Merge branch 'main' into ssh-mirror-migrations

2026-10-19 08:35:05 +02:00 · 2026-05-18 14:48:04 +03:00
commit 1fed086975
@@ -21,7 +21,7 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: renovatebot/github-action@79dc0ba74dc3de28db0a7aeb1d0b95d5bf5fde2a # v46.1.13
+      - uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
        with:
          renovate-version: ${{ env.RENOVATE_VERSION }}
          configurationFile: renovate.json5
@@ -63,11 +63,9 @@ jobs:
              - "options/locale/locale_en-US.json"

            frontend:
-              - "*.js"
              - "*.ts"
              - "web_src/**"
-              - "tools/*.js"
-              - "tools/*.ts"
+              - "tools/generate-svg.ts"
              - "assets/emoji.json"
              - "package.json"
              - "pnpm-lock.yaml"
@@ -99,8 +97,8 @@ jobs:
              - "Makefile"

            dockerfile:
-                - "Dockerfile"
-                - "Dockerfile.rootless"
+              - "Dockerfile"
+              - "Dockerfile.rootless"

            swagger:
              - "templates/swagger/v1_json.tmpl"
@@ -0,0 +1,44 @@
+name: giteabot
+
+on:
+  push:
+    branches:
+      - main
+  # pull_request_target gives this workflow access to GITEABOT_TOKEN on PRs from
+  # forks, which the bot needs to write labels, statuses and comments. Safe here
+  # because the job only runs a pinned action and never checks out PR HEAD.
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
+    types:
+      - opened
+      - synchronize
+      - labeled
+      - unlabeled
+      - closed
+      - review_requested
+      - review_request_removed
+  pull_request_review:
+    types:
+      - submitted
+      - edited
+      - dismissed
+  schedule:
+    - cron: "15 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ format('{0}-{1}', github.workflow, (github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review') && format('pr-{0}', github.event.pull_request.number) || 'maintenance') }}
+  cancel-in-progress: false
+
+jobs:
+  giteabot:
+    if: github.repository == 'go-gitea/gitea'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: go-gitea/giteabot@8996d0b0e6c4ab066e3adcaf2c49b5d4cd15d7af # v1.0.1
+        with:
+          github_token: ${{ secrets.GITEABOT_TOKEN }}
+          gitea_fork: giteabot/gitea
@@ -43,7 +43,7 @@ jobs:
          go-version-file: go.mod
          check-latest: true
          cache: false
-      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
@@ -89,7 +89,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
@@ -29,7 +29,7 @@ jobs:
        with:
          cache-name: e2e
          build-cache: "false"
-      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
@@ -23,6 +23,9 @@ jobs:
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
      - run: make lint-pr-title
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
@@ -22,7 +22,7 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
@@ -23,7 +23,7 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
@@ -26,7 +26,7 @@ jobs:
        with:
          go-version-file: go.mod
          check-latest: true
-      - uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 24
@@ -7,7 +7,7 @@
 - Run single playwright e2e test files with `GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e`
 - Add the current year into the copyright header of new `.go` files
 - Ensure no trailing whitespace in edited files
- Use Conventional Commits format for commit messages and PR titles (e.g. `type(scope): subject`)
+- Use Conventional Commits format for commit messages and PR titles (for example `type(scope): subject`; place `!` immediately before the colon when the change is breaking)
 - Never force-push, amend, or squash unless asked. Use new commits and normal push for pull request updates
 - Preserve existing code comments, do not remove or rewrite comments that are still relevant
 - Keep comments short, prefer same-line, explain why, never narrate code
@@ -195,14 +195,30 @@ PR titles must follow the [Conventional Commits](https://www.conventionalcommits
 type(scope)!: subject
 ```

-The allowed types are `build`, `chore`, `ci`, `docs`, `feat`, `fix`, `perf`, `refactor`, `revert`, `style`, and `test`. The generic `chore` type is intentionally not accepted; pick a more descriptive type instead.
+The scope in parentheses is optional. A `!` immediately before the colon marks a [breaking change](https://www.conventionalcommits.org/en/v1.0.0/#summary): either `type!:` or `type(scope)!:` (not `type!(scope):`).
+
+Use one of these types:
+
+- `build`: Changes affecting the build system, packaging, or external dependencies
+- `ci`: Changes to CI/CD configuration files and scripts
+- `chore`: Maintenance changes that do not affect production code or should not appear in the changelog
+- `docs`: Documentation-only changes
+- `feat`: A larger user-facing feature, improvement, or new functionality
+- `enhance`: Small or trivial user-facing improvements or UX polish (for example wording changes, color adjustments, spacing or padding tweaks, placeholders, small UI behavior improvements)
+- `fix`: A bug fix, UX correction, or security-related dependency update
+- `perf`: Performance improvements (speed, memory, scalability)
+- `refactor`: A code change that neither fixes a bug nor adds a feature
+- `revert`: Reverts a previous change
+- `style`: Formatting or style-only changes that do not affect code behavior (for example lint-driven edits)
+- `test`: Adding or correcting tests

 Examples:

 ```text
 fix(web): prevent avatar upload crash on empty file
 feat(api): add pagination to repo hooks list
-ci(workflows): lint PR titles with commitlint
+enhance(repo): improve diff toolbar spacing
+ci(workflows): lint PR titles in CI
 ```

 Keep this summary up-to-date as the PR evolves. \
@@ -217,6 +233,10 @@ Another requirement for merging PRs is that the PR is labeled correctly.\
 However, this is not your job as a contributor, but the job of the person merging your PR.\
 If you think that your PR was labeled incorrectly, or notice that it was merged without labels, please let us know.

+For pull requests that use a valid Conventional Commits title, CI automatically applies a matching `type/…` label when the title prefix is `feat`, `enhance`, `fix`, `docs`, or `test` (for example `enhance(web): …` receives `type/enhancement`).\
+That label is kept in sync with the PR title when the title is edited.\
+Other title prefixes do not get an automatic `type/…` label; the merger still assigns the correct labels (including `type/…` when needed) for changelog and backport decisions.
+
 If your PR closes some issues, you must note that in a way that both GitHub and Gitea understand, i.e. by appending a paragraph like

 ```text
@@ -320,7 +320,7 @@ lint-md-fix: node_modules ## lint markdown files and fix issues

 .PHONY: lint-pr-title
 lint-pr-title: ## lint PR title against Conventional Commits (set PR_TITLE=...)
-	@node ./tools/lint-pr-title.js
+	@node ./tools/lint-pr-title.ts

 .PHONY: lint-spell
 lint-spell: ## lint spelling
@@ -660,8 +660,8 @@
    "licenseText": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under tLine truncated
  },
  {
-    "name": "github.com/google/go-github/v85",
-    "path": "github.com/google/go-github/v85/LICENSE",
+    "name": "github.com/google/go-github/v86",
+    "path": "github.com/google/go-github/v86/LICENSE",
    "licenseText": "Copyright (c) 2013 The go-github AUTHORS. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
  },
  {
@@ -21,7 +21,6 @@ import (
 	"code.gitea.io/gitea/services/doctor"

 	"github.com/urfave/cli/v3"
-	"xorm.io/xorm"
 )

 func newDoctorCommand() *cli.Command {
@@ -132,7 +131,7 @@ func runRecreateTable(ctx context.Context, cmd *cli.Command) error {
 	}
 	recreateTables := migrate_base.RecreateTables(beans...)

-	return db.InitEngineWithMigration(context.Background(), func(ctx context.Context, x *xorm.Engine) error {
+	return db.InitEngineWithMigration(context.Background(), func(ctx context.Context, x db.EngineMigration) error {
 		if err := migrations.EnsureUpToDate(ctx, x); err != nil {
 			return err
 		}
@@ -48,7 +48,7 @@ If a PR has `lgtm/done`, no open discussions, and no merge conflicts, any mainta

 <https://github.com/go-gitea/gitea/pulls?q=is%3Apr+label%3Areviewed%2Fwait-merge+sort%3Acreated-asc+is%3Aopen>

-Gitea uses its own tool, <https://github.com/GiteaBot/gitea-backporter>, to automate parts of the review process. The backporter:
+Gitea uses its own tool, <https://github.com/go-gitea/gitea/blob/main/.github/workflows/giteabot.yml>, to automate parts of the review process. The backporter:

 - Creates a backport PR when needed after the initial PR merges.
 - Removes the PR from the merge queue after it merges.
@@ -9,10 +9,10 @@ godebug x509negativeserial=1

