diff --git a/.gitattributes b/.gitattributes
index afd02555f59..3ddb8f641ba 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -4,6 +4,7 @@
 /assets/*.json linguist-generated
 /public/assets/img/svg/*.svg linguist-generated
 /templates/swagger/v1_json.tmpl linguist-generated
+/templates/swagger/v1_openapi3_json.tmpl linguist-generated
 /options/fileicon/** linguist-generated
 /vendor/** -text -eol linguist-vendored
 /web_src/js/vendor/** -text -eol linguist-vendored
diff --git a/.gitea/issue_template.md b/.gitea/issue_template.md
deleted file mode 100644
index cf173a67cae..00000000000
--- a/.gitea/issue_template.md
+++ /dev/null
@@ -1,42 +0,0 @@
-<!-- NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue -->
-
-<!--
-    1. Please speak English, this is the language all maintainers can speak and write.
-    2. Please ask questions or configuration/deploy problems on our Discord
-       server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
-    3. Please take a moment to check that your issue doesn't already exist.
-    4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
-    5. Please give all relevant information below for bug reports, because
-       incomplete details will be handled as an invalid report.
--->
-
-- Gitea version (or commit ref):
-- Git version:
-- Operating system:
-  <!-- Please include information on whether you built gitea yourself, used one of our downloads or are using some other package -->
-  <!-- Please also tell us how you are running gitea, e.g. if it is being run from docker, a command-line, systemd etc. --->
-  <!-- If you are using a package or systemd tell us what distribution you are using -->
-- Database (use `[x]`):
-  - [ ] PostgreSQL
-  - [ ] MySQL
-  - [ ] MSSQL
-  - [ ] SQLite
-- Can you reproduce the bug at https://demo.gitea.com:
-  - [ ] Yes (provide example URL)
-  - [ ] No
-- Log gist:
-<!-- It really is important to provide pertinent logs -->
-<!-- Please read https://docs.gitea.com/administration/logging-config#collecting-logs-for-help -->
-<!-- In addition, if your problem relates to git commands set `RUN_MODE=dev` at the top of app.ini -->
-
-## Description
-<!-- If using a proxy or a CDN (e.g. CloudFlare) in front of gitea, please
-     disable the proxy/CDN fully and connect to gitea directly to confirm
-     the issue still persists without those services. -->
-
-...
-
-
-## Screenshots
-
-<!-- **If this issue involves the Web Interface, please include a screenshot** -->
diff --git a/.github/ISSUE_TEMPLATE/bug-report.yaml b/.github/ISSUE_TEMPLATE/bug-report.yaml
index 4dbe1a4c56d..e793e068bb8 100644
--- a/.github/ISSUE_TEMPLATE/bug-report.yaml
+++ b/.github/ISSUE_TEMPLATE/bug-report.yaml
@@ -1,91 +1,28 @@
 name: Bug Report
-description: Found something you weren't expecting? Report it here!
+description: Something isn't working as expected.
 labels: ["type/bug"]
 body:
   - type: markdown
     attributes:
       value: |
-        NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue.
-  - type: markdown
-    attributes:
-      value: |
-        1. Please speak English, this is the language all maintainers can speak and write.
-        2. Please ask questions or configuration/deploy problems on our Discord
-           server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
-        3. Make sure you are using the latest release and
-           take a moment to check that your issue hasn't been reported before.
-        4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
-        5. It's really important to provide pertinent details and logs (https://docs.gitea.com/help/support),
-           incomplete details will be handled as an invalid report.
-  - type: textarea
-    id: description
-    attributes:
-      label: Description
-      description: |
-        Please provide a description of your issue here, with a URL if you were able to reproduce the issue (see below)
-        If you are using a proxy or a CDN (e.g. Cloudflare) in front of Gitea, please disable the proxy/CDN fully and access Gitea directly to confirm the issue still persists without those services.
+        - **Security issue?** Email security@gitea.io instead of opening a public issue.
+        - **Need help** with setup or configuration? Ask on [Discord](https://discord.gg/Gitea) or the [forum](https://forum.gitea.com).
+        - Search [existing issues](https://github.com/go-gitea/gitea/issues?q=is%3Aissue) first.
   - type: input
     id: gitea-ver
     attributes:
       label: Gitea Version
-      description: Gitea version (or commit reference) of your instance
     validations:
       required: true
-  - type: dropdown
-    id: can-reproduce
+  - type: textarea
+    id: description
     attributes:
-      label: Can you reproduce the bug on the Gitea demo site?
-      description: |
-        If so, please provide a URL in the Description field
-        URL of Gitea demo: https://demo.gitea.com
-      options:
-        - "Yes"
-        - "No"
+      label: What happened?
+      description: What you did, what you expected to happen, and what happened instead. Include logs if relevant.
     validations:
       required: true
-  - type: markdown
-    attributes:
-      value: |
-        It's really important to provide pertinent logs
-        Please read https://docs.gitea.com/administration/logging-config#collecting-logs-for-help
-        In addition, if your problem relates to git commands set `RUN_MODE=dev` at the top of app.ini
-  - type: input
-    id: logs
-    attributes:
-      label: Log Gist
-      description: Please provide a gist URL of your logs, with any sensitive information (e.g. API keys) removed/hidden
   - type: textarea
-    id: screenshots
-    attributes:
-      label: Screenshots
-      description: If this issue involves the Web Interface, please provide one or more screenshots
-  - type: input
-    id: git-ver
-    attributes:
-      label: Git Version
-      description: The version of git running on the server
-  - type: input
-    id: os-ver
-    attributes:
-      label: Operating System
-      description: The operating system you are using to run Gitea
-  - type: textarea
-    id: run-info
+    id: environment
     attributes:
       label: How are you running Gitea?
-      description: |
-        Please include information on whether you built Gitea yourself, used one of our downloads, are using https://demo.gitea.com or are using some other package
-        Please also tell us how you are running Gitea, e.g. if it is being run from docker, a command-line, systemd etc.
-        If you are using a package or systemd tell us what distribution you are using
-    validations:
-      required: true
-  - type: dropdown
-    id: database
-    attributes:
-      label: Database
-      description: What database system are you running?
-      options:
-        - PostgreSQL
-        - MySQL/MariaDB
-        - MSSQL
-        - SQLite
+      description: Install method (binary, Docker, package), operating system, and database.
diff --git a/.github/ISSUE_TEMPLATE/feature-request.yaml b/.github/ISSUE_TEMPLATE/feature-request.yaml
index d5c480d2023..3ad0fb9e643 100644
--- a/.github/ISSUE_TEMPLATE/feature-request.yaml
+++ b/.github/ISSUE_TEMPLATE/feature-request.yaml
@@ -1,24 +1,20 @@
 name: Feature Request
-description: Got an idea for a feature that Gitea doesn't have currently?  Submit your idea here!
+description: Suggest an idea for Gitea.
 labels: ["type/proposal"]
 body:
   - type: markdown
     attributes:
       value: |
-        1. Please speak English, this is the language all maintainers can speak and write.
-        2. Please ask questions or configuration/deploy problems on our Discord
-           server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
-        3. Please take a moment to check that your feature hasn't already been suggested.
+        Search [existing issues](https://github.com/go-gitea/gitea/issues?q=is%3Aissue) first.
   - type: textarea
-    id: description
+    id: problem
     attributes:
-      label: Feature Description
-      placeholder: |
-        I think it would be great if Gitea had...
+      label: What problem would this solve?
     validations:
       required: true
   - type: textarea
-    id: screenshots
+    id: proposal
     attributes:
-      label: Screenshots
-      description: If you can, provide screenshots of an implementation on another site e.g. GitHub
+      label: What do you propose?
+    validations:
+      required: true
diff --git a/.github/ISSUE_TEMPLATE/ui.bug-report.yaml b/.github/ISSUE_TEMPLATE/ui.bug-report.yaml
deleted file mode 100644
index 3ad5dbaf54e..00000000000
--- a/.github/ISSUE_TEMPLATE/ui.bug-report.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-name: Web Interface Bug Report
-description: Something doesn't look quite as it should?  Report it here!
-labels: ["type/bug", "topic/ui"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        NOTE: If your issue is a security concern, please send an email to security@gitea.io instead of opening a public issue.
-  - type: markdown
-    attributes:
-      value: |
-        1. Please speak English, this is the language all maintainers can speak and write.
-        2. Please ask questions or configuration/deploy problems on our Discord
-           server (https://discord.gg/gitea) or forum (https://forum.gitea.com).
-        3. Please take a moment to check that your issue doesn't already exist.
-        4. Make sure it's not mentioned in the FAQ (https://docs.gitea.com/help/faq)
-        5. Please give all relevant information below for bug reports, because
-           incomplete details will be handled as an invalid report.
-        6. In particular it's really important to provide pertinent logs. If you are certain that this is a javascript
-           error, show us the javascript console. If the error appears to relate to Gitea the server you must also give us
-           DEBUG level logs. (See https://docs.gitea.com/administration/logging-config#collecting-logs-for-help)
-  - type: textarea
-    id: description
-    attributes:
-      label: Description
-      description: |
-        Please provide a description of your issue here, with a URL if you were able to reproduce the issue (see below)
-        If using a proxy or a CDN (e.g. CloudFlare) in front of gitea, please disable the proxy/CDN fully and connect to gitea directly to confirm the issue still persists without those services.
-  - type: textarea
-    id: screenshots
-    attributes:
-      label: Screenshots
-      description: Please provide at least 1 screenshot showing the issue.
-    validations:
-      required: true
-  - type: input
-    id: gitea-ver
-    attributes:
-      label: Gitea Version
-      description: Gitea version (or commit reference) your instance is running
-    validations:
-      required: true
-  - type: dropdown
-    id: can-reproduce
-    attributes:
-      label: Can you reproduce the bug on the Gitea demo site?
-      description: |
-        If so, please provide a URL in the Description field
-        URL of Gitea demo: https://demo.gitea.com
-      options:
-        - "Yes"
-        - "No"
-    validations:
-      required: true
-  - type: input
-    id: os-ver
-    attributes:
-      label: Operating System
-      description: The operating system you are using to access Gitea
-  - type: input
-    id: browser-ver
-    attributes:
-      label: Browser Version
-      description: The browser and version that you are using to access Gitea
-    validations:
-      required: true
diff --git a/.github/actions/docker-dryrun/action.yml b/.github/actions/docker-dryrun/action.yml
index d280ea26ce7..e9cd88d46f6 100644
--- a/.github/actions/docker-dryrun/action.yml
+++ b/.github/actions/docker-dryrun/action.yml
@@ -9,10 +9,10 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-    - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+    - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+    - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
     - name: Build regular image
-      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
       with:
         context: .
         platforms: ${{ inputs.platform }}
@@ -20,7 +20,7 @@ runs:
         file: Dockerfile
         cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
     - name: Build rootless image
-      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
       with:
         context: .
         platforms: ${{ inputs.platform }}
diff --git a/.github/actions/free-disk-space/action.yml b/.github/actions/free-disk-space/action.yml
new file mode 100644
index 00000000000..510b643a334
--- /dev/null
+++ b/.github/actions/free-disk-space/action.yml
@@ -0,0 +1,9 @@
+name: free-disk-space
+description: Free space on / before large cache restores
+
+# Delete preinstalled toolchains which gitea doesn't use
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: sudo rm -rf /usr/local/lib/android /usr/local/.ghcup /opt/ghc /usr/share/dotnet
diff --git a/.github/actions/go-cache/action.yml b/.github/actions/go-cache/action.yml
index 04d4bac3673..7096fa3952c 100644
--- a/.github/actions/go-cache/action.yml
+++ b/.github/actions/go-cache/action.yml
@@ -1,47 +1,51 @@
 name: go-caches
-description: Restore and save go module, build, and golangci-lint caches
+description: Restore the go module, build, and golangci-lint caches. Save only on the cache-seeder workflow.
+
+# Only the cache-seeder workflow saves; rename requires updating cache-seeder.yml.
+# The lint job restores but does not save the gobuild cache, so only one writer
+# (the gobuild job) populates it and there is no contention on the cache key.
 
 inputs:
-  cache-name:
-    description: Short identifier used in the per-caller build cache key
-    required: true
-  build-cache:
-    description: Whether to include ~/.cache/go-build
-    default: "true"
-  build-cache-rotate:
-    description: Whether to rotate the build cache key per run so Go's test result cache can accumulate across runs
-    default: "false"
   lint-cache:
-    description: Whether to include ~/.cache/golangci-lint
+    description: Restore (and save in cache-seeder) ~/.cache/golangci-lint
     default: "false"
 
 runs:
   using: composite
   steps:
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - if: ${{ github.workflow == 'cache-seeder' }}
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/go/pkg/mod
         key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
         restore-keys: gomod-${{ runner.os }}-${{ runner.arch }}
-    - if: ${{ inputs.build-cache == 'true' && inputs.build-cache-rotate == 'true' }}
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+    - if: ${{ github.workflow != 'cache-seeder' }}
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
-        path: ~/.cache/go-build
-        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ inputs.cache-name }}-${{ hashFiles('go.sum') }}-${{ github.run_id }}
-        restore-keys: |
-          gobuild-${{ runner.os }}-${{ runner.arch }}-${{ inputs.cache-name }}-${{ hashFiles('go.sum') }}
-          gobuild-${{ runner.os }}-${{ runner.arch }}-${{ inputs.cache-name }}
-          gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
-          gobuild-${{ runner.os }}-${{ runner.arch }}
-    - if: ${{ inputs.build-cache == 'true' && inputs.build-cache-rotate != 'true' }}
+        path: ~/go/pkg/mod
+        key: gomod-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
+        restore-keys: gomod-${{ runner.os }}-${{ runner.arch }}
+    - if: ${{ github.workflow == 'cache-seeder' && inputs.lint-cache != 'true' }}
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.cache/go-build
         key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
         restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}
-    - if: ${{ inputs.lint-cache == 'true' }}
+    - if: ${{ github.workflow != 'cache-seeder' || inputs.lint-cache == 'true' }}
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ~/.cache/go-build
+        key: gobuild-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum') }}
+        restore-keys: gobuild-${{ runner.os }}-${{ runner.arch }}
+    - if: ${{ inputs.lint-cache == 'true' && github.workflow == 'cache-seeder' }}
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ~/.cache/golangci-lint
-        key: golangci-${{ runner.os }}-${{ runner.arch }}-${{ inputs.cache-name }}-${{ hashFiles('go.sum', '.golangci.yml') }}
-        restore-keys: golangci-${{ runner.os }}-${{ runner.arch }}-${{ inputs.cache-name }}
+        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+        restore-keys: golint-${{ runner.os }}-${{ runner.arch }}
+    - if: ${{ inputs.lint-cache == 'true' && github.workflow != 'cache-seeder' }}
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ~/.cache/golangci-lint
+        key: golint-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('go.sum', '.golangci.yml') }}
+        restore-keys: golint-${{ runner.os }}-${{ runner.arch }}
diff --git a/.github/actions/go-setup/action.yml b/.github/actions/go-setup/action.yml
new file mode 100644
index 00000000000..a99ef0629ac
--- /dev/null
+++ b/.github/actions/go-setup/action.yml
@@ -0,0 +1,24 @@
+name: go-setup
+description: Set up go and restore caches
+
+inputs:
+  cache:
+    description: Restore go caches
+    default: "true"
+  lint-cache:
+    description: Also restore the golangci-lint cache
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/free-disk-space
+    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      with:
+        go-version-file: go.mod
+        check-latest: true
+        cache: false
+    - if: ${{ inputs.cache == 'true' }}
+      uses: ./.github/actions/go-cache
+      with:
+        lint-cache: ${{ inputs.lint-cache }}
diff --git a/.github/actions/node-setup/action.yml b/.github/actions/node-setup/action.yml
new file mode 100644
index 00000000000..c9ab484d57e
--- /dev/null
+++ b/.github/actions/node-setup/action.yml
@@ -0,0 +1,22 @@
+name: node-setup
+description: Set up pnpm and node and restore caches
+
+inputs:
+  cache:
+    description: Cache pnpm downloads
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+    - if: ${{ inputs.cache == 'true' }}
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 24
+        cache: pnpm
+        cache-dependency-path: pnpm-lock.yaml
+    - if: ${{ inputs.cache != 'true' }}
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 24
diff --git a/.github/actions/pgsql-shard/action.yml b/.github/actions/pgsql-shard/action.yml
new file mode 100644
index 00000000000..9a5a03ae0de
--- /dev/null
+++ b/.github/actions/pgsql-shard/action.yml
@@ -0,0 +1,40 @@
+name: pgsql-shard
+description: Run one pgsql integration test shard
+
+inputs:
+  shard:
+    description: Shard index
+    required: true
+  total-shards:
+    description: Total shard count
+    required: true
+  run-migration:
+    description: Also run migration tests
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Add hosts to /etc/hosts
+      shell: bash
+      run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 pgsql ldap minio" | sudo tee -a /etc/hosts'
+    - shell: bash
+      run: make deps-backend
+    - shell: bash
+      run: make backend
+      env:
+        TAGS: bindata
+    - name: run migration tests
+      if: ${{ inputs.run-migration == 'true' }}
+      shell: bash
+      run: GITEA_TEST_DATABASE=pgsql make test-migration
+    - name: run tests
+      shell: bash
+      run: GITEA_TEST_DATABASE=pgsql make test-integration
+      env:
+        # pgsql is chosen to be the unlucky one to run with the slow "race detector", it is about 60% slower.
+        GOTEST_FLAGS: -race -timeout=40m
+        TAGS: bindata gogit
+        TEST_LDAP: 1
+        TEST_SHARD: ${{ inputs.shard }}
+        TEST_TOTAL_SHARDS: ${{ inputs.total-shards }}
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index b7594a1ba7f..6ae22da7be2 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,10 +1,9 @@
-<!-- start tips -->
-Please check the following:
-1. Make sure you are targeting the `main` branch, pull requests on release branches are only allowed for backports.
-2. Make sure you have read contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md .
-3. For documentations contribution, please go to https://gitea.com/gitea/docs
-4. Describe what your pull request does and which issue you're targeting (if any).
-5. It is recommended to enable "Allow edits by maintainers", so maintainers can help more easily.
-6. Your input here will be included in the commit message when this PR has been merged. If you don't want some content to be included, please separate them with a line like `---`.
-7. Delete all these tips before posting.
-<!-- end tips -->
+<!--
+Before submitting:
+- Target the `main` branch; release branches are for backports only.
+- Use a Conventional Commits title, e.g. `fix(repo): handle empty branch names`.
+- Read the contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md
+- Documentation changes go to https://gitea.com/gitea/docs
+
+Describe your change below and link any issue it fixes.
+-->
diff --git a/.github/workflows/cache-seeder.yml b/.github/workflows/cache-seeder.yml
index cd086fae17f..8ec7adee07d 100644
--- a/.github/workflows/cache-seeder.yml
+++ b/.github/workflows/cache-seeder.yml
@@ -1,15 +1,9 @@
-# Populates the go module, build, and golangci-lint caches under the default
-# branch's cache scope so that PR runs have a warm fallback to restore from.
+# Populates main's cache scope so PR runs warm-start from it. Saves the go
+# module, go build (incl. test compile), and golangci-lint caches.
 #
-# GitHub Actions caches are scoped per ref: a PR run can only write to its own
-# branch's scope, but can read from the base branch's scope as a fallback.
-# PRs therefore cannot seed main's scope themselves. Running the same cache
-# steps on push-to-main is the only opportunity to populate that fallback
-# scope so fresh PR branches start with a useful cache on first run.
-
-# A PR job's exact key lives in its own PR-scope (empty on first run, filled
-# by later runs of the same PR); on miss, actions/cache's restore-keys fall
-# back to prefix matches against entries this seeder saves in main's scope.
+# Caches are ref-scoped: PR runs read their own scope then fall back to the
+# base branch. Per .github/actions/go-cache/action.yml, PRs are restore-only,
+# so push-to-main is the only opportunity to populate the fallback scope.
 
 name: cache-seeder
 
@@ -21,6 +15,7 @@ on:
       - "go.sum"
       - ".golangci.yml"
       - ".github/actions/go-cache/action.yml"
+      - ".github/actions/go-setup/action.yml"
       - ".github/workflows/cache-seeder.yml"
 
 concurrency:
@@ -35,18 +30,26 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: seed
-      - run: make deps-backend
+      - uses: ./.github/actions/go-setup
+      - run: make deps-backend deps-tools
       - run: TAGS="bindata" make backend
-      - run: TAGS="bindata sqlite sqlite_unlock_notify" make backend
-      - run: TAGS="bindata gogit sqlite sqlite_unlock_notify" GOEXPERIMENT="" make backend
+      - run: TAGS="bindata gogit" GOEXPERIMENT="" make backend
+      - name: warm test compile cache (bindata)
+        env:
+          TAGS: bindata
+          GOTEST_FLAGS: -race -list=^$$ -count=1
+        run: make test-backend
+      - name: warm test compile cache (bindata gogit)
+        env:
+          TAGS: bindata gogit
+          GOEXPERIMENT:
+          GOTEST_FLAGS: -race -list=^$$ -count=1
+        run: make test-backend
+      - name: warm integration compile cache
+        run: |
+          TAGS="bindata" make test-integration-compile
+          TAGS="bindata gogit" GOEXPERIMENT="" make test-integration-compile
+          TAGS="bindata gogit" GOTEST_FLAGS="-race" make test-integration-compile
 
   lint:
     runs-on: ubuntu-latest
@@ -54,21 +57,16 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - { job: lint-backend, tags: "bindata sqlite sqlite_unlock_notify", target: "lint-backend" }
-          - { job: lint-go-windows, tags: "bindata sqlite sqlite_unlock_notify", target: "lint-go-windows" }
-          - { job: lint-go-gogit, tags: "bindata gogit sqlite sqlite_unlock_notify", target: "lint-go" }
+          - { tags: "bindata", target: "lint-backend" }
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: ./.github/actions/go-setup
         with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: ${{ matrix.job }}
           lint-cache: "true"
       - run: make deps-backend deps-tools
+      - run: make generate-go
+        env:
+          TAGS: ${{ matrix.tags }}
       - run: make ${{ matrix.target }}
         env:
           TAGS: ${{ matrix.tags }}
diff --git a/.github/workflows/cron-renovate.yml b/.github/workflows/cron-renovate.yml
index 39bcf26ac98..a50af530f20 100644
--- a/.github/workflows/cron-renovate.yml
+++ b/.github/workflows/cron-renovate.yml
@@ -2,7 +2,7 @@ name: cron-renovate
 
 on:
   schedule:
-    - cron: "0 1 * * *" # daily at 01:00 UTC
+    - cron: "23 * * * *" # hourly at :23
   workflow_dispatch:
 
 concurrency:
@@ -21,7 +21,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: renovatebot/github-action@83ec54fee49ab67d9cd201084c1ff325b4b462e4 # v46.1.10
+      - uses: renovatebot/github-action@693b9ef15eec82123529a37c782242f091365961 # v46.1.14
         with:
           renovate-version: ${{ env.RENOVATE_VERSION }}
           configurationFile: renovate.json5
diff --git a/.github/workflows/files-changed.yml b/.github/workflows/files-changed.yml
index 78915d81ea4..c17afbca97f 100644
--- a/.github/workflows/files-changed.yml
+++ b/.github/workflows/files-changed.yml
@@ -25,6 +25,8 @@ on:
         value: ${{ jobs.detect.outputs.json }}
       e2e:
         value: ${{ jobs.detect.outputs.e2e }}
+      shell:
+        value: ${{ jobs.detect.outputs.shell }}
 
 permissions:
   contents: read
@@ -45,6 +47,7 @@ jobs:
       yaml: ${{ steps.changes.outputs.yaml }}
       json: ${{ steps.changes.outputs.json }}
       e2e: ${{ steps.changes.outputs.e2e }}
+      shell: ${{ steps.changes.outputs.shell }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
@@ -63,44 +66,46 @@ jobs:
               - "options/locale/locale_en-US.json"
 
             frontend:
-              - "*.js"
               - "*.ts"
               - "web_src/**"
-              - "tools/*.js"
-              - "tools/*.ts"
+              - "tools/generate-svg.ts"
+              - "tools/generate-svg-vscode-extensions.json"
+              - "tsconfig.json"
               - "assets/emoji.json"
               - "package.json"
               - "pnpm-lock.yaml"
+              - "pnpm-workspace.yaml"
               - "Makefile"
-              - ".eslintrc.cjs"
-              - ".npmrc"
 
             docs:
               - "**/*.md"
               - ".markdownlint.yaml"
               - "package.json"
               - "pnpm-lock.yaml"
+              - "pnpm-workspace.yaml"
 
             actions:
               - ".github/workflows/*"
+              - ".github/actions/**"
               - "Makefile"
 
             templates:
-              - "tools/lint-templates-*.js"
+              - "tools/lint-templates-*.ts"
               - "templates/**/*.tmpl"
               - "pyproject.toml"
               - "uv.lock"
 
             docker:
               - ".github/workflows/pull-docker-dryrun.yml"
+              - ".github/actions/docker-dryrun/**"
               - "Dockerfile"
               - "Dockerfile.rootless"
               - "docker/**"
               - "Makefile"
 
             dockerfile:
-                - "Dockerfile"
-                - "Dockerfile.rootless"
+              - "Dockerfile"
+              - "Dockerfile.rootless"
 
             swagger:
               - "templates/swagger/v1_json.tmpl"
@@ -108,6 +113,7 @@ jobs:
               - "Makefile"
               - "package.json"
               - "pnpm-lock.yaml"
+              - "pnpm-workspace.yaml"
               - ".spectral.yaml"
 
             yaml:
@@ -118,8 +124,14 @@ jobs:
 
             json:
               - "**/*.json"
+              - "**/*.json5"
+              - "eslint.json.config.ts"
 
             e2e:
               - "tests/e2e/**"
               - "tools/test-e2e.sh"
               - "playwright.config.ts"
+
+            shell:
+              - "**/*.sh"
+              - ".shellcheckrc"
diff --git a/.github/workflows/giteabot-backport.yml b/.github/workflows/giteabot-backport.yml
new file mode 100644
index 00000000000..b90c225b4ba
--- /dev/null
+++ b/.github/workflows/giteabot-backport.yml
@@ -0,0 +1,26 @@
+name: giteabot backport
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  giteabot:
+    if: github.repository == 'go-gitea/gitea'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: go-gitea/giteabot@f8a6f4c14d46920b4b5448852be3de72d00066f0 # v1.0.3
+        with:
+          github_token: ${{ secrets.GITEABOT_TOKEN }}
+          gitea_fork: giteabot/gitea
+          checks: backport
diff --git a/.github/workflows/giteabot.yml b/.github/workflows/giteabot.yml
new file mode 100644
index 00000000000..efa9fe047ae
--- /dev/null
+++ b/.github/workflows/giteabot.yml
@@ -0,0 +1,51 @@
+name: giteabot
+
+on:
+  # pull_request_target gives this workflow access to GITEABOT_TOKEN on PRs from
+  # forks, which the bot needs to write labels, statuses and comments. Safe here
+  # because the job only runs a pinned action and never checks out PR HEAD.
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
+    types:
+      - opened
+      - synchronize
+      - labeled
+      - unlabeled
+      - closed
+      - review_requested
+      - review_request_removed
+  pull_request_review:
+    types:
+      - submitted
+      - edited
+      - dismissed
+  schedule:
+    - cron: "15 3 * * *"
+  workflow_dispatch:
+    inputs:
+      checks:
+        description: Comma-separated list of non-backport checks to run
+        required: false
+        default: labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+  statuses: write
+
+concurrency:
+  group: ${{ format('{0}-{1}', github.workflow, (github.event_name == 'pull_request_target' || github.event_name == 'pull_request_review') && format('pr-{0}', github.event.pull_request.number) || 'maintenance') }}
+  cancel-in-progress: false
+
+jobs:
+  giteabot:
+    if: github.repository == 'go-gitea/gitea'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      # pull_request_review runs without repository secrets on fork PRs, so fall
+      # back to the workflow token for the non-backport checks handled here.
+      - uses: go-gitea/giteabot@f8a6f4c14d46920b4b5448852be3de72d00066f0 # v1.0.3
+        with:
+          github_token: ${{ secrets.GITEABOT_TOKEN || github.token }}
+          checks: ${{ github.event.inputs.checks || 'labels,merge_queue,lock,feedback,last_call,milestones,lgtm,translation_comment,pr_actions' }}
diff --git a/.github/workflows/pull-compliance.yml b/.github/workflows/pull-compliance.yml
index dc46c9fa42e..801966e1444 100644
--- a/.github/workflows/pull-compliance.yml
+++ b/.github/workflows/pull-compliance.yml
@@ -20,43 +20,33 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: ./.github/actions/go-setup
         with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: lint-backend
           lint-cache: "true"
       - run: make deps-backend deps-tools
+      - run: TAGS="bindata" make generate-go # lint-go also lints with "bindata" tags which requires "_bindata.go"
       - run: make lint-backend
-        env:
-          TAGS: bindata sqlite sqlite_unlock_notify
 
   lint-on-demand:
     needs: files-changed
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: ./.github/actions/go-setup
         with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+          cache: "false"
+      - uses: ./.github/actions/node-setup
         with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+          cache: "false"
 
       - run: make lint-spell
 
-      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
+      - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true' || needs.files-changed.outputs.actions == 'true'
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          python-version: 3.14
       - if: needs.files-changed.outputs.templates == 'true' || needs.files-changed.outputs.yaml == 'true'
-        run: uv python install 3.14 && make deps-py lint-templates lint-yaml
+        run: make deps-py lint-templates lint-yaml
 
       - if: needs.files-changed.outputs.docs == 'true' || needs.files-changed.outputs.swagger == 'true' || needs.files-changed.outputs.json == 'true'
         run: make deps-frontend lint-md lint-swagger lint-json
@@ -64,47 +54,8 @@ jobs:
       - if: needs.files-changed.outputs.actions == 'true'
         run: make lint-actions
 
-  lint-go-windows:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: lint-go-windows
-          lint-cache: "true"
-      - run: make deps-backend deps-tools
-      - run: make lint-go-windows
-        env:
-          TAGS: bindata sqlite sqlite_unlock_notify
-          GOOS: windows
-          GOARCH: amd64
-
-  lint-go-gogit:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
-    needs: files-changed
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: lint-go-gogit
-          lint-cache: "true"
-      - run: make deps-backend deps-tools
-      - run: make lint-go
-        env:
-          TAGS: bindata gogit sqlite sqlite_unlock_notify
+      - if: needs.files-changed.outputs.shell == 'true'
+        run: make lint-shell
 
   checks-backend:
     if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
@@ -112,15 +63,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: checks-backend
-          build-cache: "false"
+      - uses: ./.github/actions/go-setup
       - run: make deps-backend deps-tools
       - run: make --always-make checks-backend # ensure the "go-licenses" make target runs
 
@@ -130,12 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: ./.github/actions/node-setup
       - run: make deps-frontend
       - run: make lint-frontend
       - run: make checks-frontend
@@ -148,14 +86,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: compliance-backend
+      - uses: ./.github/actions/go-setup
       - run: make deps-backend generate-go
       # no frontend build here as backend should be able to build, even without any frontend files
       # CGO is not used when cross-compile, so these steps also test if the code is compatible with CGO disabled
diff --git a/.github/workflows/pull-db-tests.yml b/.github/workflows/pull-db-tests.yml
index c2293ac8535..cbf86247ce1 100644
--- a/.github/workflows/pull-db-tests.yml
+++ b/.github/workflows/pull-db-tests.yml
@@ -14,10 +14,11 @@ jobs:
   files-changed:
     uses: ./.github/workflows/files-changed.yml
 
-  test-pgsql:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+  test-pgsql-shard-1:
+    if: needs.files-changed.outputs.backend == 'true'
     needs: files-changed
     runs-on: ubuntu-latest
+    timeout-minutes: 50
     services:
       pgsql:
         image: postgres:14
@@ -27,14 +28,14 @@ jobs:
         ports:
           - "5432:5432"
       ldap:
-        image: gitea/test-openldap:latest
+        image: gitea/test-openldap:latest@sha256:4ac633b01d684e6b2a458cc0c8530c92f9b3702f6e040ce5f365607df34fbda0
         ports:
           - "389:389"
           - "636:636"
       minio:
         # as github actions doesn't support "entrypoint", we need to use a non-official image
         # that has a custom entrypoint set to "minio server /data"
-        image: bitnamilegacy/minio:2023.8.31
+        image: bitnamilegacy/minio:2025.7.23
         env:
           MINIO_ROOT_USER: 123456
           MINIO_ROOT_PASSWORD: 12345678
@@ -42,28 +43,47 @@ jobs:
           - "9000:9000"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: ./.github/actions/go-setup
+      - uses: ./.github/actions/pgsql-shard
         with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
+          shard: 1
+          total-shards: 2
+          run-migration: "true"
+
+  test-pgsql-shard-2:
+    if: needs.files-changed.outputs.backend == 'true'
+    needs: files-changed
+    runs-on: ubuntu-latest
+    timeout-minutes: 50
+    services:
+      pgsql:
+        image: postgres:14
+        env:
+          POSTGRES_DB: test
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - "5432:5432"
+      ldap:
+        image: gitea/test-openldap:latest@sha256:4ac633b01d684e6b2a458cc0c8530c92f9b3702f6e040ce5f365607df34fbda0
+        ports:
+          - "389:389"
+          - "636:636"
+      minio:
+        # as github actions doesn't support "entrypoint", we need to use a non-official image
+        # that has a custom entrypoint set to "minio server /data"
+        image: bitnamilegacy/minio:2025.7.23
+        env:
+          MINIO_ROOT_USER: 123456
+          MINIO_ROOT_PASSWORD: 12345678
+        ports:
+          - "9000:9000"
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/go-setup
+      - uses: ./.github/actions/pgsql-shard
         with:
-          cache-name: pgsql
-      - name: Add hosts to /etc/hosts
-        run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 pgsql ldap minio" | sudo tee -a /etc/hosts'
-      - run: make deps-backend
-      - run: make backend
-        env:
-          TAGS: bindata
-      - name: run migration tests
-        run: GITEA_TEST_DATABASE=pgsql make test-migration
-      - name: run tests
-        run: GITEA_TEST_DATABASE=pgsql make test-integration
-        timeout-minutes: 50
-        env:
-          TAGS: bindata gogit
-          TEST_LDAP: 1
+          shard: 2
+          total-shards: 2
 
   test-sqlite:
     if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
@@ -71,41 +91,37 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: sqlite
+      - uses: ./.github/actions/go-setup
       - run: make deps-backend
       - run: make backend
         env:
-          TAGS: bindata gogit sqlite sqlite_unlock_notify
+          TAGS: bindata gogit
           GOEXPERIMENT:
-      - name: run migration tests
-        run: GITEA_TEST_DATABASE=sqlite make test-migration
+      - run: GITEA_TEST_DATABASE=sqlite make test-migration
         env:
           TAGS: bindata gogit
       - name: run tests
         run: GITEA_TEST_DATABASE=sqlite make test-integration
         timeout-minutes: 50
         env:
+          # sqlite driver can contain large amount of Golang code, so don't use race detector for it, otherwise, extremely slow
+          GOTEST_FLAGS: -timeout=40m
           TAGS: bindata gogit
           GOEXPERIMENT:
-          GOTEST_FLAGS: -race -timeout=40m
 
   test-unit:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+    if: needs.files-changed.outputs.backend == 'true'
     needs: files-changed
     runs-on: ubuntu-latest
     services:
       elasticsearch:
-        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.14
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15
         env:
           discovery.type: single-node
           xpack.security.enabled: false
+          xpack.ml.enabled: false
+          ingest.geoip.downloader.enabled: false
+          ES_JAVA_OPTS: "-Xms1g -Xmx1g"
         ports:
           - "9200:9200"
       meilisearch:
@@ -115,7 +131,7 @@ jobs:
         ports:
           - "7700:7700"
       redis:
-        image: redis
+        image: redis:latest@sha256:e74c9b933d78e2829583d88f92793f4524752a15ac59c8baff2dd5ed000b7432
         options: >- # wait until redis has started
           --health-cmd "redis-cli ping"
           --health-interval 5s
@@ -124,55 +140,49 @@ jobs:
         ports:
           - 6379:6379
       minio:
-        image: bitnamilegacy/minio:2021.3.17
+        image: bitnamilegacy/minio:2025.7.23
         env:
-          MINIO_ACCESS_KEY: 123456
-          MINIO_SECRET_KEY: 12345678
+          MINIO_ROOT_USER: 123456
+          MINIO_ROOT_PASSWORD: 12345678
         ports:
           - "9000:9000"
       devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest
+        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
         ports:
           - 10000:10000
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: unit
-          build-cache-rotate: "true"
+      - uses: ./.github/actions/go-setup
       - name: Add hosts to /etc/hosts
         run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 minio devstoreaccount1.azurite.local mysql elasticsearch meilisearch smtpimap" | sudo tee -a /etc/hosts'
       - run: make deps-backend
-      - run: make backend
+      - run: make generate-go
         env:
           TAGS: bindata
       - name: unit-tests
-        run: make test-backend test-check
+        run: make test-backend
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
           GOTEST_FLAGS: -race -timeout=20m
+          TAGS: bindata
           GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
       - name: unit-tests-gogit
-        run: make test-backend test-check
+        run: make test-backend
         env:
-          TAGS: bindata gogit sqlite sqlite_unlock_notify
-          GOEXPERIMENT:
           GOTEST_FLAGS: -race -timeout=20m
+          TAGS: bindata gogit
+          GOEXPERIMENT:
           GITHUB_READ_TOKEN: ${{ secrets.GITHUB_READ_TOKEN }}
+          GITEA_TEST_CI_SKIP_EXTERNAL: true
+      - run: make test-check
 
   test-mysql:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+    if: needs.files-changed.outputs.backend == 'true'
     needs: files-changed
     runs-on: ubuntu-latest
     services:
       mysql:
         # the bitnami mysql image has more options than the official one, it's easier to customize
-        image: bitnamilegacy/mysql:8.0
+        image: bitnamilegacy/mysql:8.4
         env:
           ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: testgitea
@@ -181,14 +191,17 @@ jobs:
         options: >-
           --mount type=tmpfs,destination=/bitnami/mysql/data
       elasticsearch:
-        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.14
+        image: docker.elastic.co/elasticsearch/elasticsearch:8.19.15
         env:
           discovery.type: single-node
           xpack.security.enabled: false
+          xpack.ml.enabled: false
+          ingest.geoip.downloader.enabled: false
+          ES_JAVA_OPTS: "-Xms1g -Xmx1g"
         ports:
           - "9200:9200"
       smtpimap:
-        image: tabascoterrier/docker-imap-devel:latest
+        image: tabascoterrier/docker-imap-devel:latest@sha256:3fb7cf50b47693e7b80f6f74abea2def4d7386016931d61359864de8a0aba551
         ports:
           - "25:25"
           - "143:143"
@@ -196,22 +209,14 @@ jobs:
           - "993:993"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: mysql
+      - uses: ./.github/actions/go-setup
       - name: Add hosts to /etc/hosts
         run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mysql elasticsearch smtpimap" | sudo tee -a /etc/hosts'
       - run: make deps-backend
       - run: make backend
         env:
           TAGS: bindata
-      - name: run migration tests
-        run: GITEA_TEST_DATABASE=mysql make test-migration
+      - run: GITEA_TEST_DATABASE=mysql make test-migration
       - name: run tests
         run: GITEA_TEST_DATABASE=mysql make test-integration
         env:
@@ -219,7 +224,7 @@ jobs:
           TEST_INDEXER_CODE_ES_URL: "http://elastic:changeme@elasticsearch:9200"
 
   test-mssql:
-    if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
+    if: needs.files-changed.outputs.backend == 'true'
     needs: files-changed
     runs-on: ubuntu-latest
     services:
@@ -232,19 +237,12 @@ jobs:
         ports:
           - "1433:1433"
       devstoreaccount1.azurite.local: # https://github.com/Azure/Azurite/issues/1583
-        image: mcr.microsoft.com/azure-storage/azurite:latest
+        image: mcr.microsoft.com/azure-storage/azurite:latest@sha256:dae2a5f96553962901304b94e72ef87e299d0825e4b679673bcc527a25076fe4
         ports:
           - 10000:10000
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: mssql
+      - uses: ./.github/actions/go-setup
       - name: Add hosts to /etc/hosts
         run: '[ -e "/.dockerenv" ] || [ -e "/run/.containerenv" ] || echo "127.0.0.1 mssql devstoreaccount1.azurite.local" | sudo tee -a /etc/hosts'
       - run: make deps-backend
diff --git a/.github/workflows/pull-e2e-tests.yml b/.github/workflows/pull-e2e-tests.yml
index 974d82ea5e9..f0283f40227 100644
--- a/.github/workflows/pull-e2e-tests.yml
+++ b/.github/workflows/pull-e2e-tests.yml
@@ -20,31 +20,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: go.mod
-          check-latest: true
-          cache: false
-      - uses: ./.github/actions/go-cache
-        with:
-          cache-name: e2e
-          build-cache: "false"
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-          cache: pnpm
-          cache-dependency-path: pnpm-lock.yaml
+      - uses: ./.github/actions/go-setup
+      - uses: ./.github/actions/node-setup
       - run: make deps-frontend
       - run: make frontend
       - run: make deps-backend
       - run: make backend
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
       - run: make playwright
       - run: make test-e2e
         timeout-minutes: 10
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
           FORCE_COLOR: 1
           GITEA_TEST_E2E_DEBUG: 1
diff --git a/.github/workflows/pull-labeler.yml b/.github/workflows/pull-labeler.yml
index f9e2e5e07b7..34395c8d9e3 100644
--- a/.github/workflows/pull-labeler.yml
+++ b/.github/workflows/pull-labeler.yml
@@ -1,8 +1,10 @@
 name: labeler
 
 on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
+  # pull_request_target is required to label PRs from forks; jobs only use pinned
+  # actions or base-branch checkout, never PR-head code.
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
+    types: [opened, synchronize, reopened, edited, ready_for_review]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -15,6 +17,31 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         with:
           sync-labels: true
+
+  pr-title:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      # Base-branch checkout only: pull_request_target runs with elevated token; never run PR-head code here.
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+      # Labels are only synced after the title lints, so an invalid title never reaches the label diff.
+      - run: node ./tools/ci-tools.ts lint-pr-title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+      - run: node ./tools/ci-tools.ts set-pr-labels
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          GITHUB_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/release-nightly-snapcraft.yml b/.github/workflows/release-nightly-snapcraft.yml
new file mode 100644
index 00000000000..0f9ac1d423b
--- /dev/null
+++ b/.github/workflows/release-nightly-snapcraft.yml
@@ -0,0 +1,41 @@
+name: release-nightly-snapcraft
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+
+    env:
+      SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install snapcraft
+        run: sudo snap install snapcraft --classic
+
+      - name: Remote build
+        run: |
+          snapcraft remote-build \
+            --launchpad-accept-public-upload \
+            --build-for=amd64,arm64,armhf
+
+      - name: List built snaps
+        run: find . -maxdepth 1 -type f -name '*.snap' -print
+
+      - name: Upload and release snapcraft nightly build
+        run: |
+          set -euo pipefail
+
+          for snap in ./*.snap; do
+            echo "Uploading $snap to edge"
+            snapcraft upload --release="latest/edge" "$snap"
+          done
diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml
index a5fa452ef36..d1561329431 100644
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
@@ -32,7 +32,7 @@ jobs:
       # xgo build
       - run: make release
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
       - name: import gpg key
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -40,26 +40,34 @@ jobs:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
       - name: sign binaries
+        env:
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
+          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
         run: |
           for f in dist/release/*; do
-            echo '${{ secrets.GPGSIGN_PASSPHRASE }}' | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u ${{ steps.import_gpg.outputs.fingerprint }} --output "$f.asc" "$f"
+            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
           done
       # clean branch name to get the folder name in S3
       - name: Get cleaned branch name
         id: clean_name
+        env:
+          REF: ${{ github.ref }}
         run: |
-          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
+          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@acca2b1b2070338fb9fd1ca27ecee81d687e58e5 # v6.1.2
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       - name: upload binaries to s3
+        env:
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
+          BRANCH: ${{ steps.clean_name.outputs.branch }}
         run: |
-          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
 
   nightly-container:
     runs-on: namespace-profile-gitea-release-docker
@@ -71,14 +79,16 @@ jobs:
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
       - name: Get cleaned branch name
         id: clean_name
+        env:
+          REF: ${{ github.ref }}
         run: |
-          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
+          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\///' -e 's/release\/v//')
           echo "branch=${REF_NAME}-nightly" >> "$GITHUB_OUTPUT"
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         id: meta
         with:
           images: |-
@@ -88,7 +98,7 @@ jobs:
             type=raw,value=${{ steps.clean_name.outputs.branch }}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         id: meta_rootless
         with:
           images: |-
@@ -102,18 +112,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular docker image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -123,7 +133,7 @@ jobs:
           cache-from: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful
           cache-to: type=registry,ref=ghcr.io/go-gitea/gitea:buildcache-rootful,mode=max
       - name: build rootless docker image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
diff --git a/.github/workflows/release-tag-rc.yml b/.github/workflows/release-tag-rc.yml
index 2e0f2dd5c0b..3e7655027c4 100644
--- a/.github/workflows/release-tag-rc.yml
+++ b/.github/workflows/release-tag-rc.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
@@ -33,7 +33,7 @@ jobs:
       # xgo build
       - run: make release
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
       - name: import gpg key
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -41,35 +41,44 @@ jobs:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
       - name: sign binaries
+        env:
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
+          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
         run: |
           for f in dist/release/*; do
-            echo '${{ secrets.GPGSIGN_PASSPHRASE }}' | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u ${{ steps.import_gpg.outputs.fingerprint }} --output "$f.asc" "$f"
+            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
           done
       # clean branch name to get the folder name in S3
       - name: Get cleaned branch name
         id: clean_name
+        env:
+          REF: ${{ github.ref }}
         run: |
-          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
+          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@acca2b1b2070338fb9fd1ca27ecee81d687e58e5 # v6.1.2
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       - name: upload binaries to s3
+        env:
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
+          BRANCH: ${{ steps.clean_name.outputs.branch }}
         run: |
-          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
       - name: Install GH CLI
         uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
         with:
           gh-cli-version: 2.39.1
       - name: create github release
-        run: |
-          gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --draft --notes-from-tag dist/release/*
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          gh release create "$TAG" --title "$TAG" --draft --notes-from-tag dist/release/*
 
   container:
     runs-on: namespace-profile-gitea-release-docker
@@ -81,9 +90,9 @@ jobs:
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         id: meta
         with:
           images: |-
@@ -96,7 +105,7 @@ jobs:
             type=semver,pattern={{version}}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         id: meta_rootless
         with:
           images: |-
@@ -112,18 +121,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular container image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -131,7 +140,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
       - name: build rootless container image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
diff --git a/.github/workflows/release-tag-version.yml b/.github/workflows/release-tag-version.yml
index 2e7a9f5f54c..66a2984def3 100644
--- a/.github/workflows/release-tag-version.yml
+++ b/.github/workflows/release-tag-version.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           go-version-file: go.mod
           check-latest: true
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
@@ -36,7 +36,7 @@ jobs:
       # xgo build
       - run: make release
         env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          TAGS: bindata
       - name: import gpg key
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
@@ -44,35 +44,44 @@ jobs:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
       - name: sign binaries
+        env:
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
+          GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
         run: |
           for f in dist/release/*; do
-            echo '${{ secrets.GPGSIGN_PASSPHRASE }}' | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u ${{ steps.import_gpg.outputs.fingerprint }} --output "$f.asc" "$f"
+            echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f"
           done
       # clean branch name to get the folder name in S3
       - name: Get cleaned branch name
         id: clean_name
+        env:
+          REF: ${{ github.ref }}
         run: |
-          REF_NAME=$(echo "${{ github.ref }}" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
+          REF_NAME=$(echo "$REF" | sed -e 's/refs\/heads\///' -e 's/refs\/tags\/v//' -e 's/release\/v//')
           echo "Cleaned name is ${REF_NAME}"
           echo "branch=${REF_NAME}" >> "$GITHUB_OUTPUT"
       - name: configure aws
-        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        uses: aws-actions/configure-aws-credentials@acca2b1b2070338fb9fd1ca27ecee81d687e58e5 # v6.1.2
         with:
           aws-region: ${{ secrets.AWS_REGION }}
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       - name: upload binaries to s3
+        env:
+          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
+          BRANCH: ${{ steps.clean_name.outputs.branch }}
         run: |
-          aws s3 sync dist/release s3://${{ secrets.AWS_S3_BUCKET }}/gitea/${{ steps.clean_name.outputs.branch }} --no-progress
+          aws s3 sync dist/release "s3://$AWS_S3_BUCKET/gitea/$BRANCH" --no-progress
       - name: Install GH CLI
         uses: dev-hanz-ops/install-gh-cli-action@af38ce09b1ec248aeb08eea2b16bbecea9e059f8 # v0.2.1
         with:
           gh-cli-version: 2.39.1
       - name: create github release
-        run: |
-          gh release create ${{ github.ref_name }} --title ${{ github.ref_name }} --notes-from-tag dist/release/*
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          gh release create "$TAG" --title "$TAG" --notes-from-tag dist/release/*
 
   container:
     runs-on: namespace-profile-gitea-release-docker
@@ -84,9 +93,9 @@ jobs:
       # fetch all commits instead of only the last as some branches are long lived and could have many between versions
       # fetch all tags to ensure that "git describe" reports expected Gitea version, eg. v1.21.0-dev-1-g1234567
       - run: git fetch --unshallow --quiet --tags --force
-      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         id: meta
         with:
           images: |-
@@ -103,7 +112,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
-      - uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+      - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         id: meta_rootless
         with:
           images: |-
@@ -124,18 +133,18 @@ jobs:
           annotations: |
             org.opencontainers.image.authors="maintainers@gitea.io"
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to GHCR using PAT
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: build regular container image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
@@ -143,7 +152,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           annotations: ${{ steps.meta.outputs.annotations }}
       - name: build rootless container image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/riscv64
diff --git a/.golangci.yml b/.golangci.yml
index 570942bdd32..b72b3fbebd6 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -13,7 +13,6 @@ linters:
     - forbidigo
     - gocheckcompilerdirectives
     - gocritic
-    - goheader
     - govet
     - ineffassign
     - mirror
@@ -44,7 +43,7 @@ linters:
               desc: use os or io instead
             - pkg: golang.org/x/exp
               desc: it's experimental and unreliable
-            - pkg: code.gitea.io/gitea/modules/git/internal
+            - pkg: gitea.dev/modules/git/internal
               desc: do not use the internal package, use AddXxx function instead
             - pkg: gopkg.in/ini.v1
               desc: do not use the ini package, use gitea's config system instead
@@ -56,9 +55,9 @@ linters:
           files:
             - '**/models/migrations/**/*.go'
           deny:
-            - pkg: code.gitea.io/gitea/models$
+            - pkg: gitea.dev/models$
               desc: migrations must not depend on the models package
-            - pkg: code.gitea.io/gitea/modules/structs
+            - pkg: gitea.dev/modules/structs
               desc: migrations must not depend on modules/structs (API structures change over time)
     nolintlint:
       allow-unused: false
@@ -118,11 +117,6 @@ linters:
       enable:
         - nilness
         - unusedwrite
-    goheader:
-      values:
-        regexp:
-          HEADER: '((Copyright [^\n]+|All rights reserved\.)\n)*Copyright \d{4} (The (Gogs|Gitea) Authors|Gitea Authors|Gitea)\.( All rights reserved\.)?(\n(Copyright [^\n]+|All rights reserved\.))*\nSPDX-License-Identifier: [\w.-]+'
-      template: '{{ HEADER }}'
   exclusions:
     generated: lax
     presets:
@@ -179,7 +173,7 @@ formatters:
       custom-order: true
       sections:
         - standard
-        - prefix(code.gitea.io/gitea)
+        - prefix(gitea.dev)
         - blank
         - default
     gofumpt:
diff --git a/.npmrc b/.npmrc
deleted file mode 100644
index 790a49a6eb9..00000000000
--- a/.npmrc
+++ /dev/null
@@ -1,7 +0,0 @@
-audit=false
-fund=false
-update-notifier=false
-save-exact=true
-auto-install-peers=true
-dedupe-peer-dependents=false
-enable-pre-post-scripts=true
diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 00000000000..a012fba96e5
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1 @@
+disable=SC1091,SC2001,SC2002,SC2016,SC2028,SC2046,SC2124,SC2128,SC2129,SC2154,SC2155,SC2164,SC2181,SC2207
diff --git a/AGENTS.md b/AGENTS.md
index fd87f432b71..5a4ecda6da9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,14 +2,19 @@
 - Run `make fmt` to format `.go` files, and run `make lint-go` to lint them
 - Run `make lint-js` to lint `.ts` files
 - Run `make tidy` after any `go.mod` changes
-- Run single go tests with `go test -tags 'sqlite sqlite_unlock_notify' -run '^TestName$' ./modulepath/`
+- Run single go tests with `go test -run '^TestName$' ./modulepath/`
 - Run single js test files with `pnpm exec vitest <path-filter>`
 - Run single playwright e2e test files with `GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e`
 - Add the current year into the copyright header of new `.go` files
 - Ensure no trailing whitespace in edited files
+- Use Conventional Commits for commit messages and PR titles, e.g. `type(scope): subject`; `!` before the colon if breaking. Use `test` type for test-only changes.
 - Never force-push, amend, or squash unless asked. Use new commits and normal push for pull request updates
 - Preserve existing code comments, do not remove or rewrite comments that are still relevant
+- Keep comments short, prefer same-line, explain why, never narrate code
+- Prefer unit tests over integration tests when logic is testable in isolation
+- Aim for sub-2s local runtime for integration and e2e tests
 - In TypeScript, use `!` (non-null assertion) instead of `?.`/`??` when a value is known to always exist
 - For CSS layout, prefer `flex-*` helpers over per-child `tw-ml-*` / `tw-mr-*` margins; fall back to `tw-*` utilities when specificity requires `!important`
 - Include authorship attribution in issue and pull request comments
-- Add `Co-Authored-By` lines to all commits, indicating name and model used
+- Always add `Assisted-By` trailers to commit messages in format `Assisted-by: AGENT_NAME:MODEL_VERSION`
+- Never add `Co-Authored-By` `Signed-off-by` trailer to commit messages. Sign off must be done by a human.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c3b6b94269b..691e6eaed14 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,68 @@ This changelog goes through the changes that have been made in each release
 without substantial changes to our git log; to see the highlights of what has
 been added to each release, please refer to the [blog](https://blog.gitea.com).
 
+## [1.26.2](https://github.com/go-gitea/gitea/releases/tag/1.26.2) - 2026-05-20
+
+* SECURITY
+  * fix(permissions): Fix reading permission (#37769)
+  * fix(actions): make artifact signature payloads unambiguous (#37707)
+  * fix: Unify public-only token filtering in API queries and repo access checks (#37118)
+  * fix: Add missed token scope checking (#37735)
+  * fix(oauth): bind token exchanges to the original client request (#37704)
+  * fix(oauth): strengthen PKCE validation and refresh token replay protection (#37706)
+  * fix(web): enforce token scopes on raw, media, and attachment downloads (#37698)
+  * fix(security): enforce wiki git writes and LFS token access at request time (#37695)
+  * feat(api): encrypt AWS creds (#37679)
+  * fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test
+  * fix(packages): Add label for private and internal package and fix composor package source permission check (#37610)
+  * fix(git): Fix smart http request scope bug (#37583)
+  * Fix basic auth bug (#37503)
+  * Fix allow maintainer edit permission check (#37479) (#37484)
+  * Fix URL sanitization to handle schemeless credentials (#37440) (#37471)
+  * Fix attachment Content-Security-Policy (#37455) (#37464)
+  * chore(deps): bump go-git/go-git/v5 to 5.19.0 (#37608)
+
+* BUGFIXES
+  * fix(pull): handle empty pull request files view to allow reviews (#37783)
+  * fix(markup): make RenderString never fail (#37779)
+  * fix: add natural sort to sortTreeViewNodes (#37772)
+  * fix: package creation unique conflict (#37774)
+  * fix!: add DEFAULT_TITLE_SOURCE setting for pull request title default behavior (#37465)
+  * fix: Allow direct commits for unprotected files with push restrictions (#37657)
+  * fix(actions): wrong assumption that run id always >= job id (#37737)
+  * fix(auth): set User-Agent on avatar fetch and sync avatar on link-account register (#37564) (#37588)
+  * fix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState (#37692)
+  * fix(repo): /generate must sync the branch table for the new repo (#37693)
+  * build: Fix snap build (1.26)
+  * fix(actions): run TransferLogs on UpdateLog{Rows:[], NoMore:true} (#37631)
+  * fix show correct mergebase
+  * fix: make clone URL respect public URL detection setting (#37615)
+  * fix: "run as root" check (#37622)
+  * chore(deps): update dependency go to v1.26.3 (#37601)
+  * Compare dropdown fails when selecting branch with no common merge-base (#37470)
+  * fix: treat email addresses case-insensitively (#37600)
+  * fix(actions): fix blank lines after ::endgroup:: (#37597)
+  * fix(actions): report individual step status in workflow job API response (#37592)
+  * fix: Invalid UTF-8 commit messages in JSON API responses (#37542)
+  * fix: use consistent GetUser family functions (#37553)
+  * fix(api): return 409 message instead of empty JSON for wrong commit id (#37572)
+  * fix(actions): prevent panic when workflow contains null jobs (#37570)
+  * Make ServeSetHeaders default to download attachment if filename exists (#37552) (#37555)
+  * Fix(actions): validate workflow param to prevent 500 error (#37546) (#37554)
+  * Don't unblock run-level-concurrency-blocked runs in the resolver (#37461) (#37538)
+  * Fix(packages): use file names for generic web downloads (#37514) (#37520)
+  * Fix merge autodetect can't close other PRs but only the last one when multiple PRs are pushed at once (#37512) (#37516)
+  * Fix update branch protection order (#37508) (#37513)
+  * Fix mCaptcha broken after Vite migration (#37492) (#37509)
+  * Fix review submission from single-commit PR view (#37475) (#37485)
+  * Fix scheduled action panic with null event payload (#37459) (#37466)
+  * Make GetPossibleUserByID can handle deleted user (#37430) (#37431)
+  * Remove excessive quote from terraform instructions (#37424) (#37426)
+  * Fix color regressions, add `priority` color (#37417) (#37421)
+
+* MISC
+  * Add CurrentURL template variable back (#37444) (#37449)
+
 ## [1.26.1](https://github.com/go-gitea/gitea/releases/tag/v1.26.1) - 2026-04-21
 
 * BUGFIXES
@@ -1383,7 +1445,7 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
   * Fix mCaptcha bug (#33659) (#33661)
   * Git graph: don't show detached commits (#33645) (#33650)
   * Use MatchPhraseQuery for bleve code search (#33628)
-  * Adjust appearence of commit status webhook (#33778) #33789
+  * Adjust appearance of commit status webhook (#33778) #33789
   * Upgrade golang net from 0.35.0 -> 0.36.0 (#33795) #33796
 
 ## [1.23.4](https://github.com/go-gitea/gitea/releases/tag/v1.23.4) - 2025-02-16
@@ -2114,7 +2176,7 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
   * Optimize repo-list layout to enhance visual experience (#31272) (#31276)
   * fixed the dropdown menu for the top New button to expand to the left (#31273) (#31275)
   * Fix Activity Page Contributors dropdown (#31264) (#31269)
-  * fix: allow actions artifacts storage migration to complete succesfully (#31251) (#31257)
+  * fix: allow actions artifacts storage migration to complete successfully (#31251) (#31257)
   * Make blockquote attention recognize more syntaxes (#31240) (#31250)
   * Remove .segment from .project-column (#31204) (#31239)
   * Ignore FindRecentlyPushedNewBranches err (#31164) (#31171)
@@ -2298,7 +2360,7 @@ Key highlights of this release encompass significant changes categorized under `
   * Performance optimization for git push and check permissions for push options (#30104) (#30354)
 * BUGFIXES
   * Fix close file in the Upload func (#30262) (#30269)
-  * Fix inline math blocks can't be preceeded/followed by alphanumerical characters (#30175) (#30250)
+  * Fix inline math blocks can't be preceded/followed by alphanumerical characters (#30175) (#30250)
   * Fix missing 0 prefix of GPG key id (#30245) (#30247)
   * Include encoding in signature payload (#30174) (#30181)
   * Move from `max( id )` to `max( index )` for latest commit statuses (#30076) (#30155)
@@ -5590,7 +5652,7 @@ Key highlights of this release encompass significant changes categorized under `
   * Fix navbar on project view (#17749)
   * More pleasantly handle broken or missing git repositories (#17747)
   * Use `*PushUpdateOptions` as receiver (#17724)
-  * Remove unused `user` paramater (#17723)
+  * Remove unused `user` parameter (#17723)
   * Better builtin avatar generator (#17707)
   * Cleanup and use global style on popups (#17674)
   * Move user/org deletion to services (#17673)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f1871f14701..6888b4ad653 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -189,6 +189,38 @@ In the PR title, describe the problem you are fixing, not how you are fixing it.
 Use the first comment as a summary of your PR. \
 In the PR summary, you can describe exactly how you are fixing this problem.
 
+PR titles must follow the [Conventional Commits](https://www.conventionalcommits.org/) format, because PRs are squash-merged and the PR title becomes the resulting commit message:
+
+```text
+type(scope)!: subject
+```
+
+The scope in parentheses is optional. A `!` immediately before the colon marks a [breaking change](https://www.conventionalcommits.org/en/v1.0.0/#summary): either `type!:` or `type(scope)!:` (not `type!(scope):`).
+
+Use one of these types:
+
+- `build`: Changes affecting the build system, packaging, or external dependencies
+- `ci`: Changes to CI/CD configuration files and scripts
+- `chore`: Maintenance changes that do not affect production code or should not appear in the changelog
+- `docs`: Documentation-only changes
+- `feat`: A larger user-facing feature, improvement, or new functionality
+- `enhance`: Small or trivial user-facing improvements or UX polish (for example wording changes, color adjustments, spacing or padding tweaks, placeholders, small UI behavior improvements)
+- `fix`: A bug fix, UX correction, or security-related dependency update
+- `perf`: Performance improvements (speed, memory, scalability)
+- `refactor`: A code change that neither fixes a bug nor adds a feature
+- `revert`: Reverts a previous change
+- `style`: Formatting or style-only changes that do not affect code behavior (for example lint-driven edits)
+- `test`: Adding or correcting tests
+
+Examples:
+
+```text
+fix(web): prevent avatar upload crash on empty file
+feat(api): add pagination to repo hooks list
+enhance(repo): improve diff toolbar spacing
+ci(workflows): lint PR titles in CI
+```
+
 Keep this summary up-to-date as the PR evolves. \
 If your PR changes the UI, you must add **after** screenshots in the PR summary. \
 If you are not implementing a new feature, you should also post **before** screenshots for comparison.
@@ -201,6 +233,10 @@ Another requirement for merging PRs is that the PR is labeled correctly.\
 However, this is not your job as a contributor, but the job of the person merging your PR.\
 If you think that your PR was labeled incorrectly, or notice that it was merged without labels, please let us know.
 
