pr)
      - [How to handle breaking PRs?](#how-to-handle-breaking-prs)
    - [Maintaining open PRs](#maintaining-open-prs)
-    - [Getting PRs merged](#getting-prs-merged)
-    - [Final call](#final-call)
-    - [Commit messages](#commit-messages)
-      - [PR Co-authors](#pr-co-authors)
-      - [PRs targeting `main`](#prs-targeting-main)
-      - [Backport PRs](#backport-prs)
+    - [Reviewing PRs](#reviewing-prs)
+      - [For PR authors](#for-pr-authors)
  - [Documentation](#documentation)
-  - [API v1](#api-v1)
-    - [GitHub API compatibility](#github-api-compatibility)
-    - [Adding/Maintaining API routes](#addingmaintaining-api-routes)
-    - [When to use what HTTP method](#when-to-use-what-http-method)
-    - [Requirements for API routes](#requirements-for-api-routes)
-  - [Backports and Frontports](#backports-and-frontports)
-    - [What is backported?](#what-is-backported)
-    - [How to backport?](#how-to-backport)
-    - [Format of backport PRs](#format-of-backport-prs)
-    - [Frontports](#frontports)
  - [Developer Certificate of Origin (DCO)](#developer-certificate-of-origin-dco)
-  - [Release Cycle](#release-cycle)
-  - [Maintainers](#maintainers)
-  - [Technical Oversight Committee (TOC)](#technical-oversight-committee-toc)
-    - [TOC election process](#toc-election-process)
-    - [Current TOC members](#current-toc-members)
-    - [Previous TOC/owners members](#previous-tocowners-members)
-  - [Governance Compensation](#governance-compensation)
-  - [TOC \& Working groups](#toc--working-groups)
-  - [Roadmap](#roadmap)
-  - [Versions](#versions)
-  - [Releasing Gitea](#releasing-gitea)

 </details>

 ## Introduction

-This document explains how to contribute changes to the Gitea project. \
 It assumes you have followed the [installation instructions](https://docs.gitea.com/category/installation). \
 Sensitive security-related issues should be reported to [security@gitea.io](mailto:security@gitea.io).

@@ -131,34 +108,6 @@ If further discussion is needed, we encourage you to open a new issue instead an

 See the [development setup instructions](https://docs.gitea.com/development/hacking-on-gitea).

-## Dependencies
-
-### Backend
-
-Go dependencies are managed using [Go Modules](https://go.dev/cmd/go/#hdr-Module_maintenance). \
-You can find more details in the [go mod documentation](https://go.dev/ref/mod) and the [Go Modules Wiki](https://github.com/golang/go/wiki/Modules).
-
-Pull requests should only modify `go.mod` and `go.sum` where it is related to your change, be it a bugfix or a new feature. \
-Apart from that, these files should only be modified by Pull Requests whose only purpose is to update dependencies.
-
-The `go.mod`, `go.sum` update needs to be justified as part of the PR description,
-and must be verified by the reviewers and/or merger to always reference
-an existing upstream commit.
-
-### Frontend
-
-For the frontend, we use [npm](https://www.npmjs.com/).
-
-The same restrictions apply for frontend dependencies as for backend dependencies, with the exceptions that the files for it are `package.json` and `package-lock.json`, and that new versions must always reference an existing version.
-
-## Design guideline
-
-Depending on your change, please read the
-
- [backend development guideline](https://docs.gitea.com/contributing/guidelines-backend)
- [frontend development guideline](https://docs.gitea.com/contributing/guidelines-frontend)
- [refactoring guideline](https://docs.gitea.com/contributing/guidelines-refactoring)
-
 ## Styleguide

 You should always run `make fmt` before committing to conform to Gitea's styleguide.
@@ -216,6 +165,8 @@ The tool `go run build/backport-locale.go` can be used to backport locales from

 ## Code review

+How labels, milestones, and the merge queue work is documented in [docs/community-governance.md](docs/community-governance.md).
+
 ### Pull request format

 Please try to make your pull request easy to review for us. \
@@ -260,29 +211,6 @@ Fixes/Closes/Resolves #<ISSUE_NR_Y>.
 to your summary. \
 Each issue that will be closed must stand on a separate line.

-### Milestone
-
-A PR should only be assigned to a milestone if it will likely be merged into the given version. \
-As a rule of thumb, assume that a PR will stay open for an additional month for every 100 added lines. \
-PRs without a milestone may not be merged.
-
-### Labels
-
-Almost all labels used inside Gitea can be classified as one of the following:
-
- `modifies/…`: Determines which parts of the codebase are affected. These labels will be set through the CI.
- `topic/…`:  Determines the conceptual component of Gitea that is affected, i.e. issues, projects, or authentication. At best, PRs should only target one component but there might be overlap. Must be set manually.
- `type/…`: Determines the type of an issue or PR (feature, refactoring, docs, bug, …). If GitHub supported scoped labels, these labels would be exclusive, so you should set **exactly** one, not more or less (every PR should fall into one of the provided categories, and only one).
- `issue/…` / `pr/…`: Labels that are specific to issues or PRs respectively and that are only necessary in a given context, i.e. `issue/not-a-bug` or `pr/need-2-approvals`
-
-Every PR should be labeled correctly with every label that applies.
-
-There are also some labels that will be managed automatically.\
-In particular, these are
-
- the amount of pending required approvals
- has all `backport`s or needs a manual backport
-
 ### Breaking PRs

 #### What is a breaking PR?
@@ -311,165 +239,29 @@ Breaking PRs will not be merged as long as not both of these requirements are me

 ### Maintaining open PRs

-The moment you create a non-draft PR or the moment you convert a draft PR to a non-draft PR is the moment code review starts for it. \
-Once that happens, do not rebase or squash your branch anymore as it makes it difficult to review the new changes. \
-Merge the base branch into your branch only when you really need to, i.e. because of conflicting changes in the mean time. \
-This reduces unnecessary CI runs. \
-Don't worry about merge commits messing up your commit history as every PR will be squash merged. \
-This means that all changes are joined into a single new commit whose message is as described below.
+Code review starts when you open a non-draft PR or move a draft out of draft state. After that, do not rebase or squash your branch; it makes new changes harder to review.

-### Getting PRs merged
+Merge the base branch into yours only when you need to, for example because of conflicting changes elsewhere. That limits unnecessary CI runs.

-Changes to Gitea must be reviewed before they are accepted — no matter who
-makes the change, even if they are an owner or a maintainer. \
-The only exception are critical bugs that prevent Gitea from being compiled or started. \
-Specifically, we require two approvals from maintainers for every PR. \
-Once this criteria has been met, your PR receives the `lgtm/done` label. \
-From this point on, your only responsibility is to fix merge conflicts or respond to/implement requests by maintainers. \
-It is the responsibility of the maintainers from this point to get your PR merged.
+Every PR is squash-merged, so merge commits on your branch do not matter for final history. The squash produces a single commit; mergers follow the [commit message format](docs/community-governance.md#commit-messages) in the governance guide.

-If a PR has the `lgtm/done` label and there are no open discussions or merge conflicts anymore, any maintainer can add the `reviewed/wait-merge` label. \
-This label means that the PR is part of the merge queue and will be merged as soon as possible. \
-The merge queue will be cleared in the order of the list below:
+### Reviewing PRs

-<https://github.com/go-gitea/gitea/pulls?q=is%3Apr+label%3Areviewed%2Fwait-merge+sort%3Acreated-asc+is%3Aopen>
+Maintainers are encouraged to review pull requests in areas where they have expertise or particular interest.

-Gitea uses it's own tool, the <https://github.com/GiteaBot/gitea-backporter> to automate parts of the review process. \
-This tool does the things listed below automatically:
+#### For PR authors

- create a backport PR if needed once the initial PR was merged
- remove the PR from the merge queue after the PR merged
- keep the oldest branch in the merge queue up to date with merges
+- **Response**: When answering reviewer questions, use real-world cases or examples and avoid speculation.
+- **Discussion**: A discussion is always welcome and should be used to clarify the changes and the intent of the PR.
+- **Help**: If you need help with the PR or comments are unclear, ask for clarification.

-### Final call
-
-If a PR has been ignored for more than 7 days with no comments or reviews, and the author or any maintainer believes it will not survive a long wait (such as a refactoring PR), they can send "final call" to the TOC by mentioning them in a comment.
-
-After another 7 days, if there is still zero approval, this is considered a polite refusal, and the PR will be closed to avoid wasting further time. Therefore, the "final call" has a cost, and should be used cautiously.
-
-However, if there are no objections from maintainers, the PR can be merged with only one approval from the TOC (not the author).
-
-### Commit messages
-
-Mergers are able and required to rewrite the PR title and summary (the first comment of a PR) so that it can produce an easily understandable commit message if necessary. \
-The final commit message should no longer contain any uncertainty such as `hopefully, <x> won't happen anymore`. Replace uncertainty with certainty.
-
-#### PR Co-authors
-
-A person counts as a PR co-author the moment they (co-)authored a commit that is not simply a `Merge base branch into branch` commit. \
-Mergers are required to remove such "false-positive" co-authors when writing the commit message. \
-The true co-authors must remain in the commit message.
-
-#### PRs targeting `main`
-
-The commit message of PRs targeting `main` is always
-
-```bash
-$PR_TITLE ($PR_INDEX)
-
-$REWRITTEN_PR_SUMMARY
-```
-
-#### Backport PRs
-
-The commit message of backport PRs is always
-
-```bash
-$PR_TITLE ($INITIAL_PR_INDEX) ($BACKPORT_PR_INDEX)
-
-$REWRITTEN_PR_SUMMARY
-```
+Guidance for reviewers, the merge queue, and the squash commit message format is in [docs/community-governance.md](docs/community-governance.md).

 ## Documentation

 If you add a new feature or change an existing aspect of Gitea, the documentation for that feature must be created or updated in another PR at [https://gitea.com/gitea/docs](https://gitea.com/gitea/docs).
 **The docs directory on main repository will be removed at some time. We will have a yaml file to store configuration file's meta data. After that completed, configuration documentation should be in the main repository.**

-## API v1
-
-The API is documented by [swagger](https://gitea.com/api/swagger) and is based on [the GitHub API](https://docs.github.com/en/rest).
-
-### GitHub API compatibility
-
-Gitea's API should use the same endpoints and fields as the GitHub API as far as possible, unless there are good reasons to deviate. \
-If Gitea provides functionality that GitHub does not, a new endpoint can be created. \
-If information is provided by Gitea that is not provided by the GitHub API, a new field can be used that doesn't collide with any GitHub fields. \
-Updating an existing API should not remove existing fields unless there is a really good reason to do so. \
-The same applies to status responses. If you notice a problem, feel free to leave a comment in the code for future refactoring to API v2 (which is currently not planned).
-
-### Adding/Maintaining API routes
-
-All expected results (errors, success, fail messages) must be documented ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L319-L327)). \
-All JSON input types must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L76-L91)) \
-and referenced in [routers/api/v1/swagger/options.go](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/options.go). \
-They can then be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L318). \
-All JSON responses must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L36-L68)) \
-and referenced in its category in [routers/api/v1/swagger/](routers/api/v1/swagger/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/issue.go#L11-L16)) \
-They can be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L277-L279).
-
-### When to use what HTTP method
-
-In general, HTTP methods are chosen as follows:
-
- **GET** endpoints return the requested object(s) and status **OK (200)**
- **DELETE** endpoints return the status **No Content (204)** and no content either
- **POST** endpoints are used to **create** new objects (e.g. a User) and return the status **Created (201)** and the created object
- **PUT** endpoints are used to **add/assign** existing Objects (e.g. a user to a team) and return the status **No Content (204)** and no content either
- **PATCH** endpoints are used to **edit/change** an existing object and return the changed object and the status **OK (200)**
-
-### Requirements for API routes
-
-All parameters of endpoints changing/editing an object must be optional (except the ones to identify the object, which are required).
-
-Endpoints returning lists must
-
- support pagination (`page` & `limit` options in query)
- set `X-Total-Count` header via **SetTotalCountHeader** ([example](https://github.com/go-gitea/gitea/blob/7aae98cc5d4113f1e9918b7ee7dd09f67c189e3e/routers/api/v1/repo/issue.go#L444))
-
-## Backports and Frontports
-
-### What is backported?
-
-We backport PRs given the following circumstances:
-
-1. Feature freeze is active, but `<version>-rc0` has not been released yet. Here, we backport as much as possible. <!-- TODO: Is that our definition with the new backport bot? -->
-2. `rc0` has been released. Here, we only backport bug- and security-fixes, and small enhancements. Large PRs such as refactors are not backported anymore. <!-- TODO: Is that our definition with the new backport bot? -->
-3. We never backport new features.
-4. We never backport breaking changes except when
-    1. The breaking change has no effect on the vast majority of users
-    2. The component triggering the breaking change is marked as experimental
-
-### How to backport?
-
-In the past, it was necessary to manually backport your PRs. \
-Now, that's not a requirement anymore as our [backport bot](https://github.com/GiteaBot) tries to create backports automatically once the PR is merged when the PR
-
- does not have the label `backport/manual`
- has the label `backport/<version>`
-
-The `backport/manual` label signifies either that you want to backport the change yourself, or that there were conflicts when backporting, thus you **must** do it yourself.
-
-### Format of backport PRs
-
-The title of backport PRs should be
-
-```
-<original PR title> (#<original pr number>)
-```
-
-The first two lines of the summary of the backporting PR should be
-
-```
-Backport #<original pr number>
-
-```
-
-with the rest of the summary and labels matching the original PR.
-
-### Frontports
-
-Frontports behave exactly as described above for backports.
-
 ## Developer Certificate of Origin (DCO)

 We consider the act of contributing to the code by submitting a Pull Request as the "Sign off" or agreement to the certifications and terms of the [DCO](DCO) and [MIT license](LICENSE). \
@@ -483,148 +275,3 @@ Signed-off-by: Joe Smith <joe.smith@email.com>
 If you set the `user.name` and `user.email` Git config options, you can add the line to the end of your commits automatically with `git commit -s`.