 require (
 	code.gitea.io/actions-proto-go v0.4.1
-	code.gitea.io/sdk/gitea v0.25.0
+	code.gitea.io/sdk/gitea v0.25.1
 	codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570
 	connectrpc.com/connect v1.19.2
-	gitea.com/gitea/runner v1.0.0
+	gitea.com/gitea/runner v1.0.3
 	gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a
 	gitea.com/go-chi/cache v0.2.1
 	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098
@@ -48,24 +48,24 @@ require (
 	github.com/ethantkoenig/rupture v1.0.1
 	github.com/felixge/fgprof v0.9.5
 	github.com/fsnotify/fsnotify v1.10.1
-	github.com/getkin/kin-openapi v0.137.0
+	github.com/getkin/kin-openapi v0.138.0
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/go-chi/cors v1.2.2
-	github.com/go-co-op/gocron/v2 v2.21.1
+	github.com/go-co-op/gocron/v2 v2.21.2
 	github.com/go-enry/go-enry/v2 v2.9.6
 	github.com/go-git/go-billy/v5 v5.9.0
 	github.com/go-git/go-git/v5 v5.19.0
 	github.com/go-ldap/ldap/v3 v3.4.13
 	github.com/go-redsync/redsync/v4 v4.16.0
 	github.com/go-sql-driver/mysql v1.10.0
-	github.com/go-webauthn/webauthn v0.17.2
+	github.com/go-webauthn/webauthn v0.17.3
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/google/go-github/v85 v85.0.0
+	github.com/google/go-github/v86 v86.0.0
 	github.com/google/licenseclassifier/v2 v2.0.0
-	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936
+	github.com/google/pprof v0.0.0-20260507013755-92041b743c96
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/feeds v1.2.0
 	github.com/gorilla/sessions v1.4.0
@@ -104,25 +104,25 @@ require (
 	github.com/ulikunitz/xz v0.5.15
 	github.com/urfave/cli-docs/v3 v3.1.0
 	github.com/urfave/cli/v3 v3.6.1
-	github.com/wneessen/go-mail v0.7.2
+	github.com/wneessen/go-mail v0.7.3
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/yohcop/openid-go v1.0.1
 	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	gitlab.com/gitlab-org/api/client-go/v2 v2.24.1
+	gitlab.com/gitlab-org/api/client-go/v2 v2.25.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.3
-	golang.org/x/crypto v0.50.0
-	golang.org/x/image v0.39.0
-	golang.org/x/net v0.53.0
+	golang.org/x/crypto v0.51.0
+	golang.org/x/image v0.40.0
+	golang.org/x/net v0.54.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.20.0
 	golang.org/x/sys v0.44.0
-	golang.org/x/text v0.36.0
+	golang.org/x/text v0.37.0
 	google.golang.org/grpc v1.81.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/ini.v1 v1.67.2
 	gopkg.in/yaml.v3 v3.0.1
-	modernc.org/sqlite v1.50.0
+	modernc.org/sqlite v1.50.1
 	mvdan.cc/xurls/v2 v2.6.0
 	strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab
 	xorm.io/builder v0.3.13
@@ -186,7 +186,7 @@ require (
 	github.com/davidmz/go-pageant v1.0.2 // indirect
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-enry/go-oniguruma v1.2.1 // indirect
@@ -196,7 +196,7 @@ require (
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/go-webauthn/x v0.2.3 // indirect
+	github.com/go-webauthn/x v0.2.5 // indirect
 	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
@@ -290,7 +290,7 @@ require (
 	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401020348-3a24fdc17823 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	modernc.org/libc v1.72.0 // indirect
+	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 )
@@ -2,8 +2,8 @@ cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdB
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 code.gitea.io/actions-proto-go v0.4.1 h1:l0EYhjsgpUe/1VABo2eK7zcoNX2W44WOnb0MSLrKfls=
 code.gitea.io/actions-proto-go v0.4.1/go.mod h1:mn7Wkqz6JbnTOHQpot3yDeHx+O5C9EGhMEE+htvHBas=
-code.gitea.io/sdk/gitea v0.25.0 h1:wSJlL0Qv+ODY2OdF0L7fwt86wgf1C/0g3xIXZ6eC5zI=
-code.gitea.io/sdk/gitea v0.25.0/go.mod h1:uDFWYBU8dgZsgOHwe6C/6olxvf8FHguNB3wW1i83fgg=
+code.gitea.io/sdk/gitea v0.25.1 h1:yywxWwoV+SdjHtbC6unBiXojWdZOtoHuGhEazEXeWuE=
+code.gitea.io/sdk/gitea v0.25.1/go.mod h1:uDFWYBU8dgZsgOHwe6C/6olxvf8FHguNB3wW1i83fgg=
 code.pfad.fr/check v1.1.0 h1:GWvjdzhSEgHvEHe2uJujDcpmZoySKuHQNrZMfzfO0bE=
 code.pfad.fr/check v1.1.0/go.mod h1:NiUH13DtYsb7xp5wll0U4SXx7KhXQVCtRgdC96IPfoM=
 codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570 h1:TXbikPqa7YRtfU9vS6QJBg77pUvbEb6StRdZO8t1bEY=
@@ -14,8 +14,8 @@ dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
-gitea.com/gitea/runner v1.0.0 h1:s3AS5u8r+B5W+Gy69sYYvCVTb0f23fRM6H+CbrFrobE=
-gitea.com/gitea/runner v1.0.0/go.mod h1:bn+8Qt3KyvdVQHD3OR2yRoKgEXs8dXqwBVtmfYVrNIE=
+gitea.com/gitea/runner v1.0.3 h1:jwwXPj2UKSrbFCfyAcqoiXcbaTNQTWlozRb1kikiquw=
+gitea.com/gitea/runner v1.0.3/go.mod h1:0xR69LP2GwVJT9QnbLHok/87YIFDmpKnJVLkRKKJbSM=
 gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a h1:JHoBrfuTSF9Ke9aNfSYj1XRPBHjKPgCApVprnt2Am0M=
 gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a/go.mod h1:FOsLJIMdpiHzBp3Vby6Wfkdw2ppGscrjgU1IC7E4/zQ=
 gitea.com/go-chi/cache v0.2.1 h1:bfAPkvXlbcZxPCpcmDVCWoHgiBSBmZN/QosnZvEC0+g=
@@ -273,10 +273,10 @@ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMo
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
-github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
-github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/getkin/kin-openapi v0.137.0 h1:Q3HhawNQV0GfvO2mIYMUBUSEFrDsVlzcYz4VydL9YEo=
-github.com/getkin/kin-openapi v0.137.0/go.mod h1:vUYWaKyMqj7PfTybelXtLuLN9tReS12vxnzMRK+z2GY=
+github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
+github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/getkin/kin-openapi v0.138.0 h1:ebfE0JAmF6AqHrNBy1KO3Fs68K9tPs48HalvLPo7Rv4=
+github.com/getkin/kin-openapi v0.138.0/go.mod h1:vUYWaKyMqj7PfTybelXtLuLN9tReS12vxnzMRK+z2GY=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 h1:mtDjlmloH7ytdblogrMz1/8Hqua1y8B4ID+bh3rvod0=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1/go.mod h1:fenKRzpXDjNpsIBhuhUzvjCKlDjKam0boRAenTE0Q6A=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
@@ -290,8 +290,8 @@ github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
 github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
 github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
-github.com/go-co-op/gocron/v2 v2.21.1 h1:QYOK6iOQVCut+jDcs4zRdWRTBHRxRCEeeFi1TnAmgbU=
-github.com/go-co-op/gocron/v2 v2.21.1/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
+github.com/go-co-op/gocron/v2 v2.21.2 h1:bD8/YwkojYHgXFr3iEulL148KBdTbKVxUZzFKpXcdbY=
+github.com/go-co-op/gocron/v2 v2.21.2/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
 github.com/go-enry/go-enry/v2 v2.9.6 h1:np63eOtMV56zfYDHnFVgpEVOk8fr2kmylcMnAZUDbSs=
 github.com/go-enry/go-enry/v2 v2.9.6/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
 github.com/go-enry/go-oniguruma v1.2.1 h1:k8aAMuJfMrqm/56SG2lV9Cfti6tC4x8673aHCcBk+eo=
@@ -331,10 +331,10 @@ github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/go-webauthn/webauthn v0.17.2 h1:e9YtSZTVnxnMWFezXi6JvnqOSxmH4Er8QDHK2a/mM40=
-github.com/go-webauthn/webauthn v0.17.2/go.mod h1:mQC6L0lZ5Kiu35G70zeB2WnrW4+vbHjR8Koq4HdVaMg=
-github.com/go-webauthn/x v0.2.3 h1:8oArS+Rc1SWFLXhE17KZNx258Z4kUSyaDgsSncCO5RA=
-github.com/go-webauthn/x v0.2.3/go.mod h1:tM04GF3V6VYq79AZMl7vbj4q6pz9r7L2criWRzbWhPk=
+github.com/go-webauthn/webauthn v0.17.3 h1:XHZ0TXV7k8vChcE4TFgPitOPJ5cb7h1dpAeFDS0cjCo=
+github.com/go-webauthn/webauthn v0.17.3/go.mod h1:PlkMgmuL9McCT7dvgBj/Sz/fgs3V6ZID6/KnFkEcPvQ=
+github.com/go-webauthn/x v0.2.5 h1:wEVTfU04XFyPTXGQbKOQwMKhcDWfDAkdsDDBsDaG9yY=
+github.com/go-webauthn/x v0.2.5/go.mod h1:Qna/yJz9rV6lRzwl5BfYbmTJpVGxcBIds3gJtw2tlGg=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
@@ -381,8 +381,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v85 v85.0.0 h1:1+TLFX/akTFXK7o9Z9uAloQGufOn4ySa5DItUM1VWT4=
-github.com/google/go-github/v85 v85.0.0/go.mod h1:jYkBnqN+SzR2A2fGKYfbt6DEEQAyxeK0Q2XpPV9ZFsU=
+github.com/google/go-github/v86 v86.0.0 h1:S/6aANJhwRm8EQmGKVML3j41yq0h2BsTP8FnDkO7kcA=
+github.com/google/go-github/v86 v86.0.0/go.mod h1:zKv1l4SwDXNFMGByi2FWkq71KwSXqj/eQRZuqtmcot8=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -395,8 +395,8 @@ github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/
 github.com/google/licenseclassifier/v2 v2.0.0 h1:1Y57HHILNf4m0ABuMVb6xk4vAJYEUO0gDxNpog0pyeA=
 github.com/google/licenseclassifier/v2 v2.0.0/go.mod h1:cOjbdH0kyC9R22sdQbYsFkto4NGCAc+ZSwbeThazEtM=
 github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
-github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
-github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260507013755-92041b743c96 h1:YDDnaZ9afWajDboPMt9Vikqca/yWAX7KAxVzb4lJU1M=
+github.com/google/pprof v0.0.0-20260507013755-92041b743c96/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
@@ -723,8 +723,8 @@ github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XD
 github.com/urfave/cli/v3 v3.6.1 h1:j8Qq8NyUawj/7rTYdBGrxcH7A/j7/G8Q5LhWEW4G3Mo=
 github.com/urfave/cli/v3 v3.6.1/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/willf/bitset v1.1.10/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
-github.com/wneessen/go-mail v0.7.2 h1:xxPnhZ6IZLSgxShebmZ6DPKh1b6OJcoHfzy7UjOkzS8=
-github.com/wneessen/go-mail v0.7.2/go.mod h1:+TkW6QP3EVkgTEqHtVmnAE/1MRhmzb8Y9/W3pweuS+k=
+github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
+github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
 github.com/woodsbury/decimal128 v1.3.0 h1:8pffMNWIlC0O5vbyHWFZAt5yWvWcrHA+3ovIIjVWss0=
 github.com/woodsbury/decimal128 v1.3.0/go.mod h1:C5UTmyTjW3JftjUFzOVhC20BEQa2a4ZKOB5I6Zjb+ds=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@@ -760,8 +760,8 @@ github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
-gitlab.com/gitlab-org/api/client-go/v2 v2.24.1 h1:XuTWCNmVSnXzjb9ty8XPR60BOHsXbzqgOlujW3+5DTM=
-gitlab.com/gitlab-org/api/client-go/v2 v2.24.1/go.mod h1:OSJITkIrT0UuA3JCucEK9UEGcC1PWBkQg5WW6W4nWuo=
+gitlab.com/gitlab-org/api/client-go/v2 v2.25.0 h1:ATTBB0Iiup5SRox2IPNSkkrGy/Any7FWBL1BOpZrpCU=
+gitlab.com/gitlab-org/api/client-go/v2 v2.25.0/go.mod h1:OSJITkIrT0UuA3JCucEK9UEGcC1PWBkQg5WW6W4nWuo=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
@@ -797,12 +797,12 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
+golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
-golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
-golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/image v0.40.0 h1:Tw4GyDXMo+daZN1znreBRC3VayR1aLFUyUEOLUdW1a8=
+golang.org/x/image v0.40.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -829,8 +829,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
+golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -889,8 +889,8 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -901,8 +901,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -952,10 +952,10 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/cc/v4 v4.27.3 h1:uNCgn37E5U09mTv1XgskEVUJ8ADKpmFMPxzGJ0TSo+U=
-modernc.org/cc/v4 v4.27.3/go.mod h1:3YjcbCqhoTTHPycJDRl2WZKKFj0nwcOIPBfEZK0Hdk8=
-modernc.org/ccgo/v4 v4.32.4 h1:L5OB8rpEX4ZsXEQwGozRfJyJSFHbbNVOoQ59DU9/KuU=
-modernc.org/ccgo/v4 v4.32.4/go.mod h1:lY7f+fiTDHfcv6YlRgSkxYfhs+UvOEEzj49jAn2TOx0=
+modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
+modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.0 h1:yRLPFZieg532OT4rp4JFNIVcquwalMX26G95WQDqwCQ=
+modernc.org/ccgo/v4 v4.34.0/go.mod h1:AS5WYMyBakQ+fhsHhtP8mWB82KTGPkNNJDGfGQCe0/A=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
@@ -964,18 +964,18 @@ modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
 modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.72.0 h1:IEu559v9a0XWjw0DPoVKtXpO2qt5NVLAnFaBbjq+n8c=
-modernc.org/libc v1.72.0/go.mod h1:tTU8DL8A+XLVkEY3x5E/tO7s2Q/q42EtnNWda/L5QhQ=
+modernc.org/libc v1.72.3 h1:ZnDF4tXn4NBXFutMMQC4vtbTFSXhhKzR73fv0beZEAU=
+modernc.org/libc v1.72.3/go.mod h1:dn0dZNnnn1clLyvRxLxYExxiKRZIRENOfqQ8XEeg4Qs=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
 modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
-modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
+modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.50.0 h1:eMowQSWLK0MeiQTdmz3lqoF5dqclujdlIKeJA11+7oM=
-modernc.org/sqlite v1.50.0/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
+modernc.org/sqlite v1.50.1 h1:l+cQvn0sd0zJJtfygGHuQJ5AjlrwXmWPw4KP3ZMwr9w=
+modernc.org/sqlite v1.50.1/go.mod h1:tcNzv5p84E0skkmJn038y+hWJbLQXQqEnQfeh5r2JLM=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -242,7 +242,7 @@ func GetFeeds(ctx context.Context, opts GetFeedsOptions) (ActionList, int64, err