+For pull requests that use a valid Conventional Commits title, CI automatically applies a matching `type/…` label when the title prefix is `feat`, `enhance`, `fix`, `docs`, or `test` (for example `enhance(web): …` receives `type/enhancement`).\
+That label is kept in sync with the PR title when the title is edited.\
+Other title prefixes do not get an automatic `type/…` label; the merger still assigns the correct labels (including `type/…` when needed) for changelog and backport decisions.
+
 If your PR closes some issues, you must note that in a way that both GitHub and Gitea understand, i.e. by appending a paragraph like
 
 ```text
diff --git a/Dockerfile b/Dockerfile
index 323f06125fe..383e761330e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@
 FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-alpine3.23 AS frontend-build
 RUN apk --no-cache add build-base git nodejs pnpm
 WORKDIR /src
-COPY package.json pnpm-lock.yaml .npmrc ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install --frozen-lockfile
 COPY --exclude=.git/ . .
 RUN make frontend
@@ -12,7 +12,7 @@ RUN make frontend
 FROM docker.io/library/golang:1.26-alpine3.23 AS build-env
 
 ARG GITEA_VERSION
-ARG TAGS="sqlite sqlite_unlock_notify"
+ARG TAGS=""
 ENV TAGS="bindata timetzdata $TAGS"
 ARG CGO_EXTRA_CFLAGS
 
@@ -21,7 +21,7 @@ RUN apk --no-cache add \
     build-base \
     git
 
-WORKDIR ${GOPATH}/src/code.gitea.io/gitea
+WORKDIR ${GOPATH}/src/gitea.dev
 COPY go.mod go.sum ./
 RUN go mod download
 # Use COPY instead of bind mount as read-only one breaks makefile state tracking and read-write one needs binary to be moved as it's discarded.
@@ -42,7 +42,7 @@ RUN chmod 755 /tmp/local/usr/bin/entrypoint \
               /tmp/local/etc/s6/gitea/* \
               /tmp/local/etc/s6/openssh/* \
               /tmp/local/etc/s6/.s6-svscan/* \
-              /go/src/code.gitea.io/gitea/gitea
+              /go/src/gitea.dev/gitea
 
 FROM docker.io/library/alpine:3.23 AS gitea
 
@@ -74,7 +74,7 @@ RUN addgroup \
   echo "git:*" | chpasswd -e
 
 COPY --from=build-env /tmp/local /
-COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+COPY --from=build-env /go/src/gitea.dev/gitea /app/gitea/gitea
 
 ENV USER=git
 ENV GITEA_CUSTOM=/data/gitea
diff --git a/Dockerfile.rootless b/Dockerfile.rootless
index 83c69cbd513..af1ef336ae4 100644
--- a/Dockerfile.rootless
+++ b/Dockerfile.rootless
@@ -3,7 +3,7 @@
 FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26-alpine3.23 AS frontend-build
 RUN apk --no-cache add build-base git nodejs pnpm
 WORKDIR /src
-COPY package.json pnpm-lock.yaml .npmrc ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install --frozen-lockfile
 COPY --exclude=.git/ . .
 RUN make frontend
@@ -12,7 +12,7 @@ RUN make frontend
 FROM docker.io/library/golang:1.26-alpine3.23 AS build-env
 
 ARG GITEA_VERSION
-ARG TAGS="sqlite sqlite_unlock_notify"
+ARG TAGS=""
 ENV TAGS="bindata timetzdata $TAGS"
 ARG CGO_EXTRA_CFLAGS
 
@@ -21,7 +21,7 @@ RUN apk --no-cache add \
     build-base \
     git
 
-WORKDIR ${GOPATH}/src/code.gitea.io/gitea
+WORKDIR ${GOPATH}/src/gitea.dev
 COPY go.mod go.sum ./
 RUN go mod download
 # See the comments in Dockerfile
@@ -37,7 +37,7 @@ COPY docker/rootless /tmp/local
 
 # Set permissions for builds that made under windows which strips the executable bit from file
 RUN chmod 755 /tmp/local/usr/local/bin/* \
-              /go/src/code.gitea.io/gitea/gitea
+              /go/src/gitea.dev/gitea
 
 FROM docker.io/library/alpine:3.23 AS gitea-rootless
 
@@ -68,7 +68,7 @@ RUN mkdir -p /var/lib/gitea /etc/gitea
 RUN chown git:git /var/lib/gitea /etc/gitea
 
 COPY --from=build-env /tmp/local /
-COPY --from=build-env --chown=root:root /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+COPY --from=build-env --chown=root:root /go/src/gitea.dev/gitea /app/gitea/gitea
 
 # git:git
 USER 1000:1000
diff --git a/MAINTAINERS b/MAINTAINERS
index 26192eff447..03ff6999f33 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -64,4 +64,4 @@ metiftikci <metiftikci@hotmail.com> (@metiftikci)
 Christopher Homberger <christopher.homberger@web.de> (@ChristopherHX)
 Tobias Balle-Petersen <tobiasbp@gmail.com> (@tobiasbp)
 TheFox <thefox0x7@gmail.com> (@TheFox0x7)
-Nicolas <bircni@icloud.com> (@bircni)
\ No newline at end of file
+Nicolas <bircni@icloud.com> (@bircni)
diff --git a/Makefile b/Makefile
index ad7739c07b9..2b19075a484 100644
--- a/Makefile
+++ b/Makefile
@@ -11,15 +11,18 @@ COMMA := ,
 
 XGO_VERSION := go-1.26.x
 
-AIR_PACKAGE ?= github.com/air-verse/air@v1 # renovate: datasource=go
-EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3 # renovate: datasource=go
-GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4 # renovate: datasource=go
+AIR_PACKAGE ?= github.com/air-verse/air@v1.65.3 # renovate: datasource=go
+EDITORCONFIG_CHECKER_PACKAGE ?= github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.7.0 # renovate: datasource=go
+GOLANGCI_LINT_PACKAGE ?= github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 # renovate: datasource=go
 GXZ_PACKAGE ?= github.com/ulikunitz/xz/cmd/gxz@v0.5.15 # renovate: datasource=go
 MISSPELL_PACKAGE ?= github.com/golangci/misspell/cmd/misspell@v0.8.0 # renovate: datasource=go
-SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.33.1 # renovate: datasource=go
-XGO_PACKAGE ?= src.techknowlogick.com/xgo@latest
-GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1 # renovate: datasource=go
-ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.11 # renovate: datasource=go
+SWAGGER_PACKAGE ?= github.com/go-swagger/go-swagger/cmd/swagger@v0.33.2 # renovate: datasource=go
+XGO_PACKAGE ?= src.techknowlogick.com/xgo@v1.9.0 # renovate: datasource=go
+GOVULNCHECK_PACKAGE ?= golang.org/x/vuln/cmd/govulncheck@v1.3.0 # renovate: datasource=go
+ACTIONLINT_PACKAGE ?= github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 # renovate: datasource=go
+SHELLCHECK_IMAGE ?= docker.io/koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d # renovate: datasource=docker
+
+CONTAINER_RUNTIME ?= $(shell hash docker >/dev/null 2>&1 && echo docker || echo podman)
 
 HAS_GO := $(shell hash $(GO) > /dev/null 2>&1 && echo yes)
 ifeq ($(HAS_GO), yes)
@@ -38,13 +41,10 @@ ifneq ($(findstring test-,$(MAKECMDGOALS)),)
 endif
 
 TAGS ?=
-ifeq ($(GITEA_TEST_DATABASE),sqlite)
-	TAGS += sqlite sqlite_unlock_notify
-endif
 TAGS_EVIDENCE := $(MAKE_EVIDENCE_DIR)/tags
 
 CGO_ENABLED ?= 0
-ifneq (,$(findstring sqlite,$(TAGS))$(findstring pam,$(TAGS)))
+ifneq (,$(findstring sqlite_mattn,$(TAGS))$(findstring pam,$(TAGS)))
 	CGO_ENABLED = 1
 endif
 
@@ -113,8 +113,8 @@ LDFLAGS := $(LDFLAGS) -X "main.Version=$(GITEA_VERSION)" -X "main.Tags=$(TAGS)"
 
 LINUX_ARCHS ?= linux/amd64,linux/386,linux/arm-5,linux/arm-6,linux/arm64,linux/riscv64
 
-GO_TEST_PACKAGES ?= $(filter-out $(shell $(GO) list code.gitea.io/gitea/models/migrations/...) code.gitea.io/gitea/tests/integration/migration-test code.gitea.io/gitea/tests code.gitea.io/gitea/tests/integration,$(shell $(GO) list ./... | grep -v /vendor/))
-MIGRATE_TEST_PACKAGES ?= $(shell $(GO) list code.gitea.io/gitea/models/migrations/...)
+GO_TEST_PACKAGES ?= $(filter-out $(shell $(GO) list gitea.dev/models/migrations/...) gitea.dev/tests/integration/migration-test gitea.dev/tests gitea.dev/tests/integration,$(shell $(GO) list ./... | grep -v /vendor/))
+MIGRATE_TEST_PACKAGES ?= $(shell $(GO) list gitea.dev/models/migrations/...)
 
 FRONTEND_SOURCES := $(shell find web_src/js web_src/css -type f)
 FRONTEND_CONFIGS := vite.config.ts tailwind.config.ts
@@ -150,7 +150,7 @@ ESLINT_CONCURRENCY ?= 2
 
 SWAGGER_SPEC := templates/swagger/v1_json.tmpl
 SWAGGER_SPEC_INPUT := templates/swagger/v1_input.json
-SWAGGER_EXCLUDE := code.gitea.io/sdk
+SWAGGER_EXCLUDE := gitea.dev/sdk
 OPENAPI3_SPEC := templates/swagger/v1_openapi3_json.tmpl
 
 TEST_MYSQL_HOST ?= mysql:3306
@@ -274,7 +274,7 @@ checks-frontend: lockfile-check svg-check ## check frontend files
 checks-backend: tidy-check swagger-check openapi3-check fmt-check swagger-validate security-check ## check backend files
 
 .PHONY: lint
-lint: lint-frontend lint-backend lint-templates lint-swagger lint-spell lint-md lint-actions lint-json lint-yaml ## lint everything
+lint: lint-frontend lint-backend lint-templates lint-swagger lint-spell lint-md lint-actions lint-json lint-yaml lint-shell ## lint everything
 
 .PHONY: lint-fix
 lint-fix: lint-frontend-fix lint-backend-fix lint-spell-fix ## lint everything and fix issues
@@ -331,18 +331,11 @@ lint-spell-fix: ## lint spelling and fix issues
 
 .PHONY: lint-go
 lint-go: ## lint go files
-	$(GO) run $(GOLANGCI_LINT_PACKAGE) run
+	GO=$(GO) GOLANGCI_LINT_PACKAGE=$(GOLANGCI_LINT_PACKAGE) $(GO) run ./tools/lint-go-all.go
 
 .PHONY: lint-go-fix
 lint-go-fix: ## lint go files and fix issues
-	$(GO) run $(GOLANGCI_LINT_PACKAGE) run --fix
-
-# workaround step for the lint-go-windows CI task because 'go run' can not
-# have distinct GOOS/GOARCH for its build and run steps
-.PHONY: lint-go-windows
-lint-go-windows:
-	@GOOS= GOARCH= $(GO) install $(GOLANGCI_LINT_PACKAGE)
-	golangci-lint run
+	GO=$(GO) GOLANGCI_LINT_PACKAGE=$(GOLANGCI_LINT_PACKAGE) $(GO) run ./tools/lint-go-all.go --fix
 
 .PHONY: lint-editorconfig
 lint-editorconfig:
@@ -350,8 +343,13 @@ lint-editorconfig:
 	@$(GO) run $(EDITORCONFIG_CHECKER_PACKAGE) $(EDITORCONFIG_FILES)
 
 .PHONY: lint-actions
-lint-actions: ## lint action workflow files
-	$(GO) run $(ACTIONLINT_PACKAGE)
+lint-actions: .venv ## lint action workflow files
+	@$(GO) run $(ACTIONLINT_PACKAGE)
+	@uv run --frozen zizmor --quiet --min-confidence=medium .github
+
+.PHONY: lint-shell
+lint-shell: ## lint shell scripts
+	@SHELLCHECK_IMAGE=$(SHELLCHECK_IMAGE) CONTAINER_RUNTIME=$(CONTAINER_RUNTIME) ./tools/lint-shell.sh $$(git ls-files '*.sh')
 
 .PHONY: lint-templates
 lint-templates: .venv node_modules ## lint template files
@@ -449,19 +447,23 @@ test-integration:
 	@# Use a compiled binary: testlogger forwards gitea logs to t.Log, so `go test -v`
 	@# would flood output per passing test. testcache can't help these tests anyway —
 	@# they mutate the work directory, so cache inputs change between runs.
-	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' -c code.gitea.io/gitea/tests/integration -o ./test-integration-$(GITEA_TEST_DATABASE).test
-	./test-integration-$(GITEA_TEST_DATABASE).test
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' -c gitea.dev/tests/integration -o ./test-integration-$(GITEA_TEST_DATABASE).test
+	./tools/test-integration.sh ./test-integration-$(GITEA_TEST_DATABASE).test
+
+.PHONY: test-integration-compile
+test-integration-compile:
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' -c -o /dev/null gitea.dev/tests/integration
 
 .PHONY: test-integration\#%
 test-integration\#%:
-	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' -run $(subst .,/,$*) code.gitea.io/gitea/tests/integration
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' -run $(subst .,/,$*) gitea.dev/tests/integration
 
 .PHONY: test-migration
 test-migration: migrations.integration.test migrations.individual.test
 
 .PHONY: migrations.integration.test
 migrations.integration.test:
-	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' code.gitea.io/gitea/tests/integration/migration-test
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' gitea.dev/tests/integration/migration-test
 
 .PHONY: migrations.individual.test
 migrations.individual.test:
@@ -470,16 +472,15 @@ migrations.individual.test:
 
 .PHONY: migrations.individual.test\#%
 migrations.individual.test\#%:
-	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' code.gitea.io/gitea/models/migrations/$*
+	$(GO) test $(GOTEST_FLAGS) -tags '$(TAGS)' gitea.dev/models/migrations/$*
 
 .PHONY: playwright
 playwright: deps-frontend
-	@# on GitHub Actions VMs, playwright's system deps are pre-installed
-	@pnpm exec playwright install $(if $(GITHUB_ACTIONS),,--with-deps) chromium firefox $(PLAYWRIGHT_FLAGS)
+	@CONTAINER_RUNTIME=$(CONTAINER_RUNTIME) ./tools/test-e2e.sh install
 
 .PHONY: test-e2e
 test-e2e: playwright frontend backend
-	@EXECUTABLE=$(EXECUTABLE) ./tools/test-e2e.sh $(GITEA_TEST_E2E_FLAGS)
+	@CONTAINER_RUNTIME=$(CONTAINER_RUNTIME) EXECUTABLE=$(EXECUTABLE) ./tools/test-e2e.sh run $(GITEA_TEST_E2E_FLAGS)
 
 .PHONY: build
 build: frontend backend ## build everything
@@ -606,8 +607,6 @@ update-js: node_modules ## update js dependencies
 	pnpm exec updates -u -f package.json
 	rm -rf node_modules pnpm-lock.yaml
 	pnpm install
-	pnpm exec nolyfill install
-	pnpm install
 	@touch node_modules
 
 .PHONY: update-py
@@ -661,6 +660,10 @@ generate-gitignore: ## update gitignore files
 generate-images: | node_modules ## generate images
 	cd tools && node generate-images.ts $(TAGS)
 
+.PHONY: generate-codemirror-languages
+generate-codemirror-languages: | node_modules ## generate codemirror languages
+	node tools/generate-codemirror-languages.ts
+
 .PHONY: generate-manpage
 generate-manpage: ## generate manpage
 	@[ -f gitea ] || make backend
diff --git a/README.md b/README.md
index 7ebeac97be0..3aa5138dac4 100644
--- a/README.md
+++ b/README.md
@@ -2,8 +2,8 @@
 
 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-[![](https://goreportcard.com/badge/code.gitea.io/gitea)](https://goreportcard.com/report/code.gitea.io/gitea "Go Report Card")
-[![](https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg)](https://pkg.go.dev/code.gitea.io/gitea "GoDoc")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
+[![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
 [![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
@@ -44,10 +44,6 @@ From the root of the source tree, run:
 
     TAGS="bindata" make build
 
-or if SQLite support is required:
-
-    TAGS="bindata sqlite sqlite_unlock_notify" make build
-
 The `build` target is split into two sub-targets:
 
 - `make backend` which requires [Go Stable](https://go.dev/dl/), the required version is defined in [go.mod](/go.mod).
diff --git a/README.zh-cn.md b/README.zh-cn.md
index 8ccacc0fea4..0855827f2e2 100644
--- a/README.zh-cn.md
+++ b/README.zh-cn.md
@@ -2,8 +2,8 @@
 
 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-[![](https://goreportcard.com/badge/code.gitea.io/gitea)](https://goreportcard.com/report/code.gitea.io/gitea "Go Report Card")
-[![](https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg)](https://pkg.go.dev/code.gitea.io/gitea "GoDoc")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
+[![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
 [![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
@@ -38,10 +38,6 @@
 
     TAGS="bindata" make build
 
-如果需要 SQLite 支持：
-
-    TAGS="bindata sqlite sqlite_unlock_notify" make build
-
 `build` 目标分为两个子目标：
 
 - `make backend` 需要 [Go Stable](https://go.dev/dl/)，所需版本在 [go.mod](/go.mod) 中定义。
diff --git a/README.zh-tw.md b/README.zh-tw.md
index 4160fd0bd91..0c89d041667 100644
--- a/README.zh-tw.md
+++ b/README.zh-tw.md
@@ -2,8 +2,8 @@
 
 [![](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml/badge.svg?branch=main)](https://github.com/go-gitea/gitea/actions/workflows/release-nightly.yml?query=branch%3Amain "Release Nightly")
 [![](https://img.shields.io/discord/322538954119184384.svg?logo=discord&logoColor=white&label=Discord&color=5865F2)](https://discord.gg/Gitea "Join the Discord chat at https://discord.gg/Gitea")
-[![](https://goreportcard.com/badge/code.gitea.io/gitea)](https://goreportcard.com/report/code.gitea.io/gitea "Go Report Card")
-[![](https://pkg.go.dev/badge/code.gitea.io/gitea?status.svg)](https://pkg.go.dev/code.gitea.io/gitea "GoDoc")
+[![](https://goreportcard.com/badge/gitea.dev)](https://goreportcard.com/report/gitea.dev "Go Report Card")
+[![](https://pkg.go.dev/badge/gitea.dev?status.svg)](https://pkg.go.dev/gitea.dev "GoDoc")
 [![](https://img.shields.io/github/release/go-gitea/gitea.svg)](https://github.com/go-gitea/gitea/releases/latest "GitHub release")
 [![](https://www.codetriage.com/go-gitea/gitea/badges/users.svg)](https://www.codetriage.com/go-gitea/gitea "Help Contribute to Open Source")
 [![](https://opencollective.com/gitea/tiers/backers/badge.svg?label=backers&color=brightgreen)](https://opencollective.com/gitea "Become a backer/sponsor of gitea")
@@ -38,10 +38,6 @@
 
     TAGS="bindata" make build
 
-如果需要 SQLite 支援：
-
-    TAGS="bindata sqlite sqlite_unlock_notify" make build
-
 `build` 目標分為兩個子目標：
 
 - `make backend` 需要 [Go Stable](https://go.dev/dl/)，所需版本在 [go.mod](/go.mod) 中定義。
diff --git a/assets/codemirror-languages.json b/assets/codemirror-languages.json
new file mode 100644
index 00000000000..573e7c493b3
--- /dev/null
+++ b/assets/codemirror-languages.json
@@ -0,0 +1,1277 @@
+[
+  {
+    "name": "APL",
+    "extensions": [
+      "apl",
+      "dyalog"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "ASN.1",
+    "extensions": [
+      "asn",
+      "asn1"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Brainfuck",
+    "extensions": [
+      "b",
+      "bf"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "C",
+    "extensions": [
+      "c",
+      "cats",
+      "h",
+      "idc"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "C#",
+    "extensions": [
+      "cs",
+      "cake",
+      "csx",
+      "linq"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "C++",
+    "extensions": [
+      "cpp",
+      "c++",
+      "cc",
+      "cp",
+      "cppm",
+      "cxx",
+      "h++",
+      "hh",
+      "hpp",
+      "hxx",
+      "inl",
+      "ipp",
+      "ixx",
+      "re",
+      "tcc",
+      "tpp",
+      "txx"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Clojure",
+    "extensions": [
+      "clj",
+      "bb",
+      "boot",
+      "cl2",
+      "cljc",
+      "cljscm",
+      "cljx",
+      "hic"
+    ],
+    "filenames": [
+      "riemann.config"
+    ]
+  },
+  {
+    "name": "CMake",
+    "extensions": [
+      "cmake"
+    ],
+    "filenames": [
+      "CMakeLists.txt"
+    ]
+  },
+  {
+    "name": "Cobol",
+    "extensions": [
+      "cob",
+      "cbl",
+      "ccp",
+      "cobol",
+      "cpy"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "CoffeeScript",
+    "extensions": [
+      "coffee",
+      "_coffee",
+      "cake",
+      "cjsx",
+      "iced"
+    ],
+    "filenames": [
+      "Cakefile"
+    ]
+  },
+  {
+    "name": "Common Lisp",
+    "extensions": [
+      "lisp",
+      "asd",
+      "cl",
+      "l",
+      "lsp",
+      "ny",
+      "podsl",
+      "sexp"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "CQL",
+    "extensions": [
+      "cql"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Crystal",
+    "extensions": [
+      "cr"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "CSS",
+    "extensions": [
+      "css"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Cypher",
+    "extensions": [
+      "cyp",
+      "cypher"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Cython",
+    "extensions": [
+      "pyx",
+      "pxd",
+      "pxi"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "D",
+    "extensions": [
+      "d",
+      "di"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Dart",
+    "extensions": [
+      "dart"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "diff",
+    "extensions": [
+      "diff",
+      "patch"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Dylan",
+    "extensions": [
+      "dylan",
+      "dyl",
+      "intr",
+      "lid"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "EBNF",
+    "extensions": [
+      "ebnf"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "ECL",
+    "extensions": [
+      "ecl",
+      "eclxml"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "edn",
+    "extensions": [
+      "edn"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Eiffel",
+    "extensions": [
+      "e"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Elm",
+    "extensions": [
+      "elm"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Erlang",
+    "extensions": [
+      "erl",
+      "app",
+      "es",
+      "escript",
+      "hrl",
+      "xrl",
+      "yrl"
+    ],
+    "filenames": [
+      "Emakefile",
+      "rebar.config",
+      "rebar.config.lock",
+      "rebar.lock"
+    ]
+  },
+  {
+    "name": "F#",
+    "extensions": [
+      "fs",
+      "fsi",
+      "fsx"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Factor",
+    "extensions": [
+      "factor"
+    ],
+    "filenames": [
+      ".factor-boot-rc",
+      ".factor-rc"
+    ]
+  },
+  {
+    "name": "Forth",
+    "extensions": [
+      "fth",
+      "4th",
+      "forth",
+      "fr",
+      "frt"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Fortran",
+    "extensions": [
+      "f",
+      "f77",
+      "for",
+      "fpp"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Gherkin",
+    "extensions": [
+      "feature",
+      "story"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Go",
+    "extensions": [
+      "go"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Groovy",
+    "extensions": [
+      "groovy",
+      "grt",
+      "gtpl",
+      "gvy"
+    ],
+    "filenames": [
+      "Jenkinsfile"
+    ]
+  },
+  {
+    "name": "Haskell",
+    "extensions": [
+      "hs",
+      "hs-boot",
+      "hsc"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Haxe",
+    "extensions": [
+      "hx",
+      "hxsl"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "HTML",
+    "extensions": [
+      "html",
+      "hta",
+      "htm",
+      "xht",
+      "xhtml"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "HTTP",
+    "extensions": [
+      "http"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "HXML",
+    "extensions": [
+      "hxml"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "IDL",
+    "extensions": [
+      "pro",
+      "dlm"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Java",
+    "extensions": [
+      "java",
+      "jav",
+      "jsh"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "JavaScript",
+    "extensions": [
+      "js",
+      "_js",
+      "bones",
+      "cjs",
+      "es",
+      "es6",
+      "frag",
+      "gs",
+      "jake",
+      "javascript",
+      "jsb",
+      "jscad",
+      "jsfl",
+      "jslib",
+      "jsm",
+      "jspre",
+      "jss",
+      "mjs",
+      "njs",
+      "pac",
+      "sjs",
+      "ssjs",
+      "xsjs",
+      "xsjslib"
+    ],
+    "filenames": [
+      "Jakefile"
+    ]
+  },
+  {
+    "name": "Jinja",
+    "extensions": [
+      "jinja",
+      "j2",
+      "jinja2"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "JSON",
+    "extensions": [
+      "json",
+      "4DForm",
+      "4DProject",
+      "avsc",
+      "geojson",
+      "gltf",
+      "har",
+      "ice",
+      "JSON-tmLanguage",
+      "jsonl",
+      "mcmeta",
+      "sarif",
+      "tact",
+      "tfstate",
+      "topojson",
+      "webapp",
+      "webmanifest",
+      "yy",
+      "yyp"
+    ],
+    "filenames": [
+      ".all-contributorsrc",
+      ".arcconfig",
+      ".auto-changelog",
+      ".c8rc",
+      ".htmlhintrc",
+      ".imgbotconfig",
+      ".nycrc",
+      ".tern-config",
+      ".tern-project",
+      ".watchmanconfig",
+      "MODULE.bazel.lock",
+      "Package.resolved",
+      "Pipfile.lock",
+      "bun.lock",
+      "composer.lock",
+      "deno.lock",
+      "flake.lock",
+      "mcmod.info"
+    ]
+  },
+  {
+    "name": "JSON-LD",
+    "extensions": [
+      "jsonld"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Julia",
+    "extensions": [
+      "jl"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Kotlin",
+    "extensions": [
+      "kt",
+      "ktm",
+      "kts"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "LaTeX",
+    "extensions": [
+      "tex",
+      "aux",
+      "bbx",
+      "cbx",
+      "cls",
+      "dtx",
+      "ins",
+      "lbx",
+      "ltx",
+      "mkii",
+      "mkiv",
+      "mkvi",
+      "sty",
+      "toc"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "LESS",
+    "extensions": [
+      "less"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Liquid",
+    "extensions": [
+      "liquid"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "LiveScript",
+    "extensions": [
+      "ls",
+      "_ls"
+    ],
+    "filenames": [
+      "Slakefile"
+    ]
+  },
+  {
+    "name": "Lua",
+    "extensions": [
+      "lua",
+      "nse",
+      "p8",
+      "pd_lua",
+      "rbxs",
+      "rockspec",
+      "wlua"
+    ],
+    "filenames": [
+      ".luacheckrc"
+    ]
+  },
+  {
+    "name": "Modelica",
+    "extensions": [
+      "mo"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Nginx",
+    "extensions": [
+      "nginx",
+      "nginxconf",
+      "vhost"
+    ],
+    "filenames": [
+      "nginx.conf"
+    ]
+  },
+  {
+    "name": "NSIS",
+    "extensions": [
+      "nsi",
+      "nsh"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Objective-C",
+    "extensions": [],
+    "filenames": []
+  },
+  {
+    "name": "Objective-C++",
+    "extensions": [
+      "mm"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "OCaml",
+    "extensions": [
+      "ml",
+      "eliom",
+      "eliomi",
+      "ml4",
+      "mli",
+      "mll",
+      "mly"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Oz",
+    "extensions": [
+      "oz"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Pascal",
+    "extensions": [
+      "pas",
+      "dfm",
+      "dpr",
+      "lpr",
+      "pascal"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Perl",
+    "extensions": [
+      "pl",
+      "al",
+      "perl",
+      "ph",
+      "plx",
+      "pm",
+      "psgi",
+      "t"
+    ],
+    "filenames": [
+      ".latexmkrc",
+      "Makefile.PL",
+      "Rexfile",
+      "ack",
+      "cpanfile",
+      "latexmkrc"
+    ]
+  },
+  {
+    "name": "PHP",
+    "extensions": [
+      "php",
+      "aw",
+      "ctp",
+      "php3",
+      "php4",
+      "php5",
+      "phps",
+      "phpt"
+    ],
+    "filenames": [
+      ".php",
+      ".php_cs",
+      ".php_cs.dist",
+      "Phakefile"
+    ]
+  },
+  {
+    "name": "PLSQL",
+    "extensions": [
+      "pls",
+      "bdy",
+      "ddl",
+      "fnc",
+      "pck",
+      "pkb",
+      "pks",
+      "plb",
+      "plsql",
+      "prc",
+      "spc",
+      "tpb",
+      "tps",
+      "trg",
+      "vw"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "PowerShell",
+    "extensions": [
+      "ps1",
+      "psd1",
+      "psm1"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Properties files",
+    "extensions": [
+      "ini",
+      "cnf",
+      "dof",
+      "lektorproject",
+      "prefs",
+      "properties",
+      "url",
+      "conf"
+    ],
+    "filenames": [
+      ".buckconfig",
+      ".coveragerc",
+      ".flake8",
+      ".pylintrc",
+      "HOSTS",
+      "buildozer.spec",
+      "hosts",
+      "pylintrc",
+      "vlcrc",
+      ".editorconfig",
+      ".gitconfig",
+      ".npmrc"
+    ]
+  },
+  {
+    "name": "ProtoBuf",
+    "extensions": [
+      "proto"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Pug",
+    "extensions": [
+      "jade",
+      "pug"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Puppet",
+    "extensions": [
+      "pp"
+    ],
+    "filenames": [
+      "Modulefile"
+    ]
+  },
+  {
+    "name": "Python",
+    "extensions": [
+      "py",
+      "gyp",
+      "gypi",
+      "lmi",
+      "py3",
+      "pyde",
+      "pyi",
+      "pyp",
+      "pyt",
+      "pyw",
+      "rpy",
+      "tac",
+      "wsgi",
+      "xpy"
+    ],
+    "filenames": [
+      ".gclient",
+      "DEPS",
+      "SConscript",
+      "SConstruct",
+      "wscript",
+      "Snakefile"
+    ]
+  },
+  {
+    "name": "Q",
+    "extensions": [
+      "q"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "R",
+    "extensions": [
+      "r",
+      "rd",
+      "rsx"
+    ],
+    "filenames": [
+      ".Rprofile",
+      "expr-dist"
+    ]
+  },
+  {
+    "name": "RPM Spec",
+    "extensions": [
+      "spec"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Ruby",
+    "extensions": [
+      "rb",
+      "builder",
+      "eye",
+      "gemspec",
+      "god",
+      "jbuilder",
+      "mspec",
+      "pluginspec",
+      "podspec",
+      "prawn",
+      "rabl",
+      "rake",
+      "rbi",
+      "rbuild",
+      "rbw",
+      "rbx",
+      "ru",
+      "ruby",
+      "thor",
+      "watchr"
+    ],
+    "filenames": [
+      ".irbrc",
+      ".pryrc",
+      ".simplecov",
+      "Appraisals",
+      "Berksfile",
+      "Brewfile",
+      "Buildfile",
+      "Capfile",
+      "Dangerfile",
+      "Deliverfile",
+      "Fastfile",
+      "Gemfile",
+      "Guardfile",
+      "Jarfile",
+      "Mavenfile",
+      "Podfile",
+      "Puppetfile",
+      "Rakefile",
+      "Snapfile",
+      "Steepfile",
+      "Thorfile",
+      "Vagrantfile",
+      "buildfile"
+    ]
+  },
+  {
+    "name": "Rust",
+    "extensions": [
+      "rs"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "SAS",
+    "extensions": [
+      "sas"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Sass",
+    "extensions": [
+      "sass"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Scala",
+    "extensions": [
+      "scala",
+      "kojo",
+      "sbt",
+      "sc"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Scheme",
+    "extensions": [
+      "scm",
+      "sch",
+      "sld",
+      "sls",
+      "sps",
+      "ss"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "SCSS",
+    "extensions": [
+      "scss"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Shell",
+    "extensions": [
+      "sh",
+      "bash",
+      "bats",
+      "command",
+      "ksh",
+      "sbatch",
+      "slurm",
+      "tmux",
+      "tool",
+      "trigger",
+      "zsh",
+      "zsh-theme"
+    ],
+    "filenames": [
+      ".bash_aliases",
+      ".bash_functions",
+      ".bash_history",
+      ".bash_logout",
+      ".bash_profile",
+      ".bashrc",
+      ".cshrc",
+      ".envrc",
+      ".flaskenv",
+      ".kshrc",
+      ".login",
+      ".profile",
+      ".tmux.conf",
+      ".xinitrc",
+      ".xsession",
+      ".zlogin",
+      ".zlogout",
+      ".zprofile",
+      ".zshenv",
+      ".zshrc",
+      "9fs",
+      "PKGBUILD",
+      "bash_aliases",
+      "bash_logout",
+      "bash_profile",
+      "bashrc",
+      "cshrc",
+      "gradlew",
+      "kshrc",
+      "login",
+      "man",
+      "mvnw",
+      "profile",
+      "tmux.conf",
+      "xinitrc",
+      "xsession",
+      "zlogin",
+      "zlogout",
+      "zprofile",
+      "zshenv",
+      "zshrc"
+    ]
+  },
+  {
+    "name": "Sieve",
+    "extensions": [
+      "sieve"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Smalltalk",
+    "extensions": [
+      "st"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "SPARQL",
+    "extensions": [
+      "sparql",
+      "rq"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "SQL",
+    "extensions": [
+      "sql",
+      "ddl",
+      "mysql",
+      "prc",
+      "tab",
+      "udf",
+      "viw"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Squirrel",
+    "extensions": [
+      "nut"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Stylus",
+    "extensions": [
+      "styl"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Swift",
+    "extensions": [
+      "swift"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "SystemVerilog",
+    "extensions": [
+      "sv",
+      "svh",
+      "vh"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Tcl",
+    "extensions": [
+      "tcl",
+      "adp",
+      "sdc",
+      "tm",
+      "xdc"
+    ],
+    "filenames": [
+      "owh",
+      "starfield"
+    ]
+  },
+  {
+    "name": "Textile",
+    "extensions": [
+      "textile"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "TOML",
+    "extensions": [
+      "toml"
+    ],
+    "filenames": [
+      "Cargo.lock",
+      "Cargo.toml.orig",
+      "Gopkg.lock",
+      "Pipfile",
+      "mise.local.lock",
+      "mise.lock",
+      "pdm.lock",
+      "poetry.lock",
+      "uv.lock"
+    ]
+  },
+  {
+    "name": "TSX",
+    "extensions": [
+      "tsx"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Turtle",
+    "extensions": [
+      "ttl"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "TypeScript",
+    "extensions": [
+      "ts",
+      "cts",
+      "mts"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "VBScript",
+    "extensions": [
+      "vbs"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Verilog",
+    "extensions": [
+      "veo"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "VHDL",
+    "extensions": [
+      "vhdl",
+      "vhd",
+      "vhf",
+      "vhi",
+      "vho",
+      "vhs",
+      "vht",
+      "vhw"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "Vue",
+    "extensions": [
+      "vue"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "WebAssembly",
+    "extensions": [
+      "wast",
+      "wat"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "XML",
+    "extensions": [
+      "xml",
+      "adml",
+      "admx",
+      "ant",
+      "axaml",
+      "axml",
+      "builds",
+      "ccproj",
+      "ccxml",
+      "clixml",
+      "cproject",
+      "cscfg",
+      "csdef",
+      "csl",
+      "csproj",
+      "ct",
+      "depproj",
+      "dita",
+      "ditamap",
+      "ditaval",
+      "dotsettings",
+      "filters",
+      "fsproj",
+      "fxml",
+      "glade",
+      "gml",
+      "gmx",
+      "gpx",
+      "grxml",
+      "gst",
+      "hzp",
+      "icls",
+      "iml",
+      "ivy",
+      "jelly",
+      "jsproj",
+      "kml",
+      "launch",
+      "mdpolicy",
+      "mjml",
+      "mod",
+      "mojo",
+      "mxml",
+      "natvis",
+      "ncl",
+      "ndproj",
+      "nproj",
+      "nuspec",
+      "odd",
+      "osm",
+      "pkgproj",
+      "pluginspec",
+      "proj",
+      "props",
+      "ps1xml",
+      "psc1",
+      "pt",
+      "pubxml",
+      "qhelp",
+      "rdf",
+      "res",
+      "resx",
+      "rss",
+      "sch",
+      "scxml",
+      "sfproj",
+      "shproj",
+      "slnx",
+      "srdf",
+      "storyboard",
+      "sublime-snippet",
+      "sw",
+      "targets",
+      "tml",
+      "typ",
+      "ui",
+      "urdf",
+      "ux",
+      "vbproj",
+      "vcxproj",
+      "vsixmanifest",
+      "vssettings",
+      "vstemplate",
+      "vxml",
+      "wixproj",
+      "workflow",
+      "wsdl",
+      "wsf",
+      "wxi",
+      "wxl",
+      "wxs",
+      "x3d",
+      "xacro",
+      "xaml",
+      "xib",
+      "xlf",
+      "xliff",
+      "xmi",
+      "xmp",
+      "xproj",
+      "xsd",
+      "xspec",
+      "xul",
+      "zcml"
+    ],
+    "filenames": [
+      ".classpath",
+      ".cproject",
+      ".project",
+      "App.config",
+      "NuGet.config",
+      "Settings.StyleCop",
+      "Web.Debug.config",
+      "Web.Release.config",
+      "Web.config",
+      "packages.config"
+    ]
+  },
+  {
+    "name": "XQuery",
+    "extensions": [
+      "xquery",
+      "xq",
+      "xql",
+      "xqm",
+      "xqy"
+    ],
+    "filenames": []
+  },
+  {
+    "name": "YAML",
+    "extensions": [
+      "yml",
+      "mir",
+      "reek",
+      "rviz",
+      "sublime-syntax",
+      "syntax",
+      "yaml",
+      "yaml-tmlanguage"
+    ],
+    "filenames": [
+      ".clang-format",
+      ".clang-tidy",
+      ".clangd",
+      ".gemrc",
+      "CITATION.cff",
+      "glide.lock",
+      "pixi.lock",
+      "yarn.lock"
+    ]
+  }
+]
diff --git a/assets/go-licenses.json b/assets/go-licenses.json
index e642cb2c59f..22dc1696246 100644
--- a/assets/go-licenses.json
+++ b/assets/go-licenses.json
@@ -4,21 +4,6 @@
     "path": "cloud.google.com/go/compute/metadata/LICENSE",
     "licenseText": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"[]\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright [yyyy] [name of copyright owner]\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n"
   },
-  {
-    "name": "code.gitea.io/actions-proto-go",
-    "path": "code.gitea.io/actions-proto-go/LICENSE",
-    "licenseText": "MIT License\n\nCopyright (c) 2022 The Gitea Authors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n"
-  },
-  {
-    "name": "code.gitea.io/gitea/modules/lfs",
-    "path": "code.gitea.io/gitea/modules/lfs/LICENSE",
-    "licenseText": "Copyright (c) 2016 The Gitea Authors\nCopyright (c) GitHub, Inc. and LFS Test Server contributors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
-  },
-  {
-    "name": "code.gitea.io/sdk/gitea",
-    "path": "code.gitea.io/sdk/gitea/LICENSE",
-    "licenseText": "Copyright (c) 2016 The Gitea Authors\nCopyright (c) 2014 The Gogs Authors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
-  },
   {
     "name": "codeberg.org/gusted/mcaptcha",
     "path": "codeberg.org/gusted/mcaptcha/LICENSE",
@@ -39,6 +24,16 @@
     "path": "filippo.io/edwards25519/LICENSE",
     "licenseText": "Copyright (c) 2009 The Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
   },
+  {
+    "name": "gitea.com/gitea/runner",
+    "path": "gitea.com/gitea/runner/LICENSE",
+    "licenseText": "Copyright (c) 2022 The Gitea Authors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
+  },
+  {
+    "name": "gitea.com/gitea/runner/act",
+    "path": "gitea.com/gitea/runner/act/LICENSE",
+    "licenseText": "MIT License\n\nCopyright (c) 2022 The Gitea Authors\nCopyright (c) 2019\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
+  },
   {
     "name": "gitea.com/go-chi/binding",
     "path": "gitea.com/go-chi/binding/LICENSE",
@@ -69,6 +64,21 @@
     "path": "gitea.com/lunny/levelqueue/LICENSE",
     "licenseText": "Copyright (c) 2019 Lunny Xiao\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
   },
+  {
+    "name": "gitea.dev/actions-proto-go",
+    "path": "gitea.dev/actions-proto-go/LICENSE",
+    "licenseText": "MIT License\n\nCopyright (c) 2022 The Gitea Authors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n"
+  },
+  {
+    "name": "gitea.dev/modules/lfs",
+    "path": "gitea.dev/modules/lfs/LICENSE",
+    "licenseText": "Copyright (c) 2016 The Gitea Authors\nCopyright (c) GitHub, Inc. and LFS Test Server contributors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
+  },
+  {
+    "name": "gitea.dev/sdk",
+    "path": "gitea.dev/sdk/LICENSE",
+    "licenseText": "Copyright (c) 2016 The Gitea Authors\nCopyright (c) 2014 The Gogs Authors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
+  },
   {
     "name": "github.com/42wim/httpsig",
     "path": "github.com/42wim/httpsig/LICENSE",
@@ -104,6 +114,11 @@
     "path": "github.com/DataDog/zstd/LICENSE",
     "licenseText": "Simplified BSD License\n\nCopyright (c) 2016, Datadog \u003cinfo@datadoghq.com\u003e\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n    * Redistributions of source code must retain the above copyright notice,\n      this list of conditions and the following disclaimer.\n    * Redistributions in binary form must reproduce the above copyright notice,\n      this list of conditions and the following disclaimer in the documentation\n      and/or other materials provided with the distribution.\n    * Neither the name of the copyright holder nor the names of its contributors\n      may be used to endorse or promote products derived from this software\n      without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
   },
+  {
+    "name": "github.com/Necoro/html2text",
+    "path": "github.com/Necoro/html2text/LICENSE",
+    "licenseText": "The MIT License (MIT)\n\nCopyright (c) 2015 Jay Taylor\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n"
+  },
   {
     "name": "github.com/ProtonMail/go-crypto",
     "path": "github.com/ProtonMail/go-crypto/LICENSE",
@@ -132,7 +147,7 @@
   {
     "name": "github.com/alecthomas/chroma/v2",
     "path": "github.com/alecthomas/chroma/v2/COPYING",
-    "licenseText": "Copyright (C) 2017 Alec Thomas\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies\nof the Software, and to permit persons to whom the Software is furnished to do\nso, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
+    "licenseText": "Copyright (C) 2017 Alec Thomas\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies\nof the Software, and to permit persons to whom the Software is furnished to do\nso, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n\n// formatters/svg/font_liberation_mono.go\n\nDigitized data copyright (c) 2010 Google Corporation\nwith Reserved Font Arimo, Tinos and Cousine.\nCopyright (c) 2012 Red Hat, Inc.\nwith Reserved Font Name Liberation.\n\nThis Font Software is licensed under the SIL Open Font License, Version 1.1.\nThis license is copied below, and is also available with a FAQ at:\nhttps://openfontlicense.org\n\n-----------------------------------------------------------\nSIL OPEN FONT LICENSE Version 1.1 - 26 February 2007\n-----------------------------------------------------------\n\nPREAMBLE\nThe goals of the Open Font License (OFL) are to stimulate worldwide\ndevelopment of collaborative font projects, to support the font creation\nefforts of academic and linguistic communities, and to provide a free and\nopen framework in which fonts may be shared and improved in partnership\nwith others.\n\nThe OFL allows the licensed fonts to be used, studied, modified and\nredistributed freely as long as they are not sold by themselves. The\nfonts, including any derivative works, can be bundled, embedded,\nredistributed and/or sold with any software provided that any reserved\nnames are not used by derivative works. The fonts and derivatives,\nhowever, cannot be released under any other type of license. The\nrequirement for fonts to remain under this license does not apply\nto any document created using the fonts or their derivatives.\n\nDEFINITIONS\n\"Font Software\" refers to the set of files released by the Copyright\nHolder(s) under this license and clearly marked as such. This may\ninclude source files, build scripts and documentation.\n\n\"Reserved Font Name\" refers to any names specified as such after the\ncopyright statement(s).\n\n\"Original Version\" refers to the collection of Font Software components as\ndistributed by the Copyright Holder(s).\n\n\"Modified Version\" refers to any derivative made by adding to, deleting,\nor substituting -- in part or in whole -- any of the components of the\nOriginal Version, by changing formats or by porting the Font Software to a\nnew environment.\n\n\"Author\" refers to any designer, engineer, programmer, technical\nwriter or other person who contributed to the Font Software.\n\nPERMISSION \u0026 CONDITIONS\nPermission is hereby granted, free of charge, to any person obtaining\na copy of the Font Software, to use, study, copy, merge, embed, modify,\nredistribute, and sell modified and unmodified copies of the Font\nSoftware, subject to the following conditions:\n\n1) Neither the Font Software nor any of its individual components,\nin Original or Modified Versions, may be sold by itself.\n\n2) Original or Modified Versions of the Font Software may be bundled,\nredistributed and/or sold with any software, provided that each copy\ncontains the above copyright notice and this license. These can be\nincluded either as stand-alone text files, human-readable headers or\nin the appropriate machine-readable metadata fields within text or\nbinary files as long as those fields can be easily viewed by the user.\n\n3) No Modified Version of the Font Software may use the Reserved Font\nName(s) unless explicit written permission is granted by the corresponding\nCopyright Holder. This restriction only applies to the primary font name as\npresented to the users.\n\n4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font\nSoftware shall not be used to promote, endorse or advertise any\nModified Version, except to acknowledge the contribution(s) of the\nCopyright Holder(s) and the Author(s) or with their explicit written\npermission.\n\n5) The Font Software, modified or unmodified, in part or in whole,\nmust be distributed entirely under this license, and must not be\ndistributed under any other license. The requirement for fonts to\nremain under this license does not apply to any document created\nusing the Font Software.\n\nTERMINATION\nThis license becomes null and void if any of the above conditions are\nnot met.\n\nDISCLAIMER\nTHE FONT SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF\nMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT\nOF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE\nCOPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,\nINCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL\nDAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING\nFROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM\nOTHER DEALINGS IN THE FONT SOFTWARE.\n"
   },
   {
     "name": "github.com/andybalholm/brotli",
@@ -304,6 +319,11 @@
     "path": "github.com/blevesearch/zapx/v16/LICENSE",
     "licenseText": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"[]\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright [yyyy] [name of copyright owner]\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License."
   },
+  {
+    "name": "github.com/blevesearch/zapx/v17",
+    "path": "github.com/blevesearch/zapx/v17/LICENSE",
+    "licenseText": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"[]\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright [yyyy] [name of copyright owner]\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License."
+  },
   {
     "name": "github.com/bmatcuk/doublestar/v4",
     "path": "github.com/bmatcuk/doublestar/v4/LICENSE",
@@ -420,18 +440,8 @@
     "licenseText": "ISC License\n\nCopyright (c) 2012-2016 Dave Collins \u003cdave@davec.name\u003e\n\nPermission to use, copy, modify, and/or distribute this software for any\npurpose with or without fee is hereby granted, provided that the above\ncopyright notice and this permission notice appear in all copies.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\" AND THE AUTHOR DISCLAIMS ALL WARRANTIES\nWITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF\nMERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR\nANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES\nWHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN\nACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF\nOR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.\n"
   },
   {
-    "name": "github.com/dgryski/go-rendezvous",
-    "path": "github.com/dgryski/go-rendezvous/LICENSE",
-    "licenseText": "The MIT License (MIT)\n\nCopyright (c) 2017-2020 Damian Gryski \u003cdamian@gryski.com\u003e\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n"
-  },
-  {
-    "name": "github.com/dimiro1/reply",
-    "path": "github.com/dimiro1/reply/LICENSE",
-    "licenseText": "MIT License\n\nCopyright (c) Discourse\nCopyright (c) Claudemiro\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
-  },
-  {
-    "name": "github.com/dlclark/regexp2",
-    "path": "github.com/dlclark/regexp2/LICENSE",
+    "name": "github.com/dlclark/regexp2/v2",
+    "path": "github.com/dlclark/regexp2/v2/LICENSE",
     "licenseText": "The MIT License (MIT)\n\nCopyright (c) Doug Clark\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
   },
   {
@@ -650,8 +660,8 @@
     "licenseText": "\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"[]\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright [yyyy] [name of copyright owner]\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n"
   },
   {
-    "name": "github.com/google/go-github/v84",
-    "path": "github.com/google/go-github/v84/LICENSE",
+    "name": "github.com/google/go-github/v88",
+    "path": "github.com/google/go-github/v88/LICENSE",
     "licenseText": "Copyright (c) 2013 The go-github AUTHORS. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
   },
   {
@@ -749,11 +759,6 @@
     "path": "github.com/inbucket/html2text/LICENSE",
     "licenseText": "The MIT License (MIT)\n\nCopyright (c) 2015 Jay Taylor\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n"
   },
-  {
-    "name": "github.com/jaytaylor/html2text",
-    "path": "github.com/jaytaylor/html2text/LICENSE",
-    "licenseText": "The MIT License (MIT)\n\nCopyright (c) 2015 Jay Taylor\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n"
-  },
   {
     "name": "github.com/jbenet/go-context",
     "path": "github.com/jbenet/go-context/LICENSE",
@@ -959,11 +964,6 @@
     "path": "github.com/munnerz/goautoneg/LICENSE",
     "licenseText": "Copyright (c) 2011, Open Knowledge Foundation Ltd.\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n    Redistributions of source code must retain the above copyright\n    notice, this list of conditions and the following disclaimer.\n\n    Redistributions in binary form must reproduce the above copyright\n    notice, this list of conditions and the following disclaimer in\n    the documentation and/or other materials provided with the\n    distribution.\n\n    Neither the name of the Open Knowledge Foundation Ltd. nor the\n    names of its contributors may be used to endorse or promote\n    products derived from this software without specific prior written\n    permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nHOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
   },
-  {
-    "name": "github.com/nektos/act",
-    "path": "github.com/nektos/act/LICENSE",
-    "licenseText": "MIT License\n\nCopyright (c) 2022 The Gitea Authors\nCopyright (c) 2019\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
-  },
   {
     "name": "github.com/niklasfasching/go-org",
     "path": "github.com/niklasfasching/go-org/LICENSE",
@@ -1079,6 +1079,11 @@
     "path": "github.com/redis/go-redis/v9/LICENSE",
     "licenseText": "Copyright (c) 2013 The github.com/redis/go-redis Authors.\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
   },
+  {
+    "name": "github.com/remyoudompheng/bigfft",
+    "path": "github.com/remyoudompheng/bigfft/LICENSE",
+    "licenseText": "Copyright (c) 2012 The Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
+  },
   {
     "name": "github.com/rhysd/actionlint",
     "path": "github.com/rhysd/actionlint/LICENSE.txt",
@@ -1235,8 +1240,13 @@
     "licenseText": "This work is released into the public domain with CC0 1.0.\n\n-------------------------------------------------------------------------------\n\nCreative Commons Legal Code\n\nCC0 1.0 Universal\n\n    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE\n    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN\n    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS\n    INFORMATION ON AN \"AS-IS\" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES\n    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS\n    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM\n    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED\n    HEREUNDER.\n\nStatement of Purpose\n\nThe laws of most jurisdictions throughout the world automatically confer\nexclusive Copyright and Related Rights (defined below) upon the creator\nand subsequent owner(s) (each and all, an \"owner\") of an original work of\nauthorship and/or a database (each, a \"Work\").\n\nCertain owners wish to permanently relinquish those rights to a Work for\nthe purpose of contributing to a commons of creative, cultural and\nscientific works (\"Commons\") that the public can reliably and without fear\nof later claims of infringement build upon, modify, incorporate in other\nworks, reuse and redistribute as freely as possible in any form whatsoever\nand for any purposes, including without limitation commercial purposes.\nThese owners may contribute to the Commons to promote the ideal of a free\nculture and the further production of creative, cultural and scientific\nworks, or to gain reputation or greater distribution for their Work in\npart through the use and efforts of others.\n\nFor these and/or other purposes and motivations, and without any\nexpectation of additional consideration or compensation, the person\nassociating CC0 with a Work (the \"Affirmer\"), to the extent that he or she\nis an owner of Copyright and Related Rights in the Work, voluntarily\nelects to apply CC0 to the Work and publicly distribute the Work under its\nterms, with knowledge of his or her Copyright and Related Rights in the\nWork and the meaning and intended legal effect of CC0 on those rights.\n\n1. Copyright and Related Rights. A Work made available under CC0 may be\nprotected by copyright and related or neighboring rights (\"Copyright and\nRelated Rights\"). Copyright and Related Rights include, but are not\nlimited to, the following:\n\n  i. the right to reproduce, adapt, distribute, perform, display,\n     communicate, and translate a Work;\n ii. moral rights retained by the original author(s) and/or performer(s);\niii. publicity and privacy rights pertaining to a person's image or\n     likeness depicted in a Work;\n iv. rights protecting against unfair competition in regards to a Work,\n     subject to the limitations in paragraph 4(a), below;\n  v. rights protecting the extraction, dissemination, use and reuse of data\n     in a Work;\n vi. database rights (such as those arising under Directive 96/9/EC of the\n     European Parliament and of the Council of 11 March 1996 on the legal\n     protection of databases, and under any national implementation\n     thereof, including any amended or successor version of such\n     directive); and\nvii. other similar, equivalent or corresponding rights throughout the\n     world based on applicable law or treaty, and any national\n     implementations thereof.\n\n2. Waiver. To the greatest extent permitted by, but not in contravention\nof, applicable law, Affirmer hereby overtly, fully, permanently,\nirrevocably and unconditionally waives, abandons, and surrenders all of\nAffirmer's Copyright and Related Rights and associated claims and causes\nof action, whether now known or unknown (including existing as well as\nfuture claims and causes of action), in the Work (i) in all territories\nworldwide, (ii) for the maximum duration provided by applicable law or\ntreaty (including future time extensions), (iii) in any current or future\nmedium and for any number of copies, and (iv) for any purpose whatsoever,\nincluding without limitation commercial, advertising or promotional\npurposes (the \"Waiver\"). Affirmer makes the Waiver for the benefit of each\nmember of the public at large and to the detriment of Affirmer's heirs and\nsuccessors, fully intending that such Waiver shall not be subject to\nrevocation, rescission, cancellation, termination, or any other legal or\nequitable action to disrupt the quiet enjoyment of the Work by the public\nas contemplated by Affirmer's express Statement of Purpose.\n\n3. Public License Fallback. Should any part of the Waiver for any reason\nbe judged legally invalid or ineffective under applicable law, then the\nWaiver shall be preserved to the maximum extent permitted taking into\naccount Affirmer's express Statement of Purpose. In addition, to the\nextent the Waiver is so judged Affirmer hereby grants to each affected\nperson a royalty-free, non transferable, non sublicensable, non exclusive,\nirrevocable and unconditional license to exercise Affirmer's Copyright and\nRelated Rights in the Work (i) in all territories worldwide, (ii) for the\nmaximum duration provided by applicable law or treaty (including future\ntime extensions), (iii) in any current or future medium and for any number\nof copies, and (iv) for any purpose whatsoever, including without\nlimitation commercial, advertising or promotional purposes (the\n\"License\"). The License shall be deemed effective as of the date CC0 was\napplied by Affirmer to the Work. Should any part of the License for any\nreason be judged legally invalid or ineffective under applicable law, such\npartial invalidity or ineffectiveness shall not invalidate the remainder\nof the License, and in such case Affirmer hereby affirms that he or she\nwill not (i) exercise any of his or her remaining Copyright and Related\nRights in the Work or (ii) assert any associated claims and causes of\naction with respect to the Work, in either case contrary to Affirmer's\nexpress Statement of Purpose.\n\n4. Limitations and Disclaimers.\n\n a. No trademark or patent rights held by Affirmer are waived, abandoned,\n    surrendered, licensed or otherwise affected by this document.\n b. Affirmer offers the Work as-is and makes no representations or\n    warranties of any kind concerning the Work, express, implied,\n    statutory or otherwise, including without limitation warranties of\n    title, merchantability, fitness for a particular purpose, non\n    infringement, or the absence of latent or other defects, accuracy, or\n    the present or absence of errors, whether or not discoverable, all to\n    the greatest extent permissible under applicable law.\n c. Affirmer disclaims responsibility for clearing rights of other persons\n    that may apply to the Work or any use thereof, including without\n    limitation any person's Copyright and Related Rights in the Work.\n    Further, Affirmer disclaims responsibility for obtaining any necessary\n    consents, permissions or other rights required for any use of the\n    Work.\n d. Affirmer understands and acknowledges that Creative Commons is not a\n    party to this document and has no duty or obligation with respect to\n    this CC0 or use of the Work.\n"
   },
   {
-    "name": "gitlab.com/gitlab-org/api/client-go",
-    "path": "gitlab.com/gitlab-org/api/client-go/LICENSE",
+    "name": "github.com/zeebo/xxh3",
+    "path": "github.com/zeebo/xxh3/LICENSE",
+    "licenseText": "BSD 2-Clause License\n\nCopyright (c) 2012-2014, Yann Collet\nCopyright (c) 2019, Jeff Wendling\nAll rights reserved.\n\nxxHash Library\n\nRedistribution and use in source and binary forms, with or without modification,\nare permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n  list of conditions and the following disclaimer.\n\n* Redistributions in binary form must reproduce the above copyright notice, this\n  list of conditions and the following disclaimer in the documentation and/or\n  other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
+  },
+  {
+    "name": "gitlab.com/gitlab-org/api/client-go/v2",
+    "path": "gitlab.com/gitlab-org/api/client-go/v2/LICENSE",
     "licenseText": "                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n\n   APPENDIX: How to apply the Apache License to your work.\n\n      To apply the Apache License to your work, attach the following\n      boilerplate notice, with the fields enclosed by brackets \"{}\"\n      replaced with your own identifying information. (Don't include\n      the brackets!)  The text should be enclosed in the appropriate\n      comment syntax for the file format. We also recommend that a\n      file or class name and description of purpose be included on the\n      same \"printed page\" as the copyright notice for easier\n      identification within third-party archives.\n\n   Copyright {yyyy} {name of copyright owner}\n\n   Licensed under the Apache License, Version 2.0 (the \"License\");\n   you may not use this file except in compliance with the License.\n   You may obtain a copy of the License at\n\n       http://www.apache.org/licenses/LICENSE-2.0\n\n   Unless required by applicable law or agreed to in writing, software\n   distributed under the License is distributed on an \"AS IS\" BASIS,\n   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n   See the License for the specific language governing permissions and\n   limitations under the License.\n"
   },
   {
@@ -1359,6 +1369,26 @@
     "path": "gopkg.in/yaml.v3/LICENSE",
     "licenseText": "\nThis project is covered by two different licenses: MIT and Apache.\n\n#### MIT License ####\n\nThe following files were ported to Go from C files of libyaml, and thus\nare still covered by their original MIT license, with the additional\ncopyright staring in 2011 when the project was ported over:\n\n    apic.go emitterc.go parserc.go readerc.go scannerc.go\n    writerc.go yamlh.go yamlprivateh.go\n\nCopyright (c) 2006-2010 Kirill Simonov\nCopyright (c) 2006-2011 Kirill Simonov\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies\nof the Software, and to permit persons to whom the Software is furnished to do\nso, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n### Apache License ###\n\nAll the remaining project files are covered by the Apache license:\n\nCopyright (c) 2011-2019 Canonical Ltd\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n"
   },
+  {
+    "name": "modernc.org/libc",
+    "path": "modernc.org/libc/LICENSE",
+    "licenseText": "Copyright (c) 2017 The Libc Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the names of the authors nor the names of the\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
+  },
+  {
+    "name": "modernc.org/mathutil",
+    "path": "modernc.org/mathutil/LICENSE",
+    "licenseText": "Copyright (c) 2014 The mathutil Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the names of the authors nor the names of the\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
+  },
+  {
+    "name": "modernc.org/memory",
+    "path": "modernc.org/memory/LICENSE",
+    "licenseText": "Copyright (c) 2017 The Memory Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n   * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n   * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n   * Neither the names of the authors nor the names of the\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
+  },
+  {
+    "name": "modernc.org/sqlite",
+    "path": "modernc.org/sqlite/LICENSE",
+    "licenseText": "Copyright (c) 2017 The Sqlite Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer.\n\n2. Redistributions in binary form must reproduce the above copyright notice,\nthis list of conditions and the following disclaimer in the documentation\nand/or other materials provided with the distribution.\n\n3. Neither the name of the copyright holder nor the names of its contributors\nmay be used to endorse or promote products derived from this software without\nspecific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
+  },
   {
     "name": "mvdan.cc/xurls/v2",
     "path": "mvdan.cc/xurls/v2/LICENSE",
diff --git a/build/generate-bindata.go b/build/generate-bindata.go
index 2553770762f..3e14eba4cb3 100644
--- a/build/generate-bindata.go
+++ b/build/generate-bindata.go
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"os"
 
-	"code.gitea.io/gitea/modules/assetfs"
+	"gitea.dev/modules/assetfs"
 )
 
 func main() {
diff --git a/build/generate-emoji.go b/build/generate-emoji.go
index cbc1be2139e..7d38a4cbd56 100644
--- a/build/generate-emoji.go
+++ b/build/generate-emoji.go
@@ -20,7 +20,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 )
 
 const (
diff --git a/build/generate-gitignores.go b/build/generate-gitignores.go
index 1e09c83a6a7..11af4eb70ea 100644
--- a/build/generate-gitignores.go
+++ b/build/generate-gitignores.go
@@ -1,3 +1,6 @@
+// Copyright 2020 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
 //go:build ignore
 
 package main
@@ -15,7 +18,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 func main() {
diff --git a/build/generate-go-licenses.go b/build/generate-go-licenses.go
index 057e6a6e49a..a4aa5b08323 100644
--- a/build/generate-go-licenses.go
+++ b/build/generate-go-licenses.go
@@ -29,8 +29,8 @@ var primaryLicenseRe = regexp.MustCompile(`^(?i)(LICEN[SC]E|COPYING)$`)
 
 // ignoredNames are LicenseEntry.Name values to exclude from the output.
 var ignoredNames = map[string]bool{
-	"code.gitea.io/gitea":                 true,
-	"code.gitea.io/gitea/options/license": true,
+	"gitea.dev":                 true,
+	"gitea.dev/options/license": true,
 }
 
 var excludedExt = map[string]bool{
diff --git a/build/generate-openapi.go b/build/generate-openapi.go
index 7b37a5bbba9..3c65781481d 100644
--- a/build/generate-openapi.go
+++ b/build/generate-openapi.go
@@ -25,7 +25,7 @@ import (
 	"sort"
 	"strings"
 
-	"code.gitea.io/gitea/build/openapi3gen"
+	"gitea.dev/build/openapi3gen"
 
 	"github.com/getkin/kin-openapi/openapi3"
 )
diff --git a/build/openapi3gen/convert.go b/build/openapi3gen/convert.go
index 04587b33039..9d446ff45b8 100644
--- a/build/openapi3gen/convert.go
+++ b/build/openapi3gen/convert.go
@@ -8,7 +8,7 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"github.com/getkin/kin-openapi/openapi2"
 	"github.com/getkin/kin-openapi/openapi2conv"
diff --git a/build/test-env-check.sh b/build/test-env-check.sh
deleted file mode 100755
index 38e5a288231..00000000000
--- a/build/test-env-check.sh
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/sh
-
-set -e
-
-if [ ! -f ./build/test-env-check.sh ]; then
-  echo "${0} can only be executed in gitea source root directory"
-  exit 1
-fi
-
-
-echo "check uid ..."
-
-# the uid of gitea defined in "https://gitea.com/gitea/test-env" is 1000
-gitea_uid=$(id -u gitea)
-if [ "$gitea_uid" != "1000" ]; then
-  echo "The uid of linux user 'gitea' is expected to be 1000, but it is $gitea_uid"
-  exit 1
-fi
-
-cur_uid=$(id -u)
-if [ "$cur_uid" != "0" -a "$cur_uid" != "$gitea_uid" ]; then
-  echo "The uid of current linux user is expected to be 0 or $gitea_uid, but it is $cur_uid"
-  exit 1
-fi
diff --git a/build/test-env-prepare.sh b/build/test-env-prepare.sh
deleted file mode 100755
index 0c5bc25f116..00000000000
--- a/build/test-env-prepare.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-set -e
-
-if [ ! -f ./build/test-env-prepare.sh ]; then
-  echo "${0} can only be executed in gitea source root directory"
-  exit 1
-fi
-
-echo "change the owner of files to gitea ..."
-chown -R gitea:gitea .
diff --git a/cmd/actions.go b/cmd/actions.go
index 44b6b7b54cf..576be764881 100644
--- a/cmd/actions.go
+++ b/cmd/actions.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/setting"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin.go b/cmd/admin.go
index c0e21731cbe..2396bbb47c9 100644
--- a/cmd/admin.go
+++ b/cmd/admin.go
@@ -8,12 +8,12 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_auth.go b/cmd/admin_auth.go
index b55bb1481cf..6a00e961b9a 100644
--- a/cmd/admin_auth.go
+++ b/cmd/admin_auth.go
@@ -10,9 +10,9 @@ import (
 	"os"
 	"text/tabwriter"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	auth_service "code.gitea.io/gitea/services/auth"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	auth_service "gitea.dev/services/auth"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_auth_ldap.go b/cmd/admin_auth_ldap.go
index c9be5abb379..d3266fa48d5 100644
--- a/cmd/admin_auth_ldap.go
+++ b/cmd/admin_auth_ldap.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/auth/source/ldap"
+	"gitea.dev/models/auth"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/auth/source/ldap"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_auth_ldap_test.go b/cmd/admin_auth_ldap_test.go
index 0e3e465e81e..f9b5338ba0e 100644
--- a/cmd/admin_auth_ldap_test.go
+++ b/cmd/admin_auth_ldap_test.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"testing"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/services/auth/source/ldap"
+	"gitea.dev/models/auth"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/auth/source/ldap"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
diff --git a/cmd/admin_auth_oauth.go b/cmd/admin_auth_oauth.go
index 8848c94fc51..c4a86191a17 100644
--- a/cmd/admin_auth_oauth.go
+++ b/cmd/admin_auth_oauth.go
@@ -9,9 +9,9 @@ import (
 	"fmt"
 	"net/url"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/auth/source/oauth2"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_auth_oauth_test.go b/cmd/admin_auth_oauth_test.go
index bb9da667fd1..c16dd96d565 100644
--- a/cmd/admin_auth_oauth_test.go
+++ b/cmd/admin_auth_oauth_test.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/services/auth/source/oauth2"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
diff --git a/cmd/admin_auth_smtp.go b/cmd/admin_auth_smtp.go
index 93e0587fc3c..b7c1a8807ee 100644
--- a/cmd/admin_auth_smtp.go
+++ b/cmd/admin_auth_smtp.go
@@ -8,9 +8,9 @@ import (
 	"errors"
 	"strings"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/auth/source/smtp"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/auth/source/smtp"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_auth_smtp_test.go b/cmd/admin_auth_smtp_test.go
index e54e01830c7..2b890f154aa 100644
--- a/cmd/admin_auth_smtp_test.go
+++ b/cmd/admin_auth_smtp_test.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth/source/smtp"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/services/auth/source/smtp"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
diff --git a/cmd/admin_regenerate.go b/cmd/admin_regenerate.go
index aa235441bac..89b7bf383ce 100644
--- a/cmd/admin_regenerate.go
+++ b/cmd/admin_regenerate.go
@@ -6,9 +6,9 @@ package cmd
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/graceful"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/modules/graceful"
+	asymkey_service "gitea.dev/services/asymkey"
+	repo_service "gitea.dev/services/repository"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_user_change_password.go b/cmd/admin_user_change_password.go
index c27905b4db5..4d5fe586e1d 100644
--- a/cmd/admin_user_change_password.go
+++ b/cmd/admin_user_change_password.go
@@ -8,11 +8,11 @@ import (
 	"errors"
 	"fmt"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	user_service "code.gitea.io/gitea/services/user"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/password"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	user_service "gitea.dev/services/user"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_user_change_password_test.go b/cmd/admin_user_change_password_test.go
index cf497517f74..50fd8d9e4dd 100644
--- a/cmd/admin_user_change_password_test.go
+++ b/cmd/admin_user_change_password_test.go
@@ -7,9 +7,9 @@ import (
 	"io"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/cmd/admin_user_create.go b/cmd/admin_user_create.go
index 7e5675cf58d..340ea072d5f 100644
--- a/cmd/admin_user_create.go
+++ b/cmd/admin_user_create.go
@@ -9,12 +9,12 @@ import (
 	"fmt"
 	"strings"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	pwd "code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	pwd "gitea.dev/modules/auth/password"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_user_create_test.go b/cmd/admin_user_create_test.go
index dbe949ff8d2..f3794c5dffb 100644
--- a/cmd/admin_user_create_test.go
+++ b/cmd/admin_user_create_test.go
@@ -8,10 +8,10 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/cmd/admin_user_delete.go b/cmd/admin_user_delete.go
index f91041577c3..cc70fe70bf7 100644
--- a/cmd/admin_user_delete.go
+++ b/cmd/admin_user_delete.go
@@ -9,10 +9,10 @@ import (
 	"fmt"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	user_service "code.gitea.io/gitea/services/user"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	user_service "gitea.dev/services/user"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_user_delete_test.go b/cmd/admin_user_delete_test.go
index b68b358152a..4fbd0435c51 100644
--- a/cmd/admin_user_delete_test.go
+++ b/cmd/admin_user_delete_test.go
@@ -8,10 +8,10 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/require"
 )
diff --git a/cmd/admin_user_generate_access_token.go b/cmd/admin_user_generate_access_token.go
index 7f8330ff7e4..cf42a97cddb 100644
--- a/cmd/admin_user_generate_access_token.go
+++ b/cmd/admin_user_generate_access_token.go
@@ -8,8 +8,8 @@ import (
 	"errors"
 	"fmt"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_user_list.go b/cmd/admin_user_list.go
index 2958fe0cc8b..7f9ce57e24d 100644
--- a/cmd/admin_user_list.go
+++ b/cmd/admin_user_list.go
@@ -9,7 +9,7 @@ import (
 	"os"
 	"text/tabwriter"
 
-	user_model "code.gitea.io/gitea/models/user"
+	user_model "gitea.dev/models/user"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_user_must_change_password.go b/cmd/admin_user_must_change_password.go
index 468d462b74c..ff318dd0bce 100644
--- a/cmd/admin_user_must_change_password.go
+++ b/cmd/admin_user_must_change_password.go
@@ -8,8 +8,8 @@ import (
 	"errors"
 	"fmt"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/admin_user_must_change_password_test.go b/cmd/admin_user_must_change_password_test.go
index efdbe3a9ee9..cf81fbe0ba7 100644
--- a/cmd/admin_user_must_change_password_test.go
+++ b/cmd/admin_user_must_change_password_test.go
@@ -6,9 +6,9 @@ package cmd
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/cmd/cmdtest/cmd_test.go b/cmd/cmdtest/cmd_test.go
index 4ff854f8abf..6d4937fa110 100644
--- a/cmd/cmdtest/cmd_test.go
+++ b/cmd/cmdtest/cmd_test.go
@@ -15,11 +15,11 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/cmd"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/cmd"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
diff --git a/cmd/config.go b/cmd/config.go
index 5303b0e1e07..42880d99f23 100644
--- a/cmd/config.go
+++ b/cmd/config.go
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"os"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/doctor.go b/cmd/doctor.go
index 188740dbcea..8941be0ca0e 100644
--- a/cmd/doctor.go
+++ b/cmd/doctor.go
@@ -12,16 +12,15 @@ import (
 	"strings"
 	"text/tabwriter"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/migrations"
-	migrate_base "code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/doctor"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations"
+	migrate_base "gitea.dev/models/migrations/base"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/doctor"
 
 	"github.com/urfave/cli/v3"
-	"xorm.io/xorm"
 )
 
 func newDoctorCommand() *cli.Command {
@@ -132,7 +131,7 @@ func runRecreateTable(ctx context.Context, cmd *cli.Command) error {
 	}
 	recreateTables := migrate_base.RecreateTables(beans...)
 
-	return db.InitEngineWithMigration(context.Background(), func(ctx context.Context, x *xorm.Engine) error {
+	return db.InitEngineWithMigration(context.Background(), func(ctx context.Context, x db.EngineMigration) error {
 		if err := migrations.EnsureUpToDate(ctx, x); err != nil {
 			return err
 		}
diff --git a/cmd/doctor_convert.go b/cmd/doctor_convert.go
index f4867912ab3..eceda00183b 100644
--- a/cmd/doctor_convert.go
+++ b/cmd/doctor_convert.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/doctor_test.go b/cmd/doctor_test.go
index 7d2f3589475..6cc22b0c494 100644
--- a/cmd/doctor_test.go
+++ b/cmd/doctor_test.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"testing"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/services/doctor"
+	"gitea.dev/modules/log"
+	"gitea.dev/services/doctor"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
diff --git a/cmd/dump.go b/cmd/dump.go
index 40b73f69aa1..719e62d3afa 100644
--- a/cmd/dump.go
+++ b/cmd/dump.go
@@ -11,13 +11,13 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/dump"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/dump"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/util"
 
 	"gitea.com/go-chi/session"
 	"github.com/urfave/cli/v3"
diff --git a/cmd/dump_repo.go b/cmd/dump_repo.go
index 367454366ec..cc84922e6ab 100644
--- a/cmd/dump_repo.go
+++ b/cmd/dump_repo.go
@@ -10,14 +10,14 @@ import (
 	"os"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/migrations"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/migrations"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/embedded.go b/cmd/embedded.go
index e2110756b8f..add8dda12b9 100644
--- a/cmd/embedded.go
+++ b/cmd/embedded.go
@@ -11,14 +11,14 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/assetfs"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/options"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/assetfs"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/options"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/generate.go b/cmd/generate.go
index 21f8b42bff7..01be73c2d11 100644
--- a/cmd/generate.go
+++ b/cmd/generate.go
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"os"
 
-	"code.gitea.io/gitea/modules/generate"
+	"gitea.dev/modules/generate"
 
 	"github.com/mattn/go-isatty"
 	"github.com/urfave/cli/v3"
diff --git a/cmd/helper.go b/cmd/helper.go
index ca4cddb49d7..9150e1c2338 100644
--- a/cmd/helper.go
+++ b/cmd/helper.go
@@ -15,9 +15,9 @@ import (
 	"strings"
 	"syscall"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"github.com/urfave/cli/v3"
 )
@@ -142,9 +142,9 @@ func PrepareConsoleLoggerLevel(defaultLevel log.Level) func(context.Context, *cl
 func isValidDefaultSubCommand(cmd *cli.Command) (string, bool) {
 	// Dirty patch for urfave/cli's strange design.
 	// "./gitea bad-cmd" should not start the web server.
-	rootArgs := cmd.Root().Args().Slice()
-	if len(rootArgs) != 0 && rootArgs[0] != cmd.Name {
-		return rootArgs[0], false
+	args := cmd.Args().Slice()
+	if len(args) != 0 {
+		return args[0], false
 	}
 	return "", true
 }
diff --git a/cmd/hook.go b/cmd/hook.go
index 4a6c7c2905a..26b3b56053c 100644
--- a/cmd/hook.go
+++ b/cmd/hook.go
@@ -14,12 +14,12 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/keys.go b/cmd/keys.go
index 912cf250915..2f9f52e5dbf 100644
--- a/cmd/keys.go
+++ b/cmd/keys.go
@@ -9,8 +9,8 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/mailer.go b/cmd/mailer.go
index a7dbd68e20a..61bd66c963a 100644
--- a/cmd/mailer.go
+++ b/cmd/mailer.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/setting"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/main.go b/cmd/main.go
index 27d8cba2e90..243995d634b 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -10,8 +10,8 @@ import (
 	"os"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/main_test.go b/cmd/main_test.go
index f367bf12e42..047698074c6 100644
--- a/cmd/main_test.go
+++ b/cmd/main_test.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
@@ -41,4 +41,5 @@ func TestDefaultCommand(t *testing.T) {
 	test(t, []string{"./gitea"}, "", true)
 	test(t, []string{"./gitea", "test"}, "", true)
 	test(t, []string{"./gitea", "other"}, "other", false)
+	test(t, []string{"./gitea", "test", "extra"}, "extra", false)
 }
diff --git a/cmd/manager.go b/cmd/manager.go
index 586c65990bc..85fccc992de 100644
--- a/cmd/manager.go
+++ b/cmd/manager.go
@@ -8,7 +8,7 @@ import (
 	"os"
 	"time"
 
-	"code.gitea.io/gitea/modules/private"
+	"gitea.dev/modules/private"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/manager_logging.go b/cmd/manager_logging.go
index 5812e707e20..4fae0c96c74 100644
--- a/cmd/manager_logging.go
+++ b/cmd/manager_logging.go
@@ -9,8 +9,8 @@ import (
 	"fmt"
 	"os"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/migrate.go b/cmd/migrate.go
index 016f8a0db56..cc4fee3308a 100644
--- a/cmd/migrate.go
+++ b/cmd/migrate.go
@@ -6,10 +6,10 @@ package cmd
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/versioned_migration"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/versioned_migration"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/migrate_storage.go b/cmd/migrate_storage.go
index c9b82055c13..36b224fbf38 100644
--- a/cmd/migrate_storage.go
+++ b/cmd/migrate_storage.go
@@ -10,17 +10,17 @@ import (
 	"io/fs"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/services/versioned_migration"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	packages_module "gitea.dev/modules/packages"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/services/versioned_migration"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/migrate_storage_test.go b/cmd/migrate_storage_test.go
index 3ea193eb1ea..67a6b9e2eef 100644
--- a/cmd/migrate_storage_test.go
+++ b/cmd/migrate_storage_test.go
@@ -8,13 +8,13 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	packages_service "code.gitea.io/gitea/services/packages"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	packages_module "gitea.dev/modules/packages"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/cmd/restore_repo.go b/cmd/restore_repo.go
index 26b4682f136..c7bbddd7c4f 100644
--- a/cmd/restore_repo.go
+++ b/cmd/restore_repo.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/setting"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/cmd/serv.go b/cmd/serv.go
index a35d476c860..93009cd32a3 100644
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -15,21 +15,21 @@ import (
 	"strings"
 	"unicode"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/lfstransfer"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/pprof"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/process"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/lfs"
+	asymkey_model "gitea.dev/models/asymkey"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/lfstransfer"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/pprof"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/process"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/lfs"
 
 	"github.com/kballard/go-shellquote"
 	"github.com/urfave/cli/v3"
diff --git a/cmd/web.go b/cmd/web.go
index 994c481fc08..5644f37d232 100644
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -15,17 +15,17 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/gtprof"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers"
-	"code.gitea.io/gitea/routers/install"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/gtprof"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers"
+	"gitea.dev/routers/install"
 
 	"github.com/felixge/fgprof"
 	"github.com/urfave/cli/v3"
@@ -150,7 +150,7 @@ func serveInstall(cmd *cli.Command) error {
 	c := install.Routes()
 	err := listen(c, false)
 	if err != nil {
-		log.Critical("Unable to open listener for installer. Is Gitea already running?")
+		log.Error("Unable to open listener for installer. Is Gitea already running?")
 		graceful.GetManager().DoGracefulShutdown()
 	}
 	select {
@@ -375,7 +375,7 @@ func listen(m http.Handler, handleRedirector bool) error {
 		log.Fatal("Invalid protocol: %s", setting.Protocol)
 	}
 	if err != nil {
-		log.Critical("Failed to start server: %v", err)
+		log.Error("Failed to start server: %v", err)
 	}
 	log.Info("HTTP Listener: %s Closed", listenAddr)
 	return err
diff --git a/cmd/web_acme.go b/cmd/web_acme.go
index a2e14638f8c..512a990e02d 100644
--- a/cmd/web_acme.go
+++ b/cmd/web_acme.go
@@ -13,11 +13,11 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/caddyserver/certmagic"
 )
diff --git a/cmd/web_graceful.go b/cmd/web_graceful.go
index 5e06d2c2164..13eb9ddc46f 100644
--- a/cmd/web_graceful.go
+++ b/cmd/web_graceful.go
@@ -9,9 +9,9 @@ import (
 	"net/http/fcgi"
 	"strings"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 func runHTTP(network, listenAddr, name string, m http.Handler, useProxyProtocol bool) error {
diff --git a/cmd/web_https.go b/cmd/web_https.go
index 70d35cd40d8..2eabe32ca5b 100644
--- a/cmd/web_https.go
+++ b/cmd/web_https.go
@@ -9,9 +9,9 @@ import (
 	"os"
 	"strings"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"github.com/klauspost/cpuid/v2"
 )
diff --git a/contrib/backport/README b/contrib/backport/README
deleted file mode 100644
index 466b79c6d49..00000000000
--- a/contrib/backport/README
+++ /dev/null
@@ -1,41 +0,0 @@
-`backport`
-==========
-
-`backport` is a command to help create backports of PRs. It backports a
-provided PR from main on to a released version.
-
-It will create a backport branch, cherry-pick the PR's merge commit, adjust
-the commit message and then push this back up to your fork's remote.
-
-The default version will read from `docs/config.yml`. You can override this
-using the option `--version`.
-
-The upstream branches will be fetched, using the remote `origin`. This can
-be overridden using `--upstream`, and fetching can be avoided using
-`--no-fetch`.
-
-By default the branch created will be called `backport-$PR-$VERSION`. You
-can override this using the option `--backport-branch`. This branch will
-be created from `--release-branch` which is `release/$(VERSION)`
-by default and will be pulled from `$(UPSTREAM)`.
-
-The merge-commit as determined by the github API will be used as the SHA to
-cherry-pick. You can override this using `--cherry-pick`.
-
-The commit message will be amended to add the `Backport` header.
-`--no-amend-message` can be set to stop this from happening.
-
-If cherry-pick is successful the backported branch will be pushed up to your
-fork using your remote. These will be determined using `git remote -v`. You
-can set your fork name using `--fork-user` and your remote name using
-`--remote`. You can avoid pushing using `--no-push`.
-
-If the push is successful, `xdg-open` will be called to open a backport url.
-You can stop this using `--no-xdg-open`.
-
-Installation
-============
-
-```bash
-go install contrib/backport/backport.go
-```
diff --git a/contrib/backport/backport.go b/contrib/backport/backport.go
deleted file mode 100644
index 2af980e5e3c..00000000000
--- a/contrib/backport/backport.go
+++ /dev/null
@@ -1,456 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//nolint:forbidigo // use of print functions is allowed in cli
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log"
-	"net/http"
-	"os"
-	"os/exec"
-	"path"
-	"strconv"
-	"strings"
-
-	"github.com/google/go-github/v84/github"
-	"github.com/urfave/cli/v3"
-	"gopkg.in/yaml.v3"
-)
-
-const defaultVersion = "v1.18" // to backport to
-
-func main() {
-	app := &cli.Command{}
-	app.Name = "backport"
-	app.Usage = "Backport provided PR-number on to the current or previous released version"
-	app.Description = `Backport will look-up the PR in Gitea's git log and attempt to cherry-pick it on the current version`
-	app.ArgsUsage = "<PR-to-backport>"
-
-	app.Flags = []cli.Flag{
-		&cli.StringFlag{
-			Name:  "version",
-			Usage: "Version branch to backport on to",
-		},
-		&cli.StringFlag{
-			Name:  "upstream",
-			Value: "origin",
-			Usage: "Upstream remote for the Gitea upstream",
-		},
-		&cli.StringFlag{
-			Name:  "release-branch",
-			Value: "",
-			Usage: "Release branch to backport on. Will default to release/<version>",
-		},
-		&cli.StringFlag{
-			Name:  "cherry-pick",
-			Usage: "SHA to cherry-pick as backport",
-		},
-		&cli.StringFlag{
-			Name:  "backport-branch",
-			Usage: "Backport branch to backport on to (default: backport-<pr>-<version>",
-		},
-		&cli.StringFlag{
-			Name:  "remote",
-			Value: "",
-			Usage: "Remote for your fork of the Gitea upstream",
-		},
-		&cli.StringFlag{
-			Name:  "fork-user",
-			Value: "",
-			Usage: "Forked user name on Github",
-		},
-		&cli.StringFlag{
-			Name:  "gh-access-token",
-			Value: "",
-			Usage: "Access token for GitHub api request",
-		},
-		&cli.BoolFlag{
-			Name:  "no-fetch",
-			Usage: "Set this flag to prevent fetch of remote branches",
-		},
-		&cli.BoolFlag{
-			Name:  "no-amend-message",
-			Usage: "Set this flag to prevent automatic amendment of the commit message",
-		},
-		&cli.BoolFlag{
-			Name:  "no-push",
-			Usage: "Set this flag to prevent pushing the backport up to your fork",
-		},
-		&cli.BoolFlag{
-			Name:  "no-xdg-open",
-			Usage: "Set this flag to not use xdg-open to open the PR URL",
-		},
-		&cli.BoolFlag{
-			Name:  "continue",
-			Usage: "Set this flag to continue from a git cherry-pick that has broken",
-		},
-	}
-	cli.RootCommandHelpTemplate = `NAME:
-	{{.Name}} - {{.Usage}}
-USAGE:
-	{{.HelpName}} {{if .VisibleFlags}}[options]{{end}} {{if .ArgsUsage}}{{.ArgsUsage}}{{else}}[arguments...]{{end}}
-	{{if len .Authors}}
-AUTHOR:
-	{{range .Authors}}{{ . }}{{end}}
-	{{end}}{{if .Commands}}
-OPTIONS:
-	{{range .VisibleFlags}}{{.}}
-	{{end}}{{end}}
-`
-
-	app.Action = runBackport
-	if err := app.Run(context.Background(), os.Args); err != nil {
-		fmt.Fprintf(os.Stderr, "Unable to backport: %v\n", err)
-	}
-}
-
-func runBackport(ctx context.Context, c *cli.Command) error {
-	continuing := c.Bool("continue")
-
-	var pr string
-
-	version := c.String("version")
-	if version == "" && continuing {
-		// determine version from current branch name
-		var err error
-		pr, version, err = readCurrentBranch(ctx)
-		if err != nil {
-			return err
-		}
-	}
-	if version == "" {
-		version = readVersion()
-	}
-	if version == "" {
-		version = defaultVersion
-	}
-
-	upstream := c.String("upstream")
-	if upstream == "" {
-		upstream = "origin"
-	}
-
-	forkUser := c.String("fork-user")
-	remote := c.String("remote")
-	if remote == "" && !c.Bool("--no-push") {
-		var err error
-		remote, forkUser, err = determineRemote(ctx, forkUser)
-		if err != nil {
-			return err
-		}
-	}
-
-	upstreamReleaseBranch := c.String("release-branch")
-	if upstreamReleaseBranch == "" {
-		upstreamReleaseBranch = path.Join("release", version)
-	}
-
-	localReleaseBranch := path.Join(upstream, upstreamReleaseBranch)
-
-	args := c.Args().Slice()
-	if len(args) == 0 && pr == "" {
-		return errors.New("no PR number provided\nProvide a PR number to backport")
-	} else if len(args) != 1 && pr == "" {
-		return fmt.Errorf("multiple PRs provided %v\nOnly a single PR can be backported at a time", args)
-	}
-	if pr == "" {
-		pr = args[0]
-	}
-
-	backportBranch := c.String("backport-branch")
-	if backportBranch == "" {
-		backportBranch = "backport-" + pr + "-" + version
-	}
-
-	fmt.Printf("* Backporting %s to %s as %s\n", pr, localReleaseBranch, backportBranch)
-
-	sha := c.String("cherry-pick")
-	accessToken := c.String("gh-access-token")
-	if sha == "" {
-		var err error
-		sha, err = determineSHAforPR(ctx, pr, accessToken)
-		if err != nil {
-			return err
-		}
-	}
-	if sha == "" {
-		return fmt.Errorf("unable to determine sha for cherry-pick of %s", pr)
-	}
-
-	if !c.Bool("no-fetch") {
-		if err := fetchRemoteAndMain(ctx, upstream, upstreamReleaseBranch); err != nil {
-			return err
-		}
-	}
-
-	if !continuing {
-		if err := checkoutBackportBranch(ctx, backportBranch, localReleaseBranch); err != nil {
-			return err
-		}
-	}
-
-	if err := cherrypick(ctx, sha); err != nil {
-		return err
-	}
-
-	if !c.Bool("no-amend-message") {
-		if err := amendCommit(ctx, pr); err != nil {
-			return err
-		}
-	}
-
-	if !c.Bool("no-push") {
-		url := "https://github.com/go-gitea/gitea/compare/" + upstreamReleaseBranch + "..." + forkUser + ":" + backportBranch
-
-		if err := gitPushUp(ctx, remote, backportBranch); err != nil {
-			return err
-		}
-
-		if !c.Bool("no-xdg-open") {
-			if err := xdgOpen(ctx, url); err != nil {
-				return err
-			}
-		} else {
-			fmt.Printf("* Navigate to %s to open PR\n", url)
-		}
-	}
-	return nil
-}
-
-func xdgOpen(ctx context.Context, url string) error {
-	fmt.Printf("* `xdg-open %s`\n", url)
-	out, err := exec.CommandContext(ctx, "xdg-open", url).Output()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "%s", string(out))
-		return fmt.Errorf("unable to xdg-open to %s: %w", url, err)
-	}
-	return nil
-}
-
-func gitPushUp(ctx context.Context, remote, backportBranch string) error {
-	fmt.Printf("* `git push -u %s %s`\n", remote, backportBranch)
-	out, err := exec.CommandContext(ctx, "git", "push", "-u", remote, backportBranch).Output()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "%s", string(out))
-		return fmt.Errorf("unable to push up to %s: %w", remote, err)
-	}
-	return nil
-}
-
-func amendCommit(ctx context.Context, pr string) error {
-	fmt.Printf("* Amending commit to prepend `Backport #%s` to body\n", pr)
-	out, err := exec.CommandContext(ctx, "git", "log", "-1", "--pretty=format:%B").Output()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "%s", string(out))
-		return fmt.Errorf("unable to get last log message: %w", err)
-	}
-
-	parts := strings.SplitN(string(out), "\n", 2)
-
-	if len(parts) != 2 {
-		return fmt.Errorf("unable to interpret log message:\n%s", string(out))
-	}
-	subject, body := parts[0], parts[1]
-	if !strings.HasSuffix(subject, " (#"+pr+")") {
-		subject = subject + " (#" + pr + ")"
-	}
-
-	out, err = exec.CommandContext(ctx, "git", "commit", "--amend", "-m", subject+"\n\nBackport #"+pr+"\n"+body).Output()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "%s", string(out))
-		return fmt.Errorf("unable to amend last log message: %w", err)
-	}
-	return nil
-}
-
-func cherrypick(ctx context.Context, sha string) error {
-	// Check if a CHERRY_PICK_HEAD exists
-	if _, err := os.Stat(".git/CHERRY_PICK_HEAD"); err == nil {
-		// Assume that we are in the middle of cherry-pick - continue it
-		fmt.Println("* Attempting git cherry-pick --continue")
-		out, err := exec.CommandContext(ctx, "git", "cherry-pick", "--continue").Output()
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "git cherry-pick --continue failed:\n%s\n", string(out))
-			return fmt.Errorf("unable to continue cherry-pick: %w", err)
-		}
-		return nil
-	}
-
-	fmt.Printf("* Attempting git cherry-pick %s\n", sha)
-	out, err := exec.CommandContext(ctx, "git", "cherry-pick", sha).Output()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "git cherry-pick %s failed:\n%s\n", sha, string(out))
-		return fmt.Errorf("git cherry-pick %s failed: %w", sha, err)
-	}
-	return nil
-}
-
-func checkoutBackportBranch(ctx context.Context, backportBranch, releaseBranch string) error {
-	out, err := exec.CommandContext(ctx, "git", "branch", "--show-current").Output()
-	if err != nil {
-		return fmt.Errorf("unable to check current branch %w", err)
-	}
-
-	currentBranch := strings.TrimSpace(string(out))
-	fmt.Printf("* Current branch is %s\n", currentBranch)
-	if currentBranch == backportBranch {
-		fmt.Printf("* Current branch is %s - not checking out\n", currentBranch)
-		return nil
-	}
-
-	if _, err := exec.CommandContext(ctx, "git", "rev-list", "-1", backportBranch).Output(); err == nil {
-		fmt.Printf("* Branch %s already exists. Checking it out...\n", backportBranch)
-		return exec.CommandContext(ctx, "git", "checkout", "-f", backportBranch).Run()
-	}
-
-	fmt.Printf("* `git checkout -b %s %s`\n", backportBranch, releaseBranch)
-	return exec.CommandContext(ctx, "git", "checkout", "-b", backportBranch, releaseBranch).Run()
-}
-
-func fetchRemoteAndMain(ctx context.Context, remote, releaseBranch string) error {
-	fmt.Printf("* `git fetch %s main`\n", remote)
-	out, err := exec.CommandContext(ctx, "git", "fetch", remote, "main").Output()
-	if err != nil {
-		fmt.Println(string(out))
-		return fmt.Errorf("unable to fetch %s from %s: %w", "main", remote, err)
-	}
-	fmt.Println(string(out))
-
-	fmt.Printf("* `git fetch %s %s`\n", remote, releaseBranch)
-	out, err = exec.CommandContext(ctx, "git", "fetch", remote, releaseBranch).Output()
-	if err != nil {
-		fmt.Println(string(out))
-		return fmt.Errorf("unable to fetch %s from %s: %w", releaseBranch, remote, err)
-	}
-	fmt.Println(string(out))
-
-	return nil
-}
-
-func determineRemote(ctx context.Context, forkUser string) (string, string, error) {
-	out, err := exec.CommandContext(ctx, "git", "remote", "-v").Output()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Unable to list git remotes:\n%s\n", string(out))
-		return "", "", fmt.Errorf("unable to determine forked remote: %w", err)
-	}
-	lines := strings.SplitSeq(string(out), "\n")
-	for line := range lines {
-		fields := strings.Split(line, "\t")
-		name, remote := fields[0], fields[1]
-		// only look at pushers
-		if !strings.HasSuffix(remote, " (push)") {
-			continue
-		}
-		// only look at github.com pushes
-		if !strings.Contains(remote, "github.com") {
-			continue
-		}
-		// ignore go-gitea/gitea
-		if strings.Contains(remote, "go-gitea/gitea") {
-			continue
-		}
-		if !strings.Contains(remote, forkUser) {
-			continue
-		}
-		if after, ok := strings.CutPrefix(remote, "git@github.com:"); ok {
-			forkUser = after
-		} else if after, ok := strings.CutPrefix(remote, "https://github.com/"); ok {
-			forkUser = after
-		} else if after, ok := strings.CutPrefix(remote, "https://www.github.com/"); ok {
-			forkUser = after
-		} else if forkUser == "" {
-			return "", "", fmt.Errorf("unable to extract forkUser from remote %s: %s", name, remote)
-		}
-		idx := strings.Index(forkUser, "/")
-		if idx >= 0 {
-			forkUser = forkUser[:idx]
-		}
-		return name, forkUser, nil
-	}
-	return "", "", fmt.Errorf("unable to find appropriate remote in:\n%s", string(out))
-}
-
-func readCurrentBranch(ctx context.Context) (pr, version string, err error) {
-	out, err := exec.CommandContext(ctx, "git", "branch", "--show-current").Output()
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Unable to read current git branch:\n%s\n", string(out))
-		return "", "", fmt.Errorf("unable to read current git branch: %w", err)
-	}
-	parts := strings.Split(strings.TrimSpace(string(out)), "-")
-
-	if len(parts) != 3 || parts[0] != "backport" {
-		fmt.Fprintf(os.Stderr, "Unable to continue from git branch:\n%s\n", string(out))
-		return "", "", fmt.Errorf("unable to continue from git branch:\n%s", string(out))
-	}
-
-	return parts[1], parts[2], nil
-}
-
-func readVersion() string {
-	bs, err := os.ReadFile("docs/config.yaml")
-	if err != nil {
-		if err == os.ErrNotExist {
-			log.Println("`docs/config.yaml` not present")
-			return ""
-		}
-		fmt.Fprintf(os.Stderr, "Unable to read `docs/config.yaml`: %v\n", err)
-		return ""
-	}
-
-	type params struct {
-		Version string
-	}
-	type docConfig struct {
-		Params params
-	}
-	dc := &docConfig{}
-	if err := yaml.Unmarshal(bs, dc); err != nil {
-		fmt.Fprintf(os.Stderr, "Unable to read `docs/config.yaml`: %v\n", err)
-		return ""
-	}
-
-	if dc.Params.Version == "" {
-		fmt.Fprintf(os.Stderr, "No version in `docs/config.yaml`")
-		return ""
-	}
-
-	version := dc.Params.Version
-	if version[0] != 'v' {
-		version = "v" + version
-	}
-
-	split := strings.SplitN(version, ".", 3)
-
-	return strings.Join(split[:2], ".")
-}
-
-func determineSHAforPR(ctx context.Context, prStr, accessToken string) (string, error) {
-	prNum, err := strconv.Atoi(prStr)
-	if err != nil {
-		return "", err
-	}
-
-	client := github.NewClient(http.DefaultClient)
-	if accessToken != "" {
-		client = client.WithAuthToken(accessToken)
-	}
-
-	pr, _, err := client.PullRequests.Get(ctx, "go-gitea", "gitea", prNum)
-	if err != nil {
-		return "", err
-	}
-
-	if pr.Merged == nil || !*pr.Merged {
-		return "", fmt.Errorf("PR #%d is not yet merged - cannot determine sha to backport", prNum)
-	}
-
-	if pr.MergeCommitSHA != nil {
-		return *pr.MergeCommitSHA, nil
-	}
-
-	return "", nil
-}
diff --git a/contrib/ide/README.md b/contrib/development/README.md
similarity index 100%
rename from contrib/ide/README.md
rename to contrib/development/README.md
diff --git a/contrib/ide/vscode/launch.json b/contrib/development/vscode/launch.json
similarity index 50%
rename from contrib/ide/vscode/launch.json
rename to contrib/development/vscode/launch.json
index b80b826fc0b..048428fc27f 100644
--- a/contrib/ide/vscode/launch.json
+++ b/contrib/development/vscode/launch.json
@@ -13,19 +13,6 @@
       },
       "args": ["web"],
       "showLog": true
-    },
-    {
-      "name": "Launch (with SQLite3)",
-      "type": "go",
-      "request": "launch",
-      "mode": "debug",
-      "buildFlags": "-tags='sqlite sqlite_unlock_notify'",
-      "program": "${workspaceRoot}/main.go",
-      "env": {
-        "GITEA_WORK_DIR": "${workspaceRoot}",
-      },
-      "args": ["web"],
-      "showLog": true
     }
   ]
 }
diff --git a/contrib/development/vscode/settings.json b/contrib/development/vscode/settings.json
new file mode 100644
index 00000000000..d968e4daca4
--- /dev/null
+++ b/contrib/development/vscode/settings.json
@@ -0,0 +1,4 @@
+{
+    "go.buildTags": "",
+    "go.testFlags": ["-v"]
+}
diff --git a/contrib/development/vscode/tasks.json b/contrib/development/vscode/tasks.json
new file mode 100644
index 00000000000..490e30338b1
--- /dev/null
+++ b/contrib/development/vscode/tasks.json
@@ -0,0 +1,27 @@
+{
+  "version": "2.0.0",
+  "tasks": [
+    {
+      "label": "Build",
+      "type": "shell",
+      "command": "go",
+      "group": "build",
+      "presentation": {
+        "echo": true,
+        "reveal": "always",
+        "focus": false,
+        "panel": "shared"
+      },
+      "linux": {
+        "args": ["build", "-o", "gitea", "${workspaceRoot}/main.go" ]
+      },
+      "osx": {
+        "args": ["build", "-o", "gitea", "${workspaceRoot}/main.go" ]
+      },
+      "windows": {
+        "args": ["build", "-o", "gitea.exe", "\"${workspaceRoot}\\main.go\""]
+      },
+      "problemMatcher": ["$go"]
+    }
+  ]
+}
diff --git a/contrib/gitea-monitoring-mixin/.gitignore b/contrib/grafana-monitoring-mixin/.gitignore
similarity index 100%
rename from contrib/gitea-monitoring-mixin/.gitignore
rename to contrib/grafana-monitoring-mixin/.gitignore
diff --git a/contrib/gitea-monitoring-mixin/Makefile b/contrib/grafana-monitoring-mixin/Makefile
similarity index 100%
rename from contrib/gitea-monitoring-mixin/Makefile
rename to contrib/grafana-monitoring-mixin/Makefile
diff --git a/contrib/gitea-monitoring-mixin/README.md b/contrib/grafana-monitoring-mixin/README.md
similarity index 100%
rename from contrib/gitea-monitoring-mixin/README.md
rename to contrib/grafana-monitoring-mixin/README.md
diff --git a/contrib/gitea-monitoring-mixin/config.libsonnet b/contrib/grafana-monitoring-mixin/config.libsonnet
similarity index 100%
rename from contrib/gitea-monitoring-mixin/config.libsonnet
rename to contrib/grafana-monitoring-mixin/config.libsonnet
diff --git a/contrib/gitea-monitoring-mixin/dashboards/dashboards.libsonnet b/contrib/grafana-monitoring-mixin/dashboards/dashboards.libsonnet
similarity index 100%
rename from contrib/gitea-monitoring-mixin/dashboards/dashboards.libsonnet
rename to contrib/grafana-monitoring-mixin/dashboards/dashboards.libsonnet
diff --git a/contrib/gitea-monitoring-mixin/dashboards/overview.libsonnet b/contrib/grafana-monitoring-mixin/dashboards/overview.libsonnet
similarity index 100%
rename from contrib/gitea-monitoring-mixin/dashboards/overview.libsonnet
rename to contrib/grafana-monitoring-mixin/dashboards/overview.libsonnet
diff --git a/contrib/gitea-monitoring-mixin/jsonnetfile.json b/contrib/grafana-monitoring-mixin/jsonnetfile.json
similarity index 100%
rename from contrib/gitea-monitoring-mixin/jsonnetfile.json
rename to contrib/grafana-monitoring-mixin/jsonnetfile.json
diff --git a/contrib/gitea-monitoring-mixin/jsonnetfile.lock.json b/contrib/grafana-monitoring-mixin/jsonnetfile.lock.json
similarity index 100%
rename from contrib/gitea-monitoring-mixin/jsonnetfile.lock.json
rename to contrib/grafana-monitoring-mixin/jsonnetfile.lock.json
diff --git a/contrib/gitea-monitoring-mixin/lib/alerts.jsonnet b/contrib/grafana-monitoring-mixin/lib/alerts.jsonnet
similarity index 100%
rename from contrib/gitea-monitoring-mixin/lib/alerts.jsonnet
rename to contrib/grafana-monitoring-mixin/lib/alerts.jsonnet
diff --git a/contrib/gitea-monitoring-mixin/lib/dashboards.jsonnet b/contrib/grafana-monitoring-mixin/lib/dashboards.jsonnet
similarity index 100%
rename from contrib/gitea-monitoring-mixin/lib/dashboards.jsonnet
rename to contrib/grafana-monitoring-mixin/lib/dashboards.jsonnet
diff --git a/contrib/gitea-monitoring-mixin/lib/rules.jsonnet b/contrib/grafana-monitoring-mixin/lib/rules.jsonnet
similarity index 100%
rename from contrib/gitea-monitoring-mixin/lib/rules.jsonnet
rename to contrib/grafana-monitoring-mixin/lib/rules.jsonnet
diff --git a/contrib/gitea-monitoring-mixin/mixin.libsonnet b/contrib/grafana-monitoring-mixin/mixin.libsonnet
similarity index 100%
rename from contrib/gitea-monitoring-mixin/mixin.libsonnet
rename to contrib/grafana-monitoring-mixin/mixin.libsonnet
diff --git a/contrib/ide/vscode/settings.json b/contrib/ide/vscode/settings.json
deleted file mode 100644
index e33bccf9028..00000000000
--- a/contrib/ide/vscode/settings.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "go.buildTags": "'sqlite sqlite_unlock_notify'",
-    "go.testFlags": ["-v"]
-}
\ No newline at end of file
diff --git a/contrib/ide/vscode/tasks.json b/contrib/ide/vscode/tasks.json
deleted file mode 100644
index e35ae303b27..00000000000
--- a/contrib/ide/vscode/tasks.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  "version": "2.0.0",
-  "tasks": [
-    {
-      "label": "Build",
-      "type": "shell",
-      "command": "go",
-      "group": "build",
-      "presentation": {
-        "echo": true,
-        "reveal": "always",
-        "focus": false,
-        "panel": "shared"
-      },
-      "linux": {
-        "args": ["build", "-o", "gitea", "${workspaceRoot}/main.go" ]
-      },
-      "osx": {
-        "args": ["build", "-o", "gitea", "${workspaceRoot}/main.go" ]
-      },
-      "windows": {
-        "args": ["build", "-o", "gitea.exe", "\"${workspaceRoot}\\main.go\""]
-      },
-      "problemMatcher": ["$go"]
-    },
-    {
-      "label": "Build (with SQLite3)",
-      "type": "shell",
-      "command": "go",
-      "group": "build",
-      "presentation": {
-        "echo": true,
-        "reveal": "always",
-        "focus": false,
-        "panel": "shared"
-      },
-      "linux": {
-        "args": ["build", "-tags=\"sqlite sqlite_unlock_notify\"", "-o", "gitea", "${workspaceRoot}/main.go"]
-      },
-      "osx": {
-        "args": ["build", "-tags=\"sqlite sqlite_unlock_notify\"", "-o", "gitea", "${workspaceRoot}/main.go"]
-      },
-      "windows": {
-        "args": ["build", "-tags=\"sqlite sqlite_unlock_notify\"", "-o", "gitea.exe", "\"${workspaceRoot}\\main.go\""]
-      },
-      "problemMatcher": ["$go"]
-    }
-  ]
-}
diff --git a/contrib/init/centos/gitea b/contrib/init/centos/gitea
deleted file mode 100644
index 4f0d0d99b26..00000000000
--- a/contrib/init/centos/gitea
+++ /dev/null
@@ -1,93 +0,0 @@
-#!/bin/sh
-#
-#       /etc/rc.d/init.d/gitea
-#
-#       Runs the Gitea Git with a cup of tea.
-#
-#
-# chkconfig:   - 85 15
-#
-
-### BEGIN INIT INFO
-# Provides:          gitea
-# Required-Start:    $remote_fs $syslog
-# Required-Stop:     $remote_fs $syslog
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: Start gitea at boot time.
-# Description:       Control gitea.
-### END INIT INFO
-
-# Source function library.
-. /etc/init.d/functions
-
-# Default values
-
-NAME=gitea
-GITEA_HOME=/var/lib/${NAME}
-GITEA_PATH=/usr/local/bin/${NAME}
-GITEA_USER=git
-SERVICENAME="Gitea - Git with a cup of tea"
-LOCKFILE=/var/lock/subsys/gitea
-LOGPATH=${GITEA_HOME}/log
-LOGFILE=${LOGPATH}/gitea.log
-RETVAL=0
-
-# Read configuration from /etc/sysconfig/gitea to override defaults
-[ -r /etc/sysconfig/$NAME ] && . /etc/sysconfig/$NAME
-
-# Don't do anything if nothing is installed
-[ -x ${GITEA_PATH} ] || exit 0
-# exit if logpath dir is not created.
-[ -x ${LOGPATH} ] || exit 0
-
-DAEMON_OPTS="--check $NAME"
-
-# Set additional options, if any
-[ ! -z "$GITEA_USER" ] && DAEMON_OPTS="$DAEMON_OPTS --user=${GITEA_USER}"
-
-start() {
-  cd ${GITEA_HOME}
-  echo -n "Starting ${SERVICENAME}: "
-  daemon $DAEMON_OPTS "${GITEA_PATH} web -c /etc/${NAME}/app.ini > ${LOGFILE} 2>&1 &"
-  RETVAL=$?
-  echo
-  [ $RETVAL = 0 ] && touch ${LOCKFILE}
-
-  return $RETVAL
-}
-
-stop() {
-  cd ${GITEA_HOME}
-        echo -n "Shutting down ${SERVICENAME}: "
-        killproc ${NAME}
-        RETVAL=$?
-        echo
-        [ $RETVAL = 0 ] && rm -f ${LOCKFILE}
-}
-
-case "$1" in
-    start)
-        status ${NAME} > /dev/null 2>&1 && exit 0
-        start
-        ;;
-    stop)
-        stop
-        ;;
-    status)
-        status ${NAME}
-        ;;
-    restart)
-        stop
-        start
-        ;;
-    reload)
-        stop
-        start
-        ;;
-    *)
-        echo "Usage: ${NAME} {start|stop|status|restart}"
-        exit 1
-        ;;
-esac
-exit $RETVAL
diff --git a/contrib/init/debian/gitea b/contrib/init/debian/gitea
deleted file mode 100644
index 22463094407..00000000000
--- a/contrib/init/debian/gitea
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/bin/sh
-### BEGIN INIT INFO
-# Provides:          gitea
-# Required-Start:    $syslog $network
-# Required-Stop:     $syslog
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: A self-hosted Git service written in Go.
-# Description:       A self-hosted Git service written in Go.
-### END INIT INFO
-
-# Author: Danny Boisvert
-
-# Do NOT "set -e"
-
-# PATH should only include /usr/* if it runs after the mountnfs.sh script
-PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/bin
-DESC="Gitea - Git with a cup of tea"
-NAME=gitea
-SERVICEVERBOSE=yes
-PIDFILE=/run/$NAME.pid
-SCRIPTNAME=/etc/init.d/$NAME
-WORKINGDIR=/var/lib/$NAME
-DAEMON=/usr/local/bin/$NAME
-DAEMON_ARGS="web -c /etc/$NAME/app.ini"
-USER=git
-USERBIND=""
-# If you want to bind Gitea to a port below 1024 uncomment
-# the line below
-#USERBIND="setcap cap_net_bind_service=+ep"
-STOP_SCHEDULE="${STOP_SCHEDULE:-QUIT/5/TERM/1/KILL/5}"
-
-# Read configuration variable file if it is present
-[ -r /etc/default/$NAME ] && . /etc/default/$NAME
-
-# Exit if the package is not installed
-[ -x "$DAEMON" ] || exit 0
-
-do_start()
-{
-    $USERBIND $DAEMON
-    sh -c "USER=$USER HOME=/home/$USER GITEA_WORK_DIR=$WORKINGDIR start-stop-daemon --start --quiet --pidfile $PIDFILE --make-pidfile \\
-        --background --chdir $WORKINGDIR --chuid $USER \\
-        --exec $DAEMON -- $DAEMON_ARGS"
-}
-
-do_stop()
-{
-    start-stop-daemon --stop --quiet --retry=$STOP_SCHEDULE --pidfile $PIDFILE --name $NAME --oknodo
-    rm -f $PIDFILE
-}
-
-do_status()
-{
-    if [ -f $PIDFILE ]; then
-        if kill -0 $(cat "$PIDFILE"); then
-            echo "$NAME is running, PID is $(cat $PIDFILE)"
-        else
-            echo "$NAME process is dead, but pidfile exists"
-        fi
-    else
-        echo "$NAME is not running"
-    fi
-}
-
-case "$1" in
-    start)
-        echo "Starting $DESC" "$NAME"
-        do_start
-        ;;
-    stop)
-        echo "Stopping $DESC" "$NAME"
-        do_stop
-        ;;
-    status)
-        do_status
-        ;;
-    restart)
-        echo "Restarting $DESC" "$NAME"
-        do_stop
-        do_start
-        ;;
-    *)
-        echo "Usage: $SCRIPTNAME {start|stop|status|restart}" >&2
-        exit 2
-        ;;
-esac
-
-exit 0
diff --git a/contrib/init/suse/gitea b/contrib/init/suse/gitea
deleted file mode 100644
index 6391bedaf83..00000000000
--- a/contrib/init/suse/gitea
+++ /dev/null
@@ -1,115 +0,0 @@
-#!/bin/sh
-#
-#       /etc/init.d/gitea
-#
-#       Runs the Gitea Git with a cup of tea.
-#
-
-### BEGIN INIT INFO
-# Provides:          gitea
-# Required-Start:    $remote_fs
-# Required-Stop:     $remote_fs
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: Start gitea at boot time.
-# Description:       Control gitea.
-### END INIT INFO
-
-# Default values
-
-NAME=gitea
-GITEA_HOME=/var/lib/$NAME
-GITEA_PATH=/usr/local/bin/$NAME
-GITEA_USER=git
-SERVICENAME="Gitea - Git with a cup of tea"
-LOCKFILE=/var/lock/subsys/gitea
-LOGPATH=${GITEA_HOME}/log
-LOGFILE=${LOGPATH}/error.log
-# gitea creates its own gitea.log from stdout
-RETVAL=0
-
-# Read configuration from /etc/sysconfig/gitea to override defaults
-[ -r /etc/sysconfig/$NAME ] && . /etc/sysconfig/$NAME
-
-# Don't do anything if nothing is installed
-test -x ${GITEA_PATH} || { echo "$NAME not installed";
-	if [ "$1" = "stop" ]; then exit 0;
-	else exit 5; fi; }
-
-# exit if logpath dir is not created.
-test -r ${LOGPATH} || { echo "$LOGPATH not existing";
-	if [ "$1" = "stop" ]; then exit 0;
-	else exit 6; fi; }
-
-# Source function library.
-. /etc/rc.status
-
-# Reset status of this service
-rc_reset
-
-
-case "$1" in
-    start)
-		echo -n "Starting ${SERVICENAME} "
-
-		# As we can't use startproc, we have to check ourselves if the service is already running
-		/sbin/checkproc ${GITEA_PATH}
-		if [ $? -eq 0 ]; then
-			# return skipped as service is already running
-			(exit 5)
-		else
-			su - ${GITEA_USER} -c "USER=${GITEA_USER} GITEA_WORK_DIR=${GITEA_HOME} ${GITEA_PATH} web -c /etc/${NAME}/app.ini 2>&1 >>${LOGFILE} &"
-		fi
-
-		# Remember status and be verbose
-		rc_status -v
-	;;
-
-	stop)
-		echo -n "Shutting down ${SERVICENAME} "
-
-		## Stop daemon with killproc(8) and if this fails
-		## killproc sets the return value according to LSB.
-		/sbin/killproc ${GITEA_PATH}
-
-		# Remember status and be verbose
-		rc_status -v
-	;;
-
-	restart)
-		## Stop the service and regardless of whether it was
-		## running or not, start it again.
-		$0 stop
-		$0 start
-
-		# Remember status and be quiet
-		rc_status
-	;;
-
-	status)
-		echo -n "Checking for ${SERVICENAME} "
-		## Check status with checkproc(8), if process is running
-		## checkproc will return with exit status 0.
-
-		# Return value is slightly different for the status command:
-		# 0 - service up and running
-		# 1 - service dead, but /run/  pid  file exists
-		# 2 - service dead, but /var/lock/ lock file exists
-		# 3 - service not running (unused)
-		# 4 - service status unknown :-(
-		# 5--199 reserved (5--99 LSB, 100--149 distro, 150--199 appl.)
-
-		# NOTE: checkproc returns LSB compliant status values.
-		/sbin/checkproc ${GITEA_PATH}
-		# NOTE: rc_status knows that we called this init script with
-		# "status" option and adapts its messages accordingly.
-		rc_status -v
-	;;
-
-    *)
-		echo "Usage: $0 {start|stop|status|restart}"
-		exit 1
-	;;
-
-esac
-rc_exit
diff --git a/contrib/legal/privacy.html.sample b/contrib/sample-page/privacy.html.sample
similarity index 100%
rename from contrib/legal/privacy.html.sample
rename to contrib/sample-page/privacy.html.sample
diff --git a/contrib/legal/tos.html.sample b/contrib/sample-page/tos.html.sample
similarity index 100%
rename from contrib/legal/tos.html.sample
rename to contrib/sample-page/tos.html.sample
diff --git a/contrib/init/freebsd/gitea b/contrib/service/freebsd/gitea
similarity index 100%
rename from contrib/init/freebsd/gitea
rename to contrib/service/freebsd/gitea
diff --git a/contrib/init/gentoo/gitea b/contrib/service/gentoo/gitea
similarity index 100%
rename from contrib/init/gentoo/gitea
rename to contrib/service/gentoo/gitea
diff --git a/contrib/launchd/io.gitea.web.plist b/contrib/service/launchd/io.gitea.web.plist
similarity index 100%
rename from contrib/launchd/io.gitea.web.plist
rename to contrib/service/launchd/io.gitea.web.plist
diff --git a/contrib/init/openbsd/gitea b/contrib/service/openbsd/gitea
similarity index 100%
rename from contrib/init/openbsd/gitea
rename to contrib/service/openbsd/gitea
diff --git a/contrib/init/openwrt/gitea b/contrib/service/openwrt/gitea
similarity index 100%
rename from contrib/init/openwrt/gitea
rename to contrib/service/openwrt/gitea
diff --git a/contrib/init/sunos/gitea.xml b/contrib/service/sunos/gitea.xml
similarity index 100%
rename from contrib/init/sunos/gitea.xml
rename to contrib/service/sunos/gitea.xml
diff --git a/contrib/supervisor/gitea b/contrib/service/supervisor/gitea
similarity index 100%
rename from contrib/supervisor/gitea
rename to contrib/service/supervisor/gitea
diff --git a/contrib/systemd/gitea.service b/contrib/service/systemd/gitea.service
similarity index 100%
rename from contrib/systemd/gitea.service
rename to contrib/service/systemd/gitea.service
diff --git a/contrib/init/ubuntu/gitea b/contrib/service/sysvinit/gitea
similarity index 90%
rename from contrib/init/ubuntu/gitea
rename to contrib/service/sysvinit/gitea
index da56b6e4a97..1508da7f843 100644
--- a/contrib/init/ubuntu/gitea
+++ b/contrib/service/sysvinit/gitea
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 ### BEGIN INIT INFO
 # Provides:          gitea
 # Required-Start:    $syslog $network
@@ -9,6 +9,8 @@
 # Description:       A self-hosted Git service written in Go.
 ### END INIT INFO
 
+# This is a System V Init (init.d) startup script for legacy Linux distributions
+
 # Do NOT "set -e"
 
 # PATH should only include /usr/* if it runs after the mountnfs.sh script
@@ -24,6 +26,9 @@ DAEMON_ARGS="web -c /etc/$NAME/app.ini"
 USER=git
 STOP_SCHEDULE="${STOP_SCHEDULE:-QUIT/5/TERM/1/KILL/5}"
 
+# If you want to bind Gitea to a port below 1024, apply "setcap" to the gitea binary
+#setcap cap_net_bind_service=+ep $DAEMON"
+
 # Read configuration variable file if it is present
 [ -r /etc/default/$NAME ] && . /etc/default/$NAME
 
diff --git a/contrib/update_dependencies.sh b/contrib/update_dependencies.sh
deleted file mode 100755
index 5700a198974..00000000000
--- a/contrib/update_dependencies.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-grep 'git' go.mod | grep '\.com' | grep -v indirect | grep -v replace | cut -f 2 | cut -d ' ' -f 1 | while read line; do
-  go get -u "$line"
-  make vendor
-  git add .
-  git commit -m "update $line"
-done
diff --git a/contrib/upgrade.sh b/contrib/upgrade.sh
index 2593d245093..71d0435d146 100755
--- a/contrib/upgrade.sh
+++ b/contrib/upgrade.sh
@@ -126,6 +126,7 @@ giteacmd manager flush-queues
 echo "Stopping gitea at $(date)"
 $service_stop
 echo "Creating backup in $giteahome"
+# shellcheck disable=SC2086 # flag string
 giteacmd dump $backupopts
 echo "Updating binary at $giteabin"
 cp -f "$giteabin" "$giteabin.bak" && mv -f "$binname" "$giteabin"
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index dd62cf8e830..2793dd1ca09 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -159,6 +159,16 @@
 ;; Domain name to be exposed in clone URL, defaults to DOMAIN or the domain part of ROOT_URL
 ;SSH_DOMAIN =
 ;;
+;; Port number to be exposed in clone URL.
+;; If you need a different "SSH clone port" from the real "SSH listen port", set the SSH_LISTEN_PORT separately.
+;SSH_PORT = 22
+;;
+;; The network interface that the builtin SSH server should listen on
+;SSH_LISTEN_HOST =
+;;
+;; The port number that the builtin SSH server should listen on, defaults to SSH_PORT
+;SSH_LISTEN_PORT =
+;;
 ;; SSH username displayed in clone URLs. It defaults to BUILTIN_SSH_SERVER_USER or RUN_USER.
 ;; If it is set to "(DOER_USERNAME)", it will use current signed-in user's username.
 ;; This option is only for some advanced users who have configured their SSH reverse-proxy
@@ -166,15 +176,6 @@
 ;; Most users should just leave it blank.
 ;SSH_USER =
 ;;
-;; The network interface the builtin SSH server should listen on
-;SSH_LISTEN_HOST =
-;;
-;; Port number to be exposed in clone URL
-;SSH_PORT = 22
-;;
-;; The port number the builtin SSH server should listen on, defaults to SSH_PORT
-;SSH_LISTEN_PORT =
-;;
 ;; Root path of SSH user directory for the system's standalone SSH server if Gitea is not using its builtin SSH server.
 ;; Default is the '.ssh' directory in the run user's home directory.
 ;SSH_ROOT_PATH =
@@ -383,7 +384,7 @@ USER = root
 ;;
 ;DB_TYPE = sqlite3
 ;PATH= ; defaults to data/gitea.db
-;SQLITE_TIMEOUT = ; Query timeout defaults to: 500
+;SQLITE_TIMEOUT = ; Query timeout in milliseconds, defaults to: 20000
 ;SQLITE_JOURNAL_MODE = ; defaults to sqlite database default (often DELETE), can be used to enable WAL mode. https://www.sqlite.org/pragma.html#pragma_journal_mode
 ;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -1023,9 +1024,18 @@ LEVEL = Info
 ;; Default private when using push-to-create
 ;DEFAULT_PUSH_CREATE_PRIVATE = true
 ;;
-;; Global limit of repositories per user, applied at creation time. -1 means no limit
+;; Global limit of repositories per user or org, applied at creation time. -1 means no limit
+;; To configure independent limits for users and orgs, use USER_MAX_CREATION_LIMIT and ORG_MAX_CREATION_LIMIT
 ;MAX_CREATION_LIMIT = -1
 ;;
+;; Global limit of repositories per user, applied at creation time. -1 means no limit
+;; Takes precedence over MAX_CREATION_LIMIT when set
+;USER_MAX_CREATION_LIMIT = -1
+;;
+;; Global limit of repositories per organization, applied at creation time. -1 means no limit
+;; Takes precedence over MAX_CREATION_LIMIT when set
+;ORG_MAX_CREATION_LIMIT = -1
+;;
 ;; Preferred Licenses to place at the top of the List
 ;; The name here must match the filename in options/license or custom/options/license
 ;PREFERRED_LICENSES = Apache License 2.0,MIT License
@@ -1172,7 +1182,7 @@ LEVEL = Info
 ;; Default source for the pull request title when opening a new PR.
 ;; "first-commit" uses the oldest commit's summary.
 ;; "auto" uses commit's summary if the PR only has one commit, normalizes the branch name if multiple commits.
-;DEFAULT_TITLE_SOURCE = first-commit
+;DEFAULT_TITLE_SOURCE = auto
 ;;
 ;; Delay mergeable check until page view or API access, for pull requests that have not been updated in the specified days when their base branches get updated.
 ;; Use "-1" to always check all pull requests (old behavior). Use "0" to always delay the checks.
diff --git a/docker/rootless/usr/local/bin/docker-entrypoint.sh b/docker/rootless/usr/local/bin/docker-entrypoint.sh
index ca509214bff..4ffc4ff3a11 100755
--- a/docker/rootless/usr/local/bin/docker-entrypoint.sh
+++ b/docker/rootless/usr/local/bin/docker-entrypoint.sh
@@ -13,5 +13,5 @@ fi
 if [ $# -gt 0 ]; then
     exec "$@"
 else
-    exec /usr/local/bin/gitea -c ${GITEA_APP_INI} web
+    exec /usr/local/bin/gitea -c "${GITEA_APP_INI}" web
 fi
diff --git a/docker/rootless/usr/local/bin/docker-setup.sh b/docker/rootless/usr/local/bin/docker-setup.sh
index feab02a3793..3320d69dde8 100755
--- a/docker/rootless/usr/local/bin/docker-setup.sh
+++ b/docker/rootless/usr/local/bin/docker-setup.sh
@@ -1,23 +1,23 @@
 #!/bin/bash
 
 # Prepare git folder
-mkdir -p ${HOME} && chmod 0700 ${HOME}
-if [ ! -w ${HOME} ]; then echo "${HOME} is not writable"; exit 1; fi
+mkdir -p "${HOME}" && chmod 0700 "${HOME}"
+if [ ! -w "${HOME}" ]; then echo "${HOME} is not writable"; exit 1; fi
 
 # Prepare custom folder
-mkdir -p ${GITEA_CUSTOM} && chmod 0700 ${GITEA_CUSTOM}
+mkdir -p "${GITEA_CUSTOM}" && chmod 0700 "${GITEA_CUSTOM}"
 
 # Prepare temp folder
-mkdir -p ${GITEA_TEMP} && chmod 0700 ${GITEA_TEMP}
-if [ ! -w ${GITEA_TEMP} ]; then echo "${GITEA_TEMP} is not writable"; exit 1; fi
+mkdir -p "${GITEA_TEMP}" && chmod 0700 "${GITEA_TEMP}"
+if [ ! -w "${GITEA_TEMP}" ]; then echo "${GITEA_TEMP} is not writable"; exit 1; fi
 
 #Prepare config file
-if [ ! -f ${GITEA_APP_INI} ]; then
+if [ ! -f "${GITEA_APP_INI}" ]; then
 
     #Prepare config file folder
-    GITEA_APP_INI_DIR=$(dirname ${GITEA_APP_INI})
-    mkdir -p ${GITEA_APP_INI_DIR} && chmod 0700 ${GITEA_APP_INI_DIR}
-    if [ ! -w ${GITEA_APP_INI_DIR} ]; then echo "${GITEA_APP_INI_DIR} is not writable"; exit 1; fi
+    GITEA_APP_INI_DIR=$(dirname "${GITEA_APP_INI}")
+    mkdir -p "${GITEA_APP_INI_DIR}" && chmod 0700 "${GITEA_APP_INI_DIR}"
+    if [ ! -w "${GITEA_APP_INI_DIR}" ]; then echo "${GITEA_APP_INI_DIR} is not writable"; exit 1; fi
 
     # Set INSTALL_LOCK to true only if SECRET_KEY is not empty and
     # INSTALL_LOCK is empty
@@ -34,7 +34,7 @@ if [ ! -f ${GITEA_APP_INI} ]; then
     ROOT_URL=${ROOT_URL:-""} \
     DISABLE_SSH=${DISABLE_SSH:-"false"} \
     SSH_PORT=${SSH_PORT:-"2222"} \
-    SSH_LISTEN_PORT=${SSH_LISTEN_PORT:-$SSH_PORT} \
+    SSH_LISTEN_PORT=${SSH_LISTEN_PORT:-} \
     DB_TYPE=${DB_TYPE:-"sqlite3"} \
     DB_HOST=${DB_HOST:-"localhost:3306"} \
     DB_NAME=${DB_NAME:-"gitea"} \
@@ -44,8 +44,8 @@ if [ ! -f ${GITEA_APP_INI} ]; then
     DISABLE_REGISTRATION=${DISABLE_REGISTRATION:-"false"} \
     REQUIRE_SIGNIN_VIEW=${REQUIRE_SIGNIN_VIEW:-"false"} \
     SECRET_KEY=${SECRET_KEY:-""} \
-    envsubst < /etc/templates/app.ini > ${GITEA_APP_INI}
+    envsubst < /etc/templates/app.ini > "${GITEA_APP_INI}"
 fi
 
 # Replace app.ini settings with env variables in the form GITEA__SECTION_NAME__KEY_NAME
-environment-to-ini --config ${GITEA_APP_INI}
+environment-to-ini --config "${GITEA_APP_INI}"
diff --git a/docs/community-governance.md b/docs/community-governance.md
index dbf24813295..e37e9def64e 100644
--- a/docs/community-governance.md
+++ b/docs/community-governance.md
@@ -48,7 +48,7 @@ If a PR has `lgtm/done`, no open discussions, and no merge conflicts, any mainta
 
 <https://github.com/go-gitea/gitea/pulls?q=is%3Apr+label%3Areviewed%2Fwait-merge+sort%3Acreated-asc+is%3Aopen>
 
-Gitea uses its own tool, <https://github.com/GiteaBot/gitea-backporter>, to automate parts of the review process. The backporter:
+Gitea uses its own tool, <https://github.com/go-gitea/gitea/blob/main/.github/workflows/giteabot.yml>, to automate parts of the review process. The backporter:
 
 - Creates a backport PR when needed after the initial PR merges.
 - Removes the PR from the merge queue after it merges.
diff --git a/docs/guideline-backend.md b/docs/guideline-backend.md
index bc3e71113f2..29fa92288cd 100644
--- a/docs/guideline-backend.md
+++ b/docs/guideline-backend.md
@@ -56,3 +56,8 @@ Endpoints returning lists must
 
 - support pagination (`page` & `limit` options in query)
 - set `X-Total-Count` header via **SetTotalCountHeader** ([example](https://github.com/go-gitea/gitea/blob/7aae98cc5d4113f1e9918b7ee7dd09f67c189e3e/routers/api/v1/repo/issue.go#L444))
+
+### Knowledge
+
+- Partially database table migration must use `SyncWithOptions(IgnoreDrop...)`
+- Template variables with "camelCase" or "snake_case" are used for restoring the form values from a submitted form
diff --git a/eslint.config.ts b/eslint.config.ts
index 29016ed808b..91adc06e193 100644
--- a/eslint.config.ts
+++ b/eslint.config.ts
@@ -570,8 +570,6 @@ export default defineConfig([
       'no-redeclare': [0], // must be disabled for typescript overloads
       'no-regex-spaces': [2],
       'no-restricted-exports': [0],
-      'no-restricted-globals': [2, ...restrictedGlobals],
-      'no-restricted-properties': [2, ...restrictedProperties],
       'no-restricted-imports': [2, {paths: [
         {name: 'jquery', message: 'Use the global $ instead', allowTypeImports: true},
       ]}],
@@ -1022,5 +1020,9 @@ export default defineConfig([
   {
     files: ['web_src/**/*'],
     languageOptions: {globals: {...globals.browser, ...globals.jquery}},
+    rules: {
+      'no-restricted-globals': [2, ...restrictedGlobals],
+      'no-restricted-properties': [2, ...restrictedProperties],
+    },
   },
 ]);
diff --git a/eslint.json.config.ts b/eslint.json.config.ts
index 45696fb79cb..aa6ed0e4c62 100644
--- a/eslint.json.config.ts
+++ b/eslint.json.config.ts
@@ -13,12 +13,18 @@ export default defineConfig([
     language: 'json/json',
     extends: ['json/recommended'],
   },
+  {
+    files: ['**/*.json5'],
+    plugins: {json},
+    language: 'json/json5',
+    extends: ['json/recommended'],
+  },
   {
     files: [
       'tsconfig.json',
       '.devcontainer/*.json',
       '.vscode/*.json',
-      'contrib/ide/vscode/*.json',
+      'contrib/development/vscode/*.json',
     ],
     plugins: {json},
     language: 'json/jsonc',
diff --git a/flake.nix b/flake.nix
index 7b9fbb193c3..ca88b581a22 100644
--- a/flake.nix
+++ b/flake.nix
@@ -83,7 +83,7 @@
                 GO = "${go}/bin/go";
                 GOROOT = "${go}/share/go";
 
-                TAGS = "sqlite sqlite_unlock_notify";
+                TAGS = "";
                 STATIC = "true";
               }
               // linuxOnlyEnv;
diff --git a/go.mod b/go.mod
index 156abf4afb8..ead88bf5fb7 100644
--- a/go.mod
+++ b/go.mod
@@ -1,43 +1,39 @@
-module code.gitea.io/gitea
+module gitea.dev
 
-go 1.26.2
-
-// rfc5280 said: "The serial number is an integer assigned by the CA to each certificate."
-// But some CAs use negative serial number, just relax the check. related:
-// Default TLS cert uses negative serial number #895 https://github.com/microsoft/mssql-docker/issues/895
-godebug x509negativeserial=1
+go 1.26.3
 
 require (
-	code.gitea.io/actions-proto-go v0.4.1
-	code.gitea.io/sdk/gitea v0.24.1
 	codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570
-	connectrpc.com/connect v1.19.1
+	connectrpc.com/connect v1.20.0
+	gitea.com/gitea/runner v1.0.5
 	gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a
 	gitea.com/go-chi/cache v0.2.1
 	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098
 	gitea.com/go-chi/session v0.0.0-20251124165456-68e0254e989e
 	gitea.com/lunny/dingtalk_webhook v0.0.0-20171025031554-e3534c89ef96
 	gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4
+	gitea.dev/actions-proto-go v0.5.0
+	gitea.dev/sdk v1.0.1
 	github.com/42wim/httpsig v1.2.4
 	github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.0
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.2
-	github.com/Azure/go-ntlmssp v0.1.0
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.3
+	github.com/Azure/go-ntlmssp v0.1.1
+	github.com/Necoro/html2text v0.0.0-20250804200300-7bf1ce1c7347
 	github.com/ProtonMail/go-crypto v1.4.1
 	github.com/PuerkitoBio/goquery v1.12.0
-	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.0
-	github.com/alecthomas/chroma/v2 v2.23.1
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.15
-	github.com/aws/aws-sdk-go-v2/service/codecommit v1.33.13
+	github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.3
+	github.com/alecthomas/chroma/v2 v2.25.0
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.16
+	github.com/aws/aws-sdk-go-v2/service/codecommit v1.33.14
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
-	github.com/blevesearch/bleve/v2 v2.5.7
+	github.com/blevesearch/bleve/v2 v2.6.0
 	github.com/bohde/codel v0.2.0
 	github.com/buildkite/terminal-to-html/v3 v3.16.8
-	github.com/caddyserver/certmagic v0.25.2
-	github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20251013092601-6327009efd21
+	github.com/caddyserver/certmagic v0.25.3
+	github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260309112543-12416315a635
 	github.com/chi-middleware/proxy v1.1.1
-	github.com/dimiro1/reply v0.0.0-20200315094148-d0136a4c9e21
-	github.com/dlclark/regexp2 v1.12.0
+	github.com/dlclark/regexp2/v2 v2.1.0
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707
 	github.com/dustin/go-humanize v1.0.1
 	github.com/editorconfig/editorconfig-core-go/v2 v2.6.4
@@ -45,54 +41,52 @@ require (
 	github.com/emirpasic/gods v1.18.1
 	github.com/ethantkoenig/rupture v1.0.1
 	github.com/felixge/fgprof v0.9.5
-	github.com/fsnotify/fsnotify v1.9.0
-	github.com/getkin/kin-openapi v0.134.0
+	github.com/fsnotify/fsnotify v1.10.1
+	github.com/getkin/kin-openapi v0.138.0
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/go-chi/cors v1.2.2
-	github.com/go-co-op/gocron/v2 v2.21.0
+	github.com/go-co-op/gocron/v2 v2.21.2
 	github.com/go-enry/go-enry/v2 v2.9.6
-	github.com/go-git/go-billy/v5 v5.8.0
-	github.com/go-git/go-git/v5 v5.18.0
+	github.com/go-git/go-billy/v5 v5.9.0
+	github.com/go-git/go-git/v5 v5.19.1
 	github.com/go-ldap/ldap/v3 v3.4.13
 	github.com/go-redsync/redsync/v4 v4.16.0
-	github.com/go-sql-driver/mysql v1.9.3
-	github.com/go-webauthn/webauthn v0.16.5
+	github.com/go-sql-driver/mysql v1.10.0
+	github.com/go-webauthn/webauthn v0.17.3
 	github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
 	github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
 	github.com/golang-jwt/jwt/v5 v5.3.1
-	github.com/google/go-github/v84 v84.0.0
+	github.com/google/go-github/v88 v88.0.0
 	github.com/google/licenseclassifier/v2 v2.0.0
-	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936
+	github.com/google/pprof v0.0.0-20260507013755-92041b743c96
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/feeds v1.2.0
 	github.com/gorilla/sessions v1.4.0
 	github.com/hashicorp/go-version v1.9.0
 	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/huandu/xstrings v1.5.0
-	github.com/jaytaylor/html2text v0.0.0-20230321000545-74c2419ad056
-	github.com/jhillyerd/enmime/v2 v2.3.0
+	github.com/jhillyerd/enmime/v2 v2.4.0
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/klauspost/compress v1.18.5
+	github.com/klauspost/compress v1.18.6
 	github.com/klauspost/cpuid/v2 v2.3.0
 	github.com/lib/pq v1.12.3
 	github.com/markbates/goth v1.82.0
-	github.com/mattn/go-isatty v0.0.21
-	github.com/mattn/go-sqlite3 v1.14.42
+	github.com/mattn/go-isatty v0.0.22
+	github.com/mattn/go-sqlite3 v1.14.44
 	github.com/meilisearch/meilisearch-go v0.36.2
 	github.com/mholt/archives v0.1.5
 	github.com/microcosm-cc/bluemonday v1.0.27
-	github.com/microsoft/go-mssqldb v1.9.6
-	github.com/minio/minio-go/v7 v7.0.100
+	github.com/microsoft/go-mssqldb v1.9.7
+	github.com/minio/minio-go/v7 v7.1.0
 	github.com/msteinert/pam/v2 v2.1.0
-	github.com/nektos/act v0.2.63
 	github.com/niklasfasching/go-org v1.9.1
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
 	github.com/pquerna/otp v1.5.0
 	github.com/prometheus/client_golang v1.23.2
 	github.com/quasoft/websspi v1.1.2
-	github.com/redis/go-redis/v9 v9.18.0
+	github.com/redis/go-redis/v9 v9.19.0
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	github.com/sassoftware/go-rpmutils v0.4.0
@@ -102,25 +96,24 @@ require (
 	github.com/tstranex/u2f v1.0.0
 	github.com/ulikunitz/xz v0.5.15
 	github.com/urfave/cli-docs/v3 v3.1.0
-	github.com/urfave/cli/v3 v3.4.1
-	github.com/wneessen/go-mail v0.7.2
-	github.com/xeipuuv/gojsonschema v1.2.0
+	github.com/urfave/cli/v3 v3.9.0
+	github.com/wneessen/go-mail v0.7.3
 	github.com/yohcop/openid-go v1.0.1
 	github.com/yuin/goldmark v1.8.2
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
-	gitlab.com/gitlab-org/api/client-go v1.46.0
+	gitlab.com/gitlab-org/api/client-go/v2 v2.30.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.3
-	golang.org/x/crypto v0.50.0
-	golang.org/x/image v0.39.0
-	golang.org/x/net v0.53.0
+	golang.org/x/crypto v0.52.0
+	golang.org/x/image v0.41.0
+	golang.org/x/net v0.55.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.20.0
-	golang.org/x/sys v0.43.0
-	golang.org/x/text v0.36.0
-	google.golang.org/grpc v1.80.0
+	golang.org/x/sys v0.45.0
+	golang.org/x/text v0.37.0
+	google.golang.org/grpc v1.81.1
 	google.golang.org/protobuf v1.36.11
-	gopkg.in/ini.v1 v1.67.1
-	gopkg.in/yaml.v3 v3.0.1
+	gopkg.in/ini.v1 v1.67.2
+	modernc.org/sqlite v1.50.1
 	mvdan.cc/xurls/v2 v2.6.0
 	strk.kbt.io/projects/go/libravatar v0.0.0-20260301104140-add494e31dab
 	xorm.io/builder v0.3.13
@@ -139,20 +132,20 @@ require (
 	github.com/andybalholm/brotli v1.2.1 // indirect
 	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.22 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22 // indirect
-	github.com/aws/smithy-go v1.25.0 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.7 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
+	github.com/aws/smithy-go v1.25.1 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bits-and-blooms/bitset v1.24.4 // indirect
-	github.com/blevesearch/bleve_index_api v1.3.7 // indirect
+	github.com/blevesearch/bleve_index_api v1.3.11 // indirect
 	github.com/blevesearch/geo v0.2.5 // indirect
-	github.com/blevesearch/go-faiss v1.0.30 // indirect
+	github.com/blevesearch/go-faiss v1.1.0 // indirect
 	github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
 	github.com/blevesearch/gtreap v0.1.1 // indirect
 	github.com/blevesearch/mmap-go v1.2.0 // indirect
-	github.com/blevesearch/scorch_segment_api/v2 v2.4.5 // indirect
+	github.com/blevesearch/scorch_segment_api/v2 v2.4.7 // indirect
 	github.com/blevesearch/segment v0.9.1 // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
@@ -162,7 +155,8 @@ require (
 	github.com/blevesearch/zapx/v13 v13.4.3 // indirect
 	github.com/blevesearch/zapx/v14 v14.4.3 // indirect
 	github.com/blevesearch/zapx/v15 v15.4.3 // indirect
-	github.com/blevesearch/zapx/v16 v16.3.2 // indirect
+	github.com/blevesearch/zapx/v16 v16.3.4 // indirect
+	github.com/blevesearch/zapx/v17 v17.1.2 // indirect
 	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
 	github.com/bodgit/sevenzip v1.6.1 // indirect
@@ -182,10 +176,10 @@ require (
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/davidmz/go-pageant v1.0.2 // indirect
-	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/dlclark/regexp2 v1.12.0 // indirect
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-enry/go-oniguruma v1.2.1 // indirect
@@ -195,7 +189,7 @@ require (
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/go-webauthn/x v0.2.3 // indirect
+	github.com/go-webauthn/x v0.2.5 // indirect
 	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
@@ -224,7 +218,7 @@ require (
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/markbates/going v1.0.3 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-runewidth v0.0.21 // indirect
+	github.com/mattn/go-runewidth v0.0.23 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
 	github.com/mholt/acmez/v3 v3.1.6 // indirect
 	github.com/miekg/dns v1.1.72 // indirect
@@ -238,23 +232,25 @@ require (
 	github.com/mrjones/oauth v0.0.0-20190623134757-126b35219450 // indirect
 	github.com/mschoch/smat v0.2.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/nwaples/rardecode/v2 v2.2.2 // indirect
-	github.com/oasdiff/yaml v0.0.0-20260313112342-a3ea61cb4d4c // indirect
-	github.com/oasdiff/yaml3 v0.0.0-20260224194419-61cd415a242b // indirect
+	github.com/oasdiff/yaml v0.0.9 // indirect
+	github.com/oasdiff/yaml3 v0.0.12 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
-	github.com/olekukonko/errors v1.2.0 // indirect
+	github.com/olekukonko/errors v1.3.0 // indirect
 	github.com/olekukonko/ll v0.1.8 // indirect
 	github.com/olekukonko/tablewriter v1.1.4 // indirect
 	github.com/onsi/ginkgo v1.16.5 // indirect
 	github.com/perimeterx/marshmallow v1.1.5 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.26 // indirect
-	github.com/pjbgf/sha1cd v0.5.0 // indirect
+	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rhysd/actionlint v1.7.12 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
@@ -269,11 +265,9 @@ require (
 	github.com/woodsbury/decimal128 v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
-	github.com/zeebo/assert v1.3.0 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
+	github.com/zeebo/xxh3 v1.1.0 // indirect
 	go.etcd.io/bbolt v1.4.3 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
@@ -282,12 +276,15 @@ require (
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go4.org v0.0.0-20260112195520-a5071408f32f // indirect
-	golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b // indirect
-	golang.org/x/mod v0.34.0 // indirect
+	golang.org/x/mod v0.35.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401020348-3a24fdc17823 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	modernc.org/libc v1.72.3 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
 )
 
 ignore (
@@ -299,12 +296,6 @@ ignore (
 // But not all latest versions of dependencies are compatible with other packages or our codebase, so we need to pin some dependencies to specific versions
 // Need to regularly maintain this list to try to update them to latest versions, especially the TODO ones
 
-replace github.com/jaytaylor/html2text => github.com/Necoro/html2text v0.0.0-20250804200300-7bf1ce1c7347 // jaytaylor/html2text is unmaintained
-
-replace github.com/nektos/act => gitea.com/gitea/act v0.261.10 // gitea maintains its own package
-
-replace github.com/urfave/cli/v3 => github.com/urfave/cli/v3 v3.4.1 // v3.6.2 breaks -c flag parsing in help commands
-
 replace go.yaml.in/yaml/v4 => go.yaml.in/yaml/v4 v4.0.0-rc.3 // rc.4 changes block scalar serialization, wait for stable release
 
 replace github.com/Azure/azure-sdk-for-go/sdk/azcore => github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.0 // v1.21.0+ uses API version unsupported by Azurite in CI
diff --git a/go.sum b/go.sum
index b8ff05bb0a5..521779a0278 100644
--- a/go.sum
+++ b/go.sum
@@ -1,21 +1,17 @@
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-code.gitea.io/actions-proto-go v0.4.1 h1:l0EYhjsgpUe/1VABo2eK7zcoNX2W44WOnb0MSLrKfls=
-code.gitea.io/actions-proto-go v0.4.1/go.mod h1:mn7Wkqz6JbnTOHQpot3yDeHx+O5C9EGhMEE+htvHBas=
-code.gitea.io/sdk/gitea v0.24.1 h1:hpaqcdGcBmfMpV7JSbBJVwE99qo+WqGreJYKrDKEyW8=
-code.gitea.io/sdk/gitea v0.24.1/go.mod h1:5/77BL3sHneCMEiZaMT9lfTvnnibsYxyO48mceCF3qA=
 code.pfad.fr/check v1.1.0 h1:GWvjdzhSEgHvEHe2uJujDcpmZoySKuHQNrZMfzfO0bE=
 code.pfad.fr/check v1.1.0/go.mod h1:NiUH13DtYsb7xp5wll0U4SXx7KhXQVCtRgdC96IPfoM=
 codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570 h1:TXbikPqa7YRtfU9vS6QJBg77pUvbEb6StRdZO8t1bEY=
 codeberg.org/gusted/mcaptcha v0.0.0-20220723083913-4f3072e1d570/go.mod h1:IIAjsijsd8q1isWX8MACefDEgTQslQ4stk2AeeTt3kM=
-connectrpc.com/connect v1.19.1 h1:R5M57z05+90EfEvCY1b7hBxDVOUl45PrtXtAV2fOC14=
-connectrpc.com/connect v1.19.1/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w=
+connectrpc.com/connect v1.20.0 h1:6TNDAB+WeNd2uolWNlYczB5E0KNNaVMNUEx8JEUsPmQ=
+connectrpc.com/connect v1.20.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
-gitea.com/gitea/act v0.261.10 h1:ndwbtuMXXz1dpYF2iwY1/PkgKNETo4jmPXfinTZt8cs=
-gitea.com/gitea/act v0.261.10/go.mod h1:oIkqQHvU0lfuIWwcpqa4FmU+t3prA89tgkuHUTsrI2c=
+gitea.com/gitea/runner v1.0.5 h1:9Idm8XXxXp4aHoLp0Ba0AEwv87YUblp9gk4qbih+DlE=
+gitea.com/gitea/runner v1.0.5/go.mod h1:ff8SKVat/6FywBGpN4dKi2x3AlHZUfLOA/vVWHf7+Cw=
 gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a h1:JHoBrfuTSF9Ke9aNfSYj1XRPBHjKPgCApVprnt2Am0M=
 gitea.com/go-chi/binding v0.0.0-20260414111559-654cea7ac60a/go.mod h1:FOsLJIMdpiHzBp3Vby6Wfkdw2ppGscrjgU1IC7E4/zQ=
 gitea.com/go-chi/cache v0.2.1 h1:bfAPkvXlbcZxPCpcmDVCWoHgiBSBmZN/QosnZvEC0+g=
@@ -30,6 +26,10 @@ gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4 h1:IFT+hup2xejHq
 gitea.com/lunny/levelqueue v0.4.2-0.20230414023320-3c0159fe0fe4/go.mod h1:HBqmLbz56JWpfEGG0prskAV97ATNRoj5LDmPicD22hU=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a h1:lSA0F4e9A2NcQSqGqTOXqu2aRi/XEQxDCBwM8yJtE6s=
 gitea.com/xorm/sqlfiddle v0.0.0-20180821085327-62ce714f951a/go.mod h1:EXuID2Zs0pAQhH8yz+DNjUbjppKQzKFAn28TMYPB6IU=
+gitea.dev/actions-proto-go v0.5.0 h1:Fc3DI4Fm3B3JBRXFUjegql+usoNAjjAw1cxMansfA2I=
+gitea.dev/actions-proto-go v0.5.0/go.mod h1:p4RX+D9oqiEEzzkPMXscw2CmaGuYFPWFc6xIOmDNDqs=
+gitea.dev/sdk v1.0.1 h1:CWXQUQvp2I6YKOWkhYo1Flx2sRNfMK1X9Op4oR2awXs=
+gitea.dev/sdk v1.0.1/go.mod h1:jCf5Uzz0Jkb61jxNgMxLOCWwle1J1B2nKdcRtxuK9rY=
 github.com/42wim/httpsig v1.2.4 h1:mI5bH0nm4xn7K18fo1K3okNDRq8CCJ0KbBYWyA6r8lU=
 github.com/42wim/httpsig v1.2.4/go.mod h1:yKsYfSyTBEohkPik224QPFylmzEBtda/kjyIAJjh3ps=
 github.com/42wim/sshsig v0.0.0-20260317195500-b9f38cf0d432 h1:3Fcz1QzlS7Jv4FT2KI3cHNSZL+KPN3dXxurn9f3YL/Y=
@@ -48,8 +48,8 @@ github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 h1:bFWuo
 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1/go.mod h1:Vih/3yc6yac2JzU4hzpaDupBJP0Flaia9rXXrU8xyww=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.2 h1:FwladfywkNirM+FZYLBR2kBz5C8Tg0fw5w5Y7meRXWI=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.6.2/go.mod h1:vv5Ad0RrIoT1lJFdWBZwt4mB1+j+V8DUroixmKDTCdk=
-github.com/Azure/go-ntlmssp v0.1.0 h1:DjFo6YtWzNqNvQdrwEyr/e4nhU3vRiwenz5QX7sFz+A=
-github.com/Azure/go-ntlmssp v0.1.0/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=
+github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 h1:oygO0locgZJe7PpYPXT5A29ZkwJaPqcva7BVeemZOZs=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
@@ -71,13 +71,13 @@ github.com/RoaringBitmap/roaring/v2 v2.16.0 h1:Kys1UNf49d5W8Tq3bpuAhIr/Z8/yPB+59
 github.com/RoaringBitmap/roaring/v2 v2.16.0/go.mod h1:eq4wdNXxtJIS/oikeCzdX1rBzek7ANzbth041hrU8Q4=
 github.com/STARRY-S/zip v0.2.3 h1:luE4dMvRPDOWQdeDdUxUoZkzUIpTccdKdhHHsQJ1fm4=
 github.com/STARRY-S/zip v0.2.3/go.mod h1:lqJ9JdeRipyOQJrYSOtpNAiaesFO6zVDsE8GIGFaoSk=
-github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.0 h1:tgjwQrDH5m6jIYB7kac5IQZmfUzQNseac/e3H4VoCNE=
-github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.0/go.mod h1:1HmmMEVsr+0R1QWahSeMJkjSkq6CYAZu1aIbYSpfJ4o=
+github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.3 h1:ikrUPushSxbpr9mmDhSgz1KyUTChjwkDrxY/jzv2OTQ=
+github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.8.3/go.mod h1:bnXbvnI9Mfqdj4L3Y9aCsB1A/ztuYLNRzgVKsJFgR/U=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.2.0/go.mod h1:vf4zrexSH54oEjJ7EdB65tGNHmH3pGZmVkgTP5RHvAs=
-github.com/alecthomas/chroma/v2 v2.23.1 h1:nv2AVZdTyClGbVQkIzlDm/rnhk1E9bU9nXwmZ/Vk/iY=
-github.com/alecthomas/chroma/v2 v2.23.1/go.mod h1:NqVhfBR0lte5Ouh3DcthuUCTUpDC9cxBOfyMbMQPs3o=
+github.com/alecthomas/chroma/v2 v2.25.0 h1:DWkVlxrNpxPf+Qcfe04LBqUArxUiybK8ZQ9T7OFu68E=
+github.com/alecthomas/chroma/v2 v2.25.0/go.mod h1:+95AZrRWlpW9g6qXD7S7UdHviopsGP/kCIrtJcU3QoQ=
 github.com/alecthomas/repr v0.0.0-20220113201626-b1b626ac65ae/go.mod h1:2kn6fqh/zIyPLmm3ugklbEi5hg5wS435eygvNfaDQL8=
 github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
 github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
@@ -92,18 +92,18 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuW
 github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/aws/aws-sdk-go-v2 v1.41.6 h1:1AX0AthnBQzMx1vbmir3Y4WsnJgiydmnJjiLu+LvXOg=
-github.com/aws/aws-sdk-go-v2 v1.41.6/go.mod h1:dy0UzBIfwSeot4grGvY1AqFWN5zgziMmWGzysDnHFcQ=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.15 h1:fyvgWTszojq8hEnMi8PPBTvZdTtEVmAVyo+NFLHBhH4=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.15/go.mod h1:gJiYyMOjNg8OEdRWOf3CrFQxM2a98qmrtjx1zuiQfB8=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.22 h1:GmLa5Kw1ESqtFpXsx5MmC84QWa/ZrLZvlJGa2y+4kcQ=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.22/go.mod h1:6sW9iWm9DK9YRpRGga/qzrzNLgKpT2cIxb7Vo2eNOp0=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22 h1:dY4kWZiSaXIzxnKlj17nHnBcXXBfac6UlsAx2qL6XrU=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22/go.mod h1:KIpEUx0JuRZLO7U6cbV204cWAEco2iC3l061IxlwLtI=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.33.13 h1:IIW5QmNI9PrnDTBCPa75HcD0g+hoD/a+d388dbIAkEM=
-github.com/aws/aws-sdk-go-v2/service/codecommit v1.33.13/go.mod h1:B1FUSufCQp3d8VUzob1EY+AdSo2OuEWNEY6GQff7EHA=
-github.com/aws/smithy-go v1.25.0 h1:Sz/XJ64rwuiKtB6j98nDIPyYrV1nVNJ4YU74gttcl5U=
-github.com/aws/smithy-go v1.25.0/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
+github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.16 h1:r3RJBuU7X9ibt8RHbMjWE6y60QbKBiII6wSrXnapxSU=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.16/go.mod h1:6cx7zqDENJDbBIIWX6P8s0h6hqHC8Avbjh9Dseo27ug=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23/go.mod h1:15DfR2nw+CRHIk0tqNyifu3G1YdAOy68RftkhMDDwYk=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.33.14 h1:3N664oayz66ttIkc8B9/OLntMWhoGhKqPudRRfsZQ20=
+github.com/aws/aws-sdk-go-v2/service/codecommit v1.33.14/go.mod h1:M+6j5lOmtDMjLlFMO8lfTs0gI3qBsSjM8L7F1cQF5Ng=
+github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
+github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -115,15 +115,15 @@ github.com/bits-and-blooms/bitset v1.24.4/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb h1:m935MPodAbYS46DG4pJSv7WO+VECIWUQ7OJYSoTrMh4=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI=
 github.com/blevesearch/bleve/v2 v2.0.5/go.mod h1:ZjWibgnbRX33c+vBRgla9QhPb4QOjD6fdVJ+R1Bk8LM=
-github.com/blevesearch/bleve/v2 v2.5.7 h1:2d9YrL5zrX5EBBW++GOaEKjE+NPWeZGaX77IM26m1Z8=
-github.com/blevesearch/bleve/v2 v2.5.7/go.mod h1:yj0NlS7ocGC4VOSAedqDDMktdh2935v2CSWOCDMHdSA=
+github.com/blevesearch/bleve/v2 v2.6.0 h1:Cyd3dd4q5tCbOV8MnKUVRUDYMHOir9xn12NZzXVSEd4=
+github.com/blevesearch/bleve/v2 v2.6.0/go.mod h1:gLmI8lWgHgrIYf7UpUX7JISI1CaqC6VScu46mHThuAY=
 github.com/blevesearch/bleve_index_api v1.0.0/go.mod h1:fiwKS0xLEm+gBRgv5mumf0dhgFr2mDgZah1pqv1c1M4=
-github.com/blevesearch/bleve_index_api v1.3.7 h1:x3C4pl6o3MlSJ3rNKLQpZMRF0uR9+BDvmF3t8LYCOpk=
-github.com/blevesearch/bleve_index_api v1.3.7/go.mod h1:xvd48t5XMeeioWQ5/jZvgLrV98flT2rdvEJ3l/ki4Ko=
+github.com/blevesearch/bleve_index_api v1.3.11 h1:x29vbV8OjWfLcrDVd7Lr1q+BkLNS0JWNEig0MCVnKH4=
+github.com/blevesearch/bleve_index_api v1.3.11/go.mod h1:xvd48t5XMeeioWQ5/jZvgLrV98flT2rdvEJ3l/ki4Ko=
 github.com/blevesearch/geo v0.2.5 h1:yJg9FX1oRwLnjXSXF+ECHfXFTF4diF02Ca/qUGVjJhE=
 github.com/blevesearch/geo v0.2.5/go.mod h1:Jhq7WE2K6mJTx1xS44M2pUO6Io+wjCSHh1+co3YOgH4=
-github.com/blevesearch/go-faiss v1.0.30 h1:pWX3/Si4Z7GlwsD2eRXoF3SfVaDkg8plBlPdUKuhGts=
-github.com/blevesearch/go-faiss v1.0.30/go.mod h1:OMGQwOaRRYxrmeNdMrXJPvVx8gBnvE5RYrr0BahNnkk=
+github.com/blevesearch/go-faiss v1.1.0 h1:xM7Jc0ZUCv5lssG9Ohj3Jv0SdTpxcUABU1dDt9XVsc4=
+github.com/blevesearch/go-faiss v1.1.0/go.mod h1:OMGQwOaRRYxrmeNdMrXJPvVx8gBnvE5RYrr0BahNnkk=
 github.com/blevesearch/go-porterstemmer v1.0.3 h1:GtmsqID0aZdCSNiY8SkuPJ12pD4jI+DdXTAn4YRcHCo=
 github.com/blevesearch/go-porterstemmer v1.0.3/go.mod h1:angGc5Ht+k2xhJdZi511LtmxuEf0OVpvUUNrwmM1P7M=
 github.com/blevesearch/gtreap v0.1.1 h1:2JWigFrzDMR+42WGIN/V2p0cUvn4UP3C4Q5nmaZGW8Y=
@@ -132,8 +132,8 @@ github.com/blevesearch/mmap-go v1.0.2/go.mod h1:ol2qBqYaOUsGdm7aRMRrYGgPvnwLe6Y+
 github.com/blevesearch/mmap-go v1.2.0 h1:l33nNKPFcBjJUMwem6sAYJPUzhUCABoK9FxZDGiFNBI=
 github.com/blevesearch/mmap-go v1.2.0/go.mod h1:Vd6+20GBhEdwJnU1Xohgt88XCD/CTWcqbCNxkZpyBo0=
 github.com/blevesearch/scorch_segment_api/v2 v2.0.1/go.mod h1:lq7yK2jQy1yQjtjTfU931aVqz7pYxEudHaDwOt1tXfU=
-github.com/blevesearch/scorch_segment_api/v2 v2.4.5 h1:Q7Bzpyk86xS22TgTd4VQfSvzZAybDEJ90hNOGqyNqlI=
-github.com/blevesearch/scorch_segment_api/v2 v2.4.5/go.mod h1:xWYn3EwRM7zBFAPt/J136OugUNzftpYLvPBBx31IpCw=
+github.com/blevesearch/scorch_segment_api/v2 v2.4.7 h1:GlMzW08hcsM3DnLUxhyF/1PcDal1qtvvIuytuph5djw=
+github.com/blevesearch/scorch_segment_api/v2 v2.4.7/go.mod h1://IJ7tG3QCf0cWW/aVSXqy77tc1AvLu3fcJLYEvOAFs=
 github.com/blevesearch/segment v0.9.0/go.mod h1:9PfHYUdQCgHktBgvtUOF4x+pc4/l8rdH0u5spnW85UQ=
 github.com/blevesearch/segment v0.9.1 h1:+dThDy+Lvgj5JMxhmOVlgFfkUtZV2kw49xax4+jTfSU=
 github.com/blevesearch/segment v0.9.1/go.mod h1:zN21iLm7+GnBHWTao9I+Au/7MBiL8pPFtJBJTsk6kQw=
@@ -161,8 +161,10 @@ github.com/blevesearch/zapx/v14 v14.4.3/go.mod h1:rz0XNb/OZSMjNorufDGSpFpjoFKhXm
 github.com/blevesearch/zapx/v15 v15.2.0/go.mod h1:MmQceLpWfME4n1WrBFIwplhWmaQbQqLQARpaKUEOs/A=
 github.com/blevesearch/zapx/v15 v15.4.3 h1:iJiMJOHrz216jyO6lS0m9RTCEkprUnzvqAI2lc/0/CU=
 github.com/blevesearch/zapx/v15 v15.4.3/go.mod h1:1pssev/59FsuWcgSnTa0OeEpOzmhtmr/0/11H0Z8+Nw=
-github.com/blevesearch/zapx/v16 v16.3.2 h1:R8alnAeYxzKO4JjQY4FBqJduJwcPE3YjcgevWgI+XT0=
-github.com/blevesearch/zapx/v16 v16.3.2/go.mod h1:zCFjv7McXWm1C8rROL+3mUoD5WYe2RKsZP3ufqcYpLY=
+github.com/blevesearch/zapx/v16 v16.3.4 h1:hDAqA8qusZTNbPEL7//w5P65UZ2de6yhSeUaTbp0Po0=
+github.com/blevesearch/zapx/v16 v16.3.4/go.mod h1:zqkPPqs9GS9FzVWzCO3Wf1X044yWAV17+4zb+FTiEHg=
+github.com/blevesearch/zapx/v17 v17.1.2 h1:avbOk2igaASNoiy0BE/jPgcxAnRI2PGeydeP4hg7Ikk=
+github.com/blevesearch/zapx/v17 v17.1.2/go.mod h1:WQObxKrqUX7cd0G1GMvDfc/bmZzQvoy7APOPimx7DiI=
 github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs=
 github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bmizerany/perks v0.0.0-20141205001514-d9a9656a3a4b/go.mod h1:ac9efd0D1fsDb3EJvhqgXRbFx7bs2wqZ10HQPeU8U/Q=
@@ -185,16 +187,16 @@ github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/buildkite/terminal-to-html/v3 v3.16.8 h1:QN/daUob6cmK8GcdKnwn9+YTlPr1vNj+oeAIiJK6fPc=
 github.com/buildkite/terminal-to-html/v3 v3.16.8/go.mod h1:+k1KVKROZocrTLsEQ9PEf9A+8+X8uaVV5iO1ZIOwKYM=
-github.com/caddyserver/certmagic v0.25.2 h1:D7xcS7ggX/WEY54x0czj7ioTkmDWKIgxtIi2OcQclUc=
-github.com/caddyserver/certmagic v0.25.2/go.mod h1:llW/CvsNmza8S6hmsuggsZeiX+uS27dkqY27wDIuBWg=
+github.com/caddyserver/certmagic v0.25.3 h1:mGf5ba8F7xA4c5jfDZZbK2buY1VEkbnwpMDixaju94A=
+github.com/caddyserver/certmagic v0.25.3/go.mod h1:YVs43D5+H/Dckt4bTga1KSO/xYfFBfVZainGDywYPAA=
 github.com/caddyserver/zerossl v0.1.5 h1:dkvOjBAEEtY6LIGAHei7sw2UgqSD6TrWweXpV7lvEvE=
 github.com/caddyserver/zerossl v0.1.5/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a h1:MISbI8sU/PSK/ztvmWKFcI7UGb5/HQT7B+i3a2myKgI=
 github.com/cention-sany/utf7 v0.0.0-20170124080048-26cad61bd60a/go.mod h1:2GxOXOlEPAMFPfp014mK1SWq8G8BN8o7/dfYqJrVGn8=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20251013092601-6327009efd21 h1:2d64+4Jek9vjYwhY93AjbleiVH+AeWvPwPmDi1mfKFQ=
-github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20251013092601-6327009efd21/go.mod h1:fNlYtCHWTRC8MofQERZkVUNUWaOvZeTBqHn/amSbKZI=
+github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260309112543-12416315a635 h1:RwCfD5XyO8jAermEy6pauh5Q5o6mCvbeNcCPOZlIA5o=
+github.com/charmbracelet/git-lfs-transfer v0.1.1-0.20260309112543-12416315a635/go.mod h1:R+SetERD4+IL7QH0WHp9MLifvITvh9gL3g8vX1j2Fcs=
 github.com/chi-middleware/proxy v1.1.1 h1:4HaXUp8o2+bhHr1OhVy+VjN0+L7/07JDcn6v7YrTjrQ=
 github.com/chi-middleware/proxy v1.1.1/go.mod h1:jQwMEJct2tz9VmtCELxvnXoMfa+SOdikvbVJVHv/M+0=
 github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
@@ -234,13 +236,12 @@ github.com/davidmz/go-pageant v1.0.2 h1:bPblRCh5jGU+Uptpz6LgMZGD5hJoOt7otgT454Wv
 github.com/davidmz/go-pageant v1.0.2/go.mod h1:P2EDDnMqIwG5Rrp05dTRITj9z2zpGcD9efWSkTNKLIE=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
-github.com/dimiro1/reply v0.0.0-20200315094148-d0136a4c9e21 h1:PdsjTl0Cg+ZJgOx/CFV5NNgO1ThTreqdgKYiDCMHJwA=
-github.com/dimiro1/reply v0.0.0-20200315094148-d0136a4c9e21/go.mod h1:xJvkyD6Y2rZapGvPJLYo9dyx1s5dxBEDPa8T3YTuOk0=
-github.com/dlclark/regexp2 v1.2.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8=
 github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dlclark/regexp2/v2 v2.1.0 h1:jHXRmHRZGbuQzDZjMlCAXOvQb75iv3HyLDzXGj5H1AY=
+github.com/dlclark/regexp2/v2 v2.1.0/go.mod h1:Bz5TMy5d8fPK0ximH0Yi9KvsRHNnvXqUx9XG6a4wB+I=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
@@ -269,12 +270,12 @@ github.com/felixge/fgprof v0.9.5 h1:8+vR6yu2vvSKn08urWyEuxx75NWPEvybbkBirEpsbVY=
 github.com/felixge/fgprof v0.9.5/go.mod h1:yKl+ERSa++RYOs32d8K6WEXCB4uXdLls4ZaZPpayhMM=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
-github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/getkin/kin-openapi v0.134.0 h1:/L5+1+kfe6dXh8Ot/wqiTgUkjOIEJiC0bbYVziHB8rU=
-github.com/getkin/kin-openapi v0.134.0/go.mod h1:wK6ZLG/VgoETO9pcLJ/VmAtIcl/DNlMayNTb716EUxE=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
+github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/getkin/kin-openapi v0.138.0 h1:ebfE0JAmF6AqHrNBy1KO3Fs68K9tPs48HalvLPo7Rv4=
+github.com/getkin/kin-openapi v0.138.0/go.mod h1:vUYWaKyMqj7PfTybelXtLuLN9tReS12vxnzMRK+z2GY=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1 h1:mtDjlmloH7ytdblogrMz1/8Hqua1y8B4ID+bh3rvod0=
 github.com/git-lfs/pktline v0.0.0-20230103162542-ca444d533ef1/go.mod h1:fenKRzpXDjNpsIBhuhUzvjCKlDjKam0boRAenTE0Q6A=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
@@ -288,8 +289,8 @@ github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
 github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
 github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
-github.com/go-co-op/gocron/v2 v2.21.0 h1:e1nt9AEFglarRH9/9y9q0V5sblwxlknpHPjttEajrwQ=
-github.com/go-co-op/gocron/v2 v2.21.0/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
+github.com/go-co-op/gocron/v2 v2.21.2 h1:bD8/YwkojYHgXFr3iEulL148KBdTbKVxUZzFKpXcdbY=
+github.com/go-co-op/gocron/v2 v2.21.2/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
 github.com/go-enry/go-enry/v2 v2.9.6 h1:np63eOtMV56zfYDHnFVgpEVOk8fr2kmylcMnAZUDbSs=
 github.com/go-enry/go-enry/v2 v2.9.6/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
 github.com/go-enry/go-oniguruma v1.2.1 h1:k8aAMuJfMrqm/56SG2lV9Cfti6tC4x8673aHCcBk+eo=
@@ -298,16 +299,16 @@ github.com/go-fed/httpsig v1.1.1-0.20201223112313-55836744818e h1:oRq/fiirun5Hql
 github.com/go-fed/httpsig v1.1.1-0.20201223112313-55836744818e/go.mod h1:RCMrTZvN1bJYtofsG4rd5NaO5obxQ5xBkdiS7xsT7bM=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0=
-github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
+github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
+github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.18.0 h1:O831KI+0PR51hM2kep6T8k+w0/LIAD490gvqMCvL5hM=
-github.com/go-git/go-git/v5 v5.18.0/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
+github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
+github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
 github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
-github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
-github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ=
 github.com/go-ldap/ldap/v3 v3.4.13/go.mod h1:LxsGZV6vbaK0sIvYfsv47rfh4ca0JXokCoKjZxsszv0=
 github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
@@ -322,17 +323,17 @@ github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC
 github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
 github.com/go-redsync/redsync/v4 v4.16.0 h1:bNcOzeHH9d3s6pghU9NJFMPrQa41f5Nx3L4YKr3BdEU=
 github.com/go-redsync/redsync/v4 v4.16.0/go.mod h1:V4gagqgyASWBZuwx4xGzu72aZNb/6Mo05byUa3mVmKQ=
-github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
-github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
+github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/go-webauthn/webauthn v0.16.5 h1:x+vADHlaiIjta23kGhtwyCIlB5mayKx6SBlpwQ5NF9A=
-github.com/go-webauthn/webauthn v0.16.5/go.mod h1:mQC6L0lZ5Kiu35G70zeB2WnrW4+vbHjR8Koq4HdVaMg=
-github.com/go-webauthn/x v0.2.3 h1:8oArS+Rc1SWFLXhE17KZNx258Z4kUSyaDgsSncCO5RA=
-github.com/go-webauthn/x v0.2.3/go.mod h1:tM04GF3V6VYq79AZMl7vbj4q6pz9r7L2criWRzbWhPk=
+github.com/go-webauthn/webauthn v0.17.3 h1:XHZ0TXV7k8vChcE4TFgPitOPJ5cb7h1dpAeFDS0cjCo=
+github.com/go-webauthn/webauthn v0.17.3/go.mod h1:PlkMgmuL9McCT7dvgBj/Sz/fgs3V6ZID6/KnFkEcPvQ=
+github.com/go-webauthn/x v0.2.5 h1:wEVTfU04XFyPTXGQbKOQwMKhcDWfDAkdsDDBsDaG9yY=
+github.com/go-webauthn/x v0.2.5/go.mod h1:Qna/yJz9rV6lRzwl5BfYbmTJpVGxcBIds3gJtw2tlGg=
 github.com/gobwas/httphead v0.1.0/go.mod h1:O/RXo79gxV8G+RqlR/otEwx4Q36zl9rqC5u12GKvMCM=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
@@ -379,8 +380,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-github/v84 v84.0.0 h1:I/0Xn5IuChMe8TdmI2bbim5nyhaRFJ7DEdzmD2w+yVA=
-github.com/google/go-github/v84 v84.0.0/go.mod h1:WwYL1z1ajRdlaPszjVu/47x1L0PXukJBn73xsiYrRRQ=
+github.com/google/go-github/v88 v88.0.0 h1:dZA9IKkPK1eXZj4ypngnpRj5FwdpTv4whix2PrQMP7M=
+github.com/google/go-github/v88 v88.0.0/go.mod h1:rufTDgn2N45wjhukLTyxmvc9nilSp3mr3Rgtt6b1MPw=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -393,8 +394,8 @@ github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/
 github.com/google/licenseclassifier/v2 v2.0.0 h1:1Y57HHILNf4m0ABuMVb6xk4vAJYEUO0gDxNpog0pyeA=
 github.com/google/licenseclassifier/v2 v2.0.0/go.mod h1:cOjbdH0kyC9R22sdQbYsFkto4NGCAc+ZSwbeThazEtM=
 github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
-github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
-github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260507013755-92041b743c96 h1:YDDnaZ9afWajDboPMt9Vikqca/yWAX7KAxVzb4lJU1M=
+github.com/google/pprof v0.0.0-20260507013755-92041b743c96/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gopherjs/gopherjs v0.0.0-20181103185306-d547d1d9531e/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
@@ -459,8 +460,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
-github.com/jhillyerd/enmime/v2 v2.3.0 h1:Y/pzQanyU8nkSgB2npXX8Dha5OItJE/QwbDJM4sf/kU=
-github.com/jhillyerd/enmime/v2 v2.3.0/go.mod h1:mGKXAP45l6pF6HZiaLhgSYsgteJskaSIYmEZXpw6ZpI=
+github.com/jhillyerd/enmime/v2 v2.4.0 h1:6bPyyg2OPXEK1fKsLT89DntZf05LqaL2cIx+cvkEXTo=
+github.com/jhillyerd/enmime/v2 v2.4.0/go.mod h1:TLpvqImPiumRecsJK5TYseRw2bPg3g0EtWc+SfU7cMs=
 github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
 github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
@@ -475,8 +476,8 @@ github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:C
 github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY=
 github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M=
 github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
-github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
+github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
@@ -513,14 +514,14 @@ github.com/markbates/goth v1.82.0 h1:8j/c34AjBSTNzO7zTsOyP5IYCQCMBTRBHAbBt/PI0bQ
 github.com/markbates/goth v1.82.0/go.mod h1:/DRlcq0pyqkKToyZjsL2KgiA1zbF1HIjE7u2uC79rUk=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
-github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
-github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=
-github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
+github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/mattn/go-sqlite3 v1.14.42 h1:MigqEP4ZmHw3aIdIT7T+9TLa90Z6smwcthx+Azv4Cgo=
-github.com/mattn/go-sqlite3 v1.14.42/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
+github.com/mattn/go-sqlite3 v1.14.44 h1:3VSe+xafpbzsLbdr2AWlAZk9yRHiBhTBakioXaCKTF8=
+github.com/mattn/go-sqlite3 v1.14.44/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
 github.com/meilisearch/meilisearch-go v0.36.2 h1:MYaMPCpdLh2aYPt+zK+19mLoA4dfBY3S1L7T0FADCjU=
 github.com/meilisearch/meilisearch-go v0.36.2/go.mod h1:hWcR0MuWLSzHfbz9GGzIr3s9rnXLm1jqkmHkJPbUSvM=
 github.com/mholt/acmez/v3 v3.1.6 h1:eGVQNObP0pBN4sxqrXeg7MYqTOWyoiYpQqITVWlrevk=
@@ -539,8 +540,8 @@ github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.0.100 h1:ShkWi8Tyj9RtU57OQB2HIXKz4bFgtVib0bbT1sbtLI8=
-github.com/minio/minio-go/v7 v7.0.100/go.mod h1:EtGNKtlX20iL2yaYnxEigaIvj0G0GwSDnifnG8ClIdw=
+github.com/minio/minio-go/v7 v7.1.0 h1:QEt5IStDpxgGjEdtOgpiZ5QhmSl3ax7qy61vi2SwHO8=
+github.com/minio/minio-go/v7 v7.1.0/go.mod h1:Dm7WS1AgLmBa0NcQD6SeJnJf+K/EUW3GR7Ks6olB3OA=
 github.com/minio/minlz v1.1.0 h1:rUOGu3EP4EqJC5k3qCsIwEnZiJULKqtRyDdqbhlvMmQ=
 github.com/minio/minlz v1.1.0/go.mod h1:qT0aEB35q79LLornSzeDH75LBf3aH1MV+jB5w9Wasec=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
@@ -561,8 +562,8 @@ github.com/msteinert/pam/v2 v2.1.0 h1:er5F9TKV5nGFuTt12ubtqPHEUdeBwReP7vd3wovidG
 github.com/msteinert/pam/v2 v2.1.0/go.mod h1:KT28NNIcDFf3PcBmNI2mIGO4zZJ+9RSs/At2PB3IDVc=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
-github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/niklasfasching/go-org v1.9.1 h1:/3s4uTPOF06pImGa2Yvlp24yKXZoTYM+nsIlMzfpg/0=
 github.com/niklasfasching/go-org v1.9.1/go.mod h1:ZAGFFkWvUQcpazmi/8nHqwvARpr1xpb+Es67oUGX/48=
 github.com/nwaples/rardecode/v2 v2.2.2 h1:/5oL8dzYivRM/tqX9VcTSWfbpwcbwKG1QtSJr3b3KcU=
@@ -570,14 +571,14 @@ github.com/nwaples/rardecode/v2 v2.2.2/go.mod h1:7uz379lSxPe6j9nvzxUZ+n7mnJNgjsR
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oasdiff/yaml v0.0.0-20260313112342-a3ea61cb4d4c h1:7ACFcSaQsrWtrH4WHHfUqE1C+f8r2uv8KGaW0jTNjus=
-github.com/oasdiff/yaml v0.0.0-20260313112342-a3ea61cb4d4c/go.mod h1:JKox4Gszkxt57kj27u7rvi7IFoIULvCZHUsBTUmQM/s=
-github.com/oasdiff/yaml3 v0.0.0-20260224194419-61cd415a242b h1:vivRhVUAa9t1q0Db4ZmezBP8pWQWnXHFokZj0AOea2g=
-github.com/oasdiff/yaml3 v0.0.0-20260224194419-61cd415a242b/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
+github.com/oasdiff/yaml v0.0.9 h1:zQOvd2UKoozsSsAknnWoDJlSK4lC0mpmjfDsfqNwX48=
+github.com/oasdiff/yaml v0.0.9/go.mod h1:8lvhgJG4xiKPj3HN5lDow4jZHPlx1i7dIwzkdAo6oAM=
+github.com/oasdiff/yaml3 v0.0.12 h1:75urAtPeDg2/iDEWwzNrLOWxI9N/dCh81nTTJtokt2M=
+github.com/oasdiff/yaml3 v0.0.12/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
-github.com/olekukonko/errors v1.2.0 h1:10Zcn4GeV59t/EGqJc8fUjtFT/FuUh5bTMzZ1XwmCRo=
-github.com/olekukonko/errors v1.2.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
+github.com/olekukonko/errors v1.3.0 h1:teJvgLGUEqMzBUms+Dj3/3szNqCG/Jdw9iDbum8fR6U=
+github.com/olekukonko/errors v1.3.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
 github.com/olekukonko/ll v0.1.8 h1:ysHCJRGHYKzmBSdz9w5AySztx7lG8SQY+naTGYUbsz8=
 github.com/olekukonko/ll v0.1.8/go.mod h1:RPRC6UcscfFZgjo1nulkfMH5IM0QAYim0LfnMvUuozw=
 github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I=
@@ -605,8 +606,8 @@ github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
 github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=
 github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
-github.com/pjbgf/sha1cd v0.5.0 h1:a+UkboSi1znleCDUNT3M5YxjOnN1fz2FhN48FlwCxs0=
-github.com/pjbgf/sha1cd v0.5.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
+github.com/pjbgf/sha1cd v0.6.0 h1:3WJ8Wz8gvDz29quX1OcEmkAlUg9diU4GxJHqs0/XiwU=
+github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -627,8 +628,8 @@ github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4Ul
 github.com/quasoft/websspi v1.1.2 h1:/mA4w0LxWlE3novvsoEL6BBA1WnjJATbjkh1kFrTidw=
 github.com/quasoft/websspi v1.1.2/go.mod h1:HmVdl939dQ0WIXZhyik+ARdI03M6bQzaSEKcgpFmewk=
 github.com/rcrowley/go-metrics v0.0.0-20190826022208-cac0b30c2563/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
-github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=
-github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=
+github.com/redis/go-redis/v9 v9.19.0 h1:XPVaaPSnG6RhYf7p+rmSa9zZfeVAnWsH5h3lxthOm/k=
+github.com/redis/go-redis/v9 v9.19.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
 github.com/redis/rueidis v1.0.71 h1:pODtnAR5GAB7j4ekhldZ29HKOxe4Hph0GTDGk1ayEQY=
 github.com/redis/rueidis v1.0.71/go.mod h1:lfdcZzJ1oKGKL37vh9fO3ymwt+0TdjkkUCJxbgpmcgQ=
 github.com/redis/rueidis/rueidiscompat v1.0.71 h1:wNZ//kEjMZgBM0KCk7ncOX8KmAgROU2kDdDNpwheG4w=
@@ -684,8 +685,9 @@ github.com/steveyen/gtreap v0.1.0/go.mod h1:kl/5J7XbrOmlIbYIXdRHDDE5QxHqpk0cmkT7
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -717,24 +719,17 @@ github.com/unknwon/com v1.0.1 h1:3d1LTxD+Lnf3soQiD4Cp/0BRB+Rsa/+RTvz8GMMzIXs=
 github.com/unknwon/com v1.0.1/go.mod h1:tOOxU81rwgoCLoOVVPHb6T/wt8HZygqH5id+GNnlCXM=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
-github.com/urfave/cli/v3 v3.4.1 h1:1M9UOCy5bLmGnuu1yn3t3CB4rG79Rtoxuv1sPhnm6qM=
-github.com/urfave/cli/v3 v3.4.1/go.mod h1:FJSKtM/9AiiTOJL4fJ6TbMUkxBXn7GO9guZqoZtpYpo=
+github.com/urfave/cli/v3 v3.9.0 h1:AV9lIiPv3ukYnxunaCUsHnEozptYmDN2F0+yWqLMn/c=
+github.com/urfave/cli/v3 v3.9.0/go.mod h1:ysVLtOEmg2tOy6PknnYVhDoouyC/6N42TMeoMzskhso=
 github.com/willf/bitset v1.1.10/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
-github.com/wneessen/go-mail v0.7.2 h1:xxPnhZ6IZLSgxShebmZ6DPKh1b6OJcoHfzy7UjOkzS8=
-github.com/wneessen/go-mail v0.7.2/go.mod h1:+TkW6QP3EVkgTEqHtVmnAE/1MRhmzb8Y9/W3pweuS+k=
+github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
+github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
 github.com/woodsbury/decimal128 v1.3.0 h1:8pffMNWIlC0O5vbyHWFZAt5yWvWcrHA+3ovIIjVWss0=
 github.com/woodsbury/decimal128 v1.3.0/go.mod h1:C5UTmyTjW3JftjUFzOVhC20BEQa2a4ZKOB5I6Zjb+ds=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
-github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
-github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
-github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
-github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
 github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
@@ -755,10 +750,10 @@ github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
 github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
 github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
-github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
-github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
-gitlab.com/gitlab-org/api/client-go v1.46.0 h1:YxBWFZIFYKcGESCb9fpkwzouo+apyB9pr/XTWzNoL24=
-gitlab.com/gitlab-org/api/client-go v1.46.0/go.mod h1:FtgyU6g2HS5+fMhw6nLK96GBEEBx5MzntOiJWfIaiN8=
+github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
+github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
+gitlab.com/gitlab-org/api/client-go/v2 v2.30.0 h1:guXC+uOA325P1FIwUVesPoDcnogHnbPrhV8c+wMHZPE=
+gitlab.com/gitlab-org/api/client-go/v2 v2.30.0/go.mod h1:0upZTKi9YMMvhavTlKJ3YgQUZE/GJkcLmXT/+6knTXU=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.etcd.io/bbolt v1.4.3 h1:dEadXpI6G79deX5prL3QRNP6JB8UxVkqo4UPnHaNXJo=
 go.etcd.io/bbolt v1.4.3/go.mod h1:tKQlpPaYCVFctUIgFKFnAlvbmB3tpy1vkTnDWohtc0E=
@@ -794,12 +789,12 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
-golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b h1:DXr+pvt3nC887026GRP39Ej11UATqWDmWuS99x26cD0=
-golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b/go.mod h1:4QTo5u+SEIbbKW1RacMZq1YEfOBqeXa19JeshGi+zc4=
-golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
-golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/image v0.41.0 h1:8wS72eGJMJaBxK6okTzd4WaXumUlTVlb753MlsSvTCo=
+golang.org/x/image v0.41.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -808,8 +803,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -826,8 +821,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -874,8 +869,8 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -886,8 +881,8 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -898,8 +893,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -911,16 +906,16 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260401020348-3a24fdc17823 h1:YedBIttDguBl/zy2wJauEUm+DZZg4UXseWj0g/3N+yo=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260401020348-3a24fdc17823/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
-google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
+google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -934,8 +929,8 @@ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/ini.v1 v1.67.1 h1:tVBILHy0R6e4wkYOn3XmiITt/hEVH4TFMYvAX2Ytz6k=
-gopkg.in/ini.v1 v1.67.1/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
+gopkg.in/ini.v1 v1.67.2 h1:JtOSMb9OuaCZKr7h5D/h6iii14sK0hLbplTc6frx4Ss=
+gopkg.in/ini.v1 v1.67.2/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
@@ -949,24 +944,32 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-lukechampine.com/uint128 v1.2.0 h1:mBi/5l91vocEN8otkC5bDLhi2KdCticRiwbdB0O+rjI=
-lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
-modernc.org/cc/v3 v3.40.0 h1:P3g79IUS/93SYhtoeaHW+kRCIrYaxJ27MFPv+7kaTOw=
-modernc.org/cc/v3 v3.40.0/go.mod h1:/bTg4dnWkSXowUO6ssQKnOV0yMVxDYNIsIrzqTFDGH0=
-modernc.org/ccgo/v3 v3.16.13 h1:Mkgdzl46i5F/CNR/Kj80Ri59hC8TKAhZrYSaqvkwzUw=
-modernc.org/ccgo/v3 v3.16.13/go.mod h1:2Quk+5YgpImhPjv2Qsob1DnZ/4som1lJTodubIcoUkY=
-modernc.org/libc v1.55.3 h1:AzcW1mhlPNrRtjS5sS+eW2ISCgSOLLNyFzRh/V3Qj/U=
-modernc.org/libc v1.55.3/go.mod h1:qFXepLhz+JjFThQ4kzwzOjA/y/artDeg+pcYnY+Q83w=
-modernc.org/mathutil v1.6.0 h1:fRe9+AmYlaej+64JsEEhoWuAYBkOtQiMEU7n/XgfYi4=
-modernc.org/mathutil v1.6.0/go.mod h1:Ui5Q9q1TR2gFm0AQRqQUaBWFLAhQpCwNcuhBOSedWPo=
-modernc.org/memory v1.8.0 h1:IqGTL6eFMaDZZhEWwcREgeMXYwmW83LYW8cROZYkg+E=
-modernc.org/memory v1.8.0/go.mod h1:XPZ936zp5OMKGWPqbD3JShgd/ZoQ7899TUuQqxY+peU=
-modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
-modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sqlite v1.20.4 h1:J8+m2trkN+KKoE7jglyHYYYiaq5xmz2HoHJIiBlRzbE=
-modernc.org/sqlite v1.20.4/go.mod h1:zKcGyrICaxNTMEHSr1HQ2GUraP0j+845GYw37+EyT6A=
-modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
-modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
+modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
+modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.0 h1:yRLPFZieg532OT4rp4JFNIVcquwalMX26G95WQDqwCQ=
+modernc.org/ccgo/v4 v4.34.0/go.mod h1:AS5WYMyBakQ+fhsHhtP8mWB82KTGPkNNJDGfGQCe0/A=
+modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
+modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
+modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.72.3 h1:ZnDF4tXn4NBXFutMMQC4vtbTFSXhhKzR73fv0beZEAU=
+modernc.org/libc v1.72.3/go.mod h1:dn0dZNnnn1clLyvRxLxYExxiKRZIRENOfqQ8XEeg4Qs=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
+modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.50.1 h1:l+cQvn0sd0zJJtfygGHuQJ5AjlrwXmWPw4KP3ZMwr9w=
+modernc.org/sqlite v1.50.1/go.mod h1:tcNzv5p84E0skkmJn038y+hWJbLQXQqEnQfeh5r2JLM=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 mvdan.cc/xurls/v2 v2.6.0 h1:3NTZpeTxYVWNSokW3MKeyVkz/j7uYXYiMtXRUfmjbgI=
diff --git a/main.go b/main.go
index fcfbb733715..bdb962f4fc1 100644
--- a/main.go
+++ b/main.go
@@ -10,16 +10,16 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/cmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/cmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	// register supported doc types
-	_ "code.gitea.io/gitea/modules/markup/asciicast"
-	_ "code.gitea.io/gitea/modules/markup/console"
-	_ "code.gitea.io/gitea/modules/markup/csv"
-	_ "code.gitea.io/gitea/modules/markup/markdown"
-	_ "code.gitea.io/gitea/modules/markup/orgmode"
+	_ "gitea.dev/modules/markup/asciicast"
+	_ "gitea.dev/modules/markup/console"
+	_ "gitea.dev/modules/markup/csv"
+	_ "gitea.dev/modules/markup/markdown"
+	_ "gitea.dev/modules/markup/orgmode"
 
 	"github.com/urfave/cli/v3"
 )
diff --git a/models/actions/artifact.go b/models/actions/artifact.go
index f0effdeecaf..8a50c09179e 100644
--- a/models/actions/artifact.go
+++ b/models/actions/artifact.go
@@ -1,7 +1,7 @@
 // Copyright 2023 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
-// This artifact server is inspired by https://github.com/nektos/act/blob/master/pkg/artifacts/server.go.
+// This artifact server is inspired by the Gitea runner artifact server implementation.
 // It updates url setting and uses ObjectStore to handle artifacts persistence.
 
 package actions
@@ -11,10 +11,10 @@ import (
 	"errors"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/actions/config.go b/models/actions/config.go
index 4f5357c5605..f4d99b8f7ab 100644
--- a/models/actions/config.go
+++ b/models/actions/config.go
@@ -6,11 +6,11 @@ package actions
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
 
 	"xorm.io/xorm/convert"
 )
diff --git a/models/actions/main_test.go b/models/actions/main_test.go
index 4af483813ab..c3ae15d769b 100644
--- a/models/actions/main_test.go
+++ b/models/actions/main_test.go
@@ -6,7 +6,7 @@ package actions
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
@@ -15,6 +15,7 @@ func TestMain(m *testing.M) {
 			"action_runner_token.yml",
 			"action_run.yml",
 			"repository.yml",
+			"user.yml",
 		},
 	})
 }
diff --git a/models/actions/run.go b/models/actions/run.go
index a44b0ff343e..bba6b4c34eb 100644
--- a/models/actions/run.go
+++ b/models/actions/run.go
@@ -7,23 +7,20 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"slices"
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-
-	"xorm.io/builder"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 // ActionRun represents a run of a workflow file
@@ -224,120 +221,34 @@ func (run *ActionRun) IsSchedule() bool {
 }
 
 // UpdateRepoRunsNumbers updates the number of runs and closed runs of a repository.
-func UpdateRepoRunsNumbers(ctx context.Context, repo *repo_model.Repository) error {
-	_, err := db.GetEngine(ctx).ID(repo.ID).
-		NoAutoTime().
-		Cols("num_action_runs", "num_closed_action_runs").
-		SetExpr("num_action_runs",
-			builder.Select("count(*)").From("action_run").
-				Where(builder.Eq{"repo_id": repo.ID}),
-		).
-		SetExpr("num_closed_action_runs",
-			builder.Select("count(*)").From("action_run").
-				Where(builder.Eq{
-					"repo_id": repo.ID,
-				}.And(
-					builder.In("status",
-						StatusSuccess,
-						StatusFailure,
-						StatusCancelled,
-						StatusSkipped,
-					),
-				),
-				),
-		).
-		Update(repo)
-	return err
-}
+// Callers MUST invoke this from outside any transaction that has X-locked action_run rows for the same repo, otherwise, transaction deadlock
+func UpdateRepoRunsNumbers(ctx context.Context, repoID int64) {
+	if db.InTransaction(ctx) {
+		setting.PanicInDevOrTesting("UpdateRepoRunsNumbers must not be called inside a transaction")
+	}
 
-// CancelPreviousJobs cancels all previous jobs of the same repository, reference, workflow, and event.
-// It's useful when a new run is triggered, and all previous runs needn't be continued anymore.
-func CancelPreviousJobs(ctx context.Context, repoID int64, ref, workflowID string, event webhook_module.HookEventType) ([]*ActionRunJob, error) {
-	// Find all runs in the specified repository, reference, and workflow with non-final status
-	runs, total, err := db.FindAndCount[ActionRun](ctx, FindRunOptions{
-		RepoID:       repoID,
-		Ref:          ref,
-		WorkflowID:   workflowID,
-		TriggerEvent: event,
-		Status:       []Status{StatusRunning, StatusWaiting, StatusBlocked},
-	})
+	e := db.GetEngine(ctx)
+
+	numActionRuns, err := e.Where("repo_id = ?", repoID).Count(new(ActionRun))
 	if err != nil {
-		return nil, err
+		log.Error("UpdateRepoRunsNumbers count num_action_runs for repo %d: %v", repoID, err)
+		return
 	}
 
-	// If there are no runs found, there's no need to proceed with cancellation, so return nil.
-	if total == 0 {
-		return nil, nil
+	numClosedActionRuns, err := e.Where("repo_id = ?", repoID).
+		In("status", StatusSuccess, StatusFailure, StatusCancelled, StatusSkipped).
+		Count(new(ActionRun))
+	if err != nil {
+		log.Error("UpdateRepoRunsNumbers count num_closed_action_runs for repo %d: %v", repoID, err)
+		return
 	}
 
-	cancelledJobs := make([]*ActionRunJob, 0, total)
-
-	// Iterate over each found run and cancel its associated jobs.
-	for _, run := range runs {
-		// Find all jobs associated with the current run.
-		jobs, err := db.Find[ActionRunJob](ctx, FindRunJobOptions{
-			RunID: run.ID,
-		})
-		if err != nil {
-			return cancelledJobs, err
-		}
-
-		cjs, err := CancelJobs(ctx, jobs)
-		if err != nil {
-			return cancelledJobs, err
-		}
-		cancelledJobs = append(cancelledJobs, cjs...)
+	if _, err := e.ID(repoID).Cols("num_action_runs", "num_closed_action_runs").NoAutoTime().Update(&repo_model.Repository{
+		NumActionRuns:       int(numActionRuns),
+		NumClosedActionRuns: int(numClosedActionRuns),
+	}); err != nil {
+		log.Error("UpdateRepoRunsNumbers update repo %d: %v", repoID, err)
 	}
-
-	// Return nil to indicate successful cancellation of all running and waiting jobs.
-	return cancelledJobs, nil
-}
-
-func CancelJobs(ctx context.Context, jobs []*ActionRunJob) ([]*ActionRunJob, error) {
-	cancelledJobs := make([]*ActionRunJob, 0, len(jobs))
-	// Iterate over each job and attempt to cancel it.
-	for _, job := range jobs {
-		// Skip jobs that are already in a terminal state (completed, cancelled, etc.).
-		status := job.Status
-		if status.IsDone() {
-			continue
-		}
-
-		// If the job has no associated task (probably an error), set its status to 'Cancelled' and stop it.
-		if job.TaskID == 0 {
-			job.Status = StatusCancelled
-			job.Stopped = timeutil.TimeStampNow()
-
-			// Update the job's status and stopped time in the database.
-			n, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": 0}, "status", "stopped")
-			if err != nil {
-				return cancelledJobs, err
-			}
-
-			// If the update affected 0 rows, it means the job has changed in the meantime
-			if n == 0 {
-				log.Error("Failed to cancel job %d because it has changed", job.ID)
-				continue
-			}
-
-			cancelledJobs = append(cancelledJobs, job)
-			// Continue with the next job.
-			continue
-		}
-
-		// If the job has an associated task, try to stop the task, effectively cancelling the job.
-		if err := StopTask(ctx, job.TaskID, StatusCancelled); err != nil {
-			return cancelledJobs, err
-		}
-		updatedJob, err := GetRunJobByRunAndID(ctx, job.RunID, job.ID)
-		if err != nil {
-			return cancelledJobs, fmt.Errorf("get job: %w", err)
-		}
-		cancelledJobs = append(cancelledJobs, updatedJob)
-	}
-
-	// Return nil to indicate successful cancellation of all running and waiting jobs.
-	return cancelledJobs, nil
 }
 
 func GetRunByRepoAndID(ctx context.Context, repoID, runID int64) (*ActionRun, error) {
@@ -415,18 +326,6 @@ func UpdateRun(ctx context.Context, run *ActionRun, cols ...string) error {
 		// It's impossible that the run is not found, since Gitea never deletes runs.
 	}
 
-	if run.Status != 0 || slices.Contains(cols, "status") {
-		if run.RepoID == 0 {
-			setting.PanicInDevOrTesting("RepoID should not be 0")
-		}
-		if err = run.LoadRepo(ctx); err != nil {
-			return err
-		}
-		if err := UpdateRepoRunsNumbers(ctx, run.Repo); err != nil {
-			return err
-		}
-	}
-
 	return nil
 }
 
@@ -461,6 +360,7 @@ func CancelPreviousJobsByRunConcurrency(ctx context.Context, attempt *ActionRunA
 	statusFindOption := []Status{StatusWaiting, StatusBlocked}
 	if attempt.ConcurrencyCancel {
 		statusFindOption = append(statusFindOption, StatusRunning)
+		statusFindOption = append(statusFindOption, StatusCancelling)
 	}
 	attempts, jobs, err := GetConcurrentRunAttemptsAndJobs(ctx, attempt.RepoID, attempt.ConcurrencyGroup, statusFindOption)
 	if err != nil {
diff --git a/models/actions/run_attempt.go b/models/actions/run_attempt.go
index 857247b0689..778b153cb4d 100644
--- a/models/actions/run_attempt.go
+++ b/models/actions/run_attempt.go
@@ -9,11 +9,11 @@ import (
 	"slices"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
 // ActionRunAttempt represents a single execution attempt of an ActionRun.
diff --git a/models/actions/run_attempt_list.go b/models/actions/run_attempt_list.go
index 77a5b8f15c9..9c125d559e0 100644
--- a/models/actions/run_attempt_list.go
+++ b/models/actions/run_attempt_list.go
@@ -6,9 +6,9 @@ package actions
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
 )
 
 type ActionRunAttemptList []*ActionRunAttempt
diff --git a/models/actions/run_job.go b/models/actions/run_job.go
index f0d41ef4b47..caf66ca451c 100644
--- a/models/actions/run_job.go
+++ b/models/actions/run_job.go
@@ -9,11 +9,13 @@ import (
 	"slices"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/actions/jobparser"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"xorm.io/builder"
 )
@@ -75,14 +77,55 @@ type ActionRunJob struct {
 	// A value of 0 indicates a legacy job created before ActionRunAttempt existed.
 	AttemptJobID int64 `xorm:"index NOT NULL DEFAULT 0"`
 
+	// WorkflowSourceRepoID + WorkflowSourceCommitSHA record the (repo, commit) this job's containing workflow file came from.
+	WorkflowSourceRepoID    int64  `xorm:"NOT NULL DEFAULT 0"`
+	WorkflowSourceCommitSHA string `xorm:"VARCHAR(64) NOT NULL DEFAULT ''"`
+
+	// IsReusableCaller marks this job as a reusable workflow caller.
+	// Caller jobs do not run on a runner; their status is derived from their child jobs.
+	IsReusableCaller bool `xorm:"index NOT NULL DEFAULT FALSE"`
+	// IsExpanded reports whether this job's lazy expansion (children-row insertion) is complete.
+	// For a reusable workflow caller, true means children rows exist and CallPayload is populated.
+	IsExpanded bool `xorm:"NOT NULL DEFAULT FALSE"`
+	// CallUses stores the raw "uses:" string of a reusable workflow caller job.
+	// Only set when IsReusableCaller is true.
+	CallUses string `xorm:"VARCHAR(512) NOT NULL DEFAULT ''"`
+	// ReusableWorkflowContent is the content of the reusable workflow specified by "uses:".
+	// Only set when IsReusableCaller is true.
+	ReusableWorkflowContent []byte `xorm:"LONGBLOB"`
+	// CallSecrets encodes the reusable workflow caller's "secrets:" section:
+	//   - ""           : no "secrets:" section (children only see auto-generated tokens).
+	//   - "inherit"    : the caller wrote "secrets: inherit".
+	//   - JSON object  : explicit mapping {alias: source_name}; names only, no values.
+	// Only set when IsReusableCaller is true.
+	CallSecrets string `xorm:"LONGTEXT"`
+	// CallPayload is the JSON-encoded WorkflowCallPayload exposed to children as gitea.event.
+	// Populated atomically with IsExpanded at the end of expandReusableWorkflowCaller.
+	// Only set when IsReusableCaller is true.
+	CallPayload string `xorm:"LONGTEXT"`
+
+	// ParentJobID scopes `Needs` resolution: name lookups happen only among rows sharing the same ParentJobID. 0 for top-level rows.
+	ParentJobID int64 `xorm:"index NOT NULL DEFAULT 0"`
+
 	Started timeutil.TimeStamp
 	Stopped timeutil.TimeStamp
 	Created timeutil.TimeStamp `xorm:"created"`
 	Updated timeutil.TimeStamp `xorm:"updated index"`
 }
 
+// ActionRunAttemptJobIDIndex backs the run-wide AttemptJobID counter, keyed by ActionRun.ID.
+// Use GetNextAttemptJobID to allocate the next ID for a run.
+type ActionRunAttemptJobIDIndex db.ResourceIndex
+
+// GetNextAttemptJobID atomically allocates the next AttemptJobID for a job in the given run.
+// AttemptJobIDs are unique within a single attempt and stable across attempts for the same logical job
+func GetNextAttemptJobID(ctx context.Context, runID int64) (int64, error) {
+	return db.GetNextResourceIndex(ctx, "action_run_attempt_job_id_index", runID)
+}
+
 func init() {
 	db.RegisterModel(new(ActionRunJob))
+	db.RegisterModel(new(ActionRunAttemptJobIDIndex))
 }
 
 func (job *ActionRunJob) Duration() time.Duration {
@@ -218,6 +261,101 @@ func GetRunJobsByRunAndAttemptID(ctx context.Context, runID, runAttemptID int64)
 	return jobs, nil
 }
 
+// GetPriorAttemptChildrenByParent returns the children of the most recent prior attempt where
+// the parent (identified by parentAttemptJobID) actually had children, indexed by child JobID then child Name.
+// Returns (nil, nil) when no such attempt exists.
+// The (JobID, Name) key disambiguates both reusable-workflow subtrees and matrix-expanded instances (whose Name carries the matrix suffix).
+func GetPriorAttemptChildrenByParent(ctx context.Context, runID, currentAttemptID, parentAttemptJobID int64) (map[string]map[string]*ActionRunJob, error) {
+	// query every prior caller row sharing this AttemptJobID, newest first.
+	var priorCallers []*ActionRunJob
+	if err := db.GetEngine(ctx).
+		Where("run_id = ? AND attempt_job_id = ? AND run_attempt_id < ?", runID, parentAttemptJobID, currentAttemptID).
+		Desc("run_attempt_id").
+		Find(&priorCallers); err != nil {
+		return nil, fmt.Errorf("find prior callers: %w", err)
+	}
+	if len(priorCallers) == 0 {
+		return nil, nil //nolint:nilnil // caller is brand new in this attempt
+	}
+
+	// query for every child of every prior caller
+	callerIDs := make([]int64, len(priorCallers))
+	for i, c := range priorCallers {
+		callerIDs[i] = c.ID
+	}
+	var allChildren []*ActionRunJob
+	if err := db.GetEngine(ctx).
+		Where("run_id = ?", runID).
+		In("parent_job_id", callerIDs).
+		Find(&allChildren); err != nil {
+		return nil, fmt.Errorf("find prior children: %w", err)
+	}
+
+	childrenByCallerID := make(map[int64][]*ActionRunJob, len(callerIDs))
+	for _, c := range allChildren {
+		childrenByCallerID[c.ParentJobID] = append(childrenByCallerID[c.ParentJobID], c)
+	}
+
+	// Walk priorCallers in run_attempt_id-desc order and return the children of the first caller that actually had any.
+	// Skipped attempts (caller exists but no children) are bypassed.
+	for _, caller := range priorCallers {
+		children := childrenByCallerID[caller.ID]
+		if len(children) == 0 {
+			continue
+		}
+		out := make(map[string]map[string]*ActionRunJob)
+		for _, c := range children {
+			if out[c.JobID] == nil {
+				out[c.JobID] = make(map[string]*ActionRunJob)
+			}
+			out[c.JobID][c.Name] = c
+		}
+		return out, nil
+	}
+
+	return nil, nil //nolint:nilnil // every prior attempt skipped this caller
+}
+
+// GetDirectChildJobsByParent returns the direct child jobs of a parent job (e.g. a reusable workflow caller).
+func GetDirectChildJobsByParent(ctx context.Context, parentJob *ActionRunJob) (ActionJobList, error) {
+	var jobs []*ActionRunJob
+	if err := db.GetEngine(ctx).
+		Where("run_id=? AND parent_job_id=?", parentJob.RunID, parentJob.ID).
+		OrderBy("id").
+		Find(&jobs); err != nil {
+		return nil, err
+	}
+	return jobs, nil
+}
+
+// CollectAllDescendantJobs returns every job in `allJobs` that lives under parent's subtree (recursively), excluding `parent` itself
+func CollectAllDescendantJobs(parent *ActionRunJob, allJobs []*ActionRunJob) []*ActionRunJob {
+	parents := map[int64]bool{parent.ID: true}
+	for {
+		grew := false
+		for _, j := range allJobs {
+			if j.ParentJobID == 0 {
+				continue
+			}
+			if parents[j.ParentJobID] && !parents[j.ID] {
+				parents[j.ID] = true
+				grew = true
+			}
+		}
+		if !grew {
+			break
+		}
+	}
+	out := make([]*ActionRunJob, 0)
+	for _, j := range allJobs {
+		if j.ID == parent.ID || !parents[j.ID] {
+			continue
+		}
+		out = append(out, j)
+	}
+	return out
+}
+
 func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, cols ...string) (int64, error) {
 	e := db.GetEngine(ctx)
 
@@ -235,11 +373,15 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 		return 0, err
 	}
 
-	if affected == 0 || (!slices.Contains(cols, "status") && job.Status == 0) {
+	// xorm's Update writes only non-zero fields when cols is empty, so a zero job.Status
+	// with empty cols means status isn't actually being persisted — skip aggregation.
+	statusUpdated := slices.Contains(cols, "status") || (len(cols) == 0 && job.Status != 0)
+	if affected == 0 || !statusUpdated {
 		return affected, nil
 	}
 
-	if slices.Contains(cols, "status") && job.Status.IsWaiting() {
+	// Reusable workflow caller jobs are never picked up by runners, so they don't need a task-version bump.
+	if statusUpdated && job.Status.IsWaiting() && !job.IsReusableCaller {
 		// if the status of job changes to waiting again, increase tasks version.
 		if err := IncreaseTaskVersion(ctx, job.OwnerID, job.RepoID); err != nil {
 			return 0, err
@@ -253,6 +395,15 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 		}
 	}
 
+	if statusUpdated && job.ParentJobID > 0 {
+		// Reusable workflow caller's children cascade their status changes upward to the parent caller.
+		parent, err := GetRunJobByRunAndID(ctx, job.RunID, job.ParentJobID)
+		if err != nil {
+			return affected, fmt.Errorf("load parent caller %d: %w", job.ParentJobID, err)
+		}
+		return affected, RefreshReusableCallerStatus(ctx, parent)
+	}
+
 	{
 		// Other goroutines may aggregate the status of the attempt/run and update it too.
 		// So we need to load the current jobs before updating the aggregate state.
@@ -305,15 +456,54 @@ func UpdateRunJob(ctx context.Context, job *ActionRunJob, cond builder.Cond, col
 	return affected, nil
 }
 
+// RefreshReusableCallerStatus recomputes a reusable workflow caller's Status, Started and Stopped from its current direct children and persists the change.
+// No-op if caller is not a reusable caller.
+//
+// Concurrency: two sibling children finishing at roughly the same time can each invoke this for the same parent caller.
+// No row-level lock is taken because AggregateJobStatus is a pure function of the children's statuses (order-independent), so racing callers arrive at the same Status.
+func RefreshReusableCallerStatus(ctx context.Context, caller *ActionRunJob) error {
+	if !caller.IsReusableCaller {
+		return nil
+	}
+	children, err := GetDirectChildJobsByParent(ctx, caller)
+	if err != nil {
+		return err
+	}
+
+	newStatus := AggregateJobStatus(children)
+	cols := make([]string, 0, 3)
+	if caller.Status != newStatus {
+		caller.Status = newStatus
+		cols = append(cols, "status")
+	}
+	if newStatus != StatusSkipped {
+		now := timeutil.TimeStampNow()
+		if caller.Started.IsZero() && newStatus == StatusRunning {
+			caller.Started = now
+			cols = append(cols, "started")
+		}
+		if caller.Stopped.IsZero() && newStatus.IsDone() {
+			caller.Stopped = now
+			cols = append(cols, "stopped")
+		}
+	}
+	if len(cols) == 0 {
+		return nil
+	}
+	_, err = UpdateRunJob(ctx, caller, nil, cols...)
+	return err
+}
+
 func AggregateJobStatus(jobs []*ActionRunJob) Status {
 	allSuccessOrSkipped := len(jobs) != 0
 	allSkipped := len(jobs) != 0
-	var hasFailure, hasCancelled, hasWaiting, hasRunning, hasBlocked bool
+	var hasFailure, hasCancelled, hasCancelling, hasWaiting, hasRunning, hasBlocked bool
 	for _, job := range jobs {
 		allSuccessOrSkipped = allSuccessOrSkipped && (job.Status == StatusSuccess || job.Status == StatusSkipped)
 		allSkipped = allSkipped && job.Status == StatusSkipped
 		hasFailure = hasFailure || job.Status == StatusFailure
 		hasCancelled = hasCancelled || job.Status == StatusCancelled
+		hasCancelling = hasCancelling || job.Status == StatusCancelling
 		hasWaiting = hasWaiting || job.Status == StatusWaiting
 		hasRunning = hasRunning || job.Status == StatusRunning
 		hasBlocked = hasBlocked || job.Status == StatusBlocked
@@ -323,21 +513,68 @@ func AggregateJobStatus(jobs []*ActionRunJob) Status {
 		return StatusSkipped
 	case allSuccessOrSkipped:
 		return StatusSuccess
-	case hasCancelled:
-		return StatusCancelled
+	case hasCancelling:
+		return StatusCancelling
 	case hasRunning:
 		return StatusRunning
 	case hasWaiting:
 		return StatusWaiting
+	case hasBlocked:
+		// Blocked is still a pending state, so it should outrank terminal
+		// statuses like cancelled/failure when no job is waiting or running.
+		return StatusBlocked
+	case hasCancelled:
+		return StatusCancelled
 	case hasFailure:
 		return StatusFailure
-	case hasBlocked:
-		return StatusBlocked
 	default:
 		return StatusUnknown // it shouldn't happen
 	}
 }
 
+// CancelPreviousJobs cancels all previous jobs of the same repository, reference, workflow, and event.
+// It's useful when a new run is triggered, and all previous runs needn't be continued anymore.
+func CancelPreviousJobs(ctx context.Context, repoID int64, ref, workflowID string, event webhook_module.HookEventType) ([]*ActionRunJob, error) {
+	// Find all runs in the specified repository, reference, and workflow with non-final status
+	runs, total, err := db.FindAndCount[ActionRun](ctx, FindRunOptions{
+		RepoID:       repoID,
+		Ref:          ref,
+		WorkflowID:   workflowID,
+		TriggerEvent: event,
+		Status:       []Status{StatusRunning, StatusWaiting, StatusBlocked, StatusCancelling},
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// If there are no runs found, there's no need to proceed with cancellation, so return nil.
+	if total == 0 {
+		return nil, nil
+	}
+
+	cancelledJobs := make([]*ActionRunJob, 0, total)
+
+	// Iterate over each found run and cancel its associated jobs.
+	for _, run := range runs {
+		// Find all jobs associated with the current run.
+		jobs, err := db.Find[ActionRunJob](ctx, FindRunJobOptions{
+			RunID: run.ID,
+		})
+		if err != nil {
+			return cancelledJobs, err
+		}
+
+		cjs, err := CancelJobs(ctx, jobs)
+		if err != nil {
+			return cancelledJobs, err
+		}
+		cancelledJobs = append(cancelledJobs, cjs...)
+	}
+
+	// Return nil to indicate successful cancellation of all running and waiting jobs.
+	return cancelledJobs, nil
+}
+
 func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob) (jobsToCancel []*ActionRunJob, _ error) {
 	if job.RawConcurrency == "" {
 		return nil, nil
@@ -352,6 +589,7 @@ func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob)
 	statusFindOption := []Status{StatusWaiting, StatusBlocked}
 	if job.ConcurrencyCancel {
 		statusFindOption = append(statusFindOption, StatusRunning)
+		statusFindOption = append(statusFindOption, StatusCancelling)
 	}
 	attempts, jobs, err := GetConcurrentRunAttemptsAndJobs(ctx, job.RepoID, job.ConcurrencyGroup, statusFindOption)
 	if err != nil {
@@ -374,3 +612,84 @@ func CancelPreviousJobsByJobConcurrency(ctx context.Context, job *ActionRunJob)
 
 	return CancelJobs(ctx, jobsToCancel)
 }
+
+func CancelJobs(ctx context.Context, jobs []*ActionRunJob) ([]*ActionRunJob, error) {
+	cancelledJobs := make([]*ActionRunJob, 0, len(jobs))
+
+	for _, job := range jobs {
+		if job.IsReusableCaller {
+			sub, err := cancelReusableCaller(ctx, job)
+			if err != nil {
+				return cancelledJobs, err
+			}
+			cancelledJobs = append(cancelledJobs, sub...)
+			continue
+		}
+
+		c, err := cancelOneJob(ctx, job)
+		if err != nil {
+			return cancelledJobs, err
+		}
+		if c != nil {
+			cancelledJobs = append(cancelledJobs, c)
+		}
+	}
+	return cancelledJobs, nil
+}
+
+// cancelOneJob cancels a single job and returns the post-cancel row
+func cancelOneJob(ctx context.Context, job *ActionRunJob) (*ActionRunJob, error) {
+	if job.Status.IsDone() {
+		return nil, nil //nolint:nilnil // signal "nothing to cancel; not an error"
+	}
+	// No associated task: mark Cancelled directly. This includes reusable callers and jobs that never reached PickTask.
+	if job.TaskID == 0 {
+		job.Status = StatusCancelled
+		job.Stopped = timeutil.TimeStampNow()
+		n, err := UpdateRunJob(ctx, job, builder.Eq{"task_id": 0}, "status", "stopped")
+		if err != nil {
+			return nil, err
+		}
+		if n == 0 {
+			log.Error("Failed to cancel job %d because it has changed", job.ID)
+			return nil, nil //nolint:nilnil // signal "nothing to cancel; not an error"
+		}
+		return job, nil
+	}
+	// Has a task: stop the task and re-read the row.
+	if err := StopTask(ctx, job.TaskID, StatusCancelling); err != nil {
+		return nil, err
+	}
+	updated, err := GetRunJobByRunAndID(ctx, job.RunID, job.ID)
+	if err != nil {
+		return nil, fmt.Errorf("get job: %w", err)
+	}
+	return updated, nil
+}
+
+// cancelReusableCaller cancels `caller` and all its child jobs
+func cancelReusableCaller(ctx context.Context, caller *ActionRunJob) ([]*ActionRunJob, error) {
+	cancelledJobs := make([]*ActionRunJob, 0)
+
+	if c, err := cancelOneJob(ctx, caller); err != nil {
+		return cancelledJobs, err
+	} else if c != nil {
+		cancelledJobs = append(cancelledJobs, c)
+	}
+
+	attemptJobs, err := GetRunJobsByRunAndAttemptID(ctx, caller.RunID, caller.RunAttemptID)
+	if err != nil {
+		return cancelledJobs, err
+	}
+
+	for _, c := range CollectAllDescendantJobs(caller, attemptJobs) {
+		cancelled, err := cancelOneJob(ctx, c)
+		if err != nil {
+			return cancelledJobs, err
+		}
+		if cancelled != nil {
+			cancelledJobs = append(cancelledJobs, cancelled)
+		}
+	}
+	return cancelledJobs, nil
+}
diff --git a/models/actions/run_job_list.go b/models/actions/run_job_list.go
index db7554593dd..f08f7c84a61 100644
--- a/models/actions/run_job_list.go
+++ b/models/actions/run_job_list.go
@@ -5,12 +5,14 @@ package actions
 
 import (
 	"context"
+	"slices"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
 
 	"xorm.io/builder"
 )
@@ -23,6 +25,22 @@ func (jobs ActionJobList) GetRunIDs() []int64 {
 	})
 }
 
+// SortMatrixGroupsByName natural-sorts each contiguous run of jobs that share a JobID
+// so matrix expansions (e.g. "test (1)", "test (2)", "test (10)") appear in human order.
+// Input is expected to be in DB id order so JobID groups are contiguous; cross-group order is preserved.
+func (jobs ActionJobList) SortMatrixGroupsByName() {
+	for i := 0; i < len(jobs); {
+		j := i + 1
+		for j < len(jobs) && jobs[j].JobID == jobs[i].JobID {
+			j++
+		}
+		slices.SortFunc(jobs[i:j], func(a, b *ActionRunJob) int {
+			return base.NaturalSortCompare(a.Name, b.Name)
+		})
+		i = j
+	}
+}
+
 func (jobs ActionJobList) LoadRepos(ctx context.Context) error {
 	repoIDs := container.FilterSlice(jobs, func(j *ActionRunJob) (int64, bool) {
 		return j.RepoID, j.RepoID != 0 && j.Repo == nil
@@ -80,6 +98,12 @@ type FindRunJobOptions struct {
 	Statuses         []Status
 	UpdatedBefore    timeutil.TimeStamp
 	ConcurrencyGroup string
+	OrderBy          db.SearchOrderBy
+}
+
+var JobOrderByMap = map[string]map[string]db.SearchOrderBy{
+	"asc":  {"id": "`action_run_job`.id ASC"},
+	"desc": {"id": "`action_run_job`.id DESC"},
 }
 
 func (opts FindRunJobOptions) ToConds() builder.Cond {
@@ -122,3 +146,9 @@ func (opts FindRunJobOptions) ToJoins() []db.JoinFunc {
 	}
 	return nil
 }
+
+func (opts FindRunJobOptions) ToOrders() string {
+	return string(opts.OrderBy)
+}
+
+var _ db.FindOptionsOrder = FindRunJobOptions{}
diff --git a/models/actions/run_job_list_test.go b/models/actions/run_job_list_test.go
new file mode 100644
index 00000000000..271031b4cdd
--- /dev/null
+++ b/models/actions/run_job_list_test.go
@@ -0,0 +1,61 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestActionJobList_SortMatrixGroupsByName(t *testing.T) {
+	mk := func(jobID, name string) *ActionRunJob {
+		return &ActionRunJob{JobID: jobID, Name: name}
+	}
+	names := func(jobs ActionJobList) []string {
+		out := make([]string, len(jobs))
+		for i, j := range jobs {
+			out[i] = j.Name
+		}
+		return out
+	}
+
+	t.Run("matrix group sorted naturally", func(t *testing.T) {
+		jobs := ActionJobList{
+			mk("build", "build"),
+			mk("test", "test (10)"),
+			mk("test", "test (2)"),
+			mk("test", "test (1)"),
+			mk("deploy", "deploy"),
+		}
+		jobs.SortMatrixGroupsByName()
+		assert.Equal(t, []string{"build", "test (1)", "test (2)", "test (10)", "deploy"}, names(jobs))
+	})
+
+	t.Run("non-adjacent same JobID stays in input order", func(t *testing.T) {
+		jobs := ActionJobList{
+			mk("test", "test (10)"),
+			mk("build", "build"),
+			mk("test", "test (1)"),
+		}
+		jobs.SortMatrixGroupsByName()
+		assert.Equal(t, []string{"test (10)", "build", "test (1)"}, names(jobs))
+	})
+
+	t.Run("groups stay in input order", func(t *testing.T) {
+		jobs := ActionJobList{
+			mk("z", "z"),
+			mk("a", "a"),
+		}
+		jobs.SortMatrixGroupsByName()
+		assert.Equal(t, []string{"z", "a"}, names(jobs))
+	})
+
+	t.Run("empty and singleton", func(t *testing.T) {
+		ActionJobList(nil).SortMatrixGroupsByName()
+		jobs := ActionJobList{mk("only", "only")}
+		jobs.SortMatrixGroupsByName()
+		assert.Equal(t, []string{"only"}, names(jobs))
+	})
+}
diff --git a/models/actions/run_job_status_test.go b/models/actions/run_job_status_test.go
index b9ae9f34bfd..c1a44cc6d36 100644
--- a/models/actions/run_job_status_test.go
+++ b/models/actions/run_job_status_test.go
@@ -36,6 +36,7 @@ func TestAggregateJobStatus(t *testing.T) {
 		{[]Status{StatusUnknown, StatusSkipped}, StatusUnknown},
 		{[]Status{StatusUnknown, StatusFailure}, StatusFailure},
 		{[]Status{StatusUnknown, StatusCancelled}, StatusCancelled},
+		{[]Status{StatusUnknown, StatusCancelling}, StatusCancelling},
 		{[]Status{StatusUnknown, StatusWaiting}, StatusWaiting},
 		{[]Status{StatusUnknown, StatusRunning}, StatusRunning},
 		{[]Status{StatusUnknown, StatusBlocked}, StatusBlocked},
@@ -45,6 +46,7 @@ func TestAggregateJobStatus(t *testing.T) {
 		{[]Status{StatusSuccess, StatusSkipped}, StatusSuccess}, // skipped doesn't affect success
 		{[]Status{StatusSuccess, StatusFailure}, StatusFailure},
 		{[]Status{StatusSuccess, StatusCancelled}, StatusCancelled},
+		{[]Status{StatusSuccess, StatusCancelling}, StatusCancelling},
 		{[]Status{StatusSuccess, StatusWaiting}, StatusWaiting},
 		{[]Status{StatusSuccess, StatusRunning}, StatusRunning},
 		{[]Status{StatusSuccess, StatusBlocked}, StatusBlocked},
@@ -54,9 +56,16 @@ func TestAggregateJobStatus(t *testing.T) {
 		{[]Status{StatusCancelled, StatusSuccess}, StatusCancelled},
 		{[]Status{StatusCancelled, StatusSkipped}, StatusCancelled},
 		{[]Status{StatusCancelled, StatusFailure}, StatusCancelled},
-		{[]Status{StatusCancelled, StatusWaiting}, StatusCancelled},
-		{[]Status{StatusCancelled, StatusRunning}, StatusCancelled},
-		{[]Status{StatusCancelled, StatusBlocked}, StatusCancelled},
+		{[]Status{StatusCancelled, StatusCancelling}, StatusCancelling},
+		{[]Status{StatusCancelled, StatusWaiting}, StatusWaiting},
+		{[]Status{StatusCancelled, StatusRunning}, StatusRunning},
+		{[]Status{StatusCancelled, StatusBlocked}, StatusBlocked},
+
+		{[]Status{StatusCancelling}, StatusCancelling},
+		{[]Status{StatusCancelling, StatusRunning}, StatusCancelling},
+		{[]Status{StatusCancelling, StatusWaiting}, StatusCancelling},
+		{[]Status{StatusCancelling, StatusFailure}, StatusCancelling},
+		{[]Status{StatusCancelling, StatusSkipped}, StatusCancelling},
 
 		// failure with other status, usually fail fast, but "running" wins to match GitHub's behavior
 		// another reason that we can't make "failure" wins over "running": it would cause a weird behavior that user cannot cancel a workflow or get current running workflows correctly by filter after a job fail.
@@ -64,9 +73,10 @@ func TestAggregateJobStatus(t *testing.T) {
 		{[]Status{StatusFailure, StatusSuccess}, StatusFailure},
 		{[]Status{StatusFailure, StatusSkipped}, StatusFailure},
 		{[]Status{StatusFailure, StatusCancelled}, StatusCancelled},
+		{[]Status{StatusFailure, StatusCancelling}, StatusCancelling},
 		{[]Status{StatusFailure, StatusWaiting}, StatusWaiting},
 		{[]Status{StatusFailure, StatusRunning}, StatusRunning},
-		{[]Status{StatusFailure, StatusBlocked}, StatusFailure},
+		{[]Status{StatusFailure, StatusBlocked}, StatusBlocked},
 
 		// skipped with other status
 		// "all skipped" is also considered as "mergeable" by "services/actions.toCommitStatus", the same as GitHub
@@ -74,6 +84,7 @@ func TestAggregateJobStatus(t *testing.T) {
 		{[]Status{StatusSkipped, StatusSuccess}, StatusSuccess},
 		{[]Status{StatusSkipped, StatusFailure}, StatusFailure},
 		{[]Status{StatusSkipped, StatusCancelled}, StatusCancelled},
+		{[]Status{StatusSkipped, StatusCancelling}, StatusCancelling},
 		{[]Status{StatusSkipped, StatusWaiting}, StatusWaiting},
 		{[]Status{StatusSkipped, StatusRunning}, StatusRunning},
 		{[]Status{StatusSkipped, StatusBlocked}, StatusBlocked},
diff --git a/models/actions/run_job_test.go b/models/actions/run_job_test.go
new file mode 100644
index 00000000000..a9e07ce0cf0
--- /dev/null
+++ b/models/actions/run_job_test.go
@@ -0,0 +1,133 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetPriorAttemptChildrenByParent(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	// 3 attempts of one run:
+	//   1: caller expanded with 3 matrix instances of "work" + non-matrix sibling "summary".
+	//   2: caller skipped, no children rows.
+	//   3: placeholder "current" attempt for the walkback subtest.
+
+	run := &ActionRun{
+		Title:         "prior-children-test",
+		RepoID:        4,
+		Index:         9501,
+		OwnerID:       1,
+		WorkflowID:    "matrix.yaml",
+		TriggerUserID: 1,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		EventPayload:  "{}",
+		Status:        StatusSuccess,
+	}
+	require.NoError(t, db.Insert(ctx, run))
+
+	const callerAttemptJobID int64 = 9001
+	insertAttempt := func(t *testing.T, num int64, status Status) *ActionRunAttempt {
+		t.Helper()
+		a := &ActionRunAttempt{
+			RepoID:        run.RepoID,
+			RunID:         run.ID,
+			Attempt:       num,
+			TriggerUserID: 1,
+			Status:        status,
+		}
+		require.NoError(t, db.Insert(ctx, a))
+		return a
+	}
+	insertCaller := func(t *testing.T, attemptID int64, status Status, expanded bool) *ActionRunJob {
+		t.Helper()
+		caller := &ActionRunJob{
+			RunID:            run.ID,
+			RunAttemptID:     attemptID,
+			RepoID:           run.RepoID,
+			OwnerID:          run.OwnerID,
+			CommitSHA:        run.CommitSHA,
+			Name:             "caller",
+			JobID:            "caller",
+			Attempt:          1,
+			Status:           status,
+			AttemptJobID:     callerAttemptJobID,
+			IsReusableCaller: true,
+			IsExpanded:       expanded,
+		}
+		require.NoError(t, db.Insert(ctx, caller))
+		return caller
+	}
+	insertChild := func(t *testing.T, attemptID, parentID, attemptJobID int64, name, jobID string) {
+		t.Helper()
+		require.NoError(t, db.Insert(ctx, &ActionRunJob{
+			RunID:        run.ID,
+			RunAttemptID: attemptID,
+			RepoID:       run.RepoID,
+			OwnerID:      run.OwnerID,
+			CommitSHA:    run.CommitSHA,
+			Name:         name,
+			JobID:        jobID,
+			Attempt:      1,
+			Status:       StatusSuccess,
+			AttemptJobID: attemptJobID,
+			ParentJobID:  parentID,
+		}))
+	}
+
+	attempt1 := insertAttempt(t, 1, StatusSuccess)
+	caller1 := insertCaller(t, attempt1.ID, StatusSuccess, true)
+	insertChild(t, attempt1.ID, caller1.ID, 101, "work (alpha)", "work")
+	insertChild(t, attempt1.ID, caller1.ID, 102, "work (beta)", "work")
+	insertChild(t, attempt1.ID, caller1.ID, 103, "work (gamma)", "work")
+	insertChild(t, attempt1.ID, caller1.ID, 104, "summary", "summary")
+
+	attempt2 := insertAttempt(t, 2, StatusSkipped)
+	insertCaller(t, attempt2.ID, StatusSkipped, false) // no children intentionally
+
+	// both subtests expect attempt 1's expansion, differing only in the "current" attempt id
+	assertAttempt1Children := func(t *testing.T, out map[string]map[string]*ActionRunJob) {
+		t.Helper()
+		// outer map keyed by JobID: "work" has 3 matrix instances, "summary" 1
+		assert.Len(t, out, 2)
+		assert.Len(t, out["work"], 3, "matrix instances must each get their own inner-map entry")
+		assert.Len(t, out["summary"], 1)
+
+		require.NotNil(t, out["work"]["work (alpha)"])
+		require.NotNil(t, out["work"]["work (beta)"])
+		require.NotNil(t, out["work"]["work (gamma)"])
+		require.NotNil(t, out["summary"]["summary"])
+
+		assert.Equal(t, int64(101), out["work"]["work (alpha)"].AttemptJobID)
+		assert.Equal(t, int64(102), out["work"]["work (beta)"].AttemptJobID)
+		assert.Equal(t, int64(103), out["work"]["work (gamma)"].AttemptJobID)
+		assert.Equal(t, int64(104), out["summary"]["summary"].AttemptJobID)
+	}
+
+	t.Run("matrix instances and non-matrix sibling are indexed by (JobID, Name)", func(t *testing.T) {
+		// "current" = attempt 2; prior = attempt 1, which is the immediately preceding attempt.
+		out, err := GetPriorAttemptChildrenByParent(ctx, run.ID, attempt2.ID, callerAttemptJobID)
+		require.NoError(t, err)
+		assertAttempt1Children(t, out)
+	})
+
+	t.Run("walkback past an attempt where the caller had no children", func(t *testing.T) {
+		attempt3 := insertAttempt(t, 3, StatusRunning)
+		// "current" = attempt 3; the immediately preceding attempt 2 has no children, so the lookup must walk further back to attempt 1.
+		out, err := GetPriorAttemptChildrenByParent(ctx, run.ID, attempt3.ID, callerAttemptJobID)
+		require.NoError(t, err)
+		assertAttempt1Children(t, out)
+	})
+}
diff --git a/models/actions/run_list.go b/models/actions/run_list.go
index 0a0840648da..77de6a85127 100644
--- a/models/actions/run_list.go
+++ b/models/actions/run_list.go
@@ -6,12 +6,12 @@ package actions
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/translation"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/translation"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"xorm.io/builder"
 )
@@ -121,8 +121,8 @@ type StatusInfo struct {
 // GetStatusInfoList returns a slice of StatusInfo
 func GetStatusInfoList(ctx context.Context, lang translation.Locale) []StatusInfo {
 	// same as those in aggregateJobStatus
-	allStatus := []Status{StatusSuccess, StatusFailure, StatusWaiting, StatusRunning}
-	statusInfoList := make([]StatusInfo, 0, 4)
+	allStatus := []Status{StatusSuccess, StatusFailure, StatusWaiting, StatusRunning, StatusCancelling}
+	statusInfoList := make([]StatusInfo, 0, len(allStatus))
 	for _, s := range allStatus {
 		statusInfoList = append(statusInfoList, StatusInfo{
 			Status:          int(s),
@@ -132,6 +132,32 @@ func GetStatusInfoList(ctx context.Context, lang translation.Locale) []StatusInf
 	return statusInfoList
 }
 
+// GetRunBranches returns branch names for the run-list "Branch" filter.
+// Sourced from the `branch` table (indexed by repo_id) rather than DISTINCT-ing
+// `action_run.ref`, which is wildcard-matched and slow on large repos; as a side
+// effect the list reflects existing branches, not only ones that produced a run.
+func GetRunBranches(ctx context.Context, repoID int64) ([]string, error) {
+	branches := make([]string, 0, 10)
+	return branches, db.GetEngine(ctx).Table("branch").
+		Where("repo_id = ?", repoID).
+		And("is_deleted = ?", false).
+		Cols("name").
+		OrderBy("name ASC").
+		Find(&branches)
+}
+
+// GetRunWorkflowIDs returns all distinct WorkflowIDs that have at least
+// one ActionRun in the given repo.
+func GetRunWorkflowIDs(ctx context.Context, repoID int64) ([]string, error) {
+	ids := make([]string, 0, 10)
+	return ids, db.GetEngine(ctx).Table("action_run").
+		Where(builder.Eq{"repo_id": repoID}).
+		Distinct("workflow_id").
+		Cols("workflow_id").
+		Asc("workflow_id").
+		Find(&ids)
+}
+
 // GetActors returns a slice of Actors
 func GetActors(ctx context.Context, repoID int64) ([]*user_model.User, error) {
 	actors := make([]*user_model.User, 0, 10)
diff --git a/models/actions/run_list_test.go b/models/actions/run_list_test.go
new file mode 100644
index 00000000000..70d8dd91b1b
--- /dev/null
+++ b/models/actions/run_list_test.go
@@ -0,0 +1,24 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"gitea.dev/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetRunWorkflowIDs(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	ids, err := GetRunWorkflowIDs(t.Context(), 4)
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"artifact.yaml", "test.yaml"}, ids)
+
+	ids, err = GetRunWorkflowIDs(t.Context(), 999999)
+	assert.NoError(t, err)
+	assert.Empty(t, ids)
+}
diff --git a/models/actions/run_test.go b/models/actions/run_test.go
index e82cbe84b51..356ed28a74e 100644
--- a/models/actions/run_test.go
+++ b/models/actions/run_test.go
@@ -7,10 +7,10 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -29,8 +29,7 @@ func TestUpdateRepoRunsNumbers(t *testing.T) {
 	assert.Equal(t, 2, repo.NumClosedActionRuns)
 
 	// now update will correct them, only num_actionr_runs and num_closed_action_runs should be updated
-	err = UpdateRepoRunsNumbers(t.Context(), repo)
-	assert.NoError(t, err)
+	UpdateRepoRunsNumbers(t.Context(), repo.ID)
 	repo = unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
 	assert.Equal(t, 4, repo.NumActionRuns)
 	assert.Equal(t, 3, repo.NumClosedActionRuns)
diff --git a/models/actions/runner.go b/models/actions/runner.go
index f0088491bb5..ba2b38ee7e9 100644
--- a/models/actions/runner.go
+++ b/models/actions/runner.go
@@ -10,18 +10,18 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/shared/types"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/shared/types"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"xorm.io/builder"
 )
 
@@ -64,6 +64,8 @@ type ActionRunner struct {
 	Ephemeral bool `xorm:"ephemeral NOT NULL DEFAULT false"`
 	// Store if this runner is disabled and should not pick up new jobs
 	IsDisabled bool `xorm:"is_disabled NOT NULL DEFAULT false"`
+	// Store if this runner supports the StatusCancelling flow
+	HasCancellingSupport bool `xorm:"has_cancelling_support NOT NULL DEFAULT false"`
 
 	Created timeutil.TimeStamp `xorm:"created"`
 	Updated timeutil.TimeStamp `xorm:"updated"`
diff --git a/models/actions/runner_list.go b/models/actions/runner_list.go
index 3ef8ebb2545..1bd714c66fd 100644
--- a/models/actions/runner_list.go
+++ b/models/actions/runner_list.go
@@ -6,10 +6,10 @@ package actions
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
 )
 
 type RunnerList []*ActionRunner
diff --git a/models/actions/runner_token.go b/models/actions/runner_token.go
index f7b7c9fdf0b..0945ce3d489 100644
--- a/models/actions/runner_token.go
+++ b/models/actions/runner_token.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
 // ActionRunnerToken represents runner tokens
diff --git a/models/actions/runner_token_test.go b/models/actions/runner_token_test.go
index 243d6716a00..d95a530f101 100644
--- a/models/actions/runner_token_test.go
+++ b/models/actions/runner_token_test.go
@@ -6,7 +6,7 @@ package actions
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/actions/schedule.go b/models/actions/schedule.go
index ffde5092e0f..031ea8350d0 100644
--- a/models/actions/schedule.go
+++ b/models/actions/schedule.go
@@ -8,12 +8,12 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 // ActionSchedule represents a schedule of a workflow file
diff --git a/models/actions/schedule_list.go b/models/actions/schedule_list.go
index 6b5cae94fe9..549bbf17441 100644
--- a/models/actions/schedule_list.go
+++ b/models/actions/schedule_list.go
@@ -4,7 +4,7 @@
 package actions
 
 import (
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 
 	"xorm.io/builder"
 )
diff --git a/models/actions/schedule_spec.go b/models/actions/schedule_spec.go
index 923e5f78077..3e127cec8c8 100644
--- a/models/actions/schedule_spec.go
+++ b/models/actions/schedule_spec.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/robfig/cron/v3"
 )
diff --git a/models/actions/schedule_spec_list.go b/models/actions/schedule_spec_list.go
index e26b2c11206..81994471f02 100644
--- a/models/actions/schedule_spec_list.go
+++ b/models/actions/schedule_spec_list.go
@@ -6,9 +6,9 @@ package actions
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/container"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/container"
 
 	"xorm.io/builder"
 )
diff --git a/models/actions/schedule_spec_test.go b/models/actions/schedule_spec_test.go
index 57221461dfe..3b2cfd087bc 100644
--- a/models/actions/schedule_spec_test.go
+++ b/models/actions/schedule_spec_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/actions/status.go b/models/actions/status.go
index 2b1d70613c7..22ea0d1555b 100644
--- a/models/actions/status.go
+++ b/models/actions/status.go
@@ -6,34 +6,35 @@ package actions
 import (
 	"slices"
 
-	"code.gitea.io/gitea/modules/translation"
-
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	"gitea.dev/modules/translation"
 )
 
 // Status represents the status of ActionRun, ActionRunJob, ActionTask, or ActionTaskStep
 type Status int
 
 const (
-	StatusUnknown   Status = iota // 0, consistent with runnerv1.Result_RESULT_UNSPECIFIED
-	StatusSuccess                 // 1, consistent with runnerv1.Result_RESULT_SUCCESS
-	StatusFailure                 // 2, consistent with runnerv1.Result_RESULT_FAILURE
-	StatusCancelled               // 3, consistent with runnerv1.Result_RESULT_CANCELLED
-	StatusSkipped                 // 4, consistent with runnerv1.Result_RESULT_SKIPPED
-	StatusWaiting                 // 5, isn't a runnerv1.Result
-	StatusRunning                 // 6, isn't a runnerv1.Result
-	StatusBlocked                 // 7, isn't a runnerv1.Result
+	StatusUnknown    Status = iota // 0, consistent with runnerv1.Result_RESULT_UNSPECIFIED
+	StatusSuccess                  // 1, consistent with runnerv1.Result_RESULT_SUCCESS
+	StatusFailure                  // 2, consistent with runnerv1.Result_RESULT_FAILURE
+	StatusCancelled                // 3, consistent with runnerv1.Result_RESULT_CANCELLED
+	StatusSkipped                  // 4, consistent with runnerv1.Result_RESULT_SKIPPED
+	StatusWaiting                  // 5, isn't a runnerv1.Result
+	StatusRunning                  // 6, isn't a runnerv1.Result
+	StatusBlocked                  // 7, isn't a runnerv1.Result
+	StatusCancelling               // 8, isn't a runnerv1.Result
 )
 
 var statusNames = map[Status]string{
-	StatusUnknown:   "unknown",
-	StatusWaiting:   "waiting",