 We assume in good faith that the information you provide is legally binding.
-
-## Release Cycle
-
-We adopted a release schedule to streamline the process of working on, finishing, and issuing releases. \
-The overall goal is to make a major release every three or four months, which breaks down into two or three months of general development followed by one month of testing and polishing known as the release freeze. \
-All the feature pull requests should be
-merged before feature freeze. All feature pull requests haven't been merged before this feature freeze will be moved to next milestone, please notice our feature freeze announcement on discord. And, during the frozen period, a corresponding
-release branch is open for fixes backported from main branch. Release candidates
-are made during this period for user testing to
-obtain a final version that is maintained in this branch.
-
-During a development cycle, we may also publish any necessary minor releases
-for the previous version. For example, if the latest, published release is
-v1.2, then minor changes for the previous release—e.g., v1.1.0 -> v1.1.1—are
-still possible.
-
-## Maintainers
-
-To make sure every PR is checked, we have [maintainers](MAINTAINERS). \
-Every PR **must** be reviewed by at least two maintainers (or owners) before it can get merged. \
-For refactoring PRs after a week and documentation only PRs, the approval of only one maintainer is enough. \
-A maintainer should be a contributor of Gitea and contributed at least
-4 accepted PRs. A contributor should apply as a maintainer in the
-[Discord](https://discord.gg/Gitea) `#develop` channel. The team maintainers may invite the contributor. A maintainer
-should spend some time on code reviews. If a maintainer has no
-time to do that, they should apply to leave the maintainers team
-and we will give them the honor of being a member of the [advisors
-team](https://github.com/orgs/go-gitea/teams/advisors). Of course, if
-an advisor has time to code review, we will gladly welcome them back
-to the maintainers team. If a maintainer is inactive for more than 3
-months and forgets to leave the maintainers team, the owners may move
-him or her from the maintainers team to the advisors team.
-For security reasons, Maintainers should use 2FA for their accounts and
-if possible provide GPG signed commits.
-https://help.github.com/articles/securing-your-account-with-two-factor-authentication-2fa/
-https://help.github.com/articles/signing-commits-with-gpg/
-
-Furthermore, any account with write access (like bots and TOC members) **must** use 2FA.
-https://help.github.com/articles/securing-your-account-with-two-factor-authentication-2fa/
-
-## Technical Oversight Committee (TOC)
-
-At the start of 2023, the `Owners` team was dissolved. Instead, the governance charter proposed a technical oversight committee (TOC) which expands the ownership team of the Gitea project from three elected positions to six positions. Three positions are elected as it has been over the past years, and the other three consist of appointed members from the Gitea company.
-https://blog.gitea.com/quarterly-23q1/
-
-### TOC election process
-
-Any maintainer is eligible to be part of the community TOC if they are not associated with the Gitea company.
-A maintainer can either nominate themselves, or can be nominated by other maintainers to be a candidate for the TOC election.
-If you are nominated by someone else, you must first accept your nomination before the vote starts to be a candidate.
-
-The TOC is elected for one year, the TOC election happens yearly.
-After the announcement of the results of the TOC election, elected members have two weeks time to confirm or refuse the seat.
-If an elected member does not answer within this timeframe, they are automatically assumed to refuse the seat.
-Refusals result in the person with the next highest vote getting the same choice.
-As long as seats are empty in the TOC, members of the previous TOC can fill them until an elected member accepts the seat.
-
-If an elected member that accepts the seat does not have 2FA configured yet, they will be temporarily counted as `answer pending` until they manage to configure 2FA, thus leaving their seat empty for this duration.
-
-### Current TOC members
-
- 2024-01-01 ~ 2024-12-31
-  - Company
-    - [Jason Song](https://gitea.com/wolfogre) <i@wolfogre.com>
-    - [Lunny Xiao](https://gitea.com/lunny) <xiaolunwen@gmail.com>
-    - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.com>
-  - Community
-    - [6543](https://gitea.com/6543) <6543@obermui.de>
-    - [delvh](https://gitea.com/delvh) <dev.lh@web.de>
-    - [John Olheiser](https://gitea.com/jolheiser) <john.olheiser@gmail.com>
-
-### Previous TOC/owners members
-
-Here's the history of the owners and the time they served:
-
- [Lunny Xiao](https://gitea.com/lunny) - 2016, 2017, [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
- [Kim Carlbäcker](https://github.com/bkcsoft) - 2016, 2017
- [Thomas Boerger](https://gitea.com/tboerger) - 2016, 2017
- [Lauris Bukšis-Haberkorns](https://gitea.com/lafriks) - [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801)
- [Matti Ranta](https://gitea.com/techknowlogick) - [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
- [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
- [6543](https://gitea.com/6543) - 2023
- [John Olheiser](https://gitea.com/jolheiser) - 2023
- [Jason Song](https://gitea.com/wolfogre) - 2023
-
-## Governance Compensation
-
-Each member of the community elected TOC will be granted $500 each month as compensation for their work.
-
-Furthermore, any community release manager for a specific release or LTS will be compensated $500 for the delivery of said release.
-
-These funds will come from community sources like the OpenCollective rather than directly from the company.
-Only non-company members are eligible for this compensation, and if a member of the community TOC takes the responsibility of release manager, they would only be compensated for their TOC duties.
-Gitea Ltd employees are not eligible to receive any funds from the OpenCollective unless it is reimbursement for a purchase made for the Gitea project itself.
-
-## TOC & Working groups
-
-With Gitea covering many projects outside of the main repository, several groups will be created to help focus on specific areas instead of requiring maintainers to be a jack-of-all-trades. Maintainers are of course more than welcome to be part of multiple groups should they wish to contribute in multiple places.
-
-The currently proposed groups are:
-
- **Core Group**: maintain the primary Gitea repository
- **Integration Group**: maintain the Gitea ecosystem's related tools, including go-sdk/tea/changelog/bots etc.
- **Documentation Group**: maintain related documents and repositories
- **Translation Group**: coordinate with translators and maintain translations
- **Security Group**: managed by TOC directly, members are decided by TOC, maintains security patches/responsible for security items
-
-## Roadmap
-
-Each year a roadmap will be discussed with the entire Gitea maintainers team, and feedback will be solicited from various stakeholders.
-TOC members need to review the roadmap every year and work together on the direction of the project.
-
-When a vote is required for a proposal or other change, the vote of community elected TOC members count slightly more than the vote of company elected TOC members. With this approach, we both avoid ties and ensure that changes align with the mission statement and community opinion.
-
-You can visit our roadmap on the wiki.
-
-## Versions
-
-Gitea has the `main` branch as a tip branch and has version branches
-such as `release/v1.19`. `release/v1.19` is a release branch and we will
-tag `v1.19.0` for binary download. If `v1.19.0` has bugs, we will accept
-pull requests on the `release/v1.19` branch and publish a `v1.19.1` tag,
-after bringing the bug fix also to the main branch.
-
-Since the `main` branch is a tip version, if you wish to use Gitea
-in production, please download the latest release tag version. All the
-branches will be protected via GitHub, all the PRs to every branch must
-be reviewed by two maintainers and must pass the automatic tests.
-
-## Releasing Gitea
-
- Let $vmaj, $vmin and $vpat be Major, Minor and Patch version numbers, $vpat should be rc1, rc2, 0, 1, ...... $vmaj.$vmin will be kept the same as milestones on github or gitea in future.
- Before releasing, confirm all the version's milestone issues or PRs has been resolved. Then discuss the release on Discord channel #maintainers and get agreed with almost all the owners and mergers. Or you can declare the version and if nobody is against it in about several hours.
- If this is a big version first you have to create PR for changelog on branch `main` with PRs with label `changelog` and after it has been merged do following steps:
-  - Create `-dev` tag as `git tag -s -F release.notes v$vmaj.$vmin.0-dev` and push the tag as `git push origin v$vmaj.$vmin.0-dev`.
-  - When CI has finished building tag then you have to create a new branch named `release/v$vmaj.$vmin`
- If it is bugfix version create PR for changelog on branch `release/v$vmaj.$vmin` and wait till it is reviewed and merged.
- Add a tag as `git tag -s -F release.notes v$vmaj.$vmin.$`, release.notes file could be a temporary file to only include the changelog this version which you added to `CHANGELOG.md`.
- And then push the tag as `git push origin v$vmaj.$vmin.$`. Drone CI will automatically create a release and upload all the compiled binary. (But currently it doesn't add the release notes automatically. Maybe we should fix that.)
- If needed send a frontport PR for the changelog to branch `main` and update the version in `docs/config.yaml` to refer to the new version.
- Send PR to [blog repository](https://gitea.com/gitea/blog) announcing the release.
- Verify all release assets were correctly published through CI on dl.gitea.com and GitHub releases. Once ACKed:
-  - bump the version of https://dl.gitea.com/gitea/version.json
-  - merge the blog post PR
-  - announce the release in discord `#announcements`
--- a/build/generate-go-licenses.go
+++ b/build/generate-go-licenses.go
@@ -19,6 +19,7 @@ import (

 // regexp is based on go-license, excluding README and NOTICE
 // https://github.com/google/go-licenses/blob/master/licenses/find.go
+// also defined in vite.config.ts
 var licenseRe = regexp.MustCompile(`^(?i)((UN)?LICEN(S|C)E|COPYING).*$`)