 	if opts.Page < 10 { // TODO: why it's 10 but other values? It's an experience value.
 		sess := db.GetEngine(ctx).Where(cond)
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)

 		if opts.DontCount {
 			err = sess.Desc("`action`.created_unix").Find(&actions)
@@ -255,7 +255,7 @@ func GetFeeds(ctx context.Context, opts GetFeedsOptions) (ActionList, int64, err
 	} else {
 		// First, only query which IDs are necessary, and only then query all actions to speed up the overall query
 		sess := db.GetEngine(ctx).Where(cond).Select("`action`.id")
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)

 		actionIDs := make([]int64, 0, opts.PageSize)
 		if err := sess.Table("action").Desc("`action`.created_unix").Find(&actionIDs); err != nil {
@@ -17,7 +17,6 @@ import (
 	"code.gitea.io/gitea/modules/gitrepo"

 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

 // ActivityAuthorData represents statistical git commit count data
@@ -248,7 +247,7 @@ func (stats *ActivityStats) FillPullRequests(ctx context.Context, repoID int64,
 	return nil
 }

-func pullRequestsForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time, merged bool) *xorm.Session {
+func pullRequestsForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time, merged bool) db.Session {
 	sess := db.GetEngine(ctx).Where("pull_request.base_repo_id=?", repoID).
 		Join("INNER", "issue", "pull_request.issue_id = issue.id")

@@ -324,7 +323,7 @@ func (stats *ActivityStats) FillUnresolvedIssues(ctx context.Context, repoID int
 	return sess.Find(&stats.UnresolvedIssues)
 }

-func newlyCreatedIssues(ctx context.Context, repoID int64, fromTime time.Time) *xorm.Session {
+func newlyCreatedIssues(ctx context.Context, repoID int64, fromTime time.Time) db.Session {
 	sess := db.GetEngine(ctx).Where("issue.repo_id = ?", repoID).
 		And("issue.is_pull = ?", false).                // Retain the is_pull check to exclude pull requests
 		And("issue.created_unix >= ?", fromTime.Unix()) // Include all issues created after fromTime
@@ -332,7 +331,7 @@ func newlyCreatedIssues(ctx context.Context, repoID int64, fromTime time.Time) *
 	return sess
 }

-func activeIssues(ctx context.Context, repoID int64, fromTime time.Time) *xorm.Session {
+func activeIssues(ctx context.Context, repoID int64, fromTime time.Time) db.Session {
 	sess := db.GetEngine(ctx).Where("issue.repo_id = ?", repoID).
 		And("issue.is_pull = ?", false).
 		And(builder.Or(
@@ -343,7 +342,7 @@ func activeIssues(ctx context.Context, repoID int64, fromTime time.Time) *xorm.S
 	return sess
 }

-func issuesForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time, closed, unresolved bool) *xorm.Session {
+func issuesForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time, closed, unresolved bool) db.Session {
 	sess := db.GetEngine(ctx).Where("issue.repo_id = ?", repoID).
 		And("issue.is_closed = ?", closed)

@@ -385,7 +384,7 @@ func (stats *ActivityStats) FillReleases(ctx context.Context, repoID int64, from
 	return nil
 }

-func releasesForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time) *xorm.Session {
+func releasesForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time) db.Session {
 	return db.GetEngine(ctx).Where("`release`.repo_id = ?", repoID).
 		And("`release`.is_draft = ?", false).
 		And("`release`.created_unix >= ?", fromTime.Unix())
@@ -12,7 +12,6 @@ import (
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"

-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )

@@ -27,7 +26,7 @@ type CheckCollationsResult struct {
 	InconsistentCollationColumns []string
 }

-func findAvailableCollationsMySQL(x *xorm.Engine) (ret container.Set[string], err error) {
+func findAvailableCollationsMySQL(x EngineMigration) (ret container.Set[string], err error) {
 	var res []struct {
 		Collation string
 	}
@@ -41,7 +40,7 @@ func findAvailableCollationsMySQL(x *xorm.Engine) (ret container.Set[string], er
 	return ret, nil
 }

-func findAvailableCollationsMSSQL(x *xorm.Engine) (ret container.Set[string], err error) {
+func findAvailableCollationsMSSQL(x EngineMigration) (ret container.Set[string], err error) {
 	var res []struct {
 		Name string
 	}
@@ -55,7 +54,7 @@ func findAvailableCollationsMSSQL(x *xorm.Engine) (ret container.Set[string], er
 	return ret, nil
 }

-func CheckCollations(x *xorm.Engine) (*CheckCollationsResult, error) {
+func CheckCollations(x EngineMigration) (*CheckCollationsResult, error) {
 	dbTables, err := x.DBMetas()
 	if err != nil {
 		return nil, err
@@ -143,7 +142,7 @@ func CheckCollationsDefaultEngine() (*CheckCollationsResult, error) {
 	return CheckCollations(xormEngine)
 }

-func alterDatabaseCollation(x *xorm.Engine, collation string) error {
+func alterDatabaseCollation(x EngineMigration, collation string) error {
 	if x.Dialect().URI().DBType == schemas.MYSQL {
 		_, err := x.Exec("ALTER DATABASE CHARACTER SET utf8mb4 COLLATE " + collation)
 		return err
@@ -156,7 +155,7 @@ func alterDatabaseCollation(x *xorm.Engine, collation string) error {
 }

 // preprocessDatabaseCollation checks database & table column collation, and alter the database collation if needed
-func preprocessDatabaseCollation(x *xorm.Engine) {
+func preprocessDatabaseCollation(x EngineMigration) {
 	r, err := CheckCollations(x)
 	if err != nil {
 		log.Error("Failed to check database collation: %v", err)
@@ -16,6 +16,10 @@ import (
 	_ "github.com/microsoft/go-mssqldb" // Needed for the MSSQL driver