-	StatusRunning:   "running",
-	StatusSuccess:   "success",
-	StatusFailure:   "failure",
-	StatusCancelled: "cancelled",
-	StatusSkipped:   "skipped",
-	StatusBlocked:   "blocked",
+	StatusUnknown:    "unknown",
+	StatusWaiting:    "waiting",
+	StatusRunning:    "running",
+	StatusSuccess:    "success",
+	StatusFailure:    "failure",
+	StatusCancelled:  "cancelled",
+	StatusCancelling: "cancelling",
+	StatusSkipped:    "skipped",
+	StatusBlocked:    "blocked",
 }
 
 // String returns the string name of the Status
@@ -88,14 +89,41 @@ func (s Status) IsBlocked() bool {
 	return s == StatusBlocked
 }
 
+func (s Status) IsCancelling() bool {
+	return s == StatusCancelling
+}
+
 // In returns whether s is one of the given statuses
 func (s Status) In(statuses ...Status) bool {
 	return slices.Contains(statuses, s)
 }
 
 func (s Status) AsResult() runnerv1.Result {
-	if s.IsDone() {
-		return runnerv1.Result(s)
+	switch s {
+	case StatusSuccess:
+		return runnerv1.Result_RESULT_SUCCESS
+	case StatusFailure:
+		return runnerv1.Result_RESULT_FAILURE
+	case StatusCancelled, StatusCancelling:
+		return runnerv1.Result_RESULT_CANCELLED
+	case StatusSkipped:
+		return runnerv1.Result_RESULT_SKIPPED
+	default:
+		return runnerv1.Result_RESULT_UNSPECIFIED
+	}
+}
+
+func StatusFromResult(r runnerv1.Result) Status {
+	switch r {
+	case runnerv1.Result_RESULT_SUCCESS:
+		return StatusSuccess
+	case runnerv1.Result_RESULT_FAILURE:
+		return StatusFailure
+	case runnerv1.Result_RESULT_CANCELLED:
+		return StatusCancelled
+	case runnerv1.Result_RESULT_SKIPPED:
+		return StatusSkipped
+	default:
+		return StatusUnknown
 	}
-	return runnerv1.Result_RESULT_UNSPECIFIED
 }
diff --git a/models/actions/status_test.go b/models/actions/status_test.go
new file mode 100644
index 00000000000..f1551b28923
--- /dev/null
+++ b/models/actions/status_test.go
@@ -0,0 +1,50 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStatusAsResult(t *testing.T) {
+	cases := []struct {
+		status Status
+		want   runnerv1.Result
+	}{
+		{StatusUnknown, runnerv1.Result_RESULT_UNSPECIFIED},
+		{StatusWaiting, runnerv1.Result_RESULT_UNSPECIFIED},
+		{StatusRunning, runnerv1.Result_RESULT_UNSPECIFIED},
+		{StatusBlocked, runnerv1.Result_RESULT_UNSPECIFIED},
+		{StatusSuccess, runnerv1.Result_RESULT_SUCCESS},
+		{StatusFailure, runnerv1.Result_RESULT_FAILURE},
+		{StatusCancelled, runnerv1.Result_RESULT_CANCELLED},
+		{StatusCancelling, runnerv1.Result_RESULT_CANCELLED},
+		{StatusSkipped, runnerv1.Result_RESULT_SKIPPED},
+	}
+
+	for _, tt := range cases {
+		assert.Equal(t, tt.want, tt.status.AsResult(), "status=%s", tt.status)
+	}
+}
+
+func TestStatusFromResult(t *testing.T) {
+	cases := []struct {
+		result runnerv1.Result
+		want   Status
+	}{
+		{runnerv1.Result_RESULT_UNSPECIFIED, StatusUnknown},
+		{runnerv1.Result_RESULT_SUCCESS, StatusSuccess},
+		{runnerv1.Result_RESULT_FAILURE, StatusFailure},
+		{runnerv1.Result_RESULT_CANCELLED, StatusCancelled},
+		{runnerv1.Result_RESULT_SKIPPED, StatusSkipped},
+	}
+
+	for _, tt := range cases {
+		assert.Equal(t, tt.want, StatusFromResult(tt.result), "result=%s", tt.result)
+	}
+}
diff --git a/models/actions/task.go b/models/actions/task.go
index 7a97eadc798..36318c878aa 100644
--- a/models/actions/task.go
+++ b/models/actions/task.go
@@ -11,16 +11,16 @@ import (
 	"strings"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/actions/jobparser"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	lru "github.com/hashicorp/golang-lru/v2"
 	"google.golang.org/protobuf/types/known/timestamppb"
 	"xorm.io/builder"
@@ -193,7 +193,8 @@ func GetRunningTaskByToken(ctx context.Context, token string) (*ActionTask, erro
 	}
 
 	var tasks []*ActionTask
-	err := db.GetEngine(ctx).Where("token_last_eight = ? AND status = ?", lastEight, StatusRunning).Find(&tasks)
+	// Cancelling tasks are still authenticating — post-run cleanup steps need API access (artifact uploads, cache saves, etc.) before the runner finalizes the task.
+	err := db.GetEngine(ctx).Where("token_last_eight = ? AND status IN (?, ?)", lastEight, StatusRunning, StatusCancelling).Find(&tasks)
 	if err != nil {
 		return nil, err
 	} else if len(tasks) == 0 {
@@ -248,7 +249,7 @@ func CreateTaskForRunner(ctx context.Context, runner *ActionRunner) (*ActionTask
 	}
 
 	var jobs []*ActionRunJob
-	if err := e.Where("task_id=? AND status=?", 0, StatusWaiting).And(jobCond).Asc("updated", "id").Find(&jobs); err != nil {
+	if err := e.Where("task_id=? AND status=? AND is_reusable_caller=?", 0, StatusWaiting, false).And(jobCond).Asc("updated", "id").Find(&jobs); err != nil {
 		return nil, false, err
 	}
 
@@ -374,7 +375,12 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 
 		// state.Result is not unspecified means the task is finished
 		if state.Result != runnerv1.Result_RESULT_UNSPECIFIED {
-			task.Status = Status(state.Result)
+			if task.Status == StatusCancelling {
+				// The runner may report SUCCESS/FAILURE for the cleanup phase; preserve user intent.
+				task.Status = StatusCancelled
+			} else {
+				task.Status = StatusFromResult(state.Result)
+			}
 			task.Stopped = timeutil.TimeStamp(state.StoppedAt.AsTime().Unix())
 			if err := UpdateTask(ctx, task, "status", "stopped"); err != nil {
 				return nil, err
@@ -384,7 +390,7 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 				RepoID:  task.RepoID,
 				Status:  task.Status,
 				Stopped: task.Stopped,
-			}, nil); err != nil {
+			}, nil, "status", "stopped"); err != nil {
 				return nil, err
 			}
 		} else {
@@ -409,7 +415,7 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 				step.Stopped = convertTimestamp(v.StoppedAt)
 			}
 			if result != runnerv1.Result_RESULT_UNSPECIFIED {
-				step.Status = Status(result)
+				step.Status = StatusFromResult(result)
 			} else if step.Started != 0 {
 				step.Status = StatusRunning
 			}
@@ -423,7 +429,7 @@ func UpdateTaskByState(ctx context.Context, runnerID int64, state *runnerv1.Task
 }
 
 func StopTask(ctx context.Context, taskID int64, status Status) error {
-	if !status.IsDone() {
+	if !status.IsDone() && status != StatusCancelling {
 		return fmt.Errorf("cannot stop task with status %v", status)
 	}
 	e := db.GetEngine(ctx)
@@ -439,6 +445,32 @@ func StopTask(ctx context.Context, taskID int64, status Status) error {
 	}
 
 	now := timeutil.TimeStampNow()
+	if status == StatusCancelling {
+		runner, err := GetRunnerByID(ctx, task.RunnerID)
+		if err != nil {
+			if !errors.Is(err, util.ErrNotExist) {
+				return err
+			}
+			status = StatusCancelled
+		} else if !runner.HasCancellingSupport {
+			status = StatusCancelled
+		}
+	}
+
+	if status == StatusCancelling {
+		task.Status = StatusCancelling
+
+		if _, err := UpdateRunJob(ctx, &ActionRunJob{
+			ID:     task.JobID,
+			RepoID: task.RepoID,
+			Status: StatusCancelling,
+		}, nil, "status"); err != nil {
+			return err
+		}
+
+		return UpdateTask(ctx, task, "status")
+	}
+
 	task.Status = status
 	task.Stopped = now
 	if _, err := UpdateRunJob(ctx, &ActionRunJob{
diff --git a/models/actions/task_list.go b/models/actions/task_list.go
index 0c803978994..5df0f3bfa58 100644
--- a/models/actions/task_list.go
+++ b/models/actions/task_list.go
@@ -6,9 +6,9 @@ package actions
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/timeutil"
 
 	"xorm.io/builder"
 )
diff --git a/models/actions/task_output.go b/models/actions/task_output.go
index eab5b931183..36cc77e6d19 100644
--- a/models/actions/task_output.go
+++ b/models/actions/task_output.go
@@ -6,7 +6,7 @@ package actions
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 )
 
 // ActionTaskOutput represents an output of ActionTask.
diff --git a/models/actions/task_step.go b/models/actions/task_step.go
index 3b477d8483c..598b9adb1ae 100644
--- a/models/actions/task_step.go
+++ b/models/actions/task_step.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
 // ActionTaskStep represents a step of ActionTask
diff --git a/models/actions/task_test.go b/models/actions/task_test.go
index cbfc6f7636b..fe4436ec635 100644
--- a/models/actions/task_test.go
+++ b/models/actions/task_test.go
@@ -7,9 +7,15 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/actions/jobparser"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 func TestMakeTaskStepDisplayName(t *testing.T) {
@@ -75,3 +81,228 @@ func TestMakeTaskStepDisplayName(t *testing.T) {
 		})
 	}
 }
+
+func TestTaskCancellingFinalizesToCancelled(t *testing.T) {
+	newRunningTask := func(t *testing.T) (*ActionTask, *ActionRunJob) {
+		t.Helper()
+
+		run := &ActionRun{
+			Title:         "cancelling-test-run",
+			RepoID:        1,
+			OwnerID:       2,
+			WorkflowID:    "test.yaml",
+			Index:         999,
+			TriggerUserID: 2,
+			Ref:           "refs/heads/master",
+			CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+			Event:         "push",
+			TriggerEvent:  "push",
+			Status:        StatusRunning,
+			Started:       timeutil.TimeStampNow(),
+		}
+		require.NoError(t, db.Insert(t.Context(), run))
+
+		job := &ActionRunJob{
+			RunID:     run.ID,
+			RepoID:    run.RepoID,
+			OwnerID:   run.OwnerID,
+			CommitSHA: run.CommitSHA,
+			Name:      "cancelling-finalization-job",
+			Attempt:   1,
+			JobID:     "cancelling-finalization-job",
+			Status:    StatusRunning,
+		}
+		require.NoError(t, db.Insert(t.Context(), job))
+
+		runner := &ActionRunner{
+			UUID:                 "runner-cancelling-supported",
+			Name:                 "runner-cancelling-supported",
+			HasCancellingSupport: true,
+		}
+		require.NoError(t, db.Insert(t.Context(), runner))
+
+		task := &ActionTask{
+			JobID:     job.ID,
+			Attempt:   1,
+			RunnerID:  runner.ID,
+			Status:    StatusRunning,
+			Started:   timeutil.TimeStampNow(),
+			RepoID:    run.RepoID,
+			OwnerID:   run.OwnerID,
+			CommitSHA: run.CommitSHA,
+		}
+		require.NoError(t, db.Insert(t.Context(), task))
+
+		job.TaskID = task.ID
+		_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+		require.NoError(t, err)
+
+		return task, job
+	}
+
+	testResult := func(t *testing.T, result runnerv1.Result) {
+		t.Helper()
+		require.NoError(t, unittest.PrepareTestDatabase())
+
+		task, job := newRunningTask(t)
+		require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
+
+		taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+		assert.Equal(t, StatusCancelling, taskAfterStop.Status)
+
+		updatedTask, err := UpdateTaskByState(t.Context(), task.RunnerID, &runnerv1.TaskState{
+			Id:        task.ID,
+			Result:    result,
+			StoppedAt: timestamppb.Now(),
+		})
+		require.NoError(t, err)
+		assert.Equal(t, StatusCancelled, updatedTask.Status)
+
+		taskAfterUpdate := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+		assert.Equal(t, StatusCancelled, taskAfterUpdate.Status)
+
+		jobAfterUpdate := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+		assert.Equal(t, StatusCancelled, jobAfterUpdate.Status)
+	}
+
+	t.Run("runner reports success", func(t *testing.T) {
+		testResult(t, runnerv1.Result_RESULT_SUCCESS)
+	})
+
+	t.Run("runner reports failure", func(t *testing.T) {
+		testResult(t, runnerv1.Result_RESULT_FAILURE)
+	})
+}
+
+func TestStopTaskCancellingFallsBackForLegacyRunner(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	run := &ActionRun{
+		Title:         "cancelling-test-run",
+		RepoID:        1,
+		OwnerID:       2,
+		WorkflowID:    "test.yaml",
+		Index:         999,
+		TriggerUserID: 2,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		Status:        StatusRunning,
+		Started:       timeutil.TimeStampNow(),
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	job := &ActionRunJob{
+		RunID:     run.ID,
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+		Name:      "legacy-cancelling-job",
+		Attempt:   1,
+		JobID:     "legacy-cancelling-job",
+		Status:    StatusRunning,
+	}
+	require.NoError(t, db.Insert(t.Context(), job))
+
+	runner := &ActionRunner{
+		UUID:                 "runner-legacy-no-cancelling",
+		Name:                 "runner-legacy-no-cancelling",
+		HasCancellingSupport: false,
+	}
+	require.NoError(t, db.Insert(t.Context(), runner))
+
+	task := &ActionTask{
+		JobID:     job.ID,
+		Attempt:   1,
+		RunnerID:  runner.ID,
+		Status:    StatusRunning,
+		Started:   timeutil.TimeStampNow(),
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+	}
+	require.NoError(t, db.Insert(t.Context(), task))
+
+	job.TaskID = task.ID
+	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+	require.NoError(t, err)
+
+	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
+
+	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+	assert.Equal(t, StatusCancelled, taskAfterStop.Status)
+	assert.NotZero(t, taskAfterStop.Stopped)
+
+	jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+	assert.Equal(t, StatusCancelled, jobAfterStop.Status)
+	assert.NotZero(t, jobAfterStop.Stopped)
+}
+
+func TestStopTaskCancellingFallsBackForMissingRunner(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	run := &ActionRun{
+		Title:         "cancelling-test-run",
+		RepoID:        1,
+		OwnerID:       2,
+		WorkflowID:    "test.yaml",
+		Index:         999,
+		TriggerUserID: 2,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		Status:        StatusRunning,
+		Started:       timeutil.TimeStampNow(),
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	job := &ActionRunJob{
+		RunID:     run.ID,
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+		Name:      "missing-runner-cancelling-job",
+		Attempt:   1,
+		JobID:     "missing-runner-cancelling-job",
+		Status:    StatusRunning,
+	}
+	require.NoError(t, db.Insert(t.Context(), job))
+
+	runner := &ActionRunner{
+		UUID:                 "runner-cleaned-up-before-cancel",
+		Name:                 "runner-cleaned-up-before-cancel",
+		HasCancellingSupport: true,
+	}
+	require.NoError(t, db.Insert(t.Context(), runner))
+
+	task := &ActionTask{
+		JobID:     job.ID,
+		Attempt:   1,
+		RunnerID:  runner.ID,
+		Status:    StatusRunning,
+		Started:   timeutil.TimeStampNow(),
+		RepoID:    run.RepoID,
+		OwnerID:   run.OwnerID,
+		CommitSHA: run.CommitSHA,
+	}
+	require.NoError(t, db.Insert(t.Context(), task))
+
+	job.TaskID = task.ID
+	_, err := UpdateRunJob(t.Context(), job, nil, "task_id")
+	require.NoError(t, err)
+
+	_, err = db.DeleteByID[ActionRunner](t.Context(), runner.ID)
+	require.NoError(t, err)
+
+	require.NoError(t, StopTask(t.Context(), task.ID, StatusCancelling))
+
+	taskAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionTask{ID: task.ID})
+	assert.Equal(t, StatusCancelled, taskAfterStop.Status)
+	assert.NotZero(t, taskAfterStop.Stopped)
+
+	jobAfterStop := unittest.AssertExistsAndLoadBean(t, &ActionRunJob{ID: job.ID})
+	assert.Equal(t, StatusCancelled, jobAfterStop.Status)
+	assert.NotZero(t, jobAfterStop.Stopped)
+}
diff --git a/models/actions/tasks_version.go b/models/actions/tasks_version.go
index b686ce24431..c8fd0db36b1 100644
--- a/models/actions/tasks_version.go
+++ b/models/actions/tasks_version.go
@@ -6,9 +6,9 @@ package actions
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
 )
 
 // ActionTasksVersion
diff --git a/models/actions/token_permissions.go b/models/actions/token_permissions.go
index 985f6cc97be..f77ce48878a 100644
--- a/models/actions/token_permissions.go
+++ b/models/actions/token_permissions.go
@@ -6,8 +6,8 @@ package actions
 import (
 	"context"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
 )
 
 // ComputeTaskTokenPermissions computes the effective permissions for a job token against the target repository.
diff --git a/models/actions/utils.go b/models/actions/utils.go
index e5704d0377d..25b6532972b 100644
--- a/models/actions/utils.go
+++ b/models/actions/utils.go
@@ -12,10 +12,10 @@ import (
 	"io"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
 func generateSaltedToken() (string, string, string, string) {
diff --git a/models/actions/utils_test.go b/models/actions/utils_test.go
index 2f7e7da3607..c83173e81ea 100644
--- a/models/actions/utils_test.go
+++ b/models/actions/utils_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/actions/variable.go b/models/actions/variable.go
index 7154843c170..839b8129ad3 100644
--- a/models/actions/variable.go
+++ b/models/actions/variable.go
@@ -8,10 +8,10 @@ import (
 	"strings"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/activities/action.go b/models/activities/action.go
index 4ffdca842a4..a666c31c270 100644
--- a/models/activities/action.go
+++ b/models/activities/action.go
@@ -14,17 +14,17 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 	"xorm.io/xorm/schemas"
@@ -436,6 +436,12 @@ type GetFeedsOptions struct {
 	DontCount       bool                   // do counting in GetFeeds
 }
 
+func (opts *GetFeedsOptions) ApplyPublicOnly(publicOnly bool) {
+	if publicOnly {
+		opts.IncludePrivate = false
+	}
+}
+
 // ActivityReadable return whether doer can read activities of user
 func ActivityReadable(user, doer *user_model.User) bool {
 	return !user.KeepActivityPrivate ||
diff --git a/models/activities/action_list.go b/models/activities/action_list.go
index 5b07a8e080a..f1c617f5942 100644
--- a/models/activities/action_list.go
+++ b/models/activities/action_list.go
@@ -9,12 +9,12 @@ import (
 	"fmt"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -242,7 +242,7 @@ func GetFeeds(ctx context.Context, opts GetFeedsOptions) (ActionList, int64, err
 
 	if opts.Page < 10 { // TODO: why it's 10 but other values? It's an experience value.
 		sess := db.GetEngine(ctx).Where(cond)
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)
 
 		if opts.DontCount {
 			err = sess.Desc("`action`.created_unix").Find(&actions)
@@ -255,7 +255,7 @@ func GetFeeds(ctx context.Context, opts GetFeedsOptions) (ActionList, int64, err
 	} else {
 		// First, only query which IDs are necessary, and only then query all actions to speed up the overall query
 		sess := db.GetEngine(ctx).Where(cond).Select("`action`.id")
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)
 
 		actionIDs := make([]int64, 0, opts.PageSize)
 		if err := sess.Table("action").Desc("`action`.created_unix").Find(&actionIDs); err != nil {
diff --git a/models/activities/action_test.go b/models/activities/action_test.go
index 9447f39d62a..0a60cd9c781 100644
--- a/models/activities/action_test.go
+++ b/models/activities/action_test.go
@@ -8,14 +8,14 @@ import (
 	"path"
 	"testing"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	issue_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	issue_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/activities/main_test.go b/models/activities/main_test.go
index 43afb84ef15..5b64a455fef 100644
--- a/models/activities/main_test.go
+++ b/models/activities/main_test.go
@@ -6,10 +6,10 @@ package activities_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/activities/notification.go b/models/activities/notification.go
index 8a830c5aa26..c786811fcd2 100644
--- a/models/activities/notification.go
+++ b/models/activities/notification.go
@@ -9,13 +9,13 @@ import (
 	"net/url"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 
 	"xorm.io/builder"
 	"xorm.io/xorm/schemas"
diff --git a/models/activities/notification_list.go b/models/activities/notification_list.go
index d38758bc41a..70bf6811bce 100644
--- a/models/activities/notification_list.go
+++ b/models/activities/notification_list.go
@@ -6,15 +6,15 @@ package activities
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/activities/notification_test.go b/models/activities/notification_test.go
index 6f2253c815d..eaf96bf31eb 100644
--- a/models/activities/notification_test.go
+++ b/models/activities/notification_test.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"testing"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/activities/repo_activity.go b/models/activities/repo_activity.go
index aeaa452c9e9..fd6a1630e51 100644
--- a/models/activities/repo_activity.go
+++ b/models/activities/repo_activity.go
@@ -9,15 +9,14 @@ import (
 	"sort"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
 // ActivityAuthorData represents statistical git commit count data
@@ -248,7 +247,7 @@ func (stats *ActivityStats) FillPullRequests(ctx context.Context, repoID int64,
 	return nil
 }
 
-func pullRequestsForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time, merged bool) *xorm.Session {
+func pullRequestsForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time, merged bool) db.Session {
 	sess := db.GetEngine(ctx).Where("pull_request.base_repo_id=?", repoID).
 		Join("INNER", "issue", "pull_request.issue_id = issue.id")
 
@@ -324,7 +323,7 @@ func (stats *ActivityStats) FillUnresolvedIssues(ctx context.Context, repoID int
 	return sess.Find(&stats.UnresolvedIssues)
 }
 
-func newlyCreatedIssues(ctx context.Context, repoID int64, fromTime time.Time) *xorm.Session {
+func newlyCreatedIssues(ctx context.Context, repoID int64, fromTime time.Time) db.Session {
 	sess := db.GetEngine(ctx).Where("issue.repo_id = ?", repoID).
 		And("issue.is_pull = ?", false).                // Retain the is_pull check to exclude pull requests
 		And("issue.created_unix >= ?", fromTime.Unix()) // Include all issues created after fromTime
@@ -332,7 +331,7 @@ func newlyCreatedIssues(ctx context.Context, repoID int64, fromTime time.Time) *
 	return sess
 }
 
-func activeIssues(ctx context.Context, repoID int64, fromTime time.Time) *xorm.Session {
+func activeIssues(ctx context.Context, repoID int64, fromTime time.Time) db.Session {
 	sess := db.GetEngine(ctx).Where("issue.repo_id = ?", repoID).
 		And("issue.is_pull = ?", false).
 		And(builder.Or(
@@ -343,7 +342,7 @@ func activeIssues(ctx context.Context, repoID int64, fromTime time.Time) *xorm.S
 	return sess
 }
 
-func issuesForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time, closed, unresolved bool) *xorm.Session {
+func issuesForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time, closed, unresolved bool) db.Session {
 	sess := db.GetEngine(ctx).Where("issue.repo_id = ?", repoID).
 		And("issue.is_closed = ?", closed)
 
@@ -385,7 +384,7 @@ func (stats *ActivityStats) FillReleases(ctx context.Context, repoID int64, from
 	return nil
 }
 
-func releasesForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time) *xorm.Session {
+func releasesForActivityStatement(ctx context.Context, repoID int64, fromTime time.Time) db.Session {
 	return db.GetEngine(ctx).Where("`release`.repo_id = ?", repoID).
 		And("`release`.is_draft = ?", false).
 		And("`release`.created_unix >= ?", fromTime.Unix())
diff --git a/models/activities/statistic.go b/models/activities/statistic.go
index 940651d3592..087a257a336 100644
--- a/models/activities/statistic.go
+++ b/models/activities/statistic.go
@@ -6,20 +6,20 @@ package activities
 import (
 	"context"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
 )
 
 // Statistic contains the database statistics
diff --git a/models/activities/user_heatmap.go b/models/activities/user_heatmap.go
index 2d1635917ef..643c86e480b 100644
--- a/models/activities/user_heatmap.go
+++ b/models/activities/user_heatmap.go
@@ -6,11 +6,11 @@ package activities
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 )
 
 // UserHeatmapData represents the data needed to create a heatmap
diff --git a/models/activities/user_heatmap_test.go b/models/activities/user_heatmap_test.go
index 66087325b1d..1a8ad7620f6 100644
--- a/models/activities/user_heatmap_test.go
+++ b/models/activities/user_heatmap_test.go
@@ -7,11 +7,11 @@ import (
 	"testing"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/timeutil"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/admin/task.go b/models/admin/task.go
index 5d2b9bbff6f..be02137c906 100644
--- a/models/admin/task.go
+++ b/models/admin/task.go
@@ -7,17 +7,17 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/secret"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/migration"
+	"gitea.dev/modules/secret"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
 // Task represents a task
@@ -137,6 +137,11 @@ func (task *Task) MigrateConfig() (*migration.MigrateOptions, error) {
 				log.Error("Unable to decrypt AuthToken, maybe SECRET_KEY is wrong: %v", err)
 			}
 		}
+		if opts.AWSSecretAccessKeyEncrypted != "" {
+			if opts.AWSSecretAccessKey, err = secret.DecryptSecret(setting.SecretKey, opts.AWSSecretAccessKeyEncrypted); err != nil {
+				log.Error("Unable to decrypt AWSSecretAccessKey, maybe SECRET_KEY is wrong: %v", err)
+			}
+		}
 
 		return &opts, nil
 	}
@@ -201,6 +206,8 @@ func FinishMigrateTask(ctx context.Context, task *Task) error {
 	conf.AuthPasswordEncrypted = ""
 	conf.AuthTokenEncrypted = ""
 	conf.CloneAddrEncrypted = ""
+	conf.AWSSecretAccessKey = ""
+	conf.AWSSecretAccessKeyEncrypted = ""
 	confBytes, err := json.Marshal(conf)
 	if err != nil {
 		return err
diff --git a/models/asymkey/error.go b/models/asymkey/error.go
index 5df7beb8cd7..1a862954a32 100644
--- a/models/asymkey/error.go
+++ b/models/asymkey/error.go
@@ -6,7 +6,7 @@ package asymkey
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // ErrKeyUnableVerify represents a "KeyUnableVerify" kind of error.
diff --git a/models/asymkey/gpg_key.go b/models/asymkey/gpg_key.go
index 38de7cbda61..77034eb0892 100644
--- a/models/asymkey/gpg_key.go
+++ b/models/asymkey/gpg_key.go
@@ -10,9 +10,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
diff --git a/models/asymkey/gpg_key_add.go b/models/asymkey/gpg_key_add.go
index 3969edcc869..aa74f66c557 100644
--- a/models/asymkey/gpg_key_add.go
+++ b/models/asymkey/gpg_key_add.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 )
diff --git a/models/asymkey/gpg_key_commit_verification.go b/models/asymkey/gpg_key_commit_verification.go
index ae5192de9fd..17244076dd2 100644
--- a/models/asymkey/gpg_key_commit_verification.go
+++ b/models/asymkey/gpg_key_commit_verification.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"hash"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
 
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
 )
diff --git a/models/asymkey/gpg_key_import.go b/models/asymkey/gpg_key_import.go
index c9d46d29e56..0189f331f8d 100644
--- a/models/asymkey/gpg_key_import.go
+++ b/models/asymkey/gpg_key_import.go
@@ -6,7 +6,7 @@ package asymkey
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 )
 
 //    __________________  ________   ____  __.
diff --git a/models/asymkey/gpg_key_list.go b/models/asymkey/gpg_key_list.go
index 89548e495ec..e7cff4e3fb5 100644
--- a/models/asymkey/gpg_key_list.go
+++ b/models/asymkey/gpg_key_list.go
@@ -6,7 +6,7 @@ package asymkey
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 )
 
 type GPGKeyList []*GPGKey
diff --git a/models/asymkey/gpg_key_test.go b/models/asymkey/gpg_key_test.go
index e6656cb70d6..5cce164a78f 100644
--- a/models/asymkey/gpg_key_test.go
+++ b/models/asymkey/gpg_key_test.go
@@ -7,10 +7,10 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
diff --git a/models/asymkey/gpg_key_verify.go b/models/asymkey/gpg_key_verify.go
index 5df0265c880..b699a1d3cb2 100644
--- a/models/asymkey/gpg_key_verify.go
+++ b/models/asymkey/gpg_key_verify.go
@@ -8,10 +8,10 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/log"
 )
 
 // This file provides functions relating verifying gpg keys
diff --git a/models/asymkey/key_display.go b/models/asymkey/key_display.go
index ee17553b5b4..0bfba26bac4 100644
--- a/models/asymkey/key_display.go
+++ b/models/asymkey/key_display.go
@@ -6,9 +6,9 @@ package asymkey
 import (
 	"os"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 func GetDisplaySigningKey(key *git.SigningKey) string {
diff --git a/models/asymkey/main_test.go b/models/asymkey/main_test.go
index be71f848d9d..3c64834e274 100644
--- a/models/asymkey/main_test.go
+++ b/models/asymkey/main_test.go
@@ -6,7 +6,7 @@ package asymkey
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/asymkey/ssh_key.go b/models/asymkey/ssh_key.go
index 1873c30859d..e72a88ae8f6 100644
--- a/models/asymkey/ssh_key.go
+++ b/models/asymkey/ssh_key.go
@@ -10,14 +10,14 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"golang.org/x/crypto/ssh"
 	"xorm.io/builder"
diff --git a/models/asymkey/ssh_key_authorized_keys.go b/models/asymkey/ssh_key_authorized_keys.go
index cb2943e31df..8eb5d24c82c 100644
--- a/models/asymkey/ssh_key_authorized_keys.go
+++ b/models/asymkey/ssh_key_authorized_keys.go
@@ -14,10 +14,10 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"golang.org/x/crypto/ssh"
 )
diff --git a/models/asymkey/ssh_key_authorized_keys_test.go b/models/asymkey/ssh_key_authorized_keys_test.go
index 36ed57a6537..0eb4097f85e 100644
--- a/models/asymkey/ssh_key_authorized_keys_test.go
+++ b/models/asymkey/ssh_key_authorized_keys_test.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/asymkey/ssh_key_deploy.go b/models/asymkey/ssh_key_deploy.go
index ea3d93e8c81..e7cbc9253eb 100644
--- a/models/asymkey/ssh_key_deploy.go
+++ b/models/asymkey/ssh_key_deploy.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	"gitea.dev/modules/timeutil"
 
 	"xorm.io/builder"
 )
diff --git a/models/asymkey/ssh_key_fingerprint.go b/models/asymkey/ssh_key_fingerprint.go
index b666469ae87..c495275e210 100644
--- a/models/asymkey/ssh_key_fingerprint.go
+++ b/models/asymkey/ssh_key_fingerprint.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 
 	"golang.org/x/crypto/ssh"
 	"xorm.io/builder"
diff --git a/models/asymkey/ssh_key_parse.go b/models/asymkey/ssh_key_parse.go
index fc39f28624d..d39ddf3c772 100644
--- a/models/asymkey/ssh_key_parse.go
+++ b/models/asymkey/ssh_key_parse.go
@@ -15,9 +15,9 @@ import (
 	"math/big"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"golang.org/x/crypto/ssh"
 )
diff --git a/models/asymkey/ssh_key_principals.go b/models/asymkey/ssh_key_principals.go
index e8b97d306e6..24072667646 100644
--- a/models/asymkey/ssh_key_principals.go
+++ b/models/asymkey/ssh_key_principals.go
@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // CheckPrincipalKeyString strips spaces and returns an error if the given principal contains newlines
@@ -40,7 +40,7 @@ func CheckPrincipalKeyString(ctx context.Context, user *user_model.User, content
 				if !email.IsActivated {
 					continue
 				}
-				if content == email.Email {
+				if strings.EqualFold(content, email.LowerEmail) {
 					return content, nil
 				}
 			}
diff --git a/models/asymkey/ssh_key_test.go b/models/asymkey/ssh_key_test.go
index d7f48ada033..8ecb3f94741 100644
--- a/models/asymkey/ssh_key_test.go
+++ b/models/asymkey/ssh_key_test.go
@@ -12,8 +12,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
 
 	"github.com/42wim/sshsig"
 	"github.com/stretchr/testify/assert"
diff --git a/models/asymkey/ssh_key_verify.go b/models/asymkey/ssh_key_verify.go
index 04917239eed..85dba08746e 100644
--- a/models/asymkey/ssh_key_verify.go
+++ b/models/asymkey/ssh_key_verify.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
 
 	"github.com/42wim/sshsig"
 )
diff --git a/models/auth/access_token.go b/models/auth/access_token.go
index 7578528be87..da451fb044d 100644
--- a/models/auth/access_token.go
+++ b/models/auth/access_token.go
@@ -11,10 +11,10 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	lru "github.com/hashicorp/golang-lru/v2"
 	"xorm.io/builder"
diff --git a/models/auth/access_token_scope.go b/models/auth/access_token_scope.go
index 3eae19b2a53..71a81425a0b 100644
--- a/models/auth/access_token_scope.go
+++ b/models/auth/access_token_scope.go
@@ -8,7 +8,7 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/models/perm"
+	"gitea.dev/models/perm"
 )
 
 // AccessTokenScopeCategory represents the scope category for an access token
diff --git a/models/auth/access_token_test.go b/models/auth/access_token_test.go
index 9ae072cc5fa..504600cd087 100644
--- a/models/auth/access_token_test.go
+++ b/models/auth/access_token_test.go
@@ -6,9 +6,9 @@ package auth_test
 import (
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/auth/auth_token.go b/models/auth/auth_token.go
index 54ff5a0d754..0eaf700c2e2 100644
--- a/models/auth/auth_token.go
+++ b/models/auth/auth_token.go
@@ -6,9 +6,9 @@ package auth
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/auth/main_test.go b/models/auth/main_test.go
index d772ea6b1c8..0d9eddbdfe5 100644
--- a/models/auth/main_test.go
+++ b/models/auth/main_test.go
@@ -6,13 +6,13 @@ package auth_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
-	_ "code.gitea.io/gitea/models/auth"
-	_ "code.gitea.io/gitea/models/perm/access"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
+	_ "gitea.dev/models/auth"
+	_ "gitea.dev/models/perm/access"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/auth/oauth2.go b/models/auth/oauth2.go
index d5a5e2af8e8..f67a5560654 100644
--- a/models/auth/oauth2.go
+++ b/models/auth/oauth2.go
@@ -5,9 +5,8 @@ package auth
 
 import (
 	"context"
-	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/base32"
-	"encoding/base64"
 	"errors"
 	"fmt"
 	"net"
@@ -16,14 +15,15 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	uuid "github.com/google/uuid"
 	"golang.org/x/crypto/bcrypt"
+	"golang.org/x/oauth2"
 	"xorm.io/builder"
 	"xorm.io/xorm"
 )
@@ -31,7 +31,10 @@ import (
 // Authorization codes should expire within 10 minutes per https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2
 const oauth2AuthorizationCodeValidity = 10 * time.Minute
 
-var ErrOAuth2AuthorizationCodeInvalidated = errors.New("oauth2 authorization code already invalidated")
+var (
+	ErrOAuth2AuthorizationCodeInvalidated = errors.New("oauth2 authorization code already invalidated")
+	ErrOAuth2GrantStaleCounter            = errors.New("oauth2 grant state changed during token refresh")
+)
 
 // OAuth2Application represents an OAuth2 client (RFC 6749)
 type OAuth2Application struct {
@@ -151,30 +154,40 @@ func (app *OAuth2Application) ContainsRedirectURI(redirectURI string) bool {
 	// https://www.rfc-editor.org/rfc/rfc6819#section-5.2.3.3
 	// https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
 	// https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-12#section-3.1
-	contains := func(s string) bool {
-		s = strings.TrimSuffix(strings.ToLower(s), "/")
-		for _, u := range app.RedirectURIs {
-			if strings.TrimSuffix(strings.ToLower(u), "/") == s {
+	redirectCandidates := []string{redirectURI}
+	if !app.ConfidentialClient {
+		loopbackRedirect, ok := normalizePublicClientRedirectURI(redirectURI)
+		if ok {
+			redirectCandidates = append(redirectCandidates, loopbackRedirect)
+		}
+	}
+
+	for _, candidate := range redirectCandidates {
+		normalizedCandidate := normalizeRedirectURIForComparison(candidate)
+		for _, registeredURI := range app.RedirectURIs {
+			if normalizeRedirectURIForComparison(registeredURI) == normalizedCandidate {
 				return true
 			}
 		}
-		return false
 	}
-	if !app.ConfidentialClient {
-		uri, err := url.Parse(redirectURI)
-		// ignore port for http loopback uris following https://datatracker.ietf.org/doc/html/rfc8252#section-7.3
-		if err == nil && uri.Scheme == "http" && uri.Port() != "" {
-			ip := net.ParseIP(uri.Hostname())
-			if ip != nil && ip.IsLoopback() {
-				// strip port
-				uri.Host = uri.Hostname()
-				if contains(uri.String()) {
-					return true
-				}
-			}
-		}
+
+	return false
+}
+
+func normalizeRedirectURIForComparison(redirectURI string) string {
+	return strings.TrimSuffix(util.ToLowerASCII(redirectURI), "/")
+}
+
+func normalizePublicClientRedirectURI(redirectURI string) (string, bool) {
+	parsedURI, err := url.Parse(redirectURI)
+	if err != nil || parsedURI.Scheme != "http" || parsedURI.Port() == "" {
+		return "", false
 	}
-	return contains(redirectURI)
+	if ip := net.ParseIP(parsedURI.Hostname()); ip == nil || !ip.IsLoopback() {
+		return "", false
+	}
+	parsedURI.Host = parsedURI.Hostname()
+	return parsedURI.String(), true
 }
 
 // Base32 characters, but lowercased.
@@ -424,22 +437,34 @@ func (code *OAuth2AuthorizationCode) Invalidate(ctx context.Context) error {
 	return nil
 }
 
+func (code *OAuth2AuthorizationCode) requiresCodeVerifier() bool {
+	return code.CodeChallengeMethod != "" || code.CodeChallenge != ""
+}
+
+func deriveCodeChallenge(method, verifier string) (string, bool) {
+	switch method {
+	case "S256":
+		return oauth2.S256ChallengeFromVerifier(verifier), true
+	case "plain":
+		return verifier, true
+	default:
+		return "", false
+	}
+}
+
 // ValidateCodeChallenge validates the given verifier against the saved code challenge. This is part of the PKCE implementation.
 func (code *OAuth2AuthorizationCode) ValidateCodeChallenge(verifier string) bool {
-	switch code.CodeChallengeMethod {
-	case "S256":
-		// base64url(SHA256(verifier)) see https://tools.ietf.org/html/rfc7636#section-4.6
-		h := sha256.Sum256([]byte(verifier))
-		hashedVerifier := base64.RawURLEncoding.EncodeToString(h[:])
-		return hashedVerifier == code.CodeChallenge
-	case "plain":
-		return verifier == code.CodeChallenge
-	case "":
+	if !code.requiresCodeVerifier() {
 		return true
-	default:
-		// unsupported method -> return false
+	}
+	if verifier == "" || code.CodeChallengeMethod == "" {
 		return false
 	}
+	expectedChallenge, ok := deriveCodeChallenge(code.CodeChallengeMethod, verifier)
+	if !ok {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(expectedChallenge), []byte(code.CodeChallenge)) == 1
 }
 
 // GetOAuth2AuthorizationByCode returns an authorization by its code
@@ -504,15 +529,18 @@ func (grant *OAuth2Grant) GenerateNewAuthorizationCode(ctx context.Context, redi
 
 // IncreaseCounter increases the counter and updates the grant
 func (grant *OAuth2Grant) IncreaseCounter(ctx context.Context) error {
-	_, err := db.GetEngine(ctx).ID(grant.ID).Incr("counter").Update(new(OAuth2Grant))
+	affected, err := db.GetEngine(ctx).
+		Where("id = ?", grant.ID).
+		And("counter = ?", grant.Counter).
+		Incr("counter").
+		Update(new(OAuth2Grant))
 	if err != nil {
 		return err
 	}
-	updatedGrant, err := GetOAuth2GrantByID(ctx, grant.ID)
-	if err != nil {
-		return err
+	if affected == 0 {
+		return ErrOAuth2GrantStaleCounter
 	}
-	grant.Counter = updatedGrant.Counter
+	grant.Counter++
 	return nil
 }
 
diff --git a/models/auth/oauth2_list.go b/models/auth/oauth2_list.go
index c55f10b3c85..9a4271fb6db 100644
--- a/models/auth/oauth2_list.go
+++ b/models/auth/oauth2_list.go
@@ -4,7 +4,7 @@
 package auth
 
 import (
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 
 	"xorm.io/builder"
 )
diff --git a/models/auth/oauth2_test.go b/models/auth/oauth2_test.go
index d72e1cb1d52..ea760eb2636 100644
--- a/models/auth/oauth2_test.go
+++ b/models/auth/oauth2_test.go
@@ -7,12 +7,13 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/timeutil"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
 )
 
 func TestOAuth2AuthorizationCode(t *testing.T) {
@@ -116,6 +117,47 @@ func TestOAuth2Application_ContainsRedirect_Slash(t *testing.T) {
 	assert.False(t, app.ContainsRedirectURI("http://127.0.0.1/other"))
 }
 
+func TestOAuth2Application_ContainsRedirectURI_ASCIIOnlyNormalization(t *testing.T) {
+	testCases := []struct {
+		name        string
+		registered  []string
+		redirectURI string
+		allowed     bool
+	}{
+		{
+			name:        "exact-match",
+			registered:  []string{"https://signin.example.test/callback"},
+			redirectURI: "https://signin.example.test/callback",
+			allowed:     true,
+		},
+		{
+			name:        "ascii-case-insensitive",
+			registered:  []string{"https://signin.example.test/callback"},
+			redirectURI: "https://signIN.example.test/callback",
+			allowed:     true,
+		},
+		{
+			name:        "non-ascii-not-folded",
+			registered:  []string{"https://signin.example.test/callback"},
+			redirectURI: "https://signİn.example.test/callback",
+			allowed:     false,
+		},
+		{
+			name:        "loopback-strips-port",
+			registered:  []string{"http://127.0.0.1/callback"},
+			redirectURI: "http://127.0.0.1:12345/callback",
+			allowed:     true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			app := &auth_model.OAuth2Application{RedirectURIs: tc.registered}
+			assert.Equal(t, tc.allowed, app.ContainsRedirectURI(tc.redirectURI))
+		})
+	}
+}
+
 func TestOAuth2Application_ValidateClientSecret(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	app := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Application{ID: 1})
@@ -193,6 +235,16 @@ func TestOAuth2Grant_IncreaseCounter(t *testing.T) {
 	unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Grant{ID: 1, Counter: 2})
 }
 
+func TestOAuth2Grant_IncreaseCounterRejectsStaleCounter(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	grant := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Grant{ID: 1, Counter: 1})
+	stale := *grant
+
+	assert.NoError(t, grant.IncreaseCounter(t.Context()))
+	err := stale.IncreaseCounter(t.Context())
+	assert.ErrorIs(t, err, auth_model.ErrOAuth2GrantStaleCounter)
+}
+
 func TestOAuth2Grant_ScopeContains(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	grant := unittest.AssertExistsAndLoadBean(t, &auth_model.OAuth2Grant{ID: 1, Scope: "openid profile"})
@@ -237,35 +289,38 @@ func TestRevokeOAuth2Grant(t *testing.T) {
 //////////////////// Authorization Code
 
 func TestOAuth2AuthorizationCode_ValidateCodeChallenge(t *testing.T) {
-	// test plain
-	code := &auth_model.OAuth2AuthorizationCode{
-		CodeChallengeMethod: "plain",
-		CodeChallenge:       "test123",
-	}
-	assert.True(t, code.ValidateCodeChallenge("test123"))
-	assert.False(t, code.ValidateCodeChallenge("ierwgjoergjio"))
+	s256Verifier := "s256-verifier"
+	s256Challenge := oauth2.S256ChallengeFromVerifier(s256Verifier)
+	missingVerifierChallenge := oauth2.S256ChallengeFromVerifier("verifier-not-supplied")
 
-	// test S256
-	code = &auth_model.OAuth2AuthorizationCode{
-		CodeChallengeMethod: "S256",
-		CodeChallenge:       "CjvyTLSdR47G5zYenDA-eDWW4lRrO8yvjcWwbD_deOg",
+	testCases := []struct {
+		name      string
+		method    string
+		challenge string
+		verifier  string
+		valid     bool
+	}{
+		{"plain-success", "plain", "plain-secret", "plain-secret", true},
+		{"plain-failure", "plain", "plain-secret", "ierwgjoergjio", false},
+		{"s256-success", "S256", s256Challenge, s256Verifier, true},
+		{"s256-failure", "S256", s256Challenge, "wiogjerogorewngoenrgoiuenorg", false},
+		{"unsupported-method", "monkey", "foiwgjioriogeiogjerger", "foiwgjioriogeiogjerger", false},
+		{"no-pkce-configured", "", "", "", true},
+		{"s256-missing-verifier", "S256", missingVerifierChallenge, "", false},
+		{"plain-missing-verifier", "plain", "plain-secret", "", false},
+		{"missing-method-with-challenge", "", "foierjiogerogerg", "", false},
+		{"missing-method-rejects-even-matching-verifier", "", "foierjiogerogerg", "foierjiogerogerg", false},
 	}
-	assert.True(t, code.ValidateCodeChallenge("N1Zo9-8Rfwhkt68r1r29ty8YwIraXR8eh_1Qwxg7yQXsonBt"))
-	assert.False(t, code.ValidateCodeChallenge("wiogjerogorewngoenrgoiuenorg"))
 
-	// test unknown
-	code = &auth_model.OAuth2AuthorizationCode{
-		CodeChallengeMethod: "monkey",
-		CodeChallenge:       "foiwgjioriogeiogjerger",
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			code := &auth_model.OAuth2AuthorizationCode{
+				CodeChallengeMethod: tc.method,
+				CodeChallenge:       tc.challenge,
+			}
+			assert.Equal(t, tc.valid, code.ValidateCodeChallenge(tc.verifier))
+		})
 	}
-	assert.False(t, code.ValidateCodeChallenge("foiwgjioriogeiogjerger"))
-
-	// test no code challenge
-	code = &auth_model.OAuth2AuthorizationCode{
-		CodeChallengeMethod: "",
-		CodeChallenge:       "foierjiogerogerg",
-	}
-	assert.True(t, code.ValidateCodeChallenge(""))
 }
 
 func TestOAuth2AuthorizationCode_GenerateRedirectURI(t *testing.T) {
diff --git a/models/auth/session.go b/models/auth/session.go
index dbdcde03a0b..6de69a61308 100644
--- a/models/auth/session.go
+++ b/models/auth/session.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 
 	"xorm.io/builder"
 )
diff --git a/models/auth/source.go b/models/auth/source.go
index 7a008f08a8b..278898e49db 100644
--- a/models/auth/source.go
+++ b/models/auth/source.go
@@ -9,12 +9,12 @@ import (
 	"fmt"
 	"reflect"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 	"xorm.io/xorm"
@@ -100,7 +100,7 @@ var registeredConfigs = map[Type]func() Config{}
 
 // RegisterTypeConfig register a config for a provided type
 func RegisterTypeConfig(typ Type, exemplar Config) {
-	if reflect.TypeOf(exemplar).Kind() == reflect.Ptr {
+	if reflect.TypeOf(exemplar).Kind() == reflect.Pointer {
 		// Pointer:
 		registeredConfigs[typ] = func() Config {
 			return reflect.New(reflect.ValueOf(exemplar).Elem().Type()).Interface().(Config)
diff --git a/models/auth/source_test.go b/models/auth/source_test.go
index fbd663a64fa..b09fc7f4b06 100644
--- a/models/auth/source_test.go
+++ b/models/auth/source_test.go
@@ -7,9 +7,9 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/json"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/auth/twofactor.go b/models/auth/twofactor.go
index 80c34ba6adb..9c0208f47f5 100644
--- a/models/auth/twofactor.go
+++ b/models/auth/twofactor.go
@@ -13,11 +13,11 @@ import (
 	"encoding/hex"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/secret"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/secret"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"github.com/pquerna/otp/totp"
 	"golang.org/x/crypto/pbkdf2"
diff --git a/models/auth/webauthn.go b/models/auth/webauthn.go
index 7bd79ed3f52..11297556d25 100644
--- a/models/auth/webauthn.go
+++ b/models/auth/webauthn.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"github.com/go-webauthn/webauthn/protocol"
 	"github.com/go-webauthn/webauthn/webauthn"
diff --git a/models/auth/webauthn_test.go b/models/auth/webauthn_test.go
index 41c5f6de94a..a6483192261 100644
--- a/models/auth/webauthn_test.go
+++ b/models/auth/webauthn_test.go
@@ -6,8 +6,8 @@ package auth_test
 import (
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
 
 	"github.com/go-webauthn/webauthn/webauthn"
 	"github.com/stretchr/testify/assert"
diff --git a/models/avatars/avatar.go b/models/avatars/avatar.go
index 9c56e0f9a0f..7ecb55183c5 100644
--- a/models/avatars/avatar.go
+++ b/models/avatars/avatar.go
@@ -14,10 +14,10 @@ import (
 	"strings"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"strk.kbt.io/projects/go/libravatar"
 )
diff --git a/models/avatars/avatar_test.go b/models/avatars/avatar_test.go
index 43a062cc2a1..cfc578d27b9 100644
--- a/models/avatars/avatar_test.go
+++ b/models/avatars/avatar_test.go
@@ -6,10 +6,10 @@ package avatars_test
 import (
 	"testing"
 
-	avatars_model "code.gitea.io/gitea/models/avatars"
-	system_model "code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/setting/config"
+	avatars_model "gitea.dev/models/avatars"
+	system_model "gitea.dev/models/system"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/setting/config"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/avatars/main_test.go b/models/avatars/main_test.go
index c721a7dc2ac..ce48dada28a 100644
--- a/models/avatars/main_test.go
+++ b/models/avatars/main_test.go
@@ -6,11 +6,11 @@ package avatars_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/activities"
-	_ "code.gitea.io/gitea/models/perm/access"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/activities"
+	_ "gitea.dev/models/perm/access"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/db/collation.go b/models/db/collation.go
index 203f7cbfe47..d9a54e57689 100644
--- a/models/db/collation.go
+++ b/models/db/collation.go
@@ -8,11 +8,10 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
@@ -27,7 +26,7 @@ type CheckCollationsResult struct {
 	InconsistentCollationColumns []string
 }
 
-func findAvailableCollationsMySQL(x *xorm.Engine) (ret container.Set[string], err error) {
+func findAvailableCollationsMySQL(x EngineMigration) (ret container.Set[string], err error) {
 	var res []struct {
 		Collation string
 	}
@@ -41,7 +40,7 @@ func findAvailableCollationsMySQL(x *xorm.Engine) (ret container.Set[string], er
 	return ret, nil
 }
 
-func findAvailableCollationsMSSQL(x *xorm.Engine) (ret container.Set[string], err error) {
+func findAvailableCollationsMSSQL(x EngineMigration) (ret container.Set[string], err error) {
 	var res []struct {
 		Name string
 	}
@@ -55,7 +54,7 @@ func findAvailableCollationsMSSQL(x *xorm.Engine) (ret container.Set[string], er
 	return ret, nil
 }
 
-func CheckCollations(x *xorm.Engine) (*CheckCollationsResult, error) {
+func CheckCollations(x EngineMigration) (*CheckCollationsResult, error) {
 	dbTables, err := x.DBMetas()
 	if err != nil {
 		return nil, err
@@ -143,7 +142,7 @@ func CheckCollationsDefaultEngine() (*CheckCollationsResult, error) {
 	return CheckCollations(xormEngine)
 }
 
-func alterDatabaseCollation(x *xorm.Engine, collation string) error {
+func alterDatabaseCollation(x EngineMigration, collation string) error {
 	if x.Dialect().URI().DBType == schemas.MYSQL {
 		_, err := x.Exec("ALTER DATABASE CHARACTER SET utf8mb4 COLLATE " + collation)
 		return err
@@ -156,7 +155,7 @@ func alterDatabaseCollation(x *xorm.Engine, collation string) error {
 }
 
 // preprocessDatabaseCollation checks database & table column collation, and alter the database collation if needed
-func preprocessDatabaseCollation(x *xorm.Engine) {
+func preprocessDatabaseCollation(x EngineMigration) {
 	r, err := CheckCollations(x)
 	if err != nil {
 		log.Error("Failed to check database collation: %v", err)
diff --git a/models/db/common.go b/models/db/common.go
index b3c43f8b626..ff17962fa46 100644
--- a/models/db/common.go
+++ b/models/db/common.go
@@ -6,8 +6,8 @@ package db
 import (
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/db/conn.go b/models/db/conn.go
index de6f3cd5ec7..34349124178 100644
--- a/models/db/conn.go
+++ b/models/db/conn.go
@@ -10,10 +10,11 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 type ConnOptions struct {
@@ -31,7 +32,9 @@ type ConnOptions struct {
 }
 
 type SQLiteConnStrOptions struct {
-	FilePath    string
+	FilePath string
+	// how long a concurrent query can wait for others (milliseconds),
+	// if timeout is reached, the error is something like "database is locked (SQLITE_BUSY)"
 	BusyTimeout int
 	JournalMode string
 }
@@ -52,10 +55,21 @@ func GlobalConnOptions() ConnOptions {
 	}
 }
 
-const sqlDriverPostgresSchema = "postgresschema"
+const (
+	sqlDriverPostgresSchema = "postgresschema"
+	sqlDriverSQLite3        = "sqlite3" // although database type also has "sqlite3", they are different, for different purposes
+)
 
 var makeSQLiteConnStr = func(opts SQLiteConnStrOptions) (string, string, error) {
-	return "", "", errors.New(`this Gitea binary was not built with SQLite3 support, get an official release or rebuild with: -tags sqlite,sqlite_unlock_notify`)
+	return "", "", errors.New(`this Gitea binary was not built with SQLite3 support, get an official release or rebuild with correct "-tags"`)
+}
+
+func registerSQLiteConnStrMaker(fn func(opts SQLiteConnStrOptions) (string, string, error)) {
+	if slices.Contains(setting.SupportedDatabaseTypes, setting.DatabaseTypeSQLite3) {
+		panic("another sqlite3 driver has been registered")
+	}
+	setting.SupportedDatabaseTypes = append(setting.SupportedDatabaseTypes, setting.DatabaseTypeSQLite3)
+	makeSQLiteConnStr = fn
 }
 
 func ConnStrDefaultDatabase(opts ConnOptions) (string, string, error) {
diff --git a/models/db/context.go b/models/db/context.go
index 8bb14f1389b..bb2001673d0 100644
--- a/models/db/context.go
+++ b/models/db/context.go
@@ -11,18 +11,21 @@ import (
 	"slices"
 	"sync"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"xorm.io/builder"
 	"xorm.io/xorm"
 )
 
-type engineContextKeyType struct{}
+type contextKey struct{ key string }
 
-var engineContextKey = engineContextKeyType{}
+var (
+	contextKeyEngine       = contextKey{"engine"}
+	ContextKeyTestFixtures = contextKey{"test-fixtures"}
+)
 
 func withContextEngine(ctx context.Context, e Engine) context.Context {
-	return context.WithValue(ctx, engineContextKey, e)
+	return context.WithValue(ctx, contextKeyEngine, e)
 }
 
 var (
@@ -68,7 +71,7 @@ func contextSafetyCheck(e Engine) {
 
 // GetEngine gets an existing db Engine/Statement or creates a new Session
 func GetEngine(ctx context.Context) Engine {
-	if engine, ok := ctx.Value(engineContextKey).(Engine); ok {
+	if engine, ok := ctx.Value(contextKeyEngine).(Engine); ok {
 		// if reusing the existing session, need to do "contextSafetyCheck" because the Iterate creates a "autoResetStatement=false" session
 		contextSafetyCheck(engine)
 		return engine
@@ -309,7 +312,7 @@ func InTransaction(ctx context.Context) bool {
 }
 
 func getTransactionSession(ctx context.Context) *xorm.Session {
-	e, _ := ctx.Value(engineContextKey).(Engine)
+	e, _ := ctx.Value(contextKeyEngine).(Engine)
 	if sess, ok := e.(*xorm.Session); ok && sess.IsInTx() {
 		return sess
 	}
diff --git a/models/db/context_test.go b/models/db/context_test.go
index 1719a7bfe85..7804a15d1a3 100644
--- a/models/db/context_test.go
+++ b/models/db/context_test.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/db/convert.go b/models/db/convert.go
index 374dbfd8a82..125449705c0 100644
--- a/models/db/convert.go
+++ b/models/db/convert.go
@@ -6,7 +6,7 @@ package db
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"xorm.io/xorm"
 	"xorm.io/xorm/convert"
diff --git a/models/db/driver_postgresschema.go b/models/db/driver_postgresschema.go
index b6735007631..ad2b5abc04a 100644
--- a/models/db/driver_postgresschema.go
+++ b/models/db/driver_postgresschema.go
@@ -8,7 +8,7 @@ import (
 	"database/sql/driver"
 	"sync"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/lib/pq"
 	"xorm.io/xorm/dialects"
diff --git a/models/db/driver_sqlite_mattn.go b/models/db/driver_sqlite_mattn.go
index 4988a43d3f2..a25cb099901 100644
--- a/models/db/driver_sqlite_mattn.go
+++ b/models/db/driver_sqlite_mattn.go
@@ -1,8 +1,8 @@
-//go:build sqlite
-
 // Copyright 2026 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
+//go:build sqlite_mattn && sqlite_unlock_notify
+
 package db
 
 import (
@@ -10,14 +10,11 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
-
 	_ "github.com/mattn/go-sqlite3"
 )
 
 func init() {
-	setting.SupportedDatabaseTypes = append(setting.SupportedDatabaseTypes, "sqlite3")
-	makeSQLiteConnStr = makeSQLiteConnStrMattnCGO
+	registerSQLiteConnStrMaker(makeSQLiteConnStrMattnCGO)
 }
 
 func makeSQLiteConnStrMattnCGO(opts SQLiteConnStrOptions) (string, string, error) {
@@ -30,5 +27,5 @@ func makeSQLiteConnStrMattnCGO(opts SQLiteConnStrOptions) (string, string, error
 		params = append(params, "_journal_mode="+opts.JournalMode)
 	}
 	connStr := fmt.Sprintf("file:%s?%s", opts.FilePath, strings.Join(params, "&"))
-	return "sqlite3", connStr, nil
+	return sqlDriverSQLite3, connStr, nil
 }
diff --git a/models/db/driver_sqlite_modernc.go b/models/db/driver_sqlite_modernc.go
new file mode 100644
index 00000000000..6bd5498a555
--- /dev/null
+++ b/models/db/driver_sqlite_modernc.go
@@ -0,0 +1,41 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build !sqlite_mattn
+
+// modernc driver is chosen as the default one (compared to mattn, ncruces)
+// * mattn was used as default, but it requires CGO
+// * the CI times are almost the same for these three (race detector must be disabled)
+// * modernc increases the binary size about 2MB, ncruces increases about 7MB
+// * compiling time: modernc is slightly slower than mattn, ncruces is the slowest
+
+package db
+
+import (
+	"database/sql"
+	"fmt"
+	"strings"
+
+	"modernc.org/sqlite"
+)
+
+func init() {
+	// this driver contains huge amount of Golang code, so it is much slower when "-race" check is enabled.
+	registerSQLiteConnStrMaker(makeSQLiteConnStrModerncCCGO)
+	sql.Register(sqlDriverSQLite3, &sqlite.Driver{})
+}
+
+func makeSQLiteConnStrModerncCCGO(opts SQLiteConnStrOptions) (string, string, error) {
+	var params []string
+	// TODO: there is a changed behavior from mattn driver:
+	// * mattn driver can wait for pretty long time for concurrent accesses (not limited by the busy timeout)
+	// * but other drivers will report something like "database is locked (5) (SQLITE_BUSY)" if the timeout is reached
+	// Maybe we need to relax the busy timeout to a reasonable long time in the future
+	params = append(params, fmt.Sprintf("_pragma=busy_timeout(%d)", opts.BusyTimeout))
+	params = append(params, "_txlock=immediate")
+	if opts.JournalMode != "" {
+		params = append(params, fmt.Sprintf("_pragma=journal_mode(%s)", opts.JournalMode))
+	}
+	connStr := fmt.Sprintf("file:%s?%s", opts.FilePath, strings.Join(params, "&"))
+	return sqlDriverSQLite3, connStr, nil
+}
diff --git a/models/db/engine.go b/models/db/engine.go
index fbcc3fa15e8..d4ac0b4aca0 100755
--- a/models/db/engine.go
+++ b/models/db/engine.go
@@ -16,6 +16,10 @@ import (
 	_ "github.com/microsoft/go-mssqldb" // Needed for the MSSQL driver
 
 	"xorm.io/xorm"
+	"xorm.io/xorm/core"
+	"xorm.io/xorm/dialects"
+	"xorm.io/xorm/names"
+	"xorm.io/xorm/schemas"
 )
 
 var (
@@ -33,6 +37,7 @@ type Engine interface {
 	Truncate(...any) (int64, error)
 	Exec(...any) (sql.Result, error)
 	Find(any, ...any) error
+	FindAndCount(any, ...any) (int64, error)
 	Get(beans ...any) (bool, error)
 	ID(any) *xorm.Session
 	In(string, ...any) *xorm.Session
@@ -61,9 +66,41 @@ type Engine interface {
 	IsTableExist(tableNameOrBean any) (bool, error)
 }
 
+// Session represents a xorm session interface, used as an abstraction over *xorm.Session.
+type Session interface {
+	Engine
+	And(query any, args ...any) *xorm.Session
+	Begin() error
+	Close() error
+	Commit() error
+	IsInTx() bool
+	Rollback() error
+	Engine() *xorm.Engine
+}
+
+// EngineMigration is a xorm engine interface used for migrations.
+// It extends Engine with additional methods that are only available on the engine (not on the session)
+// and are needed by the migration packages.
+type EngineMigration interface {
+	Engine
+	Close() error
+	DB() *core.DB
+	DBMetas() ([]*schemas.Table, error)
+	Dialect() dialects.Dialect
+	DropTables(beans ...any) error
+	NewSession() *xorm.Session
+	QueryInterface(sqlOrArgs ...any) ([]map[string]any, error)
+	SetMapper(mapper names.Mapper)
+	SyncWithOptions(opts xorm.SyncOptions, beans ...any) (*xorm.SyncResult, error)
+	TableInfo(bean any) (*schemas.Table, error)
+	TableName(bean any, includeSchema ...bool) string
+}
+
 var (
-	_ Engine = (*xorm.Engine)(nil)
-	_ Engine = (*xorm.Session)(nil)
+	_ Engine          = (*xorm.Engine)(nil)
+	_ Engine          = (*xorm.Session)(nil)
+	_ Session         = (*xorm.Session)(nil)
+	_ EngineMigration = (*xorm.Engine)(nil)
 )
 
 // RegisterModel registers model, if initFuncs provided, it will be invoked after data model sync
diff --git a/models/db/engine_dump.go b/models/db/engine_dump.go
index 1d8d555b448..016bc99287a 100644
--- a/models/db/engine_dump.go
+++ b/models/db/engine_dump.go
@@ -4,7 +4,7 @@
 package db
 
 import (
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"xorm.io/xorm/schemas"
 )
diff --git a/models/db/engine_hook.go b/models/db/engine_hook.go
index 8709a2c2a13..00318d28e76 100644
--- a/models/db/engine_hook.go
+++ b/models/db/engine_hook.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"time"
 
-	"code.gitea.io/gitea/modules/gtprof"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/gtprof"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"xorm.io/xorm/contexts"
 )
@@ -22,11 +22,17 @@ type EngineHook struct {
 var _ contexts.Hook = (*EngineHook)(nil)
 
 func (*EngineHook) BeforeProcess(c *contexts.ContextHook) (context.Context, error) {
+	if c.Ctx.Value(ContextKeyTestFixtures) != nil {
+		return c.Ctx, nil
+	}
 	ctx, _ := gtprof.GetTracer().Start(c.Ctx, gtprof.TraceSpanDatabase)
 	return ctx, nil
 }
 
 func (h *EngineHook) AfterProcess(c *contexts.ContextHook) error {
+	if c.Ctx.Value(ContextKeyTestFixtures) != nil {
+		return nil
+	}
 	span := gtprof.GetContextSpan(c.Ctx)
 	if span != nil {
 		// Do not record SQL parameters here:
diff --git a/models/db/engine_init.go b/models/db/engine_init.go
index 65192d3327a..a7ae3488da4 100644
--- a/models/db/engine_init.go
+++ b/models/db/engine_init.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"xorm.io/xorm"
 	"xorm.io/xorm/names"
@@ -92,7 +92,7 @@ func UnsetDefaultEngine() {
 // When called from the "doctor" command, the migration function is a version check
 // that prevents the doctor from fixing anything in the database if the migration level
 // is different from the expected value.
-func InitEngineWithMigration(ctx context.Context, migrateFunc func(context.Context, *xorm.Engine) error) (err error) {
+func InitEngineWithMigration(ctx context.Context, migrateFunc func(context.Context, EngineMigration) error) (err error) {
 	if err = InitEngine(ctx); err != nil {
 		return err
 	}
diff --git a/models/db/engine_test.go b/models/db/engine_test.go
index 6a6264b5353..69e30aaa4bf 100644
--- a/models/db/engine_test.go
+++ b/models/db/engine_test.go
@@ -7,12 +7,12 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
 
-	_ "code.gitea.io/gitea/cmd" // for TestPrimaryKeys
+	_ "gitea.dev/cmd" // for TestPrimaryKeys
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -60,7 +60,7 @@ func TestPrimaryKeys(t *testing.T) {
 	//   https://github.com/go-gitea/gitea/issues/21086
 	//   https://github.com/go-gitea/gitea/issues/16802
 	// To avoid creating tables without primary key again, this test will check them.
-	// Import "code.gitea.io/gitea/cmd" to make sure each db.RegisterModel in init functions has been called.
+	// Import "gitea.dev/cmd" to make sure each db.RegisterModel in init functions has been called.
 
 	beans, err := db.NamesToBean()
 	require.NoError(t, err)
diff --git a/models/db/error.go b/models/db/error.go
index d47c7adac49..e44886dcd71 100644
--- a/models/db/error.go
+++ b/models/db/error.go
@@ -6,7 +6,7 @@ package db
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // ErrCancelled represents an error due to context cancellation
diff --git a/models/db/index.go b/models/db/index.go
index 7a11645bd45..488e188aca9 100644
--- a/models/db/index.go
+++ b/models/db/index.go
@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"strconv"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // ResourceIndex represents a resource index which could be used as issue/release and others
diff --git a/models/db/index_test.go b/models/db/index_test.go
index e2af7f35bb1..5dece7e1beb 100644
--- a/models/db/index_test.go
+++ b/models/db/index_test.go
@@ -9,8 +9,8 @@ import (
 	"fmt"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/db/install/db.go b/models/db/install/db.go
index a84e5e54fe6..1fee5ff9db4 100644
--- a/models/db/install/db.go
+++ b/models/db/install/db.go
@@ -6,8 +6,8 @@ package install
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
 )
 
 // CheckDatabaseConnection checks the database connection
diff --git a/models/db/iterate.go b/models/db/iterate.go
index 481be1b4b77..171ad9f5576 100644
--- a/models/db/iterate.go
+++ b/models/db/iterate.go
@@ -6,7 +6,7 @@ package db
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"xorm.io/builder"
 )
diff --git a/models/db/iterate_test.go b/models/db/iterate_test.go
index 21bb0c0b4bb..d6d50730875 100644
--- a/models/db/iterate_test.go
+++ b/models/db/iterate_test.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/db/list.go b/models/db/list.go
index 5c005a03501..47c163c1d72 100644
--- a/models/db/list.go
+++ b/models/db/list.go
@@ -6,10 +6,9 @@ package db
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
 const (
@@ -25,7 +24,7 @@ type Paginator interface {
 }
 
 // SetSessionPagination sets pagination for a database session
-func SetSessionPagination(sess Engine, p Paginator) *xorm.Session {
+func SetSessionPagination(sess Engine, p Paginator) Session {
 	skip, take := p.GetSkipTake()
 
 	return sess.Limit(take, skip)
diff --git a/models/db/list_test.go b/models/db/list_test.go
index ddcfff1f88d..959cb91bfb6 100644
--- a/models/db/list_test.go
+++ b/models/db/list_test.go
@@ -6,9 +6,9 @@ package db_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 	"xorm.io/builder"
diff --git a/models/db/log.go b/models/db/log.go
index 4f563a4df04..55b03c81646 100644
--- a/models/db/log.go
+++ b/models/db/log.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	xormlog "xorm.io/xorm/log"
 )
diff --git a/models/db/main_test.go b/models/db/main_test.go
index 7d80b400fe5..81cd92a9f68 100644
--- a/models/db/main_test.go
+++ b/models/db/main_test.go
@@ -6,10 +6,10 @@ package db_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/repo"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/repo"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/db/name.go b/models/db/name.go
index 48c7fdbce5f..dc449ba9d7a 100644
--- a/models/db/name.go
+++ b/models/db/name.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // ErrNameReserved represents a "reserved name" error.
diff --git a/models/db/paginator/main_test.go b/models/db/paginator/main_test.go
index 47993aed6be..2f5ef392df3 100644
--- a/models/db/paginator/main_test.go
+++ b/models/db/paginator/main_test.go
@@ -6,7 +6,7 @@ package paginator
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/db/paginator/paginator_test.go b/models/db/paginator/paginator_test.go
index 20602212d98..7511ed5ea8c 100644
--- a/models/db/paginator/paginator_test.go
+++ b/models/db/paginator/paginator_test.go
@@ -6,8 +6,8 @@ package paginator
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/db/sequence.go b/models/db/sequence.go
index 9adc5113acc..446f344fbc1 100644
--- a/models/db/sequence.go
+++ b/models/db/sequence.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"regexp"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // CountBadSequences looks for broken sequences from recreate-table mistakes
diff --git a/models/dbfs/dbfile.go b/models/dbfs/dbfile.go
index a6981cb7d6a..8ff836452e8 100644
--- a/models/dbfs/dbfile.go
+++ b/models/dbfs/dbfile.go
@@ -14,7 +14,7 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 )
 
 var defaultFileBlockSize int64 = 32 * 1024
diff --git a/models/dbfs/dbfs.go b/models/dbfs/dbfs.go
index 3f768b5339d..92581857f92 100644
--- a/models/dbfs/dbfs.go
+++ b/models/dbfs/dbfs.go
@@ -10,7 +10,7 @@ import (
 	"path"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 )
 
 /*
diff --git a/models/dbfs/dbfs_test.go b/models/dbfs/dbfs_test.go
index ca57ebe171a..7dff86153f0 100644
--- a/models/dbfs/dbfs_test.go
+++ b/models/dbfs/dbfs_test.go
@@ -9,7 +9,7 @@ import (
 	"os"
 	"testing"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/dbfs/main_test.go b/models/dbfs/main_test.go
index 537ba0935d6..7c737a1b744 100644
--- a/models/dbfs/main_test.go
+++ b/models/dbfs/main_test.go
@@ -6,7 +6,7 @@ package dbfs
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/git/branch.go b/models/git/branch.go
index 698c43f1472..17433fcff81 100644
--- a/models/git/branch.go
+++ b/models/git/branch.go
@@ -8,16 +8,16 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -261,7 +261,7 @@ func UpdateBranch(ctx context.Context, repoID, pusherID int64, branchName string
 		Cols("commit_id, commit_message, pusher_id, commit_time, is_deleted, updated_unix").
 		Update(&Branch{
 			CommitID:      commit.ID.String(),
-			CommitMessage: commit.Summary(),
+			CommitMessage: commit.MessageTitle(),
 			PusherID:      pusherID,
 			CommitTime:    timeutil.TimeStamp(commit.Committer.When.Unix()),
 			IsDeleted:     false,
diff --git a/models/git/branch_list.go b/models/git/branch_list.go
index 1445f3a5a02..45b02d9d33d 100644
--- a/models/git/branch_list.go
+++ b/models/git/branch_list.go
@@ -6,10 +6,10 @@ package git
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
 
 	"xorm.io/builder"
 )
@@ -101,7 +101,7 @@ func (opts FindBranchOptions) ToOrders() string {
 func FindBranchNames(ctx context.Context, opts FindBranchOptions) ([]string, error) {
 	sess := db.GetEngine(ctx).Select("name").Where(opts.ToConds())
 	if opts.PageSize > 0 && !opts.IsListAll() {
-		sess = db.SetSessionPagination(sess, &opts.ListOptions)
+		db.SetSessionPagination(sess, &opts.ListOptions)
 	}
 
 	var branches []string
diff --git a/models/git/branch_test.go b/models/git/branch_test.go
index 3832df93509..54ee652abd7 100644
--- a/models/git/branch_test.go
+++ b/models/git/branch_test.go
@@ -8,15 +8,15 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -36,7 +36,7 @@ func TestAddDeletedBranch(t *testing.T) {
 
 	commit := &git.Commit{
 		ID:            git.MustIDFromString(secondBranch.CommitID),
-		CommitMessage: secondBranch.CommitMessage,
+		CommitMessage: git.CommitMessage{MessageRaw: secondBranch.CommitMessage},
 		Committer: &git.Signature{
 			When: secondBranch.CommitTime.AsLocalTime(),
 		},
diff --git a/models/git/commit_status.go b/models/git/commit_status.go
index 2ae5937a3d8..918e45c207c 100644
--- a/models/git/commit_status.go
+++ b/models/git/commit_status.go
@@ -13,19 +13,18 @@ import (
 	"strings"
 	"time"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/translation"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/translation"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
 // CommitStatus holds a single Status of a single Commit
@@ -329,7 +328,7 @@ type CommitStatusIndex struct {
 	MaxIndex int64  `xorm:"index"`
 }
 
-func makeRepoCommitQuery(ctx context.Context, repoID int64, sha string) *xorm.Session {
+func makeRepoCommitQuery(ctx context.Context, repoID int64, sha string) db.Session {
 	return db.GetEngine(ctx).Table(&CommitStatus{}).
 		Where("repo_id = ?", repoID).And("sha = ?", sha)
 }
@@ -337,12 +336,10 @@ func makeRepoCommitQuery(ctx context.Context, repoID int64, sha string) *xorm.Se
 // GetLatestCommitStatus returns all statuses with a unique context for a given commit.
 func GetLatestCommitStatus(ctx context.Context, repoID int64, sha string, listOptions db.ListOptions) ([]*CommitStatus, error) {
 	indices := make([]int64, 0, 10)
-	sess := makeRepoCommitQuery(ctx, repoID, sha).
-		Select("max( `index` ) as `index`").
-		GroupBy("context_hash").
-		OrderBy("max( `index` ) desc")
+	sess := makeRepoCommitQuery(ctx, repoID, sha)
+	sess.Select("max( `index` ) as `index`").GroupBy("context_hash").OrderBy("max( `index` ) desc")
 	if !listOptions.IsListAll() {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 	}
 	if err := sess.Find(&indices); err != nil {
 		return nil, err
@@ -372,7 +369,7 @@ func GetLatestCommitStatusForPairs(ctx context.Context, repoSHAs []RepoSHA) (map
 
 	results := make([]result, 0, len(repoSHAs))
 
-	getBase := func() *xorm.Session {
+	getBase := func() db.Session {
 		return db.GetEngine(ctx).Table(&CommitStatus{})
 	}
 
@@ -425,7 +422,7 @@ func GetLatestCommitStatusForRepoCommitIDs(ctx context.Context, repoID int64, co
 		SHA   string
 	}
 
-	getBase := func() *xorm.Session {
+	getBase := func() db.Session {
 		return db.GetEngine(ctx).Table(&CommitStatus{}).Where("repo_id = ?", repoID)
 	}
 	results := make([]result, 0, len(commitIDs))
diff --git a/models/git/commit_status_summary.go b/models/git/commit_status_summary.go
index dd416fa0159..4ab1beec923 100644
--- a/models/git/commit_status_summary.go
+++ b/models/git/commit_status_summary.go
@@ -6,9 +6,9 @@ package git
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/setting"
 
 	"xorm.io/builder"
 )
diff --git a/models/git/commit_status_test.go b/models/git/commit_status_test.go
index f18d3470b02..bb0858c44ed 100644
--- a/models/git/commit_status_test.go
+++ b/models/git/commit_status_test.go
@@ -8,14 +8,14 @@ import (
 	"testing"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/gitrepo"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/gitrepo"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/git/lfs.go b/models/git/lfs.go
index 1f3d086ac25..1cfb9331001 100644
--- a/models/git/lfs.go
+++ b/models/git/lfs.go
@@ -7,15 +7,15 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/git/lfs_lock.go b/models/git/lfs_lock.go
index 8e63598fb28..92fb06f5b68 100644
--- a/models/git/lfs_lock.go
+++ b/models/git/lfs_lock.go
@@ -10,11 +10,11 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // LFSLock represents a git lfs lock of repository.
diff --git a/models/git/lfs_lock_list.go b/models/git/lfs_lock_list.go
index cab1e61cabc..85cce753c87 100644
--- a/models/git/lfs_lock_list.go
+++ b/models/git/lfs_lock_list.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
 )
 
 // LFSLockList is a list of LFSLock
diff --git a/models/git/lfs_lock_test.go b/models/git/lfs_lock_test.go
index c88e89be473..ca875534911 100644
--- a/models/git/lfs_lock_test.go
+++ b/models/git/lfs_lock_test.go
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/git/lfs_test.go b/models/git/lfs_test.go
index 4c0242f439c..17772cdd3c2 100644
--- a/models/git/lfs_test.go
+++ b/models/git/lfs_test.go
@@ -10,14 +10,14 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/git/main_test.go b/models/git/main_test.go
index aab1fa9a26f..98f0bf32ee3 100644
--- a/models/git/main_test.go
+++ b/models/git/main_test.go
@@ -6,11 +6,11 @@ package git_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/git/protected_branch.go b/models/git/protected_branch.go
index f242f94f7b7..ec710a710e2 100644
--- a/models/git/protected_branch.go
+++ b/models/git/protected_branch.go
@@ -9,17 +9,17 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -43,6 +43,9 @@ type ProtectedBranch struct {
 	WhitelistDeployKeys           bool     `xorm:"NOT NULL DEFAULT false"`
 	MergeWhitelistUserIDs         []int64  `xorm:"JSON TEXT"`
 	MergeWhitelistTeamIDs         []int64  `xorm:"JSON TEXT"`
+	EnableBypassAllowlist         bool     `xorm:"NOT NULL DEFAULT false"`
+	BypassAllowlistUserIDs        []int64  `xorm:"JSON TEXT"`
+	BypassAllowlistTeamIDs        []int64  `xorm:"JSON TEXT"`
 	CanForcePush                  bool     `xorm:"NOT NULL DEFAULT false"`
 	EnableForcePushAllowlist      bool     `xorm:"NOT NULL DEFAULT false"`
 	ForcePushAllowlistUserIDs     []int64  `xorm:"JSON TEXT"`
@@ -204,6 +207,29 @@ func IsUserMergeWhitelisted(ctx context.Context, protectBranch *ProtectedBranch,
 	return in
 }
 
+// CanBypassBranchProtection reports whether the user can bypass branch protection checks (status checks, approvals, protected files)
+// Either a repo admin (when not blocked) or a user/team on the bypass allowlist can bypass.
+func CanBypassBranchProtection(ctx context.Context, protectBranch *ProtectedBranch, user *user_model.User, isRepoAdmin bool) bool {
+	if isRepoAdmin && !protectBranch.BlockAdminMergeOverride {
+		return true
+	}
+	if !protectBranch.EnableBypassAllowlist {
+		return false
+	}
+	if slices.Contains(protectBranch.BypassAllowlistUserIDs, user.ID) {
+		return true
+	}
+	if len(protectBranch.BypassAllowlistTeamIDs) == 0 {
+		return false
+	}
+	in, err := organization.IsUserInTeams(ctx, user.ID, protectBranch.BypassAllowlistTeamIDs)
+	if err != nil {
+		log.Error("IsUserInTeams failed: userID=%d, repoID=%d, allowlistTeamIDs=%v, err=%v", user.ID, protectBranch.RepoID, protectBranch.BypassAllowlistTeamIDs, err)
+		return false
+	}
+	return in
+}
+
 // IsUserOfficialReviewer check if user is official reviewer for the branch (counts towards required approvals)
 func IsUserOfficialReviewer(ctx context.Context, protectBranch *ProtectedBranch, user *user_model.User) (bool, error) {
 	repo, err := repo_model.GetRepositoryByID(ctx, protectBranch.RepoID)
@@ -347,6 +373,9 @@ type WhitelistOptions struct {
 
 	ApprovalsUserIDs []int64
 	ApprovalsTeamIDs []int64
+
+	BypassUserIDs []int64
+	BypassTeamIDs []int64
 }
 
 // UpdateProtectBranch saves branch protection options of repository.
@@ -387,6 +416,12 @@ func UpdateProtectBranch(ctx context.Context, repo *repo_model.Repository, prote
 	}
 	protectBranch.ApprovalsWhitelistUserIDs = whitelist
 
+	whitelist, err = updateUserWhitelist(ctx, repo, protectBranch.BypassAllowlistUserIDs, opts.BypassUserIDs)
+	if err != nil {
+		return err
+	}
+	protectBranch.BypassAllowlistUserIDs = whitelist
+
 	// if the repo is in an organization
 	whitelist, err = updateTeamWhitelist(ctx, repo, protectBranch.WhitelistTeamIDs, opts.TeamIDs)
 	if err != nil {
@@ -412,6 +447,12 @@ func UpdateProtectBranch(ctx context.Context, repo *repo_model.Repository, prote
 	}
 	protectBranch.ApprovalsWhitelistTeamIDs = whitelist
 
+	whitelist, err = updateTeamWhitelist(ctx, repo, protectBranch.BypassAllowlistTeamIDs, opts.BypassTeamIDs)
+	if err != nil {
+		return err
+	}
+	protectBranch.BypassAllowlistTeamIDs = whitelist
+
 	// Looks like it's a new rule
 	if protectBranch.ID == 0 {
 		// as it's a new rule and if priority was not set, we need to calc it.
diff --git a/models/git/protected_branch_list.go b/models/git/protected_branch_list.go
index 6b282835a46..9defb708401 100644
--- a/models/git/protected_branch_list.go
+++ b/models/git/protected_branch_list.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"sort"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/optional"
 )
 
 type ProtectedBranchRules []*ProtectedBranch
diff --git a/models/git/protected_branch_test.go b/models/git/protected_branch_test.go
index 3aa1d7daa8a..da642d6aad7 100644
--- a/models/git/protected_branch_test.go
+++ b/models/git/protected_branch_test.go
@@ -6,9 +6,10 @@ package git
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -153,3 +154,51 @@ func TestNewProtectBranchPriority(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, int64(2), savedPB2.Priority)
 }
+
+func TestCanBypassBranchProtection(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1}) // not in team 1
+	teamMember := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+
+	pb := &ProtectedBranch{
+		EnableBypassAllowlist:  true,
+		BypassAllowlistUserIDs: []int64{user.ID},
+	}
+
+	testBypass := func(t *testing.T, expected bool, pb *ProtectedBranch, doer *user_model.User, isAdmin bool) {
+		assert.Equal(t, expected, CanBypassBranchProtection(t.Context(), pb, doer, isAdmin))
+	}
+	// User bypasses via explicit allowlist.
+	testBypass(t, true, pb, user, false)
+
+	// Non-admin cannot bypass when allowlist is disabled.
+	pb.EnableBypassAllowlist = false
+	testBypass(t, false, pb, user, false)
+
+	// Repo admin can bypass independently of allowlist when not blocked.
+	testBypass(t, true, pb, user, true)
+
+	// Admin override block still allows bypass for allowlisted users.
+	pb.EnableBypassAllowlist = true
+	pb.BlockAdminMergeOverride = true
+	testBypass(t, true, pb, user, false)
+
+	// admin cannot bypass without allowlist membership.
+	pb.BypassAllowlistUserIDs = nil
+	testBypass(t, false, pb, user, true)
+
+	// admin can bypass when allowlisted.
+	pb.BypassAllowlistUserIDs = []int64{user.ID}
+	testBypass(t, true, pb, user, true)
+
+	// User bypasses via team allowlist membership.
+	pb.EnableBypassAllowlist = true
+	pb.BlockAdminMergeOverride = false
+	pb.BypassAllowlistUserIDs = nil
+	pb.BypassAllowlistTeamIDs = []int64{1} // team 1 contains user 2 in test fixtures
+	testBypass(t, true, pb, teamMember, false)
+
+	// User does not bypass when not in allowlisted teams.
+	testBypass(t, false, pb, user, false)
+}
diff --git a/models/git/protected_tag.go b/models/git/protected_tag.go
index dc38daf9815..35d406f45ce 100644
--- a/models/git/protected_tag.go
+++ b/models/git/protected_tag.go
@@ -9,10 +9,10 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/timeutil"
 )
 
 // ProtectedTag struct
diff --git a/models/git/protected_tag_test.go b/models/git/protected_tag_test.go
index 252eaf1bbae..a0400c9bfa1 100644
--- a/models/git/protected_tag_test.go
+++ b/models/git/protected_tag_test.go
@@ -6,8 +6,8 @@ package git_test
 import (
 	"testing"
 
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/unittest"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/assignees.go b/models/issues/assignees.go
index 54f995dd2e9..a45ab468ebc 100644
--- a/models/issues/assignees.go
+++ b/models/issues/assignees.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/issues/assignees_test.go b/models/issues/assignees_test.go
index 13922899dc0..58a1edc02b8 100644
--- a/models/issues/assignees_test.go
+++ b/models/issues/assignees_test.go
@@ -6,9 +6,9 @@ package issues_test
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/comment.go b/models/issues/comment.go
index acfc07ff220..febc49ca76b 100644
--- a/models/issues/comment.go
+++ b/models/issues/comment.go
@@ -14,23 +14,23 @@ import (
 	"strconv"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/organization"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/references"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/organization"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/references"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -1124,7 +1124,7 @@ func FindComments(ctx context.Context, opts *FindCommentsOptions) (CommentList,
 	}
 
 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, opts)
+		db.SetSessionPagination(sess, opts)
 	}
 
 	// WARNING: If you change this order you will need to fix createCodeComment
diff --git a/models/issues/comment_code.go b/models/issues/comment_code.go
index 8de52f815a4..7195736f923 100644
--- a/models/issues/comment_code.go
+++ b/models/issues/comment_code.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/renderhelper"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/markup/markdown"
+	"gitea.dev/models/db"
+	"gitea.dev/models/renderhelper"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/markup/markdown"
 
 	"xorm.io/builder"
 )
diff --git a/models/issues/comment_list.go b/models/issues/comment_list.go
index f6c485449f6..522c066309b 100644
--- a/models/issues/comment_list.go
+++ b/models/issues/comment_list.go
@@ -6,11 +6,11 @@ package issues
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
 )
 
 // CommentList defines a list of comments
diff --git a/models/issues/comment_test.go b/models/issues/comment_test.go
index 3660f9c9398..c47a0c7a4a4 100644
--- a/models/issues/comment_test.go
+++ b/models/issues/comment_test.go
@@ -7,11 +7,11 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/content_history.go b/models/issues/content_history.go
index 31c80d2cea3..fe2fc0d6804 100644
--- a/models/issues/content_history.go
+++ b/models/issues/content_history.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/avatars"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/avatars"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/issues/content_history_test.go b/models/issues/content_history_test.go
index d2fcc82b1d5..9efd4a33e24 100644
--- a/models/issues/content_history_test.go
+++ b/models/issues/content_history_test.go
@@ -6,10 +6,10 @@ package issues_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/dependency.go b/models/issues/dependency.go
index db8054e1618..cf76fec2bff 100644
--- a/models/issues/dependency.go
+++ b/models/issues/dependency.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
 // ErrDependencyExists represents a "DependencyAlreadyExists" kind of error.
diff --git a/models/issues/dependency_test.go b/models/issues/dependency_test.go
index 0e6a870ff9e..786a24f146d 100644
--- a/models/issues/dependency_test.go
+++ b/models/issues/dependency_test.go
@@ -6,9 +6,9 @@ package issues_test
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/issue.go b/models/issues/issue.go
index 345b36a82fa..1dba275ff03 100644
--- a/models/issues/issue.go
+++ b/models/issues/issue.go
@@ -12,17 +12,17 @@ import (
 	"slices"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -682,7 +682,7 @@ func (issue *Issue) BlockedByDependencies(ctx context.Context, opts db.ListOptio
 		// sort by repo id then created date, with the issues of the same repo at the beginning of the list
 		OrderBy("CASE WHEN issue.repo_id = ? THEN 0 ELSE issue.repo_id END, issue.created_unix DESC", issue.RepoID)
 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)
 	}
 	total, err = sess.FindAndCount(&issueDeps)
 
diff --git a/models/issues/issue_index.go b/models/issues/issue_index.go
index 1fe4a08a09b..895fd34193c 100644
--- a/models/issues/issue_index.go
+++ b/models/issues/issue_index.go
@@ -6,7 +6,7 @@ package issues
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 )
 
 // RecalculateIssueIndexForRepo create issue_index for repo if not exist and
diff --git a/models/issues/issue_label.go b/models/issues/issue_label.go
index 697448cf5e5..b628a25c14c 100644
--- a/models/issues/issue_label.go
+++ b/models/issues/issue_label.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"sort"
 
-	"code.gitea.io/gitea/models/db"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	access_model "gitea.dev/models/perm/access"
+	user_model "gitea.dev/models/user"
 
 	"xorm.io/builder"
 )
diff --git a/models/issues/issue_label_test.go b/models/issues/issue_label_test.go
index 6ccf6debaea..fc01feaecfa 100644
--- a/models/issues/issue_label_test.go
+++ b/models/issues/issue_label_test.go
@@ -6,9 +6,9 @@ package issues_test
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/issue_list.go b/models/issues/issue_list.go
index da407094a74..45e25c2da89 100644
--- a/models/issues/issue_list.go
+++ b/models/issues/issue_list.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
+	"gitea.dev/models/db"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
 
 	"xorm.io/builder"
 )
diff --git a/models/issues/issue_list_test.go b/models/issues/issue_list_test.go
index 842249bad23..1c9f2a1e8e7 100644
--- a/models/issues/issue_list_test.go
+++ b/models/issues/issue_list_test.go
@@ -6,9 +6,9 @@ package issues_test
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/issue_lock.go b/models/issues/issue_lock.go
index 2e5bf64cc65..0bb4dc149a7 100644
--- a/models/issues/issue_lock.go
+++ b/models/issues/issue_lock.go
@@ -6,8 +6,8 @@ package issues
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
 )
 
 // IssueLockOptions defines options for locking and/or unlocking an issue/PR
diff --git a/models/issues/issue_pin.go b/models/issues/issue_pin.go
index 753c96ed180..b3f2a485223 100644
--- a/models/issues/issue_pin.go
+++ b/models/issues/issue_pin.go
@@ -8,10 +8,10 @@ import (
 	"errors"
 	"sort"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 type IssuePin struct {
diff --git a/models/issues/issue_project.go b/models/issues/issue_project.go
index 18f0f91c381..894eede22c3 100644
--- a/models/issues/issue_project.go
+++ b/models/issues/issue_project.go
@@ -6,10 +6,10 @@ package issues
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	project_model "code.gitea.io/gitea/models/project"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	project_model "gitea.dev/models/project"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
 )
 
 // LoadProjects loads all projects the issue is assigned to
diff --git a/models/issues/issue_project_multi_test.go b/models/issues/issue_project_multi_test.go
index b004f994b17..5d5aae3b9ce 100644
--- a/models/issues/issue_project_multi_test.go
+++ b/models/issues/issue_project_multi_test.go
@@ -7,10 +7,10 @@ import (
 	"fmt"
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	project_model "code.gitea.io/gitea/models/project"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	project_model "gitea.dev/models/project"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/issues/issue_search.go b/models/issues/issue_search.go
index f905e629e38..bc39199766e 100644
--- a/models/issues/issue_search.go
+++ b/models/issues/issue_search.go
@@ -9,17 +9,16 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
 const ScopeSortPrefix = "scope-"
@@ -71,7 +70,7 @@ func (o *IssuesOptions) Copy(edit ...func(options *IssuesOptions)) *IssuesOption
 
 // applySorts sort an issues-related session based on the provided
 // sortType string
-func applySorts(sess *xorm.Session, sortType string, priorityRepoID int64) {
+func applySorts(sess db.Session, sortType string, priorityRepoID int64) {
 	// Since this sortType is dynamically created, it has to be treated specially.
 	if after, ok := strings.CutPrefix(sortType, ScopeSortPrefix); ok {
 		scope := after
@@ -129,7 +128,7 @@ func applySorts(sess *xorm.Session, sortType string, priorityRepoID int64) {
 	}
 }
 
-func applyLimit(sess *xorm.Session, opts *IssuesOptions) {
+func applyLimit(sess db.Session, opts *IssuesOptions) {
 	if opts.Paginator == nil || opts.Paginator.IsListAll() {
 		return
 	}
@@ -141,7 +140,7 @@ func applyLimit(sess *xorm.Session, opts *IssuesOptions) {
 	sess.Limit(opts.Paginator.PageSize, start)
 }
 
-func applyLabelsCondition(sess *xorm.Session, opts *IssuesOptions) {
+func applyLabelsCondition(sess db.Session, opts *IssuesOptions) {
 	if len(opts.LabelIDs) > 0 {
 		if opts.LabelIDs[0] == 0 {
 			sess.Where("issue.id NOT IN (SELECT issue_id FROM issue_label)")
@@ -182,7 +181,7 @@ func applyLabelsCondition(sess *xorm.Session, opts *IssuesOptions) {
 	}
 }
 
-func applyMilestoneCondition(sess *xorm.Session, opts *IssuesOptions) {
+func applyMilestoneCondition(sess db.Session, opts *IssuesOptions) {
 	if len(opts.MilestoneIDs) == 1 && opts.MilestoneIDs[0] == db.NoConditionID {
 		sess.And("issue.milestone_id = 0")
 	} else if len(opts.MilestoneIDs) > 0 {
@@ -197,7 +196,7 @@ func applyMilestoneCondition(sess *xorm.Session, opts *IssuesOptions) {
 	}
 }
 
-func applyProjectCondition(sess *xorm.Session, opts *IssuesOptions) {
+func applyProjectCondition(sess db.Session, opts *IssuesOptions) {
 	projectIDs := util.SliceRemoveAll(opts.ProjectIDs, 0)
 	if len(projectIDs) == 1 && projectIDs[0] == db.NoConditionID { // show those that are in no project
 		sess.And(builder.NotIn("issue.id", builder.Select("issue_id").From("project_issue")))
@@ -211,7 +210,7 @@ func applyProjectCondition(sess *xorm.Session, opts *IssuesOptions) {
 	// do not need to apply any condition
 }
 
-func applyRepoConditions(sess *xorm.Session, opts *IssuesOptions) {
+func applyRepoConditions(sess db.Session, opts *IssuesOptions) {
 	if len(opts.RepoIDs) == 1 {
 		opts.RepoCond = builder.Eq{"issue.repo_id": opts.RepoIDs[0]}
 	} else if len(opts.RepoIDs) > 1 {
@@ -228,7 +227,7 @@ func applyRepoConditions(sess *xorm.Session, opts *IssuesOptions) {
 	}
 }
 
-func applyConditions(sess *xorm.Session, opts *IssuesOptions) {
+func applyConditions(sess db.Session, opts *IssuesOptions) {
 	if len(opts.IssueIDs) > 0 {
 		sess.In("issue.id", opts.IssueIDs)
 	}
@@ -362,7 +361,7 @@ func issuePullAccessibleRepoCond(repoIDstr string, userID int64, owner *user_mod
 	return cond
 }
 
-func applyAssigneeCondition(sess *xorm.Session, assigneeID string) {
+func applyAssigneeCondition(sess db.Session, assigneeID string) {
 	// old logic: 0 is also treated as "not filtering assignee", because the "assignee" was read as FormInt64
 	if assigneeID == "(none)" {
 		sess.Where("issue.id NOT IN (SELECT issue_id FROM issue_assignees)")
@@ -374,7 +373,7 @@ func applyAssigneeCondition(sess *xorm.Session, assigneeID string) {
 	}
 }
 
-func applyPosterCondition(sess *xorm.Session, posterID string) {
+func applyPosterCondition(sess db.Session, posterID string) {
 	// Actually every issue has a poster.
 	// The "(none)" is for internal usage only: when doer tries to search non-existing user as poster, use "(none)" to return empty result.
 	if posterID == "(none)" {
@@ -384,13 +383,13 @@ func applyPosterCondition(sess *xorm.Session, posterID string) {
 	}
 }
 
-func applyMentionedCondition(sess *xorm.Session, mentionedID int64) {
+func applyMentionedCondition(sess db.Session, mentionedID int64) {
 	sess.Join("INNER", "issue_user", "issue.id = issue_user.issue_id").
 		And("issue_user.is_mentioned = ?", true).
 		And("issue_user.uid = ?", mentionedID)
 }
 
-func applyReviewRequestedCondition(sess *xorm.Session, reviewRequestedID int64) {
+func applyReviewRequestedCondition(sess db.Session, reviewRequestedID int64) {
 	existInTeamQuery := builder.Select("team_user.team_id").
 		From("team_user").
 		Where(builder.Eq{"team_user.uid": reviewRequestedID})
@@ -415,7 +414,7 @@ func applyReviewRequestedCondition(sess *xorm.Session, reviewRequestedID int64)
 		And(builder.In("issue.id", subQuery))
 }
 
-func applyReviewedCondition(sess *xorm.Session, reviewedID int64) {
+func applyReviewedCondition(sess db.Session, reviewedID int64) {
 	// Query for pull requests where you are a reviewer or commenter, excluding
 	// any pull requests already returned by the review requested filter.
 	notPoster := builder.Neq{"issue.poster_id": reviewedID}
@@ -445,7 +444,7 @@ func applyReviewedCondition(sess *xorm.Session, reviewedID int64) {
 	sess.And(notPoster, builder.Or(reviewed, commented))
 }
 
-func applySubscribedCondition(sess *xorm.Session, subscriberID int64) {
+func applySubscribedCondition(sess db.Session, subscriberID int64) {
 	sess.And(
 		builder.
 			NotIn("issue.id",
diff --git a/models/issues/issue_stats.go b/models/issues/issue_stats.go
index adedaa3d3a0..0be8216c319 100644
--- a/models/issues/issue_stats.go
+++ b/models/issues/issue_stats.go
@@ -7,10 +7,9 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
 // IssueStats represents issue statistic information.
@@ -35,12 +34,10 @@ const (
 	FilterModeYourRepositories
 )
 
-const (
-	// MaxQueryParameters represents the max query parameters
-	// When queries are broken down in parts because of the number
-	// of parameters, attempt to break by this amount
-	MaxQueryParameters = 300
-)
+// MaxQueryParameters represents the max query parameters
+// When queries are broken down in parts because of the number
+// of parameters, attempt to break by this amount
+var MaxQueryParameters = 300
 
 // CountIssuesByRepo map from repoID to number of issues matching the options
 func CountIssuesByRepo(ctx context.Context, opts *IssuesOptions) (map[int64]int64, error) {
@@ -131,7 +128,7 @@ func getIssueStatsChunk(ctx context.Context, opts *IssuesOptions, issueIDs []int
 	return stats, err
 }
 
-func applyIssuesOptions(sess *xorm.Session, opts *IssuesOptions, issueIDs []int64) *xorm.Session {
+func applyIssuesOptions(sess db.Session, opts *IssuesOptions, issueIDs []int64) db.Session {
 	if len(opts.RepoIDs) > 1 {
 		sess.In("issue.repo_id", opts.RepoIDs)
 	} else if len(opts.RepoIDs) == 1 {
diff --git a/models/issues/issue_test.go b/models/issues/issue_test.go
index b935c0fffdb..9d975d998ed 100644
--- a/models/issues/issue_test.go
+++ b/models/issues/issue_test.go
@@ -11,12 +11,13 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"xorm.io/builder"
@@ -297,14 +298,11 @@ func TestIssue_ResolveMentions(t *testing.T) {
 
 func TestResourceIndex(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
-
 	var wg sync.WaitGroup
-	for i := range 100 {
-		wg.Add(1)
-		go func(i int) {
+	for i := range 10 {
+		wg.Go(func() {
 			testInsertIssue(t, fmt.Sprintf("issue %d", i+1), "my issue", 0)
-			wg.Done()
-		}(i)
+		})
 	}
 	wg.Wait()
 }
@@ -317,18 +315,12 @@ func TestCorrectIssueStats(t *testing.T) {
 	// maxQueryParameters + 10 issues into the testDatabase.
 	// Each new issues will have a constant description "Bugs are nasty"
 	// Which will be used later on.
-
+	defer test.MockVariableValue(&issues_model.MaxQueryParameters, 25)()
 	issueAmount := issues_model.MaxQueryParameters + 10
 
-	var wg sync.WaitGroup
 	for i := range issueAmount {
-		wg.Add(1)
-		go func(i int) {
-			testInsertIssue(t, fmt.Sprintf("Issue %d", i+1), "Bugs are nasty", 0)
-			wg.Done()
-		}(i)
+		testInsertIssue(t, fmt.Sprintf("Issue %d", i+1), "Bugs are nasty", 0)
 	}
-	wg.Wait()
 
 	// Now we will get all issueID's that match the "Bugs are nasty" query.
 	issues, err := issues_model.Issues(t.Context(), &issues_model.IssuesOptions{
diff --git a/models/issues/issue_update.go b/models/issues/issue_update.go
index c58a2f319dd..74a4b4aac1b 100644
--- a/models/issues/issue_update.go
+++ b/models/issues/issue_update.go
@@ -9,17 +9,17 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/references"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/references"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/issues/issue_user.go b/models/issues/issue_user.go
index 6b59e0725ed..038447dca18 100644
--- a/models/issues/issue_user.go
+++ b/models/issues/issue_user.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
 )
 
 // IssueUser represents an issue-user relation.
diff --git a/models/issues/issue_user_test.go b/models/issues/issue_user_test.go
index ec6d85c2bb5..58d2698e768 100644
--- a/models/issues/issue_user_test.go
+++ b/models/issues/issue_user_test.go
@@ -6,10 +6,10 @@ package issues_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/issues/issue_watch.go b/models/issues/issue_watch.go
index f384e086e56..9ac7278f83f 100644
--- a/models/issues/issue_watch.go
+++ b/models/issues/issue_watch.go
@@ -6,10 +6,10 @@ package issues
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
 )
 
 // IssueWatch is connection request for receiving issue notification.
@@ -106,7 +106,7 @@ func GetIssueWatchers(ctx context.Context, issueID int64, listOptions db.ListOpt
 		Join("INNER", "`user`", "`user`.id = `issue_watch`.user_id")
 
 	if listOptions.Page > 0 {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 		watches := make([]*IssueWatch, 0, listOptions.PageSize)
 		return watches, sess.Find(&watches)
 	}
diff --git a/models/issues/issue_watch_test.go b/models/issues/issue_watch_test.go
index c860e8b8caf..9ff5bd7e8e4 100644
--- a/models/issues/issue_watch_test.go
+++ b/models/issues/issue_watch_test.go
@@ -6,9 +6,9 @@ package issues_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/issue_xref.go b/models/issues/issue_xref.go
index 41a867c892a..0bdc48d7156 100644
--- a/models/issues/issue_xref.go
+++ b/models/issues/issue_xref.go
@@ -7,12 +7,12 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/references"
+	"gitea.dev/models/db"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/references"
 )
 
 type crossReference struct {
diff --git a/models/issues/issue_xref_test.go b/models/issues/issue_xref_test.go
index b25a704bec2..4ecc6547852 100644
--- a/models/issues/issue_xref_test.go
+++ b/models/issues/issue_xref_test.go
@@ -7,12 +7,12 @@ import (
 	"fmt"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/references"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/references"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/label.go b/models/issues/label.go
index 25d6f1303e8..e3312bdab14 100644
--- a/models/issues/label.go
+++ b/models/issues/label.go
@@ -11,12 +11,12 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/label"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/label"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -396,7 +396,7 @@ func GetLabelsByRepoID(ctx context.Context, repoID int64, sortType string, listO
 	}
 
 	if listOptions.Page > 0 {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 	}
 
 	return labels, sess.Find(&labels)
@@ -471,7 +471,7 @@ func GetLabelsByOrgID(ctx context.Context, orgID int64, sortType string, listOpt
 	}
 
 	if listOptions.Page > 0 {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 	}
 
 	return labels, sess.Find(&labels)
diff --git a/models/issues/label_test.go b/models/issues/label_test.go
index 42f774e7507..f336190f0f7 100644
--- a/models/issues/label_test.go
+++ b/models/issues/label_test.go
@@ -6,12 +6,12 @@ package issues_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/main_test.go b/models/issues/main_test.go
index ba83ca55524..ad43ffbc85c 100644
--- a/models/issues/main_test.go
+++ b/models/issues/main_test.go
@@ -6,14 +6,14 @@ package issues_test
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
-	_ "code.gitea.io/gitea/models/repo"
-	_ "code.gitea.io/gitea/models/user"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
+	_ "gitea.dev/models/repo"
+	_ "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/milestone.go b/models/issues/milestone.go
index 1dd86302765..eb3c548c087 100644
--- a/models/issues/milestone.go
+++ b/models/issues/milestone.go
@@ -9,12 +9,12 @@ import (
 	"html/template"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/optional"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/optional"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/issues/milestone_list.go b/models/issues/milestone_list.go
index 021b8beb9e0..3b4bdc6e9f6 100644
--- a/models/issues/milestone_list.go
+++ b/models/issues/milestone_list.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/optional"
 
 	"xorm.io/builder"
 )
diff --git a/models/issues/milestone_test.go b/models/issues/milestone_test.go
index 107ad305d48..925038f68e2 100644
--- a/models/issues/milestone_test.go
+++ b/models/issues/milestone_test.go
@@ -7,14 +7,14 @@ import (
 	"sort"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/pull.go b/models/issues/pull.go
index 4c8d02a990e..7dbcef0d3fe 100644
--- a/models/issues/pull.go
+++ b/models/issues/pull.go
@@ -11,19 +11,19 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	org_model "code.gitea.io/gitea/models/organization"
-	pull_model "code.gitea.io/gitea/models/pull"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	org_model "gitea.dev/models/organization"
+	pull_model "gitea.dev/models/pull"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
-	"github.com/dlclark/regexp2"
+	"github.com/dlclark/regexp2/v2"
 	"xorm.io/builder"
 )
 
diff --git a/models/issues/pull_list.go b/models/issues/pull_list.go
index 6a6abca9709..f271850a147 100644
--- a/models/issues/pull_list.go
+++ b/models/issues/pull_list.go
@@ -7,18 +7,17 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
 // PullRequestsOptions holds the options for PRs
@@ -32,7 +31,7 @@ type PullRequestsOptions struct {
 	BaseBranch  string
 }
 
-func listPullRequestStatement(ctx context.Context, baseRepoID int64, opts *PullRequestsOptions) *xorm.Session {
+func listPullRequestStatement(ctx context.Context, baseRepoID int64, opts *PullRequestsOptions) db.Session {
 	sess := db.GetEngine(ctx).Where("pull_request.base_repo_id=?", baseRepoID)
 
 	if opts.BaseBranch != "" {
diff --git a/models/issues/pull_list_test.go b/models/issues/pull_list_test.go
index 302b2ca0ba7..1312ba1feee 100644
--- a/models/issues/pull_list_test.go
+++ b/models/issues/pull_list_test.go
@@ -6,13 +6,13 @@ package issues_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/issues/pull_test.go b/models/issues/pull_test.go
index 79d1f8aa9b4..166fdd8482b 100644
--- a/models/issues/pull_test.go
+++ b/models/issues/pull_test.go
@@ -6,12 +6,12 @@ package issues_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/issues/reaction.go b/models/issues/reaction.go
index 3b5ad6d7ab9..0043379d6d8 100644
--- a/models/issues/reaction.go
+++ b/models/issues/reaction.go
@@ -9,13 +9,13 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -165,7 +165,7 @@ func FindReactions(ctx context.Context, opts FindReactionsOptions) (ReactionList
 		In("reaction.`type`", setting.UI.Reactions).
 		Asc("reaction.issue_id", "reaction.comment_id", "reaction.created_unix", "reaction.id")
 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)
 
 		reactions := make([]*Reaction, 0, opts.PageSize)
 		count, err := sess.FindAndCount(&reactions)
diff --git a/models/issues/review.go b/models/issues/review.go
index 78ef0d20c23..e1f522be75d 100644
--- a/models/issues/review.go
+++ b/models/issues/review.go
@@ -10,16 +10,16 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -483,6 +483,14 @@ func SubmitReview(ctx context.Context, doer *user_model.User, issue *Issue, revi
 		if _, err := sess.ID(review.ID).Cols("content, type, official, commit_id, stale").Update(review); err != nil {
 			return nil, nil, err
 		}
+
+		// make sure the leftover review request is cleared, consistent with CreateReview
+		if reviewType != ReviewTypePending {
+			if _, err := sess.Where(builder.Eq{"reviewer_id": doer.ID, "issue_id": issue.ID, "type": ReviewTypeRequest}).
+				Delete(new(Review)); err != nil {
+				return nil, nil, err
+			}
+		}
 	}
 
 	comm, err := CreateComment(ctx, &CreateCommentOptions{
diff --git a/models/issues/review_list.go b/models/issues/review_list.go
index d0430cd06d3..d65c3fc6d7d 100644
--- a/models/issues/review_list.go
+++ b/models/issues/review_list.go
@@ -8,11 +8,11 @@ import (
 	"slices"
 	"sort"
 
-	"code.gitea.io/gitea/models/db"
-	organization_model "code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/models/db"
+	organization_model "gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
 
 	"xorm.io/builder"
 )
@@ -121,7 +121,7 @@ func FindReviews(ctx context.Context, opts FindReviewOptions) (ReviewList, error
 	reviews := make([]*Review, 0, 10)
 	sess := db.GetEngine(ctx).Where(opts.toCond())
 	if opts.Page > 0 && !opts.IsListAll() {
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)
 	}
 	return reviews, sess.
 		Asc("created_unix").
@@ -135,7 +135,7 @@ func FindLatestReviews(ctx context.Context, opts FindReviewOptions) (ReviewList,
 	cond := opts.toCond()
 	sess := db.GetEngine(ctx).Where(cond)
 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)
 	}
 
 	sess.In("id", builder.
diff --git a/models/issues/review_test.go b/models/issues/review_test.go
index 092d88d1749..3d2672c4036 100644
--- a/models/issues/review_test.go
+++ b/models/issues/review_test.go
@@ -6,10 +6,10 @@ package issues_test
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -303,6 +303,46 @@ func TestDeleteDismissedReview(t *testing.T) {
 	unittest.AssertNotExistsBean(t, &issues_model.Comment{ID: comment.ID})
 }
 
+func TestSubmitReviewClearsStaleReviewRequest(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 3})
+	assert.NoError(t, issue.LoadRepo(t.Context()))
+	assert.NoError(t, issue.Repo.LoadOwner(t.Context()))
+	reviewer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
+	doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+
+	// the reviewer is requested to review the pull request
+	requestReview, err := issues_model.CreateReview(t.Context(), issues_model.CreateReviewOptions{
+		Type:     issues_model.ReviewTypeRequest,
+		Issue:    issue,
+		Reviewer: reviewer,
+	})
+	assert.NoError(t, err)
+
+	// the reviewer starts a pending review (e.g. by adding code comments)
+	pendingReview, err := issues_model.CreateReview(t.Context(), issues_model.CreateReviewOptions{
+		Type:     issues_model.ReviewTypePending,
+		Issue:    issue,
+		Reviewer: reviewer,
+	})
+	assert.NoError(t, err)
+
+	// submitting the pending review must clear the leftover review request,
+	// otherwise the reviewer can no longer be re-requested afterwards
+	review, _, err := issues_model.SubmitReview(t.Context(), reviewer, issue, issues_model.ReviewTypeComment, "looks good", "", false, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, pendingReview.ID, review.ID)
+	assert.Equal(t, issues_model.ReviewTypeComment, review.Type)
+
+	unittest.AssertNotExistsBean(t, &issues_model.Review{ID: requestReview.ID})
+
+	// the reviewer can be re-requested afterwards (no-op before the fix)
+	comment, err := issues_model.AddReviewRequest(t.Context(), issue, reviewer, doer, false)
+	assert.NoError(t, err)
+	assert.NotNil(t, comment)
+}
+
 func TestAddReviewRequest(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 
diff --git a/models/issues/stopwatch.go b/models/issues/stopwatch.go
index f119951b091..9ad5796c346 100644
--- a/models/issues/stopwatch.go
+++ b/models/issues/stopwatch.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -77,7 +77,7 @@ func GetUserStopwatches(ctx context.Context, userID int64, listOptions db.ListOp
 	sws := make([]*Stopwatch, 0, 8)
 	sess := db.GetEngine(ctx).Where("stopwatch.user_id = ?", userID)
 	if listOptions.Page > 0 {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 	}
 
 	err := sess.Find(&sws)
diff --git a/models/issues/stopwatch_test.go b/models/issues/stopwatch_test.go
index 684ec6cd319..e22328061f5 100644
--- a/models/issues/stopwatch_test.go
+++ b/models/issues/stopwatch_test.go
@@ -6,9 +6,9 @@ package issues_test
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/issues/tracked_time.go b/models/issues/tracked_time.go
index 0b5c341f1f2..764d03e4aad 100644
--- a/models/issues/tracked_time.go
+++ b/models/issues/tracked_time.go
@@ -9,14 +9,13 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
 // TrackedTime represents a time that was spent for a specific issue.
@@ -140,7 +139,7 @@ func (opts *FindTrackedTimesOptions) toSession(e db.Engine) db.Engine {
 	sess = sess.Where(opts.ToConds())
 
 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, opts)
+		db.SetSessionPagination(sess, opts)
 	}
 
 	return sess
@@ -344,7 +343,7 @@ func GetIssueTotalTrackedTime(ctx context.Context, opts *IssuesOptions, isClosed
 }
 
 func getIssueTotalTrackedTimeChunk(ctx context.Context, opts *IssuesOptions, isClosed optional.Option[bool], issueIDs []int64) (int64, error) {
-	sumSession := func(opts *IssuesOptions, issueIDs []int64) *xorm.Session {
+	sumSession := func(opts *IssuesOptions, issueIDs []int64) db.Session {
 		sess := db.GetEngine(ctx).
 			Table("tracked_time").
 			Where("tracked_time.deleted = ?", false).
@@ -359,7 +358,7 @@ func getIssueTotalTrackedTimeChunk(ctx context.Context, opts *IssuesOptions, isC
 
 	session := sumSession(opts, issueIDs)
 	if isClosed.Has() {
-		session = session.And("issue.is_closed = ?", isClosed.Value())
+		session.And("issue.is_closed = ?", isClosed.Value())
 	}
 	return session.SumInt(new(trackedTime), "tracked_time.time")
 }
diff --git a/models/issues/tracked_time_test.go b/models/issues/tracked_time_test.go
index ef7c72958fc..3b8004b9e60 100644
--- a/models/issues/tracked_time_test.go
+++ b/models/issues/tracked_time_test.go
@@ -7,10 +7,10 @@ import (
 	"testing"
 	"time"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/main_test.go b/models/main_test.go
index 600dcc889b7..21112a1736c 100644
--- a/models/main_test.go
+++ b/models/main_test.go
@@ -6,14 +6,14 @@ package models
 import (
 	"testing"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/system"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/system"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/base/db.go b/models/migrations/base/db.go
index 16048c2073b..569fd2109ff 100644
--- a/models/migrations/base/db.go
+++ b/models/migrations/base/db.go
@@ -11,17 +11,17 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
 // RecreateTables will recreate the tables for the provided beans using the newly provided bean definition and move all data to that new table
 // WARNING: YOU MUST PROVIDE THE FULL BEAN DEFINITION
-func RecreateTables(beans ...any) func(*xorm.Engine) error {
-	return func(x *xorm.Engine) error {
+func RecreateTables(beans ...any) func(db.EngineMigration) error {
+	return func(x db.EngineMigration) error {
 		sess := x.NewSession()
 		defer sess.Close()
 		if err := sess.Begin(); err != nil {
@@ -41,7 +41,7 @@ func RecreateTables(beans ...any) func(*xorm.Engine) error {
 // RecreateTable will recreate the table using the newly provided bean definition and move all data to that new table
 // WARNING: YOU MUST PROVIDE THE FULL BEAN DEFINITION
 // WARNING: YOU MUST COMMIT THE SESSION AT THE END
-func RecreateTable(sess *xorm.Session, bean any) error {
+func RecreateTable(sess db.Session, bean any) error {
 	// TODO: This will not work if there are foreign keys
 
 	tableName := sess.Engine().TableName(bean)
@@ -304,7 +304,7 @@ func RecreateTable(sess *xorm.Session, bean any) error {
 }
 
 // WARNING: YOU MUST COMMIT THE SESSION AT THE END
-func DropTableColumns(sess *xorm.Session, tableName string, columnNames ...string) (err error) {
+func DropTableColumns(sess db.Session, tableName string, columnNames ...string) (err error) {
 	if tableName == "" || len(columnNames) == 0 {
 		return nil
 	}
@@ -474,7 +474,7 @@ func DropTableColumns(sess *xorm.Session, tableName string, columnNames ...strin
 }
 
 // ModifyColumn will modify column's type or other property. SQLITE is not supported
-func ModifyColumn(x *xorm.Engine, tableName string, col *schemas.Column) error {
+func ModifyColumn(x db.EngineMigration, tableName string, col *schemas.Column) error {
 	var indexes map[string]*schemas.Index
 	var err error
 	// MSSQL have to remove index at first, otherwise alter column will fail
diff --git a/models/migrations/base/db_test.go b/models/migrations/base/db_test.go
index ce6e1169d83..3f04e6620fd 100644
--- a/models/migrations/base/db_test.go
+++ b/models/migrations/base/db_test.go
@@ -6,8 +6,8 @@ package base
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/modules/timeutil"
 
 	"xorm.io/xorm/names"
 )
diff --git a/models/migrations/migrations.go b/models/migrations/migrations.go
index c3a8f08b5d7..904a3ffa205 100644
--- a/models/migrations/migrations.go
+++ b/models/migrations/migrations.go
@@ -9,33 +9,33 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/models/migrations/v1_10"
-	"code.gitea.io/gitea/models/migrations/v1_11"
-	"code.gitea.io/gitea/models/migrations/v1_12"
-	"code.gitea.io/gitea/models/migrations/v1_13"
-	"code.gitea.io/gitea/models/migrations/v1_14"
-	"code.gitea.io/gitea/models/migrations/v1_15"
-	"code.gitea.io/gitea/models/migrations/v1_16"
-	"code.gitea.io/gitea/models/migrations/v1_17"
-	"code.gitea.io/gitea/models/migrations/v1_18"
-	"code.gitea.io/gitea/models/migrations/v1_19"
-	"code.gitea.io/gitea/models/migrations/v1_20"
-	"code.gitea.io/gitea/models/migrations/v1_21"
-	"code.gitea.io/gitea/models/migrations/v1_22"
-	"code.gitea.io/gitea/models/migrations/v1_23"
-	"code.gitea.io/gitea/models/migrations/v1_24"
-	"code.gitea.io/gitea/models/migrations/v1_25"
-	"code.gitea.io/gitea/models/migrations/v1_26"
-	"code.gitea.io/gitea/models/migrations/v1_27"
-	"code.gitea.io/gitea/models/migrations/v1_6"
-	"code.gitea.io/gitea/models/migrations/v1_7"
-	"code.gitea.io/gitea/models/migrations/v1_8"
-	"code.gitea.io/gitea/models/migrations/v1_9"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/v1_10"
+	"gitea.dev/models/migrations/v1_11"
+	"gitea.dev/models/migrations/v1_12"
+	"gitea.dev/models/migrations/v1_13"
+	"gitea.dev/models/migrations/v1_14"
+	"gitea.dev/models/migrations/v1_15"
+	"gitea.dev/models/migrations/v1_16"
+	"gitea.dev/models/migrations/v1_17"
+	"gitea.dev/models/migrations/v1_18"
+	"gitea.dev/models/migrations/v1_19"
+	"gitea.dev/models/migrations/v1_20"
+	"gitea.dev/models/migrations/v1_21"
+	"gitea.dev/models/migrations/v1_22"
+	"gitea.dev/models/migrations/v1_23"
+	"gitea.dev/models/migrations/v1_24"
+	"gitea.dev/models/migrations/v1_25"
+	"gitea.dev/models/migrations/v1_26"
+	"gitea.dev/models/migrations/v1_27"
+	"gitea.dev/models/migrations/v1_6"
+	"gitea.dev/models/migrations/v1_7"
+	"gitea.dev/models/migrations/v1_8"
+	"gitea.dev/models/migrations/v1_9"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/names"
 )
 
@@ -44,23 +44,23 @@ const minDBVersion = 70 // Gitea 1.5.3
 type migration struct {
 	idNumber    int64 // DB version is "the last migration's idNumber" + 1
 	description string
-	migrate     func(context.Context, *xorm.Engine) error
+	migrate     func(context.Context, db.EngineMigration) error
 }
 
 // newMigration creates a new migration
-func newMigration[T func(*xorm.Engine) error | func(context.Context, *xorm.Engine) error](idNumber int64, desc string, fn T) *migration {
+func newMigration[T func(db.EngineMigration) error | func(context.Context, db.EngineMigration) error](idNumber int64, desc string, fn T) *migration {
 	m := &migration{idNumber: idNumber, description: desc}
 	var ok bool
-	if m.migrate, ok = any(fn).(func(context.Context, *xorm.Engine) error); !ok {
-		m.migrate = func(ctx context.Context, x *xorm.Engine) error {
-			return any(fn).(func(*xorm.Engine) error)(x)
+	if m.migrate, ok = any(fn).(func(context.Context, db.EngineMigration) error); !ok {
+		m.migrate = func(ctx context.Context, x db.EngineMigration) error {
+			return any(fn).(func(db.EngineMigration) error)(x)
 		}
 	}
 	return m
 }
 
 // Migrate executes the migration
-func (m *migration) Migrate(ctx context.Context, x *xorm.Engine) error {
+func (m *migration) Migrate(ctx context.Context, x db.EngineMigration) error {
 	return m.migrate(ctx, x)
 }
 
@@ -71,7 +71,7 @@ type Version struct {
 }
 
 // Use noopMigration when there is a migration that has been no-oped
-var noopMigration = func(_ *xorm.Engine) error { return nil }
+var noopMigration = func(_ db.EngineMigration) error { return nil }
 
 var preparedMigrations []*migration
 
@@ -409,12 +409,16 @@ func prepareMigrationTasks() []*migration {
 		// Gitea 1.26.0 ends at migration ID number 330 (database version 331)
 
 		newMigration(331, "Add ActionRunAttempt model and related action fields", v1_27.AddActionRunAttemptModel),
+		newMigration(332, "Add last_sync_unix to mirror", v1_27.AddLastSyncUnixToMirror),
+		newMigration(333, "Add bypass allowlist to branch protection", v1_27.AddBranchProtectionBypassAllowlist),
+		newMigration(334, "Add cancelling support to action runners", v1_27.AddCancellingSupportToActionRunner),
+		newMigration(335, "Add reusable workflow fields and action_run_attempt_job_id_index table for ActionRunJob", v1_27.AddReusableWorkflowFieldsToActionRunJob),
 	}
 	return preparedMigrations
 }
 
 // GetCurrentDBVersion returns the current db version
-func GetCurrentDBVersion(x *xorm.Engine) (int64, error) {
+func GetCurrentDBVersion(x db.EngineMigration) (int64, error) {
 	if err := x.Sync(new(Version)); err != nil {
 		return -1, fmt.Errorf("sync: %w", err)
 	}
@@ -447,7 +451,7 @@ func ExpectedDBVersion() int64 {
 }
 
 // EnsureUpToDate will check if the db is at the correct version
-func EnsureUpToDate(ctx context.Context, x *xorm.Engine) error {
+func EnsureUpToDate(ctx context.Context, x db.EngineMigration) error {
 	currentDB, err := GetCurrentDBVersion(x)
 	if err != nil {
 		return err
@@ -479,7 +483,7 @@ func migrationIDNumberToDBVersion(idNumber int64) int64 {
 }
 
 // Migrate database to current version
-func Migrate(ctx context.Context, x *xorm.Engine) error {
+func Migrate(ctx context.Context, x db.EngineMigration) error {
 	migrations := prepareMigrationTasks()
 	maxDBVer := calcDBVersion(migrations)
 
@@ -498,7 +502,7 @@ func Migrate(ctx context.Context, x *xorm.Engine) error {
 		// XORM model framework will create all tables when initializing.
 		currentVersion.ID = 0
 		currentVersion.Version = maxDBVer
-		if _, err = x.InsertOne(currentVersion); err != nil {
+		if _, err = x.Insert(currentVersion); err != nil {
 			return fmt.Errorf("insert: %w", err)
 		}
 	}
diff --git a/models/migrations/migrations_test.go b/models/migrations/migrations_test.go
index 8649d116f58..bc94d7b1e60 100644
--- a/models/migrations/migrations_test.go
+++ b/models/migrations/migrations_test.go
@@ -6,7 +6,7 @@ package migrations
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/migrationtest/tests.go b/models/migrations/migrationtest/tests.go
index ed8bb16ef1a..bafdea24cf7 100644
--- a/models/migrations/migrationtest/tests.go
+++ b/models/migrations/migrationtest/tests.go
@@ -8,15 +8,14 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/testlogger"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/testlogger"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
@@ -24,7 +23,7 @@ import (
 // Provide models to be sync'd with the database - in particular any models you expect fixtures to be loaded from.
 //
 // fixtures in `models/migrations/fixtures/<TestName>` will be loaded automatically
-func PrepareTestEnv(t *testing.T, skip int, syncModels ...any) (*xorm.Engine, func()) {
+func PrepareTestEnv(t *testing.T, skip int, syncModels ...any) (db.EngineMigration, func()) {
 	t.Helper()
 	ourSkip := 2
 	ourSkip += skip
@@ -72,7 +71,7 @@ func PrepareTestEnv(t *testing.T, skip int, syncModels ...any) (*xorm.Engine, fu
 		if err := unittest.InitFixtures(
 			unittest.FixturesOptions{
 				Dir: fixturesDir,
-			}, x); err != nil {
+			}); err != nil {
 			t.Errorf("error whilst initializing fixtures from %s: %v", fixturesDir, err)
 			return x, deferFn
 		}
@@ -89,7 +88,7 @@ func PrepareTestEnv(t *testing.T, skip int, syncModels ...any) (*xorm.Engine, fu
 	return x, deferFn
 }
 
-func LoadTableSchemasMap(t *testing.T, x *xorm.Engine) map[string]*schemas.Table {
+func LoadTableSchemasMap(t *testing.T, x db.EngineMigration) map[string]*schemas.Table {
 	tables, err := x.DBMetas()
 	require.NoError(t, err)
 	tableMap := make(map[string]*schemas.Table)
@@ -110,6 +109,7 @@ func mainTest(m *testing.M) int {
 	if err = git.InitFull(); err != nil {
 		return testlogger.MainErrorf("Unable to InitFull: %v", err)
 	}
+	setting.Database.SlowQueryThreshold = 0
 	setting.LoadDBSetting()
 	setting.InitLoggersForTest()
 	return m.Run()
diff --git a/models/migrations/v1_10/v100.go b/models/migrations/v1_10/v100.go
index 1742bea2963..9a2bf5fe092 100644
--- a/models/migrations/v1_10/v100.go
+++ b/models/migrations/v1_10/v100.go
@@ -8,10 +8,10 @@ import (
 	"strings"
 	"time"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func UpdateMigrationServiceTypes(x *xorm.Engine) error {
+func UpdateMigrationServiceTypes(x db.EngineMigration) error {
 	type Repository struct {
 		ID                  int64
 		OriginalServiceType int    `xorm:"index default(0)"`
diff --git a/models/migrations/v1_10/v101.go b/models/migrations/v1_10/v101.go
index 6c8dfe24860..06415af073b 100644
--- a/models/migrations/v1_10/v101.go
+++ b/models/migrations/v1_10/v101.go
@@ -3,11 +3,9 @@
 
 package v1_10
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func ChangeSomeColumnsLengthOfExternalLoginUser(x *xorm.Engine) error {
+func ChangeSomeColumnsLengthOfExternalLoginUser(x db.EngineMigration) error {
 	type ExternalLoginUser struct {
 		AccessToken       string `xorm:"TEXT"`
 		AccessTokenSecret string `xorm:"TEXT"`
diff --git a/models/migrations/v1_10/v88.go b/models/migrations/v1_10/v88.go
index eb8e81c19ee..dc086488edb 100644
--- a/models/migrations/v1_10/v88.go
+++ b/models/migrations/v1_10/v88.go
@@ -7,14 +7,14 @@ import (
 	"crypto/sha1"
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
 func hashContext(context string) string {
 	return fmt.Sprintf("%x", sha1.Sum([]byte(context)))
 }
 
-func AddCommitStatusContext(x *xorm.Engine) error {
+func AddCommitStatusContext(x db.EngineMigration) error {
 	type CommitStatus struct {
 		ID          int64  `xorm:"pk autoincr"`
 		ContextHash string `xorm:"char(40) index"`
diff --git a/models/migrations/v1_10/v89.go b/models/migrations/v1_10/v89.go
index 0df2a6e17b6..336c637f189 100644
--- a/models/migrations/v1_10/v89.go
+++ b/models/migrations/v1_10/v89.go
@@ -3,9 +3,9 @@
 
 package v1_10
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddOriginalMigrationInfo(x *xorm.Engine) error {
+func AddOriginalMigrationInfo(x db.EngineMigration) error {
 	// Issue see models/issue.go
 	type Issue struct {
 		OriginalAuthor   string
diff --git a/models/migrations/v1_10/v90.go b/models/migrations/v1_10/v90.go
index 5521a97e327..b00607f5965 100644
--- a/models/migrations/v1_10/v90.go
+++ b/models/migrations/v1_10/v90.go
@@ -3,9 +3,9 @@
 
 package v1_10
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func ChangeSomeColumnsLengthOfRepo(x *xorm.Engine) error {
+func ChangeSomeColumnsLengthOfRepo(x db.EngineMigration) error {
 	type Repository struct {
 		ID          int64  `xorm:"pk autoincr"`
 		Description string `xorm:"TEXT"`
diff --git a/models/migrations/v1_10/v91.go b/models/migrations/v1_10/v91.go
index 08db6c27421..e78b39b7ec5 100644
--- a/models/migrations/v1_10/v91.go
+++ b/models/migrations/v1_10/v91.go
@@ -3,9 +3,9 @@
 
 package v1_10
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddIndexOnRepositoryAndComment(x *xorm.Engine) error {
+func AddIndexOnRepositoryAndComment(x db.EngineMigration) error {
 	type Repository struct {
 		ID      int64 `xorm:"pk autoincr"`
 		OwnerID int64 `xorm:"index"`
diff --git a/models/migrations/v1_10/v92.go b/models/migrations/v1_10/v92.go
index b6c04a92348..15ed28ad20a 100644
--- a/models/migrations/v1_10/v92.go
+++ b/models/migrations/v1_10/v92.go
@@ -4,11 +4,12 @@
 package v1_10
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
-func RemoveLingeringIndexStatus(x *xorm.Engine) error {
+func RemoveLingeringIndexStatus(x db.EngineMigration) error {
 	_, err := x.Exec(builder.Delete(builder.NotIn("`repo_id`", builder.Select("`id`").From("`repository`"))).From("`repo_indexer_status`"))
 	return err
 }
diff --git a/models/migrations/v1_10/v93.go b/models/migrations/v1_10/v93.go
index c131be9a8d8..08dc4b4118c 100644
--- a/models/migrations/v1_10/v93.go
+++ b/models/migrations/v1_10/v93.go
@@ -3,9 +3,9 @@
 
 package v1_10
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddEmailNotificationEnabledToUser(x *xorm.Engine) error {
+func AddEmailNotificationEnabledToUser(x db.EngineMigration) error {
 	// User see models/user.go
 	type User struct {
 		EmailNotificationsPreference string `xorm:"VARCHAR(20) NOT NULL DEFAULT 'enabled'"`
diff --git a/models/migrations/v1_10/v94.go b/models/migrations/v1_10/v94.go
index 13b7d7b303e..ace5f4eec29 100644
--- a/models/migrations/v1_10/v94.go
+++ b/models/migrations/v1_10/v94.go
@@ -3,9 +3,9 @@
 
 package v1_10
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddStatusCheckColumnsForProtectedBranches(x *xorm.Engine) error {
+func AddStatusCheckColumnsForProtectedBranches(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		EnableStatusCheck   bool     `xorm:"NOT NULL DEFAULT false"`
 		StatusCheckContexts []string `xorm:"JSON TEXT"`
diff --git a/models/migrations/v1_10/v95.go b/models/migrations/v1_10/v95.go
index 86b52026bfa..4638cb175a0 100644
--- a/models/migrations/v1_10/v95.go
+++ b/models/migrations/v1_10/v95.go
@@ -3,9 +3,9 @@
 
 package v1_10
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddCrossReferenceColumns(x *xorm.Engine) error {
+func AddCrossReferenceColumns(x db.EngineMigration) error {
 	// Comment see models/comment.go
 	type Comment struct {
 		RefRepoID    int64 `xorm:"index"`
diff --git a/models/migrations/v1_10/v96.go b/models/migrations/v1_10/v96.go
index ca35a169c4a..8fc0c8b71cc 100644
--- a/models/migrations/v1_10/v96.go
+++ b/models/migrations/v1_10/v96.go
@@ -6,13 +6,12 @@ package v1_10
 import (
 	"path/filepath"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
-func DeleteOrphanedAttachments(x *xorm.Engine) error {
+func DeleteOrphanedAttachments(x db.EngineMigration) error {
 	type Attachment struct {
 		ID        int64  `xorm:"pk autoincr"`
 		UUID      string `xorm:"uuid UNIQUE"`
diff --git a/models/migrations/v1_10/v97.go b/models/migrations/v1_10/v97.go
index 5872bb63e57..554869af3e4 100644
--- a/models/migrations/v1_10/v97.go
+++ b/models/migrations/v1_10/v97.go
@@ -3,9 +3,9 @@
 
 package v1_10
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddRepoAdminChangeTeamAccessColumnForUser(x *xorm.Engine) error {
+func AddRepoAdminChangeTeamAccessColumnForUser(x db.EngineMigration) error {
 	type User struct {
 		RepoAdminChangeTeamAccess bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_10/v98.go b/models/migrations/v1_10/v98.go
index d21c3264595..9f4d1eb8460 100644
--- a/models/migrations/v1_10/v98.go
+++ b/models/migrations/v1_10/v98.go
@@ -3,9 +3,9 @@
 
 package v1_10
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddOriginalAuthorOnMigratedReleases(x *xorm.Engine) error {
+func AddOriginalAuthorOnMigratedReleases(x db.EngineMigration) error {
 	type Release struct {
 		ID               int64
 		OriginalAuthor   string
diff --git a/models/migrations/v1_10/v99.go b/models/migrations/v1_10/v99.go
index 223c188057b..36802c6cb66 100644
--- a/models/migrations/v1_10/v99.go
+++ b/models/migrations/v1_10/v99.go
@@ -4,12 +4,11 @@
 package v1_10
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddTaskTable(x *xorm.Engine) error {
+func AddTaskTable(x db.EngineMigration) error {
 	// TaskType defines task type
 	type TaskType int
 
diff --git a/models/migrations/v1_11/v102.go b/models/migrations/v1_11/v102.go
index e52290afb0a..e5263f6b942 100644
--- a/models/migrations/v1_11/v102.go
+++ b/models/migrations/v1_11/v102.go
@@ -4,12 +4,11 @@
 package v1_11
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 )
 
-func DropColumnHeadUserNameOnPullRequest(x *xorm.Engine) error {
+func DropColumnHeadUserNameOnPullRequest(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 	if err := sess.Begin(); err != nil {
diff --git a/models/migrations/v1_11/v103.go b/models/migrations/v1_11/v103.go
index a5157101605..1bb4fb4dffe 100644
--- a/models/migrations/v1_11/v103.go
+++ b/models/migrations/v1_11/v103.go
@@ -3,11 +3,9 @@
 
 package v1_11
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddWhitelistDeployKeysToBranches(x *xorm.Engine) error {
+func AddWhitelistDeployKeysToBranches(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		ID                  int64
 		WhitelistDeployKeys bool `xorm:"NOT NULL DEFAULT false"`
diff --git a/models/migrations/v1_11/v104.go b/models/migrations/v1_11/v104.go
index 3b0d3c64b2f..e907c212082 100644
--- a/models/migrations/v1_11/v104.go
+++ b/models/migrations/v1_11/v104.go
@@ -4,12 +4,11 @@
 package v1_11
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 )
 
-func RemoveLabelUneededCols(x *xorm.Engine) error {
+func RemoveLabelUneededCols(x db.EngineMigration) error {
 	// Make sure the columns exist before dropping them
 	type Label struct {
 		QueryString string
diff --git a/models/migrations/v1_11/v105.go b/models/migrations/v1_11/v105.go
index d86973a0f68..49544148f80 100644
--- a/models/migrations/v1_11/v105.go
+++ b/models/migrations/v1_11/v105.go
@@ -3,11 +3,9 @@
 
 package v1_11
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddTeamIncludesAllRepositories(x *xorm.Engine) error {
+func AddTeamIncludesAllRepositories(x db.EngineMigration) error {
 	type Team struct {
 		ID                      int64 `xorm:"pk autoincr"`
 		IncludesAllRepositories bool  `xorm:"NOT NULL DEFAULT false"`
diff --git a/models/migrations/v1_11/v106.go b/models/migrations/v1_11/v106.go
index edffe186831..8e5848cb902 100644
--- a/models/migrations/v1_11/v106.go
+++ b/models/migrations/v1_11/v106.go
@@ -3,9 +3,7 @@
 
 package v1_11
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
 // RepoWatchMode specifies what kind of watch the user has on a repository
 type RepoWatchMode int8
@@ -16,7 +14,7 @@ type Watch struct {
 	Mode RepoWatchMode `xorm:"SMALLINT NOT NULL DEFAULT 1"`
 }
 
-func AddModeColumnToWatch(x *xorm.Engine) error {
+func AddModeColumnToWatch(x db.EngineMigration) error {
 	if err := x.Sync(new(Watch)); err != nil {
 		return err
 	}
diff --git a/models/migrations/v1_11/v107.go b/models/migrations/v1_11/v107.go
index a158e3bb502..83efb242537 100644
--- a/models/migrations/v1_11/v107.go
+++ b/models/migrations/v1_11/v107.go
@@ -3,11 +3,9 @@
 
 package v1_11
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddTemplateToRepo(x *xorm.Engine) error {
+func AddTemplateToRepo(x db.EngineMigration) error {
 	type Repository struct {
 		IsTemplate bool  `xorm:"INDEX NOT NULL DEFAULT false"`
 		TemplateID int64 `xorm:"INDEX"`
diff --git a/models/migrations/v1_11/v108.go b/models/migrations/v1_11/v108.go
index 8f14504cebf..a8b1e50b11f 100644
--- a/models/migrations/v1_11/v108.go
+++ b/models/migrations/v1_11/v108.go
@@ -3,11 +3,9 @@
 
 package v1_11
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddCommentIDOnNotification(x *xorm.Engine) error {
+func AddCommentIDOnNotification(x db.EngineMigration) error {
 	type Notification struct {
 		ID        int64 `xorm:"pk autoincr"`
 		CommentID int64
diff --git a/models/migrations/v1_11/v109.go b/models/migrations/v1_11/v109.go
index f7616aec7b5..63f4e521ef9 100644
--- a/models/migrations/v1_11/v109.go
+++ b/models/migrations/v1_11/v109.go
@@ -3,11 +3,9 @@
 
 package v1_11
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddCanCreateOrgRepoColumnForTeam(x *xorm.Engine) error {
+func AddCanCreateOrgRepoColumnForTeam(x db.EngineMigration) error {
 	type Team struct {
 		CanCreateOrgRepo bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_11/v110.go b/models/migrations/v1_11/v110.go
index 512f728c035..ccd5bb0fc1e 100644
--- a/models/migrations/v1_11/v110.go
+++ b/models/migrations/v1_11/v110.go
@@ -4,11 +4,12 @@
 package v1_11
 
 import (
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm/schemas"
 )
 
-func ChangeReviewContentToText(x *xorm.Engine) error {
+func ChangeReviewContentToText(x db.EngineMigration) error {
 	switch x.Dialect().URI().DBType {
 	case schemas.MYSQL:
 		_, err := x.Exec("ALTER TABLE review MODIFY COLUMN content TEXT")
diff --git a/models/migrations/v1_11/v111.go b/models/migrations/v1_11/v111.go
index 2634906565e..7f3cf4fc929 100644
--- a/models/migrations/v1_11/v111.go
+++ b/models/migrations/v1_11/v111.go
@@ -7,10 +7,10 @@ import (
 	"fmt"
 	"slices"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddBranchProtectionCanPushAndEnableWhitelist(x *xorm.Engine) error {
+func AddBranchProtectionCanPushAndEnableWhitelist(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		CanPush                   bool    `xorm:"NOT NULL DEFAULT false"`
 		EnableApprovalsWhitelist  bool    `xorm:"NOT NULL DEFAULT false"`
@@ -132,7 +132,7 @@ func AddBranchProtectionCanPushAndEnableWhitelist(x *xorm.Engine) error {
 	}
 
 	// getUserRepoPermission static function based on issues_model.IsOfficialReviewer at 5d78792385
-	getUserRepoPermission := func(sess *xorm.Session, repo *Repository, user *User) (Permission, error) {
+	getUserRepoPermission := func(sess db.Session, repo *Repository, user *User) (Permission, error) {
 		var perm Permission
 
 		repoOwner := new(User)
@@ -305,7 +305,7 @@ func AddBranchProtectionCanPushAndEnableWhitelist(x *xorm.Engine) error {
 	}
 
 	// isOfficialReviewer static function based on 5d78792385
-	isOfficialReviewer := func(sess *xorm.Session, issueID int64, reviewer *User) (bool, error) {
+	isOfficialReviewer := func(sess db.Session, issueID int64, reviewer *User) (bool, error) {
 		pr := new(PullRequest)
 		has, err := sess.ID(issueID).Get(pr)
 		if err != nil {
diff --git a/models/migrations/v1_11/v112.go b/models/migrations/v1_11/v112.go
index fe45cf92221..1acc7e6dfac 100644
--- a/models/migrations/v1_11/v112.go
+++ b/models/migrations/v1_11/v112.go
@@ -6,15 +6,15 @@ package v1_11
 import (
 	"path/filepath"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
-func RemoveAttachmentMissedRepo(x *xorm.Engine) error {
+func RemoveAttachmentMissedRepo(x db.EngineMigration) error {
 	type Attachment struct {
 		UUID string `xorm:"uuid"`
 	}
diff --git a/models/migrations/v1_11/v113.go b/models/migrations/v1_11/v113.go
index a4d54f66fb4..0cdf0a9dfec 100644
--- a/models/migrations/v1_11/v113.go
+++ b/models/migrations/v1_11/v113.go
@@ -6,10 +6,10 @@ package v1_11
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func FeatureChangeTargetBranch(x *xorm.Engine) error {
+func FeatureChangeTargetBranch(x db.EngineMigration) error {
 	type Comment struct {
 		OldRef string
 		NewRef string
diff --git a/models/migrations/v1_11/v114.go b/models/migrations/v1_11/v114.go
index 9467a8a90c9..34025428566 100644
--- a/models/migrations/v1_11/v114.go
+++ b/models/migrations/v1_11/v114.go
@@ -6,10 +6,10 @@ package v1_11
 import (
 	"net/url"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func SanitizeOriginalURL(x *xorm.Engine) error {
+func SanitizeOriginalURL(x db.EngineMigration) error {
 	type Repository struct {
 		ID          int64
 		OriginalURL string `xorm:"VARCHAR(2048)"`
diff --git a/models/migrations/v1_11/v115.go b/models/migrations/v1_11/v115.go
index 5933c0520f6..d63c9c09ec7 100644
--- a/models/migrations/v1_11/v115.go
+++ b/models/migrations/v1_11/v115.go
@@ -12,15 +12,14 @@ import (
 	"path/filepath"
 	"time"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
-func RenameExistingUserAvatarName(x *xorm.Engine) error {
+func RenameExistingUserAvatarName(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 
diff --git a/models/migrations/v1_11/v116.go b/models/migrations/v1_11/v116.go
index 729fbad18b8..9397d2a02c7 100644
--- a/models/migrations/v1_11/v116.go
+++ b/models/migrations/v1_11/v116.go
@@ -3,11 +3,9 @@
 
 package v1_11
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func ExtendTrackedTimes(x *xorm.Engine) error {
+func ExtendTrackedTimes(x db.EngineMigration) error {
 	type TrackedTime struct {
 		Time    int64 `xorm:"NOT NULL"`
 		Deleted bool  `xorm:"NOT NULL DEFAULT false"`
diff --git a/models/migrations/v1_12/v117.go b/models/migrations/v1_12/v117.go
index 73b58ca34b2..d15c55cac36 100644
--- a/models/migrations/v1_12/v117.go
+++ b/models/migrations/v1_12/v117.go
@@ -3,11 +3,9 @@
 
 package v1_12
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddBlockOnRejectedReviews(x *xorm.Engine) error {
+func AddBlockOnRejectedReviews(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		BlockOnRejectedReviews bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_12/v118.go b/models/migrations/v1_12/v118.go
index e8b4249743d..878b0e8b245 100644
--- a/models/migrations/v1_12/v118.go
+++ b/models/migrations/v1_12/v118.go
@@ -3,11 +3,9 @@
 
 package v1_12
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddReviewCommitAndStale(x *xorm.Engine) error {
+func AddReviewCommitAndStale(x db.EngineMigration) error {
 	type Review struct {
 		CommitID string `xorm:"VARCHAR(40)"`
 		Stale    bool   `xorm:"NOT NULL DEFAULT false"`
diff --git a/models/migrations/v1_12/v119.go b/models/migrations/v1_12/v119.go
index b4bf29a9359..b4ed7c42a40 100644
--- a/models/migrations/v1_12/v119.go
+++ b/models/migrations/v1_12/v119.go
@@ -3,11 +3,9 @@
 
 package v1_12
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func FixMigratedRepositoryServiceType(x *xorm.Engine) error {
+func FixMigratedRepositoryServiceType(x db.EngineMigration) error {
 	// structs.GithubService:
 	// GithubService = 2
 	_, err := x.Exec("UPDATE repository SET original_service_type = ? WHERE original_url LIKE 'https://github.com/%'", 2)
diff --git a/models/migrations/v1_12/v120.go b/models/migrations/v1_12/v120.go
index 14d515f5a7f..7f0088346f5 100644
--- a/models/migrations/v1_12/v120.go
+++ b/models/migrations/v1_12/v120.go
@@ -3,11 +3,9 @@
 
 package v1_12
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddOwnerNameOnRepository(x *xorm.Engine) error {
+func AddOwnerNameOnRepository(x db.EngineMigration) error {
 	type Repository struct {
 		OwnerName string
 	}
diff --git a/models/migrations/v1_12/v121.go b/models/migrations/v1_12/v121.go
index a28ae4e1c9f..fc436259b9b 100644
--- a/models/migrations/v1_12/v121.go
+++ b/models/migrations/v1_12/v121.go
@@ -3,9 +3,9 @@
 
 package v1_12
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddIsRestricted(x *xorm.Engine) error {
+func AddIsRestricted(x db.EngineMigration) error {
 	// User see models/user.go
 	type User struct {
 		ID           int64 `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_12/v122.go b/models/migrations/v1_12/v122.go
index bc1b175f6ae..c2d114d9251 100644
--- a/models/migrations/v1_12/v122.go
+++ b/models/migrations/v1_12/v122.go
@@ -3,11 +3,9 @@
 
 package v1_12
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddRequireSignedCommits(x *xorm.Engine) error {
+func AddRequireSignedCommits(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		RequireSignedCommits bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_12/v123.go b/models/migrations/v1_12/v123.go
index 52b10bb8506..159d0c2e0d7 100644
--- a/models/migrations/v1_12/v123.go
+++ b/models/migrations/v1_12/v123.go
@@ -3,11 +3,9 @@
 
 package v1_12
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddReactionOriginals(x *xorm.Engine) error {
+func AddReactionOriginals(x db.EngineMigration) error {
 	type Reaction struct {
 		OriginalAuthorID int64 `xorm:"INDEX NOT NULL DEFAULT(0)"`
 		OriginalAuthor   string
diff --git a/models/migrations/v1_12/v124.go b/models/migrations/v1_12/v124.go
index 9a93f436d43..928d13f3a11 100644
--- a/models/migrations/v1_12/v124.go
+++ b/models/migrations/v1_12/v124.go
@@ -3,11 +3,9 @@
 
 package v1_12
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddUserRepoMissingColumns(x *xorm.Engine) error {
+func AddUserRepoMissingColumns(x db.EngineMigration) error {
 	type VisibleType int
 	type User struct {
 		PasswdHashAlgo string      `xorm:"NOT NULL DEFAULT 'pbkdf2'"`
diff --git a/models/migrations/v1_12/v125.go b/models/migrations/v1_12/v125.go
index 7f582ecff5e..c83c068b6b0 100644
--- a/models/migrations/v1_12/v125.go
+++ b/models/migrations/v1_12/v125.go
@@ -6,10 +6,10 @@ package v1_12
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddReviewMigrateInfo(x *xorm.Engine) error {
+func AddReviewMigrateInfo(x db.EngineMigration) error {
 	type Review struct {
 		OriginalAuthor   string
 		OriginalAuthorID int64
diff --git a/models/migrations/v1_12/v126.go b/models/migrations/v1_12/v126.go
index 64fd7f74787..f74dac9985d 100644
--- a/models/migrations/v1_12/v126.go
+++ b/models/migrations/v1_12/v126.go
@@ -4,11 +4,12 @@
 package v1_12
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
-func FixTopicRepositoryCount(x *xorm.Engine) error {
+func FixTopicRepositoryCount(x db.EngineMigration) error {
 	_, err := x.Exec(builder.Delete(builder.NotIn("`repo_id`", builder.Select("`id`").From("`repository`"))).From("`repo_topic`"))
 	if err != nil {
 		return err
diff --git a/models/migrations/v1_12/v127.go b/models/migrations/v1_12/v127.go
index 9bd78db95e4..2a2438bacc6 100644
--- a/models/migrations/v1_12/v127.go
+++ b/models/migrations/v1_12/v127.go
@@ -6,12 +6,11 @@ package v1_12
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddLanguageStats(x *xorm.Engine) error {
+func AddLanguageStats(x db.EngineMigration) error {
 	// LanguageStat see models/repo_language_stats.go
 	type LanguageStat struct {
 		ID          int64 `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_12/v128.go b/models/migrations/v1_12/v128.go
index ff5b12af18f..b2486ea3c6f 100644
--- a/models/migrations/v1_12/v128.go
+++ b/models/migrations/v1_12/v128.go
@@ -11,15 +11,14 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
-func FixMergeBase(ctx context.Context, x *xorm.Engine) error {
+func FixMergeBase(ctx context.Context, x db.EngineMigration) error {
 	type Repository struct {
 		ID        int64 `xorm:"pk autoincr"`
 		OwnerID   int64 `xorm:"UNIQUE(s) index"`
diff --git a/models/migrations/v1_12/v129.go b/models/migrations/v1_12/v129.go
index 3e4d3aca685..5867530090c 100644
--- a/models/migrations/v1_12/v129.go
+++ b/models/migrations/v1_12/v129.go
@@ -3,11 +3,9 @@
 
 package v1_12
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func PurgeUnusedDependencies(x *xorm.Engine) error {
+func PurgeUnusedDependencies(x db.EngineMigration) error {
 	if _, err := x.Exec("DELETE FROM issue_dependency WHERE issue_id NOT IN (SELECT id FROM issue)"); err != nil {
 		return err
 	}
diff --git a/models/migrations/v1_12/v130.go b/models/migrations/v1_12/v130.go
index 107bb756fd6..290cb0af052 100644
--- a/models/migrations/v1_12/v130.go
+++ b/models/migrations/v1_12/v130.go
@@ -4,13 +4,12 @@
 package v1_12
 
 import (
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
 )
 
-func ExpandWebhooks(x *xorm.Engine) error {
+func ExpandWebhooks(x db.EngineMigration) error {
 	type HookEvents struct {
 		Create               bool `json:"create"`
 		Delete               bool `json:"delete"`
diff --git a/models/migrations/v1_12/v131.go b/models/migrations/v1_12/v131.go
index 1266c2f1859..35831d0cc6c 100644
--- a/models/migrations/v1_12/v131.go
+++ b/models/migrations/v1_12/v131.go
@@ -6,10 +6,10 @@ package v1_12
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddSystemWebhookColumn(x *xorm.Engine) error {
+func AddSystemWebhookColumn(x db.EngineMigration) error {
 	type Webhook struct {
 		IsSystemWebhook bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_12/v132.go b/models/migrations/v1_12/v132.go
index 8b1ae6db935..2248251b57e 100644
--- a/models/migrations/v1_12/v132.go
+++ b/models/migrations/v1_12/v132.go
@@ -6,10 +6,10 @@ package v1_12
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddBranchProtectionProtectedFilesColumn(x *xorm.Engine) error {
+func AddBranchProtectionProtectedFilesColumn(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		ProtectedFilePatterns string `xorm:"TEXT"`
 	}
diff --git a/models/migrations/v1_12/v133.go b/models/migrations/v1_12/v133.go
index 69e20597d85..6eb6cdc5041 100644
--- a/models/migrations/v1_12/v133.go
+++ b/models/migrations/v1_12/v133.go
@@ -3,9 +3,9 @@
 
 package v1_12
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddEmailHashTable(x *xorm.Engine) error {
+func AddEmailHashTable(x db.EngineMigration) error {
 	// EmailHash represents a pre-generated hash map
 	type EmailHash struct {
 		Hash  string `xorm:"pk varchar(32)"`
diff --git a/models/migrations/v1_12/v134.go b/models/migrations/v1_12/v134.go
index 98bb8dbda72..017fb547d39 100644
--- a/models/migrations/v1_12/v134.go
+++ b/models/migrations/v1_12/v134.go
@@ -11,14 +11,13 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
-func RefixMergeBase(ctx context.Context, x *xorm.Engine) error {
+func RefixMergeBase(ctx context.Context, x db.EngineMigration) error {
 	type Repository struct {
 		ID        int64 `xorm:"pk autoincr"`
 		OwnerID   int64 `xorm:"UNIQUE(s) index"`
diff --git a/models/migrations/v1_12/v135.go b/models/migrations/v1_12/v135.go
index 5df0ad7fc4f..00664ca2ff1 100644
--- a/models/migrations/v1_12/v135.go
+++ b/models/migrations/v1_12/v135.go
@@ -6,10 +6,10 @@ package v1_12
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddOrgIDLabelColumn(x *xorm.Engine) error {
+func AddOrgIDLabelColumn(x db.EngineMigration) error {
 	type Label struct {
 		OrgID int64 `xorm:"INDEX"`
 	}
diff --git a/models/migrations/v1_12/v136.go b/models/migrations/v1_12/v136.go
index 20b892b6cc5..66f7b2aea4e 100644
--- a/models/migrations/v1_12/v136.go
+++ b/models/migrations/v1_12/v136.go
@@ -8,16 +8,15 @@ import (
 	"math"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
-func AddCommitDivergenceToPulls(x *xorm.Engine) error {
+func AddCommitDivergenceToPulls(x db.EngineMigration) error {
 	type Repository struct {
 		ID        int64 `xorm:"pk autoincr"`
 		OwnerID   int64 `xorm:"UNIQUE(s) index"`
diff --git a/models/migrations/v1_12/v137.go b/models/migrations/v1_12/v137.go
index 9d384834882..c8ef8dbd430 100644
--- a/models/migrations/v1_12/v137.go
+++ b/models/migrations/v1_12/v137.go
@@ -3,11 +3,9 @@
 
 package v1_12
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddBlockOnOutdatedBranch(x *xorm.Engine) error {
+func AddBlockOnOutdatedBranch(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		BlockOnOutdatedBranch bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_12/v138.go b/models/migrations/v1_12/v138.go
index 4485adeb2dc..fa418abc709 100644
--- a/models/migrations/v1_12/v138.go
+++ b/models/migrations/v1_12/v138.go
@@ -6,10 +6,10 @@ package v1_12
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddResolveDoerIDCommentColumn(x *xorm.Engine) error {
+func AddResolveDoerIDCommentColumn(x db.EngineMigration) error {
 	type Comment struct {
 		ResolveDoerID int64
 	}
diff --git a/models/migrations/v1_12/v139.go b/models/migrations/v1_12/v139.go
index a3799841ac5..6c57fdef0b9 100644
--- a/models/migrations/v1_12/v139.go
+++ b/models/migrations/v1_12/v139.go
@@ -4,12 +4,11 @@
 package v1_12
 
 import (
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
 )
 
-func PrependRefsHeadsToIssueRefs(x *xorm.Engine) error {
+func PrependRefsHeadsToIssueRefs(x db.EngineMigration) error {
 	var query string
 
 	switch {
diff --git a/models/migrations/v1_13/v140.go b/models/migrations/v1_13/v140.go
index a9a047bca9d..8c8e5d795a0 100644
--- a/models/migrations/v1_13/v140.go
+++ b/models/migrations/v1_13/v140.go
@@ -6,13 +6,12 @@ package v1_13
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/setting"
 )
 
-func FixLanguageStatsToSaveSize(x *xorm.Engine) error {
+func FixLanguageStatsToSaveSize(x db.EngineMigration) error {
 	// LanguageStat see models/repo_language_stats.go
 	type LanguageStat struct {
 		Size int64 `xorm:"NOT NULL DEFAULT 0"`
diff --git a/models/migrations/v1_13/v141.go b/models/migrations/v1_13/v141.go
index b54bc1727cb..e6d56ffa5ed 100644
--- a/models/migrations/v1_13/v141.go
+++ b/models/migrations/v1_13/v141.go
@@ -6,10 +6,10 @@ package v1_13
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddKeepActivityPrivateUserColumn(x *xorm.Engine) error {
+func AddKeepActivityPrivateUserColumn(x db.EngineMigration) error {
 	type User struct {
 		KeepActivityPrivate bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_13/v142.go b/models/migrations/v1_13/v142.go
index d08a0ae0bf4..189504772ff 100644
--- a/models/migrations/v1_13/v142.go
+++ b/models/migrations/v1_13/v142.go
@@ -4,13 +4,13 @@
 package v1_13
 
 import (
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
-func SetIsArchivedToFalse(x *xorm.Engine) error {
+func SetIsArchivedToFalse(x db.EngineMigration) error {
 	type Repository struct {
 		IsArchived bool `xorm:"INDEX"`
 	}
diff --git a/models/migrations/v1_13/v143.go b/models/migrations/v1_13/v143.go
index b9a856ed0fa..283611e764e 100644
--- a/models/migrations/v1_13/v143.go
+++ b/models/migrations/v1_13/v143.go
@@ -4,12 +4,11 @@
 package v1_13
 
 import (
-	"code.gitea.io/gitea/modules/log"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
 )
 
-func RecalculateStars(x *xorm.Engine) (err error) {
+func RecalculateStars(x db.EngineMigration) (err error) {
 	// because of issue https://github.com/go-gitea/gitea/issues/11949,
 	// recalculate Stars number for all users to fully fix it.
 
diff --git a/models/migrations/v1_13/v144.go b/models/migrations/v1_13/v144.go
index 9352d78bc88..0e51ab9cb91 100644
--- a/models/migrations/v1_13/v144.go
+++ b/models/migrations/v1_13/v144.go
@@ -4,13 +4,13 @@
 package v1_13
 
 import (
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
-func UpdateMatrixWebhookHTTPMethod(x *xorm.Engine) error {
+func UpdateMatrixWebhookHTTPMethod(x db.EngineMigration) error {
 	matrixHookTaskType := 9 // value comes from the models package
 	type Webhook struct {
 		HTTPMethod string
diff --git a/models/migrations/v1_13/v145.go b/models/migrations/v1_13/v145.go
index 86ebb4f9d95..b46b269650f 100644
--- a/models/migrations/v1_13/v145.go
+++ b/models/migrations/v1_13/v145.go
@@ -6,12 +6,11 @@ package v1_13
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
 )
 
-func IncreaseLanguageField(x *xorm.Engine) error {
+func IncreaseLanguageField(x db.EngineMigration) error {
 	type LanguageStat struct {
 		RepoID   int64  `xorm:"UNIQUE(s) INDEX NOT NULL"`
 		Language string `xorm:"VARCHAR(50) UNIQUE(s) INDEX NOT NULL"`
diff --git a/models/migrations/v1_13/v146.go b/models/migrations/v1_13/v146.go
index 355c772c268..dc0cb1a4e19 100644
--- a/models/migrations/v1_13/v146.go
+++ b/models/migrations/v1_13/v146.go
@@ -4,12 +4,11 @@
 package v1_13
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddProjectsInfo(x *xorm.Engine) error {
+func AddProjectsInfo(x db.EngineMigration) error {
 	// Create new tables
 	type (
 		ProjectType      uint8
diff --git a/models/migrations/v1_13/v147.go b/models/migrations/v1_13/v147.go
index 0059c062203..314b4578b60 100644
--- a/models/migrations/v1_13/v147.go
+++ b/models/migrations/v1_13/v147.go
@@ -4,12 +4,11 @@
 package v1_13
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func CreateReviewsForCodeComments(x *xorm.Engine) error {
+func CreateReviewsForCodeComments(x db.EngineMigration) error {
 	// Review
 	type Review struct {
 		ID               int64 `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_13/v148.go b/models/migrations/v1_13/v148.go
index d276db3d61d..c1c27a49d43 100644
--- a/models/migrations/v1_13/v148.go
+++ b/models/migrations/v1_13/v148.go
@@ -3,11 +3,9 @@
 
 package v1_13
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func PurgeInvalidDependenciesComments(x *xorm.Engine) error {
+func PurgeInvalidDependenciesComments(x db.EngineMigration) error {
 	_, err := x.Exec("DELETE FROM comment WHERE dependent_issue_id != 0 AND dependent_issue_id NOT IN (SELECT id FROM issue)")
 	return err
 }
diff --git a/models/migrations/v1_13/v149.go b/models/migrations/v1_13/v149.go
index a96b8e5ac7d..09f1e818516 100644
--- a/models/migrations/v1_13/v149.go
+++ b/models/migrations/v1_13/v149.go
@@ -6,12 +6,11 @@ package v1_13
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddCreatedAndUpdatedToMilestones(x *xorm.Engine) error {
+func AddCreatedAndUpdatedToMilestones(x db.EngineMigration) error {
 	type Milestone struct {
 		CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
 		UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
diff --git a/models/migrations/v1_13/v150.go b/models/migrations/v1_13/v150.go
index 590ea729030..a1e8236f7d1 100644
--- a/models/migrations/v1_13/v150.go
+++ b/models/migrations/v1_13/v150.go
@@ -4,13 +4,12 @@
 package v1_13
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddPrimaryKeyToRepoTopic(x *xorm.Engine) error {
+func AddPrimaryKeyToRepoTopic(x db.EngineMigration) error {
 	// Topic represents a topic of repositories
 	type Topic struct {
 		ID          int64  `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_13/v151.go b/models/migrations/v1_13/v151.go
index 454929534fe..995d4b32fa9 100644
--- a/models/migrations/v1_13/v151.go
+++ b/models/migrations/v1_13/v151.go
@@ -9,14 +9,14 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
-func SetDefaultPasswordToArgon2(x *xorm.Engine) error {
+func SetDefaultPasswordToArgon2(x db.EngineMigration) error {
 	switch {
 	case setting.Database.Type.IsMySQL():
 		_, err := x.Exec("ALTER TABLE `user` ALTER passwd_hash_algo SET DEFAULT 'argon2';")
diff --git a/models/migrations/v1_13/v152.go b/models/migrations/v1_13/v152.go
index 648e26446fe..42055d0e78f 100644
--- a/models/migrations/v1_13/v152.go
+++ b/models/migrations/v1_13/v152.go
@@ -3,9 +3,9 @@
 
 package v1_13
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddTrustModelToRepository(x *xorm.Engine) error {
+func AddTrustModelToRepository(x db.EngineMigration) error {
 	type Repository struct {
 		TrustModel int
 	}
diff --git a/models/migrations/v1_13/v153.go b/models/migrations/v1_13/v153.go
index e5462fc1624..c04d1b64a3e 100644
--- a/models/migrations/v1_13/v153.go
+++ b/models/migrations/v1_13/v153.go
@@ -3,11 +3,9 @@
 
 package v1_13
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddTeamReviewRequestSupport(x *xorm.Engine) error {
+func AddTeamReviewRequestSupport(x db.EngineMigration) error {
 	type Review struct {
 		ReviewerTeamID int64 `xorm:"NOT NULL DEFAULT 0"`
 	}
diff --git a/models/migrations/v1_13/v154.go b/models/migrations/v1_13/v154.go
index 5477d1b8891..1954a04692e 100644
--- a/models/migrations/v1_13/v154.go
+++ b/models/migrations/v1_13/v154.go
@@ -4,12 +4,11 @@
 package v1_13
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddTimeStamps(x *xorm.Engine) error {
+func AddTimeStamps(x db.EngineMigration) error {
 	// this will add timestamps where it is useful to have
 
 	// Star represents a starred repo by an user.
diff --git a/models/migrations/v1_14/main_test.go b/models/migrations/v1_14/main_test.go
index 6ed240c4075..31aacc52111 100644
--- a/models/migrations/v1_14/main_test.go
+++ b/models/migrations/v1_14/main_test.go
@@ -6,7 +6,7 @@ package v1_14
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_14/v155.go b/models/migrations/v1_14/v155.go
index 505a9ae0334..f605c18d57b 100644
--- a/models/migrations/v1_14/v155.go
+++ b/models/migrations/v1_14/v155.go
@@ -6,10 +6,10 @@ package v1_14
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddChangedProtectedFilesPullRequestColumn(x *xorm.Engine) error {
+func AddChangedProtectedFilesPullRequestColumn(x db.EngineMigration) error {
 	type PullRequest struct {
 		ChangedProtectedFiles []string `xorm:"TEXT JSON"`
 	}
diff --git a/models/migrations/v1_14/v156.go b/models/migrations/v1_14/v156.go
index 593d3f9c70c..e1078f4bd05 100644
--- a/models/migrations/v1_14/v156.go
+++ b/models/migrations/v1_14/v156.go
@@ -9,11 +9,10 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 // Copy paste from models/repo.go because we cannot import models package
@@ -25,7 +24,7 @@ func userPath(userName string) string {
 	return filepath.Join(setting.RepoRootPath, strings.ToLower(userName))
 }
 
-func FixPublisherIDforTagReleases(ctx context.Context, x *xorm.Engine) error {
+func FixPublisherIDforTagReleases(ctx context.Context, x db.EngineMigration) error {
 	type Release struct {
 		ID          int64
 		RepoID      int64
diff --git a/models/migrations/v1_14/v157.go b/models/migrations/v1_14/v157.go
index 2c5625ebbd4..b6058a03039 100644
--- a/models/migrations/v1_14/v157.go
+++ b/models/migrations/v1_14/v157.go
@@ -3,11 +3,9 @@
 
 package v1_14
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func FixRepoTopics(x *xorm.Engine) error {
+func FixRepoTopics(x db.EngineMigration) error {
 	type Repository struct {
 		ID     int64    `xorm:"pk autoincr"`
 		Topics []string `xorm:"TEXT JSON"`
diff --git a/models/migrations/v1_14/v158.go b/models/migrations/v1_14/v158.go
index 3c57e8e3daa..62f8036b355 100644
--- a/models/migrations/v1_14/v158.go
+++ b/models/migrations/v1_14/v158.go
@@ -7,13 +7,12 @@ import (
 	"errors"
 	"strconv"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
-func UpdateCodeCommentReplies(x *xorm.Engine) error {
+func UpdateCodeCommentReplies(x db.EngineMigration) error {
 	type Comment struct {
 		ID          int64  `xorm:"pk autoincr"`
 		CommitSHA   string `xorm:"VARCHAR(40)"`
diff --git a/models/migrations/v1_14/v159.go b/models/migrations/v1_14/v159.go
index e6f6f0f061a..1dd2e1c639f 100644
--- a/models/migrations/v1_14/v159.go
+++ b/models/migrations/v1_14/v159.go
@@ -4,13 +4,12 @@
 package v1_14
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/timeutil"
 )
 
-func UpdateReactionConstraint(x *xorm.Engine) error {
+func UpdateReactionConstraint(x db.EngineMigration) error {
 	// Reaction represents a reactions on issues and comments.
 	type Reaction struct {
 		ID               int64              `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_14/v160.go b/models/migrations/v1_14/v160.go
index 73f37989547..b216929387c 100644
--- a/models/migrations/v1_14/v160.go
+++ b/models/migrations/v1_14/v160.go
@@ -3,11 +3,9 @@
 
 package v1_14
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddBlockOnOfficialReviewRequests(x *xorm.Engine) error {
+func AddBlockOnOfficialReviewRequests(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		BlockOnOfficialReviewRequests bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_14/v161.go b/models/migrations/v1_14/v161.go
index eb92dee77cb..78ef19c34d3 100644
--- a/models/migrations/v1_14/v161.go
+++ b/models/migrations/v1_14/v161.go
@@ -6,12 +6,11 @@ package v1_14
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 )
 
-func ConvertTaskTypeToString(x *xorm.Engine) error {
+func ConvertTaskTypeToString(x db.EngineMigration) error {
 	const (
 		GOGS int = iota + 1
 		SLACK
diff --git a/models/migrations/v1_14/v162.go b/models/migrations/v1_14/v162.go
index a0ddd36d55f..02bc48938ed 100644
--- a/models/migrations/v1_14/v162.go
+++ b/models/migrations/v1_14/v162.go
@@ -4,12 +4,11 @@
 package v1_14
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 )
 
-func ConvertWebhookTaskTypeToString(x *xorm.Engine) error {
+func ConvertWebhookTaskTypeToString(x db.EngineMigration) error {
 	const (
 		GOGS int = iota + 1
 		SLACK
diff --git a/models/migrations/v1_14/v163.go b/models/migrations/v1_14/v163.go
index 84c35190b7b..08819d2dc56 100644
--- a/models/migrations/v1_14/v163.go
+++ b/models/migrations/v1_14/v163.go
@@ -4,12 +4,11 @@
 package v1_14
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 )
 
-func ConvertTopicNameFrom25To50(x *xorm.Engine) error {
+func ConvertTopicNameFrom25To50(x db.EngineMigration) error {
 	type Topic struct {
 		ID          int64  `xorm:"pk autoincr"`
 		Name        string `xorm:"UNIQUE VARCHAR(50)"`
diff --git a/models/migrations/v1_14/v164.go b/models/migrations/v1_14/v164.go
index d2fd9b8464a..58325ca4044 100644
--- a/models/migrations/v1_14/v164.go
+++ b/models/migrations/v1_14/v164.go
@@ -6,7 +6,7 @@ package v1_14
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
 // OAuth2Grant here is a snapshot of models.OAuth2Grant for this version
@@ -29,7 +29,7 @@ func (grant *OAuth2Grant) TableName() string {
 	return "oauth2_grant"
 }
 
-func AddScopeAndNonceColumnsToOAuth2Grant(x *xorm.Engine) error {
+func AddScopeAndNonceColumnsToOAuth2Grant(x db.EngineMigration) error {
 	if err := x.Sync(new(OAuth2Grant)); err != nil {
 		return fmt.Errorf("Sync: %w", err)
 	}
diff --git a/models/migrations/v1_14/v165.go b/models/migrations/v1_14/v165.go
index 6e1b34156b8..d5fa4d008d8 100644
--- a/models/migrations/v1_14/v165.go
+++ b/models/migrations/v1_14/v165.go
@@ -4,13 +4,13 @@
 package v1_14
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
-func ConvertHookTaskTypeToVarcharAndTrim(x *xorm.Engine) error {
+func ConvertHookTaskTypeToVarcharAndTrim(x db.EngineMigration) error {
 	dbType := x.Dialect().URI().DBType
 	if dbType == schemas.SQLITE { // For SQLITE, varchar or char will always be represented as TEXT
 		return nil
diff --git a/models/migrations/v1_14/v166.go b/models/migrations/v1_14/v166.go
index 4c106bd7daf..ca03363d558 100644
--- a/models/migrations/v1_14/v166.go
+++ b/models/migrations/v1_14/v166.go
@@ -7,15 +7,16 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 
+	"gitea.dev/models/db"
+
 	"golang.org/x/crypto/argon2"
 	"golang.org/x/crypto/bcrypt"
 	"golang.org/x/crypto/pbkdf2"
 	"golang.org/x/crypto/scrypt"
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
-func RecalculateUserEmptyPWD(x *xorm.Engine) (err error) {
+func RecalculateUserEmptyPWD(x db.EngineMigration) (err error) {
 	const (
 		algoBcrypt = "bcrypt"
 		algoScrypt = "scrypt"
diff --git a/models/migrations/v1_14/v167.go b/models/migrations/v1_14/v167.go
index d77bbc401e5..ac1e6c04985 100644
--- a/models/migrations/v1_14/v167.go
+++ b/models/migrations/v1_14/v167.go
@@ -6,10 +6,10 @@ package v1_14
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddUserRedirect(x *xorm.Engine) (err error) {
+func AddUserRedirect(x db.EngineMigration) (err error) {
 	type UserRedirect struct {
 		ID             int64  `xorm:"pk autoincr"`
 		LowerName      string `xorm:"UNIQUE(s) INDEX NOT NULL"`
diff --git a/models/migrations/v1_14/v168.go b/models/migrations/v1_14/v168.go
index aa93eec19b0..f8eda53fd87 100644
--- a/models/migrations/v1_14/v168.go
+++ b/models/migrations/v1_14/v168.go
@@ -3,8 +3,8 @@
 
 package v1_14
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func RecreateUserTableToFixDefaultValues(_ *xorm.Engine) error {
+func RecreateUserTableToFixDefaultValues(_ db.EngineMigration) error {
 	return nil
 }
diff --git a/models/migrations/v1_14/v169.go b/models/migrations/v1_14/v169.go
index 4f9df0d96f2..3bb542516b5 100644
--- a/models/migrations/v1_14/v169.go
+++ b/models/migrations/v1_14/v169.go
@@ -3,11 +3,9 @@
 
 package v1_14
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func CommentTypeDeleteBranchUseOldRef(x *xorm.Engine) error {
+func CommentTypeDeleteBranchUseOldRef(x db.EngineMigration) error {
 	_, err := x.Exec("UPDATE comment SET old_ref = commit_sha, commit_sha = '' WHERE type = 11")
 	return err
 }
diff --git a/models/migrations/v1_14/v170.go b/models/migrations/v1_14/v170.go
index a2ff4623e14..1626316a20c 100644
--- a/models/migrations/v1_14/v170.go
+++ b/models/migrations/v1_14/v170.go
@@ -6,10 +6,10 @@ package v1_14
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddDismissedReviewColumn(x *xorm.Engine) error {
+func AddDismissedReviewColumn(x db.EngineMigration) error {
 	type Review struct {
 		Dismissed bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_14/v171.go b/models/migrations/v1_14/v171.go
index 7b200e960ad..4e6577592aa 100644
--- a/models/migrations/v1_14/v171.go
+++ b/models/migrations/v1_14/v171.go
@@ -6,10 +6,10 @@ package v1_14
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddSortingColToProjectBoard(x *xorm.Engine) error {
+func AddSortingColToProjectBoard(x db.EngineMigration) error {
 	type ProjectBoard struct {
 		Sorting int8 `xorm:"NOT NULL DEFAULT 0"`
 	}
diff --git a/models/migrations/v1_14/v172.go b/models/migrations/v1_14/v172.go
index bbd61d87b28..d912ba3b78d 100644
--- a/models/migrations/v1_14/v172.go
+++ b/models/migrations/v1_14/v172.go
@@ -4,12 +4,11 @@
 package v1_14
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddSessionTable(x *xorm.Engine) error {
+func AddSessionTable(x db.EngineMigration) error {
 	type Session struct {
 		Key    string `xorm:"pk CHAR(16)"`
 		Data   []byte `xorm:"BLOB"`
diff --git a/models/migrations/v1_14/v173.go b/models/migrations/v1_14/v173.go
index 7752fbe9664..51278211b5e 100644
--- a/models/migrations/v1_14/v173.go
+++ b/models/migrations/v1_14/v173.go
@@ -6,10 +6,10 @@ package v1_14
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddTimeIDCommentColumn(x *xorm.Engine) error {
+func AddTimeIDCommentColumn(x db.EngineMigration) error {
 	type Comment struct {
 		TimeID int64
 	}
diff --git a/models/migrations/v1_14/v174.go b/models/migrations/v1_14/v174.go
index 4049e43070d..4e88e892c9b 100644
--- a/models/migrations/v1_14/v174.go
+++ b/models/migrations/v1_14/v174.go
@@ -6,10 +6,10 @@ package v1_14
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddRepoTransfer(x *xorm.Engine) error {
+func AddRepoTransfer(x db.EngineMigration) error {
 	type RepoTransfer struct {
 		ID          int64 `xorm:"pk autoincr"`
 		DoerID      int64
diff --git a/models/migrations/v1_14/v175.go b/models/migrations/v1_14/v175.go
index 92ed1304734..556996e9726 100644
--- a/models/migrations/v1_14/v175.go
+++ b/models/migrations/v1_14/v175.go
@@ -7,13 +7,12 @@ import (
 	"fmt"
 	"regexp"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
-func FixPostgresIDSequences(x *xorm.Engine) error {
+func FixPostgresIDSequences(x db.EngineMigration) error {
 	if !setting.Database.Type.IsPostgreSQL() {
 		return nil
 	}
diff --git a/models/migrations/v1_14/v176.go b/models/migrations/v1_14/v176.go
index ef5dce9a027..a464ed56ec6 100644
--- a/models/migrations/v1_14/v176.go
+++ b/models/migrations/v1_14/v176.go
@@ -3,14 +3,12 @@
 
 package v1_14
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
 // RemoveInvalidLabels looks through the database to look for comments and issue_labels
 // that refer to labels do not belong to the repository or organization that repository
 // that the issue is in
-func RemoveInvalidLabels(x *xorm.Engine) error {
+func RemoveInvalidLabels(x db.EngineMigration) error {
 	type Comment struct {
 		ID      int64 `xorm:"pk autoincr"`
 		Type    int   `xorm:"INDEX"`
diff --git a/models/migrations/v1_14/v176_test.go b/models/migrations/v1_14/v176_test.go
index aa57b5ad1d9..7a830d8d512 100644
--- a/models/migrations/v1_14/v176_test.go
+++ b/models/migrations/v1_14/v176_test.go
@@ -6,7 +6,7 @@ package v1_14
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_14/v177.go b/models/migrations/v1_14/v177.go
index 96676bf8d94..7230693909b 100644
--- a/models/migrations/v1_14/v177.go
+++ b/models/migrations/v1_14/v177.go
@@ -6,11 +6,11 @@ package v1_14
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
 // DeleteOrphanedIssueLabels looks through the database for issue_labels where the label no longer exists and deletes them.
-func DeleteOrphanedIssueLabels(x *xorm.Engine) error {
+func DeleteOrphanedIssueLabels(x db.EngineMigration) error {
 	type IssueLabel struct {
 		ID      int64 `xorm:"pk autoincr"`
 		IssueID int64 `xorm:"UNIQUE(s)"`
diff --git a/models/migrations/v1_14/v177_test.go b/models/migrations/v1_14/v177_test.go
index a86fb98830c..4b80dc7d6aa 100644
--- a/models/migrations/v1_14/v177_test.go
+++ b/models/migrations/v1_14/v177_test.go
@@ -6,8 +6,8 @@ package v1_14
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_15/main_test.go b/models/migrations/v1_15/main_test.go
index 768bbd310b0..87b10d3b76d 100644
--- a/models/migrations/v1_15/main_test.go
+++ b/models/migrations/v1_15/main_test.go
@@ -6,7 +6,7 @@ package v1_15
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_15/v178.go b/models/migrations/v1_15/v178.go
index ca3a5c262e4..35bbf74f419 100644
--- a/models/migrations/v1_15/v178.go
+++ b/models/migrations/v1_15/v178.go
@@ -3,11 +3,9 @@
 
 package v1_15
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddLFSMirrorColumns(x *xorm.Engine) error {
+func AddLFSMirrorColumns(x db.EngineMigration) error {
 	type Mirror struct {
 		LFS         bool   `xorm:"lfs_enabled NOT NULL DEFAULT false"`
 		LFSEndpoint string `xorm:"lfs_endpoint TEXT"`
diff --git a/models/migrations/v1_15/v179.go b/models/migrations/v1_15/v179.go
index d6fb86ffecc..4380bc560aa 100644
--- a/models/migrations/v1_15/v179.go
+++ b/models/migrations/v1_15/v179.go
@@ -4,13 +4,13 @@
 package v1_15
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
-func ConvertAvatarURLToText(x *xorm.Engine) error {
+func ConvertAvatarURLToText(x db.EngineMigration) error {
 	dbType := x.Dialect().URI().DBType
 	if dbType == schemas.SQLITE { // For SQLITE, varchar or char will always be represented as TEXT
 		return nil
diff --git a/models/migrations/v1_15/v180.go b/models/migrations/v1_15/v180.go
index dd132f83306..b5247b1a333 100644
--- a/models/migrations/v1_15/v180.go
+++ b/models/migrations/v1_15/v180.go
@@ -4,14 +4,14 @@
 package v1_15
 
 import (
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
-func DeleteMigrationCredentials(x *xorm.Engine) (err error) {
+func DeleteMigrationCredentials(x db.EngineMigration) (err error) {
 	// Task represents a task
 	type Task struct {
 		ID             int64
diff --git a/models/migrations/v1_15/v181.go b/models/migrations/v1_15/v181.go
index fb1d3d7a75f..841a8a85e56 100644
--- a/models/migrations/v1_15/v181.go
+++ b/models/migrations/v1_15/v181.go
@@ -6,10 +6,10 @@ package v1_15
 import (
 	"strings"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddPrimaryEmail2EmailAddress(x *xorm.Engine) error {
+func AddPrimaryEmail2EmailAddress(x db.EngineMigration) error {
 	type User struct {
 		ID       int64  `xorm:"pk autoincr"`
 		Email    string `xorm:"NOT NULL"`
diff --git a/models/migrations/v1_15/v181_test.go b/models/migrations/v1_15/v181_test.go
index e230c684eab..4e004abcb0c 100644
--- a/models/migrations/v1_15/v181_test.go
+++ b/models/migrations/v1_15/v181_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_15/v182.go b/models/migrations/v1_15/v182.go
index f53ff11df9c..2fc8f06225e 100644
--- a/models/migrations/v1_15/v182.go
+++ b/models/migrations/v1_15/v182.go
@@ -3,11 +3,9 @@
 
 package v1_15
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddIssueResourceIndexTable(x *xorm.Engine) error {
+func AddIssueResourceIndexTable(x db.EngineMigration) error {
 	type ResourceIndex struct {
 		GroupID  int64 `xorm:"pk"`
 		MaxIndex int64 `xorm:"index"`
diff --git a/models/migrations/v1_15/v182_test.go b/models/migrations/v1_15/v182_test.go
index c0a1378534c..049f9a17850 100644
--- a/models/migrations/v1_15/v182_test.go
+++ b/models/migrations/v1_15/v182_test.go
@@ -6,7 +6,7 @@ package v1_15
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_15/v183.go b/models/migrations/v1_15/v183.go
index 5d0582f03d4..dee388a961b 100644
--- a/models/migrations/v1_15/v183.go
+++ b/models/migrations/v1_15/v183.go
@@ -7,12 +7,11 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func CreatePushMirrorTable(x *xorm.Engine) error {
+func CreatePushMirrorTable(x db.EngineMigration) error {
 	type PushMirror struct {
 		ID         int64 `xorm:"pk autoincr"`
 		RepoID     int64 `xorm:"INDEX"`
diff --git a/models/migrations/v1_15/v184.go b/models/migrations/v1_15/v184.go
index 2823bc1f7af..21ae3395222 100644
--- a/models/migrations/v1_15/v184.go
+++ b/models/migrations/v1_15/v184.go
@@ -7,13 +7,12 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/setting"
 )
 
-func RenameTaskErrorsToMessage(x *xorm.Engine) error {
+func RenameTaskErrorsToMessage(x db.EngineMigration) error {
 	type Task struct {
 		Errors string `xorm:"TEXT"` // if task failed, saved the error reason
 		Type   int
diff --git a/models/migrations/v1_15/v185.go b/models/migrations/v1_15/v185.go
index 60af59edca4..1a6d84afff1 100644
--- a/models/migrations/v1_15/v185.go
+++ b/models/migrations/v1_15/v185.go
@@ -3,11 +3,9 @@
 
 package v1_15
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddRepoArchiver(x *xorm.Engine) error {
+func AddRepoArchiver(x db.EngineMigration) error {
 	// RepoArchiver represents all archivers
 	type RepoArchiver struct {
 		ID          int64 `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_15/v186.go b/models/migrations/v1_15/v186.go
index 67dc97d13d7..44e096fecb9 100644
--- a/models/migrations/v1_15/v186.go
+++ b/models/migrations/v1_15/v186.go
@@ -4,12 +4,11 @@
 package v1_15
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func CreateProtectedTagTable(x *xorm.Engine) error {
+func CreateProtectedTagTable(x db.EngineMigration) error {
 	type ProtectedTag struct {
 		ID               int64 `xorm:"pk autoincr"`
 		RepoID           int64
diff --git a/models/migrations/v1_15/v187.go b/models/migrations/v1_15/v187.go
index 5fd90c65fbf..e8c388554b5 100644
--- a/models/migrations/v1_15/v187.go
+++ b/models/migrations/v1_15/v187.go
@@ -4,12 +4,11 @@
 package v1_15
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 )
 
-func DropWebhookColumns(x *xorm.Engine) error {
+func DropWebhookColumns(x db.EngineMigration) error {
 	// Make sure the columns exist before dropping them
 	type Webhook struct {
 		Signature string `xorm:"TEXT"`
diff --git a/models/migrations/v1_15/v188.go b/models/migrations/v1_15/v188.go
index 4494e6ff055..d3f9de33618 100644
--- a/models/migrations/v1_15/v188.go
+++ b/models/migrations/v1_15/v188.go
@@ -3,9 +3,9 @@
 
 package v1_15
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddKeyIsVerified(x *xorm.Engine) error {
+func AddKeyIsVerified(x db.EngineMigration) error {
 	type GPGKey struct {
 		Verified bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_16/main_test.go b/models/migrations/v1_16/main_test.go
index c54424788d6..aac2609f0e0 100644
--- a/models/migrations/v1_16/main_test.go
+++ b/models/migrations/v1_16/main_test.go
@@ -6,7 +6,7 @@ package v1_16
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_16/v189.go b/models/migrations/v1_16/v189.go
index 6bc99e58ab7..419135c8818 100644
--- a/models/migrations/v1_16/v189.go
+++ b/models/migrations/v1_16/v189.go
@@ -7,13 +7,12 @@ import (
 	"encoding/binary"
 	"fmt"
 
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/json"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/json"
 )
 
-func UnwrapLDAPSourceCfg(x *xorm.Engine) error {
+func UnwrapLDAPSourceCfg(x db.EngineMigration) error {
 	jsonUnmarshalHandleDoubleEncode := func(bs []byte, v any) error {
 		err := json.Unmarshal(bs, v)
 		if err != nil {
diff --git a/models/migrations/v1_16/v189_test.go b/models/migrations/v1_16/v189_test.go
index 44424dd3691..382b4972080 100644
--- a/models/migrations/v1_16/v189_test.go
+++ b/models/migrations/v1_16/v189_test.go
@@ -6,8 +6,8 @@ package v1_16
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_16/v190.go b/models/migrations/v1_16/v190.go
index 1eb6b6ddb4f..8dcb09b657e 100644
--- a/models/migrations/v1_16/v190.go
+++ b/models/migrations/v1_16/v190.go
@@ -6,10 +6,10 @@ package v1_16
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddAgitFlowPullRequest(x *xorm.Engine) error {
+func AddAgitFlowPullRequest(x db.EngineMigration) error {
 	type PullRequestFlow int
 
 	type PullRequest struct {
diff --git a/models/migrations/v1_16/v191.go b/models/migrations/v1_16/v191.go
index 957c82e484c..fc0ab2e08c9 100644
--- a/models/migrations/v1_16/v191.go
+++ b/models/migrations/v1_16/v191.go
@@ -4,12 +4,11 @@
 package v1_16
 
 import (
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
 )
 
-func AlterIssueAndCommentTextFieldsToLongText(x *xorm.Engine) error {
+func AlterIssueAndCommentTextFieldsToLongText(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 	if err := sess.Begin(); err != nil {
diff --git a/models/migrations/v1_16/v192.go b/models/migrations/v1_16/v192.go
index 9d03fbe3c8f..1daf229b27e 100644
--- a/models/migrations/v1_16/v192.go
+++ b/models/migrations/v1_16/v192.go
@@ -4,12 +4,11 @@
 package v1_16
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 )
 
-func RecreateIssueResourceIndexTable(x *xorm.Engine) error {
+func RecreateIssueResourceIndexTable(x db.EngineMigration) error {
 	type IssueIndex struct {
 		GroupID  int64 `xorm:"pk"`
 		MaxIndex int64 `xorm:"index"`
diff --git a/models/migrations/v1_16/v193.go b/models/migrations/v1_16/v193.go
index a5af2de3805..b015f61e3a1 100644
--- a/models/migrations/v1_16/v193.go
+++ b/models/migrations/v1_16/v193.go
@@ -3,11 +3,9 @@
 
 package v1_16
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddRepoIDForAttachment(x *xorm.Engine) error {
+func AddRepoIDForAttachment(x db.EngineMigration) error {
 	type Attachment struct {
 		ID         int64  `xorm:"pk autoincr"`
 		UUID       string `xorm:"uuid UNIQUE"`
diff --git a/models/migrations/v1_16/v193_test.go b/models/migrations/v1_16/v193_test.go
index f68dd6d92d8..a8359acb8ef 100644
--- a/models/migrations/v1_16/v193_test.go
+++ b/models/migrations/v1_16/v193_test.go
@@ -6,7 +6,7 @@ package v1_16
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_16/v194.go b/models/migrations/v1_16/v194.go
index 2e4ed8340e6..baf19df95fd 100644
--- a/models/migrations/v1_16/v194.go
+++ b/models/migrations/v1_16/v194.go
@@ -6,10 +6,10 @@ package v1_16
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddBranchProtectionUnprotectedFilesColumn(x *xorm.Engine) error {
+func AddBranchProtectionUnprotectedFilesColumn(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		UnprotectedFilePatterns string `xorm:"TEXT"`
 	}
diff --git a/models/migrations/v1_16/v195.go b/models/migrations/v1_16/v195.go
index 4fd42b7bd23..515e30eb8a5 100644
--- a/models/migrations/v1_16/v195.go
+++ b/models/migrations/v1_16/v195.go
@@ -6,10 +6,10 @@ package v1_16
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddTableCommitStatusIndex(x *xorm.Engine) error {
+func AddTableCommitStatusIndex(x db.EngineMigration) error {
 	// CommitStatusIndex represents a table for commit status index
 	type CommitStatusIndex struct {
 		ID       int64
diff --git a/models/migrations/v1_16/v195_test.go b/models/migrations/v1_16/v195_test.go
index bbfa5e162a8..4b4ffb5cb32 100644
--- a/models/migrations/v1_16/v195_test.go
+++ b/models/migrations/v1_16/v195_test.go
@@ -6,7 +6,7 @@ package v1_16
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_16/v196.go b/models/migrations/v1_16/v196.go
index 6c9caa100f1..8eb13cd024c 100644
--- a/models/migrations/v1_16/v196.go
+++ b/models/migrations/v1_16/v196.go
@@ -6,10 +6,10 @@ package v1_16
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddColorColToProjectBoard(x *xorm.Engine) error {
+func AddColorColToProjectBoard(x db.EngineMigration) error {
 	type ProjectBoard struct {
 		Color string `xorm:"VARCHAR(7)"`
 	}
diff --git a/models/migrations/v1_16/v197.go b/models/migrations/v1_16/v197.go
index 862bdfdcbdb..5f89635a0a5 100644
--- a/models/migrations/v1_16/v197.go
+++ b/models/migrations/v1_16/v197.go
@@ -3,11 +3,9 @@
 
 package v1_16
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddRenamedBranchTable(x *xorm.Engine) error {
+func AddRenamedBranchTable(x db.EngineMigration) error {
 	type RenamedBranch struct {
 		ID          int64 `xorm:"pk autoincr"`
 		RepoID      int64 `xorm:"INDEX NOT NULL"`
diff --git a/models/migrations/v1_16/v198.go b/models/migrations/v1_16/v198.go
index f35ede138a0..0cabb239885 100644
--- a/models/migrations/v1_16/v198.go
+++ b/models/migrations/v1_16/v198.go
@@ -6,12 +6,11 @@ package v1_16
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddTableIssueContentHistory(x *xorm.Engine) error {
+func AddTableIssueContentHistory(x db.EngineMigration) error {
 	type IssueContentHistory struct {
 		ID             int64 `xorm:"pk autoincr"`
 		PosterID       int64
diff --git a/models/migrations/v1_16/v200.go b/models/migrations/v1_16/v200.go
index de57fad8fe7..b6f65fc5c06 100644
--- a/models/migrations/v1_16/v200.go
+++ b/models/migrations/v1_16/v200.go
@@ -6,10 +6,10 @@ package v1_16
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddTableAppState(x *xorm.Engine) error {
+func AddTableAppState(x db.EngineMigration) error {
 	type AppState struct {
 		ID       string `xorm:"pk varchar(200)"`
 		Revision int64
diff --git a/models/migrations/v1_16/v201.go b/models/migrations/v1_16/v201.go
index 2c43698b0c9..f5e1422413d 100644
--- a/models/migrations/v1_16/v201.go
+++ b/models/migrations/v1_16/v201.go
@@ -3,11 +3,9 @@
 
 package v1_16
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func DropTableRemoteVersion(x *xorm.Engine) error {
+func DropTableRemoteVersion(x db.EngineMigration) error {
 	// drop the orphaned table introduced in `v199`, now the update checker also uses AppState, do not need this table
 	_ = x.DropTables("remote_version")
 	return nil
diff --git a/models/migrations/v1_16/v202.go b/models/migrations/v1_16/v202.go
index d8c8fdcadc3..0f1647054b0 100644
--- a/models/migrations/v1_16/v202.go
+++ b/models/migrations/v1_16/v202.go
@@ -6,10 +6,10 @@ package v1_16
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func CreateUserSettingsTable(x *xorm.Engine) error {
+func CreateUserSettingsTable(x db.EngineMigration) error {
 	type UserSetting struct {
 		ID           int64  `xorm:"pk autoincr"`
 		UserID       int64  `xorm:"index unique(key_userid)"`              // to load all of someone's settings
diff --git a/models/migrations/v1_16/v203.go b/models/migrations/v1_16/v203.go
index c3241cba576..b91c4da6567 100644
--- a/models/migrations/v1_16/v203.go
+++ b/models/migrations/v1_16/v203.go
@@ -3,11 +3,9 @@
 
 package v1_16
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddProjectIssueSorting(x *xorm.Engine) error {
+func AddProjectIssueSorting(x db.EngineMigration) error {
 	// ProjectIssue saves relation from issue to a project
 	type ProjectIssue struct {
 		Sorting int64 `xorm:"NOT NULL DEFAULT 0"`
diff --git a/models/migrations/v1_16/v204.go b/models/migrations/v1_16/v204.go
index 4d375307e76..3a882fd56f0 100644
--- a/models/migrations/v1_16/v204.go
+++ b/models/migrations/v1_16/v204.go
@@ -3,9 +3,9 @@
 
 package v1_16
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddSSHKeyIsVerified(x *xorm.Engine) error {
+func AddSSHKeyIsVerified(x db.EngineMigration) error {
 	type PublicKey struct {
 		Verified bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_16/v205.go b/models/migrations/v1_16/v205.go
index 78241bad5b2..18dda1875fb 100644
--- a/models/migrations/v1_16/v205.go
+++ b/models/migrations/v1_16/v205.go
@@ -4,13 +4,13 @@
 package v1_16
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
-func MigrateUserPasswordSalt(x *xorm.Engine) error {
+func MigrateUserPasswordSalt(x db.EngineMigration) error {
 	dbType := x.Dialect().URI().DBType
 	// For SQLITE, the max length doesn't matter.
 	if dbType == schemas.SQLITE {
diff --git a/models/migrations/v1_16/v206.go b/models/migrations/v1_16/v206.go
index 01a9c386eb2..b612fa106d7 100644
--- a/models/migrations/v1_16/v206.go
+++ b/models/migrations/v1_16/v206.go
@@ -6,10 +6,10 @@ package v1_16
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func AddAuthorizeColForTeamUnit(x *xorm.Engine) error {
+func AddAuthorizeColForTeamUnit(x db.EngineMigration) error {
 	type TeamUnit struct {
 		ID         int64 `xorm:"pk autoincr"`
 		OrgID      int64 `xorm:"INDEX"`
diff --git a/models/migrations/v1_16/v207.go b/models/migrations/v1_16/v207.go
index 19126ead1f4..da89c7b8bbd 100644
--- a/models/migrations/v1_16/v207.go
+++ b/models/migrations/v1_16/v207.go
@@ -3,11 +3,9 @@
 
 package v1_16
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddWebAuthnCred(x *xorm.Engine) error {
+func AddWebAuthnCred(x db.EngineMigration) error {
 	// NO-OP Don't migrate here - let v210 do this.
 
 	return nil
diff --git a/models/migrations/v1_16/v208.go b/models/migrations/v1_16/v208.go
index fb643324f48..1f4752b34a2 100644
--- a/models/migrations/v1_16/v208.go
+++ b/models/migrations/v1_16/v208.go
@@ -3,11 +3,9 @@
 
 package v1_16
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func UseBase32HexForCredIDInWebAuthnCredential(x *xorm.Engine) error {
+func UseBase32HexForCredIDInWebAuthnCredential(x db.EngineMigration) error {
 	// noop
 	return nil
 }
diff --git a/models/migrations/v1_16/v209.go b/models/migrations/v1_16/v209.go
index 230838647bb..bfa0a63d354 100644
--- a/models/migrations/v1_16/v209.go
+++ b/models/migrations/v1_16/v209.go
@@ -3,11 +3,9 @@
 
 package v1_16
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func IncreaseCredentialIDTo410(x *xorm.Engine) error {
+func IncreaseCredentialIDTo410(x db.EngineMigration) error {
 	// no-op
 	// v208 was completely wrong
 	// So now we have to no-op again.
diff --git a/models/migrations/v1_16/v210.go b/models/migrations/v1_16/v210.go
index 0b94baf8e3d..4eb6a4dacc7 100644
--- a/models/migrations/v1_16/v210.go
+++ b/models/migrations/v1_16/v210.go
@@ -8,16 +8,16 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/tstranex/u2f"
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
 // v208 migration was completely broken
-func RemigrateU2FCredentials(x *xorm.Engine) error {
+func RemigrateU2FCredentials(x db.EngineMigration) error {
 	// Create webauthnCredential table
 	type webauthnCredential struct {
 		ID              int64 `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_16/v210_test.go b/models/migrations/v1_16/v210_test.go
index 7bff2572e11..ed90e62f5a2 100644
--- a/models/migrations/v1_16/v210_test.go
+++ b/models/migrations/v1_16/v210_test.go
@@ -6,8 +6,8 @@ package v1_16
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"xorm.io/xorm/schemas"
diff --git a/models/migrations/v1_17/main_test.go b/models/migrations/v1_17/main_test.go
index 86522018719..4e5e83d8a8d 100644
--- a/models/migrations/v1_17/main_test.go
+++ b/models/migrations/v1_17/main_test.go
@@ -6,7 +6,7 @@ package v1_17
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_17/v211.go b/models/migrations/v1_17/v211.go
index 517cf19388d..144e52c1d07 100644
--- a/models/migrations/v1_17/v211.go
+++ b/models/migrations/v1_17/v211.go
@@ -3,10 +3,8 @@
 
 package v1_17
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func CreateForeignReferenceTable(_ *xorm.Engine) error {
+func CreateForeignReferenceTable(_ db.EngineMigration) error {
 	return nil // This table was dropped in v1_19/v237.go
 }
diff --git a/models/migrations/v1_17/v212.go b/models/migrations/v1_17/v212.go
index 788792211f5..8fd4036106e 100644
--- a/models/migrations/v1_17/v212.go
+++ b/models/migrations/v1_17/v212.go
@@ -4,12 +4,11 @@
 package v1_17
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddPackageTables(x *xorm.Engine) error {
+func AddPackageTables(x db.EngineMigration) error {
 	type Package struct {
 		ID               int64  `xorm:"pk autoincr"`
 		OwnerID          int64  `xorm:"UNIQUE(s) INDEX NOT NULL"`
diff --git a/models/migrations/v1_17/v213.go b/models/migrations/v1_17/v213.go
index b2bbdf72795..eddb7f538da 100644
--- a/models/migrations/v1_17/v213.go
+++ b/models/migrations/v1_17/v213.go
@@ -3,11 +3,9 @@
 
 package v1_17
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddAllowMaintainerEdit(x *xorm.Engine) error {
+func AddAllowMaintainerEdit(x db.EngineMigration) error {
 	// PullRequest represents relation between pull request and repositories.
 	type PullRequest struct {
 		AllowMaintainerEdit bool `xorm:"NOT NULL DEFAULT false"`
diff --git a/models/migrations/v1_17/v214.go b/models/migrations/v1_17/v214.go
index 1925324f0f1..68194fca9bd 100644
--- a/models/migrations/v1_17/v214.go
+++ b/models/migrations/v1_17/v214.go
@@ -3,11 +3,9 @@
 
 package v1_17
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddAutoMergeTable(x *xorm.Engine) error {
+func AddAutoMergeTable(x db.EngineMigration) error {
 	type MergeStyle string
 	type PullAutoMerge struct {
 		ID          int64      `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_17/v215.go b/models/migrations/v1_17/v215.go
index 748539225d3..857d37f7d13 100644
--- a/models/migrations/v1_17/v215.go
+++ b/models/migrations/v1_17/v215.go
@@ -4,13 +4,12 @@
 package v1_17
 
 import (
-	"code.gitea.io/gitea/models/pull"
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/pull"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddReviewViewedFiles(x *xorm.Engine) error {
+func AddReviewViewedFiles(x db.EngineMigration) error {
 	type ReviewState struct {
 		ID           int64                       `xorm:"pk autoincr"`
 		UserID       int64                       `xorm:"NOT NULL UNIQUE(pull_commit_user)"`
diff --git a/models/migrations/v1_17/v217.go b/models/migrations/v1_17/v217.go
index 04626bcbc59..fd9ec96d252 100644
--- a/models/migrations/v1_17/v217.go
+++ b/models/migrations/v1_17/v217.go
@@ -4,12 +4,11 @@
 package v1_17
 
 import (
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
 )
 
-func AlterHookTaskTextFieldsToLongText(x *xorm.Engine) error {
+func AlterHookTaskTextFieldsToLongText(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 	if err := sess.Begin(); err != nil {
diff --git a/models/migrations/v1_17/v218.go b/models/migrations/v1_17/v218.go
index 17d4cd89d4e..17c10915178 100644
--- a/models/migrations/v1_17/v218.go
+++ b/models/migrations/v1_17/v218.go
@@ -4,10 +4,10 @@
 package v1_17
 
 import (
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
@@ -47,6 +47,6 @@ func (*improveActionTableIndicesAction) TableIndices() []*schemas.Index {
 	return indices
 }
 
-func ImproveActionTableIndices(x *xorm.Engine) error {
+func ImproveActionTableIndices(x db.EngineMigration) error {
 	return x.Sync(&improveActionTableIndicesAction{})
 }
diff --git a/models/migrations/v1_17/v219.go b/models/migrations/v1_17/v219.go
index 6e335cb813a..0605fd14fae 100644
--- a/models/migrations/v1_17/v219.go
+++ b/models/migrations/v1_17/v219.go
@@ -6,13 +6,12 @@ package v1_17
 import (
 	"time"
 
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/repo"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddSyncOnCommitColForPushMirror(x *xorm.Engine) error {
+func AddSyncOnCommitColForPushMirror(x db.EngineMigration) error {
 	type PushMirror struct {
 		ID         int64            `xorm:"pk autoincr"`
 		RepoID     int64            `xorm:"INDEX"`
diff --git a/models/migrations/v1_17/v220.go b/models/migrations/v1_17/v220.go
index 4ac8c58e1ec..2157bf24d3f 100644
--- a/models/migrations/v1_17/v220.go
+++ b/models/migrations/v1_17/v220.go
@@ -4,14 +4,14 @@
 package v1_17
 
 import (
-	packages_model "code.gitea.io/gitea/models/packages"
-	container_module "code.gitea.io/gitea/modules/packages/container"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	container_module "gitea.dev/modules/packages/container"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
-func AddContainerRepositoryProperty(x *xorm.Engine) (err error) {
+func AddContainerRepositoryProperty(x db.EngineMigration) (err error) {
 	switch x.Dialect().URI().DBType {
 	case schemas.SQLITE:
 		_, err = x.Exec("INSERT INTO package_property (ref_type, ref_id, name, value) SELECT ?, p.id, ?, u.lower_name || '/' || p.lower_name FROM package p JOIN `user` u ON p.owner_id = u.id WHERE p.type = ?",
diff --git a/models/migrations/v1_17/v221.go b/models/migrations/v1_17/v221.go
index 9e6a67eb183..a5d2dc91665 100644
--- a/models/migrations/v1_17/v221.go
+++ b/models/migrations/v1_17/v221.go
@@ -7,12 +7,11 @@ import (
 	"encoding/base32"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func StoreWebauthnCredentialIDAsBytes(x *xorm.Engine) error {
+func StoreWebauthnCredentialIDAsBytes(x db.EngineMigration) error {
 	// Create webauthnCredential table
 	type webauthnCredential struct {
 		ID           int64 `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_17/v221_test.go b/models/migrations/v1_17/v221_test.go
index 6fda9b9980e..2c217cf02e4 100644
--- a/models/migrations/v1_17/v221_test.go
+++ b/models/migrations/v1_17/v221_test.go
@@ -7,7 +7,7 @@ import (
 	"encoding/base32"
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_17/v222.go b/models/migrations/v1_17/v222.go
index a5ea537d8a4..97b36af5caa 100644
--- a/models/migrations/v1_17/v222.go
+++ b/models/migrations/v1_17/v222.go
@@ -8,13 +8,12 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/timeutil"
 )
 
-func DropOldCredentialIDColumn(x *xorm.Engine) error {
+func DropOldCredentialIDColumn(x db.EngineMigration) error {
 	// This migration maybe rerun so that we should check if it has been run
 	credentialIDExist, err := x.Dialect().IsColumnExist(x.DB(), context.Background(), "webauthn_credential", "credential_id")
 	if err != nil {
diff --git a/models/migrations/v1_17/v223.go b/models/migrations/v1_17/v223.go
index b2bfb76551d..a97a49566d8 100644
--- a/models/migrations/v1_17/v223.go
+++ b/models/migrations/v1_17/v223.go
@@ -7,14 +7,13 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 )
 
-func RenameCredentialIDBytes(x *xorm.Engine) error {
+func RenameCredentialIDBytes(x db.EngineMigration) error {
 	// This migration maybe rerun so that we should check if it has been run
 	credentialIDExist, err := x.Dialect().IsColumnExist(x.DB(), context.Background(), "webauthn_credential", "credential_id")
 	if err != nil {
diff --git a/models/migrations/v1_18/main_test.go b/models/migrations/v1_18/main_test.go
index b8641526f3d..720784d6800 100644
--- a/models/migrations/v1_18/main_test.go
+++ b/models/migrations/v1_18/main_test.go
@@ -6,7 +6,7 @@ package v1_18
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_18/v224.go b/models/migrations/v1_18/v224.go
index 6dc12020eaa..7e796e40a72 100644
--- a/models/migrations/v1_18/v224.go
+++ b/models/migrations/v1_18/v224.go
@@ -3,11 +3,9 @@
 
 package v1_18
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func CreateUserBadgesTable(x *xorm.Engine) error {
+func CreateUserBadgesTable(x db.EngineMigration) error {
 	type Badge struct {
 		ID          int64 `xorm:"pk autoincr"`
 		Description string
diff --git a/models/migrations/v1_18/v225.go b/models/migrations/v1_18/v225.go
index bc6117e38f5..3a0268e97d0 100644
--- a/models/migrations/v1_18/v225.go
+++ b/models/migrations/v1_18/v225.go
@@ -4,12 +4,11 @@
 package v1_18
 
 import (
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
 )
 
-func AlterPublicGPGKeyContentFieldsToMediumText(x *xorm.Engine) error {
+func AlterPublicGPGKeyContentFieldsToMediumText(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 	if err := sess.Begin(); err != nil {
diff --git a/models/migrations/v1_18/v226.go b/models/migrations/v1_18/v226.go
index 8ed9761476d..cd9e826bd05 100644
--- a/models/migrations/v1_18/v226.go
+++ b/models/migrations/v1_18/v226.go
@@ -4,11 +4,12 @@
 package v1_18
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
-func FixPackageSemverField(x *xorm.Engine) error {
+func FixPackageSemverField(x db.EngineMigration) error {
 	_, err := x.Exec(builder.Update(builder.Eq{"semver_compatible": false}).From("`package`").Where(builder.In("`type`", "conan", "generic")))
 	return err
 }
diff --git a/models/migrations/v1_18/v227.go b/models/migrations/v1_18/v227.go
index 3aca686d597..058f6331175 100644
--- a/models/migrations/v1_18/v227.go
+++ b/models/migrations/v1_18/v227.go
@@ -4,9 +4,8 @@
 package v1_18
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
 type SystemSetting struct {
@@ -18,6 +17,6 @@ type SystemSetting struct {
 	Updated      timeutil.TimeStamp `xorm:"updated"`
 }
 
-func CreateSystemSettingsTable(x *xorm.Engine) error {
+func CreateSystemSettingsTable(x db.EngineMigration) error {
 	return x.Sync(new(SystemSetting))
 }
diff --git a/models/migrations/v1_18/v228.go b/models/migrations/v1_18/v228.go
index b13f6461bd8..558411ef473 100644
--- a/models/migrations/v1_18/v228.go
+++ b/models/migrations/v1_18/v228.go
@@ -4,12 +4,11 @@
 package v1_18
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddTeamInviteTable(x *xorm.Engine) error {
+func AddTeamInviteTable(x db.EngineMigration) error {
 	type TeamInvite struct {
 		ID          int64              `xorm:"pk autoincr"`
 		Token       string             `xorm:"UNIQUE(token) INDEX NOT NULL DEFAULT ''"`
diff --git a/models/migrations/v1_18/v229.go b/models/migrations/v1_18/v229.go
index 1f69724365a..be9bda66ec0 100644
--- a/models/migrations/v1_18/v229.go
+++ b/models/migrations/v1_18/v229.go
@@ -6,13 +6,13 @@ package v1_18
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/models/issues"
+	"gitea.dev/models/db"
+	"gitea.dev/models/issues"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
-func UpdateOpenMilestoneCounts(x *xorm.Engine) error {
+func UpdateOpenMilestoneCounts(x db.EngineMigration) error {
 	var openMilestoneIDs []int64
 	err := x.Table("milestone").Select("id").Where(builder.Neq{"is_closed": 1}).Find(&openMilestoneIDs)
 	if err != nil {
diff --git a/models/migrations/v1_18/v229_test.go b/models/migrations/v1_18/v229_test.go
index 638983ad0ba..f1f3482bba9 100644
--- a/models/migrations/v1_18/v229_test.go
+++ b/models/migrations/v1_18/v229_test.go
@@ -6,8 +6,8 @@ package v1_18
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/issues"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_18/v230.go b/models/migrations/v1_18/v230.go
index 078fce7643d..670b3227df7 100644
--- a/models/migrations/v1_18/v230.go
+++ b/models/migrations/v1_18/v230.go
@@ -3,12 +3,10 @@
 
 package v1_18
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
 // AddConfidentialColumnToOAuth2ApplicationTable: add ConfidentialClient column, setting existing rows to true
-func AddConfidentialClientColumnToOAuth2ApplicationTable(x *xorm.Engine) error {
+func AddConfidentialClientColumnToOAuth2ApplicationTable(x db.EngineMigration) error {
 	type oauth2Application struct {
 		ID                 int64
 		ConfidentialClient bool `xorm:"NOT NULL DEFAULT TRUE"`
diff --git a/models/migrations/v1_18/v230_test.go b/models/migrations/v1_18/v230_test.go
index e5e28ea63fc..e711a6cd595 100644
--- a/models/migrations/v1_18/v230_test.go
+++ b/models/migrations/v1_18/v230_test.go
@@ -6,7 +6,7 @@ package v1_18
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_19/main_test.go b/models/migrations/v1_19/main_test.go
index 784ca0e46ed..383ffb93882 100644
--- a/models/migrations/v1_19/main_test.go
+++ b/models/migrations/v1_19/main_test.go
@@ -6,7 +6,7 @@ package v1_19
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_19/v231.go b/models/migrations/v1_19/v231.go
index 8ef1e4e7438..d8fa52a1a7c 100644
--- a/models/migrations/v1_19/v231.go
+++ b/models/migrations/v1_19/v231.go
@@ -3,11 +3,9 @@
 
 package v1_19
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddIndexForHookTask(x *xorm.Engine) error {
+func AddIndexForHookTask(x db.EngineMigration) error {
 	type HookTask struct {
 		ID     int64  `xorm:"pk autoincr"`
 		HookID int64  `xorm:"index"`
diff --git a/models/migrations/v1_19/v232.go b/models/migrations/v1_19/v232.go
index 493dbc6df83..4e4a8ae6f00 100644
--- a/models/migrations/v1_19/v232.go
+++ b/models/migrations/v1_19/v232.go
@@ -4,12 +4,11 @@
 package v1_19
 
 import (
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
 )
 
-func AlterPackageVersionMetadataToLongText(x *xorm.Engine) error {
+func AlterPackageVersionMetadataToLongText(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 	if err := sess.Begin(); err != nil {
diff --git a/models/migrations/v1_19/v233.go b/models/migrations/v1_19/v233.go
index 44ced874b32..6098e7882eb 100644
--- a/models/migrations/v1_19/v233.go
+++ b/models/migrations/v1_19/v233.go
@@ -6,15 +6,15 @@ package v1_19
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/secret"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/secret"
+	"gitea.dev/modules/setting"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
-func batchProcess[T any](x *xorm.Engine, buf []T, query func(limit, start int) *xorm.Session, process func(*xorm.Session, T) error) error {
+func batchProcess[T any](x db.EngineMigration, buf []T, query func(limit, start int) db.Session, process func(db.Session, T) error) error {
 	size := cap(buf)
 	start := 0
 	for {
@@ -51,7 +51,7 @@ func batchProcess[T any](x *xorm.Engine, buf []T, query func(limit, start int) *
 	}
 }
 
-func AddHeaderAuthorizationEncryptedColWebhook(x *xorm.Engine) error {
+func AddHeaderAuthorizationEncryptedColWebhook(x db.EngineMigration) error {
 	// Add the column to the table
 	type Webhook struct {
 		ID   int64  `xorm:"pk autoincr"`
@@ -80,10 +80,10 @@ func AddHeaderAuthorizationEncryptedColWebhook(x *xorm.Engine) error {
 
 	err = batchProcess(x,
 		make([]*Webhook, 0, 50),
-		func(limit, start int) *xorm.Session {
+		func(limit, start int) db.Session {
 			return x.Where("type=?", "matrix").OrderBy("id").Limit(limit, start)
 		},
-		func(sess *xorm.Session, hook *Webhook) error {
+		func(sess db.Session, hook *Webhook) error {
 			// retrieve token from meta
 			var withToken MatrixMetaWithAccessToken
 			err := json.Unmarshal([]byte(hook.Meta), &withToken)
@@ -141,13 +141,13 @@ func AddHeaderAuthorizationEncryptedColWebhook(x *xorm.Engine) error {
 
 	err = batchProcess(x,
 		make([]*HookTask, 0, 50),
-		func(limit, start int) *xorm.Session {
+		func(limit, start int) db.Session {
 			return x.Where(builder.And(
 				builder.In("hook_id", builder.Select("id").From("webhook").Where(builder.Eq{"type": "matrix"})),
 				builder.Like{"payload_content", "access_token"},
 			)).OrderBy("id").Limit(limit, 0) // ignore the provided "start", since other payload were already converted and don't contain 'payload_content' anymore
 		},
-		func(sess *xorm.Session, hookTask *HookTask) error {
+		func(sess db.Session, hookTask *HookTask) error {
 			// retrieve token from payload_content
 			var withToken MatrixPayloadUnsafe
 			err := json.Unmarshal([]byte(hookTask.PayloadContent), &withToken)
diff --git a/models/migrations/v1_19/v233_test.go b/models/migrations/v1_19/v233_test.go
index 3f7900c58f0..add19443059 100644
--- a/models/migrations/v1_19/v233_test.go
+++ b/models/migrations/v1_19/v233_test.go
@@ -6,11 +6,11 @@ package v1_19
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/secret"
-	"code.gitea.io/gitea/modules/setting"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/secret"
+	"gitea.dev/modules/setting"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_19/v234.go b/models/migrations/v1_19/v234.go
index 3475384d6f4..325d2c70fee 100644
--- a/models/migrations/v1_19/v234.go
+++ b/models/migrations/v1_19/v234.go
@@ -4,12 +4,11 @@
 package v1_19
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func CreatePackageCleanupRuleTable(x *xorm.Engine) error {
+func CreatePackageCleanupRuleTable(x db.EngineMigration) error {
 	type PackageCleanupRule struct {
 		ID            int64              `xorm:"pk autoincr"`
 		Enabled       bool               `xorm:"INDEX NOT NULL DEFAULT false"`
diff --git a/models/migrations/v1_19/v235.go b/models/migrations/v1_19/v235.go
index 297d90f65a2..5a49b3f31f1 100644
--- a/models/migrations/v1_19/v235.go
+++ b/models/migrations/v1_19/v235.go
@@ -3,11 +3,9 @@
 
 package v1_19
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddIndexForAccessToken(x *xorm.Engine) error {
+func AddIndexForAccessToken(x db.EngineMigration) error {
 	type AccessToken struct {
 		TokenLastEight string `xorm:"INDEX token_last_eight"`
 	}
diff --git a/models/migrations/v1_19/v236.go b/models/migrations/v1_19/v236.go
index 0ed4d97a272..9547a949237 100644
--- a/models/migrations/v1_19/v236.go
+++ b/models/migrations/v1_19/v236.go
@@ -4,12 +4,11 @@
 package v1_19
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func CreateSecretsTable(x *xorm.Engine) error {
+func CreateSecretsTable(x db.EngineMigration) error {
 	type Secret struct {
 		ID          int64
 		OwnerID     int64              `xorm:"INDEX UNIQUE(owner_repo_name) NOT NULL"`
diff --git a/models/migrations/v1_19/v237.go b/models/migrations/v1_19/v237.go
index cf30226ccd8..f5ec09ff907 100644
--- a/models/migrations/v1_19/v237.go
+++ b/models/migrations/v1_19/v237.go
@@ -3,11 +3,9 @@
 
 package v1_19
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func DropForeignReferenceTable(x *xorm.Engine) error {
+func DropForeignReferenceTable(x db.EngineMigration) error {
 	// Drop the table introduced in `v211`, it's considered badly designed and doesn't look like to be used.
 	// See: https://github.com/go-gitea/gitea/issues/21086#issuecomment-1318217453
 	type ForeignReference struct{}
diff --git a/models/migrations/v1_19/v238.go b/models/migrations/v1_19/v238.go
index de681bfc7a4..5b2173e6a50 100644
--- a/models/migrations/v1_19/v238.go
+++ b/models/migrations/v1_19/v238.go
@@ -4,13 +4,12 @@
 package v1_19
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
 // AddUpdatedUnixToLFSMetaObject adds an updated column to the LFSMetaObject to allow for garbage collection
-func AddUpdatedUnixToLFSMetaObject(x *xorm.Engine) error {
+func AddUpdatedUnixToLFSMetaObject(x db.EngineMigration) error {
 	// Drop the table introduced in `v211`, it's considered badly designed and doesn't look like to be used.
 	// See: https://github.com/go-gitea/gitea/issues/21086#issuecomment-1318217453
 	// LFSMetaObject stores metadata for LFS tracked files.
diff --git a/models/migrations/v1_19/v239.go b/models/migrations/v1_19/v239.go
index 8f4a65be95d..826150a7237 100644
--- a/models/migrations/v1_19/v239.go
+++ b/models/migrations/v1_19/v239.go
@@ -3,11 +3,9 @@
 
 package v1_19
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddScopeForAccessTokens(x *xorm.Engine) error {
+func AddScopeForAccessTokens(x db.EngineMigration) error {
 	type AccessToken struct {
 		Scope string
 	}
diff --git a/models/migrations/v1_19/v240.go b/models/migrations/v1_19/v240.go
index 7fdbaeb9dc9..b23553cc4ec 100644
--- a/models/migrations/v1_19/v240.go
+++ b/models/migrations/v1_19/v240.go
@@ -4,13 +4,11 @@
 package v1_19
 
 import (
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddActionsTables(x *xorm.Engine) error {
+func AddActionsTables(x db.EngineMigration) error {
 	type ActionRunner struct {
 		ID          int64
 		UUID        string `xorm:"CHAR(36) UNIQUE"`
diff --git a/models/migrations/v1_19/v241.go b/models/migrations/v1_19/v241.go
index e35801a0572..3237dc11de9 100644
--- a/models/migrations/v1_19/v241.go
+++ b/models/migrations/v1_19/v241.go
@@ -3,12 +3,10 @@
 
 package v1_19
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
 // AddCardTypeToProjectTable: add CardType column, setting existing rows to CardTypeTextOnly
-func AddCardTypeToProjectTable(x *xorm.Engine) error {
+func AddCardTypeToProjectTable(x db.EngineMigration) error {
 	type Project struct {
 		CardType int `xorm:"NOT NULL DEFAULT 0"`
 	}
diff --git a/models/migrations/v1_19/v242.go b/models/migrations/v1_19/v242.go
index e9e759eaaa9..4015d0e1740 100644
--- a/models/migrations/v1_19/v242.go
+++ b/models/migrations/v1_19/v242.go
@@ -4,13 +4,12 @@
 package v1_19
 
 import (
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
 )
 
 // AlterPublicGPGKeyImportContentFieldToMediumText: set GPGKeyImport Content field to MEDIUMTEXT
-func AlterPublicGPGKeyImportContentFieldToMediumText(x *xorm.Engine) error {
+func AlterPublicGPGKeyImportContentFieldToMediumText(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 	if err := sess.Begin(); err != nil {
diff --git a/models/migrations/v1_19/v243.go b/models/migrations/v1_19/v243.go
index 9c3f3725949..547b591596f 100644
--- a/models/migrations/v1_19/v243.go
+++ b/models/migrations/v1_19/v243.go
@@ -3,11 +3,9 @@
 
 package v1_19
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddExclusiveLabel(x *xorm.Engine) error {
+func AddExclusiveLabel(x db.EngineMigration) error {
 	type Label struct {
 		Exclusive bool
 	}
diff --git a/models/migrations/v1_20/main_test.go b/models/migrations/v1_20/main_test.go
index 3ceb9a3c66d..17437be0f91 100644
--- a/models/migrations/v1_20/main_test.go
+++ b/models/migrations/v1_20/main_test.go
@@ -6,7 +6,7 @@ package v1_20
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_20/v244.go b/models/migrations/v1_20/v244.go
index 76cdccaca5b..722677f019f 100644
--- a/models/migrations/v1_20/v244.go
+++ b/models/migrations/v1_20/v244.go
@@ -3,11 +3,9 @@
 
 package v1_20
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddNeedApprovalToActionRun(x *xorm.Engine) error {
+func AddNeedApprovalToActionRun(x db.EngineMigration) error {
 	/*
 		New index: TriggerUserID
 		New fields: NeedApproval, ApprovedBy
diff --git a/models/migrations/v1_20/v245.go b/models/migrations/v1_20/v245.go
index 4acb11416c3..52c6fa04860 100644
--- a/models/migrations/v1_20/v245.go
+++ b/models/migrations/v1_20/v245.go
@@ -6,13 +6,12 @@ package v1_20
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/setting"
 )
 
-func RenameWebhookOrgToOwner(x *xorm.Engine) error {
+func RenameWebhookOrgToOwner(x db.EngineMigration) error {
 	type Webhook struct {
 		OrgID int64 `xorm:"INDEX"`
 	}
diff --git a/models/migrations/v1_20/v246.go b/models/migrations/v1_20/v246.go
index 22bf7234043..8232d21f938 100644
--- a/models/migrations/v1_20/v246.go
+++ b/models/migrations/v1_20/v246.go
@@ -3,11 +3,9 @@
 
 package v1_20
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddNewColumnForProject(x *xorm.Engine) error {
+func AddNewColumnForProject(x db.EngineMigration) error {
 	type Project struct {
 		OwnerID int64 `xorm:"INDEX"`
 	}
diff --git a/models/migrations/v1_20/v247.go b/models/migrations/v1_20/v247.go
index 4f82937e185..46daa73203b 100644
--- a/models/migrations/v1_20/v247.go
+++ b/models/migrations/v1_20/v247.go
@@ -4,13 +4,12 @@
 package v1_20
 
 import (
-	"code.gitea.io/gitea/modules/log"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
 )
 
 // FixIncorrectProjectType: set individual project's type from 3(TypeOrganization) to 1(TypeIndividual)
-func FixIncorrectProjectType(x *xorm.Engine) error {
+func FixIncorrectProjectType(x db.EngineMigration) error {
 	type User struct {
 		ID   int64 `xorm:"pk autoincr"`
 		Type int
diff --git a/models/migrations/v1_20/v248.go b/models/migrations/v1_20/v248.go
index 4f2091e4bca..7dd7f464704 100644
--- a/models/migrations/v1_20/v248.go
+++ b/models/migrations/v1_20/v248.go
@@ -3,9 +3,9 @@
 
 package v1_20
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddVersionToActionRunner(x *xorm.Engine) error {
+func AddVersionToActionRunner(x db.EngineMigration) error {
 	type ActionRunner struct {
 		Version string `xorm:"VARCHAR(64)"` // the version of act_runner
 	}
diff --git a/models/migrations/v1_20/v249.go b/models/migrations/v1_20/v249.go
index c6d3a177ca3..7db38b73e9a 100644
--- a/models/migrations/v1_20/v249.go
+++ b/models/migrations/v1_20/v249.go
@@ -4,9 +4,9 @@
 package v1_20
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
@@ -40,6 +40,6 @@ func (a *Action) TableIndices() []*schemas.Index {
 	return indices
 }
 
-func ImproveActionTableIndices(x *xorm.Engine) error {
+func ImproveActionTableIndices(x db.EngineMigration) error {
 	return x.Sync(new(Action))
 }
diff --git a/models/migrations/v1_20/v250.go b/models/migrations/v1_20/v250.go
index ec45e6e5c31..07662c86b22 100644
--- a/models/migrations/v1_20/v250.go
+++ b/models/migrations/v1_20/v250.go
@@ -6,12 +6,11 @@ package v1_20
 import (
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/json"
 )
 
-func ChangeContainerMetadataMultiArch(x *xorm.Engine) error {
+func ChangeContainerMetadataMultiArch(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 
diff --git a/models/migrations/v1_20/v251.go b/models/migrations/v1_20/v251.go
index a274c22a731..609417d1054 100644
--- a/models/migrations/v1_20/v251.go
+++ b/models/migrations/v1_20/v251.go
@@ -4,12 +4,11 @@
 package v1_20
 
 import (
-	"code.gitea.io/gitea/modules/log"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
 )
 
-func FixIncorrectOwnerTeamUnitAccessMode(x *xorm.Engine) error {
+func FixIncorrectOwnerTeamUnitAccessMode(x db.EngineMigration) error {
 	type UnitType int
 	type AccessMode int
 
diff --git a/models/migrations/v1_20/v252.go b/models/migrations/v1_20/v252.go
index d6aa6027534..2ee06ea2d2c 100644
--- a/models/migrations/v1_20/v252.go
+++ b/models/migrations/v1_20/v252.go
@@ -4,12 +4,11 @@
 package v1_20
 
 import (
-	"code.gitea.io/gitea/modules/log"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
 )
 
-func FixIncorrectAdminTeamUnitAccessMode(x *xorm.Engine) error {
+func FixIncorrectAdminTeamUnitAccessMode(x db.EngineMigration) error {
 	type UnitType int
 	type AccessMode int
 
diff --git a/models/migrations/v1_20/v253.go b/models/migrations/v1_20/v253.go
index c96454dbf92..99480ce67a0 100644
--- a/models/migrations/v1_20/v253.go
+++ b/models/migrations/v1_20/v253.go
@@ -4,12 +4,11 @@
 package v1_20
 
 import (
-	"code.gitea.io/gitea/modules/log"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
 )
 
-func FixExternalTrackerAndExternalWikiAccessModeInOwnerAndAdminTeam(x *xorm.Engine) error {
+func FixExternalTrackerAndExternalWikiAccessModeInOwnerAndAdminTeam(x db.EngineMigration) error {
 	type UnitType int
 	type AccessMode int
 
diff --git a/models/migrations/v1_20/v254.go b/models/migrations/v1_20/v254.go
index 9cdbfb39164..50fcf267af8 100644
--- a/models/migrations/v1_20/v254.go
+++ b/models/migrations/v1_20/v254.go
@@ -3,11 +3,9 @@
 
 package v1_20
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddActionTaskOutputTable(x *xorm.Engine) error {
+func AddActionTaskOutputTable(x db.EngineMigration) error {
 	type ActionTaskOutput struct {
 		ID          int64
 		TaskID      int64  `xorm:"INDEX UNIQUE(task_id_output_key)"`
diff --git a/models/migrations/v1_20/v255.go b/models/migrations/v1_20/v255.go
index caf198700e0..7e3305ac053 100644
--- a/models/migrations/v1_20/v255.go
+++ b/models/migrations/v1_20/v255.go
@@ -4,12 +4,11 @@
 package v1_20
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddArchivedUnixToRepository(x *xorm.Engine) error {
+func AddArchivedUnixToRepository(x db.EngineMigration) error {
 	type Repository struct {
 		ArchivedUnix timeutil.TimeStamp `xorm:"DEFAULT 0"`
 	}
diff --git a/models/migrations/v1_20/v256.go b/models/migrations/v1_20/v256.go
index 7b84c1e1544..28130f89056 100644
--- a/models/migrations/v1_20/v256.go
+++ b/models/migrations/v1_20/v256.go
@@ -3,11 +3,9 @@
 
 package v1_20
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddIsInternalColumnToPackage(x *xorm.Engine) error {
+func AddIsInternalColumnToPackage(x db.EngineMigration) error {
 	type Package struct {
 		ID               int64  `xorm:"pk autoincr"`
 		OwnerID          int64  `xorm:"UNIQUE(s) INDEX NOT NULL"`
diff --git a/models/migrations/v1_20/v257.go b/models/migrations/v1_20/v257.go
index 9d5f7c07dfc..96169c94d26 100644
--- a/models/migrations/v1_20/v257.go
+++ b/models/migrations/v1_20/v257.go
@@ -4,12 +4,11 @@
 package v1_20
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func CreateActionArtifactTable(x *xorm.Engine) error {
+func CreateActionArtifactTable(x db.EngineMigration) error {
 	// ActionArtifact is a file that is stored in the artifact storage.
 	type ActionArtifact struct {
 		ID                 int64 `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_20/v258.go b/models/migrations/v1_20/v258.go
index 1d3faffdaed..a8773d06384 100644
--- a/models/migrations/v1_20/v258.go
+++ b/models/migrations/v1_20/v258.go
@@ -3,11 +3,9 @@
 
 package v1_20
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddPinOrderToIssue(x *xorm.Engine) error {
+func AddPinOrderToIssue(x db.EngineMigration) error {
 	type Issue struct {
 		PinOrder int `xorm:"DEFAULT 0"`
 	}
diff --git a/models/migrations/v1_20/v259.go b/models/migrations/v1_20/v259.go
index 9e0dc9b61d9..d6200a69502 100644
--- a/models/migrations/v1_20/v259.go
+++ b/models/migrations/v1_20/v259.go
@@ -7,9 +7,8 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
 )
 
 // unknownAccessTokenScope represents the scope for an access token that isn't
@@ -319,7 +318,7 @@ type AccessToken struct {
 	Scope string
 }
 
-func ConvertScopedAccessTokens(x *xorm.Engine) error {
+func ConvertScopedAccessTokens(x db.EngineMigration) error {
 	var tokens []*AccessToken
 
 	if err := x.Find(&tokens); err != nil {
diff --git a/models/migrations/v1_20/v259_test.go b/models/migrations/v1_20/v259_test.go
index 3864eecb78a..7c596579e50 100644
--- a/models/migrations/v1_20/v259_test.go
+++ b/models/migrations/v1_20/v259_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_21/main_test.go b/models/migrations/v1_21/main_test.go
index daf98d40f4c..058e7af59f3 100644
--- a/models/migrations/v1_21/main_test.go
+++ b/models/migrations/v1_21/main_test.go
@@ -6,7 +6,7 @@ package v1_21
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_21/v260.go b/models/migrations/v1_21/v260.go
index 8540c58ae86..320c38fde0a 100644
--- a/models/migrations/v1_21/v260.go
+++ b/models/migrations/v1_21/v260.go
@@ -4,12 +4,11 @@
 package v1_21
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 )
 
-func DropCustomLabelsColumnOfActionRunner(x *xorm.Engine) error {
+func DropCustomLabelsColumnOfActionRunner(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 
diff --git a/models/migrations/v1_21/v261.go b/models/migrations/v1_21/v261.go
index 122b98eb93b..5f98e8b427f 100644
--- a/models/migrations/v1_21/v261.go
+++ b/models/migrations/v1_21/v261.go
@@ -4,12 +4,11 @@
 package v1_21
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func CreateVariableTable(x *xorm.Engine) error {
+func CreateVariableTable(x db.EngineMigration) error {
 	type ActionVariable struct {
 		ID          int64              `xorm:"pk autoincr"`
 		OwnerID     int64              `xorm:"UNIQUE(owner_repo_name)"`
diff --git a/models/migrations/v1_21/v262.go b/models/migrations/v1_21/v262.go
index 6e88e29b9db..ab057842087 100644
--- a/models/migrations/v1_21/v262.go
+++ b/models/migrations/v1_21/v262.go
@@ -3,11 +3,9 @@
 
 package v1_21
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddTriggerEventToActionRun(x *xorm.Engine) error {
+func AddTriggerEventToActionRun(x db.EngineMigration) error {
 	type ActionRun struct {
 		TriggerEvent string
 	}