 // primaryLicenseRe matches exact primary license filenames without suffixes.
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -41,10 +41,10 @@
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
 ;; App name that shows in every page title
-APP_NAME = ; Gitea: Git with a cup of tea
+;APP_NAME = Gitea: Git with a cup of tea
 ;;
 ;; RUN_USER will automatically detect the current user - but you can set it here change it if you run locally
-RUN_USER = ; git
+;RUN_USER =
 ;;
 ;; Application run mode, affects performance and debugging: "dev" or "prod", default is "prod"
 ;; Mode "dev" makes Gitea easier to develop and debug, values other than "dev" are treated as "prod" which is for production use.
@@ -461,6 +461,11 @@ INTERNAL_TOKEN =
 ;; Name of cookie used to store authentication information.
 ;COOKIE_REMEMBER_NAME = gitea_incredible
 ;;
+;; URL or path that Gitea should redirect users to *after* performing its own logout.
+;; Use this, if needed, when authentication is handled by a reverse proxy or SSO.
+;; For example: "/my-sso/logout?return=/my-sso/home"
+;REVERSE_PROXY_LOGOUT_REDIRECT =
+;;
 ;; Reverse proxy authentication header name of user name, email, and full name
 ;REVERSE_PROXY_AUTHENTICATION_USER = X-WEBAUTH-USER
 ;REVERSE_PROXY_AUTHENTICATION_EMAIL = X-WEBAUTH-EMAIL
--- a/docs/community-governance.md
+++ b/docs/community-governance.md
@@ -0,0 +1,198 @@
+# Community governance and review process
+
+This document describes maintainer expectations, project governance, and the detailed pull request review workflow (labels, merge queue, commit message format for mergers). For what contributors should do when opening and updating a PR, see [CONTRIBUTING.md](../CONTRIBUTING.md).
+
+## Code review
+
+### Milestone
+
+A PR should only be assigned to a milestone if it will likely be merged into the given version. \
+PRs without a milestone may not be merged.
+
+### Labels
+
+Almost all labels used inside Gitea can be classified as one of the following:
+
+- `modifies/…`: Determines which parts of the codebase are affected. These labels will be set through the CI.
+- `topic/…`:  Determines the conceptual component of Gitea that is affected, i.e. issues, projects, or authentication. At best, PRs should only target one component but there might be overlap. Must be set manually.
+- `type/…`: Determines the type of an issue or PR (feature, refactoring, docs, bug, …). If GitHub supported scoped labels, these labels would be exclusive, so you should set **exactly** one, not more or less (every PR should fall into one of the provided categories, and only one).
+- `issue/…` / `lgtm/…`: Labels that are specific to issues or PRs respectively and that are only necessary in a given context, i.e. `issue/not-a-bug` or `lgtm/need 2`
+
+Every PR should be labeled correctly with every label that applies.
+
+There are also some labels that will be managed automatically.\
+In particular, these are
+
+- the amount of pending required approvals
+- has all `backport`s or needs a manual backport
+
+### Reviewing PRs
+
+Maintainers are encouraged to review pull requests in areas where they have expertise or particular interest.
+
+#### For reviewers
+
+- **Verification**: Verify that the PR accurately reflects the changes, and verify that the tests and documentation are complete and aligned with the implementation.
+- **Actionable feedback**: Say what should change and why, and distinguish required changes from optional suggestions.
+- **Feedback**: Focus feedback on the issue itself and avoid comments about the contributor's abilities.
+- **Request changes**: If you request changes (i.e., block a PR), give a clear rationale and, whenever possible, a concrete path to resolution.
+- **Approval**: Only approve a PR when you are fully satisfied with its current state - "rubber-stamp" approvals need to be highlighted as such.
+
+### Getting PRs merged
+
+Changes to Gitea must be reviewed before they are accepted, including changes from owners and maintainers. The exception is critical bugs that prevent Gitea from compiling or starting.
+
+We require two maintainer approvals for every PR. When that is satisfied, your PR gets the `lgtm/done` label. After that, you mainly fix merge conflicts and respond to or implement maintainer requests; maintainers drive getting the PR merged.
+
+If a PR has `lgtm/done`, no open discussions, and no merge conflicts, any maintainer may add `reviewed/wait-merge`. That puts the PR in the merge queue. PRs are merged from the queue in the order of this list:
+
+<https://github.com/go-gitea/gitea/pulls?q=is%3Apr+label%3Areviewed%2Fwait-merge+sort%3Acreated-asc+is%3Aopen>
+
+Gitea uses its own tool, <https://github.com/GiteaBot/gitea-backporter>, to automate parts of the review process. The backporter:
+
+- Creates a backport PR when needed after the initial PR merges.
+- Removes the PR from the merge queue after it merges.
+- Keeps the oldest branch in the merge queue up to date with merges.
+
+### Final call
+
+If a PR has been ignored for more than 7 days with no comments or reviews, and the author or any maintainer believes it will not survive a long wait (such as a refactoring PR), they can send "final call" to the TOC by mentioning them in a comment.
+
+After another 7 days, if there is still zero approval, this is considered a polite refusal, and the PR will be closed to avoid wasting further time. Therefore, the "final call" has a cost, and should be used cautiously.
+
+However, if there are no objections from maintainers, the PR can be merged with only one approval from the TOC (not the author).
+
+### Commit messages
+
+Mergers are required to rewrite the PR title and the first comment (the summary) when necessary so the squash commit message is clear.
+
+The final commit message should not hedge: replace phrases like `hopefully, <x> won't happen anymore` with definite wording.
+
+#### PR Co-authors
+
+A person counts as a PR co-author once they (co-)authored a commit that is not simply a `Merge base branch into branch` commit. Mergers must remove such false-positive co-authors when writing the squash message. Every true co-author must remain in the commit message.
+
+#### PRs targeting `main`
+
+The commit message of PRs targeting `main` is always
+
+```bash
+$PR_TITLE ($PR_INDEX)
+
+$REWRITTEN_PR_SUMMARY
+```
+
+#### Backport PRs
+
+The commit message of backport PRs is always
+
+```bash
+$PR_TITLE ($INITIAL_PR_INDEX) ($BACKPORT_PR_INDEX)
+
+$REWRITTEN_PR_SUMMARY
+```
+
+## Maintainers
+
+We list [maintainers](../MAINTAINERS) so every PR gets proper review.
+
+#### Review expectations
+
+Every PR **must** be reviewed by at least two maintainers (or owners) before merge. **Exception:** after one week, refactoring PRs and documentation-only PRs need only one maintainer approval.
+
+Maintainers are expected to spend time on code reviews.
+
+#### Becoming a maintainer
+
+A maintainer should already be a Gitea contributor with at least four merged PRs. To apply, use the [Discord](https://discord.gg/Gitea) `#develop` channel. Maintainer teams may also invite contributors.
+
+#### Stepping down, advisors, and inactivity
+
+If you cannot keep reviewing, apply to leave the maintainers team. You can join the [advisors team](https://github.com/orgs/go-gitea/teams/advisors); advisors who want to review again are welcome back as maintainers.
+
+If a maintainer is inactive for more than three months and has not left the team, owners may move them to the advisors team.
+
+#### Account security
+
+For security, maintainers should enable 2FA and sign commits with GPG when possible:
+
+- [Two-factor authentication](https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication)
+- [Signing commits with GPG](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits)
+
+Any account with write access (including bots and TOC members) **must** use [2FA](https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication).
+
+## Technical Oversight Committee (TOC)
+
+At the start of 2023, the `Owners` team was dissolved. Instead, the governance charter proposed a technical oversight committee (TOC) which expands the ownership team of the Gitea project from three elected positions to six positions. Three positions are elected as it has been over the past years, and the other three consist of appointed members from the Gitea company.
+https://blog.gitea.com/quarterly-23q1/
+
+### TOC election process
+
+Any maintainer is eligible to be part of the community TOC if they are not associated with the Gitea company.
+A maintainer can either nominate themselves, or can be nominated by other maintainers to be a candidate for the TOC election.
+If you are nominated by someone else, you must first accept your nomination before the vote starts to be a candidate.
+
+The TOC is elected for one year, the TOC election happens yearly.
+After the announcement of the results of the TOC election, elected members have two weeks time to confirm or refuse the seat.
+If an elected member does not answer within this timeframe, they are automatically assumed to refuse the seat.
+Refusals result in the person with the next highest vote getting the same choice.
+As long as seats are empty in the TOC, members of the previous TOC can fill them until an elected member accepts the seat.
+
+If an elected member that accepts the seat does not have 2FA configured yet, they will be temporarily counted as `answer pending` until they manage to configure 2FA, thus leaving their seat empty for this duration.
+
+### Current TOC members
+
+- 2024-01-01 ~ 2024-12-31
+  - Company
+    - [Jason Song](https://gitea.com/wolfogre) <i@wolfogre.com>
+    - [Lunny Xiao](https://gitea.com/lunny) <xiaolunwen@gmail.com>
+    - [Matti Ranta](https://gitea.com/techknowlogick) <techknowlogick@gitea.com>
+  - Community
+    - [6543](https://gitea.com/6543) <6543@obermui.de>
+    - [delvh](https://gitea.com/delvh) <dev.lh@web.de>
+    - [John Olheiser](https://gitea.com/jolheiser) <john.olheiser@gmail.com>
+
+### Previous TOC/owners members
+
+Here's the history of the owners and the time they served:
+
+- [Lunny Xiao](https://gitea.com/lunny) - 2016, 2017, [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
+- [Kim Carlbäcker](https://github.com/bkcsoft) - 2016, 2017
+- [Thomas Boerger](https://gitea.com/tboerger) - 2016, 2017
+- [Lauris Bukšis-Haberkorns](https://gitea.com/lafriks) - [2018](https://github.com/go-gitea/gitea/issues/3255), [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801)
+- [Matti Ranta](https://gitea.com/techknowlogick) - [2019](https://github.com/go-gitea/gitea/issues/5572), [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
+- [Andrew Thornton](https://gitea.com/zeripath) - [2020](https://github.com/go-gitea/gitea/issues/9230), [2021](https://github.com/go-gitea/gitea/issues/13801), [2022](https://github.com/go-gitea/gitea/issues/17872), 2023
+- [6543](https://gitea.com/6543) - 2023
+- [John Olheiser](https://gitea.com/jolheiser) - 2023
+- [Jason Song](https://gitea.com/wolfogre) - 2023
+
+## Governance Compensation
+
+Each member of the community elected TOC will be granted $500 each month as compensation for their work.
+
+Furthermore, any community release manager for a specific release or LTS will be compensated $500 for the delivery of said release.
+
+These funds will come from community sources like the OpenCollective rather than directly from the company.
+Only non-company members are eligible for this compensation, and if a member of the community TOC takes the responsibility of release manager, they would only be compensated for their TOC duties.
+Gitea Ltd employees are not eligible to receive any funds from the OpenCollective unless it is reimbursement for a purchase made for the Gitea project itself.
+
+## TOC & Working groups
+
+With Gitea covering many projects outside of the main repository, several groups will be created to help focus on specific areas instead of requiring maintainers to be a jack-of-all-trades. Maintainers are of course more than welcome to be part of multiple groups should they wish to contribute in multiple places.
+
+The currently proposed groups are:
+
+- **Core Group**: maintain the primary Gitea repository
+- **Integration Group**: maintain the Gitea ecosystem's related tools, including go-sdk/tea/changelog/bots etc.
+- **Documentation Group**: maintain related documents and repositories
+- **Translation Group**: coordinate with translators and maintain translations
+- **Security Group**: managed by TOC directly, members are decided by TOC, maintains security patches/responsible for security items
+
+## Roadmap
+
+Each year a roadmap will be discussed with the entire Gitea maintainers team, and feedback will be solicited from various stakeholders.
+TOC members need to review the roadmap every year and work together on the direction of the project.
+
+When a vote is required for a proposal or other change, the vote of community elected TOC members count slightly more than the vote of company elected TOC members. With this approach, we both avoid ties and ensure that changes align with the mission statement and community opinion.
+
+You can visit our roadmap on the wiki.
--- a/docs/guideline-backend.md
+++ b/docs/guideline-backend.md
@@ -0,0 +1,58 @@
+# Backend development
+
+This document covers backend-specific contribution expectations. For general contribution workflow, see [CONTRIBUTING.md](../CONTRIBUTING.md).
+
+For coding style and architecture, see also the [backend development guideline](https://docs.gitea.com/contributing/guidelines-backend) on the documentation site.
+
+## Dependencies
+
+Go dependencies are managed using [Go Modules](https://go.dev/cmd/go/#hdr-Module_maintenance). \
+You can find more details in the [go mod documentation](https://go.dev/ref/mod) and the [Go Modules Wiki](https://github.com/golang/go/wiki/Modules).
+
+Pull requests should only modify `go.mod` and `go.sum` where it is related to your change, be it a bugfix or a new feature. \
+Apart from that, these files should only be modified by Pull Requests whose only purpose is to update dependencies.
+
+The `go.mod`, `go.sum` update needs to be justified as part of the PR description,
+and must be verified by the reviewers and/or merger to always reference
+an existing upstream commit.
+
+## API v1
+
+The API is documented by [swagger](https://gitea.com/api/swagger) and is based on [the GitHub API](https://docs.github.com/en/rest).
+
+### GitHub API compatibility
+
+Gitea's API should use the same endpoints and fields as the GitHub API as far as possible, unless there are good reasons to deviate. \
+If Gitea provides functionality that GitHub does not, a new endpoint can be created. \
+If information is provided by Gitea that is not provided by the GitHub API, a new field can be used that doesn't collide with any GitHub fields. \
+Updating an existing API should not remove existing fields unless there is a really good reason to do so. \
+The same applies to status responses. If you notice a problem, feel free to leave a comment in the code for future refactoring to API v2 (which is currently not planned).
+
+### Adding/Maintaining API routes
+
+All expected results (errors, success, fail messages) must be documented ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L319-L327)). \
+All JSON input types must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L76-L91)) \
+and referenced in [routers/api/v1/swagger/options.go](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/options.go). \
+They can then be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L318). \
+All JSON responses must be defined as a struct in [modules/structs/](modules/structs/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/modules/structs/issue.go#L36-L68)) \
+and referenced in its category in [routers/api/v1/swagger/](routers/api/v1/swagger/) ([example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/swagger/issue.go#L11-L16)) \
+They can be used like [this example](https://github.com/go-gitea/gitea/blob/c620eb5b2d0d874da68ebd734d3864c5224f71f7/routers/api/v1/repo/issue.go#L277-L279).
+
+### When to use what HTTP method
+
+In general, HTTP methods are chosen as follows:
+
+- **GET** endpoints return the requested object(s) and status **OK (200)**
+- **DELETE** endpoints return the status **No Content (204)** and no content either
+- **POST** endpoints are used to **create** new objects (e.g. a User) and return the status **Created (201)** and the created object
+- **PUT** endpoints are used to **add/assign** existing Objects (e.g. a user to a team) and return the status **No Content (204)** and no content either
+- **PATCH** endpoints are used to **edit/change** an existing object and return the changed object and the status **OK (200)**
+
+### Requirements for API routes
+
+All parameters of endpoints changing/editing an object must be optional (except the ones to identify the object, which are required).
+
+Endpoints returning lists must
+
+- support pagination (`page` & `limit` options in query)
+- set `X-Total-Count` header via **SetTotalCountHeader** ([example](https://github.com/go-gitea/gitea/blob/7aae98cc5d4113f1e9918b7ee7dd09f67c189e3e/routers/api/v1/repo/issue.go#L444))
--- a/docs/guideline-frontend.md
+++ b/docs/guideline-frontend.md
@@ -0,0 +1,17 @@
+# Frontend development
+
+This document covers frontend-specific contribution expectations. For general contribution workflow, see [CONTRIBUTING.md](../CONTRIBUTING.md).
+
+## Dependencies
+
+For the frontend, we use [npm](https://www.npmjs.com/).
+
+The same restrictions apply for frontend dependencies as for [backend dependencies](guideline-backend.md#dependencies), with the exceptions that the files for it are `package.json` and `package-lock.json`, and that new versions must always reference an existing version.
+
+## Design guideline
+
+Depending on your change, please read the
+
+- [backend development guideline](https://docs.gitea.com/contributing/guidelines-backend)
+- [frontend development guideline](https://docs.gitea.com/contributing/guidelines-frontend)
+- [refactoring guideline](https://docs.gitea.com/contributing/guidelines-refactoring)
--- a/docs/release-management.md
+++ b/docs/release-management.md
@@ -0,0 +1,115 @@
+# Release management
+
+This document describes the release cycle, backports, versioning, and the release manager checklist. For everyday contribution workflow, see [CONTRIBUTING.md](../CONTRIBUTING.md).
+
+## Backports and Frontports
+
+### What is backported?
+
+We backport PRs given the following circumstances:
+
+1. Feature freeze is active, but `<version>-rc0` has not been released yet. Here, we backport as much as possible. <!-- TODO: Is that our definition with the new backport bot? -->
+2. `rc0` has been released. Here, we only backport bug- and security-fixes, and small enhancements. Large PRs such as refactors are not backported anymore. <!-- TODO: Is that our definition with the new backport bot? -->
+3. We never backport new features.
+4. We never backport breaking changes except when
+    1. The breaking change has no effect on the vast majority of users
+    2. The component triggering the breaking change is marked as experimental
+
+### How to backport?
+
+In the past, it was necessary to manually backport your PRs. \
+Now, that's not a requirement anymore as our [backport bot](https://github.com/GiteaBot) tries to create backports automatically once the PR is merged when the PR
+
+- does not have the label `backport/manual`
+- has the label `backport/<version>`
+
+The `backport/manual` label signifies either that you want to backport the change yourself, or that there were conflicts when backporting, thus you **must** do it yourself.
+
+### Format of backport PRs
+
+The title of backport PRs should be
+
+```
+<original PR title> (#<original pr number>)
+```
+
+The first two lines of the summary of the backporting PR should be
+
+```
+Backport #<original pr number>
+
+```
+
+with the rest of the summary and labels matching the original PR.
+
+### Frontports
+
+Frontports behave exactly as described above for backports.
+
+## Release Cycle
+
+We use a release schedule so work, stabilization, and releases stay predictable.
+
+### Cadence
+
+- Aim for a major release about every three or four months.
+- Roughly two or three months of general development, then about one month of testing and polish called the **release freeze**.
+- *Starting with v1.26 the release cycle will be more predictable and follow a more regular schedule.*
+
+### Release schedule
+
+We will try to publish a new major version every three months:
+
+- v1.26.0 in April 2026
+- v1.27.0 in June 2026
+- v1.28.0 in September 2026
+- v1.29.0 in December 2026
+
+#### How is the release handled?
+- The release manager will tag the release candidate (e.g. `v1.26.0-rc0`) and publish it for testing in the **first week of the release month**.
+- If there are no major issues, the release manager will check with the other maintainers and then tag the final release (e.g. `v1.26.0`) in the **one or two weeks following the release candidate**.
+
+### Feature freeze
+
+- Merge feature PRs before the freeze when you can.
+- Feature PRs still open at the freeze move to the next milestone. Watch Discord for the freeze announcement.
+- During the freeze, a **release branch** takes fixes backported from `main`. Release candidates ship for testing; the final release for that line is maintained from that branch.
+
+### Patch releases
+
+During a cycle we may ship patch releases for an older line. For example, if the latest release is v1.2, we can still publish v1.1.1 after v1.1.0.
+
+### End of life (EOL)
+
+We support per standard the last major release. For example, if the latest release is v1.26, we support v1.26 and v1.25, but not v1.24 anymore. We will only publish security fixes for the last major release, so if you are using an older release, please upgrade to a supported release as soon as possible.
+Also we always try to support the latest on main branch, so if you are using the latest on main, you should be fine.
+
+## Versions
+
+Gitea has the `main` branch as a tip branch and has version branches
+such as `release/v1.19`. `release/v1.19` is a release branch and we will
+tag `v1.19.0` for binary download. If `v1.19.0` has bugs, we will accept
+pull requests on the `release/v1.19` branch and publish a `v1.19.1` tag,
+after bringing the bug fix also to the main branch.
+
+Since the `main` branch is a tip version, if you wish to use Gitea
+in production, please download the latest release tag version. All the
+branches will be protected via GitHub, all the PRs to every branch must
+be reviewed by two maintainers and must pass the automatic tests.
+
+## Releasing Gitea
+
+- Let MAJOR, MINOR and PATCH be Major, Minor and Patch version numbers, PATCH should be rc1, rc2, 0, 1, ...... MAJOR.MINOR will be kept the same as milestones on github or gitea in future.
+- Before releasing, confirm all the version's milestone issues or PRs has been resolved. Then discuss the release on Discord channel #maintainers and get agreed with almost all the owners and mergers. Or you can declare the version and if nobody is against it in about several hours.
+- If this is a big version first you have to create PR for changelog on branch `main` with PRs with label `changelog` and after it has been merged do following steps:
+  - Create `-dev` tag as `git tag -s -F release.notes vMAJOR.MINOR.0-dev` and push the tag as `git push origin vMAJOR.MINOR.0-dev`.
+  - When CI has finished building tag then you have to create a new branch named `release/vMAJOR.MINOR`
+- If it is bugfix version create PR for changelog on branch `release/vMAJOR.MINOR` and wait till it is reviewed and merged.
+- Add a tag as `git tag -s -F release.notes vMAJOR.MINOR.PATCH`, release.notes file could be a temporary file to only include the changelog this version which you added to `CHANGELOG.md`.
+- And then push the tag as `git push origin vMAJOR.MINOR.$`. CI will automatically create a release and upload all the compiled binary. (But currently it doesn't add the release notes automatically. Maybe we should fix that.)
+- If needed send a frontport PR for the changelog to branch `main` and update the version in `docs/config.yaml` to refer to the new version.
+- Send PR to [blog repository](https://gitea.com/gitea/blog) announcing the release.
+- Verify all release assets were correctly published through CI on dl.gitea.com and GitHub releases. Once ACKed:
+  - bump the version of https://dl.gitea.com/gitea/version.json
+  - merge the blog post PR
+  - announce the release in discord `#announcements`
--- a/eslint.config.ts
+++ b/eslint.config.ts
@@ -575,7 +575,6 @@ export default defineConfig([
      'no-restricted-imports': [2, {paths: [
        {name: 'jquery', message: 'Use the global $ instead', allowTypeImports: true},
        {name: 'htmx.org', message: 'Use the global htmx instead', allowTypeImports: true},
-        {name: 'idiomorph/htmx', message: 'Loaded in globals.ts', allowTypeImports: true},
      ]}],
      'no-restricted-syntax': [2, 'WithStatement', 'ForInStatement', 'LabeledStatement', 'SequenceExpression'],
      'no-return-assign': [0],
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
  "nodes": {
    "nixpkgs": {
      "locked": {
-        "lastModified": 1775036866,
-        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
+        "lastModified": 1775710090,
+        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
+        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
        "type": "github"
      },
      "original": {
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module code.gitea.io/gitea