 	"xorm.io/xorm"
+	"xorm.io/xorm/core"
+	"xorm.io/xorm/dialects"
+	"xorm.io/xorm/names"
+	"xorm.io/xorm/schemas"
 )

 var (
@@ -33,6 +37,7 @@ type Engine interface {
 	Truncate(...any) (int64, error)
 	Exec(...any) (sql.Result, error)
 	Find(any, ...any) error
+	FindAndCount(any, ...any) (int64, error)
 	Get(beans ...any) (bool, error)
 	ID(any) *xorm.Session
 	In(string, ...any) *xorm.Session
@@ -61,9 +66,41 @@ type Engine interface {
 	IsTableExist(tableNameOrBean any) (bool, error)
 }

+// Session represents a xorm session interface, used as an abstraction over *xorm.Session.
+type Session interface {
+	Engine
+	And(query any, args ...any) *xorm.Session
+	Begin() error
+	Close() error
+	Commit() error
+	IsInTx() bool
+	Rollback() error
+	Engine() *xorm.Engine
+}
+
+// EngineMigration is a xorm engine interface used for migrations.
+// It extends Engine with additional methods that are only available on the engine (not on the session)
+// and are needed by the migration packages.
+type EngineMigration interface {
+	Engine
+	Close() error
+	DB() *core.DB
+	DBMetas() ([]*schemas.Table, error)
+	Dialect() dialects.Dialect
+	DropTables(beans ...any) error
+	NewSession() *xorm.Session
+	QueryInterface(sqlOrArgs ...any) ([]map[string]any, error)
+	SetMapper(mapper names.Mapper)
+	SyncWithOptions(opts xorm.SyncOptions, beans ...any) (*xorm.SyncResult, error)
+	TableInfo(bean any) (*schemas.Table, error)
+	TableName(bean any, includeSchema ...bool) string
+}
+
 var (
-	_ Engine = (*xorm.Engine)(nil)
-	_ Engine = (*xorm.Session)(nil)
+	_ Engine          = (*xorm.Engine)(nil)
+	_ Engine          = (*xorm.Session)(nil)
+	_ Session         = (*xorm.Session)(nil)
+	_ EngineMigration = (*xorm.Engine)(nil)
 )

 // RegisterModel registers model, if initFuncs provided, it will be invoked after data model sync
@@ -92,7 +92,7 @@ func UnsetDefaultEngine() {
 // When called from the "doctor" command, the migration function is a version check
 // that prevents the doctor from fixing anything in the database if the migration level
 // is different from the expected value.
-func InitEngineWithMigration(ctx context.Context, migrateFunc func(context.Context, *xorm.Engine) error) (err error) {
+func InitEngineWithMigration(ctx context.Context, migrateFunc func(context.Context, EngineMigration) error) (err error) {
 	if err = InitEngine(ctx); err != nil {
 		return err
 	}
@@ -9,7 +9,6 @@ import (
 	"code.gitea.io/gitea/modules/setting"

 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

 const (
@@ -25,7 +24,7 @@ type Paginator interface {
 }

 // SetSessionPagination sets pagination for a database session
-func SetSessionPagination(sess Engine, p Paginator) *xorm.Session {
+func SetSessionPagination(sess Engine, p Paginator) Session {
 	skip, take := p.GetSkipTake()

 	return sess.Limit(take, skip)
@@ -101,7 +101,7 @@ func (opts FindBranchOptions) ToOrders() string {
 func FindBranchNames(ctx context.Context, opts FindBranchOptions) ([]string, error) {
 	sess := db.GetEngine(ctx).Select("name").Where(opts.ToConds())
 	if opts.PageSize > 0 && !opts.IsListAll() {
-		sess = db.SetSessionPagination(sess, &opts.ListOptions)
+		db.SetSessionPagination(sess, &opts.ListOptions)
 	}

 	var branches []string
@@ -25,7 +25,6 @@ import (
 	"code.gitea.io/gitea/modules/translation"

 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

 // CommitStatus holds a single Status of a single Commit
@@ -329,7 +328,7 @@ type CommitStatusIndex struct {
 	MaxIndex int64  `xorm:"index"`
 }

-func makeRepoCommitQuery(ctx context.Context, repoID int64, sha string) *xorm.Session {
+func makeRepoCommitQuery(ctx context.Context, repoID int64, sha string) db.Session {
 	return db.GetEngine(ctx).Table(&CommitStatus{}).
 		Where("repo_id = ?", repoID).And("sha = ?", sha)
 }
@@ -337,12 +336,10 @@ func makeRepoCommitQuery(ctx context.Context, repoID int64, sha string) *xorm.Se
 // GetLatestCommitStatus returns all statuses with a unique context for a given commit.
 func GetLatestCommitStatus(ctx context.Context, repoID int64, sha string, listOptions db.ListOptions) ([]*CommitStatus, error) {
 	indices := make([]int64, 0, 10)
-	sess := makeRepoCommitQuery(ctx, repoID, sha).
-		Select("max( `index` ) as `index`").
-		GroupBy("context_hash").
-		OrderBy("max( `index` ) desc")
+	sess := makeRepoCommitQuery(ctx, repoID, sha)
+	sess.Select("max( `index` ) as `index`").GroupBy("context_hash").OrderBy("max( `index` ) desc")
 	if !listOptions.IsListAll() {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 	}
 	if err := sess.Find(&indices); err != nil {
 		return nil, err
@@ -372,7 +369,7 @@ func GetLatestCommitStatusForPairs(ctx context.Context, repoSHAs []RepoSHA) (map

 	results := make([]result, 0, len(repoSHAs))

-	getBase := func() *xorm.Session {
+	getBase := func() db.Session {
 		return db.GetEngine(ctx).Table(&CommitStatus{})
 	}

@@ -425,7 +422,7 @@ func GetLatestCommitStatusForRepoCommitIDs(ctx context.Context, repoID int64, co
 		SHA   string
 	}

-	getBase := func() *xorm.Session {
+	getBase := func() db.Session {
 		return db.GetEngine(ctx).Table(&CommitStatus{}).Where("repo_id = ?", repoID)
 	}
 	results := make([]result, 0, len(commitIDs))
@@ -1124,7 +1124,7 @@ func FindComments(ctx context.Context, opts *FindCommentsOptions) (CommentList,
 	}

 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, opts)
+		db.SetSessionPagination(sess, opts)
 	}

 	// WARNING: If you change this order you will need to fix createCodeComment
@@ -682,7 +682,7 @@ func (issue *Issue) BlockedByDependencies(ctx context.Context, opts db.ListOptio
 		// sort by repo id then created date, with the issues of the same repo at the beginning of the list
 		OrderBy("CASE WHEN issue.repo_id = ? THEN 0 ELSE issue.repo_id END, issue.created_unix DESC", issue.RepoID)
 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)
 	}
 	total, err = sess.FindAndCount(&issueDeps)

@@ -19,7 +19,6 @@ import (
 	"code.gitea.io/gitea/modules/util"

 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

 const ScopeSortPrefix = "scope-"
@@ -71,7 +70,7 @@ func (o *IssuesOptions) Copy(edit ...func(options *IssuesOptions)) *IssuesOption

 // applySorts sort an issues-related session based on the provided
 // sortType string
-func applySorts(sess *xorm.Session, sortType string, priorityRepoID int64) {
+func applySorts(sess db.Session, sortType string, priorityRepoID int64) {
 	// Since this sortType is dynamically created, it has to be treated specially.
 	if after, ok := strings.CutPrefix(sortType, ScopeSortPrefix); ok {
 		scope := after
@@ -129,7 +128,7 @@ func applySorts(sess *xorm.Session, sortType string, priorityRepoID int64) {
 	}
 }

-func applyLimit(sess *xorm.Session, opts *IssuesOptions) {
+func applyLimit(sess db.Session, opts *IssuesOptions) {
 	if opts.Paginator == nil || opts.Paginator.IsListAll() {
 		return
 	}
@@ -141,7 +140,7 @@ func applyLimit(sess *xorm.Session, opts *IssuesOptions) {
 	sess.Limit(opts.Paginator.PageSize, start)
 }

-func applyLabelsCondition(sess *xorm.Session, opts *IssuesOptions) {
+func applyLabelsCondition(sess db.Session, opts *IssuesOptions) {
 	if len(opts.LabelIDs) > 0 {
 		if opts.LabelIDs[0] == 0 {
 			sess.Where("issue.id NOT IN (SELECT issue_id FROM issue_label)")
@@ -182,7 +181,7 @@ func applyLabelsCondition(sess *xorm.Session, opts *IssuesOptions) {
 	}
 }

-func applyMilestoneCondition(sess *xorm.Session, opts *IssuesOptions) {
+func applyMilestoneCondition(sess db.Session, opts *IssuesOptions) {
 	if len(opts.MilestoneIDs) == 1 && opts.MilestoneIDs[0] == db.NoConditionID {
 		sess.And("issue.milestone_id = 0")
 	} else if len(opts.MilestoneIDs) > 0 {
@@ -197,7 +196,7 @@ func applyMilestoneCondition(sess *xorm.Session, opts *IssuesOptions) {
 	}
 }

-func applyProjectCondition(sess *xorm.Session, opts *IssuesOptions) {
+func applyProjectCondition(sess db.Session, opts *IssuesOptions) {
 	projectIDs := util.SliceRemoveAll(opts.ProjectIDs, 0)
 	if len(projectIDs) == 1 && projectIDs[0] == db.NoConditionID { // show those that are in no project
 		sess.And(builder.NotIn("issue.id", builder.Select("issue_id").From("project_issue")))
@@ -211,7 +210,7 @@ func applyProjectCondition(sess *xorm.Session, opts *IssuesOptions) {
 	// do not need to apply any condition
 }