diff --git a/models/migrations/v1_21/v263.go b/models/migrations/v1_21/v263.go
index 55c418bde0d..18af1caed4e 100644
--- a/models/migrations/v1_21/v263.go
+++ b/models/migrations/v1_21/v263.go
@@ -6,11 +6,11 @@ package v1_21
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
 // AddGitSizeAndLFSSizeToRepositoryTable: add GitSize and LFSSize columns to Repository
-func AddGitSizeAndLFSSizeToRepositoryTable(x *xorm.Engine) error {
+func AddGitSizeAndLFSSizeToRepositoryTable(x db.EngineMigration) error {
 	type Repository struct {
 		GitSize int64 `xorm:"NOT NULL DEFAULT 0"`
 		LFSSize int64 `xorm:"NOT NULL DEFAULT 0"`
diff --git a/models/migrations/v1_21/v264.go b/models/migrations/v1_21/v264.go
index 7fc0ec60240..0353f474d46 100644
--- a/models/migrations/v1_21/v264.go
+++ b/models/migrations/v1_21/v264.go
@@ -7,13 +7,11 @@ import (
 	"context"
 	"errors"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddBranchTable(x *xorm.Engine) error {
+func AddBranchTable(x db.EngineMigration) error {
 	type Branch struct {
 		ID            int64
 		RepoID        int64  `xorm:"UNIQUE(s)"`
diff --git a/models/migrations/v1_21/v265.go b/models/migrations/v1_21/v265.go
index b6892acc277..cd991b535d2 100644
--- a/models/migrations/v1_21/v265.go
+++ b/models/migrations/v1_21/v265.go
@@ -3,11 +3,9 @@
 
 package v1_21
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AlterActionArtifactTable(x *xorm.Engine) error {
+func AlterActionArtifactTable(x db.EngineMigration) error {
 	// ActionArtifact is a file that is stored in the artifact storage.
 	type ActionArtifact struct {
 		RunID        int64  `xorm:"index unique(runid_name_path)"` // The run id of the artifact
diff --git a/models/migrations/v1_21/v266.go b/models/migrations/v1_21/v266.go
index 440549e868b..d7ab34e57e6 100644
--- a/models/migrations/v1_21/v266.go
+++ b/models/migrations/v1_21/v266.go
@@ -3,11 +3,9 @@
 
 package v1_21
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func ReduceCommitStatus(x *xorm.Engine) error {
+func ReduceCommitStatus(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 
diff --git a/models/migrations/v1_21/v267.go b/models/migrations/v1_21/v267.go
index 394139a17e2..b6a93cf1815 100644
--- a/models/migrations/v1_21/v267.go
+++ b/models/migrations/v1_21/v267.go
@@ -4,12 +4,11 @@
 package v1_21
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func CreateActionTasksVersionTable(x *xorm.Engine) error {
+func CreateActionTasksVersionTable(x db.EngineMigration) error {
 	type ActionTasksVersion struct {
 		ID          int64 `xorm:"pk autoincr"`
 		OwnerID     int64 `xorm:"UNIQUE(owner_repo)"`
diff --git a/models/migrations/v1_21/v268.go b/models/migrations/v1_21/v268.go
index b677d2383e9..e9f697645f7 100644
--- a/models/migrations/v1_21/v268.go
+++ b/models/migrations/v1_21/v268.go
@@ -3,12 +3,10 @@
 
 package v1_21
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
 // UpdateActionsRefIndex updates the index of actions ref field
-func UpdateActionsRefIndex(x *xorm.Engine) error {
+func UpdateActionsRefIndex(x db.EngineMigration) error {
 	type ActionRun struct {
 		Ref string `xorm:"index"` // the commit/tag/… causing the run
 	}
diff --git a/models/migrations/v1_21/v269.go b/models/migrations/v1_21/v269.go
index 042040927d4..8ea5b3fd41f 100644
--- a/models/migrations/v1_21/v269.go
+++ b/models/migrations/v1_21/v269.go
@@ -3,10 +3,8 @@
 
 package v1_21
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func DropDeletedBranchTable(x *xorm.Engine) error {
+func DropDeletedBranchTable(x db.EngineMigration) error {
 	return x.DropTables("deleted_branch")
 }
diff --git a/models/migrations/v1_21/v270.go b/models/migrations/v1_21/v270.go
index ab7c5660bad..5e1482b3209 100644
--- a/models/migrations/v1_21/v270.go
+++ b/models/migrations/v1_21/v270.go
@@ -3,11 +3,9 @@
 
 package v1_21
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func FixPackagePropertyTypo(x *xorm.Engine) error {
+func FixPackagePropertyTypo(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 
diff --git a/models/migrations/v1_21/v271.go b/models/migrations/v1_21/v271.go
index 05e1af1351d..e24f484332c 100644
--- a/models/migrations/v1_21/v271.go
+++ b/models/migrations/v1_21/v271.go
@@ -4,12 +4,11 @@
 package v1_21
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddArchivedUnixColumInLabelTable(x *xorm.Engine) error {
+func AddArchivedUnixColumInLabelTable(x db.EngineMigration) error {
 	type Label struct {
 		ArchivedUnix timeutil.TimeStamp `xorm:"DEFAULT NULL"`
 	}
diff --git a/models/migrations/v1_21/v272.go b/models/migrations/v1_21/v272.go
index 14c1e0c4b0f..60335e8b46b 100644
--- a/models/migrations/v1_21/v272.go
+++ b/models/migrations/v1_21/v272.go
@@ -3,11 +3,9 @@
 
 package v1_21
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddVersionToActionRunTable(x *xorm.Engine) error {
+func AddVersionToActionRunTable(x db.EngineMigration) error {
 	type ActionRun struct {
 		Version int `xorm:"version default 0"`
 	}
diff --git a/models/migrations/v1_21/v273.go b/models/migrations/v1_21/v273.go
index e614a56a7dc..74c3c8f9eba 100644
--- a/models/migrations/v1_21/v273.go
+++ b/models/migrations/v1_21/v273.go
@@ -4,12 +4,11 @@
 package v1_21
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddActionScheduleTable(x *xorm.Engine) error {
+func AddActionScheduleTable(x db.EngineMigration) error {
 	type ActionSchedule struct {
 		ID            int64
 		Title         string
diff --git a/models/migrations/v1_21/v274.go b/models/migrations/v1_21/v274.go
index d0b557a1519..4644154c637 100644
--- a/models/migrations/v1_21/v274.go
+++ b/models/migrations/v1_21/v274.go
@@ -6,12 +6,11 @@ package v1_21
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddExpiredUnixColumnInActionArtifactTable(x *xorm.Engine) error {
+func AddExpiredUnixColumnInActionArtifactTable(x db.EngineMigration) error {
 	type ActionArtifact struct {
 		ExpiredUnix timeutil.TimeStamp `xorm:"index"` // time when the artifact will be expired
 	}
@@ -21,7 +20,7 @@ func AddExpiredUnixColumnInActionArtifactTable(x *xorm.Engine) error {
 	return updateArtifactsExpiredUnixTo90Days(x)
 }
 
-func updateArtifactsExpiredUnixTo90Days(x *xorm.Engine) error {
+func updateArtifactsExpiredUnixTo90Days(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 
diff --git a/models/migrations/v1_21/v275.go b/models/migrations/v1_21/v275.go
index 2bfe5c72fa9..7d999495b67 100644
--- a/models/migrations/v1_21/v275.go
+++ b/models/migrations/v1_21/v275.go
@@ -3,11 +3,9 @@
 
 package v1_21
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddScheduleIDForActionRun(x *xorm.Engine) error {
+func AddScheduleIDForActionRun(x db.EngineMigration) error {
 	type ActionRun struct {
 		ScheduleID int64
 	}
diff --git a/models/migrations/v1_21/v276.go b/models/migrations/v1_21/v276.go
index be24b31902e..1bd0157156d 100644
--- a/models/migrations/v1_21/v276.go
+++ b/models/migrations/v1_21/v276.go
@@ -6,14 +6,13 @@ package v1_21
 import (
 	"context"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
 )
 
-func AddRemoteAddressToMirrors(x *xorm.Engine) error {
+func AddRemoteAddressToMirrors(x db.EngineMigration) error {
 	type Mirror struct {
 		RemoteAddress string `xorm:"VARCHAR(2048)"`
 	}
@@ -33,7 +32,7 @@ func AddRemoteAddressToMirrors(x *xorm.Engine) error {
 	return migratePushMirrors(x)
 }
 
-func migratePullMirrors(x *xorm.Engine) error {
+func migratePullMirrors(x db.EngineMigration) error {
 	type Mirror struct {
 		ID            int64  `xorm:"pk autoincr"`
 		RepoID        int64  `xorm:"INDEX"`
@@ -95,7 +94,7 @@ func migratePullMirrors(x *xorm.Engine) error {
 	return sess.Commit()
 }
 
-func migratePushMirrors(x *xorm.Engine) error {
+func migratePushMirrors(x db.EngineMigration) error {
 	type PushMirror struct {
 		ID            int64 `xorm:"pk autoincr"`
 		RepoID        int64 `xorm:"INDEX"`
diff --git a/models/migrations/v1_21/v277.go b/models/migrations/v1_21/v277.go
index 0c102edddec..74bc4c86dbe 100644
--- a/models/migrations/v1_21/v277.go
+++ b/models/migrations/v1_21/v277.go
@@ -3,11 +3,9 @@
 
 package v1_21
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddIndexToIssueUserIssueID(x *xorm.Engine) error {
+func AddIndexToIssueUserIssueID(x db.EngineMigration) error {
 	type IssueUser struct {
 		IssueID int64 `xorm:"INDEX"`
 	}
diff --git a/models/migrations/v1_21/v278.go b/models/migrations/v1_21/v278.go
index 846f2286780..1fd5ec7aa0c 100644
--- a/models/migrations/v1_21/v278.go
+++ b/models/migrations/v1_21/v278.go
@@ -3,11 +3,9 @@
 
 package v1_21
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddIndexToCommentDependentIssueID(x *xorm.Engine) error {
+func AddIndexToCommentDependentIssueID(x db.EngineMigration) error {
 	type Comment struct {
 		DependentIssueID int64 `xorm:"index"`
 	}
diff --git a/models/migrations/v1_21/v279.go b/models/migrations/v1_21/v279.go
index beb39effe1a..8cfa6bb090a 100644
--- a/models/migrations/v1_21/v279.go
+++ b/models/migrations/v1_21/v279.go
@@ -4,10 +4,12 @@
 package v1_21
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
-func AddIndexToActionUserID(x *xorm.Engine) error {
+func AddIndexToActionUserID(x db.EngineMigration) error {
 	type Action struct {
 		UserID int64 `xorm:"INDEX"`
 	}
diff --git a/models/migrations/v1_22/main_test.go b/models/migrations/v1_22/main_test.go
index e02c8a53282..f7f9442f21a 100644
--- a/models/migrations/v1_22/main_test.go
+++ b/models/migrations/v1_22/main_test.go
@@ -6,7 +6,7 @@ package v1_22
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_22/v280.go b/models/migrations/v1_22/v280.go
index 2271cb60896..5dbab169178 100644
--- a/models/migrations/v1_22/v280.go
+++ b/models/migrations/v1_22/v280.go
@@ -3,11 +3,9 @@
 
 package v1_22
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func RenameUserThemes(x *xorm.Engine) error {
+func RenameUserThemes(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 
diff --git a/models/migrations/v1_22/v281.go b/models/migrations/v1_22/v281.go
index 129ec2cba09..295d6b4aa9f 100644
--- a/models/migrations/v1_22/v281.go
+++ b/models/migrations/v1_22/v281.go
@@ -4,12 +4,11 @@
 package v1_22
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func CreateAuthTokenTable(x *xorm.Engine) error {
+func CreateAuthTokenTable(x db.EngineMigration) error {
 	type AuthToken struct {
 		ID          string `xorm:"pk"`
 		TokenHash   string
diff --git a/models/migrations/v1_22/v282.go b/models/migrations/v1_22/v282.go
index eed64c30f79..fca5e1d5c24 100644
--- a/models/migrations/v1_22/v282.go
+++ b/models/migrations/v1_22/v282.go
@@ -3,11 +3,9 @@
 
 package v1_22
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddIndexToPullAutoMergeDoerID(x *xorm.Engine) error {
+func AddIndexToPullAutoMergeDoerID(x db.EngineMigration) error {
 	type PullAutoMerge struct {
 		DoerID int64 `xorm:"INDEX NOT NULL"`
 	}
diff --git a/models/migrations/v1_22/v283.go b/models/migrations/v1_22/v283.go
index 0eca031b654..4aca890a859 100644
--- a/models/migrations/v1_22/v283.go
+++ b/models/migrations/v1_22/v283.go
@@ -6,11 +6,12 @@ package v1_22
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm/schemas"
 )
 
-func AddCombinedIndexToIssueUser(x *xorm.Engine) error {
+func AddCombinedIndexToIssueUser(x db.EngineMigration) error {
 	type OldIssueUser struct {
 		IssueID int64
 		UID     int64
diff --git a/models/migrations/v1_22/v283_test.go b/models/migrations/v1_22/v283_test.go
index 8e4c9410bd7..9705c3ee2fb 100644
--- a/models/migrations/v1_22/v283_test.go
+++ b/models/migrations/v1_22/v283_test.go
@@ -6,7 +6,7 @@ package v1_22
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_22/v284.go b/models/migrations/v1_22/v284.go
index 31b38f6aed8..55a1646973c 100644
--- a/models/migrations/v1_22/v284.go
+++ b/models/migrations/v1_22/v284.go
@@ -4,10 +4,12 @@
 package v1_22
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
-func AddIgnoreStaleApprovalsColumnToProtectedBranchTable(x *xorm.Engine) error {
+func AddIgnoreStaleApprovalsColumnToProtectedBranchTable(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		IgnoreStaleApprovals bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_22/v285.go b/models/migrations/v1_22/v285.go
index fed89f670e0..6cd24a21481 100644
--- a/models/migrations/v1_22/v285.go
+++ b/models/migrations/v1_22/v285.go
@@ -6,10 +6,12 @@ package v1_22
 import (
 	"time"
 
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
-func AddPreviousDurationToActionRun(x *xorm.Engine) error {
+func AddPreviousDurationToActionRun(x db.EngineMigration) error {
 	type ActionRun struct {
 		PreviousDuration time.Duration
 	}
diff --git a/models/migrations/v1_22/v286.go b/models/migrations/v1_22/v286.go
index f3ba50dbb63..3f49400c2b4 100644
--- a/models/migrations/v1_22/v286.go
+++ b/models/migrations/v1_22/v286.go
@@ -6,13 +6,14 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"xorm.io/xorm"
 )
 
-func expandHashReferencesToSha256(x *xorm.Engine) error {
+func expandHashReferencesToSha256(x db.EngineMigration) error {
 	alteredTables := [][2]string{
 		{"commit_status", "context_hash"},
 		{"comment", "commit_sha"},
@@ -81,7 +82,7 @@ func expandHashReferencesToSha256(x *xorm.Engine) error {
 	return db.Commit()
 }
 
-func addObjectFormatNameToRepository(x *xorm.Engine) error {
+func addObjectFormatNameToRepository(x db.EngineMigration) error {
 	type Repository struct {
 		ObjectFormatName string `xorm:"VARCHAR(6) NOT NULL DEFAULT 'sha1'"`
 	}
@@ -99,7 +100,7 @@ func addObjectFormatNameToRepository(x *xorm.Engine) error {
 	return err
 }
 
-func AdjustDBForSha256(x *xorm.Engine) error {
+func AdjustDBForSha256(x db.EngineMigration) error {
 	if err := expandHashReferencesToSha256(x); err != nil {
 		return err
 	}
diff --git a/models/migrations/v1_22/v286_test.go b/models/migrations/v1_22/v286_test.go
index 1bd7fac2f18..1874cbe884e 100644
--- a/models/migrations/v1_22/v286_test.go
+++ b/models/migrations/v1_22/v286_test.go
@@ -6,13 +6,13 @@ package v1_22
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
-	"xorm.io/xorm"
 )
 
-func PrepareOldRepository(t *testing.T) (*xorm.Engine, func()) {
+func PrepareOldRepository(t *testing.T) (db.EngineMigration, func()) {
 	type Repository struct { // old struct
 		ID int64 `xorm:"pk autoincr"`
 	}
diff --git a/models/migrations/v1_22/v287.go b/models/migrations/v1_22/v287.go
index 5fd901f9ded..7b3de53b779 100644
--- a/models/migrations/v1_22/v287.go
+++ b/models/migrations/v1_22/v287.go
@@ -3,9 +3,7 @@
 
 package v1_22
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
 type BadgeUnique struct {
 	ID   int64  `xorm:"pk autoincr"`
@@ -16,7 +14,7 @@ func (BadgeUnique) TableName() string {
 	return "badge"
 }
 
-func UseSlugInsteadOfIDForBadges(x *xorm.Engine) error {
+func UseSlugInsteadOfIDForBadges(x db.EngineMigration) error {
 	type Badge struct {
 		Slug string
 	}
diff --git a/models/migrations/v1_22/v287_test.go b/models/migrations/v1_22/v287_test.go
index 21946a662ab..7ac86d5d0f8 100644
--- a/models/migrations/v1_22/v287_test.go
+++ b/models/migrations/v1_22/v287_test.go
@@ -7,7 +7,7 @@ import (
 	"strconv"
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_22/v288.go b/models/migrations/v1_22/v288.go
index 26c850c2188..cb133631c39 100644
--- a/models/migrations/v1_22/v288.go
+++ b/models/migrations/v1_22/v288.go
@@ -4,9 +4,8 @@
 package v1_22
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
 type Blocking struct {
@@ -21,6 +20,6 @@ func (*Blocking) TableName() string {
 	return "user_blocking"
 }
 
-func AddUserBlockingTable(x *xorm.Engine) error {
+func AddUserBlockingTable(x db.EngineMigration) error {
 	return x.Sync(&Blocking{})
 }
diff --git a/models/migrations/v1_22/v289.go b/models/migrations/v1_22/v289.go
index 78689a4ffae..e32e5b2a7f9 100644
--- a/models/migrations/v1_22/v289.go
+++ b/models/migrations/v1_22/v289.go
@@ -3,9 +3,13 @@
 
 package v1_22
 
-import "xorm.io/xorm"
+import (
+	"gitea.dev/models/db"
 
-func AddDefaultWikiBranch(x *xorm.Engine) error {
+	"xorm.io/xorm"
+)
+
+func AddDefaultWikiBranch(x db.EngineMigration) error {
 	type Repository struct {
 		ID                int64
 		DefaultWikiBranch string
diff --git a/models/migrations/v1_22/v290.go b/models/migrations/v1_22/v290.go
index 0f4d78410c1..55d1c192a74 100644
--- a/models/migrations/v1_22/v290.go
+++ b/models/migrations/v1_22/v290.go
@@ -4,6 +4,8 @@
 package v1_22
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
@@ -11,7 +13,7 @@ type HookTask struct {
 	PayloadVersion int `xorm:"DEFAULT 1"`
 }
 
-func AddPayloadVersionToHookTaskTable(x *xorm.Engine) error {
+func AddPayloadVersionToHookTaskTable(x db.EngineMigration) error {
 	// create missing column
 	if _, err := x.SyncWithOptions(xorm.SyncOptions{
 		IgnoreIndices:    true,
diff --git a/models/migrations/v1_22/v291.go b/models/migrations/v1_22/v291.go
index 823a644a955..316fc1675ff 100644
--- a/models/migrations/v1_22/v291.go
+++ b/models/migrations/v1_22/v291.go
@@ -3,9 +3,13 @@
 
 package v1_22
 
-import "xorm.io/xorm"
+import (
+	"gitea.dev/models/db"
 
-func AddCommentIDIndexofAttachment(x *xorm.Engine) error {
+	"xorm.io/xorm"
+)
+
+func AddCommentIDIndexofAttachment(x db.EngineMigration) error {
 	type Attachment struct {
 		CommentID int64 `xorm:"INDEX"`
 	}
diff --git a/models/migrations/v1_22/v293.go b/models/migrations/v1_22/v293.go
index 5299b8618f0..8c082cea3bc 100644
--- a/models/migrations/v1_22/v293.go
+++ b/models/migrations/v1_22/v293.go
@@ -4,14 +4,13 @@
 package v1_22
 
 import (
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 )
 
 // CheckProjectColumnsConsistency ensures there is exactly one default board per project present
-func CheckProjectColumnsConsistency(x *xorm.Engine) error {
+func CheckProjectColumnsConsistency(x db.EngineMigration) error {
 	sess := x.NewSession()
 	defer sess.Close()
 
@@ -79,7 +78,7 @@ func CheckProjectColumnsConsistency(x *xorm.Engine) error {
 	return removeDuplicatedBoardDefault(x)
 }
 
-func removeDuplicatedBoardDefault(x *xorm.Engine) error {
+func removeDuplicatedBoardDefault(x db.EngineMigration) error {
 	type ProjectInfo struct {
 		ProjectID  int64
 		DefaultNum int
diff --git a/models/migrations/v1_22/v293_test.go b/models/migrations/v1_22/v293_test.go
index bc3a33055cc..c19d0a4aa50 100644
--- a/models/migrations/v1_22/v293_test.go
+++ b/models/migrations/v1_22/v293_test.go
@@ -6,8 +6,8 @@ package v1_22
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/models/project"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/models/project"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_22/v294.go b/models/migrations/v1_22/v294.go
index 8776e51a165..2c8f1744933 100644
--- a/models/migrations/v1_22/v294.go
+++ b/models/migrations/v1_22/v294.go
@@ -6,12 +6,13 @@ package v1_22
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm/schemas"
 )
 
 // AddUniqueIndexForProjectIssue adds unique indexes for project issue table
-func AddUniqueIndexForProjectIssue(x *xorm.Engine) error {
+func AddUniqueIndexForProjectIssue(x db.EngineMigration) error {
 	// remove possible duplicated records in table project_issue
 	type result struct {
 		IssueID   int64
diff --git a/models/migrations/v1_22/v294_test.go b/models/migrations/v1_22/v294_test.go
index a711b5ec5f0..6a21b0adc50 100644
--- a/models/migrations/v1_22/v294_test.go
+++ b/models/migrations/v1_22/v294_test.go
@@ -6,7 +6,7 @@ package v1_22
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 	"xorm.io/xorm/schemas"
diff --git a/models/migrations/v1_22/v295.go b/models/migrations/v1_22/v295.go
index 319b1a399b3..7595460281b 100644
--- a/models/migrations/v1_22/v295.go
+++ b/models/migrations/v1_22/v295.go
@@ -3,9 +3,9 @@
 
 package v1_22
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddCommitStatusSummary(x *xorm.Engine) error {
+func AddCommitStatusSummary(x db.EngineMigration) error {
 	type CommitStatusSummary struct {
 		ID     int64  `xorm:"pk autoincr"`
 		RepoID int64  `xorm:"INDEX UNIQUE(repo_id_sha)"`
@@ -14,5 +14,5 @@ func AddCommitStatusSummary(x *xorm.Engine) error {
 	}
 	// there is no migrations because if there is no data on this table, it will fall back to get data
 	// from commit status
-	return x.Sync2(new(CommitStatusSummary))
+	return x.Sync(new(CommitStatusSummary))
 }
diff --git a/models/migrations/v1_22/v296.go b/models/migrations/v1_22/v296.go
index 75350f9f654..79134dea011 100644
--- a/models/migrations/v1_22/v296.go
+++ b/models/migrations/v1_22/v296.go
@@ -3,9 +3,9 @@
 
 package v1_22
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddCommitStatusSummary2(x *xorm.Engine) error {
+func AddCommitStatusSummary2(x db.EngineMigration) error {
 	type CommitStatusSummary struct {
 		ID        int64  `xorm:"pk autoincr"`
 		TargetURL string `xorm:"TEXT"`
diff --git a/models/migrations/v1_22/v297.go b/models/migrations/v1_22/v297.go
index 9a4405f2666..9912434e44c 100644
--- a/models/migrations/v1_22/v297.go
+++ b/models/migrations/v1_22/v297.go
@@ -4,12 +4,11 @@
 package v1_22
 
 import (
-	"code.gitea.io/gitea/models/perm"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
 )
 
-func AddRepoUnitEveryoneAccessMode(x *xorm.Engine) error {
+func AddRepoUnitEveryoneAccessMode(x db.EngineMigration) error {
 	type RepoUnit struct { //revive:disable-line:exported
 		EveryoneAccessMode perm.AccessMode `xorm:"NOT NULL DEFAULT 0"`
 	}
diff --git a/models/migrations/v1_22/v298.go b/models/migrations/v1_22/v298.go
index 7700173a004..d334ff4142a 100644
--- a/models/migrations/v1_22/v298.go
+++ b/models/migrations/v1_22/v298.go
@@ -3,8 +3,8 @@
 
 package v1_22
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func DropWronglyCreatedTable(x *xorm.Engine) error {
+func DropWronglyCreatedTable(x db.EngineMigration) error {
 	return x.DropTables("o_auth2_application")
 }
diff --git a/models/migrations/v1_23/main_test.go b/models/migrations/v1_23/main_test.go
index ffccac0fd3d..03a2a2d048e 100644
--- a/models/migrations/v1_23/main_test.go
+++ b/models/migrations/v1_23/main_test.go
@@ -6,7 +6,7 @@ package v1_23
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_23/v299.go b/models/migrations/v1_23/v299.go
index 11021d8855f..cb6fd97c924 100644
--- a/models/migrations/v1_23/v299.go
+++ b/models/migrations/v1_23/v299.go
@@ -3,9 +3,13 @@
 
 package v1_23
 
-import "xorm.io/xorm"
+import (
+	"gitea.dev/models/db"
 
-func AddContentVersionToIssueAndComment(x *xorm.Engine) error {
+	"xorm.io/xorm"
+)
+
+func AddContentVersionToIssueAndComment(x db.EngineMigration) error {
 	type Issue struct {
 		ContentVersion int `xorm:"NOT NULL DEFAULT 0"`
 	}
diff --git a/models/migrations/v1_23/v300.go b/models/migrations/v1_23/v300.go
index 13c6489c5e4..06c6c161b62 100644
--- a/models/migrations/v1_23/v300.go
+++ b/models/migrations/v1_23/v300.go
@@ -3,9 +3,13 @@
 
 package v1_23
 
-import "xorm.io/xorm"
+import (
+	"gitea.dev/models/db"
 
-func AddForcePushBranchProtection(x *xorm.Engine) error {
+	"xorm.io/xorm"
+)
+
+func AddForcePushBranchProtection(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		CanForcePush                 bool    `xorm:"NOT NULL DEFAULT false"`
 		EnableForcePushAllowlist     bool    `xorm:"NOT NULL DEFAULT false"`
diff --git a/models/migrations/v1_23/v301.go b/models/migrations/v1_23/v301.go
index ed8e9ef0599..03f6f2012a5 100644
--- a/models/migrations/v1_23/v301.go
+++ b/models/migrations/v1_23/v301.go
@@ -3,10 +3,14 @@
 
 package v1_23
 
-import "xorm.io/xorm"
+import (
+	"gitea.dev/models/db"
+
+	"xorm.io/xorm"
+)
 
 // AddSkipSeconderyAuthToOAuth2ApplicationTable: add SkipSecondaryAuthorization column, setting existing rows to false
-func AddSkipSecondaryAuthColumnToOAuth2ApplicationTable(x *xorm.Engine) error {
+func AddSkipSecondaryAuthColumnToOAuth2ApplicationTable(x db.EngineMigration) error {
 	type oauth2Application struct {
 		SkipSecondaryAuthorization bool `xorm:"NOT NULL DEFAULT FALSE"`
 	}
diff --git a/models/migrations/v1_23/v302.go b/models/migrations/v1_23/v302.go
index e4a50b3ec88..c347a0a0687 100644
--- a/models/migrations/v1_23/v302.go
+++ b/models/migrations/v1_23/v302.go
@@ -4,12 +4,13 @@
 package v1_23
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 
 	"xorm.io/xorm"
 )
 
-func AddIndexToActionTaskStoppedLogExpired(x *xorm.Engine) error {
+func AddIndexToActionTaskStoppedLogExpired(x db.EngineMigration) error {
 	type ActionTask struct {
 		Stopped    timeutil.TimeStamp `xorm:"index(stopped_log_expired)"`
 		LogExpired bool               `xorm:"index(stopped_log_expired)"`
diff --git a/models/migrations/v1_23/v302_test.go b/models/migrations/v1_23/v302_test.go
index 1832adf39ab..c0af662fc98 100644
--- a/models/migrations/v1_23/v302_test.go
+++ b/models/migrations/v1_23/v302_test.go
@@ -6,8 +6,8 @@ package v1_23
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_23/v303.go b/models/migrations/v1_23/v303.go
index dc541a9535a..c11e23b2f33 100644
--- a/models/migrations/v1_23/v303.go
+++ b/models/migrations/v1_23/v303.go
@@ -4,6 +4,8 @@
 package v1_23
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
@@ -14,7 +16,7 @@ type CommentMetaData struct {
 	ProjectTitle       string `json:"project_title"`
 }
 
-func AddCommentMetaDataColumn(x *xorm.Engine) error {
+func AddCommentMetaDataColumn(x db.EngineMigration) error {
 	type Comment struct {
 		CommentMetaData *CommentMetaData `xorm:"JSON TEXT"` // put all non-index metadata in a single field
 	}
diff --git a/models/migrations/v1_23/v304.go b/models/migrations/v1_23/v304.go
index 35d4d4881a9..2920c712a82 100644
--- a/models/migrations/v1_23/v304.go
+++ b/models/migrations/v1_23/v304.go
@@ -3,9 +3,13 @@
 
 package v1_23
 
-import "xorm.io/xorm"
+import (
+	"gitea.dev/models/db"
 
-func AddIndexForReleaseSha1(x *xorm.Engine) error {
+	"xorm.io/xorm"
+)
+
+func AddIndexForReleaseSha1(x db.EngineMigration) error {
 	type Release struct {
 		Sha1 string `xorm:"INDEX VARCHAR(64)"`
 	}
diff --git a/models/migrations/v1_23/v304_test.go b/models/migrations/v1_23/v304_test.go
index 9af84cd257f..2cd550d395b 100644
--- a/models/migrations/v1_23/v304_test.go
+++ b/models/migrations/v1_23/v304_test.go
@@ -6,8 +6,8 @@ package v1_23
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_23/v305.go b/models/migrations/v1_23/v305.go
index 3762279de1b..9832fd17b61 100644
--- a/models/migrations/v1_23/v305.go
+++ b/models/migrations/v1_23/v305.go
@@ -4,12 +4,11 @@
 package v1_23
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddRepositoryLicenses(x *xorm.Engine) error {
+func AddRepositoryLicenses(x db.EngineMigration) error {
 	type RepoLicense struct {
 		ID          int64 `xorm:"pk autoincr"`
 		RepoID      int64 `xorm:"UNIQUE(s) NOT NULL"`
diff --git a/models/migrations/v1_23/v306.go b/models/migrations/v1_23/v306.go
index c5c89dbeb8f..7da7b548f3b 100644
--- a/models/migrations/v1_23/v306.go
+++ b/models/migrations/v1_23/v306.go
@@ -3,9 +3,13 @@
 
 package v1_23
 
-import "xorm.io/xorm"
+import (
+	"gitea.dev/models/db"
 
-func AddBlockAdminMergeOverrideBranchProtection(x *xorm.Engine) error {
+	"xorm.io/xorm"
+)
+
+func AddBlockAdminMergeOverrideBranchProtection(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		BlockAdminMergeOverride bool `xorm:"NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_23/v307.go b/models/migrations/v1_23/v307.go
index 54a69d250b7..f87257b21e5 100644
--- a/models/migrations/v1_23/v307.go
+++ b/models/migrations/v1_23/v307.go
@@ -4,12 +4,11 @@
 package v1_23
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func FixMilestoneNoDueDate(x *xorm.Engine) error {
+func FixMilestoneNoDueDate(x db.EngineMigration) error {
 	type Milestone struct {
 		DeadlineUnix timeutil.TimeStamp
 	}
diff --git a/models/migrations/v1_23/v308.go b/models/migrations/v1_23/v308.go
index 695fdfcc2de..8a511aae77e 100644
--- a/models/migrations/v1_23/v308.go
+++ b/models/migrations/v1_23/v308.go
@@ -4,9 +4,9 @@
 package v1_23
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
@@ -47,6 +47,6 @@ func (a *improveActionTableIndicesAction) TableIndices() []*schemas.Index {
 	return indices
 }
 
-func AddNewIndexForUserDashboard(x *xorm.Engine) error {
+func AddNewIndexForUserDashboard(x db.EngineMigration) error {
 	return x.Sync(new(improveActionTableIndicesAction))
 }
diff --git a/models/migrations/v1_23/v309.go b/models/migrations/v1_23/v309.go
index e629b718a80..432ae62e3c6 100644
--- a/models/migrations/v1_23/v309.go
+++ b/models/migrations/v1_23/v309.go
@@ -4,9 +4,9 @@
 package v1_23
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
@@ -72,6 +72,6 @@ func (*improveNotificationTableIndicesAction) TableIndices() []*schemas.Index {
 	return indices
 }
 
-func ImproveNotificationTableIndices(x *xorm.Engine) error {
+func ImproveNotificationTableIndices(x db.EngineMigration) error {
 	return x.Sync(&improveNotificationTableIndicesAction{})
 }
diff --git a/models/migrations/v1_23/v310.go b/models/migrations/v1_23/v310.go
index 074b1c54d35..845eaf19bad 100644
--- a/models/migrations/v1_23/v310.go
+++ b/models/migrations/v1_23/v310.go
@@ -4,10 +4,12 @@
 package v1_23
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
-func AddPriorityToProtectedBranch(x *xorm.Engine) error {
+func AddPriorityToProtectedBranch(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		Priority int64 `xorm:"NOT NULL DEFAULT 0"`
 	}
diff --git a/models/migrations/v1_23/v311.go b/models/migrations/v1_23/v311.go
index ef48085c79b..8b9c0e78a35 100644
--- a/models/migrations/v1_23/v311.go
+++ b/models/migrations/v1_23/v311.go
@@ -4,10 +4,12 @@
 package v1_23
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
-func AddTimeEstimateColumnToIssueTable(x *xorm.Engine) error {
+func AddTimeEstimateColumnToIssueTable(x db.EngineMigration) error {
 	type Issue struct {
 		TimeEstimate int64 `xorm:"NOT NULL DEFAULT 0"`
 	}
diff --git a/models/migrations/v1_24/v312.go b/models/migrations/v1_24/v312.go
index 823b0eae403..c3f0c5635d1 100644
--- a/models/migrations/v1_24/v312.go
+++ b/models/migrations/v1_24/v312.go
@@ -4,6 +4,8 @@
 package v1_24
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
@@ -16,7 +18,7 @@ func (pullAutoMerge) TableName() string {
 	return "pull_auto_merge"
 }
 
-func AddDeleteBranchAfterMergeForAutoMerge(x *xorm.Engine) error {
+func AddDeleteBranchAfterMergeForAutoMerge(x db.EngineMigration) error {
 	_, err := x.SyncWithOptions(xorm.SyncOptions{
 		IgnoreConstrains: true,
 		IgnoreIndices:    true,
diff --git a/models/migrations/v1_24/v313.go b/models/migrations/v1_24/v313.go
index 7e6cda6bfd3..69bfda106e8 100644
--- a/models/migrations/v1_24/v313.go
+++ b/models/migrations/v1_24/v313.go
@@ -4,12 +4,11 @@
 package v1_24
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 )
 
-func MovePinOrderToTableIssuePin(x *xorm.Engine) error {
+func MovePinOrderToTableIssuePin(x db.EngineMigration) error {
 	type IssuePin struct {
 		ID       int64 `xorm:"pk autoincr"`
 		RepoID   int64 `xorm:"UNIQUE(s) NOT NULL"`
diff --git a/models/migrations/v1_24/v314.go b/models/migrations/v1_24/v314.go
index 51cb2e34aa9..502dce9c2a8 100644
--- a/models/migrations/v1_24/v314.go
+++ b/models/migrations/v1_24/v314.go
@@ -3,11 +3,9 @@
 
 package v1_24
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func UpdateOwnerIDOfRepoLevelActionsTables(x *xorm.Engine) error {
+func UpdateOwnerIDOfRepoLevelActionsTables(x db.EngineMigration) error {
 	if _, err := x.Exec("UPDATE `action_runner` SET `owner_id` = 0 WHERE `repo_id` > 0 AND `owner_id` > 0"); err != nil {
 		return err
 	}
diff --git a/models/migrations/v1_24/v315.go b/models/migrations/v1_24/v315.go
index 52b9b447856..168b9efb320 100644
--- a/models/migrations/v1_24/v315.go
+++ b/models/migrations/v1_24/v315.go
@@ -4,10 +4,12 @@
 package v1_24
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
-func AddEphemeralToActionRunner(x *xorm.Engine) error {
+func AddEphemeralToActionRunner(x db.EngineMigration) error {
 	type ActionRunner struct {
 		Ephemeral bool `xorm:"ephemeral NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_24/v316.go b/models/migrations/v1_24/v316.go
index 14e888f9eea..9539ee8a998 100644
--- a/models/migrations/v1_24/v316.go
+++ b/models/migrations/v1_24/v316.go
@@ -4,10 +4,12 @@
 package v1_24
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
-func AddDescriptionForSecretsAndVariables(x *xorm.Engine) error {
+func AddDescriptionForSecretsAndVariables(x db.EngineMigration) error {
 	type Secret struct {
 		Description string `xorm:"TEXT"`
 	}
diff --git a/models/migrations/v1_24/v317.go b/models/migrations/v1_24/v317.go
index a13db2dd27e..622f9e03ddb 100644
--- a/models/migrations/v1_24/v317.go
+++ b/models/migrations/v1_24/v317.go
@@ -4,9 +4,9 @@
 package v1_24
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
@@ -51,6 +51,6 @@ func (a *improveActionTableIndicesAction) TableIndices() []*schemas.Index {
 	return indices
 }
 
-func AddNewIndexForUserDashboard(x *xorm.Engine) error {
+func AddNewIndexForUserDashboard(x db.EngineMigration) error {
 	return x.Sync(new(improveActionTableIndicesAction))
 }
diff --git a/models/migrations/v1_24/v318.go b/models/migrations/v1_24/v318.go
index 9b4a5409609..cad0ca397d1 100644
--- a/models/migrations/v1_24/v318.go
+++ b/models/migrations/v1_24/v318.go
@@ -4,12 +4,13 @@
 package v1_24
 
 import (
-	"code.gitea.io/gitea/models/perm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
 
 	"xorm.io/xorm"
 )
 
-func AddRepoUnitAnonymousAccessMode(x *xorm.Engine) error {
+func AddRepoUnitAnonymousAccessMode(x db.EngineMigration) error {
 	type RepoUnit struct { //revive:disable-line:exported
 		AnonymousAccessMode perm.AccessMode `xorm:"NOT NULL DEFAULT 0"`
 	}
diff --git a/models/migrations/v1_24/v319.go b/models/migrations/v1_24/v319.go
index 648081f74e0..a26ac0ce710 100644
--- a/models/migrations/v1_24/v319.go
+++ b/models/migrations/v1_24/v319.go
@@ -4,10 +4,12 @@
 package v1_24
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
-func AddExclusiveOrderColumnToLabelTable(x *xorm.Engine) error {
+func AddExclusiveOrderColumnToLabelTable(x db.EngineMigration) error {
 	type Label struct {
 		ExclusiveOrder int `xorm:"DEFAULT 0"`
 	}
diff --git a/models/migrations/v1_24/v320.go b/models/migrations/v1_24/v320.go
index ebef71939c2..7ff7a78033e 100644
--- a/models/migrations/v1_24/v320.go
+++ b/models/migrations/v1_24/v320.go
@@ -4,12 +4,13 @@
 package v1_24
 
 import (
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/json"
 
 	"xorm.io/xorm"
 )
 
-func MigrateSkipTwoFactor(x *xorm.Engine) error {
+func MigrateSkipTwoFactor(x db.EngineMigration) error {
 	type LoginSource struct {
 		TwoFactorPolicy string `xorm:"two_factor_policy NOT NULL DEFAULT ''"`
 	}
diff --git a/models/migrations/v1_25/main_test.go b/models/migrations/v1_25/main_test.go
index 33c981edb97..a4fbc0e6ab8 100644
--- a/models/migrations/v1_25/main_test.go
+++ b/models/migrations/v1_25/main_test.go
@@ -6,7 +6,7 @@ package v1_25
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_25/v321.go b/models/migrations/v1_25/v321.go
index 73ef180f485..dfea8f0d44b 100644
--- a/models/migrations/v1_25/v321.go
+++ b/models/migrations/v1_25/v321.go
@@ -4,14 +4,14 @@
 package v1_25
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/setting"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
-func UseLongTextInSomeColumnsAndFixBugs(x *xorm.Engine) error {
+func UseLongTextInSomeColumnsAndFixBugs(x db.EngineMigration) error {
 	if !setting.Database.Type.IsMySQL() {
 		return nil // Only mysql need to change from text to long text, for other databases, they are the same
 	}
diff --git a/models/migrations/v1_25/v321_test.go b/models/migrations/v1_25/v321_test.go
index 0749a20e20e..a20b4c916dd 100644
--- a/models/migrations/v1_25/v321_test.go
+++ b/models/migrations/v1_25/v321_test.go
@@ -6,9 +6,9 @@ package v1_25
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/migrations/v1_25/v322.go b/models/migrations/v1_25/v322.go
index 32dae9945ae..16eabace322 100644
--- a/models/migrations/v1_25/v322.go
+++ b/models/migrations/v1_25/v322.go
@@ -4,13 +4,13 @@
 package v1_25
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 
-	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
 
-func ExtendCommentTreePathLength(x *xorm.Engine) error {
+func ExtendCommentTreePathLength(x db.EngineMigration) error {
 	dbType := x.Dialect().URI().DBType
 	if dbType == schemas.SQLITE { // For SQLITE, varchar or char will always be represented as TEXT
 		return nil
diff --git a/models/migrations/v1_25/v322_test.go b/models/migrations/v1_25/v322_test.go
index 19646140351..2e5f9a87d9b 100644
--- a/models/migrations/v1_25/v322_test.go
+++ b/models/migrations/v1_25/v322_test.go
@@ -6,8 +6,8 @@ package v1_25
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/migrations/v1_26/main_test.go b/models/migrations/v1_26/main_test.go
index 0b271b9bbcf..9befeee38f5 100644
--- a/models/migrations/v1_26/main_test.go
+++ b/models/migrations/v1_26/main_test.go
@@ -6,7 +6,7 @@ package v1_26
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_26/v323.go b/models/migrations/v1_26/v323.go
index b116f73bf0e..f2a701cb8fb 100644
--- a/models/migrations/v1_26/v323.go
+++ b/models/migrations/v1_26/v323.go
@@ -4,10 +4,12 @@
 package v1_26
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
-func AddActionsConcurrency(x *xorm.Engine) error {
+func AddActionsConcurrency(x db.EngineMigration) error {
 	type ActionRun struct {
 		RepoID            int64 `xorm:"index(repo_concurrency)"`
 		RawConcurrency    string
diff --git a/models/migrations/v1_26/v324.go b/models/migrations/v1_26/v324.go
index 5d96bfa3cae..cca28e1241c 100644
--- a/models/migrations/v1_26/v324.go
+++ b/models/migrations/v1_26/v324.go
@@ -6,10 +6,10 @@ package v1_26
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
 )
 
-func FixClosedMilestoneCompleteness(x *xorm.Engine) error {
+func FixClosedMilestoneCompleteness(x db.EngineMigration) error {
 	// Update all milestones to recalculate completeness with the new logic:
 	// - Closed milestones with 0 issues should show 100%
 	// - All other milestones should calculate based on closed/total ratio
diff --git a/models/migrations/v1_26/v325.go b/models/migrations/v1_26/v325.go
index d81540f44e9..e7bac3e02d5 100644
--- a/models/migrations/v1_26/v325.go
+++ b/models/migrations/v1_26/v325.go
@@ -3,11 +3,9 @@
 
 package v1_26
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func FixMissedRepoIDWhenMigrateAttachments(x *xorm.Engine) error {
+func FixMissedRepoIDWhenMigrateAttachments(x db.EngineMigration) error {
 	_, err := x.Exec("UPDATE `attachment` SET `repo_id` = (SELECT `repo_id` FROM `issue` WHERE `issue`.`id` = `attachment`.`issue_id`) WHERE `issue_id` > 0 AND (`repo_id` IS NULL OR `repo_id` = 0);")
 	if err != nil {
 		return err
diff --git a/models/migrations/v1_26/v325_test.go b/models/migrations/v1_26/v325_test.go
index 3fd658e01b9..b18b9544692 100644
--- a/models/migrations/v1_26/v325_test.go
+++ b/models/migrations/v1_26/v325_test.go
@@ -6,8 +6,8 @@ package v1_26
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/require"
 )
diff --git a/models/migrations/v1_26/v326.go b/models/migrations/v1_26/v326.go
index dcf548bec0e..b2c28f06d9a 100644
--- a/models/migrations/v1_26/v326.go
+++ b/models/migrations/v1_26/v326.go
@@ -10,12 +10,11 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 const (
@@ -92,7 +91,7 @@ type commitSHAAndRuns struct {
 // Only rows whose resolved run ID is below legacyURLIDThreshold are rewritten.
 // This is because smaller legacy run indexes are more likely to collide with run ID URLs during runtime resolution,
 // so this migration prioritizes that lower range and leaves the remaining legacy target URLs to the web compatibility logic.
-func FixCommitStatusTargetURLToUseRunAndJobID(x *xorm.Engine) error {
+func FixCommitStatusTargetURLToUseRunAndJobID(x db.EngineMigration) error {
 	jobsByRunIDCache := make(map[int64][]int64)
 	repoLinkCache := make(map[int64]string)
 	groups, err := loadLegacyMigrationRunGroups(x)
@@ -113,7 +112,7 @@ func FixCommitStatusTargetURLToUseRunAndJobID(x *xorm.Engine) error {
 	return nil
 }
 
-func loadLegacyMigrationRunGroups(x *xorm.Engine) (map[int64]map[string]*commitSHAAndRuns, error) {
+func loadLegacyMigrationRunGroups(x db.EngineMigration) (map[int64]map[string]*commitSHAAndRuns, error) {
 	var runs []migrationActionRun
 	if err := x.Table("action_run").
 		Where("id < ?", legacyURLIDThreshold).
@@ -149,7 +148,7 @@ func loadLegacyMigrationRunGroups(x *xorm.Engine) (map[int64]map[string]*commitS
 }
 
 func migrateCommitStatusTargetURLForGroup(
-	x *xorm.Engine,
+	x db.EngineMigration,
 	table string,
 	repoID int64,
 	sha string,
@@ -210,7 +209,7 @@ func migrateCommitStatusTargetURLForGroup(
 	return nil
 }
 
-func getRepoLinkCached(x *xorm.Engine, cache map[int64]string, repoID int64) (string, error) {
+func getRepoLinkCached(x db.EngineMigration, cache map[int64]string, repoID int64) (string, error) {
 	if link, ok := cache[repoID]; ok {
 		return link, nil
 	}
@@ -228,7 +227,7 @@ func getRepoLinkCached(x *xorm.Engine, cache map[int64]string, repoID int64) (st
 	return link, nil
 }
 
-func getJobIDByIndexCached(x *xorm.Engine, cache map[int64][]int64, runID, jobIndex int64) (int64, bool, error) {
+func getJobIDByIndexCached(x db.EngineMigration, cache map[int64][]int64, runID, jobIndex int64) (int64, bool, error) {
 	jobIDs, ok := cache[runID]
 	if !ok {
 		var jobs []migrationActionRunJob
diff --git a/models/migrations/v1_26/v326_test.go b/models/migrations/v1_26/v326_test.go
index a0225eb774c..09f3c3ab5c7 100644
--- a/models/migrations/v1_26/v326_test.go
+++ b/models/migrations/v1_26/v326_test.go
@@ -6,16 +6,16 @@ package v1_26
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/migrationtest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/git"
-	_ "code.gitea.io/gitea/models/repo"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/git"
+	_ "gitea.dev/models/repo"
 
 	"github.com/stretchr/testify/require"
-	"xorm.io/xorm"
 )
 
 func Test_FixCommitStatusTargetURLToUseRunAndJobID(t *testing.T) {
@@ -100,7 +100,7 @@ func Test_FixCommitStatusTargetURLToUseRunAndJobID(t *testing.T) {
 	}
 }
 
-func assertTargetURL(t *testing.T, x *xorm.Engine, table string, id int64, want string) {
+func assertTargetURL(t *testing.T, x db.EngineMigration, table string, id int64, want string) {
 	t.Helper()
 
 	var row struct {
diff --git a/models/migrations/v1_26/v327.go b/models/migrations/v1_26/v327.go
index 51af567650d..19c1eae725f 100644
--- a/models/migrations/v1_26/v327.go
+++ b/models/migrations/v1_26/v327.go
@@ -3,9 +3,13 @@
 
 package v1_26
 
-import "xorm.io/xorm"
+import (
+	"gitea.dev/models/db"
 
-func AddDisabledToActionRunner(x *xorm.Engine) error {
+	"xorm.io/xorm"
+)
+
+func AddDisabledToActionRunner(x db.EngineMigration) error {
 	type ActionRunner struct {
 		IsDisabled bool `xorm:"is_disabled NOT NULL DEFAULT false"`
 	}
diff --git a/models/migrations/v1_26/v327_test.go b/models/migrations/v1_26/v327_test.go
index 98e948cf05c..f93c2cbc20f 100644
--- a/models/migrations/v1_26/v327_test.go
+++ b/models/migrations/v1_26/v327_test.go
@@ -6,7 +6,7 @@ package v1_26
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/require"
 )
diff --git a/models/migrations/v1_26/v328.go b/models/migrations/v1_26/v328.go
index 81047305289..b7ca9930496 100644
--- a/models/migrations/v1_26/v328.go
+++ b/models/migrations/v1_26/v328.go
@@ -4,10 +4,12 @@
 package v1_26
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
-func AddTokenPermissionsToActionRunJob(x *xorm.Engine) error {
+func AddTokenPermissionsToActionRunJob(x db.EngineMigration) error {
 	type ActionRunJob struct {
 		TokenPermissions string `xorm:"JSON TEXT"`
 	}
diff --git a/models/migrations/v1_26/v329.go b/models/migrations/v1_26/v329.go
index 1afd155f05e..15754e28665 100644
--- a/models/migrations/v1_26/v329.go
+++ b/models/migrations/v1_26/v329.go
@@ -6,7 +6,8 @@ package v1_26
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm/schemas"
 )
 
@@ -27,7 +28,7 @@ func (n *UserBadge) TableIndices() []*schemas.Index {
 
 // AddUniqueIndexForUserBadge adds a compound unique indexes for user badge table
 // and it replaces an old index on user_id
-func AddUniqueIndexForUserBadge(x *xorm.Engine) error {
+func AddUniqueIndexForUserBadge(x db.EngineMigration) error {
 	// remove possible duplicated records in table user_badge
 	type result struct {
 		UserID  int64
diff --git a/models/migrations/v1_26/v329_test.go b/models/migrations/v1_26/v329_test.go
index e4bebfb71dc..4b20273e7b5 100644
--- a/models/migrations/v1_26/v329_test.go
+++ b/models/migrations/v1_26/v329_test.go
@@ -6,7 +6,7 @@ package v1_26
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/migrations/v1_26/v330.go b/models/migrations/v1_26/v330.go
index 9f77331090b..341da864bd6 100644
--- a/models/migrations/v1_26/v330.go
+++ b/models/migrations/v1_26/v330.go
@@ -4,10 +4,12 @@
 package v1_26
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm"
 )
 
-func AddNameToWebhook(x *xorm.Engine) error {
+func AddNameToWebhook(x db.EngineMigration) error {
 	type Webhook struct {
 		Name string `xorm:"VARCHAR(255) NOT NULL DEFAULT ''"`
 	}
diff --git a/models/migrations/v1_27/main_test.go b/models/migrations/v1_27/main_test.go
index 0c6a6a24401..949c88c23fb 100644
--- a/models/migrations/v1_27/main_test.go
+++ b/models/migrations/v1_27/main_test.go
@@ -6,7 +6,7 @@ package v1_27
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/migrations/v1_27/v331.go b/models/migrations/v1_27/v331.go
index 204b7b661e9..09d94929d0d 100644
--- a/models/migrations/v1_27/v331.go
+++ b/models/migrations/v1_27/v331.go
@@ -7,8 +7,9 @@ import (
 	"context"
 	"time"
 
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/timeutil"
 
 	"xorm.io/xorm"
 )
@@ -90,7 +91,7 @@ func (actionRun) TableName() string {
 }
 
 // AddActionRunAttemptModel adds the ActionRunAttempt table and the supporting ActionRun/ActionRunJob fields.
-func AddActionRunAttemptModel(x *xorm.Engine) error {
+func AddActionRunAttemptModel(x db.EngineMigration) error {
 	// add "action_run_attempt"
 	if _, err := x.SyncWithOptions(xorm.SyncOptions{
 		IgnoreDropIndices: true,
diff --git a/models/migrations/v1_27/v331_test.go b/models/migrations/v1_27/v331_test.go
index 2302fee024f..d86f9d943ff 100644
--- a/models/migrations/v1_27/v331_test.go
+++ b/models/migrations/v1_27/v331_test.go
@@ -8,7 +8,7 @@ import (
 	"slices"
 	"testing"
 
-	"code.gitea.io/gitea/models/migrations/migrationtest"
+	"gitea.dev/models/migrations/migrationtest"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/migrations/v1_27/v332.go b/models/migrations/v1_27/v332.go
new file mode 100644
index 00000000000..e0fc6a6c0f6
--- /dev/null
+++ b/models/migrations/v1_27/v332.go
@@ -0,0 +1,25 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v1_27
+
+import (
+	"gitea.dev/models/db"
+
+	"xorm.io/xorm"
+)
+
+type mirrorWithLastSyncUnix struct {
+	LastSyncUnix int64 `xorm:"INDEX"`
+}
+
+func (mirrorWithLastSyncUnix) TableName() string {
+	return "mirror"
+}
+
+func AddLastSyncUnixToMirror(x db.EngineMigration) error {
+	_, err := x.SyncWithOptions(xorm.SyncOptions{
+		IgnoreDropIndices: true,
+	}, new(mirrorWithLastSyncUnix))
+	return err
+}
diff --git a/models/migrations/v1_27/v333.go b/models/migrations/v1_27/v333.go
new file mode 100644
index 00000000000..e019313d1e7
--- /dev/null
+++ b/models/migrations/v1_27/v333.go
@@ -0,0 +1,24 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v1_27
+
+import (
+	"gitea.dev/models/db"
+
+	"xorm.io/xorm"
+)
+
+func AddBranchProtectionBypassAllowlist(x db.EngineMigration) error {
+	type ProtectedBranch struct {
+		EnableBypassAllowlist  bool    `xorm:"NOT NULL DEFAULT false"`
+		BypassAllowlistUserIDs []int64 `xorm:"JSON TEXT"`
+		BypassAllowlistTeamIDs []int64 `xorm:"JSON TEXT"`
+	}
+
+	_, err := x.SyncWithOptions(xorm.SyncOptions{
+		IgnoreConstrains: true,
+		IgnoreIndices:    true,
+	}, new(ProtectedBranch))
+	return err
+}
diff --git a/models/migrations/v1_27/v333_test.go b/models/migrations/v1_27/v333_test.go
new file mode 100644
index 00000000000..901831fb1ec
--- /dev/null
+++ b/models/migrations/v1_27/v333_test.go
@@ -0,0 +1,60 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v1_27
+
+import (
+	"testing"
+
+	"gitea.dev/models/migrations/migrationtest"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_AddBranchProtectionBypassAllowlist(t *testing.T) {
+	type ProtectedBranch struct {
+		ID                     int64   `xorm:"pk autoincr"`
+		RepoID                 int64   `xorm:"INDEX"`
+		BranchName             string  `xorm:"INDEX"`
+		EnableBypassAllowlist  bool    `xorm:"NOT NULL DEFAULT false"`
+		BypassAllowlistUserIDs []int64 `xorm:"JSON TEXT"`
+		BypassAllowlistTeamIDs []int64 `xorm:"JSON TEXT"`
+	}
+
+	x, deferable := migrationtest.PrepareTestEnv(t, 0, new(ProtectedBranch))
+	defer deferable()
+
+	// Test with default values
+	_, err := x.Insert(&ProtectedBranch{RepoID: 1, BranchName: "main"})
+	require.NoError(t, err)
+
+	// Test with populated allowlist
+	_, err = x.Insert(&ProtectedBranch{
+		RepoID:                 1,
+		BranchName:             "develop",
+		EnableBypassAllowlist:  true,
+		BypassAllowlistUserIDs: []int64{1, 2, 3},
+		BypassAllowlistTeamIDs: []int64{10, 20},
+	})
+	require.NoError(t, err)
+
+	require.NoError(t, AddBranchProtectionBypassAllowlist(x))
+
+	// Verify the default values record
+	var pb ProtectedBranch
+	has, err := x.Where("repo_id = ? AND branch_name = ?", 1, "main").Get(&pb)
+	require.NoError(t, err)
+	require.True(t, has)
+	require.False(t, pb.EnableBypassAllowlist)
+	require.Nil(t, pb.BypassAllowlistUserIDs)
+	require.Nil(t, pb.BypassAllowlistTeamIDs)
+
+	// Verify the populated allowlist record
+	var pb2 ProtectedBranch
+	has, err = x.Where("repo_id = ? AND branch_name = ?", 1, "develop").Get(&pb2)
+	require.NoError(t, err)
+	require.True(t, has)
+	require.True(t, pb2.EnableBypassAllowlist)
+	require.Equal(t, []int64{1, 2, 3}, pb2.BypassAllowlistUserIDs)
+	require.Equal(t, []int64{10, 20}, pb2.BypassAllowlistTeamIDs)
+}
diff --git a/models/migrations/v1_27/v334.go b/models/migrations/v1_27/v334.go
new file mode 100644
index 00000000000..a39a3ecf844
--- /dev/null
+++ b/models/migrations/v1_27/v334.go
@@ -0,0 +1,22 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v1_27
+
+import (
+	"gitea.dev/models/db"
+
+	"xorm.io/xorm"
+)
+
+func AddCancellingSupportToActionRunner(x db.EngineMigration) error {
+	type ActionRunner struct {
+		HasCancellingSupport bool `xorm:"has_cancelling_support NOT NULL DEFAULT false"`
+	}
+
+	_, err := x.SyncWithOptions(xorm.SyncOptions{
+		IgnoreConstrains:  true,
+		IgnoreDropIndices: true,
+	}, new(ActionRunner))
+	return err
+}
diff --git a/models/migrations/v1_27/v334_test.go b/models/migrations/v1_27/v334_test.go
new file mode 100644
index 00000000000..8bcb82e4751
--- /dev/null
+++ b/models/migrations/v1_27/v334_test.go
@@ -0,0 +1,36 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v1_27
+
+import (
+	"testing"
+
+	"gitea.dev/models/migrations/migrationtest"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAddCancellingSupportToActionRunner(t *testing.T) {
+	type ActionRunner struct {
+		ID   int64 `xorm:"pk autoincr"`
+		Name string
+	}
+
+	x, deferable := migrationtest.PrepareTestEnv(t, 0, new(ActionRunner))
+	defer deferable()
+	if x == nil || t.Failed() {
+		return
+	}
+
+	_, err := x.Insert(&ActionRunner{Name: "runner"})
+	require.NoError(t, err)
+
+	require.NoError(t, AddCancellingSupportToActionRunner(x))
+
+	var hasCancellingSupport bool
+	has, err := x.SQL("SELECT has_cancelling_support FROM action_runner WHERE id = ?", 1).Get(&hasCancellingSupport)
+	require.NoError(t, err)
+	require.True(t, has)
+	require.False(t, hasCancellingSupport)
+}
diff --git a/models/migrations/v1_27/v335.go b/models/migrations/v1_27/v335.go
new file mode 100644
index 00000000000..c14488e343e
--- /dev/null
+++ b/models/migrations/v1_27/v335.go
@@ -0,0 +1,33 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v1_27
+
+import (
+	"gitea.dev/models/db"
+
+	"xorm.io/xorm"
+)
+
+// AddReusableWorkflowFieldsToActionRunJob adds the ActionRunJob columns that describe the reusable workflow caller hierarchy,
+// and the ActionRunAttemptJobIDIndex table backing run-wide AttemptJobID allocation.
+func AddReusableWorkflowFieldsToActionRunJob(x db.EngineMigration) error {
+	type ActionRunJob struct {
+		WorkflowSourceRepoID    int64  `xorm:"NOT NULL DEFAULT 0"`
+		WorkflowSourceCommitSHA string `xorm:"VARCHAR(64) NOT NULL DEFAULT ''"`
+		IsReusableCaller        bool   `xorm:"index NOT NULL DEFAULT FALSE"`
+		ParentJobID             int64  `xorm:"index NOT NULL DEFAULT 0"`
+		CallUses                string `xorm:"VARCHAR(512) NOT NULL DEFAULT ''"`
+		CallSecrets             string `xorm:"LONGTEXT"`
+		CallPayload             string `xorm:"LONGTEXT"`
+		IsExpanded              bool   `xorm:"NOT NULL DEFAULT FALSE"`
+		ReusableWorkflowContent []byte `xorm:"LONGBLOB"`
+	}
+
+	type ActionRunAttemptJobIDIndex db.ResourceIndex
+
+	if _, err := x.SyncWithOptions(xorm.SyncOptions{IgnoreDropIndices: true}, new(ActionRunJob)); err != nil {
+		return err
+	}
+	return x.Sync(new(ActionRunAttemptJobIDIndex))
+}
diff --git a/models/migrations/v1_6/v70.go b/models/migrations/v1_6/v70.go
index 41f09669423..947d27d3dd9 100644
--- a/models/migrations/v1_6/v70.go
+++ b/models/migrations/v1_6/v70.go
@@ -7,12 +7,11 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
 )
 
-func AddIssueDependencies(x *xorm.Engine) (err error) {
+func AddIssueDependencies(x db.EngineMigration) (err error) {
 	type IssueDependency struct {
 		ID           int64     `xorm:"pk autoincr"`
 		UserID       int64     `xorm:"NOT NULL"`
diff --git a/models/migrations/v1_6/v71.go b/models/migrations/v1_6/v71.go
index b4dcd87ebae..ba2fbb6f179 100644
--- a/models/migrations/v1_6/v71.go
+++ b/models/migrations/v1_6/v71.go
@@ -6,14 +6,13 @@ package v1_6
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
-func AddScratchHash(x *xorm.Engine) error {
+func AddScratchHash(x db.EngineMigration) error {
 	// TwoFactor see models/twofactor.go
 	type TwoFactor struct {
 		ID               int64 `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_6/v72.go b/models/migrations/v1_6/v72.go
index 9fad88a1b61..5aa74402f54 100644
--- a/models/migrations/v1_6/v72.go
+++ b/models/migrations/v1_6/v72.go
@@ -6,12 +6,11 @@ package v1_6
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddReview(x *xorm.Engine) error {
+func AddReview(x db.EngineMigration) error {
 	// Review see models/review.go
 	type Review struct {
 		ID          int64 `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_7/v73.go b/models/migrations/v1_7/v73.go
index e0b7a285375..6f068cc9d9c 100644
--- a/models/migrations/v1_7/v73.go
+++ b/models/migrations/v1_7/v73.go
@@ -3,11 +3,9 @@
 
 package v1_7
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddMustChangePassword(x *xorm.Engine) error {
+func AddMustChangePassword(x db.EngineMigration) error {
 	// User see models/user.go
 	type User struct {
 		ID                 int64 `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_7/v74.go b/models/migrations/v1_7/v74.go
index 376be37a246..774602317e2 100644
--- a/models/migrations/v1_7/v74.go
+++ b/models/migrations/v1_7/v74.go
@@ -3,9 +3,9 @@
 
 package v1_7
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddApprovalWhitelistsToProtectedBranches(x *xorm.Engine) error {
+func AddApprovalWhitelistsToProtectedBranches(x db.EngineMigration) error {
 	type ProtectedBranch struct {
 		ApprovalsWhitelistUserIDs []int64 `xorm:"JSON TEXT"`
 		ApprovalsWhitelistTeamIDs []int64 `xorm:"JSON TEXT"`
diff --git a/models/migrations/v1_7/v75.go b/models/migrations/v1_7/v75.go
index ef115754664..2da93264c30 100644
--- a/models/migrations/v1_7/v75.go
+++ b/models/migrations/v1_7/v75.go
@@ -4,11 +4,12 @@
 package v1_7
 
 import (
+	"gitea.dev/models/db"
+
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
-func ClearNonusedData(x *xorm.Engine) error {
+func ClearNonusedData(x db.EngineMigration) error {
 	condDelete := func(colName string) builder.Cond {
 		return builder.NotIn(colName, builder.Select("id").From("`user`"))
 	}
diff --git a/models/migrations/v1_8/v76.go b/models/migrations/v1_8/v76.go
index 81e93075497..d2afd23ffe2 100644
--- a/models/migrations/v1_8/v76.go
+++ b/models/migrations/v1_8/v76.go
@@ -6,12 +6,11 @@ package v1_8
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddPullRequestRebaseWithMerge(x *xorm.Engine) error {
+func AddPullRequestRebaseWithMerge(x db.EngineMigration) error {
 	// RepoUnit describes all units of a repository
 	type RepoUnit struct {
 		ID          int64
diff --git a/models/migrations/v1_8/v77.go b/models/migrations/v1_8/v77.go
index 4fe5ebe6350..8f91891cfe3 100644
--- a/models/migrations/v1_8/v77.go
+++ b/models/migrations/v1_8/v77.go
@@ -3,11 +3,9 @@
 
 package v1_8
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddUserDefaultTheme(x *xorm.Engine) error {
+func AddUserDefaultTheme(x db.EngineMigration) error {
 	type User struct {
 		Theme string `xorm:"VARCHAR(30) NOT NULL DEFAULT ''"`
 	}
diff --git a/models/migrations/v1_8/v78.go b/models/migrations/v1_8/v78.go
index e67f4641312..b41bbbed7e1 100644
--- a/models/migrations/v1_8/v78.go
+++ b/models/migrations/v1_8/v78.go
@@ -4,12 +4,11 @@
 package v1_8
 
 import (
-	"code.gitea.io/gitea/models/migrations/base"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
 )
 
-func RenameRepoIsBareToIsEmpty(x *xorm.Engine) error {
+func RenameRepoIsBareToIsEmpty(x db.EngineMigration) error {
 	type Repository struct {
 		ID      int64 `xorm:"pk autoincr"`
 		IsBare  bool
diff --git a/models/migrations/v1_8/v79.go b/models/migrations/v1_8/v79.go
index 3f50114d5a5..b29f973c871 100644
--- a/models/migrations/v1_8/v79.go
+++ b/models/migrations/v1_8/v79.go
@@ -4,12 +4,11 @@
 package v1_8
 
 import (
-	"code.gitea.io/gitea/modules/setting"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
 )
 
-func AddCanCloseIssuesViaCommitInAnyBranch(x *xorm.Engine) error {
+func AddCanCloseIssuesViaCommitInAnyBranch(x db.EngineMigration) error {
 	type Repository struct {
 		ID                              int64 `xorm:"pk autoincr"`
 		CloseIssuesViaCommitInAnyBranch bool  `xorm:"NOT NULL DEFAULT false"`
diff --git a/models/migrations/v1_8/v80.go b/models/migrations/v1_8/v80.go
index 6f9df47a933..7e8855cb222 100644
--- a/models/migrations/v1_8/v80.go
+++ b/models/migrations/v1_8/v80.go
@@ -3,9 +3,9 @@
 
 package v1_8
 
-import "xorm.io/xorm"
+import "gitea.dev/models/db"
 
-func AddIsLockedToIssues(x *xorm.Engine) error {
+func AddIsLockedToIssues(x db.EngineMigration) error {
 	// Issue see models/issue.go
 	type Issue struct {
 		ID       int64 `xorm:"pk autoincr"`
diff --git a/models/migrations/v1_8/v81.go b/models/migrations/v1_8/v81.go
index 3c2acc64584..406ea973bc2 100644
--- a/models/migrations/v1_8/v81.go
+++ b/models/migrations/v1_8/v81.go
@@ -6,11 +6,12 @@ package v1_8
 import (
 	"fmt"
 
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+
 	"xorm.io/xorm/schemas"
 )
 
-func ChangeU2FCounterType(x *xorm.Engine) error {
+func ChangeU2FCounterType(x db.EngineMigration) error {
 	var err error
 
 	switch x.Dialect().URI().DBType {
diff --git a/models/migrations/v1_9/v82.go b/models/migrations/v1_9/v82.go
index 8796b0563db..9e8b47e8829 100644
--- a/models/migrations/v1_9/v82.go
+++ b/models/migrations/v1_9/v82.go
@@ -7,14 +7,13 @@ import (
 	"context"
 	"fmt"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
 )
 
-func FixReleaseSha1OnReleaseTable(ctx context.Context, x *xorm.Engine) error {
+func FixReleaseSha1OnReleaseTable(ctx context.Context, x db.EngineMigration) error {
 	type Release struct {
 		ID      int64
 		RepoID  int64
diff --git a/models/migrations/v1_9/v83.go b/models/migrations/v1_9/v83.go
index a0cd57f7c5f..84da3f5a5c8 100644
--- a/models/migrations/v1_9/v83.go
+++ b/models/migrations/v1_9/v83.go
@@ -4,12 +4,11 @@
 package v1_9
 
 import (
-	"code.gitea.io/gitea/modules/timeutil"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
-func AddUploaderIDForAttachment(x *xorm.Engine) error {
+func AddUploaderIDForAttachment(x db.EngineMigration) error {
 	type Attachment struct {
 		ID            int64  `xorm:"pk autoincr"`
 		UUID          string `xorm:"uuid UNIQUE"`
diff --git a/models/migrations/v1_9/v84.go b/models/migrations/v1_9/v84.go
index 423915ae57c..9e7347b3a39 100644
--- a/models/migrations/v1_9/v84.go
+++ b/models/migrations/v1_9/v84.go
@@ -3,11 +3,9 @@
 
 package v1_9
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddGPGKeyImport(x *xorm.Engine) error {
+func AddGPGKeyImport(x db.EngineMigration) error {
 	type GPGKeyImport struct {
 		KeyID   string `xorm:"pk CHAR(16) NOT NULL"`
 		Content string `xorm:"TEXT NOT NULL"`
diff --git a/models/migrations/v1_9/v85.go b/models/migrations/v1_9/v85.go
index 0e95a71f929..6d7c05cb0d6 100644
--- a/models/migrations/v1_9/v85.go
+++ b/models/migrations/v1_9/v85.go
@@ -6,15 +6,14 @@ package v1_9
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations/base"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
-func HashAppToken(x *xorm.Engine) error {
+func HashAppToken(x db.EngineMigration) error {
 	// AccessToken see models/token.go
 	type AccessToken struct {
 		ID             int64 `xorm:"pk autoincr"`
@@ -98,7 +97,7 @@ func HashAppToken(x *xorm.Engine) error {
 	return resyncHashAppTokenWithUniqueHash(x)
 }
 
-func resyncHashAppTokenWithUniqueHash(x *xorm.Engine) error {
+func resyncHashAppTokenWithUniqueHash(x db.EngineMigration) error {
 	// AccessToken see models/token.go
 	type AccessToken struct {
 		TokenHash string `xorm:"UNIQUE"` // sha256 of token - we will ensure UNIQUE later
diff --git a/models/migrations/v1_9/v86.go b/models/migrations/v1_9/v86.go
index 9464ff0cf68..08bf2795e03 100644
--- a/models/migrations/v1_9/v86.go
+++ b/models/migrations/v1_9/v86.go
@@ -3,11 +3,9 @@
 
 package v1_9
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddHTTPMethodToWebhook(x *xorm.Engine) error {
+func AddHTTPMethodToWebhook(x db.EngineMigration) error {
 	type Webhook struct {
 		HTTPMethod string `xorm:"http_method DEFAULT 'POST'"`
 	}
diff --git a/models/migrations/v1_9/v87.go b/models/migrations/v1_9/v87.go
index 81a4ebf80d0..478d5496418 100644
--- a/models/migrations/v1_9/v87.go
+++ b/models/migrations/v1_9/v87.go
@@ -3,11 +3,9 @@
 
 package v1_9
 
-import (
-	"xorm.io/xorm"
-)
+import "gitea.dev/models/db"
 
-func AddAvatarFieldToRepository(x *xorm.Engine) error {
+func AddAvatarFieldToRepository(x db.EngineMigration) error {
 	type Repository struct {
 		// ID(10-20)-md5(32) - must fit into 64 symbols
 		Avatar string `xorm:"VARCHAR(64)"`
diff --git a/models/organization/main_test.go b/models/organization/main_test.go
index c35898a465d..f06678cd03d 100644
--- a/models/organization/main_test.go
+++ b/models/organization/main_test.go
@@ -6,14 +6,14 @@ package organization_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
-	_ "code.gitea.io/gitea/models/organization"
-	_ "code.gitea.io/gitea/models/repo"
-	_ "code.gitea.io/gitea/models/user"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
+	_ "gitea.dev/models/organization"
+	_ "gitea.dev/models/repo"
+	_ "gitea.dev/models/user"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/organization/org.go b/models/organization/org.go
index 10a2c330e56..d9390fc147f 100644
--- a/models/organization/org.go
+++ b/models/organization/org.go
@@ -9,14 +9,14 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 	"xorm.io/xorm"
@@ -181,17 +181,49 @@ func (org *Organization) HomeLink() string {
 // FindOrgMembersOpts represents find org members conditions
 type FindOrgMembersOpts struct {
 	db.ListOptions
-	Doer         *user_model.User
-	IsDoerMember bool
-	OrgID        int64
+	Doer          *user_model.User
+	IsDoerMember  bool
+	OrgID         int64
+	Keyword       string
+	SearchByEmail bool
 }
 
 func (opts FindOrgMembersOpts) PublicOnly() bool {
 	return opts.Doer == nil || !(opts.IsDoerMember || opts.Doer.IsAdmin)
 }
 
+func (opts FindOrgMembersOpts) applyKeywordFilter(sess *xorm.Session) (*xorm.Session, bool) {
+	if opts.Keyword == "" {
+		return sess, false
+	}
+
+	lowerKeyword := strings.ToLower(opts.Keyword)
+	keywordCond := builder.Or(
+		builder.Like{"`user`.lower_name", lowerKeyword},
+		builder.Like{"LOWER(`user`.full_name)", lowerKeyword},
+	)
+	if opts.SearchByEmail {
+		var emailCond builder.Cond = builder.Like{"LOWER(`user`.email)", lowerKeyword}
+		switch {
+		case opts.Doer == nil:
+			emailCond = emailCond.And(builder.Eq{"`user`.keep_email_private": false})
+		case !opts.Doer.IsAdmin:
+			emailCond = emailCond.And(
+				builder.Or(
+					builder.Eq{"`user`.keep_email_private": false},
+					builder.Eq{"`user`.id": opts.Doer.ID},
+				),
+			)
+		}
+		keywordCond = keywordCond.Or(emailCond)
+	}
+
+	sess = sess.Join("INNER", "`user`", "org_user.uid = `user`.id").And(keywordCond)
+	return sess, true
+}
+
 // applyTeamMatesOnlyFilter make sure restricted users only see public team members and there own team mates
-func (opts FindOrgMembersOpts) applyTeamMatesOnlyFilter(sess *xorm.Session) {
+func (opts FindOrgMembersOpts) applyTeamMatesOnlyFilter(sess db.Session) {
 	if opts.Doer != nil && opts.IsDoerMember && opts.Doer.IsRestricted {
 		teamMates := builder.Select("DISTINCT team_user.uid").
 			From("team_user").
@@ -213,6 +245,7 @@ func CountOrgMembers(ctx context.Context, opts *FindOrgMembersOpts) (int64, erro
 	} else {
 		opts.applyTeamMatesOnlyFilter(sess)
 	}
+	sess, _ = opts.applyKeywordFilter(sess)
 
 	return sess.Count(new(OrgUser))
 }
@@ -461,9 +494,13 @@ func GetOrgUsersByOrgID(ctx context.Context, opts *FindOrgMembersOpts) ([]*OrgUs
 	} else {
 		opts.applyTeamMatesOnlyFilter(sess)
 	}
+	if keywordSess, hasKeyword := opts.applyKeywordFilter(sess); hasKeyword {
+		sess = keywordSess.Select("org_user.*")
+	}
 
+	sess = sess.OrderBy("org_user.uid ASC")
 	if opts.ListOptions.PageSize > 0 {
-		sess = db.SetSessionPagination(sess, opts)
+		db.SetSessionPagination(sess, opts)
 
 		ous := make([]*OrgUser, 0, opts.PageSize)
 		return ous, sess.Find(&ous)
diff --git a/models/organization/org_list.go b/models/organization/org_list.go
index f37961b5f62..73de7db824b 100644
--- a/models/organization/org_list.go
+++ b/models/organization/org_list.go
@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/structs"
 
 	"xorm.io/builder"
 )
@@ -54,6 +54,12 @@ type FindOrgOptions struct {
 	IncludeVisibility structs.VisibleType
 }
 
+func (opts *FindOrgOptions) ApplyPublicOnly(publicOnly bool) {
+	if publicOnly {
+		opts.IncludeVisibility = structs.VisibleTypePublic
+	}
+}
+
 func queryUserOrgIDs(userID int64, includePrivate bool) *builder.Builder {
 	cond := builder.Eq{"uid": userID}
 	if !includePrivate {
diff --git a/models/organization/org_list_test.go b/models/organization/org_list_test.go
index b2a10444225..a3a8b1e2b05 100644
--- a/models/organization/org_list_test.go
+++ b/models/organization/org_list_test.go
@@ -6,11 +6,11 @@ package organization_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/organization/org_test.go b/models/organization/org_test.go
index 7a74c5f5fcc..8fe4b792976 100644
--- a/models/organization/org_test.go
+++ b/models/organization/org_test.go
@@ -8,14 +8,14 @@ import (
 	"sort"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -288,6 +288,80 @@ func TestGetOrgUsersByOrgID(t *testing.T) {
 	assert.Empty(t, orgUsers)
 }
 
+func TestOrgMembersSearch(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	member := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+	admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
+
+	testCases := []struct {
+		name         string
+		opts         *organization.FindOrgMembersOpts
+		expectedUIDs []int64
+	}{
+		{
+			name: "match by username",
+			opts: &organization.FindOrgMembersOpts{
+				OrgID:         3,
+				Doer:          member,
+				IsDoerMember:  true,
+				Keyword:       "user4",
+				SearchByEmail: true,
+			},
+			expectedUIDs: []int64{4},
+		},
+		{
+			name: "match by full name",
+			opts: &organization.FindOrgMembersOpts{
+				OrgID:         3,
+				Doer:          member,
+				IsDoerMember:  true,
+				Keyword:       "user27",
+				SearchByEmail: true,
+			},
+			expectedUIDs: []int64{28},
+		},
+		{
+			name: "private email hidden",
+			opts: &organization.FindOrgMembersOpts{
+				OrgID:         3,
+				Doer:          member,
+				IsDoerMember:  true,
+				Keyword:       "user2@example.com",
+				SearchByEmail: true,
+			},
+			expectedUIDs: []int64{},
+		},
+		{
+			name: "admin can search private email",
+			opts: &organization.FindOrgMembersOpts{
+				OrgID:         3,
+				Doer:          admin,
+				Keyword:       "user2@example.com",
+				SearchByEmail: true,
+			},
+			expectedUIDs: []int64{2},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			count, err := organization.CountOrgMembers(t.Context(), tc.opts)
+			assert.NoError(t, err)
+			assert.EqualValues(t, len(tc.expectedUIDs), count)
+
+			members, err := organization.GetOrgUsersByOrgID(t.Context(), tc.opts)
+			assert.NoError(t, err)
+			memberUIDs := make([]int64, 0, len(members))
+			for _, member := range members {
+				memberUIDs = append(memberUIDs, member.UID)
+			}
+			slices.Sort(memberUIDs)
+			assert.Equal(t, tc.expectedUIDs, memberUIDs)
+		})
+	}
+}
+
 func TestChangeOrgUserStatus(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 
@@ -456,6 +530,22 @@ func TestGetUsersWhoCanCreateOrgRepo(t *testing.T) {
 	assert.NotNil(t, users[5])
 }
 
+func TestCanCreateOrgRepoByOwnerTeamWithoutFlag(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
+	ownerTeam, err := org.GetOwnerTeam(t.Context())
+	require.NoError(t, err)
+
+	ownerTeam.CanCreateOrgRepo = false
+	_, err = db.GetEngine(t.Context()).ID(ownerTeam.ID).Cols("can_create_org_repo").Update(ownerTeam)
+	require.NoError(t, err)
+
+	ok, err := organization.CanCreateOrgRepo(t.Context(), org.ID, 2)
+	require.NoError(t, err)
+	assert.True(t, ok)
+}
+
 func TestUser_RemoveOrgRepo(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
diff --git a/models/organization/org_user.go b/models/organization/org_user.go
index 627c1c2edf0..61102501af2 100644
--- a/models/organization/org_user.go
+++ b/models/organization/org_user.go
@@ -7,9 +7,10 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
 
 	"xorm.io/builder"
 )
@@ -104,7 +105,7 @@ func IsPublicMembership(ctx context.Context, orgID, uid int64) (bool, error) {
 // CanCreateOrgRepo returns true if user can create repo in organization
 func CanCreateOrgRepo(ctx context.Context, orgID, uid int64) (bool, error) {
 	return db.GetEngine(ctx).
-		Where(builder.Eq{"team.can_create_org_repo": true}).
+		Where(builder.Eq{"team.can_create_org_repo": true}.Or(builder.Eq{"team.authorize": perm.AccessModeOwner})).
 		Join("INNER", "team_user", "team_user.team_id = team.id").
 		And("team_user.uid = ?", uid).
 		And("team_user.org_id = ?", orgID).
diff --git a/models/organization/org_user_test.go b/models/organization/org_user_test.go
index d21df4b474c..c16def2dbbd 100644
--- a/models/organization/org_user_test.go
+++ b/models/organization/org_user_test.go
@@ -7,10 +7,10 @@ import (
 	"fmt"
 	"testing"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/organization/org_worktime.go b/models/organization/org_worktime.go
index 3ef3e512adc..f80b741c5df 100644
--- a/models/organization/org_worktime.go
+++ b/models/organization/org_worktime.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"sort"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 
 	"xorm.io/builder"
 )
diff --git a/models/organization/team.go b/models/organization/team.go
index 7f3a9b38295..fd6365e7319 100644
--- a/models/organization/team.go
+++ b/models/organization/team.go
@@ -9,12 +9,12 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/organization/team_invite.go b/models/organization/team_invite.go
index 186ae5f6e82..409ca7529bf 100644
--- a/models/organization/team_invite.go
+++ b/models/organization/team_invite.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/organization/team_invite_test.go b/models/organization/team_invite_test.go
index e9fabed1db5..200e80e4995 100644
--- a/models/organization/team_invite_test.go
+++ b/models/organization/team_invite_test.go
@@ -6,9 +6,9 @@ package organization_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/organization/team_list.go b/models/organization/team_list.go
index 5629cec3661..64b084eaaaf 100644
--- a/models/organization/team_list.go
+++ b/models/organization/team_list.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
 
 	"xorm.io/builder"
 )
@@ -85,7 +85,7 @@ func SearchTeam(ctx context.Context, opts *SearchTeamOptions) (TeamList, int64,
 	if opts.UserID > 0 {
 		sess = sess.Join("INNER", "team_user", "team_user.team_id = team.id")
 	}
-	sess = db.SetSessionPagination(sess, opts)
+	db.SetSessionPagination(sess, opts)
 
 	teams := make([]*Team, 0, opts.PageSize)
 	count, err := sess.Where(cond).OrderBy("CASE WHEN name=? THEN '' ELSE lower_name END", OwnerTeamName).FindAndCount(&teams)
diff --git a/models/organization/team_list_test.go b/models/organization/team_list_test.go
index df73f958986..553f1f1c91f 100644
--- a/models/organization/team_list_test.go
+++ b/models/organization/team_list_test.go
@@ -6,8 +6,8 @@ package organization_test
 import (
 	"testing"
 
-	org_model "code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/unittest"
+	org_model "gitea.dev/models/organization"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/organization/team_repo.go b/models/organization/team_repo.go
index 2652b34c6f7..b4974199796 100644
--- a/models/organization/team_repo.go
+++ b/models/organization/team_repo.go
@@ -6,9 +6,9 @@ package organization
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
 
 	"xorm.io/builder"
 )
diff --git a/models/organization/team_repo_test.go b/models/organization/team_repo_test.go
index af959f46585..91d5e6f569a 100644
--- a/models/organization/team_repo_test.go
+++ b/models/organization/team_repo_test.go
@@ -6,11 +6,11 @@ package organization_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/organization/team_test.go b/models/organization/team_test.go
index fea5e8990ab..aa1cc90caa3 100644
--- a/models/organization/team_test.go
+++ b/models/organization/team_test.go
@@ -6,10 +6,10 @@ package organization_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/organization/team_unit.go b/models/organization/team_unit.go
index b5237c2c587..0741d28ff1f 100644
--- a/models/organization/team_unit.go
+++ b/models/organization/team_unit.go
@@ -6,9 +6,9 @@ package organization
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
 )
 
 // TeamUnit describes all units of a repository
diff --git a/models/organization/team_user.go b/models/organization/team_user.go
index d24a4c51263..069f85c0dc3 100644
--- a/models/organization/team_user.go
+++ b/models/organization/team_user.go
@@ -6,8 +6,8 @@ package organization
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
 
 	"xorm.io/builder"
 )
diff --git a/models/packages/alpine/search.go b/models/packages/alpine/search.go
index 77eccb90ed5..c196c6eff6a 100644
--- a/models/packages/alpine/search.go
+++ b/models/packages/alpine/search.go
@@ -6,8 +6,8 @@ package alpine
 import (
 	"context"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	alpine_module "code.gitea.io/gitea/modules/packages/alpine"
+	packages_model "gitea.dev/models/packages"
+	alpine_module "gitea.dev/modules/packages/alpine"
 )
 
 // GetBranches gets all available branches
diff --git a/models/packages/arch/search.go b/models/packages/arch/search.go
index f35c037b23a..fd4e8d15638 100644
--- a/models/packages/arch/search.go
+++ b/models/packages/arch/search.go
@@ -6,8 +6,8 @@ package arch
 import (
 	"context"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	arch_module "code.gitea.io/gitea/modules/packages/arch"
+	packages_model "gitea.dev/models/packages"
+	arch_module "gitea.dev/modules/packages/arch"
 )
 
 // GetRepositories gets all available repositories
diff --git a/models/packages/conan/references.go b/models/packages/conan/references.go
index 0d888a1ec88..0a040bdb3f8 100644
--- a/models/packages/conan/references.go
+++ b/models/packages/conan/references.go
@@ -8,11 +8,11 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/packages"
-	conan_module "code.gitea.io/gitea/modules/packages/conan"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/packages"
+	conan_module "gitea.dev/modules/packages/conan"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/packages/conan/search.go b/models/packages/conan/search.go
index ab0bff59689..b40d0537b81 100644
--- a/models/packages/conan/search.go
+++ b/models/packages/conan/search.go
@@ -9,10 +9,10 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/container"
-	conan_module "code.gitea.io/gitea/modules/packages/conan"
+	"gitea.dev/models/db"
+	"gitea.dev/models/packages"
+	"gitea.dev/modules/container"
+	conan_module "gitea.dev/modules/packages/conan"
 
 	"xorm.io/builder"
 )
diff --git a/models/packages/conda/search.go b/models/packages/conda/search.go
index 887441e3b2b..5b4973fa749 100644
--- a/models/packages/conda/search.go
+++ b/models/packages/conda/search.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/packages"
-	conda_module "code.gitea.io/gitea/modules/packages/conda"
+	"gitea.dev/models/db"
+	"gitea.dev/models/packages"
+	conda_module "gitea.dev/modules/packages/conda"
 
 	"xorm.io/builder"
 )
diff --git a/models/packages/container/search.go b/models/packages/container/search.go
index 9321d9eb410..df9a2d5537b 100644
--- a/models/packages/container/search.go
+++ b/models/packages/container/search.go
@@ -8,11 +8,11 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/packages"
-	user_model "code.gitea.io/gitea/models/user"
-	container_module "code.gitea.io/gitea/modules/packages/container"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/packages"
+	user_model "gitea.dev/models/user"
+	container_module "gitea.dev/modules/packages/container"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -223,7 +223,7 @@ func SearchImageTags(ctx context.Context, opts *ImageTagsSearchOptions) ([]*pack
 	opts.configureOrderBy(sess)
 
 	if opts.Paginator != nil {
-		sess = db.SetSessionPagination(sess, opts)
+		db.SetSessionPagination(sess, opts)
 	}
 
 	pvs := make([]*packages.PackageVersion, 0, 10)
diff --git a/models/packages/cran/search.go b/models/packages/cran/search.go
index 8a8b52a35ec..0ff1c31edef 100644
--- a/models/packages/cran/search.go
+++ b/models/packages/cran/search.go
@@ -8,9 +8,9 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/packages"
-	cran_module "code.gitea.io/gitea/modules/packages/cran"
+	"gitea.dev/models/db"
+	"gitea.dev/models/packages"
+	cran_module "gitea.dev/modules/packages/cran"
 
 	"xorm.io/builder"
 )
diff --git a/models/packages/debian/search.go b/models/packages/debian/search.go
index 5333d0c6e48..165e8b8a02e 100644
--- a/models/packages/debian/search.go
+++ b/models/packages/debian/search.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/packages"
-	debian_module "code.gitea.io/gitea/modules/packages/debian"
+	"gitea.dev/models/db"
+	"gitea.dev/models/packages"
+	debian_module "gitea.dev/modules/packages/debian"
 
 	"xorm.io/builder"
 )
diff --git a/models/packages/descriptor.go b/models/packages/descriptor.go
index 2ef27051eea..b5b8634846c 100644
--- a/models/packages/descriptor.go
+++ b/models/packages/descriptor.go
@@ -9,32 +9,32 @@ import (
 	"fmt"
 	"net/url"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/packages/alpine"
-	"code.gitea.io/gitea/modules/packages/arch"
-	"code.gitea.io/gitea/modules/packages/cargo"
-	"code.gitea.io/gitea/modules/packages/chef"
-	"code.gitea.io/gitea/modules/packages/composer"
-	"code.gitea.io/gitea/modules/packages/conan"
-	"code.gitea.io/gitea/modules/packages/conda"
-	"code.gitea.io/gitea/modules/packages/container"
-	"code.gitea.io/gitea/modules/packages/cran"
-	"code.gitea.io/gitea/modules/packages/debian"
-	"code.gitea.io/gitea/modules/packages/helm"
-	"code.gitea.io/gitea/modules/packages/maven"
-	"code.gitea.io/gitea/modules/packages/npm"
-	"code.gitea.io/gitea/modules/packages/nuget"
-	"code.gitea.io/gitea/modules/packages/pub"
-	"code.gitea.io/gitea/modules/packages/pypi"
-	"code.gitea.io/gitea/modules/packages/rpm"
-	"code.gitea.io/gitea/modules/packages/rubygems"
-	"code.gitea.io/gitea/modules/packages/swift"
-	"code.gitea.io/gitea/modules/packages/vagrant"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/packages/alpine"
+	"gitea.dev/modules/packages/arch"
+	"gitea.dev/modules/packages/cargo"
+	"gitea.dev/modules/packages/chef"
+	"gitea.dev/modules/packages/composer"
+	"gitea.dev/modules/packages/conan"
+	"gitea.dev/modules/packages/conda"
+	"gitea.dev/modules/packages/container"
+	"gitea.dev/modules/packages/cran"
+	"gitea.dev/modules/packages/debian"
+	"gitea.dev/modules/packages/helm"
+	"gitea.dev/modules/packages/maven"
+	"gitea.dev/modules/packages/npm"
+	"gitea.dev/modules/packages/nuget"
+	"gitea.dev/modules/packages/pub"
+	"gitea.dev/modules/packages/pypi"
+	"gitea.dev/modules/packages/rpm"
+	"gitea.dev/modules/packages/rubygems"
+	"gitea.dev/modules/packages/swift"
+	"gitea.dev/modules/packages/vagrant"
+	"gitea.dev/modules/util"
 
 	"github.com/hashicorp/go-version"
 )
diff --git a/models/packages/nuget/search.go b/models/packages/nuget/search.go
index a4b23f31d55..1ec0cece682 100644
--- a/models/packages/nuget/search.go
+++ b/models/packages/nuget/search.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
 
 	"xorm.io/builder"
 )
diff --git a/models/packages/package.go b/models/packages/package.go
index 17e5d4eee35..c4cfcdd39c9 100644
--- a/models/packages/package.go
+++ b/models/packages/package.go
@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/packages/package_blob.go b/models/packages/package_blob.go
index e765bbf0c21..db3288a4be3 100644
--- a/models/packages/package_blob.go
+++ b/models/packages/package_blob.go
@@ -8,13 +8,13 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/packages/package_blob_test.go b/models/packages/package_blob_test.go
index 8b636b4ee00..b73328d26b2 100644
--- a/models/packages/package_blob_test.go
+++ b/models/packages/package_blob_test.go
@@ -6,7 +6,7 @@ package packages
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/packages/package_blob_upload.go b/models/packages/package_blob_upload.go
index 60a55805a8b..07afd0591b0 100644
--- a/models/packages/package_blob_upload.go
+++ b/models/packages/package_blob_upload.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
 // ErrPackageBlobUploadNotExist indicates a package blob upload not exist error
diff --git a/models/packages/package_cleanup_rule.go b/models/packages/package_cleanup_rule.go
index fa12dec4060..6aca8060511 100644
--- a/models/packages/package_cleanup_rule.go
+++ b/models/packages/package_cleanup_rule.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"regexp"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/packages/package_file.go b/models/packages/package_file.go
index 64bd08f0b21..d4e6e82d056 100644
--- a/models/packages/package_file.go
+++ b/models/packages/package_file.go
@@ -9,9 +9,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -232,7 +232,7 @@ func SearchFiles(ctx context.Context, opts *PackageFileSearchOptions) ([]*Packag
 		Where(opts.toConds())
 
 	if opts.Paginator != nil {
-		sess = db.SetSessionPagination(sess, opts)
+		db.SetSessionPagination(sess, opts)
 	}
 
 	pfs := make([]*PackageFile, 0, 10)
diff --git a/models/packages/package_property.go b/models/packages/package_property.go
index 30794ad73c3..52815a9e431 100644
--- a/models/packages/package_property.go
+++ b/models/packages/package_property.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"errors"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 
 	"xorm.io/builder"
 )
diff --git a/models/packages/package_test.go b/models/packages/package_test.go
index 9c71f2980d1..f6eb5b1184c 100644
--- a/models/packages/package_test.go
+++ b/models/packages/package_test.go
@@ -6,13 +6,13 @@ package packages_test
 import (
 	"testing"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/packages/package_version.go b/models/packages/package_version.go
index 3e0e1899ea4..77b1da43de7 100644
--- a/models/packages/package_version.go
+++ b/models/packages/package_version.go
@@ -8,13 +8,12 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
 // ErrDuplicatePackageVersion indicates a duplicated package version error
@@ -297,11 +296,11 @@ func (opts *PackageSearchOptions) configureOrderBy(e db.Engine) {
 	e.Desc("package_version.id") // Sort by id for stable order with duplicates in the other field
 }
 
-func searchVersionsBySession(sess *xorm.Session, opts *PackageSearchOptions) ([]*PackageVersion, int64, error) {
+func searchVersionsBySession(sess db.Session, opts *PackageSearchOptions) ([]*PackageVersion, int64, error) {
 	opts.configureOrderBy(sess)
 	pvs := make([]*PackageVersion, 0, 10)
 	if opts.Paginator != nil {
-		sess = db.SetSessionPagination(sess, opts.Paginator)
+		db.SetSessionPagination(sess, opts.Paginator)
 		count, err := sess.FindAndCount(&pvs)
 		return pvs, count, err
 	}
diff --git a/models/packages/rpm/search.go b/models/packages/rpm/search.go
index e697421b494..3c37443ead9 100644
--- a/models/packages/rpm/search.go
+++ b/models/packages/rpm/search.go
@@ -6,8 +6,8 @@ package rpm
 import (
 	"context"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	rpm_module "code.gitea.io/gitea/modules/packages/rpm"
+	packages_model "gitea.dev/models/packages"
+	rpm_module "gitea.dev/modules/packages/rpm"
 )
 
 // GetGroups gets all available groups
diff --git a/models/perm/access/access.go b/models/perm/access/access.go
index acc34c434ea..53d14fca1b5 100644
--- a/models/perm/access/access.go
+++ b/models/perm/access/access.go
@@ -8,13 +8,13 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
 
 	"xorm.io/builder"
 )
diff --git a/models/perm/access/access_test.go b/models/perm/access/access_test.go
index 148a02efa33..eb2c58caf5f 100644
--- a/models/perm/access/access_test.go
+++ b/models/perm/access/access_test.go
@@ -6,13 +6,13 @@ package access_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	perm_model "code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	perm_model "gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/perm/access/actions_repo_permission_test.go b/models/perm/access/actions_repo_permission_test.go
index 442f6cf2fc2..aee097cf93e 100644
--- a/models/perm/access/actions_repo_permission_test.go
+++ b/models/perm/access/actions_repo_permission_test.go
@@ -6,13 +6,13 @@ package access
 import (
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	perm_model "code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	perm_model "gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/perm/access/main_test.go b/models/perm/access/main_test.go
index 0a350dc41ea..e4804124e8a 100644
--- a/models/perm/access/main_test.go
+++ b/models/perm/access/main_test.go
@@ -6,13 +6,13 @@ package access_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
-	_ "code.gitea.io/gitea/models/repo"
-	_ "code.gitea.io/gitea/models/user"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
+	_ "gitea.dev/models/repo"
+	_ "gitea.dev/models/user"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/perm/access/repo_permission.go b/models/perm/access/repo_permission.go
index 21821f17466..6e52177f0a6 100644
--- a/models/perm/access/repo_permission.go
+++ b/models/perm/access/repo_permission.go
@@ -11,17 +11,17 @@ import (
 	"slices"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	perm_model "code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	perm_model "gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // Permission contains all the permissions related variables to a repository for a user
@@ -655,3 +655,37 @@ func CheckRepoUnitUser(ctx context.Context, repo *repo_model.Repository, user *u
 func PermissionNoAccess() Permission {
 	return Permission{AccessMode: perm_model.AccessModeNone}
 }
+
+// CanReadWorkflowCrossRepo checks whether the run can read workflow files from targetRepo.
+func CanReadWorkflowCrossRepo(ctx context.Context, targetRepo *repo_model.Repository, run *actions_model.ActionRun) (bool, error) {
+	if err := run.LoadRepo(ctx); err != nil {
+		return false, err
+	}
+
+	// (1) Same owner: always allowed (fork-PR scrubbing handled inside).
+	if checkSameOwnerCrossRepoAccess(ctx, run.Repo, targetRepo, run.IsForkPullRequest) {
+		return true, nil
+	}
+
+	// (2) Cross-owner: respect the target repo's collaborative-owner allowlist on its Actions unit.
+	// The caller (run.Repo) must itself be private. The collaborative-owner grant is owner-level, so without this
+	// guard a public caller owned by a grantee could pull a private reusable workflow and expose its definition and
+	// logs in a publicly visible run; requiring a private caller keeps private content flowing private -> private.
+	// This is intentionally stricter than GitHub, which gates on the target repo's access setting (introduced in #32562):
+	// https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#allowing-access-to-components-in-a-private-repository
+	if run.Repo.IsPrivate {
+		if actionsUnit, err := targetRepo.GetUnit(ctx, unit.TypeActions); err == nil {
+			if actionsUnit.ActionsConfig().IsCollaborativeOwner(run.Repo.OwnerID) {
+				return true, nil
+			}
+		}
+	}
+
+	// (3) Public target: the Actions user's individual permission gives read on any public repo, so `uses:` to a public reusable-workflow library is permitted by default.
+	// Matches GitHub's behavior: public reusable workflows are universally readable.
+	botPerm, err := GetIndividualUserRepoPermission(ctx, targetRepo, user_model.NewActionsUser())
+	if err != nil {
+		return false, err
+	}
+	return botPerm.AccessMode >= perm_model.AccessModeRead, nil
+}
diff --git a/models/perm/access/repo_permission_test.go b/models/perm/access/repo_permission_test.go
index 29a8dac71d4..b5c82afb297 100644
--- a/models/perm/access/repo_permission_test.go
+++ b/models/perm/access/repo_permission_test.go
@@ -6,14 +6,14 @@ package access
 import (
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	perm_model "code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	perm_model "gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/perm/access_mode.go b/models/perm/access_mode.go
index 6baeb5531a5..3be195b48d4 100644
--- a/models/perm/access_mode.go
+++ b/models/perm/access_mode.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"slices"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // AccessMode specifies the users access mode
diff --git a/models/project/column.go b/models/project/column.go
index 9c9abb4599d..06b59897f84 100644
--- a/models/project/column.go
+++ b/models/project/column.go
@@ -9,10 +9,10 @@ import (
 	"fmt"
 	"regexp"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/project/column_test.go b/models/project/column_test.go
index 6437a764ed3..ef6016a50d6 100644
--- a/models/project/column_test.go
+++ b/models/project/column_test.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/project/issue.go b/models/project/issue.go
index c89f5243054..cf1619a7738 100644
--- a/models/project/issue.go
+++ b/models/project/issue.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"errors"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/util"
 )
 
 // ProjectIssue saves relation from issue to a project
diff --git a/models/project/main_test.go b/models/project/main_test.go
index f4b2d6fedac..f52242c98af 100644
--- a/models/project/main_test.go
+++ b/models/project/main_test.go
@@ -6,9 +6,9 @@ package project
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models/repo"
+	_ "gitea.dev/models/repo"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/project/project.go b/models/project/project.go
index 7fcef430f26..546409c5d5c 100644
--- a/models/project/project.go
+++ b/models/project/project.go
@@ -8,14 +8,14 @@ import (
 	"fmt"
 	"html/template"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/project/project_test.go b/models/project/project_test.go
index 4b24615979b..b28bca92565 100644
--- a/models/project/project_test.go
+++ b/models/project/project_test.go
@@ -6,9 +6,9 @@ package project
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/pull/automerge.go b/models/pull/automerge.go
index d32dc847d2d..5415009fdea 100644
--- a/models/pull/automerge.go
+++ b/models/pull/automerge.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
 )
 
 // AutoMerge represents a pull request scheduled for merging when checks succeed
diff --git a/models/pull/review_state.go b/models/pull/review_state.go
index a0f5548dd44..241a79d1dfb 100644
--- a/models/pull/review_state.go
+++ b/models/pull/review_state.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"maps"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
 )
 
 // ViewedState stores for a file in which state it is currently viewed
diff --git a/models/renderhelper/commit_checker.go b/models/renderhelper/commit_checker.go
index 407e45fb543..faf2d94eb0a 100644
--- a/models/renderhelper/commit_checker.go
+++ b/models/renderhelper/commit_checker.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"io"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
 )
 
 type commitChecker struct {
diff --git a/models/renderhelper/main_test.go b/models/renderhelper/main_test.go
index 331450172a6..ebca1132199 100644
--- a/models/renderhelper/main_test.go
+++ b/models/renderhelper/main_test.go
@@ -5,12 +5,19 @@ package renderhelper
 
 import (
 	"context"
+	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/markup"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/markup"
 )
 
+func testRenderString(ctx *markup.RenderContext, content string) (string, error) {
+	var buf strings.Builder
+	err := markup.Render(ctx, strings.NewReader(content), &buf)
+	return buf.String(), err
+}
+
 func TestMain(m *testing.M) {
 	unittest.MainTest(m, &unittest.TestOptions{
 		FixtureFiles: []string{"repository.yml", "user.yml"},
diff --git a/models/renderhelper/repo_comment.go b/models/renderhelper/repo_comment.go
index d1c587671b7..16e130a776b 100644
--- a/models/renderhelper/repo_comment.go
+++ b/models/renderhelper/repo_comment.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"fmt"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/util"
 )
 
 type RepoComment struct {
diff --git a/models/renderhelper/repo_comment_test.go b/models/renderhelper/repo_comment_test.go
index 1443f8b3c02..03b3fcfae6d 100644
--- a/models/renderhelper/repo_comment_test.go
+++ b/models/renderhelper/repo_comment_test.go
@@ -6,10 +6,9 @@ package renderhelper
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/markup/markdown"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -21,7 +20,7 @@ func TestRepoComment(t *testing.T) {
 
 	t.Run("AutoLink", func(t *testing.T) {
 		rctx := NewRenderContextRepoComment(t.Context(), repo1).WithMarkupType(markdown.MarkupName)
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 65f1bf27bc3bf70f64657658635e66094edbcb4d
 #1
 @user2
@@ -39,7 +38,7 @@ func TestRepoComment(t *testing.T) {
 
 		// It is Gitea's old behavior, the relative path is resolved to the repo path
 		// It is different from GitHub, GitHub resolves relative links to current page's path
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 [/test](/test)
 [./test](./test)
 ![/image](/image)
@@ -59,7 +58,7 @@ func TestRepoComment(t *testing.T) {
 			WithMarkupType(markdown.MarkupName)
 
 		// the ref path is only used to render commit message: a commit message is rendered at the commit page with its commit ID path
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 [/test](/test)
 [./test](./test)
 ![/image](/image)
@@ -75,7 +74,7 @@ func TestRepoComment(t *testing.T) {
 
 	t.Run("NoRepo", func(t *testing.T) {
 		rctx := NewRenderContextRepoComment(t.Context(), nil).WithMarkupType(markdown.MarkupName)
-		rendered, err := markup.RenderString(rctx, "any")
+		rendered, err := testRenderString(rctx, "any")
 		assert.NoError(t, err)
 		assert.Equal(t, "<p>any</p>\n", rendered)
 	})
diff --git a/models/renderhelper/repo_file.go b/models/renderhelper/repo_file.go
index d9aa71b7270..0251de8da32 100644
--- a/models/renderhelper/repo_file.go
+++ b/models/renderhelper/repo_file.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"path"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/util"
 )
 
 type RepoFile struct {
diff --git a/models/renderhelper/repo_file_test.go b/models/renderhelper/repo_file_test.go
index 72d98efc66e..bb95501bec4 100644
--- a/models/renderhelper/repo_file_test.go
+++ b/models/renderhelper/repo_file_test.go
@@ -6,12 +6,11 @@ package renderhelper
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/markup/markdown"
 
-	_ "code.gitea.io/gitea/modules/markup/orgmode"
+	_ "gitea.dev/modules/markup/orgmode"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -22,7 +21,7 @@ func TestRepoFile(t *testing.T) {
 
 	t.Run("AutoLink", func(t *testing.T) {
 		rctx := NewRenderContextRepoFile(t.Context(), repo1).WithMarkupType(markdown.MarkupName)
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 65f1bf27bc3bf70f64657658635e66094edbcb4d
 #1
 @user2
@@ -38,7 +37,7 @@ func TestRepoFile(t *testing.T) {
 	t.Run("AbsoluteAndRelative", func(t *testing.T) {
 		rctx := NewRenderContextRepoFile(t.Context(), repo1, RepoFileOptions{CurrentRefSubURL: "branch/main"}).
 			WithMarkupType(markdown.MarkupName)
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 [/test](/test)
 [./test](./test)
 ![/image](/image)
@@ -56,7 +55,7 @@ func TestRepoFile(t *testing.T) {
 	t.Run("WithCurrentRefSubURL", func(t *testing.T) {
 		rctx := NewRenderContextRepoFile(t.Context(), repo1, RepoFileOptions{CurrentRefSubURL: "/commit/1234"}).
 			WithMarkupType(markdown.MarkupName)
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 [/test](/test)
 ![/image](/image)
 `)
@@ -72,7 +71,7 @@ func TestRepoFile(t *testing.T) {
 			CurrentTreePath:  "my-dir",
 		}).
 			WithMarkupType(markdown.MarkupName)
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 <img src="LINK">
 <video src="LINK">
 `)
@@ -93,7 +92,7 @@ func TestRepoFileOrgMode(t *testing.T) {
 			CurrentTreePath:  "my-dir",
 		}).WithRelativePath("my-dir/a.org")
 
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 [[https://google.com/]]
 [[ImageLink.svg][The Image Desc]]
 `)
@@ -107,7 +106,7 @@ func TestRepoFileOrgMode(t *testing.T) {
 	t.Run("CodeHighlight", func(t *testing.T) {
 		rctx := NewRenderContextRepoFile(t.Context(), repo1, RepoFileOptions{}).WithRelativePath("my-dir/a.org")
 
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 #+begin_src c
 int a = 1;
 #+end_src
diff --git a/models/renderhelper/repo_wiki.go b/models/renderhelper/repo_wiki.go
index 61e2b570e53..9ebd54cfb2e 100644
--- a/models/renderhelper/repo_wiki.go
+++ b/models/renderhelper/repo_wiki.go
@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"path"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/util"
 )
 
 type RepoWiki struct {
diff --git a/models/renderhelper/repo_wiki_test.go b/models/renderhelper/repo_wiki_test.go
index 4f6da541a5e..2061bcc8f10 100644
--- a/models/renderhelper/repo_wiki_test.go
+++ b/models/renderhelper/repo_wiki_test.go
@@ -6,10 +6,9 @@ package renderhelper
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/markup/markdown"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -20,7 +19,7 @@ func TestRepoWiki(t *testing.T) {
 
 	t.Run("AutoLink", func(t *testing.T) {
 		rctx := NewRenderContextRepoWiki(t.Context(), repo1).WithMarkupType(markdown.MarkupName)
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 65f1bf27bc3bf70f64657658635e66094edbcb4d
 #1
 @user2
@@ -35,7 +34,7 @@ func TestRepoWiki(t *testing.T) {
 
 	t.Run("AbsoluteAndRelative", func(t *testing.T) {
 		rctx := NewRenderContextRepoWiki(t.Context(), repo1).WithMarkupType(markdown.MarkupName)
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 [/test](/test)
 [./test](./test)
 ![/image](/image)
@@ -52,7 +51,7 @@ func TestRepoWiki(t *testing.T) {
 
 	t.Run("PathInTag", func(t *testing.T) {
 		rctx := NewRenderContextRepoWiki(t.Context(), repo1).WithMarkupType(markdown.MarkupName)
-		rendered, err := markup.RenderString(rctx, `
+		rendered, err := testRenderString(rctx, `
 <img src="LINK">
 <video src="LINK">
 `)
diff --git a/models/renderhelper/simple_document.go b/models/renderhelper/simple_document.go
index 9b3dacaea33..4dacc34b239 100644
--- a/models/renderhelper/simple_document.go
+++ b/models/renderhelper/simple_document.go
@@ -6,7 +6,7 @@ package renderhelper
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/markup"
+	"gitea.dev/modules/markup"
 )
 
 type SimpleDocument struct {
diff --git a/models/renderhelper/simple_document_test.go b/models/renderhelper/simple_document_test.go
index 890592860ae..b07c75a259c 100644
--- a/models/renderhelper/simple_document_test.go
+++ b/models/renderhelper/simple_document_test.go
@@ -6,9 +6,8 @@ package renderhelper
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/markup/markdown"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -16,7 +15,7 @@ import (
 func TestSimpleDocument(t *testing.T) {
 	unittest.PrepareTestEnv(t)
 	rctx := NewRenderContextSimpleDocument(t.Context(), "/base").WithMarkupType(markdown.MarkupName)
-	rendered, err := markup.RenderString(rctx, `
+	rendered, err := testRenderString(rctx, `
 65f1bf27bc3bf70f64657658635e66094edbcb4d
 #1
 @user2
diff --git a/models/repo.go b/models/repo.go
index 34e7b108033..c0f59e3bdaa 100644
--- a/models/repo.go
+++ b/models/repo.go
@@ -9,12 +9,12 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
 
 	_ "image/jpeg" // Needed for jpeg support
 
diff --git a/models/repo/archiver.go b/models/repo/archiver.go
index ca981a178c6..751fbf4b9cb 100644
--- a/models/repo/archiver.go
+++ b/models/repo/archiver.go
@@ -10,9 +10,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/repo/attachment.go b/models/repo/attachment.go
index 27856f2d2e2..b7136b657bb 100644
--- a/models/repo/attachment.go
+++ b/models/repo/attachment.go
@@ -11,12 +11,12 @@ import (
 	"os"
 	"path"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
 // Attachment represent a attachment of issue/comment/release.
diff --git a/models/repo/attachment_test.go b/models/repo/attachment_test.go
index 07f4c587a7a..a9d76318561 100644
--- a/models/repo/attachment_test.go
+++ b/models/repo/attachment_test.go
@@ -6,8 +6,8 @@ package repo_test
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/repo/avatar.go b/models/repo/avatar.go
index bfb08d9982d..3dde6a8e030 100644
--- a/models/repo/avatar.go
+++ b/models/repo/avatar.go
@@ -11,12 +11,12 @@ import (
 	"net/url"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/avatar"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/avatar"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
 )
 
 // CustomAvatarRelativePath returns repository custom avatar file path.
diff --git a/models/repo/avatar_test.go b/models/repo/avatar_test.go
index f683a13e843..9d895912d77 100644
--- a/models/repo/avatar_test.go
+++ b/models/repo/avatar_test.go
@@ -6,8 +6,8 @@ package repo
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/repo/collaboration.go b/models/repo/collaboration.go
index 272c6ac05bd..5748265f96c 100644
--- a/models/repo/collaboration.go
+++ b/models/repo/collaboration.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
 
 	"xorm.io/builder"
 )
diff --git a/models/repo/collaboration_test.go b/models/repo/collaboration_test.go
index 7e06bffb725..602cf650b4d 100644
--- a/models/repo/collaboration_test.go
+++ b/models/repo/collaboration_test.go
@@ -6,11 +6,11 @@ package repo_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/repo/fork.go b/models/repo/fork.go
index 80b3e5634e0..84f648e8704 100644
--- a/models/repo/fork.go
+++ b/models/repo/fork.go
@@ -6,8 +6,8 @@ package repo
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
 
 	"xorm.io/builder"
 )
diff --git a/models/repo/fork_test.go b/models/repo/fork_test.go
index e33b6f2f0a1..ddeeb429420 100644
--- a/models/repo/fork_test.go
+++ b/models/repo/fork_test.go
@@ -6,8 +6,8 @@ package repo_test
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/repo/git.go b/models/repo/git.go
index 388bf865223..8da93e393ee 100644
--- a/models/repo/git.go
+++ b/models/repo/git.go
@@ -6,7 +6,7 @@ package repo
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 )
 
 // MergeStyle represents the approach to merge commits into base branch.
@@ -29,6 +29,16 @@ const (
 	MergeStyleRebaseUpdate MergeStyle = "rebase-update-only"
 )
 
+// UpdateStyle is a pull request branch update style
+type UpdateStyle string
+
+const (
+	// UpdateStyleMerge merges the base branch into the pull request branch
+	UpdateStyleMerge UpdateStyle = "merge"
+	// UpdateStyleRebase rebases the pull request branch onto the base branch
+	UpdateStyleRebase UpdateStyle = "rebase"
+)
+
 // UpdateDefaultBranch updates the default branch
 func UpdateDefaultBranch(ctx context.Context, repo *Repository) error {
 	_, err := db.GetEngine(ctx).ID(repo.ID).Cols("default_branch").Update(repo)
diff --git a/models/repo/issue.go b/models/repo/issue.go
index 0dd4fd5ed48..4995971859d 100644
--- a/models/repo/issue.go
+++ b/models/repo/issue.go
@@ -6,9 +6,9 @@ package repo
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 // ___________.__             ___________                     __
diff --git a/models/repo/language_stats.go b/models/repo/language_stats.go
index 1cddd25f1df..daa2ab80e41 100644
--- a/models/repo/language_stats.go
+++ b/models/repo/language_stats.go
@@ -9,8 +9,8 @@ import (
 	"sort"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/go-enry/go-enry/v2"
 )
diff --git a/models/repo/license.go b/models/repo/license.go
index 9bcf0f7bc97..3ab721a9deb 100644
--- a/models/repo/license.go
+++ b/models/repo/license.go
@@ -6,8 +6,8 @@ package repo
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
 func init() {
diff --git a/models/repo/main_test.go b/models/repo/main_test.go
index b49855f2c86..277d42343b7 100644
--- a/models/repo/main_test.go
+++ b/models/repo/main_test.go
@@ -6,14 +6,14 @@ package repo_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models" // register table model
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
-	_ "code.gitea.io/gitea/models/perm/access" // register table model
-	_ "code.gitea.io/gitea/models/repo"        // register table model
-	_ "code.gitea.io/gitea/models/user"        // register table model
+	_ "gitea.dev/models" // register table model
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
+	_ "gitea.dev/models/perm/access" // register table model
+	_ "gitea.dev/models/repo"        // register table model
+	_ "gitea.dev/models/user"        // register table model
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/repo/mirror.go b/models/repo/mirror.go
index be7b7856127..8bfff01a025 100644
--- a/models/repo/mirror.go
+++ b/models/repo/mirror.go
@@ -8,10 +8,10 @@ import (
 	"context"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
 // ErrMirrorNotExist mirror does not exist error
@@ -27,6 +27,7 @@ type Mirror struct {
 
 	UpdatedUnix    timeutil.TimeStamp `xorm:"INDEX"`
 	NextUpdateUnix timeutil.TimeStamp `xorm:"INDEX"`
+	LastSyncUnix   timeutil.TimeStamp `xorm:"INDEX"`
 
 	LFS         bool   `xorm:"lfs_enabled NOT NULL DEFAULT false"`
 	LFSEndpoint string `xorm:"lfs_endpoint TEXT"`
diff --git a/models/repo/org_repo.go b/models/repo/org_repo.go
index d8c2c91fec5..ef4d9a4a622 100644
--- a/models/repo/org_repo.go
+++ b/models/repo/org_repo.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	org_model "code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	org_model "gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
 
 	"xorm.io/builder"
 )
diff --git a/models/repo/pull_request_default.go b/models/repo/pull_request_default.go
index 89f8eb6a2c3..ba5d5f7535f 100644
--- a/models/repo/pull_request_default.go
+++ b/models/repo/pull_request_default.go
@@ -6,8 +6,8 @@ package repo
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/util"
 )
 
 func (repo *Repository) GetPullRequestTargetBranch(ctx context.Context) string {
diff --git a/models/repo/pull_request_default_test.go b/models/repo/pull_request_default_test.go
index b1653f2f1ae..40be8d6573a 100644
--- a/models/repo/pull_request_default_test.go
+++ b/models/repo/pull_request_default_test.go
@@ -6,8 +6,9 @@ package repo
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -30,3 +31,82 @@ func TestDefaultTargetBranchSelection(t *testing.T) {
 	repo.Units = nil
 	assert.Equal(t, "branch2", repo.GetPullRequestTargetBranch(ctx))
 }
+
+func TestPullRequestConfigFromDB(t *testing.T) {
+	cases := []struct {
+		// name describes the row shape under test; the comments capture why each row matters.
+		name              string
+		json              string
+		wantMergeUpdate   bool
+		wantRebaseUpdate  bool
+		wantDefaultStyle  UpdateStyle
+		wantValidatesPass bool
+	}{
+		{
+			// Empty object exercises the all-defaults path (e.g. fresh repos created via low-level paths).
+			name: "defaults", json: "{}",
+			wantMergeUpdate: true, wantRebaseUpdate: true,
+			wantDefaultStyle: UpdateStyleMerge, wantValidatesPass: true,
+		},
+		{
+			// Realistic upgrade case: pre-PR JSON lacks the new fields and has AllowRebaseUpdate=false.
+			// Historical setting must be preserved while new fields take safe defaults.
+			name:            "legacy without new fields",
+			json:            `{"AllowMerge":true,"AllowRebase":true,"AllowRebaseMerge":true,"AllowSquash":true,"AllowRebaseUpdate":false}`,
+			wantMergeUpdate: true, wantRebaseUpdate: false,
+			wantDefaultStyle: UpdateStyleMerge, wantValidatesPass: true,
+		},
+		{
+			// Partially-migrated row with explicit empty string must normalize so ValidateUpdateSettings passes.
+			name: "empty default style", json: `{"DefaultUpdateStyle":""}`,
+			wantMergeUpdate: true, wantRebaseUpdate: true,
+			wantDefaultStyle: UpdateStyleMerge, wantValidatesPass: true,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := new(PullRequestsConfig)
+			assert.NoError(t, cfg.FromDB([]byte(tc.json)))
+			assert.Equal(t, tc.wantMergeUpdate, cfg.AllowMergeUpdate)
+			assert.Equal(t, tc.wantRebaseUpdate, cfg.AllowRebaseUpdate)
+			assert.Equal(t, tc.wantDefaultStyle, cfg.DefaultUpdateStyle)
+			if tc.wantValidatesPass {
+				assert.NoError(t, cfg.ValidateUpdateSettings())
+			}
+		})
+	}
+}
+
+func TestPullRequestConfigValidateUpdateSettingsInvalidArgument(t *testing.T) {
+	cases := []struct {
+		name string
+		cfg  PullRequestsConfig
+	}{
+		{
+			name: "invalid default style",
+			cfg: PullRequestsConfig{
+				AllowMergeUpdate:   true,
+				AllowRebaseUpdate:  true,
+				DefaultUpdateStyle: "invalid",
+			},
+		},
+		{
+			name: "no update style enabled",
+			cfg: PullRequestsConfig{
+				DefaultUpdateStyle: UpdateStyleMerge,
+			},
+		},
+		{
+			name: "default update style disabled",
+			cfg: PullRequestsConfig{
+				AllowRebaseUpdate:  true,
+				DefaultUpdateStyle: UpdateStyleMerge,
+			},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.ErrorIs(t, tc.cfg.ValidateUpdateSettings(), util.ErrInvalidArgument)
+		})
+	}
+}
diff --git a/models/repo/pushmirror.go b/models/repo/pushmirror.go
index 55e8f3a068f..fc2b1b9e1aa 100644
--- a/models/repo/pushmirror.go
+++ b/models/repo/pushmirror.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/repo/pushmirror_test.go b/models/repo/pushmirror_test.go
index 777cc5982f6..f4e25e67e52 100644
--- a/models/repo/pushmirror_test.go
+++ b/models/repo/pushmirror_test.go
@@ -7,10 +7,10 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/repo/redirect.go b/models/repo/redirect.go
index 61789ebefac..405feb57822 100644
--- a/models/repo/redirect.go
+++ b/models/repo/redirect.go
@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/util"
 )
 
 // ErrRedirectNotExist represents a "RedirectNotExist" kind of error.
diff --git a/models/repo/redirect_test.go b/models/repo/redirect_test.go
index aa5e5b7c6bc..bceaf869216 100644
--- a/models/repo/redirect_test.go
+++ b/models/repo/redirect_test.go
@@ -6,8 +6,8 @@ package repo_test
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/repo/release.go b/models/repo/release.go
index e2010c8a38d..2c3ee187576 100644
--- a/models/repo/release.go
+++ b/models/repo/release.go
@@ -13,13 +13,13 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/repo/release_test.go b/models/repo/release_test.go
index 2a09ffb36de..932775ae94d 100644
--- a/models/repo/release_test.go
+++ b/models/repo/release_test.go
@@ -6,9 +6,9 @@ package repo
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/repo/repo.go b/models/repo/repo.go
index 7814bb4876d..7f8507722f0 100644
--- a/models/repo/repo.go
+++ b/models/repo/repo.go
@@ -17,20 +17,20 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/git"
-	giturl "code.gitea.io/gitea/modules/git/url"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/git"
+	giturl "gitea.dev/modules/git/url"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/repo/repo_indexer.go b/models/repo/repo_indexer.go
index 6e19d8f937f..2f8ca777cf5 100644
--- a/models/repo/repo_indexer.go
+++ b/models/repo/repo_indexer.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 
 	"xorm.io/builder"
 )
diff --git a/models/repo/repo_list.go b/models/repo/repo_list.go
index e927174a55f..d0e5dd8f60f 100644
--- a/models/repo/repo_list.go
+++ b/models/repo/repo_list.go
@@ -8,15 +8,15 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -212,6 +212,13 @@ type SearchRepoOptions struct {
 	OnlyShowRelevant bool
 }
 
+func (opts *SearchRepoOptions) ApplyPublicOnly(publicOnly bool) {
+	if publicOnly {
+		opts.Private = false
+		opts.AllLimited = false
+	}
+}
+
 // UserOwnedRepoCond returns user ownered repositories
 func UserOwnedRepoCond(userID int64) builder.Cond {
 	return builder.Eq{
diff --git a/models/repo/repo_list_test.go b/models/repo/repo_list_test.go
index 943e0c50250..78ede841504 100644
--- a/models/repo/repo_list_test.go
+++ b/models/repo/repo_list_test.go
@@ -7,14 +7,14 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/repo/repo_test.go b/models/repo/repo_test.go
index ce17789a3ba..f23e4c64681 100644
--- a/models/repo/repo_test.go
+++ b/models/repo/repo_test.go
@@ -6,13 +6,13 @@ package repo
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/repo/repo_unit.go b/models/repo/repo_unit.go
index c32adbbcd43..5de5b6e4f32 100644
--- a/models/repo/repo_unit.go
+++ b/models/repo/repo_unit.go
@@ -6,13 +6,13 @@ package repo
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/xorm"
 	"xorm.io/xorm/convert"
@@ -125,7 +125,9 @@ type PullRequestsConfig struct {
 	AllowFastForwardOnly          bool
 	AllowManualMerge              bool
 	AutodetectManualMerge         bool
+	AllowMergeUpdate              bool
 	AllowRebaseUpdate             bool
+	DefaultUpdateStyle            UpdateStyle
 	DefaultDeleteBranchAfterMerge bool
 	DefaultMergeStyle             MergeStyle
 	DefaultAllowMaintainerEdit    bool
@@ -139,7 +141,9 @@ func DefaultPullRequestsConfig() *PullRequestsConfig {
 		AllowRebaseMerge:           true,
 		AllowSquash:                true,
 		AllowFastForwardOnly:       true,
+		AllowMergeUpdate:           true,
 		AllowRebaseUpdate:          true,
+		DefaultUpdateStyle:         UpdateStyleMerge,
 		DefaultAllowMaintainerEdit: true,
 	}
 	cfg.DefaultDeleteBranchAfterMerge = setting.Repository.PullRequest.DefaultDeleteBranchAfterMerge
@@ -152,7 +156,9 @@ func DefaultPullRequestsConfig() *PullRequestsConfig {
 func (cfg *PullRequestsConfig) FromDB(bs []byte) error {
 	// set default values for existing PullRequestConfig in DB
 	*cfg = *DefaultPullRequestsConfig()
-	return json.UnmarshalHandleDoubleEncode(bs, &cfg)
+	_ = json.UnmarshalHandleDoubleEncode(bs, &cfg) // don't let corrupted database value cause unnecessary 500 error
+	cfg.DefaultUpdateStyle = util.IfZero(cfg.DefaultUpdateStyle, UpdateStyleMerge)
+	return nil
 }
 
 // ToDB exports a PullRequestsConfig to a serialized format.
@@ -170,6 +176,32 @@ func (cfg *PullRequestsConfig) IsMergeStyleAllowed(mergeStyle MergeStyle) bool {
 		mergeStyle == MergeStyleManuallyMerged && cfg.AllowManualMerge
 }
 
+// IsUpdateStyleAllowed returns if a pull request branch update style is allowed
+func (cfg *PullRequestsConfig) IsUpdateStyleAllowed(updateStyle UpdateStyle) bool {
+	switch updateStyle {
+	case UpdateStyleMerge:
+		return cfg.AllowMergeUpdate
+	case UpdateStyleRebase:
+		return cfg.AllowRebaseUpdate
+	default:
+		return false
+	}
+}
+
+// ValidateUpdateSettings checks that the AllowMerge/RebaseUpdate flags and DefaultUpdateStyle are mutually consistent.
+func (cfg *PullRequestsConfig) ValidateUpdateSettings() error {
+	if cfg.DefaultUpdateStyle != UpdateStyleMerge && cfg.DefaultUpdateStyle != UpdateStyleRebase {
+		return util.NewInvalidArgumentErrorf("default update style must be merge or rebase")
+	}
+	if !cfg.AllowMergeUpdate && !cfg.AllowRebaseUpdate {
+		return util.NewInvalidArgumentErrorf("at least one pull request branch update style must be enabled")
+	}
+	if !cfg.IsUpdateStyleAllowed(cfg.DefaultUpdateStyle) {
+		return util.NewInvalidArgumentErrorf("default update style must be enabled")
+	}
+	return nil
+}
+
 func DefaultPullRequestsUnit(repoID int64) RepoUnit {
 	return RepoUnit{RepoID: repoID, Type: unit.TypePullRequests, Config: DefaultPullRequestsConfig()}
 }
diff --git a/models/repo/repo_unit_actions.go b/models/repo/repo_unit_actions.go
index 50e2925792a..da162027b4c 100644
--- a/models/repo/repo_unit_actions.go
+++ b/models/repo/repo_unit_actions.go
@@ -6,10 +6,10 @@ package repo
 import (
 	"slices"
 
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
 )
 
 // ActionsTokenPermissionMode defines the default permission mode for Actions tokens
diff --git a/models/repo/repo_unit_test.go b/models/repo/repo_unit_test.go
index 08f9ac2cd4e..d0a6caaf1a4 100644
--- a/models/repo/repo_unit_test.go
+++ b/models/repo/repo_unit_test.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/repo/search.go b/models/repo/search.go
index ffb8e26745a..e91241e8497 100644
--- a/models/repo/search.go
+++ b/models/repo/search.go
@@ -3,7 +3,7 @@
 
 package repo
 
-import "code.gitea.io/gitea/models/db"
+import "gitea.dev/models/db"
 
 // OrderByMap represents all possible search order
 var OrderByMap = map[string]map[string]db.SearchOrderBy{
diff --git a/models/repo/star.go b/models/repo/star.go
index e1672623c82..c3f1203fecf 100644
--- a/models/repo/star.go
+++ b/models/repo/star.go
@@ -6,9 +6,9 @@ package repo
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/timeutil"
 )
 
 // Star represents a starred repo by a user.
@@ -77,7 +77,7 @@ func GetStargazers(ctx context.Context, repo *Repository, opts db.ListOptions) (
 	sess := db.GetEngine(ctx).Where("star.repo_id = ?", repo.ID).
 		Join("LEFT", "star", "`user`.id = star.uid")
 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)
 
 		users := make([]*user_model.User, 0, opts.PageSize)
 		return users, sess.Find(&users)
diff --git a/models/repo/star_test.go b/models/repo/star_test.go
index 4fd256cd088..d81c3a1685b 100644
--- a/models/repo/star_test.go
+++ b/models/repo/star_test.go
@@ -6,10 +6,10 @@ package repo_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/repo/topic.go b/models/repo/topic.go
index 14017da2d0b..8656d334187 100644
--- a/models/repo/topic.go
+++ b/models/repo/topic.go
@@ -9,10 +9,10 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/repo/topic_test.go b/models/repo/topic_test.go
index 903b9ad3fac..09b75e5c609 100644
--- a/models/repo/topic_test.go
+++ b/models/repo/topic_test.go
@@ -6,9 +6,9 @@ package repo_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/repo/transfer.go b/models/repo/transfer.go
index 3fb8cb69abd..90916e0ddb6 100644
--- a/models/repo/transfer.go
+++ b/models/repo/transfer.go
@@ -8,12 +8,12 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/repo/update.go b/models/repo/update.go
index bf560cf6950..5f5e8eb7e56 100644
--- a/models/repo/update.go
+++ b/models/repo/update.go
@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/util"
 )
 
 // UpdateRepositoryOwnerNames updates repository owner_names (this should only be used when the ownerName has changed case)
diff --git a/models/repo/upload.go b/models/repo/upload.go
index b9bda8fdbf5..d850d34bf1d 100644
--- a/models/repo/upload.go
+++ b/models/repo/upload.go
@@ -12,10 +12,10 @@ import (
 	"os"
 	"path/filepath"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	gouuid "github.com/google/uuid"
 )
diff --git a/models/repo/user_repo.go b/models/repo/user_repo.go
index 28ae83a095e..94425c0a1d8 100644
--- a/models/repo/user_repo.go
+++ b/models/repo/user_repo.go
@@ -7,12 +7,12 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
 
 	"xorm.io/builder"
 )
@@ -24,6 +24,12 @@ type StarredReposOptions struct {
 	IncludePrivate bool
 }
 
+func (opts *StarredReposOptions) ApplyPublicOnly(publicOnly bool) {
+	if publicOnly {
+		opts.IncludePrivate = false
+	}
+}
+
 func (opts *StarredReposOptions) ToConds() builder.Cond {
 	var cond builder.Cond = builder.Eq{
 		"star.uid": opts.StarrerID,
@@ -62,6 +68,12 @@ type WatchedReposOptions struct {
 	IncludePrivate bool
 }
 
+func (opts *WatchedReposOptions) ApplyPublicOnly(publicOnly bool) {
+	if publicOnly {
+		opts.IncludePrivate = false
+	}
+}
+
 func (opts *WatchedReposOptions) ToConds() builder.Cond {
 	var cond builder.Cond = builder.Eq{
 		"watch.user_id": opts.WatcherID,
diff --git a/models/repo/user_repo_test.go b/models/repo/user_repo_test.go
index cd45db61d08..d21c77aa0aa 100644
--- a/models/repo/user_repo_test.go
+++ b/models/repo/user_repo_test.go
@@ -6,14 +6,14 @@ package repo_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	perm_model "code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	perm_model "gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/repo/watch.go b/models/repo/watch.go
index 1e63d5c3d2c..3d349dde3ec 100644
--- a/models/repo/watch.go
+++ b/models/repo/watch.go
@@ -6,10 +6,10 @@ package repo
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 )
 
 // WatchMode specifies what kind of watch the user has on a repository
@@ -152,7 +152,7 @@ func GetRepoWatchers(ctx context.Context, repoID int64, opts db.ListOptions) ([]
 		Join("LEFT", "watch", "`user`.id=`watch`.user_id").
 		And("`watch`.mode<>?", WatchModeDont)
 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, &opts)
+		db.SetSessionPagination(sess, &opts)
 		users := make([]*user_model.User, 0, opts.PageSize)
 
 		return users, sess.Find(&users)
diff --git a/models/repo/watch_test.go b/models/repo/watch_test.go
index 97576fb787b..a0603e38d84 100644
--- a/models/repo/watch_test.go
+++ b/models/repo/watch_test.go
@@ -6,11 +6,11 @@ package repo_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/repo/wiki.go b/models/repo/wiki.go
index 47c8fa43abc..cbc1229c9f3 100644
--- a/models/repo/wiki.go
+++ b/models/repo/wiki.go
@@ -9,8 +9,8 @@ import (
 	"fmt"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
 )
 
 // ErrWikiAlreadyExist represents a "WikiAlreadyExist" kind of error.
diff --git a/models/repo/wiki_test.go b/models/repo/wiki_test.go
index 636c78009b5..62a881f6f84 100644
--- a/models/repo/wiki_test.go
+++ b/models/repo/wiki_test.go
@@ -6,8 +6,8 @@ package repo_test
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/repo_test.go b/models/repo_test.go
index 5273b9d8384..059ceab709e 100644
--- a/models/repo_test.go
+++ b/models/repo_test.go
@@ -6,8 +6,8 @@ package models
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/secret/main_test.go b/models/secret/main_test.go
new file mode 100644
index 00000000000..bd74c3f5c99
--- /dev/null
+++ b/models/secret/main_test.go
@@ -0,0 +1,14 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package secret
+
+import (
+	"testing"
+
+	"gitea.dev/models/unittest"
+)
+
+func TestMain(m *testing.M) {
+	unittest.MainTest(m)
+}
diff --git a/models/secret/secret.go b/models/secret/secret.go
index a82a924c393..8d4cfd3e646 100644
--- a/models/secret/secret.go
+++ b/models/secret/secret.go
@@ -8,14 +8,16 @@ import (
 	"fmt"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	actions_module "code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/log"
-	secret_module "code.gitea.io/gitea/modules/secret"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	actions_module "gitea.dev/modules/actions"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	secret_module "gitea.dev/modules/secret"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -152,16 +154,16 @@ func UpdateSecret(ctx context.Context, secretID int64, data, description string)
 }
 
 func GetSecretsOfTask(ctx context.Context, task *actions_model.ActionTask) (map[string]string, error) {
-	secrets := map[string]string{}
+	baseSecrets := map[string]string{}
 
-	secrets["GITHUB_TOKEN"] = task.Token
-	secrets["GITEA_TOKEN"] = task.Token
+	baseSecrets["GITHUB_TOKEN"] = task.Token
+	baseSecrets["GITEA_TOKEN"] = task.Token
 
 	if task.Job.Run.IsForkPullRequest && task.Job.Run.TriggerEvent != actions_module.GithubEventPullRequestTarget {
 		// ignore secrets for fork pull request, except GITHUB_TOKEN and GITEA_TOKEN which are automatically generated.
 		// for the tasks triggered by pull_request_target event, they could access the secrets because they will run in the context of the base branch
 		// see the documentation: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
-		return secrets, nil
+		return baseSecrets, nil
 	}
 
 	ownerSecrets, err := db.Find[Secret](ctx, FindSecretsOptions{OwnerID: task.Job.Run.Repo.OwnerID})
@@ -181,10 +183,60 @@ func GetSecretsOfTask(ctx context.Context, task *actions_model.ActionTask) (map[
 			log.Error("Unable to decrypt Actions secret %v %q, maybe SECRET_KEY is wrong: %v", secret.ID, secret.Name, err)
 			continue
 		}
-		secrets[secret.Name] = v
+		baseSecrets[secret.Name] = v
 	}
 
-	return secrets, nil
+	return getScopedSecretsForJob(ctx, task.Job, baseSecrets)
+}
+
+// getScopedSecretsForJob walks up the caller chain (ParentJobID) and applies
+// each caller's secrets policy:
+//   - "secrets: inherit" passes the parent scope's secrets through unchanged.
+//   - explicit mapping {alias: SOURCE} only forwards the named secrets, plus the auto-generated tokens.
+//
+// For top-level jobs (ParentJobID == 0) the base secrets are returned as-is.
+func getScopedSecretsForJob(ctx context.Context, job *actions_model.ActionRunJob, baseSecrets map[string]string) (map[string]string, error) {
+	if job.ParentJobID == 0 {
+		return baseSecrets, nil
+	}
+
+	caller, err := actions_model.GetRunJobByRunAndID(ctx, job.RunID, job.ParentJobID)
+	if err != nil {
+		return nil, fmt.Errorf("load caller job %d: %w", job.ParentJobID, err)
+	}
+
+	parentScope, err := getScopedSecretsForJob(ctx, caller, baseSecrets)
+	if err != nil {
+		return nil, err
+	}
+
+	if caller.CallSecrets == jobparser.SecretsInherit {
+		return parentScope, nil
+	}
+
+	// Empty or explicit-mapping path: only auto-tokens + (any) mapped aliases are exposed.
+	scoped := map[string]string{
+		"GITHUB_TOKEN": baseSecrets["GITHUB_TOKEN"],
+		"GITEA_TOKEN":  baseSecrets["GITEA_TOKEN"],
+	}
+	if caller.CallSecrets == "" {
+		return scoped, nil
+	}
+	var mapping map[string]string
+	if err := json.Unmarshal([]byte(caller.CallSecrets), &mapping); err != nil {
+		return nil, fmt.Errorf("decode caller %d secret map: %w", caller.ID, err)
+	}
+	for alias, source := range mapping {
+		if v, ok := parentScope[source]; ok {
+			scoped[alias] = v
+			continue
+		}
+		// Secret names are case-insensitive in storage (uppercased).
+		if v, ok := parentScope[strings.ToUpper(source)]; ok {
+			scoped[alias] = v
+		}
+	}
+	return scoped, nil
 }
 
 func CountWrongRepoLevelSecrets(ctx context.Context) (int64, error) {
diff --git a/models/secret/secret_test.go b/models/secret/secret_test.go
new file mode 100644
index 00000000000..11dd0f750cd
--- /dev/null
+++ b/models/secret/secret_test.go
@@ -0,0 +1,174 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package secret
+
+import (
+	"testing"
+
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetScopedSecretsForJob(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	base := map[string]string{
+		"GITHUB_TOKEN": "tok",
+		"GITEA_TOKEN":  "tok",
+		"PROD_API_KEY": "prod-secret",
+		"DEV_API_KEY":  "dev-secret",
+	}
+
+	// insertCaller create an ActionRunJob caller row with the given CallSecrets policy
+	insertCaller := func(t *testing.T, runID, parentJobID int64, callSecrets string) *actions_model.ActionRunJob {
+		t.Helper()
+		job := &actions_model.ActionRunJob{
+			RunID:            runID,
+			RepoID:           1,
+			IsReusableCaller: true,
+			ParentJobID:      parentJobID,
+			CallSecrets:      callSecrets,
+			Status:           actions_model.StatusBlocked,
+		}
+		require.NoError(t, db.Insert(t.Context(), job))
+		return job
+	}
+
+	t.Run("TopLevelJob_ReturnsBaseUnchanged", func(t *testing.T) {
+		const runID = 9001
+		leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: 0}
+
+		got, err := getScopedSecretsForJob(ctx, leaf, base)
+		require.NoError(t, err)
+		assert.Equal(t, base, got, "top-level jobs should see the full base scope")
+	})
+
+	t.Run("CallerInherit_PassesParentScopeThrough", func(t *testing.T) {
+		const runID = 9002
+		caller := insertCaller(t, runID, 0, "inherit")
+		leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: caller.ID}
+
+		got, err := getScopedSecretsForJob(ctx, leaf, base)
+		require.NoError(t, err)
+		assert.Equal(t, base, got, "secrets: inherit forwards everything from parent scope")
+	})
+
+	t.Run("CallerEmptySecrets_ExposesOnlyAutoTokens", func(t *testing.T) {
+		const runID = 9003
+		caller := insertCaller(t, runID, 0, "")
+		leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: caller.ID}
+
+		got, err := getScopedSecretsForJob(ctx, leaf, base)
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{
+			"GITHUB_TOKEN": "tok",
+			"GITEA_TOKEN":  "tok",
+		}, got)
+	})
+
+	t.Run("CallerMapping_OnlyMappedAliasesPlusTokens", func(t *testing.T) {
+		const runID = 9004
+		// {alias: source} - the called workflow sees `secrets.MY_KEY` resolved to PROD_API_KEY's value.
+		caller := insertCaller(t, runID, 0, `{"MY_KEY":"PROD_API_KEY"}`)
+		leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: caller.ID}
+
+		got, err := getScopedSecretsForJob(ctx, leaf, base)
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{
+			"GITHUB_TOKEN": "tok",
+			"GITEA_TOKEN":  "tok",
+			"MY_KEY":       "prod-secret",
+			// no "dev-secret"
+		}, got)
+	})
+
+	t.Run("CallerMapping_CaseInsensitiveSource", func(t *testing.T) {
+		const runID = 9005
+		caller := insertCaller(t, runID, 0, `{"alias":"prod_api_key"}`)
+		leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: caller.ID}
+
+		got, err := getScopedSecretsForJob(ctx, leaf, base)
+		require.NoError(t, err)
+		assert.Equal(t, "prod-secret", got["alias"])
+	})
+
+	t.Run("CallerMapping_UnknownSourceDropsAlias", func(t *testing.T) {
+		const runID = 9006
+		// alias points at a non-existent secret name, so it must be dropped.
+		caller := insertCaller(t, runID, 0, `{"MAPPED_ALIAS":"DOES_NOT_EXIST"}`)
+		leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: caller.ID}
+
+		got, err := getScopedSecretsForJob(ctx, leaf, base)
+		require.NoError(t, err)
+		_, present := got["MAPPED_ALIAS"]
+		assert.False(t, present)
+	})
+
+	t.Run("Nested_InheritThenInherit_FullScope", func(t *testing.T) {
+		const runID = 9007
+		outer := insertCaller(t, runID, 0, "inherit")
+		inner := insertCaller(t, runID, outer.ID, "inherit")
+		leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: inner.ID}
+
+		got, err := getScopedSecretsForJob(ctx, leaf, base)
+		require.NoError(t, err)
+		assert.Equal(t, base, got, "inherit-then-inherit should pass the full base scope through")
+	})
+
+	t.Run("Nested_InheritThenMapping_InnerNarrows", func(t *testing.T) {
+		const runID = 9008
+		// inner mapping narrows the full scope it inherited from outer.
+		outer := insertCaller(t, runID, 0, "inherit")
+		inner := insertCaller(t, runID, outer.ID, `{"ALIAS_OUT":"PROD_API_KEY"}`)
+		leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: inner.ID}
+
+		got, err := getScopedSecretsForJob(ctx, leaf, base)
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{
+			"GITHUB_TOKEN": "tok",
+			"GITEA_TOKEN":  "tok",
+			"ALIAS_OUT":    "prod-secret",
+			// no "dev-secret"
+		}, got)
+	})
+
+	t.Run("Nested_MappingThenInherit_OuterNarrows", func(t *testing.T) {
+		const runID = 9009
+		// inner inherits outer's already-narrowed scope, so leaf sees only auto-tokens + OUTER_ALIAS.
+		outer := insertCaller(t, runID, 0, `{"OUTER_ALIAS":"PROD_API_KEY"}`)
+		inner := insertCaller(t, runID, outer.ID, "inherit")
+		leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: inner.ID}
+
+		got, err := getScopedSecretsForJob(ctx, leaf, base)
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{
+			"GITHUB_TOKEN": "tok",
+			"GITEA_TOKEN":  "tok",
+			"OUTER_ALIAS":  "prod-secret",
+			// no "dev-secret"
+		}, got)
+	})
+
+	t.Run("Nested_MappingThenMapping_InnerSourceMustExistInOuterScope", func(t *testing.T) {
+		const runID = 9010
+		// inner can rename ALIAS_A (in outer's scope) to ALIAS_C, but cannot forward DEV_API_KEY, which outer dropped.
+		outer := insertCaller(t, runID, 0, `{"ALIAS_A":"PROD_API_KEY"}`)
+		inner := insertCaller(t, runID, outer.ID, `{"ALIAS_B":"DEV_API_KEY","ALIAS_C":"ALIAS_A"}`)
+		leaf := &actions_model.ActionRunJob{RunID: runID, ParentJobID: inner.ID}
+
+		got, err := getScopedSecretsForJob(ctx, leaf, base)
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{
+			"GITHUB_TOKEN": "tok",
+			"GITEA_TOKEN":  "tok",
+			"ALIAS_C":      "prod-secret",
+			// no "dev-secret"
+		}, got)
+	})
+}
diff --git a/models/shared/types/ownertype.go b/models/shared/types/ownertype.go
index a1d46c986f9..98a59c7008f 100644
--- a/models/shared/types/ownertype.go
+++ b/models/shared/types/ownertype.go
@@ -3,7 +3,7 @@
 
 package types
 
-import "code.gitea.io/gitea/modules/translation"
+import "gitea.dev/modules/translation"
 
 type OwnerType string
 
diff --git a/models/system/appstate.go b/models/system/appstate.go
index 01faa1a5bef..34a136e3bdf 100644
--- a/models/system/appstate.go
+++ b/models/system/appstate.go
@@ -6,7 +6,7 @@ package system
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 )
 
 // AppState represents a state record in database
diff --git a/models/system/main_test.go b/models/system/main_test.go
index 6bc27a7cff8..f52b1e9f045 100644
--- a/models/system/main_test.go
+++ b/models/system/main_test.go
@@ -6,12 +6,12 @@ package system_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models" // register models
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
-	_ "code.gitea.io/gitea/models/system" // register models of system
+	_ "gitea.dev/models" // register models
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
+	_ "gitea.dev/models/system" // register models of system
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/system/notice.go b/models/system/notice.go
index 4b919dffc92..6225dcf40c3 100644
--- a/models/system/notice.go
+++ b/models/system/notice.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/timeutil"
 )
 
 // NoticeType describes the notice type
diff --git a/models/system/notice_test.go b/models/system/notice_test.go
index 802bcf41b1d..3d0a70a8c71 100644
--- a/models/system/notice_test.go
+++ b/models/system/notice_test.go
@@ -6,9 +6,9 @@ package system_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	"gitea.dev/models/system"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/system/setting.go b/models/system/setting.go
index 4472b4c2286..5c3d5a03240 100644
--- a/models/system/setting.go
+++ b/models/system/setting.go
@@ -9,10 +9,10 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting/config"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting/config"
+	"gitea.dev/modules/timeutil"
 
 	"xorm.io/builder"
 )
diff --git a/models/system/setting_test.go b/models/system/setting_test.go
index 780a323fe14..c319e2b54dd 100644
--- a/models/system/setting_test.go
+++ b/models/system/setting_test.go
@@ -6,9 +6,9 @@ package system_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	"gitea.dev/models/system"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/unit/unit.go b/models/unit/unit.go
index c0560678ca9..9e34fe354ea 100644
--- a/models/unit/unit.go
+++ b/models/unit/unit.go
@@ -10,10 +10,10 @@ import (
 	"strings"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/perm"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 // Type is Unit's Type
diff --git a/models/unit/unit_test.go b/models/unit/unit_test.go
index 7bf63261455..3964d0b74e6 100644
--- a/models/unit/unit_test.go
+++ b/models/unit/unit_test.go
@@ -6,7 +6,7 @@ package unit
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/unittest/consistency.go b/models/unittest/consistency.go
index 8447bd93ba7..b689a7d2f6f 100644
--- a/models/unittest/consistency.go
+++ b/models/unittest/consistency.go
@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/unittest/fixtures.go b/models/unittest/fixtures.go
index a9a01a32275..19882de96e6 100644
--- a/models/unittest/fixtures.go
+++ b/models/unittest/fixtures.go
@@ -4,19 +4,24 @@
 package unittest
 
 import (
+	"context"
 	"fmt"
+	"strings"
+	"unicode"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/auth/password/hash"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/auth/password/hash"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"xorm.io/xorm"
+	"xorm.io/xorm/contexts"
 	"xorm.io/xorm/schemas"
 )
 
 type FixturesLoader interface {
 	Load() error
+	MarkTableChanged(tableName string)
 }
 
 var fixturesLoader FixturesLoader
@@ -57,15 +62,101 @@ func loadFixtureResetSeqPgsql(e *xorm.Engine) error {
 	return nil
 }
 
+type fixturesHookStruct struct{}
+
+func cutSpaceForSQL(s string) (string, string, bool) {
+	s = strings.TrimSpace(s)
+	pos := strings.IndexFunc(s, unicode.IsSpace)
+	if pos == -1 {
+		return s, "", false
+	}
+	return s[:pos], strings.TrimSpace(s[pos+1:]), true
+}
+
+func trimTableNameQuotes(s string) string {
+	pos := strings.IndexByte(s, '.')
+	if pos != -1 {
+		s = s[pos+1:]
+	}
+	return strings.Trim(s, "\"`[]")
+}
+
+func (f fixturesHookStruct) BeforeProcess(c *contexts.ContextHook) (context.Context, error) {
+	if c.Ctx.Value(db.ContextKeyTestFixtures) != nil {
+		return c.Ctx, nil
+	}
+	ctx, sql := c.Ctx, c.SQL
+	cmdPart, cmdRemaining, ok := cutSpaceForSQL(sql)
+	if !ok {
+		return ctx, nil
+	}
+
+	// ignore the SQLs which don't change data
+	if util.AsciiEqualFold(cmdPart, "SELECT") ||
+		util.AsciiEqualFold(cmdPart, "SHOW") ||
+		util.AsciiEqualFold(cmdPart, "PRAGMA") ||
+		util.AsciiEqualFold(cmdPart, "ALTER") ||
+		util.AsciiEqualFold(cmdPart, "CREATE") ||
+		util.AsciiEqualFold(cmdPart, "DROP") ||
+		util.AsciiEqualFold(cmdPart, "IF") ||
+		util.AsciiEqualFold(cmdPart, "SET") ||
+		util.AsciiEqualFold(cmdPart, "sp_rename") ||
+		util.AsciiEqualFold(cmdPart, "BEGIN") ||
+		util.AsciiEqualFold(cmdPart, "ROLLBACK") ||
+		util.AsciiEqualFold(cmdPart, "COMMIT") {
+		return ctx, nil
+	}
+
+	switch {
+	case util.AsciiEqualFold(cmdPart, "INSERT"):
+		cmdPart, cmdRemaining, _ = cutSpaceForSQL(cmdRemaining)
+		if util.AsciiEqualFold(cmdPart, "INTO") {
+			cmdPart, cmdRemaining, _ = cutSpaceForSQL(cmdRemaining)
+		}
+		fixturesLoader.MarkTableChanged(trimTableNameQuotes(cmdPart))
+	case util.AsciiEqualFold(cmdPart, "MERGE"):
+		cmdPart, cmdRemaining, _ = cutSpaceForSQL(cmdRemaining)
+		if util.AsciiEqualFold(cmdPart, "INTO") {
+			cmdPart, cmdRemaining, _ = cutSpaceForSQL(cmdRemaining)
+		}
+		fixturesLoader.MarkTableChanged(trimTableNameQuotes(cmdPart))
+	case util.AsciiEqualFold(cmdPart, "UPDATE"):
+		cmdPart, cmdRemaining, _ = cutSpaceForSQL(cmdRemaining)
+		fixturesLoader.MarkTableChanged(trimTableNameQuotes(cmdPart))
+	case util.AsciiEqualFold(cmdPart, "DELETE"):
+		cmdPart, cmdRemaining, _ = cutSpaceForSQL(cmdRemaining)
+		if util.AsciiEqualFold(cmdPart, "FROM") {
+			cmdPart, cmdRemaining, _ = cutSpaceForSQL(cmdRemaining)
+		}
+		fixturesLoader.MarkTableChanged(trimTableNameQuotes(cmdPart))
+	case util.AsciiEqualFold(cmdPart, "TRUNCATE"):
+		cmdPart, cmdRemaining, _ = cutSpaceForSQL(cmdRemaining)
+		if util.AsciiEqualFold(cmdPart, "TABLE") {
+			cmdPart, cmdRemaining, _ = cutSpaceForSQL(cmdRemaining)
+		}
+		fixturesLoader.MarkTableChanged(trimTableNameQuotes(cmdPart))
+	default:
+		// should either parse the table name if it changes data, or ignore it
+		panic("unrecognized sql: " + sql)
+	}
+	_ = cmdRemaining
+	return ctx, nil
+}
+
+func (f fixturesHookStruct) AfterProcess(c *contexts.ContextHook) error {
+	return nil
+}
+
 // InitFixtures initialize test fixtures for a test database
-func InitFixtures(opts FixturesOptions, engine ...*xorm.Engine) (err error) {
-	xormEngine := util.IfZero(util.OptionalArg(engine), GetXORMEngine())
+func InitFixtures(opts FixturesOptions) (err error) {
+	xormEngine := GetXORMEngine()
 	fixturesLoader, err = NewFixturesLoader(xormEngine, opts)
 	// fixturesLoader = NewFixturesLoaderVendor(xormEngine, opts)
 
 	// register the dummy hash algorithm function used in the test fixtures
 	_ = hash.Register("dummy", hash.NewDummyHasher)
 	setting.PasswordHashAlgo, _ = hash.SetDefaultPasswordHashAlgorithm("dummy")
+	xormEngine.AddHook(&fixturesHookStruct{})
 	return err
 }
 
diff --git a/models/unittest/fixtures_loader.go b/models/unittest/fixtures_loader.go
index 5b79cb5643b..7ad3bc90583 100644
--- a/models/unittest/fixtures_loader.go
+++ b/models/unittest/fixtures_loader.go
@@ -4,6 +4,7 @@
 package unittest
 
 import (
+	"context"
 	"database/sql"
 	"encoding/hex"
 	"fmt"
@@ -11,10 +12,11 @@ import (
 	"path/filepath"
 	"slices"
 	"strings"
+	"sync"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 	"xorm.io/xorm"
 	"xorm.io/xorm/schemas"
 )
@@ -32,7 +34,7 @@ type FixtureItem struct {
 
 type fixturesLoaderInternal struct {
 	xormEngine       *xorm.Engine
-	xormTableNames   map[string]bool
+	tableSyncMap     sync.Map
 	db               *sql.DB
 	dbType           schemas.DBType
 	fixtures         map[string]*FixtureItem
@@ -148,25 +150,36 @@ func (f *fixturesLoaderInternal) Load() error {
 	}
 	defer func() { _ = tx.Rollback() }()
 
+	ctx := context.WithValue(context.Background(), db.ContextKeyTestFixtures, true)
+
 	for _, fixture := range f.fixtures {
-		if !f.xormTableNames[fixture.tableName] {
+		synced, existing := f.tableSyncMap.Load(fixture.tableName)
+		if synced == true || !existing {
 			continue
 		}
 		if err := f.loadFixtures(tx, fixture); err != nil {
 			return fmt.Errorf("failed to load fixtures from %s: %w", fixture.fileFullPath, err)
 		}
+		f.tableSyncMap.Store(fixture.tableName, true)
 	}
 	if err = tx.Commit(); err != nil {
 		return err
 	}
-	for xormTableName := range f.xormTableNames {
-		if f.fixtures[xormTableName] == nil {
-			_, _ = f.xormEngine.Exec("DELETE FROM `" + xormTableName + "`")
+	f.tableSyncMap.Range(func(k, v any) bool {
+		tableName, synced := k.(string), v.(bool)
+		if !synced && f.fixtures[tableName] == nil {
+			_, _ = f.xormEngine.Context(ctx).Exec("DELETE FROM `" + tableName + "`")
 		}
-	}
+		f.tableSyncMap.Store(tableName, true)
+		return true
+	})
 	return nil
 }
 
+func (f *fixturesLoaderInternal) MarkTableChanged(tableName string) {
+	f.tableSyncMap.Store(tableName, false)
+}
+
 func FixturesFileFullPaths(dir string, files []string) (map[string]*FixtureItem, error) {
 	if files != nil && len(files) == 0 {
 		return nil, nil //nolint:nilnil // load nothing
@@ -215,11 +228,12 @@ func NewFixturesLoader(x *xorm.Engine, opts FixturesOptions) (FixturesLoader, er
 		f.paramPlaceholder = func(idx int) string { return "?" }
 	}
 
+	// If a model is not imported in a package (no bean is registered), the table won't exist in database.
+	// So only use tables of registered models (beans).
 	xormBeans, _ := db.NamesToBean()
-	f.xormTableNames = map[string]bool{}
 	for _, bean := range xormBeans {
-		f.xormTableNames[x.TableName(bean)] = true
+		beanTableName := x.TableName(bean)
+		f.tableSyncMap.Store(trimTableNameQuotes(beanTableName), false)
 	}
-
 	return f, nil
 }
diff --git a/models/unittest/fixtures_test.go b/models/unittest/fixtures_test.go
index 72944ec0dbe..8d81a367dd0 100644
--- a/models/unittest/fixtures_test.go
+++ b/models/unittest/fixtures_test.go
@@ -8,9 +8,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/require"
 	"xorm.io/xorm"
@@ -70,7 +70,7 @@ func prepareTestFixturesLoaders(t testing.TB) unittest.FixturesOptions {
 	opts := unittest.FixturesOptions{Dir: filepath.Join(giteaRoot, "models", "fixtures"), Files: []string{
 		"user.yml",
 	}}
-	require.NoError(t, unittest.CreateTestEngine(opts))
+	require.NoError(t, unittest.CreateTestEngine(filepath.Join(t.TempDir(), "sqlite-test.db"), opts))
 	return opts
 }
 
@@ -95,7 +95,7 @@ func TestFixturesLoader(t *testing.T) {
 
 func BenchmarkFixturesLoader(b *testing.B) {
 	opts := prepareTestFixturesLoaders(b)
-	require.NoError(b, unittest.CreateTestEngine(opts))
+	require.NoError(b, unittest.CreateTestEngine(filepath.Join(b.TempDir(), "sqlite-test.db"), opts))
 	loaderInternal, err := unittest.NewFixturesLoader(unittest.GetXORMEngine(), opts)
 	require.NoError(b, err)
 	loaderVendor, err := NewFixturesLoaderVendor(unittest.GetXORMEngine(), opts)
diff --git a/models/unittest/fscopy.go b/models/unittest/fscopy.go
index cddb7a3f778..62743b6acab 100644
--- a/models/unittest/fscopy.go
+++ b/models/unittest/fscopy.go
@@ -9,8 +9,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // SyncFile synchronizes the two files. This is skipped if both files
diff --git a/models/unittest/mock_http.go b/models/unittest/mock_http.go
index dd05b263ede..cc1e389d778 100644
--- a/models/unittest/mock_http.go
+++ b/models/unittest/mock_http.go
@@ -15,7 +15,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/unittest/reflection.go b/models/unittest/reflection.go
index bc96a059733..47145d6c031 100644
--- a/models/unittest/reflection.go
+++ b/models/unittest/reflection.go
@@ -9,7 +9,7 @@ import (
 )
 
 func fieldByName(v reflect.Value, field string) reflect.Value {
-	if v.Kind() == reflect.Ptr {
+	if v.Kind() == reflect.Pointer {
 		v = v.Elem()
 	}
 	f := v.FieldByName(field)
diff --git a/models/unittest/testdb.go b/models/unittest/testdb.go
index 116fdab4968..740df0e2ab9 100644
--- a/models/unittest/testdb.go
+++ b/models/unittest/testdb.go
@@ -13,16 +13,16 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/setting/config"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/tempdir"
-	"code.gitea.io/gitea/modules/testlogger"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/system"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/setting/config"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/tempdir"
+	"gitea.dev/modules/testlogger"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"xorm.io/xorm"
@@ -56,7 +56,7 @@ func mainTest(m *testing.M, testOptsArg ...*TestOptions) int {
 
 	giteaRoot := setting.GetGiteaTestSourceRoot()
 	fixturesOpts := FixturesOptions{Dir: filepath.Join(giteaRoot, "models", "fixtures"), Files: testOpts.FixtureFiles}
-	if err := CreateTestEngine(fixturesOpts); err != nil {
+	if err := CreateTestEngine(filepath.Join(tempWorkPath, "sqlite-test.db"), fixturesOpts); err != nil {
 		return testlogger.MainErrorf("Error creating test database engine: %v", err)
 	}
 
@@ -205,9 +205,9 @@ type FixturesOptions struct {
 	Files []string
 }
 
-// CreateTestEngine creates a memory database and loads the fixture data from fixturesDir
-func CreateTestEngine(opts FixturesOptions) error {
-	driver, connStr, err := db.ConnStr(db.ConnOptions{Type: "sqlite3", SQLitePath: ":memory:"})
+// CreateTestEngine creates a test database and loads the fixture data from fixturesDir
+func CreateTestEngine(testSQLiteFile string, opts FixturesOptions) error {
+	driver, connStr, err := db.ConnStr(db.ConnOptions{Type: setting.DatabaseTypeSQLite3, SQLitePath: testSQLiteFile, SQLiteBusyTimeout: setting.DefaultSQLiteBusyTimeout})
 	if err != nil {
 		return err
 	}
diff --git a/models/unittest/unit_tests.go b/models/unittest/unit_tests.go
index c49b26fea45..45ea0d175ea 100644
--- a/models/unittest/unit_tests.go
+++ b/models/unittest/unit_tests.go
@@ -10,7 +10,7 @@ import (
 	"os"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/user/avatar.go b/models/user/avatar.go
index 5811d859117..13f001e3ba2 100644
--- a/models/user/avatar.go
+++ b/models/user/avatar.go
@@ -9,13 +9,13 @@ import (
 	"image/png"
 	"io"
 
-	"code.gitea.io/gitea/models/avatars"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/avatar"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
+	"gitea.dev/models/avatars"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/avatar"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
 )
 
 // CustomAvatarRelativePath returns user custom avatar relative path.
diff --git a/models/user/avatar_test.go b/models/user/avatar_test.go
index 9ebf00de491..f090dc467cf 100644
--- a/models/user/avatar_test.go
+++ b/models/user/avatar_test.go
@@ -8,10 +8,10 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/user/badge.go b/models/user/badge.go
index a4a465a9d54..0858fd67656 100644
--- a/models/user/badge.go
+++ b/models/user/badge.go
@@ -6,8 +6,8 @@ package user
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 	"xorm.io/xorm/schemas"
@@ -69,7 +69,7 @@ func GetBadgeUsers(ctx context.Context, opts *GetBadgeUsersOptions) ([]*User, in
 		Where("badge.slug=?", opts.BadgeSlug)
 
 	if opts.Page > 0 {
-		sess = db.SetSessionPagination(sess, opts)
+		db.SetSessionPagination(sess, opts)
 	}
 
 	users := make([]*User, 0, opts.PageSize)
diff --git a/models/user/badge_test.go b/models/user/badge_test.go
index 04979a9cafe..72d2aedc1e1 100644
--- a/models/user/badge_test.go
+++ b/models/user/badge_test.go
@@ -6,10 +6,10 @@ package user_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/user/block.go b/models/user/block.go
index 03f984a8fdf..6331b754a39 100644
--- a/models/user/block.go
+++ b/models/user/block.go
@@ -6,10 +6,10 @@ package user
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/user/email_address.go b/models/user/email_address.go
index 670d417f9e6..5a259b8e2b8 100644
--- a/models/user/email_address.go
+++ b/models/user/email_address.go
@@ -11,13 +11,13 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"xorm.io/builder"
 )
diff --git a/models/user/email_address_test.go b/models/user/email_address_test.go
index 4167aaac0df..06ab883779d 100644
--- a/models/user/email_address_test.go
+++ b/models/user/email_address_test.go
@@ -7,10 +7,10 @@ import (
 	"slices"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/user/error.go b/models/user/error.go
index 5a956a2afe1..28ea4f21c1c 100644
--- a/models/user/error.go
+++ b/models/user/error.go
@@ -6,7 +6,7 @@ package user
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // ErrUserAlreadyExist represents a "user already exists" error.
diff --git a/models/user/external_login_user.go b/models/user/external_login_user.go
index 636a2007ee8..1069b0f2836 100644
--- a/models/user/external_login_user.go
+++ b/models/user/external_login_user.go
@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -80,8 +80,11 @@ func init() {
 }
 
 // GetExternalLogin checks if a externalID in loginSourceID scope already exists
-func GetExternalLogin(ctx context.Context, externalLoginUser *ExternalLoginUser) (bool, error) {
-	return db.GetEngine(ctx).Get(externalLoginUser)
+func GetExternalLogin(ctx context.Context, loginSourceID int64, externalID string) (*ExternalLoginUser, bool, error) {
+	return db.Get[ExternalLoginUser](ctx, builder.Eq{
+		"external_id":     externalID,
+		"login_source_id": loginSourceID,
+	})
 }
 
 // LinkExternalToUser link the external user to the user
@@ -118,6 +121,12 @@ func RemoveAllAccountLinks(ctx context.Context, user *User) error {
 	return err
 }
 
+// RemoveExternalLoginByExternalID removes a specific external login link by its provider-side identifier.
+func RemoveExternalLoginByExternalID(ctx context.Context, loginSourceID int64, externalID string) error {
+	_, err := db.GetEngine(ctx).Where("external_id=? AND login_source_id=?", externalID, loginSourceID).Delete(new(ExternalLoginUser))
+	return err
+}
+
 // GetUserIDByExternalUserID get user id according to provider and userID
 func GetUserIDByExternalUserID(ctx context.Context, provider, userID string) (int64, error) {
 	var id int64
diff --git a/models/user/follow.go b/models/user/follow.go
index e098caab5b1..617211886ec 100644
--- a/models/user/follow.go
+++ b/models/user/follow.go
@@ -6,8 +6,8 @@ package user
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/timeutil"
 )
 
 // Follow represents relations of user and their followers.
diff --git a/models/user/follow_test.go b/models/user/follow_test.go
index 1d5f144164e..b24682d0f20 100644
--- a/models/user/follow_test.go
+++ b/models/user/follow_test.go
@@ -6,8 +6,8 @@ package user_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/user/list.go b/models/user/list.go
index aaaa7965c89..7a737935f90 100644
--- a/models/user/list.go
+++ b/models/user/list.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
 )
 
 // UserList is a list of user.
diff --git a/models/user/main_test.go b/models/user/main_test.go
index a626d323a71..1a8cd4af594 100644
--- a/models/user/main_test.go
+++ b/models/user/main_test.go
@@ -6,12 +6,12 @@ package user_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
-	_ "code.gitea.io/gitea/models/user"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
+	_ "gitea.dev/models/user"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/user/must_change_password.go b/models/user/must_change_password.go
index 686847c7d7c..5603b0f65be 100644
--- a/models/user/must_change_password.go
+++ b/models/user/must_change_password.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/models/user/openid.go b/models/user/openid.go
index 5baa48c8240..84ec5a5cd87 100644
--- a/models/user/openid.go
+++ b/models/user/openid.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/util"
 )
 
 // UserOpenID is the list of all OpenID identities of a user.
diff --git a/models/user/openid_test.go b/models/user/openid_test.go
index 6d2260324fd..b9a2572adb2 100644
--- a/models/user/openid_test.go
+++ b/models/user/openid_test.go
@@ -6,9 +6,9 @@ package user_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/user/redirect.go b/models/user/redirect.go
index 5a40d4df3ba..325a643eb6c 100644
--- a/models/user/redirect.go
+++ b/models/user/redirect.go
@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/util"
 )
 
 // ErrUserRedirectNotExist represents a "UserRedirectNotExist" kind of error.
diff --git a/models/user/redirect_test.go b/models/user/redirect_test.go
index 015eac06682..492c9085810 100644
--- a/models/user/redirect_test.go
+++ b/models/user/redirect_test.go
@@ -6,8 +6,8 @@ package user_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/user/search.go b/models/user/search.go
index 36d1d3913b6..536b15527ec 100644
--- a/models/user/search.go
+++ b/models/user/search.go
@@ -9,13 +9,12 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/structs"
 
 	"xorm.io/builder"
-	"xorm.io/xorm"
 )
 
 // AdminUserOrderByMap represents all possible admin user search orders
@@ -59,7 +58,13 @@ type SearchUserOptions struct {
 	IncludeReserved    bool
 }
 
-func (opts *SearchUserOptions) toSearchQueryBase(ctx context.Context) *xorm.Session {
+func (opts *SearchUserOptions) ApplyPublicOnly(publicOnly bool) {
+	if publicOnly {
+		opts.Visible = []structs.VisibleType{structs.VisibleTypePublic}
+	}
+}
+
+func (opts *SearchUserOptions) toSearchQueryBase(ctx context.Context) db.Session {
 	var cond builder.Cond
 	cond = builder.In("type", opts.Types)
 	if opts.IncludeReserved {
@@ -167,14 +172,15 @@ func SearchUsers(ctx context.Context, opts SearchUserOptions) (users []*User, _
 		opts.OrderBy = db.SearchOrderByAlphabetically
 	}
 
-	sessQuery := opts.toSearchQueryBase(ctx).OrderBy(opts.OrderBy.String())
+	sessQuery := opts.toSearchQueryBase(ctx)
 	defer sessQuery.Close()
+	sessQuery.OrderBy(opts.OrderBy.String())
 	if opts.Page > 0 {
-		sessQuery = db.SetSessionPagination(sessQuery, &opts)
+		db.SetSessionPagination(sessQuery, &opts)
 	}
 
 	// the sql may contain JOIN, so we must only select User related columns
-	sessQuery = sessQuery.Select("`user`.*")
+	sessQuery.Select("`user`.*")
 	users = make([]*User, 0, opts.PageSize)
 	return users, count, sessQuery.Find(&users)
 }
diff --git a/models/user/setting.go b/models/user/setting.go
index 67b45208fcf..a3903d59155 100644
--- a/models/user/setting.go
+++ b/models/user/setting.go
@@ -9,11 +9,11 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/json"
-	setting_module "code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/json"
+	setting_module "gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 	"xorm.io/xorm/convert"
diff --git a/models/user/setting_test.go b/models/user/setting_test.go
index 7332e442b4c..482c6843d8e 100644
--- a/models/user/setting_test.go
+++ b/models/user/setting_test.go
@@ -6,8 +6,8 @@ package user_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/models/user/user.go b/models/user/user.go
index 0e87d7b7b93..66e8d49b420 100644
--- a/models/user/user.go
+++ b/models/user/user.go
@@ -21,22 +21,22 @@ import (
 	"time"
 	"unicode"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/auth/openid"
-	"code.gitea.io/gitea/modules/auth/password/hash"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/auth/openid"
+	"gitea.dev/modules/auth/password/hash"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	_ "image/jpeg" // Needed for jpeg support
 
@@ -244,12 +244,15 @@ func (u *User) IsOAuth2() bool {
 	return u.LoginType == auth.OAuth2
 }
 
-// MaxCreationLimit returns the number of repositories a user is allowed to create
+// MaxCreationLimit returns the number of repositories a user or an organization is allowed to create
 func (u *User) MaxCreationLimit() int {
-	if u.MaxRepoCreation <= -1 {
-		return setting.Repository.MaxCreationLimit
+	if u.MaxRepoCreation > -1 {
+		return u.MaxRepoCreation
 	}
-	return u.MaxRepoCreation
+	if u.IsOrganization() {
+		return setting.Repository.OrgMaxCreationLimit
+	}
+	return setting.Repository.UserMaxCreationLimit
 }
 
 // CanCreateRepoIn checks whether the doer(u) can create a repository in the owner
@@ -264,13 +267,11 @@ func (u *User) CanCreateRepoIn(owner *User) bool {
 		return true
 	}
 	const noLimit = -1
-	if owner.MaxRepoCreation == noLimit {
-		if setting.Repository.MaxCreationLimit == noLimit {
-			return true
-		}
-		return owner.NumRepos < setting.Repository.MaxCreationLimit
+	limit := owner.MaxCreationLimit()
+	if limit == noLimit {
+		return true
 	}
-	return owner.NumRepos < owner.MaxRepoCreation
+	return owner.NumRepos < limit
 }
 
 // CanCreateOrganization returns true if user can create organisation.
@@ -307,6 +308,13 @@ func (u *User) DashboardLink() string {
 	return setting.AppSubURL + "/"
 }
 
+func (u *User) SettingsLink() string {
+	if u.IsOrganization() {
+		return u.OrganisationLink() + "/settings"
+	}
+	return setting.AppSubURL + "/user/settings"
+}
+
 // HomeLink returns the user or organization home page link.
 func (u *User) HomeLink() string {
 	return setting.AppSubURL + "/" + url.PathEscape(u.Name)
@@ -332,7 +340,7 @@ func GetUserFollowers(ctx context.Context, u, viewer *User, listOptions db.ListO
 		And(isUserVisibleToViewerCond(viewer))
 
 	if listOptions.Page > 0 {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 
 		users := make([]*User, 0, listOptions.PageSize)
 		count, err := sess.FindAndCount(&users)
@@ -354,7 +362,7 @@ func GetUserFollowing(ctx context.Context, u, viewer *User, listOptions db.ListO
 		And(isUserVisibleToViewerCond(viewer))
 
 	if listOptions.Page > 0 {
-		sess = db.SetSessionPagination(sess, &listOptions)
+		db.SetSessionPagination(sess, &listOptions)
 
 		users := make([]*User, 0, listOptions.PageSize)
 		count, err := sess.FindAndCount(&users)
@@ -1051,13 +1059,13 @@ func GetPossibleUserByIDs(ctx context.Context, ids []int64) ([]*User, error) {
 	return users, nil
 }
 
-// GetUserByName returns user by given name.
-func GetUserByName(ctx context.Context, name string) (*User, error) {
-	if len(name) == 0 {
-		return nil, ErrUserNotExist{Name: name}
+func getUserByNameWithTypes(ctx context.Context, name string, types ...UserType) (*User, error) {
+	u := &User{}
+	sess := db.GetEngine(ctx).Where(builder.Eq{"lower_name": strings.ToLower(name)})
+	if len(types) > 0 {
+		sess.In("`type`", types)
 	}
-	u := &User{LowerName: strings.ToLower(name), Type: UserTypeIndividual}
-	has, err := db.GetEngine(ctx).Get(u)
+	has, err := sess.Get(u)
 	if err != nil {
 		return nil, err
 	} else if !has {
@@ -1066,6 +1074,15 @@ func GetUserByName(ctx context.Context, name string) (*User, error) {
 	return u, nil
 }
 
+// GetUserByName returns the user object by given name, any user type.
+func GetUserByName(ctx context.Context, name string) (*User, error) {
+	return getUserByNameWithTypes(ctx, name)
+}
+
+func GetIndividualUserByName(ctx context.Context, name string) (*User, error) {
+	return getUserByNameWithTypes(ctx, name, UserTypeIndividual)
+}
+
 // GetUserEmailsByNames returns a list of e-mails corresponds to names of users
 // that have their email notifications set to enabled or onmention.
 func GetUserEmailsByNames(ctx context.Context, names []string) []string {
@@ -1108,19 +1125,6 @@ func GetMailableUsersByIDs(ctx context.Context, ids []int64, isMention bool) ([]
 		Find(&ous)
 }
 
-// GetUserNameByID returns username for the id
-func GetUserNameByID(ctx context.Context, id int64) (string, error) {
-	var name string
-	has, err := db.GetEngine(ctx).Table("user").Where("id = ?", id).Cols("name").Get(&name)
-	if err != nil {
-		return "", err
-	}
-	if has {
-		return name, nil
-	}
-	return "", nil
-}
-
 // GetUserIDsByNames returns a slice of ids corresponds to names.
 func GetUserIDsByNames(ctx context.Context, names []string, ignoreNonExistent bool) ([]int64, error) {
 	ids := make([]int64, 0, len(names))
@@ -1321,13 +1325,14 @@ func GetUserByEmail(ctx context.Context, email string) (*User, error) {
 		if id != 0 {
 			return GetUserByID(ctx, id)
 		}
-		return GetUserByName(ctx, name)
+		return GetIndividualUserByName(ctx, name)
 	}
 
 	return nil, ErrUserNotExist{Name: email}
 }
 
 func GetIndividualUser(ctx context.Context, user *User) (bool, error) {
+	// FIXME: the design is wrong, empty User fields won't apply, this function should be removed in the future
 	has, err := db.GetEngine(ctx).Get(user)
 	if has && user.Type != UserTypeIndividual {
 		has = false
@@ -1492,27 +1497,3 @@ func DisabledFeaturesWithLoginType(user *User) *container.Set[string] {
 	}
 	return &setting.Admin.UserDisabledFeatures
 }
-
-// GetUserOrOrgIDByName returns the id for a user or an org by name
-func GetUserOrOrgIDByName(ctx context.Context, name string) (int64, error) {
-	var id int64
-	has, err := db.GetEngine(ctx).Table("user").Where("name = ?", name).Cols("id").Get(&id)
-	if err != nil {
-		return 0, err
-	} else if !has {
-		return 0, fmt.Errorf("user or org with name %s: %w", name, util.ErrNotExist)
-	}
-	return id, nil
-}
-
-// GetUserOrOrgByName returns the user or org by name
-func GetUserOrOrgByName(ctx context.Context, name string) (*User, error) {
-	var u User
-	has, err := db.GetEngine(ctx).Where("lower_name = ?", strings.ToLower(name)).Get(&u)
-	if err != nil {
-		return nil, err
-	} else if !has {
-		return nil, ErrUserNotExist{Name: name}
-	}
-	return &u, nil
-}
diff --git a/models/user/user_list.go b/models/user/user_list.go
index 1b6a27dd862..c0802860599 100644
--- a/models/user/user_list.go
+++ b/models/user/user_list.go
@@ -6,7 +6,7 @@ package user
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 )
 
 func GetUsersMapByIDs(ctx context.Context, userIDs []int64) (map[int64]*User, error) {
diff --git a/models/user/user_system.go b/models/user/user_system.go
index cf4306df25d..5a71553e9ec 100644
--- a/models/user/user_system.go
+++ b/models/user/user_system.go
@@ -7,7 +7,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/structs"
 )
 
 const (
diff --git a/models/user/user_test.go b/models/user/user_test.go
index 956eaeafb4f..2bf32a50382 100644
--- a/models/user/user_test.go
+++ b/models/user/user_test.go
@@ -10,17 +10,17 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/password/hash"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/password/hash"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -674,12 +674,18 @@ func TestGetInactiveUsers(t *testing.T) {
 
 func TestCanCreateRepo(t *testing.T) {
 	defer test.MockVariableValue(&setting.Repository.MaxCreationLimit)()
+	defer test.MockVariableValue(&setting.Repository.UserMaxCreationLimit)()
+	defer test.MockVariableValue(&setting.Repository.OrgMaxCreationLimit)()
 	const noLimit = -1
 	doerActions := user_model.NewActionsUser()
 	doerNormal := &user_model.User{ID: 2}
 	doerAdmin := &user_model.User{ID: 1, IsAdmin: true}
+	orgOwner := func(numRepos, maxRepoCreation int) *user_model.User {
+		return &user_model.User{ID: 3, Type: user_model.UserTypeOrganization, NumRepos: numRepos, MaxRepoCreation: maxRepoCreation}
+	}
 	t.Run("NoGlobalLimit", func(t *testing.T) {
-		setting.Repository.MaxCreationLimit = noLimit
+		setting.Repository.UserMaxCreationLimit = noLimit
+		setting.Repository.OrgMaxCreationLimit = noLimit
 
 		assert.False(t, doerNormal.CanCreateRepoIn(&user_model.User{ID: 2, NumRepos: 10, MaxRepoCreation: 0}))
 		assert.True(t, doerNormal.CanCreateRepoIn(&user_model.User{ID: 2, NumRepos: 10, MaxRepoCreation: 100}))
@@ -693,7 +699,8 @@ func TestCanCreateRepo(t *testing.T) {
 	})
 
 	t.Run("GlobalLimit50", func(t *testing.T) {
-		setting.Repository.MaxCreationLimit = 50
+		setting.Repository.UserMaxCreationLimit = 50
+		setting.Repository.OrgMaxCreationLimit = 50
 
 		assert.True(t, doerNormal.CanCreateRepoIn(&user_model.User{ID: 2, NumRepos: 10, MaxRepoCreation: noLimit}))
 		assert.False(t, doerNormal.CanCreateRepoIn(&user_model.User{ID: 2, NumRepos: 60, MaxRepoCreation: noLimit})) // limited by global limit
@@ -707,4 +714,33 @@ func TestCanCreateRepo(t *testing.T) {
 		assert.True(t, doerAdmin.CanCreateRepoIn(&user_model.User{ID: 2, NumRepos: 10, MaxRepoCreation: 100}))
 		assert.True(t, doerAdmin.CanCreateRepoIn(&user_model.User{ID: 2, NumRepos: 60, MaxRepoCreation: 100}))
 	})
+
+	t.Run("UserBlockedOrgsUnlimited", func(t *testing.T) {
+		// User and org limits are independent: a deployment can block personal repos while leaving orgs unrestricted.
+		setting.Repository.UserMaxCreationLimit = 0
+		setting.Repository.OrgMaxCreationLimit = noLimit
+
+		// regular user is blocked
+		assert.False(t, doerNormal.CanCreateRepoIn(&user_model.User{ID: 2, NumRepos: 0, MaxRepoCreation: noLimit}))
+		// per-user override grants individual exceptions even when the global user limit is 0
+		assert.True(t, doerNormal.CanCreateRepoIn(&user_model.User{ID: 2, NumRepos: 3, MaxRepoCreation: 5}))
+		assert.False(t, doerNormal.CanCreateRepoIn(&user_model.User{ID: 2, NumRepos: 5, MaxRepoCreation: 5}))
+
+		// organization can create unlimited repos
+		assert.True(t, doerNormal.CanCreateRepoIn(orgOwner(10, noLimit)))
+		assert.True(t, doerNormal.CanCreateRepoIn(orgOwner(999, noLimit)))
+		// per-org override still wins over the global org limit
+		assert.False(t, doerNormal.CanCreateRepoIn(orgOwner(5, 5)))
+	})
+
+	t.Run("OrgGlobalLimitWithPerOrgOverride", func(t *testing.T) {
+		setting.Repository.UserMaxCreationLimit = noLimit
+		setting.Repository.OrgMaxCreationLimit = 10
+
+		assert.True(t, doerNormal.CanCreateRepoIn(orgOwner(5, noLimit)))
+		assert.False(t, doerNormal.CanCreateRepoIn(orgOwner(10, noLimit)))
+
+		// per-org override bypasses the global org limit
+		assert.True(t, doerNormal.CanCreateRepoIn(orgOwner(10, 100)))
+	})
 }
diff --git a/models/user/user_update.go b/models/user/user_update.go
index 66702e2a144..b29a501ee24 100644
--- a/models/user/user_update.go
+++ b/models/user/user_update.go
@@ -6,7 +6,7 @@ package user
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 )
 
 func IncrUserRepoNum(ctx context.Context, userID int64) error {
diff --git a/models/webhook/hooktask.go b/models/webhook/hooktask.go
index 96ec11e43f0..a0a6eef60f4 100644
--- a/models/webhook/hooktask.go
+++ b/models/webhook/hooktask.go
@@ -8,12 +8,12 @@ import (
 	"errors"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	webhook_module "gitea.dev/modules/webhook"
 
 	gouuid "github.com/google/uuid"
 	"xorm.io/builder"
diff --git a/models/webhook/main_test.go b/models/webhook/main_test.go
index 5f2d5081a1a..28626f71112 100644
--- a/models/webhook/main_test.go
+++ b/models/webhook/main_test.go
@@ -6,7 +6,7 @@ package webhook
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/models/webhook/webhook.go b/models/webhook/webhook.go
index 5144c0eca60..893ec159279 100644
--- a/models/webhook/webhook.go
+++ b/models/webhook/webhook.go
@@ -9,15 +9,15 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/secret"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/secret"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"xorm.io/builder"
 )
diff --git a/models/webhook/webhook_system.go b/models/webhook/webhook_system.go
index e8b5040c96f..49e21bbf087 100644
--- a/models/webhook/webhook_system.go
+++ b/models/webhook/webhook_system.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/optional"
 
 	"xorm.io/builder"
 )
diff --git a/models/webhook/webhook_system_test.go b/models/webhook/webhook_system_test.go
index 9e954d1e377..69f9dfb7fbf 100644
--- a/models/webhook/webhook_system_test.go
+++ b/models/webhook/webhook_system_test.go
@@ -6,8 +6,8 @@ package webhook
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/optional"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/models/webhook/webhook_test.go b/models/webhook/webhook_test.go
index 073af91de21..cd527d11591 100644
--- a/models/webhook/webhook_test.go
+++ b/models/webhook/webhook_test.go
@@ -8,12 +8,12 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/timeutil"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
diff --git a/modules/actions/artifacts.go b/modules/actions/artifacts.go
index 4884eb42e80..ba1f9acc010 100644
--- a/modules/actions/artifacts.go
+++ b/modules/actions/artifacts.go
@@ -1,65 +1,29 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
+// Copyright 2026 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
 package actions
 
 import (
-	"net/http"
-	"strings"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/binary"
+	"io"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/setting"
 )
 
-// IsArtifactV4 detects whether the artifact is likely from v4.
-// V4 backend stores the files as a single combined zip file per artifact, and ensures ContentEncoding contains a slash
-// (otherwise this uses application/zip instead of the custom mime type), which is not the case for the old backend.
-func IsArtifactV4(art *actions_model.ActionArtifact) bool {
-	return strings.Contains(art.ContentEncodingOrType, "/")
-}
+type tagType string
 
-func GetArtifactV4ServeDirectURL(art *actions_model.ActionArtifact, method string) (string, error) {
-	contentType := art.ContentEncodingOrType
-	u, err := storage.ActionsArtifacts.ServeDirectURL(art.StoragePath, art.ArtifactPath, method, &storage.ServeDirectOptions{ContentType: contentType})
-	if err != nil {
-		return "", err
+// BuildSignature builds a hmac signature for the input values.
+// "tag" is an internal pre-defined static string to distinguish the signatures for different purpose.
+func BuildSignature(tag tagType, vals ...string) []byte {
+	m := hmac.New(sha256.New, setting.GetGeneralTokenSigningSecret())
+	_, _ = io.WriteString(m, string(tag))
+	var buf8 [8]byte
+	for _, v := range vals {
+		binary.LittleEndian.PutUint64(buf8[:], uint64(len(v)))
+		_, _ = m.Write(buf8[:])
+		_, _ = io.WriteString(m, v)
 	}
-	return u.String(), nil
-}
-
-func DownloadArtifactV4ServeDirect(ctx *context.Base, art *actions_model.ActionArtifact) bool {
-	if !setting.Actions.ArtifactStorage.ServeDirect() {
-		return false
-	}
-	u, err := GetArtifactV4ServeDirectURL(art, ctx.Req.Method)
-	if err != nil {
-		log.Error("GetArtifactV4ServeDirectURL: %v", err)
-		return false
-	}
-	ctx.Redirect(u, http.StatusFound)
-	return true
-}
-
-func DownloadArtifactV4ReadStorage(ctx *context.Base, art *actions_model.ActionArtifact) error {
-	f, err := storage.ActionsArtifacts.Open(art.StoragePath)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	httplib.ServeUserContentByFile(ctx.Req, ctx.Resp, f, httplib.ServeHeaderOptions{
-		Filename:    art.ArtifactPath,
-		ContentType: art.ContentEncodingOrType, // v4 guarantees that the field is Content-Type
-	})
-	return nil
-}
-
-func DownloadArtifactV4(ctx *context.Base, art *actions_model.ActionArtifact) error {
-	if DownloadArtifactV4ServeDirect(ctx, art) {
-		return nil
-	}
-	return DownloadArtifactV4ReadStorage(ctx, art)
+	return m.Sum(nil)
 }
diff --git a/modules/actions/artifacts_test.go b/modules/actions/artifacts_test.go
new file mode 100644
index 00000000000..4c038436539
--- /dev/null
+++ b/modules/actions/artifacts_test.go
@@ -0,0 +1,36 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestBuildSignature(t *testing.T) {
+	a := BuildSignature("v0", "x")
+	b := BuildSignature("v0", "x")
+	assert.Equal(t, a, b)
+
+	a = BuildSignature("v0", "x", "yz")
+	b = BuildSignature("v0", "xy", "z")
+	assert.NotEqual(t, a, b)
+
+	a = BuildSignature("v1", "x")
+	b = BuildSignature("v2", "x")
+	assert.NotEqual(t, a, b)
+
+	a = BuildSignature("v0", "x")
+	b = BuildSignature("v0x")
+	assert.NotEqual(t, a, b)
+
+	a = BuildSignature("v0", "", "x")
+	b = BuildSignature("v0", "x", "")
+	assert.NotEqual(t, a, b)
+
+	a = BuildSignature("v0")
+	b = BuildSignature("v0")
+	assert.Equal(t, a, b)
+}
diff --git a/modules/actions/commit_status_info.go b/modules/actions/commit_status_info.go
new file mode 100644
index 00000000000..e7e33695440
--- /dev/null
+++ b/modules/actions/commit_status_info.go
@@ -0,0 +1,70 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"maps"
+	"slices"
+
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+)
+
+// CommitActionsStatusMap maps CommitStatus.ID to the live ActionRunJob status
+// for Gitea Actions rows.
+type CommitActionsStatusMap map[int64]actions_model.Status
+
+// IconStatus returns the action status name to route the icon through
+// repo/icons/action_status, or "" when the row isn't from Gitea Actions.
+func (m CommitActionsStatusMap) IconStatus(s *git_model.CommitStatus) string {
+	if status, ok := m[s.ID]; ok {
+		return status.String()
+	}
+	return ""
+}
+
+// GetCommitActionsStatusMap resolves the live ActionRunJob.Status for every
+// CommitStatus row backed by Gitea Actions. Rows from other sources (external
+// CIs, API) are left untouched and rendered from their stored State.
+func GetCommitActionsStatusMap(ctx context.Context, statuses []*git_model.CommitStatus) CommitActionsStatusMap {
+	if len(statuses) == 0 {
+		return nil
+	}
+	statusByJobID := make(map[int64]*git_model.CommitStatus)
+	repoByID := make(map[int64]*repo_model.Repository)
+	for _, status := range statuses {
+		if status == nil || status.TargetURL == "" {
+			continue
+		}
+		if status.Repo == nil {
+			status.Repo = repoByID[status.RepoID]
+		}
+		// ParseGiteaActionsTargetURL lazy-loads status.Repo on miss; cache the
+		// outcome so later entries with the same RepoID skip that load.
+		_, jobID, ok := status.ParseGiteaActionsTargetURL(ctx)
+		repoByID[status.RepoID] = status.Repo
+		if ok {
+			statusByJobID[jobID] = status
+		}
+	}
+	if len(statusByJobID) == 0 {
+		return nil
+	}
+	jobs := make(map[int64]*actions_model.ActionRunJob, len(statusByJobID))
+	if err := db.GetEngine(ctx).In("id", slices.Collect(maps.Keys(statusByJobID))).Cols("id", "status").Find(&jobs); err != nil {
+		log.Error("db.Find: failed to find action run jobs: %v", err)
+		return nil
+	}
+	info := make(CommitActionsStatusMap, len(jobs))
+	for jobID, status := range statusByJobID {
+		if job, ok := jobs[jobID]; ok {
+			info[status.ID] = job.Status
+		}
+	}
+	return info
+}
diff --git a/modules/actions/github.go b/modules/actions/github.go
index b7f475aa91b..0789419b4a1 100644
--- a/modules/actions/github.go
+++ b/modules/actions/github.go
@@ -4,7 +4,7 @@
 package actions
 
 import (
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 const (
diff --git a/modules/actions/github_test.go b/modules/actions/github_test.go
index 6652ff6eac2..26d05b8560c 100644
--- a/modules/actions/github_test.go
+++ b/modules/actions/github_test.go
@@ -6,7 +6,7 @@ package actions
 import (
 	"testing"
 
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/actions/jobparser/evaluator.go b/modules/actions/jobparser/evaluator.go
index b320095071d..3e314afb62b 100644
--- a/modules/actions/jobparser/evaluator.go
+++ b/modules/actions/jobparser/evaluator.go
@@ -9,7 +9,7 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/nektos/act/pkg/exprparser"
+	"gitea.com/gitea/runner/act/exprparser"
 	"go.yaml.in/yaml/v4"
 )
 
diff --git a/modules/actions/jobparser/interpeter.go b/modules/actions/jobparser/interpeter.go
index 512b6f02ab6..37defeff7a0 100644
--- a/modules/actions/jobparser/interpeter.go
+++ b/modules/actions/jobparser/interpeter.go
@@ -4,8 +4,8 @@
 package jobparser
 
 import (
-	"github.com/nektos/act/pkg/exprparser"
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/exprparser"
+	"gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
diff --git a/modules/actions/jobparser/jobparser.go b/modules/actions/jobparser/jobparser.go
index 76f229a54b3..e7a2b484981 100644
--- a/modules/actions/jobparser/jobparser.go
+++ b/modules/actions/jobparser/jobparser.go
@@ -9,8 +9,8 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/nektos/act/pkg/exprparser"
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/exprparser"
+	"gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -31,6 +31,9 @@ func Parse(content []byte, options ...ParseOption) ([]*SingleWorkflow, error) {
 	}
 	results := map[string]*JobResult{}
 	for id, job := range origin.Jobs {
+		if job == nil {
+			return nil, fmt.Errorf("needed job not found: %q", id)
+		}
 		results[id] = &JobResult{
 			Needs:   job.Needs(),
 			Result:  pc.jobResults[id],
diff --git a/modules/actions/jobparser/jobparser_test.go b/modules/actions/jobparser/jobparser_test.go
index 51ba70fc2ad..e74f0644f82 100644
--- a/modules/actions/jobparser/jobparser_test.go
+++ b/modules/actions/jobparser/jobparser_test.go
@@ -59,6 +59,13 @@ func TestParse(t *testing.T) {
 			wantErr: false,
 		},
 	}
+	invalidFileTests := []struct {
+		name string
+	}{
+		{name: "null_job_implicit"},
+		{name: "null_job_explicit"},
+	}
+
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			content := ReadTestdata(t, tt.name+".in.yaml")
@@ -84,4 +91,14 @@ func TestParse(t *testing.T) {
 			assert.Equal(t, string(want), builder.String())
 		})
 	}
+
+	for _, tt := range invalidFileTests {
+		t.Run(tt.name, func(t *testing.T) {
+			content := ReadTestdata(t, tt.name+".in.yaml")
+			require.NotPanics(t, func() {
+				_, err := Parse(content)
+				require.Error(t, err)
+			})
+		})
+	}
 }
diff --git a/modules/actions/jobparser/model.go b/modules/actions/jobparser/model.go
index 7132c278e95..c80626e4c04 100644
--- a/modules/actions/jobparser/model.go
+++ b/modules/actions/jobparser/model.go
@@ -8,7 +8,8 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/exprparser"
+	"gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -298,6 +299,9 @@ func toGitContext(input map[string]any) *model.GithubContext {
 	return gitContext
 }
 
+// workflowCallEvent is only fired by another workflow's `uses:`, so it is excluded from trigger detection.
+const workflowCallEvent = "workflow_call"
+
 func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 	switch rawOn.Kind {
 	case yaml.ScalarNode:
@@ -306,6 +310,9 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 		if err != nil {
 			return nil, err
 		}
+		if val == workflowCallEvent {
+			return []*Event{}, nil
+		}
 		return []*Event{
 			{Name: val},
 		}, nil
@@ -319,6 +326,9 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 		for _, v := range val {
 			switch t := v.(type) {
 			case string:
+				if t == workflowCallEvent {
+					continue
+				}
 				res = append(res, &Event{Name: t})
 			default:
 				return nil, fmt.Errorf("invalid type %T", t)
@@ -332,6 +342,9 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 		}
 		res := make([]*Event, 0, len(events))
 		for i, k := range events {
+			if k == workflowCallEvent {
+				continue
+			}
 			v := triggers[i]
 			switch v.Kind {
 			case yaml.ScalarNode:
@@ -454,6 +467,26 @@ func ParseRawOn(rawOn *yaml.Node) ([]*Event, error) {
 	}
 }
 
+func EvaluateJobIfExpression(jobID string, job *Job, gitCtx map[string]any, results map[string]*JobResult, vars map[string]string, inputs map[string]any) (bool, error) {
+	actJob := &model.Job{
+		Strategy: &model.Strategy{
+			FailFastString:    job.Strategy.FailFastString,
+			MaxParallelString: job.Strategy.MaxParallelString,
+			RawMatrix:         job.Strategy.RawMatrix,
+		},
+	}
+	evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, nil, toGitContext(gitCtx), results, vars, inputs))
+	expr, err := rewriteSubExpression(job.If.Value, false)
+	if err != nil {
+		return false, err
+	}
+	result, err := evaluator.evaluate(expr, exprparser.DefaultStatusCheckSuccess)
+	if err != nil {
+		return false, err
+	}
+	return exprparser.IsTruthy(result), nil
+}
+
 // parseMappingNode parse a mapping node and preserve order.
 func parseMappingNode[T any](node *yaml.Node) ([]string, []T, error) {
 	if node.Kind != yaml.MappingNode {
diff --git a/modules/actions/jobparser/model_test.go b/modules/actions/jobparser/model_test.go
index d0e82041618..567c160f928 100644
--- a/modules/actions/jobparser/model_test.go
+++ b/modules/actions/jobparser/model_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.yaml.in/yaml/v4"
@@ -254,6 +254,53 @@ func TestParseRawOn(t *testing.T) {
 				},
 			},
 		},
+		{
+			// `workflow_call` is only fired by another workflow's `uses:`, so ParseRawOn intentionally excludes it from trigger detection.
+			input: `on:
+  workflow_call:
+    inputs:
+      env:
+        type: string
+        required: true
+    outputs:
+      sha:
+        value: ${{ jobs.build.outputs.commit }}
+    secrets:
+      DEPLOY_KEY:
+        required: true
+`,
+			result: []*Event{},
+		},
+		{
+			// Mixed: a workflow that is both callable AND triggered by push. Only the "push" event surfaces.
+			input: `on:
+  workflow_call:
+    inputs:
+      env:
+        type: string
+  push:
+    branches: [main]
+`,
+			result: []*Event{
+				{
+					Name: "push",
+					acts: map[string][]string{"branches": {"main"}},
+				},
+			},
+		},
+		{
+			// Scalar form: a purely reusable workflow has no event triggers.
+			input:  "on: workflow_call",
+			result: []*Event{},
+		},
+		{
+			// Sequence form: `workflow_call` is excluded while sibling events are kept.
+			input: "on:\n  - push\n  - workflow_call\n  - pull_request",
+			result: []*Event{
+				{Name: "push"},
+				{Name: "pull_request"},
+			},
+		},
 	}
 	for _, kase := range kases {
 		t.Run(kase.input, func(t *testing.T) {
diff --git a/modules/actions/jobparser/testdata/null_job_explicit.in.yaml b/modules/actions/jobparser/testdata/null_job_explicit.in.yaml
new file mode 100644
index 00000000000..6731507a327
--- /dev/null
+++ b/modules/actions/jobparser/testdata/null_job_explicit.in.yaml
@@ -0,0 +1,9 @@
+# null_job_explicit.in.yaml
+on: push
+jobs:
+  empty: null
+  notempty:
+    needs: empty
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo ok
diff --git a/modules/actions/jobparser/testdata/null_job_implicit.in.yaml b/modules/actions/jobparser/testdata/null_job_implicit.in.yaml
new file mode 100644
index 00000000000..26591aadcd7
--- /dev/null
+++ b/modules/actions/jobparser/testdata/null_job_implicit.in.yaml
@@ -0,0 +1,9 @@
+# null_job_implicit.in.yaml
+on: push
+jobs:
+  empty:
+  notempty:
+    needs: empty
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo ok
diff --git a/modules/actions/jobparser/uses.go b/modules/actions/jobparser/uses.go
new file mode 100644
index 00000000000..d829537c699
--- /dev/null
+++ b/modules/actions/jobparser/uses.go
@@ -0,0 +1,75 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"errors"
+	"fmt"
+	"path"
+	"regexp"
+	"strings"
+)
+
+// UsesKind enumerates the supported forms of a reusable workflow "uses:" value.
+type UsesKind int
+
+const (
+	// UsesKindLocalSameRepo is "./.gitea/workflows/foo.yml" - a path inside the calling repository.
+	UsesKindLocalSameRepo UsesKind = iota + 1
+	// UsesKindLocalCrossRepo is "owner/repo/.gitea/workflows/foo.yml@ref" - a workflow in another repo on the same instance.
+	UsesKindLocalCrossRepo
+)
+
+// UsesRef is the parsed form of a reusable workflow "uses:" value.
+type UsesRef struct {
+	Kind  UsesKind
+	Owner string // empty for UsesKindLocalSameRepo
+	Repo  string // empty for UsesKindLocalSameRepo
+	Path  string // workflow file path inside the source repo
+	Ref   string // git ref; empty for UsesKindLocalSameRepo
+}
+
+var (
+	reLocalSameRepo  = regexp.MustCompile(`^\./\.(gitea|github)/workflows/([^@]+\.ya?ml)$`)
+	reLocalCrossRepo = regexp.MustCompile(`^([-.\w]+)/([-.\w]+)/\.(gitea|github)/workflows/([^@]+\.ya?ml)@(.+)$`)
+)
+
+// ParseUses parses a reusable workflow "uses:" value.
+// Only two forms are supported:
+//   - "./.gitea/workflows/foo.yml"              (UsesKindLocalSameRepo, no @ref)
+//   - "OWNER/REPO/.gitea/workflows/foo.yml@REF" (UsesKindLocalCrossRepo)
+func ParseUses(s string) (*UsesRef, error) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return nil, errors.New("empty uses value")
+	}
+
+	if strings.HasPrefix(s, "./") {
+		m := reLocalSameRepo.FindStringSubmatch(s)
+		if m == nil {
+			return nil, fmt.Errorf(`invalid local "uses:" %q (expect ./.gitea/workflows/<file>.yml)`, s)
+		}
+		p := fmt.Sprintf(".%s/workflows/%s", m[1], m[2])
+		if path.Clean(p) != p {
+			return nil, fmt.Errorf("invalid workflow path %q", s)
+		}
+		return &UsesRef{Kind: UsesKindLocalSameRepo, Path: p}, nil
+	}
+
+	m := reLocalCrossRepo.FindStringSubmatch(s)
+	if m == nil {
+		return nil, fmt.Errorf(`invalid cross-repo "uses:" %q (expect owner/repo/.gitea/workflows/<file>.yml@ref)`, s)
+	}
+	p := fmt.Sprintf(".%s/workflows/%s", m[3], m[4])
+	if path.Clean(p) != p {
+		return nil, fmt.Errorf("invalid workflow path %q", s)
+	}
+	return &UsesRef{
+		Kind:  UsesKindLocalCrossRepo,
+		Owner: m[1],
+		Repo:  m[2],
+		Path:  p,
+		Ref:   m[5],
+	}, nil
+}
diff --git a/modules/actions/jobparser/uses_test.go b/modules/actions/jobparser/uses_test.go
new file mode 100644
index 00000000000..c6692054dc4
--- /dev/null
+++ b/modules/actions/jobparser/uses_test.go
@@ -0,0 +1,170 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseUses(t *testing.T) {
+	t.Run("LocalSameRepo", func(t *testing.T) {
+		cases := []struct {
+			name string
+			in   string
+			want UsesRef
+		}{
+			{
+				name: "gitea dir, .yml",
+				in:   "./.gitea/workflows/build.yml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/workflows/build.yml"},
+			},
+			{
+				name: "github dir, .yml",
+				in:   "./.github/workflows/build.yml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".github/workflows/build.yml"},
+			},
+			{
+				name: "gitea dir, .yaml",
+				in:   "./.gitea/workflows/build.yaml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/workflows/build.yaml"},
+			},
+			{
+				name: "filename containing dots is allowed",
+				in:   "./.gitea/workflows/foo..bar.yml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/workflows/foo..bar.yml"},
+			},
+			{
+				name: "nested subdirectory",
+				in:   "./.gitea/workflows/sub/build.yml",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/workflows/sub/build.yml"},
+			},
+			{
+				name: "leading/trailing whitespace is trimmed",
+				in:   "  ./.gitea/workflows/build.yml  ",
+				want: UsesRef{Kind: UsesKindLocalSameRepo, Path: ".gitea/workflows/build.yml"},
+			},
+		}
+		for _, c := range cases {
+			t.Run(c.name, func(t *testing.T) {
+				got, err := ParseUses(c.in)
+				require.NoError(t, err)
+				assert.Equal(t, c.want, *got)
+			})
+		}
+	})
+
+	t.Run("LocalCrossRepo", func(t *testing.T) {
+		cases := []struct {
+			name string
+			in   string
+			want UsesRef
+		}{
+			{
+				name: "gitea dir, simple ref",
+				in:   "owner/repo/.gitea/workflows/build.yml@v1",
+				want: UsesRef{
+					Kind:  UsesKindLocalCrossRepo,
+					Owner: "owner",
+					Repo:  "repo",
+					Path:  ".gitea/workflows/build.yml",
+					Ref:   "v1",
+				},
+			},
+			{
+				name: "github dir, branch ref",
+				in:   "owner/repo/.github/workflows/build.yml@main",
+				want: UsesRef{
+					Kind:  UsesKindLocalCrossRepo,
+					Owner: "owner",
+					Repo:  "repo",
+					Path:  ".github/workflows/build.yml",
+					Ref:   "main",
+				},
+			},
+			{
+				name: ".yaml extension",
+				in:   "owner/repo/.gitea/workflows/build.yaml@abc123",
+				want: UsesRef{
+					Kind:  UsesKindLocalCrossRepo,
+					Owner: "owner",
+					Repo:  "repo",
+					Path:  ".gitea/workflows/build.yaml",
+					Ref:   "abc123",
+				},
+			},
+			{
+				name: "ref with slashes (refs/heads/feature)",
+				in:   "owner/repo/.gitea/workflows/build.yml@refs/heads/feature",
+				want: UsesRef{
+					Kind:  UsesKindLocalCrossRepo,
+					Owner: "owner",
+					Repo:  "repo",
+					Path:  ".gitea/workflows/build.yml",
+					Ref:   "refs/heads/feature",
+				},
+			},
+			{
+				name: "nested subdirectory under workflows",
+				in:   "owner/repo/.gitea/workflows/sub/build.yml@v1",
+				want: UsesRef{
+					Kind:  UsesKindLocalCrossRepo,
+					Owner: "owner",
+					Repo:  "repo",
+					Path:  ".gitea/workflows/sub/build.yml",
+					Ref:   "v1",
+				},
+			},
+		}
+		for _, c := range cases {
+			t.Run(c.name, func(t *testing.T) {
+				got, err := ParseUses(c.in)
+				require.NoError(t, err)
+				assert.Equal(t, c.want, *got)
+			})
+		}
+	})
+
+	t.Run("Errors", func(t *testing.T) {
+		cases := []struct {
+			name string
+			in   string
+		}{
+			{name: "empty string", in: ""},
+			{name: "whitespace only", in: "   "},
+
+			// Same-repo malformed
+			{name: "same-repo with @ref", in: "./.gitea/workflows/build.yml@v1"},
+			{name: "same-repo wrong directory", in: "./not-workflows/build.yml"},
+			{name: "same-repo wrong extension", in: "./.gitea/workflows/build.txt"},
+			{name: "same-repo missing extension", in: "./.gitea/workflows/build"},
+			{name: "same-repo absolute path", in: "/.gitea/workflows/build.yml"},
+			{name: "same-repo path traversal", in: "./.gitea/workflows/../escape.yml"},
+			{name: "same-repo double slash", in: "./.gitea/workflows//build.yml"},
+			{name: "same-repo redundant ./", in: "./.gitea/workflows/./build.yml"},
+			{name: "same-repo no filename", in: "./.gitea/workflows/.yml"},
+
+			// Cross-repo malformed
+			{name: "cross-repo missing @ref", in: "owner/repo/.gitea/workflows/build.yml"},
+			{name: "cross-repo empty ref", in: "owner/repo/.gitea/workflows/build.yml@"},
+			{name: "cross-repo missing owner", in: "/repo/.gitea/workflows/build.yml@v1"},
+			{name: "cross-repo missing repo", in: "owner//.gitea/workflows/build.yml@v1"},
+			{name: "cross-repo wrong workflows dir", in: "owner/repo/workflows/build.yml@v1"},
+			{name: "cross-repo wrong extension", in: "owner/repo/.gitea/workflows/build.txt@v1"},
+			{name: "cross-repo path traversal", in: "owner/repo/.gitea/workflows/../escape.yml@v1"},
+			{name: "cross-repo double slash in path", in: "owner/repo/.gitea/workflows//build.yml@v1"},
+			// owner/repo with chars Gitea's name validators reject
+			{name: "cross-repo owner with space", in: "bad owner/repo/.gitea/workflows/build.yml@v1"},
+			{name: "cross-repo repo with @", in: "owner/re@po/.gitea/workflows/build.yml@v1"},
+		}
+		for _, c := range cases {
+			t.Run(c.name, func(t *testing.T) {
+				_, err := ParseUses(c.in)
+				assert.Error(t, err)
+			})
+		}
+	})
+}
diff --git a/modules/actions/jobparser/workflow_call.go b/modules/actions/jobparser/workflow_call.go
new file mode 100644
index 00000000000..7c534dca3c0
--- /dev/null
+++ b/modules/actions/jobparser/workflow_call.go
@@ -0,0 +1,401 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/util"
+
+	"gitea.com/gitea/runner/act/exprparser"
+	"gitea.com/gitea/runner/act/model"
+	"go.yaml.in/yaml/v4"
+)
+
+// InputType enumerates the allowed types for a workflow_call input.
+type InputType string
+
+const (
+	InputTypeString  InputType = "string"
+	InputTypeBoolean InputType = "boolean"
+	InputTypeNumber  InputType = "number"
+)
+
+// InputSpec describes a single workflow_call input declaration.
+type InputSpec struct {
+	Description string    `yaml:"description"`
+	Required    bool      `yaml:"required"`
+	Default     yaml.Node `yaml:"default"`
+	Type        InputType `yaml:"type"`
+}
+
+// SecretSpec describes a single workflow_call secret declaration.
+type SecretSpec struct {
+	Description string `yaml:"description"`
+	Required    bool   `yaml:"required"`
+}
+
+// OutputSpec describes a single workflow_call output declaration.
+type OutputSpec struct {
+	Description string `yaml:"description"`
+	Value       string `yaml:"value"`
+}
+
+// WorkflowCallSpec is the parsed "on.workflow_call" schema of a called workflow.
+type WorkflowCallSpec struct {
+	Inputs  map[string]InputSpec
+	Secrets map[string]SecretSpec
+	Outputs map[string]OutputSpec
+}
+
+// JobOutputs is the per-job-id outputs map used for evaluating workflow_call outputs.
+type JobOutputs map[string]map[string]string
+
+// ParseWorkflowCallSpec extracts on.workflow_call.{inputs,secrets,outputs} from a workflow YAML.
+// Returns an error if the workflow does not declare on.workflow_call at all.
+func ParseWorkflowCallSpec(content []byte) (*WorkflowCallSpec, error) {
+	var doc struct {
+		On yaml.Node `yaml:"on"`
+	}
+	if err := yaml.Unmarshal(content, &doc); err != nil {
+		return nil, fmt.Errorf("parse workflow yaml: %w", err)
+	}
+
+	wcNode, ok := findWorkflowCallNode(&doc.On)
+	if !ok {
+		return nil, errors.New("workflow does not declare on.workflow_call")
+	}
+
+	spec := &WorkflowCallSpec{
+		Inputs:  map[string]InputSpec{},
+		Secrets: map[string]SecretSpec{},
+		Outputs: map[string]OutputSpec{},
+	}
+
+	if wcNode == nil || wcNode.Kind != yaml.MappingNode {
+		return spec, nil
+	}
+
+	for i := 0; i+1 < len(wcNode.Content); i += 2 {
+		key := wcNode.Content[i]
+		val := wcNode.Content[i+1]
+		switch key.Value {
+		case "inputs":
+			if err := decodeWorkflowCallMapping(val, spec.Inputs); err != nil {
+				return nil, fmt.Errorf("parse workflow_call.inputs: %w", err)
+			}
+		case "secrets":
+			if err := decodeWorkflowCallMapping(val, spec.Secrets); err != nil {
+				return nil, fmt.Errorf("parse workflow_call.secrets: %w", err)
+			}
+		case "outputs":
+			if err := decodeWorkflowCallMapping(val, spec.Outputs); err != nil {
+				return nil, fmt.Errorf("parse workflow_call.outputs: %w", err)
+			}
+		}
+	}
+
+	for name, in := range spec.Inputs {
+		if in.Type == "" {
+			return nil, fmt.Errorf("workflow_call input %q is missing required field \"type\"", name)
+		}
+		switch in.Type {
+		case InputTypeString, InputTypeBoolean, InputTypeNumber:
+		default:
+			return nil, fmt.Errorf("workflow_call input %q has unsupported type %q", name, in.Type)
+		}
+	}
+
+	return spec, nil
+}
+
+// findWorkflowCallNode walks the "on:" node and returns the value mapping (or nil) for "workflow_call".
+// "ok" is true when the workflow declares workflow_call (even with an empty body).
+func findWorkflowCallNode(on *yaml.Node) (val *yaml.Node, ok bool) {
+	if on == nil || on.Kind == 0 {
+		return nil, false
+	}
+	switch on.Kind {
+	case yaml.ScalarNode:
+		return nil, on.Value == "workflow_call"
+	case yaml.SequenceNode:
+		for _, item := range on.Content {
+			if item.Kind == yaml.ScalarNode && item.Value == "workflow_call" {
+				return nil, true
+			}
+		}
+		return nil, false
+	case yaml.MappingNode:
+		for i := 0; i+1 < len(on.Content); i += 2 {
+			k := on.Content[i]
+			v := on.Content[i+1]
+			if k.Value != "workflow_call" {
+				continue
+			}
+			if v.Kind == yaml.MappingNode {
+				return v, true
+			}
+			return nil, true
+		}
+	}
+	return nil, false
+}
+
+func decodeWorkflowCallMapping[T any](node *yaml.Node, dst map[string]T) error {
+	if node == nil || node.Kind != yaml.MappingNode {
+		return nil
+	}
+	for i := 0; i+1 < len(node.Content); i += 2 {
+		name := node.Content[i].Value
+		var v T
+		if err := node.Content[i+1].Decode(&v); err != nil {
+			return fmt.Errorf("%q: %w", name, err)
+		}
+		dst[name] = v
+	}
+	return nil
+}
+
+// EvaluateCallerWith evaluates the caller-side expressions in `job.With` against the provided contexts
+func EvaluateCallerWith(
+	jobID string,
+	job *Job,
+	gitCtx map[string]any,
+	results map[string]*JobResult,
+	vars map[string]string,
+	inputs map[string]any,
+) (map[string]any, error) {
+	actJob := &model.Job{Strategy: &model.Strategy{
+		FailFastString:    job.Strategy.FailFastString,
+		MaxParallelString: job.Strategy.MaxParallelString,
+		RawMatrix:         job.Strategy.RawMatrix,
+	}}
+
+	var matrix map[string]any
+	matrixes, err := actJob.GetMatrixes()
+	if err != nil {
+		return nil, fmt.Errorf("get caller %q matrix: %w", jobID, err)
+	}
+	if len(matrixes) > 0 {
+		matrix = matrixes[0]
+	}
+
+	evaluator := NewExpressionEvaluator(NewInterpeter(jobID, actJob, matrix, toGitContext(gitCtx), results, vars, inputs))
+
+	out := make(map[string]any, len(job.With))
+	for k, raw := range job.With {
+		var evaluated any
+		switch v := raw.(type) {
+		case string:
+			node := yaml.Node{}
+			if err := node.Encode(v); err != nil {
+				return nil, fmt.Errorf("encode caller %q with[%q]: %w", jobID, k, err)
+			}
+			if err := evaluator.EvaluateYamlNode(&node); err != nil {
+				return nil, fmt.Errorf("evaluate caller %q with[%q]: %w", jobID, k, err)
+			}
+			if err := node.Decode(&evaluated); err != nil {
+				return nil, fmt.Errorf("decode caller %q with[%q]: %w", jobID, k, err)
+			}
+		default:
+			evaluated = v
+		}
+		out[k] = evaluated
+	}
+	return out, nil
+}
+
+// MatchCallerInputsAgainstSpec checks the caller's already-evaluated `with:` values against the callee's declared `on.workflow_call.inputs` schema
+func MatchCallerInputsAgainstSpec(spec *WorkflowCallSpec, evaluated map[string]any) (map[string]any, error) {
+	resolved := make(map[string]any, len(spec.Inputs))
+
+	// fill defaults first
+	for name, in := range spec.Inputs {
+		if in.Default.IsZero() {
+			continue
+		}
+		var defaultVal any
+		if err := in.Default.Decode(&defaultVal); err != nil {
+			return nil, fmt.Errorf("decode workflow_call input %q default: %w", name, err)
+		}
+		v, err := parseWorkflowCallInput(name, in.Type, defaultVal)
+		if err != nil {
+			return nil, err
+		}
+		resolved[name] = v
+	}
+
+	for k, raw := range evaluated {
+		inputSpec, ok := spec.Inputs[k]
+		if !ok {
+			// ignore unknown "with:" keys
+			continue
+		}
+		converted, err := parseWorkflowCallInput(k, inputSpec.Type, raw)
+		if err != nil {
+			return nil, err
+		}
+		resolved[k] = converted
+	}
+
+	for name, in := range spec.Inputs {
+		if !in.Required {
+			continue
+		}
+		// resolved[name] is set when caller provided it OR when spec has a non-zero default - both satisfy "required".
+		if _, ok := resolved[name]; ok {
+			continue
+		}
+		return nil, fmt.Errorf("workflow_call input %q is required", name)
+	}
+
+	return resolved, nil
+}
+
+func parseWorkflowCallInput(name string, typ InputType, v any) (any, error) {
+	switch typ {
+	case InputTypeString:
+		return toString(v), nil
+	case InputTypeBoolean:
+		// strict type matching: a boolean input only accepts a native bool, not a "true"/"false" string
+		if b, ok := v.(bool); ok {
+			return b, nil
+		}
+		return false, fmt.Errorf("workflow_call input %q expects boolean", name)
+	case InputTypeNumber:
+		// strict type matching: a number input rejects "123"/"3.14" strings.
+		if _, isString := v.(string); isString {
+			return 0.0, fmt.Errorf("workflow_call input %q expects number", name)
+		}
+		return util.ToFloat64(v)
+	default:
+		return nil, fmt.Errorf("workflow_call input %q has unsupported type %q", name, typ)
+	}
+}
+
+// SecretsInherit is the literal keyword used in a caller's `secrets: inherit` directive
+const SecretsInherit = "inherit"
+
+// callerSecretValueRegexp matches the `${{ secrets.NAME }}` form expected for each value in a caller's `secrets:` mapping.
+var callerSecretValueRegexp = regexp.MustCompile(`^\s*\$\{\{\s*secrets\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}\s*$`)
+
+// ParseCallerSecrets decodes a caller's "secrets:" YAML node into one of two forms:
+//   - inherit == true: the caller wrote `secrets: inherit`; mapping is nil
+//   - inherit == false, mapping == {alias: source_name}: explicit mapping. Each value must be of the form `${{ secrets.NAME }}`.
+//
+// Both alias and source name are upper-cased: secret names are case-insensitive (matching GitHub),
+// and Gitea stores secrets upper-cased, so this keeps lookups and schema validation consistent.
+func ParseCallerSecrets(node yaml.Node) (inherit bool, mapping map[string]string, err error) {
+	if node.IsZero() {
+		return false, nil, nil
+	}
+	if node.Kind == yaml.ScalarNode && strings.TrimSpace(node.Value) == SecretsInherit {
+		return true, nil, nil
+	}
+	if node.Kind != yaml.MappingNode {
+		return false, nil, errors.New("invalid secrets: section, expected mapping or 'inherit'")
+	}
+	out := make(map[string]string, len(node.Content)/2)
+	for i := 0; i+1 < len(node.Content); i += 2 {
+		k := node.Content[i]
+		v := node.Content[i+1]
+		var sv string
+		if err := v.Decode(&sv); err != nil {
+			return false, nil, fmt.Errorf("decode secret %q: %w", k.Value, err)
+		}
+		matches := callerSecretValueRegexp.FindStringSubmatch(sv)
+		if len(matches) != 2 {
+			return false, nil, fmt.Errorf("caller secret %q value must be of the form ${{ secrets.NAME }}", k.Value)
+		}
+		out[strings.ToUpper(k.Value)] = strings.ToUpper(matches[1])
+	}
+	return false, out, nil
+}
+
+// ValidateCallerSecrets checks a caller's parsed explicit-mapping `secrets:` against the called workflow's declared `on.workflow_call.secrets` schema.
+func ValidateCallerSecrets(spec *WorkflowCallSpec, mapping map[string]string) error {
+	if spec == nil {
+		return errors.New("ValidateCallerSecrets: nil workflow_call spec")
+	}
+	// Secret names are case-insensitive, so compare declared names and caller aliases upper-cased.
+	declaredNames := make(container.Set[string], len(spec.Secrets))
+	for name := range spec.Secrets {
+		declaredNames.Add(strings.ToUpper(name))
+	}
+	provided := make(container.Set[string], len(mapping))
+	for alias := range mapping {
+		up := strings.ToUpper(alias)
+		provided.Add(up)
+		if !declaredNames.Contains(up) {
+			return fmt.Errorf("caller secret %q is not declared in the called workflow's on.workflow_call.secrets", alias)
+		}
+	}
+	for name, sec := range spec.Secrets {
+		if sec.Required && !provided.Contains(strings.ToUpper(name)) {
+			return fmt.Errorf("required secret %q is not provided by the caller", name)
+		}
+	}
+	return nil
+}
+
+// EvaluateWorkflowCallOutputs evaluates a called workflow's "on.workflow_call.outputs.<name>.value" expressions against the provided contexts.
+func EvaluateWorkflowCallOutputs(spec *WorkflowCallSpec, gitCtx *model.GithubContext, vars map[string]string, inputs map[string]any, jobOutputs JobOutputs) (map[string]string, error) {
+	if spec == nil || len(spec.Outputs) == 0 {
+		return map[string]string{}, nil
+	}
+
+	jobsCtx := make(map[string]*model.WorkflowCallResult, len(jobOutputs))
+	for jobID, outputs := range jobOutputs {
+		jobsCtx[jobID] = &model.WorkflowCallResult{Outputs: outputs}
+	}
+
+	// See `on.workflow_call.outputs.<output_id>.value` in https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#context-availability
+	env := &exprparser.EvaluationEnvironment{
+		Github: gitCtx,
+		Jobs:   &jobsCtx,
+		Vars:   vars,
+		Inputs: inputs,
+	}
+	interpreter := exprparser.NewInterpeter(env, exprparser.Config{})
+
+	out := make(map[string]string, len(spec.Outputs))
+	for name, o := range spec.Outputs {
+		v, err := evaluateWorkflowCallOutputValue(interpreter, o.Value)
+		if err != nil {
+			return nil, fmt.Errorf("workflow_call output %q: %w", name, err)
+		}
+		out[name] = v
+	}
+	return out, nil
+}
+
+func evaluateWorkflowCallOutputValue(interpreter exprparser.Interpreter, value string) (string, error) {
+	if !strings.Contains(value, "${{") || !strings.Contains(value, "}}") {
+		return value, nil
+	}
+	expr, err := rewriteSubExpression(value, true)
+	if err != nil {
+		return "", err
+	}
+	evaluated, err := interpreter.Evaluate(expr, exprparser.DefaultStatusCheckNone)
+	if err != nil {
+		return "", err
+	}
+	return toString(evaluated), nil
+}
+
+func toString(v any) string {
+	switch s := v.(type) {
+	case string:
+		return s
+	case nil:
+		return ""
+	default:
+		return fmt.Sprintf("%v", s)
+	}
+}
diff --git a/modules/actions/jobparser/workflow_call_test.go b/modules/actions/jobparser/workflow_call_test.go
new file mode 100644
index 00000000000..6777d8173ab
--- /dev/null
+++ b/modules/actions/jobparser/workflow_call_test.go
@@ -0,0 +1,471 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package jobparser
+
+import (
+	"maps"
+	"testing"
+
+	"gitea.com/gitea/runner/act/model"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v4"
+)
+
+func TestParseWorkflowCallSpec(t *testing.T) {
+	t.Run("malformed YAML surfaces a parse error", func(t *testing.T) {
+		// Mismatched flow-sequence brackets — yaml.Unmarshal must reject this.
+		_, err := ParseWorkflowCallSpec([]byte(`name: bad
+on: [workflow_call
+jobs:
+  noop: { }
+`))
+		require.Error(t, err)
+	})
+
+	t.Run("workflow without on.workflow_call is rejected", func(t *testing.T) {
+		notCallable := []byte(`name: ordinary
+on: push
+jobs:
+  noop:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo
+`)
+		_, err := ParseWorkflowCallSpec(notCallable)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "does not declare on.workflow_call")
+	})
+
+	t.Run("input missing the required type field is rejected", func(t *testing.T) {
+		content := callableWorkflow(t, `inputs:
+      x:
+        description: missing type
+`)
+		_, err := ParseWorkflowCallSpec(content)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `missing required field "type"`)
+	})
+
+	t.Run("inputs/secrets/outputs are decoded", func(t *testing.T) {
+		content := callableWorkflow(t, `inputs:
+      env:
+        type: string
+        required: true
+    secrets:
+      DEPLOY_KEY:
+        required: true
+    outputs:
+      sha:
+        value: ${{ jobs.build.outputs.commit }}
+`)
+		spec, err := ParseWorkflowCallSpec(content)
+		require.NoError(t, err)
+		assert.Equal(t, InputTypeString, spec.Inputs["env"].Type)
+		assert.True(t, spec.Inputs["env"].Required)
+		assert.True(t, spec.Secrets["DEPLOY_KEY"].Required)
+		assert.Equal(t, "${{ jobs.build.outputs.commit }}", spec.Outputs["sha"].Value)
+	})
+}
+
+func TestEvaluateCallerWith(t *testing.T) {
+	t.Run("empty with: returns empty map", func(t *testing.T) {
+		out, err := EvaluateCallerWith("caller", &Job{}, nil, callerResults("caller", nil, nil), nil, nil)
+		require.NoError(t, err)
+		assert.Empty(t, out)
+	})
+
+	t.Run("non-string raw values pass through unchanged", func(t *testing.T) {
+		job := &Job{With: map[string]any{
+			"already_bool":  true,
+			"already_int":   42,
+			"already_slice": []any{"a", "b"},
+		}}
+		out, err := EvaluateCallerWith("caller", job, nil, callerResults("caller", nil, nil), nil, nil)
+		require.NoError(t, err)
+		assert.Equal(t, true, out["already_bool"])
+		assert.Equal(t, 42, out["already_int"])
+		assert.Equal(t, []any{"a", "b"}, out["already_slice"])
+	})
+
+	t.Run("expressions resolve against vars/inputs/results", func(t *testing.T) {
+		job := &Job{With: map[string]any{
+			"env_name":    "${{ vars.ENV }}",
+			"from_inputs": "${{ inputs.PARENT_VAR }}",
+			"from_needs":  "${{ needs.upstream.outputs.commit }}",
+		}}
+		gitCtx := map[string]any{"event": map[string]any{}}
+		results := callerResults("caller", []string{"upstream"}, map[string]*JobResult{
+			"upstream": {Result: "success", Outputs: map[string]string{"commit": "abc123"}},
+		})
+		vars := map[string]string{"ENV": "staging"}
+		inputs := map[string]any{"PARENT_VAR": "from-parent"}
+		out, err := EvaluateCallerWith("caller", job, gitCtx, results, vars, inputs)
+		require.NoError(t, err)
+		assert.Equal(t, "staging", out["env_name"])
+		assert.Equal(t, "from-parent", out["from_inputs"])
+		assert.Equal(t, "abc123", out["from_needs"])
+	})
+
+	t.Run("matrix.X resolves to this caller row's matrix instance", func(t *testing.T) {
+		var rawMatrix yaml.Node
+		require.NoError(t, rawMatrix.Encode(map[string][]any{"target": {"staging"}}))
+		job := &Job{
+			With:     map[string]any{"env": "${{ matrix.target }}"},
+			Strategy: Strategy{RawMatrix: rawMatrix},
+		}
+		out, err := EvaluateCallerWith("caller", job, nil, callerResults("caller", nil, nil), nil, nil)
+		require.NoError(t, err)
+		assert.Equal(t, "staging", out["env"])
+	})
+}
+
+func TestMatchCallerInputsAgainstSpec(t *testing.T) {
+	// mustParseSpec wraps ParseWorkflowCallSpec for test brevity.
+	mustParseSpec := func(t *testing.T, content []byte) *WorkflowCallSpec {
+		t.Helper()
+		spec, err := ParseWorkflowCallSpec(content)
+		require.NoError(t, err)
+		return spec
+	}
+
+	t.Run("default is filled when caller does not provide the input", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      greeting:
+        type: string
+        default: hi
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, nil)
+		require.NoError(t, err)
+		assert.Equal(t, map[string]any{"greeting": "hi"}, out)
+	})
+
+	t.Run("caller-provided value wins over default", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      greeting:
+        type: string
+        default: hi
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, map[string]any{"greeting": "hello"})
+		require.NoError(t, err)
+		assert.Equal(t, map[string]any{"greeting": "hello"}, out)
+	})
+
+	t.Run("required input must be provided", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      target:
+        type: string
+        required: true
+`))
+		_, err := MatchCallerInputsAgainstSpec(spec, nil)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `"target" is required`)
+	})
+
+	t.Run("required input is satisfied by a default value", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      target:
+        type: string
+        required: true
+        default: prod
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, nil)
+		require.NoError(t, err)
+		assert.Equal(t, map[string]any{"target": "prod"}, out)
+	})
+
+	t.Run("boolean inputs accept native bool values and bool defaults", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      flag1:
+        type: boolean
+      flag2:
+        type: boolean
+        default: true
+      flag3:
+        type: boolean
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, map[string]any{
+			"flag1": true,
+			"flag3": false,
+		})
+		require.NoError(t, err)
+		assert.Equal(t, true, out["flag1"])
+		assert.Equal(t, true, out["flag2"]) // from default
+		assert.Equal(t, false, out["flag3"])
+	})
+
+	t.Run("boolean input rejects strings", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      flag:
+        type: boolean
+`))
+		_, err := MatchCallerInputsAgainstSpec(spec, map[string]any{"flag": "true"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "expects boolean")
+	})
+
+	t.Run("number inputs accept native numeric values and number defaults", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      count:
+        type: number
+      ratio:
+        type: number
+        default: 0.5
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, map[string]any{"count": 42})
+		require.NoError(t, err)
+		assert.InDelta(t, 42.0, out["count"], 0)
+		assert.InDelta(t, 0.5, out["ratio"], 0)
+	})
+
+	t.Run("number input rejects strings", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      count:
+        type: number
+`))
+		_, err := MatchCallerInputsAgainstSpec(spec, map[string]any{"count": "42"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "expects number")
+	})
+
+	t.Run("unknown caller-with key is silently dropped", func(t *testing.T) {
+		spec := mustParseSpec(t, callableWorkflow(t, `inputs:
+      known:
+        type: string
+        default: ok
+`))
+		out, err := MatchCallerInputsAgainstSpec(spec, map[string]any{
+			"known":   "yes",
+			"unknown": "ignored",
+		})
+		require.NoError(t, err)
+		assert.Equal(t, map[string]any{"known": "yes"}, out)
+	})
+}
+
+func TestParseCallerSecrets(t *testing.T) {
+	// secretYAMLNode unmarshals raw YAML text into a yaml.Node so tests can hand it to ParseCallerSecrets.
+	secretYAMLNode := func(t *testing.T, s string) yaml.Node {
+		t.Helper()
+		var node yaml.Node
+		require.NoError(t, yaml.Unmarshal([]byte(s), &node))
+		// yaml.Unmarshal wraps content in a DocumentNode; the meaningful node is the first child.
+		if node.Kind == yaml.DocumentNode && len(node.Content) > 0 {
+			return *node.Content[0]
+		}
+		return node
+	}
+
+	t.Run("zero node returns no inherit, no mapping", func(t *testing.T) {
+		inherit, mapping, err := ParseCallerSecrets(yaml.Node{})
+		require.NoError(t, err)
+		assert.False(t, inherit)
+		assert.Nil(t, mapping)
+	})
+
+	t.Run("\"inherit\" scalar sets inherit=true", func(t *testing.T) {
+		inherit, mapping, err := ParseCallerSecrets(secretYAMLNode(t, `inherit`))
+		require.NoError(t, err)
+		assert.True(t, inherit)
+		assert.Nil(t, mapping)
+	})
+
+	t.Run("non-inherit scalar is rejected", func(t *testing.T) {
+		_, _, err := ParseCallerSecrets(secretYAMLNode(t, `something-else`))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "expected mapping or 'inherit'")
+	})
+
+	t.Run("mapping of secrets-style references is parsed", func(t *testing.T) {
+		inherit, mapping, err := ParseCallerSecrets(secretYAMLNode(t, `
+DEPLOY_KEY: ${{ secrets.GITEA_DEPLOY_KEY }}
+DB_PASS:    ${{ secrets.PROD_DB_PASS }}
+`))
+		require.NoError(t, err)
+		assert.False(t, inherit)
+		assert.Equal(t, map[string]string{
+			"DEPLOY_KEY": "GITEA_DEPLOY_KEY",
+			"DB_PASS":    "PROD_DB_PASS",
+		}, mapping)
+	})
+
+	t.Run("alias and source names are upper-cased", func(t *testing.T) {
+		inherit, mapping, err := ParseCallerSecrets(secretYAMLNode(t, `
+deploy_key: ${{ secrets.gitea_deploy_key }}
+`))
+		require.NoError(t, err)
+		assert.False(t, inherit)
+		assert.Equal(t, map[string]string{"DEPLOY_KEY": "GITEA_DEPLOY_KEY"}, mapping)
+	})
+
+	t.Run("mapping value not in ${{ secrets.NAME }} form is rejected", func(t *testing.T) {
+		// plain string
+		_, _, err := ParseCallerSecrets(secretYAMLNode(t, `KEY: not-an-expression`))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `must be of the form ${{ secrets.NAME }}`)
+
+		// expression but referencing the wrong context (vars instead of secrets)
+		_, _, err = ParseCallerSecrets(secretYAMLNode(t, `KEY: ${{ vars.NAME }}`))
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `must be of the form ${{ secrets.NAME }}`)
+	})
+}
+
+func TestValidateCallerSecrets(t *testing.T) {
+	specWith := func(secrets map[string]SecretSpec) *WorkflowCallSpec {
+		return &WorkflowCallSpec{Secrets: secrets}
+	}
+
+	t.Run("explicit mapping with all required + only declared aliases is accepted", func(t *testing.T) {
+		spec := specWith(map[string]SecretSpec{
+			"DEPLOY_KEY": {Required: true},
+			"OPTIONAL":   {},
+		})
+		mapping := map[string]string{
+			"DEPLOY_KEY": "PROD_DEPLOY_KEY",
+			"OPTIONAL":   "SOMETHING_ELSE",
+		}
+		require.NoError(t, ValidateCallerSecrets(spec, mapping))
+	})
+
+	t.Run("alias not in callee schema is rejected", func(t *testing.T) {
+		spec := specWith(map[string]SecretSpec{"DEPLOY_KEY": {}})
+		mapping := map[string]string{
+			"DEPLOY_KEY": "PROD_DEPLOY_KEY",
+			"EXTRA":      "SOMETHING_NOT_DECLARED",
+		}
+		err := ValidateCallerSecrets(spec, mapping)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `caller secret "EXTRA"`)
+		assert.Contains(t, err.Error(), `not declared`)
+	})
+
+	t.Run("missing required secret is rejected", func(t *testing.T) {
+		spec := specWith(map[string]SecretSpec{
+			"MUST_HAVE": {Required: true},
+			"OPTIONAL":  {},
+		})
+		mapping := map[string]string{"OPTIONAL": "X"}
+		err := ValidateCallerSecrets(spec, mapping)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `required secret "MUST_HAVE"`)
+		assert.Contains(t, err.Error(), `not provided`)
+	})
+
+	t.Run("callee with no secrets schema accepts an empty mapping", func(t *testing.T) {
+		spec := specWith(map[string]SecretSpec{})
+		require.NoError(t, ValidateCallerSecrets(spec, nil))
+		require.NoError(t, ValidateCallerSecrets(spec, map[string]string{}))
+	})
+
+	t.Run("callee with no secrets schema rejects a non-empty mapping", func(t *testing.T) {
+		spec := specWith(map[string]SecretSpec{})
+		err := ValidateCallerSecrets(spec, map[string]string{"X": "Y"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `caller secret "X"`)
+	})
+
+	t.Run("name matching is case-insensitive", func(t *testing.T) {
+		// declared name and caller alias differ only in case; both should match.
+		spec := specWith(map[string]SecretSpec{"deploy_key": {Required: true}})
+		mapping := map[string]string{"DEPLOY_KEY": "PROD_DEPLOY_KEY"}
+		require.NoError(t, ValidateCallerSecrets(spec, mapping))
+	})
+
+	t.Run("nil spec is rejected", func(t *testing.T) {
+		err := ValidateCallerSecrets(nil, map[string]string{"X": "Y"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "nil workflow_call spec")
+	})