-go 1.26.1
+go 1.26.2

 // rfc5280 said: "The serial number is an integer assigned by the CA to each certificate."
 // But some CAs use negative serial number, just relax the check. related:
@@ -27,7 +27,7 @@ require (
 	github.com/PuerkitoBio/goquery v1.12.0
 	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.0
 	github.com/alecthomas/chroma/v2 v2.23.1
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.13
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.14
 	github.com/aws/aws-sdk-go-v2/service/codecommit v1.33.12
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
 	github.com/blevesearch/bleve/v2 v2.5.7
@@ -49,21 +49,21 @@ require (
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/go-chi/cors v1.2.2
-	github.com/go-co-op/gocron/v2 v2.19.1
-	github.com/go-enry/go-enry/v2 v2.9.5
+	github.com/go-co-op/gocron/v2 v2.20.0
+	github.com/go-enry/go-enry/v2 v2.9.6
 	github.com/go-git/go-billy/v5 v5.8.0
 	github.com/go-git/go-git/v5 v5.17.2
 	github.com/go-ldap/ldap/v3 v3.4.13
 	github.com/go-redsync/redsync/v4 v4.16.0
 	github.com/go-sql-driver/mysql v1.9.3
-	github.com/go-webauthn/webauthn v0.16.1
+	github.com/go-webauthn/webauthn v0.16.4
 	github.com/goccy/go-json v0.10.6
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/go-github/v84 v84.0.0
 	github.com/google/licenseclassifier/v2 v2.0.0
-	github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc
+	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/feeds v1.2.0
 	github.com/gorilla/sessions v1.4.0
@@ -75,15 +75,15 @@ require (
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/klauspost/compress v1.18.5
 	github.com/klauspost/cpuid/v2 v2.3.0
-	github.com/lib/pq v1.12.1
+	github.com/lib/pq v1.12.3
 	github.com/markbates/goth v1.82.0
-	github.com/mattn/go-isatty v0.0.20
-	github.com/mattn/go-sqlite3 v1.14.38
-	github.com/meilisearch/meilisearch-go v0.36.1
+	github.com/mattn/go-isatty v0.0.21
+	github.com/mattn/go-sqlite3 v1.14.42
+	github.com/meilisearch/meilisearch-go v0.36.2
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/microsoft/go-mssqldb v1.9.6
-	github.com/minio/minio-go/v7 v7.0.99
+	github.com/minio/minio-go/v7 v7.0.100
 	github.com/msteinert/pam/v2 v2.1.0
 	github.com/nektos/act v0.2.63
 	github.com/niklasfasching/go-org v1.9.1
@@ -111,14 +111,14 @@ require (
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	gitlab.com/gitlab-org/api/client-go v1.46.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.3
-	golang.org/x/crypto v0.49.0
-	golang.org/x/image v0.38.0
-	golang.org/x/net v0.52.0
+	golang.org/x/crypto v0.50.0
+	golang.org/x/image v0.39.0
+	golang.org/x/net v0.53.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.20.0
-	golang.org/x/sys v0.42.0
-	golang.org/x/text v0.35.0
-	google.golang.org/grpc v1.79.3
+	golang.org/x/sys v0.43.0
+	golang.org/x/text v0.36.0
+	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/ini.v1 v1.67.1
 	gopkg.in/yaml.v3 v3.0.1
@@ -195,7 +195,7 @@ require (
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/go-webauthn/x v0.2.2 // indirect
+	github.com/go-webauthn/x v0.2.3 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
--- a/go.sum
+++ b/go.sum
@@ -96,8 +96,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
 github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.13 h1:mA59E3fokBvyEGHKFdnpNNrvaR351cqiHgRg+JzOSRI=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.13/go.mod h1:yoTXOQKea18nrM69wGF9jBdG4WocSZA1h38A+t/MAsk=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.14 h1:n+UcGWAIZHkXzYt87uMFBv/l8THYELoX6gVcUvgl6fI=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.14/go.mod h1:cJKuyWB59Mqi0jM3nFYQRmnHVQIcgoxjEMAbLkpr62w=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
@@ -290,10 +290,10 @@ github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
 github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
 github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
-github.com/go-co-op/gocron/v2 v2.19.1 h1:B4iLeA0NB/2iO3EKQ7NfKn5KsQgZfjb2fkvoZJU3yBI=
-github.com/go-co-op/gocron/v2 v2.19.1/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
-github.com/go-enry/go-enry/v2 v2.9.5 h1:HPhAQQHYwJgihL2PxBZiUMFWiROsGwOBdB6/D8zCUhY=
-github.com/go-enry/go-enry/v2 v2.9.5/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
+github.com/go-co-op/gocron/v2 v2.20.0 h1:9IMrnnVSWjfSh3E54gWmWCHbloQJLh6f9+nwyKfLNpc=
+github.com/go-co-op/gocron/v2 v2.20.0/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
+github.com/go-enry/go-enry/v2 v2.9.6 h1:np63eOtMV56zfYDHnFVgpEVOk8fr2kmylcMnAZUDbSs=
+github.com/go-enry/go-enry/v2 v2.9.6/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
 github.com/go-enry/go-oniguruma v1.2.1 h1:k8aAMuJfMrqm/56SG2lV9Cfti6tC4x8673aHCcBk+eo=
 github.com/go-enry/go-oniguruma v1.2.1/go.mod h1:bWDhYP+S6xZQgiRL7wlTScFYBe023B6ilRZbCAD5Hf4=
 github.com/go-fed/httpsig v1.1.1-0.20201223112313-55836744818e h1:oRq/fiirun5HqlEWMLIcDmLpIELlG4iGbd0s8iqgPi8=
@@ -327,10 +327,10 @@ github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/go-webauthn/webauthn v0.16.1 h1:x5/SSki5/aIfogaRukqvbg/RXa3Sgxy/9vU7UfFPHKU=
-github.com/go-webauthn/webauthn v0.16.1/go.mod h1:RBS+rtQJMkE5VfMQ4diDA2VNrEL8OeUhp4Srz37FHbQ=
-github.com/go-webauthn/x v0.2.2 h1:zIiipvMbr48CXi5RG0XdBJR94kd8I5LfzHPb/q+YYmk=
-github.com/go-webauthn/x v0.2.2/go.mod h1:IpJ5qyWB9NRhLX3C7gIfjTU7RZLXEP6kzFkoVSE7Fz4=
+github.com/go-webauthn/webauthn v0.16.4 h1:R9jqR/cYZa7hRquFF7Za/8qoH/K/TIs1/Q/4CyGN+1Q=
+github.com/go-webauthn/webauthn v0.16.4/go.mod h1:SU2ljAgToTV/YLPI0C05QS4qn+e04WpB5g1RMfcZfS4=
+github.com/go-webauthn/x v0.2.3 h1:8oArS+Rc1SWFLXhE17KZNx258Z4kUSyaDgsSncCO5RA=
+github.com/go-webauthn/x v0.2.3/go.mod h1:tM04GF3V6VYq79AZMl7vbj4q6pz9r7L2criWRzbWhPk=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
@@ -391,8 +391,8 @@ github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/
 github.com/google/licenseclassifier/v2 v2.0.0 h1:1Y57HHILNf4m0ABuMVb6xk4vAJYEUO0gDxNpog0pyeA=
 github.com/google/licenseclassifier/v2 v2.0.0/go.mod h1:cOjbdH0kyC9R22sdQbYsFkto4NGCAc+ZSwbeThazEtM=
 github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
-github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=
-github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
@@ -498,8 +498,8 @@ github.com/letsencrypt/challtestsrv v1.4.2 h1:0ON3ldMhZyWlfVNYYpFuWRTmZNnyfiL9Hh
 github.com/letsencrypt/challtestsrv v1.4.2/go.mod h1:GhqMqcSoeGpYd5zX5TgwA6er/1MbWzx/o7yuuVya+Wk=
 github.com/letsencrypt/pebble/v2 v2.10.0 h1:Wq6gYXlsY6ubqI3hhxsTzdyotvfdjFBxuwYqCLCnj/U=
 github.com/letsencrypt/pebble/v2 v2.10.0/go.mod h1:Sk8cmUIPcIdv2nINo+9PB4L+ZBhzY+F9A1a/h/xmWiQ=
-github.com/lib/pq v1.12.1 h1:x1nbl/338GLqeDJ/FAiILallhAsqubLzEZu/pXtHUow=
-github.com/lib/pq v1.12.1/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
+github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
+github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/libdns/libdns v1.1.1 h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
 github.com/libdns/libdns v1.1.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
@@ -512,16 +512,16 @@ github.com/markbates/goth v1.82.0 h1:8j/c34AjBSTNzO7zTsOyP5IYCQCMBTRBHAbBt/PI0bQ
 github.com/markbates/goth v1.82.0/go.mod h1:/DRlcq0pyqkKToyZjsL2KgiA1zbF1HIjE7u2uC79rUk=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
+github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
 github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/mattn/go-sqlite3 v1.14.38 h1:tDUzL85kMvOrvpCt8P64SbGgVFtJB11GPi2AdmITgb4=
-github.com/mattn/go-sqlite3 v1.14.38/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
-github.com/meilisearch/meilisearch-go v0.36.1 h1:mJTCJE5g7tRvaqKco6DfqOuJEjX+rRltDEnkEC02Y0M=
-github.com/meilisearch/meilisearch-go v0.36.1/go.mod h1:hWcR0MuWLSzHfbz9GGzIr3s9rnXLm1jqkmHkJPbUSvM=
+github.com/mattn/go-sqlite3 v1.14.42 h1:MigqEP4ZmHw3aIdIT7T+9TLa90Z6smwcthx+Azv4Cgo=
+github.com/mattn/go-sqlite3 v1.14.42/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
+github.com/meilisearch/meilisearch-go v0.36.2 h1:MYaMPCpdLh2aYPt+zK+19mLoA4dfBY3S1L7T0FADCjU=
+github.com/meilisearch/meilisearch-go v0.36.2/go.mod h1:hWcR0MuWLSzHfbz9GGzIr3s9rnXLm1jqkmHkJPbUSvM=
 github.com/mholt/acmez/v3 v3.1.6 h1:eGVQNObP0pBN4sxqrXeg7MYqTOWyoiYpQqITVWlrevk=
 github.com/mholt/acmez/v3 v3.1.6/go.mod h1:5nTPosTGosLxF3+LU4ygbgMRFDhbAVpqMI4+a4aHLBY=
 github.com/mholt/archives v0.1.5 h1:Fh2hl1j7VEhc6DZs2DLMgiBNChUux154a1G+2esNvzQ=
@@ -538,8 +538,8 @@ github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.0.99 h1:2vH/byrwUkIpFQFOilvTfaUpvAX3fEFhEzO+DR3DlCE=
-github.com/minio/minio-go/v7 v7.0.99/go.mod h1:EtGNKtlX20iL2yaYnxEigaIvj0G0GwSDnifnG8ClIdw=
+github.com/minio/minio-go/v7 v7.0.100 h1:ShkWi8Tyj9RtU57OQB2HIXKz4bFgtVib0bbT1sbtLI8=
+github.com/minio/minio-go/v7 v7.0.100/go.mod h1:EtGNKtlX20iL2yaYnxEigaIvj0G0GwSDnifnG8ClIdw=
 github.com/minio/minlz v1.1.0 h1:rUOGu3EP4EqJC5k3qCsIwEnZiJULKqtRyDdqbhlvMmQ=
 github.com/minio/minlz v1.1.0/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
@@ -785,12 +785,12 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
 golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b h1:DXr+pvt3nC887026GRP39Ej11UATqWDmWuS99x26cD0=
 golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b/go.mod h1:4QTo5u+SEIbbKW1RacMZq1YEfOBqeXa19JeshGi+zc4=
-golang.org/x/image v0.38.0 h1:5l+q+Y9JDC7mBOMjo4/aPhMDcxEptsX+Tt3GgRQRPuE=
-golang.org/x/image v0.38.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
+golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
+golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -819,8 +819,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -868,8 +868,8 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -880,8 +880,8 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -892,8 +892,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -914,8 +914,8 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260401020348-3a24fdc17823 h1:YedBIttDguBl/zy2wJauEUm+DZZg4UXseWj0g/3N+yo=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260401020348-3a24fdc17823/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
--- a/models/actions/run_test.go
+++ b/models/actions/run_test.go
@@ -32,7 +32,7 @@ func TestUpdateRepoRunsNumbers(t *testing.T) {
 	err = UpdateRepoRunsNumbers(t.Context(), repo)
 	assert.NoError(t, err)
 	repo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
-	assert.Equal(t, 5, repo.NumActionRuns)
+	assert.Equal(t, 4, repo.NumActionRuns)
 	assert.Equal(t, 3, repo.NumClosedActionRuns)
 }