-func applyRepoConditions(sess *xorm.Session, opts *IssuesOptions) {
+func applyRepoConditions(sess db.Session, opts *IssuesOptions) {
 	if len(opts.RepoIDs) == 1 {
 		opts.RepoCond = builder.Eq{"issue.repo_id": opts.RepoIDs[0]}
 	} else if len(opts.RepoIDs) > 1 {
@@ -228,7 +227,7 @@ func applyRepoConditions(sess *xorm.Session, opts *IssuesOptions) {
 	}
 }

-func applyConditions(sess *xorm.Session, opts *IssuesOptions) {
+func applyConditions(sess db.Session, opts *IssuesOptions) {
 	if len(opts.IssueIDs) > 0 {
 		sess.In("issue.id", opts.IssueIDs)
 	}
@@ -362,7 +361,7 @@ func issuePullAccessibleRepoCond(repoIDstr string, userID int64, owner *user_mod
 	return cond
 }

-func applyAssigneeCondition(sess *xorm.Session, assigneeID string) {
+func applyAssigneeCondition(sess db.Session, assigneeID string) {
 	// old logic: 0 is also treated as "not filtering assignee", because the "assignee" was read as FormInt64
 	if assigneeID == "(none)" {
 		sess.Where("issue.id NOT IN (SELECT issue_id FROM issue_assignees)")
@@ -374,7 +373,7 @@ func applyAssigneeCondition(sess *xorm.Session, assigneeID string) {
 	}
 }

-func applyPosterCondition(sess *xorm.Session, posterID string) {
+func applyPosterCondition(sess db.Session, posterID string) {
 	// Actually every issue has a poster.
 	// The "(none)" is for internal usage only: when doer tries to search non-existing user as poster, use "(none)" to return empty result.
 	if posterID == "(none)" {
@@ -384,13 +383,13 @@ func applyPosterCondition(sess *xorm.Session, posterID string) {
 	}
 }

-func applyMentionedCondition(sess *xorm.Session, mentionedID int64) {
+func applyMentionedCondition(sess db.Session, mentionedID int64) {
 	sess.Join("INNER", "issue_user", "issue.id = issue_user.issue_id").
 		And("issue_user.is_mentioned = ?", true).
 		And("issue_user.uid = ?", mentionedID)
 }

-func applyReviewRequestedCondition(sess *xorm.Session, reviewRequestedID int64) {
+func applyReviewRequestedCondition(sess db.Session, reviewRequestedID int64) {
 	existInTeamQuery := builder.Select("team_user.team_id").
 		From("team_user").
 		Where(builder.Eq{"team_user.uid": reviewRequestedID})
@@ -415,7 +414,7 @@ func applyReviewRequestedCondition(sess *xorm.Session, reviewRequestedID int64)
 		And(builder.In("issue.id", subQuery))
 }

-func applyReviewedCondition(sess *xorm.Session, reviewedID int64) {
+func applyReviewedCondition(sess db.Session, reviewedID int64) {
 	// Query for pull requests where you are a reviewer or commenter, excluding
 	// any pull requests already returned by the review requested filter.
 	notPoster := builder.Neq{"issue.poster_id": reviewedID}
@@ -445,7 +444,7 @@ func applyReviewedCondition(sess *xorm.Session, reviewedID int64) {
 	sess.And(notPoster, builder.Or(reviewed, commented))
 }

-func applySubscribedCondition(sess *xorm.Session, subscriberID int64) {
+func applySubscribedCondition(sess db.Session, subscriberID int64) {
 	sess.And(
 		builder.
 			NotIn("issue.id",
@@ -10,7 +10,6 @@ import (
 	"code.gitea.io/gitea/models/db"

 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

 // IssueStats represents issue statistic information.
@@ -129,7 +128,7 @@ func getIssueStatsChunk(ctx context.Context, opts *IssuesOptions, issueIDs []int
 	return stats, err
 }

-func applyIssuesOptions(sess *xorm.Session, opts *IssuesOptions, issueIDs []int64) *xorm.Session {
+func applyIssuesOptions(sess db.Session, opts *IssuesOptions, issueIDs []int64) db.Session {
 	if len(opts.RepoIDs) > 1 {
 		sess.In("issue.repo_id", opts.RepoIDs)
 	} else if len(opts.RepoIDs) == 1 {
@@ -106,7 +106,7 @@ func GetIssueWatchers(ctx context.Context, issueID int64, listOptions db.ListOpt
 		Join("INNER", "`user`", "`user`.id = `issue_watch`.user_id")

 	if listOptions.Page > 0 {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 		watches := make([]*IssueWatch, 0, listOptions.PageSize)
 		return watches, sess.Find(&watches)
 	}
@@ -396,7 +396,7 @@ func GetLabelsByRepoID(ctx context.Context, repoID int64, sortType string, listO
 	}

 	if listOptions.Page > 0 {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 	}

 	return labels, sess.Find(&labels)
@@ -471,7 +471,7 @@ func GetLabelsByOrgID(ctx context.Context, orgID int64, sortType string, listOpt
 	}

 	if listOptions.Page > 0 {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 	}

 	return labels, sess.Find(&labels)
@@ -18,7 +18,6 @@ import (
 	"code.gitea.io/gitea/modules/util"

 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

 // PullRequestsOptions holds the options for PRs
@@ -32,7 +31,7 @@ type PullRequestsOptions struct {
 	BaseBranch  string
 }

-func listPullRequestStatement(ctx context.Context, baseRepoID int64, opts *PullRequestsOptions) *xorm.Session {
+func listPullRequestStatement(ctx context.Context, baseRepoID int64, opts *PullRequestsOptions) db.Session {
 	sess := db.GetEngine(ctx).Where("pull_request.base_repo_id=?", baseRepoID)

 	if opts.BaseBranch != "" {
@@ -165,7 +165,7 @@ func FindReactions(ctx context.Context, opts FindReactionsOptions) (ReactionList
 		In("reaction.`type`", setting.UI.Reactions).
 		Asc("reaction.issue_id", "reaction.comment_id", "reaction.created_unix", "reaction.id")
 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)

 		reactions := make([]*Reaction, 0, opts.PageSize)
 		count, err := sess.FindAndCount(&reactions)
@@ -121,7 +121,7 @@ func FindReviews(ctx context.Context, opts FindReviewOptions) (ReviewList, error
 	reviews := make([]*Review, 0, 10)
 	sess := db.GetEngine(ctx).Where(opts.toCond())
 	if opts.Page > 0 && !opts.IsListAll() {
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)
 	}
 	return reviews, sess.
 		Asc("created_unix").
@@ -135,7 +135,7 @@ func FindLatestReviews(ctx context.Context, opts FindReviewOptions) (ReviewList,
 	cond := opts.toCond()
 	sess := db.GetEngine(ctx).Where(cond)
 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)
 	}

 	sess.In("id", builder.
@@ -77,7 +77,7 @@ func GetUserStopwatches(ctx context.Context, userID int64, listOptions db.ListOp
 	sws := make([]*Stopwatch, 0, 8)
 	sess := db.GetEngine(ctx).Where("stopwatch.user_id = ?", userID)
 	if listOptions.Page > 0 {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 	}

 	err := sess.Find(&sws)
@@ -16,7 +16,6 @@ import (
 	"code.gitea.io/gitea/modules/util"

 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

 // TrackedTime represents a time that was spent for a specific issue.
@@ -140,7 +139,7 @@ func (opts *FindTrackedTimesOptions) toSession(e db.Engine) db.Engine {
 	sess = sess.Where(opts.ToConds())

 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, opts)
+		db.SetSessionPagination(sess, opts)
 	}

 	return sess
@@ -344,7 +343,7 @@ func GetIssueTotalTrackedTime(ctx context.Context, opts *IssuesOptions, isClosed
 }

 func getIssueTotalTrackedTimeChunk(ctx context.Context, opts *IssuesOptions, isClosed optional.Option[bool], issueIDs []int64) (int64, error) {
-	sumSession := func(opts *IssuesOptions, issueIDs []int64) *xorm.Session {
+	sumSession := func(opts *IssuesOptions, issueIDs []int64) db.Session {
 		sess := db.GetEngine(ctx).
 			Table("tracked_time").
 			Where("tracked_time.deleted = ?", false).
@@ -359,7 +358,7 @@ func getIssueTotalTrackedTimeChunk(ctx context.Context, opts *IssuesOptions, isC

 	session := sumSession(opts, issueIDs)
 	if isClosed.Has() {
-		session = session.And("issue.is_closed = ?", isClosed.Value())
+		session.And("issue.is_closed = ?", isClosed.Value())
 	}
 	return session.SumInt(new(trackedTime), "tracked_time.time")
 }
@@ -11,17 +11,17 @@ import (
 	"regexp"
 	"strings"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"

-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )

 // RecreateTables will recreate the tables for the provided beans using the newly provided bean definition and move all data to that new table
 // WARNING: YOU MUST PROVIDE THE FULL BEAN DEFINITION
-func RecreateTables(beans ...any) func(*xorm.Engine) error {
-	return func(x *xorm.Engine) error {
+func RecreateTables(beans ...any) func(db.EngineMigration) error {
+	return func(x db.EngineMigration) error {
 		sess := x.NewSession()
 		defer sess.Close()
 		if err := sess.Begin(); err != nil {
@@ -41,7 +41,7 @@ func RecreateTables(beans ...any) func(*xorm.Engine) error {
 // RecreateTable will recreate the table using the newly provided bean definition and move all data to that new table
 // WARNING: YOU MUST PROVIDE THE FULL BEAN DEFINITION
 // WARNING: YOU MUST COMMIT THE SESSION AT THE END
-func RecreateTable(sess *xorm.Session, bean any) error {
+func RecreateTable(sess db.Session, bean any) error {
 	// TODO: This will not work if there are foreign keys

 	tableName := sess.Engine().TableName(bean)
@@ -304,7 +304,7 @@ func RecreateTable(sess *xorm.Session, bean any) error {
 }