+}
+
+func TestEvaluateWorkflowCallOutputs(t *testing.T) {
+	t.Run("nil spec returns empty map", func(t *testing.T) {
+		out, err := EvaluateWorkflowCallOutputs(nil, &model.GithubContext{}, nil, nil, nil)
+		require.NoError(t, err)
+		assert.Empty(t, out)
+	})
+
+	t.Run("spec with no outputs returns empty map", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{}}
+		out, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, nil, nil, nil)
+		require.NoError(t, err)
+		assert.Empty(t, out)
+	})
+
+	t.Run("plain string value passes through unchanged", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{
+			"name": {Value: "static-value"},
+		}}
+		out, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, nil, nil, nil)
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{"name": "static-value"}, out)
+	})
+
+	t.Run("output references jobs.<id>.outputs.<name>", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{
+			"sha": {Value: "${{ jobs.build.outputs.commit }}"},
+		}}
+		jobOutputs := JobOutputs{
+			"build": {"commit": "deadbeef"},
+		}
+		out, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, nil, nil, jobOutputs)
+		require.NoError(t, err)
+		assert.Equal(t, "deadbeef", out["sha"])
+	})
+
+	t.Run("output references inputs.<name>", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{
+			"target": {Value: "${{ inputs.env_name }}"},
+		}}
+		inputs := map[string]any{"env_name": "staging"}
+		out, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, nil, inputs, nil)
+		require.NoError(t, err)
+		assert.Equal(t, "staging", out["target"])
+	})
+
+	t.Run("multiple outputs are all evaluated", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{
+			"static":  {Value: "static-value"},
+			"dynamic": {Value: "${{ vars.SUFFIX }}"},
+		}}
+		vars := map[string]string{"SUFFIX": "abc"}
+		out, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, vars, nil, nil)
+		require.NoError(t, err)
+		assert.Equal(t, "static-value", out["static"])
+		assert.Equal(t, "abc", out["dynamic"])
+	})
+
+	t.Run("expression referencing an undefined symbol surfaces an error", func(t *testing.T) {
+		spec := &WorkflowCallSpec{Outputs: map[string]OutputSpec{
+			"bad": {Value: "${{ this.is.not.valid() }}"},
+		}}
+		_, err := EvaluateWorkflowCallOutputs(spec, &model.GithubContext{}, nil, nil, nil)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), `output "bad"`)
+	})
+}
+
+// callableWorkflow returns a minimal valid called-workflow YAML with on.workflow_call.
+func callableWorkflow(t *testing.T, body string) []byte {
+	t.Helper()
+	return []byte(`name: callable
+on:
+  workflow_call:
+    ` + body + `
+jobs:
+  noop:
+    runs-on: ubuntu-latest
+    steps:
+      - run: "echo"
+`)
+}
+
+// callerResults returns the minimum results map shape that NewInterpeter expects
+func callerResults(callerJobID string, callerNeeds []string, deps map[string]*JobResult) map[string]*JobResult {
+	out := make(map[string]*JobResult, len(deps)+1)
+	maps.Copy(out, deps)
+	out[callerJobID] = &JobResult{Needs: callerNeeds}
+	return out
+}
diff --git a/modules/actions/log.go b/modules/actions/log.go
index 3fb56b402ab..3fbdf4cdeb7 100644
--- a/modules/actions/log.go
+++ b/modules/actions/log.go
@@ -12,12 +12,12 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/dbfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/zstd"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	"gitea.dev/models/dbfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/zstd"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
diff --git a/modules/actions/task_state.go b/modules/actions/task_state.go
index 1f36e021a59..cb7f5724fe1 100644
--- a/modules/actions/task_state.go
+++ b/modules/actions/task_state.go
@@ -4,7 +4,7 @@
 package actions
 
 import (
-	actions_model "code.gitea.io/gitea/models/actions"
+	actions_model "gitea.dev/models/actions"
 )
 
 const (
diff --git a/modules/actions/task_state_test.go b/modules/actions/task_state_test.go
index ff0fd571951..7b8087a1475 100644
--- a/modules/actions/task_state_test.go
+++ b/modules/actions/task_state_test.go
@@ -6,7 +6,7 @@ package actions
 import (
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
+	actions_model "gitea.dev/models/actions"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/actions/workflowpattern/workflow_pattern.go b/modules/actions/workflowpattern/workflow_pattern.go
new file mode 100644
index 00000000000..c5eb1fb5750
--- /dev/null
+++ b/modules/actions/workflowpattern/workflow_pattern.go
@@ -0,0 +1,65 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package workflowpattern
+
+import (
+	"strings"
+
+	"gitea.dev/modules/glob"
+)
+
+type WorkflowPattern struct {
+	negative bool
+	glob     glob.Glob
+}
+
+func CompilePatterns(patterns ...string) ([]*WorkflowPattern, error) {
+	ret := make([]*WorkflowPattern, 0, len(patterns))
+	for _, pattern := range patterns {
+		cp, err := glob.CompileWorkflow(pattern)
+		if err != nil {
+			return nil, err
+		}
+		ret = append(ret, &WorkflowPattern{glob: cp, negative: strings.HasPrefix(pattern, "!")})
+	}
+	return ret, nil
+}
+
+// Skip returns true if the workflow should be skipped per paths/branches semantics.
+func Skip(sequence []*WorkflowPattern, input []string) bool {
+	allSkipped := true
+	for _, file := range input {
+		shouldSkip := true
+		for _, item := range sequence {
+			if item.negative {
+				// "!README.md" doesn't match "README.md", so "README.md" should be skipped
+				// "!README.md" matches "help.md" but it shouldn't affect "skip or not", because "help.md" might have been skipped by other rules like "docs/*.md"
+				if !item.glob.Match(file) {
+					shouldSkip = true
+				}
+			} else if item.glob.Match(file) {
+				// if "*.md" matches "help.md" so it shouldn't be skipped
+				shouldSkip = false
+			}
+		}
+		allSkipped = allSkipped && shouldSkip
+	}
+	return len(sequence) > 0 && allSkipped
+}
+
+// Filter returns true if the workflow should be skipped per paths-ignore/branches-ignore semantics.
+func Filter(sequence []*WorkflowPattern, input []string) bool {
+	for _, file := range input {
+		anyMatched := false
+		for _, item := range sequence {
+			if anyMatched = item.glob.Match(file); anyMatched {
+				break
+			}
+		}
+		if !anyMatched {
+			return false
+		}
+	}
+	return len(sequence) != 0
+}
diff --git a/modules/actions/workflowpattern/workflow_pattern_test.go b/modules/actions/workflowpattern/workflow_pattern_test.go
new file mode 100644
index 00000000000..59a38326342
--- /dev/null
+++ b/modules/actions/workflowpattern/workflow_pattern_test.go
@@ -0,0 +1,416 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package workflowpattern
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMatchPattern(t *testing.T) {
+	kases := []struct {
+		inputs       []string
+		patterns     []string
+		skipResult   bool
+		filterResult bool
+	}{
+		{
+			patterns:     []string{"*"},
+			inputs:       []string{"path/with/slash"},
+			skipResult:   true,
+			filterResult: false,
+		},
+		{
+			patterns:     []string{"path/a", "path/b", "path/c"},
+			inputs:       []string{"meta", "path/b", "otherfile"},
+			skipResult:   false,
+			filterResult: false,
+		},
+		{
+			patterns:     []string{"path/a", "path/b", "path/c"},
+			inputs:       []string{"path/b"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"path/a", "path/b", "path/c"},
+			inputs:       []string{"path/c", "path/b"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"path/a", "path/b", "path/c"},
+			inputs:       []string{"path/c", "path/b", "path/a"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"path/a", "path/b", "path/c"},
+			inputs:       []string{"path/c", "path/b", "path/d", "path/a"},
+			skipResult:   false,
+			filterResult: false,
+		},
+		{
+			patterns:     []string{},
+			inputs:       []string{},
+			skipResult:   false,
+			filterResult: false,
+		},
+		{
+			patterns:     []string{"\\!file"},
+			inputs:       []string{"!file"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"escape\\\\backslash"},
+			inputs:       []string{"escape\\backslash"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{".yml"},
+			inputs:       []string{"fyml"},
+			skipResult:   true,
+			filterResult: false,
+		},
+		// https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#patterns-to-match-branches-and-tags
+		{
+			patterns:     []string{"feature/*"},
+			inputs:       []string{"feature/my-branch"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"feature/*"},
+			inputs:       []string{"feature/your-branch"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"feature/**"},
+			inputs:       []string{"feature/beta-a/my-branch"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"feature/**"},
+			inputs:       []string{"feature/beta-a/my-branch"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"feature/**"},
+			inputs:       []string{"feature/mona/the/octocat"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"main", "releases/mona-the-octocat"},
+			inputs:       []string{"main"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"main", "releases/mona-the-octocat"},
+			inputs:       []string{"releases/mona-the-octocat"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*"},
+			inputs:       []string{"main"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*"},
+			inputs:       []string{"releases"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**"},
+			inputs:       []string{"all/the/branches"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**"},
+			inputs:       []string{"every/tag"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*feature"},
+			inputs:       []string{"mona-feature"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*feature"},
+			inputs:       []string{"feature"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*feature"},
+			inputs:       []string{"ver-10-feature"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"v2*"},
+			inputs:       []string{"v2"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"v2*"},
+			inputs:       []string{"v2.0"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"v2*"},
+			inputs:       []string{"v2.9"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"v[12].[0-9]+.[0-9]+"},
+			inputs:       []string{"v1.10.1"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"v[12].[0-9]+.[0-9]+"},
+			inputs:       []string{"v2.0.0"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		// https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#patterns-to-match-file-paths
+		{
+			patterns:     []string{"*"},
+			inputs:       []string{"README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*"},
+			inputs:       []string{"server.rb"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.jsx?"},
+			inputs:       []string{"page.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.jsx?"},
+			inputs:       []string{"page.jsx"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**"},
+			inputs:       []string{"all/the/files.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.js"},
+			inputs:       []string{"app.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.js"},
+			inputs:       []string{"index.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**.js"},
+			inputs:       []string{"index.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**.js"},
+			inputs:       []string{"js/index.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**.js"},
+			inputs:       []string{"src/js/app.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/*"},
+			inputs:       []string{"docs/README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/*"},
+			inputs:       []string{"docs/file.txt"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/**"},
+			inputs:       []string{"docs/README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/**"},
+			inputs:       []string{"docs/mona/octocat.txt"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/**/*.md"},
+			inputs:       []string{"docs/README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/**/*.md"},
+			inputs:       []string{"docs/mona/hello-world.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"docs/**/*.md"},
+			inputs:       []string{"docs/a/markdown/file.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/docs/**"},
+			inputs:       []string{"docs/hello.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/docs/**"},
+			inputs:       []string{"dir/docs/my-file.txt"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/docs/**"},
+			inputs:       []string{"space/docs/plan/space.doc"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/README.md"},
+			inputs:       []string{"README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/README.md"},
+			inputs:       []string{"js/README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/*src/**"},
+			inputs:       []string{"a/src/app.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/*src/**"},
+			inputs:       []string{"my-src/code/js/app.js"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/*-post.md"},
+			inputs:       []string{"my-post.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/*-post.md"},
+			inputs:       []string{"path/their-post.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/migrate-*.sql"},
+			inputs:       []string{"migrate-10909.sql"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/migrate-*.sql"},
+			inputs:       []string{"db/migrate-v1.0.sql"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"**/migrate-*.sql"},
+			inputs:       []string{"db/sept/migrate-v1.sql"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md"},
+			inputs:       []string{"hello.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md"},
+			inputs:       []string{"README.md"},
+			skipResult:   true,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md"},
+			inputs:       []string{"docs/hello.md"},
+			skipResult:   true,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md", "README*"},
+			inputs:       []string{"hello.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md", "README*"},
+			inputs:       []string{"README.md"},
+			skipResult:   false,
+			filterResult: true,
+		},
+		{
+			patterns:     []string{"*.md", "!README.md", "README*"},
+			inputs:       []string{"README.doc"},
+			skipResult:   false,
+			filterResult: true,
+		},
+	}
+
+	for _, kase := range kases {
+		msg := fmt.Sprintf("patterns=%s, input=%s", strings.Join(kase.patterns, ","), strings.Join(kase.inputs, ","))
+		patterns, err := CompilePatterns(kase.patterns...)
+		assert.NoError(t, err, "compile error: %s", msg)
+		assert.Equal(t, kase.skipResult, Skip(patterns, kase.inputs), "unexpected skip result: %s", msg)
+		assert.Equal(t, kase.filterResult, Filter(patterns, kase.inputs), "unexpected filter result: %s", msg)
+	}
+}
diff --git a/modules/actions/workflows.go b/modules/actions/workflows.go
index ba1aee7d72f..28dc45dc7a2 100644
--- a/modules/actions/workflows.go
+++ b/modules/actions/workflows.go
@@ -8,17 +8,17 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/modules/actions/jobparser"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/actions/workflowpattern"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 
-	"github.com/nektos/act/pkg/model"
-	"github.com/nektos/act/pkg/workflowpattern"
+	"gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -297,7 +297,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Skip(patterns, []string{refName.BranchName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Skip(patterns, []string{refName.BranchName()}) {
 				matchTimes++
 			}
 		case "branches-ignore":
@@ -309,7 +309,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Filter(patterns, []string{refName.BranchName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Filter(patterns, []string{refName.BranchName()}) {
 				matchTimes++
 			}
 		case "tags":
@@ -321,7 +321,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Skip(patterns, []string{refName.TagName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Skip(patterns, []string{refName.TagName()}) {
 				matchTimes++
 			}
 		case "tags-ignore":
@@ -333,7 +333,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Filter(patterns, []string{refName.TagName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Filter(patterns, []string{refName.TagName()}) {
 				matchTimes++
 			}
 		case "paths":
@@ -349,7 +349,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 				if err != nil {
 					break
 				}
-				if !workflowpattern.Skip(patterns, filesChanged, &workflowpattern.EmptyTraceWriter{}) {
+				if !workflowpattern.Skip(patterns, filesChanged) {
 					matchTimes++
 				}
 			}
@@ -366,7 +366,7 @@ func matchPushEvent(commit *git.Commit, pushPayload *api.PushPayload, evt *jobpa
 				if err != nil {
 					break
 				}
-				if !workflowpattern.Filter(patterns, filesChanged, &workflowpattern.EmptyTraceWriter{}) {
+				if !workflowpattern.Filter(patterns, filesChanged) {
 					matchTimes++
 				}
 			}
@@ -492,7 +492,7 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Skip(patterns, []string{refName.ShortName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Skip(patterns, []string{refName.ShortName()}) {
 				matchTimes++
 			}
 		case "branches-ignore":
@@ -501,7 +501,7 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Filter(patterns, []string{refName.ShortName()}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Filter(patterns, []string{refName.ShortName()}) {
 				matchTimes++
 			}
 		case "paths":
@@ -513,7 +513,7 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 				if err != nil {
 					break
 				}
-				if !workflowpattern.Skip(patterns, filesChanged, &workflowpattern.EmptyTraceWriter{}) {
+				if !workflowpattern.Skip(patterns, filesChanged) {
 					matchTimes++
 				}
 			}
@@ -526,7 +526,7 @@ func matchPullRequestEvent(gitRepo *git.Repository, commit *git.Commit, prPayloa
 				if err != nil {
 					break
 				}
-				if !workflowpattern.Filter(patterns, filesChanged, &workflowpattern.EmptyTraceWriter{}) {
+				if !workflowpattern.Filter(patterns, filesChanged) {
 					matchTimes++
 				}
 			}
@@ -747,7 +747,7 @@ func matchWorkflowRunEvent(payload *api.WorkflowRunPayload, evt *jobparser.Event
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Skip(patterns, []string{workflow.Name}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Skip(patterns, []string{workflow.Name}) {
 				matchTimes++
 			}
 		case "branches":
@@ -755,7 +755,7 @@ func matchWorkflowRunEvent(payload *api.WorkflowRunPayload, evt *jobparser.Event
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Skip(patterns, []string{payload.WorkflowRun.HeadBranch}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Skip(patterns, []string{payload.WorkflowRun.HeadBranch}) {
 				matchTimes++
 			}
 		case "branches-ignore":
@@ -763,7 +763,7 @@ func matchWorkflowRunEvent(payload *api.WorkflowRunPayload, evt *jobparser.Event
 			if err != nil {
 				break
 			}
-			if !workflowpattern.Filter(patterns, []string{payload.WorkflowRun.HeadBranch}, &workflowpattern.EmptyTraceWriter{}) {
+			if !workflowpattern.Filter(patterns, []string{payload.WorkflowRun.HeadBranch}) {
 				matchTimes++
 			}
 		default:
diff --git a/modules/actions/workflows_test.go b/modules/actions/workflows_test.go
index cda2de13e28..aec7144783c 100644
--- a/modules/actions/workflows_test.go
+++ b/modules/actions/workflows_test.go
@@ -6,11 +6,11 @@ package actions
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/assetfs/embed.go b/modules/assetfs/embed.go
index 7c90e3aca21..99a6e5e6242 100644
--- a/modules/assetfs/embed.go
+++ b/modules/assetfs/embed.go
@@ -15,8 +15,8 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
 )
 
 type EmbeddedFile interface {
diff --git a/modules/assetfs/layered.go b/modules/assetfs/layered.go
index 380c3ac4551..5ee585afa13 100644
--- a/modules/assetfs/layered.go
+++ b/modules/assetfs/layered.go
@@ -14,10 +14,10 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/util"
 
 	"github.com/fsnotify/fsnotify"
 )
diff --git a/modules/auth/common.go b/modules/auth/common.go
index 77361f65614..ea72d77086f 100644
--- a/modules/auth/common.go
+++ b/modules/auth/common.go
@@ -4,8 +4,8 @@
 package auth
 
 import (
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
 )
 
 func UnmarshalGroupTeamMapping(raw string) (map[string]map[string][]string, error) {
diff --git a/modules/auth/httpauth/httpauth.go b/modules/auth/httpauth/httpauth.go
index 7f1f1ee152c..332441bca67 100644
--- a/modules/auth/httpauth/httpauth.go
+++ b/modules/auth/httpauth/httpauth.go
@@ -7,7 +7,7 @@ import (
 	"encoding/base64"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 type BasicAuth struct {
diff --git a/modules/auth/pam/pam_test.go b/modules/auth/pam/pam_test.go
index d4ab058ec78..1180e75d88a 100644
--- a/modules/auth/pam/pam_test.go
+++ b/modules/auth/pam/pam_test.go
@@ -1,8 +1,8 @@
-//go:build pam
-
 // Copyright 2021 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
+//go:build pam
+
 package pam
 
 import (
diff --git a/modules/auth/password/hash/argon2.go b/modules/auth/password/hash/argon2.go
index f4a7497df69..64d1fe82947 100644
--- a/modules/auth/password/hash/argon2.go
+++ b/modules/auth/password/hash/argon2.go
@@ -7,7 +7,7 @@ import (
 	"encoding/hex"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"golang.org/x/crypto/argon2"
 )
diff --git a/modules/auth/password/hash/common.go b/modules/auth/password/hash/common.go
index 1fafc289ed4..30324de546d 100644
--- a/modules/auth/password/hash/common.go
+++ b/modules/auth/password/hash/common.go
@@ -6,8 +6,8 @@ package hash
 import (
 	"strconv"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 func parseIntParam(value, param, algorithmName, config string, previousErr error) (int, error) {
diff --git a/modules/auth/password/hash/hash.go b/modules/auth/password/hash/hash.go
index 459320e1b02..ffe5d76cbd5 100644
--- a/modules/auth/password/hash/hash.go
+++ b/modules/auth/password/hash/hash.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // This package takes care of hashing passwords, verifying passwords, defining
diff --git a/modules/auth/password/hash/hash_test.go b/modules/auth/password/hash/hash_test.go
index 7aa051733f8..4b459778de5 100644
--- a/modules/auth/password/hash/hash_test.go
+++ b/modules/auth/password/hash/hash_test.go
@@ -74,6 +74,7 @@ func TestHashing(t *testing.T) {
 	runTests := func(password, salt string, shouldPass bool) {
 		for _, algorithmName := range hashAlgorithmsToTest {
 			t.Run(algorithmName, func(t *testing.T) {
+				t.Parallel() // CPU-bound; these subtests only read the shared hasher registry
 				output, err := Parse(algorithmName).Hash(password, salt)
 				if shouldPass {
 					assert.NoError(t, err)
@@ -182,6 +183,7 @@ func TestVectors(t *testing.T) {
 	for i, vector := range vectors {
 		for _, algorithm := range vector.algorithms {
 			t.Run(strconv.Itoa(i)+": "+algorithm, func(t *testing.T) {
+				t.Parallel() // CPU-bound; these subtests only read the shared hasher registry
 				pa := Parse(algorithm)
 				assert.Equal(t, !vector.shouldfail, pa.VerifyPassword(vector.password, vector.output, vector.salt))
 			})
diff --git a/modules/auth/password/hash/pbkdf2.go b/modules/auth/password/hash/pbkdf2.go
index 27382fedb8c..44d7e54be1b 100644
--- a/modules/auth/password/hash/pbkdf2.go
+++ b/modules/auth/password/hash/pbkdf2.go
@@ -8,7 +8,7 @@ import (
 	"encoding/hex"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"golang.org/x/crypto/pbkdf2"
 )
diff --git a/modules/auth/password/hash/scrypt.go b/modules/auth/password/hash/scrypt.go
index f3d38f751a3..ef678c697e5 100644
--- a/modules/auth/password/hash/scrypt.go
+++ b/modules/auth/password/hash/scrypt.go
@@ -7,7 +7,7 @@ import (
 	"encoding/hex"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"golang.org/x/crypto/scrypt"
 )
diff --git a/modules/auth/password/password.go b/modules/auth/password/password.go
index a1e101dd621..fd943c0f757 100644
--- a/modules/auth/password/password.go
+++ b/modules/auth/password/password.go
@@ -13,8 +13,8 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation"
 )
 
 var (
diff --git a/modules/auth/password/pwn.go b/modules/auth/password/pwn.go
index e00205ea193..3539f250a8c 100644
--- a/modules/auth/password/pwn.go
+++ b/modules/auth/password/pwn.go
@@ -8,8 +8,8 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/auth/password/pwn"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/auth/password/pwn"
+	"gitea.dev/modules/setting"
 )
 
 var ErrIsPwned = errors.New("password has been pwned")
diff --git a/modules/auth/password/pwn/pwn.go b/modules/auth/password/pwn/pwn.go
index d5ea96c4afc..a4043996fa4 100644
--- a/modules/auth/password/pwn/pwn.go
+++ b/modules/auth/password/pwn/pwn.go
@@ -14,7 +14,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 const passwordURL = "https://api.pwnedpasswords.com/range/"
diff --git a/modules/auth/webauthn/webauthn.go b/modules/auth/webauthn/webauthn.go
index 86f55c6b247..b0b49591687 100644
--- a/modules/auth/webauthn/webauthn.go
+++ b/modules/auth/webauthn/webauthn.go
@@ -8,10 +8,10 @@ import (
 	"encoding/binary"
 	"encoding/gob"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/go-webauthn/webauthn/protocol"
 	"github.com/go-webauthn/webauthn/webauthn"
diff --git a/modules/auth/webauthn/webauthn_test.go b/modules/auth/webauthn/webauthn_test.go
index 15a8d718283..c83afefa2ac 100644
--- a/modules/auth/webauthn/webauthn_test.go
+++ b/modules/auth/webauthn/webauthn_test.go
@@ -6,7 +6,7 @@ package webauthn
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/avatar/avatar.go b/modules/avatar/avatar.go
index 44c61e1ff67..ccb5ce58c3b 100644
--- a/modules/avatar/avatar.go
+++ b/modules/avatar/avatar.go
@@ -11,8 +11,8 @@ import (
 	"image/color"
 	"image/png"
 
-	"code.gitea.io/gitea/modules/avatar/identicon"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/avatar/identicon"
+	"gitea.dev/modules/setting"
 
 	_ "golang.org/x/image/webp" // for processing webp images
 	_ "image/gif"               // for processing gif images
diff --git a/modules/avatar/avatar_test.go b/modules/avatar/avatar_test.go
index 5414184b6b2..8e2aae43feb 100644
--- a/modules/avatar/avatar_test.go
+++ b/modules/avatar/avatar_test.go
@@ -10,7 +10,7 @@ import (
 	"os"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/avatar/hash_test.go b/modules/avatar/hash_test.go
index c518144b47e..089f8b25bf4 100644
--- a/modules/avatar/hash_test.go
+++ b/modules/avatar/hash_test.go
@@ -9,7 +9,7 @@ import (
 	"image/png"
 	"testing"
 
-	"code.gitea.io/gitea/modules/avatar"
+	"gitea.dev/modules/avatar"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/badge/badge.go b/modules/badge/badge.go
index d2e9bd9d1bc..60781f1893f 100644
--- a/modules/badge/badge.go
+++ b/modules/badge/badge.go
@@ -8,7 +8,7 @@ import (
 	"sync"
 	"unicode"
 
-	actions_model "code.gitea.io/gitea/models/actions"
+	actions_model "gitea.dev/models/actions"
 )
 
 // The Badge layout: |offset|label|message|
diff --git a/modules/base/tool.go b/modules/base/tool.go
index ed94575e741..3709d5ffeee 100644
--- a/modules/base/tool.go
+++ b/modules/base/tool.go
@@ -14,8 +14,8 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/dustin/go-humanize"
 )
diff --git a/modules/base/tool_test.go b/modules/base/tool_test.go
index 85d28836f15..2523771b936 100644
--- a/modules/base/tool_test.go
+++ b/modules/base/tool_test.go
@@ -9,8 +9,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/cache/cache.go b/modules/cache/cache.go
index 039caa9fbc8..3be8f0fb0a3 100644
--- a/modules/cache/cache.go
+++ b/modules/cache/cache.go
@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	_ "gitea.com/go-chi/cache/memcache" //nolint:depguard // memcache plugin for cache, it is required for config "ADAPTER=memcache"
 )
diff --git a/modules/cache/cache_redis.go b/modules/cache/cache_redis.go
index 7473c938af7..f6029d533b8 100644
--- a/modules/cache/cache_redis.go
+++ b/modules/cache/cache_redis.go
@@ -8,8 +8,8 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/nosql"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/nosql"
 
 	"gitea.com/go-chi/cache" //nolint:depguard // we wrap this package here
 	"github.com/redis/go-redis/v9"
diff --git a/modules/cache/cache_test.go b/modules/cache/cache_test.go
index d6ea2032eee..97ccf0f6e51 100644
--- a/modules/cache/cache_test.go
+++ b/modules/cache/cache_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/cache/cache_twoqueue.go b/modules/cache/cache_twoqueue.go
index c8db686e576..ea0f0410e91 100644
--- a/modules/cache/cache_twoqueue.go
+++ b/modules/cache/cache_twoqueue.go
@@ -8,7 +8,7 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	mc "gitea.com/go-chi/cache" //nolint:depguard // we wrap this package here
 	lru "github.com/hashicorp/golang-lru/v2"
diff --git a/modules/cache/context_test.go b/modules/cache/context_test.go
index 8371c2b9080..1eee11836e9 100644
--- a/modules/cache/context_test.go
+++ b/modules/cache/context_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/cache/ephemeral.go b/modules/cache/ephemeral.go
index 6996010ac4b..9e0a611dc75 100644
--- a/modules/cache/ephemeral.go
+++ b/modules/cache/ephemeral.go
@@ -8,8 +8,8 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 // EphemeralCache is a cache that can be used to store data in a request level context
diff --git a/modules/cache/string_cache.go b/modules/cache/string_cache.go
index 3562b7a926c..1582c319c43 100644
--- a/modules/cache/string_cache.go
+++ b/modules/cache/string_cache.go
@@ -7,9 +7,9 @@ import (
 	"errors"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	chi_cache "gitea.com/go-chi/cache" //nolint:depguard // we wrap this package here
 )
diff --git a/modules/charset/ambiguous.go b/modules/charset/ambiguous.go
index c87d3cfa5af..97f676c372f 100644
--- a/modules/charset/ambiguous.go
+++ b/modules/charset/ambiguous.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"unicode"
 
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/translation"
 )
 
 // AmbiguousTablesForLocale provides the table of ambiguous characters for this locale.
diff --git a/modules/charset/ambiguous_gen_test.go b/modules/charset/ambiguous_gen_test.go
index 81d2e8065b0..7b5ebc2c294 100644
--- a/modules/charset/ambiguous_gen_test.go
+++ b/modules/charset/ambiguous_gen_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"unicode"
 
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/charset/charset.go b/modules/charset/charset.go
index 96de1c9fcc0..70f46142a52 100644
--- a/modules/charset/charset.go
+++ b/modules/charset/charset.go
@@ -12,8 +12,8 @@ import (
 	"unicode"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/gogs/chardet"
 	"golang.org/x/net/html/charset"
@@ -89,7 +89,10 @@ func ToUTF8(content []byte, opts ConvertOpts) []byte {
 	encoding, _ := charset.Lookup(charsetLabel)
 	if encoding == nil {
 		setting.PanicInDevOrTesting("unsupported detected charset %q, it shouldn't happen", charsetLabel)
-		return content
+		if opts.ErrorReturnOrigin {
+			return content
+		}
+		return bytes.ToValidUTF8(content, opts.ErrorReplacement)
 	}
 
 	var decoded []byte
diff --git a/modules/charset/charset_test.go b/modules/charset/charset_test.go
index 0314abc347b..30b16e2d47d 100644
--- a/modules/charset/charset_test.go
+++ b/modules/charset/charset_test.go
@@ -9,8 +9,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/charset/escape.go b/modules/charset/escape.go
index 8f25e7876d4..596bde8e74b 100644
--- a/modules/charset/escape.go
+++ b/modules/charset/escape.go
@@ -8,8 +8,8 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation"
 )
 
 type EscapeOptions struct {
diff --git a/modules/charset/escape_stream.go b/modules/charset/escape_stream.go
index 11d09083fcb..360e77782fb 100644
--- a/modules/charset/escape_stream.go
+++ b/modules/charset/escape_stream.go
@@ -11,8 +11,8 @@ import (
 	"unicode"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation"
 )
 
 type htmlChunkReader struct {
diff --git a/modules/charset/escape_test.go b/modules/charset/escape_test.go
index 4e1ff0fcf40..9791cbd933a 100644
--- a/modules/charset/escape_test.go
+++ b/modules/charset/escape_test.go
@@ -7,9 +7,9 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/charset/generate/generate.go b/modules/charset/generate/generate.go
index 16ea53fda1a..0d719ae97e1 100644
--- a/modules/charset/generate/generate.go
+++ b/modules/charset/generate/generate.go
@@ -13,7 +13,7 @@ import (
 	"text/template"
 	"unicode"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"golang.org/x/text/unicode/rangetable"
 )
diff --git a/modules/csv/csv.go b/modules/csv/csv.go
index ad61b81d699..1985e27828c 100644
--- a/modules/csv/csv.go
+++ b/modules/csv/csv.go
@@ -11,9 +11,9 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
 )
 
 const (
diff --git a/modules/csv/csv_test.go b/modules/csv/csv_test.go
index 5ea97184662..d217d57e537 100644
--- a/modules/csv/csv_test.go
+++ b/modules/csv/csv_test.go
@@ -11,8 +11,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/dump/dumper.go b/modules/dump/dumper.go
index 2f160707041..edc666db6df 100644
--- a/modules/dump/dumper.go
+++ b/modules/dump/dumper.go
@@ -16,9 +16,9 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/mholt/archives"
 )
diff --git a/modules/dump/dumper_test.go b/modules/dump/dumper_test.go
index f6b79c072ac..b713c87121b 100644
--- a/modules/dump/dumper_test.go
+++ b/modules/dump/dumper_test.go
@@ -14,7 +14,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/emoji/emoji.go b/modules/emoji/emoji.go
index 891a0b9ab34..26d552a2a25 100644
--- a/modules/emoji/emoji.go
+++ b/modules/emoji/emoji.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // Gemoji is a set of emoji data.
diff --git a/modules/emoji/emoji_test.go b/modules/emoji/emoji_test.go
index 607299cdc10..e33239bf19b 100644
--- a/modules/emoji/emoji_test.go
+++ b/modules/emoji/emoji_test.go
@@ -7,9 +7,9 @@ package emoji
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/eventsource/event.go b/modules/eventsource/event.go
index c72cc466a03..1f2372d9806 100644
--- a/modules/eventsource/event.go
+++ b/modules/eventsource/event.go
@@ -9,7 +9,7 @@ import (
 	"io"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 )
 
 func wrapNewlines(w io.Writer, prefix, value []byte) (sum int64, err error) {
diff --git a/modules/eventsource/manager_run.go b/modules/eventsource/manager_run.go
index 4a42224ddac..b39d400813c 100644
--- a/modules/eventsource/manager_run.go
+++ b/modules/eventsource/manager_run.go
@@ -7,16 +7,16 @@ import (
 	"context"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/services/convert"
+	activities_model "gitea.dev/models/activities"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/services/convert"
 )
 
 // Init starts this eventsource
diff --git a/modules/fileicon/basic.go b/modules/fileicon/basic.go
index 9c513ccbd9f..c777345b72a 100644
--- a/modules/fileicon/basic.go
+++ b/modules/fileicon/basic.go
@@ -6,8 +6,8 @@ package fileicon
 import (
 	"html/template"
 
-	"code.gitea.io/gitea/modules/svg"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/util"
 )
 
 func BasicEntryIconName(entry *EntryInfo) string {
diff --git a/modules/fileicon/entry.go b/modules/fileicon/entry.go
index 0326c2bfa8a..2f76da24758 100644
--- a/modules/fileicon/entry.go
+++ b/modules/fileicon/entry.go
@@ -3,7 +3,7 @@
 
 package fileicon
 
-import "code.gitea.io/gitea/modules/git"
+import "gitea.dev/modules/git"
 
 type EntryInfo struct {
 	BaseName      string
diff --git a/modules/fileicon/material.go b/modules/fileicon/material.go
index b8ee13cd8cb..94c2cead3d2 100644
--- a/modules/fileicon/material.go
+++ b/modules/fileicon/material.go
@@ -8,12 +8,12 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/options"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/svg"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/options"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/util"
 )
 
 type materialIconRulesData struct {
diff --git a/modules/fileicon/material_test.go b/modules/fileicon/material_test.go
index d2a769eaac0..f6e08ba4c1b 100644
--- a/modules/fileicon/material_test.go
+++ b/modules/fileicon/material_test.go
@@ -6,9 +6,9 @@ package fileicon_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/fileicon/render.go b/modules/fileicon/render.go
index 5bf2a3a02ec..b974196994e 100644
--- a/modules/fileicon/render.go
+++ b/modules/fileicon/render.go
@@ -7,7 +7,7 @@ import (
 	"html/template"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 type RenderedIconPool struct {
diff --git a/modules/fileicon/render_test.go b/modules/fileicon/render_test.go
index d9998f3f4c8..ac03fc49286 100644
--- a/modules/fileicon/render_test.go
+++ b/modules/fileicon/render_test.go
@@ -6,10 +6,10 @@ package fileicon_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/generate/generate.go b/modules/generate/generate.go
index 9baa057b17e..f2a5b366d8f 100644
--- a/modules/generate/generate.go
+++ b/modules/generate/generate.go
@@ -11,7 +11,7 @@ import (
 	"io"
 	"time"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 
 	"github.com/golang-jwt/jwt/v5"
 )
diff --git a/modules/git/attribute/attribute.go b/modules/git/attribute/attribute.go
index 8719369df8f..02c601399a4 100644
--- a/modules/git/attribute/attribute.go
+++ b/modules/git/attribute/attribute.go
@@ -6,7 +6,7 @@ package attribute
 import (
 	"strings"
 
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/modules/optional"
 )
 
 type Attribute string
diff --git a/modules/git/attribute/batch.go b/modules/git/attribute/batch.go
index b1e6387ade7..96d63a910f8 100644
--- a/modules/git/attribute/batch.go
+++ b/modules/git/attribute/batch.go
@@ -11,9 +11,9 @@ import (
 	"path/filepath"
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
 )
 
 // BatchChecker provides a reader for check-attribute content that can be long running
diff --git a/modules/git/attribute/batch_test.go b/modules/git/attribute/batch_test.go
index 30a3d805fe9..a71a73b3026 100644
--- a/modules/git/attribute/batch_test.go
+++ b/modules/git/attribute/batch_test.go
@@ -8,9 +8,9 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/git/attribute/checker.go b/modules/git/attribute/checker.go
index 3eea31e813c..0be610994c4 100644
--- a/modules/git/attribute/checker.go
+++ b/modules/git/attribute/checker.go
@@ -10,8 +10,8 @@ import (
 	"fmt"
 	"os"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 func checkAttrCommand(gitRepo *git.Repository, treeish string, filenames, attributes []string) (*gitcmd.Command, []string, func(), error) {
diff --git a/modules/git/attribute/checker_test.go b/modules/git/attribute/checker_test.go
index 67fbda89188..ca102143519 100644
--- a/modules/git/attribute/checker_test.go
+++ b/modules/git/attribute/checker_test.go
@@ -7,9 +7,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/git/attribute/main_test.go b/modules/git/attribute/main_test.go
index 1f1d80ec0a6..174c27c6f1f 100644
--- a/modules/git/attribute/main_test.go
+++ b/modules/git/attribute/main_test.go
@@ -8,9 +8,9 @@ import (
 	"os"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 func testRun(m *testing.M) error {
diff --git a/modules/git/blob.go b/modules/git/blob.go
index 40d8f44e799..eca9e37d95e 100644
--- a/modules/git/blob.go
+++ b/modules/git/blob.go
@@ -11,8 +11,8 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/util"
 )
 
 // This file contains common functions between the gogit and !gogit variants for git Blobs
diff --git a/modules/git/blob_gogit.go b/modules/git/blob_gogit.go
index 7cf622d180f..4b96c692535 100644
--- a/modules/git/blob_gogit.go
+++ b/modules/git/blob_gogit.go
@@ -9,7 +9,7 @@ package git
 import (
 	"io"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"github.com/go-git/go-git/v5/plumbing"
 )
diff --git a/modules/git/blob_nogogit.go b/modules/git/blob_nogogit.go
index 837b30fd883..102faf2a5f0 100644
--- a/modules/git/blob_nogogit.go
+++ b/modules/git/blob_nogogit.go
@@ -8,7 +8,7 @@ package git
 import (
 	"io"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // Blob represents a Git object.
diff --git a/modules/git/catfile_batch_command.go b/modules/git/catfile_batch_command.go
index 4e18282bf38..3cf7defa8ba 100644
--- a/modules/git/catfile_batch_command.go
+++ b/modules/git/catfile_batch_command.go
@@ -9,9 +9,9 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // catFileBatchCommand implements the CatFileBatch interface using the "cat-file --batch-command" command
diff --git a/modules/git/catfile_batch_legacy.go b/modules/git/catfile_batch_legacy.go
index 595043d1d2e..05c55f3008a 100644
--- a/modules/git/catfile_batch_legacy.go
+++ b/modules/git/catfile_batch_legacy.go
@@ -10,9 +10,9 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // catFileBatchLegacy implements the CatFileBatch interface using the "cat-file --batch" command and "cat-file --batch-check" command
diff --git a/modules/git/catfile_batch_reader.go b/modules/git/catfile_batch_reader.go
index 4d77fb03c78..71c0c87af6b 100644
--- a/modules/git/catfile_batch_reader.go
+++ b/modules/git/catfile_batch_reader.go
@@ -15,9 +15,9 @@ import (
 	"strings"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 type catFileBatchCommunicator struct {
diff --git a/modules/git/catfile_batch_test.go b/modules/git/catfile_batch_test.go
index 782d34d2493..072759e409d 100644
--- a/modules/git/catfile_batch_test.go
+++ b/modules/git/catfile_batch_test.go
@@ -9,7 +9,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/git/commit.go b/modules/git/commit.go
index c3d23d68786..0231770a293 100644
--- a/modules/git/commit.go
+++ b/modules/git/commit.go
@@ -11,19 +11,28 @@ import (
 	"os/exec"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/util"
 )
 
+type CommitMessage struct {
+	MessageRaw   string
+	messageUTF8  *string
+	messageTitle *string
+	messageBody  *string
+}
+
 // Commit represents a git commit.
 type Commit struct {
 	Tree // FIXME: bad design, this field can be nil if the commit is from "last commit cache"
 
-	ID            ObjectID
-	Author        *Signature // never nil
-	Committer     *Signature // never nil
-	CommitMessage string
-	Signature     *CommitSignature
+	CommitMessage
+
+	ID        ObjectID
+	Author    *Signature // never nil
+	Committer *Signature // never nil
+	Signature *CommitSignature
 
 	Parents        []ObjectID // ID strings
 	submoduleCache *ObjectCache[*SubModule]
@@ -35,19 +44,28 @@ type CommitSignature struct {
 	Payload   string
 }
 
-// Message returns the commit message. Same as retrieving CommitMessage directly.
-func (c *Commit) Message() string {
-	// FIXME: GIT-COMMIT-MESSAGE-ENCODING: this logic is not right
-	// * When need to use commit message in templates/database, it should be valid UTF-8
-	// * When need to get the original commit message, it should just use "c.CommitMessage"
-	// It's not easy to refactor at the moment, many templates need to be updated and tested
-	return c.CommitMessage
+func (c *CommitMessage) MessageUTF8() string {
+	if c.messageUTF8 == nil {
+		bs := charset.ToUTF8(util.UnsafeStringToBytes(c.MessageRaw), charset.ConvertOpts{ErrorReplacement: []byte{'?'}})
+		c.messageUTF8 = new(util.UnsafeBytesToString(bs))
+	}
+	return *c.messageUTF8
 }
 
-// Summary returns first line of commit message.
-// The string is forced to be valid UTF8
-func (c *Commit) Summary() string {
-	return strings.ToValidUTF8(strings.Split(strings.TrimSpace(c.CommitMessage), "\n")[0], "?")
+func (c *CommitMessage) MessageTitle() string {
+	if c.messageTitle == nil {
+		s, _, _ := strings.Cut(strings.TrimSpace(c.MessageUTF8()), "\n")
+		c.messageTitle = new(strings.TrimSpace(s))
+	}
+	return *c.messageTitle
+}
+
+func (c *CommitMessage) MessageBody() string {
+	if c.messageBody == nil {
+		_, s, _ := strings.Cut(strings.TrimSpace(c.MessageUTF8()), "\n")
+		c.messageBody = new(strings.TrimSpace(s))
+	}
+	return *c.messageBody
 }
 
 // ParentID returns oid of n-th parent (0-based index).
diff --git a/modules/git/commit_convert_gogit.go b/modules/git/commit_convert_gogit.go
index d7b945ed6b8..92ad1d21fda 100644
--- a/modules/git/commit_convert_gogit.go
+++ b/modules/git/commit_convert_gogit.go
@@ -66,7 +66,7 @@ func convertPGPSignature(c *object.Commit) *CommitSignature {
 func convertCommit(c *object.Commit) *Commit {
 	return &Commit{
 		ID:            ParseGogitHash(c.Hash),
-		CommitMessage: c.Message,
+		CommitMessage: CommitMessage{MessageRaw: c.Message},
 		Committer:     &c.Committer,
 		Author:        &c.Author,
 		Signature:     convertPGPSignature(c),
diff --git a/modules/git/commit_info_gogit.go b/modules/git/commit_info_gogit.go
index 73227347bc7..6174f46f07f 100644
--- a/modules/git/commit_info_gogit.go
+++ b/modules/git/commit_info_gogit.go
@@ -7,6 +7,7 @@ package git
 
 import (
 	"context"
+	"maps"
 	"path"
 
 	"github.com/emirpasic/gods/trees/binaryheap"
@@ -47,9 +48,7 @@ func (tes Entries) GetCommitsInfo(ctx context.Context, repoLink string, commit *
 				return nil, nil, err
 			}
 
-			for k, v := range revs2 {
-				revs[k] = v
-			}
+			maps.Copy(revs, revs2)
 		}
 	} else {
 		revs, err = GetLastCommitForPaths(ctx, nil, c, treePath, entryPaths)
@@ -201,7 +200,7 @@ heaploop:
 		// Load the parent commits for the one we are currently examining
 		numParents := current.commit.NumParents()
 		var parents []cgobject.CommitNode
-		for i := 0; i < numParents; i++ {
+		for i := range numParents {
 			parent, err := current.commit.ParentNode(i)
 			if err != nil {
 				break
@@ -273,9 +272,8 @@ heaploop:
 
 				if len(newRemainingPaths) == 0 {
 					break
-				} else {
-					remainingPaths = newRemainingPaths
 				}
+				remainingPaths = newRemainingPaths
 			}
 		}
 	}
diff --git a/modules/git/commit_info_nogogit.go b/modules/git/commit_info_nogogit.go
index ed775332a92..cf53f9fdf40 100644
--- a/modules/git/commit_info_nogogit.go
+++ b/modules/git/commit_info_nogogit.go
@@ -11,7 +11,7 @@ import (
 	"path"
 	"sort"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // GetCommitsInfo gets information of all commits that are corresponding to these entries
diff --git a/modules/git/commit_reader.go b/modules/git/commit_reader.go
index eb8f4c63227..ce48d6f3198 100644
--- a/modules/git/commit_reader.go
+++ b/modules/git/commit_reader.go
@@ -92,7 +92,7 @@ func CommitFromReader(gitRepo *Repository, objectID ObjectID, reader io.Reader)
 		}
 	}
 
-	commit.CommitMessage = messageSB.String()
+	commit.MessageRaw = messageSB.String()
 	if commit.Signature != nil {
 		commit.Signature.Payload = payloadSB.String()
 	}
diff --git a/modules/git/commit_sha256_test.go b/modules/git/commit_sha256_test.go
index 0aefb30c95e..9fb1539dc99 100644
--- a/modules/git/commit_sha256_test.go
+++ b/modules/git/commit_sha256_test.go
@@ -95,7 +95,7 @@ signed commit`, commitFromReader.Signature.Payload)
 
 	commitFromReader2, err := CommitFromReader(gitRepo, sha, strings.NewReader(commitString+"\n\n"))
 	assert.NoError(t, err)
-	commitFromReader.CommitMessage += "\n\n"
+	commitFromReader.CommitMessage.MessageRaw += "\n\n"
 	commitFromReader.Signature.Payload += "\n\n"
 	assert.Equal(t, commitFromReader, commitFromReader2)
 }
diff --git a/modules/git/commit_submodule_file.go b/modules/git/commit_submodule_file.go
index efcf53b07c8..fe925dda97a 100644
--- a/modules/git/commit_submodule_file.go
+++ b/modules/git/commit_submodule_file.go
@@ -9,8 +9,8 @@ import (
 	"path"
 	"strings"
 
-	giturl "code.gitea.io/gitea/modules/git/url"
-	"code.gitea.io/gitea/modules/util"
+	giturl "gitea.dev/modules/git/url"
+	"gitea.dev/modules/util"
 )
 
 // CommitSubmoduleFile represents a file with submodule type.
diff --git a/modules/git/commit_test.go b/modules/git/commit_test.go
index de7b7455ebb..a7668e4debe 100644
--- a/modules/git/commit_test.go
+++ b/modules/git/commit_test.go
@@ -91,7 +91,7 @@ empty commit`, commitFromReader.Signature.Payload)
 
 	commitFromReader2, err := CommitFromReader(gitRepo, sha, strings.NewReader(commitString+"\n\n"))
 	assert.NoError(t, err)
-	commitFromReader.CommitMessage += "\n\n"
+	commitFromReader.CommitMessage.MessageRaw += "\n\n"
 	commitFromReader.Signature.Payload += "\n\n"
 	assert.Equal(t, commitFromReader, commitFromReader2)
 }
@@ -154,11 +154,20 @@ ISO-8859-1`, commitFromReader.Signature.Payload)
 
 	commitFromReader2, err := CommitFromReader(gitRepo, sha, strings.NewReader(commitString+"\n\n"))
 	assert.NoError(t, err)
-	commitFromReader.CommitMessage += "\n\n"
+	commitFromReader.CommitMessage.MessageRaw += "\n\n"
 	commitFromReader.Signature.Payload += "\n\n"
 	assert.Equal(t, commitFromReader, commitFromReader2)
 }
 
+func TestCommitMessageSanitizesInvalidUTF8(t *testing.T) {
+	commit := &Commit{
+		CommitMessage: CommitMessage{MessageRaw: "title \xff\n\n\n\nbody \xff\n\n\n"},
+	}
+	assert.Equal(t, "title ÿ", commit.MessageTitle())
+	assert.Equal(t, "body ÿ", commit.MessageBody())
+	assert.Equal(t, "title ÿ\n\n\n\nbody ÿ\n\n\n", commit.MessageUTF8())
+}
+
 func TestHasPreviousCommit(t *testing.T) {
 	bareRepo1Path := filepath.Join(testReposDir, "repo1_bare")
 
diff --git a/modules/git/config.go b/modules/git/config.go
index 79aa0535e4c..b1ca18c9882 100644
--- a/modules/git/config.go
+++ b/modules/git/config.go
@@ -11,8 +11,8 @@ import (
 	"runtime"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
 )
 
 // syncGitConfig only modifies gitconfig, won't change global variables (otherwise there will be data-race problem)
diff --git a/modules/git/config_test.go b/modules/git/config_test.go
index 237feb67d54..9e358d4a807 100644
--- a/modules/git/config_test.go
+++ b/modules/git/config_test.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/git/diff.go b/modules/git/diff.go
index d7732eaa29b..eebb3c098fe 100644
--- a/modules/git/diff.go
+++ b/modules/git/diff.go
@@ -12,10 +12,10 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // RawDiffType output format: diff or patch
diff --git a/modules/git/error.go b/modules/git/error.go
index 1b7bdca0434..23853f42a2d 100644
--- a/modules/git/error.go
+++ b/modules/git/error.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // ErrNotExist commit not exist error
diff --git a/modules/git/foreachref/format_test.go b/modules/git/foreachref/format_test.go
index 8ff239323c8..5d1082e7952 100644
--- a/modules/git/foreachref/format_test.go
+++ b/modules/git/foreachref/format_test.go
@@ -6,7 +6,7 @@ package foreachref_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/git/foreachref"
+	"gitea.dev/modules/git/foreachref"
 
 	"github.com/stretchr/testify/require"
 )
diff --git a/modules/git/foreachref/parser.go b/modules/git/foreachref/parser.go
index 91868076b42..874b3744c30 100644
--- a/modules/git/foreachref/parser.go
+++ b/modules/git/foreachref/parser.go
@@ -111,8 +111,6 @@ func (p *Parser) parseRef(refBlock string) (map[string]string, error) {
 			len(fields), len(p.format.fieldNames))
 	}
 	for i, field := range fields {
-		field = strings.TrimSpace(field)
-
 		var fieldKey string
 		var fieldVal string
 		before, after, ok := strings.Cut(field, " ")
diff --git a/modules/git/foreachref/parser_test.go b/modules/git/foreachref/parser_test.go
index 7a37ced3565..4ace4286d60 100644
--- a/modules/git/foreachref/parser_test.go
+++ b/modules/git/foreachref/parser_test.go
@@ -10,8 +10,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git/foreachref"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/git/foreachref"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/require"
 )
@@ -116,12 +116,12 @@ func TestParser(t *testing.T) {
 				},
 				{
 					"refname:short": "v0.0.2",
-					"contents":      "Update CI config (#651)",
+					"contents":      "Update CI config (#651)\n\n",
 					"author":        "John Doe <john.doe@foo.com> 1521643174 +0000",
 				},
 				{
 					"refname:short": "v0.0.3",
-					"contents":      "Fixed code sample for bash completion (#687)",
+					"contents":      "Fixed code sample for bash completion (#687)\n\n",
 					"author":        "Foo Baz <foo@baz.com> 1524836750 +0200",
 				},
 			},
diff --git a/modules/git/git.go b/modules/git/git.go
index 69eb07d1f0b..5359781968f 100644
--- a/modules/git/git.go
+++ b/modules/git/git.go
@@ -13,11 +13,11 @@ import (
 	"runtime"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/tempdir"
-	"code.gitea.io/gitea/modules/testlogger"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/tempdir"
+	"gitea.dev/modules/testlogger"
 
 	"github.com/hashicorp/go-version"
 )
diff --git a/modules/git/gitcmd/command.go b/modules/git/gitcmd/command.go
index ee447dfd032..b6f56af07a9 100644
--- a/modules/git/gitcmd/command.go
+++ b/modules/git/gitcmd/command.go
@@ -16,11 +16,11 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/git/internal" //nolint:depguard // only this file can use the internal type CmdArg, other files and packages should use AddXxx functions
-	"code.gitea.io/gitea/modules/gtprof"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/internal" //nolint:depguard // only this file can use the internal type CmdArg, other files and packages should use AddXxx functions
+	"gitea.dev/modules/gtprof"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/util"
 )
 
 // TrustedCmdArgs returns the trusted arguments for git command.
diff --git a/modules/git/gitcmd/command_test.go b/modules/git/gitcmd/command_test.go
index 1a9bfe7d752..8425f6f837a 100644
--- a/modules/git/gitcmd/command_test.go
+++ b/modules/git/gitcmd/command_test.go
@@ -11,9 +11,9 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/tempdir"
-	"code.gitea.io/gitea/modules/testlogger"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/tempdir"
+	"gitea.dev/modules/testlogger"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/git/gitcmd/env.go b/modules/git/gitcmd/env.go
index 269b51a253a..4f8b860e372 100644
--- a/modules/git/gitcmd/env.go
+++ b/modules/git/gitcmd/env.go
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"os/exec"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 var GitExecutable = "git" // the command name of git, will be updated to an absolute path during initialization
diff --git a/modules/git/gpg.go b/modules/git/gpg.go
index dbc5569309c..68974b93674 100644
--- a/modules/git/gpg.go
+++ b/modules/git/gpg.go
@@ -11,8 +11,8 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/process"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/process"
 )
 
 // GPGSettings represents the default GPG settings for this repository
diff --git a/modules/git/grep.go b/modules/git/grep.go
index 47f66b88b24..5eb8a0320cf 100644
--- a/modules/git/grep.go
+++ b/modules/git/grep.go
@@ -13,8 +13,8 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/util"
 )
 
 type GrepResult struct {
diff --git a/modules/git/hook.go b/modules/git/hook.go
index 0e19387d976..b8cf186dc1a 100644
--- a/modules/git/hook.go
+++ b/modules/git/hook.go
@@ -11,7 +11,7 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // hookNames is a list of Git server hooks' name that are supported.
diff --git a/modules/git/key.go b/modules/git/key.go
index 9d51704595d..9fd1e09f57c 100644
--- a/modules/git/key.go
+++ b/modules/git/key.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
 )
 
 // Based on https://git-scm.com/docs/git-config#Documentation/git-config.txt-gpgformat
diff --git a/modules/git/languagestats/language_stats.go b/modules/git/languagestats/language_stats.go
index a71284c3e44..b83d4299cd9 100644
--- a/modules/git/languagestats/language_stats.go
+++ b/modules/git/languagestats/language_stats.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"unicode"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/attribute"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/attribute"
 )
 
 const (
diff --git a/modules/git/languagestats/language_stats_gogit.go b/modules/git/languagestats/language_stats_gogit.go
index ec03ca31597..090ac532745 100644
--- a/modules/git/languagestats/language_stats_gogit.go
+++ b/modules/git/languagestats/language_stats_gogit.go
@@ -9,10 +9,10 @@ import (
 	"bytes"
 	"io"
 
-	"code.gitea.io/gitea/modules/analyze"
-	git_module "code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/attribute"
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/modules/analyze"
+	git_module "gitea.dev/modules/git"
+	"gitea.dev/modules/git/attribute"
+	"gitea.dev/modules/optional"
 
 	"github.com/go-enry/go-enry/v2"
 	"github.com/go-git/go-git/v5"
diff --git a/modules/git/languagestats/language_stats_nogogit.go b/modules/git/languagestats/language_stats_nogogit.go
index 442313d4959..de431ee33af 100644
--- a/modules/git/languagestats/language_stats_nogogit.go
+++ b/modules/git/languagestats/language_stats_nogogit.go
@@ -9,11 +9,11 @@ import (
 	"bytes"
 	"io"
 
-	"code.gitea.io/gitea/modules/analyze"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/attribute"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/modules/analyze"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/attribute"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
 
 	"github.com/go-enry/go-enry/v2"
 )
diff --git a/modules/git/languagestats/language_stats_test.go b/modules/git/languagestats/language_stats_test.go
index b908ae6413d..1953559f914 100644
--- a/modules/git/languagestats/language_stats_test.go
+++ b/modules/git/languagestats/language_stats_test.go
@@ -8,8 +8,8 @@ package languagestats
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/git/languagestats/main_test.go b/modules/git/languagestats/main_test.go
index bf860f2a188..b70be1a5e72 100644
--- a/modules/git/languagestats/main_test.go
+++ b/modules/git/languagestats/main_test.go
@@ -6,7 +6,7 @@ package languagestats
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 func TestMain(m *testing.M) {
diff --git a/modules/git/last_commit_cache.go b/modules/git/last_commit_cache.go
index a013773b470..a7e78ff8b3c 100644
--- a/modules/git/last_commit_cache.go
+++ b/modules/git/last_commit_cache.go
@@ -7,9 +7,9 @@ import (
 	"crypto/sha256"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 func getCacheKey(repoPath, commitID, entryPath string) string {
diff --git a/modules/git/log_name_status.go b/modules/git/log_name_status.go
index 6e6d9985ae0..a7347a6d8a4 100644
--- a/modules/git/log_name_status.go
+++ b/modules/git/log_name_status.go
@@ -13,9 +13,9 @@ import (
 	"sort"
 	"strings"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
 )
 
 // LogNameStatusRepo opens git log --raw in the provided repo and returns a stdin pipe, a stdout reader and cancel function
diff --git a/modules/git/notes_gogit.go b/modules/git/notes_gogit.go
index 340f4d5ccc4..a4cf575ad41 100644
--- a/modules/git/notes_gogit.go
+++ b/modules/git/notes_gogit.go
@@ -9,8 +9,9 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/object"
@@ -30,7 +31,7 @@ func GetNote(ctx context.Context, repo *Repository, commitID string, note *Note)
 	}
 
 	remainingCommitID := commitID
-	path := ""
+	var path strings.Builder
 	currentTree, err := notes.Tree.gogitTreeObject()
 	if err != nil {
 		return fmt.Errorf("unable to get tree object for notes commit %q: %w", notes.ID.String(), err)
@@ -41,17 +42,17 @@ func GetNote(ctx context.Context, repo *Repository, commitID string, note *Note)
 	for len(remainingCommitID) > 2 {
 		file, err = currentTree.File(remainingCommitID)
 		if err == nil {
-			path += remainingCommitID
+			path.WriteString(remainingCommitID)
 			break
 		}
 		if err == object.ErrFileNotFound {
 			currentTree, err = currentTree.Tree(remainingCommitID[0:2])
-			path += remainingCommitID[0:2] + "/"
+			path.WriteString(remainingCommitID[0:2] + "/")
 			remainingCommitID = remainingCommitID[2:]
 		}
 		if err != nil {
 			if err == object.ErrDirectoryNotFound {
-				return ErrNotExist{ID: remainingCommitID, RelPath: path}
+				return ErrNotExist{ID: remainingCommitID, RelPath: path.String()}
 			}
 			log.Error("Unable to find git note corresponding to the commit %q. Error: %v", commitID, err)
 			return err
@@ -83,12 +84,12 @@ func GetNote(ctx context.Context, repo *Repository, commitID string, note *Note)
 		return err
 	}
 
-	lastCommits, err := GetLastCommitForPaths(ctx, nil, commitNode, "", []string{path})
+	lastCommits, err := GetLastCommitForPaths(ctx, nil, commitNode, "", []string{path.String()})
 	if err != nil {
-		log.Error("Unable to get the commit for the path %q. Error: %v", path, err)
+		log.Error("Unable to get the commit for the path %q. Error: %v", path.String(), err)
 		return err
 	}
-	note.Commit = lastCommits[path]
+	note.Commit = lastCommits[path.String()]
 
 	return nil
 }
diff --git a/modules/git/notes_nogogit.go b/modules/git/notes_nogogit.go
index 4da375c3211..09ee53f6931 100644
--- a/modules/git/notes_nogogit.go
+++ b/modules/git/notes_nogogit.go
@@ -10,7 +10,7 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // GetNote retrieves the git-notes data for a given commit.
diff --git a/modules/git/parse.go b/modules/git/parse.go
index 94020e690dd..045caf0bedb 100644
--- a/modules/git/parse.go
+++ b/modules/git/parse.go
@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/modules/optional"
 )
 
 var sepSpace = []byte{' '}
diff --git a/modules/git/parse_treeentry.go b/modules/git/parse_treeentry.go
index 23d59c19233..4a00cc1fb1f 100644
--- a/modules/git/parse_treeentry.go
+++ b/modules/git/parse_treeentry.go
@@ -43,6 +43,8 @@ func parseTreeEntries(data []byte, ptree *Tree) ([]*TreeEntry, error) {
 	return entries, nil
 }
 
+var _ = catBatchParseTreeEntries // bypass "unused" lint because it is only used by "nogogit"
+
 func catBatchParseTreeEntries(objectFormat ObjectFormat, ptree *Tree, rd BufferedReader, sz int64) ([]*TreeEntry, error) {
 	entries := make([]*TreeEntry, 0, 10)
 
diff --git a/modules/git/pipeline/catfile.go b/modules/git/pipeline/catfile.go
index 3d005e28f15..767f08af909 100644
--- a/modules/git/pipeline/catfile.go
+++ b/modules/git/pipeline/catfile.go
@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // CatFileBatchCheck runs cat-file with --batch-check
diff --git a/modules/git/pipeline/lfs_common.go b/modules/git/pipeline/lfs_common.go
index 914aefbeaf5..99949affde1 100644
--- a/modules/git/pipeline/lfs_common.go
+++ b/modules/git/pipeline/lfs_common.go
@@ -6,7 +6,7 @@ package pipeline
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 // LFSResult represents commits found using a provided pointer file hash
diff --git a/modules/git/pipeline/lfs_gogit.go b/modules/git/pipeline/lfs_gogit.go
index c12397569cb..c9685c053d9 100644
--- a/modules/git/pipeline/lfs_gogit.go
+++ b/modules/git/pipeline/lfs_gogit.go
@@ -11,7 +11,7 @@ import (
 	"sort"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 
 	gogit "github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing"
diff --git a/modules/git/pipeline/lfs_nogogit.go b/modules/git/pipeline/lfs_nogogit.go
index 9a49dc81a28..8b596e9b056 100644
--- a/modules/git/pipeline/lfs_nogogit.go
+++ b/modules/git/pipeline/lfs_nogogit.go
@@ -10,10 +10,9 @@ import (
 	"bytes"
 	"io"
 	"sort"
-	"strings"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // FindLFSFile finds commits that contain a provided pointer file hash
@@ -97,7 +96,7 @@ func findLFSFileFunc(repo *git.Repository, objectID git.ObjectID, revListReader
 						result := LFSResult{
 							Name:         curPath + fname,
 							SHA:          curCommit.ID.String(),
-							Summary:      strings.Split(strings.TrimSpace(curCommit.CommitMessage), "\n")[0],
+							Summary:      curCommit.MessageTitle(),
 							When:         curCommit.Author.When,
 							ParentHashes: curCommit.Parents,
 						}
diff --git a/modules/git/pipeline/lfs_test.go b/modules/git/pipeline/lfs_test.go
index 30fe2f93c29..97cdbea5ca4 100644
--- a/modules/git/pipeline/lfs_test.go
+++ b/modules/git/pipeline/lfs_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/git/pipeline/main_test.go b/modules/git/pipeline/main_test.go
index fa5832b68cc..7481bec2505 100644
--- a/modules/git/pipeline/main_test.go
+++ b/modules/git/pipeline/main_test.go
@@ -6,7 +6,7 @@ package pipeline
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 func TestMain(m *testing.M) {
diff --git a/modules/git/pipeline/namerev.go b/modules/git/pipeline/namerev.go
index 24de442940f..c8447b86d5e 100644
--- a/modules/git/pipeline/namerev.go
+++ b/modules/git/pipeline/namerev.go
@@ -9,7 +9,7 @@ import (
 	"errors"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 
 	"golang.org/x/sync/errgroup"
 )
diff --git a/modules/git/pipeline/revlist.go b/modules/git/pipeline/revlist.go
index 28d4751bd82..48b489bef7c 100644
--- a/modules/git/pipeline/revlist.go
+++ b/modules/git/pipeline/revlist.go
@@ -9,7 +9,7 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // RevListObjects run rev-list --objects from headSHA to baseSHA
diff --git a/modules/git/ref.go b/modules/git/ref.go
index 7b63d06b388..6ce49687384 100644
--- a/modules/git/ref.go
+++ b/modules/git/ref.go
@@ -7,7 +7,7 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 const (
diff --git a/modules/git/remote.go b/modules/git/remote.go
index ae56c5576a2..f215cd36713 100644
--- a/modules/git/remote.go
+++ b/modules/git/remote.go
@@ -9,8 +9,8 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/util"
 )
 
 // GetRemoteAddress returns remote url of git repository in the repoPath with special remote name
diff --git a/modules/git/repo.go b/modules/git/repo.go
index 1e31eb1b801..e17e7e14600 100644
--- a/modules/git/repo.go
+++ b/modules/git/repo.go
@@ -15,8 +15,8 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/proxy"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/proxy"
 )
 
 const prettyLogFormat = `--pretty=format:%H`
diff --git a/modules/git/repo_base_gogit.go b/modules/git/repo_base_gogit.go
index 986264fd936..83f12f3f9e7 100644
--- a/modules/git/repo_base_gogit.go
+++ b/modules/git/repo_base_gogit.go
@@ -10,9 +10,9 @@ import (
 	"context"
 	"path/filepath"
 
-	gitealog "code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	gitealog "gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/go-git/go-billy/v5"
 	"github.com/go-git/go-billy/v5/osfs"
diff --git a/modules/git/repo_base_nogogit.go b/modules/git/repo_base_nogogit.go
index 775bbd4a09c..2206849544e 100644
--- a/modules/git/repo_base_nogogit.go
+++ b/modules/git/repo_base_nogogit.go
@@ -11,8 +11,8 @@ import (
 	"path/filepath"
 	"sync"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 const isGogit = false
diff --git a/modules/git/repo_branch.go b/modules/git/repo_branch.go
index 1eebc72158b..aef09a0927d 100644
--- a/modules/git/repo_branch.go
+++ b/modules/git/repo_branch.go
@@ -5,7 +5,7 @@
 package git
 
 import (
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // BranchPrefix base dir of the branch information file store on git
diff --git a/modules/git/repo_branch_nogogit.go b/modules/git/repo_branch_nogogit.go
index f925aab3e4a..b43b622d050 100644
--- a/modules/git/repo_branch_nogogit.go
+++ b/modules/git/repo_branch_nogogit.go
@@ -12,8 +12,8 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
 )
 
 // IsObjectExist returns true if the given object exists in the repository.
diff --git a/modules/git/repo_commit.go b/modules/git/repo_commit.go
index 8ba3f833868..cbe5053346b 100644
--- a/modules/git/repo_commit.go
+++ b/modules/git/repo_commit.go
@@ -11,8 +11,8 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
 )
 
 // GetBranchCommitID returns last commit ID string of given branch.
diff --git a/modules/git/repo_commit_gogit.go b/modules/git/repo_commit_gogit.go
index 550d1537220..ce85b8a8787 100644
--- a/modules/git/repo_commit_gogit.go
+++ b/modules/git/repo_commit_gogit.go
@@ -9,7 +9,7 @@ package git
 import (
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/hash"
diff --git a/modules/git/repo_commit_nogogit.go b/modules/git/repo_commit_nogogit.go
index 2ddb5275020..c90650532b8 100644
--- a/modules/git/repo_commit_nogogit.go
+++ b/modules/git/repo_commit_nogogit.go
@@ -10,8 +10,8 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
 )
 
 // ResolveReference resolves a name to a reference
diff --git a/modules/git/repo_commit_test.go b/modules/git/repo_commit_test.go
index 3f7883ab14d..517decf0ca3 100644
--- a/modules/git/repo_commit_test.go
+++ b/modules/git/repo_commit_test.go
@@ -8,8 +8,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -54,7 +54,7 @@ func TestGetTagCommitWithSignature(t *testing.T) {
 	assert.NotNil(t, commit)
 	assert.NotNil(t, commit.Signature)
 	// test that signature is not in message
-	assert.Equal(t, "signed-commit\n", commit.CommitMessage)
+	assert.Equal(t, "signed-commit\n", commit.CommitMessage.MessageRaw)
 }
 
 func TestGetCommitWithBadCommitID(t *testing.T) {
diff --git a/modules/git/repo_commitgraph.go b/modules/git/repo_commitgraph.go
index 3dac74304c1..4db3c70f52e 100644
--- a/modules/git/repo_commitgraph.go
+++ b/modules/git/repo_commitgraph.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // WriteCommitGraph write commit graph to speed up repo access
diff --git a/modules/git/repo_commitgraph_gogit.go b/modules/git/repo_commitgraph_gogit.go
index c0082b62c89..68646737a22 100644
--- a/modules/git/repo_commitgraph_gogit.go
+++ b/modules/git/repo_commitgraph_gogit.go
@@ -10,28 +10,28 @@ import (
 	"os"
 	"path/filepath"
 
-	gitealog "code.gitea.io/gitea/modules/log"
+	gitealog "gitea.dev/modules/log"
 
 	commitgraph "github.com/go-git/go-git/v5/plumbing/format/commitgraph/v2"
 	cgobject "github.com/go-git/go-git/v5/plumbing/object/commitgraph"
 )
 
 // CommitNodeIndex returns the index for walking commit graph
-func (r *Repository) CommitNodeIndex() (cgobject.CommitNodeIndex, *os.File) {
-	indexPath := filepath.Join(r.Path, "objects", "info", "commit-graph")
+func (repo *Repository) CommitNodeIndex() (cgobject.CommitNodeIndex, *os.File) {
+	indexPath := filepath.Join(repo.Path, "objects", "info", "commit-graph")
 
 	file, err := os.Open(indexPath)
 	if err == nil {
 		var index commitgraph.Index
 		index, err = commitgraph.OpenFileIndex(file)
 		if err == nil {
-			return cgobject.NewGraphCommitNodeIndex(index, r.gogitRepo.Storer), file
+			return cgobject.NewGraphCommitNodeIndex(index, repo.gogitRepo.Storer), file
 		}
 	}
 
 	if !os.IsNotExist(err) {
-		gitealog.Warn("Unable to read commit-graph for %s: %v", r.Path, err)
+		gitealog.Warn("Unable to read commit-graph for %s: %v", repo.Path, err)
 	}
 
-	return cgobject.NewObjectCommitNodeIndex(r.gogitRepo.Storer), nil
+	return cgobject.NewObjectCommitNodeIndex(repo.gogitRepo.Storer), nil
 }
diff --git a/modules/git/repo_compare.go b/modules/git/repo_compare.go
index aa25e2ec208..2fc18de58b9 100644
--- a/modules/git/repo_compare.go
+++ b/modules/git/repo_compare.go
@@ -15,7 +15,7 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 type lineCountWriter struct {
diff --git a/modules/git/repo_compare_test.go b/modules/git/repo_compare_test.go
index bf16b7cfceb..21c1e2a4326 100644
--- a/modules/git/repo_compare_test.go
+++ b/modules/git/repo_compare_test.go
@@ -9,7 +9,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/git/repo_index.go b/modules/git/repo_index.go
index 1d040d5e0a4..957bb6ee328 100644
--- a/modules/git/repo_index.go
+++ b/modules/git/repo_index.go
@@ -10,8 +10,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
 )
 
 // ReadTreeToIndex reads a treeish to the index
diff --git a/modules/git/repo_object.go b/modules/git/repo_object.go
index 38e16b4646f..5398973ef60 100644
--- a/modules/git/repo_object.go
+++ b/modules/git/repo_object.go
@@ -7,7 +7,7 @@ package git
 import (
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // ObjectType git object type
diff --git a/modules/git/repo_ref.go b/modules/git/repo_ref.go
index 8859a93a578..5adb1e57353 100644
--- a/modules/git/repo_ref.go
+++ b/modules/git/repo_ref.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/util"
 )
 
 // GetRefs returns all references of the repository.
diff --git a/modules/git/repo_ref_nogogit.go b/modules/git/repo_ref_nogogit.go
index c58992fa9d1..918581e06ab 100644
--- a/modules/git/repo_ref_nogogit.go
+++ b/modules/git/repo_ref_nogogit.go
@@ -10,7 +10,7 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // GetRefsFiltered returns all references of the repository that matches patterm exactly or starting with.
diff --git a/modules/git/repo_stats.go b/modules/git/repo_stats.go
index 1dd77f05d4e..716bf0ba05b 100644
--- a/modules/git/repo_stats.go
+++ b/modules/git/repo_stats.go
@@ -11,8 +11,8 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // CodeActivityStats represents git statistics data
diff --git a/modules/git/repo_tag.go b/modules/git/repo_tag.go
index 2599236ae03..0a424016115 100644
--- a/modules/git/repo_tag.go
+++ b/modules/git/repo_tag.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/foreachref"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/foreachref"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/util"
 )
 
 // TagPrefix tags prefix path on the repository
@@ -176,15 +176,14 @@ func parseTagRef(ref map[string]string) (tag *Tag, err error) {
 	}
 
 	tag.Tagger = parseSignatureFromCommitLine(ref["creator"])
-	tag.Message = ref["contents"]
+	tag.MessageRaw = ref["contents"]
 
 	// strip any signature if present in contents field
-	_, tag.Message, _ = parsePayloadSignature(util.UnsafeStringToBytes(tag.Message), 0)
+	_, tag.MessageRaw, _ = parsePayloadSignature(util.UnsafeStringToBytes(tag.MessageRaw), 0)
 
 	// annotated tag with GPG signature
 	if tag.Type == "tag" && ref["contents:signature"] != "" {
-		payload := fmt.Sprintf("object %s\ntype commit\ntag %s\ntagger %s\n\n%s\n",
-			tag.Object, tag.Name, ref["creator"], strings.TrimSpace(tag.Message))
+		payload := fmt.Sprintf("object %s\ntype commit\ntag %s\ntagger %s\n\n%s", tag.Object, tag.Name, ref["creator"], tag.MessageRaw)
 		tag.Signature = &CommitSignature{
 			Signature: ref["contents:signature"],
 			Payload:   payload,
diff --git a/modules/git/repo_tag_gogit.go b/modules/git/repo_tag_gogit.go
index 878ab55bf20..bcb58266232 100644
--- a/modules/git/repo_tag_gogit.go
+++ b/modules/git/repo_tag_gogit.go
@@ -7,7 +7,7 @@
 package git
 
 import (
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"github.com/go-git/go-git/v5/plumbing"
 )
@@ -64,12 +64,12 @@ func (repo *Repository) getTag(tagID ObjectID, name string) (*Tag, error) {
 			return nil, err
 		}
 		tag := &Tag{
-			Name:    name,
-			ID:      tagID,
-			Object:  commitID,
-			Type:    tp,
-			Tagger:  commit.Committer,
-			Message: commit.Message(),
+			Name:          name,
+			ID:            tagID,
+			Object:        commitID,
+			Type:          tp,
+			Tagger:        commit.Committer,
+			CommitMessage: CommitMessage{MessageRaw: commit.CommitMessage.MessageRaw},
 		}
 
 		repo.tagCache.Set(tagID.String(), tag)
@@ -86,12 +86,12 @@ func (repo *Repository) getTag(tagID ObjectID, name string) (*Tag, error) {
 	}
 
 	tag := &Tag{
-		Name:    name,
-		ID:      tagID,
-		Object:  commitID.Type().MustID(gogitTag.Target[:]),
-		Type:    tp,
-		Tagger:  &gogitTag.Tagger,
-		Message: gogitTag.Message,
+		Name:          name,
+		ID:            tagID,
+		Object:        commitID.Type().MustID(gogitTag.Target[:]),
+		Type:          tp,
+		Tagger:        &gogitTag.Tagger,
+		CommitMessage: CommitMessage{MessageRaw: gogitTag.Message},
 	}
 
 	repo.tagCache.Set(tagID.String(), tag)
diff --git a/modules/git/repo_tag_nogogit.go b/modules/git/repo_tag_nogogit.go
index a9ac0408216..184e125a8f2 100644
--- a/modules/git/repo_tag_nogogit.go
+++ b/modules/git/repo_tag_nogogit.go
@@ -10,7 +10,7 @@ import (
 	"errors"
 	"io"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // IsTagExist returns true if given tag exists in the repository.
@@ -71,12 +71,12 @@ func (repo *Repository) getTag(tagID ObjectID, name string) (*Tag, error) {
 			return nil, err
 		}
 		tag := &Tag{
-			Name:    name,
-			ID:      tagID,
-			Object:  commitID,
-			Type:    tp,
-			Tagger:  commit.Committer,
-			Message: commit.Message(),
+			Name:          name,
+			ID:            tagID,
+			Object:        commitID,
+			Type:          tp,
+			Tagger:        commit.Committer,
+			CommitMessage: commit.CommitMessage,
 		}
 
 		repo.tagCache.Set(tagID.String(), tag)
diff --git a/modules/git/repo_tag_test.go b/modules/git/repo_tag_test.go
index e6f8e75a0eb..50c6ab50361 100644
--- a/modules/git/repo_tag_test.go
+++ b/modules/git/repo_tag_test.go
@@ -211,13 +211,13 @@ func TestRepository_parseTagRef(t *testing.T) {
 			},
 
 			want: &Tag{
-				Name:      "v1.9.1",
-				ID:        MustIDFromString("ab23e4b7f4cd0caafe0174c0e7ef6d651ba72889"),
-				Object:    MustIDFromString("ab23e4b7f4cd0caafe0174c0e7ef6d651ba72889"),
-				Type:      "commit",
-				Tagger:    parseSignatureFromCommitLine("Foo Bar <foo@bar.com> 1565789218 +0300"),
-				Message:   "Add changelog of v1.9.1 (#7859)\n\n* add changelog of v1.9.1\n* Update CHANGELOG.md\n",
-				Signature: nil,
+				Name:          "v1.9.1",
+				ID:            MustIDFromString("ab23e4b7f4cd0caafe0174c0e7ef6d651ba72889"),
+				Object:        MustIDFromString("ab23e4b7f4cd0caafe0174c0e7ef6d651ba72889"),
+				Type:          "commit",
+				Tagger:        parseSignatureFromCommitLine("Foo Bar <foo@bar.com> 1565789218 +0300"),
+				CommitMessage: CommitMessage{MessageRaw: "Add changelog of v1.9.1 (#7859)\n\n* add changelog of v1.9.1\n* Update CHANGELOG.md\n"},
+				Signature:     nil,
 			},
 		},
 
@@ -240,13 +240,13 @@ func TestRepository_parseTagRef(t *testing.T) {
 			},
 
 			want: &Tag{
-				Name:      "v0.0.1",
-				ID:        MustIDFromString("8c68a1f06fc59c655b7e3905b159d761e91c53c9"),
-				Object:    MustIDFromString("3325fd8a973321fd59455492976c042dde3fd1ca"),
-				Type:      "tag",
-				Tagger:    parseSignatureFromCommitLine("Foo Bar <foo@bar.com> 1565789218 +0300"),
-				Message:   "Add changelog of v1.9.1 (#7859)\n\n* add changelog of v1.9.1\n* Update CHANGELOG.md\n",
-				Signature: nil,
+				Name:          "v0.0.1",
+				ID:            MustIDFromString("8c68a1f06fc59c655b7e3905b159d761e91c53c9"),
+				Object:        MustIDFromString("3325fd8a973321fd59455492976c042dde3fd1ca"),
+				Type:          "tag",
+				Tagger:        parseSignatureFromCommitLine("Foo Bar <foo@bar.com> 1565789218 +0300"),
+				CommitMessage: CommitMessage{MessageRaw: "Add changelog of v1.9.1 (#7859)\n\n* add changelog of v1.9.1\n* Update CHANGELOG.md\n"},
+				Signature:     nil,
 			},
 		},
 
@@ -263,6 +263,7 @@ func TestRepository_parseTagRef(t *testing.T) {
 
 * add changelog of v1.9.1
 * Update CHANGELOG.md
+
 -----BEGIN PGP SIGNATURE-----
 
 aBCGzBAABCgAdFiEEyWRwv/q1Q6IjSv+D4IPOwzt33PoFAmI8jbIACgkQ4IPOwzt3
@@ -298,12 +299,12 @@ qbHDASXl
 			},
 
 			want: &Tag{
-				Name:    "v0.0.1",
-				ID:      MustIDFromString("8c68a1f06fc59c655b7e3905b159d761e91c53c9"),
-				Object:  MustIDFromString("3325fd8a973321fd59455492976c042dde3fd1ca"),
-				Type:    "tag",
-				Tagger:  parseSignatureFromCommitLine("Foo Bar <foo@bar.com> 1565789218 +0300"),
-				Message: "Add changelog of v1.9.1 (#7859)\n\n* add changelog of v1.9.1\n* Update CHANGELOG.md",
+				Name:          "v0.0.1",
+				ID:            MustIDFromString("8c68a1f06fc59c655b7e3905b159d761e91c53c9"),
+				Object:        MustIDFromString("3325fd8a973321fd59455492976c042dde3fd1ca"),
+				Type:          "tag",
+				Tagger:        parseSignatureFromCommitLine("Foo Bar <foo@bar.com> 1565789218 +0300"),
+				CommitMessage: CommitMessage{MessageRaw: "Add changelog of v1.9.1 (#7859)\n\n* add changelog of v1.9.1\n* Update CHANGELOG.md\n"},
 				Signature: &CommitSignature{
 					Signature: `-----BEGIN PGP SIGNATURE-----
 
diff --git a/modules/git/repo_tree.go b/modules/git/repo_tree.go
index e65e2441edb..aa750d3e1ec 100644
--- a/modules/git/repo_tree.go
+++ b/modules/git/repo_tree.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // CommitTreeOpts represents the possible options to CommitTree
diff --git a/modules/git/repo_tree_gogit.go b/modules/git/repo_tree_gogit.go
index 89d34e87daf..622052d64d6 100644
--- a/modules/git/repo_tree_gogit.go
+++ b/modules/git/repo_tree_gogit.go
@@ -9,7 +9,7 @@ package git
 import (
 	"errors"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 
 	"github.com/go-git/go-git/v5/plumbing"
 )
diff --git a/modules/git/signature.go b/modules/git/signature.go
index f50a097758b..231b2e25cd1 100644
--- a/modules/git/signature.go
+++ b/modules/git/signature.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // Helper to get a signature from the commit line, which looks like:
diff --git a/modules/git/signature_nogogit.go b/modules/git/signature_nogogit.go
index 0d19c0abdcc..d4ddfb23ce8 100644
--- a/modules/git/signature_nogogit.go
+++ b/modules/git/signature_nogogit.go
@@ -10,7 +10,7 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // Signature represents the Author, Committer or Tagger information.
diff --git a/modules/git/submodule.go b/modules/git/submodule.go
index ed69cbe55d1..1b100c06c58 100644
--- a/modules/git/submodule.go
+++ b/modules/git/submodule.go
@@ -8,8 +8,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
 )
 
 type TemplateSubmoduleCommit struct {
diff --git a/modules/git/submodule_test.go b/modules/git/submodule_test.go
index 22bd5bf71e5..25355ac32a6 100644
--- a/modules/git/submodule_test.go
+++ b/modules/git/submodule_test.go
@@ -8,7 +8,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/git/tag.go b/modules/git/tag.go
index 8bf3658d62f..601debde260 100644
--- a/modules/git/tag.go
+++ b/modules/git/tag.go
@@ -7,17 +7,18 @@ import (
 	"bytes"
 	"sort"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // Tag represents a Git tag.
 type Tag struct {
+	CommitMessage
+
 	Name      string
 	ID        ObjectID
 	Object    ObjectID // The id of this commit object
 	Type      string
 	Tagger    *Signature
-	Message   string
 	Signature *CommitSignature
 }
 
@@ -87,7 +88,7 @@ func parseTagData(objectFormat ObjectFormat, data []byte) (*Tag, error) {
 		pos += eol + 1
 	}
 	payload, msg, sign := parsePayloadSignature(data, pos)
-	tag.Message = msg
+	tag.MessageRaw = msg
 	if len(sign) > 0 {
 		tag.Signature = &CommitSignature{Signature: sign, Payload: payload}
 	}
diff --git a/modules/git/tag_test.go b/modules/git/tag_test.go
index ba02c28946d..6a65e359a25 100644
--- a/modules/git/tag_test.go
+++ b/modules/git/tag_test.go
@@ -28,7 +28,6 @@ tagger Lucas Michot <lucas@semalead.com> 1484491741 +0100
 				Object:    MustIDFromString("3b114ab800c6432ad42387ccf6bc8d4388a2885a"),
 				Type:      "commit",
 				Tagger:    &Signature{Name: "Lucas Michot", Email: "lucas@semalead.com", When: time.Unix(1484491741, 0).In(time.FixedZone("", 3600))},
-				Message:   "",
 				Signature: nil,
 			},
 		},
@@ -43,13 +42,13 @@ o
 
 ono`,
 			expected: Tag{
-				Name:      "",
-				ID:        Sha1ObjectFormat.EmptyObjectID(),
-				Object:    MustIDFromString("7cdf42c0b1cc763ab7e4c33c47a24e27c66bfccc"),
-				Type:      "commit",
-				Tagger:    &Signature{Name: "Lucas Michot", Email: "lucas@semalead.com", When: time.Unix(1484553735, 0).In(time.FixedZone("", 3600))},
-				Message:   "test message\no\n\nono",
-				Signature: nil,
+				Name:          "",
+				ID:            Sha1ObjectFormat.EmptyObjectID(),
+				Object:        MustIDFromString("7cdf42c0b1cc763ab7e4c33c47a24e27c66bfccc"),
+				Type:          "commit",
+				Tagger:        &Signature{Name: "Lucas Michot", Email: "lucas@semalead.com", When: time.Unix(1484553735, 0).In(time.FixedZone("", 3600))},
+				CommitMessage: CommitMessage{MessageRaw: "test message\no\n\nono"},
+				Signature:     nil,
 			},
 		},
 		{
@@ -64,12 +63,12 @@ dummy signature
 -----END SSH SIGNATURE-----
 `,
 			expected: Tag{
-				Name:    "",
-				ID:      Sha1ObjectFormat.EmptyObjectID(),
-				Object:  MustIDFromString("7cdf42c0b1cc763ab7e4c33c47a24e27c66bfaaa"),
-				Type:    "commit",
-				Tagger:  &Signature{Name: "dummy user", Email: "dummy-email@example.com", When: time.Unix(1484491741, 0).In(time.FixedZone("", 3600))},
-				Message: "dummy message",
+				Name:          "",
+				ID:            Sha1ObjectFormat.EmptyObjectID(),
+				Object:        MustIDFromString("7cdf42c0b1cc763ab7e4c33c47a24e27c66bfaaa"),
+				Type:          "commit",
+				Tagger:        &Signature{Name: "dummy user", Email: "dummy-email@example.com", When: time.Unix(1484491741, 0).In(time.FixedZone("", 3600))},
+				CommitMessage: CommitMessage{MessageRaw: "dummy message"},
 				Signature: &CommitSignature{
 					Signature: `-----BEGIN SSH SIGNATURE-----
 dummy signature
@@ -93,5 +92,5 @@ dummy message`,
 
 	tag, err := parseTagData(Sha1ObjectFormat, []byte("type commit\n\nfoo\n-----BEGIN SSH SIGNATURE-----\ncorrupted..."))
 	assert.NoError(t, err)
-	assert.Equal(t, "foo\n-----BEGIN SSH SIGNATURE-----\ncorrupted...", tag.Message)
+	assert.Equal(t, "foo\n-----BEGIN SSH SIGNATURE-----\ncorrupted...", tag.CommitMessage.MessageRaw)
 }
diff --git a/modules/git/tree.go b/modules/git/tree.go
index c1898b20cbe..854f45c56f4 100644
--- a/modules/git/tree.go
+++ b/modules/git/tree.go
@@ -8,7 +8,7 @@ import (
 	"bytes"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 type TreeCommon struct {
diff --git a/modules/git/tree_entry.go b/modules/git/tree_entry.go
index e7e4ea2d5bd..bd7e5131b53 100644
--- a/modules/git/tree_entry.go
+++ b/modules/git/tree_entry.go
@@ -9,7 +9,7 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // TreeEntry the leaf in the git tree
diff --git a/modules/git/tree_entry_common_test.go b/modules/git/tree_entry_common_test.go
index 8e20ee56ff6..2907077693f 100644
--- a/modules/git/tree_entry_common_test.go
+++ b/modules/git/tree_entry_common_test.go
@@ -6,7 +6,7 @@ package git
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/git/tree_entry_gogit_test.go b/modules/git/tree_entry_gogit_test.go
index ed14b45e9e0..7727b08cb91 100644
--- a/modules/git/tree_entry_gogit_test.go
+++ b/modules/git/tree_entry_gogit_test.go
@@ -21,7 +21,7 @@ func TestEntryGogit(t *testing.T) {
 		EntryModeTree:    filemode.Dir,
 	}
 	for emode, fmode := range cases {
-		assert.EqualValues(t, fmode, entryModeToGogitFileMode(emode))
-		assert.EqualValues(t, emode, gogitFileModeToEntryMode(fmode))
+		assert.Equal(t, fmode, entryModeToGogitFileMode(emode))
+		assert.Equal(t, emode, gogitFileModeToEntryMode(fmode))
 	}
 }
diff --git a/modules/git/tree_entry_nogogit.go b/modules/git/tree_entry_nogogit.go
index 0a19b38d3e6..467a0d76950 100644
--- a/modules/git/tree_entry_nogogit.go
+++ b/modules/git/tree_entry_nogogit.go
@@ -5,7 +5,7 @@
 
 package git
 
-import "code.gitea.io/gitea/modules/log"
+import "gitea.dev/modules/log"
 
 // Size returns the size of the entry
 func (te *TreeEntry) Size() int64 {
diff --git a/modules/git/tree_nogogit.go b/modules/git/tree_nogogit.go
index 5d951dad0dc..1d78ecdee24 100644
--- a/modules/git/tree_nogogit.go
+++ b/modules/git/tree_nogogit.go
@@ -9,7 +9,7 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // Tree represents a flat directory listing.
diff --git a/modules/git/url/url.go b/modules/git/url/url.go
index aa6fa31c5e3..d73a4fbcbf6 100644
--- a/modules/git/url/url.go
+++ b/modules/git/url/url.go
@@ -10,9 +10,9 @@ import (
 	stdurl "net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // ErrWrongURLFormat represents an error with wrong url format
diff --git a/modules/git/url/url_test.go b/modules/git/url/url_test.go
index 76aa74a1287..3a6dcf9632e 100644
--- a/modules/git/url/url_test.go
+++ b/modules/git/url/url_test.go
@@ -9,9 +9,9 @@ import (
 	"net/url"
 	"testing"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/git/utils.go b/modules/git/utils.go
index e7d30ce9eee..848af0b9e70 100644
--- a/modules/git/utils.go
+++ b/modules/git/utils.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // ObjectCache provides thread-safe cache operations.
diff --git a/modules/gitrepo/archive.go b/modules/gitrepo/archive.go
index 191a1bd2c03..d7075d6dd7b 100644
--- a/modules/gitrepo/archive.go
+++ b/modules/gitrepo/archive.go
@@ -13,8 +13,8 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
 )
 
 // CreateArchive create archive content to the target path
diff --git a/modules/gitrepo/blame.go b/modules/gitrepo/blame.go
index 2352da17604..e2a5eefa5f4 100644
--- a/modules/gitrepo/blame.go
+++ b/modules/gitrepo/blame.go
@@ -9,9 +9,9 @@ import (
 	"context"
 	"io"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
 )
 
 func LineBlame(ctx context.Context, repo Repository, revision, file string, line uint) (string, error) {
diff --git a/modules/gitrepo/blame_sha256_test.go b/modules/gitrepo/blame_sha256_test.go
index e92931d596a..5577432cafd 100644
--- a/modules/gitrepo/blame_sha256_test.go
+++ b/modules/gitrepo/blame_sha256_test.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/gitrepo/blame_test.go b/modules/gitrepo/blame_test.go
index 0307a5fd33c..54be64f996b 100644
--- a/modules/gitrepo/blame_test.go
+++ b/modules/gitrepo/blame_test.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/gitrepo/branch.go b/modules/gitrepo/branch.go
index 4c40d1fba36..09594ca35a0 100644
--- a/modules/gitrepo/branch.go
+++ b/modules/gitrepo/branch.go
@@ -8,8 +8,8 @@ import (
 	"errors"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // GetBranchesByPath returns a branch by its path
diff --git a/modules/gitrepo/cat_file.go b/modules/gitrepo/cat_file.go
index 42ca23acdeb..e824c07923a 100644
--- a/modules/gitrepo/cat_file.go
+++ b/modules/gitrepo/cat_file.go
@@ -6,7 +6,7 @@ package gitrepo
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 func NewBatch(ctx context.Context, repo Repository) (git.CatFileBatchCloser, error) {
diff --git a/modules/gitrepo/clone.go b/modules/gitrepo/clone.go
index a0e4cc814cb..e1718fd8791 100644
--- a/modules/gitrepo/clone.go
+++ b/modules/gitrepo/clone.go
@@ -6,7 +6,7 @@ package gitrepo
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 // CloneExternalRepo clones an external repository to the managed repository.
diff --git a/modules/gitrepo/command.go b/modules/gitrepo/command.go
index fd21b9a7254..f672ca1dbd7 100644
--- a/modules/gitrepo/command.go
+++ b/modules/gitrepo/command.go
@@ -6,7 +6,7 @@ package gitrepo
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 func RunCmd(ctx context.Context, repo Repository, cmd *gitcmd.Command) error {
diff --git a/modules/gitrepo/commit.go b/modules/gitrepo/commit.go
index 0a8cb0544cb..38785dcb978 100644
--- a/modules/gitrepo/commit.go
+++ b/modules/gitrepo/commit.go
@@ -9,8 +9,8 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // CommitsCountOptions the options when counting commits
diff --git a/modules/gitrepo/commit_file.go b/modules/gitrepo/commit_file.go
index 437b3b51ad1..ce4f51ffdab 100644
--- a/modules/gitrepo/commit_file.go
+++ b/modules/gitrepo/commit_file.go
@@ -8,8 +8,8 @@ import (
 	"context"
 	"io"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
 )
 
 // CommitFileStatus represents status of files in a commit.
diff --git a/modules/gitrepo/commitgraph.go b/modules/gitrepo/commitgraph.go
index 7310e167f69..adafd107bf6 100644
--- a/modules/gitrepo/commitgraph.go
+++ b/modules/gitrepo/commitgraph.go
@@ -6,7 +6,7 @@ package gitrepo
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 func WriteCommitGraph(ctx context.Context, repo Repository) error {
diff --git a/modules/gitrepo/compare.go b/modules/gitrepo/compare.go
index 7e38d33e6f2..16280312305 100644
--- a/modules/gitrepo/compare.go
+++ b/modules/gitrepo/compare.go
@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // DivergeObject represents commit count diverging commits
diff --git a/modules/gitrepo/compare_test.go b/modules/gitrepo/compare_test.go
index 91ee32bed54..770a3589ea8 100644
--- a/modules/gitrepo/compare_test.go
+++ b/modules/gitrepo/compare_test.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/gitrepo/config.go b/modules/gitrepo/config.go
index 4940f1c0788..a6e97d594d2 100644
--- a/modules/gitrepo/config.go
+++ b/modules/gitrepo/config.go
@@ -6,8 +6,8 @@ package gitrepo
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/globallock"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/globallock"
 )
 
 func getRepoConfigLockKey(repoStoragePath string) string {
diff --git a/modules/gitrepo/diff.go b/modules/gitrepo/diff.go
index 0092cf0bb8c..5aaddf0560a 100644
--- a/modules/gitrepo/diff.go
+++ b/modules/gitrepo/diff.go
@@ -10,7 +10,7 @@ import (
 	"regexp"
 	"strconv"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // GetDiffShortStatByCmdArgs counts number of changed files, number of additions and deletions
diff --git a/modules/gitrepo/fetch.go b/modules/gitrepo/fetch.go
index 0474d6111e6..b50571e5b2b 100644
--- a/modules/gitrepo/fetch.go
+++ b/modules/gitrepo/fetch.go
@@ -6,8 +6,8 @@ package gitrepo
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/globallock"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/globallock"
 )
 
 // FetchRemoteCommit fetches a specific commit and its related objects from a remote
diff --git a/modules/gitrepo/fsck.go b/modules/gitrepo/fsck.go
index f74ca3b46a4..42cf9cb4f98 100644
--- a/modules/gitrepo/fsck.go
+++ b/modules/gitrepo/fsck.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"time"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 // Fsck verifies the connectivity and validity of the objects in the database
diff --git a/modules/gitrepo/gitrepo.go b/modules/gitrepo/gitrepo.go
index 535d72ed98a..1af6f4406c6 100644
--- a/modules/gitrepo/gitrepo.go
+++ b/modules/gitrepo/gitrepo.go
@@ -11,11 +11,11 @@ import (
 	"os"
 	"path/filepath"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // Repository represents a git repository which stored in a disk
diff --git a/modules/gitrepo/hooks.go b/modules/gitrepo/hooks.go
index d9d4a88ff14..19b24e6abb4 100644
--- a/modules/gitrepo/hooks.go
+++ b/modules/gitrepo/hooks.go
@@ -10,8 +10,8 @@ import (
 	"path/filepath"
 	"runtime"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 func getHookTemplates() (hookNames, hookTpls, giteaHookTpls []string) {
diff --git a/modules/gitrepo/main_test.go b/modules/gitrepo/main_test.go
index 08afdffcc6a..d7dd292155c 100644
--- a/modules/gitrepo/main_test.go
+++ b/modules/gitrepo/main_test.go
@@ -7,8 +7,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
 )
 
 func TestMain(m *testing.M) {
diff --git a/modules/gitrepo/merge.go b/modules/gitrepo/merge.go
index 51983929495..831b96102b1 100644
--- a/modules/gitrepo/merge.go
+++ b/modules/gitrepo/merge.go
@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/util"
 )
 
 // MergeBase checks and returns merge base of two commits.
diff --git a/modules/gitrepo/merge_tree.go b/modules/gitrepo/merge_tree.go
index 6151b1179fc..a026882f0e3 100644
--- a/modules/gitrepo/merge_tree.go
+++ b/modules/gitrepo/merge_tree.go
@@ -8,8 +8,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/util"
 )
 
 const MaxConflictedDetectFiles = 10
diff --git a/modules/gitrepo/merge_tree_test.go b/modules/gitrepo/merge_tree_test.go
index 9327a0c3d80..7d1075fd7b3 100644
--- a/modules/gitrepo/merge_tree_test.go
+++ b/modules/gitrepo/merge_tree_test.go
@@ -7,7 +7,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/gitrepo/push.go b/modules/gitrepo/push.go
index 920c317f796..c7debe431a8 100644
--- a/modules/gitrepo/push.go
+++ b/modules/gitrepo/push.go
@@ -6,7 +6,7 @@ package gitrepo
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 // PushToExternal pushes a managed repository to an external remote.
diff --git a/modules/gitrepo/ref.go b/modules/gitrepo/ref.go
index 52125283268..f8f78d4bcc5 100644
--- a/modules/gitrepo/ref.go
+++ b/modules/gitrepo/ref.go
@@ -6,7 +6,7 @@ package gitrepo
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	"gitea.dev/modules/git/gitcmd"
 )
 
 func UpdateRef(ctx context.Context, repo Repository, refName, newCommitID string) error {
diff --git a/modules/gitrepo/remote.go b/modules/gitrepo/remote.go
index 3cbc34eedb0..eeef123ba72 100644
--- a/modules/gitrepo/remote.go
+++ b/modules/gitrepo/remote.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"errors"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	giturl "code.gitea.io/gitea/modules/git/url"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	giturl "gitea.dev/modules/git/url"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/util"
 )
 
 type RemoteOption string
diff --git a/modules/gitrepo/signing.go b/modules/gitrepo/signing.go
index 2f77758d8c8..aa8f947e999 100644
--- a/modules/gitrepo/signing.go
+++ b/modules/gitrepo/signing.go
@@ -6,7 +6,7 @@ package gitrepo
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 func GetSigningKey(ctx context.Context) (*git.SigningKey, *git.Signature) {
diff --git a/modules/gitrepo/tag.go b/modules/gitrepo/tag.go
index 58ed204a99f..47abcac8ceb 100644
--- a/modules/gitrepo/tag.go
+++ b/modules/gitrepo/tag.go
@@ -6,7 +6,7 @@ package gitrepo
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 // IsTagExist returns true if given tag exists in the repository.
diff --git a/modules/gitrepo/walk_nogogit.go b/modules/gitrepo/walk_nogogit.go
index ff9555996df..b4f6f7dfc4e 100644
--- a/modules/gitrepo/walk_nogogit.go
+++ b/modules/gitrepo/walk_nogogit.go
@@ -8,7 +8,7 @@ package gitrepo
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 // WalkReferences walks all the references from the repository
diff --git a/modules/glob/glob.go b/modules/glob/glob.go
index d4ca77e2ee1..edc900b72ba 100644
--- a/modules/glob/glob.go
+++ b/modules/glob/glob.go
@@ -7,8 +7,10 @@ import (
 	"errors"
 	"fmt"
 	"regexp"
+	"slices"
+	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // Reference: https://github.com/gobwas/glob/blob/master/glob.go
@@ -18,19 +20,27 @@ type Glob interface {
 }
 
 type globCompiler struct {
+	regexpQuestion     bool
+	regexpPlus         bool
+	superWildcardRight bool
+	supportNegative    bool
+
+	separators        []rune
 	nonSeparatorChars string
 	globPattern       []rune
 	regexpPattern     string
 	regexp            *regexp.Regexp
+	builder           *strings.Builder
 	pos               int
+	negativeFlip      bool
 }
 
 // compileChars compiles character class patterns like [abc] or [!abc]
-func (g *globCompiler) compileChars() (string, error) {
-	result := ""
+func (g *globCompiler) compileChars() error {
+	g.builder.WriteByte('[')
 	if g.pos < len(g.globPattern) && g.globPattern[g.pos] == '!' {
 		g.pos++
-		result += "^"
+		g.builder.WriteByte('^')
 	}
 
 	for g.pos < len(g.globPattern) {
@@ -38,81 +48,111 @@ func (g *globCompiler) compileChars() (string, error) {
 		g.pos++
 
 		if c == ']' {
-			return "[" + result + "]", nil
+			g.builder.WriteByte(']')
+			return nil
 		}
 
 		if c == '\\' {
 			if g.pos >= len(g.globPattern) {
-				return "", errors.New("unterminated character class escape")
+				return errors.New("unterminated character class escape")
 			}
-			result += "\\" + string(g.globPattern[g.pos])
+			g.builder.WriteByte('\\')
+			g.builder.WriteRune(g.globPattern[g.pos])
 			g.pos++
 		} else {
-			result += string(c)
+			g.builder.WriteRune(c)
 		}
 	}
 
-	return "", errors.New("unterminated character class")
+	return errors.New("unterminated character class")
 }
 
 // compile compiles the glob pattern into a regular expression
-func (g *globCompiler) compile(subPattern bool) (string, error) {
-	result := ""
-
+func (g *globCompiler) compile(subPattern bool) error {
 	for g.pos < len(g.globPattern) {
 		c := g.globPattern[g.pos]
 		g.pos++
 
 		if subPattern && c == '}' {
-			return "(" + result + ")", nil
+			g.builder.WriteByte(')')
+			return nil
 		}
 
 		switch c {
 		case '*':
 			if g.pos < len(g.globPattern) && g.globPattern[g.pos] == '*' {
-				g.pos++
-				result += ".*" // match any sequence of characters
+				var matchRightSep bool
+				if g.superWildcardRight {
+					// check "**/" pattern, then the wildcards should also match the right separator
+					// e.g.: "**/docs" should match "docs"
+					var rightRune rune
+					if g.pos+1 < len(g.globPattern) {
+						rightRune = g.globPattern[g.pos+1]
+					}
+					if slices.Contains(g.separators, rightRune) {
+						matchRightSep = g.pos-2 < 0 || g.globPattern[g.pos-2] == rightRune
+					}
+				}
+				if matchRightSep {
+					g.pos += 2
+				} else {
+					g.pos++
+				}
+				g.builder.WriteString(".*") // match any sequence of characters
 			} else {
-				result += g.nonSeparatorChars + "*" // match any sequence of non-separator characters
+				g.builder.WriteString(g.nonSeparatorChars)
+				g.builder.WriteByte('*') // match any sequence of non-separator characters
 			}
 		case '?':
-			result += g.nonSeparatorChars // match any single non-separator character
+			if g.regexpQuestion {
+				g.builder.WriteByte('?')
+			} else {
+				g.builder.WriteString(g.nonSeparatorChars) // match any single non-separator character
+			}
+		case '+':
+			if g.regexpPlus {
+				g.builder.WriteByte('+')
+			} else {
+				g.builder.WriteByte('\\')
+				g.builder.WriteRune(c)
+			}
 		case '[':
-			chars, err := g.compileChars()
-			if err != nil {
-				return "", err
+			if err := g.compileChars(); err != nil {
+				return err
 			}
-			result += chars
 		case '{':
-			subResult, err := g.compile(true)
-			if err != nil {
-				return "", err
+			g.builder.WriteByte('(')
+			if err := g.compile(true); err != nil {
+				return err
 			}
-			result += subResult
 		case ',':
 			if subPattern {
-				result += "|"
+				g.builder.WriteByte('|')
 			} else {
-				result += ","
+				g.builder.WriteByte(',')
 			}
 		case '\\':
 			if g.pos >= len(g.globPattern) {
-				return "", errors.New("no character to escape")
+				return errors.New("no character to escape")
 			}
-			result += "\\" + string(g.globPattern[g.pos])
+			g.builder.WriteByte('\\')
+			g.builder.WriteRune(g.globPattern[g.pos])
 			g.pos++
-		case '.', '+', '^', '$', '(', ')', '|':
-			result += "\\" + string(c) // escape regexp special characters
+		case '.', '^', '$', '(', ')', '|':
+			g.builder.WriteByte('\\')
+			g.builder.WriteRune(c) // escape regexp special characters
 		default:
-			result += string(c)
+			g.builder.WriteRune(c)
 		}
 	}
 
-	return result, nil
+	return nil
 }
 
-func newGlobCompiler(pattern string, separators ...rune) (Glob, error) {
-	g := &globCompiler{globPattern: []rune(pattern)}
+func initGlobCompiler(g *globCompiler, pattern string, separators []rune) (Glob, error) {
+	g.globPattern = []rune(pattern)
+	g.separators = separators
+	g.builder = new(strings.Builder)
 
 	// Escape separators for use in character class
 	escapedSeparators := regexp.QuoteMeta(string(separators))
@@ -122,12 +162,18 @@ func newGlobCompiler(pattern string, separators ...rune) (Glob, error) {
 		g.nonSeparatorChars = "."
 	}
 
-	compiled, err := g.compile(false)
-	if err != nil {
-		return nil, err
+	if g.supportNegative && len(g.globPattern) > 0 && g.globPattern[0] == '!' {
+		g.negativeFlip = true
+		g.pos++
 	}
 
-	g.regexpPattern = "^" + compiled + "$"
+	g.builder.WriteByte('^')
+	if err := g.compile(false); err != nil {
+		return nil, err
+	}
+	g.builder.WriteByte('$')
+	g.regexpPattern = g.builder.String()
+	g.builder = nil
 
 	regex, err := regexp.Compile(g.regexpPattern)
 	if err != nil {
@@ -139,11 +185,24 @@ func newGlobCompiler(pattern string, separators ...rune) (Glob, error) {
 }
 
 func (g *globCompiler) Match(s string) bool {
-	return g.regexp.MatchString(s)
+	ret := g.regexp.MatchString(s)
+	if g.negativeFlip {
+		ret = !ret
+	}
+	return ret
 }
 
 func Compile(pattern string, separators ...rune) (Glob, error) {
-	return newGlobCompiler(pattern, separators...)
+	return initGlobCompiler(&globCompiler{}, pattern, separators)
+}
+
+func CompileWorkflow(pattern string) (Glob, error) {
+	return initGlobCompiler(&globCompiler{
+		regexpQuestion:     true,
+		regexpPlus:         true,
+		superWildcardRight: true,
+		supportNegative:    true,
+	}, pattern, []rune{'/'})
 }
 
 func MustCompile(pattern string, separators ...rune) Glob {
diff --git a/modules/globallock/globallock.go b/modules/globallock/globallock.go
index 24e91881bb3..eec9ac04c26 100644
--- a/modules/globallock/globallock.go
+++ b/modules/globallock/globallock.go
@@ -6,31 +6,39 @@ package globallock
 import (
 	"context"
 	"sync"
+	"sync/atomic"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 var (
-	defaultLocker Locker
-	initOnce      sync.Once
-	initFunc      = func() {
-		switch setting.GlobalLock.ServiceType {
-		case "redis":
-			defaultLocker = NewRedisLocker(setting.GlobalLock.ServiceConnStr)
-		case "memory":
-			fallthrough
-		default:
-			defaultLocker = NewMemoryLocker()
-		}
-	} // define initFunc as a variable to make it possible to change it in tests
+	defaultLocker atomic.Pointer[Locker]
+	defaultMutex  sync.Mutex
 )
 
+func initDefaultLocker() Locker {
+	switch setting.GlobalLock.ServiceType {
+	case "redis":
+		return NewRedisLocker(setting.GlobalLock.ServiceConnStr)
+	default: // "memory"
+		return NewMemoryLocker()
+	}
+}
+
 // DefaultLocker returns the default locker.
 func DefaultLocker() Locker {
-	initOnce.Do(func() {
-		initFunc()
-	})
-	return defaultLocker
+	ptr := defaultLocker.Load()
+	if ptr == nil {
+		defaultMutex.Lock()
+		ptr = defaultLocker.Load()
+		if ptr == nil {
+			ptr = new(initDefaultLocker())
+			defaultLocker.Store(ptr)
+		}
+		defaultMutex.Unlock()
+		ptr = defaultLocker.Load()
+	}
+	return *ptr
 }
 
 // Lock tries to acquire a lock for the given key, it uses the default locker.
diff --git a/modules/globallock/globallock_test.go b/modules/globallock/globallock_test.go
index 8d55d9f6998..7bee4409daa 100644
--- a/modules/globallock/globallock_test.go
+++ b/modules/globallock/globallock_test.go
@@ -5,7 +5,6 @@ package globallock
 
 import (
 	"context"
-	"os"
 	"sync"
 	"testing"
 
@@ -15,50 +14,13 @@ import (
 
 func TestLockAndDo(t *testing.T) {
 	t.Run("redis", func(t *testing.T) {
-		url := "redis://127.0.0.1:6379/0"
-		if os.Getenv("CI") == "" {
-			// Make it possible to run tests against a local redis instance
-			url = os.Getenv("TEST_REDIS_URL")
-			if url == "" {
-				t.Skip("TEST_REDIS_URL not set and not running in CI")
-				return
-			}
-		}
-
-		oldDefaultLocker := defaultLocker
-		oldInitFunc := initFunc
-		defer func() {
-			defaultLocker = oldDefaultLocker
-			initFunc = oldInitFunc
-			if defaultLocker == nil {
-				initOnce = sync.Once{}
-			}
-		}()
-
-		initOnce = sync.Once{}
-		initFunc = func() {
-			defaultLocker = NewRedisLocker(url)
-		}
-
+		locker := newTestRedisLocker(t)
+		defaultLocker.Store(new(locker))
 		testLockAndDo(t)
-		require.NoError(t, defaultLocker.(*redisLocker).Close())
+		require.NoError(t, locker.(*redisLocker).Close())
 	})
 	t.Run("memory", func(t *testing.T) {
-		oldDefaultLocker := defaultLocker
-		oldInitFunc := initFunc
-		defer func() {
-			defaultLocker = oldDefaultLocker
-			initFunc = oldInitFunc
-			if defaultLocker == nil {
-				initOnce = sync.Once{}
-			}
-		}()
-
-		initOnce = sync.Once{}
-		initFunc = func() {
-			defaultLocker = NewMemoryLocker()
-		}
-
+		defaultLocker.Store(new(NewMemoryLocker()))
 		testLockAndDo(t)
 	})
 }
@@ -69,13 +31,10 @@ func testLockAndDo(t *testing.T) {
 	ctx := t.Context()
 	count := 0
 	wg := sync.WaitGroup{}
-	wg.Add(concurrency)
 	for range concurrency {
-		go func() {
-			defer wg.Done()
+		wg.Go(func() {
 			err := LockAndDo(ctx, "test", func(ctx context.Context) error {
 				count++
-
 				// It's impossible to acquire the lock inner the function
 				ok, err := TryLockAndDo(ctx, "test", func(ctx context.Context) error {
 					assert.Fail(t, "should not acquire the lock")
@@ -83,13 +42,11 @@ func testLockAndDo(t *testing.T) {
 				})
 				assert.False(t, ok)
 				assert.NoError(t, err)
-
 				return nil
 			})
-			require.NoError(t, err)
-		}()
+			assert.NoError(t, err)
+		})
 	}
-
 	wg.Wait()
 
 	assert.Equal(t, concurrency, count)
diff --git a/modules/globallock/locker_test.go b/modules/globallock/locker_test.go
index 14cb0ec3888..131270abd31 100644
--- a/modules/globallock/locker_test.go
+++ b/modules/globallock/locker_test.go
@@ -10,29 +10,30 @@ import (
 	"testing"
 	"time"
 
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
+
 	"github.com/go-redsync/redsync/v4"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func newTestRedisLocker(t *testing.T) Locker {
+	t.Helper()
+	redisURL := util.IfZero(os.Getenv("TEST_REDIS_URL"), "redis://127.0.0.1:6379/0")
+	rl := NewRedisLocker(redisURL).(*redisLocker)
+	err := rl.conn.Ping(t.Context()).Err()
+	if err != nil && test.AllowSkipExternalService() {
+		t.Skip("no redis server for testing, skipped")
+	}
+	require.NoError(t, err, "redis error for testing: %v", err)
+	return rl
+}
+
 func TestLocker(t *testing.T) {
 	t.Run("redis", func(t *testing.T) {
-		url := "redis://127.0.0.1:6379/0"
-		if os.Getenv("CI") == "" {
-			// Make it possible to run tests against a local redis instance
-			url = os.Getenv("TEST_REDIS_URL")
-			if url == "" {
-				t.Skip("TEST_REDIS_URL not set and not running in CI")
-				return
-			}
-		}
-		oldExpiry := redisLockExpiry
-		redisLockExpiry = 5 * time.Second // make it shorter for testing
-		defer func() {
-			redisLockExpiry = oldExpiry
-		}()
-
-		locker := NewRedisLocker(url)
+		defer test.MockVariableValue(&redisLockExpiry, 5*time.Second)() // make it shorter for testing
+		locker := newTestRedisLocker(t)
 		testLocker(t, locker)
 		testRedisLocker(t, locker.(*redisLocker))
 		require.NoError(t, locker.(*redisLocker).Close())
diff --git a/modules/globallock/redis_locker.go b/modules/globallock/redis_locker.go
index 45dc769fd49..6c9fa80a7f4 100644
--- a/modules/globallock/redis_locker.go
+++ b/modules/globallock/redis_locker.go
@@ -10,10 +10,11 @@ import (
 	"sync/atomic"
 	"time"
 
-	"code.gitea.io/gitea/modules/nosql"
+	"gitea.dev/modules/nosql"
 
 	"github.com/go-redsync/redsync/v4"
 	"github.com/go-redsync/redsync/v4/redis/goredis/v9"
+	"github.com/redis/go-redis/v9"
 )
 
 const redisLockKeyPrefix = "gitea:globallock:"
@@ -23,7 +24,8 @@ const redisLockKeyPrefix = "gitea:globallock:"
 var redisLockExpiry = 30 * time.Second
 
 type redisLocker struct {
-	rs *redsync.Redsync
+	conn redis.UniversalClient
+	rs   *redsync.Redsync
 
 	mutexM   sync.Map
 	closed   atomic.Bool
@@ -33,17 +35,13 @@ type redisLocker struct {
 var _ Locker = &redisLocker{}
 
 func NewRedisLocker(connection string) Locker {
+	conn := nosql.GetManager().GetRedisClient(connection)
 	l := &redisLocker{
-		rs: redsync.New(
-			goredis.NewPool(
-				nosql.GetManager().GetRedisClient(connection),
-			),
-		),
+		conn: conn,
+		rs:   redsync.New(goredis.NewPool(conn)),
 	}
-
 	l.extendWg.Add(1)
 	l.startExtend()
-
 	return l
 }
 
diff --git a/modules/google/groups.go b/modules/google/groups.go
index b8a3af159dc..9bcd8bf490a 100644
--- a/modules/google/groups.go
+++ b/modules/google/groups.go
@@ -10,8 +10,8 @@ import (
 	"net/http"
 	"net/url"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
 
 	"github.com/markbates/goth"
 )
diff --git a/modules/graceful/manager.go b/modules/graceful/manager.go
index 51bd5a23346..24d4c3f61e3 100644
--- a/modules/graceful/manager.go
+++ b/modules/graceful/manager.go
@@ -9,10 +9,10 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/gtprof"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/gtprof"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
 )
 
 type state uint8
@@ -98,7 +98,7 @@ func (g *Manager) RunAtTerminate(terminate func()) {
 			defer g.terminateWaitGroup.Done()
 			defer func() {
 				if err := recover(); err != nil {
-					log.Critical("PANIC during RunAtTerminate: %v\nStacktrace: %s", err, log.Stack(2))
+					log.Error("PANIC during RunAtTerminate: %v\nStacktrace: %s", err, log.Stack(2))
 				}
 			}()
 			terminate()
@@ -113,7 +113,7 @@ func (g *Manager) RunAtShutdown(ctx context.Context, shutdown func()) {
 		func() {
 			defer func() {
 				if err := recover(); err != nil {
-					log.Critical("PANIC during RunAtShutdown: %v\nStacktrace: %s", err, log.Stack(2))
+					log.Error("PANIC during RunAtShutdown: %v\nStacktrace: %s", err, log.Stack(2))
 				}
 			}()
 			select {
diff --git a/modules/graceful/manager_common.go b/modules/graceful/manager_common.go
index 7cfbdfbeb0e..04afeee61b1 100644
--- a/modules/graceful/manager_common.go
+++ b/modules/graceful/manager_common.go
@@ -9,7 +9,7 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/gtprof"
+	"gitea.dev/modules/gtprof"
 )
 
 // FIXME: it seems that there is a bug when using systemd Type=notify: the "Install Page" (INSTALL_LOCK=false) doesn't notify properly.
diff --git a/modules/graceful/manager_unix.go b/modules/graceful/manager_unix.go
index d03fff9b5bb..fb540a79c96 100644
--- a/modules/graceful/manager_unix.go
+++ b/modules/graceful/manager_unix.go
@@ -15,10 +15,10 @@ import (
 	"syscall"
 	"time"
 
-	"code.gitea.io/gitea/modules/graceful/releasereopen"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/graceful/releasereopen"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
 )
 
 func pidMsg() systemdNotifyMsg {
diff --git a/modules/graceful/manager_windows.go b/modules/graceful/manager_windows.go
index 9592dd6b39c..be87202bbb8 100644
--- a/modules/graceful/manager_windows.go
+++ b/modules/graceful/manager_windows.go
@@ -13,8 +13,8 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"golang.org/x/sys/windows/svc"
 	"golang.org/x/sys/windows/svc/debug"
diff --git a/modules/graceful/net_unix.go b/modules/graceful/net_unix.go
index a06f78dafe8..98227cb4020 100644
--- a/modules/graceful/net_unix.go
+++ b/modules/graceful/net_unix.go
@@ -16,9 +16,9 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 const (
diff --git a/modules/graceful/server.go b/modules/graceful/server.go
index b440f68ab55..18e9b96b8fe 100644
--- a/modules/graceful/server.go
+++ b/modules/graceful/server.go
@@ -14,9 +14,9 @@ import (
 	"syscall"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/proxyprotocol"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/proxyprotocol"
+	"gitea.dev/modules/setting"
 )
 
 // GetListener returns a net listener
diff --git a/modules/graceful/server_hooks.go b/modules/graceful/server_hooks.go
index b800c32503e..afa74f36f5c 100644
--- a/modules/graceful/server_hooks.go
+++ b/modules/graceful/server_hooks.go
@@ -6,7 +6,7 @@ package graceful
 import (
 	"os"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // awaitShutdown waits for the shutdown signal from the Manager
diff --git a/modules/gtprof/trace.go b/modules/gtprof/trace.go
index ad67c226dce..370078516ea 100644
--- a/modules/gtprof/trace.go
+++ b/modules/gtprof/trace.go
@@ -9,7 +9,7 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 type contextKey struct {
diff --git a/modules/gtprof/trace_builtin.go b/modules/gtprof/trace_builtin.go
index 7b4e3b8b4f5..76b2dae4b0e 100644
--- a/modules/gtprof/trace_builtin.go
+++ b/modules/gtprof/trace_builtin.go
@@ -10,7 +10,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	"code.gitea.io/gitea/modules/tailmsg"
+	"gitea.dev/modules/tailmsg"
 )
 
 type traceBuiltinStarter struct{}
diff --git a/modules/hcaptcha/hcaptcha.go b/modules/hcaptcha/hcaptcha.go
index b970d491c57..0af1f959ea6 100644
--- a/modules/hcaptcha/hcaptcha.go
+++ b/modules/hcaptcha/hcaptcha.go
@@ -10,8 +10,8 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
 )
 
 const verifyURL = "https://hcaptcha.com/siteverify"
diff --git a/modules/highlight/highlight.go b/modules/highlight/highlight.go
index dca28588e47..1ca97c4968e 100644
--- a/modules/highlight/highlight.go
+++ b/modules/highlight/highlight.go
@@ -10,9 +10,9 @@ import (
 	"html/template"
 	"sync"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/alecthomas/chroma/v2"
 	chromahtml "github.com/alecthomas/chroma/v2/formatters/html"
diff --git a/modules/highlight/highlight_test.go b/modules/highlight/highlight_test.go
index 211132b255f..a31f8752f15 100644
--- a/modules/highlight/highlight_test.go
+++ b/modules/highlight/highlight_test.go
@@ -63,7 +63,7 @@ func TestFile(t *testing.T) {
 		{
 			name:      "tags.py",
 			code:      "<>",
-			want:      lines(`<span class="o">&lt;</span><span class="o">&gt;</span>`),
+			want:      lines(`<span class="o">&lt;&gt;</span>`),
 			lexerName: "Python",
 		},
 		{
@@ -102,7 +102,7 @@ c=2
 <span class="n">def</span><span class="p">:</span>\n
     <span class="n">a</span><span class="o">=</span><span class="mi">1</span>\n
 \n
-<span class="n">b</span><span class="o">=</span><span class="sa"></span><span class="s1">&#39;</span><span class="s1">&#39;</span>\n
+<span class="n">b</span><span class="o">=</span><span class="s1">&#39;&#39;</span>\n
     \n
 <span class="n">c</span><span class="o">=</span><span class="mi">2</span>`,
 			),
@@ -114,6 +114,18 @@ c=2
 			want:      []template.HTML{"<span class=\"c1\">--\n</span>", `<span class="k">SELECT</span>`},
 			lexerName: "SQL",
 		},
+		{
+			name: "test.http",
+			code: `HTTP/1.0 400 Bad request
+Content-Type: text/html
+
+<html></html>`,
+			want: lines(`<span class="kr">HTTP</span><span class="o">/</span><span class="m">1.0</span> <span class="m">400</span> <span class="ne">Bad request</span>\n
+<span class="n">Content-Type</span><span class="o">:</span> <span class="l">text/html</span>\n
+\n
+<span class="p">&lt;</span><span class="nt">html</span><span class="p">&gt;&lt;/</span><span class="nt">html</span><span class="p">&gt;</span>`),
+			lexerName: "HTTP",
+		},
 	}
 
 	for _, tt := range tests {
diff --git a/modules/highlight/lexerdetect.go b/modules/highlight/lexerdetect.go
index fe430f463fc..755c4d10766 100644
--- a/modules/highlight/lexerdetect.go
+++ b/modules/highlight/lexerdetect.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/analyze"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/analyze"
+	"gitea.dev/modules/log"
 
 	"github.com/alecthomas/chroma/v2"
 	"github.com/alecthomas/chroma/v2/lexers"
@@ -58,6 +58,7 @@ var chromaLexers = sync.OnceValue(func() (ret struct {
 		".inc":     "PHP",          // ObjectPascal, POVRay, SourcePawn, PHTML
 		".m":       "Objective-C",  // Matlab, Mathematica, Mason
 		".mc":      "Mason",        // MonkeyC
+		".mod":     "AMPL",         // Modula-2
 		".network": "SYSTEMD",      // INI
 		".php":     "PHP",          // PHTML
 		".php3":    "PHP",          // PHTML
@@ -288,24 +289,24 @@ func detectChromaLexerWithAnalyze(fileName, lang string, code []byte) chroma.Lex
 
 	// if lang is provided, and it matches a lexer, use it directly
 	if byLang {
-		return lexer
+		return chroma.Coalesce(lexer)
 	}
 
 	// if a lexer is detected and there is no conflict for the file extension, use it directly
 	fileExt := path.Ext(fileName)
 	_, hasConflicts := chromaLexers().conflictingExtLangMap[fileExt]
 	if !hasConflicts && lexer != lexers.Fallback {
-		return lexer
+		return chroma.Coalesce(lexer)
 	}
 
 	// try to detect language by content, for best guessing for the language
 	// when using "code" to detect, analyze.GetCodeLanguage is slow, it iterates many rules to detect language from content
 	analyzedLanguage := analyze.GetCodeLanguage(fileName, code)
-	lexer = DetectChromaLexerByFileName(fileName, analyzedLanguage)
+	lexer, _ = detectChromaLexerByFileName(fileName, analyzedLanguage)
 	if lexer == lexers.Fallback {
 		if analyzedLanguage != enry.OtherLanguage {
 			log.Warn("No chroma lexer found for enry detected language: %s (file: %s), need to fix the language mapping between enry and chroma.", analyzedLanguage, fileName)
 		}
 	}
-	return lexer
+	return chroma.Coalesce(lexer)
 }
diff --git a/modules/htmlutil/html.go b/modules/htmlutil/html.go
index 8dbfe0c22e2..5db1d6404ad 100644
--- a/modules/htmlutil/html.go
+++ b/modules/htmlutil/html.go
@@ -83,3 +83,34 @@ func HTMLPrintTag(w io.Writer, tag template.HTML, attrs map[string]string) (writ
 	written += n
 	return written, err
 }
+
+func EscapeString(s string) template.HTML {
+	return template.HTML(template.HTMLEscapeString(s))
+}
+
+type HTMLBuilder struct {
+	sb strings.Builder
+}
+
+func (b *HTMLBuilder) WriteString(s string) *HTMLBuilder {
+	b.sb.WriteString(template.HTMLEscapeString(s))
+	return b
+}
+
+func (b *HTMLBuilder) WriteHTML(s template.HTML) *HTMLBuilder {
+	b.sb.WriteString(string(s))
+	return b
+}
+
+func (b *HTMLBuilder) WriteFormat(fmt template.HTML, args ...any) *HTMLBuilder {
+	_, _ = HTMLPrintf(&b.sb, fmt, args...)
+	return b
+}
+
+func (b *HTMLBuilder) HTMLString() template.HTML {
+	return template.HTML(b.sb.String())
+}
+
+func (b *HTMLBuilder) String() string {
+	return b.sb.String()
+}
diff --git a/modules/htmlutil/html_test.go b/modules/htmlutil/html_test.go
index 22258ce59d6..a1ab0a6a49b 100644
--- a/modules/htmlutil/html_test.go
+++ b/modules/htmlutil/html_test.go
@@ -22,3 +22,10 @@ func TestHTMLFormat(t *testing.T) {
 	assert.Equal(t, template.HTML("&lt;&gt;"), HTMLFormat("%s", template.URL("<>")))
 	assert.Equal(t, template.HTML("&amp;StringMethod &amp;StringMethod"), HTMLFormat("%s %s", testStringer{}, &testStringer{}))
 }
+
+func TestHTMLBuilder(t *testing.T) {
+	b := &HTMLBuilder{}
+	b.WriteString("<").WriteHTML("<hr>").WriteFormat("<span>%s%s</span>", ">", EscapeString(">"))
+	assert.Equal(t, "&lt;<hr><span>&gt;&gt;</span>", b.String())
+	assert.Equal(t, template.HTML("&lt;<hr><span>&gt;&gt;</span>"), b.HTMLString())
+}
diff --git a/modules/httpcache/httpcache.go b/modules/httpcache/httpcache.go
index e23cf0a92a2..f55e13ce594 100644
--- a/modules/httpcache/httpcache.go
+++ b/modules/httpcache/httpcache.go
@@ -10,8 +10,8 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 type CacheControlOptions struct {
diff --git a/modules/httpcache/httpcache_test.go b/modules/httpcache/httpcache_test.go
index d510cbe4d7f..f9625981aaf 100644
--- a/modules/httpcache/httpcache_test.go
+++ b/modules/httpcache/httpcache_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/httplib/content_disposition.go b/modules/httplib/content_disposition.go
index da23dae2210..3262ad6c65c 100644
--- a/modules/httplib/content_disposition.go
+++ b/modules/httplib/content_disposition.go
@@ -7,7 +7,7 @@ import (
 	"mime"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 type ContentDispositionType string
diff --git a/modules/httplib/serve.go b/modules/httplib/serve.go
index 6c2fe9b0d6c..cf2e049cb7a 100644
--- a/modules/httplib/serve.go
+++ b/modules/httplib/serve.go
@@ -15,12 +15,12 @@ import (
 	"strings"
 	"time"
 
-	charsetModule "code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/util"
+	charsetModule "gitea.dev/modules/charset"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/util"
 
 	"github.com/klauspost/compress/gzhttp"
 )
@@ -87,8 +87,9 @@ func ServeSetHeaders(w http.ResponseWriter, opts ServeHeaderOptions) {
 	if opts.ContentLength != nil {
 		header.Set("Content-Length", strconv.FormatInt(*opts.ContentLength, 10))
 	}
-	if opts.Filename != "" && opts.ContentDisposition != "" {
-		header.Set("Content-Disposition", encodeContentDisposition(opts.ContentDisposition, path.Base(opts.Filename)))
+	if opts.Filename != "" {
+		contentDisposition := util.IfZero(opts.ContentDisposition, ContentDispositionAttachment)
+		header.Set("Content-Disposition", encodeContentDisposition(contentDisposition, path.Base(opts.Filename)))
 		header.Set("Access-Control-Expose-Headers", "Content-Disposition")
 	}
 
diff --git a/modules/httplib/serve_test.go b/modules/httplib/serve_test.go
index 2a245300b06..9981a8e0e76 100644
--- a/modules/httplib/serve_test.go
+++ b/modules/httplib/serve_test.go
@@ -12,7 +12,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/typesniffer"
+	"gitea.dev/modules/typesniffer"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -133,3 +133,11 @@ func TestServeSetHeaderContentRelated(t *testing.T) {
 	// make sure sandboxed
 	require.Contains(t, serveHeaderCspDefault, "; sandbox")
 }
+
+func TestServeSetHeaders(t *testing.T) {
+	w := httptest.NewRecorder()
+	ServeSetHeaders(w, ServeHeaderOptions{Filename: "foo.zip"})
+	assert.Equal(t, "attachment; filename=foo.zip", w.Header().Get("Content-Disposition"))
+	ServeSetHeaders(w, ServeHeaderOptions{Filename: "foo.zip", ContentDisposition: ContentDispositionInline})
+	assert.Equal(t, "inline; filename=foo.zip", w.Header().Get("Content-Disposition"))
+}
diff --git a/modules/httplib/url.go b/modules/httplib/url.go
index a689c9e98ee..0bc996a21ea 100644
--- a/modules/httplib/url.go
+++ b/modules/httplib/url.go
@@ -10,8 +10,8 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 type RequestContextKeyStruct struct{}
diff --git a/modules/httplib/url_test.go b/modules/httplib/url_test.go
index 373693693b5..8356213724a 100644
--- a/modules/httplib/url_test.go
+++ b/modules/httplib/url_test.go
@@ -9,8 +9,8 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/indexer/code/bleve/bleve.go b/modules/indexer/code/bleve/bleve.go
index 010ee396606..ed5f38fcf0a 100644
--- a/modules/indexer/code/bleve/bleve.go
+++ b/modules/indexer/code/bleve/bleve.go
@@ -11,21 +11,21 @@ import (
 	"strings"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/analyze"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/indexer"
-	path_filter "code.gitea.io/gitea/modules/indexer/code/bleve/token/path"
-	"code.gitea.io/gitea/modules/indexer/code/internal"
-	indexer_internal "code.gitea.io/gitea/modules/indexer/internal"
-	inner_bleve "code.gitea.io/gitea/modules/indexer/internal/bleve"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/analyze"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/indexer"
+	path_filter "gitea.dev/modules/indexer/code/bleve/token/path"
+	"gitea.dev/modules/indexer/code/internal"
+	indexer_internal "gitea.dev/modules/indexer/internal"
+	inner_bleve "gitea.dev/modules/indexer/internal/bleve"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/util"
 
 	"github.com/blevesearch/bleve/v2"
 	analyzer_custom "github.com/blevesearch/bleve/v2/analysis/analyzer/custom"
diff --git a/modules/indexer/code/elasticsearch/elasticsearch.go b/modules/indexer/code/elasticsearch/elasticsearch.go
index f9a3d4156dd..4c35a17b052 100644
--- a/modules/indexer/code/elasticsearch/elasticsearch.go
+++ b/modules/indexer/code/elasticsearch/elasticsearch.go
@@ -10,21 +10,21 @@ import (
 	"strconv"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/analyze"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/indexer"
-	"code.gitea.io/gitea/modules/indexer/code/internal"
-	es "code.gitea.io/gitea/modules/indexer/internal/elasticsearch"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/analyze"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/indexer"
+	"gitea.dev/modules/indexer/code/internal"
+	es "gitea.dev/modules/indexer/internal/elasticsearch"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/util"
 
 	"github.com/go-enry/go-enry/v2"
 )
diff --git a/modules/indexer/code/git.go b/modules/indexer/code/git.go
index a17b10551d2..88a313c33ed 100644
--- a/modules/indexer/code/git.go
+++ b/modules/indexer/code/git.go
@@ -8,13 +8,13 @@ import (
 	"strconv"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/indexer/code/internal"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/indexer/code/internal"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 func getDefaultBranchSha(ctx context.Context, repo *repo_model.Repository) (string, error) {
diff --git a/modules/indexer/code/gitgrep/gitgrep.go b/modules/indexer/code/gitgrep/gitgrep.go
index 5fbd7201ef0..1d295098d86 100644
--- a/modules/indexer/code/gitgrep/gitgrep.go
+++ b/modules/indexer/code/gitgrep/gitgrep.go
@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/indexer"
-	code_indexer "code.gitea.io/gitea/modules/indexer/code"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/indexer"
+	code_indexer "gitea.dev/modules/indexer/code"
+	"gitea.dev/modules/setting"
 )
 
 func indexSettingToGitGrepPathspecList() (list []string) {
diff --git a/modules/indexer/code/gitgrep/gitgrep_test.go b/modules/indexer/code/gitgrep/gitgrep_test.go
index 97dda9d9661..5510a7d2bee 100644
--- a/modules/indexer/code/gitgrep/gitgrep_test.go
+++ b/modules/indexer/code/gitgrep/gitgrep_test.go
@@ -6,8 +6,8 @@ package gitgrep
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/indexer/code/indexer.go b/modules/indexer/code/indexer.go
index 98df6944a6b..312b038e0ee 100644
--- a/modules/indexer/code/indexer.go
+++ b/modules/indexer/code/indexer.go
@@ -11,18 +11,18 @@ import (
 	"sync/atomic"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/indexer"
-	"code.gitea.io/gitea/modules/indexer/code/bleve"
-	"code.gitea.io/gitea/modules/indexer/code/elasticsearch"
-	"code.gitea.io/gitea/modules/indexer/code/internal"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/indexer"
+	"gitea.dev/modules/indexer/code/bleve"
+	"gitea.dev/modules/indexer/code/elasticsearch"
+	"gitea.dev/modules/indexer/code/internal"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 var (
diff --git a/modules/indexer/code/indexer_test.go b/modules/indexer/code/indexer_test.go
index a8baf44edce..baf9edd8f9c 100644
--- a/modules/indexer/code/indexer_test.go
+++ b/modules/indexer/code/indexer_test.go
@@ -10,19 +10,19 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	indexer_module "code.gitea.io/gitea/modules/indexer"
-	"code.gitea.io/gitea/modules/indexer/code/bleve"
-	"code.gitea.io/gitea/modules/indexer/code/elasticsearch"
-	"code.gitea.io/gitea/modules/indexer/code/internal"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	indexer_module "gitea.dev/modules/indexer"
+	"gitea.dev/modules/indexer/code/bleve"
+	"gitea.dev/modules/indexer/code/elasticsearch"
+	"gitea.dev/modules/indexer/code/internal"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/indexer/code/internal/indexer.go b/modules/indexer/code/internal/indexer.go
index d58b028124a..7eb08ac579f 100644
--- a/modules/indexer/code/internal/indexer.go
+++ b/modules/indexer/code/internal/indexer.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"errors"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/indexer"
-	"code.gitea.io/gitea/modules/indexer/internal"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/indexer"
+	"gitea.dev/modules/indexer/internal"
 )
 
 // Indexer defines an interface to index and search code contents
diff --git a/modules/indexer/code/internal/model.go b/modules/indexer/code/internal/model.go
index f75263c83cf..01779d87764 100644
--- a/modules/indexer/code/internal/model.go
+++ b/modules/indexer/code/internal/model.go
@@ -3,7 +3,7 @@
 
 package internal
 
-import "code.gitea.io/gitea/modules/timeutil"
+import "gitea.dev/modules/timeutil"
 
 type FileUpdate struct {
 	Filename string
diff --git a/modules/indexer/code/internal/util.go b/modules/indexer/code/internal/util.go
index 5d62a5ccb9d..3608dc4f12c 100644
--- a/modules/indexer/code/internal/util.go
+++ b/modules/indexer/code/internal/util.go
@@ -6,8 +6,8 @@ package internal
 import (
 	"strings"
 
-	"code.gitea.io/gitea/modules/indexer/internal"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/indexer/internal"
+	"gitea.dev/modules/log"
 )
 
 const filenameMatchNumberOfLines = 7 // Copied from GitHub search
diff --git a/modules/indexer/code/search.go b/modules/indexer/code/search.go
index b5eb5116b06..87b3105414f 100644
--- a/modules/indexer/code/search.go
+++ b/modules/indexer/code/search.go
@@ -9,9 +9,9 @@ import (
 	"html/template"
 	"strings"
 
-	"code.gitea.io/gitea/modules/highlight"
-	"code.gitea.io/gitea/modules/indexer/code/internal"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/highlight"
+	"gitea.dev/modules/indexer/code/internal"
+	"gitea.dev/modules/timeutil"
 )
 
 // Result a search result to display
diff --git a/modules/indexer/internal/bleve/indexer.go b/modules/indexer/internal/bleve/indexer.go
index 9d1e24a874e..3e735cea197 100644
--- a/modules/indexer/internal/bleve/indexer.go
+++ b/modules/indexer/internal/bleve/indexer.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"errors"
 
-	"code.gitea.io/gitea/modules/indexer/internal"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/indexer/internal"
+	"gitea.dev/modules/log"
 
 	"github.com/blevesearch/bleve/v2"
 	"github.com/blevesearch/bleve/v2/mapping"
diff --git a/modules/indexer/internal/bleve/query.go b/modules/indexer/internal/bleve/query.go
index 8895ae2c644..aa0bf3080fb 100644
--- a/modules/indexer/internal/bleve/query.go
+++ b/modules/indexer/internal/bleve/query.go
@@ -4,7 +4,7 @@
 package bleve
 
 import (
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/modules/optional"
 
 	"github.com/blevesearch/bleve/v2"
 	"github.com/blevesearch/bleve/v2/search/query"
diff --git a/modules/indexer/internal/bleve/util.go b/modules/indexer/internal/bleve/util.go
index b6daa9e14b4..0914d4c269e 100644
--- a/modules/indexer/internal/bleve/util.go
+++ b/modules/indexer/internal/bleve/util.go
@@ -8,9 +8,9 @@ import (
 	"os"
 	"unicode"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/blevesearch/bleve/v2"
 	unicode_tokenizer "github.com/blevesearch/bleve/v2/analysis/tokenizer/unicode"
diff --git a/modules/indexer/internal/bleve/util_test.go b/modules/indexer/internal/bleve/util_test.go
index 1a7e4db0f42..9df8b017ca6 100644
--- a/modules/indexer/internal/bleve/util_test.go
+++ b/modules/indexer/internal/bleve/util_test.go
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/indexer/internal/db/indexer.go b/modules/indexer/internal/db/indexer.go
index 3deec836c4e..8d49b443667 100644
--- a/modules/indexer/internal/db/indexer.go
+++ b/modules/indexer/internal/db/indexer.go
@@ -6,7 +6,7 @@ package db
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/indexer/internal"
+	"gitea.dev/modules/indexer/internal"
 )
 
 var _ internal.Indexer = &Indexer{}
diff --git a/modules/indexer/internal/elasticsearch/indexer.go b/modules/indexer/internal/elasticsearch/indexer.go
index eaeb89efaa1..1eb7d38d8a5 100644
--- a/modules/indexer/internal/elasticsearch/indexer.go
+++ b/modules/indexer/internal/elasticsearch/indexer.go
@@ -16,8 +16,8 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/indexer/internal"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/indexer/internal"
+	"gitea.dev/modules/json"
 )
 
 var _ internal.Indexer = &Indexer{}
diff --git a/modules/indexer/internal/elasticsearch/indexer_test.go b/modules/indexer/internal/elasticsearch/indexer_test.go
index 774d6fbd6c5..cccc42ffcc6 100644
--- a/modules/indexer/internal/elasticsearch/indexer_test.go
+++ b/modules/indexer/internal/elasticsearch/indexer_test.go
@@ -4,24 +4,19 @@
 package elasticsearch
 
 import (
-	"os"
 	"strings"
 	"testing"
 
+	"gitea.dev/modules/test"
+
 	"github.com/stretchr/testify/require"
 )
 
 func newRealIndexer(t *testing.T) *Indexer {
 	t.Helper()
-	url := "http://elasticsearch:9200"
-	if os.Getenv("CI") == "" {
-		url = os.Getenv("TEST_ELASTICSEARCH_URL")
-		if url == "" {
-			t.Skip("TEST_ELASTICSEARCH_URL not set and not running in CI")
-		}
-	}
+	esURL := test.ExternalServiceHTTP(t, "TEST_ELASTICSEARCH_URL", "http://elasticsearch:9200")
 	indexName := "gitea_test_" + strings.ReplaceAll(strings.ToLower(t.Name()), "/", "_")
-	ix := NewIndexer(url, indexName, 1, `{"mappings":{"properties":{"x":{"type":"keyword"}}}}`)
+	ix := NewIndexer(esURL, indexName, 1, `{"mappings":{"properties":{"x":{"type":"keyword"}}}}`)
 	_, err := ix.Init(t.Context())
 	require.NoError(t, err)
 	t.Cleanup(ix.Close)
diff --git a/modules/indexer/internal/elasticsearch/types.go b/modules/indexer/internal/elasticsearch/types.go
index 106f2faa8e6..b843ad1f2d7 100644
--- a/modules/indexer/internal/elasticsearch/types.go
+++ b/modules/indexer/internal/elasticsearch/types.go
@@ -3,7 +3,7 @@
 
 package elasticsearch
 
-import "code.gitea.io/gitea/modules/json"
+import "gitea.dev/modules/json"
 
 const (
 	bulkActionIndex  = "index"
diff --git a/modules/indexer/internal/elasticsearch/util.go b/modules/indexer/internal/elasticsearch/util.go
index 2e96d4220aa..8713284af6c 100644
--- a/modules/indexer/internal/elasticsearch/util.go
+++ b/modules/indexer/internal/elasticsearch/util.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // VersionedIndexName returns the full index name with version suffix.
diff --git a/modules/indexer/internal/meilisearch/util.go b/modules/indexer/internal/meilisearch/util.go
index e6d8fefadeb..d54a9a5a472 100644
--- a/modules/indexer/internal/meilisearch/util.go
+++ b/modules/indexer/internal/meilisearch/util.go
@@ -6,7 +6,7 @@ package meilisearch
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // VersionedIndexName returns the full index name with version
diff --git a/modules/indexer/internal/paginator.go b/modules/indexer/internal/paginator.go
index f1e19740eb7..5ca8c4152c6 100644
--- a/modules/indexer/internal/paginator.go
+++ b/modules/indexer/internal/paginator.go
@@ -6,7 +6,7 @@ package internal
 import (
 	"math"
 
-	"code.gitea.io/gitea/models/db"
+	"gitea.dev/models/db"
 )
 
 // ParsePaginator parses a db.Paginator into a skip and limit
diff --git a/modules/indexer/issues/bleve/bleve.go b/modules/indexer/issues/bleve/bleve.go
index 219d4163d6a..a919317728d 100644
--- a/modules/indexer/issues/bleve/bleve.go
+++ b/modules/indexer/issues/bleve/bleve.go
@@ -7,12 +7,12 @@ import (
 	"context"
 	"strconv"
 
-	"code.gitea.io/gitea/modules/indexer"
-	indexer_internal "code.gitea.io/gitea/modules/indexer/internal"
-	inner_bleve "code.gitea.io/gitea/modules/indexer/internal/bleve"
-	"code.gitea.io/gitea/modules/indexer/issues/internal"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/indexer"
+	indexer_internal "gitea.dev/modules/indexer/internal"
+	inner_bleve "gitea.dev/modules/indexer/internal/bleve"
+	"gitea.dev/modules/indexer/issues/internal"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/util"
 
 	"github.com/blevesearch/bleve/v2"
 	"github.com/blevesearch/bleve/v2/analysis/analyzer/custom"
diff --git a/modules/indexer/issues/bleve/bleve_test.go b/modules/indexer/issues/bleve/bleve_test.go
index 908514a01a2..ccd7ab7b926 100644
--- a/modules/indexer/issues/bleve/bleve_test.go
+++ b/modules/indexer/issues/bleve/bleve_test.go
@@ -6,7 +6,7 @@ package bleve
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/indexer/issues/internal/tests"
+	"gitea.dev/modules/indexer/issues/internal/tests"
 )
 
 func TestBleveIndexer(t *testing.T) {
diff --git a/modules/indexer/issues/db/db.go b/modules/indexer/issues/db/db.go
index 50951f9c88e..52d6672b6e1 100644
--- a/modules/indexer/issues/db/db.go
+++ b/modules/indexer/issues/db/db.go
@@ -8,13 +8,13 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/models/db"
-	issue_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/indexer"
-	indexer_internal "code.gitea.io/gitea/modules/indexer/internal"
-	inner_db "code.gitea.io/gitea/modules/indexer/internal/db"
-	"code.gitea.io/gitea/modules/indexer/issues/internal"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	issue_model "gitea.dev/models/issues"
+	"gitea.dev/modules/indexer"
+	indexer_internal "gitea.dev/modules/indexer/internal"
+	inner_db "gitea.dev/modules/indexer/internal/db"
+	"gitea.dev/modules/indexer/issues/internal"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/modules/indexer/issues/db/options.go b/modules/indexer/issues/db/options.go
index 7a66efe7914..c3921a98ae9 100644
--- a/modules/indexer/issues/db/options.go
+++ b/modules/indexer/issues/db/options.go
@@ -8,12 +8,12 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	issue_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/indexer/issues/internal"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	issue_model "gitea.dev/models/issues"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/indexer/issues/internal"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/util"
 )
 
 func ToDBOptions(ctx context.Context, options *internal.SearchOptions) (*issue_model.IssuesOptions, error) {
diff --git a/modules/indexer/issues/dboptions.go b/modules/indexer/issues/dboptions.go
index f4582d38dd8..be692aa072b 100644
--- a/modules/indexer/issues/dboptions.go
+++ b/modules/indexer/issues/dboptions.go
@@ -6,11 +6,11 @@ package issues
 import (
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/indexer/issues/internal"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/indexer/issues/internal"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
 )
 
 func ToSearchOptions(keyword string, opts *issues_model.IssuesOptions) *SearchOptions {
diff --git a/modules/indexer/issues/elasticsearch/elasticsearch.go b/modules/indexer/issues/elasticsearch/elasticsearch.go
index 8286e72f492..baef644cc11 100644
--- a/modules/indexer/issues/elasticsearch/elasticsearch.go
+++ b/modules/indexer/issues/elasticsearch/elasticsearch.go
@@ -8,12 +8,12 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/indexer"
-	indexer_internal "code.gitea.io/gitea/modules/indexer/internal"
-	es "code.gitea.io/gitea/modules/indexer/internal/elasticsearch"
-	"code.gitea.io/gitea/modules/indexer/issues/internal"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/indexer"
+	indexer_internal "gitea.dev/modules/indexer/internal"
+	es "gitea.dev/modules/indexer/internal/elasticsearch"
+	"gitea.dev/modules/indexer/issues/internal"
+	"gitea.dev/modules/util"
 )
 
 const issueIndexerLatestVersion = 3
diff --git a/modules/indexer/issues/elasticsearch/elasticsearch_test.go b/modules/indexer/issues/elasticsearch/elasticsearch_test.go
index 9b0eaebef60..86f525121d8 100644
--- a/modules/indexer/issues/elasticsearch/elasticsearch_test.go
+++ b/modules/indexer/issues/elasticsearch/elasticsearch_test.go
@@ -7,27 +7,18 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
-	"os"
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/indexer/issues/internal/tests"
+	"gitea.dev/modules/indexer/issues/internal/tests"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/require"
 )
 
 func TestElasticsearchIndexer(t *testing.T) {
 	// The elasticsearch instance started by pull-db-tests.yml > test-unit > services > elasticsearch
-	rawURL := "http://elastic:changeme@elasticsearch:9200"
-
-	if os.Getenv("CI") == "" {
-		// Make it possible to run tests against a local elasticsearch instance
-		rawURL = os.Getenv("TEST_ELASTICSEARCH_URL")
-		if rawURL == "" {
-			t.Skip("TEST_ELASTICSEARCH_URL not set and not running in CI")
-			return
-		}
-	}
+	rawURL := test.ExternalServiceHTTP(t, "TEST_ELASTICSEARCH_URL", "http://elastic:changeme@elasticsearch:9200")
 
 	// Go's net/http does not auto-attach URL userinfo as Basic Auth, so extract
 	// it and set the header explicitly; otherwise auth-enforced clusters answer
diff --git a/modules/indexer/issues/indexer.go b/modules/indexer/issues/indexer.go
index 52b25c1794a..f22e2c2ad59 100644
--- a/modules/indexer/issues/indexer.go
+++ b/modules/indexer/issues/indexer.go
@@ -11,21 +11,21 @@ import (
 	"sync/atomic"
 	"time"
 
-	db_model "code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/indexer"
-	"code.gitea.io/gitea/modules/indexer/issues/bleve"
-	"code.gitea.io/gitea/modules/indexer/issues/db"
-	"code.gitea.io/gitea/modules/indexer/issues/elasticsearch"
-	"code.gitea.io/gitea/modules/indexer/issues/internal"
-	"code.gitea.io/gitea/modules/indexer/issues/meilisearch"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	db_model "gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/indexer"
+	"gitea.dev/modules/indexer/issues/bleve"
+	"gitea.dev/modules/indexer/issues/db"
+	"gitea.dev/modules/indexer/issues/elasticsearch"
+	"gitea.dev/modules/indexer/issues/internal"
+	"gitea.dev/modules/indexer/issues/meilisearch"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // IndexerMetadata is used to send data to the queue, so it contains only the ids.
diff --git a/modules/indexer/issues/indexer_test.go b/modules/indexer/issues/indexer_test.go
index a67e96c0a28..a718e4e72cd 100644
--- a/modules/indexer/issues/indexer_test.go
+++ b/modules/indexer/issues/indexer_test.go
@@ -6,16 +6,16 @@ package issues
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/indexer/issues/internal"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/indexer/issues/internal"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/indexer/issues/internal/indexer.go b/modules/indexer/issues/internal/indexer.go
index 59c6f48485f..0d5d2b9482f 100644
--- a/modules/indexer/issues/internal/indexer.go
+++ b/modules/indexer/issues/internal/indexer.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"errors"
 
-	"code.gitea.io/gitea/modules/indexer"
-	"code.gitea.io/gitea/modules/indexer/internal"
+	"gitea.dev/modules/indexer"
+	"gitea.dev/modules/indexer/internal"
 )
 
 // Indexer defines an interface to indexer issues contents
diff --git a/modules/indexer/issues/internal/model.go b/modules/indexer/issues/internal/model.go
index 84979a8e645..b964f349df4 100644
--- a/modules/indexer/issues/internal/model.go
+++ b/modules/indexer/issues/internal/model.go
@@ -6,10 +6,10 @@ package internal
 import (
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/indexer"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/indexer"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
 )
 
 // IndexerData data stored in the issue indexer
diff --git a/modules/indexer/issues/internal/tests/tests.go b/modules/indexer/issues/internal/tests/tests.go
index 20e64a59554..276f3fb5bb4 100644
--- a/modules/indexer/issues/internal/tests/tests.go
+++ b/modules/indexer/issues/internal/tests/tests.go
@@ -13,10 +13,10 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/indexer/issues/internal"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/indexer/issues/internal"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/indexer/issues/meilisearch/meilisearch.go b/modules/indexer/issues/meilisearch/meilisearch.go
index 6ac6d239c80..ddde9c89f09 100644
--- a/modules/indexer/issues/meilisearch/meilisearch.go
+++ b/modules/indexer/issues/meilisearch/meilisearch.go
@@ -10,11 +10,11 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/indexer"
-	indexer_internal "code.gitea.io/gitea/modules/indexer/internal"
-	inner_meilisearch "code.gitea.io/gitea/modules/indexer/internal/meilisearch"
-	"code.gitea.io/gitea/modules/indexer/issues/internal"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/indexer"
+	indexer_internal "gitea.dev/modules/indexer/internal"
+	inner_meilisearch "gitea.dev/modules/indexer/internal/meilisearch"
+	"gitea.dev/modules/indexer/issues/internal"
+	"gitea.dev/modules/json"
 
 	"github.com/meilisearch/meilisearch-go"
 )
diff --git a/modules/indexer/issues/meilisearch/meilisearch_test.go b/modules/indexer/issues/meilisearch/meilisearch_test.go
index 81a27487bb8..2c9814acf6e 100644
--- a/modules/indexer/issues/meilisearch/meilisearch_test.go
+++ b/modules/indexer/issues/meilisearch/meilisearch_test.go
@@ -10,9 +10,10 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/indexer/issues/internal"
-	"code.gitea.io/gitea/modules/indexer/issues/internal/tests"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/indexer/issues/internal"
+	"gitea.dev/modules/indexer/issues/internal/tests"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/test"
 
 	"github.com/meilisearch/meilisearch-go"
 	"github.com/stretchr/testify/assert"
@@ -21,18 +22,8 @@ import (
 
 func TestMeilisearchIndexer(t *testing.T) {
 	// The meilisearch instance started by pull-db-tests.yml > test-unit > services > meilisearch
-	url := "http://meilisearch:7700"
-	key := "" // auth has been disabled in test environment
-
-	if os.Getenv("CI") == "" {
-		// Make it possible to run tests against a local meilisearch instance
-		url = os.Getenv("TEST_MEILISEARCH_URL")
-		if url == "" {
-			t.Skip("TEST_MEILISEARCH_URL not set and not running in CI")
-			return
-		}
-		key = os.Getenv("TEST_MEILISEARCH_KEY")
-	}
+	url := test.ExternalServiceHTTP(t, "TEST_MEILISEARCH_URL", "http://meilisearch:7700")
+	key := os.Getenv("TEST_MEILISEARCH_KEY")
 
 	require.Eventually(t, func() bool {
 		resp, err := http.Get(url)
diff --git a/modules/indexer/issues/util.go b/modules/indexer/issues/util.go
index fafe9b8bbd8..bbfd42be6b9 100644
--- a/modules/indexer/issues/util.go
+++ b/modules/indexer/issues/util.go
@@ -8,12 +8,12 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	issue_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/indexer/issues/internal"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
+	"gitea.dev/models/db"
+	issue_model "gitea.dev/models/issues"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/indexer/issues/internal"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
 )
 
 // getIssueIndexerData returns the indexer data of an issue and a bool value indicating whether the issue exists.
diff --git a/modules/indexer/stats/db.go b/modules/indexer/stats/db.go
index 199d493e97d..af5127b6389 100644
--- a/modules/indexer/stats/db.go
+++ b/modules/indexer/stats/db.go
@@ -6,14 +6,14 @@ package stats
 import (
 	"fmt"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/languagestats"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/languagestats"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
 )
 
 // DBIndexer implements Indexer interface to use database's like search
diff --git a/modules/indexer/stats/indexer.go b/modules/indexer/stats/indexer.go
index aaf120c6d0d..fe11a33e061 100644
--- a/modules/indexer/stats/indexer.go
+++ b/modules/indexer/stats/indexer.go
@@ -6,10 +6,10 @@ package stats
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
 )
 
 // Indexer defines an interface to index repository stats
diff --git a/modules/indexer/stats/indexer_test.go b/modules/indexer/stats/indexer_test.go
index 088f63234a5..edc38ffad68 100644
--- a/modules/indexer/stats/indexer_test.go
+++ b/modules/indexer/stats/indexer_test.go
@@ -7,14 +7,14 @@ import (
 	"testing"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/indexer/stats/queue.go b/modules/indexer/stats/queue.go
index 69cde321d86..d9edc8b45f0 100644
--- a/modules/indexer/stats/queue.go
+++ b/modules/indexer/stats/queue.go
@@ -6,11 +6,11 @@ package stats
 import (
 	"errors"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
 )
 
 // statsQueue represents a queue to handle repository stats updates
diff --git a/modules/issue/template/template.go b/modules/issue/template/template.go
index 192aaf8e011..63f156f9f9f 100644
--- a/modules/issue/template/template.go
+++ b/modules/issue/template/template.go
@@ -12,8 +12,8 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/container"
-	api "code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/container"
+	api "gitea.dev/modules/structs"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/modules/issue/template/template_test.go b/modules/issue/template/template_test.go
index 7fec9431b6d..b696d952c86 100644
--- a/modules/issue/template/template_test.go
+++ b/modules/issue/template/template_test.go
@@ -7,8 +7,8 @@ import (
 	"net/url"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
-	api "code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/issue/template/unmarshal.go b/modules/issue/template/unmarshal.go
index ceab6babf4c..e0d6881cf59 100644
--- a/modules/issue/template/unmarshal.go
+++ b/modules/issue/template/unmarshal.go
@@ -8,13 +8,13 @@ import (
 	"path"
 	"strconv"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // CouldBe indicates a file with the filename could be a template,
diff --git a/modules/label/label.go b/modules/label/label.go
index 3e68c4d26e4..3bb881cf72e 100644
--- a/modules/label/label.go
+++ b/modules/label/label.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // Label represents label information loaded from template
diff --git a/modules/label/parser.go b/modules/label/parser.go
index 2a101520626..f56ef0e2559 100644
--- a/modules/label/parser.go
+++ b/modules/label/parser.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/modules/options"
+	"gitea.dev/modules/options"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type labelFile struct {
diff --git a/modules/lfs/content_store.go b/modules/lfs/content_store.go
index be1e6c8e90c..04e10910229 100644
--- a/modules/lfs/content_store.go
+++ b/modules/lfs/content_store.go
@@ -11,8 +11,8 @@ import (
 	"io"
 	"os"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/storage"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/storage"
 )
 
 var (
diff --git a/modules/lfs/endpoint.go b/modules/lfs/endpoint.go
index 2931defcd95..a7999fc1c4a 100644
--- a/modules/lfs/endpoint.go
+++ b/modules/lfs/endpoint.go
@@ -10,8 +10,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 // DetermineEndpoint determines an endpoint from the clone url or uses the specified LFS url.
diff --git a/modules/lfs/filesystem_client.go b/modules/lfs/filesystem_client.go
index 71bef5c899d..bf95e3ec6db 100644
--- a/modules/lfs/filesystem_client.go
+++ b/modules/lfs/filesystem_client.go
@@ -10,7 +10,7 @@ import (
 	"os"
 	"path/filepath"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // FilesystemClient is used to read LFS data from a filesystem path
diff --git a/modules/lfs/http_client.go b/modules/lfs/http_client.go
index 4b51193846f..9a7c722ac61 100644
--- a/modules/lfs/http_client.go
+++ b/modules/lfs/http_client.go
@@ -13,10 +13,10 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/proxy"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/proxy"
+	"gitea.dev/modules/setting"
 
 	"golang.org/x/sync/errgroup"
 )
diff --git a/modules/lfs/http_client_test.go b/modules/lfs/http_client_test.go
index 3e5ee9ec603..a234ceb5529 100644
--- a/modules/lfs/http_client_test.go
+++ b/modules/lfs/http_client_test.go
@@ -11,9 +11,9 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/lfs/pointer_scanner_gogit.go b/modules/lfs/pointer_scanner_gogit.go
index ccfb16b6c0e..2e2e5800a6b 100644
--- a/modules/lfs/pointer_scanner_gogit.go
+++ b/modules/lfs/pointer_scanner_gogit.go
@@ -9,7 +9,7 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 
 	"github.com/go-git/go-git/v5/plumbing/object"
 )
diff --git a/modules/lfs/pointer_scanner_nogogit.go b/modules/lfs/pointer_scanner_nogogit.go
index 29f5d0e3460..896c34a20b8 100644
--- a/modules/lfs/pointer_scanner_nogogit.go
+++ b/modules/lfs/pointer_scanner_nogogit.go
@@ -13,10 +13,10 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/git/pipeline"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/git/pipeline"
+	"gitea.dev/modules/util"
 
 	"golang.org/x/sync/errgroup"
 )
diff --git a/modules/lfs/shared.go b/modules/lfs/shared.go
index e04c089e513..a11ab7ba70c 100644
--- a/modules/lfs/shared.go
+++ b/modules/lfs/shared.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 const (
diff --git a/modules/lfs/transferadapter.go b/modules/lfs/transferadapter.go
index fbc3a3ad8c7..81ac9982907 100644
--- a/modules/lfs/transferadapter.go
+++ b/modules/lfs/transferadapter.go
@@ -9,8 +9,8 @@ import (
 	"io"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
 )
 
 // TransferAdapter represents an adapter for downloading/uploading LFS objects.
diff --git a/modules/lfs/transferadapter_test.go b/modules/lfs/transferadapter_test.go
index ef72d76db42..6c894d4496c 100644
--- a/modules/lfs/transferadapter_test.go
+++ b/modules/lfs/transferadapter_test.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/lfstransfer/backend/backend.go b/modules/lfstransfer/backend/backend.go
index 92f08eac136..42a01bf492f 100644
--- a/modules/lfstransfer/backend/backend.go
+++ b/modules/lfstransfer/backend/backend.go
@@ -12,9 +12,9 @@ import (
 	"net/url"
 	"strconv"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
 
 	"github.com/charmbracelet/git-lfs-transfer/transfer"
 )
diff --git a/modules/lfstransfer/backend/lock.go b/modules/lfstransfer/backend/lock.go
index 5bfa3a89c30..90b143a626e 100644
--- a/modules/lfstransfer/backend/lock.go
+++ b/modules/lfstransfer/backend/lock.go
@@ -13,8 +13,8 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
-	lfslock "code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/json"
+	lfslock "gitea.dev/modules/structs"
 
 	"github.com/charmbracelet/git-lfs-transfer/transfer"
 )
diff --git a/modules/lfstransfer/backend/util.go b/modules/lfstransfer/backend/util.go
index afe02f799c0..32264450487 100644
--- a/modules/lfstransfer/backend/util.go
+++ b/modules/lfstransfer/backend/util.go
@@ -11,10 +11,10 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/charmbracelet/git-lfs-transfer/transfer"
 )
diff --git a/modules/lfstransfer/backend/util_test.go b/modules/lfstransfer/backend/util_test.go
index 408b53c369f..ed60c6c454f 100644
--- a/modules/lfstransfer/backend/util_test.go
+++ b/modules/lfstransfer/backend/util_test.go
@@ -6,8 +6,8 @@ package backend
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/lfstransfer/main.go b/modules/lfstransfer/main.go
index a134f50b864..e5c8a122a4a 100644
--- a/modules/lfstransfer/main.go
+++ b/modules/lfstransfer/main.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"os"
 
-	"code.gitea.io/gitea/modules/lfstransfer/backend"
+	"gitea.dev/modules/lfstransfer/backend"
 
 	"github.com/charmbracelet/git-lfs-transfer/transfer"
 )
diff --git a/modules/log/event_format.go b/modules/log/event_format.go
index 4cf471d223c..8b57748d515 100644
--- a/modules/log/event_format.go
+++ b/modules/log/event_format.go
@@ -164,7 +164,7 @@ func EventFormatTextMessage(mode *WriterMode, event *Event, msgFormat string, ms
 		funcName := event.Caller
 		shortFuncName := funcName
 		if flags&Lshortfuncname != 0 {
-			// funcName = "code.gitea.io/gitea/modules/foo/bar.MyFunc.func1.2()"
+			// funcName = "gitea.dev/modules/foo/bar.MyFunc.func1.2()"
 			slashPos := strings.LastIndexByte(funcName, '/')
 			dotPos := strings.IndexByte(funcName[slashPos+1:], '.')
 			if dotPos > 0 {
diff --git a/modules/log/event_writer_console.go b/modules/log/event_writer_console.go
index e4c409d83e7..8a3e43710a2 100644
--- a/modules/log/event_writer_console.go
+++ b/modules/log/event_writer_console.go
@@ -6,7 +6,7 @@ package log
 import (
 	"os"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 type WriterConsoleOption struct {
diff --git a/modules/log/event_writer_file.go b/modules/log/event_writer_file.go
index f26286498a6..c4b8183c2a0 100644
--- a/modules/log/event_writer_file.go
+++ b/modules/log/event_writer_file.go
@@ -6,8 +6,8 @@ package log
 import (
 	"io"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/util/rotatingfilewriter"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/util/rotatingfilewriter"
 )
 
 type WriterFileOption struct {
diff --git a/modules/log/flags.go b/modules/log/flags.go
index f409261150e..c480e06c751 100644
--- a/modules/log/flags.go
+++ b/modules/log/flags.go
@@ -7,7 +7,7 @@ import (
 	"sort"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 )
 
 // These flags define which text to prefix to each log entry generated
diff --git a/modules/log/flags_test.go b/modules/log/flags_test.go
index 6eb65d8114c..2c3f50874ab 100644
--- a/modules/log/flags_test.go
+++ b/modules/log/flags_test.go
@@ -6,7 +6,7 @@ package log
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/log/init.go b/modules/log/init.go
index ccaab50de32..d9cf1d9f809 100644
--- a/modules/log/init.go
+++ b/modules/log/init.go
@@ -8,8 +8,8 @@ import (
 	"runtime"
 	"strings"
 
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/util/rotatingfilewriter"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/util/rotatingfilewriter"
 )
 
 var projectPackagePrefix string
diff --git a/modules/log/level.go b/modules/log/level.go
index 01fa3f5e46b..41a3cd9c001 100644
--- a/modules/log/level.go
+++ b/modules/log/level.go
@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 )
 
 // Level is the level of the logger
diff --git a/modules/log/level_test.go b/modules/log/level_test.go
index 0e59af6cb70..8dc96ecfaeb 100644
--- a/modules/log/level_test.go
+++ b/modules/log/level_test.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/log/logger_global.go b/modules/log/logger_global.go
index 6dacf583a7f..08ac5d2d5f6 100644
--- a/modules/log/logger_global.go
+++ b/modules/log/logger_global.go
@@ -54,10 +54,6 @@ func ErrorWithSkip(skip int, format string, v ...any) {
 	Log(skip+1, ERROR, format, v...)
 }
 
-func Critical(format string, v ...any) {
-	Log(1, ERROR, format, v...)
-}
-
 var OsExiter = os.Exit
 
 // Fatal records fatal log and exit process
diff --git a/modules/log/logger_impl.go b/modules/log/logger_impl.go
index 551c1454aa9..082ab21ace5 100644
--- a/modules/log/logger_impl.go
+++ b/modules/log/logger_impl.go
@@ -5,6 +5,7 @@ package log
 
 import (
 	"context"
+	"net/url"
 	"reflect"
 	"runtime"
 	"strings"
@@ -12,8 +13,8 @@ import (
 	"sync/atomic"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
 )
 
 type LoggerImpl struct {
@@ -226,6 +227,8 @@ func (l *LoggerImpl) Log(skip int, event *Event, format string, logArgs ...any)
 			}
 		} else if ls := asLogStringer(v); ls != nil {
 			msgArgs[i] = logStringFormatter{v: ls}
+		} else if str, ok := v.(string); ok {
+			msgArgs[i] = protectSensitiveInfo(str)
 		}
 	}
 
@@ -235,6 +238,24 @@ func (l *LoggerImpl) Log(skip int, event *Event, format string, logArgs ...any)
 	l.SendLogEvent(event)
 }
 
+func protectSensitiveInfo(s string) string {
+	u, err := url.Parse(s)
+	if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
+		return s
+	}
+	q := u.Query()
+	for _, vals := range q {
+		for i := range vals {
+			vals[i] = "_"
+		}
+	}
+	masked := &url.URL{Scheme: u.Scheme, Host: u.Host, Path: u.Path, RawQuery: q.Encode()}
+	if u.User != nil {
+		masked.User = url.User("_masked_")
+	}
+	return masked.String()
+}
+
 func (l *LoggerImpl) GetLevel() Level {
 	return Level(l.level.Load())
 }
diff --git a/modules/log/logger_test.go b/modules/log/logger_test.go
index a74139dc51c..6e38610dddc 100644
--- a/modules/log/logger_test.go
+++ b/modules/log/logger_test.go
@@ -177,3 +177,10 @@ func TestLoggerExpressionFilter(t *testing.T) {
 
 	assert.Equal(t, []string{"foo\n", "foo bar\n", "by filename\n"}, w1.FetchLogs())
 }
+
+func TestProtectSensitiveInfo(t *testing.T) {
+	assert.Empty(t, protectSensitiveInfo(""))
+	assert.Equal(t, "mailto:user@example.com", protectSensitiveInfo("mailto:user@example.com"))
+	assert.Equal(t, "https://example.com", protectSensitiveInfo("https://example.com"))
+	assert.Equal(t, "https://_masked_@example.com/path?k=_", protectSensitiveInfo("https://u:p@example.com/path?k=v#hash"))
+}
diff --git a/modules/markup/asciicast/asciicast.go b/modules/markup/asciicast/asciicast.go
index b3af5eef091..665cc8dbc0d 100644
--- a/modules/markup/asciicast/asciicast.go
+++ b/modules/markup/asciicast/asciicast.go
@@ -8,8 +8,8 @@ import (
 	"io"
 	"net/url"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
 )
 
 func init() {
diff --git a/modules/markup/camo.go b/modules/markup/camo.go
index f07d62d4f91..6c10dee6129 100644
--- a/modules/markup/camo.go
+++ b/modules/markup/camo.go
@@ -10,7 +10,7 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // CamoEncode encodes a lnk to fit with the go-camo and camo proxy links. The purposes of camo-proxy are:
diff --git a/modules/markup/camo_test.go b/modules/markup/camo_test.go
index 3c5d40afa07..d432b9df4f0 100644
--- a/modules/markup/camo_test.go
+++ b/modules/markup/camo_test.go
@@ -6,7 +6,7 @@ package markup
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/markup/console/console.go b/modules/markup/console/console.go
index bcd6cfce77e..0524fd22cf0 100644
--- a/modules/markup/console/console.go
+++ b/modules/markup/console/console.go
@@ -8,10 +8,10 @@ import (
 	"io"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/util"
 
 	trend "github.com/buildkite/terminal-to-html/v3"
 )
diff --git a/modules/markup/console/console_test.go b/modules/markup/console/console_test.go
index d1192bebc2a..00fc5e3b7e1 100644
--- a/modules/markup/console/console_test.go
+++ b/modules/markup/console/console_test.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/typesniffer"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/typesniffer"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/markup/csv/csv.go b/modules/markup/csv/csv.go
index 910a1518bc5..da73ea8114d 100644
--- a/modules/markup/csv/csv.go
+++ b/modules/markup/csv/csv.go
@@ -9,11 +9,11 @@ import (
 	"io"
 	"strconv"
 
-	"code.gitea.io/gitea/modules/csv"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/csv"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
 )
 
 func init() {
diff --git a/modules/markup/csv/csv_test.go b/modules/markup/csv/csv_test.go
index fff7f0baca2..6d68476e90e 100644
--- a/modules/markup/csv/csv_test.go
+++ b/modules/markup/csv/csv_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
+	"gitea.dev/modules/markup"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/markup/external/external.go b/modules/markup/external/external.go
index 4b3c96fd33d..9a70e8f54bb 100644
--- a/modules/markup/external/external.go
+++ b/modules/markup/external/external.go
@@ -12,9 +12,9 @@ import (
 	"runtime"
 	"strings"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
 
 	"github.com/kballard/go-shellquote"
 )
diff --git a/modules/markup/external/frontend.go b/modules/markup/external/frontend.go
index 7327503d28a..34fa2715f78 100644
--- a/modules/markup/external/frontend.go
+++ b/modules/markup/external/frontend.go
@@ -8,11 +8,11 @@ import (
 	"io"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 type frontendRenderer struct {
@@ -90,6 +90,6 @@ func (p *frontendRenderer) Render(ctx *markup.RenderContext, input io.Reader, ou
 </html>`,
 		p.name, ctx.RenderOptions.RelativePath,
 		contentEncoding, contentString,
-		public.AssetURI("js/external-render-frontend.js"))
+		public.AssetURI("web_src/js/external-render-frontend.ts"))
 	return err
 }
diff --git a/modules/markup/html.go b/modules/markup/html.go
index 0fe37ae3052..4943bdf4a5f 100644
--- a/modules/markup/html.go
+++ b/modules/markup/html.go
@@ -13,9 +13,9 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/markup/common"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/markup/common"
+	"gitea.dev/modules/translation"
 
 	"golang.org/x/net/html"
 	"golang.org/x/net/html/atom"
@@ -175,16 +175,25 @@ var emojiProcessors = []processor{
 	emojiProcessor,
 }
 
+// isBareURLSubject reports whether the (HTML-escaped) commit subject content
+// is entirely a single URL, ignoring leading/trailing whitespace.
+func isBareURLSubject(content string) bool {
+	s := strings.TrimSpace(html.UnescapeString(content))
+	if s == "" {
+		return false
+	}
+	m := common.GlobalVars().LinkRegex.FindStringIndex(s)
+	return m != nil && m[0] == 0 && m[1] == len(s)
+}
+
 // PostProcessCommitMessageSubject will use the same logic as PostProcess and
 // PostProcessCommitMessage, but will disable the shortLinkProcessor and
-// emailAddressProcessor, will add a defaultLinkProcessor if defaultLink is set,
-// which changes every text node into a link to the passed default link.
+// emailAddressProcessor, and wraps the whole subject in defaultLink.
 func PostProcessCommitMessageSubject(ctx *RenderContext, defaultLink, content string) (string, error) {
 	procs := []processor{
 		fullIssuePatternProcessor,
 		comparePatternProcessor,
 		fullHashPatternProcessor,
-		linkProcessor,
 		mentionProcessor,
 		issueIndexPatternProcessor,
 		commitCrossReferencePatternProcessor,
@@ -192,6 +201,15 @@ func PostProcessCommitMessageSubject(ctx *RenderContext, defaultLink, content st
 		emojiShortCodeProcessor,
 		emojiProcessor,
 	}
+	// When the whole subject is a bare URL, linkProcessor would turn it into
+	// a competing anchor and hijack the surrounding defaultLink wrapper, leaving
+	// the subject visually unclickable. Match GitHub: render such subjects as
+	// plain text inside defaultLink. Partial URLs inside larger text still become
+	// their own links (nested anchors aren't legal HTML, so the outer defaultLink
+	// naturally breaks on that span, same as on GitHub).
+	if !isBareURLSubject(content) {
+		procs = append(procs, linkProcessor)
+	}
 	procs = append(procs, func(ctx *RenderContext, node *html.Node) {
 		ch := &html.Node{Parent: node, Type: html.TextNode, Data: node.Data}
 		node.Type = html.ElementNode
diff --git a/modules/markup/html_codepreview.go b/modules/markup/html_codepreview.go
index 1d6d9a61091..3d4d6d137e7 100644
--- a/modules/markup/html_codepreview.go
+++ b/modules/markup/html_codepreview.go
@@ -9,8 +9,8 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
 
 	"golang.org/x/net/html"
 )
diff --git a/modules/markup/html_codepreview_test.go b/modules/markup/html_codepreview_test.go
index 3d99348ef18..1744cc76488 100644
--- a/modules/markup/html_codepreview_test.go
+++ b/modules/markup/html_codepreview_test.go
@@ -9,8 +9,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -22,7 +22,7 @@ func TestRenderCodePreview(t *testing.T) {
 		},
 	})
 	test := func(input, expected string) {
-		buffer, err := markup.RenderString(markup.NewTestRenderContext().WithMarkupType(markdown.MarkupName), input)
+		buffer, err := testRenderString(markup.NewTestRenderContext().WithMarkupType(markdown.MarkupName), input)
 		assert.NoError(t, err)
 		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(buffer))
 	}
diff --git a/modules/markup/html_commit.go b/modules/markup/html_commit.go
index a2c5160674f..a9c4852026a 100644
--- a/modules/markup/html_commit.go
+++ b/modules/markup/html_commit.go
@@ -8,9 +8,9 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/references"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/references"
 
 	"golang.org/x/net/html"
 	"golang.org/x/net/html/atom"
diff --git a/modules/markup/html_emoji.go b/modules/markup/html_emoji.go
index 91ba26c6769..e7c2d1ba6c4 100644
--- a/modules/markup/html_emoji.go
+++ b/modules/markup/html_emoji.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"unicode"
 
-	"code.gitea.io/gitea/modules/emoji"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/emoji"
+	"gitea.dev/modules/setting"
 
 	"golang.org/x/net/html"
 	"golang.org/x/net/html/atom"
@@ -69,6 +69,11 @@ func emojiShortCodeProcessor(ctx *RenderContext, node *html.Node) {
 		m[1] += start
 		start = m[1]
 
+		// don't render a shortcode whose ":" directly follows a backtick (an unclosed code span)
+		if m[0] > 0 && node.Data[m[0]-1] == '`' {
+			continue
+		}
+
 		alias := node.Data[m[0]:m[1]]
 
 		var nextChar byte
diff --git a/modules/markup/html_internal_test.go b/modules/markup/html_internal_test.go
index 3a91797e25b..186489ae722 100644
--- a/modules/markup/html_internal_test.go
+++ b/modules/markup/html_internal_test.go
@@ -9,9 +9,9 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	testModule "code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	testModule "gitea.dev/modules/test"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/markup/html_issue.go b/modules/markup/html_issue.go
index a94abb38831..675098700f5 100644
--- a/modules/markup/html_issue.go
+++ b/modules/markup/html_issue.go
@@ -8,13 +8,13 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/references"
-	"code.gitea.io/gitea/modules/regexplru"
-	"code.gitea.io/gitea/modules/templates/vars"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/references"
+	"gitea.dev/modules/regexplru"
+	"gitea.dev/modules/templates/vars"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
 
 	"golang.org/x/net/html"
 	"golang.org/x/net/html/atom"
diff --git a/modules/markup/html_issue_test.go b/modules/markup/html_issue_test.go
index 39cd9dcf6af..210a699051d 100644
--- a/modules/markup/html_issue_test.go
+++ b/modules/markup/html_issue_test.go
@@ -9,10 +9,10 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	testModule "code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	testModule "gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/markup/html_link.go b/modules/markup/html_link.go
index c84e0b90d81..1e0e12da94d 100644
--- a/modules/markup/html_link.go
+++ b/modules/markup/html_link.go
@@ -8,8 +8,8 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/modules/markup/common"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/markup/common"
+	"gitea.dev/modules/util"
 
 	"golang.org/x/net/html"
 	"golang.org/x/net/html/atom"
diff --git a/modules/markup/html_mention.go b/modules/markup/html_mention.go
index 00cd51ca949..a8f8d18c451 100644
--- a/modules/markup/html_mention.go
+++ b/modules/markup/html_mention.go
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/modules/references"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/references"
+	"gitea.dev/modules/util"
 
 	"golang.org/x/net/html"
 )
diff --git a/modules/markup/html_node.go b/modules/markup/html_node.go
index f98e7429a28..33d402231c3 100644
--- a/modules/markup/html_node.go
+++ b/modules/markup/html_node.go
@@ -6,7 +6,7 @@ package markup
 import (
 	"strings"
 
-	"code.gitea.io/gitea/modules/markup/common"
+	"gitea.dev/modules/markup/common"
 
 	"golang.org/x/net/html"
 )
diff --git a/modules/markup/html_test.go b/modules/markup/html_test.go
index 4fa9466d19a..f3aec68b6ad 100644
--- a/modules/markup/html_test.go
+++ b/modules/markup/html_test.go
@@ -8,12 +8,12 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/emoji"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
-	testModule "code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/emoji"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
+	testModule "gitea.dev/modules/test"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -24,10 +24,16 @@ var (
 	localMetas        = map[string]string{"user": testRepoOwnerName, "repo": testRepoName}
 )
 
+func testRenderString(ctx *markup.RenderContext, content string) (string, error) {
+	var buf strings.Builder
+	err := markup.Render(ctx, strings.NewReader(content), &buf)
+	return buf.String(), err
+}
+
 func TestRender_Commits(t *testing.T) {
 	test := func(input, expected string) {
 		rctx := markup.NewTestRenderContext(markup.TestAppURL, localMetas).WithRelativePath("a.md")
-		buffer, err := markup.RenderString(rctx, input)
+		buffer, err := testRenderString(rctx, input)
 		assert.NoError(t, err)
 		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(buffer))
 	}
@@ -75,7 +81,7 @@ func TestRender_CrossReferences(t *testing.T) {
 	defer testModule.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
 	test := func(input, expected string) {
 		rctx := markup.NewTestRenderContext(markup.TestAppURL, localMetas).WithRelativePath("a.md")
-		buffer, err := markup.RenderString(rctx, input)
+		buffer, err := testRenderString(rctx, input)
 		assert.NoError(t, err)
 		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(buffer))
 	}
@@ -119,7 +125,7 @@ func TestRender_links(t *testing.T) {
 	setting.AppURL = markup.TestAppURL
 	defer testModule.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
 	test := func(input, expected string) {
-		buffer, err := markup.RenderString(markup.NewTestRenderContext().WithRelativePath("a.md"), input)
+		buffer, err := testRenderString(markup.NewTestRenderContext().WithRelativePath("a.md"), input)
 		assert.NoError(t, err)
 		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(buffer))
 	}
@@ -234,7 +240,7 @@ func TestRender_email(t *testing.T) {
 	setting.AppURL = markup.TestAppURL
 	defer testModule.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
 	test := func(input, expected string) {
-		res, err := markup.RenderString(markup.NewTestRenderContext().WithRelativePath("a.md"), input)
+		res, err := testRenderString(markup.NewTestRenderContext().WithRelativePath("a.md"), input)
 		assert.NoError(t, err)
 		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(res), "input: %s", input)
 	}
@@ -321,7 +327,7 @@ func TestRender_emoji(t *testing.T) {
 
 	test := func(input, expected string) {
 		expected = strings.ReplaceAll(expected, "&", "&amp;")
-		buffer, err := markup.RenderString(markup.NewTestRenderContext().WithRelativePath("a.md"), input)
+		buffer, err := testRenderString(markup.NewTestRenderContext().WithRelativePath("a.md"), input)
 		assert.NoError(t, err)
 		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(buffer))
 	}
@@ -371,6 +377,9 @@ func TestRender_emoji(t *testing.T) {
 	test(":100:200", `<p>:100:200</p>`)
 	test("std::thread::something", `<p>std::thread::something</p>`)
 	test(":not exist:", `<p>:not exist:</p>`)
+	test("foo `:smile:", "<p>foo `:smile:</p>")
+	test("foo `:smile:`", `<p>foo <code>:smile:</code></p>`)
+	test("foo ` :smile:", "<p>foo ` <span class=\"emoji\" aria-label=\"grinning face with smiling eyes\">😄</span></p>")
 }
 
 func TestRender_ShortLinks(t *testing.T) {
diff --git a/modules/markup/html_toc_test.go b/modules/markup/html_toc_test.go
index e93cfc93461..23dbfe3bffc 100644
--- a/modules/markup/html_toc_test.go
+++ b/modules/markup/html_toc_test.go
@@ -7,9 +7,9 @@ import (
 	"regexp"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/markup/internal/renderinternal.go b/modules/markup/internal/renderinternal.go
index 9fd9a1c0e83..3b5886a19ff 100644
--- a/modules/markup/internal/renderinternal.go
+++ b/modules/markup/internal/renderinternal.go
@@ -12,7 +12,7 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/htmlutil"
+	"gitea.dev/modules/htmlutil"
 
 	"golang.org/x/net/html"
 )
@@ -77,6 +77,7 @@ func (r *RenderInternal) ProtectSafeAttrs(content template.HTML) template.HTML {
 }
 
 func (r *RenderInternal) FormatWithSafeAttrs(w io.Writer, fmt template.HTML, a ...any) error {
-	_, err := w.Write([]byte(r.ProtectSafeAttrs(htmlutil.HTMLFormat(fmt, a...))))
+	htmlStr := r.ProtectSafeAttrs(htmlutil.HTMLFormat(fmt, a...))
+	_, err := io.WriteString(w, string(htmlStr))
 	return err
 }
diff --git a/modules/markup/main_test.go b/modules/markup/main_test.go
index a8dcff475d3..f8a77ad86ef 100644
--- a/modules/markup/main_test.go
+++ b/modules/markup/main_test.go
@@ -7,8 +7,8 @@ import (
 	"os"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
 )
 
 func TestMain(m *testing.M) {
diff --git a/modules/markup/markdown/convertyaml.go b/modules/markup/markdown/convertyaml.go
index 04664a9c1db..0c699019293 100644
--- a/modules/markup/markdown/convertyaml.go
+++ b/modules/markup/markdown/convertyaml.go
@@ -6,12 +6,12 @@ package markdown
 import (
 	"strings"
 
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/svg"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/svg"
 
 	"github.com/yuin/goldmark/ast"
 	east "github.com/yuin/goldmark/extension/ast"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func nodeToTable(meta *yaml.Node) ast.Node {
diff --git a/modules/markup/markdown/goldmark.go b/modules/markup/markdown/goldmark.go
index 4a560517f22..0fdd4cc24ff 100644
--- a/modules/markup/markdown/goldmark.go
+++ b/modules/markup/markdown/goldmark.go
@@ -6,9 +6,9 @@ package markdown
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/internal"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/internal"
 
 	"github.com/yuin/goldmark/ast"
 	east "github.com/yuin/goldmark/extension/ast"
@@ -119,12 +119,33 @@ func (r *HTMLRenderer) RegisterFuncs(reg renderer.NodeRendererFuncRegisterer) {
 	reg.Register(KindDetails, r.renderDetails)
 	reg.Register(KindSummary, r.renderSummary)
 	reg.Register(ast.KindCodeSpan, r.renderCodeSpan)
+	reg.Register(ast.KindCodeBlock, r.renderCodeBlock)
 	reg.Register(KindAttention, r.renderAttention)
 	reg.Register(KindTaskCheckBoxListItem, r.renderTaskCheckBoxListItem)
 	reg.Register(east.KindTaskCheckBox, r.renderTaskCheckBox)
 	reg.Register(KindRawHTML, r.renderRawHTML)
 }
 
+// renderCodeBlock wraps indented code blocks like the fenced renderer
+func (r *HTMLRenderer) renderCodeBlock(w util.BufWriter, source []byte, n ast.Node, entering bool) (ast.WalkStatus, error) {
+	if entering {
+		opening := r.renderInternal.ProtectSafeAttrs(`<div class="code-block-container code-overflow-scroll"><pre class="code-block"><code>`)
+		if _, err := w.WriteString(string(opening)); err != nil {
+			return ast.WalkStop, err
+		}
+		lines := n.Lines()
+		for i := 0; i < lines.Len(); i++ {
+			line := lines.At(i)
+			r.Writer.RawWrite(w, line.Value(source))
+		}
+	} else {
+		if _, err := w.WriteString("</code></pre></div>"); err != nil {
+			return ast.WalkStop, err
+		}
+	}
+	return ast.WalkContinue, nil
+}
+
 func (r *HTMLRenderer) renderDocument(w util.BufWriter, source []byte, node ast.Node, entering bool) (ast.WalkStatus, error) {
 	n := node.(*ast.Document)
 
diff --git a/modules/markup/markdown/main_test.go b/modules/markup/markdown/main_test.go
index 4b4d40bb2e0..3bbb0f28efe 100644
--- a/modules/markup/markdown/main_test.go
+++ b/modules/markup/markdown/main_test.go
@@ -7,8 +7,8 @@ import (
 	"os"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
 )
 
 func TestMain(m *testing.M) {
diff --git a/modules/markup/markdown/markdown.go b/modules/markup/markdown/markdown.go
index 1cc75d763d1..790de93c09d 100644
--- a/modules/markup/markdown/markdown.go
+++ b/modules/markup/markdown/markdown.go
@@ -11,12 +11,13 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/common"
-	"code.gitea.io/gitea/modules/markup/markdown/math"
-	"code.gitea.io/gitea/modules/setting"
-	giteautil "code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/common"
+	"gitea.dev/modules/markup/markdown/math"
+	"gitea.dev/modules/setting"
+	giteautil "gitea.dev/modules/util"
 
 	chromahtml "github.com/alecthomas/chroma/v2/formatters/html"
 	"github.com/yuin/goldmark"
@@ -266,7 +267,9 @@ func Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error
 func RenderString(ctx *markup.RenderContext, content string) (template.HTML, error) {
 	var buf strings.Builder
 	if err := Render(ctx, strings.NewReader(content), &buf); err != nil {
-		return "", err
+		log.Warn("Unable to RenderString: %v, content: %s", err, giteautil.TruncateRunes(content, 200))
+		err = nil
+		return htmlutil.EscapeString(content), err
 	}
 	return template.HTML(buf.String()), nil
 }
diff --git a/modules/markup/markdown/markdown_attention_test.go b/modules/markup/markdown/markdown_attention_test.go
index 7b54653ec0e..d39c87f12c0 100644
--- a/modules/markup/markdown/markdown_attention_test.go
+++ b/modules/markup/markdown/markdown_attention_test.go
@@ -7,9 +7,9 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/svg"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/svg"
 
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/text/cases"
diff --git a/modules/markup/markdown/markdown_benchmark_test.go b/modules/markup/markdown/markdown_benchmark_test.go
index e08612f0646..07afd45a8d1 100644
--- a/modules/markup/markdown/markdown_benchmark_test.go
+++ b/modules/markup/markdown/markdown_benchmark_test.go
@@ -6,8 +6,8 @@ package markdown_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
 )
 
 func BenchmarkSpecializedMarkdown(b *testing.B) {
diff --git a/modules/markup/markdown/markdown_math_test.go b/modules/markup/markdown/markdown_math_test.go
index 9e368cb689a..fc3ca2cf470 100644
--- a/modules/markup/markdown/markdown_math_test.go
+++ b/modules/markup/markdown/markdown_math_test.go
@@ -7,9 +7,9 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/markup/markdown/markdown_test.go b/modules/markup/markdown/markdown_test.go
index 2f14a0fae98..11ff7b09c5c 100644
--- a/modules/markup/markdown/markdown_test.go
+++ b/modules/markup/markdown/markdown_test.go
@@ -9,11 +9,11 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -601,7 +601,7 @@ func TestMarkdownUlDir(t *testing.T) {
 `, string(result))
 }
 
-func TestMarkdownFencedCodeBlock(t *testing.T) {
+func TestMarkdownCodeBlock(t *testing.T) {
 	testRender := func(input, expected string) {
 		buffer, err := markdown.RenderString(markup.NewTestRenderContext(), input)
 		assert.NoError(t, err)
@@ -618,4 +618,6 @@ func TestMarkdownFencedCodeBlock(t *testing.T) {
 	testRender("```js:app.ts\ncode\n```", jsCommon)
 	testRender("```js,ignore\ncode\n```", jsCommon)
 	testRender("```js ignore\ncode\n```", jsCommon)
+	testRender("    code\n", prefix+`<code>code`+nl+`</code>`+suffix)
+	testRender("    <script>alert(1)</script>\n", prefix+`<code>&lt;script&gt;alert(1)&lt;/script&gt;`+nl+`</code>`+suffix)
 }
diff --git a/modules/markup/markdown/math/block_parser.go b/modules/markup/markdown/math/block_parser.go
index 2c5553550a7..1768c3a4b35 100644
--- a/modules/markup/markdown/math/block_parser.go
+++ b/modules/markup/markdown/math/block_parser.go
@@ -6,7 +6,7 @@ package math
 import (
 	"bytes"
 
-	giteaUtil "code.gitea.io/gitea/modules/util"
+	giteaUtil "gitea.dev/modules/util"
 
 	"github.com/yuin/goldmark/ast"
 	"github.com/yuin/goldmark/parser"
diff --git a/modules/markup/markdown/math/block_renderer.go b/modules/markup/markdown/math/block_renderer.go
index 95a336a02ce..2d589cf7d77 100644
--- a/modules/markup/markdown/math/block_renderer.go
+++ b/modules/markup/markdown/math/block_renderer.go
@@ -6,8 +6,8 @@ package math
 import (
 	"html/template"
 
-	"code.gitea.io/gitea/modules/markup/internal"
-	giteaUtil "code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/markup/internal"
+	giteaUtil "gitea.dev/modules/util"
 
 	gast "github.com/yuin/goldmark/ast"
 	"github.com/yuin/goldmark/renderer"
diff --git a/modules/markup/markdown/math/inline_renderer.go b/modules/markup/markdown/math/inline_renderer.go
index eeeb60cc7ee..d438af1a24d 100644
--- a/modules/markup/markdown/math/inline_renderer.go
+++ b/modules/markup/markdown/math/inline_renderer.go
@@ -6,7 +6,7 @@ package math
 import (
 	"bytes"
 
-	"code.gitea.io/gitea/modules/markup/internal"
+	"gitea.dev/modules/markup/internal"
 
 	"github.com/yuin/goldmark/ast"
 	"github.com/yuin/goldmark/renderer"
diff --git a/modules/markup/markdown/math/math.go b/modules/markup/markdown/math/math.go
index 4b74db2d761..b8616f4d806 100644
--- a/modules/markup/markdown/math/math.go
+++ b/modules/markup/markdown/math/math.go
@@ -4,8 +4,8 @@
 package math
 
 import (
-	"code.gitea.io/gitea/modules/markup/internal"
-	giteaUtil "code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/markup/internal"
+	giteaUtil "gitea.dev/modules/util"
 
 	"github.com/yuin/goldmark"
 	"github.com/yuin/goldmark/parser"
diff --git a/modules/markup/markdown/meta.go b/modules/markup/markdown/meta.go
index 6ddd892110b..ecc0b81098c 100644
--- a/modules/markup/markdown/meta.go
+++ b/modules/markup/markdown/meta.go
@@ -9,7 +9,7 @@ import (
 	"unicode"
 	"unicode/utf8"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func isYAMLSeparator(line []byte) bool {
diff --git a/modules/markup/markdown/renderconfig.go b/modules/markup/markdown/renderconfig.go
index d8b1b10ce63..59f3e873ec5 100644
--- a/modules/markup/markdown/renderconfig.go
+++ b/modules/markup/markdown/renderconfig.go
@@ -7,10 +7,10 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/modules/markup"
+	"gitea.dev/modules/markup"
 
 	"github.com/yuin/goldmark/ast"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // RenderConfig represents rendering configuration for this file
diff --git a/modules/markup/markdown/renderconfig_test.go b/modules/markup/markdown/renderconfig_test.go
index 53c52177a75..84e4ac33f66 100644
--- a/modules/markup/markdown/renderconfig_test.go
+++ b/modules/markup/markdown/renderconfig_test.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestRenderConfig_UnmarshalYAML(t *testing.T) {
diff --git a/modules/markup/markdown/transform_blockquote.go b/modules/markup/markdown/transform_blockquote.go
index bf17f01681c..b6cbef9a0a8 100644
--- a/modules/markup/markdown/transform_blockquote.go
+++ b/modules/markup/markdown/transform_blockquote.go
@@ -6,7 +6,7 @@ package markdown
 import (
 	"strings"
 
-	"code.gitea.io/gitea/modules/svg"
+	"gitea.dev/modules/svg"
 
 	"github.com/yuin/goldmark/ast"
 	"github.com/yuin/goldmark/text"
diff --git a/modules/markup/markdown/transform_codespan.go b/modules/markup/markdown/transform_codespan.go
index c2e4295bc2b..900c38b129e 100644
--- a/modules/markup/markdown/transform_codespan.go
+++ b/modules/markup/markdown/transform_codespan.go
@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"strings"
 
-	"code.gitea.io/gitea/modules/markup"
+	"gitea.dev/modules/markup"
 
 	"github.com/microcosm-cc/bluemonday/css"
 	"github.com/yuin/goldmark/ast"
diff --git a/modules/markup/markdown/transform_list.go b/modules/markup/markdown/transform_list.go
index 6cafa8ff78e..999738790ce 100644
--- a/modules/markup/markdown/transform_list.go
+++ b/modules/markup/markdown/transform_list.go
@@ -6,7 +6,7 @@ package markdown
 import (
 	"fmt"
 
-	"code.gitea.io/gitea/modules/markup"
+	"gitea.dev/modules/markup"
 
 	"github.com/yuin/goldmark/ast"
 	east "github.com/yuin/goldmark/extension/ast"
diff --git a/modules/markup/mdstripper/mdstripper.go b/modules/markup/mdstripper/mdstripper.go
index bf69051e876..a127bbfd4b7 100644
--- a/modules/markup/mdstripper/mdstripper.go
+++ b/modules/markup/mdstripper/mdstripper.go
@@ -10,9 +10,9 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup/common"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup/common"
+	"gitea.dev/modules/setting"
 
 	"github.com/yuin/goldmark"
 	"github.com/yuin/goldmark/ast"
diff --git a/modules/markup/orgmode/orgmode.go b/modules/markup/orgmode/orgmode.go
index fd3071645ad..37184dcdac6 100644
--- a/modules/markup/orgmode/orgmode.go
+++ b/modules/markup/orgmode/orgmode.go
@@ -9,11 +9,11 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/highlight"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/highlight"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
 
 	"github.com/alecthomas/chroma/v2"
 	"github.com/niklasfasching/go-org/org"
@@ -106,31 +106,27 @@ func (r *orgWriter) resolveLink(link string) string {
 // WriteRegularLink renders images, links or videos
 func (r *orgWriter) WriteRegularLink(l org.RegularLink) {
 	link := r.resolveLink(l.URL)
-
-	printHTML := func(html template.HTML, a ...any) {
-		_, _ = fmt.Fprint(r, htmlutil.HTMLFormat(html, a...))
-	}
 	// Inspired by https://github.com/niklasfasching/go-org/blob/6eb20dbda93cb88c3503f7508dc78cbbc639378f/org/html_writer.go#L406-L427
 	switch l.Kind() {
 	case "image":
 		if l.Description == nil {
-			printHTML(`<img src="%s" alt="%s">`, link, link)
+			_, _ = htmlutil.HTMLPrintf(r, `<img src="%s" alt="%s">`, link, link)
 		} else {
 			imageSrc := r.resolveLink(org.String(l.Description...))
-			printHTML(`<a href="%s"><img src="%s" alt="%s"></a>`, link, imageSrc, imageSrc)
+			_, _ = htmlutil.HTMLPrintf(r, `<a href="%s"><img src="%s" alt="%s"></a>`, link, imageSrc, imageSrc)
 		}
 	case "video":
 		if l.Description == nil {
-			printHTML(`<video src="%s">%s</video>`, link, link)
+			_, _ = htmlutil.HTMLPrintf(r, `<video src="%s">%s</video>`, link, link)
 		} else {
 			videoSrc := r.resolveLink(org.String(l.Description...))
-			printHTML(`<a href="%s"><video src="%s">%s</video></a>`, link, videoSrc, videoSrc)
+			_, _ = htmlutil.HTMLPrintf(r, `<a href="%s"><video src="%s">%s</video></a>`, link, videoSrc, videoSrc)
 		}
 	default:
 		var description any = link
 		if l.Description != nil {
 			description = template.HTML(r.WriteNodesAsString(l.Description...)) // orgmode HTMLWriter outputs HTML content
 		}
-		printHTML(`<a href="%s">%s</a>`, link, description)
+		_, _ = htmlutil.HTMLPrintf(r, `<a href="%s">%s</a>`, link, description)
 	}
 }
diff --git a/modules/markup/orgmode/orgmode_test.go b/modules/markup/orgmode/orgmode_test.go
index ebda2271f28..d18660b054d 100644
--- a/modules/markup/orgmode/orgmode_test.go
+++ b/modules/markup/orgmode/orgmode_test.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/orgmode"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/orgmode"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/markup/render.go b/modules/markup/render.go
index 6e8838d49fe..6f43434485d 100644
--- a/modules/markup/render.go
+++ b/modules/markup/render.go
@@ -15,12 +15,12 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/markup/internal"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/markup/internal"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/util"
 
 	"golang.org/x/sync/errgroup"
 )
@@ -198,15 +198,6 @@ func Render(rctx *RenderContext, origInput io.Reader, output io.Writer) error {
 	return RenderWithRenderer(rctx, renderer, input, output)
 }
 
-// RenderString renders Markup string to HTML with all specific handling stuff and return string
-func RenderString(ctx *RenderContext, content string) (string, error) {
-	var buf strings.Builder
-	if err := Render(ctx, strings.NewReader(content), &buf); err != nil {
-		return "", err
-	}
-	return buf.String(), nil
-}
-
 func RenderIFrame(ctx *RenderContext, opts *ExternalRendererOptions, output io.Writer) error {
 	ownerName, repoName := ctx.RenderOptions.Metas["user"], ctx.RenderOptions.Metas["repo"]
 	refSubURL := ctx.RenderOptions.Metas["RefTypeNameSubURL"]
@@ -252,7 +243,7 @@ func RenderWithRenderer(ctx *RenderContext, renderer Renderer, input io.Reader,
 			return RenderIFrame(ctx, &extOpts, output)
 		}
 		// else: this is a standalone page, fallthrough to the real rendering, and add extra JS/CSS
-		extraScriptSrc := public.AssetURI("js/external-render-helper.js")
+		extraScriptSrc := public.AssetURI("web_src/js/external-render-helper.ts")
 		extraLinkHref := ctx.RenderOptions.StandalonePageOptions.CurrentWebTheme.PublicAssetURI()
 		// "<script>" must go before "<link>", to make Golang's http.DetectContentType() can still recognize the content as "text/html"
 		// DO NOT use "type=module", the script must run as early as possible, to set up the environment in the iframe
diff --git a/modules/markup/render_helper.go b/modules/markup/render_helper.go
index b16f1189c51..b1f44e46c37 100644
--- a/modules/markup/render_helper.go
+++ b/modules/markup/render_helper.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"html/template"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 const (
diff --git a/modules/markup/render_link.go b/modules/markup/render_link.go
index c3a95622ace..c7470cda7e6 100644
--- a/modules/markup/render_link.go
+++ b/modules/markup/render_link.go
@@ -9,8 +9,8 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/setting"
 )
 
 // resolveLinkRelative tries to resolve the link relative to the "{base}/{cur}", and returns the final link.
diff --git a/modules/markup/render_link_test.go b/modules/markup/render_link_test.go
index 045b728c8d1..1ebe60688a3 100644
--- a/modules/markup/render_link_test.go
+++ b/modules/markup/render_link_test.go
@@ -6,7 +6,7 @@ package markup
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/markup/renderer.go b/modules/markup/renderer.go
index c62c28ad2a1..99c1eb532f1 100644
--- a/modules/markup/renderer.go
+++ b/modules/markup/renderer.go
@@ -8,8 +8,8 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/typesniffer"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/typesniffer"
 )
 
 // Renderer defines an interface for rendering markup file to HTML
diff --git a/modules/markup/sanitizer_custom.go b/modules/markup/sanitizer_custom.go
index 7f96556fd79..5b7f086041f 100644
--- a/modules/markup/sanitizer_custom.go
+++ b/modules/markup/sanitizer_custom.go
@@ -7,7 +7,7 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/microcosm-cc/bluemonday"
 )
diff --git a/modules/markup/sanitizer_default.go b/modules/markup/sanitizer_default.go
index 447cf4807ec..e38852a3d5a 100644
--- a/modules/markup/sanitizer_default.go
+++ b/modules/markup/sanitizer_default.go
@@ -9,7 +9,7 @@ import (
 	"net/url"
 	"regexp"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/microcosm-cc/bluemonday"
 )
diff --git a/modules/mcaptcha/mcaptcha.go b/modules/mcaptcha/mcaptcha.go
index 74142aa8632..ed1a3c0d911 100644
--- a/modules/mcaptcha/mcaptcha.go
+++ b/modules/mcaptcha/mcaptcha.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"codeberg.org/gusted/mcaptcha"
 )
diff --git a/modules/metrics/collector.go b/modules/metrics/collector.go
index d02e5c11280..c4c596821bc 100755
--- a/modules/metrics/collector.go
+++ b/modules/metrics/collector.go
@@ -6,9 +6,9 @@ package metrics
 import (
 	"runtime"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/setting"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/setting"
 
 	"github.com/prometheus/client_golang/prometheus"
 )
diff --git a/modules/migration/downloader.go b/modules/migration/downloader.go
index 669222dea2a..d69d7f9f687 100644
--- a/modules/migration/downloader.go
+++ b/modules/migration/downloader.go
@@ -7,7 +7,7 @@ package migration
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/structs"
 )
 
 // Downloader downloads the site repo information
diff --git a/modules/migration/file_format.go b/modules/migration/file_format.go
index fd6ac45a210..e925494cd20 100644
--- a/modules/migration/file_format.go
+++ b/modules/migration/file_format.go
@@ -9,11 +9,11 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
 
 	"github.com/santhosh-tekuri/jsonschema/v6"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // schemaLoader implements jsonschema.URLLoader
diff --git a/modules/migration/options.go b/modules/migration/options.go
index 163aa0cfaaa..cf696d8ce40 100644
--- a/modules/migration/options.go
+++ b/modules/migration/options.go
@@ -4,7 +4,7 @@
 
 package migration
 
-import "code.gitea.io/gitea/modules/structs"
+import "gitea.dev/modules/structs"
 
 // MigrateOptions defines the way a repository gets migrated
 // this is for internal usage by migrations module and func who interact with it
@@ -40,5 +40,7 @@ type MigrateOptions struct {
 	MirrorInterval  string `json:"mirror_interval"`
 
 	AWSAccessKeyID     string
-	AWSSecretAccessKey string
+	AWSSecretAccessKey string `json:",omitempty"`
+
+	AWSSecretAccessKeyEncrypted string `json:"aws_secret_access_key_encrypted,omitempty"`
 }
diff --git a/modules/migration/pullrequest.go b/modules/migration/pullrequest.go
index cccab3fd7e5..1397e87daea 100644
--- a/modules/migration/pullrequest.go
+++ b/modules/migration/pullrequest.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 // PullRequest defines a standard pull request information
diff --git a/modules/migration/repo.go b/modules/migration/repo.go
index 22c2cf6fb32..8f5364fefa3 100644
--- a/modules/migration/repo.go
+++ b/modules/migration/repo.go
@@ -11,6 +11,7 @@ type Repository struct {
 	IsPrivate     bool `yaml:"is_private"`
 	IsMirror      bool `yaml:"is_mirror"`
 	Description   string
+	Website       string
 	CloneURL      string `yaml:"clone_url"` // SECURITY: This must be checked to ensure that is safe to be used
 	OriginalURL   string `yaml:"original_url"`
 	DefaultBranch string
diff --git a/modules/migration/schemas_bindata.go b/modules/migration/schemas_bindata.go
index d7c70815962..3f7ada15999 100644
--- a/modules/migration/schemas_bindata.go
+++ b/modules/migration/schemas_bindata.go
@@ -12,7 +12,7 @@ import (
 	"path"
 	"sync"
 
-	"code.gitea.io/gitea/modules/assetfs"
+	"gitea.dev/modules/assetfs"
 
 	_ "embed"
 
diff --git a/modules/nosql/manager.go b/modules/nosql/manager.go
index 9d3ab49c9a8..c7e7582c8c6 100644
--- a/modules/nosql/manager.go
+++ b/modules/nosql/manager.go
@@ -9,7 +9,7 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/process"
+	"gitea.dev/modules/process"
 
 	"github.com/redis/go-redis/v9"
 	"github.com/syndtr/goleveldb/leveldb"
diff --git a/modules/nosql/manager_leveldb.go b/modules/nosql/manager_leveldb.go
index 4d2c90debc6..3bac76f2011 100644
--- a/modules/nosql/manager_leveldb.go
+++ b/modules/nosql/manager_leveldb.go
@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"github.com/syndtr/goleveldb/leveldb"
 	"github.com/syndtr/goleveldb/leveldb/errors"
@@ -59,7 +59,7 @@ func (m *Manager) GetLevelDB(connection string) (db *leveldb.DB, err error) {
 		defer func() {
 			recovered = recover()
 			if recovered != nil {
-				log.Critical("PANIC during GetLevelDB: %v\nStacktrace: %s", recovered, log.Stack(2))
+				log.Error("PANIC during GetLevelDB: %v\nStacktrace: %s", recovered, log.Stack(2))
 			}
 			close(done)
 		}()
diff --git a/modules/nosql/manager_redis.go b/modules/nosql/manager_redis.go
index 3c82651541f..d84393b216f 100644
--- a/modules/nosql/manager_redis.go
+++ b/modules/nosql/manager_redis.go
@@ -11,7 +11,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"github.com/redis/go-redis/v9"
 )
@@ -52,7 +52,7 @@ func (m *Manager) GetRedisClient(connection string) (client redis.UniversalClien
 		defer func() {
 			recovered = recover()
 			if recovered != nil {
-				log.Critical("PANIC during GetRedisClient: %v\nStacktrace: %s", recovered, log.Stack(2))
+				log.Error("PANIC during GetRedisClient: %v\nStacktrace: %s", recovered, log.Stack(2))
 			}
 			close(done)
 		}()
diff --git a/modules/optional/option_test.go b/modules/optional/option_test.go
index ea80a2e3cb4..1ac54418b97 100644
--- a/modules/optional/option_test.go
+++ b/modules/optional/option_test.go
@@ -6,7 +6,7 @@ package optional_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/modules/optional"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/optional/serialization.go b/modules/optional/serialization.go
index 345ce562686..a3db68e76dc 100644
--- a/modules/optional/serialization.go
+++ b/modules/optional/serialization.go
@@ -4,9 +4,9 @@
 package optional
 
 import (
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func (o *Option[T]) UnmarshalJSON(data []byte) error {
diff --git a/modules/optional/serialization_test.go b/modules/optional/serialization_test.go
index c059294bbb9..966e284e8b3 100644
--- a/modules/optional/serialization_test.go
+++ b/modules/optional/serialization_test.go
@@ -7,11 +7,11 @@ import (
 	std_json "encoding/json" //nolint:depguard // for testing purpose
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/optional"
 
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type testSerializationStruct struct {
diff --git a/modules/options/base.go b/modules/options/base.go
index 6c6e3839f46..439eadb1016 100644
--- a/modules/options/base.go
+++ b/modules/options/base.go
@@ -4,8 +4,8 @@
 package options
 
 import (
-	"code.gitea.io/gitea/modules/assetfs"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/assetfs"
+	"gitea.dev/modules/setting"
 )
 
 func CustomAssets() *assetfs.Layer {
diff --git a/modules/options/options_bindata.go b/modules/options/options_bindata.go
index f85f30065e2..fcd6872e24d 100644
--- a/modules/options/options_bindata.go
+++ b/modules/options/options_bindata.go
@@ -10,7 +10,7 @@ package options
 import (
 	"sync"
 
-	"code.gitea.io/gitea/modules/assetfs"
+	"gitea.dev/modules/assetfs"
 
 	_ "embed"
 )
diff --git a/modules/options/options_dynamic.go b/modules/options/options_dynamic.go
index 085492d11c8..98a32863a8a 100644
--- a/modules/options/options_dynamic.go
+++ b/modules/options/options_dynamic.go
@@ -6,8 +6,8 @@
 package options
 
 import (
-	"code.gitea.io/gitea/modules/assetfs"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/assetfs"
+	"gitea.dev/modules/setting"
 )
 
 func BuiltinAssets() *assetfs.Layer {
diff --git a/modules/packages/alpine/metadata.go b/modules/packages/alpine/metadata.go
index c4928117449..d7e30e7108f 100644
--- a/modules/packages/alpine/metadata.go
+++ b/modules/packages/alpine/metadata.go
@@ -13,8 +13,8 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 )
 
 var (
diff --git a/modules/packages/arch/metadata.go b/modules/packages/arch/metadata.go
index 3d7bdf3997f..59608348464 100644
--- a/modules/packages/arch/metadata.go
+++ b/modules/packages/arch/metadata.go
@@ -13,8 +13,8 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"github.com/klauspost/compress/zstd"
 	"github.com/ulikunitz/xz"
diff --git a/modules/packages/cargo/parser.go b/modules/packages/cargo/parser.go
index d82e0e2f058..1aa76034596 100644
--- a/modules/packages/cargo/parser.go
+++ b/modules/packages/cargo/parser.go
@@ -9,8 +9,8 @@ import (
 	"io"
 	"regexp"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/validation"
 
 	"github.com/hashicorp/go-version"
 )
diff --git a/modules/packages/chef/metadata.go b/modules/packages/chef/metadata.go
index a1c91870c29..58e6f9fea12 100644
--- a/modules/packages/chef/metadata.go
+++ b/modules/packages/chef/metadata.go
@@ -10,9 +10,9 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 )
 
 const (
diff --git a/modules/packages/composer/metadata.go b/modules/packages/composer/metadata.go
index 3aac7058aa9..2fec0b31457 100644
--- a/modules/packages/composer/metadata.go
+++ b/modules/packages/composer/metadata.go
@@ -15,9 +15,9 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"github.com/hashicorp/go-version"
 )
diff --git a/modules/packages/composer/metadata_test.go b/modules/packages/composer/metadata_test.go
index 4eca4d92e72..48b9986405b 100644
--- a/modules/packages/composer/metadata_test.go
+++ b/modules/packages/composer/metadata_test.go
@@ -12,7 +12,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"github.com/dsnet/compress/bzip2"
 	"github.com/stretchr/testify/assert"
diff --git a/modules/packages/conan/conaninfo_parser.go b/modules/packages/conan/conaninfo_parser.go
index de11dbee45b..a06caadf58a 100644
--- a/modules/packages/conan/conaninfo_parser.go
+++ b/modules/packages/conan/conaninfo_parser.go
@@ -8,7 +8,7 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // Conaninfo represents infos of a Conan package
diff --git a/modules/packages/conan/reference.go b/modules/packages/conan/reference.go
index 58f268bd482..3fe8f907745 100644
--- a/modules/packages/conan/reference.go
+++ b/modules/packages/conan/reference.go
@@ -8,8 +8,8 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 const (
diff --git a/modules/packages/conda/metadata.go b/modules/packages/conda/metadata.go
index 5eb28901159..dcd873d7395 100644
--- a/modules/packages/conda/metadata.go
+++ b/modules/packages/conda/metadata.go
@@ -10,10 +10,10 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
-	"code.gitea.io/gitea/modules/zstd"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
+	"gitea.dev/modules/zstd"
 )
 
 var (
diff --git a/modules/packages/conda/metadata_test.go b/modules/packages/conda/metadata_test.go
index 035d63d4d88..9f5992554d7 100644
--- a/modules/packages/conda/metadata_test.go
+++ b/modules/packages/conda/metadata_test.go
@@ -10,7 +10,7 @@ import (
 	"io"
 	"testing"
 
-	"code.gitea.io/gitea/modules/zstd"
+	"gitea.dev/modules/zstd"
 
 	"github.com/dsnet/compress/bzip2"
 	"github.com/stretchr/testify/assert"
diff --git a/modules/packages/container/metadata.go b/modules/packages/container/metadata.go
index d8a48120afa..02d7d232774 100644
--- a/modules/packages/container/metadata.go
+++ b/modules/packages/container/metadata.go
@@ -8,9 +8,9 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/packages/container/helm"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/packages/container/helm"
+	"gitea.dev/modules/validation"
 
 	oci "github.com/opencontainers/image-spec/specs-go/v1"
 )
diff --git a/modules/packages/container/metadata_test.go b/modules/packages/container/metadata_test.go
index 2a6389a8f62..7a6d9a2e8dc 100644
--- a/modules/packages/container/metadata_test.go
+++ b/modules/packages/container/metadata_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/packages/container/helm"
+	"gitea.dev/modules/packages/container/helm"
 
 	oci "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/stretchr/testify/assert"
diff --git a/modules/packages/content_store.go b/modules/packages/content_store.go
index 4c61233b5e7..7554c4900e3 100644
--- a/modules/packages/content_store.go
+++ b/modules/packages/content_store.go
@@ -9,9 +9,9 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/util"
 )
 
 // BlobHash256Key is the key to address a blob content
diff --git a/modules/packages/cran/metadata.go b/modules/packages/cran/metadata.go
index 0856565e101..c239bfcad87 100644
--- a/modules/packages/cran/metadata.go
+++ b/modules/packages/cran/metadata.go
@@ -13,7 +13,7 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 const (
diff --git a/modules/packages/debian/metadata.go b/modules/packages/debian/metadata.go
index 1cae46ecb23..ba12424e747 100644
--- a/modules/packages/debian/metadata.go
+++ b/modules/packages/debian/metadata.go
@@ -12,9 +12,9 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
-	"code.gitea.io/gitea/modules/zstd"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
+	"gitea.dev/modules/zstd"
 
 	"github.com/blakesmith/ar"
 	"github.com/ulikunitz/xz"
diff --git a/modules/packages/debian/metadata_test.go b/modules/packages/debian/metadata_test.go
index fedd276614b..9598c6cac8d 100644
--- a/modules/packages/debian/metadata_test.go
+++ b/modules/packages/debian/metadata_test.go
@@ -10,8 +10,8 @@ import (
 	"io"
 	"testing"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/zstd"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/zstd"
 
 	"github.com/blakesmith/ar"
 	"github.com/stretchr/testify/assert"
diff --git a/modules/packages/goproxy/metadata.go b/modules/packages/goproxy/metadata.go
index a67b149f4d3..b19738db56d 100644
--- a/modules/packages/goproxy/metadata.go
+++ b/modules/packages/goproxy/metadata.go
@@ -9,7 +9,7 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 const (
diff --git a/modules/packages/hashed_buffer.go b/modules/packages/hashed_buffer.go
index 0cd657cd44b..9625deb4a98 100644
--- a/modules/packages/hashed_buffer.go
+++ b/modules/packages/hashed_buffer.go
@@ -6,8 +6,8 @@ package packages
 import (
 	"io"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util/filebuffer"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util/filebuffer"
 )
 
 // HashedSizeReader provide methods to read, sum hashes and a Size method
diff --git a/modules/packages/hashed_buffer_test.go b/modules/packages/hashed_buffer_test.go
index 5104c1fb25f..c9fc44f7620 100644
--- a/modules/packages/hashed_buffer_test.go
+++ b/modules/packages/hashed_buffer_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/packages/helm/metadata.go b/modules/packages/helm/metadata.go
index 421fc5e7259..723c3583ff0 100644
--- a/modules/packages/helm/metadata.go
+++ b/modules/packages/helm/metadata.go
@@ -9,11 +9,11 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"github.com/hashicorp/go-version"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 var (
diff --git a/modules/packages/maven/metadata.go b/modules/packages/maven/metadata.go
index a61a62c0862..f0cbae4d42f 100644
--- a/modules/packages/maven/metadata.go
+++ b/modules/packages/maven/metadata.go
@@ -7,8 +7,8 @@ import (
 	"encoding/xml"
 	"io"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"golang.org/x/net/html/charset"
 )
diff --git a/modules/packages/maven/metadata_test.go b/modules/packages/maven/metadata_test.go
index 2cff2908086..735f0de8b4c 100644
--- a/modules/packages/maven/metadata_test.go
+++ b/modules/packages/maven/metadata_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/packages/npm/creator.go b/modules/packages/npm/creator.go
index cc7695726bb..0ed66fbcb00 100644
--- a/modules/packages/npm/creator.go
+++ b/modules/packages/npm/creator.go
@@ -14,9 +14,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"github.com/hashicorp/go-version"
 )
@@ -181,10 +181,11 @@ func (u *User) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-// Repository https://github.com/npm/registry/blob/master/docs/REGISTRY-API.md#version
+// Repository https://docs.npmjs.com/cli/v11/configuring-npm/package-json#repository
 type Repository struct {
-	Type string `json:"type"`
-	URL  string `json:"url"`
+	Type      string `json:"type"`
+	URL       string `json:"url"`
+	Directory string `json:"directory,omitempty"`
 }
 
 // PackageAttachment https://github.com/npm/registry/blob/master/docs/REGISTRY-API.md#package
diff --git a/modules/packages/npm/creator_test.go b/modules/packages/npm/creator_test.go
index 40c50de91f9..a9e42f44227 100644
--- a/modules/packages/npm/creator_test.go
+++ b/modules/packages/npm/creator_test.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -28,8 +28,9 @@ func TestParsePackage(t *testing.T) {
 	data := "H4sIAAAAAAAA/ytITM5OTE/VL4DQelnF+XkMVAYGBgZmJiYK2MRBwNDcSIHB2NTMwNDQzMwAqA7IMDUxA9LUdgg2UFpcklgEdAql5kD8ogCnhwio5lJQUMpLzE1VslJQcihOzi9I1S9JLS7RhSYIJR2QgrLUouLM/DyQGkM9Az1D3YIiqExKanFyUWZBCVQ2BKhVwQVJDKwosbQkI78IJO/tZ+LsbRykxFXLNdA+HwWjYBSMgpENACgAbtAACAAA"
 	integrity := "sha512-yA4FJsVhetynGfOC1jFf79BuS+jrHbm0fhh+aHzCQkOaOBXKf9oBnC4a6DnLLnEsHQDRLYd00cwj8sCXpC+wIg=="
 	repository := Repository{
-		Type: "gitea",
-		URL:  "http://localhost:3000/gitea/test.git",
+		Type:      "gitea",
+		URL:       "http://localhost:3000/gitea/test.git",
+		Directory: "packages/test-package",
 	}
 
 	t.Run("InvalidUpload", func(t *testing.T) {
@@ -298,6 +299,7 @@ func TestParsePackage(t *testing.T) {
 		assert.Equal(t, "1.2.0", p.Metadata.Dependencies["package"])
 		assert.Equal(t, repository.Type, p.Metadata.Repository.Type)
 		assert.Equal(t, repository.URL, p.Metadata.Repository.URL)
+		assert.Equal(t, repository.Directory, p.Metadata.Repository.Directory)
 	})
 
 	t.Run("ValidLicenseMap", func(t *testing.T) {
diff --git a/modules/packages/nuget/metadata.go b/modules/packages/nuget/metadata.go
index ae15e4ec831..b656ade363f 100644
--- a/modules/packages/nuget/metadata.go
+++ b/modules/packages/nuget/metadata.go
@@ -13,8 +13,8 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"github.com/hashicorp/go-version"
 )
diff --git a/modules/packages/nuget/symbol_extractor.go b/modules/packages/nuget/symbol_extractor.go
index 5e398151e8c..47d98b9dd73 100644
--- a/modules/packages/nuget/symbol_extractor.go
+++ b/modules/packages/nuget/symbol_extractor.go
@@ -13,8 +13,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/packages"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/packages"
+	"gitea.dev/modules/util"
 )
 
 var (
diff --git a/modules/packages/nuget/symbol_extractor_test.go b/modules/packages/nuget/symbol_extractor_test.go
index e841e377d98..5b6884e0234 100644
--- a/modules/packages/nuget/symbol_extractor_test.go
+++ b/modules/packages/nuget/symbol_extractor_test.go
@@ -9,7 +9,7 @@ import (
 	"encoding/base64"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/packages/pub/metadata.go b/modules/packages/pub/metadata.go
index a2cf6b728ab..7291836e1fa 100644
--- a/modules/packages/pub/metadata.go
+++ b/modules/packages/pub/metadata.go
@@ -10,11 +10,11 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"github.com/hashicorp/go-version"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 var (
diff --git a/modules/packages/rpm/metadata.go b/modules/packages/rpm/metadata.go
index d8ac7ea75f5..40b1dc90e7d 100644
--- a/modules/packages/rpm/metadata.go
+++ b/modules/packages/rpm/metadata.go
@@ -8,8 +8,8 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/validation"
 
 	"github.com/sassoftware/go-rpmutils"
 )
diff --git a/modules/packages/rubygems/marshal.go b/modules/packages/rubygems/marshal.go
index 1505221acc7..8c3db6052bb 100644
--- a/modules/packages/rubygems/marshal.go
+++ b/modules/packages/rubygems/marshal.go
@@ -9,7 +9,7 @@ import (
 	"io"
 	"reflect"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 const (
@@ -91,7 +91,7 @@ func (e *MarshalEncoder) marshal(v any) error {
 	val := reflect.ValueOf(v)
 	typ := reflect.TypeOf(v)
 
-	if typ.Kind() == reflect.Ptr {
+	if typ.Kind() == reflect.Pointer {
 		val = val.Elem()
 		typ = typ.Elem()
 	}
diff --git a/modules/packages/rubygems/metadata.go b/modules/packages/rubygems/metadata.go
index 5c01abc7435..8a989bbe7f0 100644
--- a/modules/packages/rubygems/metadata.go
+++ b/modules/packages/rubygems/metadata.go
@@ -11,10 +11,10 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 var (
diff --git a/modules/packages/rubygems/metadata_test.go b/modules/packages/rubygems/metadata_test.go
index 9a98c06653b..da75edd04af 100644
--- a/modules/packages/rubygems/metadata_test.go
+++ b/modules/packages/rubygems/metadata_test.go
@@ -6,7 +6,7 @@ package rubygems
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/packages/swift/metadata.go b/modules/packages/swift/metadata.go
index d0137f8dfef..bf79916fcde 100644
--- a/modules/packages/swift/metadata.go
+++ b/modules/packages/swift/metadata.go
@@ -11,9 +11,9 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"github.com/hashicorp/go-version"
 )
diff --git a/modules/packages/swift/metadata_test.go b/modules/packages/swift/metadata_test.go
index 440bcb9fac2..4e5a617d614 100644
--- a/modules/packages/swift/metadata_test.go
+++ b/modules/packages/swift/metadata_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/hashicorp/go-version"
 	"github.com/stretchr/testify/assert"
diff --git a/modules/packages/terraform/lock.go b/modules/packages/terraform/lock.go
index 3c326c04e9b..ed9edad8e2a 100644
--- a/modules/packages/terraform/lock.go
+++ b/modules/packages/terraform/lock.go
@@ -9,10 +9,10 @@ import (
 	"io"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
diff --git a/modules/packages/terraform/state.go b/modules/packages/terraform/state.go
index 57631286991..92d586b90f6 100644
--- a/modules/packages/terraform/state.go
+++ b/modules/packages/terraform/state.go
@@ -6,8 +6,8 @@ package terraform
 import (
 	"io"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
 )
 
 // Note: this is a subset of the Terraform state file format as the full one has two forms.
diff --git a/modules/packages/vagrant/metadata.go b/modules/packages/vagrant/metadata.go
index 6789533339c..a2fda49e012 100644
--- a/modules/packages/vagrant/metadata.go
+++ b/modules/packages/vagrant/metadata.go
@@ -9,8 +9,8 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/validation"
 )
 
 const (
diff --git a/modules/packages/vagrant/metadata_test.go b/modules/packages/vagrant/metadata_test.go
index d616ffe3d3e..ab42c65f9f6 100644
--- a/modules/packages/vagrant/metadata_test.go
+++ b/modules/packages/vagrant/metadata_test.go
@@ -10,7 +10,7 @@ import (
 	"io"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/paginator/paginator.go b/modules/paginator/paginator.go
index 0f64e89d9a8..942bf7117b6 100644
--- a/modules/paginator/paginator.go
+++ b/modules/paginator/paginator.go
@@ -4,7 +4,7 @@
 
 package paginator
 
-import "code.gitea.io/gitea/modules/util"
+import "gitea.dev/modules/util"
 
 /*
 In template:
diff --git a/modules/pprof/pprof.go b/modules/pprof/pprof.go
index c611c14270d..138d33305f6 100644
--- a/modules/pprof/pprof.go
+++ b/modules/pprof/pprof.go
@@ -9,7 +9,7 @@ import (
 	"runtime"
 	"runtime/pprof"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // DumpMemProfileForUsername dumps a memory profile at pprofDataPath as memprofile_<username>_<temporary id>
diff --git a/modules/private/actions.go b/modules/private/actions.go
index e68f2f85b03..b20a90c325c 100644
--- a/modules/private/actions.go
+++ b/modules/private/actions.go
@@ -6,7 +6,7 @@ package private
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 type GenerateTokenRequest struct {
diff --git a/modules/private/hook.go b/modules/private/hook.go
index ce87ccd8019..cb6cc2f0bdf 100644