--- a/models/activities/user_heatmap.go
+++ b/models/activities/user_heatmap.go
@@ -62,6 +62,7 @@ func getUserHeatmapData(ctx context.Context, user *user_model.User, team *organi
 		return nil, err
 	}

+	// HINT: USER-ACTIVITY-PUSH-COMMITS: it only uses the doer's action time, it doesn't use git commit's time
 	return hdata, db.GetEngine(ctx).
 		Select(groupBy+" AS timestamp, count(user_id) as contributions").
 		Table("action").
--- a/models/fixtures/access.yml
+++ b/models/fixtures/access.yml
@@ -177,3 +177,5 @@
  user_id: 40
  repo_id: 1
  mode: 2
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/access_token.yml
+++ b/models/fixtures/access_token.yml
@@ -31,3 +31,5 @@
  created_unix: 946687980
  updated_unix: 946687980
  # commented out tokens so you can see what they are in plaintext
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/action.yml
+++ b/models/fixtures/action.yml
@@ -73,3 +73,5 @@
  is_private: false
  created_unix: 1680454039
  content: '4|' # issueId 5
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/action_artifact.yml
+++ b/models/fixtures/action_artifact.yml
@@ -177,3 +177,5 @@
  created_unix: 1730330775
  updated_unix: 1730330775
  expired_unix: 1738106775
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/action_run.yml
+++ b/models/fixtures/action_run.yml
@@ -140,23 +140,4 @@
  need_approval: 0
  approved_by: 0

-
-  id: 805
-  title: "update actions"
-  repo_id: 4
-  owner_id: 1
-  workflow_id: "artifact.yaml"
-  index: 191
-  trigger_user_id: 1
-  ref: "refs/heads/master"
-  commit_sha: "c2d72f548424103f01ee1dc02889c1e2bff816b0"
-  event: "push"
-  trigger_event: "push"
-  is_fork_pull_request: 0
-  status: 5
-  started: 1683636528
-  stopped: 1683636626
-  created: 1683636108
-  updated: 1683636626
-  need_approval: 0
-  approved_by: 0
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/action_run_job.yml
+++ b/models/fixtures/action_run_job.yml
@@ -130,17 +130,4 @@
  started: 1683636528
  stopped: 1683636626

-
-  id: 206
-  run_id: 805
-  repo_id: 4
-  owner_id: 1
-  commit_sha: c2d72f548424103f01ee1dc02889c1e2bff816b0
-  is_fork_pull_request: 0
-  name: job_2
-  attempt: 1
-  job_id: job_2
-  task_id: 56
-  status: 3
-  started: 1683636528
-  stopped: 1683636626
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/action_runner.yml
+++ b/models/fixtures/action_runner.yml
@@ -49,3 +49,5 @@
  repo_id: 0
  description: "This runner is going to be deleted"
  agent_labels: '["runner_to_be_deleted","linux"]'
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/action_runner_token.yml
+++ b/models/fixtures/action_runner_token.yml
@@ -33,3 +33,5 @@
  is_active: 1
  created: 1695617751
  updated: 1695617751
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/action_task.yml
+++ b/models/fixtures/action_task.yml
@@ -178,22 +178,4 @@
  log_size: 0
  log_expired: 0

-
-  id: 56
-  attempt: 1
-  runner_id: 1
-  status: 3 # 3 is the status code for "cancelled"
-  started: 1683636528
-  stopped: 1683636626
-  repo_id: 4
-  owner_id: 1
-  commit_sha: c2d72f548424103f01ee1dc02889c1e2bff816b0
-  is_fork_pull_request: 0
-  token_hash: 6d8ef48297195edcc8e22c70b3020eaa06c52976db67d39b4240c64a69a2cc1508825121b7b8394e48e00b1bf3718b2aaaab
-  token_salt: eeeeeeee
-  token_last_eight: eeeeeeee
-  log_filename: artifact-test2/2f/47.log
-  log_in_storage: 1
-  log_length: 707
-  log_size: 90179
-  log_expired: 0
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/action_task_output.yml
+++ b/models/fixtures/action_task_output.yml
@@ -18,3 +18,5 @@
  task_id: 50
  output_key: output_b
  output_value: bbb
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/attachment.yml
+++ b/models/fixtures/attachment.yml
@@ -166,3 +166,5 @@
  download_count: 0
  size: 0
  created_unix: 946684800
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/badge.yml
+++ b/models/fixtures/badge.yml
@@ -3,3 +3,5 @@
  slug: badge1
  description: just a test badge
  image_url: badge1.png
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/branch.yml
+++ b/models/fixtures/branch.yml
@@ -249,3 +249,5 @@
  is_deleted: false
  deleted_by_id: 0
  deleted_unix: 0
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/collaboration.yml
+++ b/models/fixtures/collaboration.yml
@@ -63,3 +63,5 @@
  repo_id: 32
  user_id: 10
  mode: 2 # write
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/comment.yml
+++ b/models/fixtures/comment.yml
@@ -102,3 +102,5 @@
  review_id: 22
  assignee_id: 5
  created_unix: 946684817
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/commit_status.yml
+++ b/models/fixtures/commit_status.yml
@@ -57,3 +57,5 @@
  context: deploy/awesomeness
  context_hash: ae9547713a6665fc4261d0756904932085a41cf2
  creator_id: 2
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/commit_status_index.yml
+++ b/models/fixtures/commit_status_index.yml
@@ -3,3 +3,5 @@
  repo_id: 1
  sha: "1234123412341234123412341234123412341234"
  max_index: 5
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/deploy_key.yml
+++ b/models/fixtures/deploy_key.yml
@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/email_address.yml
+++ b/models/fixtures/email_address.yml
@@ -317,3 +317,5 @@
  lower_email: user40@example.com
  is_activated: true
  is_primary: true
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/external_login_user.yml
+++ b/models/fixtures/external_login_user.yml
@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/follow.yml
+++ b/models/fixtures/follow.yml
@@ -17,3 +17,5 @@
  id: 4
  user_id: 31
  follow_id: 33
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/gpg_key.yml
+++ b/models/fixtures/gpg_key.yml
@@ -21,3 +21,5 @@
  can_encrypt_comms: true
  can_encrypt_storage: true
  can_certify: true
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/gpg_key_import.yml
+++ b/models/fixtures/gpg_key_import.yml
@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/hook_task.yml
+++ b/models/fixtures/hook_task.yml
@@ -35,3 +35,5 @@
        "X-Head": "42"
      }
    }
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/issue.yml
+++ b/models/fixtures/issue.yml
@@ -372,3 +372,5 @@
  created_unix: 1707270422
  updated_unix: 1707270422
  is_locked: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/issue_assignees.yml
+++ b/models/fixtures/issue_assignees.yml
@@ -18,3 +18,5 @@
  id: 5
  assignee_id: 10
  issue_id: 6
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/issue_index.yml
+++ b/models/fixtures/issue_index.yml
@@ -33,3 +33,5 @@
 -
  group_id: 51
  max_index: 1
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/issue_label.yml
+++ b/models/fixtures/issue_label.yml
@@ -17,3 +17,5 @@
  id: 4
  issue_id: 2
  label_id: 4
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/issue_pin.yml
+++ b/models/fixtures/issue_pin.yml
@@ -4,3 +4,5 @@
  issue_id: 4
  is_pull: false
  pin_order: 1
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/issue_user.yml
+++ b/models/fixtures/issue_user.yml
@@ -18,3 +18,5 @@
  issue_id: 1
  is_read: false
  is_mentioned: true
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/issue_watch.yml
+++ b/models/fixtures/issue_watch.yml
@@ -29,3 +29,5 @@
  is_watching: false
  created_unix: 946684800
  updated_unix: 946684800
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/label.yml
+++ b/models/fixtures/label.yml
@@ -107,3 +107,5 @@
  num_issues: 0
  num_closed_issues: 0
  archived_unix: 0
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/lfs_meta_object.yml
+++ b/models/fixtures/lfs_meta_object.yml
@@ -30,3 +30,5 @@
  size: 25
  repository_id: 54
  created_unix: 1671607299
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/login_source.yml
+++ b/models/fixtures/login_source.yml
@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/milestone.yml
+++ b/models/fixtures/milestone.yml
@@ -52,3 +52,5 @@
  num_closed_issues: 0
  completeness: 0
  deadline_unix: 253370764800
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/mirror.yml
+++ b/models/fixtures/mirror.yml
@@ -47,3 +47,5 @@
  next_update_unix: 0
  lfs_enabled: false
  lfs_endpoint: ""
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/notice.yml
+++ b/models/fixtures/notice.yml
@@ -12,3 +12,5 @@
  id: 3
  type: 1 # NoticeRepository
  description: description3
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/notification.yml
+++ b/models/fixtures/notification.yml
@@ -52,3 +52,5 @@
  issue_id: 4
  created_unix: 946688800
  updated_unix: 946688820
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/oauth2_application.yml
+++ b/models/fixtures/oauth2_application.yml
@@ -18,3 +18,5 @@
  created_unix: 1546869730
  updated_unix: 1546869730
  confidential_client: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/oauth2_authorization_code.yml
+++ b/models/fixtures/oauth2_authorization_code.yml
@@ -13,3 +13,5 @@
  code_challenge_method: "S256"
  redirect_uri: "http://127.0.0.1/"
  valid_until: 3546869730
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/oauth2_grant.yml
+++ b/models/fixtures/oauth2_grant.yml
@@ -29,3 +29,5 @@
  scope: "whatever"
  created_unix: 1546869730
  updated_unix: 1546869730
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/org_user.yml
+++ b/models/fixtures/org_user.yml
@@ -135,3 +135,5 @@
  uid: 20
  org_id: 17
  is_public: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/project.yml
+++ b/models/fixtures/project.yml
@@ -69,3 +69,5 @@
  type: 2
  created_unix: 1688973000
  updated_unix: 1688973000
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/project_board.yml
+++ b/models/fixtures/project_board.yml
@@ -75,3 +75,5 @@
  default: true
  created_unix: 1588117528
  updated_unix: 1588117528
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/project_issue.yml
+++ b/models/fixtures/project_issue.yml
@@ -21,3 +21,5 @@
  issue_id: 5
  project_id: 1
  project_board_id: 3
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/protected_branch.yml
+++ b/models/fixtures/protected_branch.yml
@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/protected_tag.yml
+++ b/models/fixtures/protected_tag.yml
@@ -22,3 +22,5 @@
  allowlist_team_i_ds: "[]"
  created_unix: 1715596037
  updated_unix: 1715596037
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/public_key.yml
+++ b/models/fixtures/public_key.yml
@@ -10,3 +10,5 @@
  updated_unix: 1565224552
  login_source_id: 0
  verified: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/pull_request.yml
+++ b/models/fixtures/pull_request.yml
@@ -117,3 +117,5 @@
  index: 1
  head_repo_id: 61
  base_repo_id: 61
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/reaction.yml
+++ b/models/fixtures/reaction.yml
@@ -37,3 +37,5 @@
  comment_id: 2
  user_id: 1
  created_unix: 1573248005
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/release.yml
+++ b/models/fixtures/release.yml
@@ -150,3 +150,5 @@
  is_prerelease: false
  is_tag: false
  created_unix: 946684803
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/renamed_branch.yml
+++ b/models/fixtures/renamed_branch.yml
@@ -3,3 +3,5 @@
  repo_id: 1
  from: dev
  to: master
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/repo_archiver.yml
+++ b/models/fixtures/repo_archiver.yml
@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/repo_indexer_status.yml
+++ b/models/fixtures/repo_indexer_status.yml
@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/repo_license.yml
+++ b/models/fixtures/repo_license.yml
@@ -1 +1,3 @@
 [] # empty
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/repo_redirect.yml
+++ b/models/fixtures/repo_redirect.yml
@@ -3,3 +3,5 @@
  owner_id: 2
  lower_name: oldrepo1
  redirect_repo_id: 1
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/repo_topic.yml
+++ b/models/fixtures/repo_topic.yml
@@ -25,3 +25,5 @@
 -
  repo_id: 2
  topic_id: 6
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/repo_transfer.yml
+++ b/models/fixtures/repo_transfer.yml
@@ -29,3 +29,5 @@
  repo_id: 5
  created_unix: 1553610671
  updated_unix: 1553610671
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/repo_unit.yml
+++ b/models/fixtures/repo_unit.yml
@@ -747,3 +747,5 @@
  type: 10
  config: "{}"
  created_unix: 946684810
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/repository.yml
+++ b/models/fixtures/repository.yml
@@ -1788,3 +1788,5 @@
  size: 0
  is_fsck_enabled: true
  close_issues_via_commit_in_any_branch: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/review.yml
+++ b/models/fixtures/review.yml
@@ -214,3 +214,5 @@
  original_author_id: 0
  updated_unix: 946684817
  created_unix: 946684817
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/star.yml
+++ b/models/fixtures/star.yml
@@ -17,3 +17,5 @@
  id: 4
  uid: 10
  repo_id: 32
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/stopwatch.yml
+++ b/models/fixtures/stopwatch.yml
@@ -9,3 +9,5 @@
  user_id: 2
  issue_id: 2
  created_unix: 1500988002
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/system_setting.yml
+++ b/models/fixtures/system_setting.yml
@@ -13,3 +13,5 @@
  version: 1
  created: 1653533198
  updated: 1653533198
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/team.yml
+++ b/models/fixtures/team.yml
@@ -261,3 +261,5 @@
  num_members: 1
  includes_all_repositories: true
  can_create_org_repo: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/team_repo.yml
+++ b/models/fixtures/team_repo.yml
@@ -75,3 +75,5 @@
  org_id: 41
  team_id: 22
  repo_id: 61
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/team_unit.yml
+++ b/models/fixtures/team_unit.yml
@@ -340,3 +340,5 @@
  team_id: 24
  type: 1 # code
  access_mode: 2
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/team_user.yml
+++ b/models/fixtures/team_user.yml
@@ -159,3 +159,5 @@
  org_id: 35
  team_id: 24
  uid: 2
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/topic.yml
+++ b/models/fixtures/topic.yml
@@ -27,3 +27,5 @@
  id: 6
  name: topicname2
  repo_count: 2
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/tracked_time.yml
+++ b/models/fixtures/tracked_time.yml
@@ -69,3 +69,5 @@
  time: 100000
  created_unix: 947688815
  deleted: true
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/two_factor.yml
+++ b/models/fixtures/two_factor.yml
@@ -7,3 +7,5 @@
  last_used_passcode:
  created_unix: 1564253724
  updated_unix: 1564253724
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/user.yml
+++ b/models/fixtures/user.yml
@@ -1556,3 +1556,5 @@
  repo_admin_change_team_access: false
  theme: ""
  keep_activity_private: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/user_blocking.yml
+++ b/models/fixtures/user_blocking.yml
@@ -17,3 +17,5 @@
  id: 4
  blocker_id: 50
  blockee_id: 34
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/user_open_id.yml
+++ b/models/fixtures/user_open_id.yml
@@ -15,3 +15,5 @@
  uid: 2
  uri: https://domain1.tld/user2/
  show: true
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/user_redirect.yml
+++ b/models/fixtures/user_redirect.yml
@@ -6,3 +6,5 @@
  id: 2
  lower_name: olduser2
  redirect_user_id: 2
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/watch.yml
+++ b/models/fixtures/watch.yml
@@ -39,3 +39,5 @@
  user_id: 10
  repo_id: 32
  mode: 1 # normal
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/webauthn_credential.yml
+++ b/models/fixtures/webauthn_credential.yml
@@ -7,3 +7,5 @@
  clone_warning: false
  created_unix: 946684800
  updated_unix: 946684800
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/fixtures/webhook.yml
+++ b/models/fixtures/webhook.yml
@@ -50,3 +50,5 @@
  events: '{"push_only":true,"branch_filter":"{master,feature*}"}'
  is_active: true
  is_system_webhook: false
+
+# DO NOT add more test data in the fixtures, test case should prepare their own test data separately and clearly
--- a/models/issues/comment.go
+++ b/models/issues/comment.go
@@ -24,6 +24,7 @@ import (
 	"code.gitea.io/gitea/modules/htmlutil"
 	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/markup"
 	"code.gitea.io/gitea/modules/optional"
 	"code.gitea.io/gitea/modules/references"
 	"code.gitea.io/gitea/modules/structs"
@@ -543,6 +544,12 @@ func (c *Comment) EventTag() string {
 	return fmt.Sprintf("event-%d", c.ID)
 }