 // WARNING: YOU MUST COMMIT THE SESSION AT THE END
-func DropTableColumns(sess *xorm.Session, tableName string, columnNames ...string) (err error) {
+func DropTableColumns(sess db.Session, tableName string, columnNames ...string) (err error) {
 	if tableName == "" || len(columnNames) == 0 {
 		return nil
 	}
@@ -474,7 +474,7 @@ func DropTableColumns(sess *xorm.Session, tableName string, columnNames ...strin
 }

 // ModifyColumn will modify column's type or other property. SQLITE is not supported
-func ModifyColumn(x *xorm.Engine, tableName string, col *schemas.Column) error {
+func ModifyColumn(x db.EngineMigration, tableName string, col *schemas.Column) error {
 	var indexes map[string]*schemas.Index
 	var err error
 	// MSSQL have to remove index at first, otherwise alter column will fail
@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/migrations/v1_10"
 	"code.gitea.io/gitea/models/migrations/v1_11"
 	"code.gitea.io/gitea/models/migrations/v1_12"
@@ -35,7 +36,6 @@ import (
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"

-	"xorm.io/xorm"
 	"xorm.io/xorm/names"
 )

@@ -44,23 +44,23 @@ const minDBVersion = 70 // Gitea 1.5.3
 type migration struct {
 	idNumber    int64 // DB version is "the last migration's idNumber" + 1
 	description string
-	migrate     func(context.Context, *xorm.Engine) error
+	migrate     func(context.Context, db.EngineMigration) error
 }

 // newMigration creates a new migration
-func newMigration[T func(*xorm.Engine) error | func(context.Context, *xorm.Engine) error](idNumber int64, desc string, fn T) *migration {
+func newMigration[T func(db.EngineMigration) error | func(context.Context, db.EngineMigration) error](idNumber int64, desc string, fn T) *migration {
 	m := &migration{idNumber: idNumber, description: desc}
 	var ok bool
-	if m.migrate, ok = any(fn).(func(context.Context, *xorm.Engine) error); !ok {
-		m.migrate = func(ctx context.Context, x *xorm.Engine) error {
-			return any(fn).(func(*xorm.Engine) error)(x)
+	if m.migrate, ok = any(fn).(func(context.Context, db.EngineMigration) error); !ok {
+		m.migrate = func(ctx context.Context, x db.EngineMigration) error {
+			return any(fn).(func(db.EngineMigration) error)(x)
 		}
 	}
 	return m
 }

 // Migrate executes the migration
-func (m *migration) Migrate(ctx context.Context, x *xorm.Engine) error {
+func (m *migration) Migrate(ctx context.Context, x db.EngineMigration) error {
 	return m.migrate(ctx, x)
 }

@@ -71,7 +71,7 @@ type Version struct {
 }

 // Use noopMigration when there is a migration that has been no-oped
-var noopMigration = func(_ *xorm.Engine) error { return nil }
+var noopMigration = func(_ db.EngineMigration) error { return nil }

 var preparedMigrations []*migration

@@ -417,7 +417,7 @@ func prepareMigrationTasks() []*migration {
 }

 // GetCurrentDBVersion returns the current db version
-func GetCurrentDBVersion(x *xorm.Engine) (int64, error) {
+func GetCurrentDBVersion(x db.EngineMigration) (int64, error) {
 	if err := x.Sync(new(Version)); err != nil {
 		return -1, fmt.Errorf("sync: %w", err)
 	}
@@ -450,7 +450,7 @@ func ExpectedDBVersion() int64 {
 }

 // EnsureUpToDate will check if the db is at the correct version
-func EnsureUpToDate(ctx context.Context, x *xorm.Engine) error {
+func EnsureUpToDate(ctx context.Context, x db.EngineMigration) error {
 	currentDB, err := GetCurrentDBVersion(x)
 	if err != nil {
 		return err
@@ -482,7 +482,7 @@ func migrationIDNumberToDBVersion(idNumber int64) int64 {
 }

 // Migrate database to current version
-func Migrate(ctx context.Context, x *xorm.Engine) error {
+func Migrate(ctx context.Context, x db.EngineMigration) error {
 	migrations := prepareMigrationTasks()
 	maxDBVer := calcDBVersion(migrations)

@@ -501,7 +501,7 @@ func Migrate(ctx context.Context, x *xorm.Engine) error {
 		// XORM model framework will create all tables when initializing.
 		currentVersion.ID = 0
 		currentVersion.Version = maxDBVer
-		if _, err = x.InsertOne(currentVersion); err != nil {
+		if _, err = x.Insert(currentVersion); err != nil {
 			return fmt.Errorf("insert: %w", err)
 		}
 	}
@@ -16,7 +16,6 @@ import (

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )

@@ -24,7 +23,7 @@ import (
 // Provide models to be sync'd with the database - in particular any models you expect fixtures to be loaded from.
 //
 // fixtures in `models/migrations/fixtures/<TestName>` will be loaded automatically
-func PrepareTestEnv(t *testing.T, skip int, syncModels ...any) (*xorm.Engine, func()) {
+func PrepareTestEnv(t *testing.T, skip int, syncModels ...any) (db.EngineMigration, func()) {
 	t.Helper()
 	ourSkip := 2
 	ourSkip += skip
@@ -89,7 +88,7 @@ func PrepareTestEnv(t *testing.T, skip int, syncModels ...any) (*xorm.Engine, fu
 	return x, deferFn
 }

-func LoadTableSchemasMap(t *testing.T, x *xorm.Engine) map[string]*schemas.Table {
+func LoadTableSchemasMap(t *testing.T, x db.EngineMigration) map[string]*schemas.Table {
 	tables, err := x.DBMetas()
 	require.NoError(t, err)
 	tableMap := make(map[string]*schemas.Table)
@@ -8,10 +8,10 @@ import (
 	"strings"
 	"time"

-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
 )

-func UpdateMigrationServiceTypes(x *xorm.Engine) error {
+func UpdateMigrationServiceTypes(x db.EngineMigration) error {
 	type Repository struct {
 		ID                  int64
 		OriginalServiceType int    `xorm:"index default(0)"`
@@ -3,11 +3,9 @@

 package v1_10

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func ChangeSomeColumnsLengthOfExternalLoginUser(x *xorm.Engine) error {
+func ChangeSomeColumnsLengthOfExternalLoginUser(x db.EngineMigration) error {
 	type ExternalLoginUser struct {
 		AccessToken       string `xorm:"TEXT"`
 		AccessTokenSecret string `xorm:"TEXT"`
@@ -7,14 +7,14 @@ import (
 	"crypto/sha1"
 	"fmt"

-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
 )

 func hashContext(context string) string {
 	return fmt.Sprintf("%x", sha1.Sum([]byte(context)))
 }

-func AddCommitStatusContext(x *xorm.Engine) error {
+func AddCommitStatusContext(x db.EngineMigration) error {
 	type CommitStatus struct {
 		ID          int64  `xorm:"pk autoincr"`
 		ContextHash string `xorm:"char(40) index"`
@@ -3,9 +3,9 @@

 package v1_10

-import "xorm.io/xorm"
+import "code.gitea.io/gitea/models/db"

-func AddOriginalMigrationInfo(x *xorm.Engine) error {
+func AddOriginalMigrationInfo(x db.EngineMigration) error {
 	// Issue see models/issue.go
 	type Issue struct {
 		OriginalAuthor   string
@@ -3,9 +3,9 @@

 package v1_10

-import "xorm.io/xorm"
+import "code.gitea.io/gitea/models/db"

-func ChangeSomeColumnsLengthOfRepo(x *xorm.Engine) error {
+func ChangeSomeColumnsLengthOfRepo(x db.EngineMigration) error {
 	type Repository struct {
 		ID          int64  `xorm:"pk autoincr"`
 		Description string `xorm:"TEXT"`
@@ -3,9 +3,9 @@

 package v1_10

-import "xorm.io/xorm"
+import "code.gitea.io/gitea/models/db"

-func AddIndexOnRepositoryAndComment(x *xorm.Engine) error {
+func AddIndexOnRepositoryAndComment(x db.EngineMigration) error {
 	type Repository struct {
 		ID      int64 `xorm:"pk autoincr"`
 		OwnerID int64 `xorm:"index"`
@@ -4,11 +4,12 @@
 package v1_10

 import (
+	"code.gitea.io/gitea/models/db"
+
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

-func RemoveLingeringIndexStatus(x *xorm.Engine) error {
+func RemoveLingeringIndexStatus(x db.EngineMigration) error {
 	_, err := x.Exec(builder.Delete(builder.NotIn("`repo_id`", builder.Select("`id`").From("`repository`"))).From("`repo_indexer_status`"))
 	return err
 }
@@ -3,9 +3,9 @@

 package v1_10

-import "xorm.io/xorm"
+import "code.gitea.io/gitea/models/db"

-func AddEmailNotificationEnabledToUser(x *xorm.Engine) error {
+func AddEmailNotificationEnabledToUser(x db.EngineMigration) error {
 	// User see models/user.go
 	type User struct {
 		EmailNotificationsPreference string `xorm:"VARCHAR(20) NOT NULL DEFAULT 'enabled'"`
@@ -3,9 +3,9 @@

 package v1_10

-import "xorm.io/xorm"
+import "code.gitea.io/gitea/models/db"

-func AddStatusCheckColumnsForProtectedBranches(x *xorm.Engine) error {
+func AddStatusCheckColumnsForProtectedBranches(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		EnableStatusCheck   bool     `xorm:"NOT NULL DEFAULT false"`
 		StatusCheckContexts []string `xorm:"JSON TEXT"`
@@ -3,9 +3,9 @@

 package v1_10

-import "xorm.io/xorm"
+import "code.gitea.io/gitea/models/db"