--- a/modules/private/hook.go
+++ b/modules/private/hook.go
@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"net/url"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
 )
 
 // Git environment variables
diff --git a/modules/private/internal.go b/modules/private/internal.go
index 1fd72a3732f..3d6b4ee4bcc 100644
--- a/modules/private/internal.go
+++ b/modules/private/internal.go
@@ -13,11 +13,11 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/proxyprotocol"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/proxyprotocol"
+	"gitea.dev/modules/setting"
 )
 
 // Response is used for internal request response (for user message and error message)
diff --git a/modules/private/key.go b/modules/private/key.go
index 114683b3439..93ea695bffe 100644
--- a/modules/private/key.go
+++ b/modules/private/key.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // UpdatePublicKeyInRepo update public key and if necessary deploy key updates
diff --git a/modules/private/mail.go b/modules/private/mail.go
index 3904e37beab..5d8d01c28a3 100644
--- a/modules/private/mail.go
+++ b/modules/private/mail.go
@@ -6,7 +6,7 @@ package private
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // Email structure holds a data for sending general emails
diff --git a/modules/private/manager.go b/modules/private/manager.go
index e3d5ad57e06..4fda7505895 100644
--- a/modules/private/manager.go
+++ b/modules/private/manager.go
@@ -12,7 +12,7 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // Shutdown calls the internal shutdown function
diff --git a/modules/private/pushoptions.go b/modules/private/pushoptions.go
index 7616e6b9417..8cf2416c8a3 100644
--- a/modules/private/pushoptions.go
+++ b/modules/private/pushoptions.go
@@ -7,7 +7,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/modules/optional"
 )
 
 // GitPushOptions is a wrapper around a map[string]string
diff --git a/modules/private/request.go b/modules/private/request.go
index 58cd2612393..057940496ac 100644
--- a/modules/private/request.go
+++ b/modules/private/request.go
@@ -8,8 +8,8 @@ import (
 	"io"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
 )
 
 // ResponseText is used to get the response as text, instead of parsing it as JSON.
diff --git a/modules/private/restore_repo.go b/modules/private/restore_repo.go
index 9d65962fcd2..02f9099bb65 100644
--- a/modules/private/restore_repo.go
+++ b/modules/private/restore_repo.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // RestoreParams structure holds a data for restore repository
diff --git a/modules/private/serv.go b/modules/private/serv.go
index b1dafbd81bc..cde255f36a4 100644
--- a/modules/private/serv.go
+++ b/modules/private/serv.go
@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"net/url"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/perm"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/perm"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 )
 
 // KeyAndOwner is the response from ServNoCommand
diff --git a/modules/process/manager.go b/modules/process/manager.go
index c51d6c76f93..74e7c405062 100644
--- a/modules/process/manager.go
+++ b/modules/process/manager.go
@@ -12,8 +12,8 @@ import (
 	"sync/atomic"
 	"time"
 
-	"code.gitea.io/gitea/modules/gtprof"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/gtprof"
+	"gitea.dev/modules/util"
 )
 
 // TODO: This packages still uses a singleton for the Manager.
diff --git a/modules/process/manager_stacktraces.go b/modules/process/manager_stacktraces.go
index d83060f6eec..3911cb994be 100644
--- a/modules/process/manager_stacktraces.go
+++ b/modules/process/manager_stacktraces.go
@@ -10,7 +10,7 @@ import (
 	"sort"
 	"time"
 
-	"code.gitea.io/gitea/modules/gtprof"
+	"gitea.dev/modules/gtprof"
 
 	"github.com/google/pprof/profile"
 )
diff --git a/modules/proxy/proxy.go b/modules/proxy/proxy.go
index f8843316aa9..38e323494d9 100644
--- a/modules/proxy/proxy.go
+++ b/modules/proxy/proxy.go
@@ -10,9 +10,9 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 var (
diff --git a/modules/proxyprotocol/conn.go b/modules/proxyprotocol/conn.go
index f437f13683c..d7aff7b1b06 100644
--- a/modules/proxyprotocol/conn.go
+++ b/modules/proxyprotocol/conn.go
@@ -14,7 +14,7 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 var (
diff --git a/modules/public/manifest.go b/modules/public/manifest.go
index f807244c893..15fa8f16766 100644
--- a/modules/public/manifest.go
+++ b/modules/public/manifest.go
@@ -4,27 +4,31 @@
 package public
 
 import (
+	"html"
+	"html/template"
 	"io"
 	"path"
+	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
+// https://vite.dev/guide/backend-integration
 type manifestEntry struct {
 	File    string   `json:"file"`
 	Name    string   `json:"name"`
-	IsEntry bool     `json:"isEntry"`
 	CSS     []string `json:"css"`
+	Imports []string `json:"imports"`
 }
 
 type manifestDataStruct struct {
-	paths     map[string]string // unhashed path -> hashed path
-	names     map[string]string // hashed path -> entry name
+	entries   map[string]*manifestEntry // source path -> entry
+	names     map[string]string         // content-hashed output file -> entry name
 	modTime   int64
 	checkTime time.Time
 }
@@ -36,35 +40,16 @@ var (
 
 const manifestPath = "assets/.vite/manifest.json"
 
-func parseManifest(data []byte) (map[string]string, map[string]string) {
-	var manifest map[string]manifestEntry
-	if err := json.Unmarshal(data, &manifest); err != nil {
+func parseManifest(data []byte) (entries map[string]*manifestEntry, names map[string]string) {
+	if err := json.Unmarshal(data, &entries); err != nil {
 		log.Error("Failed to parse frontend manifest: %v", err)
 		return nil, nil
 	}
-
-	paths := make(map[string]string)
-	names := make(map[string]string)
-	for _, entry := range manifest {
-		if !entry.IsEntry || entry.Name == "" {
-			continue
-		}
-		// Build unhashed key from file path: "js/index.js", "css/theme-gitea-dark.css"
-		dir := path.Dir(entry.File)
-		ext := path.Ext(entry.File)
-		key := dir + "/" + entry.Name + ext
-		paths[key] = entry.File
+	names = make(map[string]string, len(entries))
+	for _, entry := range entries {
 		names[entry.File] = entry.Name
-		// Map associated CSS files, e.g. "css/index.css" -> "css/index.B3zrQPqD.css"
-		// FIXME: INCORRECT-VITE-MANIFEST-PARSER: the logic is wrong, Vite manifest doesn't work this way
-		// It just happens to be correct for the current modules dependencies
-		for _, css := range entry.CSS {
-			cssKey := path.Dir(css) + "/" + entry.Name + path.Ext(css)
-			paths[cssKey] = css
-			names[css] = entry.Name
-		}
 	}
-	return paths, names
+	return entries, names
 }
 
 func reloadManifest(existingData *manifestDataStruct) *manifestDataStruct {
@@ -102,9 +87,9 @@ func reloadManifest(existingData *manifestDataStruct) *manifestDataStruct {
 }
 
 func storeManifestFromBytes(manifestContent []byte, modTime int64, checkTime time.Time) *manifestDataStruct {
-	paths, names := parseManifest(manifestContent)
+	entries, names := parseManifest(manifestContent)
 	data := &manifestDataStruct{
-		paths:     paths,
+		entries:   entries,
 		names:     names,
 		modTime:   modTime,
 		checkTime: checkTime,
@@ -127,33 +112,66 @@ func getManifestData() *manifestDataStruct {
 	return data
 }
 
-// AssetURI returns the URI for a frontend asset.
-// It may return a relative path or a full URL depending on the StaticURLPrefix setting.
-// In Vite dev mode, known entry points are mapped to their source paths
-// so the reverse proxy serves them from the Vite dev server.
-// In production, it resolves the content-hashed path from the manifest.
-func AssetURI(originPath string) string {
+// devAssetURL returns a source file's Vite dev server URL, panicking in dev/testing if it's absent.
+func devAssetURL(src string) string {
+	if url := viteDevSourceURL(src); url != "" {
+		return url
+	}
+	setting.PanicInDevOrTesting("Failed to locate source file for asset: %s", src)
+	return ""
+}
+
+// AssetURI resolves a frontend asset by its source path (the Vite manifest key, e.g.
+// "web_src/js/index.ts"). Dev mode serves the source file; production resolves the hashed output.
+func AssetURI(srcPath string) string {
 	if IsViteDevMode() {
-		if src := viteDevSourceURL(originPath); src != "" {
-			return src
-		}
-		// it should be caused by incorrect vite config
-		setting.PanicInDevOrTesting("Failed to locate local path for managed asset URI: %s", originPath)
+		return devAssetURL(srcPath)
 	}
+	if entry := getManifestData().entries[srcPath]; entry != nil {
+		return setting.StaticURLPrefix + "/assets/" + entry.File
+	}
+	// The only expected manifest miss is a user's custom theme CSS, served as a static asset
+	// under "/assets/css/". Anything else is a misconfigured or missing entry.
+	if path.Ext(srcPath) == ".css" {
+		return setting.StaticURLPrefix + "/assets/css/" + path.Base(srcPath)
+	}
+	log.Error("asset not found in frontend manifest: %s", srcPath)
+	return setting.StaticURLPrefix + "/assets/" + path.Base(srcPath)
+}
 
-	// Try to resolve an unhashed asset path (origin path) to its content-hashed path from the frontend manifest.
-	// Example: "js/index.js" -> "js/index.C6Z2MRVQ.js"
-	data := getManifestData()
-	assetPath := data.paths[originPath]
-	if assetPath == "" {
-		// it should be caused by either: "incorrect vite config" or "user's custom theme"
-		assetPath = originPath
-		if !setting.IsProd {
-			log.Warn("Failed to find managed asset URI for origin path: %s", originPath)
+// AssetCSSLinks renders the <link> tags for a JS entry's stylesheets: the entry's CSS plus the CSS
+// of every statically-imported chunk. Dev links devStylesheetSrc and lets the JS module inject the rest.
+func AssetCSSLinks(jsEntrySrc, devStylesheetSrc string) template.HTML {
+	var b strings.Builder
+	for _, href := range entryStyleURLs(jsEntrySrc, devStylesheetSrc) {
+		b.WriteString(`<link rel="stylesheet" href="` + html.EscapeString(href) + `">`)
+	}
+	return template.HTML(b.String())
+}
+
+func entryStyleURLs(jsEntrySrc, devStylesheetSrc string) []string {
+	if IsViteDevMode() {
+		return []string{devAssetURL(devStylesheetSrc)}
+	}
+	entries := getManifestData().entries
+	var urls []string
+	seen := make(map[string]bool)
+	var walk func(key string)
+	walk = func(key string) {
+		entry := entries[key]
+		if entry == nil || seen[key] {
+			return
+		}
+		seen[key] = true
+		for _, css := range entry.CSS {
+			urls = append(urls, setting.StaticURLPrefix+"/assets/"+css)
+		}
+		for _, imp := range entry.Imports {
+			walk(imp)
 		}
 	}
-
-	return setting.StaticURLPrefix + "/assets/" + assetPath
+	walk(jsEntrySrc)
+	return urls
 }
 
 // AssetNameFromHashedPath returns the asset entry name for a given hashed asset path.
diff --git a/modules/public/manifest_test.go b/modules/public/manifest_test.go
index acfeaa6dbeb..7d012c07ce9 100644
--- a/modules/public/manifest_test.go
+++ b/modules/public/manifest_test.go
@@ -4,11 +4,12 @@
 package public
 
 import (
+	"html/template"
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -22,59 +23,54 @@ func TestViteManifest(t *testing.T) {
 		"name": "index",
 		"src": "web_src/js/index.ts",
 		"isEntry": true,
-		"css": ["css/index.B3zrQPqD.css"]
+		"imports": ["_shared.AaAaAaAa.js"],
+		"css": ["css/index.B3zrQPqD.css", "css/index-extra.CcCcCcCc.css"]
+	},
+	"_shared.AaAaAaAa.js": {
+		"file": "js/shared.AaAaAaAa.js",
+		"name": "shared",
+		"css": ["css/shared.BbBbBbBb.css"]
 	},
 	"web_src/css/themes/theme-gitea-dark.css": {
 		"file": "css/theme-gitea-dark.CyAaQnn5.css",
 		"name": "theme-gitea-dark",
 		"src": "web_src/css/themes/theme-gitea-dark.css",
 		"isEntry": true
-	},
-	"web_src/js/features/eventsource.sharedworker.ts": {
-		"file": "js/eventsource.sharedworker.Dug1twio.js",
-		"name": "eventsource.sharedworker",
-		"src": "web_src/js/features/eventsource.sharedworker.ts",
-		"isEntry": true
-	},
-	"_chunk.js": {
-		"file": "js/chunk.abc123.js",
-		"name": "chunk"
 	}
 }`
 
 	t.Run("EmptyManifest", func(t *testing.T) {
 		storeManifestFromBytes([]byte(``), 0, time.Now())
-		assert.Equal(t, "/assets/js/index.js", AssetURI("js/index.js"))
-		assert.Equal(t, "/assets/css/theme-gitea-dark.css", AssetURI("css/theme-gitea-dark.css"))
-		assert.Equal(t, "", AssetNameFromHashedPath("css/no-such-file.css"))
+		// not in manifest -> custom theme fallback
+		assert.Equal(t, "/assets/css/theme-gitea-dark.css", AssetURI("web_src/css/themes/theme-gitea-dark.css"))
+		assert.Empty(t, entryStyleURLs("web_src/js/index.ts", "web_src/css/index.css"))
+		assert.Empty(t, AssetNameFromHashedPath("css/no-such-file.css"))
 	})
 
 	t.Run("ParseManifest", func(t *testing.T) {
 		storeManifestFromBytes([]byte(testManifest), 0, time.Now())
-		paths, names := manifestData.Load().paths, manifestData.Load().names
 
-		// JS entries
-		assert.Equal(t, "js/index.C6Z2MRVQ.js", paths["js/index.js"])
-		assert.Equal(t, "js/eventsource.sharedworker.Dug1twio.js", paths["js/eventsource.sharedworker.js"])
+		// assets are addressed by their source path (the manifest key)
+		assert.Equal(t, "/assets/js/index.C6Z2MRVQ.js", AssetURI("web_src/js/index.ts"))
+		assert.Equal(t, "/assets/css/theme-gitea-dark.CyAaQnn5.css", AssetURI("web_src/css/themes/theme-gitea-dark.css"))
 
-		// Associated CSS from JS entries
-		assert.Equal(t, "css/index.B3zrQPqD.css", paths["css/index.css"])
+		// custom theme not in the manifest falls back to the static asset location
+		assert.Equal(t, "/assets/css/theme-custom.css", AssetURI("web_src/css/themes/theme-custom.css"))
 
-		// CSS-only entries
-		assert.Equal(t, "css/theme-gitea-dark.CyAaQnn5.css", paths["css/theme-gitea-dark.css"])
+		// a JS entry's stylesheets: all of the entry's own CSS plus the CSS of statically-imported chunks
+		assert.Equal(t, []string{
+			"/assets/css/index.B3zrQPqD.css",
+			"/assets/css/index-extra.CcCcCcCc.css",
+			"/assets/css/shared.BbBbBbBb.css",
+		}, entryStyleURLs("web_src/js/index.ts", "web_src/css/index.css"))
+		assert.Equal(t, template.HTML(
+			`<link rel="stylesheet" href="/assets/css/index.B3zrQPqD.css">`+
+				`<link rel="stylesheet" href="/assets/css/index-extra.CcCcCcCc.css">`+
+				`<link rel="stylesheet" href="/assets/css/shared.BbBbBbBb.css">`,
+		), AssetCSSLinks("web_src/js/index.ts", "web_src/css/index.css"))
 
-		// Non-entry chunks should not be included
-		assert.Empty(t, paths["js/chunk.js"])
-
-		// Names: hashed path -> entry name
-		assert.Equal(t, "index", names["js/index.C6Z2MRVQ.js"])
-		assert.Equal(t, "index", names["css/index.B3zrQPqD.css"])
-		assert.Equal(t, "theme-gitea-dark", names["css/theme-gitea-dark.CyAaQnn5.css"])
-		assert.Equal(t, "eventsource.sharedworker", names["js/eventsource.sharedworker.Dug1twio.js"])
-
-		// Test Asset related functions
-		assert.Equal(t, "/assets/js/index.C6Z2MRVQ.js", AssetURI("js/index.js"))
-		assert.Equal(t, "/assets/css/theme-gitea-dark.CyAaQnn5.css", AssetURI("css/theme-gitea-dark.css"))
+		// hashed output file -> entry name
 		assert.Equal(t, "theme-gitea-dark", AssetNameFromHashedPath("css/theme-gitea-dark.CyAaQnn5.css"))
+		assert.Empty(t, AssetNameFromHashedPath("css/no-such-file.css"))
 	})
 }
diff --git a/modules/public/public.go b/modules/public/public.go
index bb4721a48d3..c6fb9eb5c2b 100644
--- a/modules/public/public.go
+++ b/modules/public/public.go
@@ -12,12 +12,12 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/assetfs"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/assetfs"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/go-chi/cors"
 )
diff --git a/modules/public/public_bindata.go b/modules/public/public_bindata.go
index 2dcf3e72e4e..165b6e4a6cc 100644
--- a/modules/public/public_bindata.go
+++ b/modules/public/public_bindata.go
@@ -12,7 +12,7 @@ import (
 
 	_ "embed"
 
-	"code.gitea.io/gitea/modules/assetfs"
+	"gitea.dev/modules/assetfs"
 )
 
 //go:embed bindata.dat
diff --git a/modules/public/public_dynamic.go b/modules/public/public_dynamic.go
index a668b17c344..f03b3cd8dd4 100644
--- a/modules/public/public_dynamic.go
+++ b/modules/public/public_dynamic.go
@@ -6,8 +6,8 @@
 package public
 
 import (
-	"code.gitea.io/gitea/modules/assetfs"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/assetfs"
+	"gitea.dev/modules/setting"
 )
 
 func BuiltinAssets() *assetfs.Layer {
diff --git a/modules/public/public_test.go b/modules/public/public_test.go
index 5e4bf5d6711..f2e0bd074d1 100644
--- a/modules/public/public_test.go
+++ b/modules/public/public_test.go
@@ -6,7 +6,7 @@ package public
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/container"
+	"gitea.dev/modules/container"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/public/vitedev.go b/modules/public/vitedev.go
index e6be460599a..b9bb1dbe823 100644
--- a/modules/public/vitedev.go
+++ b/modules/public/vitedev.go
@@ -13,11 +13,11 @@ import (
 	"sync/atomic"
 	"time"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web/routing"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web/routing"
 )
 
 const viteDevPortFile = "public/assets/.vite/dev-port"
@@ -140,31 +140,13 @@ func IsViteDevMode() bool {
 	return isDev
 }
 
-func detectWebSrcPath(webSrcPath string) string {
-	localPath := util.FilePathJoinAbs(setting.StaticRootPath, "web_src", webSrcPath)
-	if _, err := os.Stat(localPath); err == nil {
-		return setting.AppSubURL + "/web_src/" + webSrcPath
+// viteDevSourceURL returns the dev server URL for a source file, or "" if it doesn't exist.
+func viteDevSourceURL(srcPath string) string {
+	localPath := util.FilePathJoinAbs(setting.StaticRootPath, srcPath)
+	if _, err := os.Stat(localPath); err != nil {
+		return ""
 	}
-	return ""
-}
-
-func viteDevSourceURL(name string) string {
-	if strings.HasPrefix(name, "css/theme-") {
-		// Only redirect built-in themes to Vite source; custom themes are served from custom/public/assets/css/
-		themeFilePath := "css/themes/" + strings.TrimPrefix(name, "css/")
-		if srcPath := detectWebSrcPath(themeFilePath); srcPath != "" {
-			return srcPath
-		}
-	}
-	// try to map ".js" files to ".ts" files
-	pathPrefix, ok := strings.CutSuffix(name, ".js")
-	if ok {
-		if srcPath := detectWebSrcPath(pathPrefix + ".ts"); srcPath != "" {
-			return srcPath
-		}
-	}
-	// for all others that the names match
-	return detectWebSrcPath(name)
+	return setting.AppSubURL + "/" + srcPath
 }
 
 // isViteDevRequest returns true if the request should be proxied to the Vite dev server.
@@ -192,12 +174,13 @@ func isViteDevRequest(req *http.Request) bool {
 
 	// Vite uses a path relative to project root and adds "?import" to non-JS/CSS asset imports:
 	// - {WebSite}/public/assets/... (e.g. SVG icons from "{RepoRoot}/public/assets/img/svg/")
-	// - {WebSite}/assets/emoji.json: it is an exception for the frontend assets, it is imported by JS code, but:
+	// - {WebSite}/assets/<file>.json: exception for frontend-imported repo-root assets:
 	//   - KEEP IN MIND: all static frontend assets are served from "{AssetFS}/assets" to "{WebSite}/assets" by Gitea Web Server
 	//   - "{AssetFS}" is a layered filesystem from "{RepoRoot}/public" or embedded assets, and user's custom files in "{CustomPath}/public"
-	//   - "{RepoRoot}/assets/emoji.json" just happens to have the dir name "assets", it is not related to frontend assets
+	//   - "{RepoRoot}/assets/*.json" just happens to live under the dir name "assets"; it is not related to frontend assets
 	//   - BAD DESIGN: indeed it is a "conflicted and polluted name" sample
-	if path == "/assets/emoji.json" {
+	switch path {
+	case "/assets/emoji.json", "/assets/codemirror-languages.json":
 		return true
 	}
 	return false
diff --git a/modules/queue/base_channel.go b/modules/queue/base_channel.go
index dd8ccb15f44..e44293f9b9e 100644
--- a/modules/queue/base_channel.go
+++ b/modules/queue/base_channel.go
@@ -9,7 +9,7 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/container"
+	"gitea.dev/modules/container"
 )
 
 var errChannelClosed = errors.New("channel is closed")
diff --git a/modules/queue/base_levelqueue.go b/modules/queue/base_levelqueue.go
index efc57c9c9c8..72295ce3a0f 100644
--- a/modules/queue/base_levelqueue.go
+++ b/modules/queue/base_levelqueue.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/modules/nosql"
-	"code.gitea.io/gitea/modules/queue/lqinternal"
+	"gitea.dev/modules/nosql"
+	"gitea.dev/modules/queue/lqinternal"
 
 	"gitea.com/lunny/levelqueue"
 	"github.com/syndtr/goleveldb/leveldb"
diff --git a/modules/queue/base_levelqueue_common.go b/modules/queue/base_levelqueue_common.go
index d37093b84dc..5ac899cc189 100644
--- a/modules/queue/base_levelqueue_common.go
+++ b/modules/queue/base_levelqueue_common.go
@@ -11,7 +11,7 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/nosql"
+	"gitea.dev/modules/nosql"
 
 	"gitea.com/lunny/levelqueue"
 	"github.com/syndtr/goleveldb/leveldb"
diff --git a/modules/queue/base_levelqueue_test.go b/modules/queue/base_levelqueue_test.go
index 05d82085606..afcb5f67902 100644
--- a/modules/queue/base_levelqueue_test.go
+++ b/modules/queue/base_levelqueue_test.go
@@ -6,8 +6,8 @@ package queue
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/queue/lqinternal"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/queue/lqinternal"
+	"gitea.dev/modules/setting"
 
 	"gitea.com/lunny/levelqueue"
 	"github.com/stretchr/testify/assert"
diff --git a/modules/queue/base_levelqueue_unique.go b/modules/queue/base_levelqueue_unique.go
index 968a4e98d46..23c76bc5aed 100644
--- a/modules/queue/base_levelqueue_unique.go
+++ b/modules/queue/base_levelqueue_unique.go
@@ -8,8 +8,8 @@ import (
 	"sync"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/modules/nosql"
-	"code.gitea.io/gitea/modules/queue/lqinternal"
+	"gitea.dev/modules/nosql"
+	"gitea.dev/modules/queue/lqinternal"
 
 	"gitea.com/lunny/levelqueue"
 	"github.com/syndtr/goleveldb/leveldb"
diff --git a/modules/queue/base_redis.go b/modules/queue/base_redis.go
index bea0fd7a985..f9e1bf45801 100644
--- a/modules/queue/base_redis.go
+++ b/modules/queue/base_redis.go
@@ -8,9 +8,9 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/nosql"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/nosql"
 
 	"github.com/redis/go-redis/v9"
 )
diff --git a/modules/queue/base_redis_test.go b/modules/queue/base_redis_test.go
index 6478988d7fd..b03702d951e 100644
--- a/modules/queue/base_redis_test.go
+++ b/modules/queue/base_redis_test.go
@@ -10,8 +10,9 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/nosql"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/nosql"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -57,10 +58,10 @@ func TestBaseRedis(t *testing.T) {
 	}()
 	if !waitRedisReady("redis://127.0.0.1:6379/0", 0) {
 		redisServer = redisServerCmd(t)
-		if redisServer == nil && os.Getenv("CI") == "" {
-			t.Skip("redis-server not found")
-			return
+		if redisServer == nil && test.AllowSkipExternalService() {
+			t.Skip("redis server command not found, skipped")
 		}
+		require.NotNil(t, redisServer)
 		assert.NoError(t, redisServer.Start())
 		require.True(t, waitRedisReady("redis://127.0.0.1:6379/0", 5*time.Second), "start redis-server")
 	}
diff --git a/modules/queue/config.go b/modules/queue/config.go
index c5bc16b6f08..f05cb453d06 100644
--- a/modules/queue/config.go
+++ b/modules/queue/config.go
@@ -4,7 +4,7 @@
 package queue
 
 import (
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 type BaseConfig struct {
diff --git a/modules/queue/manager.go b/modules/queue/manager.go
index ae6c51872dd..58187217f80 100644
--- a/modules/queue/manager.go
+++ b/modules/queue/manager.go
@@ -10,8 +10,8 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 // Manager is a manager for the queues created by "CreateXxxQueue" functions, these queues are called "managed queues".
diff --git a/modules/queue/manager_test.go b/modules/queue/manager_test.go
index f9f9b7310be..b2a60ff070d 100644
--- a/modules/queue/manager_test.go
+++ b/modules/queue/manager_test.go
@@ -7,7 +7,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/queue/queue.go b/modules/queue/queue.go
index 56835014a5a..08de046ffbb 100644
--- a/modules/queue/queue.go
+++ b/modules/queue/queue.go
@@ -61,7 +61,7 @@
 //	 func handler(items ...*mypkg.QueueItem) []*mypkg.QueueItem { ... }
 package queue
 
-import "code.gitea.io/gitea/modules/util"
+import "gitea.dev/modules/util"
 
 type HandlerFuncT[T any] func(...T) (unhandled []T)
 
diff --git a/modules/queue/workergroup.go b/modules/queue/workergroup.go
index c7e33497c64..f8f55330150 100644
--- a/modules/queue/workergroup.go
+++ b/modules/queue/workergroup.go
@@ -10,7 +10,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 var (
diff --git a/modules/queue/workerqueue.go b/modules/queue/workerqueue.go
index d8b0722caf7..4e1d4c76e1e 100644
--- a/modules/queue/workerqueue.go
+++ b/modules/queue/workerqueue.go
@@ -11,10 +11,10 @@ import (
 	"sync/atomic"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
 )
 
 // WorkerPoolQueue is a queue that uses a pool of workers to process items
diff --git a/modules/queue/workerqueue_test.go b/modules/queue/workerqueue_test.go
index a6c369d5f9b..5cadabdeac6 100644
--- a/modules/queue/workerqueue_test.go
+++ b/modules/queue/workerqueue_test.go
@@ -11,8 +11,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/recaptcha/recaptcha.go b/modules/recaptcha/recaptcha.go
index 224fa38eeeb..3083c9830ef 100644
--- a/modules/recaptcha/recaptcha.go
+++ b/modules/recaptcha/recaptcha.go
@@ -11,8 +11,8 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
 )
 
 // Response is the structure of JSON returned from API
diff --git a/modules/references/references.go b/modules/references/references.go
index ef3568ebea0..67a77f171aa 100644
--- a/modules/references/references.go
+++ b/modules/references/references.go
@@ -11,10 +11,10 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup/mdstripper"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup/mdstripper"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 var (
diff --git a/modules/references/references_test.go b/modules/references/references_test.go
index 5922a9f5a94..222b93d4092 100644
--- a/modules/references/references_test.go
+++ b/modules/references/references_test.go
@@ -7,7 +7,7 @@ import (
 	"regexp"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/regexplru/regexplru.go b/modules/regexplru/regexplru.go
index 8f66dcf3f73..c4b535a749f 100644
--- a/modules/regexplru/regexplru.go
+++ b/modules/regexplru/regexplru.go
@@ -6,7 +6,7 @@ package regexplru
 import (
 	"regexp"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	lru "github.com/hashicorp/golang-lru/v2"
 )
diff --git a/modules/repository/branch.go b/modules/repository/branch.go
index 0a8f7cc464d..e91eec7167c 100644
--- a/modules/repository/branch.go
+++ b/modules/repository/branch.go
@@ -7,14 +7,14 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
 )
 
 // SyncResult describes a reference update detected during sync.
@@ -97,7 +97,7 @@ func SyncRepoBranchesWithRepo(ctx context.Context, repo *repo_model.Repository,
 				RepoID:        repo.ID,
 				Name:          branch,
 				CommitID:      commit.ID.String(),
-				CommitMessage: commit.Summary(),
+				CommitMessage: commit.MessageTitle(),
 				PusherID:      doerID,
 				CommitTime:    timeutil.TimeStamp(commit.Committer.When.Unix()),
 			})
@@ -112,7 +112,7 @@ func SyncRepoBranchesWithRepo(ctx context.Context, repo *repo_model.Repository,
 				RepoID:        repo.ID,
 				Name:          branch,
 				CommitID:      commit.ID.String(),
-				CommitMessage: commit.Summary(),
+				CommitMessage: commit.MessageTitle(),
 				PusherID:      doerID,
 				CommitTime:    timeutil.TimeStamp(commit.Committer.When.Unix()),
 			})
diff --git a/modules/repository/branch_test.go b/modules/repository/branch_test.go
index 262a35fbf7d..e8f9bad463d 100644
--- a/modules/repository/branch_test.go
+++ b/modules/repository/branch_test.go
@@ -6,10 +6,10 @@ package repository
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/repository/commits.go b/modules/repository/commits.go
index a3e253e998e..d40af3d82c4 100644
--- a/modules/repository/commits.go
+++ b/modules/repository/commits.go
@@ -9,16 +9,16 @@ import (
 	"net/url"
 	"time"
 
-	"code.gitea.io/gitea/models/avatars"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/cachegroup"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models/avatars"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/cachegroup"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
 )
 
 // PushCommit represents a commit in a push operation.
@@ -152,7 +152,7 @@ func (pc *PushCommits) AvatarLink(ctx context.Context, email string) string {
 func CommitToPushCommit(commit *git.Commit) *PushCommit {
 	return &PushCommit{
 		Sha1:           commit.ID.String(),
-		Message:        commit.Message(),
+		Message:        commit.MessageUTF8(),
 		AuthorEmail:    commit.Author.Email,
 		AuthorName:     commit.Author.Name,
 		CommitterEmail: commit.Committer.Email,
diff --git a/modules/repository/commits_test.go b/modules/repository/commits_test.go
index 04c07118283..c0f00337b92 100644
--- a/modules/repository/commits_test.go
+++ b/modules/repository/commits_test.go
@@ -8,10 +8,10 @@ import (
 	"testing"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -145,7 +145,7 @@ func TestCommitToPushCommit(t *testing.T) {
 		ID:            sha1,
 		Author:        sig,
 		Committer:     sig,
-		CommitMessage: "Commit Message",
+		CommitMessage: git.CommitMessage{MessageRaw: "Commit Message"},
 	})
 	assert.Equal(t, hexString, pushCommit.Sha1)
 	assert.Equal(t, "Commit Message", pushCommit.Message)
@@ -176,13 +176,13 @@ func TestListToPushCommits(t *testing.T) {
 			ID:            hash1,
 			Author:        sig,
 			Committer:     sig,
-			CommitMessage: "Message1",
+			CommitMessage: git.CommitMessage{MessageRaw: "Message1"},
 		},
 		{
 			ID:            hash2,
 			Author:        sig,
 			Committer:     sig,
-			CommitMessage: "Message2",
+			CommitMessage: git.CommitMessage{MessageRaw: "Message2"},
 		},
 	}
 
diff --git a/modules/repository/create.go b/modules/repository/create.go
index f5fb92df407..3076f8c4a03 100644
--- a/modules/repository/create.go
+++ b/modules/repository/create.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"fmt"
 
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/gitrepo"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/gitrepo"
 )
 
 // UpdateRepoSize updates the repository size, calculating it using getDirectorySize
diff --git a/modules/repository/create_test.go b/modules/repository/create_test.go
index a3fca02c251..45de0a0983d 100644
--- a/modules/repository/create_test.go
+++ b/modules/repository/create_test.go
@@ -6,9 +6,9 @@ package repository
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/gitrepo"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/gitrepo"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/repository/delete.go b/modules/repository/delete.go
index 04af98beefe..68ec4f0d62b 100644
--- a/modules/repository/delete.go
+++ b/modules/repository/delete.go
@@ -6,9 +6,9 @@ package repository
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
 )
 
 // CanUserDelete returns true if user could delete the repository
diff --git a/modules/repository/env.go b/modules/repository/env.go
index ed2c6fef81a..5eecb54e07b 100644
--- a/modules/repository/env.go
+++ b/modules/repository/env.go
@@ -8,10 +8,10 @@ import (
 	"strconv"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // env keys for git hooks need
diff --git a/modules/repository/fork.go b/modules/repository/fork.go
index 84ed4b23d67..4acdfea6774 100644
--- a/modules/repository/fork.go
+++ b/modules/repository/fork.go
@@ -6,10 +6,10 @@ package repository
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 )
 
 // CanUserForkBetweenOwners returns true if user can fork between owners.
diff --git a/modules/repository/fork_test.go b/modules/repository/fork_test.go
index f8c76d942d1..f9d5cf6f9a6 100644
--- a/modules/repository/fork_test.go
+++ b/modules/repository/fork_test.go
@@ -6,8 +6,8 @@ package repository
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/repository/init.go b/modules/repository/init.go
index 12e9606c740..9313f637710 100644
--- a/modules/repository/init.go
+++ b/modules/repository/init.go
@@ -10,11 +10,11 @@ import (
 	"sort"
 	"strings"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/label"
-	"code.gitea.io/gitea/modules/options"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/label"
+	"gitea.dev/modules/options"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 type OptionFile struct {
diff --git a/modules/repository/license.go b/modules/repository/license.go
index 9da3af84f85..20eab3259e7 100644
--- a/modules/repository/license.go
+++ b/modules/repository/license.go
@@ -10,7 +10,7 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/options"
+	"gitea.dev/modules/options"
 )
 
 type LicenseValues struct {
diff --git a/modules/repository/main_test.go b/modules/repository/main_test.go
index 799e8c17c3d..aeb415c076c 100644
--- a/modules/repository/main_test.go
+++ b/modules/repository/main_test.go
@@ -6,10 +6,10 @@ package repository
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
 )
 
 func TestMain(m *testing.M) {
diff --git a/modules/repository/push.go b/modules/repository/push.go
index cf047847b6c..433bbee40ae 100644
--- a/modules/repository/push.go
+++ b/modules/repository/push.go
@@ -4,7 +4,7 @@
 package repository
 
 import (
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 )
 
 // PushUpdateOptions defines the push update options
diff --git a/modules/repository/repo.go b/modules/repository/repo.go
index 76125f5e610..aa2a65c1549 100644
--- a/modules/repository/repo.go
+++ b/modules/repository/repo.go
@@ -10,15 +10,15 @@ import (
 	"io"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 )
 
 /*
diff --git a/modules/repository/repo_test.go b/modules/repository/repo_test.go
index f79a79ccbdf..40d1b4edfb5 100644
--- a/modules/repository/repo_test.go
+++ b/modules/repository/repo_test.go
@@ -6,7 +6,7 @@ package repository
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/repository/temp.go b/modules/repository/temp.go
index d7253d9e021..34c9fbb924c 100644
--- a/modules/repository/temp.go
+++ b/modules/repository/temp.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 // CreateTemporaryPath creates a temporary path
diff --git a/modules/reqctx/datastore.go b/modules/reqctx/datastore.go
index 1d4bee613f8..97277af1d5c 100644
--- a/modules/reqctx/datastore.go
+++ b/modules/reqctx/datastore.go
@@ -9,7 +9,7 @@ import (
 	"maps"
 	"sync"
 
-	"code.gitea.io/gitea/modules/process"
+	"gitea.dev/modules/process"
 )
 
 type ContextDataProvider interface {
diff --git a/modules/session/db.go b/modules/session/db.go
index 577e20a45ed..748c7ec6f78 100644
--- a/modules/session/db.go
+++ b/modules/session/db.go
@@ -9,8 +9,8 @@ import (
 	"log"
 	"sync"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/auth"
+	"gitea.dev/modules/timeutil"
 
 	"gitea.com/go-chi/session"
 )
diff --git a/modules/session/redis.go b/modules/session/redis.go
index f5cac8e636c..e04debb5882 100644
--- a/modules/session/redis.go
+++ b/modules/session/redis.go
@@ -10,8 +10,8 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/nosql"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/nosql"
 
 	"gitea.com/go-chi/session"
 	"github.com/redis/go-redis/v9"
diff --git a/modules/session/store.go b/modules/session/store.go
index 0217ed97aca..29c24e27330 100644
--- a/modules/session/store.go
+++ b/modules/session/store.go
@@ -6,7 +6,7 @@ package session
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"gitea.com/go-chi/session"
 )
diff --git a/modules/session/virtual.go b/modules/session/virtual.go
index 597b9e55c15..c51c5fe7881 100644
--- a/modules/session/virtual.go
+++ b/modules/session/virtual.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"sync"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"gitea.com/go-chi/session"
 	couchbase "gitea.com/go-chi/session/couchbase"
diff --git a/modules/setting/actions.go b/modules/setting/actions.go
index 0d1bdadc8ec..d8e229267c7 100644
--- a/modules/setting/actions.go
+++ b/modules/setting/actions.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 const defaultMaxRerunAttempts = 50
diff --git a/modules/setting/admin.go b/modules/setting/admin.go
index 782c73f0cc5..fa03c39238b 100644
--- a/modules/setting/admin.go
+++ b/modules/setting/admin.go
@@ -4,8 +4,8 @@
 package setting
 
 import (
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
 )
 
 // Admin settings
diff --git a/modules/setting/api.go b/modules/setting/api.go
index cdad474cb9f..05f0a485efa 100644
--- a/modules/setting/api.go
+++ b/modules/setting/api.go
@@ -7,7 +7,7 @@ import (
 	"net/url"
 	"path"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // API settings
diff --git a/modules/setting/cache.go b/modules/setting/cache.go
index bfa6ca0e616..c8ba04d9dfc 100644
--- a/modules/setting/cache.go
+++ b/modules/setting/cache.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // Cache represents cache settings
diff --git a/modules/setting/camo.go b/modules/setting/camo.go
index 608ecf8363c..64bcc14e462 100644
--- a/modules/setting/camo.go
+++ b/modules/setting/camo.go
@@ -6,7 +6,7 @@ package setting
 import (
 	"strconv"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 var Camo = struct {
diff --git a/modules/setting/config.go b/modules/setting/config.go
index a41734a843c..afc2eb1b7ff 100644
--- a/modules/setting/config.go
+++ b/modules/setting/config.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting/config"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting/config"
 )
 
 type PictureStruct struct {
diff --git a/modules/setting/config/value.go b/modules/setting/config/value.go
index c01f41303c6..655120c1804 100644
--- a/modules/setting/config/value.go
+++ b/modules/setting/config/value.go
@@ -8,9 +8,9 @@ import (
 	"reflect"
 	"sync"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 type CfgSecKey struct {
diff --git a/modules/setting/config_env.go b/modules/setting/config_env.go
index e956e344398..d2f138a892b 100644
--- a/modules/setting/config_env.go
+++ b/modules/setting/config_env.go
@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 const (
diff --git a/modules/setting/config_option_instance.go b/modules/setting/config_option_instance.go
index 6d97055a75e..70e27be552e 100644
--- a/modules/setting/config_option_instance.go
+++ b/modules/setting/config_option_instance.go
@@ -6,7 +6,7 @@ package setting
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/setting/config"
+	"gitea.dev/modules/setting/config"
 )
 
 // WebBannerType fields are directly used in templates,
diff --git a/modules/setting/config_provider.go b/modules/setting/config_provider.go
index a734f3bf8f5..4518819a6ab 100644
--- a/modules/setting/config_provider.go
+++ b/modules/setting/config_provider.go
@@ -12,8 +12,8 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 
 	"gopkg.in/ini.v1" //nolint:depguard // wrapper for this package
 )
diff --git a/modules/setting/database.go b/modules/setting/database.go
index 2b069a62922..639f54f7343 100644
--- a/modules/setting/database.go
+++ b/modules/setting/database.go
@@ -8,11 +8,13 @@ import (
 	"time"
 )
 
+const DefaultSQLiteBusyTimeout = 20 * 1000
+
 var (
-	// SupportedDatabaseTypes includes all XORM supported databases type, sqlite3 maybe added by `database_sqlite3.go`
+	// SupportedDatabaseTypes includes all XORM supported databases type, sqlite3 maybe added by the tag-controlled drivers
 	SupportedDatabaseTypes = []string{"mysql", "postgres", "mssql"}
 	// DatabaseTypeNames contains the friendly names for all database types
-	DatabaseTypeNames = map[string]string{"mysql": "MySQL", "postgres": "PostgreSQL", "mssql": "MSSQL", "sqlite3": "SQLite3"}
+	DatabaseTypeNames = map[string]string{"mysql": "MySQL", "postgres": "PostgreSQL", "mssql": "MSSQL", DatabaseTypeSQLite3: "SQLite3"}
 
 	// Database holds the database settings
 	Database = struct {
@@ -39,8 +41,8 @@ var (
 		AutoMigration      bool
 		SlowQueryThreshold time.Duration
 	}{
-		SQLiteBusyTimeout: 500,
-		IterateBufferSize: 50,
+		IterateBufferSize:  50,
+		SlowQueryThreshold: 5 * time.Second,
 	}
 )
 
@@ -63,7 +65,13 @@ func loadDBSetting(rootCfg ConfigProvider) {
 	Database.CharsetCollation = sec.Key("CHARSET_COLLATION").String()
 
 	Database.Path = sec.Key("PATH").MustString(filepath.Join(AppDataPath, "gitea.db"))
-	Database.SQLiteBusyTimeout = sec.Key("SQLITE_TIMEOUT").MustInt(500)
+
+	Database.SQLiteBusyTimeout = sec.Key("SQLITE_TIMEOUT").MustInt(DefaultSQLiteBusyTimeout)
+	// mattn driver isn't really affected by this timeout, but other drivers are affected
+	// the default value was 500 (0.5s), to avoid breaking existing users, make sure the timeout is long enough (at least, 5 seconds)
+	if Database.SQLiteBusyTimeout < 5000 {
+		Database.SQLiteBusyTimeout = DefaultSQLiteBusyTimeout
+	}
 	Database.SQLiteJournalMode = sec.Key("SQLITE_JOURNAL_MODE").MustString("")
 
 	Database.MaxIdleConns = sec.Key("MAX_IDLE_CONNS").MustInt(2)
@@ -79,14 +87,16 @@ func loadDBSetting(rootCfg ConfigProvider) {
 	Database.DBConnectRetries = sec.Key("DB_RETRIES").MustInt(10)
 	Database.DBConnectBackoff = sec.Key("DB_RETRY_BACKOFF").MustDuration(3 * time.Second)
 	Database.AutoMigration = sec.Key("AUTO_MIGRATION").MustBool(true)
-	Database.SlowQueryThreshold = sec.Key("SLOW_QUERY_THRESHOLD").MustDuration(5 * time.Second)
+	Database.SlowQueryThreshold = sec.Key("SLOW_QUERY_THRESHOLD").MustDuration(Database.SlowQueryThreshold)
 }
 
 // DatabaseType FIXME: it is also used directly with "schemas.DBType", so the names must be consistent
 type DatabaseType string
 
+const DatabaseTypeSQLite3 = "sqlite3"
+
 func (t DatabaseType) IsSQLite3() bool {
-	return t == "sqlite3"
+	return t == DatabaseTypeSQLite3
 }
 
 func (t DatabaseType) IsMySQL() bool {
diff --git a/modules/setting/federation.go b/modules/setting/federation.go
index 62aeaa01b49..6d1bef62ab7 100644
--- a/modules/setting/federation.go
+++ b/modules/setting/federation.go
@@ -4,7 +4,7 @@
 package setting
 
 import (
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"github.com/42wim/httpsig"
 )
diff --git a/modules/setting/git.go b/modules/setting/git.go
index 29fd3daf8a3..744a8af6a99 100644
--- a/modules/setting/git.go
+++ b/modules/setting/git.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // Git settings
diff --git a/modules/setting/git_test.go b/modules/setting/git_test.go
index 0d7f634abfa..a43e8181c36 100644
--- a/modules/setting/git_test.go
+++ b/modules/setting/git_test.go
@@ -6,7 +6,7 @@ package setting
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/setting/gloabl_lock.go b/modules/setting/gloabl_lock.go
index a7802a9df1f..c4913e0fac9 100644
--- a/modules/setting/gloabl_lock.go
+++ b/modules/setting/gloabl_lock.go
@@ -4,8 +4,8 @@
 package setting
 
 import (
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/nosql"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/nosql"
 )
 
 // GlobalLock represents configuration of global lock
diff --git a/modules/setting/glob.go b/modules/setting/glob.go
index cc76a020771..765014fa3b7 100644
--- a/modules/setting/glob.go
+++ b/modules/setting/glob.go
@@ -3,7 +3,7 @@
 
 package setting
 
-import "code.gitea.io/gitea/modules/glob"
+import "gitea.dev/modules/glob"
 
 type GlobMatcher struct {
 	compiledGlob  glob.Glob
diff --git a/modules/setting/incoming_email.go b/modules/setting/incoming_email.go
index 4e433dde60e..78c9bb2bd7f 100644
--- a/modules/setting/incoming_email.go
+++ b/modules/setting/incoming_email.go
@@ -9,13 +9,14 @@ import (
 	"net/mail"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
+const IncomingEmailTokenPlaceholder = "%{token}"
+
 var IncomingEmail = struct {
 	Enabled              bool
 	ReplyToAddress       string
-	TokenPlaceholder     string `ini:"-"`
 	Host                 string
 	Port                 int
 	UseTLS               bool `ini:"USE_TLS"`
@@ -28,7 +29,6 @@ var IncomingEmail = struct {
 }{
 	Mailbox:              "INBOX",
 	DeleteHandledMessage: true,
-	TokenPlaceholder:     "%{token}",
 	MaximumMessageSize:   10485760,
 }
 
@@ -54,19 +54,10 @@ func checkReplyToAddress() error {
 		return errors.New("name must not be set")
 	}
 
-	c := strings.Count(IncomingEmail.ReplyToAddress, IncomingEmail.TokenPlaceholder)
-	switch c {
-	case 0:
-		return fmt.Errorf("%s must appear in the user part of the address (before the @)", IncomingEmail.TokenPlaceholder)
-	case 1:
-	default:
-		return fmt.Errorf("%s must appear only once", IncomingEmail.TokenPlaceholder)
+	placeholderCount := strings.Count(IncomingEmail.ReplyToAddress, IncomingEmailTokenPlaceholder)
+	userPart, _, _ := strings.Cut(IncomingEmail.ReplyToAddress, "@")
+	if placeholderCount != 1 || !strings.Contains(userPart, IncomingEmailTokenPlaceholder) {
+		return fmt.Errorf("%s must appear in the user part of the address (before the @)", IncomingEmailTokenPlaceholder)
 	}
-
-	parts := strings.Split(IncomingEmail.ReplyToAddress, "@")
-	if !strings.Contains(parts[0], IncomingEmail.TokenPlaceholder) {
-		return fmt.Errorf("%s must appear in the user part of the address (before the @)", IncomingEmail.TokenPlaceholder)
-	}
-
 	return nil
 }
diff --git a/modules/setting/indexer.go b/modules/setting/indexer.go
index ace7eec70eb..cfcee97fda9 100644
--- a/modules/setting/indexer.go
+++ b/modules/setting/indexer.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // Indexer settings
diff --git a/modules/setting/lfs.go b/modules/setting/lfs.go
index 3ec21860ae6..eae0a7242f2 100644
--- a/modules/setting/lfs.go
+++ b/modules/setting/lfs.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/modules/generate"
+	"gitea.dev/modules/generate"
 )
 
 // LFS represents the server-side configuration for Git LFS.
diff --git a/modules/setting/log.go b/modules/setting/log.go
index 764c2a82f4f..e53cfb49bb9 100644
--- a/modules/setting/log.go
+++ b/modules/setting/log.go
@@ -10,8 +10,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 type LogGlobalConfig struct {
diff --git a/modules/setting/log_test.go b/modules/setting/log_test.go
index 87b14f0b1d8..a217cf5490c 100644
--- a/modules/setting/log_test.go
+++ b/modules/setting/log_test.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/setting/mailer.go b/modules/setting/mailer.go
index e79ff304474..0fa259225a9 100644
--- a/modules/setting/mailer.go
+++ b/modules/setting/mailer.go
@@ -11,7 +11,7 @@ import (
 	"text/template"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"github.com/kballard/go-shellquote"
 )
diff --git a/modules/setting/mailer_test.go b/modules/setting/mailer_test.go
index 7e1c988568c..7bb1134dcdf 100644
--- a/modules/setting/mailer_test.go
+++ b/modules/setting/mailer_test.go
@@ -6,7 +6,7 @@ package setting
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/setting/markup.go b/modules/setting/markup.go
index 921af60ff59..5562e01ecef 100644
--- a/modules/setting/markup.go
+++ b/modules/setting/markup.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 // ExternalMarkupRenderers represents the external markup renderers
diff --git a/modules/setting/mirror.go b/modules/setting/mirror.go
index 300711789db..6b2687088d5 100644
--- a/modules/setting/mirror.go
+++ b/modules/setting/mirror.go
@@ -6,7 +6,7 @@ package setting
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // Mirror settings
diff --git a/modules/setting/oauth2.go b/modules/setting/oauth2.go
index 83891387a77..0c2db10edf7 100644
--- a/modules/setting/oauth2.go
+++ b/modules/setting/oauth2.go
@@ -8,8 +8,8 @@ import (
 	"path/filepath"
 	"sync/atomic"
 
-	"code.gitea.io/gitea/modules/generate"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/generate"
+	"gitea.dev/modules/log"
 )
 
 // OAuth2UsernameType is enum describing the way gitea generates its 'username' from oauth2 data
diff --git a/modules/setting/oauth2_test.go b/modules/setting/oauth2_test.go
index c6e66cad02d..a2235c6fc8a 100644
--- a/modules/setting/oauth2_test.go
+++ b/modules/setting/oauth2_test.go
@@ -7,8 +7,8 @@ import (
 	"os"
 	"testing"
 
-	"code.gitea.io/gitea/modules/generate"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/generate"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/setting/other.go b/modules/setting/other.go
index 4ba494765b2..ef632ecf20f 100644
--- a/modules/setting/other.go
+++ b/modules/setting/other.go
@@ -3,7 +3,7 @@
 
 package setting
 
-import "code.gitea.io/gitea/modules/log"
+import "gitea.dev/modules/log"
 
 type OtherConfig struct {
 	ShowFooterVersion          bool
diff --git a/modules/setting/path.go b/modules/setting/path.go
index 45c6759a73e..773be5e9168 100644
--- a/modules/setting/path.go
+++ b/modules/setting/path.go
@@ -10,8 +10,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/tempdir"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/tempdir"
 )
 
 var (
diff --git a/modules/setting/proxy.go b/modules/setting/proxy.go
index 4ff420d0900..9b17dc50ca8 100644
--- a/modules/setting/proxy.go
+++ b/modules/setting/proxy.go
@@ -6,7 +6,7 @@ package setting
 import (
 	"net/url"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // Proxy settings
diff --git a/modules/setting/queue.go b/modules/setting/queue.go
index 251a6c1e305..85012e17841 100644
--- a/modules/setting/queue.go
+++ b/modules/setting/queue.go
@@ -7,8 +7,8 @@ import (
 	"path/filepath"
 	"runtime"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
 )
 
 // QueueSettings represent the settings for a queue from the ini
diff --git a/modules/setting/repository.go b/modules/setting/repository.go
index a8bc91c0895..d1000c5280f 100644
--- a/modules/setting/repository.go
+++ b/modules/setting/repository.go
@@ -8,7 +8,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // enumerates all the policy repository creating
@@ -37,6 +37,8 @@ var (
 		DefaultPrivate                          string
 		DefaultPushCreatePrivate                bool
 		MaxCreationLimit                        int
+		UserMaxCreationLimit                    int
+		OrgMaxCreationLimit                     int
 		PreferredLicenses                       []string
 		DisableHTTPGit                          bool
 		AccessControlAllowOrigin                string
@@ -165,6 +167,8 @@ var (
 		DefaultPrivate:                          RepoCreatingLastUserVisibility,
 		DefaultPushCreatePrivate:                true,
 		MaxCreationLimit:                        -1,
+		UserMaxCreationLimit:                    -1,
+		OrgMaxCreationLimit:                     -1,
 		PreferredLicenses:                       []string{"Apache License 2.0", "MIT License"},
 		DisableHTTPGit:                          false,
 		AccessControlAllowOrigin:                "",
@@ -237,7 +241,7 @@ var (
 			AddCoCommitterTrailers:                   true,
 			RetargetChildrenOnMerge:                  true,
 			DelayCheckForInactiveDays:                7,
-			DefaultTitleSource:                       RepoPRTitleSourceFirstCommit,
+			DefaultTitleSource:                       RepoPRTitleSourceAuto,
 		},
 
 		// Issue settings
@@ -297,7 +301,11 @@ func loadRepositoryFrom(rootCfg ConfigProvider) {
 	Repository.DisableHTTPGit = sec.Key("DISABLE_HTTP_GIT").MustBool()
 	Repository.UseCompatSSHURI = sec.Key("USE_COMPAT_SSH_URI").MustBool()
 	Repository.GoGetCloneURLProtocol = sec.Key("GO_GET_CLONE_URL_PROTOCOL").MustString("https")
+	// MAX_CREATION_LIMIT is a shortcut that sets the default for the two per-type limits below.
+	// USER_/ORG_MAX_CREATION_LIMIT take precedence when explicitly set.
 	Repository.MaxCreationLimit = sec.Key("MAX_CREATION_LIMIT").MustInt(-1)
+	Repository.UserMaxCreationLimit = sec.Key("USER_MAX_CREATION_LIMIT").MustInt(Repository.MaxCreationLimit)
+	Repository.OrgMaxCreationLimit = sec.Key("ORG_MAX_CREATION_LIMIT").MustInt(Repository.MaxCreationLimit)
 	Repository.DefaultBranch = sec.Key("DEFAULT_BRANCH").MustString(Repository.DefaultBranch)
 	RepoRootPath = sec.Key("ROOT").MustString(filepath.Join(AppDataPath, "gitea-repositories"))
 	if !filepath.IsAbs(RepoRootPath) {
diff --git a/modules/setting/repository_test.go b/modules/setting/repository_test.go
new file mode 100644
index 00000000000..bd2779019c6
--- /dev/null
+++ b/modules/setting/repository_test.go
@@ -0,0 +1,66 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package setting
+
+import (
+	"testing"
+
+	"gitea.dev/modules/test"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLoadRepositoryCreationLimits(t *testing.T) {
+	defer test.MockVariableValue(&Repository.MaxCreationLimit)()
+	defer test.MockVariableValue(&Repository.UserMaxCreationLimit)()
+	defer test.MockVariableValue(&Repository.OrgMaxCreationLimit)()
+
+	t.Run("ShortcutPropagatesToBoth", func(t *testing.T) {
+		cfg, err := NewConfigProviderFromData(`
+[repository]
+MAX_CREATION_LIMIT = 5
+`)
+		assert.NoError(t, err)
+		loadRepositoryFrom(cfg)
+		assert.Equal(t, 5, Repository.MaxCreationLimit)
+		assert.Equal(t, 5, Repository.UserMaxCreationLimit)
+		assert.Equal(t, 5, Repository.OrgMaxCreationLimit)
+	})
+
+	t.Run("PerTypeKeysOverrideShortcut", func(t *testing.T) {
+		cfg, err := NewConfigProviderFromData(`
+[repository]
+MAX_CREATION_LIMIT = 5
+USER_MAX_CREATION_LIMIT = 0
+ORG_MAX_CREATION_LIMIT = -1
+`)
+		assert.NoError(t, err)
+		loadRepositoryFrom(cfg)
+		assert.Equal(t, 0, Repository.UserMaxCreationLimit)
+		assert.Equal(t, -1, Repository.OrgMaxCreationLimit)
+	})
+
+	t.Run("PartialOverrideOtherInheritsShortcut", func(t *testing.T) {
+		cfg, err := NewConfigProviderFromData(`
+[repository]
+MAX_CREATION_LIMIT = 7
+ORG_MAX_CREATION_LIMIT = -1
+`)
+		assert.NoError(t, err)
+		loadRepositoryFrom(cfg)
+		assert.Equal(t, 7, Repository.UserMaxCreationLimit)
+		assert.Equal(t, -1, Repository.OrgMaxCreationLimit)
+	})
+
+	t.Run("NoKeyDefaultsToNoLimit", func(t *testing.T) {
+		cfg, err := NewConfigProviderFromData(`
+[repository]
+`)
+		assert.NoError(t, err)
+		loadRepositoryFrom(cfg)
+		assert.Equal(t, -1, Repository.MaxCreationLimit)
+		assert.Equal(t, -1, Repository.UserMaxCreationLimit)
+		assert.Equal(t, -1, Repository.OrgMaxCreationLimit)
+	})
+}
diff --git a/modules/setting/security.go b/modules/setting/security.go
index 8b7664baba3..c7f41c8b447 100644
--- a/modules/setting/security.go
+++ b/modules/setting/security.go
@@ -8,9 +8,9 @@ import (
 	"os"
 	"strings"
 
-	"code.gitea.io/gitea/modules/auth/password/hash"
-	"code.gitea.io/gitea/modules/generate"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/auth/password/hash"
+	"gitea.dev/modules/generate"
+	"gitea.dev/modules/log"
 )
 
 // Security settings
diff --git a/modules/setting/server.go b/modules/setting/server.go
index dc58e43c435..641e18bdb4c 100644
--- a/modules/setting/server.go
+++ b/modules/setting/server.go
@@ -12,7 +12,7 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // Scheme describes protocol types
diff --git a/modules/setting/service.go b/modules/setting/service.go
index e652c13c9c9..b578ce4d2e6 100644
--- a/modules/setting/service.go
+++ b/modules/setting/service.go
@@ -9,9 +9,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/structs"
 )
 
 // enumerates all the types of captchas
diff --git a/modules/setting/service_test.go b/modules/setting/service_test.go
index fad15427415..4358f0db679 100644
--- a/modules/setting/service_test.go
+++ b/modules/setting/service_test.go
@@ -6,9 +6,9 @@ package setting
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/setting/session.go b/modules/setting/session.go
index cb9b6024ba5..24545a78745 100644
--- a/modules/setting/session.go
+++ b/modules/setting/session.go
@@ -8,9 +8,9 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 // SessionConfig defines Session settings
diff --git a/modules/setting/setting.go b/modules/setting/setting.go
index 5bfe68697af..1b19923d9b4 100644
--- a/modules/setting/setting.go
+++ b/modules/setting/setting.go
@@ -11,9 +11,10 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/user"
+	"gitea.dev/modules/util"
 )
 
 // settings
@@ -163,32 +164,38 @@ func loadCommonSettingsFrom(cfg ConfigProvider) error {
 
 func loadRunModeFrom(rootCfg ConfigProvider) {
 	rootSec := rootCfg.Section("")
+	mustNotRunAsRoot(rootSec)
+
+	runModeValue := os.Getenv("GITEA_RUN_MODE")
+	runModeValue = util.IfZero(runModeValue, rootSec.Key("RUN_MODE").String())
+	// non-dev mode is treated as prod mode, to protect users from accidentally running in dev mode if there is a typo in this value.
+	IsProd = !strings.EqualFold(runModeValue, "dev") // TODO: can use case-sensitive comparing in the future
+	RunMode = util.Iif(IsProd, "prod", "dev")
+
+	// there is a separate check: mustCurrentRunUserMatch (IsRunUserMatchCurrentUser)
 	RunUser = rootSec.Key("RUN_USER").MustString(user.CurrentUsername())
+}
+
+func mustNotRunAsRoot(rootSec ConfigSection) {
+	if os.Getuid() != 0 {
+		return
+	}
+
+	mustRunAsRoot := os.Getenv("SNAP") != "" && os.Getenv("SNAP_NAME") != "" // snap container runs the app as uid=0
+	if mustRunAsRoot {
+		return
+	}
 
 	// The following is a purposefully undocumented option. Please do not run Gitea as root. It will only cause future headaches.
 	// Please don't use root as a bandaid to "fix" something that is broken, instead the broken thing should instead be fixed properly.
-	unsafeAllowRunAsRoot := ConfigSectionKeyBool(rootSec, "I_AM_BEING_UNSAFE_RUNNING_AS_ROOT")
-	unsafeAllowRunAsRoot = unsafeAllowRunAsRoot || optional.ParseBool(os.Getenv("GITEA_I_AM_BEING_UNSAFE_RUNNING_AS_ROOT")).Value()
-	RunMode = os.Getenv("GITEA_RUN_MODE")
-	if RunMode == "" {
-		RunMode = rootSec.Key("RUN_MODE").MustString("prod")
-	}
+	allowRunAsRoot := ConfigSectionKeyBool(rootSec, "I_AM_BEING_UNSAFE_RUNNING_AS_ROOT") || // check gitea config
+		optional.ParseBool(os.Getenv("GITEA_I_AM_BEING_UNSAFE_RUNNING_AS_ROOT")).Value() // check gitea env var
 
-	// non-dev mode is treated as prod mode, to protect users from accidentally running in dev mode if there is a typo in this value.
-	RunMode = strings.ToLower(RunMode)
-	if RunMode != "dev" {
-		RunMode = "prod"
-	}
-	IsProd = RunMode != "dev"
-
-	// check if we run as root
-	if os.Getuid() == 0 {
-		if !unsafeAllowRunAsRoot {
-			// Special thanks to VLC which inspired the wording of this messaging.
-			log.Fatal("Gitea is not supposed to be run as root. Sorry. If you need to use privileged TCP ports please instead use setcap and the `cap_net_bind_service` permission")
-		}
-		log.Critical("You are running Gitea using the root user, and have purposely chosen to skip built-in protections around this. You have been warned against this.")
+	if !allowRunAsRoot {
+		// Special thanks to VLC which inspired the wording of this messaging.
+		log.Fatal("Gitea is not supposed to be run as root. If you need to use privileged TCP ports please instead use `setcap` and the `cap_net_bind_service` permission.")
 	}
+	log.Warn("You are running Gitea using the root user, and have purposely chosen to skip built-in protections around this. You have been warned against this.")
 }
 
 // HasInstallLock checks the install-lock in ConfigProvider directly, because sometimes the config file is not loaded into setting variables yet.
diff --git a/modules/setting/ssh.go b/modules/setting/ssh.go
index 900fc6ade26..948ce773c52 100644
--- a/modules/setting/ssh.go
+++ b/modules/setting/ssh.go
@@ -9,8 +9,8 @@ import (
 	"text/template"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 
 	gossh "golang.org/x/crypto/ssh"
 )
diff --git a/modules/setting/testenv.go b/modules/setting/testenv.go
index 24d489d77c2..0e52e73eb20 100644
--- a/modules/setting/testenv.go
+++ b/modules/setting/testenv.go
@@ -11,9 +11,9 @@ import (
 	"runtime"
 	"strings"
 
-	"code.gitea.io/gitea/modules/auth/password/hash"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/auth/password/hash"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 
 	"github.com/kballard/go-shellquote"
 )
diff --git a/modules/setting/time.go b/modules/setting/time.go
index 97988211a98..fc70ffc7c40 100644
--- a/modules/setting/time.go
+++ b/modules/setting/time.go
@@ -6,7 +6,7 @@ package setting
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // DefaultUILocation is the location on the UI, so that we can display the time on UI.
diff --git a/modules/setting/ui.go b/modules/setting/ui.go
index 722341a71ea..5990c7a74d6 100644
--- a/modules/setting/ui.go
+++ b/modules/setting/ui.go
@@ -6,8 +6,8 @@ package setting
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
 )
 
 // UI settings
diff --git a/modules/setting/webhook.go b/modules/setting/webhook.go
index c01261dbbd6..3df5183bb30 100644
--- a/modules/setting/webhook.go
+++ b/modules/setting/webhook.go
@@ -6,7 +6,7 @@ package setting
 import (
 	"net/url"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // Webhook settings
diff --git a/modules/ssh/init.go b/modules/ssh/init.go
index cfb0d5693a8..3bd5f3d232c 100644
--- a/modules/ssh/init.go
+++ b/modules/ssh/init.go
@@ -11,9 +11,9 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 func Init() error {
diff --git a/modules/ssh/ssh.go b/modules/ssh/ssh.go
index 3fea4851c7c..94e29969b02 100644
--- a/modules/ssh/ssh.go
+++ b/modules/ssh/ssh.go
@@ -22,12 +22,12 @@ import (
 	"sync"
 	"syscall"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/gliderlabs/ssh"
 	gossh "golang.org/x/crypto/ssh"
@@ -155,7 +155,6 @@ func sessionHandler(session ssh.Session) {
 	process.SetSysProcAttribute(cmd)
 
 	wg := &sync.WaitGroup{}
-	wg.Add(2)
 
 	if err = cmd.Start(); err != nil {
 		log.Error("SSH: Start: %v", err)
@@ -169,21 +168,19 @@ func sessionHandler(session ssh.Session) {
 		}
 	}()
 
-	go func() {
-		defer wg.Done()
+	wg.Go(func() {
 		defer stdout.Close()
 		if _, err := io.Copy(session, stdout); err != nil {
 			log.Error("Failed to write stdout to session. %s", err)
 		}
-	}()
+	})
 
-	go func() {
-		defer wg.Done()
+	wg.Go(func() {
 		defer stderr.Close()
 		if _, err := io.Copy(session.Stderr(), stderr); err != nil {
 			log.Error("Failed to write stderr to session. %s", err)
 		}
-	}()
+	})
 
 	// Ensure all the output has been written before we wait on the command
 	// to exit.
diff --git a/modules/ssh/ssh_graceful.go b/modules/ssh/ssh_graceful.go
index cad2c685bd6..b700c44ba0a 100644
--- a/modules/ssh/ssh_graceful.go
+++ b/modules/ssh/ssh_graceful.go
@@ -4,9 +4,9 @@
 package ssh
 
 import (
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"github.com/gliderlabs/ssh"
 )
@@ -20,7 +20,7 @@ func listen(server *ssh.Server) {
 	if err != nil {
 		select {
 		case <-graceful.GetManager().IsShutdown():
-			log.Critical("Failed to start SSH server: %v", err)
+			log.Error("Failed to start SSH server: %v", err)
 		default:
 			log.Fatal("Failed to start SSH server: %v", err)
 		}
diff --git a/modules/storage/azureblob.go b/modules/storage/azureblob.go
index a273a7770d0..acf60972582 100644
--- a/modules/storage/azureblob.go
+++ b/modules/storage/azureblob.go
@@ -15,9 +15,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
 	"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
diff --git a/modules/storage/azureblob_test.go b/modules/storage/azureblob_test.go
index b5d5d0fecc0..6f184ea0058 100644
--- a/modules/storage/azureblob_test.go
+++ b/modules/storage/azureblob_test.go
@@ -5,25 +5,22 @@ package storage
 
 import (
 	"io"
-	"os"
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
 
 func TestAzureBlobStorage(t *testing.T) {
-	if os.Getenv("CI") == "" {
-		t.Skip("azureBlobStorage not present outside of CI")
-		return
-	}
+	endpoint := test.ExternalServiceHTTP(t, "TEST_AZURESTORAGE_ENDPOINT", "http://devstoreaccount1.azurite.local:10000")
 	storageType := setting.AzureBlobStorageType
 	config := &setting.Storage{
 		AzureBlobConfig: setting.AzureBlobStorageConfig{
 			// https://learn.microsoft.com/azure/storage/common/storage-use-azurite?tabs=visual-studio-code#ip-style-url
-			Endpoint: "http://devstoreaccount1.azurite.local:10000",
+			Endpoint: endpoint,
 			// https://learn.microsoft.com/azure/storage/common/storage-use-azurite?tabs=visual-studio-code#well-known-storage-account-and-key
 			AccountName: "devstoreaccount1",
 			AccountKey:  "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==",
@@ -77,15 +74,11 @@ func TestAzureBlobStoragePath(t *testing.T) {
 }
 
 func Test_azureBlobObject(t *testing.T) {
-	if os.Getenv("CI") == "" {
-		t.Skip("azureBlobStorage not present outside of CI")
-		return
-	}
-
+	endpoint := test.ExternalServiceHTTP(t, "TEST_AZURESTORAGE_ENDPOINT", "http://devstoreaccount1.azurite.local:10000")
 	s, err := NewStorage(setting.AzureBlobStorageType, &setting.Storage{
 		AzureBlobConfig: setting.AzureBlobStorageConfig{
 			// https://learn.microsoft.com/azure/storage/common/storage-use-azurite?tabs=visual-studio-code#ip-style-url
-			Endpoint: "http://devstoreaccount1.azurite.local:10000",
+			Endpoint: endpoint,
 			// https://learn.microsoft.com/azure/storage/common/storage-use-azurite?tabs=visual-studio-code#well-known-storage-account-and-key
 			AccountName: "devstoreaccount1",
 			AccountKey:  "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==",
diff --git a/modules/storage/local.go b/modules/storage/local.go
index 04e3e05f950..82c1173ca42 100644
--- a/modules/storage/local.go
+++ b/modules/storage/local.go
@@ -12,9 +12,9 @@ import (
 	"os"
 	"path/filepath"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 var _ ObjectStorage = &LocalStorage{}
diff --git a/modules/storage/local_test.go b/modules/storage/local_test.go
index 29c13539d0e..86fbb20ae9c 100644
--- a/modules/storage/local_test.go
+++ b/modules/storage/local_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/storage/minio.go b/modules/storage/minio.go
index ace78bb6105..565d298616f 100644
--- a/modules/storage/minio.go
+++ b/modules/storage/minio.go
@@ -15,9 +15,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/minio/minio-go/v7"
 	"github.com/minio/minio-go/v7/pkg/credentials"
diff --git a/modules/storage/minio_test.go b/modules/storage/minio_test.go
index 5c15ee1ed6d..1bb772c8d33 100644
--- a/modules/storage/minio_test.go
+++ b/modules/storage/minio_test.go
@@ -10,21 +10,19 @@ import (
 	"os"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/minio/minio-go/v7"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestMinioStorage(t *testing.T) {
-	if os.Getenv("CI") == "" {
-		t.Skip("minioStorage not present outside of CI")
-		return
-	}
+	endpoint := test.ExternalServiceHTTP(t, "TEST_MINIO_ENDPOINT", "minio:9000")
 	storageType := setting.MinioStorageType
 	config := &setting.Storage{
 		MinioConfig: setting.MinioStorageConfig{
-			Endpoint:        "minio:9000",
+			Endpoint:        endpoint,
 			AccessKeyID:     "123456",
 			SecretAccessKey: "12345678",
 			Bucket:          "gitea",
diff --git a/modules/storage/storage.go b/modules/storage/storage.go
index 1271440e5a8..43c79f5b35c 100644
--- a/modules/storage/storage.go
+++ b/modules/storage/storage.go
@@ -12,10 +12,10 @@ import (
 	"os"
 	"path"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
 )
 
 // ErrURLNotSupported represents url is not supported
diff --git a/modules/storage/storage_test.go b/modules/storage/storage_test.go
index 83ee2ef7934..003b1a9e8a8 100644
--- a/modules/storage/storage_test.go
+++ b/modules/storage/storage_test.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/modules/structs/attachment.go b/modules/structs/attachment.go
index e9499d2ee7d..5d1788f7151 100644
--- a/modules/structs/attachment.go
+++ b/modules/structs/attachment.go
@@ -1,7 +1,7 @@
 // Copyright 2017 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
-package structs // import "code.gitea.io/gitea/modules/structs"
+package structs // import "gitea.dev/modules/structs"
 
 import (
 	"time"
diff --git a/modules/structs/hook.go b/modules/structs/hook.go
index 99c1535155e..0301b08e1d6 100644
--- a/modules/structs/hook.go
+++ b/modules/structs/hook.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 )
 
 // ErrInvalidReceiveHook FIXME
@@ -434,6 +434,10 @@ type ChangesPayload struct {
 type PullRequestPayload struct {
 	// The action performed on the pull request
 	Action HookIssueAction `json:"action"`
+	// The SHA of the most recent commit on the PR head branch before the push
+	Before string `json:"before,omitempty"`
+	// The SHA of the most recent commit on the PR head branch after the push
+	After string `json:"after,omitempty"`
 	// The index number of the pull request
 	Index int64 `json:"number"`
 	// Changes made to the pull request (for edit actions)
@@ -571,6 +575,20 @@ func (p *WorkflowDispatchPayload) JSONPayload() ([]byte, error) {
 	return json.MarshalIndent(p, "", "  ")
 }
 
+// WorkflowCallPayload is persisted on a reusable workflow caller job's CallPayload field.
+type WorkflowCallPayload struct {
+	Workflow   string         `json:"workflow"`
+	Ref        string         `json:"ref"`
+	Inputs     map[string]any `json:"inputs"`
+	Repository *Repository    `json:"repository"`
+	Sender     *User          `json:"sender"`
+}
+
+// JSONPayload implements Payload
+func (p *WorkflowCallPayload) JSONPayload() ([]byte, error) {
+	return json.MarshalIndent(p, "", "  ")
+}
+
 // CommitStatusPayload represents a payload information of commit status event.
 type CommitStatusPayload struct {
 	// TODO: add Branches per https://docs.github.com/en/webhooks/webhook-events-and-payloads#status
diff --git a/modules/structs/hook_test.go b/modules/structs/hook_test.go
new file mode 100644
index 00000000000..269b3933975
--- /dev/null
+++ b/modules/structs/hook_test.go
@@ -0,0 +1,59 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package structs
+
+import (
+	"testing"
+
+	"gitea.dev/modules/json"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPullRequestPayloadSynchronizeBeforeAfter(t *testing.T) {
+	payload := &PullRequestPayload{
+		Action: HookIssueSynchronized,
+		Before: "1111111111111111111111111111111111111111",
+		After:  "2222222222222222222222222222222222222222",
+		Index:  12,
+	}
+
+	data, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	assert.JSONEq(t, `{
+		"action": "synchronized",
+		"before": "1111111111111111111111111111111111111111",
+		"after": "2222222222222222222222222222222222222222",
+		"number": 12,
+		"commit_id": "",
+		"pull_request": null,
+		"repository": null,
+		"requested_reviewer": null,
+		"review": null,
+		"sender": null
+	}`, string(data))
+}
+
+func TestPullRequestPayloadNonSynchronizeOmitsBeforeAfter(t *testing.T) {
+	payload := &PullRequestPayload{
+		Action: HookIssueOpened,
+		Index:  12,
+	}
+
+	data, err := json.Marshal(payload)
+	require.NoError(t, err)
+
+	assert.JSONEq(t, `{
+		"action": "opened",
+		"number": 12,
+		"commit_id": "",
+		"pull_request": null,
+		"repository": null,
+		"requested_reviewer": null,
+		"review": null,
+		"sender": null
+	}`, string(data))
+}
diff --git a/modules/structs/issue.go b/modules/structs/issue.go
index f108cf3d0a6..68618a3191c 100644
--- a/modules/structs/issue.go
+++ b/modules/structs/issue.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // StateType issue state type
@@ -231,7 +231,7 @@ func (l *IssueTemplateStringSlice) UnmarshalYAML(value *yaml.Node) error {
 		*l = labels
 		return nil
 	}
-	return fmt.Errorf("line %d: cannot unmarshal %s into IssueTemplateStringSlice", value.Line, value.ShortTag())
+	return fmt.Errorf("cannot unmarshal %s into IssueTemplateStringSlice", value.ShortTag())
 }
 
 type IssueConfigContactLink struct {
diff --git a/modules/structs/issue_test.go b/modules/structs/issue_test.go
index 55bd01df496..3638713caa0 100644
--- a/modules/structs/issue_test.go
+++ b/modules/structs/issue_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestIssueTemplate_Type(t *testing.T) {
@@ -88,7 +88,7 @@ labels:
   b: bb
 `,
 			tmpl:    &IssueTemplate{},
-			wantErr: "line 3: cannot unmarshal !!map into IssueTemplateStringSlice",
+			wantErr: "yaml: unmarshal errors:\n  line 3: cannot unmarshal !!map into IssueTemplateStringSlice",
 		},
 	}
 	for _, tt := range tests {
diff --git a/modules/structs/repo.go b/modules/structs/repo.go
index 0c3a0ab44e3..eca1b15b026 100644
--- a/modules/structs/repo.go
+++ b/modules/structs/repo.go
@@ -113,11 +113,13 @@ type Repository struct {
 	AllowRebaseMerge              bool             `json:"allow_rebase_explicit"`
 	AllowSquash                   bool             `json:"allow_squash_merge"`
 	AllowFastForwardOnly          bool             `json:"allow_fast_forward_only_merge"`
+	AllowMergeUpdate              bool             `json:"allow_merge_update"`
 	AllowRebaseUpdate             bool             `json:"allow_rebase_update"`
 	AllowManualMerge              bool             `json:"allow_manual_merge"`
 	AutodetectManualMerge         bool             `json:"autodetect_manual_merge"`
 	DefaultDeleteBranchAfterMerge bool             `json:"default_delete_branch_after_merge"`
 	DefaultMergeStyle             string           `json:"default_merge_style"`
+	DefaultUpdateStyle            string           `json:"default_update_style"`
 	DefaultAllowMaintainerEdit    bool             `json:"default_allow_maintainer_edit"`
 	AvatarURL                     string           `json:"avatar_url"`
 	Internal                      bool             `json:"internal"`
@@ -125,10 +127,12 @@ type Repository struct {
 	// ObjectFormatName of the underlying git repository
 	ObjectFormatName ObjectFormatName `json:"object_format_name"`
 	// swagger:strfmt date-time
-	MirrorUpdated time.Time     `json:"mirror_updated"`
-	RepoTransfer  *RepoTransfer `json:"repo_transfer,omitempty"`
-	Topics        []string      `json:"topics"`
-	Licenses      []string      `json:"licenses"`
+	MirrorUpdated time.Time `json:"mirror_updated"`
+	// swagger:strfmt date-time
+	MirrorLastSyncAt time.Time     `json:"mirror_last_sync_at"`
+	RepoTransfer     *RepoTransfer `json:"repo_transfer,omitempty"`
+	Topics           []string      `json:"topics"`
+	Licenses         []string      `json:"licenses"`
 }
 
 // CreateRepoOption options when creating repository
@@ -222,12 +226,16 @@ type EditRepoOption struct {
 	AllowManualMerge *bool `json:"allow_manual_merge,omitempty"`
 	// either `true` to enable AutodetectManualMerge, or `false` to prevent it. Note: In some special cases, misjudgments can occur.
 	AutodetectManualMerge *bool `json:"autodetect_manual_merge,omitempty"`
+	// either `true` to allow updating pull request branch by merge, or `false` to prevent it.
+	AllowMergeUpdate *bool `json:"allow_merge_update,omitempty"`
 	// either `true` to allow updating pull request branch by rebase, or `false` to prevent it.
 	AllowRebaseUpdate *bool `json:"allow_rebase_update,omitempty"`
 	// set to `true` to delete pr branch after merge by default
 	DefaultDeleteBranchAfterMerge *bool `json:"default_delete_branch_after_merge,omitempty"`
 	// set to a merge style to be used by this repository: "merge", "rebase", "rebase-merge", "squash", or "fast-forward-only".
 	DefaultMergeStyle *string `json:"default_merge_style,omitempty"`
+	// set to an update style to be used by this repository: "merge" or "rebase".
+	DefaultUpdateStyle *string `json:"default_update_style,omitempty"`
 	// set to `true` to allow edits from maintainers by default
 	DefaultAllowMaintainerEdit *bool `json:"default_allow_maintainer_edit,omitempty"`
 	// set to `true` to archive this repository.
diff --git a/modules/structs/repo_branch.go b/modules/structs/repo_branch.go
index 75f7878aa6a..fc84ab364e7 100644
--- a/modules/structs/repo_branch.go
+++ b/modules/structs/repo_branch.go
@@ -50,6 +50,9 @@ type BranchProtection struct {
 	EnableMergeWhitelist          bool     `json:"enable_merge_whitelist"`
 	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
+	EnableBypassAllowlist         bool     `json:"enable_bypass_allowlist"`
+	BypassAllowlistUsernames      []string `json:"bypass_allowlist_usernames"`
+	BypassAllowlistTeams          []string `json:"bypass_allowlist_teams"`
 	EnableStatusCheck             bool     `json:"enable_status_check"`
 	StatusCheckContexts           []string `json:"status_check_contexts"`
 	RequiredApprovals             int64    `json:"required_approvals"`
@@ -90,6 +93,9 @@ type CreateBranchProtectionOption struct {
 	EnableMergeWhitelist          bool     `json:"enable_merge_whitelist"`
 	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
+	EnableBypassAllowlist         bool     `json:"enable_bypass_allowlist"`
+	BypassAllowlistUsernames      []string `json:"bypass_allowlist_usernames"`
+	BypassAllowlistTeams          []string `json:"bypass_allowlist_teams"`
 	EnableStatusCheck             bool     `json:"enable_status_check"`
 	StatusCheckContexts           []string `json:"status_check_contexts"`
 	RequiredApprovals             int64    `json:"required_approvals"`
@@ -123,6 +129,9 @@ type EditBranchProtectionOption struct {
 	EnableMergeWhitelist          *bool    `json:"enable_merge_whitelist"`
 	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
+	EnableBypassAllowlist         *bool    `json:"enable_bypass_allowlist"`
+	BypassAllowlistUsernames      []string `json:"bypass_allowlist_usernames"`
+	BypassAllowlistTeams          []string `json:"bypass_allowlist_teams"`
 	EnableStatusCheck             *bool    `json:"enable_status_check"`
 	StatusCheckContexts           []string `json:"status_check_contexts"`
 	RequiredApprovals             *int64   `json:"required_approvals"`
diff --git a/modules/structs/status.go b/modules/structs/status.go
index 923a245c46b..7a700c6ef5f 100644
--- a/modules/structs/status.go
+++ b/modules/structs/status.go
@@ -6,7 +6,7 @@ package structs
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/commitstatus"
+	"gitea.dev/modules/commitstatus"
 )
 
 // CommitStatus holds a single status of a single Commit
diff --git a/modules/structs/user.go b/modules/structs/user.go
index a25c0c5a1e7..852d2c4bdd4 100644
--- a/modules/structs/user.go
+++ b/modules/structs/user.go
@@ -7,7 +7,7 @@ package structs
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 )
 
 // User represents a user
diff --git a/modules/svg/svg.go b/modules/svg/svg.go
index 234b1f8c130..0b8514b452c 100644
--- a/modules/svg/svg.go
+++ b/modules/svg/svg.go
@@ -10,9 +10,9 @@ import (
 	"strings"
 	"sync"
 
-	gitea_html "code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/public"
+	gitea_html "gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/public"
 )
 
 type svgIconItem struct {
diff --git a/modules/svg/svg_test.go b/modules/svg/svg_test.go
index a42f57cec61..36ea463f192 100644
--- a/modules/svg/svg_test.go
+++ b/modules/svg/svg_test.go
@@ -6,7 +6,7 @@ package svg
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/system/appstate_test.go b/modules/system/appstate_test.go
index 509210127d7..ba074ec58c8 100644
--- a/modules/system/appstate_test.go
+++ b/modules/system/appstate_test.go
@@ -6,7 +6,7 @@ package system
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/system/db.go b/modules/system/db.go
index 17178283d98..8c2855cac48 100644
--- a/modules/system/db.go
+++ b/modules/system/db.go
@@ -6,9 +6,9 @@ package system
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/system"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
 )
 
 // DBStore can be used to store app state items in local filesystem
diff --git a/modules/tempdir/tempdir.go b/modules/tempdir/tempdir.go
index e5e928e4496..b33fb32be96 100644
--- a/modules/tempdir/tempdir.go
+++ b/modules/tempdir/tempdir.go
@@ -8,8 +8,8 @@ import (
 	"path/filepath"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 type TempDir struct {
diff --git a/modules/templates/base.go b/modules/templates/base.go
index c8697cc7ef0..5f567b26639 100644
--- a/modules/templates/base.go
+++ b/modules/templates/base.go
@@ -4,8 +4,8 @@
 package templates
 
 import (
-	"code.gitea.io/gitea/modules/assetfs"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/assetfs"
+	"gitea.dev/modules/setting"
 )
 
 func AssetFS() *assetfs.LayeredFS {
diff --git a/modules/templates/eval/eval.go b/modules/templates/eval/eval.go
index 5d4ac915b98..14fcc2ca8e6 100644
--- a/modules/templates/eval/eval.go
+++ b/modules/templates/eval/eval.go
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 type Num struct {
diff --git a/modules/templates/helper.go b/modules/templates/helper.go
index 4cd6269eaf8..662b89998e4 100644
--- a/modules/templates/helper.go
+++ b/modules/templates/helper.go
@@ -12,15 +12,15 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/svg"
-	"code.gitea.io/gitea/modules/templates/eval"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/gitdiff"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/templates/eval"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/gitdiff"
 )
 
 func newFuncMapWebPage() template.FuncMap {
@@ -67,7 +67,8 @@ func newFuncMapWebPage() template.FuncMap {
 			return strconv.FormatInt(time.Since(startTime).Nanoseconds()/1e6, 10) + "ms"
 		},
 
-		"AssetURI": public.AssetURI,
+		"AssetURI":      public.AssetURI,
+		"AssetCSSLinks": public.AssetCSSLinks,
 
 		// -----------------------------------------------------------------
 		// setting
@@ -132,10 +133,9 @@ func newFuncMapWebPage() template.FuncMap {
 
 		// -----------------------------------------------------------------
 		// misc (TODO: move them to MiscUtils to avoid bloating the main func map)
-		"ActionContent2Commits":    ActionContent2Commits,
-		"IsMultilineCommitMessage": isMultilineCommitMessage,
-		"CommentMustAsDiff":        gitdiff.CommentMustAsDiff,
-		"MirrorRemoteAddress":      mirrorRemoteAddress,
+		"ActionContent2Commits": ActionContent2Commits,
+		"CommentMustAsDiff":     gitdiff.CommentMustAsDiff,
+		"MirrorRemoteAddress":   mirrorRemoteAddress,
 
 		"FilenameIsImage": filenameIsImage,
 		"TabSizeClass":    tabSizeClass,
diff --git a/modules/templates/helper_test.go b/modules/templates/helper_test.go
index c21c20efff9..27020e6e686 100644
--- a/modules/templates/helper_test.go
+++ b/modules/templates/helper_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/templates/htmlrenderer.go b/modules/templates/htmlrenderer.go
index ca85a2ddeea..23b61751c11 100644
--- a/modules/templates/htmlrenderer.go
+++ b/modules/templates/htmlrenderer.go
@@ -17,11 +17,11 @@ import (
 	"sync/atomic"
 	texttemplate "text/template"
 
-	"code.gitea.io/gitea/modules/assetfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates/scopedtmpl"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/assetfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates/scopedtmpl"
+	"gitea.dev/modules/util"
 )
 
 type TemplateExecutor scopedtmpl.TemplateExecutor
diff --git a/modules/templates/htmlrenderer_test.go b/modules/templates/htmlrenderer_test.go
index e8b01c30fea..cb3e088d8b2 100644
--- a/modules/templates/htmlrenderer_test.go
+++ b/modules/templates/htmlrenderer_test.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/assetfs"
+	"gitea.dev/modules/assetfs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/templates/mail.go b/modules/templates/mail.go
index f81073902f3..160b7d0a2ed 100644
--- a/modules/templates/mail.go
+++ b/modules/templates/mail.go
@@ -13,11 +13,11 @@ import (
 	"sync"
 	texttmpl "text/template"
 
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 type MailRender struct {
diff --git a/modules/templates/page.go b/modules/templates/page.go
index 475cb0d678e..c02f5b43ae3 100644
--- a/modules/templates/page.go
+++ b/modules/templates/page.go
@@ -14,10 +14,10 @@ import (
 	"sync"
 	texttemplate "text/template"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 type pageRenderer struct {
diff --git a/modules/templates/scopedtmpl/scopedtmpl_test.go b/modules/templates/scopedtmpl/scopedtmpl_test.go
index 774b8c7d424..dbf11e97c27 100644
--- a/modules/templates/scopedtmpl/scopedtmpl_test.go
+++ b/modules/templates/scopedtmpl/scopedtmpl_test.go
@@ -54,17 +54,14 @@ func TestScopedTemplateSetFuncMap(t *testing.T) {
 	out1 := bytes.Buffer{}
 	out2 := bytes.Buffer{}
 	wg := sync.WaitGroup{}
-	wg.Add(2)
-	go func() {
+	wg.Go(func() {
 		err := ts.newExecutor(funcMap1).Execute(&out1, nil)
 		assert.NoError(t, err)
-		wg.Done()
-	}()
-	go func() {
+	})
+	wg.Go(func() {
 		err := ts.newExecutor(funcMap2).Execute(&out2, nil)
 		assert.NoError(t, err)
-		wg.Done()
-	}()
+	})
 	wg.Wait()
 	assert.Equal(t, "base1\ntest1\nbase1\ntest1", out1.String())
 	assert.Equal(t, "base2\ntest2\nbase2\ntest2", out2.String())
diff --git a/modules/templates/templates_bindata.go b/modules/templates/templates_bindata.go
index 0399b2c49ac..49b40f93e1d 100644
--- a/modules/templates/templates_bindata.go
+++ b/modules/templates/templates_bindata.go
@@ -10,7 +10,7 @@ package templates
 import (
 	"sync"
 
-	"code.gitea.io/gitea/modules/assetfs"
+	"gitea.dev/modules/assetfs"
 
 	_ "embed"
 )
diff --git a/modules/templates/templates_dynamic.go b/modules/templates/templates_dynamic.go
index e1babd83c94..851378d2c3d 100644
--- a/modules/templates/templates_dynamic.go
+++ b/modules/templates/templates_dynamic.go
@@ -6,8 +6,8 @@
 package templates
 
 import (
-	"code.gitea.io/gitea/modules/assetfs"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/assetfs"
+	"gitea.dev/modules/setting"
 )
 
 func BuiltinAssets() *assetfs.Layer {
diff --git a/modules/templates/util_actions.go b/modules/templates/util_actions.go
new file mode 100644
index 00000000000..8bb52ef4285
--- /dev/null
+++ b/modules/templates/util_actions.go
@@ -0,0 +1,23 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package templates
+
+import (
+	"context"
+
+	git_model "gitea.dev/models/git"
+	actions_module "gitea.dev/modules/actions"
+)
+
+type ActionsUtils struct {
+	ctx context.Context
+}
+
+func NewActionsUtils(ctx context.Context) *ActionsUtils {
+	return &ActionsUtils{ctx: ctx}
+}
+
+func (a *ActionsUtils) CommitStatusesToActionsStatuses(statuses []*git_model.CommitStatus) actions_module.CommitActionsStatusMap {
+	return actions_module.GetCommitActionsStatusMap(a.ctx, statuses)
+}
diff --git a/modules/templates/util_avatar.go b/modules/templates/util_avatar.go
index 524c64d0b6e..2382ce77924 100644
--- a/modules/templates/util_avatar.go
+++ b/modules/templates/util_avatar.go
@@ -9,14 +9,14 @@ import (
 	"html/template"
 	"strconv"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/avatars"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	gitea_html "code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/avatars"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	gitea_html "gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 type AvatarUtils struct {
diff --git a/modules/templates/util_date.go b/modules/templates/util_date.go
index 1b36722c43d..823222e13eb 100644
--- a/modules/templates/util_date.go
+++ b/modules/templates/util_date.go
@@ -10,8 +10,8 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 )
 
 type DateUtils struct{}
diff --git a/modules/templates/util_date_test.go b/modules/templates/util_date_test.go
index b74bbb0ceed..577d1bba5d5 100644
--- a/modules/templates/util_date_test.go
+++ b/modules/templates/util_date_test.go
@@ -7,9 +7,9 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/templates/util_dict.go b/modules/templates/util_dict.go
index cc3018a71c7..09dc838d6bf 100644
--- a/modules/templates/util_dict.go
+++ b/modules/templates/util_dict.go
@@ -10,9 +10,9 @@ import (
 	"html/template"
 	"reflect"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
 )
 
 func dictMerge(base map[string]any, arg any) bool {
diff --git a/modules/templates/util_format.go b/modules/templates/util_format.go
index 3485e3251ec..26c195450ea 100644
--- a/modules/templates/util_format.go
+++ b/modules/templates/util_format.go
@@ -7,7 +7,7 @@ import (
 	"fmt"
 	"strconv"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 func timeEstimateString(timeSec any) string {
diff --git a/modules/templates/util_json.go b/modules/templates/util_json.go
index 29a04290fa0..928d9c998e7 100644
--- a/modules/templates/util_json.go
+++ b/modules/templates/util_json.go
@@ -6,7 +6,7 @@ package templates
 import (
 	"bytes"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 )
 
 type JsonUtils struct{} //nolint:revive // variable naming triggers on Json, wants JSON
diff --git a/modules/templates/util_misc.go b/modules/templates/util_misc.go
index fb523fd53ac..27c37615ba6 100644
--- a/modules/templates/util_misc.go
+++ b/modules/templates/util_misc.go
@@ -12,15 +12,15 @@ import (
 	"strings"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/svg"
+	activities_model "gitea.dev/models/activities"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/svg"
 
 	"github.com/editorconfig/editorconfig-core-go/v2"
 )
@@ -52,11 +52,6 @@ func sortArrow(normSort, revSort, urlSort string, isDefault bool) template.HTML
 	return ""
 }
 
-// isMultilineCommitMessage checks to see if a commit message contains multiple lines.
-func isMultilineCommitMessage(msg string) bool {
-	return strings.Count(strings.TrimSpace(msg), "\n") >= 1
-}
-
 // Actioner describes an action
 type Actioner interface {
 	GetOpType() activities_model.ActionType
diff --git a/modules/templates/util_render.go b/modules/templates/util_render.go
index 6641ee79594..3c7f9b0a7a1 100644
--- a/modules/templates/util_render.go
+++ b/modules/templates/util_render.go
@@ -13,21 +13,22 @@ import (
 	"strings"
 	"unicode"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/renderhelper"
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/emoji"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/svg"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/webtheme"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/renderhelper"
+	"gitea.dev/models/repo"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/emoji"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/webtheme"
 )
 
 type RenderUtils struct {
@@ -79,20 +80,14 @@ func (ut *RenderUtils) RenderCommitMessageLinkSubject(msg, urlDefault string, re
 
 // RenderCommitBody extracts the body of a commit message without its title.
 func (ut *RenderUtils) RenderCommitBody(msg string, repo *repo.Repository) template.HTML {
-	msgLine := strings.TrimSpace(msg)
-	lineEnd := strings.IndexByte(msgLine, '\n')
-	if lineEnd > 0 {
-		msgLine = msgLine[lineEnd+1:]
-	} else {
-		return ""
-	}
-	msgLine = strings.TrimLeftFunc(msgLine, unicode.IsSpace)
-	if len(msgLine) == 0 {
+	_, body, _ := strings.Cut(strings.TrimSpace(msg), "\n")
+	body = strings.TrimFunc(body, unicode.IsSpace)
+	if body == "" {
 		return ""
 	}
 
 	rctx := renderhelper.NewRenderContextRepoComment(ut.ctx, repo)
-	htmlContent := template.HTML(template.HTMLEscapeString(msgLine))
+	htmlContent := template.HTML(template.HTMLEscapeString(body))
 	renderedMessage, err := markup.PostProcessCommitMessage(rctx, htmlContent)
 	if err != nil {
 		log.Error("PostProcessCommitMessage: %v", err)
@@ -112,38 +107,29 @@ func renderCodeBlock(htmlEscapedTextToRender template.HTML) template.HTML {
 
 // RenderIssueTitle renders issue/pull title with defined post processors
 func (ut *RenderUtils) RenderIssueTitle(text string, repo *repo.Repository) template.HTML {
-	renderedText, err := markup.PostProcessIssueTitle(renderhelper.NewRenderContextRepoComment(ut.ctx, repo), template.HTMLEscapeString(text))
+	// wrap "`…`" in <code> before post-processing so code-span content stays literal, like comment bodies
+	htmlWithCode := renderCodeBlock(template.HTML(template.HTMLEscapeString(text)))
+	renderedText, err := markup.PostProcessIssueTitle(renderhelper.NewRenderContextRepoComment(ut.ctx, repo), string(htmlWithCode))
 	if err != nil {
 		log.Error("PostProcessIssueTitle: %v", err)
 		return ""
 	}
-	return renderCodeBlock(template.HTML(renderedText))
+	return template.HTML(renderedText)
 }
 
 // RenderIssueSimpleTitle only renders with emoji and inline code block
 func (ut *RenderUtils) RenderIssueSimpleTitle(text string) template.HTML {
-	ret := ut.RenderEmoji(text)
-	ret = renderCodeBlock(ret)
-	return ret
-}
-
-func (ut *RenderUtils) RenderLabelWithLink(label *issues_model.Label, link any) template.HTML {
-	var attrHref template.HTML
-	switch link.(type) {
-	case template.URL, string:
-		attrHref = htmlutil.HTMLFormat(`href="%s"`, link)
-	default:
-		panic(fmt.Sprintf("unexpected type %T for link", link))
+	// see RenderIssueTitle: wrap code spans before processing emoji
+	htmlWithCode := renderCodeBlock(template.HTML(template.HTMLEscapeString(text)))
+	renderedText, err := markup.PostProcessEmoji(markup.NewRenderContext(ut.ctx), string(htmlWithCode))
+	if err != nil {
+		log.Error("RenderIssueSimpleTitle: %v", err)
+		return ""
 	}
-	return ut.renderLabelWithTag(label, "a", attrHref)
+	return template.HTML(renderedText)
 }
 
 func (ut *RenderUtils) RenderLabel(label *issues_model.Label) template.HTML {
-	return ut.renderLabelWithTag(label, "span", "")
-}
-
-// RenderLabel renders a label
-func (ut *RenderUtils) renderLabelWithTag(label *issues_model.Label, tagName, tagAttrs template.HTML) template.HTML {
 	locale := ut.ctx.Value(translation.ContextKey).(translation.Locale)
 	var extraCSSClasses string
 	textColor := util.ContrastColor(label.Color)
@@ -157,8 +143,8 @@ func (ut *RenderUtils) renderLabelWithTag(label *issues_model.Label, tagName, ta
 
 	if labelScope == "" {
 		// Regular label
-		return htmlutil.HTMLFormat(`<%s %s class="ui label %s" style="color: %s !important; background-color: %s !important;" data-tooltip-content title="%s"><span class="gt-ellipsis">%s</span></%s>`,
-			tagName, tagAttrs, extraCSSClasses, textColor, label.Color, descriptionText, ut.RenderEmoji(label.Name), tagName)
+		return htmlutil.HTMLFormat(`<span class="ui label %s" style="color: %s !important; background-color: %s !important;" data-tooltip-content title="%s"><span class="gt-ellipsis">%s</span></span>`,
+			extraCSSClasses, textColor, label.Color, descriptionText, ut.RenderEmoji(label.Name))
 	}
 
 	// Scoped label
@@ -193,29 +179,25 @@ func (ut *RenderUtils) renderLabelWithTag(label *issues_model.Label, tagName, ta
 
 	if label.ExclusiveOrder > 0 {
 		// <scope> | <label> | <order>
-		return htmlutil.HTMLFormat(`<%s %s class="ui label %s scope-parent" data-tooltip-content title="%s">`+
+		return htmlutil.HTMLFormat(`<span class="ui label %s scope-parent" data-tooltip-content title="%s">`+
 			`<div class="ui label scope-left" style="color: %s !important; background-color: %s !important">%s</div>`+
 			`<div class="ui label scope-middle" style="color: %s !important; background-color: %s !important">%s</div>`+
 			`<div class="ui label scope-right">%d</div>`+
-			`</%s>`,
-			tagName, tagAttrs,
+			`</span>`,
 			extraCSSClasses, descriptionText,
 			textColor, scopeColor, scopeHTML,
 			textColor, itemColor, itemHTML,
-			label.ExclusiveOrder,
-			tagName)
+			label.ExclusiveOrder)
 	}
 
 	// <scope> | <label>
-	return htmlutil.HTMLFormat(`<%s %s class="ui label %s scope-parent" data-tooltip-content title="%s">`+
+	return htmlutil.HTMLFormat(`<span class="ui label %s scope-parent" data-tooltip-content title="%s">`+
 		`<div class="ui label scope-left" style="color: %s !important; background-color: %s !important">%s</div>`+
 		`<div class="ui label scope-right" style="color: %s !important; background-color: %s !important">%s</div>`+
-		`</%s>`,
-		tagName, tagAttrs,
+		`</span>`,
 		extraCSSClasses, descriptionText,
 		textColor, scopeColor, scopeHTML,
-		textColor, itemColor, itemHTML,
-		tagName)
+		textColor, itemColor, itemHTML)
 }
 
 // RenderEmoji renders html text with emoji post processors
@@ -249,21 +231,41 @@ func (ut *RenderUtils) MarkdownToHtml(input string) template.HTML { //nolint:rev
 	return output
 }
 
+// RenderPackageMarkdown renders package page Markdown so relative links resolve against the
+// linked repository's default branch instead of the site root, falling back to plain rendering
+// when there is no linked repository. pkgTreePath optionally roots links in a subdirectory
+// (e.g. npm's repository.directory for monorepo packages).
+func (ut *RenderUtils) RenderPackageMarkdown(input string, linkedRepo *repo.Repository, pkgTreePath ...string) template.HTML {
+	if linkedRepo == nil {
+		return `<div class="markup markdown">` + ut.MarkdownToHtml(input) + `</div>`
+	}
+	rctx := renderhelper.NewRenderContextRepoFile(ut.ctx, linkedRepo, renderhelper.RepoFileOptions{
+		CurrentRefSubURL: git.RefNameFromBranch(linkedRepo.DefaultBranch).RefWebLinkPath(),
+		CurrentTreePath:  util.OptionalArg(pkgTreePath),
+	})
+	output, err := markdown.RenderString(rctx, input)
+	if err != nil {
+		log.Error("RenderString: %v", err)
+	}
+	return `<div class="markup markdown">` + output + `</div>`
+}
+
 func (ut *RenderUtils) RenderLabels(labels []*issues_model.Label, repoLink string, issue *issues_model.Issue) template.HTML {
 	isPullRequest := issue != nil && issue.IsPull
 	baseLink := fmt.Sprintf("%s/%s", repoLink, util.Iif(isPullRequest, "pulls", "issues"))
-	var htmlCode strings.Builder
-	htmlCode.WriteString(`<span class="labels-list">`)
+	var htmlCode htmlutil.HTMLBuilder
+	htmlCode.WriteHTML(`<span class="labels-list">`)
 	for _, label := range labels {
 		// Protect against nil value in labels - shouldn't happen but would cause a panic if so
 		if label == nil {
 			continue
 		}
-		link := fmt.Sprintf("%s?labels=%d", baseLink, label.ID)
-		htmlCode.WriteString(string(ut.RenderLabelWithLink(label, template.URL(link))))
+		htmlCode.WriteFormat(`<a class="item" href="%s?labels=%d">`, baseLink, label.ID)
+		htmlCode.WriteHTML(ut.RenderLabel(label))
+		htmlCode.WriteHTML("</a>")
 	}
-	htmlCode.WriteString("</span>")
-	return template.HTML(htmlCode.String())
+	htmlCode.WriteHTML("</span>")
+	return htmlCode.HTMLString()
 }
 
 func (ut *RenderUtils) RenderThemeItem(info *webtheme.ThemeMetaInfo, iconSize int) template.HTML {
diff --git a/modules/templates/util_render_comment.go b/modules/templates/util_render_comment.go
index 73f36ad21c3..c9d0a61a9fe 100644
--- a/modules/templates/util_render_comment.go
+++ b/modules/templates/util_render_comment.go
@@ -7,12 +7,12 @@ import (
 	"html/template"
 	"strings"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/svg"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
 )
 
 func commentTimelineEventIsWipToggle(c *issues_model.Comment) (isToggle, isWip bool) {
diff --git a/modules/templates/util_render_comment_test.go b/modules/templates/util_render_comment_test.go
index 27e67bd3542..e0e912a3f81 100644
--- a/modules/templates/util_render_comment_test.go
+++ b/modules/templates/util_render_comment_test.go
@@ -7,9 +7,9 @@ import (
 	"html/template"
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/translation"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/templates/util_render_test.go b/modules/templates/util_render_test.go
index 5c37f084df6..50a443c7468 100644
--- a/modules/templates/util_render_test.go
+++ b/modules/templates/util_render_test.go
@@ -10,14 +10,14 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/models/issues"
+	"gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -140,6 +140,18 @@ com 88fc37a3c0a4dda553bdcfc80c178a58247f42fb mit
 		assert.EqualValues(t, expected, newTestRenderUtils(t).RenderCommitMessageLinkSubject(testInput(), "https://example.com/link", mockRepo))
 	})
 
+	t.Run("RenderCommitMessageLinkSubjectURLOnly", func(t *testing.T) {
+		// a bare URL in the subject must not hijack the default link
+		expected := `<a href="https://example.com/link" class="muted">https://example.com/file.bin</a>`
+		assert.EqualValues(t, expected, newTestRenderUtils(t).RenderCommitMessageLinkSubject("https://example.com/file.bin", "https://example.com/link", mockRepo))
+	})
+
+	t.Run("RenderCommitMessageLinkSubjectPartialURL", func(t *testing.T) {
+		// a URL embedded in larger subject text still becomes its own link
+		expected := `<a href="https://example.com/link" class="muted">see </a><a href="https://example.com/x" data-markdown-generated-content="">https://example.com/x</a><a href="https://example.com/link" class="muted"> here</a>`
+		assert.EqualValues(t, expected, newTestRenderUtils(t).RenderCommitMessageLinkSubject("see https://example.com/x here", "https://example.com/link", mockRepo))
+	})
+
 	t.Run("RenderIssueTitle", func(t *testing.T) {
 		defer test.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
 		expected := `  space @mention-user<SPACE><SPACE>
@@ -168,6 +180,38 @@ mail@domain.com
 	})
 }
 
+func TestRenderIssueTitleCodeSpan(t *testing.T) {
+	defer test.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
+	mockRepo := &repo.Repository{
+		ID: 1, OwnerName: "user13", Name: "repo11",
+		Owner: &user_model.User{ID: 13, Name: "user13"},
+		Units: []*repo.RepoUnit{},
+	}
+	ut := newTestRenderUtils(t)
+
+	cases := []struct {
+		input     string
+		expected  string
+		emojiSafe bool
+	}{
+		{"foo `:100:`", `foo <code class="inline-code-block">:100:</code>`, true},
+		{"`#123`", `<code class="inline-code-block">#123</code>`, false},
+		{"`88fc37a3c0a4dda553bdcfc80c178a58247f42fb`", `<code class="inline-code-block">88fc37a3c0a4dda553bdcfc80c178a58247f42fb</code>`, false},
+		{"foo `:100:", "foo `:100:", true},
+		{"foo ` :100:", `foo ` + "`" + ` <span class="emoji" aria-label="hundred points">💯</span>`, true},
+		{":100:", `<span class="emoji" aria-label="hundred points">💯</span>`, true},
+		{"#123", `<a href="/user13/repo11/issues/123" class="ref-issue">#123</a>`, false},
+		{"`x`:100:", `<code class="inline-code-block">x</code><span class="emoji" aria-label="hundred points">💯</span>`, true},
+		{"a `:100:` b `:+1:` c", `a <code class="inline-code-block">:100:</code> b <code class="inline-code-block">:+1:</code> c`, true},
+	}
+	for _, c := range cases {
+		assert.Equal(t, c.expected, string(ut.RenderIssueTitle(c.input, mockRepo)), "input=%q", c.input)
+		if c.emojiSafe {
+			assert.Equal(t, c.expected, string(ut.RenderIssueSimpleTitle(c.input)), "simple input=%q", c.input)
+		}
+	}
+}
+
 func TestRenderMarkdownToHtml(t *testing.T) {
 	defer test.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
 	expected := `<p>space <a href="/mention-user" rel="nofollow">@mention-user</a><br/>
@@ -194,6 +238,38 @@ space</p>
 	assert.Equal(t, expected, string(newTestRenderUtils(t).MarkdownToHtml(testInput())))
 }
 
+func TestRenderPackageMarkdown(t *testing.T) {
+	defer test.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
+	mockRepo := &repo.Repository{
+		ID: 1, OwnerName: "user13", Name: "repo11", DefaultBranch: "main",
+		Owner: &user_model.User{ID: 13, Name: "user13"},
+		Units: []*repo.RepoUnit{},
+	}
+	ut := newTestRenderUtils(t)
+
+	t.Run("LinkedRepoWithDirectory", func(t *testing.T) {
+		rendered := ut.RenderPackageMarkdown("[docs](docs/getting-started.md)\n![logo](logo.png)", mockRepo, "pkg-subdir")
+		expected := `<div class="markup markdown"><p><a href="/user13/repo11/src/branch/main/pkg-subdir/docs/getting-started.md" rel="nofollow">docs</a>
+<a href="/user13/repo11/src/branch/main/pkg-subdir/logo.png" target="_blank" rel="nofollow noopener"><img src="/user13/repo11/media/branch/main/pkg-subdir/logo.png" alt="logo"/></a></p>
+</div>`
+		assert.Equal(t, expected, strings.TrimSpace(string(rendered)))
+	})
+
+	t.Run("LinkedRepoWithEmptyDirectory", func(t *testing.T) {
+		rendered := ut.RenderPackageMarkdown("[docs](docs/getting-started.md)", mockRepo, "")
+		expected := `<div class="markup markdown"><p><a href="/user13/repo11/src/branch/main/docs/getting-started.md" rel="nofollow">docs</a></p>
+</div>`
+		assert.Equal(t, expected, strings.TrimSpace(string(rendered)))
+	})
+
+	t.Run("UnlinkedRepo", func(t *testing.T) {
+		rendered := ut.RenderPackageMarkdown("[docs](docs/getting-started.md)", nil, "pkg-subdir")
+		expected := `<div class="markup markdown"><p><a href="/docs/getting-started.md" rel="nofollow">docs</a></p>
+</div>`
+		assert.Equal(t, expected, strings.TrimSpace(string(rendered)))
+	})
+}
+
 func TestRenderLabels(t *testing.T) {
 	ut := newTestRenderUtils(t)
 	label := &issues.Label{ID: 123, Name: "label-name", Color: "label-color"}
@@ -206,16 +282,15 @@ func TestRenderLabels(t *testing.T) {
 	expected = `/owner/repo/pulls?labels=123`
 	assert.Contains(t, ut.RenderLabels([]*issues.Label{label}, "/owner/repo", issue), expected)
 
-	expectedLabel := `<a href="&lt;&gt;" class="ui label " style="color: #fff !important; background-color: label-color !important;" data-tooltip-content title=""><span class="gt-ellipsis">label-name</span></a>`
-	assert.Equal(t, expectedLabel, string(ut.RenderLabelWithLink(label, "<>")))
-	assert.Equal(t, expectedLabel, string(ut.RenderLabelWithLink(label, template.URL("<>"))))
+	expectedLabel := `<span class="ui label " style="color: #fff !important; background-color: label-color !important;" data-tooltip-content title=""><span class="gt-ellipsis">label-name</span></span>`
+	assert.Equal(t, expectedLabel, string(ut.RenderLabel(label)))
 
 	label = &issues.Label{ID: 123, Name: "</>", Exclusive: true}
-	expectedLabel = `<a href="" class="ui label  scope-parent" data-tooltip-content title=""><div class="ui label scope-left" style="color: #fff !important; background-color: #000000 !important">&lt;</div><div class="ui label scope-right" style="color: #fff !important; background-color: #000000 !important">&gt;</div></a>`
-	assert.Equal(t, expectedLabel, string(ut.RenderLabelWithLink(label, "")))
+	expectedLabel = `<span class="ui label  scope-parent" data-tooltip-content title=""><div class="ui label scope-left" style="color: #fff !important; background-color: #000000 !important">&lt;</div><div class="ui label scope-right" style="color: #fff !important; background-color: #000000 !important">&gt;</div></span>`
+	assert.Equal(t, expectedLabel, string(ut.RenderLabel(label)))
 	label = &issues.Label{ID: 123, Name: "</>", Exclusive: true, ExclusiveOrder: 1}
-	expectedLabel = `<a href="" class="ui label  scope-parent" data-tooltip-content title=""><div class="ui label scope-left" style="color: #fff !important; background-color: #000000 !important">&lt;</div><div class="ui label scope-middle" style="color: #fff !important; background-color: #000000 !important">&gt;</div><div class="ui label scope-right">1</div></a>`
-	assert.Equal(t, expectedLabel, string(ut.RenderLabelWithLink(label, "")))
+	expectedLabel = `<span class="ui label  scope-parent" data-tooltip-content title=""><div class="ui label scope-left" style="color: #fff !important; background-color: #000000 !important">&lt;</div><div class="ui label scope-middle" style="color: #fff !important; background-color: #000000 !important">&gt;</div><div class="ui label scope-right">1</div></span>`
+	assert.Equal(t, expectedLabel, string(ut.RenderLabel(label)))
 }
 
 func TestUserMention(t *testing.T) {
diff --git a/modules/templates/util_slice.go b/modules/templates/util_slice.go
index e74b308471a..e77b5dd75bf 100644
--- a/modules/templates/util_slice.go
+++ b/modules/templates/util_slice.go
@@ -10,7 +10,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 type SliceUtils struct{}
diff --git a/modules/templates/util_string.go b/modules/templates/util_string.go
index 683c77a8704..2b7b87d7c52 100644
--- a/modules/templates/util_string.go
+++ b/modules/templates/util_string.go
@@ -8,7 +8,7 @@ import (
 	"html/template"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 type StringUtils struct{}
diff --git a/modules/test/logchecker.go b/modules/test/logchecker.go
index 387b4f3fc5d..04e1bd58f6d 100644
--- a/modules/test/logchecker.go
+++ b/modules/test/logchecker.go
@@ -11,7 +11,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 type LogChecker struct {
diff --git a/modules/test/logchecker_test.go b/modules/test/logchecker_test.go
index 6b093ab1b36..1549ee4c943 100644
--- a/modules/test/logchecker_test.go
+++ b/modules/test/logchecker_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/test/utils.go b/modules/test/utils.go
index 331dc4a959b..5a4e13b4232 100644
--- a/modules/test/utils.go
+++ b/modules/test/utils.go
@@ -11,10 +11,13 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"strconv"
 	"strings"
+	"sync"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/util"
 )
 
 // RedirectURL returns the redirect URL of a http response.
@@ -141,3 +144,41 @@ func CompressGzip(content string) *bytes.Buffer {
 	_ = cw.Close()
 	return buf
 }
+
+var AllowSkipExternalService = sync.OnceValue(func() bool {
+	isLocalTesting := os.Getenv("CI") == ""
+	ciSkipExternal, _ := strconv.ParseBool(os.Getenv("GITEA_TEST_CI_SKIP_EXTERNAL"))
+	return isLocalTesting || ciSkipExternal
+})
+
+type TestingT interface {
+	Helper()
+	Skipf(format string, args ...any)
+	Errorf(format string, args ...any)
+	Fatalf(format string, args ...any)
+}
+
+func ExternalServiceHTTP(t TestingT, envVarName, def string) string {
+	t.Helper()
+	val := util.IfZero(os.Getenv(envVarName), def)
+	if val == "" {
+		if AllowSkipExternalService() {
+			t.Skipf("skipping test because %s is not set", envVarName)
+		} else {
+			t.Fatalf("%s is not set, but skipping is not allowed in CI", envVarName)
+		}
+	}
+	// minio's endpoint is "host:port" pattern
+	testURL := util.Iif(strings.Contains(val, "://"), val, "http://"+val)
+	resp, err := http.Get(testURL)
+	if err != nil {
+		if AllowSkipExternalService() {
+			t.Skipf("skipping test because %s is not ready", val)
+		} else {
+			t.Fatalf("%s is not ready, but skipping is not allowed in CI", val)
+		}
+	} else {
+		_ = resp.Body.Close()
+	}
+	return val
+}
diff --git a/modules/testlogger/testlogger.go b/modules/testlogger/testlogger.go
index 151ca397032..70d6841fecb 100644
--- a/modules/testlogger/testlogger.go
+++ b/modules/testlogger/testlogger.go
@@ -13,9 +13,9 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/util"
 )
 
 var (
diff --git a/modules/timeutil/since.go b/modules/timeutil/since.go
index 2c89ae38d56..1cdd2eec588 100644
--- a/modules/timeutil/since.go
+++ b/modules/timeutil/since.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/translation"
 )
 
 // Seconds-based time units
diff --git a/modules/timeutil/since_test.go b/modules/timeutil/since_test.go
index bf848bd05a3..927265ff191 100644
--- a/modules/timeutil/since_test.go
+++ b/modules/timeutil/since_test.go
@@ -9,8 +9,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/timeutil/timestamp.go b/modules/timeutil/timestamp.go
index e77652b24f2..a8c443aa493 100644
--- a/modules/timeutil/timestamp.go
+++ b/modules/timeutil/timestamp.go
@@ -6,7 +6,7 @@ package timeutil
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // TimeStamp defines a timestamp
diff --git a/modules/timeutil/timestampnano.go b/modules/timeutil/timestampnano.go
index 4a9f7955b98..aaca246e819 100644
--- a/modules/timeutil/timestampnano.go
+++ b/modules/timeutil/timestampnano.go
@@ -6,7 +6,7 @@ package timeutil
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // TimeStampNano is for nano time in database, do not use it unless there is a real requirement.
diff --git a/modules/translation/i18n/localestore.go b/modules/translation/i18n/localestore.go
index 98934e28359..75cc5455ff5 100644
--- a/modules/translation/i18n/localestore.go
+++ b/modules/translation/i18n/localestore.go
@@ -10,8 +10,8 @@ import (
 	"html/template"
 	"slices"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
 )
 
 // This file implements the static LocaleStore that will not watch for changes
diff --git a/modules/translation/translation.go b/modules/translation/translation.go
index 85a67ba2af8..f23845a6311 100644
--- a/modules/translation/translation.go
+++ b/modules/translation/translation.go
@@ -10,11 +10,11 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/options"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation/i18n"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/options"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation/i18n"
+	"gitea.dev/modules/util"
 
 	"golang.org/x/text/language"
 	"golang.org/x/text/message"
diff --git a/modules/translation/translation_test.go b/modules/translation/translation_test.go
index 87df9eb825f..2b6a0a5874d 100644
--- a/modules/translation/translation_test.go
+++ b/modules/translation/translation_test.go
@@ -6,7 +6,7 @@ package translation
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/translation/i18n"
+	"gitea.dev/modules/translation/i18n"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/turnstile/turnstile.go b/modules/turnstile/turnstile.go
index 38d02334466..381cb71fda5 100644
--- a/modules/turnstile/turnstile.go
+++ b/modules/turnstile/turnstile.go
@@ -11,8 +11,8 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
 )
 
 // Response is the structure of JSON returned from API
diff --git a/modules/updatechecker/update_checker.go b/modules/updatechecker/update_checker.go
index f0686c0f78f..5a9c2d40fdd 100644
--- a/modules/updatechecker/update_checker.go
+++ b/modules/updatechecker/update_checker.go
@@ -8,10 +8,10 @@ import (
 	"io"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/proxy"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/system"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/proxy"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/system"
 
 	"github.com/hashicorp/go-version"
 )
diff --git a/modules/util/rotatingfilewriter/writer.go b/modules/util/rotatingfilewriter/writer.go
index c595f49c49b..28ba5bd70dd 100644
--- a/modules/util/rotatingfilewriter/writer.go
+++ b/modules/util/rotatingfilewriter/writer.go
@@ -14,8 +14,8 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/graceful/releasereopen"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/graceful/releasereopen"
+	"gitea.dev/modules/util"
 )
 
 type Options struct {
diff --git a/modules/util/runtime_test.go b/modules/util/runtime_test.go
index ea6eb639d1b..418663becf5 100644
--- a/modules/util/runtime_test.go
+++ b/modules/util/runtime_test.go
@@ -12,7 +12,7 @@ import (
 
 func TestCallerFuncName(t *testing.T) {
 	s := CallerFuncName()
-	assert.Equal(t, "code.gitea.io/gitea/modules/util.TestCallerFuncName", s)
+	assert.Equal(t, "gitea.dev/modules/util.TestCallerFuncName", s)
 }
 
 func BenchmarkCallerFuncName(b *testing.B) {
diff --git a/modules/util/util.go b/modules/util/util.go
index 17733736be3..87188b1018f 100644
--- a/modules/util/util.go
+++ b/modules/util/util.go
@@ -15,7 +15,7 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/container"
+	"gitea.dev/modules/container"
 
 	"golang.org/x/text/cases"
 	"golang.org/x/text/language"
diff --git a/modules/validation/binding.go b/modules/validation/binding.go
index c9de1be96c1..373e1b4f29b 100644
--- a/modules/validation/binding.go
+++ b/modules/validation/binding.go
@@ -9,10 +9,10 @@ import (
 	"regexp"
 	"strings"
 
-	"code.gitea.io/gitea/modules/auth"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/auth"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/json"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/modules/validation/glob_pattern_test.go b/modules/validation/glob_pattern_test.go
index 80cf035ca69..e22d131c617 100644
--- a/modules/validation/glob_pattern_test.go
+++ b/modules/validation/glob_pattern_test.go
@@ -6,7 +6,7 @@ package validation
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/glob"
+	"gitea.dev/modules/glob"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/modules/validation/helpers.go b/modules/validation/helpers.go
index 7695529beba..43ad7c16499 100644
--- a/modules/validation/helpers.go
+++ b/modules/validation/helpers.go
@@ -10,8 +10,8 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/setting"
 )
 
 type globalVarsStruct struct {
diff --git a/modules/web/handler.go b/modules/web/handler.go
index 46865d0f405..d8ce8df9552 100644
--- a/modules/web/handler.go
+++ b/modules/web/handler.go
@@ -9,10 +9,11 @@ import (
 	"net"
 	"net/http"
 	"reflect"
+	"slices"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/web/routing"
-	"code.gitea.io/gitea/modules/web/types"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/web/routing"
+	"gitea.dev/modules/web/types"
 )
 
 var responseStatusProviders = map[reflect.Type]func(req *http.Request) types.ResponseStatusProvider{}
@@ -131,8 +132,8 @@ type middlewareProvider = func(next http.Handler) http.Handler
 
 func executeMiddlewaresHandler(w http.ResponseWriter, r *http.Request, middlewares []middlewareProvider, endpoint http.HandlerFunc) {
 	handler := endpoint
-	for i := len(middlewares) - 1; i >= 0; i-- {
-		handler = middlewares[i](handler).ServeHTTP
+	for _, middleware := range slices.Backward(middlewares) {
+		handler = middleware(handler).ServeHTTP
 	}
 	handler(w, r)
 }
diff --git a/modules/web/middleware/binding.go b/modules/web/middleware/binding.go
index 988beb47c52..19a9d8bab92 100644
--- a/modules/web/middleware/binding.go
+++ b/modules/web/middleware/binding.go
@@ -8,9 +8,9 @@ import (
 	"reflect"
 	"strings"
 
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
 
 	"gitea.com/go-chi/binding"
 )
@@ -29,7 +29,7 @@ func AssignForm(form any, data map[string]any) {
 	typ := reflect.TypeOf(form)
 	val := reflect.ValueOf(form)
 
-	for typ.Kind() == reflect.Ptr {
+	for typ.Kind() == reflect.Pointer {
 		typ = typ.Elem()
 		val = val.Elem()
 	}
@@ -104,7 +104,7 @@ func Validate(errs binding.Errors, data map[string]any, f Form, l translation.Lo
 	data["ErrorMsg"] = l.TrString("form.unknown_error")
 
 	typ := reflect.TypeOf(f)
-	if typ.Kind() == reflect.Ptr {
+	if typ.Kind() == reflect.Pointer {
 		typ = typ.Elem()
 	}
 
diff --git a/modules/web/middleware/cookie.go b/modules/web/middleware/cookie.go
index 5456e3c6b70..7b3ba6c7e41 100644
--- a/modules/web/middleware/cookie.go
+++ b/modules/web/middleware/cookie.go
@@ -9,9 +9,9 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/session"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/session"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 const (
diff --git a/modules/web/middleware/data.go b/modules/web/middleware/data.go
index 7d9e8160428..b42e0753ee6 100644
--- a/modules/web/middleware/data.go
+++ b/modules/web/middleware/data.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"time"
 
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/setting"
 )
 
 const ContextDataKeySignedUser = "SignedUser"
diff --git a/modules/web/middleware/flash.go b/modules/web/middleware/flash.go
index 0e848c79029..36a3615954d 100644
--- a/modules/web/middleware/flash.go
+++ b/modules/web/middleware/flash.go
@@ -9,7 +9,7 @@ import (
 	"net/http"
 	"net/url"
 
-	"code.gitea.io/gitea/modules/reqctx"
+	"gitea.dev/modules/reqctx"
 )
 
 // Flash represents a one time data transfer between two requests.
diff --git a/modules/web/middleware/locale.go b/modules/web/middleware/locale.go
index fc396f08081..c376c21865c 100644
--- a/modules/web/middleware/locale.go
+++ b/modules/web/middleware/locale.go
@@ -6,8 +6,8 @@ package middleware
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/translation/i18n"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/translation/i18n"
 
 	"golang.org/x/text/language"
 )
diff --git a/modules/web/routemock.go b/modules/web/routemock.go
index 68d19475e9f..bbb8021193f 100644
--- a/modules/web/routemock.go
+++ b/modules/web/routemock.go
@@ -6,7 +6,7 @@ package web
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // MockAfterMiddlewares is a general mock point, it's between middlewares and the handler
diff --git a/modules/web/routemock_test.go b/modules/web/routemock_test.go
index a0949bf622b..0db19f7827b 100644
--- a/modules/web/routemock_test.go
+++ b/modules/web/routemock_test.go
@@ -8,7 +8,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/modules/web/router.go b/modules/web/router.go
index f4575399b9d..66d6ae8e0c9 100644
--- a/modules/web/router.go
+++ b/modules/web/router.go
@@ -9,11 +9,11 @@ import (
 	"reflect"
 	"strings"
 
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/modules/web/types"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/modules/web/types"
 
 	"gitea.com/go-chi/binding"
 	"github.com/go-chi/chi/v5"
@@ -260,7 +260,7 @@ func (r *Router) normalizeRequestPath(resp http.ResponseWriter, req *http.Reques
 			// do not respond to other requests, to simulate a real sub-path environment
 			resp.Header().Add("Content-Type", "text/html; charset=utf-8")
 			resp.WriteHeader(http.StatusNotFound)
-			_, _ = resp.Write([]byte(htmlutil.HTMLFormat(`404 page not found, sub-path is: <a href="%s">%s</a>`, setting.AppSubURL, setting.AppSubURL)))
+			_, _ = htmlutil.HTMLPrintf(resp, `404 page not found, sub-path is: <a href="%s">%s</a>`, setting.AppSubURL, setting.AppSubURL)
 			return
 		}
 		normalized = true
diff --git a/modules/web/router_path.go b/modules/web/router_path.go
index 7278241b6df..5f356fff005 100644
--- a/modules/web/router_path.go
+++ b/modules/web/router_path.go
@@ -9,8 +9,8 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/util"
 
 	"github.com/go-chi/chi/v5"
 )
diff --git a/modules/web/router_test.go b/modules/web/router_test.go
index c1c314f85e1..fc1995773dd 100644
--- a/modules/web/router_test.go
+++ b/modules/web/router_test.go
@@ -10,10 +10,10 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web/types"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web/types"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/assert"
diff --git a/modules/web/routing/context.go b/modules/web/routing/context.go
index 7799a24e948..4ccdd62a5aa 100644
--- a/modules/web/routing/context.go
+++ b/modules/web/routing/context.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/gtprof"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/web/types"
+	"gitea.dev/modules/gtprof"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/web/types"
 )
 
 type contextKeyType struct{}
diff --git a/modules/web/routing/funcinfo.go b/modules/web/routing/funcinfo.go
index f4e9731a630..8a94711c323 100644
--- a/modules/web/routing/funcinfo.go
+++ b/modules/web/routing/funcinfo.go
@@ -130,7 +130,7 @@ func copyFuncInfo(l *FuncInfo) *FuncInfo {
 	}
 }
 
-// shortenFilename generates a short source code filename from a full package path, eg: "code.gitea.io/routers/common/logger_context.go" => "common/logger_context.go"
+// shortenFilename generates a short source code filename from a full package path, eg: "gitea.dev/routers/common/logger_context.go" => "common/logger_context.go"
 func shortenFilename(filename, fallback string) string {
 	if filename == "" {
 		return fallback
diff --git a/modules/web/routing/funcinfo_test.go b/modules/web/routing/funcinfo_test.go
index 974af58931c..aa6a58b594c 100644
--- a/modules/web/routing/funcinfo_test.go
+++ b/modules/web/routing/funcinfo_test.go
@@ -17,7 +17,7 @@ func Test_shortenFilename(t *testing.T) {
 		expected string
 	}{
 		{
-			"code.gitea.io/routers/common/logger_context.go",
+			"gitea.dev/routers/common/logger_context.go",
 			"NO_FALLBACK",
 			"common/logger_context.go",
 		},
diff --git a/modules/web/routing/logger.go b/modules/web/routing/logger.go
index cd139df66bb..4a94b71d6df 100644
--- a/modules/web/routing/logger.go
+++ b/modules/web/routing/logger.go
@@ -7,23 +7,10 @@ import (
 	"net/http"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/web/types"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/web/types"
 )
 
-// NewLoggerHandler is a handler that will log routing to the router log taking account of
-// routing information
-func NewLoggerHandler() func(next http.Handler) http.Handler {
-	manager := requestRecordsManager{
-		requestRecords: map[uint64]*requestRecord{},
-	}
-	manager.startSlowQueryDetector(3 * time.Second)
-
-	logger := log.GetLogger("router")
-	manager.print = logPrinter(logger)
-	return manager.handler
-}
-
 var (
 	startMessage          = log.NewColoredValue("started  ", log.DEBUG.ColorAttributes()...)
 	slowMessage           = log.NewColoredValue("slow     ", log.WARN.ColorAttributes()...)
@@ -89,7 +76,7 @@ func logPrinter(logger log.Logger) func(trigger Event, record *requestRecord) {
 		}
 
 		var status int
-		if v, ok := record.responseWriter.(types.ResponseStatusProvider); ok {
+		if v, ok := record.respWriter.(types.ResponseStatusProvider); ok {
 			status = v.WrittenStatus()
 		}
 		logLevel := record.logLevel
diff --git a/modules/web/routing/logger_manager.go b/modules/web/routing/logger_manager.go
index 2f767c3d669..7e3915013ad 100644
--- a/modules/web/routing/logger_manager.go
+++ b/modules/web/routing/logger_manager.go
@@ -6,13 +6,12 @@ package routing
 import (
 	"context"
 	"fmt"
-	"net/http"
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
 )
 
 // Event indicates when the printer is triggered
@@ -29,26 +28,21 @@ const (
 	EndEvent
 )
 
-// Printer is used to output the log for a request
-type Printer func(trigger Event, record *requestRecord)
+// logPrinterFunc is used to output the log for a request
+type logPrinterFunc func(trigger Event, record *requestRecord)
 
-type requestRecordsManager struct {
-	print Printer
-
-	lock sync.Mutex
-
-	requestRecords map[uint64]*requestRecord
-	count          uint64
+type loggerRequestManager struct {
+	logPrint   logPrinterFunc
+	reqRecords sync.Map // it only contains the active requests which haven't been detected as "slow"
 }
 
-func (manager *requestRecordsManager) startSlowQueryDetector(threshold time.Duration) {
+func (manager *loggerRequestManager) startSlowQueryDetector(threshold time.Duration) {
 	go graceful.GetManager().RunWithShutdownContext(func(ctx context.Context) {
 		ctx, _, finished := process.GetManager().AddTypedContext(ctx, "Service: SlowQueryDetector", process.SystemProcessType, true)
 		defer finished()
 		// This go-routine checks all active requests every second.
 		// If a request has been running for a long time (eg: /user/events), we also print a log with "still-executing" message
 		// After the "still-executing" log is printed, the record will be removed from the map to prevent from duplicated logs in future
-
 		// We do not care about accurate duration here. It just does the check periodically, 0.5s or 1.5s are all OK.
 		t := time.NewTicker(time.Second)
 		for {
@@ -58,69 +52,39 @@ func (manager *requestRecordsManager) startSlowQueryDetector(threshold time.Dura
 			case <-t.C:
 				now := time.Now()
 
-				var slowRequests []*requestRecord
-
-				// find all slow requests with lock
-				manager.lock.Lock()
-				for index, record := range manager.requestRecords {
-					if now.Sub(record.startTime) < threshold {
-						continue
-					}
-
-					slowRequests = append(slowRequests, record)
-					delete(manager.requestRecords, index)
-				}
-				manager.lock.Unlock()
-
 				// print logs for slow requests
-				for _, record := range slowRequests {
-					manager.print(StillExecutingEvent, record)
-				}
+				manager.reqRecords.Range(func(key, value any) bool {
+					index, record := key.(uint64), value.(*requestRecord)
+					if now.Sub(record.startTime) >= threshold {
+						manager.logPrint(StillExecutingEvent, record)
+						manager.reqRecords.Delete(index)
+					}
+					return true
+				})
 			}
 		}
 	})
 }
 
-func (manager *requestRecordsManager) handler(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		record := &requestRecord{
-			startTime:      time.Now(),
-			request:        req,
-			responseWriter: w,
+func (manager *loggerRequestManager) handleRequestRecord(record *requestRecord) func() {
+	manager.reqRecords.Store(record.index, record)
+	manager.logPrint(StartEvent, record)
+
+	return func() {
+		// just in case there is a panic. now the panics are all recovered in middleware.go
+		localPanicErr := recover()
+		if localPanicErr != nil {
+			record.lock.Lock()
+			record.panicError = fmt.Errorf("%v\n%s", localPanicErr, log.Stack(2))
+			record.lock.Unlock()
 		}
 
-		// generate a record index an insert into the map
-		manager.lock.Lock()
-		record.index = manager.count
-		manager.count++
-		manager.requestRecords[record.index] = record
-		manager.lock.Unlock()
+		manager.reqRecords.Delete(record.index)
+		manager.logPrint(EndEvent, record)
 
-		defer func() {
-			// just in case there is a panic. now the panics are all recovered in middleware.go
-			localPanicErr := recover()
-			if localPanicErr != nil {
-				record.lock.Lock()
-				record.panicError = fmt.Errorf("%v\n%s", localPanicErr, log.Stack(2))
-				record.lock.Unlock()
-			}
-
-			// remove from the record map
-			manager.lock.Lock()
-			delete(manager.requestRecords, record.index)
-			manager.lock.Unlock()
-
-			// log the end of the request
-			manager.print(EndEvent, record)
-
-			if localPanicErr != nil {
-				// the panic wasn't recovered before us, so we should pass it up, and let the framework handle the panic error
-				panic(localPanicErr)
-			}
-		}()
-
-		req = req.WithContext(context.WithValue(req.Context(), contextKey, record))
-		manager.print(StartEvent, record)
-		next.ServeHTTP(w, req)
-	})
+		if localPanicErr != nil {
+			// the panic wasn't recovered before us, so we should pass it up, and let the framework handle the panic error
+			panic(localPanicErr)
+		}
+	}
 }
diff --git a/modules/web/routing/requestinfo.go b/modules/web/routing/requestinfo.go
new file mode 100644
index 00000000000..5cbd192cc4a
--- /dev/null
+++ b/modules/web/routing/requestinfo.go
@@ -0,0 +1,43 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package routing
+
+import (
+	"context"
+	"net/http"
+	"sync/atomic"
+	"time"
+
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+)
+
+// NewRequestInfoHandler is a handler that saves request info into request context.
+// If router logger is enabled, it will also print request logs and detect slow requests.
+func NewRequestInfoHandler() func(next http.Handler) http.Handler {
+	var reqLogger *loggerRequestManager
+	if setting.IsRouteLogEnabled() {
+		reqLogger = &loggerRequestManager{
+			logPrint: logPrinter(log.GetLogger("router")),
+		}
+		reqLogger.startSlowQueryDetector(3 * time.Second)
+	}
+	var requestCounter atomic.Uint64
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			record := &requestRecord{
+				index:      requestCounter.Add(1),
+				startTime:  time.Now(),
+				respWriter: w,
+			}
+			req = req.WithContext(context.WithValue(req.Context(), contextKey, record))
+			record.request = req
+			if reqLogger != nil {
+				end := reqLogger.handleRequestRecord(record)
+				defer end()
+			}
+			next.ServeHTTP(w, req)
+		})
+	}
+}
diff --git a/modules/web/routing/requestrecord.go b/modules/web/routing/requestrecord.go
index 898e2f6d47c..d51c95dd399 100644
--- a/modules/web/routing/requestrecord.go
+++ b/modules/web/routing/requestrecord.go
@@ -8,24 +8,24 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 type requestRecord struct {
-	// index of the record in the records map
-	index uint64
-
 	// immutable fields
-	startTime      time.Time
-	request        *http.Request
-	responseWriter http.ResponseWriter
+	index      uint64 // unique number (per process) for the request
+	startTime  time.Time
+	request    *http.Request
+	respWriter http.ResponseWriter
 
 	// mutex
 	lock sync.RWMutex
 
-	// mutable fields
+	// below are mutable fields
+	funcInfo *FuncInfo
+	// * for "mark as long polling"
 	isLongPolling bool
-	logLevel      log.Level
-	funcInfo      *FuncInfo
-	panicError    error
+	// * for router logger
+	logLevel   log.Level
+	panicError error
 }
diff --git a/options/fileicon/material-icon-rules.json b/options/fileicon/material-icon-rules.json
index 57dc1b4c29c..aa967b71003 100644
--- a/options/fileicon/material-icon-rules.json
+++ b/options/fileicon/material-icon-rules.json
@@ -615,6 +615,11 @@
     "_github/workflows": "folder-gh-workflows",
     "-github/workflows": "folder-gh-workflows",
     "__github/workflows__": "folder-gh-workflows",
+    "gitea/workflows": "folder-gitea-workflows",
+    ".gitea/workflows": "folder-gitea-workflows",
+    "_gitea/workflows": "folder-gitea-workflows",
+    "-gitea/workflows": "folder-gitea-workflows",
+    "__gitea/workflows__": "folder-gitea-workflows",
     "git": "folder-git",
     ".git": "folder-git",
     "_git": "folder-git",
@@ -990,6 +995,11 @@
     "_vendors": "folder-lib",
     "-vendors": "folder-lib",
     "__vendors__": "folder-lib",
+    "thirdparty": "folder-lib",
+    ".thirdparty": "folder-lib",
+    "_thirdparty": "folder-lib",
+    "-thirdparty": "folder-lib",
+    "__thirdparty__": "folder-lib",
     "third-party": "folder-lib",
     ".third-party": "folder-lib",
     "_third-party": "folder-lib",
@@ -1000,6 +1010,16 @@
     "_lib64": "folder-lib",
     "-lib64": "folder-lib",
     "__lib64__": "folder-lib",
+    "external": "folder-lib",
+    ".external": "folder-lib",
+    "_external": "folder-lib",
+    "-external": "folder-lib",
+    "__external__": "folder-lib",
+    "externals": "folder-lib",
+    ".externals": "folder-lib",
+    "_externals": "folder-lib",
+    "-externals": "folder-lib",
+    "__externals__": "folder-lib",
     "themes": "folder-theme",
     ".themes": "folder-theme",
     "_themes": "folder-theme",
@@ -4538,6 +4558,11 @@
     "_scrap": "folder-scrap",
     "-scrap": "folder-scrap",
     "__scrap__": "folder-scrap",
+    "postman": "folder-postman",
+    ".postman": "folder-postman",
+    "_postman": "folder-postman",
+    "-postman": "folder-postman",
+    "__postman__": "folder-postman",
     "skill": "folder-skills",
     ".skill": "folder-skills",
     "_skill": "folder-skills",
@@ -4557,7 +4582,42 @@
     ".instructions": "folder-instructions",
     "_instructions": "folder-instructions",
     "-instructions": "folder-instructions",
-    "__instructions__": "folder-instructions"
+    "__instructions__": "folder-instructions",
+    "appwrite": "folder-appwrite",
+    ".appwrite": "folder-appwrite",
+    "_appwrite": "folder-appwrite",
+    "-appwrite": "folder-appwrite",
+    "__appwrite__": "folder-appwrite",
+    "assembly": "folder-assembly",
+    ".assembly": "folder-assembly",
+    "_assembly": "folder-assembly",
+    "-assembly": "folder-assembly",
+    "__assembly__": "folder-assembly",
+    "asm": "folder-assembly",
+    ".asm": "folder-assembly",
+    "_asm": "folder-assembly",
+    "-asm": "folder-assembly",
+    "__asm__": "folder-assembly",
+    "go": "folder-go",
+    ".go": "folder-go",
+    "_go": "folder-go",
+    "-go": "folder-go",
+    "__go__": "folder-go",
+    "golang": "folder-go",
+    ".golang": "folder-go",
+    "_golang": "folder-go",
+    "-golang": "folder-go",
+    "__golang__": "folder-go",
+    "eas": "folder-eas",
+    ".eas": "folder-eas",
+    "_eas": "folder-eas",
+    "-eas": "folder-eas",
+    "__eas__": "folder-eas",
+    "kotlin": "folder-kotlin",
+    ".kotlin": "folder-kotlin",
+    "_kotlin": "folder-kotlin",
+    "-kotlin": "folder-kotlin",
+    "__kotlin__": "folder-kotlin"
   },
   "folderNamesExpanded": {
     "rust": "folder-rust-open",
@@ -5175,6 +5235,11 @@
     "_github/workflows": "folder-gh-workflows-open",
     "-github/workflows": "folder-gh-workflows-open",
     "__github/workflows__": "folder-gh-workflows-open",
+    "gitea/workflows": "folder-gitea-workflows-open",
+    ".gitea/workflows": "folder-gitea-workflows-open",
+    "_gitea/workflows": "folder-gitea-workflows-open",
+    "-gitea/workflows": "folder-gitea-workflows-open",
+    "__gitea/workflows__": "folder-gitea-workflows-open",
     "git": "folder-git-open",
     ".git": "folder-git-open",
     "_git": "folder-git-open",
@@ -5550,6 +5615,11 @@
     "_vendors": "folder-lib-open",
     "-vendors": "folder-lib-open",
     "__vendors__": "folder-lib-open",
+    "thirdparty": "folder-lib-open",
+    ".thirdparty": "folder-lib-open",
+    "_thirdparty": "folder-lib-open",
+    "-thirdparty": "folder-lib-open",
+    "__thirdparty__": "folder-lib-open",
     "third-party": "folder-lib-open",
     ".third-party": "folder-lib-open",
     "_third-party": "folder-lib-open",
@@ -5560,6 +5630,16 @@
     "_lib64": "folder-lib-open",
     "-lib64": "folder-lib-open",
     "__lib64__": "folder-lib-open",
+    "external": "folder-lib-open",
+    ".external": "folder-lib-open",
+    "_external": "folder-lib-open",
+    "-external": "folder-lib-open",
+    "__external__": "folder-lib-open",
+    "externals": "folder-lib-open",
+    ".externals": "folder-lib-open",
+    "_externals": "folder-lib-open",
+    "-externals": "folder-lib-open",
+    "__externals__": "folder-lib-open",
     "themes": "folder-theme-open",
     ".themes": "folder-theme-open",
     "_themes": "folder-theme-open",
@@ -9098,6 +9178,11 @@
     "_scrap": "folder-scrap-open",
     "-scrap": "folder-scrap-open",
     "__scrap__": "folder-scrap-open",
+    "postman": "folder-postman-open",
+    ".postman": "folder-postman-open",
+    "_postman": "folder-postman-open",
+    "-postman": "folder-postman-open",
+    "__postman__": "folder-postman-open",
     "skill": "folder-skills-open",
     ".skill": "folder-skills-open",
     "_skill": "folder-skills-open",
@@ -9117,7 +9202,42 @@
     ".instructions": "folder-instructions-open",
     "_instructions": "folder-instructions-open",
     "-instructions": "folder-instructions-open",
-    "__instructions__": "folder-instructions-open"
+    "__instructions__": "folder-instructions-open",
+    "appwrite": "folder-appwrite-open",
+    ".appwrite": "folder-appwrite-open",
+    "_appwrite": "folder-appwrite-open",
+    "-appwrite": "folder-appwrite-open",
+    "__appwrite__": "folder-appwrite-open",
+    "assembly": "folder-assembly-open",
+    ".assembly": "folder-assembly-open",
+    "_assembly": "folder-assembly-open",
+    "-assembly": "folder-assembly-open",
+    "__assembly__": "folder-assembly-open",
+    "asm": "folder-assembly-open",
+    ".asm": "folder-assembly-open",
+    "_asm": "folder-assembly-open",
+    "-asm": "folder-assembly-open",
+    "__asm__": "folder-assembly-open",
+    "go": "folder-go-open",
+    ".go": "folder-go-open",
+    "_go": "folder-go-open",
+    "-go": "folder-go-open",
+    "__go__": "folder-go-open",
+    "golang": "folder-go-open",
+    ".golang": "folder-go-open",
+    "_golang": "folder-go-open",
+    "-golang": "folder-go-open",
+    "__golang__": "folder-go-open",
+    "eas": "folder-eas-open",
+    ".eas": "folder-eas-open",
+    "_eas": "folder-eas-open",
+    "-eas": "folder-eas-open",
+    "__eas__": "folder-eas-open",
+    "kotlin": "folder-kotlin-open",
+    ".kotlin": "folder-kotlin-open",
+    "_kotlin": "folder-kotlin-open",
+    "-kotlin": "folder-kotlin-open",
+    "__kotlin__": "folder-kotlin-open"
   },
   "rootFolderNames": {},
   "rootFolderNamesExpanded": {},
@@ -12560,6 +12680,11 @@
     "skill.md": "skill",
     "instructions.md": "instructions",
     "instruction.md": "instructions",
+    "appwrite.json": "appwrite",
+    "appwrite.js": "appwrite",
+    "appwrite.ts": "appwrite",
+    "eas.json": "expo",
+    ".easignore": "expo",
     "language-configuration.json": "jsonc",
     "icon-theme.json": "jsonc",
     "color-theme.json": "jsonc",
@@ -12974,7 +13099,9 @@
       "src/bashly-strings.yml": "bashly-strings_light",
       ".shellcheckrc": "shellcheck_light",
       "shellcheckrc": "shellcheck_light",
-      "warp.md": "warp_light"
+      "warp.md": "warp_light",
+      "eas.json": "expo_light",
+      ".easignore": "expo_light"
     },
     "languageIds": {
       "toml": "toml_light",
diff --git a/options/fileicon/material-icon-svgs.json b/options/fileicon/material-icon-svgs.json
index 0a9ebb4ff74..5c673ad3d20 100644
--- a/options/fileicon/material-icon-svgs.json
+++ b/options/fileicon/material-icon-svgs.json
@@ -31,10 +31,11 @@
   "applescript": "<svg viewBox='0 0 32 32'><path fill='#78909c' d='M25.425 26.498c-1.162 1.736-2.394 3.43-4.27 3.458-1.875.042-2.477-1.106-4.605-1.106-2.142 0-2.8 1.078-4.578 1.148-1.834.07-3.22-1.848-4.396-3.542C5.183 23 3.35 16.63 5.813 12.346a6.84 6.84 0 0 1 5.767-3.514c1.792-.028 3.5 1.217 4.606 1.217 1.092 0 3.164-1.497 5.334-1.273a6.5 6.5 0 0 1 5.095 2.771 6.38 6.38 0 0 0-3.01 5.334 6.18 6.18 0 0 0 3.752 5.656 15.5 15.5 0 0 1-1.932 3.961M17.432 4.1A6.36 6.36 0 0 1 21.548 2a6.13 6.13 0 0 1-1.456 4.466 5.11 5.11 0 0 1-4.13 1.988 5.98 5.98 0 0 1 1.47-4.354'/></svg>",
   "apps-script": "<svg viewBox='0 0 32 32'><path fill='#f44336' d='M6.053 20.055H21.21a3.01 3.01 0 0 1 3.049 2.966 3.01 3.01 0 0 1-3.049 2.966H6.053a3.01 3.01 0 0 1-3.049-2.966 3.01 3.01 0 0 1 3.049-2.966'/><path fill='#ffc107' d='M19.44 25.433 7.179 16.765a2.914 2.914 0 0 1-.674-4.143 3.104 3.104 0 0 1 4.258-.656l12.263 8.668a2.914 2.914 0 0 1 .674 4.143 3.104 3.104 0 0 1-4.258.656Z'/><path fill='#43a047' d='m19.489 8.05 4.683 14.026a2.95 2.95 0 0 1-1.957 3.737 3.067 3.067 0 0 1-3.841-1.904L13.69 9.884a2.95 2.95 0 0 1 1.957-3.738 3.067 3.067 0 0 1 3.842 1.905Z'/><path fill='#448aff' d='M18.363 22.076 23.047 8.05a3.067 3.067 0 0 1 3.841-1.904 2.95 2.95 0 0 1 1.958 3.737L24.162 23.91a3.067 3.067 0 0 1-3.842 1.904 2.95 2.95 0 0 1-1.957-3.737Z'/></svg>",
   "appveyor": "<svg preserveAspectRatio='xMidYMid' viewBox='0 0 256 256'><path fill='#00b8d4' fill-rule='evenodd' d='M127.646 17.356c61.588 0 110.999 49.414 110.999 110.29a110.64 110.64 0 0 1-110.999 110.999c-60.873 0-110.29-49.414-110.29-110.999 0-60.873 49.414-110.29 110.29-110.29m27.213 131.77c-12.174 15.756-34.375 18.62-49.414 6.446-15.039-11.459-17.187-33.66-5.013-49.414 12.891-15.039 35.091-17.904 50.131-6.445 15.039 12.174 17.187 34.375 4.297 49.414zm-58.723 72.331 42.252-40.82c-15.756 3.58-32.227.716-45.117-10.026-15.039-11.459-21.484-30.795-19.336-48.699L35.98 163.45s-5.013-9.31-6.446-26.498l66.602-52.278c20.052-14.323 47.266-15.04 66.602 0 21.484 17.187 25.781 48.698 10.027 72.33l-48.699 69.466c-7.161 0-21.484-2.149-27.93-5.013'/></svg>",
+  "appwrite": "<svg viewBox='0 0 16 16'><path fill='#ff4081' d='M7 2a6 6 0 0 0-6 6 6 6 0 0 0 6 6h8v-3H7a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 2.236 1h3.42A6 6 0 0 0 7 2m2.828 5A3 3 0 0 1 10 8a3 3 0 0 1-.764 2H15V7z'/></svg>",
   "architecture": "<svg fill='none' viewBox='0 0 24 24'><path fill='#66bb6a' d='M6.278 22 6 19.556l3.167-8.723a4.37 4.37 0 0 0 1.944 1.056l-3.055 8.389zm11.666 0-1.777-1.722-3.056-8.39q.556-.138 1.042-.402a4.4 4.4 0 0 0 .903-.653l3.166 8.723zm-5.833-11.111q-1.389 0-2.361-.972-.972-.973-.972-2.361 0-1.084.624-1.932.626-.846 1.598-1.18V2h2.222v2.444a3.27 3.27 0 0 1 1.598 1.18q.624.849.624 1.932 0 1.389-.972 2.36-.972.973-2.36.973Zm0-2.222q.473 0 .792-.32t.32-.791q0-.473-.32-.793a1.08 1.08 0 0 0-.792-.319q-.472 0-.791.32t-.32.792.32.79q.319.32.791.32Z'/></svg>",
   "arduino": "<svg viewBox='0 0 32 32'><path fill='#0097a7' d='M2 14h10v2H2zm22-4h2v10h-2z'/><path fill='#0097a7' d='M20 14h10v2H20z'/><path fill='none' stroke='#0097a7' stroke-width='2' d='M2 5h4a10 10 0 0 1 10 10 10 10 0 0 0 10 10h4'/><path fill='#0097a7' d='M11.644 22A8.95 8.95 0 0 1 6 24H2v2h4a10.98 10.98 0 0 0 8.479-4ZM26 4a10.98 10.98 0 0 0-8.479 4h2.835A8.95 8.95 0 0 1 26 6h4V4Z'/></svg>",
   "asciidoc": "<svg viewBox='0 0 32 32'><path fill='#0097a7' d='M4 18V8l5.39 10Zm0 4v3.67A2.33 2.33 0 0 0 6.33 28h8.9l-3.496-6Zm12.444 0 3.177 5.444A11.88 11.88 0 0 0 26.448 22Zm11.419-4A15 15 0 0 0 28 16 12 12 0 0 0 16 4L6 3.995q-.08 0-.158.005L14 18Z'/></svg>",
-  "assembly": "<svg viewBox='0 0 32 32'><path fill='#ff6e40' d='M8 6V2H4a2 2 0 0 0-2 2v24a2 2 0 0 0 2 2h4v-4H4V6Zm16-4v4h4v20h-4v4h4a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2Zm-4 4h-2a2 2 0 0 0-2 2v4a2 2 0 0 0 2 2h2a2 2 0 0 0 2-2V8a2 2 0 0 0-2-2m-2 6V8h2v4Zm-4 6h-2a2 2 0 0 0-2 2v4a2 2 0 0 0 2 2h2a2 2 0 0 0 2-2v-4a2 2 0 0 0-2-2m-2 6v-4h2v4Zm0-18c0 2 0 2-2 2v2h2v4h2V6Zm8 12c0 2 0 2-2 2v2h2v4h2v-8Z'/></svg>",
+  "assembly": "<svg viewBox='0 0 16 16'><path fill='#ff6e40' d='M2 1a1 1 0 0 0-1 1v12a1 1 0 0 0 1 1h2v-1H2V2h2V1Zm10 0v1h2v12h-2v1h2a1 1 0 0 0 1-1V2a1 1 0 0 0-1-1ZM6 3c0 1 0 1-1 1v1h1v2h1V3Zm3 0a1 1 0 0 0-1 1v2a1 1 0 0 0 1 1h1a1 1 0 0 0 1-1V4a1 1 0 0 0-1-1Zm0 1h1v2H9ZM6 9a1 1 0 0 0-1 1v2a1 1 0 0 0 1 1h1a1 1 0 0 0 1-1v-2a1 1 0 0 0-1-1Zm4 0c0 1 0 1-1 1v1h1v2h1V9Zm-4 1h1v2H6Z'/></svg>",
   "astro-config": "<svg viewBox='0 0 32 32'><path fill='#757575' d='M15 2H6a2.006 2.006 0 0 0-2 2v22a2.006 2.006 0 0 0 2 2h6v-4H6v-2h6v-2H6v-2h6v-2H6v-2h6v-2h2V4l8 8h2v-1Z'/><path fill='#7c4dff' d='M12 12v18h18V12Zm10 16c-.9 0-2.025-1.267-2.025-3.005-.914 0-.975.464-.975 1.005-.881-.213-1-1.15-1-2h6c0 1.919-2 1.787-2 4m2.542-6a2.5 2.5 0 0 1-2.308-1.641l-.946-2.42a.305.305 0 0 0-.576 0l-.946 2.42A2.5 2.5 0 0 1 17.458 22H16l2.965-7.59a.63.63 0 0 1 .577-.41h2.916a.63.63 0 0 1 .577.41L26 22Z'/></svg>",
   "astro": "<svg viewBox='0 0 32 32'><path fill='#7c4dff' d='M12.106 25.849c-1.262-1.156-1.63-3.586-1.105-5.346a5.18 5.18 0 0 0 3.484 1.66 9.68 9.68 0 0 0 5.882-.734c.215-.106.413-.247.648-.39a3.5 3.5 0 0 1 .16 1.555 4.26 4.26 0 0 1-1.798 3.021c-.404.3-.832.569-1.25.852a2.613 2.613 0 0 0-1.15 3.372l.048.161a3.4 3.4 0 0 1-1.5-1.285 3.6 3.6 0 0 1-.578-1.962 9 9 0 0 0-.05-1.037c-.114-.831-.504-1.204-1.238-1.225a1.45 1.45 0 0 0-1.507 1.18c-.012.056-.028.112-.046.178M4.901 20a17.75 17.75 0 0 1 7.4-2l2.913-8.38a.765.765 0 0 1 1.527 0L19.7 18a14.24 14.24 0 0 1 7.399 2S20.704 2.877 20.692 2.842C20.51 2.33 20.202 2 19.787 2h-7.619c-.415 0-.71.33-.904.842z'/></svg>",
   "astyle": "<svg viewBox='0 0 24 24'><path fill='#ef5350' d='M8.203 5.447 5.83 6.777l1.329-2.374-1.33-2.374 2.374 1.33 2.374-1.33-1.33 2.374 1.33 2.374zm11.394 9.305 2.374-1.329-1.33 2.374 1.33 2.373-2.374-1.329-2.374 1.33 1.33-2.374-1.33-2.374zm2.374-12.724-1.33 2.374 1.33 2.374-2.374-1.33-2.374 1.33 1.33-2.374-1.33-2.374 2.374 1.33zm-8.223 10.236 2.317-2.316-2.013-2.013-2.317 2.317zm.978-5.212 2.222 2.222c.37.35.37.968 0 1.338L5.867 21.694c-.37.37-.987.37-1.339 0l-2.222-2.221c-.37-.352-.37-.969 0-1.34l11.081-11.08c.37-.37.988-.37 1.34 0z'/></svg>",
@@ -186,6 +187,8 @@
   "eslint": "<svg viewBox='0 0 32 32'><path fill='#3f51b5' d='M22.713 4H9.287a.5.5 0 0 0-.432.248l-6.708 11.5a.5.5 0 0 0 0 .504l6.708 11.5a.5.5 0 0 0 .432.248h13.426a.5.5 0 0 0 .432-.248l6.708-11.5a.5.5 0 0 0 0-.504l-6.708-11.5A.5.5 0 0 0 22.713 4m-6.937 20.888-7.5-3.75A.5.5 0 0 1 8 20.691v-9.382a.5.5 0 0 1 .276-.447l7.5-3.75a.5.5 0 0 1 .448 0l7.5 3.75a.5.5 0 0 1 .276.447v9.382a.5.5 0 0 1-.276.447l-7.5 3.75a.5.5 0 0 1-.448 0'/><path fill='#7986cb' d='M22 19.441v-6.882a.5.5 0 0 0-.276-.447l-5.5-2.75a.5.5 0 0 0-.448 0l-5.5 2.75a.5.5 0 0 0-.276.447v6.882a.5.5 0 0 0 .276.447l5.5 2.75a.5.5 0 0 0 .448 0l5.5-2.75a.5.5 0 0 0 .276-.447'/></svg>",
   "excalidraw": "<svg viewBox='0 0 16 16'><path fill='#5c6bc0' d='m15 1-5 1-9 10 3 3 10-9zm-4 3h1v1h-1zm1 5-3 3 4 3 2-2zM7 4 4 7 2 5 1 1l4 1z'/></svg>",
   "exe": "<svg viewBox='0 0 32 32'><path fill='#e64a19' d='M28 4H4a2 2 0 0 0-2 2v20a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V6a2 2 0 0 0-2-2m0 22H4V10h24Z'/></svg>",
+  "expo": "<svg fill='none' viewBox='0 0 16 16'><path fill='#cfd8dc' d='M9.696 2.672c-.515-.787-.637-.892-1.687-.892h-.025c-1.05 0-1.165.105-1.687.892-.484.74-5.295 9.583-5.295 9.83.008.428.157.841.424 1.176.337.487.92.758 1.343.327.288-.29 3.375-5.63 4.865-7.649a.447.447 0 0 1 .731 0c1.49 2.02 4.578 7.359 4.865 7.649.424.43 1.006.158 1.344-.327.267-.335.416-.748.424-1.176-.007-.247-4.817-9.096-5.302-9.83'/></svg>",
+  "expo_light": "<svg fill='none' viewBox='0 0 16 16'><path fill='#455a64' d='M9.696 2.672c-.515-.787-.637-.892-1.687-.892h-.025c-1.05 0-1.165.105-1.687.892-.484.74-5.295 9.583-5.295 9.83.008.428.157.841.424 1.176.337.487.92.758 1.343.327.288-.29 3.375-5.63 4.865-7.649a.447.447 0 0 1 .731 0c1.49 2.02 4.578 7.359 4.865 7.649.424.43 1.006.158 1.344-.327.267-.335.416-.748.424-1.176-.007-.247-4.817-9.096-5.302-9.83'/></svg>",
   "fastlane": "<svg preserveAspectRatio='xMidYMid' viewBox='0 0 300 300'><path fill='#2979ff' d='M242.745 89.48c-11.223 0-21.398 4.463-28.867 11.7l-47.366-33.917c.295-1.238.469-2.524.469-3.854 0-9.167-7.432-16.6-16.6-16.6s-16.601 7.433-16.601 16.6c0 9.169 7.433 16.6 16.6 16.6 3.21 0 6.197-.927 8.738-2.504L217.1 119.7c4.52-9.428 14.49-16.77 25.645-16.77 15.492 0 28.051 12.558 28.051 28.05 0 12.38-8.02 22.887-19.148 26.608l3.806 12.91c16.703-5.368 28.79-21.03 28.79-39.518 0-22.92-18.579-41.5-41.5-41.5'/><path fill='#e64a19' d='M109.689 49.166c-3.389 10.669-2.22 21.69 2.405 30.977l-46.546 34.784a16.6 16.6 0 0 0-3.523-1.609c-8.716-2.768-18.026 2.053-20.794 10.768s2.053 18.026 10.767 20.794c8.716 2.769 18.026-2.052 20.795-10.767a16.46 16.46 0 0 0 .257-9.062l57.623-42.379c-7.598-7.144-11.567-18.84-8.2-29.444 4.68-14.727 20.411-22.874 35.139-18.195 11.768 3.738 19.334 14.535 19.513 26.238l13.421.28c-.059-17.5-11.299-33.721-28.873-39.304-21.788-6.921-45.063 5.13-51.984 26.92'/><path fill='#00bcd4' d='M32.81 161.347a41.37 41.37 0 0 0 30.043 7.612l18.362 54.878a16.3 16.3 0 0 0-2.621 2.8c-5.338 7.316-3.686 17.611 3.692 22.994 7.377 5.383 17.685 3.815 23.023-3.501 5.34-7.316 3.687-17.61-3.69-22.994a16.53 16.53 0 0 0-8.489-3.13l-22.086-67.718c-9.128 4.87-21.425 4.875-30.402-1.674-12.465-9.097-15.258-26.492-6.237-38.855 7.21-9.88 19.78-13.556 30.9-9.993l4.456-12.536c-16.566-5.525-35.414-.121-46.179 14.631-13.346 18.291-9.214 44.029 9.229 57.486'/><path fill='#8bc34a' d='M245.283 225.838c-3.42-10.583-10.75-18.811-19.884-23.64l17.72-55.05a16.6 16.6 0 0 0 3.796-.739c8.69-2.808 13.47-12.093 10.679-20.737-2.793-8.646-12.102-13.378-20.793-10.57-8.69 2.806-13.472 12.09-10.679 20.736a16.3 16.3 0 0 0 5.036 7.472l-22.334 67.6c10.315 1.374 20.312 8.527 23.71 19.046 4.72 14.61-3.36 30.298-18.044 35.042-11.735 3.791-24.138-.554-31.055-9.908l-11.078 7.543c10.176 14.106 28.706 20.71 46.23 15.048 21.726-7.019 33.678-30.23 26.696-51.843'/><path fill='#a0f' d='M116.724 270.244c9.003-6.587 14.547-16.139 16.291-26.33l57.906-.59a16.5 16.5 0 0 0 1.887 3.366c5.382 7.355 15.706 8.955 23.061 3.574s8.955-15.705 3.575-23.06c-5.382-7.356-15.706-8.956-23.061-3.575a16.4 16.4 0 0 0-5.54 7.137l-71.283.182c1.908 10.217-1.78 21.958-10.73 28.506-12.428 9.093-29.875 6.39-38.968-6.039-7.266-9.932-6.999-23.068-.257-32.585l-10.631-8.123c-10.249 14.11-10.752 33.77.098 48.601 13.453 18.389 39.265 22.389 57.652 8.936'/></svg>",
   "favicon": "<svg viewBox='0 0 32 32'><path fill='#ffd54f' d='m16 24 10 6-4-10 8-8-10-.032L16 2l-4 10H2l8 8-4 10Z'/></svg>",
   "figma": "<svg viewBox='0 0 32 32'><path fill='#f4511e' d='M12 4h4v8h-4a4 4 0 0 1-4-4 4 4 0 0 1 4-4'/><path fill='#ff8a65' d='M20 12h-4V4h4a4 4 0 0 1 4 4 4 4 0 0 1-4 4'/><rect width='8' height='8' x='16' y='12' fill='#29b6f6' rx='4' transform='rotate(180 20 16)'/><path fill='#7c4dff' d='M12 12h4v8h-4a4 4 0 0 1-4-4 4 4 0 0 1 4-4'/><path fill='#00e676' d='M12 20h4v4a4 4 0 0 1-4 4 4 4 0 0 1-4-4 4 4 0 0 1 4-4'/></svg>",
@@ -209,8 +212,12 @@
   "folder-apollo": "<svg viewBox='0 0 32 32'><path fill='#7e57c2' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#d1c4e9' d='M25 28h3l-4-12h-4l-4 12h3l.667-2h3.01L22 24h-1.667L22 19z'/><path fill='#d1c4e9' d='M28 12a2 2 0 0 0-.416.045 10.996 10.996 0 0 0-17.102 13.473 1.003 1.003 0 0 0 1.72-1.034A8.986 8.986 0 0 1 26.1 13.406 2 2 0 0 0 26 14a2 2 0 1 0 2-2'/></svg>",
   "folder-app-open": "<svg viewBox='0 0 32 32'><path fill='#ef5350' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#ffcdd2' d='M16 12h4v4h-4zm6 0h4v4h-4zm6 0h4v4h-4zm-12 6h4v4h-4zm6 0h4v4h-4zm6 0h4v4h-4zm-12 6h4v4h-4zm6 0h4v4h-4zm6 0h4v4h-4z'/></svg>",
   "folder-app": "<svg viewBox='0 0 32 32'><path fill='#ef5350' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#ffcdd2' d='M16 12h4v4h-4zm6 0h4v4h-4zm6 0h4v4h-4zm-12 6h4v4h-4zm6 0h4v4h-4zm6 0h4v4h-4zm-12 6h4v4h-4zm6 0h4v4h-4zm6 0h4v4h-4z'/></svg>",
+  "folder-appwrite-open": "<svg viewBox='0 0 16 16'><path fill='#ff4081' d='M14.483 6H4.721a1 1 0 0 0-.949.684L2 12V5h12a1 1 0 0 0-1-1H7.562a1 1 0 0 1-.64-.232l-.644-.536A1 1 0 0 0 5.638 3H2a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h11l2.403-5.606A1 1 0 0 0 14.483 6'/><path fill='#f8bbd0' d='M10.5 6A4.5 4.5 0 0 0 6 10.5a4.5 4.5 0 0 0 4.5 4.5H16v-2h-5.5A2.5 2.5 0 0 1 8 10.5 2.5 2.5 0 0 1 10.5 8a2.5 2.5 0 0 1 2 1h2.242A4.5 4.5 0 0 0 10.5 6m2.45 4a2.5 2.5 0 0 1 .05.5 2.5 2.5 0 0 1-.5 1.5H16v-2h-1.027z'/></svg>",
+  "folder-appwrite": "<svg viewBox='0 0 16 16'><path fill='#ff4081' d='m6.922 3.768-.644-.536A1 1 0 0 0 5.638 3H2a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1V5a1 1 0 0 0-1-1H7.562a1 1 0 0 1-.64-.232'/><path fill='#f8bbd0' d='M10.5 6A4.5 4.5 0 0 0 6 10.5a4.5 4.5 0 0 0 4.5 4.5H16v-2h-5.5A2.5 2.5 0 0 1 8 10.5 2.5 2.5 0 0 1 10.5 8a2.5 2.5 0 0 1 2 1h2.242A4.5 4.5 0 0 0 10.5 6m2.45 4a2.5 2.5 0 0 1 .05.5 2.5 2.5 0 0 1-.5 1.5H16v-2h-1.027z'/></svg>",
   "folder-archive-open": "<svg viewBox='0 0 1024 1024'><path fill='#ffa726' d='M926.912 384H302.144a64 64 0 0 0-60.736 43.776L128 768V320h768a64 64 0 0 0-64-64H483.968a64 64 0 0 1-40.96-14.848l-41.216-34.304A64 64 0 0 0 360.832 192H128a64 64 0 0 0-64 64v512a64 64 0 0 0 64 64h704l153.792-358.784A64 64 0 0 0 926.912 384'/><path fill='#ffe0b2' d='M512 320c-35.456 0-64 28.544-64 64v64c0 35.456 28.544 64 64 64v320c0 35.456 28.544 64 64 64h320c35.456 0 64-28.544 64-64V512c35.456 0 64-28.544 64-64v-64c0-35.456-28.544-64-64-64zm0 64h448v64H512zm128 128h192v64H640z'/></svg>",
   "folder-archive": "<svg viewBox='0 0 1024 1024'><path fill='#ffa726' d='m443.008 241.152-41.216-34.304A64 64 0 0 0 360.832 192H128a64 64 0 0 0-64 64v512a64 64 0 0 0 64 64h768a64 64 0 0 0 64-64V320a64 64 0 0 0-64-64H483.968a64 64 0 0 1-40.96-14.848'/><path fill='#ffe0b2' d='M512 320c-35.456 0-64 28.544-64 64v64c0 35.456 28.544 64 64 64v320c0 35.456 28.544 64 64 64h320c35.456 0 64-28.544 64-64V512c35.456 0 64-28.544 64-64v-64c0-35.456-28.544-64-64-64zm0 64h448v64H512zm128 128h192v64H640z'/></svg>",
+  "folder-assembly-open": "<svg viewBox='0 0 16 16'><path fill='#ff6e40' d='M14.483 6H4.721a1 1 0 0 0-.949.684L2 12V5h12a1 1 0 0 0-1-1H7.562a1 1 0 0 1-.64-.232l-.644-.536A1 1 0 0 0 5.638 3H2a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h11l2.403-5.606A1 1 0 0 0 14.483 6'/><path fill='#ffccbc' d='M9 6c0 1 0 1-1 1v1h1v2h1V6zm3 0a1 1 0 0 0-1 1v2a1 1 0 0 0 1 1h1a1 1 0 0 0 1-1V7a1 1 0 0 0-1-1zm0 1h1v2h-1zm-3 4a1 1 0 0 0-1 1v2a1 1 0 0 0 1 1h1a1 1 0 0 0 1-1v-2a1 1 0 0 0-1-1zm4 0c0 1 0 1-1 1v1h1v2h1v-4zm-4 1h1v2H9z'/></svg>",
+  "folder-assembly": "<svg viewBox='0 0 16 16'><path fill='#ff6e40' d='m6.922 3.768-.644-.536A1 1 0 0 0 5.638 3H2a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1V5a1 1 0 0 0-1-1H7.562a1 1 0 0 1-.64-.232'/><path fill='#ffccbc' d='M9 6c0 1 0 1-1 1v1h1v2h1V6zm3 0a1 1 0 0 0-1 1v2a1 1 0 0 0 1 1h1a1 1 0 0 0 1-1V7a1 1 0 0 0-1-1zm0 1h1v2h-1zm-3 4a1 1 0 0 0-1 1v2a1 1 0 0 0 1 1h1a1 1 0 0 0 1-1v-2a1 1 0 0 0-1-1zm4 0c0 1 0 1-1 1v1h1v2h1v-4zm-4 1h1v2H9z'/></svg>",
   "folder-astro-open": "<svg viewBox='0 0 32 32'><path fill='#7c4dff' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.367L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#d1c4e9' d='M19.333 27c0-.81.082-1.508 1.3-1.508 0 2.608 1.5 4.508 2.7 4.508 0-3.319 2.667-3.122 2.667-6h-8c0 1.275.158 2.681 1.333 3m5.923-16.385L30 22h-2.333a4 4 0 0 1-3.693-2.462l-1.512-3.63a.5.5 0 0 0-.924 0l-1.512 3.63A4 4 0 0 1 16.333 22H14l4.744-11.385a1 1 0 0 1 .923-.615h4.666a1 1 0 0 1 .923.615'/></svg>",
   "folder-astro": "<svg viewBox='0 0 32 32'><path fill='#7c4dff' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#d1c4e9' d='M19.333 27c0-.81.082-1.508 1.3-1.508 0 2.608 1.5 4.508 2.7 4.508 0-3.319 2.667-3.122 2.667-6h-8c0 1.275.158 2.681 1.333 3m5.923-16.385L30 22h-2.333a4 4 0 0 1-3.693-2.462l-1.512-3.63a.5.5 0 0 0-.924 0l-1.512 3.63A4 4 0 0 1 16.333 22H14l4.744-11.385a1 1 0 0 1 .923-.615h4.666a1 1 0 0 1 .923.615'/></svg>",
   "folder-atom-open": "<svg viewBox='0 0 32 32'><path fill='#1e88e5' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#bbdefb' d='M28.36 10.64a3 3 0 1 1-3 3 2.6 2.6 0 0 1 .14-.84A8.1 8.1 0 0 0 22 12a8 8 0 0 0-8 8l.04.84-1.99.21L12 20a9.996 9.996 0 0 1 14.67-8.84 3 3 0 0 1 1.69-.52m0 2a1 1 0 1 0 1 1 1 1 0 0 0-1-1M15.64 23.36a3.01 3.01 0 0 1 3 3 2.6 2.6 0 0 1-.14.84 8.1 8.1 0 0 0 3.5.8 8 8 0 0 0 8-8l-.04-.84 1.99-.21L32 20a9.996 9.996 0 0 1-14.67 8.84 3 3 0 1 1-1.69-5.48m0 2a1 1 0 1 0 1 1 .997.997 0 0 0-1-1M22 16a4 4 0 1 1-4 4 4 4 0 0 1 4-4'/></svg>",
@@ -339,6 +346,8 @@
   "folder-drizzle": "<svg viewBox='0 0 32 32'><path fill='#4caf50' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#c8e6c9' d='m10.752 27.217 3.127-5.764a1.51 1.51 0 0 0-.573-2.034 1.45 1.45 0 0 0-1.995.586l-3.127 5.763a1.51 1.51 0 0 0 .573 2.034 1.44 1.44 0 0 0 .71.187 1.46 1.46 0 0 0 1.285-.772m10.305 0 3.127-5.764a1.51 1.51 0 0 0-.574-2.034 1.45 1.45 0 0 0-1.995.586l-3.127 5.763a1.51 1.51 0 0 0 .574 2.034 1.44 1.44 0 0 0 .709.187 1.46 1.46 0 0 0 1.286-.772m-2.896-5.21 3.326-5.76a1.507 1.507 0 0 0-.518-2.04 1.447 1.447 0 0 0-2.002.527l-3.326 5.76a1.51 1.51 0 0 0 .519 2.041 1.43 1.43 0 0 0 .74.206 1.46 1.46 0 0 0 1.261-.734m10.31 0 3.327-5.76a1.507 1.507 0 0 0-.518-2.04 1.447 1.447 0 0 0-2.002.527l-3.326 5.76a1.51 1.51 0 0 0 .518 2.041 1.43 1.43 0 0 0 .74.206 1.46 1.46 0 0 0 1.262-.734Z'/></svg>",
   "folder-dump-open": "<svg viewBox='0 0 32 32'><path fill='#757575' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#bdbdbd' d='M26 12H15a1 1 0 0 0-1 1v14a1 1 0 0 0 1 1h14a1 1 0 0 0 1-1V16Zm-10 2h8v4h-8Zm6 12a3 3 0 1 1 3-3 2.996 2.996 0 0 1-3 3'/></svg>",
   "folder-dump": "<svg viewBox='0 0 32 32'><path fill='#757575' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#bdbdbd' d='M26 12H15a1 1 0 0 0-1 1v14a1 1 0 0 0 1 1h14a1 1 0 0 0 1-1V16Zm-10 2h8v4h-8Zm6 12a3 3 0 1 1 3-3 2.996 2.996 0 0 1-3 3'/></svg>",
+  "folder-eas-open.clone": "<svg viewBox='0 0 32 32'><path fill='#424242' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#bdbdbd' d='M25.182 13.148c-.663-1.013-.82-1.148-2.17-1.148h-.032c-1.35 0-1.499.135-2.17 1.148C20.187 14.1 14 25.473 14 25.79a2.5 2.5 0 0 0 .545 1.513c.434.626 1.183.974 1.728.42.37-.373 4.34-7.24 6.257-9.837a.575.575 0 0 1 .94 0c1.916 2.597 5.887 9.464 6.257 9.837.545.554 1.294.204 1.728-.42A2.5 2.5 0 0 0 32 25.79c-.008-.317-6.195-11.699-6.818-12.642'/></svg>",
+  "folder-eas.clone": "<svg viewBox='0 0 32 32'><path fill='#424242' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#bdbdbd' d='M25.182 13.148c-.663-1.013-.82-1.148-2.17-1.148h-.032c-1.35 0-1.499.135-2.17 1.148C20.187 14.1 14 25.473 14 25.79a2.5 2.5 0 0 0 .545 1.513c.434.626 1.183.974 1.728.42.37-.373 4.34-7.24 6.257-9.837a.575.575 0 0 1 .94 0c1.916 2.597 5.887 9.464 6.257 9.837.545.554 1.294.204 1.728-.42A2.5 2.5 0 0 0 32 25.79c-.008-.317-6.195-11.699-6.818-12.642'/></svg>",
   "folder-element-open": "<svg viewBox='0 0 32 32'><path fill='#ab47bc' d='M29 12H9.4a2 2 0 0 0-1.9 1.4L4 24V10h24a2 2 0 0 0-2-2H15.1a2 2 0 0 1-1.3-.5l-1.2-1a2 2 0 0 0-1.3-.5H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.8-11.2A2 2 0 0 0 29 12'/><path fill='#e1bee7' d='m21.15 25.74-8.3-5.2A1.8 1.8 0 0 1 12 19v-.98l9.15 5.72a1.6 1.6 0 0 0 1.7 0L32 18v1a1.8 1.8 0 0 1-.85 1.53l-8.3 5.21a1.6 1.6 0 0 1-1.7 0m0 4-8.3-5.2A1.8 1.8 0 0 1 12 23v-.98l9.15 5.72a1.6 1.6 0 0 0 1.7 0L32 22v1a1.8 1.8 0 0 1-.85 1.53l-8.3 5.21a1.6 1.6 0 0 1-1.7 0m-.08-19.46L12 16l9.07 5.73c.56.36 1.29.36 1.85 0L31.99 16l-9.07-5.72a1.68 1.68 0 0 0-1.85 0'/></svg>",
   "folder-element": "<svg viewBox='0 0 32 32'><path fill='#ab47bc' d='m13.84 7.54-1.28-1.08A2 2 0 0 0 11.28 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.12a2 2 0 0 1-1.28-.46'/><path fill='#e1bee7' d='m21.15 25.74-8.3-5.2A1.8 1.8 0 0 1 12 19v-.98l9.15 5.72a1.6 1.6 0 0 0 1.7 0L32 18v1a1.8 1.8 0 0 1-.85 1.53l-8.3 5.21a1.6 1.6 0 0 1-1.7 0m0 4-8.3-5.2A1.8 1.8 0 0 1 12 23v-.98l9.15 5.72a1.6 1.6 0 0 0 1.7 0L32 22v1a1.8 1.8 0 0 1-.85 1.53l-8.3 5.21a1.6 1.6 0 0 1-1.7 0m-.08-19.46L12 16l9.07 5.72c.56.37 1.29.37 1.85 0L31.99 16l-9.07-5.72a1.68 1.68 0 0 0-1.85 0'/></svg>",
   "folder-enum-open": "<svg viewBox='0 0 32 32'><path fill='#26a69a' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#b2dfdb' d='M16 12v14a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V12a2 2 0 0 0-2-2H18a2 2 0 0 0-2 2m14 14H18v-4h12Zm0-6H18v-4h12Z'/></svg>",
@@ -392,6 +401,8 @@
   "folder-git-open": "<svg viewBox='0 0 32 32'><path fill='#ff7043' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#ffccbc' d='m12.593 18.589 5.784-5.794 1.692 1.7a1.98 1.98 0 0 0 .93 2.233v5.544a1.99 1.99 0 0 0-1 1.731 2.002 2.002 0 0 0 4.003 0A1.99 1.99 0 0 0 23 22.272v-4.864l2.071 2.092a1.2 1.2 0 0 0-.07.5 2.002 2.002 0 1 0 2.002-2.002 1.2 1.2 0 0 0-.5.07l-2.573-2.571a1.98 1.98 0 0 0-1.15-2.342 2.1 2.1 0 0 0-1.281-.09l-1.702-1.692.791-.78a1.975 1.975 0 0 1 2.822 0l7.996 7.996a1.975 1.975 0 0 1 0 2.822l-7.996 7.996a1.975 1.975 0 0 1-2.822 0l-7.996-7.996a1.975 1.975 0 0 1 0-2.822Z'/></svg>",
   "folder-git": "<svg viewBox='0 0 32 32'><path fill='#ff7043' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#ffccbc' d='m12.593 18.589 5.784-5.794 1.692 1.7a1.98 1.98 0 0 0 .93 2.233v5.544a1.99 1.99 0 0 0-1 1.731 2.002 2.002 0 0 0 4.003 0A1.99 1.99 0 0 0 23 22.272v-4.864l2.071 2.092a1.2 1.2 0 0 0-.07.5 2.002 2.002 0 1 0 2.002-2.002 1.2 1.2 0 0 0-.5.07l-2.573-2.571a1.98 1.98 0 0 0-1.15-2.342 2.1 2.1 0 0 0-1.281-.09l-1.702-1.692.791-.78a1.975 1.975 0 0 1 2.822 0l7.996 7.996a1.975 1.975 0 0 1 0 2.822l-7.996 7.996a1.975 1.975 0 0 1-2.822 0l-7.996-7.996a1.975 1.975 0 0 1 0-2.822Z'/></svg>",
   "folder-gitea-open": "<svg viewBox='0 0 32 32'><path fill='#689f38' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#dcedc8' d='M24 14v4h1.5a.5.5 0 0 1 .5.5v5a.5.5 0 0 1-.5.5h-5a.5.5 0 0 1-.5-.5v-5a.5.5 0 0 1 .5-.5H22v-4H12a2 2 0 0 0-2 2v4a2 2 0 0 0 2 2h3.202l.3 2A4.55 4.55 0 0 0 20 28h6a4.55 4.55 0 0 0 4.497-4L32 14Zm-12 6v-4h2.3l.602 4Z'/></svg>",
+  "folder-gitea-workflows-open.clone": "<svg viewBox='0 0 32 32'><path fill='#689f38' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#f1f8e9' d='M24 22v2h-2a2 2 0 0 1-2-2v-4h2v-6h-6v6h2v4a4.004 4.004 0 0 0 4 4h2v2h6v-6Zm-6-6v-2h2v2Zm10 10h-2v-2h2Z'/></svg>",
+  "folder-gitea-workflows.clone": "<svg viewBox='0 0 32 32'><path fill='#689f38' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#f1f8e9' d='M24 22v2h-2a2 2 0 0 1-2-2v-4h2v-6h-6v6h2v4a4.004 4.004 0 0 0 4 4h2v2h6v-6Zm-6-6v-2h2v2Zm10 10h-2v-2h2Z'/></svg>",
   "folder-gitea": "<svg viewBox='0 0 32 32'><path fill='#689f38' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#dcedc8' d='M24 14v4h1.5a.5.5 0 0 1 .5.5v5a.5.5 0 0 1-.5.5h-5a.5.5 0 0 1-.5-.5v-5a.5.5 0 0 1 .5-.5H22v-4H12a2 2 0 0 0-2 2v4a2 2 0 0 0 2 2h3.202l.3 2A4.55 4.55 0 0 0 20 28h6a4.55 4.55 0 0 0 4.497-4L32 14Zm-12 6v-4h2.3l.602 4Z'/></svg>",
   "folder-github-open": "<svg viewBox='0 0 32 32'><path fill='#546e7a' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#eceff1' d='M23 10a9.03 9.03 0 0 0-9 9.063 9.08 9.08 0 0 0 6.157 8.609c.45.072.593-.21.593-.453v-1.532c-2.493.544-3.024-1.214-3.024-1.214a2.42 2.42 0 0 0-.998-1.333c-.82-.561.062-.544.062-.544a1.9 1.9 0 0 1 1.377.933 1.925 1.925 0 0 0 2.62.754 1.96 1.96 0 0 1 .566-1.215c-1.998-.227-4.094-1.007-4.094-4.459a3.52 3.52 0 0 1 .927-2.456 3.26 3.26 0 0 1 .09-2.392s.754-.245 2.474.924a8.6 8.6 0 0 1 4.5 0c1.718-1.169 2.476-.924 2.476-.924a3.26 3.26 0 0 1 .088 2.392 3.52 3.52 0 0 1 .927 2.456c0 3.462-2.105 4.223-4.112 4.45a2.17 2.17 0 0 1 .622 1.676v2.484c0 .244.143.533.602.453A9.08 9.08 0 0 0 23 10'/></svg>",
   "folder-github": "<svg viewBox='0 0 32 32'><path fill='#546e7a' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#eceff1' d='M23 10a9.03 9.03 0 0 0-9 9.063 9.08 9.08 0 0 0 6.157 8.609c.45.072.593-.21.593-.453v-1.532c-2.493.544-3.024-1.214-3.024-1.214a2.42 2.42 0 0 0-.998-1.333c-.82-.561.062-.544.062-.544a1.9 1.9 0 0 1 1.377.933 1.925 1.925 0 0 0 2.62.754 1.96 1.96 0 0 1 .566-1.215c-1.998-.227-4.094-1.007-4.094-4.459a3.52 3.52 0 0 1 .927-2.456 3.26 3.26 0 0 1 .09-2.392s.754-.245 2.474.924a8.6 8.6 0 0 1 4.5 0c1.718-1.169 2.476-.924 2.476-.924a3.26 3.26 0 0 1 .088 2.392 3.52 3.52 0 0 1 .927 2.456c0 3.462-2.105 4.223-4.112 4.45a2.17 2.17 0 0 1 .622 1.676v2.484c0 .244.143.533.602.453A9.08 9.08 0 0 0 23 10'/></svg>",
@@ -399,6 +410,8 @@
   "folder-gitlab": "<svg viewBox='0 0 32 32'><path fill='#757575' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><g data-mit-no-recolor='true'><path fill='#e53935' d='m31.35 17.703-.022-.063-2.339-6.097a.6.6 0 0 0-.24-.291.617.617 0 0 0-.928.353l-1.577 4.831h-6.39l-1.58-4.83a.62.62 0 0 0-.926-.354.6.6 0 0 0-.24.29l-2.337 6.1-.024.06a4.34 4.34 0 0 0 1.44 5.017l.009.006.02.015 3.556 2.667 1.764 1.333 1.072.81a.724.724 0 0 0 .873 0l1.072-.811 1.764-1.334 3.583-2.68.01-.008a4.34 4.34 0 0 0 1.44-5.014'/><path fill='#ef6c00' d='m31.35 17.703-.022-.063a7.9 7.9 0 0 0-3.143 1.413l-5.133 3.883 3.268 2.47 3.581-2.68.011-.009a4.34 4.34 0 0 0 1.44-5.014Z'/><path fill='#f9a825' d='m19.772 25.405 1.764 1.334 1.072.81a.724.724 0 0 0 .873 0l1.072-.81 1.766-1.334-3.27-2.469Z'/><path fill='#ef6c00' d='M17.912 19.053a7.9 7.9 0 0 0-3.141-1.412l-.024.062a4.34 4.34 0 0 0 1.44 5.016l.009.006.02.016 3.556 2.666 3.27-2.471Z'/></g></svg>",
   "folder-global-open": "<svg viewBox='0 0 32 32'><path fill='#5c6bc0' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#c5cae9' d='M22 10a10 10 0 1 0 10 10 10 10 0 0 0-10-10m8 10a8 8 0 0 1-.263 2H26l-2-2v-2h-4v-4h4v2h2v-2.918A8 8 0 0 1 30 20m-16 0a8 8 0 0 1 .123-1.347L18 20h4l2 2-2 2v4a8.01 8.01 0 0 1-8-8'/><path fill='#c5cae9' d='M26 17h2v1h-2z'/></svg>",
   "folder-global": "<svg viewBox='0 0 32 32'><path fill='#5c6bc0' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#c5cae9' d='M22 10a10 10 0 1 0 10 10 10 10 0 0 0-10-10m8 10a8 8 0 0 1-.263 2H26l-2-2v-2h-4v-4h4v2h2v-2.918A8 8 0 0 1 30 20m-16 0a8 8 0 0 1 .123-1.347L18 20h4l2 2-2 2v4a8.01 8.01 0 0 1-8-8'/><path fill='#c5cae9' d='M26 17h2v1h-2z'/></svg>",
+  "folder-go-open": "<svg viewBox='0 0 16 16'><path fill='#00acc1' d='M14.483 6H4.721a1 1 0 0 0-.949.684L2 12V5h12a1 1 0 0 0-1-1H7.562a1 1 0 0 1-.64-.232l-.644-.536A1 1 0 0 0 5.638 3H2a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h11l2.403-5.606A1 1 0 0 0 14.483 6'/><path fill='#b2ebf2' d='M4 10v.5h2V10zm-1.5 1v.5h3V11zM4 12v.5h1.5V12zm9.652-2.996a3.4 3.4 0 0 0-.5.053c-.788.138-1.37.468-1.853 1.101-.45.587-.657 1.245-.537 1.99.08.508.324.938.715 1.274.463.395 1.014.567 1.617.58.172-.02.35-.028.529-.06a3.04 3.04 0 0 0 1.59-.844c.616-.62.874-1.345.762-2.235-.087-.633-.41-1.114-.934-1.47a2.3 2.3 0 0 0-1.389-.39m-.119 1.209a1.08 1.08 0 0 1 1.117.908c.014.066.013.131.02.217-.033.567-.319.99-.842 1.26a1.22 1.22 0 0 1-1.078.039 1.084 1.084 0 0 1-.61-1.246c.146-.62.543-1.008 1.159-1.147q.118-.028.234-.031m-4.627-1.21q-.228.005-.46.047a2.95 2.95 0 0 0-1.856 1.13c-.438.562-.65 1.203-.565 1.915q.108.9.842 1.45c.53.391 1.134.516 1.783.43.789-.104 1.412-.49 1.889-1.11.292-.38.472-.81.545-1.28.026-.176.026-.408.039-.584H8.71c-.1 0-.146.121-.166.16-.093.17-.252.509-.338.711-.046.111-.014.13.125.13h1.28c-.067.09-.119.236-.178.308-.299.333-.677.49-1.127.431a1.03 1.03 0 0 1-.895-1.025c-.007-.53.225-.955.676-1.242.378-.242.781-.3 1.199-.098.14.065.211.137.31.248.087.098.094.093.194.067.41-.105.696-.183 1.113-.288q.057-.014.076-.039.019-.027-.01-.072a2.06 2.06 0 0 0-.769-.922 2.2 2.2 0 0 0-1.295-.367'/></svg>",
+  "folder-go": "<svg viewBox='0 0 16 16'><path fill='#00acc1' d='m6.922 3.768-.644-.536A1 1 0 0 0 5.638 3H2a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1V5a1 1 0 0 0-1-1H7.562a1 1 0 0 1-.64-.232'/><path fill='#b2ebf2' d='M4 10v.5h2V10zm-1.5 1v.5h3V11zM4 12v.5h1.5V12zm9.652-2.996a3.4 3.4 0 0 0-.5.053c-.788.138-1.37.468-1.853 1.101-.45.587-.657 1.245-.537 1.99.08.508.324.938.715 1.274.463.395 1.014.567 1.617.58.172-.02.35-.028.529-.06a3.04 3.04 0 0 0 1.59-.844c.616-.62.874-1.345.762-2.235-.087-.633-.41-1.114-.934-1.47a2.3 2.3 0 0 0-1.389-.39m-.119 1.209a1.08 1.08 0 0 1 1.117.908c.014.066.013.131.02.217-.033.567-.319.99-.842 1.26a1.22 1.22 0 0 1-1.078.039 1.084 1.084 0 0 1-.61-1.246c.146-.62.543-1.008 1.159-1.147q.118-.028.234-.031m-4.627-1.21q-.228.005-.46.047a2.95 2.95 0 0 0-1.856 1.13c-.438.562-.65 1.203-.565 1.915q.108.9.842 1.45c.53.391 1.134.516 1.783.43.789-.104 1.412-.49 1.889-1.11.292-.38.472-.81.545-1.28.026-.176.026-.408.039-.584H8.71c-.1 0-.146.121-.166.16-.093.17-.252.509-.338.711-.046.111-.014.13.125.13h1.28c-.067.09-.119.236-.178.308-.299.333-.677.49-1.127.431a1.03 1.03 0 0 1-.895-1.025c-.007-.53.225-.955.676-1.242.378-.242.781-.3 1.199-.098.14.065.211.137.31.248.087.098.094.093.194.067.41-.105.696-.183 1.113-.288q.057-.014.076-.039.019-.027-.01-.072a2.06 2.06 0 0 0-.769-.922 2.2 2.2 0 0 0-1.295-.367'/></svg>",
   "folder-godot-open": "<svg viewBox='0 0 32 32'><path fill='#42a5f5' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#bbdefb' d='M19.966 10a11.7 11.7 0 0 0-2.665.871 18 18 0 0 0 .166 2.093 11 11 0 0 0-.983.61 9 9 0 0 0-.914.717 18 18 0 0 0-1.779-.989A13 13 0 0 0 12 15.544a18 18 0 0 0 1.21 1.665h.011v5.056l.029.001 3.247.299a.34.34 0 0 1 .316.31l.1 1.367 2.833.192.195-1.262a.345.345 0 0 1 .346-.285h3.426a.346.346 0 0 1 .346.285l.195 1.262 2.833-.192.1-1.367a.345.345 0 0 1 .316-.31l3.246-.299.028-.001v-.404h.002v-4.65h.011A18 18 0 0 0 32 15.545a13 13 0 0 0-1.791-2.242 18 18 0 0 0-1.779.987 9 9 0 0 0-.914-.717 11 11 0 0 0-.982-.61 19 19 0 0 0 .166-2.093 11.8 11.8 0 0 0-2.666-.87 18 18 0 0 0-.99 1.84 7 7 0 0 0-1.037-.08h-.014a7 7 0 0 0-1.037.08 18 18 0 0 0-.99-1.84m-2.569 7.396a1.87 1.87 0 1 1 .11 3.736h-.004a1.87 1.87 0 1 1-.106-3.736m9.206 0a1.87 1.87 0 1 1 .026 3.736h-.025a1.87 1.87 0 1 1-.024-3.736zM22 18.488a.593.593 0 0 1 .63.547v1.72a.626.626 0 0 1-.69.543.62.62 0 0 1-.57-.544v-1.72a.59.59 0 0 1 .63-.546'/><path fill='#bbdefb' d='m27.863 23.203-.1 1.376a.34.34 0 0 1-.324.31l-3.459.234-.026.001a.345.345 0 0 1-.345-.285l-.198-1.284H20.59l-.199 1.284a.345.345 0 0 1-.371.284l-3.459-.236a.345.345 0 0 1-.324-.31l-.1-1.375-2.92-.269.005.693c0 2.944 3.912 4.358 8.772 4.374h.011c4.86-.016 8.772-1.43 8.772-4.374l.005-.693Z'/></svg>",
   "folder-godot": "<svg viewBox='0 0 32 32'><path fill='#42a5f5' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#bbdefb' d='M19.966 10a11.7 11.7 0 0 0-2.665.871 18 18 0 0 0 .166 2.093 11 11 0 0 0-.983.61 9 9 0 0 0-.914.717 18 18 0 0 0-1.779-.989A13 13 0 0 0 12 15.544a18 18 0 0 0 1.21 1.665h.011v5.056l.029.001 3.247.299a.34.34 0 0 1 .316.31l.1 1.367 2.833.192.195-1.262a.345.345 0 0 1 .346-.285h3.426a.346.346 0 0 1 .346.285l.195 1.262 2.833-.192.1-1.367a.345.345 0 0 1 .316-.31l3.246-.299.028-.001v-.404h.002v-4.65h.011A18 18 0 0 0 32 15.545a13 13 0 0 0-1.791-2.242 18 18 0 0 0-1.779.987 9 9 0 0 0-.914-.717 11 11 0 0 0-.982-.61 19 19 0 0 0 .166-2.093 11.8 11.8 0 0 0-2.666-.87 18 18 0 0 0-.99 1.84 7 7 0 0 0-1.037-.08h-.014a7 7 0 0 0-1.037.08 18 18 0 0 0-.99-1.84m-2.569 7.396a1.87 1.87 0 1 1 .11 3.736h-.004a1.87 1.87 0 1 1-.106-3.736m9.206 0a1.87 1.87 0 1 1 .026 3.736h-.025a1.87 1.87 0 1 1-.024-3.736zM22 18.488a.593.593 0 0 1 .63.547v1.72a.626.626 0 0 1-.69.543.62.62 0 0 1-.57-.544v-1.72a.59.59 0 0 1 .63-.546'/><path fill='#bbdefb' d='m27.863 23.203-.1 1.376a.34.34 0 0 1-.324.31l-3.459.234-.026.001a.345.345 0 0 1-.345-.285l-.198-1.284H20.59l-.199 1.284a.345.345 0 0 1-.371.284l-3.459-.236a.345.345 0 0 1-.324-.31l-.1-1.375-2.92-.269.005.693c0 2.944 3.912 4.358 8.772 4.374h.011c4.86-.016 8.772-1.43 8.772-4.374l.005-.693Z'/></svg>",
   "folder-gradle-open": "<svg viewBox='0 0 32 32'><path fill='#0097a7' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#b2ebf2' d='M31.4 13.692a3.3 3.3 0 0 0-2.869-1.691c-1.097-.022-1.998.592-1.828.996a6 6 0 0 0 .369.726c.183.269.51.061.624 0a1.84 1.84 0 0 1 1.124-.194 1.68 1.68 0 0 1 1.276.98c.832 1.618-1.736 4.945-4.95 2.641a8.34 8.34 0 0 0-7.754-1.077c-1.414.465-2.065.932-1.505 2.012a21 21 0 0 0 1.243 2.232c1.17 1.93 3.733-.888 3.733-.888-1.908 2.846-3.544 2.159-4.172 1.164a16 16 0 0 1-1.004-1.93C10.854 20.386 12.161 28 12.161 28h2.4c.611-2.803 2.8-2.699 3.174 0h1.831c1.621-5.475 5.727 0 5.727 0h2.387c-.67-3.732 1.342-4.907 2.61-7.095 1.268-2.19 2.469-4.868 1.11-7.213m-6.158 7.21a1.28 1.28 0 0 1-.845-1.589q.015-.05.034-.099s1.103.36 2.593.852a1.43 1.43 0 0 1-1.782.836'/></svg>",
@@ -457,6 +470,8 @@
   "folder-jupyter": "<svg viewBox='0 0 32 32'><path fill='#ff9800' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><g fill='#ffe0b2' data-mit-no-recolor='true' transform='matrix(.7 0 0 .7 10 10)'><path d='M6.2 18a22.7 22.7 0 0 0 9.8 2 22.7 22.7 0 0 0 9.8-2 10.002 10.002 0 0 1-19.6 0m0-4a22.7 22.7 0 0 1 9.8-2 22.7 22.7 0 0 1 9.8 2 10.002 10.002 0 0 0-19.6 0'/><circle cx='27' cy='5' r='3'/><circle cx='5' cy='27' r='3'/><circle cx='5' cy='5' r='3'/></g></svg>",
   "folder-keys-open": "<svg viewBox='0 0 32 32'><path fill='#26a69a' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#b2dfdb' d='M21.651 20a6 6 0 1 0 0 4H26v4h4v-4h2v-4ZM16 24a2 2 0 1 1 2-2 2 2 0 0 1-2 2'/></svg>",
   "folder-keys": "<svg viewBox='0 0 32 32'><path fill='#26a69a' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#b2dfdb' d='M21.651 20a6 6 0 1 0 0 4H26v4h4v-4h2v-4ZM16 24a2 2 0 1 1 2-2 2 2 0 0 1-2 2'/></svg>",
+  "folder-kotlin-open": "<svg viewBox='0 0 16 16'><path fill='#9c27b0' d='M14.483 6H4.721a1 1 0 0 0-.949.684L2 12V5h12a1 1 0 0 0-1-1H7.562a1 1 0 0 1-.64-.232l-.644-.536A1 1 0 0 0 5.638 3H2a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h11l2.403-5.606A1 1 0 0 0 14.483 6'/><path fill='#e1bee7' d='M8 6v8h8l-4-4 4-4z'/></svg>",
+  "folder-kotlin": "<svg viewBox='0 0 16 16'><path fill='#9c27b0' d='m6.922 3.768-.644-.536A1 1 0 0 0 5.638 3H2a1 1 0 0 0-1 1v8a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1V5a1 1 0 0 0-1-1H7.562a1 1 0 0 1-.64-.232'/><path fill='#e1bee7' d='M8 6v8h8l-4-4 4-4z'/></svg>",
   "folder-kubernetes-open": "<svg viewBox='0 0 32 32'><path fill='#448aff' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#bbdefb' d='M22.069 10.463a.6.6 0 0 0-.116.003.59.59 0 0 0-.517.635v.16a3.6 3.6 0 0 0 .08.543 5.2 5.2 0 0 1 .065 1.018.6.6 0 0 1-.186.305l-.013.238a7 7 0 0 0-1.031.157 7.27 7.27 0 0 0-3.706 2.117l-.196-.145a.52.52 0 0 1-.346-.039 5.4 5.4 0 0 1-.765-.69 5 5 0 0 0-.372-.395l-.12-.093a.75.75 0 0 0-.397-.158.6.6 0 0 0-.463.197.61.61 0 0 0 .148.834l.013.013c.026.027.079.067.106.093a4 4 0 0 0 .475.277 5.4 5.4 0 0 1 .848.597.6.6 0 0 1 .106.33l.183.158a7.22 7.22 0 0 0-1.137 5.121l-.25.065a.8.8 0 0 1-.254.253 4.4 4.4 0 0 1-1.018.158 2 2 0 0 0-.543.051l-.144.029h-.013v.013c-.04 0-.08.013-.106.013a.57.57 0 1 0 .339 1.086l.004-.001a1 1 0 0 0 .174-.041 2.7 2.7 0 0 0 .488-.197 7 7 0 0 1 1.018-.292.5.5 0 0 1 .305.119l.263-.039a7.43 7.43 0 0 0 3.27 4.088l-.094.238a.7.7 0 0 1 .042.33 4.2 4.2 0 0 1-.517.913c-.106.159-.199.304-.318.462a.17.17 0 0 1-.052.148c-.013.04-.04.066-.054.106a.57.57 0 0 0 1.072.382c.027-.04.051-.132.078-.132a5 5 0 0 0 .16-.53 5 5 0 0 1 .437-1.017.45.45 0 0 1 .25-.12l.132-.237a7.4 7.4 0 0 0 5.254.013l.105.212a.5.5 0 0 1 .277.183 6 6 0 0 1 .398.954c.04.172.094.344.16.542.027 0 .051.08.078.12.013.039.028.065.041.105a.568.568 0 0 0 .984-.569l-.007-.012a1 1 0 0 1-.052-.16c-.106-.146-.212-.305-.318-.45a7.4 7.4 0 0 1-.501-.9.44.44 0 0 1 .039-.343 1 1 0 0 1-.093-.225 7.44 7.44 0 0 0 3.268-4.113c.08.013.158.025.251.038a.33.33 0 0 1 .305-.106 4.7 4.7 0 0 1 1.018.28 2.6 2.6 0 0 0 .475.196.7.7 0 0 0 .187.028v.013c0 .013.053.013.093.026a.585.585 0 0 0 .635-.491.57.57 0 0 0-.483-.645l-.008-.001a.34.34 0 0 1-.157-.067h-.543a6.6 6.6 0 0 1-1.018-.186.55.55 0 0 1-.253-.238l-.251-.064a7.2 7.2 0 0 0-1.165-5.109l.211-.184a.4.4 0 0 1 .106-.317 5 5 0 0 1 .848-.597 3.3 3.3 0 0 0 .462-.277 1 1 0 0 0 .12-.093c.039-.026.08-.053.08-.08a.556.556 0 0 0-.78-.793c-.04 0-.093.054-.133.08a10 10 0 0 0-.372.395 4.8 4.8 0 0 1-.767.69.5.5 0 0 1-.344.039l-.212.158a7.37 7.37 0 0 0-4.708-2.274l-.013-.253a.45.45 0 0 1-.186-.29 5.2 5.2 0 0 1 .065-1.018 3.6 3.6 0 0 0 .08-.543v-.292a.57.57 0 0 0-.504-.506m-.778 4.408-.16 2.977h-.013a.5.5 0 0 1-.106.28.5.5 0 0 1-.687.118h-.013l-2.434-1.734a5.75 5.75 0 0 1 2.803-1.535c.212-.04.412-.08.61-.106m1.427 0a5.9 5.9 0 0 1 3.4 1.641l-2.421 1.734h-.013a.6.6 0 0 1-.277.067.494.494 0 0 1-.516-.47v-.008Zm-5.727 2.713 2.223 2.024v.013a.34.34 0 0 1 .144.253.483.483 0 0 1-.323.602l-.02.005v.013l-2.858.822a5.9 5.9 0 0 1 .834-3.732m10.013.04a6.18 6.18 0 0 1 .86 3.679l-2.87-.822-.013-.013a.47.47 0 0 1-.238-.157.49.49 0 0 1 .042-.694l.01-.01-.013-.038Zm-5.462 2.144h.912l.568.7-.199.886-.819.398-.819-.398-.212-.886Zm-2.132 2.447h.106a.55.55 0 0 1 .504.382.5.5 0 0 1-.052.28v.038l-1.127 2.74a5.84 5.84 0 0 1-2.366-2.952Zm4.87 0h.319l2.948.475a5.85 5.85 0 0 1-2.367 2.977l-1.14-2.79a.53.53 0 0 1 .24-.662m-2.327 1.199a.51.51 0 0 1 .488.256h.013l1.442 2.607a5 5 0 0 1-.569.157 5.9 5.9 0 0 1-3.214-.157l1.442-2.607h.012c.04-.093.107-.133.2-.2a.5.5 0 0 1 .186-.056'/></svg>",
   "folder-kubernetes": "<svg viewBox='0 0 32 32'><path fill='#448aff' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#bbdefb' d='M22.069 10.463a.6.6 0 0 0-.116.003.59.59 0 0 0-.517.635v.16a3.6 3.6 0 0 0 .08.543 5.2 5.2 0 0 1 .065 1.018.6.6 0 0 1-.186.305l-.013.238a7 7 0 0 0-1.031.157 7.27 7.27 0 0 0-3.706 2.117l-.196-.145a.52.52 0 0 1-.346-.039 5.4 5.4 0 0 1-.765-.69 5 5 0 0 0-.372-.395l-.12-.093a.75.75 0 0 0-.397-.158.6.6 0 0 0-.463.197.61.61 0 0 0 .148.834l.013.013c.026.027.079.067.106.093a4 4 0 0 0 .475.277 5.4 5.4 0 0 1 .848.597.6.6 0 0 1 .106.33l.183.158a7.22 7.22 0 0 0-1.137 5.121l-.25.065a.8.8 0 0 1-.254.253 4.4 4.4 0 0 1-1.018.158 2 2 0 0 0-.543.051l-.144.029h-.013v.013c-.04 0-.08.013-.106.013a.57.57 0 1 0 .339 1.086l.004-.001a1 1 0 0 0 .174-.041 2.7 2.7 0 0 0 .488-.197 7 7 0 0 1 1.018-.292.5.5 0 0 1 .305.119l.263-.039a7.43 7.43 0 0 0 3.27 4.088l-.094.238a.7.7 0 0 1 .042.33 4.2 4.2 0 0 1-.517.913c-.106.159-.199.304-.318.462a.17.17 0 0 1-.052.148c-.013.04-.04.066-.054.106a.57.57 0 0 0 1.072.382c.027-.04.051-.132.078-.132a5 5 0 0 0 .16-.53 5 5 0 0 1 .437-1.017.45.45 0 0 1 .25-.12l.132-.237a7.4 7.4 0 0 0 5.254.013l.105.212a.5.5 0 0 1 .277.183 6 6 0 0 1 .398.954c.04.172.094.344.16.542.027 0 .051.08.078.12.013.039.028.065.041.105a.568.568 0 0 0 .984-.569l-.007-.012a1 1 0 0 1-.052-.16c-.106-.146-.212-.305-.318-.45a7.4 7.4 0 0 1-.501-.9.44.44 0 0 1 .039-.343 1 1 0 0 1-.093-.225 7.44 7.44 0 0 0 3.268-4.113c.08.013.158.025.251.038a.33.33 0 0 1 .305-.106 4.7 4.7 0 0 1 1.018.28 2.6 2.6 0 0 0 .475.196.7.7 0 0 0 .187.028v.013c0 .013.053.013.093.026a.585.585 0 0 0 .635-.491.57.57 0 0 0-.483-.645l-.008-.001a.34.34 0 0 1-.157-.067h-.543a6.6 6.6 0 0 1-1.018-.186.55.55 0 0 1-.253-.238l-.251-.064a7.2 7.2 0 0 0-1.165-5.109l.211-.184a.4.4 0 0 1 .106-.317 5 5 0 0 1 .848-.597 3.3 3.3 0 0 0 .462-.277 1 1 0 0 0 .12-.093c.039-.026.08-.053.08-.08a.556.556 0 0 0-.78-.793c-.04 0-.093.054-.133.08a10 10 0 0 0-.372.395 4.8 4.8 0 0 1-.767.69.5.5 0 0 1-.344.039l-.212.158a7.37 7.37 0 0 0-4.708-2.274l-.013-.253a.45.45 0 0 1-.186-.29 5.2 5.2 0 0 1 .065-1.018 3.6 3.6 0 0 0 .08-.543v-.292a.57.57 0 0 0-.504-.506m-.778 4.408-.16 2.977h-.013a.5.5 0 0 1-.106.28.5.5 0 0 1-.687.118h-.013l-2.434-1.734a5.75 5.75 0 0 1 2.803-1.535c.212-.04.412-.08.61-.106m1.427 0a5.9 5.9 0 0 1 3.4 1.641l-2.421 1.734h-.013a.6.6 0 0 1-.277.067.494.494 0 0 1-.516-.47v-.008Zm-5.727 2.713 2.223 2.024v.013a.34.34 0 0 1 .144.253.483.483 0 0 1-.323.602l-.02.005v.013l-2.858.822a5.9 5.9 0 0 1 .834-3.732m10.013.04a6.18 6.18 0 0 1 .86 3.679l-2.87-.822-.013-.013a.47.47 0 0 1-.238-.157.49.49 0 0 1 .042-.694l.01-.01-.013-.038Zm-5.462 2.144h.912l.568.7-.199.886-.819.398-.819-.398-.212-.886Zm-2.132 2.447h.106a.55.55 0 0 1 .504.382.5.5 0 0 1-.052.28v.038l-1.127 2.74a5.84 5.84 0 0 1-2.366-2.952Zm4.87 0h.319l2.948.475a5.85 5.85 0 0 1-2.367 2.977l-1.14-2.79a.53.53 0 0 1 .24-.662m-2.327 1.199a.51.51 0 0 1 .488.256h.013l1.442 2.607a5 5 0 0 1-.569.157 5.9 5.9 0 0 1-3.214-.157l1.442-2.607h.012c.04-.093.107-.133.2-.2a.5.5 0 0 1 .186-.056'/></svg>",
   "folder-kusto-open": "<svg viewBox='0 0 32 32'><path fill='#1e88e5' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#bbdefb' d='M25 10c-3.878 0-7 3.122-7 7v7h7c3.878 0 7-3.122 7-7s-3.122-7-7-7m3 4h2v6h-2zm-8 2h2v4h-2zm4 2h2v2h-2zm-8 2-3.996.02v2.322L12 24h4zm-4 6v4h4v-4zm6 0v4h4v-4z'/></svg>",
@@ -566,6 +581,8 @@
   "folder-plugin": "<svg viewBox='0 0 32 32'><path fill='#0288d1' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#b3e5fc' d='M30.107 20H32v-4a2 2 0 0 0-2-2h-4v-2a2 2 0 0 0-4 0v2h-4a2 2 0 0 0-2 2v4h-2a2 2 0 0 0 0 4h2v4a2 2 0 0 0 2 2h4v-1.893a2.074 2.074 0 0 1 1.664-2.08A2 2 0 0 1 26 28v2h4a2 2 0 0 0 2-2v-4h-2a2 2 0 0 1-1.973-2.336A2.074 2.074 0 0 1 30.107 20'/></svg>",
   "folder-policy-open": "<svg viewBox='0 0 32 32'><path fill='#0288d1' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#90caf9' d='m21.972 21.668.697.696a1.004 1.004 0 0 0 1.414 0l5.626-5.623a1.003 1.003 0 0 0 0-1.413l-.697-.707a1.004 1.004 0 0 0-1.414 0l-.707.707-1.404-1.404a1.003 1.003 0 0 0 0-1.413.99.99 0 0 0-1.404 0l-1.414-1.423.707-.687a.99.99 0 0 0 0-1.403l-.707-.707a.99.99 0 0 0-1.404 0l-5.636 5.633a.99.99 0 0 0 0 1.404l.707.706a.99.99 0 0 0 1.404 0l.717-.706 1.394 1.413-9.56 9.555a1.003 1.003 0 0 0 0 1.413.99.99 0 0 0 1.404 0l9.57-9.565 1.404 1.404-.697.706a.985.985 0 0 0 0 1.414M24 26h6a2 2 0 0 1 2 2v2H22v-2a2 2 0 0 1 2-2'/></svg>",
   "folder-policy": "<svg viewBox='0 0 32 32'><path fill='#0288d1' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#90caf9' d='m21.972 21.668.697.696a1.004 1.004 0 0 0 1.414 0l5.626-5.623a1.003 1.003 0 0 0 0-1.413l-.697-.707a1.004 1.004 0 0 0-1.414 0l-.707.707-1.404-1.404a1.003 1.003 0 0 0 0-1.413.99.99 0 0 0-1.404 0l-1.414-1.423.707-.687a.99.99 0 0 0 0-1.403l-.707-.707a.99.99 0 0 0-1.404 0l-5.636 5.633a.99.99 0 0 0 0 1.404l.707.706a.99.99 0 0 0 1.404 0l.717-.706 1.394 1.413-9.56 9.555a1.003 1.003 0 0 0 0 1.413.99.99 0 0 0 1.404 0l9.57-9.565 1.404 1.404-.697.706a.985.985 0 0 0 0 1.414M24 26h6a2 2 0 0 1 2 2v2H22v-2a2 2 0 0 1 2-2'/></svg>",
+  "folder-postman-open": "<svg viewBox='0 0 32 32'><path fill='#ff6e40' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#ffccbc' d='M22.984 10c-4.997 0-9.043 4.045-8.983 9.043 0 4.997 4.045 9.042 9.042 8.983 1.354 0 2.708-.292 3.947-.932l-6.207-6.207a.54.54 0 0 1-.179-.417.54.54 0 0 1 .179-.416l7.972-7.972C27.148 10.714 25.125 10 22.984 10m6.663 2.915-7.615 7.555 6.009 6.01c.476-.298.951-.715 1.308-1.072 3.391-3.39 3.57-8.923.298-12.493m-.45 4.545c.298-.01.591.162.688.452.595 1.19.416 2.618-.476 3.748a.67.67 0 0 1-.952.12.723.723 0 0 1-.06-.953c.477-.654.596-1.546.239-2.26 0-.06-.06-.12-.06-.179-.119-.357.06-.773.417-.892a.7.7 0 0 1 .204-.036'/></svg>",
+  "folder-postman": "<svg viewBox='0 0 32 32'><path fill='#ff6e40' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#ffccbc' d='M23.098 10.01c-4.998 0-9.043 4.045-8.984 9.042 0 4.997 4.046 9.043 9.043 8.983 1.354 0 2.708-.291 3.947-.931l-6.208-6.208a.54.54 0 0 1-.178-.416.54.54 0 0 1 .178-.417l7.972-7.971c-1.606-1.369-3.629-2.083-5.77-2.083m6.663 2.915-7.615 7.555 6.009 6.009c.475-.298.951-.714 1.308-1.071 3.391-3.391 3.57-8.924.298-12.493m-.45 4.544c.298-.01.59.163.688.453.594 1.19.416 2.617-.476 3.748a.67.67 0 0 1-.952.119.72.72 0 0 1-.06-.952c.476-.655.595-1.547.238-2.26 0-.06-.06-.12-.06-.18-.118-.356.06-.773.417-.892a.7.7 0 0 1 .205-.036'/></svg>",
   "folder-powershell-open": "<svg viewBox='0 0 32 32'><path fill='#03a9f4' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#b3e5fc' d='M31.25 14.034a1 1 0 0 0-.285-.034H14.496a1.03 1.03 0 0 0-.996.731l-3.461 12A1.007 1.007 0 0 0 11.035 28h16.469a1.03 1.03 0 0 0 .996-.731l3.461-12a1.007 1.007 0 0 0-.71-1.235ZM15.001 26a1 1 0 0 1-.556-1.832l4.986-3.323-3.138-3.138a1 1 0 0 1 1.414-1.414l4 4a1 1 0 0 1-.152 1.54l-6 4A1 1 0 0 1 15 26ZM26 26h-4a1 1 0 0 1 0-2h4a1 1 0 0 1 0 2'/></svg>",
   "folder-powershell": "<svg viewBox='0 0 32 32'><path fill='#03a9f4' d='m13.844 7.536-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h24a2 2 0 0 0 2-2V10a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464'/><path fill='#b3e5fc' d='M31.25 14.034a1 1 0 0 0-.285-.034H14.496a1.03 1.03 0 0 0-.996.731l-3.461 12A1.007 1.007 0 0 0 11.035 28h16.469a1.03 1.03 0 0 0 .996-.731l3.461-12a1.007 1.007 0 0 0-.71-1.235ZM15.001 26a1 1 0 0 1-.556-1.832l4.986-3.323-3.138-3.138a1 1 0 0 1 1.414-1.414l4 4a1 1 0 0 1-.152 1.54l-6 4A1 1 0 0 1 15 26ZM26 26h-4a1 1 0 0 1 0-2h4a1 1 0 0 1 0 2'/></svg>",
   "folder-prisma-open": "<svg viewBox='0 0 32 32'><path fill='#00bfa5' d='M28.967 12H9.442a2 2 0 0 0-1.898 1.368L4 24V10h24a2 2 0 0 0-2-2H15.124a2 2 0 0 1-1.28-.464l-1.288-1.072A2 2 0 0 0 11.276 6H4a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h22l4.805-11.212A2 2 0 0 0 28.967 12'/><path fill='#a7ffeb' d='m30.209 26.275-9.76 2.39a.42.42 0 0 1-.51-.224.3.3 0 0 1-.012-.165l3.486-13.827a.35.35 0 0 1 .412-.21.34.34 0 0 1 .221.15l6.457 11.352a.362.362 0 0 1-.218.51zm1.672-.564-7.475-13.144a1.335 1.335 0 0 0-1.647-.453 1.2 1.2 0 0 0-.468.357l-8.106 10.873a.87.87 0 0 0 .014 1.092l3.964 5.083a1.41 1.41 0 0 0 1.432.435l11.503-2.816a1.22 1.22 0 0 0 .79-.567.86.86 0 0 0-.007-.86'/></svg>",
diff --git a/options/locale/locale_en-US.json b/options/locale/locale_en-US.json
index d15a4ab9935..aa4b3904c35 100644
--- a/options/locale/locale_en-US.json
+++ b/options/locale/locale_en-US.json
@@ -105,6 +105,7 @@
   "copy_error": "Copy failed",
   "copy_type_unsupported": "This file type cannot be copied",
   "copy_filename": "Copy filename",
+  "copy_output": "Copy output",
   "write": "Write",
   "preview": "Preview",
   "loading": "Loading…",
@@ -313,7 +314,6 @@
   "install.admin_email": "Email Address",
   "install.install_btn_confirm": "Install Gitea",
   "install.test_git_failed": "Could not test 'git' command: %v",
-  "install.sqlite3_not_available": "This Gitea version does not support SQLite3. Please download the official binary version from %s (not the 'gobuild' version).",
   "install.invalid_db_setting": "The database settings are invalid: %v",
   "install.invalid_db_table": "The database table \"%s\" is invalid: %v",
   "install.invalid_repo_path": "The repository root path is invalid: %v",
@@ -1308,7 +1308,7 @@
   "repo.editor.upload_file_is_locked": "File \"%s\" is locked by %s.",
   "repo.editor.upload_files_to_dir": "Upload files to \"%s\"",
   "repo.editor.cannot_commit_to_protected_branch": "Cannot commit to protected branch \"%s\".",
-  "repo.editor.no_commit_to_branch": "Unable to commit directly to branch because:",
+  "repo.editor.no_commit_to_branch": "Not allowed to commit directly to branch because:",
   "repo.editor.user_no_push_to_branch": "User cannot push to branch",
   "repo.editor.require_signed_commit": "Branch requires a signed commit",
   "repo.editor.cherry_pick": "Cherry-pick %s onto:",
@@ -1324,7 +1324,7 @@
   "repo.commits.desc": "Browse source code change history.",
   "repo.commits.commits": "Commits",
   "repo.commits.no_commits": "No commits in common. \"%s\" and \"%s\" have entirely different histories.",
-  "repo.commits.nothing_to_compare": "These branches are equal.",
+  "repo.commits.nothing_to_compare": "There are no differences to show.",
   "repo.commits.search.tooltip": "You can prefix keywords with \"author:\", \"committer:\", \"after:\", or \"before:\", e.g. \"revert author:Alice before:2019-01-13\".",
   "repo.commits.search_branch": "This Branch",
   "repo.commits.search_all": "All Branches",
@@ -1786,9 +1786,9 @@
   "repo.pulls.select_commit_hold_shift_for_range": "Select commit. Hold Shift and click to select a range.",
   "repo.pulls.review_only_possible_for_full_diff": "Review is only possible when viewing the full diff",
   "repo.pulls.filter_changes_by_commit": "Filter by commit",
-  "repo.pulls.nothing_to_compare": "These branches are equal. There is no need to create a pull request.",
+  "repo.pulls.nothing_to_compare": "There are no differences to show. There is no need to create a pull request.",
   "repo.pulls.no_common_history": "These branches do not share a common merge base. Select a different base or compare branch.",
-  "repo.pulls.nothing_to_compare_have_tag": "The selected branches/tags are equal.",
+  "repo.pulls.nothing_to_compare_have_tag": "There are no differences to show between the selected branches or tags.",
   "repo.pulls.nothing_to_compare_and_allow_empty_pr": "These branches are equal. This PR will be empty.",
   "repo.pulls.has_pull_request": "A pull request between these branches already exists: <a href=\"%[1]s\">%[2]s#%[3]d</a>",
   "repo.pulls.create": "Create Pull Request",
@@ -1822,6 +1822,7 @@
   "repo.pulls.required_status_check_failed": "Some required checks were not successful.",
   "repo.pulls.required_status_check_missing": "Some required checks are missing.",
   "repo.pulls.required_status_check_administrator": "As an administrator, you may still merge this pull request.",
+  "repo.pulls.required_status_check_bypass_allowlist": "You are allowed to bypass branch protection rules for this merge.",
   "repo.pulls.blocked_by_approvals": "This pull request doesn't have enough required approvals yet. %d of %d official approvals granted.",
   "repo.pulls.blocked_by_approvals_whitelisted": "This pull request doesn't have enough required approvals yet. %d of %d approvals granted from users or teams on the allowlist.",
   "repo.pulls.blocked_by_rejection": "This pull request has changes requested by an official reviewer.",
@@ -1960,7 +1961,6 @@
   "repo.signing.wont_sign.headsigned": "The merge will not be signed as the head commit is not signed.",
   "repo.signing.wont_sign.commitssigned": "The merge will not be signed as all the associated commits are not signed.",
   "repo.signing.wont_sign.approved": "The merge will not be signed as the PR is not approved.",
-  "repo.signing.wont_sign.not_signed_in": "You are not signed in.",
   "repo.ext_wiki": "Access to External Wiki",
   "repo.ext_wiki.desc": "Link to an external wiki.",
   "repo.wiki": "Wiki",
@@ -2142,7 +2142,9 @@
   "repo.settings.pulls_desc": "Enable Repository Pull Requests",
   "repo.settings.pulls.ignore_whitespace": "Ignore Whitespace for Conflicts",
   "repo.settings.pulls.enable_autodetect_manual_merge": "Enable autodetect manual merge (Note: In some special cases, misjudgments can occur)",
+  "repo.settings.pulls.allow_merge_update": "Enable updating pull request branch by merge",
   "repo.settings.pulls.allow_rebase_update": "Enable updating pull request branch by rebase",
+  "repo.settings.pulls.default_update_style": "Default branch update style",
   "repo.settings.pulls.default_target_branch": "Default target branch for new pull requests",
   "repo.settings.pulls.default_target_branch_default": "Default branch (%s)",
   "repo.settings.pulls.default_delete_branch_after_merge": "Delete pull request branch after merge by default",
@@ -2417,6 +2419,11 @@
   "repo.settings.protect_merge_whitelist_committers_desc": "Allow only allowlisted users or teams to merge pull requests into this branch.",
   "repo.settings.protect_merge_whitelist_users": "Allowlisted users for merging:",
   "repo.settings.protect_merge_whitelist_teams": "Allowlisted teams for merging:",
+  "repo.settings.protect_bypass_allowlist": "Bypass branch protection",
+  "repo.settings.protect_enable_bypass_allowlist": "Allow selected users or teams to bypass branch protection",
+  "repo.settings.protect_enable_bypass_allowlist_desc": "Allowlisted users or teams can merge or push even when required approvals, status checks, or protected-file rules would otherwise block them.",
+  "repo.settings.protect_bypass_allowlist_users": "Allowlisted users for bypassing protection:",
+  "repo.settings.protect_bypass_allowlist_teams": "Allowlisted teams for bypassing protection:",
   "repo.settings.protect_check_status_contexts": "Enable Status Check",
   "repo.settings.protect_status_check_patterns": "Status check patterns:",
   "repo.settings.protect_status_check_patterns_desc": "Enter patterns to specify which status checks must pass before branches can be merged into a branch that matches this rule. Each line specifies a pattern. Patterns cannot be empty.",
@@ -2458,7 +2465,7 @@
   "repo.settings.block_outdated_branch": "Block merge if pull request is outdated",
   "repo.settings.block_outdated_branch_desc": "Merging will not be possible when head branch is behind base branch.",
   "repo.settings.block_admin_merge_override": "Administrators must follow branch protection rules",
-  "repo.settings.block_admin_merge_override_desc": "Administrators must follow branch protection rules and cannot circumvent it.",
+  "repo.settings.block_admin_merge_override_desc": "Administrators must follow branch protection rules and cannot circumvent it. Users or teams in the bypass allowlist can still bypass these rules if bypass allowlist is enabled.",
   "repo.settings.default_branch_desc": "Select a default branch for code commits.",
   "repo.settings.default_target_branch_desc": "Pull requests can use different default target branch if it is set in the Pull Requests section of Repository Advance Settings.",
   "repo.settings.merge_style_desc": "Merge Styles",
@@ -2720,6 +2727,7 @@
   "graphs.code_frequency.what": "code frequency",
   "graphs.contributors.what": "contributions",
   "graphs.recent_commits.what": "recent commits",
+  "graphs.chart_zoom_hint": "drag: zoom, shift+drag: pan, double click: reset zoom",
   "org.org_name_holder": "Organization Name",
   "org.org_full_name_holder": "Organization Full Name",
   "org.org_name_helper": "Organization names should be short and memorable.",
@@ -3626,7 +3634,13 @@
   "packages.terraform.delete.latest": "The latest version of a Terraform state cannot be deleted.",
   "packages.vagrant.install": "To add a Vagrant box, run the following command:",
   "packages.settings.link": "Link this package to a repository",
-  "packages.settings.link.description": "If you link a package with a repository, the package will appear in the repository's package list. Only repositories under the same owner can be linked. Leaving the field empty will remove the link.",
+  "packages.settings.link.description": "If you link a package with a repository, the package will appear in the repository's package list.",
+  "packages.settings.link.notice1": "Only repositories under the same owner can be linked.",
+  "packages.settings.link.notice2": "Linking a repository does not change the package visibility.",
+  "packages.settings.link.notice3": "Leaving the field empty will remove the link.",
+  "packages.settings.visibility": "Package visibility",
+  "packages.settings.visibility.inherit": "Package visibility is inherited from the owner and cannot be changed independently here. To change it, update the visibility settings of the user or organization that owns this package.",
+  "packages.settings.visibility.button": "Change owner visibility",
   "packages.settings.link.select": "Select Repository",
   "packages.settings.link.button": "Update Repository Link",
   "packages.settings.link.success": "Repository link was successfully updated.",
@@ -3700,6 +3714,7 @@
   "actions.status.success": "Success",
   "actions.status.failure": "Failure",
   "actions.status.cancelled": "Canceled",
+  "actions.status.cancelling": "Canceling",
   "actions.status.skipped": "Skipped",
   "actions.status.blocked": "Blocked",
   "actions.runners": "Runners",
@@ -3747,6 +3762,8 @@
   "actions.runners.reset_registration_token_confirm": "Would you like to invalidate the current token and generate a new one?",
   "actions.runners.reset_registration_token_success": "Runner registration token reset successfully",
   "actions.runs.all_workflows": "All Workflows",
+  "actions.runs.other_workflows": "Other workflows",
+  "actions.runs.other_workflows_tooltip": "Workflows that were executed in this repository but do not exist on the default branch.",
   "actions.runs.workflow_run_count_1": "%d workflow run",
   "actions.runs.workflow_run_count_n": "%d workflow runs",
   "actions.runs.commit": "Commit",
@@ -3762,6 +3779,8 @@
   "actions.runs.status": "Status",
   "actions.runs.actors_no_select": "All actors",
   "actions.runs.status_no_select": "All status",
+  "actions.runs.branch": "Branch",
+  "actions.runs.branches_no_select": "All branches",
   "actions.runs.no_results": "No results matched.",
   "actions.runs.no_workflows": "There are no workflows yet.",
   "actions.runs.no_workflows.quick_start": "Don't know how to start with Gitea Actions? See <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"%s\">the quick start guide</a>.",
@@ -3776,11 +3795,23 @@
   "actions.runs.view_workflow_file": "View workflow file",
   "actions.runs.summary": "Summary",
   "actions.runs.all_jobs": "All jobs",
+  "actions.runs.expand_caller_jobs": "Show jobs of this reusable workflow caller",
+  "actions.runs.collapse_caller_jobs": "Hide jobs of this reusable workflow caller",
   "actions.runs.attempt": "Attempt",
   "actions.runs.latest": "Latest",
   "actions.runs.latest_attempt": "Latest attempt",
   "actions.runs.triggered_via": "Triggered via %s",
   "actions.runs.total_duration": "Total duration:",
+  "actions.runs.workflow_dependencies": "Workflow Dependencies",
+  "actions.runs.graph_jobs_count_1": "%d job",
+  "actions.runs.graph_jobs_count_n": "%d jobs",
+  "actions.runs.graph_dependencies_count_1": "%d dependency",
+  "actions.runs.graph_dependencies_count_n": "%d dependencies",
+  "actions.runs.graph_success_rate": "%s success",
+  "actions.runs.graph_zoom_in": "Zoom in (Ctrl/Cmd + scroll on graph)",
+  "actions.runs.graph_zoom_max": "Already at 100% zoom",
+  "actions.runs.graph_zoom_out": "Zoom out (Ctrl/Cmd + scroll on graph)",
+  "actions.runs.graph_reset_view": "Reset view",
   "actions.workflow.disable": "Disable Workflow",
   "actions.workflow.disable_success": "Workflow '%s' disabled successfully.",
   "actions.workflow.enable": "Enable Workflow",
diff --git a/options/locale/locale_fr-FR.json b/options/locale/locale_fr-FR.json
index 870e1be56fe..5cfa7498b96 100644
--- a/options/locale/locale_fr-FR.json
+++ b/options/locale/locale_fr-FR.json
@@ -105,6 +105,7 @@
   "copy_error": "Échec de la copie",
   "copy_type_unsupported": "Ce type de fichier ne peut pas être copié",
   "copy_filename": "Copier le nom du fichier",
+  "copy_output": "Copier la sortie",
   "write": "Écrire",
   "preview": "Aperçu",
   "loading": "Chargement…",
@@ -313,7 +314,6 @@
   "install.admin_email": "Courriel",
   "install.install_btn_confirm": "Installer Gitea",
   "install.test_git_failed": "Le test de la commande \"git\" a échoué : %v",
-  "install.sqlite3_not_available": "Cette version de Gitea ne supporte pas SQLite3. Veuillez télécharger la version binaire officielle de %s (pas la version 'gobuild').",
   "install.invalid_db_setting": "Les paramètres de la base de données sont invalides : %v",
   "install.invalid_db_table": "La table \"%s\" de la base de données est invalide : %v",
   "install.invalid_repo_path": "Le chemin racine du dépôt est invalide : %v",
@@ -1306,7 +1306,7 @@
   "repo.editor.upload_file_is_locked": "Le fichier \"%s\" est verrouillé par %s.",
   "repo.editor.upload_files_to_dir": "Téléverser les fichiers vers \"%s\"",
   "repo.editor.cannot_commit_to_protected_branch": "Impossible de créer une révision sur la branche protégée \"%s\".",
-  "repo.editor.no_commit_to_branch": "Impossible d'enregistrer la révision directement sur la branche parce que :",
+  "repo.editor.no_commit_to_branch": "Impossible de réviser cette branche car :",
   "repo.editor.user_no_push_to_branch": "L'utilisateur ne peut pas pousser vers la branche",
   "repo.editor.require_signed_commit": "Cette branche nécessite une révision signée",
   "repo.editor.cherry_pick": "Picorer %s vers:",
@@ -1322,7 +1322,7 @@
   "repo.commits.desc": "Naviguer dans l'historique des modifications.",
   "repo.commits.commits": "Révisions",
   "repo.commits.no_commits": "Pas de révisions en commun. \"%s\" et \"%s\" ont des historiques entièrement différents.",
-  "repo.commits.nothing_to_compare": "Ces branches sont égales.",
+  "repo.commits.nothing_to_compare": "Ces révisions sont équivalentes.",
   "repo.commits.search.tooltip": "Vous pouvez utiliser les mots-clés \"author:\", \"committer:\", \"after:\", ou \"before:\" pour filtrer votre recherche, ex.: \"revert author:Alice before:2019-01-13\".",
   "repo.commits.search_branch": "Cette branche",
   "repo.commits.search_all": "Toutes les branches",
@@ -1784,9 +1784,9 @@
   "repo.pulls.select_commit_hold_shift_for_range": "Maintenir Maj et cliquer sur des révisions pour sélectionner un ensemble de révisions.",
   "repo.pulls.review_only_possible_for_full_diff": "Une évaluation n'est possible que lorsque vous affichez le différentiel complet.",
   "repo.pulls.filter_changes_by_commit": "Filtrer par révision",
-  "repo.pulls.nothing_to_compare": "Ces branches sont identiques. Il n’y a pas besoin de créer une demande d'ajout.",
+  "repo.pulls.nothing_to_compare": "Ces branches ou étiquettes sont équivalentes, il n’est pas nécessaire de créer une demande d’ajout.",
   "repo.pulls.no_common_history": "Ces branches ne partagent pas de base de fusion commune. Sélectionnez une autre base ou branche de comparaison.",
-  "repo.pulls.nothing_to_compare_have_tag": "Les branches/étiquettes sélectionnées sont équivalentes.",
+  "repo.pulls.nothing_to_compare_have_tag": "Ces branches ou étiquettes sont équivalentes.",
   "repo.pulls.nothing_to_compare_and_allow_empty_pr": "Ces branches sont égales. Cette demande d'ajout sera vide.",
   "repo.pulls.has_pull_request": "'Il existe déjà une demande d'ajout entre ces deux branches : <a href=\"%[1]s\">%[2]s#%[3]d</a>'",
   "repo.pulls.create": "Créer une demande d'ajout",
@@ -1820,6 +1820,7 @@
   "repo.pulls.required_status_check_failed": "Certains contrôles requis n'ont pas réussi.",
   "repo.pulls.required_status_check_missing": "Certains contrôles requis sont manquants.",
   "repo.pulls.required_status_check_administrator": "En tant qu'administrateur, vous pouvez toujours fusionner cette requête de pull.",
+  "repo.pulls.required_status_check_bypass_allowlist": "Vous êtes autorisé à contourner les règles de protection pour cette fusion.",
   "repo.pulls.blocked_by_approvals": "Cette demande d’ajout n’est pas suffisamment approuvée. %d approbations obtenues sur %d.",
   "repo.pulls.blocked_by_approvals_whitelisted": "Cette demande d’ajout n’a pas encore assez d’approbations. %d sur %d approbations de la part des utilisateurs ou équipes sur la liste autorisée.",
   "repo.pulls.blocked_by_rejection": "Cette demande d’ajout nécessite des corrections sollicitées par un évaluateur officiel.",
@@ -1958,7 +1959,6 @@
   "repo.signing.wont_sign.headsigned": "La fusion ne sera pas signée car la dernière révision n’est pas signée.",
   "repo.signing.wont_sign.commitssigned": "La fusion ne sera pas signée car ses révisions ne sont pas signées.",
   "repo.signing.wont_sign.approved": "La fusion ne sera pas signée car la demande d'ajout n'a pas été approuvée.",
-  "repo.signing.wont_sign.not_signed_in": "Vous n'êtes pas connecté.",
   "repo.ext_wiki": "Accès au wiki externe",
   "repo.ext_wiki.desc": "Lier un wiki externe.",
   "repo.wiki": "Wiki",
@@ -2140,7 +2140,9 @@
   "repo.settings.pulls_desc": "Activer les demandes de fusion",
   "repo.settings.pulls.ignore_whitespace": "Ignorer les espaces lors des conflits",
   "repo.settings.pulls.enable_autodetect_manual_merge": "Activer la détection automatique de la fusion manuelle (Remarque : dans certains cas particuliers, des erreurs de détection peuvent se produire)",
+  "repo.settings.pulls.allow_merge_update": "Activer la mise à jour d’une demande d’ajout par rebase",
   "repo.settings.pulls.allow_rebase_update": "Activer la mise à jour de demande d'ajout par rebase",
+  "repo.settings.pulls.default_update_style": "Style de mise à jour de la branche par défaut",
   "repo.settings.pulls.default_target_branch": "Branche cible par défaut pour les nouvelles demandes d’ajout",
   "repo.settings.pulls.default_target_branch_default": "Branche par défaut (%s)",
   "repo.settings.pulls.default_delete_branch_after_merge": "Supprimer la branche après la fusion par default",
@@ -2415,6 +2417,11 @@
   "repo.settings.protect_merge_whitelist_committers_desc": "N’autoriser que les utilisateurs et les équipes listés à appliquer les demandes de fusion sur cette branche.",
   "repo.settings.protect_merge_whitelist_users": "Utilisateurs autorisés à fusionner :",
   "repo.settings.protect_merge_whitelist_teams": "Équipes autorisées à fusionner :",
+  "repo.settings.protect_bypass_allowlist": "Contourner la protection de la branche",
+  "repo.settings.protect_enable_bypass_allowlist": "Autoriser des utilisateurs et des équipes à contourner les restrictions de branche",
+  "repo.settings.protect_enable_bypass_allowlist_desc": "Les utilisateurs ou équipes autorisés peuvent fusionner ou pousser des changements nonobstant les règles d’approbations, de vérifications de statut et les protections fichiers.",
+  "repo.settings.protect_bypass_allowlist_users": "Liste d’utilisateurs autorisés à contourner les protections :",
+  "repo.settings.protect_bypass_allowlist_teams": "Liste d’équipes autorisées à contourner les protections :",
   "repo.settings.protect_check_status_contexts": "Activer le Contrôle Qualité",
   "repo.settings.protect_status_check_patterns": "Motifs de vérification des statuts :",
   "repo.settings.protect_status_check_patterns_desc": "Entrez des motifs pour spécifier quelles vérifications doivent réussir avant que des branches puissent être fusionnées. Un motif par ligne. Un motif ne peut être vide.",
@@ -2456,7 +2463,7 @@
   "repo.settings.block_outdated_branch": "Bloquer la fusion si la demande d'ajout est obsolète",
   "repo.settings.block_outdated_branch_desc": "La fusion ne sera pas possible lorsque la branche principale est derrière la branche de base.",
   "repo.settings.block_admin_merge_override": "Les administrateurs doivent respecter les règles de protection des branches",
-  "repo.settings.block_admin_merge_override_desc": "Les administrateurs doivent respecter les règles de protection des branches et ne peuvent pas les contourner.",
+  "repo.settings.block_admin_merge_override_desc": "Les administrateurs sont également soumis aux règles de protection des branches. En activant la liste d’autorisation de contournement, les utilisateurs et équipes qui y figurent peuvent toujours contourner ces règles.",
   "repo.settings.default_branch_desc": "Sélectionnez une branche par défaut pour les révisions.",
   "repo.settings.default_target_branch_desc": "Les demandes d’ajout peuvent utiliser une branche cible différente, telle que définie dans la section Demandes d’ajouts des Paramètres avancés du dépôt.",
   "repo.settings.merge_style_desc": "Styles de fusion",
@@ -3433,7 +3440,7 @@
   "action.transfer_repo": "a transféré le dépôt <code>%s</code> vers <a href=\"%s\">%s</a>",
   "action.push_tag": "a poussé l’étiquette <a href=\"%[2]s\">%[3]s</a> de <a href=\"%[1]s\">%[4]s</a>",
   "action.delete_tag": "a supprimé l’étiquette %[2]s de <a href=\"%[1]s\">%[3]s</a>",
-  "action.delete_branch": "a supprimée la branche %[2]s de <a href=\"%[1]s\">%[3]s</a>",
+  "action.delete_branch": "a supprimé la branche %[2]s de <a href=\"%[1]s\">%[3]s</a>",
   "action.compare_branch": "Comparer",
   "action.compare_commits": "Comparer %d révisions",
   "action.compare_commits_general": "Comparer les révisions",
@@ -3624,7 +3631,13 @@
   "packages.terraform.delete.latest": "La dernière version d’un état Terraform ne peut pas être supprimée.",
   "packages.vagrant.install": "Pour ajouter une machine Vagrant, exécutez la commande suivante :",
   "packages.settings.link": "Lier ce paquet à un dépôt",
-  "packages.settings.link.description": "Si vous associez un paquet à un dépôt, le paquet sera inclus dans sa liste des paquets. Seul les dépôts d’un même propriétaire peuvent être associés. Laisser ce champ vide supprimera le lien.",
+  "packages.settings.link.description": "Si vous liez un paquet à dépôt, il sera visible dans sa liste des paquets.",
+  "packages.settings.link.notice1": "Seuls les dépôts du même propriétaire peuvent être liés.",
+  "packages.settings.link.notice2": "Lier un dépôt ne modifie pas la visibilité du paquet.",
+  "packages.settings.link.notice3": "Laisser le champ vide supprimera le lien.",
+  "packages.settings.visibility": "Visibilité du paquet",
+  "packages.settings.visibility.inherit": "La visibilité du paquet est héritée depuis le propriétaire et ne peut pas être modifiée ici. Pour la modifier, mettez à jour les paramètres de visibilité de l’utilisateur ou de l'organisation propriétaire de ce paquet.",
+  "packages.settings.visibility.button": "Modifier la visibilité du propriétaire",
   "packages.settings.link.select": "Sélectionner un dépôt",
   "packages.settings.link.button": "Actualiser le lien du dépôt",
   "packages.settings.link.success": "Le lien du dépôt a été mis à jour avec succès.",
@@ -3698,6 +3711,7 @@
   "actions.status.success": "Succès",
   "actions.status.failure": "Échec",
   "actions.status.cancelled": "Annulé",
+  "actions.status.cancelling": "Annulation",
   "actions.status.skipped": "Ignoré",
   "actions.status.blocked": "Bloqué",
   "actions.runners": "Exécuteurs",
@@ -3745,6 +3759,8 @@
   "actions.runners.reset_registration_token_confirm": "Voulez-vous révoquer le jeton actuel et en générer un nouveau ?",
   "actions.runners.reset_registration_token_success": "Le jeton d’inscription de l’exécuteur a été réinitialisé avec succès",
   "actions.runs.all_workflows": "Tous les flux de travail",
+  "actions.runs.other_workflows": "Autres flux de travail",
+  "actions.runs.other_workflows_tooltip": "Les flux de travail qui ont été exécutés dans ce dépôt mais qui n’existent pas dans la branche par défaut.",
   "actions.runs.workflow_run_count_1": "%d exécution du workflow",
   "actions.runs.workflow_run_count_n": "%d exécutions du workflow",
   "actions.runs.commit": "Révision",
@@ -3760,6 +3776,8 @@
   "actions.runs.status": "Statut",
   "actions.runs.actors_no_select": "Tous les acteurs",
   "actions.runs.status_no_select": "Touts les statuts",
+  "actions.runs.branch": "Branche",
+  "actions.runs.branches_no_select": "Toutes les branches",
   "actions.runs.no_results": "Aucun résultat correspondant.",
   "actions.runs.no_workflows": "Il n'y a pas encore de workflows.",
   "actions.runs.no_workflows.quick_start": "Vous découvrez les Actions Gitea ? Consultez <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"%s\">le didacticiel</a>.",
diff --git a/options/locale/locale_ga-IE.json b/options/locale/locale_ga-IE.json
index 3584e0b5979..3e3fd8746f3 100644
--- a/options/locale/locale_ga-IE.json
+++ b/options/locale/locale_ga-IE.json
@@ -105,6 +105,7 @@
   "copy_error": "Theip ar an gcóipeáil",
   "copy_type_unsupported": "Ní féidir an cineál comhaid seo a chóipeáil",
   "copy_filename": "Cóipeáil ainm comhaid",
+  "copy_output": "Cóipeáil aschur",
   "write": "Scríobh",
   "preview": "Réamhamharc",
   "loading": "Á lódáil...",
@@ -313,7 +314,6 @@
   "install.admin_email": "Seoladh ríomhphoist",
   "install.install_btn_confirm": "Suiteáil Gitea",
   "install.test_git_failed": "Ní féidir ordú 'git' a thástáil: %v",
-  "install.sqlite3_not_available": "Ní thacaíonn an leagan Gitea seo le SQLite3. Íoslódáil an leagan dénártha oifigiúil ó %s (ní an leagan 'gobuild').",
   "install.invalid_db_setting": "Tá na socruithe bunachar sonraí neamhbhailí:%v",
   "install.invalid_db_table": "Tá an tábla bunachar sonraí \"%s\" neamhbhailí: %v",
   "install.invalid_repo_path": "Tá cosán fréimhe an stór neamhbhailí:%v",
@@ -1306,7 +1306,7 @@
   "repo.editor.upload_file_is_locked": "Tá comhad \"%s\" faoi ghlas ag %s.",
   "repo.editor.upload_files_to_dir": "Uaslódáil comhaid go \"%s\"",
   "repo.editor.cannot_commit_to_protected_branch": "Ní féidir gealltanas a thabhairt don bhrainse faoi chosaint \"%s\".",
-  "repo.editor.no_commit_to_branch": "Ní féidir tiomantas a thabhairt go díreach don bhrainse mar:",
+  "repo.editor.no_commit_to_branch": "Ní cheadaítear gealltanas díreach a thabhairt don bhrainse mar gheall ar:",
   "repo.editor.user_no_push_to_branch": "Ní féidir leis an úsáideoir brúigh go dtí an brainse",
   "repo.editor.require_signed_commit": "Éilíonn an Brainse tiomantas sínithe",
   "repo.editor.cherry_pick": "Roghnaigh silíní %s ar:",
@@ -1322,7 +1322,7 @@
   "repo.commits.desc": "Brabhsáil stair athraithe cód foinse.",
   "repo.commits.commits": "Tiomáintí",
   "repo.commits.no_commits": "Níl aon ghealltanas i gcoiteann. Tá stair iomlán difriúil ag \"%s\" agus \"%s\".",
-  "repo.commits.nothing_to_compare": "Tá na brainsí seo cothrom.",
+  "repo.commits.nothing_to_compare": "Níl aon difríochtaí le taispeáint.",
   "repo.commits.search.tooltip": "Is féidir eochairfhocail a réamhfhostú le “údar:”, “committer:”, “after:”, nó “before:”, e.g. \"fill an t-údar:Alice roimh: 2019-01-13\".",
   "repo.commits.search_branch": "An Brainse seo",
   "repo.commits.search_all": "Gach Brainse",
@@ -1784,9 +1784,9 @@
   "repo.pulls.select_commit_hold_shift_for_range": "Roghnaigh tiomantas. Coinnigh síos Shift agus cliceáil chun raon a roghnú.",
   "repo.pulls.review_only_possible_for_full_diff": "Ní féidir athbhreithniú a dhéanamh ach amháin nuair a bhreathnaítear ar an difríocht iomlán",
   "repo.pulls.filter_changes_by_commit": "Scagaigh de réir tiomantas",
-  "repo.pulls.nothing_to_compare": "Tá na brainsí seo cothrom. Ní gá iarratas tarraingthe a chruthú.",
+  "repo.pulls.nothing_to_compare": "Níl aon difríochtaí le taispeáint. Níl aon ghá iarratas tarraingthe a chruthú.",
   "repo.pulls.no_common_history": "Níl bonn cumaisc coitianta ag na brainsí seo. Roghnaigh bonn difriúil nó cuir brainse i gcomparáid.",
-  "repo.pulls.nothing_to_compare_have_tag": "Tá na brainsí/clibeanna roghnaithe comhionann.",
+  "repo.pulls.nothing_to_compare_have_tag": "Níl aon difríochtaí le taispeáint idir na brainsí nó na clibeanna roghnaithe.",
   "repo.pulls.nothing_to_compare_and_allow_empty_pr": "Tá na brainsí seo cothrom. Beidh an PR seo folamh.",
   "repo.pulls.has_pull_request": "Tá iarratas tarraingthe idir na brainsí seo ann cheana: <a href=\"%[1]s\">%[2]s#%[3]d</a>",
   "repo.pulls.create": "Cruthaigh Iarratas Tarraing",
@@ -1820,6 +1820,7 @@
   "repo.pulls.required_status_check_failed": "Níor éirigh le roinnt seiceálacha riachtanacha.",
   "repo.pulls.required_status_check_missing": "Tá roinnt seiceanna riachtanacha ar iarraidh.",
   "repo.pulls.required_status_check_administrator": "Mar riarthóir, féadfaidh tú an t-iarratas tarraingthe seo a chumasc fós.",
+  "repo.pulls.required_status_check_bypass_allowlist": "Ceadaítear duit rialacha cosanta brainse a sheachbhóthar don chumasc seo.",
   "repo.pulls.blocked_by_approvals": "Níl go leor ceadaithe ag an iarraidh tarraingthe seo fós. Deonaíodh %d den fhaomhadh %d.",
   "repo.pulls.blocked_by_approvals_whitelisted": "Níl go leor ceaduithe riachtanacha ag an iarratas tarraingte seo go fóill. %d de %d faomhadh tugtha ó úsáideoirí nó foirne ar an liosta ceadaithe.",
   "repo.pulls.blocked_by_rejection": "Tá athruithe ag athbhreithneoir oifigiúil ag an iarratas tarraingthe seo.",
@@ -1958,7 +1959,6 @@
   "repo.signing.wont_sign.headsigned": "Ní shínífear an cumasc toisc nach bhfuil an tiomantas ceann sínithe.",
   "repo.signing.wont_sign.commitssigned": "Ní shínífear an cumasc toisc nach bhfuil na tiomáintí gaolmhara go léir sínithe.",
   "repo.signing.wont_sign.approved": "Ní shíníofar an cumaisc toisc nach bhfuil an PR ceadaithe.",
-  "repo.signing.wont_sign.not_signed_in": "Níl tú sínithe isteach.",
   "repo.ext_wiki": "Rochtain ar Vicí Seachtrach",
   "repo.ext_wiki.desc": "Nasc le vicí seachtrach.",
   "repo.wiki": "Vicí",
@@ -2140,7 +2140,9 @@
   "repo.settings.pulls_desc": "Cumasaigh Iarratais Tarraingthe Stóras",
   "repo.settings.pulls.ignore_whitespace": "Déan neamhaird de spás bán le haghaidh coinbhleachtaí",
   "repo.settings.pulls.enable_autodetect_manual_merge": "Cumasaigh cumasc láimhe autodetector (Nóta: I roinnt cásanna speisialta, is féidir míbhreithiúnais tarlú)",
+  "repo.settings.pulls.allow_merge_update": "Cumasaigh brainse iarratais tarraingthe a nuashonrú trí chumasc",
   "repo.settings.pulls.allow_rebase_update": "Cumasaigh brainse iarratais tarraingthe a nuashonrú trí athbhunú",
+  "repo.settings.pulls.default_update_style": "Stíl réamhshocraithe nuashonraithe brainse",
   "repo.settings.pulls.default_target_branch": "Brainse sprice réamhshocraithe le haghaidh iarratais tarraingthe nua",
   "repo.settings.pulls.default_target_branch_default": "Brainse réamhshocraithe (%s)",
   "repo.settings.pulls.default_delete_branch_after_merge": "Scrios brainse an iarratais tarraingthe tar éis cumasc de réir réamhshocraithe",
@@ -2415,6 +2417,11 @@
   "repo.settings.protect_merge_whitelist_committers_desc": "Ní lig ach d'úsáideoirí nó d'fhoirne liostaithe iarratais tarraingthe isteach sa bhrainse seo a chumasc.",
   "repo.settings.protect_merge_whitelist_users": "Úsáideoirí ar an Liosta Ceadaithe le haghaidh cumasc:",
   "repo.settings.protect_merge_whitelist_teams": "Foirne ar an Liosta Ceadaithe le haghaidh cumasc:",
+  "repo.settings.protect_bypass_allowlist": "Cosaint brainse seachbhóthair",
+  "repo.settings.protect_enable_bypass_allowlist": "Ceadaigh d’úsáideoirí nó d’fhoirne roghnaithe cosaint brainse a sheachbhóthar",
+  "repo.settings.protect_enable_bypass_allowlist_desc": "Is féidir le húsáideoirí nó foirne atá ar an liosta ceadaithe cumasc nó brú fiú nuair a chuirfeadh ceaduithe riachtanacha, seiceálacha stádais nó rialacha comhad cosanta bac orthu murach sin.",
+  "repo.settings.protect_bypass_allowlist_users": "Úsáideoirí ar an liosta ceadanna chun cosaint a sheachbhóthar:",
+  "repo.settings.protect_bypass_allowlist_teams": "Foirne ar an liosta ceadaithe chun cosaint a sheachbhóthar:",
   "repo.settings.protect_check_status_contexts": "Cumasaigh Seiceáil Stádas",
   "repo.settings.protect_status_check_patterns": "Patrúin seiceála stádais:",
   "repo.settings.protect_status_check_patterns_desc": "Iontráil patrúin chun a shonrú cé na seiceálacha stádais a chaithfidh pas a fháil sular féidir brainsí a chumasc le brainse a chomhoibríonn leis an riail seo. Sonraíonn gach líne patrún. Ní féidir patrúin a bheith folamh.",
@@ -2456,7 +2463,7 @@
   "repo.settings.block_outdated_branch": "Cuir bac ar chumasc má tá an t-iarratas tarraingthe as dáta",
   "repo.settings.block_outdated_branch_desc": "Ní bheidh cumasc indéanta nuair a bhíonn ceannbhrainse taobh thiar de bhronnbhrainse.",
   "repo.settings.block_admin_merge_override": "Ní mór do riarthóirí rialacha cosanta brainse a leanúint",
-  "repo.settings.block_admin_merge_override_desc": "Ní mór do riarthóirí rialacha cosanta brainse a leanúint agus ní féidir leo iad a sheachaint.",
+  "repo.settings.block_admin_merge_override_desc": "Ní mór do riarthóirí rialacha cosanta brainse a leanúint agus ní féidir leo dul timpeall orthu. Is féidir le húsáideoirí nó foirne sa liosta ceadanna seachbhóthair na rialacha seo a sheachbhóthar fós má tá an liosta ceadanna seachbhóthair cumasaithe.",