+func (c *Comment) GetSanitizedContentHTML() template.HTML {
+	// mainly for type=4 CommentTypeCommitRef
+	// the content is a link like <a href="{RepoLink}/commit/{CommitID}">message title</a> (from CreateRefComment)
+	return markup.Sanitize(c.Content)
+}
+
 // LoadLabel if comment.Type is CommentTypeLabel, then load Label
 func (c *Comment) LoadLabel(ctx context.Context) error {
 	var label Label
--- a/models/repo/org_repo.go
+++ b/models/repo/org_repo.go
@@ -18,7 +18,14 @@ import (
 // GetOrgRepositories get repos belonging to the given organization
 func GetOrgRepositories(ctx context.Context, orgID int64) (RepositoryList, error) {
 	var orgRepos []*Repository
-	return orgRepos, db.GetEngine(ctx).Where("owner_id = ?", orgID).Find(&orgRepos)
+	err := db.GetEngine(ctx).Where("owner_id = ?", orgID).Find(&orgRepos)
+	return orgRepos, err
+}
+
+// GetOrgRepositoryIDs get repo IDs belonging to the given organization
+func GetOrgRepositoryIDs(ctx context.Context, orgID int64) (repoIDs []int64, _ error) {
+	err := db.GetEngine(ctx).Table("repository").Where("owner_id = ?", orgID).Cols("id").Find(&repoIDs)
+	return repoIDs, err
 }

 type SearchTeamRepoOptions struct {
@@ -26,7 +33,7 @@ type SearchTeamRepoOptions struct {
 	TeamID int64
 }

-// GetRepositories returns paginated repositories in team of organization.
+// GetTeamRepositories returns paginated repositories in team of organization.
 func GetTeamRepositories(ctx context.Context, opts *SearchTeamRepoOptions) (RepositoryList, error) {
 	sess := db.GetEngine(ctx)
 	if opts.TeamID > 0 {
--- a/models/user/user.go
+++ b/models/user/user.go
@@ -1462,16 +1462,6 @@ func IsUserVisibleToViewer(ctx context.Context, u, viewer *User) bool {
 	return false
 }

-// CountWrongUserType count OrgUser who have wrong type
-func CountWrongUserType(ctx context.Context) (int64, error) {
-	return db.GetEngine(ctx).Where(builder.Eq{"type": 0}.And(builder.Neq{"num_teams": 0})).Count(new(User))
-}
-
-// FixWrongUserType fix OrgUser who have wrong type
-func FixWrongUserType(ctx context.Context) (int64, error) {
-	return db.GetEngine(ctx).Where(builder.Eq{"type": 0}.And(builder.Neq{"num_teams": 0})).Cols("type").NoAutoTime().Update(&User{Type: 1})
-}
-
 func GetOrderByName() string {
 	if setting.UI.DefaultShowFullName {
 		return "full_name, name"
--- a/modules/actions/workflows.go
+++ b/modules/actions/workflows.go
@@ -103,10 +103,20 @@ func GetEventsFromContent(content []byte) ([]*jobparser.Event, error) {
 	if err != nil {
 		return nil, err
 	}
+	if err := ValidateWorkflowContent(content); err != nil {
+		return nil, err
+	}

 	return events, nil
 }

+// ValidateWorkflowContent catches structural errors (e.g. blank lines in run: | blocks)
+// that model.ReadWorkflow alone does not detect.
+func ValidateWorkflowContent(content []byte) error {
+	_, err := jobparser.Parse(content)
+	return err
+}
+
 func DetectWorkflows(
 	gitRepo *git.Repository,
 	commit *git.Commit,
--- a/modules/actions/workflows_test.go
+++ b/modules/actions/workflows_test.go
@@ -9,16 +9,26 @@ import (
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/setting"
 	api "code.gitea.io/gitea/modules/structs"
+	"code.gitea.io/gitea/modules/test"
 	webhook_module "code.gitea.io/gitea/modules/webhook"

 	"github.com/stretchr/testify/assert"
 )

+func fullWorkflowContent(part string) []byte {
+	return []byte(`
+name: test
+` + part + `
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo hello
+`)
+}
+
 func TestIsWorkflow(t *testing.T) {
-	oldDirs := setting.Actions.WorkflowDirs
-	defer func() {
-		setting.Actions.WorkflowDirs = oldDirs
-	}()
+	defer test.MockVariableValue(&setting.Actions.WorkflowDirs)()

 	tests := []struct {
 		name     string
@@ -218,7 +228,7 @@ func TestDetectMatched(t *testing.T) {

 	for _, tc := range testCases {
 		t.Run(tc.desc, func(t *testing.T) {
-			evts, err := GetEventsFromContent([]byte(tc.yamlOn))
+			evts, err := GetEventsFromContent(fullWorkflowContent(tc.yamlOn))
 			assert.NoError(t, err)
 			assert.Len(t, evts, 1)
 			assert.Equal(t, tc.expected, detectMatched(nil, tc.commit, tc.triggedEvent, tc.payload, evts[0]))
@@ -373,7 +383,7 @@ func TestMatchIssuesEvent(t *testing.T) {

 	for _, tc := range testCases {
 		t.Run(tc.desc, func(t *testing.T) {
-			evts, err := GetEventsFromContent([]byte(tc.yamlOn))
+			evts, err := GetEventsFromContent(fullWorkflowContent(tc.yamlOn))
 			assert.NoError(t, err)
 			assert.Len(t, evts, 1)

--- a/modules/git/catfile_batch_reader.go
+++ b/modules/git/catfile_batch_reader.go
@@ -10,66 +10,49 @@ import (
 	"errors"
 	"io"
 	"math"
+	"slices"
 	"strconv"
 	"strings"
 	"sync/atomic"
-	"time"

 	"code.gitea.io/gitea/modules/git/gitcmd"
 	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/util"
 )

-var catFileBatchDebugWaitClose atomic.Int64
-
 type catFileBatchCommunicator struct {
-	closeFunc   func(err error)
+	closeFunc   atomic.Pointer[func(err error)]
 	reqWriter   io.Writer
 	respReader  *bufio.Reader
 	debugGitCmd *gitcmd.Command
 }

-func (b *catFileBatchCommunicator) Close() {
-	if b.closeFunc != nil {
-		b.closeFunc(nil)
-		b.closeFunc = nil
+func (b *catFileBatchCommunicator) Close(err ...error) {
+	if fn := b.closeFunc.Swap(nil); fn != nil {
+		(*fn)(util.OptionalArg(err))
 	}
 }

-// newCatFileBatch opens git cat-file --batch in the provided repo and returns a stdin pipe, a stdout reader and cancel function
-func newCatFileBatch(ctx context.Context, repoPath string, cmdCatFile *gitcmd.Command) (ret *catFileBatchCommunicator) {
+// newCatFileBatch opens git cat-file --batch/--batch-check/--batch-command command and prepares the stdin/stdout pipes for communication.
+func newCatFileBatch(ctx context.Context, repoPath string, cmdCatFile *gitcmd.Command) *catFileBatchCommunicator {
 	ctx, ctxCancel := context.WithCancelCause(ctx)
-
-	// We often want to feed the commits in order into cat-file --batch, followed by their trees and subtrees as necessary.
 	stdinWriter, stdoutReader, stdPipeClose := cmdCatFile.MakeStdinStdoutPipe()
-	pipeClose := func() {
-		if delay := catFileBatchDebugWaitClose.Load(); delay > 0 {
-			time.Sleep(time.Duration(delay)) // for testing purpose only
-		}
-		stdPipeClose()
-	}
-	closeFunc := func(err error) {
-		ctxCancel(err)
-		pipeClose()
-	}
-	return newCatFileBatchWithCloseFunc(ctx, repoPath, cmdCatFile, stdinWriter, stdoutReader, closeFunc)
-}
-
-func newCatFileBatchWithCloseFunc(ctx context.Context, repoPath string, cmdCatFile *gitcmd.Command,
-	stdinWriter gitcmd.PipeWriter, stdoutReader gitcmd.PipeReader, closeFunc func(err error),
-) *catFileBatchCommunicator {
 	ret := &catFileBatchCommunicator{
 		debugGitCmd: cmdCatFile,
-		closeFunc:   closeFunc,
 		reqWriter:   stdinWriter,
 		respReader:  bufio.NewReaderSize(stdoutReader, 32*1024), // use a buffered reader for rich operations
 	}
+	ret.closeFunc.Store(new(func(err error) {
+		ctxCancel(err)
+		stdPipeClose()
+	}))

 	err := cmdCatFile.WithDir(repoPath).StartWithStderr(ctx)
 	if err != nil {
 		log.Error("Unable to start git command %v: %v", cmdCatFile.LogString(), err)
 		// ideally here it should return the error, but it would require refactoring all callers
 		// so just return a dummy communicator that does nothing, almost the same behavior as before, not bad
-		closeFunc(err)
+		ret.Close(err)
 		return ret
 	}