-func AddCrossReferenceColumns(x *xorm.Engine) error {
+func AddCrossReferenceColumns(x db.EngineMigration) error {
 	// Comment see models/comment.go
 	type Comment struct {
 		RefRepoID    int64 `xorm:"index"`
@@ -6,13 +6,12 @@ package v1_10
 import (
 	"path/filepath"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
-
-	"xorm.io/xorm"
 )

-func DeleteOrphanedAttachments(x *xorm.Engine) error {
+func DeleteOrphanedAttachments(x db.EngineMigration) error {
 	type Attachment struct {
 		ID        int64  `xorm:"pk autoincr"`
 		UUID      string `xorm:"uuid UNIQUE"`
@@ -3,9 +3,9 @@

 package v1_10

-import "xorm.io/xorm"
+import "code.gitea.io/gitea/models/db"

-func AddRepoAdminChangeTeamAccessColumnForUser(x *xorm.Engine) error {
+func AddRepoAdminChangeTeamAccessColumnForUser(x db.EngineMigration) error {
 	type User struct {
 		RepoAdminChangeTeamAccess bool `xorm:"NOT NULL DEFAULT false"`
 	}
@@ -3,9 +3,9 @@

 package v1_10

-import "xorm.io/xorm"
+import "code.gitea.io/gitea/models/db"

-func AddOriginalAuthorOnMigratedReleases(x *xorm.Engine) error {
+func AddOriginalAuthorOnMigratedReleases(x db.EngineMigration) error {
 	type Release struct {
 		ID               int64
 		OriginalAuthor   string
@@ -4,12 +4,11 @@
 package v1_10

 import (
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
 )

-func AddTaskTable(x *xorm.Engine) error {
+func AddTaskTable(x db.EngineMigration) error {
 	// TaskType defines task type
 	type TaskType int

@@ -4,12 +4,11 @@
 package v1_11

 import (
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
 )

-func DropColumnHeadUserNameOnPullRequest(x *xorm.Engine) error {
+func DropColumnHeadUserNameOnPullRequest(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 	if err := sess.Begin(); err != nil {
@@ -3,11 +3,9 @@

 package v1_11

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddWhitelistDeployKeysToBranches(x *xorm.Engine) error {
+func AddWhitelistDeployKeysToBranches(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		ID                  int64
 		WhitelistDeployKeys bool `xorm:"NOT NULL DEFAULT false"`
@@ -4,12 +4,11 @@
 package v1_11

 import (
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
 )

-func RemoveLabelUneededCols(x *xorm.Engine) error {
+func RemoveLabelUneededCols(x db.EngineMigration) error {
 	// Make sure the columns exist before dropping them
 	type Label struct {
 		QueryString string
@@ -3,11 +3,9 @@

 package v1_11

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddTeamIncludesAllRepositories(x *xorm.Engine) error {
+func AddTeamIncludesAllRepositories(x db.EngineMigration) error {
 	type Team struct {
 		ID                      int64 `xorm:"pk autoincr"`
 		IncludesAllRepositories bool  `xorm:"NOT NULL DEFAULT false"`
@@ -3,9 +3,7 @@

 package v1_11

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

 // RepoWatchMode specifies what kind of watch the user has on a repository
 type RepoWatchMode int8
@@ -16,7 +14,7 @@ type Watch struct {
 	Mode RepoWatchMode `xorm:"SMALLINT NOT NULL DEFAULT 1"`
 }

-func AddModeColumnToWatch(x *xorm.Engine) error {
+func AddModeColumnToWatch(x db.EngineMigration) error {
 	if err := x.Sync(new(Watch)); err != nil {
 		return err
 	}
@@ -3,11 +3,9 @@

 package v1_11

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddTemplateToRepo(x *xorm.Engine) error {
+func AddTemplateToRepo(x db.EngineMigration) error {
 	type Repository struct {
 		IsTemplate bool  `xorm:"INDEX NOT NULL DEFAULT false"`
 		TemplateID int64 `xorm:"INDEX"`
@@ -3,11 +3,9 @@

 package v1_11

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddCommentIDOnNotification(x *xorm.Engine) error {
+func AddCommentIDOnNotification(x db.EngineMigration) error {
 	type Notification struct {
 		ID        int64 `xorm:"pk autoincr"`
 		CommentID int64
@@ -3,11 +3,9 @@

 package v1_11

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddCanCreateOrgRepoColumnForTeam(x *xorm.Engine) error {
+func AddCanCreateOrgRepoColumnForTeam(x db.EngineMigration) error {
 	type Team struct {
 		CanCreateOrgRepo bool `xorm:"NOT NULL DEFAULT false"`
 	}
@@ -4,11 +4,12 @@
 package v1_11

 import (
-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
+
 	"xorm.io/xorm/schemas"
 )

-func ChangeReviewContentToText(x *xorm.Engine) error {
+func ChangeReviewContentToText(x db.EngineMigration) error {
 	switch x.Dialect().URI().DBType {
 	case schemas.MYSQL:
 		_, err := x.Exec("ALTER TABLE review MODIFY COLUMN content TEXT")
@@ -7,10 +7,10 @@ import (
 	"fmt"
 	"slices"

-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
 )

-func AddBranchProtectionCanPushAndEnableWhitelist(x *xorm.Engine) error {
+func AddBranchProtectionCanPushAndEnableWhitelist(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		CanPush                   bool    `xorm:"NOT NULL DEFAULT false"`
 		EnableApprovalsWhitelist  bool    `xorm:"NOT NULL DEFAULT false"`
@@ -132,7 +132,7 @@ func AddBranchProtectionCanPushAndEnableWhitelist(x *xorm.Engine) error {
 	}

 	// getUserRepoPermission static function based on issues_model.IsOfficialReviewer at 5d78792385
-	getUserRepoPermission := func(sess *xorm.Session, repo *Repository, user *User) (Permission, error) {
+	getUserRepoPermission := func(sess db.Session, repo *Repository, user *User) (Permission, error) {
 		var perm Permission

 		repoOwner := new(User)
@@ -305,7 +305,7 @@ func AddBranchProtectionCanPushAndEnableWhitelist(x *xorm.Engine) error {
 	}

 	// isOfficialReviewer static function based on 5d78792385
-	isOfficialReviewer := func(sess *xorm.Session, issueID int64, reviewer *User) (bool, error) {
+	isOfficialReviewer := func(sess db.Session, issueID int64, reviewer *User) (bool, error) {
 		pr := new(PullRequest)
 		has, err := sess.ID(issueID).Get(pr)
 		if err != nil {
@@ -6,15 +6,15 @@ package v1_11
 import (
 	"path/filepath"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"

 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

-func RemoveAttachmentMissedRepo(x *xorm.Engine) error {
+func RemoveAttachmentMissedRepo(x db.EngineMigration) error {
 	type Attachment struct {
 		UUID string `xorm:"uuid"`
 	}
@@ -6,10 +6,10 @@ package v1_11
 import (
 	"fmt"

-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
 )

-func FeatureChangeTargetBranch(x *xorm.Engine) error {
+func FeatureChangeTargetBranch(x db.EngineMigration) error {
 	type Comment struct {
 		OldRef string
 		NewRef string
@@ -6,10 +6,10 @@ package v1_11
 import (
 	"net/url"

-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
 )

-func SanitizeOriginalURL(x *xorm.Engine) error {
+func SanitizeOriginalURL(x db.EngineMigration) error {
 	type Repository struct {
 		ID          int64
 		OriginalURL string `xorm:"VARCHAR(2048)"`
@@ -12,15 +12,14 @@ import (
 	"path/filepath"
 	"time"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
-
-	"xorm.io/xorm"
 )

-func RenameExistingUserAvatarName(x *xorm.Engine) error {
+func RenameExistingUserAvatarName(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()

@@ -3,11 +3,9 @@

 package v1_11

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func ExtendTrackedTimes(x *xorm.Engine) error {
+func ExtendTrackedTimes(x db.EngineMigration) error {
 	type TrackedTime struct {
 		Time    int64 `xorm:"NOT NULL"`
 		Deleted bool  `xorm:"NOT NULL DEFAULT false"`
@@ -3,11 +3,9 @@

 package v1_12

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddBlockOnRejectedReviews(x *xorm.Engine) error {
+func AddBlockOnRejectedReviews(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		BlockOnRejectedReviews bool `xorm:"NOT NULL DEFAULT false"`
 	}
@@ -3,11 +3,9 @@

 package v1_12

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddReviewCommitAndStale(x *xorm.Engine) error {
+func AddReviewCommitAndStale(x db.EngineMigration) error {
 	type Review struct {
 		CommitID string `xorm:"VARCHAR(40)"`
 		Stale    bool   `xorm:"NOT NULL DEFAULT false"`
@@ -3,11 +3,9 @@

 package v1_12

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func FixMigratedRepositoryServiceType(x *xorm.Engine) error {
+func FixMigratedRepositoryServiceType(x db.EngineMigration) error {
 	// structs.GithubService:
 	// GithubService = 2
 	_, err := x.Exec("UPDATE repository SET original_service_type = ? WHERE original_url LIKE 'https://github.com/%'", 2)
@@ -3,11 +3,9 @@

 package v1_12

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddOwnerNameOnRepository(x *xorm.Engine) error {
+func AddOwnerNameOnRepository(x db.EngineMigration) error {
 	type Repository struct {
 		OwnerName string
 	}
@@ -3,9 +3,9 @@

 package v1_12

-import "xorm.io/xorm"
+import "code.gitea.io/gitea/models/db"