   "repo.settings.default_branch_desc": "Roghnaigh brainse réamhshocraithe le haghaidh tiomnuithe cóid.",
   "repo.settings.default_target_branch_desc": "Is féidir le hiarratais tarraingthe brainse sprice réamhshocraithe difriúil a úsáid má tá sé socraithe sa rannán Iarratais Tarraingthe de na Socruithe Ardleibhéil Stórála.",
   "repo.settings.merge_style_desc": "Stíleanna Cumaisc",
@@ -2718,6 +2725,7 @@
   "graphs.code_frequency.what": "minicíocht cód",
   "graphs.contributors.what": "ranníocaíochtaí",
   "graphs.recent_commits.what": "tiomantáin le déanaí",
+  "graphs.chart_zoom_hint": "tarraing: súmáil, shift+tarraing: panáil, cliceáil faoi dhó: athshocraigh súmáil",
   "org.org_name_holder": "Ainm na hEagraíochta",
   "org.org_full_name_holder": "Ainm iomlán na hEagraíochta",
   "org.org_name_helper": "Ba cheart go mbeadh ainmneacha eagraíochta gearr agus i gcuimhne.",
@@ -3624,7 +3632,13 @@
   "packages.terraform.delete.latest": "Ní féidir an leagan is déanaí de staid Terraform a scriosadh.",
   "packages.vagrant.install": "Chun bosca Vagrant a chur leis, reáchtáil an t-ordú seo a leanas:",
   "packages.settings.link": "Nasc an pacáiste seo le stóras",
-  "packages.settings.link.description": "Má nascann tú pacáiste le stórlann, beidh an pacáiste le feiceáil i liosta pacáistí an stórlainne. Ní féidir ach stórlanna faoin úinéir céanna a nascadh. Má fhágtar an réimse folamh, bainfear an nasc.",
+  "packages.settings.link.description": "Má nascann tú pacáiste le stórlann, beidh an pacáiste le feiceáil i liosta pacáistí an stórlainne.",
+  "packages.settings.link.notice1": "Ní féidir ach stórtha faoin úinéir céanna a nascadh.",
+  "packages.settings.link.notice2": "Ní athraíonn nascadh stórtha infheictheacht an phacáiste.",
+  "packages.settings.link.notice3": "Bainfear an nasc má fhágtar an réimse folamh.",
+  "packages.settings.visibility": "Infheictheacht an phacáiste",
+  "packages.settings.visibility.inherit": "Faightear infheictheacht an phacáiste ón úinéir agus ní féidir í a athrú go neamhspleách anseo. Chun í a athrú, nuashonraigh socruithe infheictheachta an úsáideora nó na heagraíochta ar leis an bpacáiste seo.",
+  "packages.settings.visibility.button": "Athraigh infheictheacht an úinéara",
   "packages.settings.link.select": "Roghnaigh Stóras",
   "packages.settings.link.button": "Nuashonraigh Nasc Stórais",
   "packages.settings.link.success": "D'éirigh le nasc an stórais a nuashonrú.",
@@ -3698,6 +3712,7 @@
   "actions.status.success": "Rath",
   "actions.status.failure": "Teip",
   "actions.status.cancelled": "Cealaíodh",
+  "actions.status.cancelling": "Ag cealú",
   "actions.status.skipped": "Scipeáilte",
   "actions.status.blocked": "Blocáilte",
   "actions.runners": "Reathaitheoirí",
@@ -3745,6 +3760,8 @@
   "actions.runners.reset_registration_token_confirm": "Ar mhaith leat an comhartha reatha a neamhbhailiú agus ceann nua a ghiniúint?",
   "actions.runners.reset_registration_token_success": "D'éirigh le hathshocrú comhartha clárúcháin an dara háit",
   "actions.runs.all_workflows": "Gach Sreafaí Oibre",
+  "actions.runs.other_workflows": "Sreafaí oibre eile",
+  "actions.runs.other_workflows_tooltip": "Sreafaí oibre a cuireadh i gcrích sa stór seo ach nach bhfuil ann ar an mbrainse réamhshocraithe.",
   "actions.runs.workflow_run_count_1": "%d rith sreabha oibre",
   "actions.runs.workflow_run_count_n": "%d rith sreabha oibre",
   "actions.runs.commit": "Tiomantas",
@@ -3760,6 +3777,8 @@
   "actions.runs.status": "Stádas",
   "actions.runs.actors_no_select": "Gach aisteoir",
   "actions.runs.status_no_select": "Gach stádas",
+  "actions.runs.branch": "Brainse",
+  "actions.runs.branches_no_select": "Gach brainse",
   "actions.runs.no_results": "Níor mheaitseáil aon torthaí.",
   "actions.runs.no_workflows": "Níl aon sreafaí oibre ann fós.",
   "actions.runs.no_workflows.quick_start": "Níl a fhios agam conas tosú le Gitea Actions? Féach <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"%s\">an treoirleabhar mear tosaithe</a>.",
@@ -3774,11 +3793,23 @@
   "actions.runs.view_workflow_file": "Féach ar chomhad sreabha oibre",
   "actions.runs.summary": "Achoimre",
   "actions.runs.all_jobs": "Gach post",
+  "actions.runs.expand_caller_jobs": "Taispeáin poist an ghlaoiteora sreabha oibre in-athúsáidte seo",
+  "actions.runs.collapse_caller_jobs": "Folaigh poist an ghlaoiteora sreabha oibre in-athúsáidte seo",
   "actions.runs.attempt": "Iarracht",
   "actions.runs.latest": "Is déanaí",
   "actions.runs.latest_attempt": "An iarracht is déanaí",
   "actions.runs.triggered_via": "Spreagtha trí %s",
   "actions.runs.total_duration": "Fad iomlán:",
+  "actions.runs.workflow_dependencies": "Spleáchais ar Shreabhadh Oibre",
+  "actions.runs.graph_jobs_count_1": "%d post",
+  "actions.runs.graph_jobs_count_n": "%d poist",
+  "actions.runs.graph_dependencies_count_1": "%d spleáchas",
+  "actions.runs.graph_dependencies_count_n": "%d spleáchais",
+  "actions.runs.graph_success_rate": "%s rath",
+  "actions.runs.graph_zoom_in": "Zúmáil isteach (Ctrl/Cmd + scrollaigh ar an ngraf)",
+  "actions.runs.graph_zoom_max": "Ag súmáil 100% cheana féin",
+  "actions.runs.graph_zoom_out": "Zúmáil amach (Ctrl/Cmd + scrollaigh ar an ngraf)",
+  "actions.runs.graph_reset_view": "Athshocraigh an radharc",
   "actions.workflow.disable": "Díchumasaigh sreabhadh oibre",
   "actions.workflow.disable_success": "D'éirigh le sreabhadh oibre '%s' a dhíchumasú.",
   "actions.workflow.enable": "Cumasaigh sreabhadh oibre",
diff --git a/options/locale/locale_ja-JP.json b/options/locale/locale_ja-JP.json
index ffbd8c0d9e1..4af9d945b2b 100644
--- a/options/locale/locale_ja-JP.json
+++ b/options/locale/locale_ja-JP.json
@@ -81,9 +81,11 @@
   "retry": "再試行",
   "rerun": "再実行",
   "rerun_all": "すべてのジョブを再実行",
+  "rerun_failed": "失敗したジョブを再実行",
   "save": "保存",
   "add": "追加",
   "add_all": "すべて追加",
+  "dismiss": "閉じる",
   "remove": "除去",
   "remove_all": "すべて除去",
   "remove_label_str": "アイテム「%s」を削除",
@@ -103,6 +105,7 @@
   "copy_error": "コピーに失敗しました",
   "copy_type_unsupported": "このファイルタイプはコピーできません",
   "copy_filename": "ファイル名をコピー",
+  "copy_output": "出力をコピー",
   "write": "書き込み",
   "preview": "プレビュー",
   "loading": "読み込み中…",
@@ -120,6 +123,7 @@
   "unpin": "ピン留め解除",
   "artifacts": "成果物",
   "expired": "期限切れ",
+  "artifact_expires_at": "保存期限 %s",
   "confirm_delete_artifact": "アーティファクト '%s' を削除してよろしいですか？",
   "archived": "アーカイブ",
   "concept_system_global": "グローバル",
@@ -167,9 +171,12 @@
   "search.exact_tooltip": "検索語と完全に一致する結果だけを含めます",
   "search.repo_kind": "リポジトリを検索…",
   "search.user_kind": "ユーザーを検索…",
+  "search.badge_kind": "バッジを検索…",
   "search.org_kind": "組織を検索…",
   "search.team_kind": "チームを検索…",
   "search.code_kind": "コードを検索…",
+  "search.code_empty": "コード検索を開始。",
+  "search.code_empty_description": "コード全体から検索するキーワードを入力してください。",
   "search.code_search_unavailable": "コード検索は現在利用できません。 サイト管理者にお問い合わせください。",
   "search.code_search_by_git_grep": "現在のコード検索は \"git grep\" によって行われています。 サイト管理者がリポジトリインデクサーを有効にすれば、より優れた結果が得られる可能性があります。",
   "search.package_kind": "パッケージを検索…",
@@ -210,11 +217,15 @@
   "editor.buttons.switch_to_legacy.tooltip": "レガシーエディタを使用する",
   "editor.buttons.enable_monospace_font": "等幅フォントを有効にする",
   "editor.buttons.disable_monospace_font": "等幅フォントを無効にする",
+  "editor.code_editor.command_palette": "コマンドパレット",
+  "editor.code_editor.find": "検索",
+  "editor.code_editor.placeholder": "ファイルの内容をここに入力",
   "filter.string.asc": "A–Z",
   "filter.string.desc": "Z–A",
   "error.occurred": "エラーが発生しました",
   "error.report_message": "Gitea のバグが疑われる場合は、<a href=\"%s\" target=\"_blank\">GitHub</a>でIssueを検索して、見つからなければ新しいIssueを作成してください。",
   "error.not_found": "ターゲットが見つかりませんでした。",
+  "error.permission_denied": "権限がありません。",
   "error.network_error": "ネットワークエラー",
   "startpage.app_desc": "自分で立てる、超簡単 Git サービス",
   "startpage.install": "簡単インストール",
@@ -261,7 +272,7 @@
   "install.lfs_path": "Git LFSルートパス",
   "install.lfs_path_helper": "Git LFSで管理するファイルが、このディレクトリに保存されます。 空欄にするとGit LFSを無効にします。",
   "install.run_user": "実行ユーザー名",
-  "install.run_user_helper": "オペレーティングシステム上のユーザー名です。 Giteaをこのユーザーとして実行します。 このユーザーはリポジトリルートパスへのアクセス権を持っている必要があります。",
+  "install.run_user_helper": "Giteaを実行しているオペレーティングシステム上のユーザー名です。 このユーザーにはデータパスへの書き込み権限が必要です。 この値は自動的に検出されたもので、ここでは変更できません。 別のユーザーを使用するには、そのアカウントからGiteaを再起動してください。",
   "install.domain": "サーバードメイン",
   "install.domain_helper": "サーバーのドメインまたはホストアドレス。",
   "install.ssh_port": "SSHサーバーのポート",
@@ -284,12 +295,6 @@
   "install.register_confirm": "登録にはメールによる確認が必要",
   "install.mail_notify": "メール通知を有効にする",
   "install.server_service_title": "サーバーと外部サービスの設定",
-  "install.offline_mode": "ローカルモードを有効にする",
-  "install.offline_mode_popup": "外のCDNサービスを使わず、すべてのリソースを自前で提供します。",
-  "install.disable_gravatar": "Gravatarを無効にする",
-  "install.disable_gravatar_popup": "Gravatarと外のアバターソースを無効にします。 アバターをローカルにアップロードしていないユーザーには、デフォルトのアバターが使用されます。",
-  "install.federated_avatar_lookup": "フェデレーテッド・アバターを有効にする",
-  "install.federated_avatar_lookup_popup": "Libravatarを使用したフェデレーテッド・アバター検索を有効にします。",
   "install.disable_registration": "セルフ登録を無効にする",
   "install.disable_registration_popup": "ユーザーのセルフ登録を無効にします。 新しいユーザーアカウントを作成できるのは管理者だけとなります。",
   "install.allow_only_external_registration_popup": "外部サービスを使用した登録のみを許可",
@@ -309,12 +314,10 @@
   "install.admin_email": "メールアドレス",
   "install.install_btn_confirm": "Giteaをインストール",
   "install.test_git_failed": "'git'コマンドが確認できません: %v",
-  "install.sqlite3_not_available": "GiteaのこのバージョンはSQLite3をサポートしていません。 公式のバイナリ版を %s からダウンロードしてください。 ('gobuild'版でないもの)",
   "install.invalid_db_setting": "データベース設定が無効です: %v",
   "install.invalid_db_table": "データベーステーブルの \"%s\" が無効です: %v",
   "install.invalid_repo_path": "リポジトリのルートパスが無効です: %v",
   "install.invalid_app_data_path": "アプリのデータパス (APP_DATA_PATH) が無効です: %v",
-  "install.run_user_not_match": "実行ユーザー名が、現在のユーザー名ではありません: %s -> %s",
   "install.internal_token_failed": "内部トークンの生成に失敗しました: %v",
   "install.secret_key_failed": "シークレットキーの生成に失敗しました: %v",
   "install.save_config_failed": "設定ファイルの保存に失敗しました: %v",
@@ -547,6 +550,7 @@
   "form.glob_pattern_error": "のglobパターンが不正です: %s.",
   "form.regex_pattern_error": "の正規表現パターンが不正です: %s.",
   "form.username_error": "は、英数字('0-9','a-z','A-Z')、ダッシュ('-')、アンダースコア('_')、ドット('.')だけを含めることができます。 先頭と末尾は英数字以外の文字にはできません。 また、連続した英数字以外の文字も許されません。",
+  "form.invalid_slug_error": " は無効です。",
   "form.invalid_group_team_map_error": "のマッピングが無効です: %s",
   "form.unknown_error": "不明なエラー:",
   "form.captcha_incorrect": "CAPTCHAコードが正しくありません。",
@@ -635,14 +639,8 @@
   "user.block.unblock.failure": "ユーザーのブロック解除に失敗しました: %s",
   "user.block.blocked": "あなたはこのユーザーをブロックしています。",
   "user.block.title": "ユーザーをブロックする",
-  "user.block.info": "ユーザーをブロックすると、そのユーザーは、プルリクエストやイシューの作成、コメントの投稿など、リポジトリに対する操作ができなくなります。 ユーザーのブロックについてはよく確認してください。",
-  "user.block.info_1": "ユーザーをブロックすることで、あなたのアカウントとあなたのリポジトリに対する以下の行為を阻止します:",
-  "user.block.info_2": "あなたのアカウントのフォロー",
-  "user.block.info_3": "あなたのユーザー名で@メンションして通知を送ること",
-  "user.block.info_4": "そのユーザーのリポジトリに、あなたを共同作業者として招待すること",
-  "user.block.info_5": "リポジトリへの、スター、フォーク、ウォッチ",
-  "user.block.info_6": "イシューやプルリクエストの作成、コメント投稿",
-  "user.block.info_7": "イシューやプルリクエストでの、あなたのコメントに対するリアクションの送信",
+  "user.block.info": "ユーザーをブロックすると、そのユーザーは、プルリクエストやイシューの作成、コメントの投稿など、リポジトリに対する操作ができなくなります。",
+  "user.block.info.docs": "ユーザーのブロックについて詳しくはこちらをご覧ください。",
   "user.block.user_to_block": "ブロックするユーザー",
   "user.block.note": "メモ",
   "user.block.note.title": "メモ(任意):",
@@ -650,6 +648,7 @@
   "user.block.note.edit": "メモを編集",
   "user.block.list": "ブロックしたユーザー",
   "user.block.list.none": "ブロックしているユーザーはいません。",
+  "settings.general": "一般",
   "settings.profile": "プロフィール",
   "settings.account": "アカウント",
   "settings.appearance": "外観",
@@ -970,7 +969,6 @@
   "repo.visibility_description": "オーナー、または権限を持つ組織のメンバーだけが、リポジトリを見ることができます。",
   "repo.visibility_helper": "リポジトリをプライベートにする",
   "repo.visibility_helper_forced": "サイト管理者の設定により、新しいリポジトリは強制的にプライベートになります。",
-  "repo.visibility_fork_helper": "(この変更はすべてのフォークに適用されます)",
   "repo.clone_helper": "クローンに関してお困りであれば<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"%s\">ヘルプ</a>を参照しましょう。",
   "repo.fork_repo": "リポジトリをフォーク",
   "repo.fork_from": "フォーク元",
@@ -1042,6 +1040,7 @@
   "repo.forks": "フォーク",
   "repo.stars": "スター",
   "repo.reactions_more": "さらに %d 件",
+  "repo.reactions": "リアクション",
   "repo.unit_disabled": "サイト管理者がこのリポジトリセクションを無効にしています。",
   "repo.language_other": "その他",
   "repo.adopt_search": "未登録リポジトリを探すユーザー名を入力… (空ですべてを探索)",
@@ -1062,8 +1061,8 @@
   "repo.transfer.accept_desc": "\"%s\" に移転",
   "repo.transfer.reject": "移転を拒否",
   "repo.transfer.reject_desc": "\"%s\" への移転をキャンセル",
-  "repo.transfer.no_permission_to_accept": "この移転を承認する権限がありません。",
-  "repo.transfer.no_permission_to_reject": "この移転を拒否する権限がありません。",
+  "repo.transfer.is_transferring": "移転処理中…",
+  "repo.transfer.is_transferring_prompt": "リポジトリは %s に移転処理中です",
   "repo.desc.private": "プライベート",
   "repo.desc.public": "公開",
   "repo.desc.public_access": "公開アクセス",
@@ -1214,7 +1213,7 @@
   "repo.ambiguous_runes_description": "このファイルには、他の文字と見間違える可能性があるUnicode文字が含まれています。 それが意図的なものと考えられる場合は、この警告を無視して構いません。 それらの文字を表示するにはエスケープボタンを使用します。",
   "repo.invisible_runes_line": "この行には不可視のUnicode文字があります",
   "repo.ambiguous_runes_line": "この行には曖昧(ambiguous)なUnicode文字があります",
-  "repo.ambiguous_character": "%[1]c [U+%04[1]X] は %[2]c [U+%04[2]X] と混同するおそれがあります",
+  "repo.ambiguous_character": "%[1]s は %[2]s と混同するおそれがあります",
   "repo.escape_control_characters": "エスケープ",
   "repo.unescape_control_characters": "エスケープ解除",
   "repo.file_copy_permalink": "パーマリンクをコピー",
@@ -1307,9 +1306,9 @@
   "repo.editor.upload_file_is_locked": "ファイル \"%s\" は %s がロックしています。",
   "repo.editor.upload_files_to_dir": "\"%s\" にファイルをアップロード",
   "repo.editor.cannot_commit_to_protected_branch": "保護されたブランチ \"%s\" にコミットすることはできません。",
-  "repo.editor.no_commit_to_branch": "ブランチに直接コミットすることはできません、なぜなら:",
+  "repo.editor.no_commit_to_branch": "ブランチに直接コミットすることは許可されません、なぜなら：",
   "repo.editor.user_no_push_to_branch": "ユーザーはブランチにプッシュできません",
-  "repo.editor.require_signed_commit": "ブランチでは署名されたコミットが必須です",
+  "repo.editor.require_signed_commit": "ブランチには署名済みコミットが必要です",
   "repo.editor.cherry_pick": "チェリーピック %s:",
   "repo.editor.revert": "リバート %s:",
   "repo.editor.failed_to_commit": "変更のコミットに失敗しました。",
@@ -1323,7 +1322,7 @@
   "repo.commits.desc": "ソースコードの変更履歴を参照します。",
   "repo.commits.commits": "コミット",
   "repo.commits.no_commits": "共通のコミットはありません。 \"%s\" と \"%s\" の履歴はすべて異なっています。",
-  "repo.commits.nothing_to_compare": "二つのブランチは同じ内容です。",
+  "repo.commits.nothing_to_compare": "差分はありません。",
   "repo.commits.search.tooltip": "キーワード \"author:\"、\"committer:\"、\"after:\"、\"before:\" を付けて指定できます。 例 \"revert author:Alice before:2019-01-13\"",
   "repo.commits.search_branch": "このブランチ",
   "repo.commits.search_all": "すべてのブランチ",
@@ -1355,10 +1354,13 @@
   "repo.projects.desc": "プロジェクトでイシューとプルリクエストを管理します。",
   "repo.projects.description": "説明 (オプション)",
   "repo.projects.description_placeholder": "説明",
+  "repo.projects.empty": "プロジェクトはまだありません。",
+  "repo.projects.empty_description": "イシューとプルリクエストを整理するために、プロジェクトを作成してください。",
   "repo.projects.create": "プロジェクトを作成",
   "repo.projects.title": "タイトル",
   "repo.projects.new": "新しいプロジェクト",
   "repo.projects.new_subheader": "作業の調整・追跡・更新をひとつの場所で行い、プロジェクトの透明性と良好な進捗を維持します。",
+  "repo.projects.no_results": "検索条件に一致するプロジェクトはありません。",
   "repo.projects.create_success": "プロジェクト \"%s\" を作成しました。",
   "repo.projects.deletion": "プロジェクトの削除",
   "repo.projects.deletion_desc": "プロジェクトを削除し、関連するすべてのイシューから除去します。続行しますか？",
@@ -1383,6 +1385,7 @@
   "repo.projects.column.delete": "列を削除",
   "repo.projects.column.deletion_desc": "プロジェクト列を削除すると、関連するすべてのイシューがデフォルトの列に移動します。 続行しますか？",
   "repo.projects.column.color": "カラー",
+  "repo.projects.column": "列",
   "repo.projects.open": "オープン",
   "repo.projects.close": "クローズ",
   "repo.projects.column.assigned_to": "担当",
@@ -1400,11 +1403,12 @@
   "repo.issues.new": "新しいイシュー",
   "repo.issues.new.title_empty": "タイトルは空にできません",
   "repo.issues.new.labels": "ラベル",
-  "repo.issues.new.no_label": "ラベルなし",
+  "repo.issues.new.no_labels": "ラベルなし",
   "repo.issues.new.clear_labels": "ラベルをクリア",
   "repo.issues.new.projects": "プロジェクト",
   "repo.issues.new.clear_projects": "プロジェクトをクリア",
   "repo.issues.new.no_projects": "プロジェクトなし",
+  "repo.issues.new.no_column": "列なし",
   "repo.issues.new.open_projects": "オープン中のプロジェクト",
   "repo.issues.new.closed_projects": "クローズ済みプロジェクト",
   "repo.issues.new.no_items": "項目なし",
@@ -1524,16 +1528,18 @@
   "repo.issues.commented_at": "がコメント <a href=\"#%s\">%s</a>",
   "repo.issues.delete_comment_confirm": "このコメントを削除してよろしいですか？",
   "repo.issues.context.copy_link": "リンクをコピー",
+  "repo.issues.context.copy_source": "ソースをコピー",
   "repo.issues.context.quote_reply": "引用して返信",
   "repo.issues.context.reference_issue": "新しいイシューから参照",
   "repo.issues.context.edit": "編集",
   "repo.issues.context.delete": "削除",
   "repo.issues.no_content": "説明はありません。",
+  "repo.issues.comment_no_content": "コメントはありません。",
   "repo.issues.close": "イシューをクローズ",
   "repo.issues.comment_pull_merged_at": "がコミット %[1]s を %[2]s にマージ %[3]s",
   "repo.issues.comment_manually_pull_merged_at": "がコミット %[1]s を %[2]s に手動マージ %[3]s",
   "repo.issues.close_comment_issue": "コメントしてクローズ",
-  "repo.issues.reopen_issue": "再オープンする",
+  "repo.issues.reopen_issue": "イシューを再オープン",
   "repo.issues.reopen_comment_issue": "コメントして再オープン",
   "repo.issues.create_comment": "コメントする",
   "repo.issues.comment.blocked_user": "投稿者またはリポジトリのオーナーがあなたをブロックしているため、コメントの作成や編集はできません。",
@@ -1778,8 +1784,9 @@
   "repo.pulls.select_commit_hold_shift_for_range": "コミットを選択。シフトを押しながらクリックで範囲選択。",
   "repo.pulls.review_only_possible_for_full_diff": "すべての差分を表示しているときだけレビューが可能です",
   "repo.pulls.filter_changes_by_commit": "コミットで絞り込み",
-  "repo.pulls.nothing_to_compare": "同じブランチ同士のため、 プルリクエストを作成する必要がありません。",
-  "repo.pulls.nothing_to_compare_have_tag": "選択したブランチ/タグは同一のものです。",
+  "repo.pulls.nothing_to_compare": "差分がないため、 プルリクエストを作成する必要はありません。",
+  "repo.pulls.no_common_history": "これらのブランチには共通のマージベースがありません。 別のベースブランチまたは比較ブランチを選択してください。",
+  "repo.pulls.nothing_to_compare_have_tag": "選択したブランチ/タグの間で差分がありません。",
   "repo.pulls.nothing_to_compare_and_allow_empty_pr": "これらのブランチは内容が同じです。 空のプルリクエストになります。",
   "repo.pulls.has_pull_request": "同じブランチのプルリクエストはすでに存在します: <a href=\"%[1]s\">%[2]s#%[3]d</a>",
   "repo.pulls.create": "プルリクエストを作成",
@@ -1813,6 +1820,7 @@
   "repo.pulls.required_status_check_failed": "いくつかの必要なステータスチェックが成功していません。",
   "repo.pulls.required_status_check_missing": "必要なチェックがいくつか抜けています。",
   "repo.pulls.required_status_check_administrator": "管理者であるため、このプルリクエストをマージすることは可能です。",
+  "repo.pulls.required_status_check_bypass_allowlist": "あなたには、このマージでブランチ保護ルールのバイパスが許可されています。",
   "repo.pulls.blocked_by_approvals": "このプルリクエストはまだ必要な承認数を満たしていません。 公式の承認を %[1]d / %[2]d 得ています。",
   "repo.pulls.blocked_by_approvals_whitelisted": "このプルリクエストはまだ必要な承認数を満たしていません。 許可リストのユーザーまたはチームからの承認を %[1]d / %[2]d 得ています。",
   "repo.pulls.blocked_by_rejection": "このプルリクエストは公式レビューアにより変更要請されています。",
@@ -1844,7 +1852,8 @@
   "repo.pulls.fast_forward_only_merge_pull_request": "ファストフォワードのみ",
   "repo.pulls.merge_manually": "手動マージ済みにする",
   "repo.pulls.merge_commit_id": "マージコミットID",
-  "repo.pulls.require_signed_wont_sign": "ブランチでは署名されたコミットが必須ですが、このマージでは署名がされません",
+  "repo.pulls.require_signed_wont_sign": "ブランチには署名済みコミットが必要ですが、このマージでは署名がされません",
+  "repo.pulls.require_signed_head_commits_unverified": "ブランチには署名済みコミットが必要ですが、このプルリクエストに対する 1つ以上のコミットは検証されていません",
   "repo.pulls.invalid_merge_option": "このプルリクエストでは、指定したマージ方法は使えません。",
   "repo.pulls.merge_conflict": "マージ失敗: マージ中にコンフリクトがありました。 ヒント: 別のストラテジーを試してみてください。",
   "repo.pulls.merge_conflict_summary": "エラーメッセージ",
@@ -1877,6 +1886,7 @@
   "repo.pulls.update_not_allowed": "ブランチを更新する権限がありません",
   "repo.pulls.outdated_with_base_branch": "このブランチはベースブランチに対して最新ではありません",
   "repo.pulls.close": "プルリクエストをクローズ",
+  "repo.pulls.reopen": "プルリクエストを再オープン",
   "repo.pulls.closed_at": "がプルリクエストをクローズ <a id=\"%[1]s\" href=\"#%[1]s\">%[2]s</a>",
   "repo.pulls.reopened_at": "がプルリクエストを再オープン <a id=\"%[1]s\" href=\"#%[1]s\">%[2]s</a>",
   "repo.pulls.cmd_instruction_hint": "コマンドラインの手順を表示",
@@ -1949,7 +1959,6 @@
   "repo.signing.wont_sign.headsigned": "HEADコミットが署名されていないため、マージは署名されません。",
   "repo.signing.wont_sign.commitssigned": "関連するコミットすべてが署名されていないため、マージは署名されません。",
   "repo.signing.wont_sign.approved": "PRが未承認のため、マージは署名されません。",
-  "repo.signing.wont_sign.not_signed_in": "サインインしていません。",
   "repo.ext_wiki": "外部Wikiへのアクセス",
   "repo.ext_wiki.desc": "外部Wikiへのリンク。",
   "repo.wiki": "Wiki",
@@ -2131,7 +2140,9 @@
   "repo.settings.pulls_desc": "プルリクエストを有効にする",
   "repo.settings.pulls.ignore_whitespace": "空白文字のコンフリクトを無視する",
   "repo.settings.pulls.enable_autodetect_manual_merge": "手動マージの自動検出を有効にする (注意: 特殊なケースでは判定ミスが発生する場合があります)",
+  "repo.settings.pulls.allow_merge_update": "マージでプルリクエストのブランチの更新を可能にする",
   "repo.settings.pulls.allow_rebase_update": "リベースでプルリクエストのブランチの更新を可能にする",
+  "repo.settings.pulls.default_update_style": "デフォルトのブランチ更新スタイル",
   "repo.settings.pulls.default_target_branch": "新しいプルリクエストのデフォルトのターゲットブランチ",
   "repo.settings.pulls.default_target_branch_default": "デフォルトブランチ (%s)",
   "repo.settings.pulls.default_delete_branch_after_merge": "デフォルトでプルリクエストのブランチをマージ後に削除する",
@@ -2173,7 +2184,8 @@
   "repo.settings.transfer_abort_invalid": "存在しないリポジトリの移転はキャンセルできません。",
   "repo.settings.transfer_abort_success": "%s へのリポジトリ移転は正常にキャンセルされました。",
   "repo.settings.transfer_desc": "別のユーザーやあなたが管理者権限を持っている組織にリポジトリを移転します。",
-  "repo.settings.transfer_form_title": "確認のためリポジトリ名を入力:",
+  "repo.settings.enter_repo_name_to_confirm": "確認のためリポジトリ名を入力：",
+  "repo.settings.enter_repo_full_name_to_confirm": "確認のため完全なリポジトリ名(owner/name形式)を入力：",
   "repo.settings.transfer_in_progress": "現在進行中の移転があります。このリポジトリを別のユーザーに移転したい場合はキャンセルしてください。",
   "repo.settings.transfer_notices_1": "- 個人ユーザーに移転すると、あなたはリポジトリへのアクセス権を失います。",
   "repo.settings.transfer_notices_2": "- あなたが所有(または共同で所有)している組織に移転すると、リポジトリへのアクセス権は維持されます。",
@@ -2249,13 +2261,14 @@
   "repo.settings.webhook.delivery.success": "イベントを配信キューに追加しました。 配信履歴に表示されるまで数秒かかります。",
   "repo.settings.githooks_desc": "GitのフックはGit自体が提供する仕組みです。 以下のフックファイルを編集するとカスタム処理を設定できます。",
   "repo.settings.githook_edit_desc": "もしフックがアクティブではない場合はサンプルの内容が表示されます。 内容を空にするとフックが無効になります。",
-  "repo.settings.githook_name": "フックの名称",
-  "repo.settings.githook_content": "フックの内容",
   "repo.settings.update_githook": "フックを更新",
   "repo.settings.add_webhook_desc": "GiteaはターゲットURLに、指定したContent Typeで<code>POST</code>リクエストを送ります。 詳細は<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"%s\">Webhookガイド</a>へ。",
   "repo.settings.payload_url": "ターゲットURL",
   "repo.settings.http_method": "HTTPメソッド",
   "repo.settings.content_type": "POST Content Type",
+  "repo.settings.webhook.name": "Webhook名",
+  "repo.settings.webhook.name_helper": "任意で、このWebhookにわかりやすい名前をつける",
+  "repo.settings.webhook.name_empty": "無名のWebhook",
   "repo.settings.secret": "シークレット",
   "repo.settings.webhook_secret_desc": "Webhookサーバーがsecretの使用をサポートしている場合は、webhookのマニュアルに従いここにsecretを入力できます。",
   "repo.settings.slack_username": "ユーザー名",
@@ -2404,6 +2417,11 @@
   "repo.settings.protect_merge_whitelist_committers_desc": "許可リストに登録したユーザーまたはチームにのみ、このブランチへのプルリクエストのマージを許可します。",
   "repo.settings.protect_merge_whitelist_users": "マージ許可リストに含むユーザー:",
   "repo.settings.protect_merge_whitelist_teams": "マージ許可リストに含むチーム:",
+  "repo.settings.protect_bypass_allowlist": "ブランチ保護のバイパス",
+  "repo.settings.protect_enable_bypass_allowlist": "選択されたユーザーまたはチームにブランチ保護のバイパスを許可",
+  "repo.settings.protect_enable_bypass_allowlist_desc": "許可リストに指定したユーザーまたはチームは、必要な承認、ステータスチェック、保護ファイルのルールにより通常であればブロックされる場合でも、マージやプッシュを行うことができます。",
+  "repo.settings.protect_bypass_allowlist_users": "保護のバイパスを許可するユーザー：",
+  "repo.settings.protect_bypass_allowlist_teams": "保護のバイパスを許可するチーム：",
   "repo.settings.protect_check_status_contexts": "ステータスチェックを有効にする",
   "repo.settings.protect_status_check_patterns": "ステータスチェック パターン:",
   "repo.settings.protect_status_check_patterns_desc": "このルールの対象ブランチがマージ可能になる前に、どのステータスチェックがパスしなければならないかを、パターンで入力します。 各行にパターンを指定します。 この設定は空にできません。",
@@ -2445,7 +2463,7 @@
   "repo.settings.block_outdated_branch": "遅れているプルリクエストのマージをブロック",
   "repo.settings.block_outdated_branch_desc": "baseブランチがheadブランチより進んでいる場合、マージできないようにします。",
   "repo.settings.block_admin_merge_override": "管理者もブランチ保護のルールに従う",
-  "repo.settings.block_admin_merge_override_desc": "管理者はブランチ保護のルールに従う必要があり、回避することはできません。",
+  "repo.settings.block_admin_merge_override_desc": "管理者はブランチ保護のルールに従う必要があり、回避することはできません。 バイパス許可リストを有効にしている場合、許可リストに含まれるユーザーやチームは、引き続きルールのバイパスが可能です。",
   "repo.settings.default_branch_desc": "コミット表示のデフォルトのブランチを選択します。",
   "repo.settings.default_target_branch_desc": "プルリクエストでは、リポジトリ拡張設定の「プルリクエスト」セクションで設定することで、別のデフォルトターゲットブランチを使用できます。",
   "repo.settings.merge_style_desc": "マージ スタイル",
@@ -2476,7 +2494,10 @@
   "repo.settings.visibility.private.text": "プライベートに変更することで、リポジトリは許可されたメンバーにのみ表示されるようになり、既存のフォーク、ウォッチャー、スターとの関係は解除される可能性があります。",
   "repo.settings.visibility.private.bullet_title": "<strong>プライベートに変更すると:</strong>",
   "repo.settings.visibility.private.bullet_one": "許可されたメンバーにのみリポジトリを表示します。",
-  "repo.settings.visibility.private.bullet_two": "<strong>フォーク</strong>、<strong>ウォッチャー</strong>、<strong>スター</strong>との関係を解除する可能性があります。",
+  "repo.settings.visibility.private.bullet_two": "非公開設定はフォークにも適用し、<strong>ウォッチャー</strong>と<strong>スター</strong>は削除します。",
+  "repo.settings.visibility.private.stats_stars": "このリポジトリには、失われるおそれのあるスターが <strong>%d</strong> 個あります。",
+  "repo.settings.visibility.private.stats_watchers": "このリポジトリには、失われるおそれのあるウォッチャーが <strong>%d</strong> 件あります。",
+  "repo.settings.visibility.private.stats_forks": "このリポジトリには、関連するフォークが <strong>%d</strong> 件あります。",
   "repo.settings.visibility.public.button": "公開する",
   "repo.settings.visibility.public.text": "公開に変更すると、リポジトリを誰でも閲覧できるようにします。",
   "repo.settings.visibility.public.bullet_title": "<strong>公開に変更すると:</strong>",
@@ -2712,6 +2733,8 @@
   "org.members": "メンバー",
   "org.teams": "チーム",
   "org.code": "コード",
+  "org.repos.empty": "リポジトリはまだありません。",
+  "org.repos.empty_description": "コードを組織内で共有するため、リポジトリを作成してください。",
   "org.lower_members": "メンバー",
   "org.lower_repositories": "リポジトリ",
   "org.create_new_team": "新しいチーム",
@@ -2804,7 +2827,10 @@
   "org.teams.no_desc": "このチームには説明がありません。",
   "org.teams.settings": "設定",
   "org.teams.owners_permission_desc": "オーナーは<strong>すべてのリポジトリ</strong>へのフルアクセス権と、組織への<strong>管理者アクセス権</strong>を持ちます。",
+  "org.teams.owners_permission_suggestion": "メンバーのアクセス権限を細かく管理するため、新しくチームを作成することもできます。",
   "org.teams.members": "チームメンバー",
+  "org.teams.manage_team_member": "チームとメンバーを管理",
+  "org.teams.manage_team_member_prompt": "メンバーの管理はチームを使って行います。 ユーザーをこの組織に招待するには、チームに追加してください。",
   "org.teams.update_settings": "設定の更新",
   "org.teams.delete_team": "チームを削除",
   "org.teams.add_team_member": "チームメンバーを追加",
@@ -2845,6 +2871,8 @@
   "org.worktime.date_range_end": "期間 (至)",
   "org.worktime.query": "集計",
   "org.worktime.time": "時間",
+  "org.worktime.empty": "作業時間のデータはまだありません。",
+  "org.worktime.empty_description": "記録された作業時間を表示するには、日付範囲を調整してください。",
   "org.worktime.by_repositories": "リポジトリ別",
   "org.worktime.by_milestones": "マイルストーン別",
   "org.worktime.by_members": "メンバー別",
@@ -2859,6 +2887,30 @@
   "admin.hooks": "Webhook",
   "admin.integrations": "連携",
   "admin.authentication": "認証ソース",
+  "admin.badges": "バッジ",
+  "admin.badges.badges_manage_panel": "バッジ管理",
+  "admin.badges.details": "バッジ詳細",
+  "admin.badges.new_badge": "新しいバッジを作成",
+  "admin.badges.slug": "スラッグ",
+  "admin.badges.slug_been_taken": "スラッグが既に使用されています。",
+  "admin.badges.description": "説明",
+  "admin.badges.image_url": "画像URL",
+  "admin.badges.new_success": "バッジ \"%s\" を作成しました。",
+  "admin.badges.update_success": "バッジを更新しました。",
+  "admin.badges.deletion_success": "バッジを削除しました。",
+  "admin.badges.edit_badge": "バッジを編集",
+  "admin.badges.update_badge": "バッジを更新",
+  "admin.badges.delete_badge": "バッジを削除",
+  "admin.badges.delete_badge_desc": "このバッジを完全に削除してよろしいですか？",
+  "admin.badges.users_with_badge": "バッジ保持者: %s",
+  "admin.badges.not_found": "バッジが見つかりません。",
+  "admin.badges.user_already_has": "ユーザーは既にこのバッジを保有しています。",
+  "admin.badges.user_add_success": "ユーザーにバッジを付与しました。",
+  "admin.badges.user_remove_success": "ユーザーのバッジを取り消しました。",
+  "admin.badges.manage_users": "ユーザーを管理",
+  "admin.badges.add_user": "ユーザーを追加",
+  "admin.badges.remove_user": "ユーザーを削除",
+  "admin.badges.delete_user_desc": "このユーザーのバッジを取り消してもよろしいですか？",
   "admin.emails": "ユーザーメールアドレス",
   "admin.config": "設定",
   "admin.config_summary": "サマリー",
@@ -3135,6 +3187,8 @@
   "admin.auths.oauth2_required_claim_name_helper": "このClaim名を設定すると、このソースからのログインを、指定したClaim名を持つユーザーに限定します。",
   "admin.auths.oauth2_required_claim_value": "必須Claim値",
   "admin.auths.oauth2_required_claim_value_helper": "この値を設定すると、このソースからのログインを、指定したClaim名とClaim値を持つユーザーに限定します。",
+  "admin.auths.open_id_connect_external_id_claim": "外部ID Claim名 (オプション)",
+  "admin.auths.open_id_connect_external_id_claim_helper": "ユーザーの外部IDに使用するClaim名。 デフォルトは \"sub\" です。 Azure AD / Entra IDについては、Azure AD V2 プロバイダーから移行したときに継続性を維持するため、この値を \"oid\" にしてください。 注: \"oid\" Claimを使う場合は、上にあるスコープ設定に \"profile\" スコープを含める必要があります。",
   "admin.auths.oauth2_group_claim_name": "このソースでグループ名を提供するClaim名 (オプション)",
   "admin.auths.oauth2_full_name_claim_name": "フルネームのClaim名。 (オプション — 設定すると、ユーザーのフルネームは常にこのClaimに同期します)",
   "admin.auths.oauth2_ssh_public_key_claim_name": "SSH公開鍵のClaim名",
@@ -3187,11 +3241,8 @@
   "admin.config.server_config": "サーバー設定",
   "admin.config.app_name": "サイトのタイトル",
   "admin.config.app_ver": "Giteaのバージョン",
-  "admin.config.app_url": "GiteaのベースURL",
   "admin.config.custom_conf": "設定ファイルのパス",
   "admin.config.custom_file_root_path": "カスタムファイルのルートパス",
-  "admin.config.domain": "サーバードメイン",
-  "admin.config.offline_mode": "ローカルモード",
   "admin.config.disable_router_log": "ルーターのログが無効",
   "admin.config.run_user": "実行ユーザー名",
   "admin.config.run_mode": "実行モード",
@@ -3271,15 +3322,20 @@
   "admin.config.cache_config": "キャッシュ設定",
   "admin.config.cache_adapter": "キャッシュ アダプター",
   "admin.config.cache_interval": "キャッシュ間隔",
-  "admin.config.cache_conn": "キャッシュ接続",
   "admin.config.cache_item_ttl": "キャッシュアイテムのTTL",
   "admin.config.cache_test": "キャッシュのテスト",
   "admin.config.cache_test_failed": "キャッシュの調査に失敗しました: %v.",
   "admin.config.cache_test_slow": "キャッシュのテストは成功しましたが、応答が遅いです: %s",
   "admin.config.cache_test_succeeded": "キャッシュのテストは成功し、応答時間は %s でした。",
+  "admin.config.common.start_time": "開始時刻",
+  "admin.config.common.end_time": "終了時刻",
+  "admin.config.common.skip_time_check": "時刻を空に(入力欄をクリア)すると時刻チェックをスキップします",
+  "admin.config.instance_maintenance": "インスタンスのメンテナンス",
+  "admin.config.instance_maintenance_mode.admin_web_access_only": "管理者にのみWeb UIへのアクセスを許可",
+  "admin.config.instance_web_banner.enabled": "バナーを表示",
+  "admin.config.instance_web_banner.message_placeholder": "バナーメッセージ (Markdownをサポート)",
   "admin.config.session_config": "セッション設定",
   "admin.config.session_provider": "セッション プロバイダー",
-  "admin.config.provider_config": "プロバイダーの設定",
   "admin.config.cookie_name": "Cookieの名称",
   "admin.config.gc_interval_time": "GCの間隔",
   "admin.config.session_life_time": "セッションの有効期間",
@@ -3287,7 +3343,7 @@
   "admin.config.cookie_life_time": "Cookieの有効期間",
   "admin.config.picture_config": "画像とアバターの設定",
   "admin.config.picture_service": "画像サービス",
-  "admin.config.disable_gravatar": "Gravatarが無効",
+  "admin.config.enable_gravatar": "Gravatar有効",
   "admin.config.enable_federated_avatar": "フェデレーテッド・アバター有効",
   "admin.config.open_with_editor_app_help": "クローンメニューの「～で開く」に表示するエディタ。 空白のままにするとデフォルトが使用されます。 展開するとデフォルトを確認できます。",
   "admin.config.git_guide_remote_name": "操作説明内のgitコマンドで使うリポジトリリモート名",
@@ -3465,6 +3521,7 @@
   "packages.dependencies": "依存関係",
   "packages.keywords": "キーワード",
   "packages.details": "詳細",
+  "packages.name": "パッケージ名",
   "packages.details.author": "著作者",
   "packages.details.project_site": "プロジェクトサイト",
   "packages.details.repository_site": "リポジトリサイト",
@@ -3560,9 +3617,27 @@
   "packages.swift.registry": "このレジストリをコマンドラインからセットアップします:",
   "packages.swift.install": "あなたの <code>Package.swift</code> ファイルにパッケージを追加します:",
   "packages.swift.install2": "そして次のコマンドを実行します:",
+  "packages.terraform.install": "HTTPバックエンドを使用するよう状態を設定します",
+  "packages.terraform.install2": "そして次のコマンドを実行します:",
+  "packages.terraform.lock_status": "ロック状態",
+  "packages.terraform.locked_by": "%s がロックしています",
+  "packages.terraform.unlocked": "アンロックされています",
+  "packages.terraform.lock": "ロック",
+  "packages.terraform.unlock": "アンロック",
+  "packages.terraform.lock.success": "Terraform状態は正常にロックされました。",
+  "packages.terraform.unlock.success": "Terraform状態は正常にアンロックされました。",
+  "packages.terraform.lock.error.already_locked": "Terraform状態は既にロックされています。",
+  "packages.terraform.delete.locked": "Terraform状態はロックされているため削除できません。",
+  "packages.terraform.delete.latest": "Terraform状態の最新バージョンは削除できません。",
   "packages.vagrant.install": "Vagrant ボックスを追加するには、次のコマンドを実行します。",
   "packages.settings.link": "このパッケージをリポジトリにリンク",
-  "packages.settings.link.description": "パッケージをリポジトリにリンクすると、リポジトリのパッケージ一覧にそのパッケージが表示されます。 リンクできるのは、同じオーナーが所有するリポジトリのみです。 入力欄を空にするとリンクを削除します。",
+  "packages.settings.link.description": "パッケージをリポジトリにリンクすると、リポジトリのパッケージ一覧に表示されるようになります。",
+  "packages.settings.link.notice1": "同じオーナーが所有するリポジトリにだけリンクできます。",
+  "packages.settings.link.notice2": "リポジトリにリンクしてもパッケージの公開範囲は変わりません。",
+  "packages.settings.link.notice3": "入力欄を空にするとリンクを削除します。",
+  "packages.settings.visibility": "パッケージの公開範囲",
+  "packages.settings.visibility.inherit": "パッケージの公開範囲は所有者から継承されており、ここで個別に変更することはできません。 変更するには、このパッケージを所有するユーザーまたは組織の公開設定を変更してください。",
+  "packages.settings.visibility.button": "所有者の公開範囲を変更",
   "packages.settings.link.select": "リポジトリを選択",
   "packages.settings.link.button": "リポジトリのリンクを更新",
   "packages.settings.link.success": "リポジトリのリンクを更新しました。",
@@ -3573,8 +3648,13 @@
   "packages.settings.delete": "パッケージ削除",
   "packages.settings.delete.description": "パッケージの削除は恒久的で元に戻すことはできません。",
   "packages.settings.delete.notice": "%s (%s) を削除しようとしています。この操作は元に戻せません。よろしいですか？",
+  "packages.settings.delete.notice.package": "%s とその全てのバージョンを削除しようとしています。この操作は元に戻せません。よろしいですか？",
   "packages.settings.delete.success": "パッケージを削除しました。",
+  "packages.settings.delete.version.success": "パッケージバージョンを削除しました。",
   "packages.settings.delete.error": "パッケージの削除に失敗しました。",
+  "packages.settings.delete.version": "バージョンを削除",
+  "packages.settings.delete.confirm": "確認のためパッケージ名を入力してください",
+  "packages.settings.delete.invalid_package_name": "入力したパッケージ名が間違っています。",
   "packages.owner.settings.cargo.title": "Cargoレジストリ インデックス",
   "packages.owner.settings.cargo.initialize": "インデックスを初期化",
   "packages.owner.settings.cargo.initialize.description": "Cargoレジストリを使用するには、インデックス用の特別なgitリポジトリが必要です。 このオプションを使用するとそのリポジトリを(再)作成し、自動的に構成します。",
@@ -3630,9 +3710,10 @@
   "actions.status.running": "実行中",
   "actions.status.success": "成功",
   "actions.status.failure": "失敗",
-  "actions.status.cancelled": "キャンセル",
-  "actions.status.skipped": "スキップ",
-  "actions.status.blocked": "ブロックされた",
+  "actions.status.cancelled": "キャンセルされました",
+  "actions.status.cancelling": "キャンセル中",
+  "actions.status.skipped": "スキップされました",
+  "actions.status.blocked": "ブロックされました",
   "actions.runners": "ランナー",
   "actions.runners.runner_manage_panel": "ランナーの管理",
   "actions.runners.new": "新しいランナーを作成",
@@ -3641,6 +3722,7 @@
   "actions.runners.id": "ID",
   "actions.runners.name": "名称",
   "actions.runners.owner_type": "タイプ",
+  "actions.runners.availability": "利用可否",
   "actions.runners.description": "説明",
   "actions.runners.labels": "ラベル",
   "actions.runners.last_online": "最終オンライン時刻",
@@ -3656,6 +3738,12 @@
   "actions.runners.update_runner": "変更を保存",
   "actions.runners.update_runner_success": "ランナーを更新しました",
   "actions.runners.update_runner_failed": "ランナーの更新に失敗しました",
+  "actions.runners.enable_runner": "このランナーを有効化",
+  "actions.runners.enable_runner_success": "ランナーを有効化しました",
+  "actions.runners.enable_runner_failed": "ランナーの有効化に失敗しました",
+  "actions.runners.disable_runner": "このランナーを無効化",
+  "actions.runners.disable_runner_success": "ランナーを無効化しました",
+  "actions.runners.disable_runner_failed": "ランナーの無効化に失敗しました",
   "actions.runners.delete_runner": "このランナーを削除",
   "actions.runners.delete_runner_success": "ランナーを削除しました",
   "actions.runners.delete_runner_failed": "ランナーの削除に失敗しました",
@@ -3671,7 +3759,11 @@
   "actions.runners.reset_registration_token_confirm": "現在のトークンを無効にして、新しいトークンを生成しますか？",
   "actions.runners.reset_registration_token_success": "ランナー登録トークンをリセットしました",
   "actions.runs.all_workflows": "すべてのワークフロー",
+  "actions.runs.workflow_run_count_1": "%d 件のワークフロー実行",
+  "actions.runs.workflow_run_count_n": "%d 件のワークフロー実行",
   "actions.runs.commit": "コミット",
+  "actions.runs.run_details": "実行の詳細",
+  "actions.runs.workflow_file": "ワークフローのファイル",
   "actions.runs.scheduled": "スケジュール済み",
   "actions.runs.pushed_by": "pushed by",
   "actions.runs.invalid_workflow_helper": "ワークフロー設定ファイルは無効です。あなたの設定ファイルを確認してください: %s",
@@ -3694,6 +3786,13 @@
   "actions.runs.delete.description": "このワークフローを完全に削除してもよろしいですか？この操作は元に戻せません。",
   "actions.runs.not_done": "このワークフローの実行は完了していません。",
   "actions.runs.view_workflow_file": "ワークフローファイルを表示",
+  "actions.runs.summary": "サマリー",
+  "actions.runs.all_jobs": "すべてのジョブ",
+  "actions.runs.attempt": "試行",
+  "actions.runs.latest": "最新",
+  "actions.runs.latest_attempt": "最新 試行",
+  "actions.runs.triggered_via": "%s によりトリガー",
+  "actions.runs.total_duration": "総所要時間：",
   "actions.workflow.disable": "ワークフローを無効にする",
   "actions.workflow.disable_success": "ワークフロー '%s' が無効になりました。",
   "actions.workflow.enable": "ワークフローを有効にする",
@@ -3743,5 +3842,24 @@
   "git.filemode.normal_file": "ノーマルファイル",
   "git.filemode.executable_file": "実行可能ファイル",
   "git.filemode.symbolic_link": "シンボリックリンク",
-  "git.filemode.submodule": "サブモジュール"
+  "git.filemode.submodule": "サブモジュール",
+  "org.repos.none": "リポジトリはありません。",
+  "actions.general.permissions": "Actionsトークンの権限",
+  "actions.general.token_permissions.mode": "トークンのデフォルトの権限",
+  "actions.general.token_permissions.mode.desc": "ワークフローファイルでActionsジョブに権限(permissions)を指定していない場合、デフォルトの権限が使用されます。",
+  "actions.general.token_permissions.mode.permissive": "許可",
+  "actions.general.token_permissions.mode.permissive.desc": "ジョブの対象リポジトリについて、読み取りと書き込みを許可。",
+  "actions.general.token_permissions.mode.restricted": "制限あり",
+  "actions.general.token_permissions.mode.restricted.desc": "ジョブの対象リポジトリのコンテンツ・ユニット(コード、リリース)について、読み取りのみ許可。",
+  "actions.general.token_permissions.override_owner": "オーナーレベルの設定を上書きする",
+  "actions.general.token_permissions.override_owner_desc": "有効にすると、このリポジトリは(ユーザーまたは組織の)オーナーのActions設定に従うのではなく、独自の設定を使用します。",
+  "actions.general.token_permissions.maximum": "トークン権限の上限",
+  "actions.general.token_permissions.maximum.description": "Actionsジョブの実効権限はこの上限によって制限されます。",
+  "actions.general.token_permissions.fork_pr_note": "フォークからのプルリクエストによってジョブが開始された場合は、実効権限は読み取り専用までとなります。",
+  "actions.general.token_permissions.customize_max_permissions": "権限の上限をカスタマイズする",
+  "actions.general.cross_repo": "クロスリポジトリ アクセス",
+  "actions.general.cross_repo_desc": "Actionsジョブの実行時に、このオーナーのすべてのリポジトリから選択したリポジトリへ、GITEA_TOKENを使用して(読み取り専用で)アクセスすることを許可します。",
+  "actions.general.cross_repo_selected": "選択したリポジトリ",
+  "actions.general.cross_repo_target_repos": "対象リポジトリ",
+  "actions.general.cross_repo_add": "対象リポジトリの追加"
 }
diff --git a/options/locale/locale_ko-KR.json b/options/locale/locale_ko-KR.json
index 4576b8bf824..121d0fb8bfe 100644
--- a/options/locale/locale_ko-KR.json
+++ b/options/locale/locale_ko-KR.json
@@ -105,6 +105,7 @@
   "copy_error": "복사 실패",
   "copy_type_unsupported": "이 파일 형식은 복사할 수 없습니다",
   "copy_filename": "파일명 복사",
+  "copy_output": "출력 복사",
   "write": "쓰기",
   "preview": "미리보기",
   "loading": "불러오는 중...",
@@ -313,7 +314,6 @@
   "install.admin_email": "이메일 주소",
   "install.install_btn_confirm": "Gitea 설치하기",
   "install.test_git_failed": "'git' 명령 테스트 실패: %v",
-  "install.sqlite3_not_available": "해당 버전에서는 SQLite3를 지원하지 않습니다. %s에서 공식 버전을 다운로드해주세요. ('gobuild' 버전이 아닙니다.)",
   "install.invalid_db_setting": "데이터베이스 설정이 올바르지 않습니다: %v",
   "install.invalid_db_table": "데이터베이스 테이블 '%s' 이 유효하지 않습니다: %v",
   "install.invalid_repo_path": "리포지토리의 경로가 올바르지 않습니다: %v",
@@ -1385,6 +1385,7 @@
   "repo.projects.column.delete": "열 삭제",
   "repo.projects.column.deletion_desc": "프로젝트 열을 삭제하면 모든 관련 이슈가 기본 열로 이동합니다. 계속하시겠습니까?",
   "repo.projects.column.color": "색",
+  "repo.projects.column": "열",
   "repo.projects.open": "열기",
   "repo.projects.close": "닫기",
   "repo.projects.column.assigned_to": "다음에 할당",
@@ -1784,6 +1785,7 @@
   "repo.pulls.review_only_possible_for_full_diff": "전체 diff를 볼 때만 검토가 가능합니다",
   "repo.pulls.filter_changes_by_commit": "커밋으로 필터링",
   "repo.pulls.nothing_to_compare": "이 브랜치들은 동일합니다. 풀 리퀘스트를 생성할 필요가 없습니다.",
+  "repo.pulls.no_common_history": "이 브랜치들은 공통된 머지 베이스를 공유하지 않습니다. 다른 베이스 브랜치 또는 비교 브랜치를 선택해 주세요.",
   "repo.pulls.nothing_to_compare_have_tag": "선택된 브랜치/태그는 동일합니다.",
   "repo.pulls.nothing_to_compare_and_allow_empty_pr": "이 브랜치들은 동일합니다. 이 PR은 비어 있을 것입니다.",
   "repo.pulls.has_pull_request": "이 브랜치들 사이의 풀 리퀘스트가 이미 존재합니다: <a href=\"%[1]s\">%[2]s#%[3]d</a>",
@@ -1818,6 +1820,7 @@
   "repo.pulls.required_status_check_failed": "일부 필수 검사가 성공하지 못했습니다.",
   "repo.pulls.required_status_check_missing": "일부 필수 검사가 누락되었습니다.",
   "repo.pulls.required_status_check_administrator": "운영자로서 이 풀 리퀘스트를 여전히 머지할 수 있습니다.",
+  "repo.pulls.required_status_check_bypass_allowlist": "이 머지에 대해 브랜치 보호 규칙 우회가 당신에게 허용되어 있습니다.",
   "repo.pulls.blocked_by_approvals": "이 풀 리퀘스트는 아직 요구되는 승인을 충분히 받지 못했습니다. %d개/%d 가 공식 승인되었습니다.",
   "repo.pulls.blocked_by_approvals_whitelisted": "이 풀 리퀘스트는 아직 필요한 승인을 충분히 받지 못했습니다. 허용 목록에 있는 사용자 또는 팀으로부터 %d개 중 %d개의 승인되었습니다.",
   "repo.pulls.blocked_by_rejection": "이 풀 리퀘스트는 공식 검토자에 의해 변경이 요청되었습니다.",
@@ -1956,7 +1959,6 @@
   "repo.signing.wont_sign.headsigned": "헤드 커밋이 서명되지 않아 머지가 서명되지 않을 것입니다.",
   "repo.signing.wont_sign.commitssigned": "연관된 모든 커밋이 서명되지 않아 머지가 서명되지 않을 것입니다.",
   "repo.signing.wont_sign.approved": "PR이 승인되지 않아 머지가 서명되지 않을 것입니다.",
-  "repo.signing.wont_sign.not_signed_in": "로그인되어 있지 않습니다.",
   "repo.ext_wiki": "외부 위키 액세스",
   "repo.ext_wiki.desc": "외부 위키에 연결하기.",
   "repo.wiki": "위키",
@@ -2138,7 +2140,9 @@
   "repo.settings.pulls_desc": "리포지토리 풀 리퀘스트 활성화",
   "repo.settings.pulls.ignore_whitespace": "공백은 충돌에서 무시하기",
   "repo.settings.pulls.enable_autodetect_manual_merge": "수동 머지 자동 감지 활성화 (참고: 일부 특별한 경우 오류가 발생할 수 있습니다.)",
+  "repo.settings.pulls.allow_merge_update": "머지로 풀 리퀘스트 브랜치 업데이트 활성화",
   "repo.settings.pulls.allow_rebase_update": "rebase로 풀 리퀘스트 브랜치 업데이트 활성화",
+  "repo.settings.pulls.default_update_style": "기본 브랜치 업데이트 스타일",
   "repo.settings.pulls.default_target_branch": "새로운 풀 리퀘스트에 대한 기본 타겟 브랜치",
   "repo.settings.pulls.default_target_branch_default": "기본 브랜치 (%s)",
   "repo.settings.pulls.default_delete_branch_after_merge": "기본적으로 머지 후 풀 리퀘스트 브랜치 삭제",
@@ -2413,6 +2417,11 @@
   "repo.settings.protect_merge_whitelist_committers_desc": "허용 목록에 있는 사용자 또는 팀만 이 브랜치에 풀 리퀘스트를 머지할 수 있도록 허용합니다.",
   "repo.settings.protect_merge_whitelist_users": "머지 가능 사용자 허용 목록:",
   "repo.settings.protect_merge_whitelist_teams": "머지 가능 팀 허용 목록:",
+  "repo.settings.protect_bypass_allowlist": "브랜치 보호 우회",
+  "repo.settings.protect_enable_bypass_allowlist": "선택된 사용자 또는 팀에게 브랜치 보호 규칙 우회 허용",
+  "repo.settings.protect_enable_bypass_allowlist_desc": "허용 목록에 등록된 사용자나 팀은 필수 승인, 상태 검사 또는 보호된 파일 규칙에 의해 차단되는 상황에서도 머지하거나 푸시할 수 있습니다.",
+  "repo.settings.protect_bypass_allowlist_users": "보호 우회를 허용하는 사용자 리스트:",
+  "repo.settings.protect_bypass_allowlist_teams": "보호 우회를 허용하는 팀 리스트:",
   "repo.settings.protect_check_status_contexts": "상태 점검 활성화",
   "repo.settings.protect_status_check_patterns": "상태 점검 패턴:",
   "repo.settings.protect_status_check_patterns_desc": "이 규칙과 일치하는 브랜치로 머지하기 전에 통과해야 하는 상태 점검을 지정하는 패턴을 입력하세요. 각 줄은 하나의 패턴을 지정합니다. 패턴은 비워둘 수 없습니다.",
@@ -2716,6 +2725,7 @@
   "graphs.code_frequency.what": "코드 빈도",
   "graphs.contributors.what": "기여",
   "graphs.recent_commits.what": "최근 커밋",
+  "graphs.chart_zoom_hint": "드래그: 줌, shift+드래그: 팬, 더블 클릭: 줌 리셋",
   "org.org_name_holder": "조직 이름",
   "org.org_full_name_holder": "조직 전체 이름",
   "org.org_name_helper": "조직명은 짧고 기억하기 쉬워야 합니다.",
@@ -3313,7 +3323,6 @@
   "admin.config.cache_config": "캐시 설정",
   "admin.config.cache_adapter": "캐시 어댑터",
   "admin.config.cache_interval": "캐시 간격",
-  "admin.config.cache_conn": "캐시 연결",
   "admin.config.cache_item_ttl": "캐시 아이템 TTL",
   "admin.config.cache_test": "캐시 테스트",
   "admin.config.cache_test_failed": "캐시 검사에 실패했습니다: %v.",
@@ -3328,7 +3337,6 @@
   "admin.config.instance_web_banner.message_placeholder": "배너 메시지 (마크다운 지원)",
   "admin.config.session_config": "세션 설정",
   "admin.config.session_provider": "세션 공급자",
-  "admin.config.provider_config": "공급자 설정",
   "admin.config.cookie_name": "쿠키 이름",
   "admin.config.gc_interval_time": "GC 인터벌 시간",
   "admin.config.session_life_time": "세션 수명",
@@ -3625,6 +3633,12 @@
   "packages.vagrant.install": "Vagrant 박스를 추가하려면 다음 명령을 실행:",
   "packages.settings.link": "이 패키지를 리포지토리에 연결",
   "packages.settings.link.description": "패키지를 리포지토리에 연결하면 리포지토리의 패키지 목록에 표시됩니다.",
+  "packages.settings.link.notice1": "동일한 소유자의 저장소만 연결할 수 있습니다.",
+  "packages.settings.link.notice2": "저장소를 연결해도 패키지 공개 범위는 변경되지 않습니다.",
+  "packages.settings.link.notice3": "입력란을 비워 두면 링크가 삭제됩니다.",
+  "packages.settings.visibility": "패키지 공개범위",
+  "packages.settings.visibility.inherit": "패키지 공개 범위는 소유자로부터 상속되므로 여기에서 직접 변경할 수 없습니다. 이를 변경하려면 이 패키지를 소유한 사용자 또는 조직의 공개 설정에서 업데이트하세요.",
+  "packages.settings.visibility.button": "소유자 공개범위 변경",
   "packages.settings.link.select": "리포지토리 선택",
   "packages.settings.link.button": "리포지토리 링크 업데이트",
   "packages.settings.link.success": "리포지토리 링크가 성공적으로 업데이트 되었습니다.",
@@ -3698,6 +3712,7 @@
   "actions.status.success": "성공",
   "actions.status.failure": "실패",
   "actions.status.cancelled": "취소됨",
+  "actions.status.cancelling": "취소중",
   "actions.status.skipped": "건너뜀",
   "actions.status.blocked": "차단됨",
   "actions.runners": "러너",
@@ -3745,6 +3760,8 @@
   "actions.runners.reset_registration_token_confirm": "현재 토큰을 무효화하고 새 토큰을 생성하시겠습니까?",
   "actions.runners.reset_registration_token_success": "러너 등록 토큰 성공적으로 리셋",
   "actions.runs.all_workflows": "모든 워크플로",
+  "actions.runs.other_workflows": "그외 워크플로우",
+  "actions.runs.other_workflows_tooltip": "이 리포지토리에서 실행되었지만 기본 브랜치에는 존재하지 않는 워크플로입니다.",
   "actions.runs.workflow_run_count_1": "%d 개 워크플로우 실행",
   "actions.runs.workflow_run_count_n": "%d 개 워크플로우 실행",
   "actions.runs.commit": "커밋",
@@ -3760,6 +3777,8 @@
   "actions.runs.status": "상태",
   "actions.runs.actors_no_select": "모든 액터",
   "actions.runs.status_no_select": "모든 상태",
+  "actions.runs.branch": "브랜치",
+  "actions.runs.branches_no_select": "모든 브랜치",
   "actions.runs.no_results": "일치하는 결과가 없습니다.",
   "actions.runs.no_workflows": "아직 워크플로가 없습니다.",
   "actions.runs.no_workflows.quick_start": "Gitea Actions를 시작하는 방법을 모르시겠어요? <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"%s\">빠른 시작 가이드</a>를 참조하세요.",
@@ -3774,11 +3793,23 @@
   "actions.runs.view_workflow_file": "워크플로우 파일 표시",
   "actions.runs.summary": "요약",
   "actions.runs.all_jobs": "모든 작업",
+  "actions.runs.expand_caller_jobs": "이 재사용 워크플로 호출기의 작업 표시",
+  "actions.runs.collapse_caller_jobs": "이 재사용 워크플로 호출기의 작업 숨기기",
   "actions.runs.attempt": "시도",
   "actions.runs.latest": "최신",
   "actions.runs.latest_attempt": "최근 시도",
   "actions.runs.triggered_via": "%s를 통해 트리거됨",
   "actions.runs.total_duration": "총기간:",
+  "actions.runs.workflow_dependencies": "워크플로우 의존성",
+  "actions.runs.graph_jobs_count_1": "%d 작업",
+  "actions.runs.graph_jobs_count_n": "%d 작업",
+  "actions.runs.graph_dependencies_count_1": "%d 의존성",
+  "actions.runs.graph_dependencies_count_n": "%d 의존성",
+  "actions.runs.graph_success_rate": "%s 성공",
+  "actions.runs.graph_zoom_in": "줌인 (그래프에서 Ctrl/Cmd + 스크롤)",
+  "actions.runs.graph_zoom_max": "이미 100% 줌",
+  "actions.runs.graph_zoom_out": "줌아웃(그래프에서 Ctrl/Cmd + 스크롤)",
+  "actions.runs.graph_reset_view": "보기 다시설정",
   "actions.workflow.disable": "워크플로 비활성화",
   "actions.workflow.disable_success": "워크플로 '%s'가 성공적으로 비활성화되었습니다.",
   "actions.workflow.enable": "워크플로 활성화",
diff --git a/options/locale/locale_zh-CN.json b/options/locale/locale_zh-CN.json
index 5960e554b75..ba52e2e79d7 100644
--- a/options/locale/locale_zh-CN.json
+++ b/options/locale/locale_zh-CN.json
@@ -105,6 +105,7 @@
   "copy_error": "复制失败",
   "copy_type_unsupported": "无法复制此类型的文件内容",
   "copy_filename": "复制文件名",
+  "copy_output": "复制输出",
   "write": "撰写",
   "preview": "预览",
   "loading": "正在加载…",
@@ -313,7 +314,6 @@
   "install.admin_email": "邮箱地址",
   "install.install_btn_confirm": "立即安装",
   "install.test_git_failed": "无法识别 'git' 命令：%v",
-  "install.sqlite3_not_available": "您所使用的发行版不支持 SQLite3，请从 %s 下载官方构建版，而不是 gobuild 版本。",
   "install.invalid_db_setting": "数据库设置无效: %v",
   "install.invalid_db_table": "数据库表「%s」无效：%v",
   "install.invalid_repo_path": "仓库根目录设置无效：%v",
@@ -1322,7 +1322,7 @@
   "repo.commits.desc": "浏览代码修改历史",
   "repo.commits.commits": "次代码提交",
   "repo.commits.no_commits": "没有共同的提交。「%s」和「%s」的历史完全不同。",
-  "repo.commits.nothing_to_compare": "这些分支是相同的。",
+  "repo.commits.nothing_to_compare": "没有差异可显示。",
   "repo.commits.search.tooltip": "您可以在关键词前加上前缀，如「author:」、「committer:」、「after:」或「before:」，例如「retrin author:Alice before:2019-01-13」。",
   "repo.commits.search_branch": "此分支",
   "repo.commits.search_all": "所有分支",
@@ -1385,6 +1385,7 @@
   "repo.projects.column.delete": "删除列",
   "repo.projects.column.deletion_desc": "删除项目列会将所有相关工单移至默认列。是否继续？",
   "repo.projects.column.color": "颜色",
+  "repo.projects.column": "列",
   "repo.projects.open": "开启",
   "repo.projects.close": "关闭",
   "repo.projects.column.assigned_to": "指派给",
@@ -1783,8 +1784,9 @@
   "repo.pulls.select_commit_hold_shift_for_range": "选择提交。按住 Shift + 单击选择一个范围",
   "repo.pulls.review_only_possible_for_full_diff": "只有在查看全部差异时才能进行审核",
   "repo.pulls.filter_changes_by_commit": "按提交筛选",
-  "repo.pulls.nothing_to_compare": "分支内容相同，无需创建合并请求。",
-  "repo.pulls.nothing_to_compare_have_tag": "所选分支 / Git 标签相同。",
+  "repo.pulls.nothing_to_compare": "没有差异可显示。无需创建合并请求。",
+  "repo.pulls.no_common_history": "这些分支没有共同的合并基点。请选择不同的基点或比较分支。",
+  "repo.pulls.nothing_to_compare_have_tag": "所选分支或 Git 标签之间没有差异可显示。",
   "repo.pulls.nothing_to_compare_and_allow_empty_pr": "这些分支是相等的，此合并请求将为空。",
   "repo.pulls.has_pull_request": "这些分支之间的合并请求已存在：<a href=\"%[1]s\">%[2]s#%[3]d</a>",
   "repo.pulls.create": "创建合并请求",
@@ -1818,6 +1820,7 @@
   "repo.pulls.required_status_check_failed": "一些必要的检查没有成功",
   "repo.pulls.required_status_check_missing": "缺少一些必要的检查。",
   "repo.pulls.required_status_check_administrator": "作为管理员，您仍可合并此合并请求",
+  "repo.pulls.required_status_check_bypass_allowlist": "您可以在此次合并中绕过分支保护规则。",
   "repo.pulls.blocked_by_approvals": "此合并请求还没有足够的批准。已获批准数 %d 个，需获批准数 %d 个。",
   "repo.pulls.blocked_by_approvals_whitelisted": "此合并请求尚未获得足够的批准。已获得 %d/%d 个来自允许列表中用户或团队的批准。",
   "repo.pulls.blocked_by_rejection": "此合并请求有官方审核员请求的更改。",
@@ -1956,7 +1959,6 @@
   "repo.signing.wont_sign.headsigned": "合并将不会被签名，因为最新提交没有签名。",
   "repo.signing.wont_sign.commitssigned": "合并将不会被签名，因为所有相关的提交都没有签名。",
   "repo.signing.wont_sign.approved": "合并将不会被签名，因为合并请求未被批准。",
-  "repo.signing.wont_sign.not_signed_in": "您还没有登录。",
   "repo.ext_wiki": "访问外部百科",
   "repo.ext_wiki.desc": "链接到外部百科。",
   "repo.wiki": "百科",
@@ -2138,7 +2140,9 @@
   "repo.settings.pulls_desc": "启用合并请求",
   "repo.settings.pulls.ignore_whitespace": "忽略空白冲突",
   "repo.settings.pulls.enable_autodetect_manual_merge": "启用自动检查手动合并（注意：在某些特殊情况下可能会出现误判）",
+  "repo.settings.pulls.allow_merge_update": "允许通过合并更新合并请求分支",
   "repo.settings.pulls.allow_rebase_update": "允许通过变基更新合并请求分支",
+  "repo.settings.pulls.default_update_style": "默认分支更新风格",
   "repo.settings.pulls.default_target_branch": "新合并请求的默认目标分支",
   "repo.settings.pulls.default_target_branch_default": "默认分支（%s）",
   "repo.settings.pulls.default_delete_branch_after_merge": "默认合并后删除合并请求分支",
@@ -2413,6 +2417,11 @@
   "repo.settings.protect_merge_whitelist_committers_desc": "仅允许白名单用户或团队合并合并请求到此分支。",
   "repo.settings.protect_merge_whitelist_users": "合并白名单用户：",
   "repo.settings.protect_merge_whitelist_teams": "合并白名单团队：",
+  "repo.settings.protect_bypass_allowlist": "绕过分支保护",
+  "repo.settings.protect_enable_bypass_allowlist": "允许指定用户或团队绕过分支保护",
+  "repo.settings.protect_enable_bypass_allowlist_desc": "列入白名单的用户或团队可以执行合并或推送操作，即使在通常情况下，这些操作会被所需的审批、状态检查或受保护文件规则所阻挡。",
+  "repo.settings.protect_bypass_allowlist_users": "允许绕过保护的用户：",
+  "repo.settings.protect_bypass_allowlist_teams": "允许绕过保护的团队：",
   "repo.settings.protect_check_status_contexts": "启用状态检查",
   "repo.settings.protect_status_check_patterns": "状态检查表达式：",
   "repo.settings.protect_status_check_patterns_desc": "输入表达式以指定在分支合并到匹配此规则的分支之前必须通过哪些状态检查。每一行指定一个表达式且表达式不能为空。",
@@ -2454,7 +2463,7 @@
   "repo.settings.block_outdated_branch": "如果合并请求已经过时，阻止合并",
   "repo.settings.block_outdated_branch_desc": "当头部分支落后基础分支时，不能合并。",
   "repo.settings.block_admin_merge_override": "管理员须遵守分支保护规则",
-  "repo.settings.block_admin_merge_override_desc": "管理员须遵守分支保护规则，不能规避该规则。",
+  "repo.settings.block_admin_merge_override_desc": "管理员必须遵守分支保护规则，且不得绕过这些规则。如果启用了绕过白名单功能，位于绕过白名单中的用户或团队仍可绕过这些规则。",
   "repo.settings.default_branch_desc": "选择一个默认分支用于提交代码。",
   "repo.settings.default_target_branch_desc": "如果在仓库高级设置的合并请求部分中进行了设置，则合并请求可以使用不同的默认目标分支。",
   "repo.settings.merge_style_desc": "合并方式",
@@ -3313,7 +3322,6 @@
   "admin.config.cache_config": "缓存配置",
   "admin.config.cache_adapter": "缓存适配器",
   "admin.config.cache_interval": "缓存周期",
-  "admin.config.cache_conn": "缓存连接字符串",
   "admin.config.cache_item_ttl": "缓存项目 TTL",
   "admin.config.cache_test": "测试缓存",
   "admin.config.cache_test_failed": "缓存测试失败：%v。",
@@ -3328,7 +3336,6 @@
   "admin.config.instance_web_banner.message_placeholder": "横幅消息（支持 Markdown）",
   "admin.config.session_config": "会话配置",
   "admin.config.session_provider": "会话提供者",
-  "admin.config.provider_config": "提供者配置",
   "admin.config.cookie_name": "Cookie 名称",
   "admin.config.gc_interval_time": "GC 周期",
   "admin.config.session_life_time": "会话生命周期",
@@ -3485,7 +3492,7 @@
   "gpg.default_key": "使用默认密钥签名",
   "gpg.error.extract_sign": "无法提取签名",
   "gpg.error.generate_hash": "无法生成提交的哈希",
-  "gpg.error.no_committer_account": "没有帐户链接到提交者的邮箱",
+  "gpg.error.no_committer_account": "没有帐户关联到提交者的邮箱",
   "gpg.error.no_gpg_keys_found": "找不到此签名对应的密钥",
   "gpg.error.not_signed_commit": "未签名的提交",
   "gpg.error.failed_retrieval_gpg_keys": "找不到任何与该提交者账号相关的密钥",
@@ -3624,7 +3631,13 @@
   "packages.terraform.delete.latest": "无法删除最新版本的 Terraform 状态。",
   "packages.vagrant.install": "若要添加一个 Vagrant box，请运行以下命令：",
   "packages.settings.link": "将此软件包链接到仓库",
-  "packages.settings.link.description": "如果您将一个软件包与一个仓库链接起来，软件包将显示在仓库的软件包列表中。",
+  "packages.settings.link.description": "如果您将软件包与仓库关联，该软件包将显示在仓库的软件包列表中。",
+  "packages.settings.link.notice1": "仅同一所有者名下的仓库可以进行关联。",
+  "packages.settings.link.notice2": "关联仓库不会更改软件包的可见性。",
+  "packages.settings.link.notice3": "留空该字段将删除关联。",
+  "packages.settings.visibility": "软件包可见性",
+  "packages.settings.visibility.inherit": "软件包的可见性继承自其所有者，无法在此处单独更改。若要更改，请更新拥有此软件包的用户或组织的可见性设置。",
+  "packages.settings.visibility.button": "更改所有者可见性",
   "packages.settings.link.select": "选择仓库",
   "packages.settings.link.button": "更新仓库链接",
   "packages.settings.link.success": "仓库链接已成功更新。",
@@ -3698,6 +3711,7 @@
   "actions.status.success": "成功",
   "actions.status.failure": "失败",
   "actions.status.cancelled": "已取消",
+  "actions.status.cancelling": "取消中",
   "actions.status.skipped": "已忽略",
   "actions.status.blocked": "阻塞中",
   "actions.runners": "运行器",
@@ -3745,6 +3759,8 @@
   "actions.runners.reset_registration_token_confirm": "是否吊销当前令牌并生成一个新令牌？",
   "actions.runners.reset_registration_token_success": "成功重置运行器注册令牌",
   "actions.runs.all_workflows": "所有工作流",
+  "actions.runs.other_workflows": "其他工作流",
+  "actions.runs.other_workflows_tooltip": "在此仓库中已执行，但不存在于默认分支上的工作流。",
   "actions.runs.workflow_run_count_1": "%d 次工作流运行",
   "actions.runs.workflow_run_count_n": "%d 次工作流运行",
   "actions.runs.commit": "提交",
@@ -3760,6 +3776,8 @@
   "actions.runs.status": "状态",
   "actions.runs.actors_no_select": "所有操作者",
   "actions.runs.status_no_select": "所有状态",
+  "actions.runs.branch": "分支",
+  "actions.runs.branches_no_select": "所有分支",
   "actions.runs.no_results": "没有匹配的结果。",
   "actions.runs.no_workflows": "目前还没有工作流。",
   "actions.runs.no_workflows.quick_start": "不知道如何使用 Gitea 工作流吗？请查看<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"%s\">快速开始指南</a>。",
diff --git a/package.json b/package.json
index eafd95da1f5..8a915ea795c 100644
--- a/package.json
+++ b/package.json
@@ -1,26 +1,26 @@
 {
   "type": "module",
-  "packageManager": "pnpm@10.33.0",
+  "packageManager": "pnpm@11.4.0",
   "engines": {
     "node": ">= 22.18.0",
-    "pnpm": ">= 10.0.0"
+    "pnpm": ">= 11.0.0"
   },
   "dependencies": {
     "@citation-js/core": "0.7.21",
     "@citation-js/plugin-bibtex": "0.7.21",
     "@citation-js/plugin-csl": "0.7.22",
     "@citation-js/plugin-software-formats": "0.6.2",
-    "@codemirror/autocomplete": "6.20.1",
+    "@codemirror/autocomplete": "6.20.2",
     "@codemirror/commands": "6.10.3",
     "@codemirror/lang-json": "6.0.2",
     "@codemirror/lang-markdown": "6.5.0",
     "@codemirror/language": "6.12.3",
     "@codemirror/language-data": "6.5.2",
-    "@codemirror/legacy-modes": "6.5.2",
-    "@codemirror/lint": "6.9.5",
-    "@codemirror/search": "6.6.0",
+    "@codemirror/legacy-modes": "6.5.3",
+    "@codemirror/lint": "6.9.6",
+    "@codemirror/search": "6.7.0",
     "@codemirror/state": "6.6.0",
-    "@codemirror/view": "6.41.1",
+    "@codemirror/view": "6.43.0",
     "@deltablot/dropzone": "7.4.3",
     "@github/markdown-toolbar-element": "2.2.3",
     "@github/paste-markdown": "1.5.3",
@@ -28,38 +28,38 @@
     "@lezer/highlight": "1.2.3",
     "@mcaptcha/vanilla-glue": "0.1.0-rc2",
     "@mermaid-js/layout-elk": "0.2.1",
-    "@primer/octicons": "19.24.1",
+    "@primer/octicons": "19.27.0",
     "@replit/codemirror-indentation-markers": "6.5.3",
     "@replit/codemirror-lang-nix": "6.0.1",
     "@replit/codemirror-lang-svelte": "6.0.0",
     "@replit/codemirror-vscode-keymap": "6.0.2",
     "@resvg/resvg-wasm": "2.6.2",
-    "@vitejs/plugin-vue": "6.0.6",
+    "@vitejs/plugin-vue": "6.0.7",
     "ansi_up": "6.0.6",
     "asciinema-player": "3.15.1",
     "chart.js": "4.5.1",
     "chartjs-adapter-dayjs-4": "1.0.4",
     "chartjs-plugin-zoom": "2.2.0",
-    "clippie": "4.1.14",
+    "clippie": "4.2.0",
     "codemirror-lang-elixir": "4.0.1",
     "colord": "2.9.3",
     "compare-versions": "6.1.1",
     "cropperjs": "1.6.2",
-    "dayjs": "1.11.20",
-    "easymde": "2.20.0",
+    "dayjs": "1.11.21",
+    "easymde": "2.21.0",
     "esbuild": "0.28.0",
     "idiomorph": "0.7.4",
     "jquery": "4.0.0",
     "js-yaml": "4.1.1",
-    "katex": "0.16.45",
-    "mermaid": "11.14.0",
+    "katex": "0.17.0",
+    "mermaid": "11.15.0",
     "online-3d-viewer": "0.18.0",
     "pdfobject": "2.3.1",
     "perfect-debounce": "2.1.0",
-    "postcss": "8.5.10",
-    "rolldown-license-plugin": "3.0.1",
+    "postcss": "8.5.15",
+    "rolldown-license-plugin": "3.0.8",
     "sortablejs": "1.15.7",
-    "swagger-ui-dist": "5.32.4",
+    "swagger-ui-dist": "5.32.6",
     "tailwindcss": "3.4.19",
     "throttle-debounce": "5.0.2",
     "tippy.js": "6.3.7",
@@ -67,89 +67,61 @@
     "tributejs": "5.1.3",
     "uint8-to-base64": "0.2.1",
     "vanilla-colorful": "0.7.2",
-    "vite": "8.0.9",
-    "vite-string-plugin": "2.0.2",
-    "vue": "3.5.32",
+    "vite": "8.0.14",
+    "vite-string-plugin": "2.0.4",
+    "vue": "3.5.35",
     "vue-bar-graph": "2.2.0",
     "vue-chartjs": "5.3.3"
   },
   "devDependencies": {
-    "@eslint-community/eslint-plugin-eslint-comments": "4.7.1",
+    "@eslint-community/eslint-plugin-eslint-comments": "4.7.2",
     "@eslint/json": "1.2.0",
-    "@playwright/test": "1.59.1",
+    "@playwright/test": "1.60.0",
     "@stylistic/eslint-plugin": "5.10.0",
-    "@stylistic/stylelint-plugin": "5.1.0",
+    "@stylistic/stylelint-plugin": "5.2.0",
     "@types/codemirror": "5.60.17",
     "@types/jquery": "4.0.0",
     "@types/js-yaml": "4.0.9",
     "@types/katex": "0.16.8",
-    "@types/node": "25.6.0",
+    "@types/node": "25.9.1",
     "@types/pdfobject": "2.2.5",
     "@types/sortablejs": "1.15.9",
     "@types/swagger-ui-dist": "3.30.6",
     "@types/throttle-debounce": "5.0.2",
     "@types/toastify-js": "1.12.4",
-    "@typescript-eslint/parser": "8.59.0",
-    "@vitejs/plugin-vue": "6.0.6",
-    "@vitest/eslint-plugin": "1.6.16",
-    "eslint": "10.2.1",
+    "@typescript-eslint/parser": "8.60.0",
+    "@vitejs/plugin-vue": "6.0.7",
+    "@vitest/eslint-plugin": "1.6.18",
+    "eslint": "10.4.0",
     "eslint-import-resolver-typescript": "4.4.4",
     "eslint-plugin-array-func": "5.1.1",
-    "eslint-plugin-de-morgan": "2.1.1",
+    "eslint-plugin-de-morgan": "2.1.2",
     "eslint-plugin-github": "6.0.0",
     "eslint-plugin-import-x": "4.16.2",
-    "eslint-plugin-playwright": "2.10.2",
+    "eslint-plugin-playwright": "2.10.4",
     "eslint-plugin-regexp": "3.1.0",
     "eslint-plugin-sonarjs": "4.0.3",
     "eslint-plugin-unicorn": "64.0.0",
-    "eslint-plugin-vue": "10.8.0",
-    "eslint-plugin-vue-scoped-css": "3.0.0",
+    "eslint-plugin-vue": "10.9.1",
+    "eslint-plugin-vue-scoped-css": "3.1.0",
     "eslint-plugin-wc": "3.1.0",
-    "globals": "17.5.0",
+    "globals": "17.6.0",
     "happy-dom": "20.9.0",
-    "jiti": "2.6.1",
+    "jiti": "2.7.0",
     "markdownlint-cli": "0.48.0",
-    "material-icon-theme": "5.33.1",
-    "nolyfill": "1.0.44",
+    "material-icon-theme": "5.35.0",
     "postcss-html": "1.8.1",
-    "spectral-cli-bundle": "1.0.7",
-    "stylelint": "17.8.0",
+    "spectral-cli-bundle": "1.0.8",
+    "stylelint": "17.12.0",
     "stylelint-config-recommended": "18.0.0",
     "stylelint-declaration-block-no-ignored-properties": "3.0.0",
     "stylelint-declaration-strict-value": "1.11.1",
     "stylelint-value-no-unknown-custom-properties": "6.1.1",
     "svgo": "4.0.1",
     "typescript": "6.0.3",
-    "typescript-eslint": "8.59.0",
-    "updates": "17.16.3",
-    "vitest": "4.1.4",
-    "vue-tsc": "3.2.7"
-  },
-  "pnpm": {
-    "peerDependencyRules": {
-      "allowedVersions": {
-        "eslint-plugin-github>eslint": ">=9"
-      }
-    },
-    "overrides": {
-      "array-includes": "npm:@nolyfill/array-includes@^1",
-      "array.prototype.findlastindex": "npm:@nolyfill/array.prototype.findlastindex@^1",
-      "array.prototype.flat": "npm:@nolyfill/array.prototype.flat@^1",
-      "array.prototype.flatmap": "npm:@nolyfill/array.prototype.flatmap@^1",
-      "es-aggregate-error": "npm:@nolyfill/es-aggregate-error@^1",
-      "hasown": "npm:@nolyfill/hasown@^1",
-      "is-core-module": "npm:@nolyfill/is-core-module@^1",
-      "object.assign": "npm:@nolyfill/object.assign@^1",
-      "object.fromentries": "npm:@nolyfill/object.fromentries@^1",
-      "object.groupby": "npm:@nolyfill/object.groupby@^1",
-      "object.values": "npm:@nolyfill/object.values@^1",
-      "safe-buffer": "npm:@nolyfill/safe-buffer@^1",
-      "safe-regex-test": "npm:@nolyfill/safe-regex-test@^1",
-      "safer-buffer": "npm:@nolyfill/safer-buffer@^1",
-      "string.prototype.includes": "npm:@nolyfill/string.prototype.includes@^1",
-      "string.prototype.trimend": "npm:@nolyfill/string.prototype.trimend@^1",
-      "object-keys": "npm:@nolyfill/object-keys@^1",
-      "object.entries": "npm:@nolyfill/object.entries@^1"
-    }
+    "typescript-eslint": "8.60.0",
+    "updates": "17.17.2",
+    "vitest": "4.1.7",
+    "vue-tsc": "3.3.2"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7ebedae9a75..11c6ebf5add 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4,26 +4,6 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
-overrides:
-  array-includes: npm:@nolyfill/array-includes@^1
-  array.prototype.findlastindex: npm:@nolyfill/array.prototype.findlastindex@^1
-  array.prototype.flat: npm:@nolyfill/array.prototype.flat@^1
-  array.prototype.flatmap: npm:@nolyfill/array.prototype.flatmap@^1
-  es-aggregate-error: npm:@nolyfill/es-aggregate-error@^1
-  hasown: npm:@nolyfill/hasown@^1
-  is-core-module: npm:@nolyfill/is-core-module@^1
-  object.assign: npm:@nolyfill/object.assign@^1
-  object.fromentries: npm:@nolyfill/object.fromentries@^1
-  object.groupby: npm:@nolyfill/object.groupby@^1
-  object.values: npm:@nolyfill/object.values@^1
-  safe-buffer: npm:@nolyfill/safe-buffer@^1
-  safe-regex-test: npm:@nolyfill/safe-regex-test@^1
-  safer-buffer: npm:@nolyfill/safer-buffer@^1
-  string.prototype.includes: npm:@nolyfill/string.prototype.includes@^1
-  string.prototype.trimend: npm:@nolyfill/string.prototype.trimend@^1
-  object-keys: npm:@nolyfill/object-keys@^1
-  object.entries: npm:@nolyfill/object.entries@^1
-
 importers:
 
   .:
@@ -41,8 +21,8 @@ importers:
         specifier: 0.6.2
         version: 0.6.2
       '@codemirror/autocomplete':
-        specifier: 6.20.1
-        version: 6.20.1
+        specifier: 6.20.2
+        version: 6.20.2
       '@codemirror/commands':
         specifier: 6.10.3
         version: 6.10.3
@@ -59,20 +39,20 @@ importers:
         specifier: 6.5.2
         version: 6.5.2
       '@codemirror/legacy-modes':
-        specifier: 6.5.2
-        version: 6.5.2
+        specifier: 6.5.3
+        version: 6.5.3
       '@codemirror/lint':
-        specifier: 6.9.5
-        version: 6.9.5
+        specifier: 6.9.6
+        version: 6.9.6
       '@codemirror/search':
-        specifier: 6.6.0
-        version: 6.6.0
+        specifier: 6.7.0
+        version: 6.7.0
       '@codemirror/state':
         specifier: 6.6.0
         version: 6.6.0
       '@codemirror/view':
-        specifier: 6.41.1
-        version: 6.41.1
+        specifier: 6.43.0
+        version: 6.43.0
       '@deltablot/dropzone':
         specifier: 7.4.3
         version: 7.4.3
@@ -93,28 +73,28 @@ importers:
         version: 0.1.0-rc2
       '@mermaid-js/layout-elk':
         specifier: 0.2.1
-        version: 0.2.1(mermaid@11.14.0)
+        version: 0.2.1(mermaid@11.15.0)
       '@primer/octicons':
-        specifier: 19.24.1
-        version: 19.24.1
+        specifier: 19.27.0
+        version: 19.27.0
       '@replit/codemirror-indentation-markers':
         specifier: 6.5.3
-        version: 6.5.3(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.41.1)
+        version: 6.5.3(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)
       '@replit/codemirror-lang-nix':
         specifier: 6.0.1
-        version: 6.0.1(@codemirror/autocomplete@6.20.1)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.41.1)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/lr@1.4.10)
+        version: 6.0.1(@codemirror/autocomplete@6.20.2)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/lr@1.4.10)
       '@replit/codemirror-lang-svelte':
         specifier: 6.0.0
-        version: 6.0.0(@codemirror/autocomplete@6.20.1)(@codemirror/lang-css@6.3.1)(@codemirror/lang-html@6.4.11)(@codemirror/lang-javascript@6.2.5)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.41.1)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/javascript@1.5.4)(@lezer/lr@1.4.10)
+        version: 6.0.0(@codemirror/autocomplete@6.20.2)(@codemirror/lang-css@6.3.1)(@codemirror/lang-html@6.4.11)(@codemirror/lang-javascript@6.2.5)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/javascript@1.5.4)(@lezer/lr@1.4.10)
       '@replit/codemirror-vscode-keymap':
         specifier: 6.0.2
-        version: 6.0.2(@codemirror/autocomplete@6.20.1)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/view@6.41.1)
+        version: 6.0.2(@codemirror/autocomplete@6.20.2)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)
       '@resvg/resvg-wasm':
         specifier: 2.6.2
         version: 2.6.2
       '@vitejs/plugin-vue':
-        specifier: 6.0.6
-        version: 6.0.6(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1))(vue@3.5.32(typescript@6.0.3))
+        specifier: 6.0.7
+        version: 6.0.7(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))(vue@3.5.35(typescript@6.0.3))
       ansi_up:
         specifier: 6.0.6
         version: 6.0.6
@@ -126,13 +106,13 @@ importers:
         version: 4.5.1
       chartjs-adapter-dayjs-4:
         specifier: 1.0.4
-        version: 1.0.4(chart.js@4.5.1)(dayjs@1.11.20)
+        version: 1.0.4(chart.js@4.5.1)(dayjs@1.11.21)
       chartjs-plugin-zoom:
         specifier: 2.2.0
         version: 2.2.0(chart.js@4.5.1)
       clippie:
-        specifier: 4.1.14
-        version: 4.1.14
+        specifier: 4.2.0
+        version: 4.2.0
       codemirror-lang-elixir:
         specifier: 4.0.1
         version: 4.0.1
@@ -146,11 +126,11 @@ importers:
         specifier: 1.6.2
         version: 1.6.2
       dayjs:
-        specifier: 1.11.20
-        version: 1.11.20
+        specifier: 1.11.21
+        version: 1.11.21
       easymde:
-        specifier: 2.20.0
-        version: 2.20.0
+        specifier: 2.21.0
+        version: 2.21.0
       esbuild:
         specifier: 0.28.0
         version: 0.28.0
@@ -164,11 +144,11 @@ importers:
         specifier: 4.1.1
         version: 4.1.1
       katex:
-        specifier: 0.16.45
-        version: 0.16.45
+        specifier: 0.17.0
+        version: 0.17.0
       mermaid:
-        specifier: 11.14.0
-        version: 11.14.0
+        specifier: 11.15.0
+        version: 11.15.0
       online-3d-viewer:
         specifier: 0.18.0
         version: 0.18.0
@@ -179,17 +159,17 @@ importers:
         specifier: 2.1.0
         version: 2.1.0
       postcss:
-        specifier: 8.5.10
-        version: 8.5.10
+        specifier: 8.5.15
+        version: 8.5.15
       rolldown-license-plugin:
-        specifier: 3.0.1
-        version: 3.0.1(rolldown@1.0.0-rc.16)
+        specifier: 3.0.8
+        version: 3.0.8(rolldown@1.0.2)
       sortablejs:
         specifier: 1.15.7
         version: 1.15.7
       swagger-ui-dist:
-        specifier: 5.32.4
-        version: 5.32.4
+        specifier: 5.32.6
+        version: 5.32.6
       tailwindcss:
         specifier: 3.4.19
         version: 3.4.19
@@ -212,36 +192,36 @@ importers:
         specifier: 0.7.2
         version: 0.7.2
       vite:
-        specifier: 8.0.9
-        version: 8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1)
+        specifier: 8.0.14
+        version: 8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
       vite-string-plugin:
-        specifier: 2.0.2
-        version: 2.0.2(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1))
+        specifier: 2.0.4
+        version: 2.0.4(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
       vue:
-        specifier: 3.5.32
-        version: 3.5.32(typescript@6.0.3)
+        specifier: 3.5.35
+        version: 3.5.35(typescript@6.0.3)
       vue-bar-graph:
         specifier: 2.2.0
         version: 2.2.0(typescript@6.0.3)
       vue-chartjs:
         specifier: 5.3.3
-        version: 5.3.3(chart.js@4.5.1)(vue@3.5.32(typescript@6.0.3))
+        version: 5.3.3(chart.js@4.5.1)(vue@3.5.35(typescript@6.0.3))
     devDependencies:
       '@eslint-community/eslint-plugin-eslint-comments':
-        specifier: 4.7.1
-        version: 4.7.1(eslint@10.2.1(jiti@2.6.1))
+        specifier: 4.7.2
+        version: 4.7.2(eslint@10.4.0(jiti@2.7.0))
       '@eslint/json':
         specifier: 1.2.0
         version: 1.2.0
       '@playwright/test':
-        specifier: 1.59.1
-        version: 1.59.1
+        specifier: 1.60.0
+        version: 1.60.0
       '@stylistic/eslint-plugin':
         specifier: 5.10.0
-        version: 5.10.0(eslint@10.2.1(jiti@2.6.1))
+        version: 5.10.0(eslint@10.4.0(jiti@2.7.0))
       '@stylistic/stylelint-plugin':
-        specifier: 5.1.0
-        version: 5.1.0(stylelint@17.8.0(typescript@6.0.3))
+        specifier: 5.2.0
+        version: 5.2.0(stylelint@17.12.0(typescript@6.0.3))
       '@types/codemirror':
         specifier: 5.60.17
         version: 5.60.17
@@ -255,8 +235,8 @@ importers:
         specifier: 0.16.8
         version: 0.16.8
       '@types/node':
-        specifier: 25.6.0
-        version: 25.6.0
+        specifier: 25.9.1
+        version: 25.9.1
       '@types/pdfobject':
         specifier: 2.2.5
         version: 2.2.5
@@ -273,89 +253,86 @@ importers:
         specifier: 1.12.4
         version: 1.12.4
       '@typescript-eslint/parser':
-        specifier: 8.59.0
-        version: 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
+        specifier: 8.60.0
+        version: 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
       '@vitest/eslint-plugin':
-        specifier: 1.6.16
-        version: 1.6.16(@typescript-eslint/eslint-plugin@8.59.0(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)(vitest@4.1.4(@types/node@25.6.0)(happy-dom@20.9.0)(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1)))
+        specifier: 1.6.18
+        version: 1.6.18(@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.7(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)))
       eslint:
-        specifier: 10.2.1
-        version: 10.2.1(jiti@2.6.1)
+        specifier: 10.4.0
+        version: 10.4.0(jiti@2.7.0)
       eslint-import-resolver-typescript:
         specifier: 4.4.4
-        version: 4.4.4(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.2.1(jiti@2.6.1)))(eslint-plugin-import@2.32.0)(eslint@10.2.1(jiti@2.6.1))
+        version: 4.4.4(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.0(jiti@2.7.0))
       eslint-plugin-array-func:
         specifier: 5.1.1
-        version: 5.1.1(eslint@10.2.1(jiti@2.6.1))
+        version: 5.1.1(eslint@10.4.0(jiti@2.7.0))
       eslint-plugin-de-morgan:
-        specifier: 2.1.1
-        version: 2.1.1(eslint@10.2.1(jiti@2.6.1))
+        specifier: 2.1.2
+        version: 2.1.2(eslint@10.4.0(jiti@2.7.0))
       eslint-plugin-github:
         specifier: 6.0.0
-        version: 6.0.0(eslint-import-resolver-typescript@4.4.4)(eslint@10.2.1(jiti@2.6.1))
+        version: 6.0.0(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0))
       eslint-plugin-import-x:
         specifier: 4.16.2
-        version: 4.16.2(@typescript-eslint/utils@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.2.1(jiti@2.6.1))
+        version: 4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0))
       eslint-plugin-playwright:
-        specifier: 2.10.2
-        version: 2.10.2(eslint@10.2.1(jiti@2.6.1))
+        specifier: 2.10.4
+        version: 2.10.4(eslint@10.4.0(jiti@2.7.0))
       eslint-plugin-regexp:
         specifier: 3.1.0
-        version: 3.1.0(eslint@10.2.1(jiti@2.6.1))
+        version: 3.1.0(eslint@10.4.0(jiti@2.7.0))
       eslint-plugin-sonarjs:
         specifier: 4.0.3
-        version: 4.0.3(eslint@10.2.1(jiti@2.6.1))
+        version: 4.0.3(eslint@10.4.0(jiti@2.7.0))
       eslint-plugin-unicorn:
         specifier: 64.0.0
-        version: 64.0.0(eslint@10.2.1(jiti@2.6.1))
+        version: 64.0.0(eslint@10.4.0(jiti@2.7.0))
       eslint-plugin-vue:
-        specifier: 10.8.0
-        version: 10.8.0(@stylistic/eslint-plugin@5.10.0(eslint@10.2.1(jiti@2.6.1)))(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(vue-eslint-parser@10.4.0(eslint@10.2.1(jiti@2.6.1)))
+        specifier: 10.9.1
+        version: 10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.4.0(jiti@2.7.0)))(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.0(jiti@2.7.0)))
       eslint-plugin-vue-scoped-css:
-        specifier: 3.0.0
-        version: 3.0.0(eslint@10.2.1(jiti@2.6.1))(vue-eslint-parser@10.4.0(eslint@10.2.1(jiti@2.6.1)))
+        specifier: 3.1.0
+        version: 3.1.0(eslint@10.4.0(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.0(jiti@2.7.0)))
       eslint-plugin-wc:
         specifier: 3.1.0
-        version: 3.1.0(eslint@10.2.1(jiti@2.6.1))
+        version: 3.1.0(eslint@10.4.0(jiti@2.7.0))
       globals:
-        specifier: 17.5.0
-        version: 17.5.0
+        specifier: 17.6.0
+        version: 17.6.0
       happy-dom:
         specifier: 20.9.0
         version: 20.9.0
       jiti:
-        specifier: 2.6.1
-        version: 2.6.1
+        specifier: 2.7.0
+        version: 2.7.0
       markdownlint-cli:
         specifier: 0.48.0
         version: 0.48.0
       material-icon-theme:
-        specifier: 5.33.1
-        version: 5.33.1
-      nolyfill:
-        specifier: 1.0.44
-        version: 1.0.44
+        specifier: 5.35.0
+        version: 5.35.0
       postcss-html:
         specifier: 1.8.1
         version: 1.8.1
       spectral-cli-bundle:
-        specifier: 1.0.7
-        version: 1.0.7
+        specifier: 1.0.8
+        version: 1.0.8
       stylelint:
-        specifier: 17.8.0
-        version: 17.8.0(typescript@6.0.3)
+        specifier: 17.12.0
+        version: 17.12.0(typescript@6.0.3)
       stylelint-config-recommended:
         specifier: 18.0.0
-        version: 18.0.0(stylelint@17.8.0(typescript@6.0.3))
+        version: 18.0.0(stylelint@17.12.0(typescript@6.0.3))
       stylelint-declaration-block-no-ignored-properties:
         specifier: 3.0.0
-        version: 3.0.0(stylelint@17.8.0(typescript@6.0.3))
+        version: 3.0.0(stylelint@17.12.0(typescript@6.0.3))
       stylelint-declaration-strict-value:
         specifier: 1.11.1
-        version: 1.11.1(stylelint@17.8.0(typescript@6.0.3))
+        version: 1.11.1(stylelint@17.12.0(typescript@6.0.3))
       stylelint-value-no-unknown-custom-properties:
         specifier: 6.1.1
-        version: 6.1.1(stylelint@17.8.0(typescript@6.0.3))
+        version: 6.1.1(stylelint@17.12.0(typescript@6.0.3))
       svgo:
         specifier: 4.0.1
         version: 4.0.1
@@ -363,17 +340,17 @@ importers:
         specifier: 6.0.3
         version: 6.0.3
       typescript-eslint:
-        specifier: 8.59.0
-        version: 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
+        specifier: 8.60.0
+        version: 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
       updates:
-        specifier: 17.16.3
-        version: 17.16.3
+        specifier: 17.17.2
+        version: 17.17.2
       vitest:
-        specifier: 4.1.4
-        version: 4.1.4(@types/node@25.6.0)(happy-dom@20.9.0)(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1))
+        specifier: 4.1.7
+        version: 4.1.7(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
       vue-tsc:
-        specifier: 3.2.7
-        version: 3.2.7(typescript@6.0.3)
+        specifier: 3.3.2
+        version: 3.3.2(typescript@6.0.3)
 
 packages:
 
@@ -384,54 +361,42 @@ packages:
   '@antfu/install-pkg@1.1.0':
     resolution: {integrity: sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==}
 
-  '@babel/code-frame@7.29.0':
-    resolution: {integrity: sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==}
+  '@babel/code-frame@7.29.7':
+    resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-string-parser@7.27.1':
-    resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
+  '@babel/helper-string-parser@7.29.7':
+    resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-validator-identifier@7.28.5':
-    resolution: {integrity: sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==}
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/parser@7.29.2':
-    resolution: {integrity: sha512-4GgRzy/+fsBa72/RZVJmGKPmZu9Byn8o4MoLpmNe1m8ZfYnz5emHLQz3U4gLud6Zwl0RZIcgiLD7Uq7ySFuDLA==}
+  '@babel/parser@7.29.7':
+    resolution: {integrity: sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
-  '@babel/runtime@7.29.2':
-    resolution: {integrity: sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==}
+  '@babel/runtime@7.29.7':
+    resolution: {integrity: sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/types@7.29.0':
-    resolution: {integrity: sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==}
+  '@babel/types@7.29.7':
+    resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
     engines: {node: '>=6.9.0'}
 
   '@braintree/sanitize-url@7.1.2':
     resolution: {integrity: sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA==}
 
-  '@cacheable/memory@2.0.8':
-    resolution: {integrity: sha512-FvEb29x5wVwu/Kf93IWwsOOEuhHh6dYCJF3vcKLzXc0KXIW181AOzv6ceT4ZpBHDvAfG60eqb+ekmrnLHIy+jw==}
+  '@cacheable/memory@2.0.9':
+    resolution: {integrity: sha512-HdMx6DoGywB30vacDbBsITbIX4pgFqj1zsrV58jZBUw3klzkNoXhj7qOqAgledhxG7YZI5rBSJg7Zp8/VG0DuA==}
 
   '@cacheable/utils@2.4.1':
     resolution: {integrity: sha512-eiFgzCbIneyMlLOmNG4g9xzF7Hv3Mga4LjxjcSC/ues6VYq2+gUbQI8JqNuw/ZM8tJIeIaBGpswAsqV2V7ApgA==}
 
-  '@chevrotain/cst-dts-gen@12.0.0':
-    resolution: {integrity: sha512-fSL4KXjTl7cDgf0B5Rip9Q05BOrYvkJV/RrBTE/bKDN096E4hN/ySpcBK5B24T76dlQ2i32Zc3PAE27jFnFrKg==}
-
-  '@chevrotain/gast@12.0.0':
-    resolution: {integrity: sha512-1ne/m3XsIT8aEdrvT33so0GUC+wkctpUPK6zU9IlOyJLUbR0rg4G7ZiApiJbggpgPir9ERy3FRjT6T7lpgetnQ==}
-
-  '@chevrotain/regexp-to-ast@12.0.0':
-    resolution: {integrity: sha512-p+EW9MaJwgaHguhoqwOtx/FwuGr+DnNn857sXWOi/mClXIkPGl3rn7hGNWvo31HA3vyeQxjqe+H36yZJwYU8cA==}
-
-  '@chevrotain/types@12.0.0':
-    resolution: {integrity: sha512-S+04vjFQKeuYw0/eW3U52LkAHQsB1ASxsPGsLPUyQgrZ2iNNibQrsidruDzjEX2JYfespXMG0eZmXlhA6z7nWA==}
-
-  '@chevrotain/utils@12.0.0':
-    resolution: {integrity: sha512-lB59uJoaGIfOOL9knQqQRfhl9g7x8/wqFkp13zTdkRu1huG9kg6IJs1O8hqj9rs6h7orGxHJUKb+mX3rPbWGhA==}
+  '@chevrotain/types@11.1.2':
+    resolution: {integrity: sha512-U+HFai5+zmJCkK86QsaJtoITlboZHBqrVketcO2ROv865xfCMSFpELQoz1GkX5GzME8pTa+3kbKrZHQtI0gdbw==}
 
   '@citation-js/core@0.7.21':
     resolution: {integrity: sha512-Vobv2/Yfnn6C6BVO/pvj7madQ7Mfzl83/jAWwixbemGF6ZThhGMz8++FD9hWHyHXDMYuLGa6fK68c2VsolZmTA==}
@@ -481,8 +446,8 @@ packages:
     resolution: {integrity: sha512-3XQOO3u4WXY/7AWZyQ+9SuBzS8bYTlJ+NF1uCgrZO64g36nK5iIc5YV9cBl2TL2QhHF6S36nvAsXsj5fX9FeHw==}
     engines: {node: '>=14.0.0'}
 
-  '@codemirror/autocomplete@6.20.1':
-    resolution: {integrity: sha512-1cvg3Vz1dSSToCNlJfRA2WSI4ht3K+WplO0UMOgmUYPivCyy2oueZY6Lx7M9wThm7SDUBViRmuT+OG/i8+ON9A==}
+  '@codemirror/autocomplete@6.20.2':
+    resolution: {integrity: sha512-G5FPkgIiLjOgZMjqVjvuKQ1rGPtHogLldJr33eFJdVLtmwY+giGrlv/ewljLz6b9BSQLkjxuwBc6g6omDM+YxQ==}
 
   '@codemirror/commands@6.10.3':
     resolution: {integrity: sha512-JFRiqhKu+bvSkDLI+rUhJwSxQxYb759W5GBezE8Uc8mHLqC9aV/9aTC7yJSqCtB3F00pylrLCwnyS91Ap5ej4Q==}
@@ -556,23 +521,23 @@ packages:
   '@codemirror/language@6.12.3':
     resolution: {integrity: sha512-QwCZW6Tt1siP37Jet9Tb02Zs81TQt6qQrZR2H+eGMcFsL1zMrk2/b9CLC7/9ieP1fjIUMgviLWMmgiHoJrj+ZA==}
 
-  '@codemirror/legacy-modes@6.5.2':
-    resolution: {integrity: sha512-/jJbwSTazlQEDOQw2FJ8LEEKVS72pU0lx6oM54kGpL8t/NJ2Jda3CZ4pcltiKTdqYSRk3ug1B3pil1gsjA6+8Q==}
+  '@codemirror/legacy-modes@6.5.3':
+    resolution: {integrity: sha512-xCsmIzH78MyWkib9jlPaaun57XNkfbMIhagfaZVd0iLTqlpw3jXaIcbZm72MTmmn64eTZpBVNjbyYh+QXnxRsg==}
 
-  '@codemirror/lint@6.9.5':
-    resolution: {integrity: sha512-GElsbU9G7QT9xXhpUg1zWGmftA/7jamh+7+ydKRuT0ORpWS3wOSP0yT1FOlIZa7mIJjpVPipErsyvVqB9cfTFA==}
+  '@codemirror/lint@6.9.6':
+    resolution: {integrity: sha512-6Kp7r6XfCi/D/5sdXieMfg9pJU1bUEx96WITuLU6ESaKizCz0QHFMjY/TaFSbigDdEAIgi93itLBIUETP4oK+A==}
 
-  '@codemirror/search@6.6.0':
-    resolution: {integrity: sha512-koFuNXcDvyyotWcgOnZGmY7LZqEOXZaaxD/j6n18TCLx2/9HieZJ5H6hs1g8FiRxBD0DNfs0nXn17g872RmYdw==}
+  '@codemirror/search@6.7.0':
+    resolution: {integrity: sha512-ZvGm99wc/s2cITtMT15LFdn8aH/aS+V+DqyGq/N5ZlV5vWtH+nILvC2nw0zX7ByNoHHDZ2IxxdW38O0tc5nVHg==}
 
   '@codemirror/state@6.6.0':
     resolution: {integrity: sha512-4nbvra5R5EtiCzr9BTHiTLc+MLXK2QGiAVYMyi8PkQd3SR+6ixar/Q/01Fa21TBIDOZXgeWV4WppsQolSreAPQ==}
 
-  '@codemirror/view@6.41.1':
-    resolution: {integrity: sha512-ToDnWKbBnke+ZLrP6vgTTDScGi5H37YYuZGniQaBzxMVdtCxMrslsmtnOvbPZk4RX9bvkQqnWR/WS/35tJA0qg==}
+  '@codemirror/view@6.43.0':
+    resolution: {integrity: sha512-V7ZCLQO3Jus9hzh2jVCCPW3mO4IBMr43O37PqSUYautJSnnJF41YlgLw21x0fLJTYvJ+Vkm6Gp+qKGH9pltgXA==}
 
-  '@csstools/css-calc@3.2.0':
-    resolution: {integrity: sha512-bR9e6o2BDB12jzN/gIbjHa5wLJ4UjD1CB9pM7ehlc0ddk6EBz+yYS1EV2MF55/HUxrHcB/hehAyt5vhsA3hx7w==}
+  '@csstools/css-calc@3.2.1':
+    resolution: {integrity: sha512-DtdHlgXh5ZkA43cwBcAm+huzgJiwx3ZTWVjBs94kwz2xKqSimDA3lBgCjphYgwgVUMWatSM0pDd8TILB1yrVVg==}
     engines: {node: '>=20.19.0'}
     peerDependencies:
       '@csstools/css-parser-algorithms': ^4.0.0
@@ -584,8 +549,8 @@ packages:
     peerDependencies:
       '@csstools/css-tokenizer': ^4.0.0
 
-  '@csstools/css-syntax-patches-for-csstree@1.1.3':
-    resolution: {integrity: sha512-SH60bMfrRCJF3morcdk57WklujF4Jr/EsQUzqkarfHXEFcAR1gg7fS/chAE922Sehgzc1/+Tz5H3Ypa1HiEKrg==}
+  '@csstools/css-syntax-patches-for-csstree@1.1.4':
+    resolution: {integrity: sha512-wgsqt92b7C7tQhIdPNxj0n9zuUbQlvAuI1exyzeNrOKOi62SD7ren8zqszmpVREjAOqg8cD2FqYhQfAuKjk4sw==}
     peerDependencies:
       css-tree: ^3.2.1
     peerDependenciesMeta:
@@ -621,15 +586,9 @@ packages:
   '@emnapi/core@1.10.0':
     resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
 
-  '@emnapi/core@1.9.2':
-    resolution: {integrity: sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA==}
-
   '@emnapi/runtime@1.10.0':
     resolution: {integrity: sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==}
 
-  '@emnapi/runtime@1.9.2':
-    resolution: {integrity: sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw==}
-
   '@emnapi/wasi-threads@1.2.1':
     resolution: {integrity: sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==}
 
@@ -789,8 +748,8 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@eslint-community/eslint-plugin-eslint-comments@4.7.1':
-    resolution: {integrity: sha512-Ql2nJFwA8wUGpILYGOQaT1glPsmvEwE0d+a+l7AALLzQvInqdbXJdx7aSu0DpUX9dB1wMVBMhm99/++S3MdEtQ==}
+  '@eslint-community/eslint-plugin-eslint-comments@4.7.2':
+    resolution: {integrity: sha512-LF03qURSwEWm2dz5wtdDCzNk+7Opl0X7q6I3undsaIuNsEiNvRV3BCtqu14Q/6Pzg1tBj44LcxpW2EpSLZStZw==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
       eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0
@@ -818,8 +777,8 @@ packages:
     resolution: {integrity: sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  '@eslint/config-helpers@0.5.5':
-    resolution: {integrity: sha512-eIJYKTCECbP/nsKaaruF6LW967mtbQbsw4JTtSVkUQc9MneSkbrgPJAbKl9nWr0ZeowV8BfsarBmPpBzGelA2w==}
+  '@eslint/config-helpers@0.6.0':
+    resolution: {integrity: sha512-ii6Bw9jJ2zi2cWA2Z+9/QZ/+3DX6kwaV5Q986D/CdP3Lap3w/pgQZ373FV7byY/i7L4IRH/G43I5dz1ClsCbpA==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
   '@eslint/core@0.17.0':
@@ -850,8 +809,8 @@ packages:
     resolution: {integrity: sha512-iH1B076HoAshH1mLpHMgwdGeTs0CYwL0SPMkGuSebZrwBp16v415e9NZXg2jtrqPVQjf6IANe2Vtlr5KswtcZQ==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  '@eslint/plugin-kit@0.7.1':
-    resolution: {integrity: sha512-rZAP3aVgB9ds9KOeUSL+zZ21hPmo8dh6fnIFwRQj5EAZl9gzR7wxYbYXYysAM8CTqGmUGyp2S4kUdV17MnGuWQ==}
+  '@eslint/plugin-kit@0.7.2':
+    resolution: {integrity: sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
   '@github/browserslist-config@1.0.0':
@@ -896,8 +855,24 @@ packages:
   '@iconify/types@2.0.0':
     resolution: {integrity: sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==}
 
-  '@iconify/utils@3.1.0':
-    resolution: {integrity: sha512-Zlzem1ZXhI1iHeeERabLNzBHdOa4VhQbqAcOQaMKuTuyZCpwKbC2R4Dd0Zo3g9EAc+Y4fiarO8HIHRAth7+skw==}
+  '@iconify/utils@3.1.3':
+    resolution: {integrity: sha512-LPKOXPn/zV+zis1oOfGWogaXVpqUybF3ZS6SCZIsz8vg0ivVp9+fVqyYB7xq0aiST/VhUQYGO1qo6uoYSiEJqw==}
+
+  '@jest/environment@29.7.0':
+    resolution: {integrity: sha512-aQIfHDq33ExsN4jP1NWGXhxgQ/wixs60gDiKO+XVMd8Mn0NWPWgc34ZQDTb2jKaUWQ7MuwoitXAsN2XVXNMpAw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/fake-timers@29.7.0':
+    resolution: {integrity: sha512-q4DH1Ha4TTFPdxLsqDXK1d3+ioSL7yL5oCMJZgDYm6i+6CygW5E5xVr/D1HdsGxjt1ZWSfUAs9OxSB/BNelWrQ==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/schemas@29.6.3':
+    resolution: {integrity: sha512-mo5j5X+jIZmJQveBKeS/clAueipV7KgiX1vMgCxam1RNYiqE1w62n0/tJJnHtjW8ZHcQco5gY85jA3mi0L+nSA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  '@jest/types@29.6.3':
+    resolution: {integrity: sha512-u3UPsIilWKOM3F9CXtrG8LEJmNxwoCQC/XVj4IKYXvvpx7QIi/Kg1LI5uDmDpKlac62NUtX7eLjRh+jVZcLOzw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
 
   '@jridgewell/gen-mapping@0.3.13':
     resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
@@ -927,8 +902,8 @@ packages:
   '@lezer/common@1.5.2':
     resolution: {integrity: sha512-sxQE460fPZyU3sdc8lafxiPwJHBzZRy/udNFynGQky1SePYBdhkBl1kOagA9uT3pxR8K09bOrmTUqA9wb/PjSQ==}
 
-  '@lezer/cpp@1.1.5':
-    resolution: {integrity: sha512-DIhSXmYtJKLehrjzDFN+2cPt547ySQ41nA8yqcDf/GxMc+YM736xqltFkvADL2M0VebU5I+3+4ks2Vv+Kyq3Aw==}
+  '@lezer/cpp@1.1.6':
+    resolution: {integrity: sha512-vh9gWWJOXFVY8HBHK3Twzq8MgwG2iN4GSyzBP9sCGTe37P15x2R14VaBQk0VA0ezTRN1KHYBBsHhvpGZ2Xy/pA==}
 
   '@lezer/css@1.3.3':
     resolution: {integrity: sha512-RzBo8r+/6QJeow7aPHIpGVIH59xTcJXp399820gZoMo9noQDRVpJLheIBUicYwKcsbOYoBRoLZlf2720dG/4Tg==}
@@ -954,14 +929,14 @@ packages:
   '@lezer/lr@1.4.10':
     resolution: {integrity: sha512-rnCpTIBafOx4mRp43xOxDJbFipJm/c0cia/V5TiGlhmMa+wsSdoGmUN3w5Bqrks/09Q/D4tNAmWaT8p6NRi77A==}
 
-  '@lezer/markdown@1.6.3':
-    resolution: {integrity: sha512-jpGm5Ps+XErS+xA4urw7ogEGkeZOahVQF21Z6oECF0sj+2liwZopd2+I8uH5I/vZsRuuze3OxBREIANLf6KKUw==}
+  '@lezer/markdown@1.6.4':
+    resolution: {integrity: sha512-N0SxazMj4k65DBfaf1azqtMZd6u7MqluP84/NZnB/io8Td9aleFmAhz9hcbvSfsxT5tdYlJ5qgv5aMJGY4zEtA==}
 
   '@lezer/php@1.0.5':
     resolution: {integrity: sha512-W7asp9DhM6q0W6DYNwIkLSKOvxlXRrif+UXBMxzsJUuqmhE7oVU+gS3THO4S/Puh7Xzgm858UNaFi6dxTP8dJA==}
 
-  '@lezer/python@1.1.18':
-    resolution: {integrity: sha512-31FiUrU7z9+d/ElGQLJFXl+dKOdx0jALlP3KEOsGTex8mvj+SoE1FgItcHWK/axkxCHGUSpqIHt6JAWfWu9Rhg==}
+  '@lezer/python@1.1.19':
+    resolution: {integrity: sha512-MhQIURHRytsNzP/YXnqpYKW6la6voAH3kyplTOOiCdjyFY6cWWGFVmYVdHIPrElqSDf4iCDktQCockB9FxuhzQ==}
 
   '@lezer/rust@1.0.2':
     resolution: {integrity: sha512-Lz5sIPBdF2FUXcWeCu1//ojFAZqzTQNRga0aYv6dYXqJqPfMdCAI0NzajWUd4Xijj1IKJLtjoXRPMvTKWBcqKg==}
@@ -989,11 +964,8 @@ packages:
     peerDependencies:
       mermaid: ^11.0.2
 
-  '@mermaid-js/parser@1.1.0':
-    resolution: {integrity: sha512-gxK9ZX2+Fex5zu8LhRQoMeMPEHbc73UKZ0FQ54YrQtUxE1VVhMwzeNtKRPAu5aXks4FasbMe4xB4bWrmq6Jlxw==}
-
-  '@napi-rs/wasm-runtime@0.2.12':
-    resolution: {integrity: sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==}
+  '@mermaid-js/parser@1.1.1':
+    resolution: {integrity: sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw==}
 
   '@napi-rs/wasm-runtime@1.1.4':
     resolution: {integrity: sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==}
@@ -1013,93 +985,26 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
-  '@nolyfill/array-includes@1.0.44':
-    resolution: {integrity: sha512-IVEqpEgFbLaU0hUoMwJYXNSdi6lq+FxHdxd8xTKDLxh8k6u5YNGz4Bo6bT46l7p0x8PbJmHViBtngqhvE528fA==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/array.prototype.findlastindex@1.0.44':
-    resolution: {integrity: sha512-BLeHS3SulsR3iFxxETL9q21lArV2KS7lh2wcUnhue1ppx19xah1W7MdFxepyeGbM3Umk9S90snfboXAds5HkTg==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/array.prototype.flat@1.0.44':
-    resolution: {integrity: sha512-HnOqOT4te0l+XU9UKhy3ry+pc+ZRNsUJFR7omMEtjXf4+dq6oXmIBk7vR35+hSTk4ldjwm/27jwV3ZIGp3l4IQ==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/array.prototype.flatmap@1.0.44':
-    resolution: {integrity: sha512-P6OsaEUrpBJ9NdNekFDQVM9LOFHPDKSJzwOWRBaC6LqREX+4lkZT2Q+to78R6aG6atuOQsxBVqPjMGCKjWdvyQ==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/hasown@1.0.44':
-    resolution: {integrity: sha512-GA/21lkTr2PAQuT6jGnhLuBD5IFd/AEhBXJ/tf33+/bVxPxg+5ejKx9jGQGnyV/P0eSmdup5E+s8b2HL6lOrwQ==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/is-core-module@1.0.39':
-    resolution: {integrity: sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/object-keys@1.0.44':
-    resolution: {integrity: sha512-k59MxUv8AFPd+GzZlGBhBaW6zu6t7f2euhctz7vdT3WsE3LVPANgE7uAN71IIpxaIn+bBEX1Xesf/rTwWqVO0Q==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/object.assign@1.0.44':
-    resolution: {integrity: sha512-cZoXq09YZXDgkxRMAP/TTb3kAsWm7p5OyBugWDe4fOfxf0XRI55mgDSkuyq41sV1qW1zVC5aSsKEh1hQo1KOvA==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/object.entries@1.0.44':
-    resolution: {integrity: sha512-RCxO6EH9YbvxQWGYLKOd7MjNi7vKzPkXv1VDWNsy1C8BksQxXNPQrddlu3INi1O2fexk82WXpCCeaCtpU/y21w==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/object.fromentries@1.0.44':
-    resolution: {integrity: sha512-/LrsCtpLmByZ6GwP/NeXULSgMyNsVr5d6FlgQy1HZatAiBc8c+WZ1VmFkK19ZLXCNNXBedXDultrp0x4Nz+QQw==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/object.groupby@1.0.44':
-    resolution: {integrity: sha512-jCt/8pN+10mlbeg0ZESpVVaqn5qqpv6kpjM+GDfEP7cXGDSPlIjtvfYWRZK4k4Gftkhhgqkzvcrr8z1wuNO1TQ==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/object.values@1.0.44':
-    resolution: {integrity: sha512-bwIpVzFMudUC0ofnvdSDB/OyGUizcU+r32ZZ0QTMbN03gUttMtdCFDekuSYT0XGFgufTQyZ4ONBnAeb3DFCPGQ==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/safe-regex-test@1.0.44':
-    resolution: {integrity: sha512-Q6veatd1NebtD8Sre6zjvO35QzG21IskMVOOEbePFcNO9noanNJgsqHeOCr0c5yZz6Z0DAizLg2gIZWokJSkXw==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/safer-buffer@1.0.44':
-    resolution: {integrity: sha512-Ouw1fMwjAy1V4MpnDASfu1DCPgkP0nNFteiiWbFoEGSqa7Vnmkb6if2c522N2WcMk+RuaaabQbC1F1D4/kTXcg==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/shared@1.0.44':
-    resolution: {integrity: sha512-NI1zxDh4LYL7PYlKKCwojjuc5CEZslywrOTKBNyodjmWjRiZ4AlCMs3Gp+zDoPQPNkYCSQp/luNojHmJWWfCbw==}
-
-  '@nolyfill/string.prototype.includes@1.0.44':
-    resolution: {integrity: sha512-d1t7rnoAYyoap0X3a/gCnusCvxzK6v7uMFzW8k0mI2WtAK8HiKuzaQUwAriyVPh63GsvQCqvXx8Y5gtdh4LjSA==}
-    engines: {node: '>=12.4.0'}
-
-  '@nolyfill/string.prototype.trimend@1.0.44':
-    resolution: {integrity: sha512-3dsKlf4Ma7o+uxLIg5OI1Tgwfet2pE8WTbPjEGWvOe6CSjMtK0skJnnSVHaEVX4N4mYU81To0qDeZOPqjaUotg==}
-    engines: {node: '>=12.4.0'}
-
-  '@oxc-project/types@0.126.0':
-    resolution: {integrity: sha512-oGfVtjAgwQVVpfBrbtk4e1XDyWHRFta6BS3GWVzrF8xYBT2VGQAk39yJS/wFSMrZqoiCU4oghT3Ch0HaHGIHcQ==}
+  '@oxc-project/types@0.132.0':
+    resolution: {integrity: sha512-FESMOxil5Se014ui/Eq8fT5uHJo6nIRwH0PfJrZJXs6Gek3ZVFOrpUv3YIZT20m+extU98Hg1Ym72U58rlsxUQ==}
 
   '@package-json/types@0.0.12':
     resolution: {integrity: sha512-uu43FGU34B5VM9mCNjXCwLaGHYjXdNincqKLaraaCW+7S2+SmiBg1Nv8bPnmschrIfZmfKNY9f3fC376MRrObw==}
 
-  '@pkgr/core@0.2.9':
-    resolution: {integrity: sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==}
-    engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
+  '@pkgr/core@0.3.6':
+    resolution: {integrity: sha512-SEeaJLb3qBNF/OaXnaR1NmmBbFYk1zC0ZH/52fATcRPLFg/p791YrcyFFy44Bo9sLaGuSuLp5Q6axbb/O+v/RA==}
+    engines: {node: ^14.18.0 || >=16.0.0}
 
-  '@playwright/test@1.59.1':
-    resolution: {integrity: sha512-PG6q63nQg5c9rIi4/Z5lR5IVF7yU5MqmKaPOe0HSc0O2cX1fPi96sUQu5j7eo4gKCkB2AnNGoWt7y4/Xx3Kcqg==}
+  '@playwright/test@1.60.0':
+    resolution: {integrity: sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag==}
     engines: {node: '>=18'}
     hasBin: true
 
   '@popperjs/core@2.11.8':
     resolution: {integrity: sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A==}
 
-  '@primer/octicons@19.24.1':
-    resolution: {integrity: sha512-vgtSHq8IIf3oo/HjPGj0B7NkeatSyyw5mupMjXByPI1gY6uRZ/UQdv7uSJnSOCJYQJF3lVDUwiwp9wM71MYIgA==}
+  '@primer/octicons@19.27.0':
+    resolution: {integrity: sha512-7xC6D89f9IcoDezeKTGETbgRAoXJnbZlakavqYzD4Wo+uTC6212k0fTE/dLV8WCDOwfp//WyONftdaFRdI1VdQ==}
 
   '@replit/codemirror-indentation-markers@6.5.3':
     resolution: {integrity: sha512-hL5Sfvw3C1vgg7GolLe/uxX5T3tmgOA3ZzqlMv47zjU1ON51pzNWiVbS22oh6crYhtVhv8b3gdXwoYp++2ilHw==}
@@ -1149,106 +1054,103 @@ packages:
     resolution: {integrity: sha512-FqALmHI8D4o6lk/LRWDnhw95z5eO+eAa6ORjVg09YRR7BkcM6oPHU9uyC0gtQG5vpFLvgpeU4+zEAz2H8APHNw==}
     engines: {node: '>= 10'}
 
-  '@rolldown/binding-android-arm64@1.0.0-rc.16':
-    resolution: {integrity: sha512-rhY3k7Bsae9qQfOtph2Pm2jZEA+s8Gmjoz4hhmx70K9iMQ/ddeae+xhRQcM5IuVx5ry1+bGfkvMn7D6MJggVSA==}
+  '@rolldown/binding-android-arm64@1.0.2':
+    resolution: {integrity: sha512-ZS4D1JPGn/MYQN/SYDWftIE/nVsM8j/AFOYEzAoOE2O3NktQOZru+/vYXGbR/qtdLdIfGCP0lcoJiYVzsEz+iQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@rolldown/binding-darwin-arm64@1.0.0-rc.16':
-    resolution: {integrity: sha512-rNz0yK078yrNn3DrdgN+PKiMOW8HfQ92jQiXxwX8yW899ayV00MLVdaCNeVBhG/TbH3ouYVObo8/yrkiectkcQ==}
+  '@rolldown/binding-darwin-arm64@1.0.2':
+    resolution: {integrity: sha512-vdFA9+C/rekyGce7WqHs/xoT0ioZEWaOFyZLIV1mEeNFaFDUQrPIo8Vs2GvJ6eetb3rzDUtUBgzto3ExpXJB3w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@rolldown/binding-darwin-x64@1.0.0-rc.16':
-    resolution: {integrity: sha512-r/OmdR00HmD4i79Z//xO06uEPOq5hRXdhw7nzkxQxwSavs3PSHa1ijntdpOiZ2mzOQ3fVVu8C1M19FoNM+dMUQ==}
+  '@rolldown/binding-darwin-x64@1.0.2':
+    resolution: {integrity: sha512-BewSOwTHazv77DTYiAZXSqqKZ4KP/KonFisDMVU7PImxoWfB2aepnPhd2E4SWz3zDzYgDNbs6jBmTdgNnF02GA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@rolldown/binding-freebsd-x64@1.0.0-rc.16':
-    resolution: {integrity: sha512-KcRE5w8h0OnjUatG8pldyD14/CQ5Phs1oxfR+3pKDjboHRo9+MkqQaiIZlZRpsxC15paeXme/I127tUa9TXJ6g==}
+  '@rolldown/binding-freebsd-x64@1.0.2':
+    resolution: {integrity: sha512-m41o7M0YWtUdqk61Tb+jnKb2rN++iRdIASlExkUoKfIAH30DOHCB8fVLzSUpbWHHU8esmEioY62PxzexE8MBuA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@rolldown/binding-linux-arm-gnueabihf@1.0.0-rc.16':
-    resolution: {integrity: sha512-bT0guA1bpxEJ/ZhTRniQf7rNF8ybvXOuWbNIeLABaV5NGjx4EtOWBTSRGWFU9ZWVkPOZ+HNFP8RMcBokBiZ0Kg==}
+  '@rolldown/binding-linux-arm-gnueabihf@1.0.2':
+    resolution: {integrity: sha512-jcojB9H7W/jS29pMKWAK1N+fU99vXodHDTatS3b3y/XSOCiHo0kkA74pL3jJmkoQtYpOCxDvaKs1fo2Ij/1X5w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@rolldown/binding-linux-arm64-gnu@1.0.0-rc.16':
-    resolution: {integrity: sha512-+tHktCHWV8BDQSjemUqm/Jl/TPk3QObCTIjmdDy/nlupcujZghmKK2962LYrqFpWu+ai01AN/REOH3NEpqvYQg==}
+  '@rolldown/binding-linux-arm64-gnu@1.0.2':
+    resolution: {integrity: sha512-1jn6qDU5iiOgFgygDzKUuKP0maTi0/f1+sBLgvij/76C77Nm3ts6ufz9Bjg5q5dduxiUIxtq86JIoBvo1xQ4Ig==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-arm64-musl@1.0.0-rc.16':
-    resolution: {integrity: sha512-3fPzdREH806oRLxpTWW1Gt4tQHs0TitZFOECB2xzCFLPKnSOy90gwA7P29cksYilFO6XVRY1kzga0cL2nRjKPg==}
+  '@rolldown/binding-linux-arm64-musl@1.0.2':
+    resolution: {integrity: sha512-QVLO/czFMdoMFSqlX3bcswcJNm/23r+qoa/jgtmFc/qEp6/jXmIkDjF/XIo8dPfGaiwy1xfQn8o77L79GeXFgw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@rolldown/binding-linux-ppc64-gnu@1.0.0-rc.16':
-    resolution: {integrity: sha512-EKwI1tSrLs7YVw+JPJT/G2dJQ1jl9qlTTTEG0V2Ok/RdOenRfBw2PQdLPyjhIu58ocdBfP7vIRN/pvMsPxs/AQ==}
+  '@rolldown/binding-linux-ppc64-gnu@1.0.2':
+    resolution: {integrity: sha512-hgO5Abm0w5UL6FEa2iFnZqo2KlK7TQ5QhV5x09hujBf7t5KzHQ1VmfPuTpqRy/rNlSxua3eWH374xxiVrP+lcA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-s390x-gnu@1.0.0-rc.16':
-    resolution: {integrity: sha512-Uknladnb3Sxqu6SEcqBldQyJUpk8NleooZEc0MbRBJ4inEhRYWZX0NJu12vNf2mqAq7gsofAxHrGghiUYjhaLQ==}
+  '@rolldown/binding-linux-s390x-gnu@1.0.2':
+    resolution: {integrity: sha512-fy8rXxuYEu602abC8MUNaPjYLIFzReOaEIEMKMUa0rFEUxNpVXhs15KSSQ4qlqSaM7B6rcj9rDZgADh/IGDzLQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-x64-gnu@1.0.0-rc.16':
-    resolution: {integrity: sha512-FIb8+uG49sZBtLTn+zt1AJ20TqVcqWeSIyoVt0or7uAWesgKaHbiBh6OpA/k9v0LTt+PTrb1Lao133kP4uVxkg==}
+  '@rolldown/binding-linux-x64-gnu@1.0.2':
+    resolution: {integrity: sha512-0+bOkiQ779+r1WpoHOWHqncvyySci0vKph+myNDYb+im6meJAzHQXay6oEgnkHuUGouM1LKTZwqKpBow6Kj7CQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-x64-musl@1.0.0-rc.16':
-    resolution: {integrity: sha512-RuERhF9/EgWxZEXYWCOaViUWHIboceK4/ivdtQ3R0T44NjLkIIlGIAVAuCddFxsZ7vnRHtNQUrt2vR2n2slB2w==}
+  '@rolldown/binding-linux-x64-musl@1.0.2':
+    resolution: {integrity: sha512-mjSkrzZK5Qsl0a9d1JgILOiuZOSDTVdKENcSXBoqbzSrspLR/4/IRVDo5wd2GgZjNss/viBFJdeq+j7qH2nypw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@rolldown/binding-openharmony-arm64@1.0.0-rc.16':
-    resolution: {integrity: sha512-mXcXnvd9GpazCxeUCCnZ2+YF7nut+ZOEbE4GtaiPtyY6AkhZWbK70y1KK3j+RDhjVq5+U8FySkKRb/+w0EeUwA==}
+  '@rolldown/binding-openharmony-arm64@1.0.2':
+    resolution: {integrity: sha512-1v5vHasdfQAZoEHakBV72LIFAC9JjnymsiKxp+GEr/ma3+NJCPSaYK+qavInOovJkgwFrs7GccX2d6IgDA3Z5w==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rolldown/binding-wasm32-wasi@1.0.0-rc.16':
-    resolution: {integrity: sha512-3Q2KQxnC8IJOLqXmUMoYwyIPZU9hzRbnHaoV3Euz+VVnjZKcY8ktnNP8T9R4/GGQtb27C/UYKABxesKWb8lsvQ==}
+  '@rolldown/binding-wasm32-wasi@1.0.2':
+    resolution: {integrity: sha512-mb1VobWn6NheziTk5/WEaR6AKVbrwT5sOi6C7zk3gy/pD1qtJfU1j4PgTo2NJnOtbL9Dl3Aeei8w9jJ7qC2jZQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [wasm32]
 
-  '@rolldown/binding-win32-arm64-msvc@1.0.0-rc.16':
-    resolution: {integrity: sha512-tj7XRemQcOcFwv7qhpUxMTBbI5mWMlE4c1Omhg5+h8GuLXzyj8HviYgR+bB2DMDgRqUE+jiDleqSCRjx4aYk/Q==}
+  '@rolldown/binding-win32-arm64-msvc@1.0.2':
+    resolution: {integrity: sha512-SqKonF56vA/L2yHwHYcEp2P34URpOZ7d1fS635cTkpDnUtEGdUbhI6NzsPdqeSWvAAeGDrxjWjNmibDIdFf9/A==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@rolldown/binding-win32-x64-msvc@1.0.0-rc.16':
-    resolution: {integrity: sha512-PH5DRZT+F4f2PTXRXR8uJxnBq2po/xFtddyabTJVJs/ZYVHqXPEgNIr35IHTEa6bpa0Q8Awg+ymkTaGnKITw4g==}
+  '@rolldown/binding-win32-x64-msvc@1.0.2':
+    resolution: {integrity: sha512-v7qRI7gXLRINcOGXt+7YmAZ6iFuyZVMIoXAxhd8oP+DR9dLfL9GfNIx7PLMxmhZdvq8waUJBQiWN9EKNy+TRBQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
 
-  '@rolldown/pluginutils@1.0.0-rc.13':
-    resolution: {integrity: sha512-3ngTAv6F/Py35BsYbeeLeecvhMKdsKm4AoOETVhAA+Qc8nrA2I0kF7oa93mE9qnIurngOSpMnQ0x2nQY2FPviA==}
-
-  '@rolldown/pluginutils@1.0.0-rc.16':
-    resolution: {integrity: sha512-45+YtqxLYKDWQouLKCrpIZhke+nXxhsw+qAHVzHDVwttyBlHNBVs2K25rDXrZzhpTp9w1FlAlvweV1H++fdZoA==}
+  '@rolldown/pluginutils@1.0.1':
+    resolution: {integrity: sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==}
 
   '@rtsao/scc@1.1.0':
     resolution: {integrity: sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g==}
@@ -1259,10 +1161,19 @@ packages:
   '@simonwep/pickr@1.9.0':
     resolution: {integrity: sha512-oEYvv15PyfZzjoAzvXYt3UyNGwzsrpFxLaZKzkOSd0WYBVwLd19iJerePDONxC1iF6+DpcswPdLIM2KzCJuYFg==}
 
+  '@sinclair/typebox@0.27.10':
+    resolution: {integrity: sha512-MTBk/3jGLNB2tVxv6uLlFh1iu64iYOQ2PbdOSK3NW8JZsmlaOh2q6sdtKowBhfw8QFLmYNzTW4/oK4uATIi6ZA==}
+
   '@sindresorhus/merge-streams@4.0.0':
     resolution: {integrity: sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ==}
     engines: {node: '>=18'}
 
+  '@sinonjs/commons@3.0.1':
+    resolution: {integrity: sha512-K3mCHKQ9sVh8o1C9cxkwxaOmXoAMlDxC1mYyHrjqOWEcBjYr76t96zL2zlj5dUGZ3HSw240X1qgH3Mjf1yJWpQ==}
+
+  '@sinonjs/fake-timers@10.3.0':
+    resolution: {integrity: sha512-V4BG07kuYSUkTCSBHG8G8TNhM+F19jXFWnQtzj+we8DrkpSBCee9Z3Ms8yiGer/dlmhe35/Xdgyo3/0rQKg7YA==}
+
   '@solid-primitives/refs@1.1.3':
     resolution: {integrity: sha512-aam02fjNKpBteewF/UliPSQCVJsIIGOLEWQOh+ll6R/QePzBOOBMcC4G+5jTaO75JuUS1d/14Q1YXT3X0Ow6iA==}
     peerDependencies:
@@ -1287,17 +1198,20 @@ packages:
     peerDependencies:
       eslint: ^9.0.0 || ^10.0.0
 
-  '@stylistic/stylelint-plugin@5.1.0':
-    resolution: {integrity: sha512-TFvKCbJUEWUYCD+rDv45qhnStO6nRtbBngaCblS2JGh8c95S3jJi3fIotfF6EDo4IVM15UPa65WP+kp6GNvXRA==}
-    engines: {node: '>=20.19.0'}
+  '@stylistic/stylelint-plugin@5.2.0':
+    resolution: {integrity: sha512-pfa2PMvlH87qwoOMUH4rqz7x/vuO5Kh+r/R1Pe+/5T8sukDPe/VfF6mbdUGE5gwZPlj5O1X56qw55IZrFFRF0g==}
     peerDependencies:
       stylelint: ^17.6.0
 
-  '@swc/helpers@0.5.21':
-    resolution: {integrity: sha512-jI/VAmtdjB/RnI8GTnokyX7Ug8c+g+ffD6QRLa6XQewtnGyukKkKSk3wLTM3b5cjt1jNh9x0jfVlagdN2gDKQg==}
+  '@swc/helpers@0.5.23':
+    resolution: {integrity: sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==}
 
-  '@tybys/wasm-util@0.10.1':
-    resolution: {integrity: sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==}
+  '@tootallnate/once@2.0.1':
+    resolution: {integrity: sha512-HqmEUIGRJ5fSXchkVgR5F7qn48bDBzv0kWj/Kfu5e6uci4UlEeng4331LnBkWffb++Ei3FOVLxo8JJWMFBDMeQ==}
+    engines: {node: '>= 10'}
+
+  '@tybys/wasm-util@0.10.2':
+    resolution: {integrity: sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==}
 
   '@types/chai@5.2.3':
     resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
@@ -1407,8 +1321,8 @@ packages:
   '@types/esrecurse@4.3.1':
     resolution: {integrity: sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw==}
 
-  '@types/estree@1.0.8':
-    resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
+  '@types/estree@1.0.9':
+    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
 
   '@types/geojson@7946.0.16':
     resolution: {integrity: sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==}
@@ -1416,12 +1330,24 @@ packages:
   '@types/hammerjs@2.0.46':
     resolution: {integrity: sha512-ynRvcq6wvqexJ9brDMS4BnBLzmr0e14d6ZJTEShTBWKymQiHwlAyGu0ZPEFI2Fh1U53F7tN9ufClWM5KvqkKOw==}
 
+  '@types/istanbul-lib-coverage@2.0.6':
+    resolution: {integrity: sha512-2QF/t/auWm0lsy8XtKVPG19v3sSOQlJe/YHZgfjb/KBBHOGSV+J2q/S671rcq9uTBrLAXmZpqJiaQbMT+zNU1w==}
+
+  '@types/istanbul-lib-report@3.0.3':
+    resolution: {integrity: sha512-NQn7AHQnk/RSLOxrBbGyJM/aVQ+pjj5HCgasFxc0K/KhoATfQ/47AyUl15I2yBUpihjmas+a+VJBOqecrFH+uA==}
+
+  '@types/istanbul-reports@3.0.4':
+    resolution: {integrity: sha512-pk2B1NWalF9toCRu6gjBzR69syFjP4Od8WRAX+0mmf9lAjCRicLOWc+ZrxZHx/0XRjotgkF9t6iaMJ+aXcOdZQ==}
+
   '@types/jquery@4.0.0':
     resolution: {integrity: sha512-Z+to+A2VkaHq1DfI2oSwsoCdhCHMpTSgjWzNcbNlRGYzksDBpPUgEcAL+RQjOBJRaLoEAOHXxqDGBVP+BblBwg==}
 
   '@types/js-yaml@4.0.9':
     resolution: {integrity: sha512-k4MGaQl5TGo/iipqb2UDG2UwjXziSWkh0uysQelTlJpX1qGlpUZYm8PnO4DxG1qBomtJUdYJ6qR6xdIah10JLg==}
 
+  '@types/jsdom@20.0.1':
+    resolution: {integrity: sha512-d0r18sZPmMQr1eG35u12FZfhIXNrnsPU/g5wvRKCUf/tOGilKKwYMYGqh33BNR6ba+2gkHw1EUiHoN3mn7E5IQ==}
+
   '@types/json-schema@7.0.15':
     resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
 
@@ -1437,8 +1363,8 @@ packages:
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
 
-  '@types/node@25.6.0':
-    resolution: {integrity: sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==}
+  '@types/node@25.9.1':
+    resolution: {integrity: sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==}
 
   '@types/pdfobject@2.2.5':
     resolution: {integrity: sha512-7gD5tqc/RUDq0PyoLemL0vEHxBYi+zY0WVaFAx/Y0jBsXFgot1vB9No1GhDZGwRGJMCIZbgAb74QG9MTyTNU/g==}
@@ -1446,6 +1372,9 @@ packages:
   '@types/sortablejs@1.15.9':
     resolution: {integrity: sha512-7HP+rZGE2p886PKV9c9OJzLBI6BBJu1O7lJGYnPyG3fS4/duUCcngkNCjsLwIMV+WMqANe3tt4irrXHSIe68OQ==}
 
+  '@types/stack-utils@2.0.3':
+    resolution: {integrity: sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==}
+
   '@types/swagger-ui-dist@3.30.6':
     resolution: {integrity: sha512-FVxN7wjLYRtJsZBscOcOcf8oR++m38vbUFjT33Mr9HBuasX9bRDrJsp7iwixcOtKSHEEa2B7o2+4wEiXqC+Ebw==}
 
@@ -1458,6 +1387,9 @@ packages:
   '@types/toastify-js@1.12.4':
     resolution: {integrity: sha512-zfZHU4tKffPCnZRe7pjv/eFKzTVHozKewFCKaCjZ4gFinKgJRz/t0bkZiMCXJxPhv/ZoeDGNOeRD09R0kQZ/nw==}
 
+  '@types/tough-cookie@4.0.5':
+    resolution: {integrity: sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA==}
+
   '@types/trusted-types@2.0.7':
     resolution: {integrity: sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==}
 
@@ -1470,180 +1402,255 @@ packages:
   '@types/ws@8.18.1':
     resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
 
-  '@typescript-eslint/eslint-plugin@8.59.0':
-    resolution: {integrity: sha512-HyAZtpdkgZwpq8Sz3FSUvCR4c+ScbuWa9AksK2Jweub7w4M3yTz4O11AqVJzLYjy/B9ZWPyc81I+mOdJU/bDQw==}
+  '@types/yargs-parser@21.0.3':
+    resolution: {integrity: sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ==}
+
+  '@types/yargs@17.0.35':
+    resolution: {integrity: sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==}
+
+  '@typescript-eslint/eslint-plugin@8.60.0':
+    resolution: {integrity: sha512-QYb/sa74/s7OKMbACMjrYnGspj9Hs5YI5aaffSL65UfeBUzVzBJfVo3oWSpbzPurvm7yaCCo2Lk7lVj610HqKw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      '@typescript-eslint/parser': ^8.59.0
+      '@typescript-eslint/parser': ^8.60.0
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/parser@8.59.0':
-    resolution: {integrity: sha512-TI1XGwKbDpo9tRW8UDIXCOeLk55qe9ZFGs8MTKU6/M08HWTw52DD/IYhfQtOEhEdPhLMT26Ka/x7p70nd3dzDg==}
+  '@typescript-eslint/eslint-plugin@8.60.1':
+    resolution: {integrity: sha512-JQ4S5GB0tfjO8BuJ4fcX+HodkzJjYBV+7OJ+wLygaX7OGQ7FudyHL4NSCA6ob+w3Yn+5MkKIozOwQhXeM7opVg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      '@typescript-eslint/parser': ^8.60.1
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/parser@8.60.0':
+    resolution: {integrity: sha512-fcqpj/MyK4sxDPcbe7STNPbpQL4RLZOPWuaTmwZYuc+hJKzRf58yRxfhqGpc6PIq9ZyfSBpfHgmUHmHs0KwHwg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/project-service@8.59.0':
-    resolution: {integrity: sha512-Lw5ITrR5s5TbC19YSvlr63ZfLaJoU6vtKTHyB0GQOpX0W7d5/Ir6vUahWi/8Sps/nOukZQ0IB3SmlxZnjaKVnw==}
+  '@typescript-eslint/project-service@8.60.0':
+    resolution: {integrity: sha512-aZu74NNKJeUWqCjDddzdiKaS82dgYgV/vmf+Ui3ZdZejmgfXR/q+pRumgobnQ2cCJTgGTWp4ypiwsuofFubavg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/scope-manager@8.59.0':
-    resolution: {integrity: sha512-UzR16Ut8IpA3Mc4DbgAShlPPkVm8xXMWafXxB0BocaVRHs8ZGakAxGRskF7FId3sdk9lgGD73GSFaWmWFDE4dg==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-
-  '@typescript-eslint/tsconfig-utils@8.59.0':
-    resolution: {integrity: sha512-91Sbl3s4Kb3SybliIY6muFBmHVv+pYXfybC4Oolp3dvk8BvIE3wOPc+403CWIT7mJNkfQRGtdqghzs2+Z91Tqg==}
+  '@typescript-eslint/project-service@8.60.1':
+    resolution: {integrity: sha512-eXkTH2bxmXlqD1RnOPmLZ9ZM9D3VwSx04JOwBnP9RQ+yUA5a2Mu7SfW8uaV2Aon53NJzZlZYuX7tn91Izf+xaw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/type-utils@8.59.0':
-    resolution: {integrity: sha512-3TRiZaQSltGqGeNrJzzr1+8YcEobKH9rHnqIp/1psfKFmhRQDNMGP5hBufanYTGznwShzVLs3Mz+gDN7HkWfXg==}
+  '@typescript-eslint/scope-manager@8.60.0':
+    resolution: {integrity: sha512-pFzqhllJMs+jghLQWzV00ds39xLzuyqPSev5pd8f4Ir0rtKR3ZLUB4/4dhjOFighWb9larvtfJvqL+4yKDI3Xw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/scope-manager@8.60.1':
+    resolution: {integrity: sha512-gvI5OQoptnxQnchOirukCuQ55svJSTuD/4k5+pC267xyBtYry748R9/c3tYUzb/iE6RZfllRz2lVulLCHkTm4w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/tsconfig-utils@8.60.0':
+    resolution: {integrity: sha512-BZPR3RGYlAXnly6ymAxfkVn5rCbZzQNou0rxv3GfWZ8cTQp+hhVd73khbGLAd8k1TlAPLISH337M+tAgAnaJDQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/tsconfig-utils@8.60.1':
+    resolution: {integrity: sha512-nh8w4qAteiKuZu3pSSzG/yGKpw0OlkrKnzFmbVRenKaD4qc+7i1GrmZaLVkr8rk4uipiPGMOW4YsM6WmKZ5CvA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/type-utils@8.60.0':
+    resolution: {integrity: sha512-SX46wEUtitCpq7AN38HkUU/+zvUpdKf7ephtWAFgckH8O7PQIyL5gvrhQgBLuEYgLfuKWOVvWVskMbuFHAz5xg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/types@8.59.0':
-    resolution: {integrity: sha512-nLzdsT1gdOgFxxxwrlNVUBzSNBEEHJ86bblmk4QAS6stfig7rcJzWKqCyxFy3YRRHXDWEkb2NralA1nOYkkm/A==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-
-  '@typescript-eslint/typescript-estree@8.59.0':
-    resolution: {integrity: sha512-O9Re9P1BmBLFJyikRbQpLku/QA3/AueZNO9WePLBwQrvkixTmDe8u76B6CYUAITRl/rHawggEqUGn5QIkVRLMw==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    peerDependencies:
-      typescript: '>=4.8.4 <6.1.0'
-
-  '@typescript-eslint/utils@8.59.0':
-    resolution: {integrity: sha512-I1R/K7V07XsMJ12Oaxg/O9GfrysGTmCRhvZJBv0RE0NcULMzjqVpR5kRRQjHsz3J/bElU7HwCO7zkqL+MSUz+g==}
+  '@typescript-eslint/type-utils@8.60.1':
+    resolution: {integrity: sha512-sdwTrpjosW7ANQYJ39ZBF1ZyEMEGVB2UsikrserVM/30a/F1dTLnu9bGxEdosugyu5caigjLrR2qiD11asjI1A==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/visitor-keys@8.59.0':
-    resolution: {integrity: sha512-/uejZt4dSere1bx12WLlPfv8GktzcaDtuJ7s42/HEZ5zGj9oxRaD4bj7qwSunXkf+pbAhFt2zjpHYUiT5lHf0Q==}
+  '@typescript-eslint/types@8.60.0':
+    resolution: {integrity: sha512-AsE7x2XaAK+CVbeih0Fvbn+r1qHxtpLDJ3XUuFcIinT318T90yHMJC+Zgv+jUuDjQQd06HKwxnDu6sz1IcTilA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@unrs/resolver-binding-android-arm-eabi@1.11.1':
-    resolution: {integrity: sha512-ppLRUgHVaGRWUx0R0Ut06Mjo9gBaBkg3v/8AxusGLhsIotbBLuRk51rAzqLC8gq6NyyAojEXglNjzf6R948DNw==}
+  '@typescript-eslint/types@8.60.1':
+    resolution: {integrity: sha512-4h0tY8ppCkdCzcrl2YM5M3my0xsE1Tf8om3owEu5oPWmXwkKRmk0j0LGDzYBGUcAlesEbxBhazqu/K4cu3Ug7w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/typescript-estree@8.60.0':
+    resolution: {integrity: sha512-3AcZNBGMClm6CXDyo8kYvVGT/sx29sS0oBsIb9oZI2gunA4Vm2M3YHzRLPvsUBBsl+yB5FPtltq7gGH0iTlp9g==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/typescript-estree@8.60.1':
+    resolution: {integrity: sha512-alpRkfG8hlVE5kdJW2GkfgDgXxold3e8e4l6EnmhRmRLbekgAPCCGDVD++sABy9FcgPFroq+uFcCSM1vR57Cew==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/utils@8.60.0':
+    resolution: {integrity: sha512-HtXuPfrHTyBDkameWpl+vJb1Uevu2tznAyahM1Oc4AENidCLTPiZDWIo4GfcxNdC/RcfGcadzzkqbRG87dUrQA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/utils@8.60.1':
+    resolution: {integrity: sha512-h2MPBLoNtjc3qZWfY3Tl51yPorQ2McHn8pJfcMNTcIvrrZrr90Ykffit0yjrPFWQcRcUxzH20+6OcVdW4yHtUg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/visitor-keys@8.60.0':
+    resolution: {integrity: sha512-9WI52t8ZGLVGrPMBet25yAftqY/n95+zmoUUtJBBQTKDSKUu7OsPTroT2op7U9JatkoRccL0YkWDNMFfC4Sjxg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/visitor-keys@8.60.1':
+    resolution: {integrity: sha512-EbGRQg4FhrmwLodl+t3JNAnXHWVr9Vp+Zl1QBZVPY4ByfkzIT8cX3K6QWODHtkIZqqJVEWvhHSx3v5PDHsaQag==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@unrs/resolver-binding-android-arm-eabi@1.12.2':
+    resolution: {integrity: sha512-g5T90pqg1bo/7mytQx6F4iBNC0Wsh9cu+z9veDbFjc7HjpesJFWD7QMS0NGStXM075+7dJPPVvBbpZlnrdpi/w==}
     cpu: [arm]
     os: [android]
 
-  '@unrs/resolver-binding-android-arm64@1.11.1':
-    resolution: {integrity: sha512-lCxkVtb4wp1v+EoN+HjIG9cIIzPkX5OtM03pQYkG+U5O/wL53LC4QbIeazgiKqluGeVEeBlZahHalCaBvU1a2g==}
+  '@unrs/resolver-binding-android-arm64@1.12.2':
+    resolution: {integrity: sha512-YGCRZv/9GLhwmz6mYDeTsm/92BAyR28l6c2ReweVW5pWgfsitWLY8upvfRlGdoyD8HjeTHSYJWyZGD4KJA/nFQ==}
     cpu: [arm64]
     os: [android]
 
-  '@unrs/resolver-binding-darwin-arm64@1.11.1':
-    resolution: {integrity: sha512-gPVA1UjRu1Y/IsB/dQEsp2V1pm44Of6+LWvbLc9SDk1c2KhhDRDBUkQCYVWe6f26uJb3fOK8saWMgtX8IrMk3g==}
+  '@unrs/resolver-binding-darwin-arm64@1.12.2':
+    resolution: {integrity: sha512-u9DiNT1auQMO20A9SyTuG3wUgQWB9Z7KjAg0uFuCDR1FsAY8A0CG2S6JpHS1xwm/w1G08bjXZDcyOCjv1WAm2w==}
     cpu: [arm64]
     os: [darwin]
 
-  '@unrs/resolver-binding-darwin-x64@1.11.1':
-    resolution: {integrity: sha512-cFzP7rWKd3lZaCsDze07QX1SC24lO8mPty9vdP+YVa3MGdVgPmFc59317b2ioXtgCMKGiCLxJ4HQs62oz6GfRQ==}
+  '@unrs/resolver-binding-darwin-x64@1.12.2':
+    resolution: {integrity: sha512-f7rPLi/T1HVKZu/u6t87lroib16n8vrSzcyxI7lg4BGO9UF26KhQL44sd9eOUgrTYhvRXtWOIZT5PejdPyJfUA==}
     cpu: [x64]
     os: [darwin]
 
-  '@unrs/resolver-binding-freebsd-x64@1.11.1':
-    resolution: {integrity: sha512-fqtGgak3zX4DCB6PFpsH5+Kmt/8CIi4Bry4rb1ho6Av2QHTREM+47y282Uqiu3ZRF5IQioJQ5qWRV6jduA+iGw==}
+  '@unrs/resolver-binding-freebsd-x64@1.12.2':
+    resolution: {integrity: sha512-BpcOjWCJub6nRZUS2zA20pmLvjtqAtGejETaIyRLiZiQf++cbrjltLA5NN/xaXfqeOBOSlMFbemIl5/S5tljmg==}
     cpu: [x64]
     os: [freebsd]
 
-  '@unrs/resolver-binding-linux-arm-gnueabihf@1.11.1':
-    resolution: {integrity: sha512-u92mvlcYtp9MRKmP+ZvMmtPN34+/3lMHlyMj7wXJDeXxuM0Vgzz0+PPJNsro1m3IZPYChIkn944wW8TYgGKFHw==}
+  '@unrs/resolver-binding-linux-arm-gnueabihf@1.12.2':
+    resolution: {integrity: sha512-vZTDvdSISZjJx66OzJqtsOhzifbqRjbmI1Mnu49fQDwog5GtDI4QidRiEAYbZCRj9C8YZEW+3ZjqsyS9GR4k2A==}
     cpu: [arm]
     os: [linux]
 
-  '@unrs/resolver-binding-linux-arm-musleabihf@1.11.1':
-    resolution: {integrity: sha512-cINaoY2z7LVCrfHkIcmvj7osTOtm6VVT16b5oQdS4beibX2SYBwgYLmqhBjA1t51CarSaBuX5YNsWLjsqfW5Cw==}
+  '@unrs/resolver-binding-linux-arm-musleabihf@1.12.2':
+    resolution: {integrity: sha512-BiPI+IrIlwcW4nLLMM21+B1dFPzd55yAVgVGrdgDjNef+ch03GdxrcyaIz8X9SsQirh/kCQ7mviyWlMxdh2D7g==}
     cpu: [arm]
     os: [linux]
 
-  '@unrs/resolver-binding-linux-arm64-gnu@1.11.1':
-    resolution: {integrity: sha512-34gw7PjDGB9JgePJEmhEqBhWvCiiWCuXsL9hYphDF7crW7UgI05gyBAi6MF58uGcMOiOqSJ2ybEeCvHcq0BCmQ==}
+  '@unrs/resolver-binding-linux-arm64-gnu@1.12.2':
+    resolution: {integrity: sha512-zJc0H99FEPoFfSrNpa91HYfxzfAJCr502oxNK1cfdC9hlaFI43RT+JFCann9JUgZmLzzntChHyn13Sgn9ljHNg==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@unrs/resolver-binding-linux-arm64-musl@1.11.1':
-    resolution: {integrity: sha512-RyMIx6Uf53hhOtJDIamSbTskA99sPHS96wxVE/bJtePJJtpdKGXO1wY90oRdXuYOGOTuqjT8ACccMc4K6QmT3w==}
+  '@unrs/resolver-binding-linux-arm64-musl@1.12.2':
+    resolution: {integrity: sha512-KQ3Lki6l+Pz1k/eBipN41ES+YUK30beLGb9YqcB1O542cyLCNE6GaxrfcY3T6EezmGGk84wb5XyO9loTM9tkcA==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@unrs/resolver-binding-linux-ppc64-gnu@1.11.1':
-    resolution: {integrity: sha512-D8Vae74A4/a+mZH0FbOkFJL9DSK2R6TFPC9M+jCWYia/q2einCubX10pecpDiTmkJVUH+y8K3BZClycD8nCShA==}
+  '@unrs/resolver-binding-linux-loong64-gnu@1.12.2':
+    resolution: {integrity: sha512-3SJGEh1DborhG6pyxvhPzCT4bbSIVihsvgJc13P1bHG7KLdNDaF9T3gsTwFc7Jw/5Y5/iWOjkEx7Zy0NvCGX3Q==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [glibc]
+
+  '@unrs/resolver-binding-linux-loong64-musl@1.12.2':
+    resolution: {integrity: sha512-jiuG/Obbel7uw1PwHNFfrkiKhLAF6mnyZ6aWlOAVN9WqKm8v0OFGnciJIHu8+CMvXLQ8AD51LPzAoUfT21D5Ew==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [musl]
+
+  '@unrs/resolver-binding-linux-ppc64-gnu@1.12.2':
+    resolution: {integrity: sha512-q7xRvVpmcfeL+LlZg8Pbbo6QaTZwDU5BaGZbwfhkEsXJn3Was8xYfE0RBH266xZt0rM6B7i8xAYIvjthuUIWHg==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@unrs/resolver-binding-linux-riscv64-gnu@1.11.1':
-    resolution: {integrity: sha512-frxL4OrzOWVVsOc96+V3aqTIQl1O2TjgExV4EKgRY09AJ9leZpEg8Ak9phadbuX0BA4k8U5qtvMSQQGGmaJqcQ==}
+  '@unrs/resolver-binding-linux-riscv64-gnu@1.12.2':
+    resolution: {integrity: sha512-0CVdx6lcnT3Q9inOH8tsMIOJ6ImndllMjqJHg8RLVdB7Vq4SfkEXl9mCSsVNuNA4MCYycRicCUxPCabVHJRr6A==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@unrs/resolver-binding-linux-riscv64-musl@1.11.1':
-    resolution: {integrity: sha512-mJ5vuDaIZ+l/acv01sHoXfpnyrNKOk/3aDoEdLO/Xtn9HuZlDD6jKxHlkN8ZhWyLJsRBxfv9GYM2utQ1SChKew==}
+  '@unrs/resolver-binding-linux-riscv64-musl@1.12.2':
+    resolution: {integrity: sha512-iOwlRo9vnp6R6ohHQS11n0NnfdXx/omhkocmIfaPRpQhKZ+3BDMkkdRVh53qjkFkpPddf+FETA28NwGN7l5l+w==}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@unrs/resolver-binding-linux-s390x-gnu@1.11.1':
-    resolution: {integrity: sha512-kELo8ebBVtb9sA7rMe1Cph4QHreByhaZ2QEADd9NzIQsYNQpt9UkM9iqr2lhGr5afh885d/cB5QeTXSbZHTYPg==}
+  '@unrs/resolver-binding-linux-s390x-gnu@1.12.2':
+    resolution: {integrity: sha512-HYJtLfXq94q8iZNFT1lknx258wlkkWhZeUXJRqzKBBUJ00CvZ+N33zgbCqimLjsyw5Va6uUxhVa12mI+kaveEw==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@unrs/resolver-binding-linux-x64-gnu@1.11.1':
-    resolution: {integrity: sha512-C3ZAHugKgovV5YvAMsxhq0gtXuwESUKc5MhEtjBpLoHPLYM+iuwSj3lflFwK3DPm68660rZ7G8BMcwSro7hD5w==}
+  '@unrs/resolver-binding-linux-x64-gnu@1.12.2':
+    resolution: {integrity: sha512-mPsUhunKKDih5O96Y6enDQyHc1SqBPlY1E/SfMWDM3EdJ95Z9CArPeCVwCCqbP45ljvivdEk8Fxn+SIb1rDAJQ==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@unrs/resolver-binding-linux-x64-musl@1.11.1':
-    resolution: {integrity: sha512-rV0YSoyhK2nZ4vEswT/QwqzqQXw5I6CjoaYMOX0TqBlWhojUf8P94mvI7nuJTeaCkkds3QE4+zS8Ko+GdXuZtA==}
+  '@unrs/resolver-binding-linux-x64-musl@1.12.2':
+    resolution: {integrity: sha512-azrt6+5ydLd8Vt210AAFis/lZevSfPw93EJRIJG+xPu4WCJ8K0kppCTpMyLPcKT7H15M4Jnt2tMp5bOvCkRC6A==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@unrs/resolver-binding-wasm32-wasi@1.11.1':
-    resolution: {integrity: sha512-5u4RkfxJm+Ng7IWgkzi3qrFOvLvQYnPBmjmZQ8+szTK/b31fQCnleNl1GgEt7nIsZRIf5PLhPwT0WM+q45x/UQ==}
+  '@unrs/resolver-binding-openharmony-arm64@1.12.2':
+    resolution: {integrity: sha512-YZ9hP4O0X9PQb8eO980qmLNGH4zT3I9+SZTdt0Pr0YyuGQhYKoOZkV02VzrzyOZJ5xIJ3UFIenKkUkGg8GjgWQ==}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@unrs/resolver-binding-wasm32-wasi@1.12.2':
+    resolution: {integrity: sha512-tYFDIkMxSflfEc/h92ZWNsZlHSwgimbNHSO3PL2JWQHfCuC2q316jMyYU9TIWZsFK2bQwyK5VAdYgn8ygPj69A==}
     engines: {node: '>=14.0.0'}
     cpu: [wasm32]
 
-  '@unrs/resolver-binding-win32-arm64-msvc@1.11.1':
-    resolution: {integrity: sha512-nRcz5Il4ln0kMhfL8S3hLkxI85BXs3o8EYoattsJNdsX4YUU89iOkVn7g0VHSRxFuVMdM4Q1jEpIId1Ihim/Uw==}
+  '@unrs/resolver-binding-win32-arm64-msvc@1.12.2':
+    resolution: {integrity: sha512-qzNyg3xL0VPQmCaUh+N5jSitce6k+uCBfMDesWRnlULOZaqUkaJ0ybdT+UqlAWJoQjuqfIU/0Ptx9bteN4D82g==}
     cpu: [arm64]
     os: [win32]
 
-  '@unrs/resolver-binding-win32-ia32-msvc@1.11.1':
-    resolution: {integrity: sha512-DCEI6t5i1NmAZp6pFonpD5m7i6aFrpofcp4LA2i8IIq60Jyo28hamKBxNrZcyOwVOZkgsRp9O2sXWBWP8MnvIQ==}
+  '@unrs/resolver-binding-win32-ia32-msvc@1.12.2':
+    resolution: {integrity: sha512-WD9sY00OfpHVGfsnHZoA8jVT+esS/Bg8z8jzxp5BnDCjjwsuKsPQrzswwpFy4J1AUJbXPRfkpcX0mXrzeXW79g==}
     cpu: [ia32]
     os: [win32]
 
-  '@unrs/resolver-binding-win32-x64-msvc@1.11.1':
-    resolution: {integrity: sha512-lrW200hZdbfRtztbygyaq/6jP6AKE8qQN2KvPcJ+x7wiD038YtnYtZ82IMNJ69GJibV7bwL3y9FgK+5w/pYt6g==}
+  '@unrs/resolver-binding-win32-x64-msvc@1.12.2':
+    resolution: {integrity: sha512-nAB74NfSNKknqQ1RrYj6uz8FcXEomu/MATJZxh/x+BArzN2U3JbOYC0APYzUIGhVY3m5hRxA8VPNdPBoG8txlA==}
     cpu: [x64]
     os: [win32]
 
   '@upsetjs/venn.js@2.0.0':
     resolution: {integrity: sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw==}
 
-  '@vitejs/plugin-vue@6.0.6':
-    resolution: {integrity: sha512-u9HHgfrq3AjXlysn0eINFnWQOJQLO9WN6VprZ8FXl7A2bYisv3Hui9Ij+7QZ41F/WYWarHjwBbXtD7dKg3uxbg==}
+  '@vitejs/plugin-vue@6.0.7':
+    resolution: {integrity: sha512-km+p+XdSz9Sxm5rqUbqcSfZYaAniKxWBj1KURl+Jr7UaPvvX7BmaWMdP69I5rrFDeQGyxAG7NXdc57vz+snhWg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     peerDependencies:
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
       vue: ^3.2.25
 
-  '@vitest/eslint-plugin@1.6.16':
-    resolution: {integrity: sha512-2pBN1F1JXq6zTSaYC58CMJa7pGxXIRsLfOioeZM4cPE3pRdSh1ySTSoHPQlOTEF5WgoVzWZQxhGQ3ygT78hOVg==}
+  '@vitest/eslint-plugin@1.6.18':
+    resolution: {integrity: sha512-J6U4X0jH3NwTuYouvrJn6I8ypTOU+GhKEjyVwpoPnDuc23usa/xi/R0caWLBbNp3xLy3/rL1YkuJuneTMVV4Mg==}
     engines: {node: '>=18'}
     peerDependencies:
       '@typescript-eslint/eslint-plugin': '*'
@@ -1658,11 +1665,11 @@ packages:
       vitest:
         optional: true
 
-  '@vitest/expect@4.1.4':
-    resolution: {integrity: sha512-iPBpra+VDuXmBFI3FMKHSFXp3Gx5HfmSCE8X67Dn+bwephCnQCaB7qWK2ldHa+8ncN8hJU8VTMcxjPpyMkUjww==}
+  '@vitest/expect@4.1.7':
+    resolution: {integrity: sha512-1R+tw0ortHEbZDGMymm+pN7/AFQ/RkFFdtd7EN+VBpynKmLbP8A3rpEXdshBJ7+8hQ9zBJh/i1s0yKNtxAnU7w==}
 
-  '@vitest/mocker@4.1.4':
-    resolution: {integrity: sha512-R9HTZBhW6yCSGbGQnDnH3QHfJxokKN4KB+Yvk9Q1le7eQNYwiCyKxmLmurSpFy6BzJanSLuEUDrD+j97Q+ZLPg==}
+  '@vitest/mocker@4.1.7':
+    resolution: {integrity: sha512-vY7nuamKgfvpA1Koa3oYIw/k7D6kZnpGyNMZW8loow2bsBYla1TFdqTaXncWdRn4pgwNs+90RhnXhJScDwQeJA==}
     peerDependencies:
       msw: ^2.4.9
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -1672,20 +1679,20 @@ packages:
       vite:
         optional: true
 
-  '@vitest/pretty-format@4.1.4':
-    resolution: {integrity: sha512-ddmDHU0gjEUyEVLxtZa7xamrpIefdEETu3nZjWtHeZX4QxqJ7tRxSteHVXJOcr8jhiLoGAhkK4WJ3WqBpjx42A==}
+  '@vitest/pretty-format@4.1.7':
+    resolution: {integrity: sha512-umgCarTOYQWIaDMvGDRZij+6b9oVeLIyJzfN+AS88e0ZOU3QTgNNSTtjQOpcvWr3np1N0j4WgZj+sb3oYBDscw==}
 
-  '@vitest/runner@4.1.4':
-    resolution: {integrity: sha512-xTp7VZ5aXP5ZJrn15UtJUWlx6qXLnGtF6jNxHepdPHpMfz/aVPx+htHtgcAL2mDXJgKhpoo2e9/hVJsIeFbytQ==}
+  '@vitest/runner@4.1.7':
+    resolution: {integrity: sha512-BapjmAQ2aI78WdMEfeUWivnfVzB+VPGwWRQcJE0OUq7qEeEcBsCSf+0T5iREBNE5nBb4wA5Ya0W6IA+sghdEFw==}
 
-  '@vitest/snapshot@4.1.4':
-    resolution: {integrity: sha512-MCjCFgaS8aZz+m5nTcEcgk/xhWv0rEH4Yl53PPlMXOZ1/Ka2VcZU6CJ+MgYCZbcJvzGhQRjVrGQNZqkGPttIKw==}
+  '@vitest/snapshot@4.1.7':
+    resolution: {integrity: sha512-ZacLzja+TmJeZ1h14xW2FB/WpeimUD3haBXQPyJqxvo8jQTmfeA8zv58mtjN2C7EHXZDYVcVYdYmAxjkWVvKCw==}
 
-  '@vitest/spy@4.1.4':
-    resolution: {integrity: sha512-XxNdAsKW7C+FLydqFJLb5KhJtl3PGCMmYwFRfhvIgxJvLSXhhVI1zM8f1qD3Zg7RCjTSzDVyct6sghs9UEgBEQ==}
+  '@vitest/spy@4.1.7':
+    resolution: {integrity: sha512-kbkI5LMWakyuTIvs6fUJ5qdIVb1XVKsYJAT4OJ938cHMROYMSfmoQdZy0aaAnjbbc8F61vkoTqz/Az+/HiIu5Q==}
 
-  '@vitest/utils@4.1.4':
-    resolution: {integrity: sha512-13QMT+eysM5uVGa1rG4kegGYNp6cnQcsTc67ELFbhNLQO+vgsygtYJx2khvdt4gVQqSSpC/KT5FZZxUpP3Oatw==}
+  '@vitest/utils@4.1.7':
+    resolution: {integrity: sha512-T532WBu791cBxJlCl6SO+J14l81DQx6uQHm1bQbmCDY7nqlEIgkza/UFnSBNaUtSf41unldDFjdOBYEQC4b5Hw==}
 
   '@volar/language-core@2.4.28':
     resolution: {integrity: sha512-w4qhIJ8ZSitgLAkVay6AbcnC7gP3glYM3fYwKV3srj8m494E3xtrCv6E+bWviiK/8hs6e6t1ij1s2Endql7vzQ==}
@@ -1696,56 +1703,79 @@ packages:
   '@volar/typescript@2.4.28':
     resolution: {integrity: sha512-Ja6yvWrbis2QtN4ClAKreeUZPVYMARDYZl9LMEv1iQ1QdepB6wn0jTRxA9MftYmYa4DQ4k/DaSZpFPUfxl8giw==}
 
-  '@vue/compiler-core@3.5.32':
-    resolution: {integrity: sha512-4x74Tbtqnda8s/NSD6e1Dr5p1c8HdMU5RWSjMSUzb8RTcUQqevDCxVAitcLBKT+ie3o0Dl9crc/S/opJM7qBGQ==}
+  '@vue/compiler-core@3.5.35':
+    resolution: {integrity: sha512-BUmHaR1J+O+CKZ9uJucdVTEr1LHsdyvv7vG3eNRhK3CczEHeMd/LtsHAuD7PbrxvI2envCY2v7HI1vC1aBRzKw==}
 
-  '@vue/compiler-dom@3.5.32':
-    resolution: {integrity: sha512-ybHAu70NtiEI1fvAUz3oXZqkUYEe5J98GjMDpTGl5iHb0T15wQYLR4wE3h9xfuTNA+Cm2f4czfe8B4s+CCH57Q==}
+  '@vue/compiler-dom@3.5.35':
+    resolution: {integrity: sha512-k+bprkXxuqhVajgTx5mUHuir7TwQzUKOWR40ng1ncAqQRPnrLngGGgqVEEhOnTMlc8btHYVKmrP8s5Qyg0hvYA==}
 
-  '@vue/compiler-sfc@3.5.32':
-    resolution: {integrity: sha512-8UYUYo71cP/0YHMO814TRZlPuUUw3oifHuMR7Wp9SNoRSrxRQnhMLNlCeaODNn6kNTJsjFoQ/kqIj4qGvya4Xg==}
+  '@vue/compiler-sfc@3.5.35':
+    resolution: {integrity: sha512-G5VPMcXTSywXBgtFOZOnHKBxKSrwXUcvY1iaF5/hRcy7t0J6CH/d8ha9F4nzi00Fax1eLV0QHM7v4mQu68jydw==}
 
-  '@vue/compiler-ssr@3.5.32':
-    resolution: {integrity: sha512-Gp4gTs22T3DgRotZ8aA/6m2jMR+GMztvBXUBEUOYOcST+giyGWJ4WvFd7QLHBkzTxkfOt8IELKNdpzITLbA2rw==}
+  '@vue/compiler-ssr@3.5.35':
+    resolution: {integrity: sha512-rGhAeXgdM7/ffTJGXT69rCCdTmjDewnFuUZfBQQHTdcEBeWdT5HCGY60y2ytLJr9/Dsu7IntUi5z/w0h6Rjnzw==}
 
-  '@vue/language-core@3.2.7':
-    resolution: {integrity: sha512-Gn4q/tRxbpVGLEuARQ43p3YELlNAFgRUVCgW9U5Cr+5q4vfD2bWDWpl3ABbJMXUt5xlE1dF8dkigg2aUq7JYYw==}
+  '@vue/language-core@3.3.2':
+    resolution: {integrity: sha512-CLwjSfHlPLhjd2qhuS3tTFtnOIWHXAM5u4X1DxmzlQ8j5bmOYlKCsSusOP7jCRJnlVg0mCTQtHU3vwFvopZGoQ==}
 
-  '@vue/reactivity@3.5.32':
-    resolution: {integrity: sha512-/ORasxSGvZ6MN5gc+uE364SxFdJ0+WqVG0CENXaGW58TOCdrAW76WWaplDtECeS1qphvtBZtR+3/o1g1zL4xPQ==}
+  '@vue/reactivity@3.5.35':
+    resolution: {integrity: sha512-tVc+SsHConvh/Lz64qq1pP3rYArBmK42xonovEcxY74SQtvctZodG/zhq54P5dr38cVuw25d27cPNRdlMidpGQ==}
 
-  '@vue/runtime-core@3.5.32':
-    resolution: {integrity: sha512-pDrXCejn4UpFDFmMd27AcJEbHaLemaE5o4pbb7sLk79SRIhc6/t34BQA7SGNgYtbMnvbF/HHOftYBgFJtUoJUQ==}
+  '@vue/runtime-core@3.5.35':
+    resolution: {integrity: sha512-A/xFNX9loIcWDygeQuNCfKuh0CoYBzxhqEMNah5TSFg9Z53DrFYEN2qi5CU9necjM1OWYegYREUTHmXTmhfXtg==}
 
-  '@vue/runtime-dom@3.5.32':
-    resolution: {integrity: sha512-1CDVv7tv/IV13V8Nip1k/aaObVbWqRlVCVezTwx3K07p7Vxossp5JU1dcPNhJk3w347gonIUT9jQOGutyJrSVQ==}
+  '@vue/runtime-dom@3.5.35':
+    resolution: {integrity: sha512-odrJ1C391dbGnyDRh8U+rnP7J2amIEzfmRk5vXy7xi3aZhEXofTvpi0T4HJb6jlNqQZTNPR5MPHSB3RHNkIORA==}
 
-  '@vue/server-renderer@3.5.32':
-    resolution: {integrity: sha512-IOjm2+JQwRFS7W28HNuJeXQle9KdZbODFY7hFGVtnnghF51ta20EWAZJHX+zLGtsHhaU6uC9BGPV52KVpYryMQ==}
+  '@vue/server-renderer@3.5.35':
+    resolution: {integrity: sha512-NkebSOYdB97wi8OQcO3HqzZSlymJi/aWsN/7h74OSVhRTm6qGs3Jp3e0rCXynmWwSlKeRrnlIug+ilYoHBmQDA==}
     peerDependencies:
-      vue: 3.5.32
+      vue: 3.5.35
 
-  '@vue/shared@3.5.32':
-    resolution: {integrity: sha512-ksNyrmRQzWJJ8n3cRDuSF7zNNontuJg1YHnmWRJd2AMu8Ij2bqwiiri2lH5rHtYPZjj4STkNcgcmiQqlOjiYGg==}
+  '@vue/shared@3.5.35':
+    resolution: {integrity: sha512-zSbjL7gRXwks2ZQLRGCajBtBXEOXW9Ddhn/HvSdrGkE2dqGnumzW8XtusRrxrE9LvqtiqDXQ+A60Hp6mvdYxfA==}
+
+  abab@2.0.6:
+    resolution: {integrity: sha512-j2afSsaIENvHZN2B8GOpF566vZ5WVk5opAiMTvWgaQT8DkbOqsTfvNAvHoRGU2zzP8cPoqys+xHTRDWW8L+/BA==}
+    deprecated: Use your platform's native atob() and btoa() methods instead
+
+  acorn-globals@7.0.1:
+    resolution: {integrity: sha512-umOSDSDrfHbTNPuNpC2NSnnA3LUrqpevPb4T9jRx4MagXNS0rs+gwiTcAvqCRmsD6utzsrzNt+ebm00SNWiC3Q==}
 
   acorn-jsx@5.3.2:
     resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
     peerDependencies:
       acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
 
+  acorn-walk@8.3.5:
+    resolution: {integrity: sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw==}
+    engines: {node: '>=0.4.0'}
+
   acorn@8.16.0:
     resolution: {integrity: sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==}
     engines: {node: '>=0.4.0'}
     hasBin: true
 
-  ajv@6.14.0:
-    resolution: {integrity: sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==}
+  agent-base@6.0.2:
+    resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==}
+    engines: {node: '>= 6.0.0'}
 
-  ajv@8.18.0:
-    resolution: {integrity: sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==}
+  ajv@6.15.0:
+    resolution: {integrity: sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==}
 
-  alien-signals@3.1.2:
-    resolution: {integrity: sha512-d9dYqZTS90WLiU0I5c6DHj/HcKkF8ZyGN3G5x8wSbslulz70KOxaqCT0hQCo9KOyhVqzqGojvNdJXoTumZOtcw==}
+  ajv@8.20.0:
+    resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==}
+
+  alien-signals@3.2.1:
+    resolution: {integrity: sha512-I8FjmltrfnDFoZedi5CG8DghVYNhzb/Ijluz7tCSJH0xpd0484Kowhbb1XDYOxfJpU1p5wnM2X54dA+IfGyD1g==}
+
+  ansi-escapes@1.4.0:
+    resolution: {integrity: sha512-wiXutNjDUlNEDWHcYH3jtZUhd3c4/VojassD8zHdHCY13xbZy2XbW+NKQwA0tWGBVzDA9qEzYwfoSsWmviidhw==}
+    engines: {node: '>=0.10.0'}
+
+  ansi-regex@2.1.1:
+    resolution: {integrity: sha512-TIGnTpdo+E3+pCyAluZvtED5p5wCqLdezCyhPZzKPcxvFplEt4i+W7OONCKgeZFT3+y5NZZfOOS/Bdcanm1MYA==}
+    engines: {node: '>=0.10.0'}
 
   ansi-regex@5.0.1:
     resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
@@ -1755,10 +1785,18 @@ packages:
     resolution: {integrity: sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==}
     engines: {node: '>=12'}
 
+  ansi-styles@2.2.1:
+    resolution: {integrity: sha512-kmCevFghRiWM7HB5zTPULl4r9bVFSWjz62MhqizDGUrq2NWuNMQyuv4tHHoKJHs69M/MF64lEcHdYIocrdWQYA==}
+    engines: {node: '>=0.10.0'}
+
   ansi-styles@4.3.0:
     resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
     engines: {node: '>=8'}
 
+  ansi-styles@5.2.0:
+    resolution: {integrity: sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==}
+    engines: {node: '>=10'}
+
   ansi_up@6.0.6:
     resolution: {integrity: sha512-yIa1x3Ecf8jWP4UWEunNjqNX6gzE4vg2gGz+xqRGY+TBSucnYp6RRdPV4brmtg6bQ1ljD48mZ5iGSEj7QEpRKA==}
 
@@ -1779,9 +1817,40 @@ packages:
     resolution: {integrity: sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==}
     engines: {node: '>= 0.4'}
 
+  array-buffer-byte-length@1.0.2:
+    resolution: {integrity: sha512-LHE+8BuR7RYGDKvnrmcuSq3tDcKv9OFEXQt/HpbZhY7V6h0zlUXutnAD82GiFx9rdieCMjkvtcsPqBwgUl1Iiw==}
+    engines: {node: '>= 0.4'}
+
+  array-includes@3.1.9:
+    resolution: {integrity: sha512-FmeCCAenzH0KH381SPT5FZmiA/TmpndpcaShhfgEN9eCVjnFBqq3l1xrI42y8+PPLI6hypzou4GXw00WHmPBLQ==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.findlastindex@1.2.6:
+    resolution: {integrity: sha512-F/TKATkzseUExPlfvmwQKGITM3DGTK+vkAsCZoDc5daVygbJBnjEUCbgkAvVFsgfXfX4YIqZ/27G3k3tdXrTxQ==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.flat@1.3.3:
+    resolution: {integrity: sha512-rwG/ja1neyLqCuGZ5YYrznA62D4mZXg0i1cIskIUKSiqF3Cje9/wXAls9B9s1Wa2fomMsIv8czB8jZcPmxCXFg==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.flatmap@1.3.3:
+    resolution: {integrity: sha512-Y7Wt51eKJSyi80hFrJCePGGNo5ktJCslFuboqJsbf57CCPcm5zztluPlc4/aD8sWsKvlwatezpV4U1efk8kpjg==}
+    engines: {node: '>= 0.4'}
+
+  arraybuffer.prototype.slice@1.0.4:
+    resolution: {integrity: sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ==}
+    engines: {node: '>= 0.4'}
+
   asciinema-player@3.15.1:
     resolution: {integrity: sha512-agVYeNlPxthLyAb92l9AS7ypW0uhesqOuQzyR58Q4Sj+MvesQztZBgx86lHqNJkB8rQ6EP0LeA9czGytQUBpYw==}
 
+  asn1@0.2.6:
+    resolution: {integrity: sha512-ix/FxPn0MDjeyJ7i/yoHGFt/EX6LyNbxSEhPPXODPL+KB0VPk86UYfL0lMdy+KCnv+fmvIzySwaK5COwqVbWTQ==}
+
+  assert-plus@1.0.0:
+    resolution: {integrity: sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw==}
+    engines: {node: '>=0.8'}
+
   assertion-error@2.0.1:
     resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
     engines: {node: '>=12'}
@@ -1793,8 +1862,25 @@ packages:
     resolution: {integrity: sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==}
     engines: {node: '>=8'}
 
-  axe-core@4.11.3:
-    resolution: {integrity: sha512-zBQouZixDTbo3jMGqHKyePxYxr1e5W8UdTmBQ7sNtaA9M2bE32daxxPLS/jojhKOHxQ7LWwPjfiwf/fhaJWzlg==}
+  async-function@1.0.0:
+    resolution: {integrity: sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==}
+    engines: {node: '>= 0.4'}
+
+  asynckit@0.4.0:
+    resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
+
+  available-typed-arrays@1.0.7:
+    resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
+    engines: {node: '>= 0.4'}
+
+  aws-sign2@0.7.0:
+    resolution: {integrity: sha512-08kcGqnYf/YmjoRhfxyu+CLxBjUtHLXLXX/vUfx9l2LYzG3c1m61nrpyFUZI6zeS+Li/wWMMidD9KgrqtGq3mA==}
+
+  aws4@1.13.2:
+    resolution: {integrity: sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw==}
+
+  axe-core@4.12.0:
+    resolution: {integrity: sha512-FTavr/7Ba0IptwGOPxnQvdyW2tAsdLBMTBXz7rKH6xJ2skpyxpBxyHkDdBs4lf69yRqYpkqCdfhnwS8YULGOmg==}
     engines: {node: '>=4'}
 
   axobject-query@4.1.0:
@@ -1811,23 +1897,33 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  baseline-browser-mapping@2.10.20:
-    resolution: {integrity: sha512-1AaXxEPfXT+GvTBJFuy4yXVHWJBXa4OdbIebGN/wX5DlsIkU0+wzGnd2lOzokSk51d5LUmqjgBLRLlypLUqInQ==}
+  baseline-browser-mapping@2.10.33:
+    resolution: {integrity: sha512-bA6+tcSLpz2tIEdDXZPpPTIuxBcC4+w6SieaYyfigIa4h8GlFxbA17v22Vx3JUtuZQj9SgOsnbK+aTBzyDyEuw==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
+  bcrypt-pbkdf@1.0.2:
+    resolution: {integrity: sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==}
+
   binary-extensions@2.3.0:
     resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
     engines: {node: '>=8'}
 
+  biome@0.3.3:
+    resolution: {integrity: sha512-4LXjrQYbn9iTXu9Y4SKT7ABzTV0WnLDHCVSd2fPUOKsy1gQ+E4xPFmlY1zcWexoi0j7fGHItlL6OWA2CZ/yYAQ==}
+    hasBin: true
+
+  bluebird@3.7.2:
+    resolution: {integrity: sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==}
+
   boolbase@1.0.0:
     resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==}
 
-  brace-expansion@1.1.14:
-    resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==}
+  brace-expansion@1.1.15:
+    resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==}
 
-  brace-expansion@5.0.5:
-    resolution: {integrity: sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==}
+  brace-expansion@5.0.6:
+    resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==}
     engines: {node: 18 || 20 || >=22}
 
   braces@3.0.3:
@@ -1846,16 +1942,28 @@ packages:
     resolution: {integrity: sha512-zhaCDicdLuWN5UbN5IMnFqNMhNfo919sH85y2/ea+5Yg9TsTkeZxpL+JLbp6cgYFS4sRLp3YV4S6yDuqVWHYOw==}
     engines: {node: '>=6'}
 
-  builtin-modules@5.1.0:
-    resolution: {integrity: sha512-c5JxaDrzwRjq3WyJkI1AGR5xy6Gr6udlt7sQPbl09+3ckB+Zo2qqQ2KhCTBr7Q8dHB43bENGYEk4xddrFH/b7A==}
+  builtin-modules@5.2.0:
+    resolution: {integrity: sha512-02yxLeyxF4dNl6SlY6/5HfRSrSdZ/sCPoxy2kZNP5dZZX8LSAD9aE2gtJIUgWrsQTiMPl3mxESyrobSwvRGisQ==}
     engines: {node: '>=18.20'}
 
   bytes@3.1.2:
     resolution: {integrity: sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==}
     engines: {node: '>= 0.8'}
 
-  cacheable@2.3.4:
-    resolution: {integrity: sha512-djgxybDbw9fL/ZWMI3+CE8ZilNxcwFkVtDc1gJ+IlOSSWkSMPQabhV/XCHTQ6pwwN6aivXPZ43omTooZiX06Ew==}
+  cacheable@2.3.5:
+    resolution: {integrity: sha512-EQfaKe09tl615iNvq/TBRWTFf1AKJNXYQSsMx0Z3EI0nA+pVsVPS8wJhnRlkbdacKPh1d0qVIhwTc2zsQNFEEg==}
+
+  call-bind-apply-helpers@1.0.2:
+    resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bind@1.0.9:
+    resolution: {integrity: sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bound@1.0.4:
+    resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
+    engines: {node: '>= 0.4'}
 
   callsites@3.1.0:
     resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
@@ -1865,13 +1973,24 @@ packages:
     resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
     engines: {node: '>= 6'}
 
-  caniuse-lite@1.0.30001788:
-    resolution: {integrity: sha512-6q8HFp+lOQtcf7wBK+uEenxymVWkGKkjFpCvw5W25cmMwEDU45p1xQFBQv8JDlMMry7eNxyBaR+qxgmTUZkIRQ==}
+  caniuse-lite@1.0.30001793:
+    resolution: {integrity: sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==}
+
+  caseless@0.12.0:
+    resolution: {integrity: sha512-4tYFyifaFfGacoiObjJegolkwSU4xQNGbVgUiNYVUxbQ2x2lUsFvY4hVgVzGiIe6WLOPqycWXA40l+PWsxthUw==}
 
   chai@6.2.2:
     resolution: {integrity: sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==}
     engines: {node: '>=18'}
 
+  chalk@1.1.3:
+    resolution: {integrity: sha512-U3lRVLMSlsCfjqYPbLyVv11M9CPW4I728d6TCKMAOJueEeB9/8o+eSsMnxPJD+Q+K909sdESg7C+tIkoH6on1A==}
+    engines: {node: '>=0.10.0'}
+
+  chalk@4.1.2:
+    resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
+    engines: {node: '>=10'}
+
   change-case@5.4.4:
     resolution: {integrity: sha512-HRQyTk2/YPEkt9TnUPbOpr64Uw3KOicFWPVBb+xiHvd6eBx/qPr9xqfBFDT8P2vWsvvz4jbEkfDe71W3VyNu2w==}
 
@@ -1900,15 +2019,6 @@ packages:
     peerDependencies:
       chart.js: '>=3.2.0'
 
-  chevrotain-allstar@0.4.1:
-    resolution: {integrity: sha512-PvVJm3oGqrveUVW2Vt/eZGeiAIsJszYweUcYwcskg9e+IubNYKKD+rHHem7A6XVO22eDAL+inxNIGAzZ/VIWlA==}
-    peerDependencies:
-      chevrotain: ^12.0.0
-
-  chevrotain@12.0.0:
-    resolution: {integrity: sha512-csJvb+6kEiQaqo1woTdSAuOWdN0WTLIydkKrBnS+V5gZz0oqBrp4kQ35519QgK6TpBThiG3V1vNSHlIkv4AglQ==}
-    engines: {node: '>=22.0.0'}
-
   chokidar@3.6.0:
     resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
     engines: {node: '>= 8.10.0'}
@@ -1916,6 +2026,10 @@ packages:
   chroma-js@3.2.0:
     resolution: {integrity: sha512-os/OippSlX1RlWWr+QDPcGUZs0uoqr32urfxESG9U93lhUfbnlyckte84Q8P1UQY/qth983AS1JONKmLS4T0nw==}
 
+  ci-info@3.9.0:
+    resolution: {integrity: sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==}
+    engines: {node: '>=8'}
+
   ci-info@4.4.0:
     resolution: {integrity: sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==}
     engines: {node: '>=8'}
@@ -1927,8 +2041,19 @@ packages:
     resolution: {integrity: sha512-GfisEZEJvzKrmGWkvfhgzcz/BllN1USeqD2V6tg14OAOgaCD2Z/PUEuxnAZ/nPvmaHRG7a8y77p1T/IRQ4D1Hw==}
     engines: {node: '>=4'}
 
-  clippie@4.1.14:
-    resolution: {integrity: sha512-VMyejKiX9jtz57BP2YLZeH+662xKTlIAXBoaHVXdtuuDiSd2D1z/0GyclLGX4POXKK03/vYB6cHVWlSLDI2YBw==}
+  cli-cursor@1.0.2:
+    resolution: {integrity: sha512-25tABq090YNKkF6JH7lcwO0zFJTRke4Jcq9iX2nr/Sz0Cjjv4gckmwlW6Ty/aoyFd6z3ysR2hMGC2GFugmBo6A==}
+    engines: {node: '>=0.10.0'}
+
+  cli-width@1.1.1:
+    resolution: {integrity: sha512-eMU2akIeEIkCxGXUNmDnJq1KzOIiPnJ+rKqRe6hcxE3vIOPvpMrBYOn/Bl7zNlYJj/zQxXquAnozHUCf9Whnsg==}
+
+  clippie@4.2.0:
+    resolution: {integrity: sha512-NcWaVzqChJ69+foFhwJXta3KXWNDJlpicxcfZG5udobyszOSBDhmFubKv1b/1nIZiVAsPoKqME2iV1SITZqFoQ==}
+
+  code-point-at@1.1.0:
+    resolution: {integrity: sha512-RpAVKQA5T63xEj6/giIbUEtZwJ4UFIc3ZtvEkiaUERylqe8xb5IvqcgOurZLahv93CLKfxcw5YI+DZcUBRyLXA==}
+    engines: {node: '>=0.10.0'}
 
   codemirror-lang-elixir@4.0.1:
     resolution: {integrity: sha512-z6W/XB4b7TZrp9EZYBGVq93vQfvKbff+1iM8YZaVErL0dguBAeLmVRlEv1NuDZHOP1qjJ3NwyibkUkNWn7q9VQ==}
@@ -1949,6 +2074,10 @@ packages:
   colord@2.9.3:
     resolution: {integrity: sha512-jeC1axXpnb0/2nn/Y1LPuLdgXBLH7aDcHu4KEKfqw3CUhX7ZpfBSlPKyqXE6btIgEzfWtrX3/tyBCaCvXvMkOw==}
 
+  combined-stream@1.0.8:
+    resolution: {integrity: sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==}
+    engines: {node: '>= 0.8'}
+
   commander@11.1.0:
     resolution: {integrity: sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==}
     engines: {node: '>=16'}
@@ -1957,6 +2086,9 @@ packages:
     resolution: {integrity: sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==}
     engines: {node: '>=20'}
 
+  commander@2.20.3:
+    resolution: {integrity: sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==}
+
   commander@4.1.1:
     resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==}
     engines: {node: '>= 6'}
@@ -1969,8 +2101,8 @@ packages:
     resolution: {integrity: sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==}
     engines: {node: '>= 12'}
 
-  comment-parser@1.4.6:
-    resolution: {integrity: sha512-ObxuY6vnbWTN6Od72xfwN9DbzC7Y2vv8u1Soi9ahRKL37gb6y1qk6/dgjs+3JWuXJHWvsg3BXIwzd/rkmAwavg==}
+  comment-parser@1.4.7:
+    resolution: {integrity: sha512-0h+uSNtQGW3D98eQt3jJ8L06Fves8hncB4V/PKdw/Qb8Hnk19VaKuTr55UNRYiSoVa7WwrFls+rh3ux9agmkeQ==}
     engines: {node: '>= 12.0.0'}
 
   compare-versions@6.1.1:
@@ -1979,18 +2111,22 @@ packages:
   concat-map@0.0.1:
     resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
 
-  confbox@0.1.8:
-    resolution: {integrity: sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==}
-
   convert-source-map@2.0.0:
     resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
 
   core-js-compat@3.49.0:
     resolution: {integrity: sha512-VQXt1jr9cBz03b331DFDCCP90b3fanciLkgiOoy8SBHy06gNf+vQ1A3WFLqG7I8TipYIKeYK9wxd0tUrvHcOZA==}
 
+  core-js@2.6.12:
+    resolution: {integrity: sha512-Kb2wC0fvsWfQrgk8HU5lW6U/Lcs8+9aaYcy4ZFc6DDlo4nZ7n70dEgE5rtR0oG6ufKDUnrwfWL1mXR5ljDatrQ==}
+    deprecated: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
+
   core-js@3.32.2:
     resolution: {integrity: sha512-pxXSw1mYZPDGvTQqEc5vgIb83jGQKFGYWY76z4a7weZXUolw3G+OvpZqSRcfYOoOVUQJYEPsWeQK8pKEnUtWxQ==}
 
+  core-util-is@1.0.2:
+    resolution: {integrity: sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ==}
+
   cose-base@1.0.3:
     resolution: {integrity: sha512-s9whTXInMSgAp/NVXVNuVxVKzGH2qck3aQlVHxDCdAEPgtMKwc4Wq6/QKhgdEdgbLSi9rBTAcPoRa6JpiG4ksg==}
 
@@ -2044,6 +2180,16 @@ packages:
     resolution: {integrity: sha512-0LrrStPOdJj+SPCCrGhzryycLjwcgUSHBtxNA8aIDxf0GLsRh1cKYhB00Gd1lDOS4yGH69+SNn13+TWbVHETFQ==}
     engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0, npm: '>=7.0.0'}
 
+  cssom@0.3.8:
+    resolution: {integrity: sha512-b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==}
+
+  cssom@0.5.0:
+    resolution: {integrity: sha512-iKuQcq+NdHqlAcwUY0o/HL69XQrUaQdMjmStJ8JFmUaiiQErlhrmuigkg/CU4E2J0IyUKUrMAgl36TvN67MqTw==}
+
+  cssstyle@2.3.0:
+    resolution: {integrity: sha512-AZL67abkUzIuvcHqk7c09cezpGNcxUxU4Ioi/05xHk4DQeTkWmGYftIE6ctU6AEt+Gn4n1lDStOtj7FKycP71A==}
+    engines: {node: '>=8'}
+
   csstype@3.2.3:
     resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==}
 
@@ -2057,8 +2203,8 @@ packages:
     peerDependencies:
       cytoscape: ^3.2.0
 
-  cytoscape@3.33.2:
-    resolution: {integrity: sha512-sj4HXd3DokGhzZAdjDejGvTPLqlt84vNFN8m7bGsOzDY5DyVcxIb2ejIXat2Iy7HxWhdT/N1oKyheJ5YdpsGuw==}
+  cytoscape@3.33.4:
+    resolution: {integrity: sha512-HIN5Pmd9MrX9BkV7tDwnOcEJCSFvCpc8X97h3f508J6I5FsqAY65wKOCvgH2CuP42CaahWaz4tuh32SOOIH7ww==}
     engines: {node: '>=0.10'}
 
   d3-array@2.12.1:
@@ -2206,8 +2352,28 @@ packages:
   damerau-levenshtein@1.0.8:
     resolution: {integrity: sha512-sdQSFB7+llfUcQHUQO3+B8ERRj0Oa4w9POWMI/puGtuf7gFywGmkaLCElnudfTiKZV+NvHqL0ifzdrI8Ro7ESA==}
 
-  dayjs@1.11.20:
-    resolution: {integrity: sha512-YbwwqR/uYpeoP4pu043q+LTDLFBLApUP6VxRihdfNTqu4ubqMlGDLd6ErXhEgsyvY0K6nCs7nggYumAN+9uEuQ==}
+  dashdash@1.14.1:
+    resolution: {integrity: sha512-jRFi8UDGo6j+odZiEpjazZaWqEal3w/basFjQHQEwVtZJGDpxbH1MeYluwCS8Xq5wmLJooDlMgvVarmWfGM44g==}
+    engines: {node: '>=0.10'}
+
+  data-urls@3.0.2:
+    resolution: {integrity: sha512-Jy/tj3ldjZJo63sVAvg6LHt2mHvl4V6AgRAmNDtLdm7faqtsx+aJG42rsyCo9JCoRVKwPFzKlIPx3DIibwSIaQ==}
+    engines: {node: '>=12'}
+
+  data-view-buffer@1.0.2:
+    resolution: {integrity: sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ==}
+    engines: {node: '>= 0.4'}
+
+  data-view-byte-length@1.0.2:
+    resolution: {integrity: sha512-tuhGbE6CfTM9+5ANGf+oQb72Ky/0+s3xKUpHvShfiz2RxMFgFPjsXuRLBVMtvMs15awe45SRb83D6wH4ew6wlQ==}
+    engines: {node: '>= 0.4'}
+
+  data-view-byte-offset@1.0.1:
+    resolution: {integrity: sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==}
+    engines: {node: '>= 0.4'}
+
+  dayjs@1.11.21:
+    resolution: {integrity: sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==}
 
   debug@3.2.7:
     resolution: {integrity: sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==}
@@ -2226,6 +2392,9 @@ packages:
       supports-color:
         optional: true
 
+  decimal.js@10.6.0:
+    resolution: {integrity: sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==}
+
   decode-named-character-reference@1.3.0:
     resolution: {integrity: sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==}
 
@@ -2240,9 +2409,21 @@ packages:
     resolution: {integrity: sha512-RHd9ABw4Fvk+gYDWqwOftG849x0bYOySl/RgX0tLI9i27ZIeSO91mLZJEp7oPHOMFqHvpgu21YptmDt0FYD/0A==}
     engines: {node: '>=0.10.0'}
 
+  define-data-property@1.1.4:
+    resolution: {integrity: sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==}
+    engines: {node: '>= 0.4'}
+
+  define-properties@1.2.1:
+    resolution: {integrity: sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
+    engines: {node: '>= 0.4'}
+
   delaunator@5.1.0:
     resolution: {integrity: sha512-AGrQ4QSgssa1NGmWmLPqN5NY2KajF5MqxetNEO+o0n3ZwZZeTmt7bBnvzHWrmkZFxGgr4HdyFgelzgi06otLuQ==}
 
+  delayed-stream@1.0.0:
+    resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
+    engines: {node: '>=0.4.0'}
+
   dequal@2.0.3:
     resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
     engines: {node: '>=6'}
@@ -2273,21 +2454,39 @@ packages:
   domelementtype@2.3.0:
     resolution: {integrity: sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==}
 
+  domexception@4.0.0:
+    resolution: {integrity: sha512-A2is4PLG+eeSfoTMA95/s4pvAoSo2mKtiM5jlHkAVewmiO8ISFTFKZjH7UAM1Atli/OT/7JHOrJRJiMKUZKYBw==}
+    engines: {node: '>=12'}
+    deprecated: Use your platform's native DOMException instead
+
   domhandler@5.0.3:
     resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==}
     engines: {node: '>= 4'}
 
-  dompurify@3.4.0:
-    resolution: {integrity: sha512-nolgK9JcaUXMSmW+j1yaSvaEaoXYHwWyGJlkoCTghc97KgGDDSnpoU/PlEnw63Ah+TGKFOyY+X5LnxaWbCSfXg==}
+  dompurify@3.4.7:
+    resolution: {integrity: sha512-2jBxDJY4RR06tQNy4w5FlFH7kfxsQZlufd0sbv+chfHCxeJwrFw2baUDsSwvBISD4K4RDbd0PTfy3uNXsR6siA==}
 
   domutils@3.2.2:
     resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==}
 
-  easymde@2.20.0:
-    resolution: {integrity: sha512-V1Z5f92TfR42Na852OWnIZMbM7zotWQYTddNaLYZFVKj7APBbyZ3FYJ27gBw2grMW3R6Qdv9J8n5Ij7XRSIgXQ==}
+  dunder-proto@1.0.1:
+    resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
+    engines: {node: '>= 0.4'}
 
-  electron-to-chromium@1.5.340:
-    resolution: {integrity: sha512-908qahOGocRMinT2nM3ajCEM99H4iPdv84eagPP3FfZy/1ZGeOy2CZYzjhms81ckOPCXPlW7LkY4XpxD8r1DrA==}
+  earlgrey-runtime@0.1.2:
+    resolution: {integrity: sha512-T4qoScXi5TwALDv8nlGTvOuCT8jXcKcxtO8qVdqv46IA2GHJfQzwoBPbkOmORnyhu3A98cVVuhWLsM2CzPljJg==}
+
+  easymde@2.21.0:
+    resolution: {integrity: sha512-5uE7I/DEN8gvGRwxaqAv7h1PMEK2ykNXVX5zL0dK3nCYROGja3AMbdQz8eCEELnfvCfy7tRkTmLuvyJG8uSWjQ==}
+
+  ecc-jsbn@0.1.2:
+    resolution: {integrity: sha512-eh9O+hwRHNbG4BLTjEl3nw044CkGm5X6LoaCf7LPp7UU8Qrt47JYNi6nPX8xjW97TKGKm1ouctg0QSpZe9qrnw==}
+
+  editor@1.0.0:
+    resolution: {integrity: sha512-SoRmbGStwNYHgKfjOrX2L0mUvp9bUVv0uPppZSOMAntEbcFtoC3MKF5b3T6HQPXKIV+QGY3xPO3JK5it5lVkuw==}
+
+  electron-to-chromium@1.5.364:
+    resolution: {integrity: sha512-G/dYE3+AYhyHwzTwg8UbnXf7zqMERYh7l2jJ3QujhFsH8agSYwtnGAR2aZ7f0AakIKJXd5En/Hre4igIUrdlYw==}
 
   elkjs@0.9.3:
     resolution: {integrity: sha512-f/ZeWvW/BCXbhGEf1Ujp29EASo/lk1FDnETgNKwJrsVvGZhUWCZyg3xLJjAsxfOmt8KjswHmI5EwCQcPMpOYhQ==}
@@ -2302,6 +2501,10 @@ packages:
     resolution: {integrity: sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==}
     engines: {node: '>=0.12'}
 
+  entities@6.0.1:
+    resolution: {integrity: sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==}
+    engines: {node: '>=0.12'}
+
   entities@7.0.1:
     resolution: {integrity: sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==}
     engines: {node: '>=0.12'}
@@ -2313,12 +2516,39 @@ packages:
   error-ex@1.3.4:
     resolution: {integrity: sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==}
 
+  es-abstract@1.24.2:
+    resolution: {integrity: sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg==}
+    engines: {node: '>= 0.4'}
+
+  es-define-property@1.0.1:
+    resolution: {integrity: sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
+    engines: {node: '>= 0.4'}
+
   es-errors@1.3.0:
     resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
     engines: {node: '>= 0.4'}
 
-  es-module-lexer@2.0.0:
-    resolution: {integrity: sha512-5POEcUuZybH7IdmGsD8wlf0AI55wMecM9rVBTI/qEAy2c1kTOm3DjFYjrBdI2K3BaJjJYfYFeRtM0t9ssnRuxw==}
+  es-module-lexer@2.1.0:
+    resolution: {integrity: sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==}
+
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
+    engines: {node: '>= 0.4'}
+
+  es-set-tostringtag@2.1.0:
+    resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
+    engines: {node: '>= 0.4'}
+
+  es-shim-unscopables@1.1.0:
+    resolution: {integrity: sha512-d9T8ucsEhh8Bi1woXCf+TIKDIROLG5WCkxg8geBCbvk22kzwC5G2OnXVMO6FUsvQlgUUXQ2itephWDLqDzbeCw==}
+    engines: {node: '>= 0.4'}
+
+  es-to-primitive@1.3.0:
+    resolution: {integrity: sha512-w+5mJ3GuFL+NjVtJlvydShqE1eN3h3PbI7/5LAsYJP/2qtuMXjfL2LpHSRqo4b4eSF5K/DH1JXKUAHSB2UW50g==}
+    engines: {node: '>= 0.4'}
+
+  es-toolkit@1.47.0:
+    resolution: {integrity: sha512-n1GuoD0WEQZMBk5tttoZSqwgyLx01oqa5XsBmCHwPyNe1S9jPBEmtR2pSgp2kJuWE3ciFZ6yRHmY4pM4C3OOkw==}
 
   esbuild@0.28.0:
     resolution: {integrity: sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==}
@@ -2333,10 +2563,19 @@ packages:
     resolution: {integrity: sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==}
     engines: {node: '>=0.8.0'}
 
+  escape-string-regexp@2.0.0:
+    resolution: {integrity: sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==}
+    engines: {node: '>=8'}
+
   escape-string-regexp@4.0.0:
     resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
     engines: {node: '>=10'}
 
+  escodegen@2.1.0:
+    resolution: {integrity: sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w==}
+    engines: {node: '>=6.0'}
+    hasBin: true
+
   eslint-config-prettier@10.1.8:
     resolution: {integrity: sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w==}
     hasBin: true
@@ -2368,8 +2607,8 @@ packages:
       eslint-plugin-import-x:
         optional: true
 
-  eslint-module-utils@2.12.1:
-    resolution: {integrity: sha512-L8jSWTze7K2mTg0vos/RuLRS5soomksDPoJLXIslC7c8Wmut3bx7CPpJijDcBZtxQ5lrbUdM+s0OlNbz0DCDNw==}
+  eslint-module-utils@2.13.0:
+    resolution: {integrity: sha512-bLohSkT6469rRs8czj0tLTD8vaeIS/whvPRJVjDr7IuoTT1k5DYDERlNycjDj/HkOlvQdYurmfZ/g3fG5bgeLQ==}
     engines: {node: '>=4'}
     peerDependencies:
       '@typescript-eslint/parser': '*'
@@ -2395,8 +2634,8 @@ packages:
     peerDependencies:
       eslint: '>=8.51.0'
 
-  eslint-plugin-de-morgan@2.1.1:
-    resolution: {integrity: sha512-0CeQ38b8hMMa3gO5vLnGcQS/xatvYno9RvjKoZ4UVaHjzvHZhR9i6+0ZkZhbbZF1FW7rqrS2MtcH3tVBejrmHQ==}
+  eslint-plugin-de-morgan@2.1.2:
+    resolution: {integrity: sha512-6/MXP77FUrFGTdJ2Lny3Jv027bE3SUHDf+/VBUBckpH5TskOY5G4UX+AebqJeUpt3nXjy3S0KWBRwTItVQwgvw==}
     engines: {node: ^20.0.0 || >=22.0.0}
     peerDependencies:
       eslint: ^8.45.0 || ^9.0.0 || ^10.0.0
@@ -2457,18 +2696,18 @@ packages:
     peerDependencies:
       eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9
 
-  eslint-plugin-no-only-tests@3.3.0:
-    resolution: {integrity: sha512-brcKcxGnISN2CcVhXJ/kEQlNa0MEfGRtwKtWA16SkqXHKitaKIMrfemJKLKX1YqDU5C/5JY3PvZXd5jEW04e0Q==}
+  eslint-plugin-no-only-tests@3.4.0:
+    resolution: {integrity: sha512-4S3/9Nb7A2tiMcpzEQE9bQSlpeOz6WJkgryBuou/SA8W2x2c8Zf4j0NvTKBjv6qNhF9T79tmkecm/0CHqV0UGg==}
     engines: {node: '>=5.0.0'}
 
-  eslint-plugin-playwright@2.10.2:
-    resolution: {integrity: sha512-0N+2OWc3NZbOZ0gK8mp2TK6Qu3UWcJTQ9rqU0UM2yRJXgT758pvpY0lsOLIySfbyFrLqn3TcXjixbmcK90VnuQ==}
+  eslint-plugin-playwright@2.10.4:
+    resolution: {integrity: sha512-l0V/VxyqfFbtqCTxj5AdRn3Q6S/hIW4nKBnKZVleVbZ24N2My6Usj//ytX3dKKqAoSbvKck9YtSytfdZ5qjLuA==}
     engines: {node: '>=16.9.0'}
     peerDependencies:
       eslint: '>=8.40.0'
 
-  eslint-plugin-prettier@5.5.5:
-    resolution: {integrity: sha512-hscXkbqUZ2sPithAuLm5MXL+Wph+U7wHngPBv9OMWwlP8iaflyxpjTYZkmdgB4/vPIhemRlBEoLrH7UC1n7aUw==}
+  eslint-plugin-prettier@5.5.6:
+    resolution: {integrity: sha512-ifetmTcxWfz+4qRW3pH/ujdTq2jQIj59AxJMIN26K5avYgU8dxycUETQonWiW+wPrYXA0j3Try0l1CnwVQtDqQ==}
     engines: {node: ^14.18.0 || >=16.0.0}
     peerDependencies:
       '@types/eslint': '>=8.0.0'
@@ -2498,8 +2737,8 @@ packages:
     peerDependencies:
       eslint: '>=9.38.0'
 
-  eslint-plugin-vue-scoped-css@3.0.0:
-    resolution: {integrity: sha512-YNGP0nUBFWFQc//kpvxnGquKjKDkEaWoDFUcZbXCX6L5UIWDlbl34/GXlEEls06bzDJ9ETRpLlmrWgvvZg+yIg==}
+  eslint-plugin-vue-scoped-css@3.1.0:
+    resolution: {integrity: sha512-R9XLrIZaP6QGz9b4kO2K4+lP4NcO2TKcw71zBtIYCoqqTk5ja1ySruYAllBT2LPIJVQ4NZaB2IFSvLjLEpYqQA==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
     peerDependencies:
       eslint: '>=9.38.0'
@@ -2512,14 +2751,14 @@ packages:
       postcss-styl:
         optional: true
 
-  eslint-plugin-vue@10.8.0:
-    resolution: {integrity: sha512-f1J/tcbnrpgC8suPN5AtdJ5MQjuXbSU9pGRSSYAuF3SHoiYCOdEX6O22pLaRyLHXvDcOe+O5ENgc1owQ587agA==}
+  eslint-plugin-vue@10.9.1:
+    resolution: {integrity: sha512-cHB0Tf4Duvzwecwd/AqWzZvF/QszE13BhjVUpVXWCy9AeMR5GjkAjP3i85vqgLgOuTmkHR1OJ5oMeqLHtuw8zg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       '@stylistic/eslint-plugin': ^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0
       '@typescript-eslint/parser': ^7.0.0 || ^8.0.0
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
-      vue-eslint-parser: ^10.0.0
+      vue-eslint-parser: ^10.3.0
     peerDependenciesMeta:
       '@stylistic/eslint-plugin':
         optional: true
@@ -2551,8 +2790,8 @@ packages:
     resolution: {integrity: sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  eslint@10.2.1:
-    resolution: {integrity: sha512-wiyGaKsDgqXvF40P8mDwiUp/KQjE1FdrIEJsM8PZ3XCiniTMXS3OHWWUe5FI5agoCnr8x4xPrTDZuxsBlNHl+Q==}
+  eslint@10.4.0:
+    resolution: {integrity: sha512-loXy6bWOoP3EP6JA7jo6p5jMpBJmHmsNZM5SFRHLdh1MGOPurMnNBj4ZlAbaqUAaQWbCr7jHV4P7gzAyryZWkQ==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
     hasBin: true
     peerDependencies:
@@ -2569,6 +2808,11 @@ packages:
     resolution: {integrity: sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
+  esprima@4.0.1:
+    resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==}
+    engines: {node: '>=4'}
+    hasBin: true
+
   esquery@1.7.0:
     resolution: {integrity: sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==}
     engines: {node: '>=0.10'}
@@ -2598,10 +2842,21 @@ packages:
     resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
     engines: {node: '>=0.8.x'}
 
+  exit-hook@1.1.1:
+    resolution: {integrity: sha512-MsG3prOVw1WtLXAZbM3KiYtooKR1LvxHh3VHsVtIy0uiUu8usxgB/94DP2HxtD/661lLdB6yzQ09lGJSQr6nkg==}
+    engines: {node: '>=0.10.0'}
+
   expect-type@1.3.0:
     resolution: {integrity: sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==}
     engines: {node: '>=12.0.0'}
 
+  extend@3.0.2:
+    resolution: {integrity: sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==}
+
+  extsprintf@1.3.0:
+    resolution: {integrity: sha512-11Ndz7Nv+mvAC1j0ktTa7fAb0vLyGGX+rMHNBYQviQDGU0Hw7lhctJANqbPhu9nV9/izT/IntTgZ7Im/9LJs9g==}
+    engines: {'0': node >=0.6.0}
+
   fast-deep-equal@3.1.3:
     resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
 
@@ -2618,8 +2873,8 @@ packages:
   fast-levenshtein@2.0.6:
     resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
 
-  fast-uri@3.1.0:
-    resolution: {integrity: sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==}
+  fast-uri@3.1.2:
+    resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==}
 
   fastest-levenshtein@1.0.16:
     resolution: {integrity: sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg==}
@@ -2643,8 +2898,12 @@ packages:
   fflate@0.8.2:
     resolution: {integrity: sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==}
 
-  file-entry-cache@11.1.2:
-    resolution: {integrity: sha512-N2WFfK12gmrK1c1GXOqiAJ1tc5YE+R53zvQ+t5P8S5XhnmKYVB5eZEiLNZKDSmoG8wqqbF9EXYBBW/nef19log==}
+  figures@1.7.0:
+    resolution: {integrity: sha512-UxKlfCRuCBxSXU4C6t9scbDyWZ4VlaFFdojKtzJuSkuOBQ5CNFum+zZXFwHjo+CxBC1t6zlYPgHIgFjL8ggoEQ==}
+    engines: {node: '>=0.10.0'}
+
+  file-entry-cache@11.1.3:
+    resolution: {integrity: sha512-oMbq0PD6VIiIwMF6LIa7MEwd/l9huKwmqRKXqmrkqIZv8CvRbfowL+L0ryAl8h//HfAS0zS+4SbYoRyAoA6BJA==}
 
   file-entry-cache@8.0.0:
     resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
@@ -2672,6 +2931,31 @@ packages:
   flatted@3.4.2:
     resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
 
+  for-each@0.3.5:
+    resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
+    engines: {node: '>= 0.4'}
+
+  forever-agent@0.6.1:
+    resolution: {integrity: sha512-j0KLYPhm6zeac4lz3oJ3o65qvgQCcPubiyotZrXqEaG4hNagNYO8qdlUrX5vwqv9ohqeT/Z3j6+yW067yWWdUw==}
+
+  form-data@2.3.3:
+    resolution: {integrity: sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==}
+    engines: {node: '>= 0.12'}
+
+  form-data@4.0.5:
+    resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
+    engines: {node: '>= 6'}
+
+  fs-extra@0.26.7:
+    resolution: {integrity: sha512-waKu+1KumRhYv8D8gMRCKJGAMI9pRnPuEb1mvgYD0f7wBscg+h6bW4FDTmEZhB9VKxvoTtxW+Y7bnIlB7zja6Q==}
+
+  fs-promise@0.5.0:
+    resolution: {integrity: sha512-Y+4F4ujhEcayCJt6JmzcOun9MYGQwz+bVUiuBmTkJImhBHKpBvmVPZR9wtfiF7k3ffwAOAuurygQe+cPLSFQhw==}
+    deprecated: Use mz or fs-extra^3.0 with Promise Support
+
+  fs.realpath@1.0.0:
+    resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
+
   fsevents@2.3.2:
     resolution: {integrity: sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==}
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
@@ -2682,16 +2966,45 @@ packages:
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
 
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
+  function.prototype.name@1.1.8:
+    resolution: {integrity: sha512-e5iwyodOHhbMr/yNrc7fDYG4qlbIvI5gajyzPnb5TCwyhjApznQh1BMFou9b30SevY43gCJKXycoCBjMbsuW0Q==}
+    engines: {node: '>= 0.4'}
+
   functional-red-black-tree@1.0.1:
     resolution: {integrity: sha512-dsKNQNdj6xA3T+QlADDA7mOSlX0qiMINjn0cgr+eGHGsbSHzTabcIogz2+p/iqP1Xs6EP/sS2SbqH+brGTbq0g==}
 
-  get-east-asian-width@1.5.0:
-    resolution: {integrity: sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA==}
+  functions-have-names@1.2.3:
+    resolution: {integrity: sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==}
+
+  generator-function@2.0.1:
+    resolution: {integrity: sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==}
+    engines: {node: '>= 0.4'}
+
+  get-east-asian-width@1.6.0:
+    resolution: {integrity: sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==}
     engines: {node: '>=18'}
 
+  get-intrinsic@1.3.0:
+    resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
+    engines: {node: '>= 0.4'}
+
+  get-proto@1.0.1:
+    resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
+    engines: {node: '>= 0.4'}
+
+  get-symbol-description@1.1.0:
+    resolution: {integrity: sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==}
+    engines: {node: '>= 0.4'}
+
   get-tsconfig@4.14.0:
     resolution: {integrity: sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==}
 
+  getpass@0.1.7:
+    resolution: {integrity: sha512-0fzj9JxOLfJ+XGLhR8ze3unN0KZCgZwiSSDz168VERjK8Wl8kVSdcu2kspd4s4wtAa1y/qrVRiAA0WclVsu0ng==}
+
   glob-parent@5.1.2:
     resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
     engines: {node: '>= 6'}
@@ -2700,6 +3013,10 @@ packages:
     resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
     engines: {node: '>=10.13.0'}
 
+  glob@7.2.3:
+    resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
+
   global-modules@2.0.0:
     resolution: {integrity: sha512-NGbfmJBp9x8IxyJSd1P+otYK8vonoJactOogrVfFRIAEY1ukil8RSKDz2Yo7wh1oihl51l/r6W4epkeKJHqL8A==}
     engines: {node: '>=6'}
@@ -2716,10 +3033,14 @@ packages:
     resolution: {integrity: sha512-c/c15i26VrJ4IRt5Z89DnIzCGDn9EcebibhAOjw5ibqEHsE1wLUgkPn9RDmNcUKyU87GeaL633nyJ+pplFR2ZQ==}
     engines: {node: '>=18'}
 
-  globals@17.5.0:
-    resolution: {integrity: sha512-qoV+HK2yFl/366t2/Cb3+xxPUo5BuMynomoDmiaZBIdbs+0pYbjfZU+twLhGKp4uCZ/+NbtpVepH5bGCxRyy2g==}
+  globals@17.6.0:
+    resolution: {integrity: sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==}
     engines: {node: '>=18'}
 
+  globalthis@1.0.4:
+    resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==}
+    engines: {node: '>= 0.4'}
+
   globby@16.2.0:
     resolution: {integrity: sha512-QrJia2qDf5BB/V6HYlDTs0I0lBahyjLzpGQg3KT7FnCdTonAyPy2RtY802m2k4ALx6Dp752f82WsOczEVr3l6Q==}
     engines: {node: '>=20'}
@@ -2727,6 +3048,13 @@ packages:
   globjoin@0.1.4:
     resolution: {integrity: sha512-xYfnw62CKG8nLkZBfWbhWwDw02CHty86jfPcc2cr3ZfeuK9ysoVPPEUxf21bAD/rWAgk52SuBrLJlefNy8mvFg==}
 
+  gopd@1.2.0:
+    resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
+    engines: {node: '>= 0.4'}
+
+  graceful-fs@4.2.11:
+    resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
+
   hachure-fill@0.5.2:
     resolution: {integrity: sha512-3GKBOn+m2LX9iq+JC1064cSFprJY4jL1jCXTcpnfER5HYE2l/4EfWSGzkPa/ZDBmYI0ZOEj5VHV/eKnPGkHuOg==}
 
@@ -2738,19 +3066,63 @@ packages:
     resolution: {integrity: sha512-GZZ9mKe8r646NUAf/zemnGbjYh4Bt8/MqASJY+pSm5ZDtc3YQox+4gsLI7yi1hba6o+eCsGxpHn5+iEVn31/FQ==}
     engines: {node: '>=20.0.0'}
 
+  har-schema@2.0.0:
+    resolution: {integrity: sha512-Oqluz6zhGX8cyRaTQlFMPw80bSJVG2x/cFb8ZPhUILGgHka9SsokCCOQgpveePerqidZOrT14ipqfJb7ILcW5Q==}
+    engines: {node: '>=4'}
+
+  har-validator@5.1.5:
+    resolution: {integrity: sha512-nmT2T0lljbxdQZfspsno9hgrG3Uir6Ks5afism62poxqBM6sDnMEuPmzTq8XN0OEwqKLLdh1jQI3qyE66Nzb3w==}
+    engines: {node: '>=6'}
+    deprecated: this library is no longer supported
+
+  has-ansi@2.0.0:
+    resolution: {integrity: sha512-C8vBJ8DwUCx19vhm7urhTuUsr4/IyP6l4VzNQDv+ryHQObW3TTTp9yB68WpYgRe2bbaGuZ/se74IqFeVnMnLZg==}
+    engines: {node: '>=0.10.0'}
+
+  has-bigints@1.1.0:
+    resolution: {integrity: sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg==}
+    engines: {node: '>= 0.4'}
+
+  has-flag@4.0.0:
+    resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
+    engines: {node: '>=8'}
+
   has-flag@5.0.1:
     resolution: {integrity: sha512-CsNUt5x9LUdx6hnk/E2SZLsDyvfqANZSUq4+D3D8RzDJ2M+HDTIkF60ibS1vHaK55vzgiZw1bEPFG9yH7l33wA==}
     engines: {node: '>=12'}
 
+  has-property-descriptors@1.0.2:
+    resolution: {integrity: sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==}
+
+  has-proto@1.2.0:
+    resolution: {integrity: sha512-KIL7eQPfHQRC8+XluaIw7BHUwwqL19bQn4hzNgdr+1wXoU0KKj6rufu47lhY7KbJR2C6T6+PfyN0Ea7wkSS+qQ==}
+    engines: {node: '>= 0.4'}
+
+  has-symbols@1.1.0:
+    resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
+    engines: {node: '>= 0.4'}
+
+  has-tostringtag@1.0.2:
+    resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
+    engines: {node: '>= 0.4'}
+
   hashery@1.5.1:
     resolution: {integrity: sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==}
     engines: {node: '>=20'}
 
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
   hookified@1.15.1:
     resolution: {integrity: sha512-MvG/clsADq1GPM2KGo2nyfaWVyn9naPiXrqIe4jYjXNZQt238kWyOGrsyc/DmRAQ+Re6yeo6yX/yoNCG5KAEVg==}
 
-  hookified@2.1.1:
-    resolution: {integrity: sha512-AHb76R16GB5EsPBE2J7Ko5kiEyXwviB9P5SMrAKcuAu4vJPZttViAbj9+tZeaQE5zjDme+1vcHP78Yj/WoAveA==}
+  hookified@2.2.0:
+    resolution: {integrity: sha512-p/LgFzRN5FeoD3DLS6bkUapeye6E4SI6yJs6KetENd18S+FBthqYq2amJUWpt5z0EQwwHemidjY5OqJGEKm5uA==}
+
+  html-encoding-sniffer@3.0.0:
+    resolution: {integrity: sha512-oWv4T4yJ52iKrufjnyZPkrN0CH3QnrUqdB6In1g5Fe1mia8GmF36gnfNySxoZtxD5+NmYw1EElVXiBk93UeskA==}
+    engines: {node: '>=12'}
 
   html-tags@5.1.0:
     resolution: {integrity: sha512-n6l5uca7/y5joxZ3LUePhzmBFUJ+U2YWzhMa8XUTecSeSlQiZdF5XAd/Q3/WUl0VsXgUwWi8I7CNIwdI5WN1SQ==}
@@ -2759,6 +3131,18 @@ packages:
   htmlparser2@8.0.2:
     resolution: {integrity: sha512-GYdjWKDkbRLkZ5geuHs5NY1puJ+PXwP7+fHPRz06Eirsb9ugf6d8kkXav6ADhcODhFFPMIXyxkxSuMf3D6NCFA==}
 
+  http-proxy-agent@5.0.0:
+    resolution: {integrity: sha512-n2hY8YdoRE1i7r6M0w9DIw5GgZN0G25P8zLCRQ8rjXtTU3vsNFBI/vWK/UIeE6g5MUUz6avwAPXmL6Fy9D/90w==}
+    engines: {node: '>= 6'}
+
+  http-signature@1.2.0:
+    resolution: {integrity: sha512-CAbnr6Rz4CYQkLYUtSNXxQPUH2gK8f3iWexVlsnMeD+GjlsQ0Xsy1cOX+mN3dtxYomRy21CiOzU8Uhw6OwncEQ==}
+    engines: {node: '>=0.8', npm: '>=1.3.7'}
+
+  https-proxy-agent@5.0.1:
+    resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
+    engines: {node: '>= 6'}
+
   iconv-lite@0.6.3:
     resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
     engines: {node: '>=0.10.0'}
@@ -2792,6 +3176,13 @@ packages:
     resolution: {integrity: sha512-m6FAo/spmsW2Ab2fU35JTYwtOKa2yAwXSwgjSv1TJzh4Mh7mC3lzAOVLBprb72XsTrgkEIsl7YrFNAiDiRhIGg==}
     engines: {node: '>=12'}
 
+  inflight@1.0.6:
+    resolution: {integrity: sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
+    deprecated: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
+
+  inherits@2.0.4:
+    resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
+
   ini@1.3.8:
     resolution: {integrity: sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==}
 
@@ -2799,6 +3190,16 @@ packages:
     resolution: {integrity: sha512-X7rqawQBvfdjS10YU1y1YVreA3SsLrW9dX2CewP2EbBJM4ypVNLDkO5y04gejPwKIY9lR+7r9gn3rFPt/kmWFg==}
     engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
 
+  inquirer-promise@0.0.3:
+    resolution: {integrity: sha512-82CQX586JAV9GAgU9yXZsMDs+NorjA0nLhkfFx9+PReyOnuoHRbHrC1Z90sS95bFJI1Tm1gzMObuE0HabzkJpg==}
+
+  inquirer@0.11.4:
+    resolution: {integrity: sha512-QR+2TW90jnKk9LUUtbcA3yQXKt2rDEKMh6+BAZQIeumtzHexnwVLdPakSslGijXYLJCzFv7GMXbFCn0pA00EUw==}
+
+  internal-slot@1.1.0:
+    resolution: {integrity: sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==}
+    engines: {node: '>= 0.4'}
+
   internmap@1.0.1:
     resolution: {integrity: sha512-lDB5YccMydFBtasVtxnZ3MRBHuaoE8GKsppq+EchKL2U4nK/DmEpPHNH8MZe5HkMtpSiTSOZwfN0tzYjO/lJEw==}
 
@@ -2812,13 +3213,29 @@ packages:
   is-alphanumerical@2.0.1:
     resolution: {integrity: sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw==}
 
+  is-array-buffer@3.0.5:
+    resolution: {integrity: sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==}
+    engines: {node: '>= 0.4'}
+
   is-arrayish@0.2.1:
     resolution: {integrity: sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==}
 
+  is-async-function@2.1.1:
+    resolution: {integrity: sha512-9dgM/cZBnNvjzaMYHVoxxfPj2QXt22Ev7SuuPrs+xav0ukGB0S6d4ydZdEiM48kLx5kDV+QBPrpVnFyefL8kkQ==}
+    engines: {node: '>= 0.4'}
+
+  is-bigint@1.1.0:
+    resolution: {integrity: sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ==}
+    engines: {node: '>= 0.4'}
+
   is-binary-path@2.1.0:
     resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
     engines: {node: '>=8'}
 
+  is-boolean-object@1.2.2:
+    resolution: {integrity: sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A==}
+    engines: {node: '>= 0.4'}
+
   is-buffer@1.1.6:
     resolution: {integrity: sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==}
 
@@ -2829,6 +3246,22 @@ packages:
   is-bun-module@2.0.0:
     resolution: {integrity: sha512-gNCGbnnnnFAUGKeZ9PdbyeGYJqewpmc2aKHUEMO5nQPWU9lOmv7jcmQIv+qHD8fXW6W7qfuCwX4rY9LNRjXrkQ==}
 
+  is-callable@1.2.7:
+    resolution: {integrity: sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==}
+    engines: {node: '>= 0.4'}
+
+  is-core-module@2.16.2:
+    resolution: {integrity: sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==}
+    engines: {node: '>= 0.4'}
+
+  is-data-view@1.0.2:
+    resolution: {integrity: sha512-RKtWF8pGmS87i2D6gqQu/l7EYRlVdfzemCJN/P3UOs//x1QE7mfhvzHIApBTRf7axvT6DMGwSwBXYCT0nfB9xw==}
+    engines: {node: '>= 0.4'}
+
+  is-date-object@1.1.0:
+    resolution: {integrity: sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg==}
+    engines: {node: '>= 0.4'}
+
   is-decimal@2.0.1:
     resolution: {integrity: sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==}
 
@@ -2836,10 +3269,22 @@ packages:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
 
+  is-finalizationregistry@1.1.1:
+    resolution: {integrity: sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg==}
+    engines: {node: '>= 0.4'}
+
+  is-fullwidth-code-point@1.0.0:
+    resolution: {integrity: sha512-1pqUqRjkhPJ9miNq9SwMfdvi6lBJcd6eFxvfaivQhaH3SgisfiuudvFntdKOmxuee/77l+FPjKrQjWvmPjWrRw==}
+    engines: {node: '>=0.10.0'}
+
   is-fullwidth-code-point@3.0.0:
     resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
     engines: {node: '>=8'}
 
+  is-generator-function@1.1.2:
+    resolution: {integrity: sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA==}
+    engines: {node: '>= 0.4'}
+
   is-glob@4.0.3:
     resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
     engines: {node: '>=0.10.0'}
@@ -2847,6 +3292,18 @@ packages:
   is-hexadecimal@2.0.1:
     resolution: {integrity: sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==}
 
+  is-map@2.0.3:
+    resolution: {integrity: sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw==}
+    engines: {node: '>= 0.4'}
+
+  is-negative-zero@2.0.3:
+    resolution: {integrity: sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw==}
+    engines: {node: '>= 0.4'}
+
+  is-number-object@1.1.1:
+    resolution: {integrity: sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw==}
+    engines: {node: '>= 0.4'}
+
   is-number@7.0.0:
     resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
     engines: {node: '>=0.12.0'}
@@ -2855,25 +3312,87 @@ packages:
     resolution: {integrity: sha512-lJJV/5dYS+RcL8uQdBDW9c9uWFLLBNRyFhnAKXw5tVqLlKZ4RMGZKv+YQ/IA3OhD+RpbJa1LLFM1FQPGyIXvOA==}
     engines: {node: '>=12'}
 
-  is-plain-object@5.0.0:
-    resolution: {integrity: sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==}
-    engines: {node: '>=0.10.0'}
-
   is-potential-custom-element-name@1.0.1:
     resolution: {integrity: sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==}
 
+  is-regex@1.2.1:
+    resolution: {integrity: sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==}
+    engines: {node: '>= 0.4'}
+
+  is-set@2.0.3:
+    resolution: {integrity: sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg==}
+    engines: {node: '>= 0.4'}
+
+  is-shared-array-buffer@1.0.4:
+    resolution: {integrity: sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A==}
+    engines: {node: '>= 0.4'}
+
+  is-string@1.1.1:
+    resolution: {integrity: sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA==}
+    engines: {node: '>= 0.4'}
+
+  is-symbol@1.1.1:
+    resolution: {integrity: sha512-9gGx6GTtCQM73BgmHQXfDmLtfjjTUDSyoxTCbp5WtoixAhfgsDirWIcVQ/IHpvI5Vgd5i/J5F7B9cN/WlVbC/w==}
+    engines: {node: '>= 0.4'}
+
+  is-typed-array@1.1.15:
+    resolution: {integrity: sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
+    engines: {node: '>= 0.4'}
+
+  is-typedarray@1.0.0:
+    resolution: {integrity: sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==}
+
   is-valid-element-name@1.0.0:
     resolution: {integrity: sha512-GZITEJY2LkSjQfaIPBha7eyZv+ge0PhBR7KITeCCWvy7VBQrCUdFkvpI+HrAPQjVtVjy1LvlEkqQTHckoszruw==}
 
+  is-weakmap@2.0.2:
+    resolution: {integrity: sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w==}
+    engines: {node: '>= 0.4'}
+
+  is-weakref@1.1.1:
+    resolution: {integrity: sha512-6i9mGWSlqzNMEqpCp93KwRS1uUOodk2OJ6b+sq7ZPDSy2WuI5NFIxp/254TytR8ftefexkWn5xNiHUNpPOfSew==}
+    engines: {node: '>= 0.4'}
+
+  is-weakset@2.0.4:
+    resolution: {integrity: sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==}
+    engines: {node: '>= 0.4'}
+
+  isarray@2.0.5:
+    resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
+
   isexe@2.0.0:
     resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
 
+  isstream@0.1.2:
+    resolution: {integrity: sha512-Yljz7ffyPbrLpLngrMtZ7NduUgVvi6wG9RJ9IUcyCd59YQ911PBJphODUcbOVbqYfxe1wuYf/LJ8PauMRwsM/g==}
+
+  jest-environment-jsdom@29.7.0:
+    resolution: {integrity: sha512-k9iQbsf9OyOfdzWH8HDmrRT0gSIcX+FLNW7IQq94tFX0gynPwqDTW0Ho6iMVNjGz/nb+l/vW3dWM2bbLLpkbXA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    peerDependencies:
+      canvas: ^2.5.0
+    peerDependenciesMeta:
+      canvas:
+        optional: true
+
+  jest-message-util@29.7.0:
+    resolution: {integrity: sha512-GBEV4GRADeP+qtB2+6u61stea8mGcOT4mCtrYISZwfu9/ISHFJ/5zOMXYbpBE9RsS5+Gb63DW4FgmnKJ79Kf6w==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-mock@29.7.0:
+    resolution: {integrity: sha512-ITOMZn+UkYS4ZFh83xYAOzWStloNzJFO2s8DWrE4lhtGD+AorgnbkiKERe4wQVBydIGPx059g6riW5Btp6Llnw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  jest-util@29.7.0:
+    resolution: {integrity: sha512-z6EbKajIpqGKU56y5KBUgy1dt1ihhQJgWzUlZHArA/+X2ad7Cb5iF+AK1EWVL/Bo7Rz9uurpqw6SiBCefUbCGA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
   jiti@1.21.7:
     resolution: {integrity: sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==}
     hasBin: true
 
-  jiti@2.6.1:
-    resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==}
+  jiti@2.7.0:
+    resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
     hasBin: true
 
   jquery@4.0.0:
@@ -2892,10 +3411,22 @@ packages:
     resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
     hasBin: true
 
+  jsbn@0.1.1:
+    resolution: {integrity: sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg==}
+
   jsdoc-type-pratt-parser@7.2.0:
     resolution: {integrity: sha512-dh140MMgjyg3JhJZY/+iEzW+NO5xR2gpbDFKHqotCmexElVntw7GjWjt511+C/Ef02RU5TKYrJo/Xlzk+OLaTw==}
     engines: {node: '>=20.0.0'}
 
+  jsdom@20.0.3:
+    resolution: {integrity: sha512-SYhBvTh89tTfCD/CRdSOm13mOBa42iTaTyfyEWBdKcGdPxPtLFBXuHR8XHb33YNYaP+lLbmSvBTsnoesCNJEsQ==}
+    engines: {node: '>=14'}
+    peerDependencies:
+      canvas: ^2.5.0
+    peerDependenciesMeta:
+      canvas:
+        optional: true
+
   jsesc@3.1.0:
     resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
     engines: {node: '>=6'}
@@ -2913,9 +3444,15 @@ packages:
   json-schema-traverse@1.0.0:
     resolution: {integrity: sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==}
 
+  json-schema@0.4.0:
+    resolution: {integrity: sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA==}
+
   json-stable-stringify-without-jsonify@1.0.1:
     resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
 
+  json-stringify-safe@5.0.1:
+    resolution: {integrity: sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==}
+
   json5@1.0.2:
     resolution: {integrity: sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==}
     hasBin: true
@@ -2923,10 +3460,17 @@ packages:
   jsonc-parser@3.3.1:
     resolution: {integrity: sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==}
 
+  jsonfile@2.4.0:
+    resolution: {integrity: sha512-PKllAqbgLgxHaj8TElYymKCAgrASebJrWpTnEkOaTowt23VKXXN0sUeriJ+eh7y6ufb/CC5ap11pz71/cM0hUw==}
+
   jsonpointer@5.0.1:
     resolution: {integrity: sha512-p/nXbhSEcu3pZRdkW1OfJhpsVtW1gd4Wa1fnQc9YLiTfAjn0312eMKimbdIQzuZl9aa9xUGaRlP9T/CJE/ditQ==}
     engines: {node: '>=0.10.0'}
 
+  jsprim@1.4.2:
+    resolution: {integrity: sha512-P2bSOMAc/ciLz6DzgjVlGJP9+BrJWu5UDGK70C2iweC5QBIeFf0ZXRvGjEj2uYgrY2MkAAhsSWHDWlFtEroZWw==}
+    engines: {node: '>=0.6.0'}
+
   jsx-ast-utils-x@0.1.0:
     resolution: {integrity: sha512-eQQBjBnsVtGacsG9uJNB8qOr3yA8rga4wAaGG1qRcBzSIvfhERLrWxMAM1hp5fcS6Abo8M4+bUBTekYR0qTPQw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -2935,8 +3479,15 @@ packages:
     resolution: {integrity: sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==}
     engines: {node: '>=4.0'}
 
-  katex@0.16.45:
-    resolution: {integrity: sha512-pQpZbdBu7wCTmQUh7ufPmLr0pFoObnGUoL/yhtwJDgmmQpbkg/0HSVti25Fu4rmd1oCR6NGWe9vqTWuWv3GcNA==}
+  kaiser@0.0.4:
+    resolution: {integrity: sha512-m8ju+rmBqvclZmyrOXgGGhOYSjKJK6RN1NhqEltemY87UqZOxEkizg9TOy1vQSyJ01Wx6SAPuuN0iO2Mgislvw==}
+
+  katex@0.16.47:
+    resolution: {integrity: sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==}
+    hasBin: true
+
+  katex@0.17.0:
+    resolution: {integrity: sha512-Vdw0ATsQ9V+LuegM/BTwQqV/6cTl5lbGcIrU+BCgLxyf6bo38ybOr372tuSIxir3CN720flu1meYR6XzNMwQnw==}
     hasBin: true
 
   keyv@4.5.4:
@@ -2956,9 +3507,8 @@ packages:
     resolution: {integrity: sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==}
     engines: {node: '>=0.10.0'}
 
-  langium@4.2.2:
-    resolution: {integrity: sha512-JUshTRAfHI4/MF9dH2WupvjSXyn8JBuUEWazB8ZVJUtXutT0doDlAv1XKbZ1Pb5sMexa8FF4CFBc0iiul7gbUQ==}
-    engines: {node: '>=20.10.0', npm: '>=10.2.3'}
+  klaw@1.3.1:
+    resolution: {integrity: sha512-TED5xi9gGQjGpNnvRWknrwAB1eL5GciPfVFOt3Vk1OJCVDQbzuSfrF3hkUQKlsgKrG1F+0t5W0m+Fje1jIt8rw==}
 
   language-subtag-registry@0.3.23:
     resolution: {integrity: sha512-0K65Lea881pHotoGEa5gDlMxt3pctLi2RplBb7Ezh4rRdLEOtgi7n4EwK9lamnUCkKBqaeKRVebTq6BAxSkpXQ==}
@@ -3061,8 +3611,8 @@ packages:
   lines-and-columns@1.2.4:
     resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
 
-  linkify-it@5.0.0:
-    resolution: {integrity: sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ==}
+  linkify-it@5.0.1:
+    resolution: {integrity: sha512-wVoTjP4Q6R0NW5hiZkVJaFZPWgtXfoGF+6LucL3/FtiNjmcHhYjEr5f1Kqjirc1nBW07J/ZuRFumqr2oqccEWg==}
 
   locate-path@6.0.0:
     resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
@@ -3089,6 +3639,9 @@ packages:
   lodash.upperfirst@4.3.1:
     resolution: {integrity: sha512-sReKOYJIJf74dhJONhU4e0/shzi1trVbSWDOhKYE5XV2O+H7Sb2Dihwuc7xWxVl+DgFPyTqIN3zMfT9cq5iWDg==}
 
+  lodash@3.10.1:
+    resolution: {integrity: sha512-9mDDwqVIma6OZX79ZlDACZl8sBm0TEnkf99zV3iMA4GzkIT/9hiqP5mY0HoT1iNLCrKc/R1HByV+yJfRWVJryQ==}
+
   lodash@4.18.1:
     resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==}
 
@@ -3118,10 +3671,14 @@ packages:
     engines: {node: '>= 12'}
     hasBin: true
 
-  material-icon-theme@5.33.1:
-    resolution: {integrity: sha512-imiILyUW/Y6YvxbobfReC4PpzjPfpMTUiiH9gN5sloQ3dJAhfJRE40l2q8pMT8+V4xRHiIZ5vaZtJw4D03qduQ==}
+  material-icon-theme@5.35.0:
+    resolution: {integrity: sha512-ptU3rjmZjPCeLRog0HcJ1HtnoVgOslc350WHk1oIvX7fVFE4NBAF7GL3QvCCEjtd1TSSDoxmS4dWsv6bTB1x9g==}
     engines: {vscode: ^1.55.0}
 
+  math-intrinsics@1.1.0:
+    resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
+    engines: {node: '>= 0.4'}
+
   mathml-tag-names@4.0.0:
     resolution: {integrity: sha512-aa6AU2Pcx0VP/XWnh8IGL0SYSgQHDT6Ucror2j2mXeFAlN3ahaNs8EZtG1YiticMkSLj3Gt6VPFfZogt7G5iFQ==}
 
@@ -3142,8 +3699,8 @@ packages:
     resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
     engines: {node: '>= 8'}
 
-  mermaid@11.14.0:
-    resolution: {integrity: sha512-GSGloRsBs+JINmmhl0JDwjpuezCsHB4WGI4NASHxL3fHo3o/BRXTxhDLKnln8/Q0lRFRyDdEjmk1/d5Sn1Xz8g==}
+  mermaid@11.15.0:
+    resolution: {integrity: sha512-pTMbcf3rWdtLiYGpmoTjHEpeY8seiy6sR+9nD7LOs8KfUbHE4lOUAprTRqRAcWSQ6MQpdX+YEsxShtGsINtPtw==}
 
   micromark-core-commonmark@2.0.3:
     resolution: {integrity: sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg==}
@@ -3224,6 +3781,14 @@ packages:
     resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
     engines: {node: '>=8.6'}
 
+  mime-db@1.52.0:
+    resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
+    engines: {node: '>= 0.6'}
+
+  mime-types@2.1.35:
+    resolution: {integrity: sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==}
+    engines: {node: '>= 0.6'}
+
   minimatch@10.2.5:
     resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
     engines: {node: 18 || 20 || >=22}
@@ -3234,9 +3799,6 @@ packages:
   minimist@1.2.8:
     resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
 
-  mlly@1.8.2:
-    resolution: {integrity: sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA==}
-
   moo@0.5.3:
     resolution: {integrity: sha512-m2fmM2dDm7GZQsY7KK2cme8agi+AAljILjQnof7p1ZMDe6dQ4bdnSMx0cPppudoeNv5hEFQirN6u+O4fDE0IWA==}
 
@@ -3246,11 +3808,14 @@ packages:
   muggle-string@0.4.1:
     resolution: {integrity: sha512-VNTrAak/KhO2i8dqqnqnAHOa3cYBwXEZe9h+D5h/1ZqFSTEFHdM65lR7RoIqq3tBBYavsOXV84NoHXZ0AkPyqQ==}
 
+  mute-stream@0.0.5:
+    resolution: {integrity: sha512-EbrziT4s8cWPmzr47eYVW3wimS4HsvlnV5ri1xw1aR6JQo/OrJX5rkl32K/QQHdxeabJETtfeaROGhd8W7uBgg==}
+
   mz@2.7.0:
     resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
 
-  nanoid@3.3.11:
-    resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==}
+  nanoid@3.3.12:
+    resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -3287,13 +3852,9 @@ packages:
       encoding:
         optional: true
 
-  node-releases@2.0.37:
-    resolution: {integrity: sha512-1h5gKZCF+pO/o3Iqt5Jp7wc9rH3eJJ0+nh/CIoiRwjRxde/hAHyLPXYN4V3CqKAbiZPSeJFSWHmJsbkicta0Eg==}
-
-  nolyfill@1.0.44:
-    resolution: {integrity: sha512-PoggwVLiJUn0MnodpftsiC7EuknW5+6v62ntTOQ6T6l7g2r6aoaOwgk0tQW2BxGLYw9bF298LL8jDFTmEFuzlA==}
-    engines: {node: '>=12.4.0'}
-    hasBin: true
+  node-releases@2.0.46:
+    resolution: {integrity: sha512-GYVXHE2KnrzAfsAjl4uP++evGFCrAU1jta4ubEjIG7YWt/64Gqv66a30yKwWczVjA6j3bM4nBwH7Pk1JmDHaxQ==}
+    engines: {node: '>=18'}
 
   normalize-path@3.0.0:
     resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
@@ -3302,6 +3863,16 @@ packages:
   nth-check@2.1.1:
     resolution: {integrity: sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==}
 
+  number-is-nan@1.0.1:
+    resolution: {integrity: sha512-4jbtZXNAsfZbAHiiqjLPBiCl16dES1zI4Hpzzxw61Tk+loF+sBDBKx1ICKKKwIqQ7M0mFn1TmkN7euSncWgHiQ==}
+    engines: {node: '>=0.10.0'}
+
+  nwsapi@2.2.23:
+    resolution: {integrity: sha512-7wfH4sLbt4M0gCDzGE6vzQBo0bfTKjU7Sfpqy/7gs1qBfYz2vEJH6vXcBKpO3+6Yu1telwd0t9HpyOoLEQQbIQ==}
+
+  oauth-sign@0.9.0:
+    resolution: {integrity: sha512-fexhUFFPTGV8ybAtSIGbV6gOkSv8UtRbDBnAyLQw4QPKkgNlsH2ByPGtMUqdWkos6YCRmAqViwgZrJc/mRDzZQ==}
+
   object-assign@4.1.1:
     resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
     engines: {node: '>=0.10.0'}
@@ -3310,9 +3881,44 @@ packages:
     resolution: {integrity: sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==}
     engines: {node: '>= 6'}
 
+  object-inspect@1.13.4:
+    resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
+    engines: {node: '>= 0.4'}
+
+  object-keys@1.1.1:
+    resolution: {integrity: sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==}
+    engines: {node: '>= 0.4'}
+
+  object.assign@4.1.7:
+    resolution: {integrity: sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw==}
+    engines: {node: '>= 0.4'}
+
+  object.entries@1.1.9:
+    resolution: {integrity: sha512-8u/hfXFRBD1O0hPUjioLhoWFHRmt6tKA4/vZPyckBr18l1KE9uHrFaFaUi8MDRTpi4uak2goyPTSNJLXX2k2Hw==}
+    engines: {node: '>= 0.4'}
+
+  object.fromentries@2.0.8:
+    resolution: {integrity: sha512-k6E21FzySsSK5a21KRADBd/NGneRegFO5pLHfdQLpRDETUNJueLXs3WCzyQ3tFRDYgbq3KHGXfTbi2bs8WQ6rQ==}
+    engines: {node: '>= 0.4'}
+
+  object.groupby@1.0.3:
+    resolution: {integrity: sha512-+Lhy3TQTuzXI5hevh8sBGqbmurHbbIjAi0Z4S63nthVLmLxfbj4T54a4CfZrXIrt9iP4mVAPYMo/v99taj3wjQ==}
+    engines: {node: '>= 0.4'}
+
+  object.values@1.2.1:
+    resolution: {integrity: sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA==}
+    engines: {node: '>= 0.4'}
+
   obug@2.1.1:
     resolution: {integrity: sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==}
 
+  once@1.4.0:
+    resolution: {integrity: sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==}
+
+  onetime@1.1.0:
+    resolution: {integrity: sha512-GZ+g4jayMqzCRMgB2sol7GiCLjKfS1PINkjmx8spcKce1LiVqcbQreXwqs2YAFXC6R03VIG28ZS31t8M866v6A==}
+    engines: {node: '>=0.10.0'}
+
   online-3d-viewer@0.18.0:
     resolution: {integrity: sha512-y7ZlV/zkakNUyjqcXz6XecA7vXgLEUnaAey9tyx8o6/wcdV64RfjXAQOjGXGY2JOZoDi4Cg1ic9icSWMWAvRQA==}
 
@@ -3320,6 +3926,14 @@ packages:
     resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
     engines: {node: '>= 0.8.0'}
 
+  os-homedir@1.0.2:
+    resolution: {integrity: sha512-B5JU3cabzk8c67mRRd3ECmROafjYMXbuzlwtqdM8IbS8ktlTix8aFGb2bAGKrSRIlnfKwovGUUr72JUPyOb6kQ==}
+    engines: {node: '>=0.10.0'}
+
+  own-keys@1.0.1:
+    resolution: {integrity: sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==}
+    engines: {node: '>= 0.4'}
+
   p-limit@3.1.0:
     resolution: {integrity: sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==}
     engines: {node: '>=10'}
@@ -3342,6 +3956,9 @@ packages:
     resolution: {integrity: sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==}
     engines: {node: '>=8'}
 
+  parse5@7.3.0:
+    resolution: {integrity: sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==}
+
   path-browserify@1.0.1:
     resolution: {integrity: sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g==}
 
@@ -3352,6 +3969,10 @@ packages:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
 
+  path-is-absolute@1.0.1:
+    resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
+    engines: {node: '>=0.10.0'}
+
   path-key@3.1.1:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
@@ -3368,6 +3989,9 @@ packages:
   perfect-debounce@2.1.0:
     resolution: {integrity: sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g==}
 
+  performance-now@2.1.0:
+    resolution: {integrity: sha512-7EAHlyLHI56VEIdK57uwHdHKIaAGbnXPiw0yWbarQZOKaKpvUIgW0jWRVLiatnM+XXlSwsanIBH/hzGMJulMow==}
+
   picocolors@1.1.1:
     resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
 
@@ -3387,16 +4011,13 @@ packages:
     resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
     engines: {node: '>= 6'}
 
-  pkg-types@1.3.1:
-    resolution: {integrity: sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==}
-
-  playwright-core@1.59.1:
-    resolution: {integrity: sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg==}
+  playwright-core@1.60.0:
+    resolution: {integrity: sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA==}
     engines: {node: '>=18'}
     hasBin: true
 
-  playwright@1.59.1:
-    resolution: {integrity: sha512-C8oWjPR3F81yljW9o5OxcWzfh6avkVwDD2VYdwIGqTkl+OGFISgypqzfu7dOe4QNLL2aqcWBmI3PMtLIK233lw==}
+  playwright@1.60.0:
+    resolution: {integrity: sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA==}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -3410,6 +4031,10 @@ packages:
   points-on-path@0.2.1:
     resolution: {integrity: sha512-25ClnWWuw7JbWZcgqY/gJ4FQWadKxGWk+3kR/7kD0tCaDtPPMj7oHu2ToLaVhfpnHrZzYby2w6tUA0eOIuUg8g==}
 
+  possible-typed-array-names@1.1.0:
+    resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
+    engines: {node: '>= 0.4'}
+
   postcss-html@1.8.1:
     resolution: {integrity: sha512-OLF6P7qctfAWayOhLpcVnTGqVeJzu2W3WpIYelfz2+JV5oGxfkcEvweN9U4XpeqE0P98dcD9ssusGwlF0TK0uQ==}
     engines: {node: ^12 || >=14}
@@ -3473,8 +4098,8 @@ packages:
   postcss-value-parser@4.2.0:
     resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
 
-  postcss@8.5.10:
-    resolution: {integrity: sha512-pMMHxBOZKFU6HgAZ4eyGnwXF/EvPGGqUr0MnZ5+99485wwW41kW91A4LOGxSHhgugZmSChL5AlElNdwlNgcnLQ==}
+  postcss@8.5.15:
+    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
     engines: {node: ^10 || ^12 || >=14}
 
   prelude-ls@1.2.1:
@@ -3490,6 +4115,13 @@ packages:
     engines: {node: '>=14'}
     hasBin: true
 
+  pretty-format@29.7.0:
+    resolution: {integrity: sha512-Pdlw/oPxN+aXdmM9R00JVC9WVFoCLTKJvDVLgmJ+qAffBMxsV85l/Lu7sNx4zSzPyoL2euImuEwHhOXdEgNFZQ==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+
+  psl@1.15.0:
+    resolution: {integrity: sha512-JZd3gMVBAVQkSs6HdNZo9Sdo0LNcQeMNP3CozBJb3JYC/QUYZTnKxP+f8oWRX4rHP5EurWxqAHTSwUCjlNKa1w==}
+
   punycode.js@2.3.1:
     resolution: {integrity: sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA==}
     engines: {node: '>=6'}
@@ -3498,13 +4130,23 @@ packages:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
-  qified@0.9.1:
-    resolution: {integrity: sha512-n7mar4T0xQ+39dE2vGTAlbxUEpndwPANH0kDef1/MYsB8Bba9wshkybIRx74qgcvKQPEWErf9AqAdYjhzY2Ilg==}
+  qified@0.10.1:
+    resolution: {integrity: sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA==}
     engines: {node: '>=20'}
 
+  qs@6.5.5:
+    resolution: {integrity: sha512-mzR4sElr1bfCaPJe7m8ilJ6ZXdDaGoObcYR0ZHSsktM/Lt21MVHj5De30GQH2eiZ1qGRTO7LCAzQsUeXTNexWQ==}
+    engines: {node: '>=0.6'}
+
+  querystringify@2.2.0:
+    resolution: {integrity: sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==}
+
   queue-microtask@1.2.3:
     resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
 
+  react-is@18.3.1:
+    resolution: {integrity: sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==}
+
   read-cache@1.0.0:
     resolution: {integrity: sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==}
 
@@ -3512,10 +4154,20 @@ packages:
     resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
     engines: {node: '>=8.10.0'}
 
+  readline2@1.0.1:
+    resolution: {integrity: sha512-8/td4MmwUB6PkZUbV25uKz7dfrmjYWxsW8DVfibWdlHRk/l/DfHKn4pU+dfcoGLFgWOdyGCzINRQD7jn+Bv+/g==}
+
   refa@0.12.1:
     resolution: {integrity: sha512-J8rn6v4DBb2nnFqkqwy6/NnTYMcgLA+sLr0iIO41qpv0n+ngb7ksag2tMRl0inb1bbO/esUwzW1vbJi7K0sI0g==}
     engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
 
+  reflect.getprototypeof@1.0.10:
+    resolution: {integrity: sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==}
+    engines: {node: '>= 0.4'}
+
+  regenerator-runtime@0.9.6:
+    resolution: {integrity: sha512-D0Y/JJ4VhusyMOd/o25a3jdUqN/bC85EFsaoL9Oqmy/O4efCh+xhp7yj2EEOsj974qvMkcW8AwUzJ1jB/MbxCw==}
+
   regexp-ast-analysis@0.7.1:
     resolution: {integrity: sha512-sZuz1dYW/ZsfG17WSAG7eS85r5a0dDsvg+7BiiYR5o6lKCAtUrEwdmRmaGF6rwVj3LcmAeYkOWKEPlbPzN3Y3A==}
     engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
@@ -3524,6 +4176,10 @@ packages:
     resolution: {integrity: sha512-iETxpjK6YoRWJG5o6hXLwvjYAoW+FEZn9os0PD/b6AP6xQwsa/Y7lCVgIixBbUPMfhu+i2LtdeAqVTgGlQarfA==}
     hasBin: true
 
+  regexp.prototype.flags@1.5.4:
+    resolution: {integrity: sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==}
+    engines: {node: '>= 0.4'}
+
   regjsparser@0.13.1:
     resolution: {integrity: sha512-dLsljMd9sqwRkby8zhO1gSg3PnJIBFid8f4CQj/sXx+7cKx+E7u0PKhZ+U4wmhx7EfmtvnA318oVaIkAB1lRJw==}
     hasBin: true
@@ -3532,10 +4188,23 @@ packages:
     resolution: {integrity: sha512-U7XpAktpbSgHTRSNRrjKSrjYkZKuhUukfoBlXWXUExCAqhzh1TU3BDRAfJmarcl5voKS+pbKU9MvyLWKZ4UEEg==}
     engines: {node: '>= 0.8.0'}
 
+  request-promise@3.0.0:
+    resolution: {integrity: sha512-wVGUX+BoKxYsavTA72i6qHcyLbjzM4LR4y/AmDCqlbuMAursZdDWO7PmgbGAUvD2SeEJ5iB99VSq/U51i/DNbw==}
+    engines: {node: '>=0.10.0'}
+    deprecated: request-promise has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
+
+  request@2.88.2:
+    resolution: {integrity: sha512-MsvtOrfG9ZcrOwAW+Qi+F6HbD0CWXEh9ou77uOb7FM2WPhwT7smM833PzanhJLsgXjN89Ir6V2PczXNnMpwKhw==}
+    engines: {node: '>= 6'}
+    deprecated: request has been deprecated, see https://github.com/request/request/issues/3142
+
   require-from-string@2.0.2:
     resolution: {integrity: sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==}
     engines: {node: '>=0.10.0'}
 
+  requires-port@1.0.0:
+    resolution: {integrity: sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==}
+
   resolve-from@4.0.0:
     resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
     engines: {node: '>=4'}
@@ -3548,31 +4217,43 @@ packages:
     engines: {node: '>= 0.4'}
     hasBin: true
 
-  resolve@2.0.0-next.6:
-    resolution: {integrity: sha512-3JmVl5hMGtJ3kMmB3zi3DL25KfkCEyy3Tw7Gmw7z5w8M9WlwoPFnIvwChzu1+cF3iaK3sp18hhPz8ANeimdJfA==}
+  resolve@2.0.0-next.7:
+    resolution: {integrity: sha512-tqt+NBWwyaMgw3zDsnygx4CByWjQEJHOPMdslYhppaQSJUtL/D4JO9CcBBlhPoI8lz9oJIDXkwXfhF4aWqP8xQ==}
     engines: {node: '>= 0.4'}
     hasBin: true
 
+  restore-cursor@1.0.1:
+    resolution: {integrity: sha512-reSjH4HuiFlxlaBaFCiS6O76ZGG2ygKoSlCsipKdaZuKSPx/+bt9mULkn4l0asVzbEfQQmXRg6Wp6gv6m0wElw==}
+    engines: {node: '>=0.10.0'}
+
   reusify@1.1.0:
     resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
 
+  rimraf@2.7.1:
+    resolution: {integrity: sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==}
+    deprecated: Rimraf versions prior to v4 are no longer supported
+    hasBin: true
+
   robust-predicates@3.0.3:
     resolution: {integrity: sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA==}
 
-  rolldown-license-plugin@3.0.1:
-    resolution: {integrity: sha512-0aBIHnHN2xiEXSmTMHFLWYCm3WBExqSbq0y9nr9LKg0JBI8wBy7Y+Nm4oL5JJHgcI4JeRniERVatHqUg2QtMzQ==}
+  rolldown-license-plugin@3.0.8:
+    resolution: {integrity: sha512-q4nvGtimBIxValBXzkri+0jP2Sdf6PLztYykn7vCu0nVkJEzGsVRfcH/1X6qm0S8//4/gFt/XxwJqpaM6uSdJA==}
     peerDependencies:
       rolldown: '*'
 
-  rolldown@1.0.0-rc.16:
-    resolution: {integrity: sha512-rzi5WqKzEZw3SooTt7cgm4eqIoujPIyGcJNGFL7iPEuajQw7vxMHUkXylu4/vhCkJGXsgRmxqMKXUpT6FEgl0g==}
+  rolldown@1.0.2:
+    resolution: {integrity: sha512-oZx5zVDtVB44AW3eaifgDml1gWRDZGvjcfdxonE4swNPG98PrrXjaO/KrnUjzlMnztCCRVlUueA1kCXhARGk6g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
 
   roughjs@4.6.6:
     resolution: {integrity: sha512-ZUz/69+SYpFN/g/lUlo2FXcIjRkSu3nDarreVdGGndHEBJ6cXPdKguS8JGxwj5HA5xIbVKSmLgr5b3AWxtRfvQ==}
 
+  run-async@0.1.0:
+    resolution: {integrity: sha512-qOX+w+IxFgpUpJfkv2oGN0+ExPs68F4sZHfaRRx4dDexAQkG83atugKVEylyT5ARees3HBbfmuvnjbrd8j9Wjw==}
+
   run-con@1.3.2:
     resolution: {integrity: sha512-CcfE+mYiTcKEzg0IqS08+efdnH0oJ3zV0wSUFBNrMHMuxCtXvBCLzCJHatwuXDcu/RlhjTziTo/a1ruQik6/Yg==}
     hasBin: true
@@ -3583,10 +4264,35 @@ packages:
   rw@1.3.3:
     resolution: {integrity: sha512-PdhdWy89SiZogBLaw42zdeqtRJ//zFd2PgQavcICDUgJT5oW10QCRKbJ6bg4r0/UY2M6BWd5tkxuGFRvCkgfHQ==}
 
+  rx-lite@3.1.2:
+    resolution: {integrity: sha512-1I1+G2gteLB8Tkt8YI1sJvSIfa0lWuRtC8GjvtyPBcLSF5jBCCJJqKrpER5JU5r6Bhe+i9/pK3VMuUcXu0kdwQ==}
+
+  safe-array-concat@1.1.4:
+    resolution: {integrity: sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg==}
+    engines: {node: '>=0.4'}
+
+  safe-buffer@5.2.1:
+    resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
+
+  safe-push-apply@1.0.0:
+    resolution: {integrity: sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA==}
+    engines: {node: '>= 0.4'}
+
+  safe-regex-test@1.1.0:
+    resolution: {integrity: sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==}
+    engines: {node: '>= 0.4'}
+
+  safer-buffer@2.1.2:
+    resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
+
   sax@1.6.0:
     resolution: {integrity: sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA==}
     engines: {node: '>=11.0.0'}
 
+  saxes@6.0.0:
+    resolution: {integrity: sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==}
+    engines: {node: '>=v12.22.7'}
+
   scslre@0.3.0:
     resolution: {integrity: sha512-3A6sD0WYP7+QrjbfNA2FN3FsOaGGFoekCVgTyypy53gPxhbkCIjtO6YWgdrfM+n/8sI8JeXZOIxsHjMTNxQ4nQ==}
     engines: {node: ^14.0.0 || >=16.0.0}
@@ -3595,21 +4301,33 @@ packages:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
 
-  semver@7.7.4:
-    resolution: {integrity: sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==}
+  semver@7.8.1:
+    resolution: {integrity: sha512-rkVq3IXh+4FDGch+KwzX3aV9W3kO54GyEgpvBzSyctDA6Xtd7RJQV1xmXbeQp5v7+VzLOfVqiutSE6GICgPFvg==}
     engines: {node: '>=10'}
     hasBin: true
 
-  seroval-plugins@1.5.2:
-    resolution: {integrity: sha512-qpY0Cl+fKYFn4GOf3cMiq6l72CpuVaawb6ILjubOQ+diJ54LfOWaSSPsaswN8DRPIPW4Yq+tE1k5aKd7ILyaFg==}
+  seroval-plugins@1.5.4:
+    resolution: {integrity: sha512-S0xQPhUTefAhNvNWFg0c1J8qJArHt5KdtJ/cFAofo06KD1MVSeFWyl4iiu+ApDIuw0WhjpOfCdgConOfAnLgkw==}
     engines: {node: '>=10'}
     peerDependencies:
       seroval: ^1.0
 
-  seroval@1.5.2:
-    resolution: {integrity: sha512-xcRN39BdsnO9Tf+VzsE7b3JyTJASItIV1FVFewJKCFcW4s4haIKS3e6vj8PGB9qBwC7tnuOywQMdv5N4qkzi7Q==}
+  seroval@1.5.4:
+    resolution: {integrity: sha512-46uFvgrXTVxZcUorgSSRZ4y+ieqLLQRMlG4bnCZKW3qI6BZm7Rg4ntMW4p1mILEEBZWrFlcpp0AyIIlM6jD9iw==}
     engines: {node: '>=10'}
 
+  set-function-length@1.2.2:
+    resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
+    engines: {node: '>= 0.4'}
+
+  set-function-name@2.0.2:
+    resolution: {integrity: sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ==}
+    engines: {node: '>= 0.4'}
+
+  set-proto@1.0.0:
+    resolution: {integrity: sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==}
+    engines: {node: '>= 0.4'}
+
   shebang-command@2.0.0:
     resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
     engines: {node: '>=8'}
@@ -3618,6 +4336,22 @@ packages:
     resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
     engines: {node: '>=8'}
 
+  side-channel-list@1.0.1:
+    resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-map@1.0.1:
+    resolution: {integrity: sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-weakmap@1.0.2:
+    resolution: {integrity: sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==}
+    engines: {node: '>= 0.4'}
+
+  side-channel@1.1.0:
+    resolution: {integrity: sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==}
+    engines: {node: '>= 0.4'}
+
   siginfo@2.0.0:
     resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
 
@@ -3625,6 +4359,10 @@ packages:
     resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
     engines: {node: '>=14'}
 
+  slash@3.0.0:
+    resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==}
+    engines: {node: '>=8'}
+
   slash@5.1.0:
     resolution: {integrity: sha512-ZA6oR3T/pEyuqwMgAKT0/hAv8oAXckzbkmR0UkUosQ+Mc4RxGoJkRmwHgHufaenlyAgE1Mxgpdcrf75y6XcnDg==}
     engines: {node: '>=14.16'}
@@ -3637,8 +4375,8 @@ packages:
     resolution: {integrity: sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg==}
     engines: {node: '>= 18'}
 
-  solid-js@1.9.12:
-    resolution: {integrity: sha512-QzKaSJq2/iDrWR1As6MHZQ8fQkdOBf8GReYb7L5iKwMGceg7HxDcaOHk0at66tNgn9U2U7dXo8ZZpLIAmGMzgw==}
+  solid-js@1.9.13:
+    resolution: {integrity: sha512-6hJeJMOcEX8ktqjpDoJZEmld3ijvcvWBDtiXBm7f4332SiFN66QeAQI1REQshvyUoISsSeJ4PHDauKYbwao9JQ==}
 
   solid-transition-group@0.2.3:
     resolution: {integrity: sha512-iB72c9N5Kz9ykRqIXl0lQohOau4t0dhel9kjwFvx81UZJbVwaChMuBuyhiZmK24b8aKEK0w3uFM96ZxzcyZGdg==}
@@ -3653,21 +4391,42 @@ packages:
     resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
     engines: {node: '>=0.10.0'}
 
-  spectral-cli-bundle@1.0.7:
-    resolution: {integrity: sha512-vIUC0nwv9tYxWV1xHdR3CTVDOEEtLKaDCcQpARZgO0Db7VmSpSWJ4xrnVPNSmO59hBtGwW2CVzHf0OimJBaKAA==}
+  source-map@0.6.1:
+    resolution: {integrity: sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==}
+    engines: {node: '>=0.10.0'}
+
+  spectral-cli-bundle@1.0.8:
+    resolution: {integrity: sha512-wxHPXFy5bdtqT/flJRjWbSdPoDjIiXzmLvxE7RO9bbs/B2DuavW2UIG8HYa7m7F6RlQaK7rhoiIRoYEEeBP5Jg==}
     engines: {node: '>=20'}
     hasBin: true
 
+  sshpk@1.18.0:
+    resolution: {integrity: sha512-2p2KJZTSqQ/I3+HX42EpYOa2l3f8Erv8MWKsy2I9uf4wA7yFIkXRffYdsx86y6z4vHtV8u7g+pPlr8/4ouAxsQ==}
+    engines: {node: '>=0.10.0'}
+    hasBin: true
+
   stable-hash-x@0.2.0:
     resolution: {integrity: sha512-o3yWv49B/o4QZk5ZcsALc6t0+eCelPc44zZsLtCQnZPDwFpDYSWcDnrv2TtMmMbQ7uKo3J0HTURCqckw23czNQ==}
     engines: {node: '>=12.0.0'}
 
+  stack-utils@2.0.6:
+    resolution: {integrity: sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==}
+    engines: {node: '>=10'}
+
   stackback@0.0.2:
     resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
 
   std-env@4.1.0:
     resolution: {integrity: sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==}
 
+  stop-iteration-iterator@1.1.0:
+    resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
+    engines: {node: '>= 0.4'}
+
+  string-width@1.0.2:
+    resolution: {integrity: sha512-0XsVpQLnVCXHJfyEs8tC0zpTVIr5PKKsQtkT29IwupnPTjtPmQ3xT/4yCREF9hYkV/3M3kzcUTSAZT6a6h81tw==}
+    engines: {node: '>=0.10.0'}
+
   string-width@4.2.3:
     resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
     engines: {node: '>=8'}
@@ -3676,10 +4435,30 @@ packages:
     resolution: {integrity: sha512-Kxl3KJGb/gxkaUMOjRsQ8IrXiGW75O4E3RPjFIINOVH8AMl2SQ/yWdTzWwF3FevIX9LcMAjJW+GRwAlAbTSXdg==}
     engines: {node: '>=20'}
 
-  string-width@8.2.0:
-    resolution: {integrity: sha512-6hJPQ8N0V0P3SNmP6h2J99RLuzrWz2gvT7VnK5tKvrNqJoyS9W4/Fb8mo31UiPvy00z7DQXkP2hnKBVav76thw==}
+  string-width@8.2.1:
+    resolution: {integrity: sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==}
     engines: {node: '>=20'}
 
+  string.prototype.includes@2.0.1:
+    resolution: {integrity: sha512-o7+c9bW6zpAdJHTtujeePODAhkuicdAryFsfVKwA+wGw89wJ4GTY484WTucM9hLtDEOpOvI+aHnzqnC5lHp4Rg==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.trim@1.2.10:
+    resolution: {integrity: sha512-Rs66F0P/1kedk5lyYyH9uBzuiI/kNRmwJAR9quK6VOtIpZ2G+hMZd+HQbbv25MgCA6gEffoMZYxlTod4WcdrKA==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.trimend@1.0.9:
+    resolution: {integrity: sha512-G7Ok5C6E/j4SGfyLCloXTrngQIQU3PWtXGst3yM7Bea9FRURf1S42ZHlZZtsNque2FN2PoUhfZXYLNWwEr4dLQ==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.trimstart@1.0.8:
+    resolution: {integrity: sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg==}
+    engines: {node: '>= 0.4'}
+
+  strip-ansi@3.0.1:
+    resolution: {integrity: sha512-VhumSSbBqDTP8p2ZLKj40UjBCV4+v8bUSEpUb4KjRgWk9pbqGF4REFj6KEagidb2f/M6AzC0EmFyDNGaw9OCzg==}
+    engines: {node: '>=0.10.0'}
+
   strip-ansi@6.0.1:
     resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
     engines: {node: '>=8'}
@@ -3730,8 +4509,8 @@ packages:
     peerDependencies:
       stylelint: '>=16'
 
-  stylelint@17.8.0:
-    resolution: {integrity: sha512-oHkld9T60LDSaUQ4CSVc+tlt9eUoDlxhaGWShsUCKyIL14boZfmK5bSphZqx64aiC5tCqX+BsQMTMoSz8D1zIg==}
+  stylelint@17.12.0:
+    resolution: {integrity: sha512-KIlzWXMHUvgfPUR0R7TK3H80yCIi0uoivUwf+6Az4yrHJD1Q3c1qIkh/H5Z0i/K3QXgtq/UMEkWyBUSUwnpnOg==}
     engines: {node: '>=20.19.0'}
     hasBin: true
 
@@ -3747,6 +4526,14 @@ packages:
     resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==}
     engines: {node: '>=18'}
 
+  supports-color@2.0.0:
+    resolution: {integrity: sha512-KKNVtd6pCYgPIKU4cp2733HWYCpplQhddZLBUryaAHou723x+FRzQ5Df824Fj+IyyuiQTRoub4SnIFfIcrp70g==}
+    engines: {node: '>=0.8.0'}
+
+  supports-color@7.2.0:
+    resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
+    engines: {node: '>=8'}
+
   supports-hyperlinks@4.4.0:
     resolution: {integrity: sha512-UKbpT93hN5Nr9go5UY7bopIB9YQlMz9nm/ct4IXt/irb5YRkn9WaqrOBJGZ5Pwvsd5FQzSVeYlGdXoCAPQZrPg==}
     engines: {node: '>=20'}
@@ -3769,15 +4556,18 @@ packages:
   svgson@5.3.1:
     resolution: {integrity: sha512-qdPgvUNWb40gWktBJnbJRelWcPzkLed/ShhnRsjbayXz8OtdPOzbil9jtiZdrYvSDumAz/VNQr6JaNfPx/gvPA==}
 
-  swagger-ui-dist@5.32.4:
-    resolution: {integrity: sha512-0AADFFQNJzExEN49SrD/34Nn9cxNxVLiydYl2MBwSZFPVXNkVwC/EFAjoezGGqE8oDegiDC+p47t8lKObCinMQ==}
+  swagger-ui-dist@5.32.6:
+    resolution: {integrity: sha512-75ttZNaYCLoFPnozPZcTUU6mS3wKT8l7WLjU5zJSHFeJa23i5vtnze6IiCl4jDMPeQTXVXIgovq4M11NNfQvSA==}
+
+  symbol-tree@3.2.4:
+    resolution: {integrity: sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==}
 
   sync-fetch@0.4.5:
     resolution: {integrity: sha512-esiWJ7ixSKGpd9DJPBTC4ckChqdOjIwJfYhVHkcQ2Gnm41323p1TRmEI+esTQ9ppD+b5opps2OTEGTCGX5kF+g==}
     engines: {node: '>=14'}
 
-  synckit@0.11.12:
-    resolution: {integrity: sha512-Bh7QjT8/SuKUIfObSXNHNSK6WHo6J1tHCqJsuaFDP7gP0fkzSfTxI8y85JrppZ0h8l0maIgc2tfuZQ6/t3GtnQ==}
+  synckit@0.11.13:
+    resolution: {integrity: sha512-eNRKgb3z66Yp3D2CixVujOUvXLFUTij/zVnV8KRyvFdQwpz7I5DS8UfRkTeLzb64u+dkzDSdelE24izu+zSSUg==}
     engines: {node: ^14.18.0 || >=16.0.0}
 
   table@6.9.0:
@@ -3803,15 +4593,18 @@ packages:
     resolution: {integrity: sha512-B71/4oyj61iNH0KeCamLuE2rmKuTO5byTOSVwECM5FA7TiAiAW+UqTKZ9ERueC4qvgSttUhdmq1mXC3kJqGX7A==}
     engines: {node: '>=12.22'}
 
+  through@2.3.8:
+    resolution: {integrity: sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==}
+
   tinybench@2.9.0:
     resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
 
-  tinyexec@1.1.1:
-    resolution: {integrity: sha512-VKS/ZaQhhkKFMANmAOhhXVoIfBXblQxGX1myCQ2faQrfmobMftXeJPcZGp0gS07ocvGJWDLZGyOZDadDBqYIJg==}
+  tinyexec@1.2.4:
+    resolution: {integrity: sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==}
     engines: {node: '>=18'}
 
-  tinyglobby@0.2.16:
-    resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
     engines: {node: '>=12.0.0'}
 
   tinyrainbow@3.1.0:
@@ -3828,9 +4621,21 @@ packages:
   toastify-js@1.12.0:
     resolution: {integrity: sha512-HeMHCO9yLPvP9k0apGSdPUWrUbLnxUKNFzgUoZp1PHCLploIX/4DSQ7V8H25ef+h4iO9n0he7ImfcndnN6nDrQ==}
 
+  tough-cookie@2.5.0:
+    resolution: {integrity: sha512-nlLsUzgm1kfLXSXfRZMc1KLAugd4hqJHDTvc2hDIwS3mZAfMEuMbc03SujMF+GEcpaX/qboeycw6iO8JwVv2+g==}
+    engines: {node: '>=0.8'}
+
+  tough-cookie@4.1.4:
+    resolution: {integrity: sha512-Loo5UUvLD9ScZ6jh8beX1T6sO1w2/MpCRpEP7V280GKMVUQ0Jzar2U3UJPsrdbziLEMMhu3Ujnq//rhiFuIeag==}
+    engines: {node: '>=6'}
+
   tr46@0.0.3:
     resolution: {integrity: sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==}
 
+  tr46@3.0.0:
+    resolution: {integrity: sha512-l7FvfAHlcmulp8kr+flpQZmVwtu7nfRV7NZujtN0OqES8EL4O4e0qqzL0DC5gAvx/ZC/9lk6rhcUwYvkBnBnYA==}
+    engines: {node: '>=12'}
+
   tributejs@5.1.3:
     resolution: {integrity: sha512-B5CXihaVzXw+1UHhNFyAwUTMDk1EfoLP5Tj1VhD9yybZ1I8DZJEv8tZ1l0RJo0t0tk9ZhR8eG5tEsaCvRigmdQ==}
 
@@ -3853,12 +4658,38 @@ packages:
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
+  tunnel-agent@0.6.0:
+    resolution: {integrity: sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==}
+
+  tweetnacl@0.14.5:
+    resolution: {integrity: sha512-KXXFFdAbFXY4geFIwoyNK+f5Z1b7swfXABfL7HXCmoIWMKU3dmS26672A4EeQtDzLKy7SXmfBu51JolvEKwtGA==}
+
   type-check@0.4.0:
     resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
     engines: {node: '>= 0.8.0'}
 
-  typescript-eslint@8.59.0:
-    resolution: {integrity: sha512-BU3ONW9X+v90EcCH9ZS6LMackcVtxRLlI3XrYyqZIwVSHIk7Qf7bFw1z0M9Q0IUxhTMZCf8piY9hTYaNEIASrw==}
+  type-detect@4.0.8:
+    resolution: {integrity: sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==}
+    engines: {node: '>=4'}
+
+  typed-array-buffer@1.0.3:
+    resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-byte-length@1.0.3:
+    resolution: {integrity: sha512-BaXgOuIxz8n8pIq3e7Atg/7s+DpiYrxn4vdot3w9KbnBhcRQq6o3xemQdIfynqSeXeDrF32x+WvfzmOjPiY9lg==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-byte-offset@1.0.4:
+    resolution: {integrity: sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-length@1.0.8:
+    resolution: {integrity: sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==}
+    engines: {node: '>= 0.4'}
+
+  typescript-eslint@8.60.0:
+    resolution: {integrity: sha512-9f65qWLZdAW9m1JaxBDUHcqRUfL8bkxxXL7XxEfI+F09q56PkBvIfCjLF3yInsDM/BBmwkqmCQdCZe/RYlIWEw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
@@ -3874,27 +4705,36 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
-  typo-js@1.3.1:
-    resolution: {integrity: sha512-elJkpCL6Z77Ghw0Lv0lGnhBAjSTOQ5FhiVOCfOuxhaoTT2xtLVbqikYItK5HHchzPbHEUFAcjOH669T2ZzeCbg==}
+  typo-js@1.3.2:
+    resolution: {integrity: sha512-Z1YkJ7IIYNrFeOxAlHUercY4Q2I+PhYD/3VkWpJGy/Oqudy3bFpNcQxnv6Oa9fTSXCHPGz1eDoX1bZYm2Z891A==}
 
   uc.micro@2.1.0:
     resolution: {integrity: sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A==}
 
-  ufo@1.6.3:
-    resolution: {integrity: sha512-yDJTmhydvl5lJzBmy/hyOAA0d+aqCBuwl818haVdYCRrWV84o7YyeVm4QlVHStqNrrJSTb6jKuFAVqAFsr+K3Q==}
-
   uint8-to-base64@0.2.1:
     resolution: {integrity: sha512-uO/84GaoDUfiAxpa8EksjVLE77A9Kc7ZTziN4zRpq4de9yLaLcZn3jx1/sVjyupsywcVX6RKWbqLe7gUNyzH+Q==}
 
-  undici-types@7.19.2:
-    resolution: {integrity: sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==}
+  unbox-primitive@1.1.0:
+    resolution: {integrity: sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==}
+    engines: {node: '>= 0.4'}
+
+  undici-types@7.24.6:
+    resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
 
   unicorn-magic@0.4.0:
     resolution: {integrity: sha512-wH590V9VNgYH9g3lH9wWjTrUoKsjLF6sGLjhR4sH1LWpLmCOH0Zf7PukhDA8BiS7KHe4oPNkcTHqYkj7SOGUOw==}
     engines: {node: '>=20'}
 
-  unrs-resolver@1.11.1:
-    resolution: {integrity: sha512-bSjt9pjaEBnNiGgc9rUiHGKv5l4/TGzDmYw3RhnkJGtLhbnnA/5qJj7x3dNDCRx/PJxu774LlH8lCOlB4hEfKg==}
+  universalify@0.2.0:
+    resolution: {integrity: sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==}
+    engines: {node: '>= 4.0.0'}
+
+  unrs-resolver@1.12.2:
+    resolution: {integrity: sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ==}
+
+  untildify@3.0.3:
+    resolution: {integrity: sha512-iSk/J8efr8uPT/Z4eSUywnqyrQU7DSdMfdqK4iWEaUVVmcP5JcnpRqmVMwcwcnmI1ATFNgC5V90u09tBynNFKA==}
+    engines: {node: '>=4'}
 
   update-browserslist-db@1.2.3:
     resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
@@ -3902,36 +4742,52 @@ packages:
     peerDependencies:
       browserslist: '>= 4.21.0'
 
-  updates@17.16.3:
-    resolution: {integrity: sha512-j+bkgObnDVB9hYTSg1tflwGtkFg23ZrgXiqRmRw3Reu/sh2P29M9oecxavO9uBMO2bbKpgC1OBrAnIpNZtL01w==}
+  updates@17.17.2:
+    resolution: {integrity: sha512-gOwGrBYBvHVS+OiaUFRuilrmf/P8eYVmKUrkq7W3fvYUgpBsNKgfZo/CPhLKBa7xEFiEuMwMxTkiKsd9mn8pEw==}
     engines: {node: '>=22'}
     hasBin: true
 
   uri-js@4.4.1:
     resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
 
+  url-parse@1.5.10:
+    resolution: {integrity: sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==}
+
+  user-home@2.0.0:
+    resolution: {integrity: sha512-KMWqdlOcjCYdtIJpicDSFBQ8nFwS2i9sslAd6f4+CBGcU4gist2REnr2fxj2YocvJFxSF3ZOHLYLVZnUxv4BZQ==}
+    engines: {node: '>=0.10.0'}
+
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
 
-  uuid@11.1.0:
-    resolution: {integrity: sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==}
+  uuid@14.0.0:
+    resolution: {integrity: sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==}
+    hasBin: true
+
+  uuid@3.4.0:
+    resolution: {integrity: sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==}
+    deprecated: uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).
     hasBin: true
 
   vanilla-colorful@0.7.2:
     resolution: {integrity: sha512-z2YZusTFC6KnLERx1cgoIRX2CjPRP0W75N+3CC6gbvdX5Ch47rZkEMGO2Xnf+IEmi3RiFLxS18gayMA27iU7Kg==}
 
-  vite-string-plugin@2.0.2:
-    resolution: {integrity: sha512-pHU9lZuUoMSYyZixdn2XBYko9IAhk3dr41CG6VsXrjB+wN2th06SZsO9mJm6+2NhKBJKNfRERaRej8TBcoq9tQ==}
+  verror@1.10.0:
+    resolution: {integrity: sha512-ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw==}
+    engines: {'0': node >=0.6.0}
+
+  vite-string-plugin@2.0.4:
+    resolution: {integrity: sha512-uahQl15I6hsHGzbjCmllVoKZBmZavXAp8GXBmq5omNQM52wgBv7e//98A6cONbq0Of6F/5uJ30OjF5ggNY6reQ==}
     peerDependencies:
       vite: '*'
 
-  vite@8.0.9:
-    resolution: {integrity: sha512-t7g7GVRpMXjNpa67HaVWI/8BWtdVIQPCL2WoozXXA7LBGEFK4AkkKkHx2hAQf5x1GZSlcmEDPkVLSGahxnEEZw==}
+  vite@8.0.14:
+    resolution: {integrity: sha512-s4BJJ+5y1pYL6Otw51FHhVJQhPnuRinKig64g/1+EUNaJsd3gCKdD31IPFvswUgW9/60QT9oFHbZHbQK5imcxw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
       '@types/node': ^20.19.0 || >=22.12.0
-      '@vitejs/devtools': ^0.1.0
+      '@vitejs/devtools': ^0.1.18
       esbuild: ^0.27.0 || ^0.28.0
       jiti: '>=1.21.0'
       less: ^4.0.0
@@ -3968,20 +4824,20 @@ packages:
       yaml:
         optional: true
 
-  vitest@4.1.4:
-    resolution: {integrity: sha512-tFuJqTxKb8AvfyqMfnavXdzfy3h3sWZRWwfluGbkeR7n0HUev+FmNgZ8SDrRBTVrVCjgH5cA21qGbCffMNtWvg==}
+  vitest@4.1.7:
+    resolution: {integrity: sha512-flYyaFd2CgoCoU+0UKt3pxksgC+S02iTDN0n3LtqaMeXsI9SBcdNujc2k0DeFLzUn/0k538yNjOSdwgCqcrwJA==}
     engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
       '@opentelemetry/api': ^1.9.0
       '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.1.4
-      '@vitest/browser-preview': 4.1.4
-      '@vitest/browser-webdriverio': 4.1.4
-      '@vitest/coverage-istanbul': 4.1.4
-      '@vitest/coverage-v8': 4.1.4
-      '@vitest/ui': 4.1.4
+      '@vitest/browser-playwright': 4.1.7
+      '@vitest/browser-preview': 4.1.7
+      '@vitest/browser-webdriverio': 4.1.7
+      '@vitest/coverage-istanbul': 4.1.7
+      '@vitest/coverage-v8': 4.1.7
+      '@vitest/ui': 4.1.7
       happy-dom: '*'
       jsdom: '*'
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -4009,23 +4865,6 @@ packages:
       jsdom:
         optional: true
 
-  vscode-jsonrpc@8.2.0:
-    resolution: {integrity: sha512-C+r0eKJUIfiDIfwJhria30+TYWPtuHJXHtI7J0YlOmKAo7ogxP20T0zxB7HZQIFhIyvoBPwWskjxrvAtfjyZfA==}
-    engines: {node: '>=14.0.0'}
-
-  vscode-languageserver-protocol@3.17.5:
-    resolution: {integrity: sha512-mb1bvRJN8SVznADSGWM9u/b07H7Ecg0I3OgXDuLdn307rl/J3A9YD6/eYOssqhecL27hK1IPZAsaqh00i/Jljg==}
-
-  vscode-languageserver-textdocument@1.0.12:
-    resolution: {integrity: sha512-cxWNPesCnQCcMPeenjKKsOCKQZ/L6Tv19DTRIGuLWe32lyzWhihGVJ/rcckZXJxfdKCFvRLS3fpBIsV/ZGX4zA==}
-
-  vscode-languageserver-types@3.17.5:
-    resolution: {integrity: sha512-Ld1VelNuX9pdF39h2Hgaeb5hEZM2Z3jUrrMgWQAu82jMtZp7p3vJT3BzToKtZI7NgQssZje5o0zryOrhQvzQAg==}
-
-  vscode-languageserver@9.0.1:
-    resolution: {integrity: sha512-woByF3PDpkHFUreUa7Hos7+pUWdeWMXRd26+ZX2A8cFx6v/JPTtd4/uN0/jB6XQHYaOlHbio03NTHCqrgG5n7g==}
-    hasBin: true
-
   vscode-uri@3.1.0:
     resolution: {integrity: sha512-/BpdSx+yCQGnCvecbyXdxHDkuk55/G3xwnC0GqY4gmQ3j+A+g8kzzgB4Nk/SINjqn6+waqw3EgbVF2QKExkRxQ==}
 
@@ -4044,14 +4883,14 @@ packages:
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
 
-  vue-tsc@3.2.7:
-    resolution: {integrity: sha512-zc1tL3HoQni1zGTGrwBVRQb7rGP5SWdu/m4rGB6JcnAC5MT5LFZIxF7Y+EJEnt4hGF23d60rXH7gRjHGb5KQQQ==}
+  vue-tsc@3.3.2:
+    resolution: {integrity: sha512-n7nQoA3YWW/eiDR8jMiv/uJvlg0uLGs+YgUrsTrf9EZaYSt3tuvMZb5V8+7Mvh/EH5pnY/hoVdgfjH+XcK+wwA==}
     hasBin: true
     peerDependencies:
       typescript: '>=5.0.0'
 
-  vue@3.5.32:
-    resolution: {integrity: sha512-vM4z4Q9tTafVfMAK7IVzmxg34rSzTFMyIe0UUEijUCkn9+23lj0WRfA83dg7eQZIUlgOSGrkViIaCfqSAUXsMw==}
+  vue@3.5.35:
+    resolution: {integrity: sha512-cx89fnr+0kVGHiNFG6y6s0bdjypJRFNZn6x3WPstNdQR1bi1mbB7h4v5IBGTsPJU3nK1+0Iqj3Zf+hZWMieR4Q==}
     peerDependencies:
       typescript: '*'
     peerDependenciesMeta:
@@ -4061,16 +4900,49 @@ packages:
   w3c-keyname@2.2.8:
     resolution: {integrity: sha512-dpojBhNsCNN7T82Tm7k26A6G9ML3NkhDsnw9n/eoxSRlVBB4CEtIQ/KTCLI2Fwf3ataSXRhYFkQi3SlnFwPvPQ==}
 
+  w3c-xmlserializer@4.0.0:
+    resolution: {integrity: sha512-d+BFHzbiCx6zGfz0HyQ6Rg69w9k19nviJspaj4yNscGjrHu94sVP+aRm75yEbCh+r2/yR+7q6hux9LVtbuTGBw==}
+    engines: {node: '>=14'}
+
   webidl-conversions@3.0.1:
     resolution: {integrity: sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==}
 
+  webidl-conversions@7.0.0:
+    resolution: {integrity: sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==}
+    engines: {node: '>=12'}
+
+  whatwg-encoding@2.0.0:
+    resolution: {integrity: sha512-p41ogyeMUrw3jWclHWTQg1k05DSVXPLcVxRTYsXUk+ZooOCZLcoYgPZ/HL/D/N+uQPOtcp1me1WhBEaX02mhWg==}
+    engines: {node: '>=12'}
+    deprecated: Use @exodus/bytes instead for a more spec-conformant and faster implementation