@@ -78,12 +61,33 @@ func newCatFileBatchWithCloseFunc(ctx context.Context, repoPath string, cmdCatFi
 		if err != nil && !errors.Is(err, context.Canceled) {
 			log.Error("cat-file --batch command failed in repo %s, error: %v", repoPath, err)
 		}
-		closeFunc(err)
+		ret.Close(err)
 	}()

 	return ret
 }

+func (b *catFileBatchCommunicator) debugKill() (ret struct {
+	beforeClose chan struct{}
+	blockClose  chan struct{}
+	afterClose  chan struct{}
+},
+) {
+	ret.beforeClose = make(chan struct{})
+	ret.blockClose = make(chan struct{})
+	ret.afterClose = make(chan struct{})
+	oldCloseFunc := b.closeFunc.Load()
+	b.closeFunc.Store(new(func(err error) {
+		b.closeFunc.Store(nil)
+		close(ret.beforeClose)
+		<-ret.blockClose
+		(*oldCloseFunc)(err)
+		close(ret.afterClose)
+	}))
+	b.debugGitCmd.DebugKill()
+	return ret
+}
+
 // catFileBatchParseInfoLine reads the header line from cat-file --batch
 // We expect: <oid> SP <type> SP <size> LF
 // then leaving the rest of the stream "<contents> LF" to be read
@@ -169,77 +173,46 @@ headerLoop:
 	return id, DiscardFull(rd, size-n+1)
 }

-// git tree files are a list:
-// <mode-in-ascii> SP <fname> NUL <binary Hash>
-//
-// Unfortunately this 20-byte notation is somewhat in conflict to all other git tools
-// Therefore we need some method to convert these binary hashes to hex hashes
-
 // ParseCatFileTreeLine reads an entry from a tree in a cat-file --batch stream
-// This carefully avoids allocations - except where fnameBuf is too small.
-// It is recommended therefore to pass in an fnameBuf large enough to avoid almost all allocations
-//
-// Each line is composed of:
-// <mode-in-ascii-dropping-initial-zeros> SP <fname> NUL <binary HASH>
-//
-// We don't attempt to convert the raw HASH to save a lot of time
-func ParseCatFileTreeLine(objectFormat ObjectFormat, rd BufferedReader, modeBuf, fnameBuf, shaBuf []byte) (mode, fname, sha []byte, n int, err error) {
-	var readBytes []byte
-
-	// Read the Mode & fname
-	readBytes, err = rd.ReadSlice('\x00')
-	if err != nil {
-		return mode, fname, sha, n, err
-	}
-	idx := bytes.IndexByte(readBytes, ' ')
-	if idx < 0 {
-		log.Debug("missing space in readBytes ParseCatFileTreeLine: %s", readBytes)
-		return mode, fname, sha, n, &ErrNotExist{}
-	}
-
-	n += idx + 1
-	copy(modeBuf, readBytes[:idx])
-	if len(modeBuf) >= idx {
-		modeBuf = modeBuf[:idx]
-	} else {
-		modeBuf = append(modeBuf, readBytes[len(modeBuf):idx]...)
-	}
-	mode = modeBuf
-
-	readBytes = readBytes[idx+1:]
-
-	// Deal with the fname
-	copy(fnameBuf, readBytes)
-	if len(fnameBuf) > len(readBytes) {
-		fnameBuf = fnameBuf[:len(readBytes)]
-	} else {
-		fnameBuf = append(fnameBuf, readBytes[len(fnameBuf):]...)
-	}
-	for err == bufio.ErrBufferFull {
-		readBytes, err = rd.ReadSlice('\x00')
-		fnameBuf = append(fnameBuf, readBytes...)
-	}
-	n += len(fnameBuf)
-	if err != nil {
-		return mode, fname, sha, n, err
-	}
-	fnameBuf = fnameBuf[:len(fnameBuf)-1]
-	fname = fnameBuf
-
-	// Deal with the binary hash
-	idx = 0
-	length := objectFormat.FullLength() / 2
-	for idx < length {
-		var read int
-		read, err = rd.Read(shaBuf[idx:length])
-		n += read
-		if err != nil {
-			return mode, fname, sha, n, err
+// Each entry is composed of:
+// <mode-in-ascii-dropping-initial-zeros> SP <name> NUL <binary-hash>
+func ParseCatFileTreeLine(objectFormat ObjectFormat, rd BufferedReader) (mode EntryMode, name string, objID ObjectID, n int, err error) {
+	// use the in-buffer memory as much as possible to avoid extra allocations
+	bufBytes, err := rd.ReadSlice('\x00')
+	const maxEntryInfoBytes = 1024 * 1024
+	if errors.Is(err, bufio.ErrBufferFull) {
+		bufBytes = slices.Clone(bufBytes)
+		for len(bufBytes) < maxEntryInfoBytes && errors.Is(err, bufio.ErrBufferFull) {
+			var tmp []byte
+			tmp, err = rd.ReadSlice('\x00')
+			bufBytes = append(bufBytes, tmp...)
 		}
-		idx += read
 	}
-	sha = shaBuf
-	return mode, fname, sha, n, err
+	if err != nil {
+		return mode, name, objID, len(bufBytes), err
+	}
+
+	idx := bytes.IndexByte(bufBytes, ' ')
+	if idx < 0 {
+		return mode, name, objID, len(bufBytes), errors.New("invalid CatFileTreeLine output")
+	}
+
+	mode = ParseEntryMode(util.UnsafeBytesToString(bufBytes[:idx]))
+	name = string(bufBytes[idx+1 : len(bufBytes)-1]) // trim the NUL terminator, it needs a copy because the bufBytes will be reused by the reader
+	if mode == EntryModeNoEntry {
+		return mode, name, objID, len(bufBytes), errors.New("invalid entry mode: " + string(bufBytes[:idx]))
+	}
+
+	switch objectFormat {
+	case Sha1ObjectFormat:
+		objID = &Sha1Hash{}
+	case Sha256ObjectFormat:
+		objID = &Sha256Hash{}
+	default:
+		panic("unsupported object format: " + objectFormat.Name())
+	}
+	readIDLen, err := io.ReadFull(rd, objID.RawValue())
+	return mode, name, objID, len(bufBytes) + readIDLen, err
 }

 func DiscardFull(rd BufferedReader, discard int64) error {
--- a/modules/git/catfile_batch_test.go
+++ b/modules/git/catfile_batch_test.go
@@ -7,9 +7,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"sync"
 	"testing"
-	"time"

 	"code.gitea.io/gitea/modules/test"

@@ -39,13 +37,22 @@ func testCatFileBatch(t *testing.T) {
 		require.Error(t, err)
 	})

-	simulateQueryTerminated := func(pipeCloseDelay, pipeReadDelay time.Duration) (errRead error) {
-		catFileBatchDebugWaitClose.Store(int64(pipeCloseDelay))
-		defer catFileBatchDebugWaitClose.Store(0)
+	simulateQueryTerminated := func(t *testing.T, errBeforePipeClose, errAfterPipeClose error) {
+		readError := func(t *testing.T, r io.Reader, expectedErr error) {
+			if expectedErr == nil {
+				return // expectedErr == nil means this read should be skipped
+			}
+			n, err := r.Read(make([]byte, 100))
+			assert.Zero(t, n)
+			assert.ErrorIs(t, err, expectedErr)
+		}
+
 		batch, err := NewBatch(t.Context(), filepath.Join(testReposDir, "repo1_bare"))
 		require.NoError(t, err)
 		defer batch.Close()
-		_, _ = batch.QueryInfo("e2129701f1a4d54dc44f03c93bca0a2aec7c5449")
+		_, err = batch.QueryInfo("e2129701f1a4d54dc44f03c93bca0a2aec7c5449")
+		require.NoError(t, err)
+
 		var c *catFileBatchCommunicator
 		switch b := batch.(type) {
 		case *catFileBatchLegacy:
@@ -58,24 +65,18 @@ func testCatFileBatch(t *testing.T) {
 			t.FailNow()
 		}

-		wg := sync.WaitGroup{}
-		wg.Go(func() {
-			time.Sleep(pipeReadDelay)
-			var n int
-			n, errRead = c.respReader.Read(make([]byte, 100))
-			assert.Zero(t, n)
-		})
-		time.Sleep(10 * time.Millisecond)
-		c.debugGitCmd.DebugKill()
-		wg.Wait()
-		return errRead
-	}
+		require.NotEqual(t, errBeforePipeClose == nil, errAfterPipeClose == nil, "must set exactly one of the expected errors")

+		inceptor := c.debugKill()
+		<-inceptor.beforeClose                         // wait for the command's Close to be called, the pipe is not closed yet
+		readError(t, c.respReader, errBeforePipeClose) // then caller will read on an open pipe which will be closed soon
+		close(inceptor.blockClose)                     // continue to close the pipe
+		<-inceptor.afterClose                          // wait for the pipe to be closed
+		readError(t, c.respReader, errAfterPipeClose)  // then caller will read on a closed pipe
+	}
 	t.Run("QueryTerminated", func(t *testing.T) {
-		err := simulateQueryTerminated(0, 20*time.Millisecond)
-		assert.ErrorIs(t, err, os.ErrClosed) // pipes are closed faster
-		err = simulateQueryTerminated(40*time.Millisecond, 20*time.Millisecond)
-		assert.ErrorIs(t, err, io.EOF) // reader is faster
+		simulateQueryTerminated(t, io.EOF, nil)       // reader is faster
+		simulateQueryTerminated(t, nil, os.ErrClosed) // pipes are closed faster
 	})

 	batch, err := NewBatch(t.Context(), filepath.Join(testReposDir, "repo1_bare"))
--- a/modules/git/parse_treeentry.go
+++ b/modules/git/parse_treeentry.go
@@ -5,10 +5,7 @@ package git

 import (
 	"bytes"
-	"fmt"
 	"io"
-
-	"code.gitea.io/gitea/modules/log"
 )

 // ParseTreeEntries parses the output of a `git ls-tree -l` command.
@@ -47,14 +44,11 @@ func parseTreeEntries(data []byte, ptree *Tree) ([]*TreeEntry, error) {
 }

 func catBatchParseTreeEntries(objectFormat ObjectFormat, ptree *Tree, rd BufferedReader, sz int64) ([]*TreeEntry, error) {
-	fnameBuf := make([]byte, 4096)
-	modeBuf := make([]byte, 40)
-	shaBuf := make([]byte, objectFormat.FullLength())
 	entries := make([]*TreeEntry, 0, 10)