-func AddIsRestricted(x *xorm.Engine) error {
+func AddIsRestricted(x db.EngineMigration) error {
 	// User see models/user.go
 	type User struct {
 		ID           int64 `xorm:"pk autoincr"`
@@ -3,11 +3,9 @@

 package v1_12

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddRequireSignedCommits(x *xorm.Engine) error {
+func AddRequireSignedCommits(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		RequireSignedCommits bool `xorm:"NOT NULL DEFAULT false"`
 	}
@@ -3,11 +3,9 @@

 package v1_12

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddReactionOriginals(x *xorm.Engine) error {
+func AddReactionOriginals(x db.EngineMigration) error {
 	type Reaction struct {
 		OriginalAuthorID int64 `xorm:"INDEX NOT NULL DEFAULT(0)"`
 		OriginalAuthor   string
@@ -3,11 +3,9 @@

 package v1_12

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddUserRepoMissingColumns(x *xorm.Engine) error {
+func AddUserRepoMissingColumns(x db.EngineMigration) error {
 	type VisibleType int
 	type User struct {
 		PasswdHashAlgo string      `xorm:"NOT NULL DEFAULT 'pbkdf2'"`
@@ -6,10 +6,10 @@ package v1_12
 import (
 	"fmt"

-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
 )

-func AddReviewMigrateInfo(x *xorm.Engine) error {
+func AddReviewMigrateInfo(x db.EngineMigration) error {
 	type Review struct {
 		OriginalAuthor   string
 		OriginalAuthorID int64
@@ -4,11 +4,12 @@
 package v1_12

 import (
+	"code.gitea.io/gitea/models/db"
+
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

-func FixTopicRepositoryCount(x *xorm.Engine) error {
+func FixTopicRepositoryCount(x db.EngineMigration) error {
 	_, err := x.Exec(builder.Delete(builder.NotIn("`repo_id`", builder.Select("`id`").From("`repository`"))).From("`repo_topic`"))
 	if err != nil {
 		return err
@@ -6,12 +6,11 @@ package v1_12
 import (
 	"fmt"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
 )

-func AddLanguageStats(x *xorm.Engine) error {
+func AddLanguageStats(x db.EngineMigration) error {
 	// LanguageStat see models/repo_language_stats.go
 	type LanguageStat struct {
 		ID          int64 `xorm:"pk autoincr"`
@@ -11,15 +11,14 @@ import (
 	"strings"
 	"time"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/git/gitcmd"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
 )

-func FixMergeBase(ctx context.Context, x *xorm.Engine) error {
+func FixMergeBase(ctx context.Context, x db.EngineMigration) error {
 	type Repository struct {
 		ID        int64 `xorm:"pk autoincr"`
 		OwnerID   int64 `xorm:"UNIQUE(s) index"`
@@ -3,11 +3,9 @@

 package v1_12

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func PurgeUnusedDependencies(x *xorm.Engine) error {
+func PurgeUnusedDependencies(x db.EngineMigration) error {
 	if _, err := x.Exec("DELETE FROM issue_dependency WHERE issue_id NOT IN (SELECT id FROM issue)"); err != nil {
 		return err
 	}
@@ -4,13 +4,12 @@
 package v1_12

 import (
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
 )

-func ExpandWebhooks(x *xorm.Engine) error {
+func ExpandWebhooks(x db.EngineMigration) error {
 	type HookEvents struct {
 		Create               bool `json:"create"`
 		Delete               bool `json:"delete"`
@@ -6,10 +6,10 @@ package v1_12
 import (
 	"fmt"

-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
 )

-func AddSystemWebhookColumn(x *xorm.Engine) error {
+func AddSystemWebhookColumn(x db.EngineMigration) error {
 	type Webhook struct {
 		IsSystemWebhook bool `xorm:"NOT NULL DEFAULT false"`
 	}
@@ -6,10 +6,10 @@ package v1_12
 import (
 	"fmt"

-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
 )

-func AddBranchProtectionProtectedFilesColumn(x *xorm.Engine) error {
+func AddBranchProtectionProtectedFilesColumn(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		ProtectedFilePatterns string `xorm:"TEXT"`
 	}
@@ -3,9 +3,9 @@

 package v1_12

-import "xorm.io/xorm"
+import "code.gitea.io/gitea/models/db"

-func AddEmailHashTable(x *xorm.Engine) error {
+func AddEmailHashTable(x db.EngineMigration) error {
 	// EmailHash represents a pre-generated hash map
 	type EmailHash struct {
 		Hash  string `xorm:"pk varchar(32)"`
@@ -11,14 +11,13 @@ import (
 	"strings"
 	"time"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/git/gitcmd"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
 )

-func RefixMergeBase(ctx context.Context, x *xorm.Engine) error {
+func RefixMergeBase(ctx context.Context, x db.EngineMigration) error {
 	type Repository struct {
 		ID        int64 `xorm:"pk autoincr"`
 		OwnerID   int64 `xorm:"UNIQUE(s) index"`
@@ -6,10 +6,10 @@ package v1_12
 import (
 	"fmt"

-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
 )

-func AddOrgIDLabelColumn(x *xorm.Engine) error {
+func AddOrgIDLabelColumn(x db.EngineMigration) error {
 	type Label struct {
 		OrgID int64 `xorm:"INDEX"`
 	}
@@ -8,16 +8,15 @@ import (
 	"math"
 	"time"

+	"code.gitea.io/gitea/models/db"
 	repo_model "code.gitea.io/gitea/models/repo"
 	"code.gitea.io/gitea/modules/gitrepo"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
 )

-func AddCommitDivergenceToPulls(x *xorm.Engine) error {
+func AddCommitDivergenceToPulls(x db.EngineMigration) error {
 	type Repository struct {
 		ID        int64 `xorm:"pk autoincr"`
 		OwnerID   int64 `xorm:"UNIQUE(s) index"`
@@ -3,11 +3,9 @@

 package v1_12

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func AddBlockOnOutdatedBranch(x *xorm.Engine) error {
+func AddBlockOnOutdatedBranch(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		BlockOnOutdatedBranch bool `xorm:"NOT NULL DEFAULT false"`
 	}
@@ -6,10 +6,10 @@ package v1_12
 import (
 	"fmt"

-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
 )

-func AddResolveDoerIDCommentColumn(x *xorm.Engine) error {
+func AddResolveDoerIDCommentColumn(x db.EngineMigration) error {
 	type Comment struct {
 		ResolveDoerID int64
 	}
@@ -4,12 +4,11 @@
 package v1_12

 import (
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
 )

-func PrependRefsHeadsToIssueRefs(x *xorm.Engine) error {
+func PrependRefsHeadsToIssueRefs(x db.EngineMigration) error {
 	var query string

 	switch {
@@ -6,13 +6,12 @@ package v1_13
 import (
 	"fmt"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/models/migrations/base"
 	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
 )

-func FixLanguageStatsToSaveSize(x *xorm.Engine) error {
+func FixLanguageStatsToSaveSize(x db.EngineMigration) error {
 	// LanguageStat see models/repo_language_stats.go
 	type LanguageStat struct {
 		Size int64 `xorm:"NOT NULL DEFAULT 0"`
@@ -6,10 +6,10 @@ package v1_13
 import (
 	"fmt"

-	"xorm.io/xorm"
+	"code.gitea.io/gitea/models/db"
 )

-func AddKeepActivityPrivateUserColumn(x *xorm.Engine) error {
+func AddKeepActivityPrivateUserColumn(x db.EngineMigration) error {
 	type User struct {
 		KeepActivityPrivate bool `xorm:"NOT NULL DEFAULT false"`
 	}
@@ -4,13 +4,13 @@
 package v1_13

 import (
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/log"

 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

-func SetIsArchivedToFalse(x *xorm.Engine) error {
+func SetIsArchivedToFalse(x db.EngineMigration) error {
 	type Repository struct {
 		IsArchived bool `xorm:"INDEX"`
 	}
@@ -4,12 +4,11 @@
 package v1_13

 import (
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/log"
-
-	"xorm.io/xorm"
 )

-func RecalculateStars(x *xorm.Engine) (err error) {
+func RecalculateStars(x db.EngineMigration) (err error) {
 	// because of issue https://github.com/go-gitea/gitea/issues/11949,
 	// recalculate Stars number for all users to fully fix it.

@@ -4,13 +4,13 @@
 package v1_13

 import (
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/log"

 	"xorm.io/builder"
-	"xorm.io/xorm"
 )

-func UpdateMatrixWebhookHTTPMethod(x *xorm.Engine) error {
+func UpdateMatrixWebhookHTTPMethod(x db.EngineMigration) error {
 	matrixHookTaskType := 9 // value comes from the models package
 	type Webhook struct {
 		HTTPMethod string
@@ -6,12 +6,11 @@ package v1_13
 import (
 	"fmt"

+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
 )

-func IncreaseLanguageField(x *xorm.Engine) error {
+func IncreaseLanguageField(x db.EngineMigration) error {
 	type LanguageStat struct {
 		RepoID   int64  `xorm:"UNIQUE(s) INDEX NOT NULL"`
 		Language string `xorm:"VARCHAR(50) UNIQUE(s) INDEX NOT NULL"`
@@ -4,12 +4,11 @@
 package v1_13

 import (
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
 )

-func AddProjectsInfo(x *xorm.Engine) error {
+func AddProjectsInfo(x db.EngineMigration) error {
 	// Create new tables
 	type (
 		ProjectType      uint8
@@ -4,12 +4,11 @@
 package v1_13

 import (
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
 )

-func CreateReviewsForCodeComments(x *xorm.Engine) error {
+func CreateReviewsForCodeComments(x db.EngineMigration) error {
 	// Review
 	type Review struct {
 		ID               int64 `xorm:"pk autoincr"`
@@ -3,11 +3,9 @@

 package v1_13

-import (
-	"xorm.io/xorm"
-)
+import "code.gitea.io/gitea/models/db"

-func PurgeInvalidDependenciesComments(x *xorm.Engine) error {
+func PurgeInvalidDependenciesComments(x db.EngineMigration) error {
 	_, err := x.Exec("DELETE FROM comment WHERE dependent_issue_id != 0 AND dependent_issue_id NOT IN (SELECT id FROM issue)")
 	return err
 }