 loop:
 	for sz > 0 {
-		mode, fname, sha, count, err := ParseCatFileTreeLine(objectFormat, rd, modeBuf, fnameBuf, shaBuf)
+		mode, fname, objID, count, err := ParseCatFileTreeLine(objectFormat, rd)
 		if err != nil {
 			if err == io.EOF {
 				break loop
@@ -64,25 +58,9 @@ loop:
 		sz -= int64(count)
 		entry := new(TreeEntry)
 		entry.ptree = ptree
-
-		switch string(mode) {
-		case "100644":
-			entry.entryMode = EntryModeBlob
-		case "100755":
-			entry.entryMode = EntryModeExec
-		case "120000":
-			entry.entryMode = EntryModeSymlink
-		case "160000":
-			entry.entryMode = EntryModeCommit
-		case "40000", "40755": // git uses 40000 for tree object, but some users may get 40755 for unknown reasons
-			entry.entryMode = EntryModeTree
-		default:
-			log.Debug("Unknown mode: %v", string(mode))
-			return nil, fmt.Errorf("unknown mode: %v", string(mode))
-		}
-
-		entry.ID = objectFormat.MustID(sha)
-		entry.name = string(fname)
+		entry.entryMode = mode
+		entry.ID = objID
+		entry.name = fname
 		entries = append(entries, entry)
 	}
 	if _, err := rd.Discard(1); err != nil {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
wxiaoguang	b4178efc39	Merge branch 'main' into copilot/refactor-catbatchparsetreeentries	2026-04-14 19:33:06 +08:00
wxiaoguang	fcb49922e8	add more test cases	2026-04-14 19:29:21 +08:00
Sebastian Ertz	b55528b1a2	Update go js py dependencies (#37204 ) \| go \| from \| to \| \| --- \| --- \| --- \| \| github.com/go-webauthn/webauthn \| `0.16.3` \| `0.16.4` \| \| github.com/meilisearch/meilisearch-go \| `0.36.1` \| `0.36.2` \| \| golang.org/x/crypto \| `0.49.0` \| `0.50.0` \| \| golang.org/x/image \| `0.38.0` \| `0.39.0` \| \| golang.org/x/net \| `0.52.0` \| `0.53.0` \| \| golang.org/x/text \| `0.35.0` \| `0.36.0` \| \| js \| from \| to \| \| --- \| --- \| --- \| \| @primer/octicons \| `19.23.1` \| `19.24.0` \| \| @vitejs/plugin-vue \| `6.0.5` \| `6.0.6` \| \| rolldown-license-plugin \| `2.2.0` \| `2.2.5` \| \| vite \| `8.0.7` \| `8.0.8` \| \| @types/node \| `25.5.2` \| `25.6.0` \| \| @typescript-eslint/parser \| `8.58.1` \| `8.58.2` \| \| @vitest/eslint-plugin \| `1.6.14` \| `1.6.15` \| \| globals \| `17.4.0` \| `17.5.0` \| \| stylelint \| `17.6.0` \| `17.7.0` \| \| typescript-eslint \| `8.58.1` \| `8.58.2` \| \| updates \| `17.13.5` \| `17.15.3` \| \| vitest \| `4.1.3` \| `4.1.4` \| \| py \| from \| to \| \| --- \| --- \| --- \| \| click \| `8.3.1` \| `8.3.2` \| \| json5 \| `0.13.0` \| `0.14.0` \| \| regex \| `2026.2.19` \| `2026.4.4` \| \| tomli \| `2.4.0` \| `2.4.1` \|	2026-04-14 12:45:54 +02:00
wxiaoguang	ec4f1f338b	fix	2026-04-14 15:57:55 +08:00
wxiaoguang	381a1e6d6c	fix	2026-04-14 15:38:13 +08:00
copilot-swe-agent[bot]	1d2609a65c	refactor: clarify ReadBytes returns fresh allocation, mode/fname are safe slices Co-Authored-By: GitHub Copilot <copilot@github.com> Agent-Logs-Url: https://github.com/go-gitea/gitea/sessions/43dab9a5-8c12-41c7-8da6-77c268a65ada Co-authored-by: wxiaoguang <2114189+wxiaoguang@users.noreply.github.com>	2026-04-14 06:50:53 +00:00
copilot-swe-agent[bot]	4bece1feb4	refactor: ParseCatFileTreeLine returns slices from ReadBytes, remove pre-provided buffers Replace the three caller-provided buffer parameters (modeBuf, fnameBuf, shaBuf) with internal allocation. Use rd.ReadBytes('\x00') to read mode+fname in one call and slice the result directly. Allocate sha internally. Update both callers (catBatchParseTreeEntries and lfs_nogogit.go) to drop the buffer setup. Co-Authored-By: GitHub Copilot <copilot@github.com> Agent-Logs-Url: https://github.com/go-gitea/gitea/sessions/43dab9a5-8c12-41c7-8da6-77c268a65ada Co-authored-by: wxiaoguang <2114189+wxiaoguang@users.noreply.github.com>	2026-04-14 06:49:29 +00:00
copilot-swe-agent[bot]	d284f5c798	refactor: use ParseEntryMode in catBatchParseTreeEntries Replace the manual switch statement for mode parsing with a call to ParseEntryMode, which already handles all the same cases including edge cases like "40755" via its fallback logic. Co-Authored-By: GitHub Copilot <copilot@github.com> Agent-Logs-Url: https://github.com/go-gitea/gitea/sessions/c93c0d76-8a70-478f-a549-2f120c5f45c4 Co-authored-by: wxiaoguang <2114189+wxiaoguang@users.noreply.github.com>	2026-04-14 06:40:57 +00:00
wxiaoguang	0593b58ff7	Add comment for the design of "user activity time" (#37195 )	2026-04-13 20:01:29 +00:00
Mohit Swarnkar	37396fff13	fix(api): handle missing base branch in PR commits API (#37193 ) Closes #36366 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-13 19:30:41 +00:00
wxiaoguang	6bcb666a9d	Refactor htmx and fetch-action related code (#37186 ) This is the first step (the hardest part): * repo file list last commit message lazy load * admin server status monitor * watch/unwatch (normal page, watchers page) * star/unstar (normal page, watchers page) * project view, delete column * workflow dispatch, switch the branch * commit page: load branches and tags referencing this commit The legacy "data-redirect" attribute is removed, it only makes the page reload (sometimes using an incorrect link). Also did cleanup for some devtest pages.	2026-04-13 18:53:55 +00:00
Nicolas	6eae04241d	Fix encoding for Matrix Webhooks (#37190 ) `url.PathEscape` unnecessarily encodes ! to %21, causing Matrix homeservers to reject the request with 401. Replace %21 back to ! after escaping. Fixes #36012 --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-13 18:10:43 +00:00
Xing Hong	fa8f7f15ef	Always show owner/repo name in compare page dropdowns (#37172 ) Fixes: https://github.com/go-gitea/gitea/issues/36677 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-14 01:25:58 +08:00
Mohit Swarnkar	80585adab4	fix(api): handle fork-only commits in compare API (#37185 ) Fix 500 error when comparing branches across fork repositories ## Problem The compare API returns a 500 Internal Server Error when comparing branches where the head commit exists only in the fork repository. ## Cause The API was using the base repository's GitRepo and repository context when converting commits. This fails when the commit does not exist in the base repository, resulting in a "fatal: bad object" error. ## Solution Use the head repository and HeadGitRepo when available to ensure commits are resolved in the correct repository context. ## Result * Fixes "fatal: bad object" error * Enables proper comparison between base and fork repositories * Prevents 500 Internal Server Error Fixes #37168 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-12 18:52:46 -07:00
Nicolas	47fdf3e284	Improve Contributing docs and set a release schedule (#37109 ) This PR updates `CONTRIBUTING.md` for clarity (code review, maintainers, PR workflow) ## Suggestion - majors about every three months, with a more predictable cadence from v1.26 onward. - target dates such as v1.26.0 (April 2026), v1.27.0 (June 2026), v1.28.0 (September 2026), v1.29.0 (December 2026). - announce feature freeze two weeks before each release. ## Other doc changes - Reviewing PRs: separate guidance for reviewers vs authors; small edits to maintaining PRs, merge queue, commit messages, co-authors. - Maintainers: clearer subsections; links to GitHub Docs for 2FA / GPG. - Split the Contributing.md into more useful markdown files --------- Signed-off-by: Nicolas <bircni@icloud.com>	2026-04-12 11:26:02 -07:00
github-actions[bot]	355aafd1f9	Update Nix flake (#37183 )	2026-04-12 16:51:54 +00:00
wxiaoguang	c2fa157731	Remove outdated RunUser logic (#37180 ) That logic is from 2014~2015, it unclear why it is necessary or whether it is still needed (whether Windows is still special) The comment "so just use current one if config says default" is not right anymore: "git" isn't the "default" value of RunUser (Comment out app.example.ini #15807). The RunUser's value is from current session's username.	2026-04-12 02:52:12 +00:00
wxiaoguang	8fcbdf05b0	Refactor flash message and remove SanitizeHTML template func (#37179 ) 1. Fix the "flash message" layout problem for different cases * I am sure most of the users should have ever seen the ugly center-aligned error message with multiple lines. 2. Fix inconsistent "Details" flash message EOL handling, sometimes `\n`, sometimes `<br>` * Now, always use "\n" and use `<pre>` to render 3. Remove SanitizeHTML template func because it is not useful and can be easily abused. * But it is still kept for mail templates, for example: https://github.com/go-gitea/gitea/issues/36049 4. Clarify PostProcessCommitMessage's behavior and add FIXME comment By the way: cleaned up some devtest pages, move embedded style block to CSS file	2026-04-12 10:17:25 +08:00
silverwind	ba9258c478	Indicate form field readonly via background (#37175 ) The `Run As Username` field on the install page was a `readonly` input that looked editable but wasn't, confusing users. Style `readonly` inputs with a subtle background, matching other frameworks. Fixes: #37174 Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-11 14:38:56 +00:00
silverwind	d913fae237	Remove dead CSS rules (#37173 ) Remove CSS rules whose HTML classes/IDs are no longer referenced in any template, Go source, or JavaScript/TypeScript file: - `.archived-icon`: removed from templates in `c85bb62635` - `.bottom-line`: removed from blame rendering in `9c6aeb47f7` - `.commit-status-link`: removed from templates in `f3c4baa84b` - `.instruct-toggle`: removed from templates in `75e85c25c1` - `.runner-new-text`, `#runner-new`: never referenced outside CSS - `.ap-terminal`: stale, asciinema-player uses `.ap-term`, still not needed - `.scrolling.dimmable.dimmed`: dimmer stand-in never adds this class - `.markup span.align-center/align-right/float-left/float-right`: never produced by any renderer, sanitizer strips class attributes - `.markup ul.no-list`, `.markup ol.no-list`: same as above --- This PR was written with the help of Claude Opus 4.6 --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-11 10:41:56 +00:00
silverwind	09c2677b21	Fix flaky `TestCatFileBatch/QueryTerminated` test (#37159 ) `TestCatFileBatch/QueryTerminated` relied on timing to distinguish `os.ErrClosed` vs `io.EOF` error paths. Replace `time.Sleep`-based synchronization with a channel-based hook on pipe close, making both error paths fully deterministic regardless of CI runner speed. Ref: https://github.com/go-gitea/gitea/actions/runs/24193070536/job/70615366804 Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-10 17:34:12 +00:00
Elisei Roca	16d7817338	Implement logout redirection for reverse proxy auth setups (#36085 ) When authentication is handled externally by a reverse proxy SSO provider, users can be redirected to an external logout URL or relative path defined on the reverse proxy. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-10 13:02:35 +00:00
silverwind	681c4074e5	Add missing `//nolint:depguard` (#37162 ) When running `golangci-lint` without `GOEXPERIMENT=jsonv2`, a lint error `import 'encoding/json' is not allowed` is seen. All other files in the module that import `encodings/json` have `//nolint` already, so add it. --- This PR was written with the help of Claude Opus 4.6 Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>	2026-04-10 10:39:28 +00:00
wxiaoguang	45c80bfec1	Make Markdown fenced code block work with more syntaxes (#37154 )	2026-04-09 23:54:39 +00:00
wxiaoguang	c10a5b908a	Remove unneeded doctor sub-commands (#37156 ) Co-authored-by: Giteabot <teabot@gitea.io>	2026-04-09 22:22:17 +02:00
Nicolas	980a8995bc	Report structurally invalid workflows to users (#37116 ) `model.ReadWorkflow` succeeds for YAML that is syntactically valid but fails deeper parsing in `jobparser.Parse` (e.g. blank lines inside `run: \|` blocks cause a SetJob round-trip error). Add `ValidateWorkflowContent` which runs the full `jobparser.Parse` to catch these cases, and use it in the file view, the actions workflow list, and the workflow detection loop so users see the error instead of silently getting a 500 or a dropped workflow. Fixes #37115 Signed-off-by: Nicolas <bircni@icloud.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Zettat123 <zettat123@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-09 15:03:32 +02:00
silverwind	04fb6f1c0b	Replace `rollup-plugin-license` with `rolldown-license-plugin` (#37130 ) Replace `rollup-plugin-license` and `wrap-ansi` with [`rolldown-license-plugin`](https://github.com/silverwind/rolldown-license-plugin), a zero-dependency plugin with async parallel I/O and built-in word wrapping. - Removes `rollup-plugin-license` (pulls in `lodash`, `moment`) and `wrap-ansi` from the dependency tree - License build time reduced by ~40% (370ms vs 640ms) - Added e2e test for `licenses.txt` Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>	2026-04-09 09:31:05 +00:00
silverwind	0914a44a9b	Clean up and improve non-gitea js error filter (#37148 ) 1. Filter out errors that contain `chrome-extension://` etc protocols 2. Extract filtering into its own function and test it 3. Fix the `window.config.assetUrlPrefix` mock, guaranteed to end with `/assets` 4. Remove useless `??` and `?.` for properties that always exist Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>	2026-04-09 08:36:08 +00:00
Copilot	6f9fa55785	models/fixtures: add "DO NOT add more test data" comment to all yml fixture files (#37150 ) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: wxiaoguang <2114189+wxiaoguang@users.noreply.github.com>	2026-04-09 13:26:21 +08:00
Lunny Xiao	8bf3c8b79d	Frontport changelog of v1.26.0-rc0 (#37138 )	2026-04-08 22:43:28 +02:00
Sebastian Ertz	dfd495f823	Update go dependencies (#37141 ) \| \| from \| to \| \| --- \| ---- \| --- \| \| github.com/aws/aws-sdk-go-v2/credentials \| `v1.19.13` \| `v1.19.14` \| \| github.com/go-co-op/gocron/v2 \| `v2.19.1` \| `v2.20.0` \| \| github.com/go-enry/go-enry/v2 \| `v2.9.5` \| `v2.9.6` \| \| github.com/go-webauthn/webauthn \| `v0.16.1` \| `v0.16.3` \| \| github.com/google/pprof \| `v0.0.0-20260302011040-a15ffb7f9dcc` \| `v0.0.0-20260402051712-545e8a4df936` \| \| github.com/lib/pq \| `v1.12.1` \| `v1.12.3` \| \| github.com/mattn/go-isatty \| `v0.0.20` \| `v0.0.21` \| \| github.com/mattn/go-sqlite3 \| `v1.14.38` \| `v1.14.42` \| \| github.com/minio/minio-go/v7 \| `v7.0.99` \| `v7.0.100` \| \| golang.org/x/sys \| `v0.42.0` \| `v0.43.0` \| \| google.golang.org/grpc \| `v1.79.3` \| `v1.80.0` \|	2026-04-08 19:07:17 +00:00
Sebastian Ertz	714f4207d9	Update javascript dependencies (#37142 ) --- \| \| from \| to \| \| --- \| ---- \| --- \| \| esbuild \| `0.27.4` \| `0.28.0` \| \| katex \| `0.16.44` \| `0.16.45` \| \| postcss \| `8.5.8` \| `8.5.9` \| \| swagger-ui-dist \| `5.32.1` \| `5.32.2` \| \| vite \| `8.0.5` \| `8.0.7` \| \| vue \| `3.5.31` \| `3.5.32` \|	2026-04-08 16:45:02 +00:00
silverwind	d600968aaf	Bump min go version to 1.26.2 (#37139 ) Update Go from 1.26.1 to 1.26.2 to fix 6 stdlib vulnerabilities: - GO-2026-4947: `crypto/x509` chain building - GO-2026-4946: `crypto/x509` policy validation - GO-2026-4870: `crypto/tls` KeyUpdate DoS - GO-2026-4869: `archive/tar` unbounded allocation - GO-2026-4866: `crypto/x509` name constraints bypass - GO-2026-4865: `html/template` XSS Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>	2026-04-08 17:56:06 +02:00
Karthik Bhandary	fc178e3203	Add bulk repository deletion for organizations (#36763 ) Fixes #36512 This PR adds a new API endpoint to delete all repositories within an organization in a single operation, improving efficiency for organization cleanup and management tasks. --------- Signed-off-by: Karthik Bhandary <34509856+karthikbhandary2@users.noreply.github.com> Co-authored-by: karthik.bhandary <karthik.bhandary@kfintech.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>	2026-04-08 04:32:22 +00:00
GiteaBot	03205d94da	[skip ci] Updated translations via Crowdin	2026-04-08 00:55:16 +00:00