+
   whatwg-mimetype@3.0.0:
     resolution: {integrity: sha512-nt+N2dzIutVRxARx1nghPKGv1xHikU7HKdfafKkLNLindmPU/ch3U31NOCGGA/dmPcmb1VlofO0vnKAcsm0o/Q==}
     engines: {node: '>=12'}
 
+  whatwg-url@11.0.0:
+    resolution: {integrity: sha512-RKT8HExMpoYx4igMiVMY83lN6UeITKJlBQ+vR/8ZJ8OCdSiN3RwCq+9gH0+Xzj0+5IrM6i4j/6LuvzbZIQgEcQ==}
+    engines: {node: '>=12'}
+
   whatwg-url@5.0.0:
     resolution: {integrity: sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==}
 
+  which-boxed-primitive@1.1.1:
+    resolution: {integrity: sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA==}
+    engines: {node: '>= 0.4'}
+
+  which-builtin-type@1.2.1:
+    resolution: {integrity: sha512-6iBczoX+kDQ7a3+YJBnh3T+KZRxM/iYNPXicqk66/Qfm1b93iu+yOImkg0zHbj5LNOcNv1TEADiZ0xa34B4q6Q==}
+    engines: {node: '>= 0.4'}
+
+  which-collection@1.0.2:
+    resolution: {integrity: sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==}
+    engines: {node: '>= 0.4'}
+
+  which-typed-array@1.1.21:
+    resolution: {integrity: sha512-zbRA8cVm6io/d5W8uIe2hblzN76/Wm3v/yiythQvr+dpBWeqhPSWIDNj4zOyHi4zKbMK6DN34Xsr9jPHJERAEw==}
+    engines: {node: '>= 0.4'}
+
   which@1.3.1:
     resolution: {integrity: sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==}
     hasBin: true
@@ -4089,12 +4961,15 @@ packages:
     resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
     engines: {node: '>=0.10.0'}
 
+  wrappy@1.0.2:
+    resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
+
   write-file-atomic@7.0.1:
     resolution: {integrity: sha512-OTIk8iR8/aCRWBqvxrzxR0hgxWpnYBblY1S5hDWBQfk/VFmJwzmJgQFN3WsoUKHISv2eAwe+PpbUzyL1CKTLXg==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
-  ws@8.20.0:
-    resolution: {integrity: sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==}
+  ws@8.21.0:
+    resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
     engines: {node: '>=10.0.0'}
     peerDependencies:
       bufferutil: ^4.0.1
@@ -4115,6 +4990,9 @@ packages:
   xml-reader@2.4.3:
     resolution: {integrity: sha512-xWldrIxjeAMAu6+HSf9t50ot1uL5M+BtOidRCWHXIeewvSeIpscWCsp4Zxjk8kHHhdqFBrfK8U0EJeCcnyQ/gA==}
 
+  xmlchars@2.2.0:
+    resolution: {integrity: sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==}
+
   yocto-queue@0.1.0:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
@@ -4126,32 +5004,32 @@ snapshots:
   '@antfu/install-pkg@1.1.0':
     dependencies:
       package-manager-detector: 1.6.0
-      tinyexec: 1.1.1
+      tinyexec: 1.2.4
 
-  '@babel/code-frame@7.29.0':
+  '@babel/code-frame@7.29.7':
     dependencies:
-      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/helper-validator-identifier': 7.29.7
       js-tokens: 4.0.0
       picocolors: 1.1.1
 
-  '@babel/helper-string-parser@7.27.1': {}
+  '@babel/helper-string-parser@7.29.7': {}
 
-  '@babel/helper-validator-identifier@7.28.5': {}
+  '@babel/helper-validator-identifier@7.29.7': {}
 
-  '@babel/parser@7.29.2':
+  '@babel/parser@7.29.7':
     dependencies:
-      '@babel/types': 7.29.0
+      '@babel/types': 7.29.7
 
-  '@babel/runtime@7.29.2': {}
+  '@babel/runtime@7.29.7': {}
 
-  '@babel/types@7.29.0':
+  '@babel/types@7.29.7':
     dependencies:
-      '@babel/helper-string-parser': 7.27.1
-      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/helper-string-parser': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
 
   '@braintree/sanitize-url@7.1.2': {}
 
-  '@cacheable/memory@2.0.8':
+  '@cacheable/memory@2.0.9':
     dependencies:
       '@cacheable/utils': 2.4.1
       '@keyv/bigmap': 1.3.1(keyv@5.6.0)
@@ -4163,20 +5041,7 @@ snapshots:
       hashery: 1.5.1
       keyv: 5.6.0
 
-  '@chevrotain/cst-dts-gen@12.0.0':
-    dependencies:
-      '@chevrotain/gast': 12.0.0
-      '@chevrotain/types': 12.0.0
-
-  '@chevrotain/gast@12.0.0':
-    dependencies:
-      '@chevrotain/types': 12.0.0
-
-  '@chevrotain/regexp-to-ast@12.0.0': {}
-
-  '@chevrotain/types@12.0.0': {}
-
-  '@chevrotain/utils@12.0.0': {}
+  '@chevrotain/types@11.1.2': {}
 
   '@citation-js/core@0.7.21':
     dependencies:
@@ -4236,18 +5101,18 @@ snapshots:
       '@citation-js/date': 0.5.1
       '@citation-js/name': 0.4.2
 
-  '@codemirror/autocomplete@6.20.1':
+  '@codemirror/autocomplete@6.20.2':
     dependencies:
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       '@lezer/common': 1.5.2
 
   '@codemirror/commands@6.10.3':
     dependencies:
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       '@lezer/common': 1.5.2
 
   '@codemirror/lang-angular@0.1.4':
@@ -4262,11 +5127,11 @@ snapshots:
   '@codemirror/lang-cpp@6.0.3':
     dependencies:
       '@codemirror/language': 6.12.3
-      '@lezer/cpp': 1.1.5
+      '@lezer/cpp': 1.1.6
 
   '@codemirror/lang-css@6.3.1':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@lezer/common': 1.5.2
@@ -4274,7 +5139,7 @@ snapshots:
 
   '@codemirror/lang-go@6.0.1':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@lezer/common': 1.5.2
@@ -4282,12 +5147,12 @@ snapshots:
 
   '@codemirror/lang-html@6.4.11':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/lang-css': 6.3.1
       '@codemirror/lang-javascript': 6.2.5
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       '@lezer/common': 1.5.2
       '@lezer/css': 1.3.3
       '@lezer/html': 1.3.13
@@ -4299,21 +5164,21 @@ snapshots:
 
   '@codemirror/lang-javascript@6.2.5':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/language': 6.12.3
-      '@codemirror/lint': 6.9.5
+      '@codemirror/lint': 6.9.6
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       '@lezer/common': 1.5.2
       '@lezer/javascript': 1.5.4
 
   '@codemirror/lang-jinja@6.0.1':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/lang-html': 6.4.11
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       '@lezer/common': 1.5.2
       '@lezer/highlight': 1.2.3
       '@lezer/lr': 1.4.10
@@ -4333,24 +5198,24 @@ snapshots:
 
   '@codemirror/lang-liquid@6.3.2':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/lang-html': 6.4.11
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       '@lezer/common': 1.5.2
       '@lezer/highlight': 1.2.3
       '@lezer/lr': 1.4.10
 
   '@codemirror/lang-markdown@6.5.0':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/lang-html': 6.4.11
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       '@lezer/common': 1.5.2
-      '@lezer/markdown': 1.6.3
+      '@lezer/markdown': 1.6.4
 
   '@codemirror/lang-php@6.0.2':
     dependencies:
@@ -4362,11 +5227,11 @@ snapshots:
 
   '@codemirror/lang-python@6.2.1':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@lezer/common': 1.5.2
-      '@lezer/python': 1.1.18
+      '@lezer/python': 1.1.19
 
   '@codemirror/lang-rust@6.0.2':
     dependencies:
@@ -4383,7 +5248,7 @@ snapshots:
 
   '@codemirror/lang-sql@6.10.0':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@lezer/common': 1.5.2
@@ -4408,16 +5273,16 @@ snapshots:
 
   '@codemirror/lang-xml@6.1.0':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       '@lezer/common': 1.5.2
       '@lezer/xml': 1.0.6
 
   '@codemirror/lang-yaml@6.1.3':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
       '@lezer/common': 1.5.2
@@ -4449,45 +5314,45 @@ snapshots:
       '@codemirror/lang-xml': 6.1.0
       '@codemirror/lang-yaml': 6.1.3
       '@codemirror/language': 6.12.3
-      '@codemirror/legacy-modes': 6.5.2
+      '@codemirror/legacy-modes': 6.5.3
 
   '@codemirror/language@6.12.3':
     dependencies:
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       '@lezer/common': 1.5.2
       '@lezer/highlight': 1.2.3
       '@lezer/lr': 1.4.10
       style-mod: 4.1.3
 
-  '@codemirror/legacy-modes@6.5.2':
+  '@codemirror/legacy-modes@6.5.3':
     dependencies:
       '@codemirror/language': 6.12.3
 
-  '@codemirror/lint@6.9.5':
+  '@codemirror/lint@6.9.6':
     dependencies:
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       crelt: 1.0.6
 
-  '@codemirror/search@6.6.0':
+  '@codemirror/search@6.7.0':
     dependencies:
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       crelt: 1.0.6
 
   '@codemirror/state@6.6.0':
     dependencies:
       '@marijn/find-cluster-break': 1.0.2
 
-  '@codemirror/view@6.41.1':
+  '@codemirror/view@6.43.0':
     dependencies:
       '@codemirror/state': 6.6.0
       crelt: 1.0.6
       style-mod: 4.1.3
       w3c-keyname: 2.2.8
 
-  '@csstools/css-calc@3.2.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)':
+  '@csstools/css-calc@3.2.1(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)':
     dependencies:
       '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.0)
       '@csstools/css-tokenizer': 4.0.0
@@ -4496,7 +5361,7 @@ snapshots:
     dependencies:
       '@csstools/css-tokenizer': 4.0.0
 
-  '@csstools/css-syntax-patches-for-csstree@1.1.3(css-tree@3.2.1)':
+  '@csstools/css-syntax-patches-for-csstree@1.1.4(css-tree@3.2.1)':
     optionalDependencies:
       css-tree: 3.2.1
 
@@ -4517,7 +5382,7 @@ snapshots:
 
   '@deltablot/dropzone@7.4.3':
     dependencies:
-      '@swc/helpers': 0.5.21
+      '@swc/helpers': 0.5.23
 
   '@emnapi/core@1.10.0':
     dependencies:
@@ -4525,22 +5390,11 @@ snapshots:
       tslib: 2.8.1
     optional: true
 
-  '@emnapi/core@1.9.2':
-    dependencies:
-      '@emnapi/wasi-threads': 1.2.1
-      tslib: 2.8.1
-    optional: true
-
   '@emnapi/runtime@1.10.0':
     dependencies:
       tslib: 2.8.1
     optional: true
 
-  '@emnapi/runtime@1.9.2':
-    dependencies:
-      tslib: 2.8.1
-    optional: true
-
   '@emnapi/wasi-threads@1.2.1':
     dependencies:
       tslib: 2.8.1
@@ -4624,24 +5478,24 @@ snapshots:
   '@esbuild/win32-x64@0.28.0':
     optional: true
 
-  '@eslint-community/eslint-plugin-eslint-comments@4.7.1(eslint@10.2.1(jiti@2.6.1))':
+  '@eslint-community/eslint-plugin-eslint-comments@4.7.2(eslint@10.4.0(jiti@2.7.0))':
     dependencies:
       escape-string-regexp: 4.0.0
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
       ignore: 7.0.5
 
-  '@eslint-community/eslint-utils@4.9.1(eslint@10.2.1(jiti@2.6.1))':
+  '@eslint-community/eslint-utils@4.9.1(eslint@10.4.0(jiti@2.7.0))':
     dependencies:
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
       eslint-visitor-keys: 3.4.3
 
   '@eslint-community/regexpp@4.12.2': {}
 
-  '@eslint/compat@1.4.1(eslint@10.2.1(jiti@2.6.1))':
+  '@eslint/compat@1.4.1(eslint@10.4.0(jiti@2.7.0))':
     dependencies:
       '@eslint/core': 0.17.0
     optionalDependencies:
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
 
   '@eslint/config-array@0.23.5':
     dependencies:
@@ -4651,7 +5505,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@eslint/config-helpers@0.5.5':
+  '@eslint/config-helpers@0.6.0':
     dependencies:
       '@eslint/core': 1.2.1
 
@@ -4665,7 +5519,7 @@ snapshots:
 
   '@eslint/eslintrc@3.3.5':
     dependencies:
-      ajv: 6.14.0
+      ajv: 6.15.0
       debug: 4.4.3
       espree: 10.4.0
       globals: 14.0.0
@@ -4693,7 +5547,7 @@ snapshots:
       '@eslint/core': 1.2.1
       levn: 0.4.1
 
-  '@eslint/plugin-kit@0.7.1':
+  '@eslint/plugin-kit@0.7.2':
     dependencies:
       '@eslint/core': 1.2.1
       levn: 0.4.1
@@ -4731,11 +5585,40 @@ snapshots:
 
   '@iconify/types@2.0.0': {}
 
-  '@iconify/utils@3.1.0':
+  '@iconify/utils@3.1.3':
     dependencies:
       '@antfu/install-pkg': 1.1.0
       '@iconify/types': 2.0.0
-      mlly: 1.8.2
+      import-meta-resolve: 4.2.0
+
+  '@jest/environment@29.7.0':
+    dependencies:
+      '@jest/fake-timers': 29.7.0
+      '@jest/types': 29.6.3
+      '@types/node': 25.9.1
+      jest-mock: 29.7.0
+
+  '@jest/fake-timers@29.7.0':
+    dependencies:
+      '@jest/types': 29.6.3
+      '@sinonjs/fake-timers': 10.3.0
+      '@types/node': 25.9.1
+      jest-message-util: 29.7.0
+      jest-mock: 29.7.0
+      jest-util: 29.7.0
+
+  '@jest/schemas@29.6.3':
+    dependencies:
+      '@sinclair/typebox': 0.27.10
+
+  '@jest/types@29.6.3':
+    dependencies:
+      '@jest/schemas': 29.6.3
+      '@types/istanbul-lib-coverage': 2.0.6
+      '@types/istanbul-reports': 3.0.4
+      '@types/node': 25.9.1
+      '@types/yargs': 17.0.35
+      chalk: 4.1.2
 
   '@jridgewell/gen-mapping@0.3.13':
     dependencies:
@@ -4763,7 +5646,7 @@ snapshots:
 
   '@lezer/common@1.5.2': {}
 
-  '@lezer/cpp@1.1.5':
+  '@lezer/cpp@1.1.6':
     dependencies:
       '@lezer/common': 1.5.2
       '@lezer/highlight': 1.2.3
@@ -4813,7 +5696,7 @@ snapshots:
     dependencies:
       '@lezer/common': 1.5.2
 
-  '@lezer/markdown@1.6.3':
+  '@lezer/markdown@1.6.4':
     dependencies:
       '@lezer/common': 1.5.2
       '@lezer/highlight': 1.2.3
@@ -4824,7 +5707,7 @@ snapshots:
       '@lezer/highlight': 1.2.3
       '@lezer/lr': 1.4.10
 
-  '@lezer/python@1.1.18':
+  '@lezer/python@1.1.19':
     dependencies:
       '@lezer/common': 1.5.2
       '@lezer/highlight': 1.2.3
@@ -4861,29 +5744,28 @@ snapshots:
   '@mcaptcha/vanilla-glue@0.1.0-rc2':
     dependencies:
       '@mcaptcha/core-glue': 0.1.0-rc1
+      jest-environment-jsdom: 29.7.0
+    transitivePeerDependencies:
+      - bufferutil
+      - canvas
+      - supports-color
+      - utf-8-validate
 
-  '@mermaid-js/layout-elk@0.2.1(mermaid@11.14.0)':
+  '@mermaid-js/layout-elk@0.2.1(mermaid@11.15.0)':
     dependencies:
       d3: 7.9.0
       elkjs: 0.9.3
-      mermaid: 11.14.0
+      mermaid: 11.15.0
 
-  '@mermaid-js/parser@1.1.0':
+  '@mermaid-js/parser@1.1.1':
     dependencies:
-      langium: 4.2.2
+      '@chevrotain/types': 11.1.2
 
-  '@napi-rs/wasm-runtime@0.2.12':
+  '@napi-rs/wasm-runtime@1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
     dependencies:
       '@emnapi/core': 1.10.0
       '@emnapi/runtime': 1.10.0
-      '@tybys/wasm-util': 0.10.1
-    optional: true
-
-  '@napi-rs/wasm-runtime@1.1.4(@emnapi/core@1.9.2)(@emnapi/runtime@1.9.2)':
-    dependencies:
-      '@emnapi/core': 1.9.2
-      '@emnapi/runtime': 1.9.2
-      '@tybys/wasm-util': 0.10.1
+      '@tybys/wasm-util': 0.10.2
     optional: true
 
   '@nodelib/fs.scandir@2.1.5':
@@ -4898,174 +5780,114 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.20.1
 
-  '@nolyfill/array-includes@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@nolyfill/array.prototype.findlastindex@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@nolyfill/array.prototype.flat@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@nolyfill/array.prototype.flatmap@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@nolyfill/hasown@1.0.44': {}
-
-  '@nolyfill/is-core-module@1.0.39': {}
-
-  '@nolyfill/object-keys@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@nolyfill/object.assign@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@nolyfill/object.entries@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@nolyfill/object.fromentries@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@nolyfill/object.groupby@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@nolyfill/object.values@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@nolyfill/safe-regex-test@1.0.44': {}
-
-  '@nolyfill/safer-buffer@1.0.44': {}
-
-  '@nolyfill/shared@1.0.44': {}
-
-  '@nolyfill/string.prototype.includes@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@nolyfill/string.prototype.trimend@1.0.44':
-    dependencies:
-      '@nolyfill/shared': 1.0.44
-
-  '@oxc-project/types@0.126.0': {}
+  '@oxc-project/types@0.132.0': {}
 
   '@package-json/types@0.0.12': {}
 
-  '@pkgr/core@0.2.9': {}
+  '@pkgr/core@0.3.6': {}
 
-  '@playwright/test@1.59.1':
+  '@playwright/test@1.60.0':
     dependencies:
-      playwright: 1.59.1
+      playwright: 1.60.0
 
   '@popperjs/core@2.11.8': {}
 
-  '@primer/octicons@19.24.1':
+  '@primer/octicons@19.27.0':
     dependencies:
       object-assign: 4.1.1
 
-  '@replit/codemirror-indentation-markers@6.5.3(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.41.1)':
+  '@replit/codemirror-indentation-markers@6.5.3(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)':
     dependencies:
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
 
-  '@replit/codemirror-lang-nix@6.0.1(@codemirror/autocomplete@6.20.1)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.41.1)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/lr@1.4.10)':
+  '@replit/codemirror-lang-nix@6.0.1(@codemirror/autocomplete@6.20.2)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/lr@1.4.10)':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       '@lezer/common': 1.5.2
       '@lezer/highlight': 1.2.3
       '@lezer/lr': 1.4.10
 
-  '@replit/codemirror-lang-svelte@6.0.0(@codemirror/autocomplete@6.20.1)(@codemirror/lang-css@6.3.1)(@codemirror/lang-html@6.4.11)(@codemirror/lang-javascript@6.2.5)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.41.1)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/javascript@1.5.4)(@lezer/lr@1.4.10)':
+  '@replit/codemirror-lang-svelte@6.0.0(@codemirror/autocomplete@6.20.2)(@codemirror/lang-css@6.3.1)(@codemirror/lang-html@6.4.11)(@codemirror/lang-javascript@6.2.5)(@codemirror/language@6.12.3)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)(@lezer/common@1.5.2)(@lezer/highlight@1.2.3)(@lezer/javascript@1.5.4)(@lezer/lr@1.4.10)':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/lang-css': 6.3.1
       '@codemirror/lang-html': 6.4.11
       '@codemirror/lang-javascript': 6.2.5
       '@codemirror/language': 6.12.3
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
       '@lezer/common': 1.5.2
       '@lezer/highlight': 1.2.3
       '@lezer/javascript': 1.5.4
       '@lezer/lr': 1.4.10
 
-  '@replit/codemirror-vscode-keymap@6.0.2(@codemirror/autocomplete@6.20.1)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/view@6.41.1)':
+  '@replit/codemirror-vscode-keymap@6.0.2(@codemirror/autocomplete@6.20.2)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.3)(@codemirror/lint@6.9.6)(@codemirror/search@6.7.0)(@codemirror/state@6.6.0)(@codemirror/view@6.43.0)':
     dependencies:
-      '@codemirror/autocomplete': 6.20.1
+      '@codemirror/autocomplete': 6.20.2
       '@codemirror/commands': 6.10.3
       '@codemirror/language': 6.12.3
-      '@codemirror/lint': 6.9.5
-      '@codemirror/search': 6.6.0
+      '@codemirror/lint': 6.9.6
+      '@codemirror/search': 6.7.0
       '@codemirror/state': 6.6.0
-      '@codemirror/view': 6.41.1
+      '@codemirror/view': 6.43.0
 
   '@resvg/resvg-wasm@2.6.2': {}
 
-  '@rolldown/binding-android-arm64@1.0.0-rc.16':
+  '@rolldown/binding-android-arm64@1.0.2':
     optional: true
 
-  '@rolldown/binding-darwin-arm64@1.0.0-rc.16':
+  '@rolldown/binding-darwin-arm64@1.0.2':
     optional: true
 
-  '@rolldown/binding-darwin-x64@1.0.0-rc.16':
+  '@rolldown/binding-darwin-x64@1.0.2':
     optional: true
 
-  '@rolldown/binding-freebsd-x64@1.0.0-rc.16':
+  '@rolldown/binding-freebsd-x64@1.0.2':
     optional: true
 
-  '@rolldown/binding-linux-arm-gnueabihf@1.0.0-rc.16':
+  '@rolldown/binding-linux-arm-gnueabihf@1.0.2':
     optional: true
 
-  '@rolldown/binding-linux-arm64-gnu@1.0.0-rc.16':
+  '@rolldown/binding-linux-arm64-gnu@1.0.2':
     optional: true
 
-  '@rolldown/binding-linux-arm64-musl@1.0.0-rc.16':
+  '@rolldown/binding-linux-arm64-musl@1.0.2':
     optional: true
 
-  '@rolldown/binding-linux-ppc64-gnu@1.0.0-rc.16':
+  '@rolldown/binding-linux-ppc64-gnu@1.0.2':
     optional: true
 
-  '@rolldown/binding-linux-s390x-gnu@1.0.0-rc.16':
+  '@rolldown/binding-linux-s390x-gnu@1.0.2':
     optional: true
 
-  '@rolldown/binding-linux-x64-gnu@1.0.0-rc.16':
+  '@rolldown/binding-linux-x64-gnu@1.0.2':
     optional: true
 
-  '@rolldown/binding-linux-x64-musl@1.0.0-rc.16':
+  '@rolldown/binding-linux-x64-musl@1.0.2':
     optional: true
 
-  '@rolldown/binding-openharmony-arm64@1.0.0-rc.16':
+  '@rolldown/binding-openharmony-arm64@1.0.2':
     optional: true
 
-  '@rolldown/binding-wasm32-wasi@1.0.0-rc.16':
+  '@rolldown/binding-wasm32-wasi@1.0.2':
     dependencies:
-      '@emnapi/core': 1.9.2
-      '@emnapi/runtime': 1.9.2
-      '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.9.2)(@emnapi/runtime@1.9.2)
+      '@emnapi/core': 1.10.0
+      '@emnapi/runtime': 1.10.0
+      '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
     optional: true
 
-  '@rolldown/binding-win32-arm64-msvc@1.0.0-rc.16':
+  '@rolldown/binding-win32-arm64-msvc@1.0.2':
     optional: true
 
-  '@rolldown/binding-win32-x64-msvc@1.0.0-rc.16':
+  '@rolldown/binding-win32-x64-msvc@1.0.2':
     optional: true
 
-  '@rolldown/pluginutils@1.0.0-rc.13': {}
-
-  '@rolldown/pluginutils@1.0.0-rc.16': {}
+  '@rolldown/pluginutils@1.0.1': {}
 
   '@rtsao/scc@1.1.0': {}
 
@@ -5076,49 +5898,61 @@ snapshots:
       core-js: 3.32.2
       nanopop: 2.3.0
 
+  '@sinclair/typebox@0.27.10': {}
+
   '@sindresorhus/merge-streams@4.0.0': {}
 
-  '@solid-primitives/refs@1.1.3(solid-js@1.9.12)':
+  '@sinonjs/commons@3.0.1':
     dependencies:
-      '@solid-primitives/utils': 6.4.0(solid-js@1.9.12)
-      solid-js: 1.9.12
+      type-detect: 4.0.8
 
-  '@solid-primitives/transition-group@1.1.2(solid-js@1.9.12)':
+  '@sinonjs/fake-timers@10.3.0':
     dependencies:
-      solid-js: 1.9.12
+      '@sinonjs/commons': 3.0.1
 
-  '@solid-primitives/utils@6.4.0(solid-js@1.9.12)':
+  '@solid-primitives/refs@1.1.3(solid-js@1.9.13)':
     dependencies:
-      solid-js: 1.9.12
+      '@solid-primitives/utils': 6.4.0(solid-js@1.9.13)
+      solid-js: 1.9.13
+
+  '@solid-primitives/transition-group@1.1.2(solid-js@1.9.13)':
+    dependencies:
+      solid-js: 1.9.13
+
+  '@solid-primitives/utils@6.4.0(solid-js@1.9.13)':
+    dependencies:
+      solid-js: 1.9.13
 
   '@standard-schema/spec@1.1.0': {}
 
-  '@stylistic/eslint-plugin@5.10.0(eslint@10.2.1(jiti@2.6.1))':
+  '@stylistic/eslint-plugin@5.10.0(eslint@10.4.0(jiti@2.7.0))':
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.2.1(jiti@2.6.1))
-      '@typescript-eslint/types': 8.59.0
-      eslint: 10.2.1(jiti@2.6.1)
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@typescript-eslint/types': 8.60.1
+      eslint: 10.4.0(jiti@2.7.0)
       eslint-visitor-keys: 4.2.1
       espree: 10.4.0
       estraverse: 5.3.0
       picomatch: 4.0.4
 
-  '@stylistic/stylelint-plugin@5.1.0(stylelint@17.8.0(typescript@6.0.3))':
+  '@stylistic/stylelint-plugin@5.2.0(stylelint@17.12.0(typescript@6.0.3))':
     dependencies:
       '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.0)
       '@csstools/css-tokenizer': 4.0.0
       '@csstools/media-query-list-parser': 5.0.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
-      postcss: 8.5.10
+      postcss: 8.5.15
       postcss-selector-parser: 7.1.1
       postcss-value-parser: 4.2.0
       style-search: 0.1.0
-      stylelint: 17.8.0(typescript@6.0.3)
+      stylelint: 17.12.0(typescript@6.0.3)
 
-  '@swc/helpers@0.5.21':
+  '@swc/helpers@0.5.23':
     dependencies:
       tslib: 2.8.1
 
-  '@tybys/wasm-util@0.10.1':
+  '@tootallnate/once@2.0.1': {}
+
+  '@tybys/wasm-util@0.10.2':
     dependencies:
       tslib: 2.8.1
     optional: true
@@ -5257,16 +6091,32 @@ snapshots:
 
   '@types/esrecurse@4.3.1': {}
 
-  '@types/estree@1.0.8': {}
+  '@types/estree@1.0.9': {}
 
   '@types/geojson@7946.0.16': {}
 
   '@types/hammerjs@2.0.46': {}
 
+  '@types/istanbul-lib-coverage@2.0.6': {}
+
+  '@types/istanbul-lib-report@3.0.3':
+    dependencies:
+      '@types/istanbul-lib-coverage': 2.0.6
+
+  '@types/istanbul-reports@3.0.4':
+    dependencies:
+      '@types/istanbul-lib-report': 3.0.3
+
   '@types/jquery@4.0.0': {}
 
   '@types/js-yaml@4.0.9': {}
 
+  '@types/jsdom@20.0.1':
+    dependencies:
+      '@types/node': 25.9.1
+      '@types/tough-cookie': 4.0.5
+      parse5: 7.3.0
+
   '@types/json-schema@7.0.15': {}
 
   '@types/json5@0.0.29': {}
@@ -5277,24 +6127,28 @@ snapshots:
 
   '@types/ms@2.1.0': {}
 
-  '@types/node@25.6.0':
+  '@types/node@25.9.1':
     dependencies:
-      undici-types: 7.19.2
+      undici-types: 7.24.6
 
   '@types/pdfobject@2.2.5': {}
 
   '@types/sortablejs@1.15.9': {}
 
+  '@types/stack-utils@2.0.3': {}
+
   '@types/swagger-ui-dist@3.30.6': {}
 
   '@types/tern@0.23.9':
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
 
   '@types/throttle-debounce@5.0.2': {}
 
   '@types/toastify-js@1.12.4': {}
 
+  '@types/tough-cookie@4.0.5': {}
+
   '@types/trusted-types@2.0.7':
     optional: true
 
@@ -5304,17 +6158,23 @@ snapshots:
 
   '@types/ws@8.18.1':
     dependencies:
-      '@types/node': 25.6.0
+      '@types/node': 25.9.1
 
-  '@typescript-eslint/eslint-plugin@8.59.0(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)':
+  '@types/yargs-parser@21.0.3': {}
+
+  '@types/yargs@17.0.35':
+    dependencies:
+      '@types/yargs-parser': 21.0.3
+
+  '@typescript-eslint/eslint-plugin@8.60.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
-      '@typescript-eslint/scope-manager': 8.59.0
-      '@typescript-eslint/type-utils': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)
-      '@typescript-eslint/visitor-keys': 8.59.0
-      eslint: 10.2.1(jiti@2.6.1)
+      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.60.0
+      '@typescript-eslint/type-utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.60.0
+      eslint: 10.4.0(jiti@2.7.0)
       ignore: 7.0.5
       natural-compare: 1.4.0
       ts-api-utils: 2.5.0(typescript@5.9.3)
@@ -5322,15 +6182,15 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/eslint-plugin@8.59.0(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)':
+  '@typescript-eslint/eslint-plugin@8.60.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
-      '@typescript-eslint/scope-manager': 8.59.0
-      '@typescript-eslint/type-utils': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
-      '@typescript-eslint/visitor-keys': 8.59.0
-      eslint: 10.2.1(jiti@2.6.1)
+      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.60.0
+      '@typescript-eslint/type-utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/visitor-keys': 8.60.0
+      eslint: 10.4.0(jiti@2.7.0)
       ignore: 7.0.5
       natural-compare: 1.4.0
       ts-api-utils: 2.5.0(typescript@6.0.3)
@@ -5338,201 +6198,360 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)':
+  '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/scope-manager': 8.59.0
-      '@typescript-eslint/types': 8.59.0
-      '@typescript-eslint/typescript-estree': 8.59.0(typescript@5.9.3)
-      '@typescript-eslint/visitor-keys': 8.59.0
-      debug: 4.4.3
-      eslint: 10.2.1(jiti@2.6.1)
-      typescript: 5.9.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)':
-    dependencies:
-      '@typescript-eslint/scope-manager': 8.59.0
-      '@typescript-eslint/types': 8.59.0
-      '@typescript-eslint/typescript-estree': 8.59.0(typescript@6.0.3)
-      '@typescript-eslint/visitor-keys': 8.59.0
-      debug: 4.4.3
-      eslint: 10.2.1(jiti@2.6.1)
-      typescript: 6.0.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/project-service@8.59.0(typescript@5.9.3)':
-    dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.59.0(typescript@5.9.3)
-      '@typescript-eslint/types': 8.59.0
-      debug: 4.4.3
-      typescript: 5.9.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/project-service@8.59.0(typescript@6.0.3)':
-    dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.59.0(typescript@6.0.3)
-      '@typescript-eslint/types': 8.59.0
-      debug: 4.4.3
-      typescript: 6.0.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/scope-manager@8.59.0':
-    dependencies:
-      '@typescript-eslint/types': 8.59.0
-      '@typescript-eslint/visitor-keys': 8.59.0
-
-  '@typescript-eslint/tsconfig-utils@8.59.0(typescript@5.9.3)':
-    dependencies:
-      typescript: 5.9.3
-
-  '@typescript-eslint/tsconfig-utils@8.59.0(typescript@6.0.3)':
-    dependencies:
-      typescript: 6.0.3
-
-  '@typescript-eslint/type-utils@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)':
-    dependencies:
-      '@typescript-eslint/types': 8.59.0
-      '@typescript-eslint/typescript-estree': 8.59.0(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)
-      debug: 4.4.3
-      eslint: 10.2.1(jiti@2.6.1)
+      '@eslint-community/regexpp': 4.12.2
+      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/type-utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.60.1
+      eslint: 10.4.0(jiti@2.7.0)
+      ignore: 7.0.5
+      natural-compare: 1.4.0
       ts-api-utils: 2.5.0(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/type-utils@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)':
+  '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
-      '@typescript-eslint/types': 8.59.0
-      '@typescript-eslint/typescript-estree': 8.59.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
-      debug: 4.4.3
-      eslint: 10.2.1(jiti@2.6.1)
+      '@eslint-community/regexpp': 4.12.2
+      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/type-utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/visitor-keys': 8.60.1
+      eslint: 10.4.0(jiti@2.7.0)
+      ignore: 7.0.5
+      natural-compare: 1.4.0
       ts-api-utils: 2.5.0(typescript@6.0.3)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
+    optional: true
 
-  '@typescript-eslint/types@8.59.0': {}
-
-  '@typescript-eslint/typescript-estree@8.59.0(typescript@5.9.3)':
+  '@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/project-service': 8.59.0(typescript@5.9.3)
-      '@typescript-eslint/tsconfig-utils': 8.59.0(typescript@5.9.3)
-      '@typescript-eslint/types': 8.59.0
-      '@typescript-eslint/visitor-keys': 8.59.0
+      '@typescript-eslint/scope-manager': 8.60.0
+      '@typescript-eslint/types': 8.60.0
+      '@typescript-eslint/typescript-estree': 8.60.0(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.60.0
       debug: 4.4.3
-      minimatch: 10.2.5
-      semver: 7.7.4
-      tinyglobby: 0.2.16
+      eslint: 10.4.0(jiti@2.7.0)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/scope-manager': 8.60.0
+      '@typescript-eslint/types': 8.60.0
+      '@typescript-eslint/typescript-estree': 8.60.0(typescript@6.0.3)
+      '@typescript-eslint/visitor-keys': 8.60.0
+      debug: 4.4.3
+      eslint: 10.4.0(jiti@2.7.0)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/project-service@8.60.0(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.60.0(typescript@5.9.3)
+      '@typescript-eslint/types': 8.60.0
+      debug: 4.4.3
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/project-service@8.60.0(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.60.0(typescript@6.0.3)
+      '@typescript-eslint/types': 8.60.0
+      debug: 4.4.3
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/project-service@8.60.1(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.60.1(typescript@5.9.3)
+      '@typescript-eslint/types': 8.60.1
+      debug: 4.4.3
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/project-service@8.60.1(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.60.1(typescript@6.0.3)
+      '@typescript-eslint/types': 8.60.1
+      debug: 4.4.3
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/scope-manager@8.60.0':
+    dependencies:
+      '@typescript-eslint/types': 8.60.0
+      '@typescript-eslint/visitor-keys': 8.60.0
+
+  '@typescript-eslint/scope-manager@8.60.1':
+    dependencies:
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/visitor-keys': 8.60.1
+
+  '@typescript-eslint/tsconfig-utils@8.60.0(typescript@5.9.3)':
+    dependencies:
+      typescript: 5.9.3
+
+  '@typescript-eslint/tsconfig-utils@8.60.0(typescript@6.0.3)':
+    dependencies:
+      typescript: 6.0.3
+
+  '@typescript-eslint/tsconfig-utils@8.60.1(typescript@5.9.3)':
+    dependencies:
+      typescript: 5.9.3
+
+  '@typescript-eslint/tsconfig-utils@8.60.1(typescript@6.0.3)':
+    dependencies:
+      typescript: 6.0.3
+
+  '@typescript-eslint/type-utils@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/types': 8.60.0
+      '@typescript-eslint/typescript-estree': 8.60.0(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      debug: 4.4.3
+      eslint: 10.4.0(jiti@2.7.0)
       ts-api-utils: 2.5.0(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/typescript-estree@8.59.0(typescript@6.0.3)':
+  '@typescript-eslint/type-utils@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
-      '@typescript-eslint/project-service': 8.59.0(typescript@6.0.3)
-      '@typescript-eslint/tsconfig-utils': 8.59.0(typescript@6.0.3)
-      '@typescript-eslint/types': 8.59.0
-      '@typescript-eslint/visitor-keys': 8.59.0
+      '@typescript-eslint/types': 8.60.0
+      '@typescript-eslint/typescript-estree': 8.60.0(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
       debug: 4.4.3
-      minimatch: 10.2.5
-      semver: 7.7.4
-      tinyglobby: 0.2.16
+      eslint: 10.4.0(jiti@2.7.0)
       ts-api-utils: 2.5.0(typescript@6.0.3)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)':
+  '@typescript-eslint/type-utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.2.1(jiti@2.6.1))
-      '@typescript-eslint/scope-manager': 8.59.0
-      '@typescript-eslint/types': 8.59.0
-      '@typescript-eslint/typescript-estree': 8.59.0(typescript@5.9.3)
-      eslint: 10.2.1(jiti@2.6.1)
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      debug: 4.4.3
+      eslint: 10.4.0(jiti@2.7.0)
+      ts-api-utils: 2.5.0(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)':
+  '@typescript-eslint/type-utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.2.1(jiti@2.6.1))
-      '@typescript-eslint/scope-manager': 8.59.0
-      '@typescript-eslint/types': 8.59.0
-      '@typescript-eslint/typescript-estree': 8.59.0(typescript@6.0.3)
-      eslint: 10.2.1(jiti@2.6.1)
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      debug: 4.4.3
+      eslint: 10.4.0(jiti@2.7.0)
+      ts-api-utils: 2.5.0(typescript@6.0.3)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+    optional: true
+
+  '@typescript-eslint/types@8.60.0': {}
+
+  '@typescript-eslint/types@8.60.1': {}
+
+  '@typescript-eslint/typescript-estree@8.60.0(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.60.0(typescript@5.9.3)
+      '@typescript-eslint/tsconfig-utils': 8.60.0(typescript@5.9.3)
+      '@typescript-eslint/types': 8.60.0
+      '@typescript-eslint/visitor-keys': 8.60.0
+      debug: 4.4.3
+      minimatch: 10.2.5
+      semver: 7.8.1
+      tinyglobby: 0.2.17
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/typescript-estree@8.60.0(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.60.0(typescript@6.0.3)
+      '@typescript-eslint/tsconfig-utils': 8.60.0(typescript@6.0.3)
+      '@typescript-eslint/types': 8.60.0
+      '@typescript-eslint/visitor-keys': 8.60.0
+      debug: 4.4.3
+      minimatch: 10.2.5
+      semver: 7.8.1
+      tinyglobby: 0.2.17
+      ts-api-utils: 2.5.0(typescript@6.0.3)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/visitor-keys@8.59.0':
+  '@typescript-eslint/typescript-estree@8.60.1(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/types': 8.59.0
+      '@typescript-eslint/project-service': 8.60.1(typescript@5.9.3)
+      '@typescript-eslint/tsconfig-utils': 8.60.1(typescript@5.9.3)
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/visitor-keys': 8.60.1
+      debug: 4.4.3
+      minimatch: 10.2.5
+      semver: 7.8.1
+      tinyglobby: 0.2.17
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/typescript-estree@8.60.1(typescript@6.0.3)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.60.1(typescript@6.0.3)
+      '@typescript-eslint/tsconfig-utils': 8.60.1(typescript@6.0.3)
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/visitor-keys': 8.60.1
+      debug: 4.4.3
+      minimatch: 10.2.5
+      semver: 7.8.1
+      tinyglobby: 0.2.17
+      ts-api-utils: 2.5.0(typescript@6.0.3)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@typescript-eslint/scope-manager': 8.60.0
+      '@typescript-eslint/types': 8.60.0
+      '@typescript-eslint/typescript-estree': 8.60.0(typescript@5.9.3)
+      eslint: 10.4.0(jiti@2.7.0)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@typescript-eslint/scope-manager': 8.60.0
+      '@typescript-eslint/types': 8.60.0
+      '@typescript-eslint/typescript-estree': 8.60.0(typescript@6.0.3)
+      eslint: 10.4.0(jiti@2.7.0)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3)
+      eslint: 10.4.0(jiti@2.7.0)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@6.0.3)
+      eslint: 10.4.0(jiti@2.7.0)
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/visitor-keys@8.60.0':
+    dependencies:
+      '@typescript-eslint/types': 8.60.0
       eslint-visitor-keys: 5.0.1
 
-  '@unrs/resolver-binding-android-arm-eabi@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-android-arm64@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-darwin-arm64@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-darwin-x64@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-freebsd-x64@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-linux-arm-gnueabihf@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-linux-arm-musleabihf@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-linux-arm64-gnu@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-linux-arm64-musl@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-linux-ppc64-gnu@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-linux-riscv64-gnu@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-linux-riscv64-musl@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-linux-s390x-gnu@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-linux-x64-gnu@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-linux-x64-musl@1.11.1':
-    optional: true
-
-  '@unrs/resolver-binding-wasm32-wasi@1.11.1':
+  '@typescript-eslint/visitor-keys@8.60.1':
     dependencies:
-      '@napi-rs/wasm-runtime': 0.2.12
+      '@typescript-eslint/types': 8.60.1
+      eslint-visitor-keys: 5.0.1
+
+  '@unrs/resolver-binding-android-arm-eabi@1.12.2':
     optional: true
 
-  '@unrs/resolver-binding-win32-arm64-msvc@1.11.1':
+  '@unrs/resolver-binding-android-arm64@1.12.2':
     optional: true
 
-  '@unrs/resolver-binding-win32-ia32-msvc@1.11.1':
+  '@unrs/resolver-binding-darwin-arm64@1.12.2':
     optional: true
 
-  '@unrs/resolver-binding-win32-x64-msvc@1.11.1':
+  '@unrs/resolver-binding-darwin-x64@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-freebsd-x64@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm-gnueabihf@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm-musleabihf@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm64-gnu@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm64-musl@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-loong64-gnu@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-loong64-musl@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-ppc64-gnu@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-riscv64-gnu@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-riscv64-musl@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-s390x-gnu@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-x64-gnu@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-linux-x64-musl@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-openharmony-arm64@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-wasm32-wasi@1.12.2':
+    dependencies:
+      '@emnapi/core': 1.10.0
+      '@emnapi/runtime': 1.10.0
+      '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
+    optional: true
+
+  '@unrs/resolver-binding-win32-arm64-msvc@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-win32-ia32-msvc@1.12.2':
+    optional: true
+
+  '@unrs/resolver-binding-win32-x64-msvc@1.12.2':
     optional: true
 
   '@upsetjs/venn.js@2.0.0':
@@ -5540,62 +6559,62 @@ snapshots:
       d3-selection: 3.0.0
       d3-transition: 3.0.1(d3-selection@3.0.0)
 
-  '@vitejs/plugin-vue@6.0.6(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1))(vue@3.5.32(typescript@6.0.3))':
+  '@vitejs/plugin-vue@6.0.7(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))(vue@3.5.35(typescript@6.0.3))':
     dependencies:
-      '@rolldown/pluginutils': 1.0.0-rc.13
-      vite: 8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1)
-      vue: 3.5.32(typescript@6.0.3)
+      '@rolldown/pluginutils': 1.0.1
+      vite: 8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
+      vue: 3.5.35(typescript@6.0.3)
 
-  '@vitest/eslint-plugin@1.6.16(@typescript-eslint/eslint-plugin@8.59.0(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)(vitest@4.1.4(@types/node@25.6.0)(happy-dom@20.9.0)(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1)))':
+  '@vitest/eslint-plugin@1.6.18(@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)(vitest@4.1.7(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)))':
     dependencies:
-      '@typescript-eslint/scope-manager': 8.59.0
-      '@typescript-eslint/utils': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
-      eslint: 10.2.1(jiti@2.6.1)
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      eslint: 10.4.0(jiti@2.7.0)
     optionalDependencies:
-      '@typescript-eslint/eslint-plugin': 8.59.0(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
+      '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
       typescript: 6.0.3
-      vitest: 4.1.4(@types/node@25.6.0)(happy-dom@20.9.0)(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1))
+      vitest: 4.1.7(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/expect@4.1.4':
+  '@vitest/expect@4.1.7':
     dependencies:
       '@standard-schema/spec': 1.1.0
       '@types/chai': 5.2.3
-      '@vitest/spy': 4.1.4
-      '@vitest/utils': 4.1.4
+      '@vitest/spy': 4.1.7
+      '@vitest/utils': 4.1.7
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.4(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1))':
+  '@vitest/mocker@4.1.7(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))':
     dependencies:
-      '@vitest/spy': 4.1.4
+      '@vitest/spy': 4.1.7
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1)
+      vite: 8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
 
-  '@vitest/pretty-format@4.1.4':
+  '@vitest/pretty-format@4.1.7':
     dependencies:
       tinyrainbow: 3.1.0
 
-  '@vitest/runner@4.1.4':
+  '@vitest/runner@4.1.7':
     dependencies:
-      '@vitest/utils': 4.1.4
+      '@vitest/utils': 4.1.7
       pathe: 2.0.3
 
-  '@vitest/snapshot@4.1.4':
+  '@vitest/snapshot@4.1.7':
     dependencies:
-      '@vitest/pretty-format': 4.1.4
-      '@vitest/utils': 4.1.4
+      '@vitest/pretty-format': 4.1.7
+      '@vitest/utils': 4.1.7
       magic-string: 0.30.21
       pathe: 2.0.3
 
-  '@vitest/spy@4.1.4': {}
+  '@vitest/spy@4.1.7': {}
 
-  '@vitest/utils@4.1.4':
+  '@vitest/utils@4.1.7':
     dependencies:
-      '@vitest/pretty-format': 4.1.4
+      '@vitest/pretty-format': 4.1.7
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.0
 
@@ -5611,100 +6630,125 @@ snapshots:
       path-browserify: 1.0.1
       vscode-uri: 3.1.0
 
-  '@vue/compiler-core@3.5.32':
+  '@vue/compiler-core@3.5.35':
     dependencies:
-      '@babel/parser': 7.29.2
-      '@vue/shared': 3.5.32
+      '@babel/parser': 7.29.7
+      '@vue/shared': 3.5.35
       entities: 7.0.1
       estree-walker: 2.0.2
       source-map-js: 1.2.1
 
-  '@vue/compiler-dom@3.5.32':
+  '@vue/compiler-dom@3.5.35':
     dependencies:
-      '@vue/compiler-core': 3.5.32
-      '@vue/shared': 3.5.32
+      '@vue/compiler-core': 3.5.35
+      '@vue/shared': 3.5.35
 
-  '@vue/compiler-sfc@3.5.32':
+  '@vue/compiler-sfc@3.5.35':
     dependencies:
-      '@babel/parser': 7.29.2
-      '@vue/compiler-core': 3.5.32
-      '@vue/compiler-dom': 3.5.32
-      '@vue/compiler-ssr': 3.5.32
-      '@vue/shared': 3.5.32
+      '@babel/parser': 7.29.7
+      '@vue/compiler-core': 3.5.35
+      '@vue/compiler-dom': 3.5.35
+      '@vue/compiler-ssr': 3.5.35
+      '@vue/shared': 3.5.35
       estree-walker: 2.0.2
       magic-string: 0.30.21
-      postcss: 8.5.10
+      postcss: 8.5.15
       source-map-js: 1.2.1
 
-  '@vue/compiler-ssr@3.5.32':
+  '@vue/compiler-ssr@3.5.35':
     dependencies:
-      '@vue/compiler-dom': 3.5.32
-      '@vue/shared': 3.5.32
+      '@vue/compiler-dom': 3.5.35
+      '@vue/shared': 3.5.35
 
-  '@vue/language-core@3.2.7':
+  '@vue/language-core@3.3.2':
     dependencies:
       '@volar/language-core': 2.4.28
-      '@vue/compiler-dom': 3.5.32
-      '@vue/shared': 3.5.32
-      alien-signals: 3.1.2
+      '@vue/compiler-dom': 3.5.35
+      '@vue/shared': 3.5.35
+      alien-signals: 3.2.1
       muggle-string: 0.4.1
       path-browserify: 1.0.1
       picomatch: 4.0.4
 
-  '@vue/reactivity@3.5.32':
+  '@vue/reactivity@3.5.35':
     dependencies:
-      '@vue/shared': 3.5.32
+      '@vue/shared': 3.5.35
 
-  '@vue/runtime-core@3.5.32':
+  '@vue/runtime-core@3.5.35':
     dependencies:
-      '@vue/reactivity': 3.5.32
-      '@vue/shared': 3.5.32
+      '@vue/reactivity': 3.5.35
+      '@vue/shared': 3.5.35
 
-  '@vue/runtime-dom@3.5.32':
+  '@vue/runtime-dom@3.5.35':
     dependencies:
-      '@vue/reactivity': 3.5.32
-      '@vue/runtime-core': 3.5.32
-      '@vue/shared': 3.5.32
+      '@vue/reactivity': 3.5.35
+      '@vue/runtime-core': 3.5.35
+      '@vue/shared': 3.5.35
       csstype: 3.2.3
 
-  '@vue/server-renderer@3.5.32(vue@3.5.32(typescript@6.0.3))':
+  '@vue/server-renderer@3.5.35(vue@3.5.35(typescript@6.0.3))':
     dependencies:
-      '@vue/compiler-ssr': 3.5.32
-      '@vue/shared': 3.5.32
-      vue: 3.5.32(typescript@6.0.3)
+      '@vue/compiler-ssr': 3.5.35
+      '@vue/shared': 3.5.35
+      vue: 3.5.35(typescript@6.0.3)
 
-  '@vue/shared@3.5.32': {}
+  '@vue/shared@3.5.35': {}
+
+  abab@2.0.6: {}
+
+  acorn-globals@7.0.1:
+    dependencies:
+      acorn: 8.16.0
+      acorn-walk: 8.3.5
 
   acorn-jsx@5.3.2(acorn@8.16.0):
     dependencies:
       acorn: 8.16.0
 
+  acorn-walk@8.3.5:
+    dependencies:
+      acorn: 8.16.0
+
   acorn@8.16.0: {}
 
-  ajv@6.14.0:
+  agent-base@6.0.2:
+    dependencies:
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  ajv@6.15.0:
     dependencies:
       fast-deep-equal: 3.1.3
       fast-json-stable-stringify: 2.1.0
       json-schema-traverse: 0.4.1
       uri-js: 4.4.1
 
-  ajv@8.18.0:
+  ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.0
+      fast-uri: 3.1.2
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
-  alien-signals@3.1.2: {}
+  alien-signals@3.2.1: {}
+
+  ansi-escapes@1.4.0: {}
+
+  ansi-regex@2.1.1: {}
 
   ansi-regex@5.0.1: {}
 
   ansi-regex@6.2.2: {}
 
+  ansi-styles@2.2.1: {}
+
   ansi-styles@4.3.0:
     dependencies:
       color-convert: 2.0.1
 
+  ansi-styles@5.2.0: {}
+
   ansi_up@6.0.6: {}
 
   any-promise@1.3.0: {}
@@ -5720,11 +6764,67 @@ snapshots:
 
   aria-query@5.3.2: {}
 
+  array-buffer-byte-length@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      is-array-buffer: 3.0.5
+
+  array-includes@3.1.9:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.2
+      get-intrinsic: 1.3.0
+      is-string: 1.1.1
+      math-intrinsics: 1.1.0
+
+  array.prototype.findlastindex@1.2.6:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.flat@1.3.3:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.flatmap@1.3.3:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-shim-unscopables: 1.1.0
+
+  arraybuffer.prototype.slice@1.0.4:
+    dependencies:
+      array-buffer-byte-length: 1.0.2
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      is-array-buffer: 3.0.5
+
   asciinema-player@3.15.1:
     dependencies:
-      '@babel/runtime': 7.29.2
-      solid-js: 1.9.12
-      solid-transition-group: 0.2.3(solid-js@1.9.12)
+      '@babel/runtime': 7.29.7
+      solid-js: 1.9.13
+      solid-transition-group: 0.2.3(solid-js@1.9.13)
+
+  asn1@0.2.6:
+    dependencies:
+      safer-buffer: 2.1.2
+
+  assert-plus@1.0.0: {}
 
   assertion-error@2.0.1: {}
 
@@ -5732,7 +6832,19 @@ snapshots:
 
   astral-regex@2.0.0: {}
 
-  axe-core@4.11.3: {}
+  async-function@1.0.0: {}
+
+  asynckit@0.4.0: {}
+
+  available-typed-arrays@1.0.7:
+    dependencies:
+      possible-typed-array-names: 1.1.0
+
+  aws-sign2@0.7.0: {}
+
+  aws4@1.13.2: {}
+
+  axe-core@4.12.0: {}
 
   axobject-query@4.1.0: {}
 
@@ -5742,18 +6854,36 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  baseline-browser-mapping@2.10.20: {}
+  baseline-browser-mapping@2.10.33: {}
+
+  bcrypt-pbkdf@1.0.2:
+    dependencies:
+      tweetnacl: 0.14.5
 
   binary-extensions@2.3.0: {}
 
+  biome@0.3.3:
+    dependencies:
+      bluebird: 3.7.2
+      chalk: 1.1.3
+      commander: 2.20.3
+      editor: 1.0.0
+      fs-promise: 0.5.0
+      inquirer-promise: 0.0.3
+      request-promise: 3.0.0
+      untildify: 3.0.3
+      user-home: 2.0.0
+
+  bluebird@3.7.2: {}
+
   boolbase@1.0.0: {}
 
-  brace-expansion@1.1.14:
+  brace-expansion@1.1.15:
     dependencies:
       balanced-match: 1.0.2
       concat-map: 0.0.1
 
-  brace-expansion@5.0.5:
+  brace-expansion@5.0.6:
     dependencies:
       balanced-match: 4.0.4
 
@@ -5763,10 +6893,10 @@ snapshots:
 
   browserslist@4.28.2:
     dependencies:
-      baseline-browser-mapping: 2.10.20
-      caniuse-lite: 1.0.30001788
-      electron-to-chromium: 1.5.340
-      node-releases: 2.0.37
+      baseline-browser-mapping: 2.10.33
+      caniuse-lite: 1.0.30001793
+      electron-to-chromium: 1.5.364
+      node-releases: 2.0.46
       update-browserslist-db: 1.2.3(browserslist@4.28.2)
 
   buffer@5.7.1:
@@ -5776,26 +6906,58 @@ snapshots:
 
   builtin-modules@3.3.0: {}
 
-  builtin-modules@5.1.0: {}
+  builtin-modules@5.2.0: {}
 
   bytes@3.1.2: {}
 
-  cacheable@2.3.4:
+  cacheable@2.3.5:
     dependencies:
-      '@cacheable/memory': 2.0.8
+      '@cacheable/memory': 2.0.9
       '@cacheable/utils': 2.4.1
       hookified: 1.15.1
       keyv: 5.6.0
-      qified: 0.9.1
+      qified: 0.10.1
+
+  call-bind-apply-helpers@1.0.2:
+    dependencies:
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+
+  call-bind@1.0.9:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      get-intrinsic: 1.3.0
+      set-function-length: 1.2.2
+
+  call-bound@1.0.4:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      get-intrinsic: 1.3.0
 
   callsites@3.1.0: {}
 
   camelcase-css@2.0.1: {}
 
-  caniuse-lite@1.0.30001788: {}
+  caniuse-lite@1.0.30001793: {}
+
+  caseless@0.12.0: {}
 
   chai@6.2.2: {}
 
+  chalk@1.1.3:
+    dependencies:
+      ansi-styles: 2.2.1
+      escape-string-regexp: 1.0.5
+      has-ansi: 2.0.0
+      strip-ansi: 3.0.1
+      supports-color: 2.0.0
+
+  chalk@4.1.2:
+    dependencies:
+      ansi-styles: 4.3.0
+      supports-color: 7.2.0
+
   change-case@5.4.4: {}
 
   character-entities-legacy@3.0.0: {}
@@ -5808,10 +6970,10 @@ snapshots:
     dependencies:
       '@kurkle/color': 0.3.4
 
-  chartjs-adapter-dayjs-4@1.0.4(chart.js@4.5.1)(dayjs@1.11.20):
+  chartjs-adapter-dayjs-4@1.0.4(chart.js@4.5.1)(dayjs@1.11.21):
     dependencies:
       chart.js: 4.5.1
-      dayjs: 1.11.20
+      dayjs: 1.11.21
 
   chartjs-plugin-zoom@2.2.0(chart.js@4.5.1):
     dependencies:
@@ -5819,19 +6981,6 @@ snapshots:
       chart.js: 4.5.1
       hammerjs: 2.0.8
 
-  chevrotain-allstar@0.4.1(chevrotain@12.0.0):
-    dependencies:
-      chevrotain: 12.0.0
-      lodash-es: 4.18.1
-
-  chevrotain@12.0.0:
-    dependencies:
-      '@chevrotain/cst-dts-gen': 12.0.0
-      '@chevrotain/gast': 12.0.0
-      '@chevrotain/regexp-to-ast': 12.0.0
-      '@chevrotain/types': 12.0.0
-      '@chevrotain/utils': 12.0.0
-
   chokidar@3.6.0:
     dependencies:
       anymatch: 3.1.3
@@ -5846,6 +6995,8 @@ snapshots:
 
   chroma-js@3.2.0: {}
 
+  ci-info@3.9.0: {}
+
   ci-info@4.4.0: {}
 
   citeproc@2.4.63: {}
@@ -5854,7 +7005,15 @@ snapshots:
     dependencies:
       escape-string-regexp: 1.0.5
 
-  clippie@4.1.14: {}
+  cli-cursor@1.0.2:
+    dependencies:
+      restore-cursor: 1.0.1
+
+  cli-width@1.1.1: {}
+
+  clippie@4.2.0: {}
+
+  code-point-at@1.1.0: {}
 
   codemirror-lang-elixir@4.0.1:
     dependencies:
@@ -5863,7 +7022,7 @@ snapshots:
 
   codemirror-spell-checker@1.1.2:
     dependencies:
-      typo-js: 1.3.1
+      typo-js: 1.3.2
 
   codemirror@5.65.21: {}
 
@@ -5875,32 +7034,40 @@ snapshots:
 
   colord@2.9.3: {}
 
+  combined-stream@1.0.8:
+    dependencies:
+      delayed-stream: 1.0.0
+
   commander@11.1.0: {}
 
   commander@14.0.3: {}
 
+  commander@2.20.3: {}
+
   commander@4.1.1: {}
 
   commander@7.2.0: {}
 
   commander@8.3.0: {}
 
-  comment-parser@1.4.6: {}
+  comment-parser@1.4.7: {}
 
   compare-versions@6.1.1: {}
 
   concat-map@0.0.1: {}
 
-  confbox@0.1.8: {}
-
   convert-source-map@2.0.0: {}
 
   core-js-compat@3.49.0:
     dependencies:
       browserslist: 4.28.2
 
+  core-js@2.6.12: {}
+
   core-js@3.32.2: {}
 
+  core-util-is@1.0.2: {}
+
   cose-base@1.0.3:
     dependencies:
       layout-base: 1.0.2
@@ -5956,19 +7123,27 @@ snapshots:
     dependencies:
       css-tree: 2.2.1
 
+  cssom@0.3.8: {}
+
+  cssom@0.5.0: {}
+
+  cssstyle@2.3.0:
+    dependencies:
+      cssom: 0.3.8
+
   csstype@3.2.3: {}
 
-  cytoscape-cose-bilkent@4.1.0(cytoscape@3.33.2):
+  cytoscape-cose-bilkent@4.1.0(cytoscape@3.33.4):
     dependencies:
       cose-base: 1.0.3
-      cytoscape: 3.33.2
+      cytoscape: 3.33.4
 
-  cytoscape-fcose@2.2.0(cytoscape@3.33.2):
+  cytoscape-fcose@2.2.0(cytoscape@3.33.4):
     dependencies:
       cose-base: 2.2.0
-      cytoscape: 3.33.2
+      cytoscape: 3.33.4
 
-  cytoscape@3.33.2: {}
+  cytoscape@3.33.4: {}
 
   d3-array@2.12.1:
     dependencies:
@@ -6144,7 +7319,35 @@ snapshots:
 
   damerau-levenshtein@1.0.8: {}
 
-  dayjs@1.11.20: {}
+  dashdash@1.14.1:
+    dependencies:
+      assert-plus: 1.0.0
+
+  data-urls@3.0.2:
+    dependencies:
+      abab: 2.0.6
+      whatwg-mimetype: 3.0.0
+      whatwg-url: 11.0.0
+
+  data-view-buffer@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  data-view-byte-length@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  data-view-byte-offset@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  dayjs@1.11.21: {}
 
   debug@3.2.7:
     dependencies:
@@ -6154,6 +7357,8 @@ snapshots:
     dependencies:
       ms: 2.1.3
 
+  decimal.js@10.6.0: {}
+
   decode-named-character-reference@1.3.0:
     dependencies:
       character-entities: 2.0.2
@@ -6167,10 +7372,24 @@ snapshots:
       kind-of: 3.2.2
       rename-keys: 1.2.0
 
+  define-data-property@1.1.4:
+    dependencies:
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  define-properties@1.2.1:
+    dependencies:
+      define-data-property: 1.1.4
+      has-property-descriptors: 1.0.2
+      object-keys: 1.1.1
+
   delaunator@5.1.0:
     dependencies:
       robust-predicates: 3.0.3
 
+  delayed-stream@1.0.0: {}
+
   dequal@2.0.3: {}
 
   detect-libc@2.1.2: {}
@@ -6197,11 +7416,15 @@ snapshots:
 
   domelementtype@2.3.0: {}
 
+  domexception@4.0.0:
+    dependencies:
+      webidl-conversions: 7.0.0
+
   domhandler@5.0.3:
     dependencies:
       domelementtype: 2.3.0
 
-  dompurify@3.4.0:
+  dompurify@3.4.7:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
@@ -6211,7 +7434,20 @@ snapshots:
       domelementtype: 2.3.0
       domhandler: 5.0.3
 
-  easymde@2.20.0:
+  dunder-proto@1.0.1:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  earlgrey-runtime@0.1.2:
+    dependencies:
+      core-js: 2.6.12
+      kaiser: 0.0.4
+      lodash: 4.18.1
+      regenerator-runtime: 0.9.6
+
+  easymde@2.21.0:
     dependencies:
       '@types/codemirror': 5.60.17
       '@types/marked': 4.3.2
@@ -6219,7 +7455,14 @@ snapshots:
       codemirror-spell-checker: 1.1.2
       marked: 4.3.0
 
-  electron-to-chromium@1.5.340: {}
+  ecc-jsbn@0.1.2:
+    dependencies:
+      jsbn: 0.1.1
+      safer-buffer: 2.1.2
+
+  editor@1.0.0: {}
+
+  electron-to-chromium@1.5.364: {}
 
   elkjs@0.9.3: {}
 
@@ -6229,6 +7472,8 @@ snapshots:
 
   entities@4.5.0: {}
 
+  entities@6.0.1: {}
+
   entities@7.0.1: {}
 
   env-paths@2.2.1: {}
@@ -6237,9 +7482,91 @@ snapshots:
     dependencies:
       is-arrayish: 0.2.1
 
+  es-abstract@1.24.2:
+    dependencies:
+      array-buffer-byte-length: 1.0.2
+      arraybuffer.prototype.slice: 1.0.4
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      data-view-buffer: 1.0.2
+      data-view-byte-length: 1.0.2
+      data-view-byte-offset: 1.0.1
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      es-set-tostringtag: 2.1.0
+      es-to-primitive: 1.3.0
+      function.prototype.name: 1.1.8
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      get-symbol-description: 1.1.0
+      globalthis: 1.0.4
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+      has-proto: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.4
+      internal-slot: 1.1.0
+      is-array-buffer: 3.0.5
+      is-callable: 1.2.7
+      is-data-view: 1.0.2
+      is-negative-zero: 2.0.3
+      is-regex: 1.2.1
+      is-set: 2.0.3
+      is-shared-array-buffer: 1.0.4
+      is-string: 1.1.1
+      is-typed-array: 1.1.15
+      is-weakref: 1.1.1
+      math-intrinsics: 1.1.0
+      object-inspect: 1.13.4
+      object-keys: 1.1.1
+      object.assign: 4.1.7
+      own-keys: 1.0.1
+      regexp.prototype.flags: 1.5.4
+      safe-array-concat: 1.1.4
+      safe-push-apply: 1.0.0
+      safe-regex-test: 1.1.0
+      set-proto: 1.0.0
+      stop-iteration-iterator: 1.1.0
+      string.prototype.trim: 1.2.10
+      string.prototype.trimend: 1.0.9
+      string.prototype.trimstart: 1.0.8
+      typed-array-buffer: 1.0.3
+      typed-array-byte-length: 1.0.3
+      typed-array-byte-offset: 1.0.4
+      typed-array-length: 1.0.8
+      unbox-primitive: 1.1.0
+      which-typed-array: 1.1.21
+
+  es-define-property@1.0.1: {}
+
   es-errors@1.3.0: {}
 
-  es-module-lexer@2.0.0: {}
+  es-module-lexer@2.1.0: {}
+
+  es-object-atoms@1.1.2:
+    dependencies:
+      es-errors: 1.3.0
+
+  es-set-tostringtag@2.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.4
+
+  es-shim-unscopables@1.1.0:
+    dependencies:
+      hasown: 2.0.4
+
+  es-to-primitive@1.3.0:
+    dependencies:
+      is-callable: 1.2.7
+      is-date-object: 1.1.0
+      is-symbol: 1.1.1
+
+  es-toolkit@1.47.0: {}
 
   esbuild@0.28.0:
     optionalDependencies:
@@ -6274,274 +7601,284 @@ snapshots:
 
   escape-string-regexp@1.0.5: {}
 
+  escape-string-regexp@2.0.0: {}
+
   escape-string-regexp@4.0.0: {}
 
-  eslint-config-prettier@10.1.8(eslint@10.2.1(jiti@2.6.1)):
+  escodegen@2.1.0:
     dependencies:
-      eslint: 10.2.1(jiti@2.6.1)
+      esprima: 4.0.1
+      estraverse: 5.3.0
+      esutils: 2.0.3
+    optionalDependencies:
+      source-map: 0.6.1
 
-  eslint-import-context@0.1.9(unrs-resolver@1.11.1):
+  eslint-config-prettier@10.1.8(eslint@10.4.0(jiti@2.7.0)):
+    dependencies:
+      eslint: 10.4.0(jiti@2.7.0)
+
+  eslint-import-context@0.1.9(unrs-resolver@1.12.2):
     dependencies:
       get-tsconfig: 4.14.0
       stable-hash-x: 0.2.0
     optionalDependencies:
-      unrs-resolver: 1.11.1
+      unrs-resolver: 1.12.2
 
   eslint-import-resolver-node@0.3.10:
     dependencies:
       debug: 3.2.7
-      is-core-module: '@nolyfill/is-core-module@1.0.39'
-      resolve: 2.0.0-next.6
+      is-core-module: 2.16.2
+      resolve: 2.0.0-next.7
     transitivePeerDependencies:
       - supports-color
 
-  eslint-import-resolver-typescript@4.4.4(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.2.1(jiti@2.6.1)))(eslint-plugin-import@2.32.0)(eslint@10.2.1(jiti@2.6.1)):
+  eslint-import-resolver-typescript@4.4.4(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
       debug: 4.4.3
-      eslint: 10.2.1(jiti@2.6.1)
-      eslint-import-context: 0.1.9(unrs-resolver@1.11.1)
+      eslint: 10.4.0(jiti@2.7.0)
+      eslint-import-context: 0.1.9(unrs-resolver@1.12.2)
       get-tsconfig: 4.14.0
       is-bun-module: 2.0.0
       stable-hash-x: 0.2.0
-      tinyglobby: 0.2.16
-      unrs-resolver: 1.11.1
+      tinyglobby: 0.2.17
+      unrs-resolver: 1.12.2
     optionalDependencies:
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.4)(eslint@10.2.1(jiti@2.6.1))
-      eslint-plugin-import-x: 4.16.2(@typescript-eslint/utils@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.2.1(jiti@2.6.1))
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0))
+      eslint-plugin-import-x: 4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0))
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.12.1(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.4)(eslint@10.2.1(jiti@2.6.1)):
+  eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
-      '@typescript-eslint/parser': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
-      eslint: 10.2.1(jiti@2.6.1)
+      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      eslint: 10.4.0(jiti@2.7.0)
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 4.4.4(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.2.1(jiti@2.6.1)))(eslint-plugin-import@2.32.0)(eslint@10.2.1(jiti@2.6.1))
+      eslint-import-resolver-typescript: 4.4.4(eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0)))(eslint-plugin-import@2.32.0)(eslint@10.4.0(jiti@2.7.0))
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-array-func@5.1.1(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-array-func@5.1.1(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
 
-  eslint-plugin-de-morgan@2.1.1(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-de-morgan@2.1.2(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
 
-  eslint-plugin-escompat@3.11.4(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-escompat@3.11.4(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
       browserslist: 4.28.2
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
 
-  eslint-plugin-eslint-comments@3.2.0(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-eslint-comments@3.2.0(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
       escape-string-regexp: 1.0.5
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
       ignore: 5.3.2
 
-  eslint-plugin-filenames@1.3.2(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-filenames@1.3.2(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
       lodash.camelcase: 4.3.0
       lodash.kebabcase: 4.1.1
       lodash.snakecase: 4.1.1
       lodash.upperfirst: 4.3.1
 
-  eslint-plugin-github@6.0.0(eslint-import-resolver-typescript@4.4.4)(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-github@6.0.0(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
-      '@eslint/compat': 1.4.1(eslint@10.2.1(jiti@2.6.1))
+      '@eslint/compat': 1.4.1(eslint@10.4.0(jiti@2.7.0))
       '@eslint/eslintrc': 3.3.5
       '@eslint/js': 9.39.4
       '@github/browserslist-config': 1.0.0
-      '@typescript-eslint/eslint-plugin': 8.59.0(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)
-      '@typescript-eslint/parser': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)
+      '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
       aria-query: 5.3.2
-      eslint: 10.2.1(jiti@2.6.1)
-      eslint-config-prettier: 10.1.8(eslint@10.2.1(jiti@2.6.1))
-      eslint-plugin-escompat: 3.11.4(eslint@10.2.1(jiti@2.6.1))
-      eslint-plugin-eslint-comments: 3.2.0(eslint@10.2.1(jiti@2.6.1))
-      eslint-plugin-filenames: 1.3.2(eslint@10.2.1(jiti@2.6.1))
-      eslint-plugin-i18n-text: 1.0.1(eslint@10.2.1(jiti@2.6.1))
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.4)(eslint@10.2.1(jiti@2.6.1))
-      eslint-plugin-jsx-a11y: 6.10.2(eslint@10.2.1(jiti@2.6.1))
-      eslint-plugin-no-only-tests: 3.3.0
-      eslint-plugin-prettier: 5.5.5(eslint-config-prettier@10.1.8(eslint@10.2.1(jiti@2.6.1)))(eslint@10.2.1(jiti@2.6.1))(prettier@3.8.3)
+      eslint: 10.4.0(jiti@2.7.0)
+      eslint-config-prettier: 10.1.8(eslint@10.4.0(jiti@2.7.0))
+      eslint-plugin-escompat: 3.11.4(eslint@10.4.0(jiti@2.7.0))
+      eslint-plugin-eslint-comments: 3.2.0(eslint@10.4.0(jiti@2.7.0))
+      eslint-plugin-filenames: 1.3.2(eslint@10.4.0(jiti@2.7.0))
+      eslint-plugin-i18n-text: 1.0.1(eslint@10.4.0(jiti@2.7.0))
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0))
+      eslint-plugin-jsx-a11y: 6.10.2(eslint@10.4.0(jiti@2.7.0))
+      eslint-plugin-no-only-tests: 3.4.0
+      eslint-plugin-prettier: 5.5.6(eslint-config-prettier@10.1.8(eslint@10.4.0(jiti@2.7.0)))(eslint@10.4.0(jiti@2.7.0))(prettier@3.8.3)
       eslint-rule-documentation: 1.0.23
       globals: 16.5.0
       jsx-ast-utils: 3.3.5
       prettier: 3.8.3
       svg-element-attributes: 1.3.1
       typescript: 5.9.3
-      typescript-eslint: 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)
+      typescript-eslint: 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
     transitivePeerDependencies:
       - '@types/eslint'
       - eslint-import-resolver-typescript
       - eslint-import-resolver-webpack
       - supports-color
 
-  eslint-plugin-i18n-text@1.0.1(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-i18n-text@1.0.1(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
 
-  eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-import-x@4.16.2(@typescript-eslint/utils@8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
       '@package-json/types': 0.0.12
-      '@typescript-eslint/types': 8.59.0
-      comment-parser: 1.4.6
+      '@typescript-eslint/types': 8.60.1
+      comment-parser: 1.4.7
       debug: 4.4.3
-      eslint: 10.2.1(jiti@2.6.1)
-      eslint-import-context: 0.1.9(unrs-resolver@1.11.1)
+      eslint: 10.4.0(jiti@2.7.0)
+      eslint-import-context: 0.1.9(unrs-resolver@1.12.2)
       is-glob: 4.0.3
       minimatch: 10.2.5
-      semver: 7.7.4
+      semver: 7.8.1
       stable-hash-x: 0.2.0
-      unrs-resolver: 1.11.1
+      unrs-resolver: 1.12.2
     optionalDependencies:
-      '@typescript-eslint/utils': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
       eslint-import-resolver-node: 0.3.10
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.4)(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
       '@rtsao/scc': 1.1.0
-      array-includes: '@nolyfill/array-includes@1.0.44'
-      array.prototype.findlastindex: '@nolyfill/array.prototype.findlastindex@1.0.44'
-      array.prototype.flat: '@nolyfill/array.prototype.flat@1.0.44'
-      array.prototype.flatmap: '@nolyfill/array.prototype.flatmap@1.0.44'
+      array-includes: 3.1.9
+      array.prototype.findlastindex: 1.2.6
+      array.prototype.flat: 1.3.3
+      array.prototype.flatmap: 1.3.3
       debug: 3.2.7
       doctrine: 2.1.0
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
       eslint-import-resolver-node: 0.3.10
-      eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.4)(eslint@10.2.1(jiti@2.6.1))
-      hasown: '@nolyfill/hasown@1.0.44'
-      is-core-module: '@nolyfill/is-core-module@1.0.39'
+      eslint-module-utils: 2.13.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.4)(eslint@10.4.0(jiti@2.7.0))
+      hasown: 2.0.4
+      is-core-module: 2.16.2
       is-glob: 4.0.3
       minimatch: 3.1.5
-      object.fromentries: '@nolyfill/object.fromentries@1.0.44'
-      object.groupby: '@nolyfill/object.groupby@1.0.44'
-      object.values: '@nolyfill/object.values@1.0.44'
+      object.fromentries: 2.0.8
+      object.groupby: 1.0.3
+      object.values: 1.2.1
       semver: 6.3.1
-      string.prototype.trimend: '@nolyfill/string.prototype.trimend@1.0.44'
+      string.prototype.trimend: 1.0.9
       tsconfig-paths: 3.15.0
     optionalDependencies:
-      '@typescript-eslint/parser': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
     transitivePeerDependencies:
       - eslint-import-resolver-typescript
       - eslint-import-resolver-webpack
       - supports-color
 
-  eslint-plugin-jsx-a11y@6.10.2(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-jsx-a11y@6.10.2(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
       aria-query: 5.3.2
-      array-includes: '@nolyfill/array-includes@1.0.44'
-      array.prototype.flatmap: '@nolyfill/array.prototype.flatmap@1.0.44'
+      array-includes: 3.1.9
+      array.prototype.flatmap: 1.3.3
       ast-types-flow: 0.0.8
-      axe-core: 4.11.3
+      axe-core: 4.12.0
       axobject-query: 4.1.0
       damerau-levenshtein: 1.0.8
       emoji-regex: 9.2.2
-      eslint: 10.2.1(jiti@2.6.1)
-      hasown: '@nolyfill/hasown@1.0.44'
+      eslint: 10.4.0(jiti@2.7.0)
+      hasown: 2.0.4
       jsx-ast-utils: 3.3.5
       language-tags: 1.0.9
       minimatch: 3.1.5
-      object.fromentries: '@nolyfill/object.fromentries@1.0.44'
-      safe-regex-test: '@nolyfill/safe-regex-test@1.0.44'
-      string.prototype.includes: '@nolyfill/string.prototype.includes@1.0.44'
+      object.fromentries: 2.0.8
+      safe-regex-test: 1.1.0
+      string.prototype.includes: 2.0.1
 
-  eslint-plugin-no-only-tests@3.3.0: {}
+  eslint-plugin-no-only-tests@3.4.0: {}
 
-  eslint-plugin-playwright@2.10.2(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-playwright@2.10.4(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
-      eslint: 10.2.1(jiti@2.6.1)
-      globals: 17.5.0
+      eslint: 10.4.0(jiti@2.7.0)
+      globals: 17.6.0
 
-  eslint-plugin-prettier@5.5.5(eslint-config-prettier@10.1.8(eslint@10.2.1(jiti@2.6.1)))(eslint@10.2.1(jiti@2.6.1))(prettier@3.8.3):
+  eslint-plugin-prettier@5.5.6(eslint-config-prettier@10.1.8(eslint@10.4.0(jiti@2.7.0)))(eslint@10.4.0(jiti@2.7.0))(prettier@3.8.3):
     dependencies:
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
       prettier: 3.8.3
       prettier-linter-helpers: 1.0.1
-      synckit: 0.11.12
+      synckit: 0.11.13
     optionalDependencies:
-      eslint-config-prettier: 10.1.8(eslint@10.2.1(jiti@2.6.1))
+      eslint-config-prettier: 10.1.8(eslint@10.4.0(jiti@2.7.0))
 
-  eslint-plugin-regexp@3.1.0(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-regexp@3.1.0(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.2.1(jiti@2.6.1))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
       '@eslint-community/regexpp': 4.12.2
-      comment-parser: 1.4.6
-      eslint: 10.2.1(jiti@2.6.1)
+      comment-parser: 1.4.7
+      eslint: 10.4.0(jiti@2.7.0)
       jsdoc-type-pratt-parser: 7.2.0
       refa: 0.12.1
       regexp-ast-analysis: 0.7.1
       scslre: 0.3.0
 
-  eslint-plugin-sonarjs@4.0.3(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-sonarjs@4.0.3(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
       '@eslint-community/regexpp': 4.12.2
       builtin-modules: 3.3.0
       bytes: 3.1.2
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
       functional-red-black-tree: 1.0.1
-      globals: 17.5.0
+      globals: 17.6.0
       jsx-ast-utils-x: 0.1.0
       lodash.merge: 4.6.2
       minimatch: 10.2.5
       scslre: 0.3.0
-      semver: 7.7.4
+      semver: 7.8.1
       ts-api-utils: 2.5.0(typescript@6.0.3)
       typescript: 6.0.3
 
-  eslint-plugin-unicorn@64.0.0(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-unicorn@64.0.0(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
-      '@babel/helper-validator-identifier': 7.28.5
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.2.1(jiti@2.6.1))
+      '@babel/helper-validator-identifier': 7.29.7
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
       change-case: 5.4.4
       ci-info: 4.4.0
       clean-regexp: 1.0.0
       core-js-compat: 3.49.0
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
       find-up-simple: 1.0.1
-      globals: 17.5.0
+      globals: 17.6.0
       indent-string: 5.0.0
       is-builtin-module: 5.0.0
       jsesc: 3.1.0
       pluralize: 8.0.0
       regexp-tree: 0.1.27
       regjsparser: 0.13.1
-      semver: 7.7.4
+      semver: 7.8.1
       strip-indent: 4.1.1
 
-  eslint-plugin-vue-scoped-css@3.0.0(eslint@10.2.1(jiti@2.6.1))(vue-eslint-parser@10.4.0(eslint@10.2.1(jiti@2.6.1))):
+  eslint-plugin-vue-scoped-css@3.1.0(eslint@10.4.0(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.0(jiti@2.7.0))):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.2.1(jiti@2.6.1))
-      eslint: 10.2.1(jiti@2.6.1)
-      lodash: 4.18.1
-      postcss: 8.5.10
-      postcss-safe-parser: 7.0.1(postcss@8.5.10)
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      es-toolkit: 1.47.0
+      eslint: 10.4.0(jiti@2.7.0)
+      postcss: 8.5.15
+      postcss-safe-parser: 7.0.1(postcss@8.5.15)
       postcss-selector-parser: 7.1.1
-      vue-eslint-parser: 10.4.0(eslint@10.2.1(jiti@2.6.1))
+      vue-eslint-parser: 10.4.0(eslint@10.4.0(jiti@2.7.0))
 
-  eslint-plugin-vue@10.8.0(@stylistic/eslint-plugin@5.10.0(eslint@10.2.1(jiti@2.6.1)))(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(vue-eslint-parser@10.4.0(eslint@10.2.1(jiti@2.6.1))):
+  eslint-plugin-vue@10.9.1(@stylistic/eslint-plugin@5.10.0(eslint@10.4.0(jiti@2.7.0)))(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(vue-eslint-parser@10.4.0(eslint@10.4.0(jiti@2.7.0))):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.2.1(jiti@2.6.1))
-      eslint: 10.2.1(jiti@2.6.1)
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
+      eslint: 10.4.0(jiti@2.7.0)
       natural-compare: 1.4.0
       nth-check: 2.1.1
       postcss-selector-parser: 7.1.1
-      semver: 7.7.4
-      vue-eslint-parser: 10.4.0(eslint@10.2.1(jiti@2.6.1))
+      semver: 7.8.1
+      vue-eslint-parser: 10.4.0(eslint@10.4.0(jiti@2.7.0))
       xml-name-validator: 4.0.0
     optionalDependencies:
-      '@stylistic/eslint-plugin': 5.10.0(eslint@10.2.1(jiti@2.6.1))
-      '@typescript-eslint/parser': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
+      '@stylistic/eslint-plugin': 5.10.0(eslint@10.4.0(jiti@2.7.0))
+      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
 
-  eslint-plugin-wc@3.1.0(eslint@10.2.1(jiti@2.6.1)):
+  eslint-plugin-wc@3.1.0(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
       is-valid-element-name: 1.0.0
       js-levenshtein-esm: 2.0.0
 
@@ -6550,7 +7887,7 @@ snapshots:
   eslint-scope@9.1.2:
     dependencies:
       '@types/esrecurse': 4.3.1
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
       esrecurse: 4.3.0
       estraverse: 5.3.0
 
@@ -6560,19 +7897,19 @@ snapshots:
 
   eslint-visitor-keys@5.0.1: {}
 
-  eslint@10.2.1(jiti@2.6.1):
+  eslint@10.4.0(jiti@2.7.0):
     dependencies:
-      '@eslint-community/eslint-utils': 4.9.1(eslint@10.2.1(jiti@2.6.1))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@10.4.0(jiti@2.7.0))
       '@eslint-community/regexpp': 4.12.2
       '@eslint/config-array': 0.23.5
-      '@eslint/config-helpers': 0.5.5
+      '@eslint/config-helpers': 0.6.0
       '@eslint/core': 1.2.1
-      '@eslint/plugin-kit': 0.7.1
+      '@eslint/plugin-kit': 0.7.2
       '@humanfs/node': 0.16.8
       '@humanwhocodes/module-importer': 1.0.1
       '@humanwhocodes/retry': 0.4.3
-      '@types/estree': 1.0.8
-      ajv: 6.14.0
+      '@types/estree': 1.0.9
+      ajv: 6.15.0
       cross-spawn: 7.0.6
       debug: 4.4.3
       escape-string-regexp: 4.0.0
@@ -6593,7 +7930,7 @@ snapshots:
       natural-compare: 1.4.0
       optionator: 0.9.4
     optionalDependencies:
-      jiti: 2.6.1
+      jiti: 2.7.0
     transitivePeerDependencies:
       - supports-color
 
@@ -6609,6 +7946,8 @@ snapshots:
       acorn-jsx: 5.3.2(acorn@8.16.0)
       eslint-visitor-keys: 5.0.1
 
+  esprima@4.0.1: {}
+
   esquery@1.7.0:
     dependencies:
       estraverse: 5.3.0
@@ -6623,7 +7962,7 @@ snapshots:
 
   estree-walker@3.0.3:
     dependencies:
-      '@types/estree': 1.0.8
+      '@types/estree': 1.0.9
 
   esutils@2.0.3: {}
 
@@ -6631,8 +7970,14 @@ snapshots:
 
   events@3.3.0: {}
 
+  exit-hook@1.1.1: {}
+
   expect-type@1.3.0: {}
 
+  extend@3.0.2: {}
+
+  extsprintf@1.3.0: {}
+
   fast-deep-equal@3.1.3: {}
 
   fast-diff@1.3.0: {}
@@ -6649,7 +7994,7 @@ snapshots:
 
   fast-levenshtein@2.0.6: {}
 
-  fast-uri@3.1.0: {}
+  fast-uri@3.1.2: {}
 
   fastest-levenshtein@1.0.16: {}
 
@@ -6669,7 +8014,12 @@ snapshots:
 
   fflate@0.8.2: {}
 
-  file-entry-cache@11.1.2:
+  figures@1.7.0:
+    dependencies:
+      escape-string-regexp: 1.0.5
+      object-assign: 4.1.1
+
+  file-entry-cache@11.1.3:
     dependencies:
       flat-cache: 6.1.22
 
@@ -6695,26 +8045,106 @@ snapshots:
 
   flat-cache@6.1.22:
     dependencies:
-      cacheable: 2.3.4
+      cacheable: 2.3.5
       flatted: 3.4.2
       hookified: 1.15.1
 
   flatted@3.4.2: {}
 
+  for-each@0.3.5:
+    dependencies:
+      is-callable: 1.2.7
+
+  forever-agent@0.6.1: {}
+
+  form-data@2.3.3:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      mime-types: 2.1.35
+
+  form-data@4.0.5:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      es-set-tostringtag: 2.1.0
+      hasown: 2.0.4
+      mime-types: 2.1.35
+
+  fs-extra@0.26.7:
+    dependencies:
+      graceful-fs: 4.2.11
+      jsonfile: 2.4.0
+      klaw: 1.3.1
+      path-is-absolute: 1.0.1
+      rimraf: 2.7.1
+
+  fs-promise@0.5.0:
+    dependencies:
+      any-promise: 1.3.0
+      fs-extra: 0.26.7
+      mz: 2.7.0
+      thenify-all: 1.6.0
+
+  fs.realpath@1.0.0: {}
+
   fsevents@2.3.2:
     optional: true
 
   fsevents@2.3.3:
     optional: true
 
+  function-bind@1.1.2: {}
+
+  function.prototype.name@1.1.8:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      functions-have-names: 1.2.3
+      hasown: 2.0.4
+      is-callable: 1.2.7
+
   functional-red-black-tree@1.0.1: {}
 
-  get-east-asian-width@1.5.0: {}
+  functions-have-names@1.2.3: {}
+
+  generator-function@2.0.1: {}
+
+  get-east-asian-width@1.6.0: {}
+
+  get-intrinsic@1.3.0:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      function-bind: 1.1.2
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.4
+      math-intrinsics: 1.1.0
+
+  get-proto@1.0.1:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-object-atoms: 1.1.2
+
+  get-symbol-description@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
 
   get-tsconfig@4.14.0:
     dependencies:
       resolve-pkg-maps: 1.0.0
 
+  getpass@0.1.7:
+    dependencies:
+      assert-plus: 1.0.0
+
   glob-parent@5.1.2:
     dependencies:
       is-glob: 4.0.3
@@ -6723,6 +8153,15 @@ snapshots:
     dependencies:
       is-glob: 4.0.3
 
+  glob@7.2.3:
+    dependencies:
+      fs.realpath: 1.0.0
+      inflight: 1.0.6
+      inherits: 2.0.4
+      minimatch: 3.1.5
+      once: 1.4.0
+      path-is-absolute: 1.0.1
+
   global-modules@2.0.0:
     dependencies:
       global-prefix: 3.0.0
@@ -6737,7 +8176,12 @@ snapshots:
 
   globals@16.5.0: {}
 
-  globals@17.5.0: {}
+  globals@17.6.0: {}
+
+  globalthis@1.0.4:
+    dependencies:
+      define-properties: 1.2.1
+      gopd: 1.2.0
 
   globby@16.2.0:
     dependencies:
@@ -6750,31 +8194,72 @@ snapshots:
 
   globjoin@0.1.4: {}
 
+  gopd@1.2.0: {}
+
+  graceful-fs@4.2.11: {}
+
   hachure-fill@0.5.2: {}
 
   hammerjs@2.0.8: {}
 
   happy-dom@20.9.0:
     dependencies:
-      '@types/node': 25.6.0
+      '@types/node': 25.9.1
       '@types/whatwg-mimetype': 3.0.2
       '@types/ws': 8.18.1
       entities: 7.0.1
       whatwg-mimetype: 3.0.0
-      ws: 8.20.0
+      ws: 8.21.0
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
+  har-schema@2.0.0: {}
+
+  har-validator@5.1.5:
+    dependencies:
+      ajv: 6.15.0
+      har-schema: 2.0.0
+
+  has-ansi@2.0.0:
+    dependencies:
+      ansi-regex: 2.1.1
+
+  has-bigints@1.1.0: {}
+
+  has-flag@4.0.0: {}
+
   has-flag@5.0.1: {}
 
+  has-property-descriptors@1.0.2:
+    dependencies:
+      es-define-property: 1.0.1
+
+  has-proto@1.2.0:
+    dependencies:
+      dunder-proto: 1.0.1
+
+  has-symbols@1.1.0: {}
+
+  has-tostringtag@1.0.2:
+    dependencies:
+      has-symbols: 1.1.0
+
   hashery@1.5.1:
     dependencies:
       hookified: 1.15.1
 
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
   hookified@1.15.1: {}
 
-  hookified@2.1.1: {}
+  hookified@2.2.0: {}
+
+  html-encoding-sniffer@3.0.0:
+    dependencies:
+      whatwg-encoding: 2.0.0
 
   html-tags@5.1.0: {}
 
@@ -6785,9 +8270,30 @@ snapshots:
       domutils: 3.2.2
       entities: 4.5.0
 
+  http-proxy-agent@5.0.0:
+    dependencies:
+      '@tootallnate/once': 2.0.1
+      agent-base: 6.0.2
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  http-signature@1.2.0:
+    dependencies:
+      assert-plus: 1.0.0
+      jsprim: 1.4.2
+      sshpk: 1.18.0
+
+  https-proxy-agent@5.0.1:
+    dependencies:
+      agent-base: 6.0.2
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
   iconv-lite@0.6.3:
     dependencies:
-      safer-buffer: '@nolyfill/safer-buffer@1.0.44'
+      safer-buffer: 2.1.2
 
   idiomorph@0.7.4: {}
 
@@ -6808,10 +8314,44 @@ snapshots:
 
   indent-string@5.0.0: {}
 
+  inflight@1.0.6:
+    dependencies:
+      once: 1.4.0
+      wrappy: 1.0.2
+
+  inherits@2.0.4: {}
+
   ini@1.3.8: {}
 
   ini@4.1.3: {}
 
+  inquirer-promise@0.0.3:
+    dependencies:
+      earlgrey-runtime: 0.1.2
+      inquirer: 0.11.4
+
+  inquirer@0.11.4:
+    dependencies:
+      ansi-escapes: 1.4.0
+      ansi-regex: 2.1.1
+      chalk: 1.1.3
+      cli-cursor: 1.0.2
+      cli-width: 1.1.1
+      figures: 1.7.0
+      lodash: 3.10.1
+      readline2: 1.0.1
+      run-async: 0.1.0
+      rx-lite: 3.1.2
+      string-width: 1.0.2
+      strip-ansi: 3.0.1
+      through: 2.3.8
+
+  internal-slot@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      hasown: 2.0.4
+      side-channel: 1.1.0
+
   internmap@1.0.1: {}
 
   internmap@2.0.3: {}
@@ -6823,51 +8363,201 @@ snapshots:
       is-alphabetical: 2.0.1
       is-decimal: 2.0.1
 
+  is-array-buffer@3.0.5:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+
   is-arrayish@0.2.1: {}
 
+  is-async-function@2.1.1:
+    dependencies:
+      async-function: 1.0.0
+      call-bound: 1.0.4
+      get-proto: 1.0.1
+      has-tostringtag: 1.0.2
+      safe-regex-test: 1.1.0
+
+  is-bigint@1.1.0:
+    dependencies:
+      has-bigints: 1.1.0
+
   is-binary-path@2.1.0:
     dependencies:
       binary-extensions: 2.3.0
 
+  is-boolean-object@1.2.2:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
   is-buffer@1.1.6: {}
 
   is-builtin-module@5.0.0:
     dependencies:
-      builtin-modules: 5.1.0
+      builtin-modules: 5.2.0
 
   is-bun-module@2.0.0:
     dependencies:
-      semver: 7.7.4
+      semver: 7.8.1
+
+  is-callable@1.2.7: {}
+
+  is-core-module@2.16.2:
+    dependencies:
+      hasown: 2.0.4
+
+  is-data-view@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+      is-typed-array: 1.1.15
+
+  is-date-object@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
 
   is-decimal@2.0.1: {}
 
   is-extglob@2.1.1: {}
 
+  is-finalizationregistry@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-fullwidth-code-point@1.0.0:
+    dependencies:
+      number-is-nan: 1.0.1
+
   is-fullwidth-code-point@3.0.0: {}
 
+  is-generator-function@1.1.2:
+    dependencies:
+      call-bound: 1.0.4
+      generator-function: 2.0.1
+      get-proto: 1.0.1
+      has-tostringtag: 1.0.2
+      safe-regex-test: 1.1.0
+
   is-glob@4.0.3:
     dependencies:
       is-extglob: 2.1.1
 
   is-hexadecimal@2.0.1: {}
 
+  is-map@2.0.3: {}
+
+  is-negative-zero@2.0.3: {}
+
+  is-number-object@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
   is-number@7.0.0: {}
 
   is-path-inside@4.0.0: {}
 
-  is-plain-object@5.0.0: {}
-
   is-potential-custom-element-name@1.0.1: {}
 
+  is-regex@1.2.1:
+    dependencies:
+      call-bound: 1.0.4
+      gopd: 1.2.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.4
+
+  is-set@2.0.3: {}
+
+  is-shared-array-buffer@1.0.4:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-string@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-symbol@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-symbols: 1.1.0
+      safe-regex-test: 1.1.0
+
+  is-typed-array@1.1.15:
+    dependencies:
+      which-typed-array: 1.1.21
+
+  is-typedarray@1.0.0: {}
+
   is-valid-element-name@1.0.0:
     dependencies:
       is-potential-custom-element-name: 1.0.1
 
+  is-weakmap@2.0.2: {}
+
+  is-weakref@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-weakset@2.0.4:
+    dependencies:
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+
+  isarray@2.0.5: {}
+
   isexe@2.0.0: {}
 
+  isstream@0.1.2: {}
+
+  jest-environment-jsdom@29.7.0:
+    dependencies:
+      '@jest/environment': 29.7.0
+      '@jest/fake-timers': 29.7.0
+      '@jest/types': 29.6.3
+      '@types/jsdom': 20.0.1
+      '@types/node': 25.9.1
+      jest-mock: 29.7.0
+      jest-util: 29.7.0
+      jsdom: 20.0.3
+    transitivePeerDependencies:
+      - bufferutil
+      - supports-color
+      - utf-8-validate
+
+  jest-message-util@29.7.0:
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@jest/types': 29.6.3
+      '@types/stack-utils': 2.0.3
+      chalk: 4.1.2
+      graceful-fs: 4.2.11
+      micromatch: 4.0.8
+      pretty-format: 29.7.0
+      slash: 3.0.0
+      stack-utils: 2.0.6
+
+  jest-mock@29.7.0:
+    dependencies:
+      '@jest/types': 29.6.3
+      '@types/node': 25.9.1
+      jest-util: 29.7.0
+
+  jest-util@29.7.0:
+    dependencies:
+      '@jest/types': 29.6.3
+      '@types/node': 25.9.1
+      chalk: 4.1.2
+      ci-info: 3.9.0
+      graceful-fs: 4.2.11
+      picomatch: 2.3.2
+
   jiti@1.21.7: {}
 
-  jiti@2.6.1: {}
+  jiti@2.7.0: {}
 
   jquery@4.0.0: {}
 
@@ -6881,8 +8571,43 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
+  jsbn@0.1.1: {}
+
   jsdoc-type-pratt-parser@7.2.0: {}
 
+  jsdom@20.0.3:
+    dependencies:
+      abab: 2.0.6
+      acorn: 8.16.0
+      acorn-globals: 7.0.1
+      cssom: 0.5.0
+      cssstyle: 2.3.0
+      data-urls: 3.0.2
+      decimal.js: 10.6.0
+      domexception: 4.0.0
+      escodegen: 2.1.0
+      form-data: 4.0.5
+      html-encoding-sniffer: 3.0.0
+      http-proxy-agent: 5.0.0
+      https-proxy-agent: 5.0.1
+      is-potential-custom-element-name: 1.0.1
+      nwsapi: 2.2.23
+      parse5: 7.3.0
+      saxes: 6.0.0
+      symbol-tree: 3.2.4
+      tough-cookie: 4.1.4
+      w3c-xmlserializer: 4.0.0
+      webidl-conversions: 7.0.0
+      whatwg-encoding: 2.0.0
+      whatwg-mimetype: 3.0.0
+      whatwg-url: 11.0.0
+      ws: 8.21.0
+      xml-name-validator: 4.0.0
+    transitivePeerDependencies:
+      - bufferutil
+      - supports-color
+      - utf-8-validate
+
   jsesc@3.1.0: {}
 
   json-buffer@3.0.1: {}
@@ -6893,26 +8618,49 @@ snapshots:
 
   json-schema-traverse@1.0.0: {}
 
+  json-schema@0.4.0: {}
+
   json-stable-stringify-without-jsonify@1.0.1: {}
 
+  json-stringify-safe@5.0.1: {}
+
   json5@1.0.2:
     dependencies:
       minimist: 1.2.8
 
   jsonc-parser@3.3.1: {}
 
+  jsonfile@2.4.0:
+    optionalDependencies:
+      graceful-fs: 4.2.11
+
   jsonpointer@5.0.1: {}
 
+  jsprim@1.4.2:
+    dependencies:
+      assert-plus: 1.0.0
+      extsprintf: 1.3.0
+      json-schema: 0.4.0
+      verror: 1.10.0
+
   jsx-ast-utils-x@0.1.0: {}
 
   jsx-ast-utils@3.3.5:
     dependencies:
-      array-includes: '@nolyfill/array-includes@1.0.44'
-      array.prototype.flat: '@nolyfill/array.prototype.flat@1.0.44'
-      object.assign: '@nolyfill/object.assign@1.0.44'
-      object.values: '@nolyfill/object.values@1.0.44'
+      array-includes: 3.1.9
+      array.prototype.flat: 1.3.3
+      object.assign: 4.1.7
+      object.values: 1.2.1
 
-  katex@0.16.45:
+  kaiser@0.0.4:
+    dependencies:
+      earlgrey-runtime: 0.1.2
+
+  katex@0.16.47:
+    dependencies:
+      commander: 8.3.0
+
+  katex@0.17.0:
     dependencies:
       commander: 8.3.0
 
@@ -6932,14 +8680,9 @@ snapshots:
 
   kind-of@6.0.3: {}
 
-  langium@4.2.2:
-    dependencies:
-      '@chevrotain/regexp-to-ast': 12.0.0
-      chevrotain: 12.0.0
-      chevrotain-allstar: 0.4.1(chevrotain@12.0.0)
-      vscode-languageserver: 9.0.1
-      vscode-languageserver-textdocument: 1.0.12
-      vscode-uri: 3.1.0
+  klaw@1.3.1:
+    optionalDependencies:
+      graceful-fs: 4.2.11
 
   language-subtag-registry@0.3.23: {}
 
@@ -7014,7 +8757,7 @@ snapshots:
 
   lines-and-columns@1.2.4: {}
 
-  linkify-it@5.0.0:
+  linkify-it@5.0.1:
     dependencies:
       uc.micro: 2.1.0
 
@@ -7036,6 +8779,8 @@ snapshots:
 
   lodash.upperfirst@4.3.1: {}
 
+  lodash@3.10.1: {}
+
   lodash@4.18.1: {}
 
   magic-string@0.30.21:
@@ -7046,7 +8791,7 @@ snapshots:
     dependencies:
       argparse: 2.0.1
       entities: 4.5.0
-      linkify-it: 5.0.0
+      linkify-it: 5.0.1
       mdurl: 2.0.0
       punycode.js: 2.3.1
       uc.micro: 2.1.0
@@ -7064,7 +8809,7 @@ snapshots:
       minimatch: 10.2.5
       run-con: 1.3.2
       smol-toml: 1.6.1
-      tinyglobby: 0.2.16
+      tinyglobby: 0.2.17
     transitivePeerDependencies:
       - supports-color
 
@@ -7086,13 +8831,16 @@ snapshots:
 
   marked@4.3.0: {}
 
-  material-icon-theme@5.33.1:
+  material-icon-theme@5.35.0:
     dependencies:
+      biome: 0.3.3
       chroma-js: 3.2.0
       events: 3.3.0
       fast-deep-equal: 3.1.3
       svgson: 5.3.1
 
+  math-intrinsics@1.1.0: {}
+
   mathml-tag-names@4.0.0: {}
 
   mdn-data@2.0.28: {}
@@ -7105,29 +8853,29 @@ snapshots:
 
   merge2@1.4.1: {}
 
-  mermaid@11.14.0:
+  mermaid@11.15.0:
     dependencies:
       '@braintree/sanitize-url': 7.1.2
-      '@iconify/utils': 3.1.0
-      '@mermaid-js/parser': 1.1.0
+      '@iconify/utils': 3.1.3
+      '@mermaid-js/parser': 1.1.1
       '@types/d3': 7.4.3
       '@upsetjs/venn.js': 2.0.0
-      cytoscape: 3.33.2
-      cytoscape-cose-bilkent: 4.1.0(cytoscape@3.33.2)
-      cytoscape-fcose: 2.2.0(cytoscape@3.33.2)
+      cytoscape: 3.33.4
+      cytoscape-cose-bilkent: 4.1.0(cytoscape@3.33.4)
+      cytoscape-fcose: 2.2.0(cytoscape@3.33.4)
       d3: 7.9.0
       d3-sankey: 0.12.3
       dagre-d3-es: 7.0.14
-      dayjs: 1.11.20
-      dompurify: 3.4.0
-      katex: 0.16.45
+      dayjs: 1.11.21
+      dompurify: 3.4.7
+      es-toolkit: 1.47.0
+      katex: 0.16.47
       khroma: 2.1.0
-      lodash-es: 4.18.1
       marked: 16.4.2
       roughjs: 4.6.6
       stylis: 4.4.0
       ts-dedent: 2.2.0
-      uuid: 11.1.0
+      uuid: 14.0.0
 
   micromark-core-commonmark@2.0.3:
     dependencies:
@@ -7188,7 +8936,7 @@ snapshots:
     dependencies:
       '@types/katex': 0.16.8
       devlop: 1.1.0
-      katex: 0.16.45
+      katex: 0.16.47
       micromark-factory-space: 2.0.1
       micromark-util-character: 2.1.1
       micromark-util-symbol: 2.0.1
@@ -7306,36 +9054,37 @@ snapshots:
       braces: 3.0.3
       picomatch: 2.3.2
 
+  mime-db@1.52.0: {}
+
+  mime-types@2.1.35:
+    dependencies:
+      mime-db: 1.52.0
+
   minimatch@10.2.5:
     dependencies:
-      brace-expansion: 5.0.5
+      brace-expansion: 5.0.6
 
   minimatch@3.1.5:
     dependencies:
-      brace-expansion: 1.1.14
+      brace-expansion: 1.1.15
 
   minimist@1.2.8: {}
 
-  mlly@1.8.2:
-    dependencies:
-      acorn: 8.16.0
-      pathe: 2.0.3
-      pkg-types: 1.3.1
-      ufo: 1.6.3
-
   moo@0.5.3: {}
 
   ms@2.1.3: {}
 
   muggle-string@0.4.1: {}
 
+  mute-stream@0.0.5: {}
+
   mz@2.7.0:
     dependencies:
       any-promise: 1.3.0
       object-assign: 4.1.1
       thenify-all: 1.6.0
 
-  nanoid@3.3.11: {}
+  nanoid@3.3.12: {}
 
   nanopop@2.3.0: {}
 
@@ -7345,9 +9094,9 @@ snapshots:
 
   node-exports-info@1.6.0:
     dependencies:
-      array.prototype.flatmap: '@nolyfill/array.prototype.flatmap@1.0.44'
+      array.prototype.flatmap: 1.3.3
       es-errors: 1.3.0
-      object.entries: '@nolyfill/object.entries@1.0.44'
+      object.entries: 1.1.9
       semver: 6.3.1
 
   node-fetch@2.6.13:
@@ -7358,9 +9107,7 @@ snapshots:
     dependencies:
       whatwg-url: 5.0.0
 
-  node-releases@2.0.37: {}
-
-  nolyfill@1.0.44: {}
+  node-releases@2.0.46: {}
 
   normalize-path@3.0.0: {}
 
@@ -7368,12 +9115,64 @@ snapshots:
     dependencies:
       boolbase: 1.0.0
 
+  number-is-nan@1.0.1: {}
+
+  nwsapi@2.2.23: {}
+
+  oauth-sign@0.9.0: {}
+
   object-assign@4.1.1: {}
 
   object-hash@3.0.0: {}
 
+  object-inspect@1.13.4: {}
+
+  object-keys@1.1.1: {}
+
+  object.assign@4.1.7:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+      has-symbols: 1.1.0
+      object-keys: 1.1.1
+
+  object.entries@1.1.9:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  object.fromentries@2.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.2
+
+  object.groupby@1.0.3:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+
+  object.values@1.2.1:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
   obug@2.1.1: {}
 
+  once@1.4.0:
+    dependencies:
+      wrappy: 1.0.2
+
+  onetime@1.1.0: {}
+
   online-3d-viewer@0.18.0:
     dependencies:
       '@simonwep/pickr': 1.9.0
@@ -7389,6 +9188,14 @@ snapshots:
       type-check: 0.4.0
       word-wrap: 1.2.5
 
+  os-homedir@1.0.2: {}
+
+  own-keys@1.0.1:
+    dependencies:
+      get-intrinsic: 1.3.0
+      object-keys: 1.1.1
+      safe-push-apply: 1.0.0
+
   p-limit@3.1.0:
     dependencies:
       yocto-queue: 0.1.0
@@ -7415,17 +9222,23 @@ snapshots:
 
   parse-json@5.2.0:
     dependencies:
-      '@babel/code-frame': 7.29.0
+      '@babel/code-frame': 7.29.7
       error-ex: 1.3.4
       json-parse-even-better-errors: 2.3.1
       lines-and-columns: 1.2.4
 
+  parse5@7.3.0:
+    dependencies:
+      entities: 6.0.1
+
   path-browserify@1.0.1: {}
 
   path-data-parser@0.1.0: {}
 
   path-exists@4.0.0: {}
 
+  path-is-absolute@1.0.1: {}
+
   path-key@3.1.1: {}
 
   path-parse@1.0.7: {}
@@ -7436,6 +9249,8 @@ snapshots:
 
   perfect-debounce@2.1.0: {}
 
+  performance-now@2.1.0: {}
+
   picocolors@1.1.1: {}
 
   picomatch@2.3.2: {}
@@ -7446,17 +9261,11 @@ snapshots:
 
   pirates@4.0.7: {}
 
-  pkg-types@1.3.1:
-    dependencies:
-      confbox: 0.1.8
-      mlly: 1.8.2
-      pathe: 2.0.3
+  playwright-core@1.60.0: {}
 
-  playwright-core@1.59.1: {}
-
-  playwright@1.59.1:
+  playwright@1.60.0:
     dependencies:
-      playwright-core: 1.59.1
+      playwright-core: 1.60.0
     optionalDependencies:
       fsevents: 2.3.2
 
@@ -7469,44 +9278,46 @@ snapshots:
       path-data-parser: 0.1.0
       points-on-curve: 0.2.0
 
+  possible-typed-array-names@1.1.0: {}
+
   postcss-html@1.8.1:
     dependencies:
       htmlparser2: 8.0.2
       js-tokens: 9.0.1
-      postcss: 8.5.10
-      postcss-safe-parser: 6.0.0(postcss@8.5.10)
+      postcss: 8.5.15
+      postcss-safe-parser: 6.0.0(postcss@8.5.15)
 
-  postcss-import@15.1.0(postcss@8.5.10):
+  postcss-import@15.1.0(postcss@8.5.15):
     dependencies:
-      postcss: 8.5.10
+      postcss: 8.5.15
       postcss-value-parser: 4.2.0
       read-cache: 1.0.0
       resolve: 1.22.12
 
-  postcss-js@4.1.0(postcss@8.5.10):
+  postcss-js@4.1.0(postcss@8.5.15):
     dependencies:
       camelcase-css: 2.0.1
-      postcss: 8.5.10
+      postcss: 8.5.15
 
-  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.10):
+  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.15):
     dependencies:
       lilconfig: 3.1.3
     optionalDependencies:
       jiti: 1.21.7
-      postcss: 8.5.10
+      postcss: 8.5.15
 
-  postcss-nested@6.2.0(postcss@8.5.10):
+  postcss-nested@6.2.0(postcss@8.5.15):
     dependencies:
-      postcss: 8.5.10
+      postcss: 8.5.15
       postcss-selector-parser: 6.1.2
 
-  postcss-safe-parser@6.0.0(postcss@8.5.10):
+  postcss-safe-parser@6.0.0(postcss@8.5.15):
     dependencies:
-      postcss: 8.5.10
+      postcss: 8.5.15
 
-  postcss-safe-parser@7.0.1(postcss@8.5.10):
+  postcss-safe-parser@7.0.1(postcss@8.5.15):
     dependencies:
-      postcss: 8.5.10
+      postcss: 8.5.15
 
   postcss-selector-parser@6.1.2:
     dependencies:
@@ -7520,9 +9331,9 @@ snapshots:
 
   postcss-value-parser@4.2.0: {}
 
-  postcss@8.5.10:
+  postcss@8.5.15:
     dependencies:
-      nanoid: 3.3.11
+      nanoid: 3.3.12
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
@@ -7534,16 +9345,32 @@ snapshots:
 
   prettier@3.8.3: {}
 
+  pretty-format@29.7.0:
+    dependencies:
+      '@jest/schemas': 29.6.3
+      ansi-styles: 5.2.0
+      react-is: 18.3.1
+
+  psl@1.15.0:
+    dependencies:
+      punycode: 2.3.1
+
   punycode.js@2.3.1: {}
 
   punycode@2.3.1: {}
 
-  qified@0.9.1:
+  qified@0.10.1:
     dependencies:
-      hookified: 2.1.1
+      hookified: 2.2.0
+
+  qs@6.5.5: {}
+
+  querystringify@2.2.0: {}
 
   queue-microtask@1.2.3: {}
 
+  react-is@18.3.1: {}
+
   read-cache@1.0.0:
     dependencies:
       pify: 2.3.0
@@ -7552,10 +9379,29 @@ snapshots:
     dependencies:
       picomatch: 2.3.2
 
+  readline2@1.0.1:
+    dependencies:
+      code-point-at: 1.1.0
+      is-fullwidth-code-point: 1.0.0
+      mute-stream: 0.0.5
+
   refa@0.12.1:
     dependencies:
       '@eslint-community/regexpp': 4.12.2
 
+  reflect.getprototypeof@1.0.10:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      which-builtin-type: 1.2.1
+
+  regenerator-runtime@0.9.6: {}
+
   regexp-ast-analysis@0.7.1:
     dependencies:
       '@eslint-community/regexpp': 4.12.2
@@ -7563,14 +9409,54 @@ snapshots:
 
   regexp-tree@0.1.27: {}
 
+  regexp.prototype.flags@1.5.4:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-errors: 1.3.0
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      set-function-name: 2.0.2
+
   regjsparser@0.13.1:
     dependencies:
       jsesc: 3.1.0
 
   rename-keys@1.2.0: {}
 
+  request-promise@3.0.0:
+    dependencies:
+      bluebird: 3.7.2
+      lodash: 4.18.1
+      request: 2.88.2
+
+  request@2.88.2:
+    dependencies:
+      aws-sign2: 0.7.0
+      aws4: 1.13.2
+      caseless: 0.12.0
+      combined-stream: 1.0.8
+      extend: 3.0.2
+      forever-agent: 0.6.1
+      form-data: 2.3.3
+      har-validator: 5.1.5
+      http-signature: 1.2.0
+      is-typedarray: 1.0.0
+      isstream: 0.1.2
+      json-stringify-safe: 5.0.1
+      mime-types: 2.1.35
+      oauth-sign: 0.9.0
+      performance-now: 2.1.0
+      qs: 6.5.5
+      safe-buffer: 5.2.1
+      tough-cookie: 2.5.0
+      tunnel-agent: 0.6.0
+      uuid: 3.4.0
+
   require-from-string@2.0.2: {}
 
+  requires-port@1.0.0: {}
+
   resolve-from@4.0.0: {}
 
   resolve-pkg-maps@1.0.0: {}
@@ -7578,47 +9464,56 @@ snapshots:
   resolve@1.22.12:
     dependencies:
       es-errors: 1.3.0
-      is-core-module: '@nolyfill/is-core-module@1.0.39'
+      is-core-module: 2.16.2
       path-parse: 1.0.7
       supports-preserve-symlinks-flag: 1.0.0
 
-  resolve@2.0.0-next.6:
+  resolve@2.0.0-next.7:
     dependencies:
       es-errors: 1.3.0
-      is-core-module: '@nolyfill/is-core-module@1.0.39'
+      is-core-module: 2.16.2
       node-exports-info: 1.6.0
-      object-keys: '@nolyfill/object-keys@1.0.44'
+      object-keys: 1.1.1
       path-parse: 1.0.7
       supports-preserve-symlinks-flag: 1.0.0
 
+  restore-cursor@1.0.1:
+    dependencies:
+      exit-hook: 1.1.1
+      onetime: 1.1.0
+
   reusify@1.1.0: {}
 
+  rimraf@2.7.1:
+    dependencies:
+      glob: 7.2.3
+
   robust-predicates@3.0.3: {}
 
-  rolldown-license-plugin@3.0.1(rolldown@1.0.0-rc.16):
+  rolldown-license-plugin@3.0.8(rolldown@1.0.2):
     dependencies:
-      rolldown: 1.0.0-rc.16
+      rolldown: 1.0.2
 
-  rolldown@1.0.0-rc.16:
+  rolldown@1.0.2:
     dependencies:
-      '@oxc-project/types': 0.126.0
-      '@rolldown/pluginutils': 1.0.0-rc.16
+      '@oxc-project/types': 0.132.0
+      '@rolldown/pluginutils': 1.0.1
     optionalDependencies:
-      '@rolldown/binding-android-arm64': 1.0.0-rc.16
-      '@rolldown/binding-darwin-arm64': 1.0.0-rc.16
-      '@rolldown/binding-darwin-x64': 1.0.0-rc.16
-      '@rolldown/binding-freebsd-x64': 1.0.0-rc.16
-      '@rolldown/binding-linux-arm-gnueabihf': 1.0.0-rc.16
-      '@rolldown/binding-linux-arm64-gnu': 1.0.0-rc.16
-      '@rolldown/binding-linux-arm64-musl': 1.0.0-rc.16
-      '@rolldown/binding-linux-ppc64-gnu': 1.0.0-rc.16
-      '@rolldown/binding-linux-s390x-gnu': 1.0.0-rc.16
-      '@rolldown/binding-linux-x64-gnu': 1.0.0-rc.16
-      '@rolldown/binding-linux-x64-musl': 1.0.0-rc.16
-      '@rolldown/binding-openharmony-arm64': 1.0.0-rc.16
-      '@rolldown/binding-wasm32-wasi': 1.0.0-rc.16
-      '@rolldown/binding-win32-arm64-msvc': 1.0.0-rc.16
-      '@rolldown/binding-win32-x64-msvc': 1.0.0-rc.16
+      '@rolldown/binding-android-arm64': 1.0.2
+      '@rolldown/binding-darwin-arm64': 1.0.2
+      '@rolldown/binding-darwin-x64': 1.0.2
+      '@rolldown/binding-freebsd-x64': 1.0.2
+      '@rolldown/binding-linux-arm-gnueabihf': 1.0.2
+      '@rolldown/binding-linux-arm64-gnu': 1.0.2
+      '@rolldown/binding-linux-arm64-musl': 1.0.2
+      '@rolldown/binding-linux-ppc64-gnu': 1.0.2
+      '@rolldown/binding-linux-s390x-gnu': 1.0.2
+      '@rolldown/binding-linux-x64-gnu': 1.0.2
+      '@rolldown/binding-linux-x64-musl': 1.0.2
+      '@rolldown/binding-openharmony-arm64': 1.0.2
+      '@rolldown/binding-wasm32-wasi': 1.0.2
+      '@rolldown/binding-win32-arm64-msvc': 1.0.2
+      '@rolldown/binding-win32-x64-msvc': 1.0.2
 
   roughjs@4.6.6:
     dependencies:
@@ -7627,6 +9522,10 @@ snapshots:
       points-on-curve: 0.2.0
       points-on-path: 0.2.1
 
+  run-async@0.1.0:
+    dependencies:
+      once: 1.4.0
+
   run-con@1.3.2:
     dependencies:
       deep-extend: 0.6.0
@@ -7640,8 +9539,37 @@ snapshots:
 
   rw@1.3.3: {}
 
+  rx-lite@3.1.2: {}
+
+  safe-array-concat@1.1.4:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+      has-symbols: 1.1.0
+      isarray: 2.0.5
+
+  safe-buffer@5.2.1: {}
+
+  safe-push-apply@1.0.0:
+    dependencies:
+      es-errors: 1.3.0
+      isarray: 2.0.5
+
+  safe-regex-test@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-regex: 1.2.1
+
+  safer-buffer@2.1.2: {}
+
   sax@1.6.0: {}
 
+  saxes@6.0.0:
+    dependencies:
+      xmlchars: 2.2.0
+
   scslre@0.3.0:
     dependencies:
       '@eslint-community/regexpp': 4.12.2
@@ -7650,13 +9578,35 @@ snapshots:
 
   semver@6.3.1: {}
 
-  semver@7.7.4: {}
+  semver@7.8.1: {}
 
-  seroval-plugins@1.5.2(seroval@1.5.2):
+  seroval-plugins@1.5.4(seroval@1.5.4):
     dependencies:
-      seroval: 1.5.2
+      seroval: 1.5.4
 
-  seroval@1.5.2: {}
+  seroval@1.5.4: {}
+
+  set-function-length@1.2.2:
+    dependencies:
+      define-data-property: 1.1.4
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+      get-intrinsic: 1.3.0
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+
+  set-function-name@2.0.2:
+    dependencies:
+      define-data-property: 1.1.4
+      es-errors: 1.3.0
+      functions-have-names: 1.2.3
+      has-property-descriptors: 1.0.2
+
+  set-proto@1.0.0:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
 
   shebang-command@2.0.0:
     dependencies:
@@ -7664,10 +9614,40 @@ snapshots:
 
   shebang-regex@3.0.0: {}
 
+  side-channel-list@1.0.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-map@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-weakmap@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-map: 1.0.1
+
+  side-channel@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-list: 1.0.1
+      side-channel-map: 1.0.1
+      side-channel-weakmap: 1.0.2
+
   siginfo@2.0.0: {}
 
   signal-exit@4.1.0: {}
 
+  slash@3.0.0: {}
+
   slash@5.1.0: {}
 
   slice-ansi@4.0.0:
@@ -7678,32 +9658,62 @@ snapshots:
 
   smol-toml@1.6.1: {}
 
-  solid-js@1.9.12:
+  solid-js@1.9.13:
     dependencies:
       csstype: 3.2.3
-      seroval: 1.5.2
-      seroval-plugins: 1.5.2(seroval@1.5.2)
+      seroval: 1.5.4
+      seroval-plugins: 1.5.4(seroval@1.5.4)
 
-  solid-transition-group@0.2.3(solid-js@1.9.12):
+  solid-transition-group@0.2.3(solid-js@1.9.13):
     dependencies:
-      '@solid-primitives/refs': 1.1.3(solid-js@1.9.12)
-      '@solid-primitives/transition-group': 1.1.2(solid-js@1.9.12)
-      solid-js: 1.9.12
+      '@solid-primitives/refs': 1.1.3(solid-js@1.9.13)
+      '@solid-primitives/transition-group': 1.1.2(solid-js@1.9.13)
+      solid-js: 1.9.13
 
   sortablejs@1.15.7: {}
 
   source-map-js@1.2.1: {}
 
-  spectral-cli-bundle@1.0.7:
+  source-map@0.6.1:
+    optional: true
+
+  spectral-cli-bundle@1.0.8:
     optionalDependencies:
       fsevents: 2.3.3
 
+  sshpk@1.18.0:
+    dependencies:
+      asn1: 0.2.6
+      assert-plus: 1.0.0
+      bcrypt-pbkdf: 1.0.2
+      dashdash: 1.14.1
+      ecc-jsbn: 0.1.2
+      getpass: 0.1.7
+      jsbn: 0.1.1
+      safer-buffer: 2.1.2
+      tweetnacl: 0.14.5
+
   stable-hash-x@0.2.0: {}
 
+  stack-utils@2.0.6:
+    dependencies:
+      escape-string-regexp: 2.0.0
+
   stackback@0.0.2: {}
 
   std-env@4.1.0: {}
 
+  stop-iteration-iterator@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      internal-slot: 1.1.0
+
+  string-width@1.0.2:
+    dependencies:
+      code-point-at: 1.1.0
+      is-fullwidth-code-point: 1.0.0
+      strip-ansi: 3.0.1
+
   string-width@4.2.3:
     dependencies:
       emoji-regex: 8.0.0
@@ -7712,14 +9722,47 @@ snapshots:
 
   string-width@8.1.0:
     dependencies:
-      get-east-asian-width: 1.5.0
+      get-east-asian-width: 1.6.0
       strip-ansi: 7.2.0
 
-  string-width@8.2.0:
+  string-width@8.2.1:
     dependencies:
-      get-east-asian-width: 1.5.0
+      get-east-asian-width: 1.6.0
       strip-ansi: 7.2.0
 
+  string.prototype.includes@2.0.1:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+
+  string.prototype.trim@1.2.10:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-data-property: 1.1.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.2
+      has-property-descriptors: 1.0.2
+
+  string.prototype.trimend@1.0.9:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  string.prototype.trimstart@1.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  strip-ansi@3.0.1:
+    dependencies:
+      ansi-regex: 2.1.1
+
   strip-ansi@6.0.1:
     dependencies:
       ansi-regex: 5.0.1
@@ -7738,29 +9781,29 @@ snapshots:
 
   style-search@0.1.0: {}
 
-  stylelint-config-recommended@18.0.0(stylelint@17.8.0(typescript@6.0.3)):
+  stylelint-config-recommended@18.0.0(stylelint@17.12.0(typescript@6.0.3)):
     dependencies:
-      stylelint: 17.8.0(typescript@6.0.3)
+      stylelint: 17.12.0(typescript@6.0.3)
 
-  stylelint-declaration-block-no-ignored-properties@3.0.0(stylelint@17.8.0(typescript@6.0.3)):
+  stylelint-declaration-block-no-ignored-properties@3.0.0(stylelint@17.12.0(typescript@6.0.3)):
     dependencies:
-      stylelint: 17.8.0(typescript@6.0.3)
+      stylelint: 17.12.0(typescript@6.0.3)
 
-  stylelint-declaration-strict-value@1.11.1(stylelint@17.8.0(typescript@6.0.3)):
+  stylelint-declaration-strict-value@1.11.1(stylelint@17.12.0(typescript@6.0.3)):
     dependencies:
-      stylelint: 17.8.0(typescript@6.0.3)
+      stylelint: 17.12.0(typescript@6.0.3)
 
-  stylelint-value-no-unknown-custom-properties@6.1.1(stylelint@17.8.0(typescript@6.0.3)):
+  stylelint-value-no-unknown-custom-properties@6.1.1(stylelint@17.12.0(typescript@6.0.3)):
     dependencies:
       postcss-value-parser: 4.2.0
       resolve: 1.22.12
-      stylelint: 17.8.0(typescript@6.0.3)
+      stylelint: 17.12.0(typescript@6.0.3)
 
-  stylelint@17.8.0(typescript@6.0.3):
+  stylelint@17.12.0(typescript@6.0.3):
     dependencies:
-      '@csstools/css-calc': 3.2.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
+      '@csstools/css-calc': 3.2.1(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
       '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.0)
-      '@csstools/css-syntax-patches-for-csstree': 1.1.3(css-tree@3.2.1)
+      '@csstools/css-syntax-patches-for-csstree': 1.1.4(css-tree@3.2.1)
       '@csstools/css-tokenizer': 4.0.0
       '@csstools/media-query-list-parser': 5.0.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
       '@csstools/selector-resolve-nested': 4.0.0(postcss-selector-parser@7.1.1)
@@ -7772,24 +9815,23 @@ snapshots:
       debug: 4.4.3
       fast-glob: 3.3.3
       fastest-levenshtein: 1.0.16
-      file-entry-cache: 11.1.2
+      file-entry-cache: 11.1.3
       global-modules: 2.0.0
       globby: 16.2.0
       globjoin: 0.1.4
       html-tags: 5.1.0
       ignore: 7.0.5
       import-meta-resolve: 4.2.0
-      is-plain-object: 5.0.0
       mathml-tag-names: 4.0.0
       meow: 14.1.0
       micromatch: 4.0.8
       normalize-path: 3.0.0
       picocolors: 1.1.1
-      postcss: 8.5.10
-      postcss-safe-parser: 7.0.1(postcss@8.5.10)
+      postcss: 8.5.15
+      postcss-safe-parser: 7.0.1(postcss@8.5.15)
       postcss-selector-parser: 7.1.1
       postcss-value-parser: 4.2.0
-      string-width: 8.2.0
+      string-width: 8.2.1
       supports-hyperlinks: 4.4.0
       svg-tags: 1.0.0
       table: 6.9.0
@@ -7807,11 +9849,17 @@ snapshots:
       lines-and-columns: 1.2.4
       mz: 2.7.0
       pirates: 4.0.7
-      tinyglobby: 0.2.16
+      tinyglobby: 0.2.17
       ts-interface-checker: 0.1.13
 
   supports-color@10.2.2: {}
 
+  supports-color@2.0.0: {}
+
+  supports-color@7.2.0:
+    dependencies:
+      has-flag: 4.0.0
+
   supports-hyperlinks@4.4.0:
     dependencies:
       has-flag: 5.0.1
@@ -7838,10 +9886,12 @@ snapshots:
       deep-rename-keys: 0.2.1
       xml-reader: 2.4.3
 
-  swagger-ui-dist@5.32.4:
+  swagger-ui-dist@5.32.6:
     dependencies:
       '@scarf/scarf': 1.4.0
 
+  symbol-tree@3.2.4: {}
+
   sync-fetch@0.4.5:
     dependencies:
       buffer: 5.7.1
@@ -7849,13 +9899,13 @@ snapshots:
     transitivePeerDependencies:
       - encoding
 
-  synckit@0.11.12:
+  synckit@0.11.13:
     dependencies:
-      '@pkgr/core': 0.2.9
+      '@pkgr/core': 0.3.6
 
   table@6.9.0:
     dependencies:
-      ajv: 8.18.0
+      ajv: 8.20.0
       lodash.truncate: 4.4.2
       slice-ansi: 4.0.0
       string-width: 4.2.3
@@ -7877,11 +9927,11 @@ snapshots:
       normalize-path: 3.0.0
       object-hash: 3.0.0
       picocolors: 1.1.1
-      postcss: 8.5.10
-      postcss-import: 15.1.0(postcss@8.5.10)
-      postcss-js: 4.1.0(postcss@8.5.10)
-      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.10)
-      postcss-nested: 6.2.0(postcss@8.5.10)
+      postcss: 8.5.15
+      postcss-import: 15.1.0(postcss@8.5.15)
+      postcss-js: 4.1.0(postcss@8.5.15)
+      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.15)
+      postcss-nested: 6.2.0(postcss@8.5.15)
       postcss-selector-parser: 6.1.2
       resolve: 1.22.12
       sucrase: 3.35.1
@@ -7901,11 +9951,13 @@ snapshots:
 
   throttle-debounce@5.0.2: {}
 
+  through@2.3.8: {}
+
   tinybench@2.9.0: {}
 
-  tinyexec@1.1.1: {}
+  tinyexec@1.2.4: {}
 
-  tinyglobby@0.2.16:
+  tinyglobby@0.2.17:
     dependencies:
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
@@ -7922,8 +9974,24 @@ snapshots:
 
   toastify-js@1.12.0: {}
 
+  tough-cookie@2.5.0:
+    dependencies:
+      psl: 1.15.0
+      punycode: 2.3.1
+
+  tough-cookie@4.1.4:
+    dependencies:
+      psl: 1.15.0
+      punycode: 2.3.1
+      universalify: 0.2.0
+      url-parse: 1.5.10
+
   tr46@0.0.3: {}
 
+  tr46@3.0.0:
+    dependencies:
+      punycode: 2.3.1
+
   tributejs@5.1.3: {}
 
   ts-api-utils@2.5.0(typescript@5.9.3):
@@ -7947,28 +10015,69 @@ snapshots:
 
   tslib@2.8.1: {}
 
+  tunnel-agent@0.6.0:
+    dependencies:
+      safe-buffer: 5.2.1
+
+  tweetnacl@0.14.5: {}
+
   type-check@0.4.0:
     dependencies:
       prelude-ls: 1.2.1
 
-  typescript-eslint@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3):
+  type-detect@4.0.8: {}
+
+  typed-array-buffer@1.0.3:
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.59.0(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)
-      '@typescript-eslint/parser': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)
-      '@typescript-eslint/typescript-estree': 8.59.0(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@5.9.3)
-      eslint: 10.2.1(jiti@2.6.1)
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-typed-array: 1.1.15
+
+  typed-array-byte-length@1.0.3:
+    dependencies:
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      has-proto: 1.2.0
+      is-typed-array: 1.1.15
+
+  typed-array-byte-offset@1.0.4:
+    dependencies:
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      has-proto: 1.2.0
+      is-typed-array: 1.1.15
+      reflect.getprototypeof: 1.0.10
+
+  typed-array-length@1.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      is-typed-array: 1.1.15
+      possible-typed-array-names: 1.1.0
+      reflect.getprototypeof: 1.0.10
+
+  typescript-eslint@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3):
+    dependencies:
+      '@typescript-eslint/eslint-plugin': 8.60.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/typescript-estree': 8.60.0(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@5.9.3)
+      eslint: 10.4.0(jiti@2.7.0)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  typescript-eslint@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3):
+  typescript-eslint@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.59.0(@typescript-eslint/parser@8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3))(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
-      '@typescript-eslint/parser': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
-      '@typescript-eslint/typescript-estree': 8.59.0(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.59.0(eslint@10.2.1(jiti@2.6.1))(typescript@6.0.3)
-      eslint: 10.2.1(jiti@2.6.1)
+      '@typescript-eslint/eslint-plugin': 8.60.0(@typescript-eslint/parser@8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/parser': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      '@typescript-eslint/typescript-estree': 8.60.0(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.60.0(eslint@10.4.0(jiti@2.7.0))(typescript@6.0.3)
+      eslint: 10.4.0(jiti@2.7.0)
       typescript: 6.0.3
     transitivePeerDependencies:
       - supports-color
@@ -7977,41 +10086,53 @@ snapshots:
 
   typescript@6.0.3: {}
 
-  typo-js@1.3.1: {}
+  typo-js@1.3.2: {}
 
   uc.micro@2.1.0: {}
 
-  ufo@1.6.3: {}
-
   uint8-to-base64@0.2.1: {}
 
-  undici-types@7.19.2: {}
+  unbox-primitive@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      has-bigints: 1.1.0
+      has-symbols: 1.1.0
+      which-boxed-primitive: 1.1.1
+
+  undici-types@7.24.6: {}
 
   unicorn-magic@0.4.0: {}
 
-  unrs-resolver@1.11.1:
+  universalify@0.2.0: {}
+
+  unrs-resolver@1.12.2:
     dependencies:
       napi-postinstall: 0.3.4
     optionalDependencies:
-      '@unrs/resolver-binding-android-arm-eabi': 1.11.1
-      '@unrs/resolver-binding-android-arm64': 1.11.1
-      '@unrs/resolver-binding-darwin-arm64': 1.11.1
-      '@unrs/resolver-binding-darwin-x64': 1.11.1
-      '@unrs/resolver-binding-freebsd-x64': 1.11.1
-      '@unrs/resolver-binding-linux-arm-gnueabihf': 1.11.1
-      '@unrs/resolver-binding-linux-arm-musleabihf': 1.11.1
-      '@unrs/resolver-binding-linux-arm64-gnu': 1.11.1
-      '@unrs/resolver-binding-linux-arm64-musl': 1.11.1
-      '@unrs/resolver-binding-linux-ppc64-gnu': 1.11.1
-      '@unrs/resolver-binding-linux-riscv64-gnu': 1.11.1
-      '@unrs/resolver-binding-linux-riscv64-musl': 1.11.1
-      '@unrs/resolver-binding-linux-s390x-gnu': 1.11.1
-      '@unrs/resolver-binding-linux-x64-gnu': 1.11.1
-      '@unrs/resolver-binding-linux-x64-musl': 1.11.1
-      '@unrs/resolver-binding-wasm32-wasi': 1.11.1
-      '@unrs/resolver-binding-win32-arm64-msvc': 1.11.1
-      '@unrs/resolver-binding-win32-ia32-msvc': 1.11.1
-      '@unrs/resolver-binding-win32-x64-msvc': 1.11.1
+      '@unrs/resolver-binding-android-arm-eabi': 1.12.2
+      '@unrs/resolver-binding-android-arm64': 1.12.2
+      '@unrs/resolver-binding-darwin-arm64': 1.12.2
+      '@unrs/resolver-binding-darwin-x64': 1.12.2
+      '@unrs/resolver-binding-freebsd-x64': 1.12.2
+      '@unrs/resolver-binding-linux-arm-gnueabihf': 1.12.2
+      '@unrs/resolver-binding-linux-arm-musleabihf': 1.12.2
+      '@unrs/resolver-binding-linux-arm64-gnu': 1.12.2
+      '@unrs/resolver-binding-linux-arm64-musl': 1.12.2
+      '@unrs/resolver-binding-linux-loong64-gnu': 1.12.2
+      '@unrs/resolver-binding-linux-loong64-musl': 1.12.2
+      '@unrs/resolver-binding-linux-ppc64-gnu': 1.12.2
+      '@unrs/resolver-binding-linux-riscv64-gnu': 1.12.2
+      '@unrs/resolver-binding-linux-riscv64-musl': 1.12.2
+      '@unrs/resolver-binding-linux-s390x-gnu': 1.12.2
+      '@unrs/resolver-binding-linux-x64-gnu': 1.12.2
+      '@unrs/resolver-binding-linux-x64-musl': 1.12.2
+      '@unrs/resolver-binding-openharmony-arm64': 1.12.2
+      '@unrs/resolver-binding-wasm32-wasi': 1.12.2
+      '@unrs/resolver-binding-win32-arm64-msvc': 1.12.2
+      '@unrs/resolver-binding-win32-ia32-msvc': 1.12.2
+      '@unrs/resolver-binding-win32-x64-msvc': 1.12.2
+
+  untildify@3.0.3: {}
 
   update-browserslist-db@1.2.3(browserslist@4.28.2):
     dependencies:
@@ -8019,45 +10140,62 @@ snapshots:
       escalade: 3.2.0
       picocolors: 1.1.1
 
-  updates@17.16.3: {}
+  updates@17.17.2: {}
 
   uri-js@4.4.1:
     dependencies:
       punycode: 2.3.1
 
+  url-parse@1.5.10:
+    dependencies:
+      querystringify: 2.2.0
+      requires-port: 1.0.0
+
+  user-home@2.0.0:
+    dependencies:
+      os-homedir: 1.0.2
+
   util-deprecate@1.0.2: {}
 
-  uuid@11.1.0: {}
+  uuid@14.0.0: {}
+
+  uuid@3.4.0: {}
 
   vanilla-colorful@0.7.2: {}
 
-  vite-string-plugin@2.0.2(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1)):
+  verror@1.10.0:
     dependencies:
-      vite: 8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1)
+      assert-plus: 1.0.0
+      core-util-is: 1.0.2
+      extsprintf: 1.3.0
 
-  vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1):
+  vite-string-plugin@2.0.4(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)):
+    dependencies:
+      vite: 8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
+
+  vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0):
     dependencies:
       lightningcss: 1.32.0
       picomatch: 4.0.4
-      postcss: 8.5.10
-      rolldown: 1.0.0-rc.16
-      tinyglobby: 0.2.16
+      postcss: 8.5.15
+      rolldown: 1.0.2
+      tinyglobby: 0.2.17
     optionalDependencies:
-      '@types/node': 25.6.0
+      '@types/node': 25.9.1
       esbuild: 0.28.0
       fsevents: 2.3.3
-      jiti: 2.6.1
+      jiti: 2.7.0
 
-  vitest@4.1.4(@types/node@25.6.0)(happy-dom@20.9.0)(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1)):
+  vitest@4.1.7(@types/node@25.9.1)(happy-dom@20.9.0)(jsdom@20.0.3)(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)):
     dependencies:
-      '@vitest/expect': 4.1.4
-      '@vitest/mocker': 4.1.4(vite@8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1))
-      '@vitest/pretty-format': 4.1.4
-      '@vitest/runner': 4.1.4
-      '@vitest/snapshot': 4.1.4
-      '@vitest/spy': 4.1.4
-      '@vitest/utils': 4.1.4
-      es-module-lexer: 2.0.0
+      '@vitest/expect': 4.1.7
+      '@vitest/mocker': 4.1.7(vite@8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0))
+      '@vitest/pretty-format': 4.1.7
+      '@vitest/runner': 4.1.7
+      '@vitest/snapshot': 4.1.7
+      '@vitest/spy': 4.1.7
+      '@vitest/utils': 4.1.7
+      es-module-lexer: 2.1.0
       expect-type: 1.3.0
       magic-string: 0.30.21
       obug: 2.1.1
@@ -8065,84 +10203,126 @@ snapshots:
       picomatch: 4.0.4
       std-env: 4.1.0
       tinybench: 2.9.0
-      tinyexec: 1.1.1
-      tinyglobby: 0.2.16
+      tinyexec: 1.2.4
+      tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 8.0.9(@types/node@25.6.0)(esbuild@0.28.0)(jiti@2.6.1)
+      vite: 8.0.14(@types/node@25.9.1)(esbuild@0.28.0)(jiti@2.7.0)
       why-is-node-running: 2.3.0
     optionalDependencies:
-      '@types/node': 25.6.0
+      '@types/node': 25.9.1
       happy-dom: 20.9.0
+      jsdom: 20.0.3
     transitivePeerDependencies:
       - msw
 
-  vscode-jsonrpc@8.2.0: {}
-
-  vscode-languageserver-protocol@3.17.5:
-    dependencies:
-      vscode-jsonrpc: 8.2.0
-      vscode-languageserver-types: 3.17.5
-
-  vscode-languageserver-textdocument@1.0.12: {}
-
-  vscode-languageserver-types@3.17.5: {}
-
-  vscode-languageserver@9.0.1:
-    dependencies:
-      vscode-languageserver-protocol: 3.17.5
-
   vscode-uri@3.1.0: {}
 
   vue-bar-graph@2.2.0(typescript@6.0.3):
     dependencies:
-      vue: 3.5.32(typescript@6.0.3)
+      vue: 3.5.35(typescript@6.0.3)
     transitivePeerDependencies:
       - typescript
 
-  vue-chartjs@5.3.3(chart.js@4.5.1)(vue@3.5.32(typescript@6.0.3)):
+  vue-chartjs@5.3.3(chart.js@4.5.1)(vue@3.5.35(typescript@6.0.3)):
     dependencies:
       chart.js: 4.5.1
-      vue: 3.5.32(typescript@6.0.3)
+      vue: 3.5.35(typescript@6.0.3)
 
-  vue-eslint-parser@10.4.0(eslint@10.2.1(jiti@2.6.1)):
+  vue-eslint-parser@10.4.0(eslint@10.4.0(jiti@2.7.0)):
     dependencies:
       debug: 4.4.3
-      eslint: 10.2.1(jiti@2.6.1)
+      eslint: 10.4.0(jiti@2.7.0)
       eslint-scope: 9.1.2
       eslint-visitor-keys: 5.0.1
       espree: 11.2.0
       esquery: 1.7.0
-      semver: 7.7.4
+      semver: 7.8.1
     transitivePeerDependencies:
       - supports-color
 
-  vue-tsc@3.2.7(typescript@6.0.3):
+  vue-tsc@3.3.2(typescript@6.0.3):
     dependencies:
       '@volar/typescript': 2.4.28
-      '@vue/language-core': 3.2.7
+      '@vue/language-core': 3.3.2
       typescript: 6.0.3
 
-  vue@3.5.32(typescript@6.0.3):
+  vue@3.5.35(typescript@6.0.3):
     dependencies:
-      '@vue/compiler-dom': 3.5.32
-      '@vue/compiler-sfc': 3.5.32
-      '@vue/runtime-dom': 3.5.32
-      '@vue/server-renderer': 3.5.32(vue@3.5.32(typescript@6.0.3))
-      '@vue/shared': 3.5.32
+      '@vue/compiler-dom': 3.5.35
+      '@vue/compiler-sfc': 3.5.35
+      '@vue/runtime-dom': 3.5.35
+      '@vue/server-renderer': 3.5.35(vue@3.5.35(typescript@6.0.3))
+      '@vue/shared': 3.5.35
     optionalDependencies:
       typescript: 6.0.3
 
   w3c-keyname@2.2.8: {}
 
+  w3c-xmlserializer@4.0.0:
+    dependencies:
+      xml-name-validator: 4.0.0
+
   webidl-conversions@3.0.1: {}
 
+  webidl-conversions@7.0.0: {}
+
+  whatwg-encoding@2.0.0:
+    dependencies:
+      iconv-lite: 0.6.3
+
   whatwg-mimetype@3.0.0: {}
 
+  whatwg-url@11.0.0:
+    dependencies:
+      tr46: 3.0.0
+      webidl-conversions: 7.0.0
+
   whatwg-url@5.0.0:
     dependencies:
       tr46: 0.0.3
       webidl-conversions: 3.0.1
 
+  which-boxed-primitive@1.1.1:
+    dependencies:
+      is-bigint: 1.1.0
+      is-boolean-object: 1.2.2
+      is-number-object: 1.1.1
+      is-string: 1.1.1
+      is-symbol: 1.1.1
+
+  which-builtin-type@1.2.1:
+    dependencies:
+      call-bound: 1.0.4
+      function.prototype.name: 1.1.8
+      has-tostringtag: 1.0.2
+      is-async-function: 2.1.1
+      is-date-object: 1.1.0
+      is-finalizationregistry: 1.1.1
+      is-generator-function: 1.1.2
+      is-regex: 1.2.1
+      is-weakref: 1.1.1
+      isarray: 2.0.5
+      which-boxed-primitive: 1.1.1
+      which-collection: 1.0.2
+      which-typed-array: 1.1.21
+
+  which-collection@1.0.2:
+    dependencies:
+      is-map: 2.0.3
+      is-set: 2.0.3
+      is-weakmap: 2.0.2
+      is-weakset: 2.0.4
+
+  which-typed-array@1.1.21:
+    dependencies:
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      for-each: 0.3.5
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-tostringtag: 1.0.2
+
   which@1.3.1:
     dependencies:
       isexe: 2.0.0
@@ -8158,11 +10338,13 @@ snapshots:
 
   word-wrap@1.2.5: {}
 
+  wrappy@1.0.2: {}
+
   write-file-atomic@7.0.1:
     dependencies:
       signal-exit: 4.1.0
 
-  ws@8.20.0: {}
+  ws@8.21.0: {}
 
   xml-lexer@0.2.2:
     dependencies:
@@ -8175,4 +10357,6 @@ snapshots:
       eventemitter3: 2.0.3
       xml-lexer: 0.2.2
 
+  xmlchars@2.2.0: {}
+
   yocto-queue@0.1.0: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 00000000000..c16cfb76cba
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,14 @@
+savePrefix: ''
+dedupePeerDependents: false
+updateNotifier: false
+minimumReleaseAge: 0
+
+peerDependencyRules:
+  allowedVersions:
+    eslint-plugin-github>eslint: '>=9'
+
+allowBuilds:
+  '@scarf/scarf': false
+  core-js: false
+  esbuild: true
+  unrs-resolver: true
diff --git a/public/assets/img/svg/octicon-flag.svg b/public/assets/img/svg/octicon-flag.svg
new file mode 100644
index 00000000000..1d757dca08d
--- /dev/null
+++ b/public/assets/img/svg/octicon-flag.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 16 16" class="svg octicon-flag" width="16" height="16" aria-hidden="true"><path fill="currentColor" d="M15 10.21V2.22c0-.08-.02-.15-.05-.23 0-.02 0-.04-.01-.06-.02-.05-.06-.09-.09-.13s-.04-.08-.07-.11c-.02-.02-.04-.02-.06-.04a.8.8 0 0 0-.19-.12c-2.78-1.11-4.86-.25-6.69.5-1.73.72-3.24 1.33-5.34.57v-.63c0-.41-.34-.75-.75-.75S1 1.56 1 1.97v12.5c0 .41.34.75.75.75s.75-.34.75-.75V4.18c.66.19 1.28.27 1.87.27 1.54 0 2.85-.54 4.05-1.04 1.66-.69 3.12-1.27 5.09-.65v6.43c-2.28-.56-4.06.17-5.66.84-1.25.52-2.41 1-3.79.92-.38-.03-.77.29-.8.7s.29.77.7.8c.14 0 .29.01.42.01 1.52 0 2.8-.53 4.04-1.04 1.79-.74 3.34-1.38 5.56-.5.06.02.12.03.19.03.03 0 .06.02.09.02.23 0 .45-.12.59-.31.04-.05.08-.09.1-.15.02-.05.02-.1.03-.15 0-.04.03-.08.03-.13z"/></svg>
\ No newline at end of file
diff --git a/public/assets/img/svg/octicon-repo-forked-locked.svg b/public/assets/img/svg/octicon-repo-forked-locked.svg
new file mode 100644
index 00000000000..4a2b35301f0
--- /dev/null
+++ b/public/assets/img/svg/octicon-repo-forked-locked.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" class="svg octicon-repo-forked-locked" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M9 10.167V9a3 3 0 1 1 6 0v1.167c.591.281 1 .884 1 1.583v2.5A1.75 1.75 0 0 1 14.25 16h-4.5A1.75 1.75 0 0 1 8 14.25v-2.5c0-.699.409-1.302 1-1.583M13.5 10h-3V9a1.5 1.5 0 0 1 3 0z"/><path fill-rule="evenodd" d="M3.25 1a2.247 2.247 0 0 1 1.938 3.388 2.25 2.25 0 0 1-1.189.982v.881a.746.746 0 0 0 .75.748h3.095c-.052.428-.008.986.051 1.499H7.75v1.748c-.315.418-.5.938-.5 1.502v.294a1 1 0 0 0-.256-.041.75.75 0 0 0-.53.22.79.79 0 0 0-.22.547.746.746 0 0 0 .75.748.8.8 0 0 0 .25-.042v.796q.002.376.107.72-.177.03-.357.031a2.247 2.247 0 0 1-1.938-3.388c.268-.456.69-.805 1.19-.983V8.5h-2.5a2.23 2.23 0 0 1-1.586-.66 2.25 2.25 0 0 1-.66-1.591v-.881A2.255 2.255 0 0 1 .03 2.867c.088-.523.36-.998.768-1.34C1.205 1.187 1.72 1 2.25 1zm0 1.499a.75.75 0 0 0-.53.22.8.8 0 0 0-.22.547.75.75 0 0 0 1.5 0 .8.8 0 0 0-.22-.547.75.75 0 0 0-.53-.22m7.5.75a2.247 2.247 0 0 1 1.938 3.388 2.25 2.25 0 0 1-1.189.982V8.96c0 .414.336.75.75.75h.5a.75.75 0 0 1 0 1.5h-.5a3 3 0 0 1-3-3v.54a.746.746 0 0 1 .75-.748h1.01V5a1.5 1.5 0 0 1 1.5-1.5zm0 1.499a.75.75 0 0 0-.53.22.8.8 0 0 0-.22.547.75.75 0 0 0 1.5 0 .8.8 0 0 0-.22-.547.75.75 0 0 0-.53-.22"/><path d="M8.63 7.749a.75.75 0 1 1-1.5 0 .75.75 0 0 1 1.5 0"/></svg>
\ No newline at end of file
diff --git a/public/assets/img/svg/octicon-sandbox.svg b/public/assets/img/svg/octicon-sandbox.svg
new file mode 100644
index 00000000000..6b5d6d07ec8
--- /dev/null
+++ b/public/assets/img/svg/octicon-sandbox.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" class="svg octicon-sandbox" width="16" height="16" aria-hidden="true"><path d="M7.72 8.97a.75.75 0 1 1 1.06 1.06L7.31 11.5l1.47 1.47a.75.75 0 1 1-1.06 1.06l-2-2a.75.75 0 0 1 0-1.06zm3.5 0a.75.75 0 0 1 1.06 0l2 2a.75.75 0 0 1 0 1.06l-2 2a.75.75 0 1 1-1.06-1.06l1.47-1.47-1.47-1.47a.75.75 0 0 1 0-1.06M14.5 8V1.75a.25.25 0 0 0-.25-.25H1.75a.25.25 0 0 0-.25.25v12.5c0 .138.112.25.25.25H3.5a.75.75 0 0 1 0 1.5H1.75A1.75 1.75 0 0 1 0 14.25V1.75C0 .784.784 0 1.75 0h12.5C15.216 0 16 .784 16 1.75V8a.75.75 0 0 1-1.5 0"/></svg>
\ No newline at end of file
diff --git a/public/assets/img/svg/octicon-stack-check.svg b/public/assets/img/svg/octicon-stack-check.svg
new file mode 100644
index 00000000000..5d35f04ad6f
--- /dev/null
+++ b/public/assets/img/svg/octicon-stack-check.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 16 16" class="svg octicon-stack-check" width="16" height="16" aria-hidden="true"><path fill="#010409" d="M7.122.392a1.75 1.75 0 0 1 1.756 0l5.003 2.902c.83.481.83 1.68 0 2.162L8.878 8.358a1.75 1.75 0 0 1-1.756 0L2.12 5.456a1.25 1.25 0 0 1 0-2.162zM8.125 1.69a.25.25 0 0 0-.25 0l-4.63 2.685 4.63 2.685a.25.25 0 0 0 .25 0l4.63-2.685zM1.602 7.79a.75.75 0 0 1 1.024-.273l5.249 3.044a.75.75 0 0 1-.753 1.297L1.874 8.814a.75.75 0 0 1-.272-1.025M1.602 11.29a.75.75 0 0 1 1.024-.273l5.249 3.044a.75.75 0 0 1-.753 1.297l-5.248-3.044a.75.75 0 0 1-.272-1.025M14.701 10.49a.75.75 0 1 1 1.098 1.02l-3.719 4a.75.75 0 0 1-1.075.024l-1.781-1.752a.751.751 0 0 1 1.052-1.069l1.23 1.21z"/></svg>
\ No newline at end of file
diff --git a/public/assets/img/svg/octicon-stack-remove.svg b/public/assets/img/svg/octicon-stack-remove.svg
new file mode 100644
index 00000000000..0cba43490fb
--- /dev/null
+++ b/public/assets/img/svg/octicon-stack-remove.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 16 16" class="svg octicon-stack-remove" width="16" height="16" aria-hidden="true"><path fill="#010409" d="M14.72 10.22a.75.75 0 0 1 1.06 1.06L14.06 13l1.72 1.72a.75.75 0 1 1-1.06 1.06L13 14.06l-1.72 1.72a.75.75 0 0 1-1.06-1.06L11.938 13l-1.72-1.72a.75.75 0 0 1 1.06-1.06L13 11.94zM1.601 11.29a.75.75 0 0 1 1.025-.273l5.249 3.044a.75.75 0 0 1-.753 1.297l-5.248-3.045A.75.75 0 0 1 1.6 11.29M1.601 7.79a.75.75 0 0 1 1.025-.273l5.249 3.044a.75.75 0 0 1-.753 1.297L1.874 8.814A.75.75 0 0 1 1.6 7.789"/><path fill="#010409" fill-rule="evenodd" d="M7.122.393a1.75 1.75 0 0 1 1.755 0l5.003 2.901c.83.482.83 1.68 0 2.162L8.877 8.358a1.75 1.75 0 0 1-1.755 0L2.119 5.456a1.25 1.25 0 0 1 0-2.162zM8.125 1.69a.25.25 0 0 0-.25 0L3.244 4.375l4.63 2.686a.25.25 0 0 0 .25 0l4.63-2.686z" clip-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/pyproject.toml b/pyproject.toml
index 20a10d19156..d62c8421e7e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,6 +7,7 @@ requires-python = ">=3.10"
 dev = [
   "djlint==1.36.4",
   "yamllint==1.38.0",
+  "zizmor==1.25.2",
 ]
 
 [tool.djlint]
diff --git a/renovate.json5 b/renovate.json5
index 586733b317e..bbfbb8d78a0 100644
--- a/renovate.json5
+++ b/renovate.json5
@@ -2,7 +2,7 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended", "helpers:pinGitHubActionDigests", "customManagers:githubActionsVersions"],
   "configMigration": true,
-  "enabledManagers": ["github-actions", "gomod", "npm", "pep621", "nix"],
+  "enabledManagers": ["github-actions", "gomod", "npm", "pep621", "nix", "custom.regex", "dockerfile"],
   "labels": ["dependencies"],
   "branchPrefix": "renovate/",
   "schedule": ["* * * * 1"], // dependency update PRs weekly, vulnerabilityAlerts bypasses this
@@ -18,6 +18,7 @@
       "managerFilePatterns": ["/(^|/)Makefile$/"],
       "matchStrings": [
         "[A-Z_]+_PACKAGE\\s*\\?=\\s*(?<depName>[^@\\s]+?)(?:/cmd/[^@/\\s]+)?@(?<currentValue>\\S+)\\s+# renovate: datasource=(?<datasource>\\S+)",
+        "[A-Z_]+_IMAGE\\s*\\?=\\s*(?<depName>[^:\\s]+):(?<currentValue>[^@\\s]+)@(?<currentDigest>sha256:[a-f0-9]+)\\s+# renovate: datasource=(?<datasource>\\S+)",
       ],
     },
   ],
@@ -38,10 +39,6 @@
       "matchPackageNames": ["tailwindcss"],
       "allowedVersions": "^3", // need to migrate
     },
-    {
-      "matchPackageNames": ["github.com/urfave/cli/v3"],
-      "allowedVersions": "<3.6.2", // v3.6.2 breaks -c flag parsing in help commands
-    },
     {
       "matchPackageNames": ["github.com/Azure/azure-sdk-for-go/sdk/azcore"],
       "allowedVersions": "<1.21.0", // v1.21.0+ uses API version unsupported by Azurite in CI
@@ -58,21 +55,48 @@
       "matchPackageNames": ["go.yaml.in/yaml/v4"],
       "allowedVersions": "<4.0.0-rc.4", // rc.4 changes block scalar serialization, wait for stable release
     },
+    {
+      "matchPackageNames": ["postgres"],
+      "allowedVersions": "/^14($|[.-])/", // pin to oldest supported major
+    },
+    {
+      "matchPackageNames": ["bitnamilegacy/mysql"],
+      "allowedVersions": "/^8\\.4($|[.-])/", // pin to oldest LTS
+    },
+    {
+      "matchPackageNames": ["mcr.microsoft.com/mssql/server"],
+      "allowedVersions": "/^2019($|[.-])/", // pin to oldest in extended support
+    },
     {
       "groupName": "go dependencies",
-      "matchDatasources": ["go"], // covers gomod manager + Makefile go-tool customManager
+      "matchManagers": ["gomod"],
+      "postUpdateOptions": ["gomodUpdateImportPaths"],
       "postUpgradeTasks": {
         "commands": ["make tidy"],
         "fileFilters": ["go.mod", "go.sum", "assets/go-licenses.json"],
         "executionMode": "branch",
       },
     },
+    {
+      "groupName": "tool dependencies",
+      "matchManagers": ["custom.regex"],
+      "matchFileNames": ["**/Makefile"],
+    },
+    {
+      "matchManagers": ["gomod"],
+      "matchDepNames": ["go"],
+      "matchDepTypes": ["golang"],
+      "rangeStrategy": "bump",
+      "schedule": ["at any time"],
+      "minimumReleaseAge": "0",
+    },
     {
       "groupName": "npm dependencies",
       "matchManagers": ["npm"],
+      "postUpdateOptions": ["pnpmDedupe"],
       "postUpgradeTasks": {
         "commands": ["make svg"],
-        "fileFilters": ["public/assets/img/svg/**"],
+        "fileFilters": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml", "public/assets/img/svg/**"],
         "executionMode": "branch",
       },
     },
@@ -84,5 +108,9 @@
       "groupName": "nix dependencies",
       "matchManagers": ["nix"],
     },
+    {
+      "groupName": "docker dependencies",
+      "matchManagers": ["dockerfile"],
+    },
   ],
 }
diff --git a/routers/api/actions/actions.go b/routers/api/actions/actions.go
index 6f03f290ea5..d75517cac67 100644
--- a/routers/api/actions/actions.go
+++ b/routers/api/actions/actions.go
@@ -6,9 +6,9 @@ package actions
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/actions/ping"
-	"code.gitea.io/gitea/routers/api/actions/runner"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/actions/ping"
+	"gitea.dev/routers/api/actions/runner"
 )
 
 func Routes(prefix string) *web.Router {
diff --git a/routers/api/actions/artifact.pb.go b/routers/api/actions/artifact.pb.go
index 130e20301fa..6b5ac371147 100644
--- a/routers/api/actions/artifact.pb.go
+++ b/routers/api/actions/artifact.pb.go
@@ -760,7 +760,7 @@ const file_artifact_proto_rawDesc = "" +
 	"\x16DeleteArtifactResponse\x12\x0e\n" +
 	"\x02ok\x18\x01 \x01(\bR\x02ok\x12\x1f\n" +
 	"\vartifact_id\x18\x02 \x01(\x03R\n" +
-	"artifactIdB)Z'code.gitea.io/gitea/routers/api/actionsb\x06proto3"
+	"artifactIdB\x1fZ\x1dgitea.dev/routers/api/actionsb\x06proto3"
 
 var (
 	file_artifact_proto_rawDescOnce sync.Once
diff --git a/routers/api/actions/artifact.proto b/routers/api/actions/artifact.proto
index 7da8bad564b..4781362a383 100644
--- a/routers/api/actions/artifact.proto
+++ b/routers/api/actions/artifact.proto
@@ -5,7 +5,7 @@ import "google/protobuf/wrappers.proto";
 
 package github.actions.results.api.v1;
 
-option go_package = "code.gitea.io/gitea/routers/api/actions";
+option go_package = "gitea.dev/routers/api/actions";
 
 message CreateArtifactRequest {
     string workflow_run_backend_id = 1;
diff --git a/routers/api/actions/artifacts.go b/routers/api/actions/artifacts.go
index 838ddb7f917..d82ac6988c8 100644
--- a/routers/api/actions/artifacts.go
+++ b/routers/api/actions/artifacts.go
@@ -69,19 +69,19 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	web_types "code.gitea.io/gitea/modules/web/types"
-	actions_service "code.gitea.io/gitea/services/actions"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	web_types "gitea.dev/modules/web/types"
+	actions_service "gitea.dev/services/actions"
+	"gitea.dev/services/context"
 )
 
 const artifactRouteBase = "/_apis/pipelines/workflows/{run_id}/artifacts"
diff --git a/routers/api/actions/artifacts_chunks.go b/routers/api/actions/artifacts_chunks.go
index 6f84f7a5cf8..c15085eecaa 100644
--- a/routers/api/actions/artifacts_chunks.go
+++ b/routers/api/actions/artifacts_chunks.go
@@ -17,12 +17,12 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
+	"gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
 )
 
 type saveUploadChunkOptions struct {
diff --git a/routers/api/actions/artifacts_utils.go b/routers/api/actions/artifacts_utils.go
index db62f0061b9..c996d3fea3b 100644
--- a/routers/api/actions/artifacts_utils.go
+++ b/routers/api/actions/artifacts_utils.go
@@ -10,9 +10,9 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/actions"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 )
 
 const (
diff --git a/routers/api/actions/artifactsv4.go b/routers/api/actions/artifactsv4.go
index 8bd3fb7e2b0..12e7c17ae88 100644
--- a/routers/api/actions/artifactsv4.go
+++ b/routers/api/actions/artifactsv4.go
@@ -102,17 +102,18 @@ import (
 	"strings"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	actions_module "gitea.dev/modules/actions"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/actions"
+	"gitea.dev/services/context"
 
 	"google.golang.org/protobuf/encoding/protojson"
 	"google.golang.org/protobuf/reflect/protoreflect"
@@ -162,13 +163,7 @@ func ArtifactsV4Routes(prefix string) *web.Router {
 }
 
 func (r *artifactV4Routes) buildSignature(endpoint, expires, artifactName string, taskID, artifactID int64) []byte {
-	mac := hmac.New(sha256.New, setting.GetGeneralTokenSigningSecret())
-	mac.Write([]byte(endpoint))
-	mac.Write([]byte(expires))
-	mac.Write([]byte(artifactName))
-	_, _ = fmt.Fprint(mac, taskID)
-	_, _ = fmt.Fprint(mac, artifactID)
-	return mac.Sum(nil)
+	return actions_module.BuildSignature("v4", endpoint, expires, artifactName, strconv.FormatInt(taskID, 10), strconv.FormatInt(artifactID, 10))
 }
 
 func (r *artifactV4Routes) buildArtifactURL(ctx *ArtifactContext, endpoint, artifactName string, taskID, artifactID int64) string {
diff --git a/routers/api/actions/ping/ping.go b/routers/api/actions/ping/ping.go
index 828350407ac..85924f179c2 100644
--- a/routers/api/actions/ping/ping.go
+++ b/routers/api/actions/ping/ping.go
@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/log"
+	pingv1 "gitea.dev/actions-proto-go/ping/v1"
+	"gitea.dev/actions-proto-go/ping/v1/pingv1connect"
+	"gitea.dev/modules/log"
 
-	pingv1 "code.gitea.io/actions-proto-go/ping/v1"
-	"code.gitea.io/actions-proto-go/ping/v1/pingv1connect"
 	"connectrpc.com/connect"
 )
 
diff --git a/routers/api/actions/ping/ping_test.go b/routers/api/actions/ping/ping_test.go
index 98d2dcb8206..3b3aec06d8c 100644
--- a/routers/api/actions/ping/ping_test.go
+++ b/routers/api/actions/ping/ping_test.go
@@ -8,8 +8,9 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	pingv1 "code.gitea.io/actions-proto-go/ping/v1"
-	"code.gitea.io/actions-proto-go/ping/v1/pingv1connect"
+	pingv1 "gitea.dev/actions-proto-go/ping/v1"
+	"gitea.dev/actions-proto-go/ping/v1/pingv1connect"
+
 	"connectrpc.com/connect"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/routers/api/actions/runner/interceptor.go b/routers/api/actions/runner/interceptor.go
index 521ba910e3b..a3508aa9b10 100644
--- a/routers/api/actions/runner/interceptor.go
+++ b/routers/api/actions/runner/interceptor.go
@@ -9,11 +9,11 @@ import (
 	"errors"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"connectrpc.com/connect"
 	"google.golang.org/grpc/codes"
diff --git a/routers/api/actions/runner/runner.go b/routers/api/actions/runner/runner.go
index eee39760edd..e98aef95153 100644
--- a/routers/api/actions/runner/runner.go
+++ b/routers/api/actions/runner/runner.go
@@ -7,21 +7,23 @@ import (
 	"context"
 	"errors"
 	"net/http"
+	"slices"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
-	actions_service "code.gitea.io/gitea/services/actions"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	"gitea.dev/actions-proto-go/runner/v1/runnerv1connect"
+	actions_model "gitea.dev/models/actions"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/actions"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
+	actions_service "gitea.dev/services/actions"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
-	"code.gitea.io/actions-proto-go/runner/v1/runnerv1connect"
 	"connectrpc.com/connect"
 	gouuid "github.com/google/uuid"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 )
 
 func NewRunnerServiceHandler() (string, http.Handler) {
@@ -67,17 +69,19 @@ func (s *Service) Register(
 	}
 
 	labels := req.Msg.Labels
+	hasCancellingSupport, _ := runnerRequestHasCancellingCapability(req.Msg)
 
 	// create new runner
 	name := util.EllipsisDisplayString(req.Msg.Name, 255)
 	runner := &actions_model.ActionRunner{
-		UUID:        gouuid.New().String(),
-		Name:        name,
-		OwnerID:     runnerToken.OwnerID,
-		RepoID:      runnerToken.RepoID,
-		Version:     req.Msg.Version,
-		AgentLabels: labels,
-		Ephemeral:   req.Msg.Ephemeral,
+		UUID:                 gouuid.New().String(),
+		Name:                 name,
+		OwnerID:              runnerToken.OwnerID,
+		RepoID:               runnerToken.RepoID,
+		Version:              req.Msg.Version,
+		AgentLabels:          labels,
+		Ephemeral:            req.Msg.Ephemeral,
+		HasCancellingSupport: hasCancellingSupport,
 	}
 	runner.GenerateAndFillToken()
 
@@ -107,14 +111,53 @@ func (s *Service) Register(
 	return res, nil
 }
 
+// runnerCapabilityCancelling is the wire string the runner advertises in its
+// capabilities list to indicate it understands the transitional cancelling
+// state and will run post-step cleanup before finalizing the task.
+const runnerCapabilityCancelling = "cancelling"
+
+type capabilityGetter interface {
+	GetCapabilities() []string
+}
+
+type declareRequest interface {
+	proto.Message
+	GetVersion() string
+	GetLabels() []string
+}
+
+func runnerRequestHasCancellingCapability(req proto.Message) (bool, bool) {
+	if req == nil {
+		return false, false
+	}
+
+	if typedReq, ok := any(req).(capabilityGetter); ok {
+		return slices.Contains(typedReq.GetCapabilities(), runnerCapabilityCancelling), true
+	}
+
+	return false, false
+}
+
+func applyDeclareRequestToRunner(runner *actions_model.ActionRunner, req declareRequest) []string {
+	runner.AgentLabels = req.GetLabels()
+	runner.Version = req.GetVersion()
+
+	cols := []string{"agent_labels", "version"}
+	hasCancellingSupport, capabilityStateKnown := runnerRequestHasCancellingCapability(req)
+	if capabilityStateKnown && runner.HasCancellingSupport != hasCancellingSupport {
+		runner.HasCancellingSupport = hasCancellingSupport
+		cols = append(cols, "has_cancelling_support")
+	}
+
+	return cols
+}
+
 func (s *Service) Declare(
 	ctx context.Context,
 	req *connect.Request[runnerv1.DeclareRequest],
 ) (*connect.Response[runnerv1.DeclareResponse], error) {
 	runner := GetRunner(ctx)
-	runner.AgentLabels = req.Msg.Labels
-	runner.Version = req.Msg.Version
-	if err := actions_model.UpdateRunner(ctx, runner, "agent_labels", "version"); err != nil {
+	if err := actions_model.UpdateRunner(ctx, runner, applyDeclareRequestToRunner(runner, req.Msg)...); err != nil {
 		return nil, status.Errorf(codes.Internal, "update runner: %v", err)
 	}
 
@@ -261,16 +304,32 @@ func (s *Service) UpdateLog(
 	}
 	ack := task.LogLength
 
-	if len(req.Msg.Rows) == 0 || req.Msg.Index > ack || int64(len(req.Msg.Rows))+req.Msg.Index <= ack {
+	// Trim rows the runner already had acked.
+	var rows []*runnerv1.LogRow
+	if req.Msg.Index <= ack && int64(len(req.Msg.Rows))+req.Msg.Index > ack {
+		rows = req.Msg.Rows[ack-req.Msg.Index:]
+	}
+
+	// Ack a re-sent finalize idempotently. Appending new rows past the seal errors.
+	if task.LogInStorage {
+		if len(rows) > 0 {
+			return nil, status.Errorf(codes.AlreadyExists, "log file has been archived")
+		}
 		res.Msg.AckIndex = ack
 		return res, nil
 	}
 
-	if task.LogInStorage {
-		return nil, status.Errorf(codes.AlreadyExists, "log file has been archived")
+	// Bail unless we have new rows or a NoMore to finalize. Even with
+	// NoMore, bail when the runner has outrun the server — archiving a
+	// log with a gap is worse than asking it to retry.
+	if len(rows) == 0 && (!req.Msg.NoMore || req.Msg.Index > ack) {
+		res.Msg.AckIndex = ack
+		return res, nil
 	}
 
-	rows := req.Msg.Rows[ack-req.Msg.Index:]
+	// WriteLogs is called even with no rows: with offset==0 it bootstraps
+	// an empty DBFS file so TransferLogs below has something to read when
+	// the runner finalizes a task that produced no log output.
 	ns, err := actions.WriteLogs(ctx, task.LogFilename, task.LogSize, rows)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "unable to append logs to dbfs file: %v", err)
diff --git a/routers/api/actions/runner/runner_test.go b/routers/api/actions/runner/runner_test.go
new file mode 100644
index 00000000000..b2ed9290878
--- /dev/null
+++ b/routers/api/actions/runner/runner_test.go
@@ -0,0 +1,86 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package runner
+
+import (
+	"testing"
+
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type capabilityRegisterRequest struct {
+	*runnerv1.RegisterRequest
+	capabilities []string
+}
+
+func (r *capabilityRegisterRequest) GetCapabilities() []string {
+	return r.capabilities
+}
+
+type capabilityDeclareRequest struct {
+	*runnerv1.DeclareRequest
+	capabilities []string
+}
+
+func (r *capabilityDeclareRequest) GetCapabilities() []string {
+	return r.capabilities
+}
+
+func TestRunnerRequestHasCancellingCapabilityTypedAccessor(t *testing.T) {
+	registerReq := &capabilityRegisterRequest{
+		RegisterRequest: &runnerv1.RegisterRequest{},
+		capabilities:    []string{runnerCapabilityCancelling, "other"},
+	}
+	hasCapability, known := runnerRequestHasCancellingCapability(registerReq)
+	assert.True(t, hasCapability)
+	assert.True(t, known)
+
+	declareReq := &capabilityDeclareRequest{
+		DeclareRequest: &runnerv1.DeclareRequest{},
+		capabilities:   nil,
+	}
+	hasCapability, known = runnerRequestHasCancellingCapability(declareReq)
+	assert.False(t, hasCapability)
+	assert.True(t, known)
+
+	hasCapability, known = runnerRequestHasCancellingCapability(nil)
+	assert.False(t, hasCapability)
+	assert.False(t, known)
+}
+
+func TestApplyDeclareRequestToRunnerPreservesUnknownCapabilityState(t *testing.T) {
+	runner := &actions_model.ActionRunner{
+		HasCancellingSupport: true,
+	}
+	req := &runnerv1.DeclareRequest{
+		Version: "1.2.3",
+		Labels:  []string{"linux"},
+	}
+
+	cols := applyDeclareRequestToRunner(runner, req)
+	assert.Equal(t, []string{"agent_labels", "version"}, cols)
+	assert.True(t, runner.HasCancellingSupport)
+	assert.Equal(t, "1.2.3", runner.Version)
+	assert.Equal(t, []string{"linux"}, runner.AgentLabels)
+}
+
+func TestApplyDeclareRequestToRunnerUpdatesTypedCapabilityState(t *testing.T) {
+	runner := &actions_model.ActionRunner{
+		HasCancellingSupport: true,
+	}
+	req := &capabilityDeclareRequest{
+		DeclareRequest: &runnerv1.DeclareRequest{
+			Version: "1.2.3",
+			Labels:  []string{"linux"},
+		},
+		capabilities: []string{},
+	}
+
+	cols := applyDeclareRequestToRunner(runner, req)
+	assert.Equal(t, []string{"agent_labels", "version", "has_cancelling_support"}, cols)
+	assert.False(t, runner.HasCancellingSupport)
+}
diff --git a/routers/api/packages/alpine/alpine.go b/routers/api/packages/alpine/alpine.go
index 52fc287a0e4..d3560dc4b99 100644
--- a/routers/api/packages/alpine/alpine.go
+++ b/routers/api/packages/alpine/alpine.go
@@ -13,15 +13,15 @@ import (
 	"net/http"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	alpine_module "code.gitea.io/gitea/modules/packages/alpine"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
-	alpine_service "code.gitea.io/gitea/services/packages/alpine"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	alpine_module "gitea.dev/modules/packages/alpine"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
+	alpine_service "gitea.dev/services/packages/alpine"
 )
 
 func apiError(ctx *context.Context, status int, obj any) {
diff --git a/routers/api/packages/api.go b/routers/api/packages/api.go
index 9283eb8a5e0..3de53929e96 100644
--- a/routers/api/packages/api.go
+++ b/routers/api/packages/api.go
@@ -6,36 +6,36 @@ package packages
 import (
 	"net/http"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/packages/alpine"
-	"code.gitea.io/gitea/routers/api/packages/arch"
-	"code.gitea.io/gitea/routers/api/packages/cargo"
-	"code.gitea.io/gitea/routers/api/packages/chef"
-	"code.gitea.io/gitea/routers/api/packages/composer"
-	"code.gitea.io/gitea/routers/api/packages/conan"
-	"code.gitea.io/gitea/routers/api/packages/conda"
-	"code.gitea.io/gitea/routers/api/packages/container"
-	"code.gitea.io/gitea/routers/api/packages/cran"
-	"code.gitea.io/gitea/routers/api/packages/debian"
-	"code.gitea.io/gitea/routers/api/packages/generic"
-	"code.gitea.io/gitea/routers/api/packages/goproxy"
-	"code.gitea.io/gitea/routers/api/packages/helm"
-	"code.gitea.io/gitea/routers/api/packages/maven"
-	"code.gitea.io/gitea/routers/api/packages/npm"
-	"code.gitea.io/gitea/routers/api/packages/nuget"
-	"code.gitea.io/gitea/routers/api/packages/pub"
-	"code.gitea.io/gitea/routers/api/packages/pypi"
-	"code.gitea.io/gitea/routers/api/packages/rpm"
-	"code.gitea.io/gitea/routers/api/packages/rubygems"
-	"code.gitea.io/gitea/routers/api/packages/swift"
-	"code.gitea.io/gitea/routers/api/packages/terraform"
-	"code.gitea.io/gitea/routers/api/packages/vagrant"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/context"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/perm"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/packages/alpine"
+	"gitea.dev/routers/api/packages/arch"
+	"gitea.dev/routers/api/packages/cargo"
+	"gitea.dev/routers/api/packages/chef"
+	"gitea.dev/routers/api/packages/composer"
+	"gitea.dev/routers/api/packages/conan"
+	"gitea.dev/routers/api/packages/conda"
+	"gitea.dev/routers/api/packages/container"
+	"gitea.dev/routers/api/packages/cran"
+	"gitea.dev/routers/api/packages/debian"
+	"gitea.dev/routers/api/packages/generic"
+	"gitea.dev/routers/api/packages/goproxy"
+	"gitea.dev/routers/api/packages/helm"
+	"gitea.dev/routers/api/packages/maven"
+	"gitea.dev/routers/api/packages/npm"
+	"gitea.dev/routers/api/packages/nuget"
+	"gitea.dev/routers/api/packages/pub"
+	"gitea.dev/routers/api/packages/pypi"
+	"gitea.dev/routers/api/packages/rpm"
+	"gitea.dev/routers/api/packages/rubygems"
+	"gitea.dev/routers/api/packages/swift"
+	"gitea.dev/routers/api/packages/terraform"
+	"gitea.dev/routers/api/packages/vagrant"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/context"
 )
 
 func reqPackageAccess(accessMode perm.AccessMode) func(ctx *context.Context) {
diff --git a/routers/api/packages/arch/arch.go b/routers/api/packages/arch/arch.go
index f3b70f39b68..eab2733f570 100644
--- a/routers/api/packages/arch/arch.go
+++ b/routers/api/packages/arch/arch.go
@@ -12,15 +12,15 @@ import (
 	"net/http"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	arch_module "code.gitea.io/gitea/modules/packages/arch"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
-	arch_service "code.gitea.io/gitea/services/packages/arch"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	arch_module "gitea.dev/modules/packages/arch"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
+	arch_service "gitea.dev/services/packages/arch"
 )
 
 func apiError(ctx *context.Context, status int, obj any) {
diff --git a/routers/api/packages/auth.go b/routers/api/packages/auth.go
index 28e5be1e4d9..27b761fc054 100644
--- a/routers/api/packages/auth.go
+++ b/routers/api/packages/auth.go
@@ -6,10 +6,10 @@ package packages
 import (
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/packages"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/packages"
 )
 
 var _ auth.Method = &Auth{}
diff --git a/routers/api/packages/cargo/cargo.go b/routers/api/packages/cargo/cargo.go
index a7f00ee1cbe..4e4e6f1289b 100644
--- a/routers/api/packages/cargo/cargo.go
+++ b/routers/api/packages/cargo/cargo.go
@@ -10,20 +10,20 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	cargo_module "code.gitea.io/gitea/modules/packages/cargo"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	packages_service "code.gitea.io/gitea/services/packages"
-	cargo_service "code.gitea.io/gitea/services/packages/cargo"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	cargo_module "gitea.dev/modules/packages/cargo"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	packages_service "gitea.dev/services/packages"
+	cargo_service "gitea.dev/services/packages/cargo"
 )
 
 // https://doc.rust-lang.org/cargo/reference/registries.html#web-api
diff --git a/routers/api/packages/chef/auth.go b/routers/api/packages/chef/auth.go
index 5f7dad9d2db..9fb1b28c5e1 100644
--- a/routers/api/packages/chef/auth.go
+++ b/routers/api/packages/chef/auth.go
@@ -24,10 +24,10 @@ import (
 	"strings"
 	"time"
 
-	user_model "code.gitea.io/gitea/models/user"
-	chef_module "code.gitea.io/gitea/modules/packages/chef"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/auth"
+	user_model "gitea.dev/models/user"
+	chef_module "gitea.dev/modules/packages/chef"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/auth"
 )
 
 const (
diff --git a/routers/api/packages/chef/chef.go b/routers/api/packages/chef/chef.go
index 50011ab0b17..4f87857e7b9 100644
--- a/routers/api/packages/chef/chef.go
+++ b/routers/api/packages/chef/chef.go
@@ -13,16 +13,16 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	chef_module "code.gitea.io/gitea/modules/packages/chef"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	chef_module "gitea.dev/modules/packages/chef"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 )
 
 func apiError(ctx *context.Context, status int, obj any) {
diff --git a/routers/api/packages/composer/api.go b/routers/api/packages/composer/api.go
index a3ea2c2f9a6..8f1a7e0d8a4 100644
--- a/routers/api/packages/composer/api.go
+++ b/routers/api/packages/composer/api.go
@@ -8,8 +8,11 @@ import (
 	"net/url"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	composer_module "code.gitea.io/gitea/modules/packages/composer"
+	packages_model "gitea.dev/models/packages"
+	access_model "gitea.dev/models/perm/access"
+	"gitea.dev/modules/log"
+	composer_module "gitea.dev/modules/packages/composer"
+	"gitea.dev/services/context"
 )
 
 // ServiceIndexResponse contains registry endpoints
@@ -91,7 +94,7 @@ type Source struct {
 	Reference string `json:"reference"`
 }
 
-func createPackageMetadataResponse(registryURL string, pds []*packages_model.PackageDescriptor) *PackageMetadataResponse {
+func createPackageMetadataResponse(ctx *context.Context, registryURL string, pds []*packages_model.PackageDescriptor) *PackageMetadataResponse {
 	versions := make([]*PackageVersionMetadata, 0, len(pds))
 
 	for _, pd := range pds {
@@ -116,10 +119,15 @@ func createPackageMetadataResponse(registryURL string, pds []*packages_model.Pac
 			},
 		}
 		if pd.Repository != nil {
-			pkg.Source = Source{
-				URL:       pd.Repository.HTMLURL(),
-				Type:      "git",
-				Reference: pd.Version.Version,
+			permission, err := access_model.GetDoerRepoPermission(ctx, pd.Repository, ctx.Doer)
+			if err != nil {
+				log.Error("GetDoerRepoPermission[%d]: %v", pd.Repository.ID, err)
+			} else if permission.HasAnyUnitAccessOrPublicAccess() {
+				pkg.Source = Source{
+					URL:       pd.Repository.HTMLURL(),
+					Type:      "git",
+					Reference: pd.Version.Version,
+				}
 			}
 		}
 
diff --git a/routers/api/packages/composer/composer.go b/routers/api/packages/composer/composer.go
index 8eb66ca2447..f09263a9233 100644
--- a/routers/api/packages/composer/composer.go
+++ b/routers/api/packages/composer/composer.go
@@ -10,17 +10,17 @@ import (
 	"net/url"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	composer_module "code.gitea.io/gitea/modules/packages/composer"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	packages_service "code.gitea.io/gitea/services/packages"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	composer_module "gitea.dev/modules/packages/composer"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	packages_service "gitea.dev/services/packages"
 )
 
 func apiError(ctx *context.Context, status int, obj any) {
@@ -146,6 +146,7 @@ func PackageMetadata(ctx *context.Context) {
 	}
 
 	resp := createPackageMetadataResponse(
+		ctx,
 		setting.AppURL+"api/packages/"+ctx.Package.Owner.Name+"/composer",
 		pds,
 	)
diff --git a/routers/api/packages/conan/conan.go b/routers/api/packages/conan/conan.go
index 126b1593cde..f328cd0a443 100644
--- a/routers/api/packages/conan/conan.go
+++ b/routers/api/packages/conan/conan.go
@@ -12,21 +12,21 @@ import (
 	"strings"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	conan_model "code.gitea.io/gitea/models/packages/conan"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	conan_module "code.gitea.io/gitea/modules/packages/conan"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	auth_service "code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/context"
-	notify_service "code.gitea.io/gitea/services/notify"
-	packages_service "code.gitea.io/gitea/services/packages"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	conan_model "gitea.dev/models/packages/conan"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	packages_module "gitea.dev/modules/packages"
+	conan_module "gitea.dev/modules/packages/conan"
+	"gitea.dev/modules/setting"
+	"gitea.dev/routers/api/packages/helper"
+	auth_service "gitea.dev/services/auth"
+	"gitea.dev/services/context"
+	notify_service "gitea.dev/services/notify"
+	packages_service "gitea.dev/services/packages"
 )
 
 const (
diff --git a/routers/api/packages/conan/search.go b/routers/api/packages/conan/search.go
index 0dbbd500d28..f816ab09d7d 100644
--- a/routers/api/packages/conan/search.go
+++ b/routers/api/packages/conan/search.go
@@ -8,11 +8,11 @@ import (
 	"net/http"
 	"strings"
 
-	conan_model "code.gitea.io/gitea/models/packages/conan"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	conan_module "code.gitea.io/gitea/modules/packages/conan"
-	"code.gitea.io/gitea/services/context"
+	conan_model "gitea.dev/models/packages/conan"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	conan_module "gitea.dev/modules/packages/conan"
+	"gitea.dev/services/context"
 )
 
 // SearchResult contains the found recipe names
diff --git a/routers/api/packages/conda/conda.go b/routers/api/packages/conda/conda.go
index 8519ae3e082..f6d3be53623 100644
--- a/routers/api/packages/conda/conda.go
+++ b/routers/api/packages/conda/conda.go
@@ -10,15 +10,15 @@ import (
 	"net/http"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	conda_model "code.gitea.io/gitea/models/packages/conda"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	conda_module "code.gitea.io/gitea/modules/packages/conda"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	conda_model "gitea.dev/models/packages/conda"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	conda_module "gitea.dev/modules/packages/conda"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/dsnet/compress/bzip2"
 )
diff --git a/routers/api/packages/container/blob.go b/routers/api/packages/container/blob.go
index da509bc7a70..b2ba5eac412 100644
--- a/routers/api/packages/container/blob.go
+++ b/routers/api/packages/container/blob.go
@@ -11,15 +11,15 @@ import (
 	"os"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	container_model "code.gitea.io/gitea/models/packages/container"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/log"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	container_module "code.gitea.io/gitea/modules/packages/container"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	container_model "gitea.dev/models/packages/container"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/log"
+	packages_module "gitea.dev/modules/packages"
+	container_module "gitea.dev/modules/packages/container"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/opencontainers/go-digest"
 )
diff --git a/routers/api/packages/container/container.go b/routers/api/packages/container/container.go
index 3fdd62298ea..a293cac08d8 100644
--- a/routers/api/packages/container/container.go
+++ b/routers/api/packages/container/container.go
@@ -15,25 +15,25 @@ import (
 	"strings"
 	"sync"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	packages_model "code.gitea.io/gitea/models/packages"
-	container_model "code.gitea.io/gitea/models/packages/container"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	container_module "code.gitea.io/gitea/modules/packages/container"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	auth_service "code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
-	container_service "code.gitea.io/gitea/services/packages/container"
+	auth_model "gitea.dev/models/auth"
+	packages_model "gitea.dev/models/packages"
+	container_model "gitea.dev/models/packages/container"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	container_module "gitea.dev/modules/packages/container"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	auth_service "gitea.dev/services/auth"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
+	container_service "gitea.dev/services/packages/container"
 
 	"github.com/opencontainers/go-digest"
 )
diff --git a/routers/api/packages/container/manifest.go b/routers/api/packages/container/manifest.go
index 30d591e60ad..79b8375a4a8 100644
--- a/routers/api/packages/container/manifest.go
+++ b/routers/api/packages/container/manifest.go
@@ -11,19 +11,19 @@ import (
 	"os"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	container_model "code.gitea.io/gitea/models/packages/container"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	container_module "code.gitea.io/gitea/modules/packages/container"
-	"code.gitea.io/gitea/modules/util"
-	notify_service "code.gitea.io/gitea/services/notify"
-	packages_service "code.gitea.io/gitea/services/packages"
-	container_service "code.gitea.io/gitea/services/packages/container"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	container_model "gitea.dev/models/packages/container"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	packages_module "gitea.dev/modules/packages"
+	container_module "gitea.dev/modules/packages/container"
+	"gitea.dev/modules/util"
+	notify_service "gitea.dev/services/notify"
+	packages_service "gitea.dev/services/packages"
+	container_service "gitea.dev/services/packages/container"
 
 	"github.com/opencontainers/go-digest"
 	oci "github.com/opencontainers/image-spec/specs-go/v1"
diff --git a/routers/api/packages/cran/cran.go b/routers/api/packages/cran/cran.go
index 323690fd52d..57c94f0aae1 100644
--- a/routers/api/packages/cran/cran.go
+++ b/routers/api/packages/cran/cran.go
@@ -11,14 +11,14 @@ import (
 	"net/http"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	cran_model "code.gitea.io/gitea/models/packages/cran"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	cran_module "code.gitea.io/gitea/modules/packages/cran"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	cran_model "gitea.dev/models/packages/cran"
+	packages_module "gitea.dev/modules/packages"
+	cran_module "gitea.dev/modules/packages/cran"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 )
 
 func apiError(ctx *context.Context, status int, obj any) {
diff --git a/routers/api/packages/debian/debian.go b/routers/api/packages/debian/debian.go
index 785efb6dda3..f9bf2960f83 100644
--- a/routers/api/packages/debian/debian.go
+++ b/routers/api/packages/debian/debian.go
@@ -11,16 +11,16 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	debian_module "code.gitea.io/gitea/modules/packages/debian"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	notify_service "code.gitea.io/gitea/services/notify"
-	packages_service "code.gitea.io/gitea/services/packages"
-	debian_service "code.gitea.io/gitea/services/packages/debian"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	packages_module "gitea.dev/modules/packages"
+	debian_module "gitea.dev/modules/packages/debian"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	notify_service "gitea.dev/services/notify"
+	packages_service "gitea.dev/services/packages"
+	debian_service "gitea.dev/services/packages/debian"
 )
 
 func apiError(ctx *context.Context, status int, obj any) {
diff --git a/routers/api/packages/generic/generic.go b/routers/api/packages/generic/generic.go
index 5eb189e6d9c..32abf661aab 100644
--- a/routers/api/packages/generic/generic.go
+++ b/routers/api/packages/generic/generic.go
@@ -10,11 +10,11 @@ import (
 	"strings"
 	"unicode"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	packages_module "gitea.dev/modules/packages"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 )
 
 var (
diff --git a/routers/api/packages/goproxy/goproxy.go b/routers/api/packages/goproxy/goproxy.go
index 951f50053c3..9d3ea6515f9 100644
--- a/routers/api/packages/goproxy/goproxy.go
+++ b/routers/api/packages/goproxy/goproxy.go
@@ -11,14 +11,14 @@ import (
 	"sort"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	goproxy_module "code.gitea.io/gitea/modules/packages/goproxy"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	goproxy_module "gitea.dev/modules/packages/goproxy"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 )
 
 func apiError(ctx *context.Context, status int, obj any) {
diff --git a/routers/api/packages/helm/helm.go b/routers/api/packages/helm/helm.go
index 4c1b72d5c01..c0fc032e15c 100644
--- a/routers/api/packages/helm/helm.go
+++ b/routers/api/packages/helm/helm.go
@@ -12,18 +12,18 @@ import (
 	"strings"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	helm_module "code.gitea.io/gitea/modules/packages/helm"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	helm_module "gitea.dev/modules/packages/helm"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func apiError(ctx *context.Context, status int, obj any) {
diff --git a/routers/api/packages/helper/helper.go b/routers/api/packages/helper/helper.go
index 01ae5d2b7ee..309d5ff4a1c 100644
--- a/routers/api/packages/helper/helper.go
+++ b/routers/api/packages/helper/helper.go
@@ -9,10 +9,10 @@ import (
 	"net/http"
 	"net/url"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 // ProcessErrorForUser logs the error and returns a user-error message for the end user.
diff --git a/routers/api/packages/maven/api.go b/routers/api/packages/maven/api.go
index ec6b9cfb0e0..75d142278a3 100644
--- a/routers/api/packages/maven/api.go
+++ b/routers/api/packages/maven/api.go
@@ -7,7 +7,7 @@ import (
 	"encoding/xml"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
+	packages_model "gitea.dev/models/packages"
 )
 
 // MetadataResponse https://maven.apache.org/ref/3.2.5/maven-repository-metadata/repository-metadata.html
diff --git a/routers/api/packages/maven/maven.go b/routers/api/packages/maven/maven.go
index 446398caf70..250074a5547 100644
--- a/routers/api/packages/maven/maven.go
+++ b/routers/api/packages/maven/maven.go
@@ -19,15 +19,15 @@ import (
 	"strconv"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	maven_module "code.gitea.io/gitea/modules/packages/maven"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	maven_module "gitea.dev/modules/packages/maven"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 )
 
 const (
diff --git a/routers/api/packages/npm/api.go b/routers/api/packages/npm/api.go
index 636680242a4..ffde98b3faf 100644
--- a/routers/api/packages/npm/api.go
+++ b/routers/api/packages/npm/api.go
@@ -10,9 +10,9 @@ import (
 	"net/url"
 	"sort"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	npm_module "code.gitea.io/gitea/modules/packages/npm"
-	"code.gitea.io/gitea/modules/setting"
+	packages_model "gitea.dev/models/packages"
+	npm_module "gitea.dev/modules/packages/npm"
+	"gitea.dev/modules/setting"
 )
 
 func createPackageMetadataResponse(registryURL string, pds []*packages_model.PackageDescriptor) *npm_module.PackageMetadata {
diff --git a/routers/api/packages/npm/npm.go b/routers/api/packages/npm/npm.go
index b65edf23344..9c92cddaa8e 100644
--- a/routers/api/packages/npm/npm.go
+++ b/routers/api/packages/npm/npm.go
@@ -12,19 +12,19 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	npm_module "code.gitea.io/gitea/modules/packages/npm"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	npm_module "gitea.dev/modules/packages/npm"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/hashicorp/go-version"
 )
diff --git a/routers/api/packages/nuget/api_v2.go b/routers/api/packages/nuget/api_v2.go
index 801c60af130..120c9c63fcb 100644
--- a/routers/api/packages/nuget/api_v2.go
+++ b/routers/api/packages/nuget/api_v2.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	nuget_module "code.gitea.io/gitea/modules/packages/nuget"
+	packages_model "gitea.dev/models/packages"
+	nuget_module "gitea.dev/modules/packages/nuget"
 )
 
 type AtomTitle struct {
diff --git a/routers/api/packages/nuget/api_v3.go b/routers/api/packages/nuget/api_v3.go
index 3262f2d9afb..e401cdc99bb 100644
--- a/routers/api/packages/nuget/api_v3.go
+++ b/routers/api/packages/nuget/api_v3.go
@@ -7,8 +7,8 @@ import (
 	"sort"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	nuget_module "code.gitea.io/gitea/modules/packages/nuget"
+	packages_model "gitea.dev/models/packages"
+	nuget_module "gitea.dev/modules/packages/nuget"
 
 	"golang.org/x/text/collate"
 	"golang.org/x/text/language"
diff --git a/routers/api/packages/nuget/auth.go b/routers/api/packages/nuget/auth.go
index 8248453e749..ba5cc3f46eb 100644
--- a/routers/api/packages/nuget/auth.go
+++ b/routers/api/packages/nuget/auth.go
@@ -6,8 +6,8 @@ package nuget
 import (
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/services/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/services/auth"
 )
 
 var _ auth.Method = &Auth{}
diff --git a/routers/api/packages/nuget/nuget.go b/routers/api/packages/nuget/nuget.go
index c42fdd7db53..eca255424e8 100644
--- a/routers/api/packages/nuget/nuget.go
+++ b/routers/api/packages/nuget/nuget.go
@@ -14,17 +14,17 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	nuget_model "code.gitea.io/gitea/models/packages/nuget"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	nuget_module "code.gitea.io/gitea/modules/packages/nuget"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	nuget_model "gitea.dev/models/packages/nuget"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	nuget_module "gitea.dev/modules/packages/nuget"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 )
 
 func apiError(ctx *context.Context, status int, obj any) {
diff --git a/routers/api/packages/pub/pub.go b/routers/api/packages/pub/pub.go
index 7564e14d0e8..842b6d2731b 100644
--- a/routers/api/packages/pub/pub.go
+++ b/routers/api/packages/pub/pub.go
@@ -13,15 +13,15 @@ import (
 	"strings"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	pub_module "code.gitea.io/gitea/modules/packages/pub"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	pub_module "gitea.dev/modules/packages/pub"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 )
 
 func jsonResponse(ctx *context.Context, status int, obj any) {
diff --git a/routers/api/packages/pypi/pypi.go b/routers/api/packages/pypi/pypi.go
index 1b8f4bea34a..3526d1aac2d 100644
--- a/routers/api/packages/pypi/pypi.go
+++ b/routers/api/packages/pypi/pypi.go
@@ -13,14 +13,14 @@ import (
 	"strings"
 	"unicode"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	pypi_module "code.gitea.io/gitea/modules/packages/pypi"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/validation"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	packages_module "gitea.dev/modules/packages"
+	pypi_module "gitea.dev/modules/packages/pypi"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/validation"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 )
 
 // https://peps.python.org/pep-0426/#name
diff --git a/routers/api/packages/rpm/rpm.go b/routers/api/packages/rpm/rpm.go
index d4fdb0affa2..c1475cf5c83 100644
--- a/routers/api/packages/rpm/rpm.go
+++ b/routers/api/packages/rpm/rpm.go
@@ -13,18 +13,18 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	rpm_module "code.gitea.io/gitea/modules/packages/rpm"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	notify_service "code.gitea.io/gitea/services/notify"
-	packages_service "code.gitea.io/gitea/services/packages"
-	rpm_service "code.gitea.io/gitea/services/packages/rpm"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	rpm_module "gitea.dev/modules/packages/rpm"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	notify_service "gitea.dev/services/notify"
+	packages_service "gitea.dev/services/packages"
+	rpm_service "gitea.dev/services/packages/rpm"
 )
 
 func apiError(ctx *context.Context, status int, obj any) {
diff --git a/routers/api/packages/rubygems/rubygems.go b/routers/api/packages/rubygems/rubygems.go
index fe2e7af6d9a..5754c0e3c34 100644
--- a/routers/api/packages/rubygems/rubygems.go
+++ b/routers/api/packages/rubygems/rubygems.go
@@ -13,15 +13,15 @@ import (
 	"net/http"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	rubygems_module "code.gitea.io/gitea/modules/packages/rubygems"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	rubygems_module "gitea.dev/modules/packages/rubygems"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 )
 
 func apiError(ctx *context.Context, status int, obj any) {
diff --git a/routers/api/packages/rubygems/rubygems_test.go b/routers/api/packages/rubygems/rubygems_test.go
index a07e12a7d3c..a2d8a523058 100644
--- a/routers/api/packages/rubygems/rubygems_test.go
+++ b/routers/api/packages/rubygems/rubygems_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	rubygems_module "code.gitea.io/gitea/modules/packages/rubygems"
+	rubygems_module "gitea.dev/modules/packages/rubygems"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/api/packages/swift/swift.go b/routers/api/packages/swift/swift.go
index 6d70f360f4c..e27ece37207 100644
--- a/routers/api/packages/swift/swift.go
+++ b/routers/api/packages/swift/swift.go
@@ -12,17 +12,17 @@ import (
 	"sort"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	swift_module "code.gitea.io/gitea/modules/packages/swift"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	swift_module "gitea.dev/modules/packages/swift"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/hashicorp/go-version"
 )
diff --git a/routers/api/packages/terraform/terraform.go b/routers/api/packages/terraform/terraform.go
index 8b731b7dd26..ee188e685fe 100644
--- a/routers/api/packages/terraform/terraform.go
+++ b/routers/api/packages/terraform/terraform.go
@@ -13,15 +13,15 @@ import (
 	"strings"
 	"unicode"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	terraform_module "code.gitea.io/gitea/modules/packages/terraform"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	terraform_module "gitea.dev/modules/packages/terraform"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 )
 
 var packageNameRegex = regexp.MustCompile(`\A[-_+.\w]+\z`)
diff --git a/routers/api/packages/vagrant/vagrant.go b/routers/api/packages/vagrant/vagrant.go
index 36fc41f5819..29a81bf531f 100644
--- a/routers/api/packages/vagrant/vagrant.go
+++ b/routers/api/packages/vagrant/vagrant.go
@@ -12,13 +12,13 @@ import (
 	"sort"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	vagrant_module "code.gitea.io/gitea/modules/packages/vagrant"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/routers/api/packages/helper"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	packages_module "gitea.dev/modules/packages"
+	vagrant_module "gitea.dev/modules/packages/vagrant"
+	"gitea.dev/modules/setting"
+	"gitea.dev/routers/api/packages/helper"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/hashicorp/go-version"
 )
diff --git a/routers/api/v1/activitypub/person.go b/routers/api/v1/activitypub/person.go
index 2ee3368a87e..7e85fedc54e 100644
--- a/routers/api/v1/activitypub/person.go
+++ b/routers/api/v1/activitypub/person.go
@@ -6,7 +6,7 @@ package activitypub
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/services/context"
 )
 
 func NotImplemented(ctx *context.APIContext) {
diff --git a/routers/api/v1/admin/action.go b/routers/api/v1/admin/action.go
index 62e0c6addcb..5fe0439f480 100644
--- a/routers/api/v1/admin/action.go
+++ b/routers/api/v1/admin/action.go
@@ -4,8 +4,8 @@
 package admin
 
 import (
-	"code.gitea.io/gitea/routers/api/v1/shared"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/routers/api/v1/shared"
+	"gitea.dev/services/context"
 )
 
 // ListWorkflowJobs Lists all jobs
@@ -29,6 +29,14 @@ func ListWorkflowJobs(ctx *context.APIContext) {
 	//   in: query
 	//   description: page size of results
 	//   type: integer
+	// - name: sort
+	//   in: query
+	//   description: sort jobs by attribute. Supported values are "id". Default is "id"
+	//   type: string
+	// - name: order
+	//   in: query
+	//   description: sort order, either "asc" (ascending) or "desc" (descending). Default is "asc"
+	//   type: string
 	// responses:
 	//   "200":
 	//     "$ref": "#/responses/WorkflowJobsList"
@@ -36,6 +44,8 @@ func ListWorkflowJobs(ctx *context.APIContext) {
 	//     "$ref": "#/responses/error"
 	//   "404":
 	//     "$ref": "#/responses/notFound"
+	//   "422":
+	//     "$ref": "#/responses/validationError"
 
 	shared.ListJobs(ctx, 0, 0, 0, nil)
 }
diff --git a/routers/api/v1/admin/adopt.go b/routers/api/v1/admin/adopt.go
index 9f1175a1ffe..8f8b9fd0ecb 100644
--- a/routers/api/v1/admin/adopt.go
+++ b/routers/api/v1/admin/adopt.go
@@ -6,12 +6,12 @@ package admin
 import (
 	"net/http"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 )
 
 // ListUnadoptedRepositories lists the unadopted repositories that match the provided names
diff --git a/routers/api/v1/admin/cron.go b/routers/api/v1/admin/cron.go
index b4dae110958..d8fd49feae9 100644
--- a/routers/api/v1/admin/cron.go
+++ b/routers/api/v1/admin/cron.go
@@ -6,12 +6,12 @@ package admin
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/cron"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/cron"
 )
 
 // ListCronTasks api for getting cron tasks
diff --git a/routers/api/v1/admin/email.go b/routers/api/v1/admin/email.go
index 1212babac45..358e350fca4 100644
--- a/routers/api/v1/admin/email.go
+++ b/routers/api/v1/admin/email.go
@@ -6,11 +6,11 @@ package admin
 import (
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // GetAllEmails
diff --git a/routers/api/v1/admin/hooks.go b/routers/api/v1/admin/hooks.go
index 80e9e964c25..f70dcff744d 100644
--- a/routers/api/v1/admin/hooks.go
+++ b/routers/api/v1/admin/hooks.go
@@ -7,15 +7,15 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	webhook_service "code.gitea.io/gitea/services/webhook"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	webhook_service "gitea.dev/services/webhook"
 )
 
 // ListHooks list system's webhooks
diff --git a/routers/api/v1/admin/org.go b/routers/api/v1/admin/org.go
index 28c21de15fe..6375748086c 100644
--- a/routers/api/v1/admin/org.go
+++ b/routers/api/v1/admin/org.go
@@ -7,14 +7,14 @@ package admin
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // CreateOrg api for create organization
diff --git a/routers/api/v1/admin/repo.go b/routers/api/v1/admin/repo.go
index 12a78c9c4b7..6b280b759be 100644
--- a/routers/api/v1/admin/repo.go
+++ b/routers/api/v1/admin/repo.go
@@ -4,10 +4,10 @@
 package admin
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/repo"
-	"code.gitea.io/gitea/services/context"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/repo"
+	"gitea.dev/services/context"
 )
 
 // CreateRepo api for creating a repository
diff --git a/routers/api/v1/admin/runners.go b/routers/api/v1/admin/runners.go
index 3d27c87935a..93af28942c8 100644
--- a/routers/api/v1/admin/runners.go
+++ b/routers/api/v1/admin/runners.go
@@ -4,8 +4,8 @@
 package admin
 
 import (
-	"code.gitea.io/gitea/routers/api/v1/shared"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/routers/api/v1/shared"
+	"gitea.dev/services/context"
 )
 
 // https://docs.github.com/en/rest/actions/self-hosted-runners?apiVersion=2022-11-28#create-a-registration-token-for-an-organization
diff --git a/routers/api/v1/admin/user.go b/routers/api/v1/admin/user.go
index 8a6924b4a39..d7f10b75b0b 100644
--- a/routers/api/v1/admin/user.go
+++ b/routers/api/v1/admin/user.go
@@ -9,27 +9,27 @@ import (
 	"fmt"
 	"net/http"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	org_model "code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/user"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/mailer"
-	user_service "code.gitea.io/gitea/services/user"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	org_model "gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/password"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/user"
+	"gitea.dev/routers/api/v1/utils"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/mailer"
+	user_service "gitea.dev/services/user"
 )
 
 func parseAuthSource(ctx *context.APIContext, u *user_model.User, sourceID int64) {
@@ -464,24 +464,9 @@ func SearchUsers(ctx *context.APIContext) {
 
 	listOptions := utils.GetListOptions(ctx)
 
-	orderBy := db.SearchOrderByAlphabetically
-	sortMode := ctx.FormString("sort")
-	if len(sortMode) > 0 {
-		sortOrder := ctx.FormString("order")
-		if len(sortOrder) == 0 {
-			sortOrder = "asc"
-		}
-		if searchModeMap, ok := user_model.AdminUserOrderByMap[sortOrder]; ok {
-			if order, ok := searchModeMap[sortMode]; ok {
-				orderBy = order
-			} else {
-				ctx.APIError(http.StatusUnprocessableEntity, fmt.Errorf("Invalid sort mode: \"%s\"", sortMode))
-				return
-			}
-		} else {
-			ctx.APIError(http.StatusUnprocessableEntity, fmt.Errorf("Invalid sort order: \"%s\"", sortOrder))
-			return
-		}
+	orderBy, ok := utils.ResolveSortOrder(ctx, user_model.AdminUserOrderByMap, db.SearchOrderByAlphabetically)
+	if !ok {
+		return
 	}
 
 	var visible []api.VisibleType
diff --git a/routers/api/v1/admin/user_badge.go b/routers/api/v1/admin/user_badge.go
index ce32f455b02..97b12d84eff 100644
--- a/routers/api/v1/admin/user_badge.go
+++ b/routers/api/v1/admin/user_badge.go
@@ -6,10 +6,10 @@ package admin
 import (
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
 )
 
 // ListUserBadges lists all badges belonging to a user
diff --git a/routers/api/v1/api.go b/routers/api/v1/api.go
index a8bfa0965ec..eb5f52fd575 100644
--- a/routers/api/v1/api.go
+++ b/routers/api/v1/api.go
@@ -68,34 +68,34 @@ import (
 	"net/http"
 	"strings"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/activitypub"
-	"code.gitea.io/gitea/routers/api/v1/admin"
-	"code.gitea.io/gitea/routers/api/v1/misc"
-	"code.gitea.io/gitea/routers/api/v1/notify"
-	"code.gitea.io/gitea/routers/api/v1/org"
-	"code.gitea.io/gitea/routers/api/v1/packages"
-	"code.gitea.io/gitea/routers/api/v1/repo"
-	"code.gitea.io/gitea/routers/api/v1/settings"
-	"code.gitea.io/gitea/routers/api/v1/user"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/actions"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/activitypub"
+	"gitea.dev/routers/api/v1/admin"
+	"gitea.dev/routers/api/v1/misc"
+	"gitea.dev/routers/api/v1/notify"
+	"gitea.dev/routers/api/v1/org"
+	"gitea.dev/routers/api/v1/packages"
+	"gitea.dev/routers/api/v1/repo"
+	"gitea.dev/routers/api/v1/settings"
+	"gitea.dev/routers/api/v1/user"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/actions"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 
-	_ "code.gitea.io/gitea/routers/api/v1/swagger" // for swagger generation
+	_ "gitea.dev/routers/api/v1/swagger" // for swagger generation
 
 	"gitea.com/go-chi/binding"
 	"github.com/go-chi/cors"
@@ -212,6 +212,11 @@ func repoAssignment() func(ctx *context.APIContext) {
 			ctx.APIErrorNotFound()
 			return
 		}
+
+		if !ctx.TokenCanAccessRepo(repo) {
+			ctx.APIErrorNotFound()
+			return
+		}
 	}
 }
 
@@ -249,51 +254,66 @@ func checkTokenPublicOnly() func(ctx *context.APIContext) {
 			return
 		}
 
-		// public Only permission check
-		switch {
-		case auth_model.ContainsCategory(requiredScopeCategories, auth_model.AccessTokenScopeCategoryRepository):
-			if ctx.Repo.Repository != nil && ctx.Repo.Repository.IsPrivate {
-				ctx.APIError(http.StatusForbidden, "token scope is limited to public repos")
-				return
-			}
-		case auth_model.ContainsCategory(requiredScopeCategories, auth_model.AccessTokenScopeCategoryIssue):
-			if ctx.Repo.Repository != nil && ctx.Repo.Repository.IsPrivate {
-				ctx.APIError(http.StatusForbidden, "token scope is limited to public issues")
-				return
-			}
-		case auth_model.ContainsCategory(requiredScopeCategories, auth_model.AccessTokenScopeCategoryOrganization):
-			if ctx.Org.Organization != nil && ctx.Org.Organization.Visibility != api.VisibleTypePublic {
-				ctx.APIError(http.StatusForbidden, "token scope is limited to public orgs")
-				return
-			}
-			if ctx.ContextUser != nil && ctx.ContextUser.IsOrganization() && ctx.ContextUser.Visibility != api.VisibleTypePublic {
-				ctx.APIError(http.StatusForbidden, "token scope is limited to public orgs")
-				return
-			}
-		case auth_model.ContainsCategory(requiredScopeCategories, auth_model.AccessTokenScopeCategoryUser):
-			if ctx.ContextUser != nil && ctx.ContextUser.IsTokenAccessAllowed() && ctx.ContextUser.Visibility != api.VisibleTypePublic {
-				ctx.APIError(http.StatusForbidden, "token scope is limited to public users")
-				return
-			}
-		case auth_model.ContainsCategory(requiredScopeCategories, auth_model.AccessTokenScopeCategoryActivityPub):
-			if ctx.ContextUser != nil && ctx.ContextUser.IsTokenAccessAllowed() && ctx.ContextUser.Visibility != api.VisibleTypePublic {
-				ctx.APIError(http.StatusForbidden, "token scope is limited to public activitypub")
-				return
-			}
-		case auth_model.ContainsCategory(requiredScopeCategories, auth_model.AccessTokenScopeCategoryNotification):
-			if ctx.Repo.Repository != nil && ctx.Repo.Repository.IsPrivate {
-				ctx.APIError(http.StatusForbidden, "token scope is limited to public notifications")
-				return
-			}
-		case auth_model.ContainsCategory(requiredScopeCategories, auth_model.AccessTokenScopeCategoryPackage):
-			if ctx.Package != nil && ctx.Package.Owner.Visibility.IsPrivate() {
-				ctx.APIError(http.StatusForbidden, "token scope is limited to public packages")
-				return
+		for _, category := range requiredScopeCategories {
+			switch category {
+			case auth_model.AccessTokenScopeCategoryRepository:
+				if !ctx.TokenCanAccessRepo(ctx.Repo.Repository) {
+					ctx.APIError(http.StatusForbidden, "token scope is limited to public repos")
+					return
+				}
+			case auth_model.AccessTokenScopeCategoryIssue:
+				if !ctx.TokenCanAccessRepo(ctx.Repo.Repository) {
+					ctx.APIError(http.StatusForbidden, "token scope is limited to public issues")
+					return
+				}
+			case auth_model.AccessTokenScopeCategoryOrganization:
+				orgPrivate := ctx.Org.Organization != nil && !ctx.Org.Organization.Visibility.IsPublic()
+				userOrgPrivate := ctx.ContextUser != nil && ctx.ContextUser.IsOrganization() && !ctx.ContextUser.Visibility.IsPublic()
+				if orgPrivate || userOrgPrivate {
+					ctx.APIError(http.StatusForbidden, "token scope is limited to public orgs")
+					return
+				}
+			case auth_model.AccessTokenScopeCategoryUser:
+				if ctx.ContextUser != nil && ctx.ContextUser.IsTokenAccessAllowed() && !ctx.ContextUser.Visibility.IsPublic() {
+					ctx.APIError(http.StatusForbidden, "token scope is limited to public users")
+					return
+				}
+			case auth_model.AccessTokenScopeCategoryActivityPub:
+				if ctx.ContextUser != nil && ctx.ContextUser.IsTokenAccessAllowed() && !ctx.ContextUser.Visibility.IsPublic() {
+					ctx.APIError(http.StatusForbidden, "token scope is limited to public activitypub")
+					return
+				}
+			case auth_model.AccessTokenScopeCategoryNotification:
+				if !ctx.TokenCanAccessRepo(ctx.Repo.Repository) {
+					ctx.APIError(http.StatusForbidden, "token scope is limited to public notifications")
+					return
+				}
+			case auth_model.AccessTokenScopeCategoryPackage:
+				if ctx.Package != nil && ctx.Package.Owner.Visibility.IsPrivate() {
+					ctx.APIError(http.StatusForbidden, "token scope is limited to public packages")
+					return
+				}
 			}
 		}
 	}
 }
 
+func rejectPublicOnly() func(ctx *context.APIContext) {
+	return func(ctx *context.APIContext) {
+		if !ctx.PublicOnly {
+			return
+		}
+
+		ctx.APIError(http.StatusForbidden, "this endpoint is not available for public-only tokens")
+	}
+}
+
+func contextAuthenticatedUser() func(ctx *context.APIContext) {
+	return func(ctx *context.APIContext) {
+		ctx.ContextUser = ctx.Doer
+	}
+}
+
 // if a token is being used for auth, we check that it contains the required scope
 // if a token is not being used, reqToken will enforce other sign in methods
 func tokenRequiresScopes(requiredScopeCategories ...auth_model.AccessTokenScopeCategory) func(ctx *context.APIContext) {
@@ -957,6 +977,8 @@ func Routes() *web.Router {
 		})
 
 		// Notifications (requires 'notifications' scope)
+		// The notifications API is not available for public-only tokens because a user's notifications mix
+		// public and private repository events in the same mailbox.
 		m.Group("/notifications", func() {
 			m.Combo("").
 				Get(reqToken(), notify.ListNotifications).
@@ -965,7 +987,7 @@ func Routes() *web.Router {
 			m.Combo("/threads/{id}").
 				Get(reqToken(), notify.GetThread).
 				Patch(reqToken(), notify.ReadThread)
-		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryNotification))
+		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryNotification), rejectPublicOnly())
 
 		// Users (requires user scope)
 		m.Group("/users", func() {
@@ -1013,8 +1035,9 @@ func Routes() *web.Router {
 			m.Group("/settings", func() {
 				m.Get("", user.GetUserSettings)
 				m.Patch("", bind(api.UserSettingsOptions{}), user.UpdateUserSettings)
-			}, reqToken())
-			m.Combo("/emails").
+			}, rejectPublicOnly())
+			// Email addresses are always private account data.
+			m.Combo("/emails", rejectPublicOnly()).
 				Get(user.ListEmails).
 				Post(bind(api.CreateEmailOption{}), user.AddEmail).
 				Delete(bind(api.DeleteEmailOption{}), user.DeleteEmail)
@@ -1046,7 +1069,7 @@ func Routes() *web.Router {
 
 				m.Get("/runs", reqToken(), user.ListWorkflowRuns)
 				m.Get("/jobs", reqToken(), user.ListWorkflowJobs)
-			})
+			}, rejectPublicOnly())
 
 			m.Get("/followers", user.ListMyFollowers)
 			m.Group("/following", func() {
@@ -1064,7 +1087,7 @@ func Routes() *web.Router {
 					Post(bind(api.CreateKeyOption{}), user.CreatePublicKey)
 				m.Combo("/{id}").Get(user.GetPublicKey).
 					Delete(user.DeletePublicKey)
-			})
+			}, rejectPublicOnly())
 
 			// (admin:application scope)
 			m.Group("/applications", func() {
@@ -1075,7 +1098,7 @@ func Routes() *web.Router {
 					Delete(user.DeleteOauth2Application).
 					Patch(bind(api.CreateOAuth2ApplicationOptions{}), user.UpdateOauth2Application).
 					Get(user.GetOauth2Application)
-			})
+			}, rejectPublicOnly())
 
 			// (admin:gpg_key scope)
 			m.Group("/gpg_keys", func() {
@@ -1083,13 +1106,13 @@ func Routes() *web.Router {
 					Post(bind(api.CreateGPGKeyOption{}), user.CreateGPGKey)
 				m.Combo("/{id}").Get(user.GetGPGKey).
 					Delete(user.DeleteGPGKey)
-			})
-			m.Get("/gpg_key_token", user.GetVerificationToken)
-			m.Post("/gpg_key_verify", bind(api.VerifyGPGKeyOption{}), user.VerifyUserGPGKey)
+			}, rejectPublicOnly())
+			m.Get("/gpg_key_token", rejectPublicOnly(), user.GetVerificationToken)
+			m.Post("/gpg_key_verify", rejectPublicOnly(), bind(api.VerifyGPGKeyOption{}), user.VerifyUserGPGKey)
 
 			// (repo scope)
 			m.Combo("/repos", tokenRequiresScopes(auth_model.AccessTokenScopeCategoryRepository)).Get(user.ListMyRepos).
-				Post(bind(api.CreateRepoOption{}), repo.Create)
+				Post(rejectPublicOnly(), bind(api.CreateRepoOption{}), repo.Create)
 
 			// (repo scope)
 			m.Group("/starred", func() {
@@ -1100,22 +1123,22 @@ func Routes() *web.Router {
 					m.Delete("", user.Unstar)
 				}, repoAssignment(), checkTokenPublicOnly())
 			}, reqStarsEnabled(), tokenRequiresScopes(auth_model.AccessTokenScopeCategoryRepository))
-			m.Get("/times", repo.ListMyTrackedTimes)
-			m.Get("/stopwatches", repo.GetStopwatches)
+			m.Get("/times", rejectPublicOnly(), repo.ListMyTrackedTimes)
+			m.Get("/stopwatches", rejectPublicOnly(), repo.GetStopwatches)
 			m.Get("/subscriptions", user.GetMyWatchedRepos)
-			m.Get("/teams", org.ListUserTeams)
+			m.Get("/teams", rejectPublicOnly(), org.ListUserTeams)
 			m.Group("/hooks", func() {
 				m.Combo("").Get(user.ListHooks).
 					Post(bind(api.CreateHookOption{}), user.CreateHook)
 				m.Combo("/{id}").Get(user.GetHook).
 					Patch(bind(api.EditHookOption{}), user.EditHook).
 					Delete(user.DeleteHook)
-			}, reqWebhooksEnabled())
+			}, reqWebhooksEnabled(), rejectPublicOnly())
 
 			m.Group("/avatar", func() {
 				m.Post("", bind(api.UpdateUserAvatarOption{}), user.UpdateAvatar)
 				m.Delete("", user.DeleteAvatar)
-			})
+			}, rejectPublicOnly())
 
 			m.Group("/blocks", func() {
 				m.Get("", user.ListBlocks)
@@ -1124,8 +1147,8 @@ func Routes() *web.Router {
 					m.Put("", user.BlockUser)
 					m.Delete("", user.UnblockUser)
 				}, context.UserAssignmentAPI(), checkTokenPublicOnly())
-			})
-		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser), reqToken())
+			}, rejectPublicOnly())
+		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser), reqToken(), contextAuthenticatedUser(), checkTokenPublicOnly())
 
 		// Repositories (requires repo scope, org scope)
 		m.Post("/org/{org}/repos",
@@ -1430,9 +1453,9 @@ func Routes() *web.Router {
 							Delete(reqToken(), repo.DeleteTopic)
 					}, reqAdmin())
 				}, reqAnyRepoReader())
-				m.Get("/issue_templates", context.ReferencesGitRepo(), repo.GetIssueTemplates)
-				m.Get("/issue_config", context.ReferencesGitRepo(), repo.GetIssueConfig)
-				m.Get("/issue_config/validate", context.ReferencesGitRepo(), repo.ValidateIssueConfig)
+				m.Get("/issue_templates", reqRepoReader(unit.TypeCode), context.ReferencesGitRepo(), repo.GetIssueTemplates)
+				m.Get("/issue_config", reqRepoReader(unit.TypeCode), context.ReferencesGitRepo(), repo.GetIssueConfig)
+				m.Get("/issue_config/validate", reqRepoReader(unit.TypeCode), context.ReferencesGitRepo(), repo.ValidateIssueConfig)
 				m.Get("/languages", reqRepoReader(unit.TypeCode), repo.GetLanguages)
 				m.Get("/licenses", reqRepoReader(unit.TypeCode), repo.GetLicenses)
 				m.Get("/activities/feeds", repo.ListRepoActivityFeeds)
@@ -1601,7 +1624,7 @@ func Routes() *web.Router {
 		}, reqToken(), tokenRequiresScopes(auth_model.AccessTokenScopeCategoryPackage), context.UserAssignmentAPI(), context.PackageAssignmentAPI(), reqPackageAccess(perm.AccessModeRead), checkTokenPublicOnly())
 
 		// Organizations
-		m.Get("/user/orgs", reqToken(), tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser, auth_model.AccessTokenScopeCategoryOrganization), org.ListMyOrgs)
+		m.Get("/user/orgs", reqToken(), tokenRequiresScopes(auth_model.AccessTokenScopeCategoryUser, auth_model.AccessTokenScopeCategoryOrganization), checkTokenPublicOnly(), org.ListMyOrgs)
 		m.Group("/users/{username}/orgs", func() {
 			m.Get("", reqToken(), org.ListUserOrgs)
 			m.Get("/{org}/permissions", reqToken(), org.GetUserOrgsPermissions)
diff --git a/routers/api/v1/misc/gitignore.go b/routers/api/v1/misc/gitignore.go
index 1ff2628ce80..6e4800fd588 100644
--- a/routers/api/v1/misc/gitignore.go
+++ b/routers/api/v1/misc/gitignore.go
@@ -6,11 +6,11 @@ package misc
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/options"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/options"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 // Shows a list of all Gitignore templates
diff --git a/routers/api/v1/misc/label_templates.go b/routers/api/v1/misc/label_templates.go
index 95c156c4ab7..1ddc948b75a 100644
--- a/routers/api/v1/misc/label_templates.go
+++ b/routers/api/v1/misc/label_templates.go
@@ -6,10 +6,10 @@ package misc
 import (
 	"net/http"
 
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // Shows a list of all Label templates
diff --git a/routers/api/v1/misc/licenses.go b/routers/api/v1/misc/licenses.go
index 12670afef97..ee3fac131ea 100644
--- a/routers/api/v1/misc/licenses.go
+++ b/routers/api/v1/misc/licenses.go
@@ -8,12 +8,12 @@ import (
 	"net/http"
 	"net/url"
 
-	"code.gitea.io/gitea/modules/options"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/options"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 // Returns a list of all License templates
diff --git a/routers/api/v1/misc/markup.go b/routers/api/v1/misc/markup.go
index f7623b9105b..8d3cb962842 100644
--- a/routers/api/v1/misc/markup.go
+++ b/routers/api/v1/misc/markup.go
@@ -4,13 +4,13 @@
 package misc
 
 import (
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
 )
 
 // Markup render markup document to HTML
diff --git a/routers/api/v1/misc/markup_test.go b/routers/api/v1/misc/markup_test.go
index 4d61b287ae3..4ddc5f47fc5 100644
--- a/routers/api/v1/misc/markup_test.go
+++ b/routers/api/v1/misc/markup_test.go
@@ -12,15 +12,15 @@ import (
 	"strings"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/web"
-	context_service "code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/contexttest"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/web"
+	context_service "gitea.dev/services/context"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/api/v1/misc/signing.go b/routers/api/v1/misc/signing.go
index 6e1a9a09b24..494b3fc61d2 100644
--- a/routers/api/v1/misc/signing.go
+++ b/routers/api/v1/misc/signing.go
@@ -4,9 +4,9 @@
 package misc
 
 import (
-	"code.gitea.io/gitea/modules/git"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/git"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/context"
 )
 
 func getSigningKey(ctx *context.APIContext, expectedFormat string) {
diff --git a/routers/api/v1/misc/version.go b/routers/api/v1/misc/version.go
index e3b43a0e6b6..4399e6ae3c9 100644
--- a/routers/api/v1/misc/version.go
+++ b/routers/api/v1/misc/version.go
@@ -6,9 +6,9 @@ package misc
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/services/context"
 )
 
 // Version shows the version of the Gitea server
diff --git a/routers/api/v1/notify/notifications.go b/routers/api/v1/notify/notifications.go
index 4e4c7dc6ddd..92aae46a784 100644
--- a/routers/api/v1/notify/notifications.go
+++ b/routers/api/v1/notify/notifications.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"strings"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
 )
 
 // NewAvailable check if unread notifications exist
diff --git a/routers/api/v1/notify/repo.go b/routers/api/v1/notify/repo.go
index 5e23e2285da..16996907508 100644
--- a/routers/api/v1/notify/repo.go
+++ b/routers/api/v1/notify/repo.go
@@ -8,11 +8,11 @@ import (
 	"strings"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/structs"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 func statusStringToNotificationStatus(status string) activities_model.NotificationStatus {
diff --git a/routers/api/v1/notify/threads.go b/routers/api/v1/notify/threads.go
index dd77e4aae4d..2b8c91169f8 100644
--- a/routers/api/v1/notify/threads.go
+++ b/routers/api/v1/notify/threads.go
@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"net/http"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // GetThread get notification by ID
diff --git a/routers/api/v1/notify/user.go b/routers/api/v1/notify/user.go
index 629a5ec2288..2e54eb178d4 100644
--- a/routers/api/v1/notify/user.go
+++ b/routers/api/v1/notify/user.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/structs"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // ListNotifications list users's notification threads
diff --git a/routers/api/v1/org/action.go b/routers/api/v1/org/action.go
index d218c19fd43..d63a134bd55 100644
--- a/routers/api/v1/org/action.go
+++ b/routers/api/v1/org/action.go
@@ -7,17 +7,17 @@ import (
 	"errors"
 	"net/http"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	secret_model "code.gitea.io/gitea/models/secret"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/shared"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	actions_service "code.gitea.io/gitea/services/actions"
-	"code.gitea.io/gitea/services/context"
-	secret_service "code.gitea.io/gitea/services/secrets"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	secret_model "gitea.dev/models/secret"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/shared"
+	"gitea.dev/routers/api/v1/utils"
+	actions_service "gitea.dev/services/actions"
+	"gitea.dev/services/context"
+	secret_service "gitea.dev/services/secrets"
 )
 
 // ListActionsSecrets list an organization's actions secrets
diff --git a/routers/api/v1/org/avatar.go b/routers/api/v1/org/avatar.go
index 0eb771b2cd3..38b0655bea9 100644
--- a/routers/api/v1/org/avatar.go
+++ b/routers/api/v1/org/avatar.go
@@ -7,10 +7,10 @@ import (
 	"encoding/base64"
 	"net/http"
 
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	user_service "code.gitea.io/gitea/services/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	user_service "gitea.dev/services/user"
 )
 
 // UpdateAvatarupdates the Avatar of an Organisation
diff --git a/routers/api/v1/org/block.go b/routers/api/v1/org/block.go
index 6b2f3dc615e..a43a7b5d7a6 100644
--- a/routers/api/v1/org/block.go
+++ b/routers/api/v1/org/block.go
@@ -4,8 +4,8 @@
 package org
 
 import (
-	"code.gitea.io/gitea/routers/api/v1/shared"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/routers/api/v1/shared"
+	"gitea.dev/services/context"
 )
 
 func ListBlocks(ctx *context.APIContext) {
diff --git a/routers/api/v1/org/hook.go b/routers/api/v1/org/hook.go
index b07e902f6e0..8d16997d739 100644
--- a/routers/api/v1/org/hook.go
+++ b/routers/api/v1/org/hook.go
@@ -6,11 +6,11 @@ package org
 import (
 	"net/http"
 
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	webhook_service "code.gitea.io/gitea/services/webhook"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	webhook_service "gitea.dev/services/webhook"
 )
 
 // ListHooks list an organization's webhooks
diff --git a/routers/api/v1/org/label.go b/routers/api/v1/org/label.go
index b5b70bdc7dc..4c3365e6a6d 100644
--- a/routers/api/v1/org/label.go
+++ b/routers/api/v1/org/label.go
@@ -8,13 +8,13 @@ import (
 	"strconv"
 	"strings"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/label"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/label"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // ListLabels list all the labels of an organization
diff --git a/routers/api/v1/org/member.go b/routers/api/v1/org/member.go
index e7311fc6fd3..957544d1047 100644
--- a/routers/api/v1/org/member.go
+++ b/routers/api/v1/org/member.go
@@ -7,15 +7,15 @@ import (
 	"net/http"
 	"net/url"
 
-	"code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/user"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	org_service "code.gitea.io/gitea/services/org"
+	"gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/routers/api/v1/user"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	org_service "gitea.dev/services/org"
 )
 
 // listMembers list an organization's members
diff --git a/routers/api/v1/org/org.go b/routers/api/v1/org/org.go
index 2df871a0aa1..87e847d6421 100644
--- a/routers/api/v1/org/org.go
+++ b/routers/api/v1/org/org.go
@@ -10,27 +10,27 @@ import (
 	"fmt"
 	"net/http"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	system_model "code.gitea.io/gitea/models/system"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/user"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	feed_service "code.gitea.io/gitea/services/feed"
-	"code.gitea.io/gitea/services/org"
-	repo_service "code.gitea.io/gitea/services/repository"
-	user_service "code.gitea.io/gitea/services/user"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	system_model "gitea.dev/models/system"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/user"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	feed_service "gitea.dev/services/feed"
+	"gitea.dev/services/org"
+	repo_service "gitea.dev/services/repository"
+	user_service "gitea.dev/services/user"
 )
 
 func listUserOrgs(ctx *context.APIContext, u *user_model.User) {
@@ -40,6 +40,7 @@ func listUserOrgs(ctx *context.APIContext, u *user_model.User) {
 		UserID:            u.ID,
 		IncludeVisibility: organization.DoerViewOtherVisibility(ctx.Doer, u),
 	}
+	opts.ApplyPublicOnly(ctx.PublicOnly)
 	orgs, maxResults, err := db.FindAndCount[organization.Organization](ctx, opts)
 	if err != nil {
 		ctx.APIErrorInternal(err)
@@ -199,7 +200,7 @@ func GetAll(ctx *context.APIContext) {
 	//     "$ref": "#/responses/OrganizationList"
 
 	vMode := []api.VisibleType{api.VisibleTypePublic}
-	if ctx.IsSigned && !ctx.PublicOnly {
+	if ctx.IsSigned {
 		vMode = append(vMode, api.VisibleTypeLimited)
 		if ctx.Doer.IsAdmin {
 			vMode = append(vMode, api.VisibleTypePrivate)
@@ -208,13 +209,16 @@ func GetAll(ctx *context.APIContext) {
 
 	listOptions := utils.GetListOptions(ctx)
 
-	publicOrgs, maxResults, err := user_model.SearchUsers(ctx, user_model.SearchUserOptions{
+	searchOpts := user_model.SearchUserOptions{
 		Actor:       ctx.Doer,
 		ListOptions: listOptions,
 		Types:       []user_model.UserType{user_model.UserTypeOrganization},
 		OrderBy:     db.SearchOrderByAlphabetically,
 		Visible:     vMode,
-	})
+	}
+	searchOpts.ApplyPublicOnly(ctx.PublicOnly)
+
+	publicOrgs, maxResults, err := user_model.SearchUsers(ctx, searchOpts)
 	if err != nil {
 		ctx.APIErrorInternal(err)
 		return
@@ -494,6 +498,7 @@ func ListOrgActivityFeeds(ctx *context.APIContext) {
 		Date:           ctx.FormString("date"),
 		ListOptions:    listOptions,
 	}
+	opts.ApplyPublicOnly(ctx.PublicOnly)
 
 	feeds, count, err := feed_service.GetFeeds(ctx, opts)
 	if err != nil {
diff --git a/routers/api/v1/org/team.go b/routers/api/v1/org/team.go
index 74ad9875405..d8acc767c58 100644
--- a/routers/api/v1/org/team.go
+++ b/routers/api/v1/org/team.go
@@ -8,23 +8,23 @@ import (
 	"errors"
 	"net/http"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/user"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	feed_service "code.gitea.io/gitea/services/feed"
-	org_service "code.gitea.io/gitea/services/org"
-	repo_service "code.gitea.io/gitea/services/repository"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/user"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	feed_service "gitea.dev/services/feed"
+	org_service "gitea.dev/services/org"
+	repo_service "gitea.dev/services/repository"
 )
 
 // ListTeams list all the teams of an organization
diff --git a/routers/api/v1/packages/package.go b/routers/api/v1/packages/package.go
index c7c66f549ce..6b01023ef91 100644
--- a/routers/api/v1/packages/package.go
+++ b/routers/api/v1/packages/package.go
@@ -7,15 +7,15 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/optional"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	packages_service "code.gitea.io/gitea/services/packages"
+	"gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/optional"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	packages_service "gitea.dev/services/packages"
 )
 
 // ListPackages gets all packages of an owner
diff --git a/routers/api/v1/repo/action.go b/routers/api/v1/repo/action.go
index 1d38cc2f534..169ed4b68ec 100644
--- a/routers/api/v1/repo/action.go
+++ b/routers/api/v1/repo/action.go
@@ -6,7 +6,6 @@ package repo
 import (
 	go_context "context"
 	"crypto/hmac"
-	"crypto/sha256"
 	"encoding/base64"
 	"errors"
 	"fmt"
@@ -17,25 +16,24 @@ import (
 	"strings"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	secret_model "code.gitea.io/gitea/models/secret"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/shared"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	actions_service "code.gitea.io/gitea/services/actions"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	secret_service "code.gitea.io/gitea/services/secrets"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	secret_model "gitea.dev/models/secret"
+	"gitea.dev/modules/actions"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/optional"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/shared"
+	"gitea.dev/routers/api/v1/utils"
+	actions_service "gitea.dev/services/actions"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	secret_service "gitea.dev/services/secrets"
 
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/model"
 )
 
 // ListActionsSecrets list an repo's actions secrets
@@ -708,6 +706,14 @@ func (Action) ListWorkflowJobs(ctx *context.APIContext) {
 	//   in: query
 	//   description: page size of results
 	//   type: integer
+	// - name: sort
+	//   in: query
+	//   description: sort jobs by attribute. Supported values are "id". Default is "id"
+	//   type: string
+	// - name: order
+	//   in: query
+	//   description: sort order, either "asc" (ascending) or "desc" (descending). Default is "asc"
+	//   type: string
 	// responses:
 	//   "200":
 	//     "$ref": "#/responses/WorkflowJobsList"
@@ -715,6 +721,8 @@ func (Action) ListWorkflowJobs(ctx *context.APIContext) {
 	//     "$ref": "#/responses/error"
 	//   "404":
 	//     "$ref": "#/responses/notFound"
+	//   "422":
+	//     "$ref": "#/responses/validationError"
 
 	repoID := ctx.Repo.Repository.ID
 
@@ -1083,6 +1091,8 @@ func ActionsDispatchWorkflow(ctx *context.APIContext) {
 			ctx.APIError(http.StatusNotFound, err)
 		} else if errors.Is(err, util.ErrPermissionDenied) {
 			ctx.APIError(http.StatusForbidden, err)
+		} else if errors.Is(err, util.ErrInvalidArgument) {
+			ctx.APIError(http.StatusUnprocessableEntity, err)
 		} else {
 			ctx.APIErrorInternal(err)
 		}
@@ -1176,6 +1186,7 @@ func getCurrentRepoActionRunJobsByID(ctx *context.APIContext) (*actions_model.Ac
 		ctx.APIErrorInternal(err)
 		return nil, nil
 	}
+	jobs.SortMatrixGroupsByName()
 	return run, jobs
 }
 
@@ -1527,6 +1538,14 @@ func ListWorkflowRunJobs(ctx *context.APIContext) {
 	//   in: query
 	//   description: page size of results
 	//   type: integer
+	// - name: sort
+	//   in: query
+	//   description: sort jobs by attribute. Supported values are "id". Default is "id"
+	//   type: string
+	// - name: order
+	//   in: query
+	//   description: sort order, either "asc" (ascending) or "desc" (descending). Default is "asc"
+	//   type: string
 	// responses:
 	//   "200":
 	//     "$ref": "#/responses/WorkflowJobsList"
@@ -1534,6 +1553,8 @@ func ListWorkflowRunJobs(ctx *context.APIContext) {
 	//     "$ref": "#/responses/error"
 	//   "404":
 	//     "$ref": "#/responses/notFound"
+	//   "422":
+	//     "$ref": "#/responses/validationError"
 
 	repoID, runID := ctx.Repo.Repository.ID, ctx.PathParamInt64("run")
 
@@ -1877,7 +1898,7 @@ func GetArtifact(ctx *context.APIContext) {
 		return
 	}
 
-	if actions.IsArtifactV4(art) {
+	if actions_service.IsArtifactV4(art) {
 		convertedArtifact, err := convert.ToActionArtifact(ctx.Repo.Repository, art)
 		if err != nil {
 			ctx.APIErrorInternal(err)
@@ -1926,7 +1947,7 @@ func DeleteArtifact(ctx *context.APIContext) {
 		return
 	}
 
-	if actions.IsArtifactV4(art) {
+	if actions_service.IsArtifactV4(art) {
 		if err := actions_model.SetArtifactNeedDeleteByID(ctx, art.ID); err != nil {
 			ctx.APIErrorInternal(err)
 			return
@@ -1939,11 +1960,7 @@ func DeleteArtifact(ctx *context.APIContext) {
 }
 
 func buildSignature(endp string, expires, artifactID int64) []byte {
-	mac := hmac.New(sha256.New, setting.GetGeneralTokenSigningSecret())
-	mac.Write([]byte(endp))
-	fmt.Fprint(mac, expires)
-	fmt.Fprint(mac, artifactID)
-	return mac.Sum(nil)
+	return actions.BuildSignature("api", endp, strconv.FormatInt(expires, 10), strconv.FormatInt(artifactID, 10))
 }
 
 func buildDownloadRawEndpoint(repo *repo_model.Repository, artifactID int64) string {
@@ -1999,10 +2016,10 @@ func DownloadArtifact(ctx *context.APIContext) {
 		return
 	}
 
-	if actions.IsArtifactV4(art) {
+	if actions_service.IsArtifactV4(art) {
 		// @actions/toolkit asserts that downloaded artifacts of a different runid return 302
 		// https://github.com/actions/toolkit/blob/44d43b5490b02998bd09b0c4ff369a4cc67876c2/packages/artifact/src/internal/download/download-artifact.ts#L203-L210
-		if actions.DownloadArtifactV4ServeDirect(ctx.Base, art) {
+		if actions_service.DownloadArtifactV4ServeDirect(ctx.Base, art) {
 			return
 		}
 
@@ -2054,8 +2071,8 @@ func DownloadArtifactRaw(ctx *context.APIContext) {
 		ctx.APIError(http.StatusNotFound, "Artifact has expired")
 		return
 	}
-	if actions.IsArtifactV4(art) {
-		err := actions.DownloadArtifactV4(ctx.Base, art)
+	if actions_service.IsArtifactV4(art) {
+		err := actions_service.DownloadArtifactV4(ctx.Base, art)
 		if err != nil {
 			ctx.APIErrorInternal(err)
 			return
diff --git a/routers/api/v1/repo/actions_run.go b/routers/api/v1/repo/actions_run.go
index 64ac1a3ad5f..d1d98ff21ab 100644
--- a/routers/api/v1/repo/actions_run.go
+++ b/routers/api/v1/repo/actions_run.go
@@ -6,10 +6,10 @@ package repo
 import (
 	"errors"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
 )
 
 func DownloadActionsRunJobLogs(ctx *context.APIContext) {
diff --git a/routers/api/v1/repo/avatar.go b/routers/api/v1/repo/avatar.go
index 593460586f8..b3d52e16634 100644
--- a/routers/api/v1/repo/avatar.go
+++ b/routers/api/v1/repo/avatar.go
@@ -7,10 +7,10 @@ import (
 	"encoding/base64"
 	"net/http"
 
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 )
 
 // UpdateVatar updates the Avatar of an Repo
diff --git a/routers/api/v1/repo/blob.go b/routers/api/v1/repo/blob.go
index 9a17fc1bbfd..cd731b0d787 100644
--- a/routers/api/v1/repo/blob.go
+++ b/routers/api/v1/repo/blob.go
@@ -6,8 +6,8 @@ package repo
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/services/context"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	"gitea.dev/services/context"
+	files_service "gitea.dev/services/repository/files"
 )
 
 // GetBlob get the blob of a repository file.
diff --git a/routers/api/v1/repo/branch.go b/routers/api/v1/repo/branch.go
index a9b88317d4c..629945398d8 100644
--- a/routers/api/v1/repo/branch.go
+++ b/routers/api/v1/repo/branch.go
@@ -8,24 +8,24 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/optional"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	pull_service "code.gitea.io/gitea/services/pull"
-	release_service "code.gitea.io/gitea/services/release"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/optional"
+	repo_module "gitea.dev/modules/repository"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	pull_service "gitea.dev/services/pull"
+	release_service "gitea.dev/services/release"
+	repo_service "gitea.dev/services/repository"
 )
 
 // GetBranch get a branch of a repository
@@ -711,7 +711,19 @@ func CreateBranchProtection(ctx *context.APIContext) {
 		ctx.APIErrorInternal(err)
 		return
 	}
-	var whitelistTeams, forcePushAllowlistTeams, mergeWhitelistTeams, approvalsWhitelistTeams []int64
+	var bypassAllowlistUsers []int64
+	if form.EnableBypassAllowlist {
+		bypassAllowlistUsers, err = user_model.GetUserIDsByNames(ctx, form.BypassAllowlistUsernames, false)
+		if err != nil {
+			if user_model.IsErrUserNotExist(err) {
+				ctx.APIError(http.StatusUnprocessableEntity, err)
+				return
+			}
+			ctx.APIErrorInternal(err)
+			return
+		}
+	}
+	var whitelistTeams, forcePushAllowlistTeams, mergeWhitelistTeams, approvalsWhitelistTeams, bypassAllowlistTeams []int64
 	if repo.Owner.IsOrganization() {
 		whitelistTeams, err = organization.GetTeamIDsByNames(ctx, repo.OwnerID, form.PushWhitelistTeams, false)
 		if err != nil {
@@ -749,6 +761,17 @@ func CreateBranchProtection(ctx *context.APIContext) {
 			ctx.APIErrorInternal(err)
 			return
 		}
+		if form.EnableBypassAllowlist {
+			bypassAllowlistTeams, err = organization.GetTeamIDsByNames(ctx, repo.OwnerID, form.BypassAllowlistTeams, false)
+			if err != nil {
+				if organization.IsErrTeamNotExist(err) {
+					ctx.APIError(http.StatusUnprocessableEntity, err)
+					return
+				}
+				ctx.APIErrorInternal(err)
+				return
+			}
+		}
 	}
 
 	protectBranch = &git_model.ProtectedBranch{
@@ -762,6 +785,7 @@ func CreateBranchProtection(ctx *context.APIContext) {
 		EnableForcePushAllowlist:      form.EnablePush && form.EnableForcePush && form.EnableForcePushAllowlist,
 		ForcePushAllowlistDeployKeys:  form.EnablePush && form.EnableForcePush && form.EnableForcePushAllowlist && form.ForcePushAllowlistDeployKeys,
 		EnableMergeWhitelist:          form.EnableMergeWhitelist,
+		EnableBypassAllowlist:         form.EnableBypassAllowlist,
 		EnableStatusCheck:             form.EnableStatusCheck,
 		StatusCheckContexts:           form.StatusCheckContexts,
 		EnableApprovalsWhitelist:      form.EnableApprovalsWhitelist,
@@ -786,6 +810,8 @@ func CreateBranchProtection(ctx *context.APIContext) {
 		MergeTeamIDs:     mergeWhitelistTeams,
 		ApprovalsUserIDs: approvalsWhitelistUsers,
 		ApprovalsTeamIDs: approvalsWhitelistTeams,
+		BypassUserIDs:    bypassAllowlistUsers,
+		BypassTeamIDs:    bypassAllowlistTeams,
 	}); err != nil {
 		ctx.APIErrorInternal(err)
 		return
@@ -906,6 +932,10 @@ func EditBranchProtection(ctx *context.APIContext) {
 		protectBranch.EnableMergeWhitelist = *form.EnableMergeWhitelist
 	}
 
+	if form.EnableBypassAllowlist != nil {
+		protectBranch.EnableBypassAllowlist = *form.EnableBypassAllowlist
+	}
+
 	if form.EnableStatusCheck != nil {
 		protectBranch.EnableStatusCheck = *form.EnableStatusCheck
 	}
@@ -958,7 +988,7 @@ func EditBranchProtection(ctx *context.APIContext) {
 		protectBranch.BlockAdminMergeOverride = *form.BlockAdminMergeOverride
 	}
 
-	var whitelistUsers, forcePushAllowlistUsers, mergeWhitelistUsers, approvalsWhitelistUsers []int64
+	var whitelistUsers, forcePushAllowlistUsers, mergeWhitelistUsers, approvalsWhitelistUsers, bypassAllowlistUsers []int64
 	if form.PushWhitelistUsernames != nil {
 		whitelistUsers, err = user_model.GetUserIDsByNames(ctx, form.PushWhitelistUsernames, false)
 		if err != nil {
@@ -1011,8 +1041,21 @@ func EditBranchProtection(ctx *context.APIContext) {
 	} else {
 		approvalsWhitelistUsers = protectBranch.ApprovalsWhitelistUserIDs
 	}
+	if form.BypassAllowlistUsernames != nil {
+		bypassAllowlistUsers, err = user_model.GetUserIDsByNames(ctx, form.BypassAllowlistUsernames, false)
+		if err != nil {
+			if user_model.IsErrUserNotExist(err) {
+				ctx.APIError(http.StatusUnprocessableEntity, err)
+				return
+			}
+			ctx.APIErrorInternal(err)
+			return
+		}
+	} else {
+		bypassAllowlistUsers = protectBranch.BypassAllowlistUserIDs
+	}
 
-	var whitelistTeams, forcePushAllowlistTeams, mergeWhitelistTeams, approvalsWhitelistTeams []int64
+	var whitelistTeams, forcePushAllowlistTeams, mergeWhitelistTeams, approvalsWhitelistTeams, bypassAllowlistTeams []int64
 	if repo.Owner.IsOrganization() {
 		if form.PushWhitelistTeams != nil {
 			whitelistTeams, err = organization.GetTeamIDsByNames(ctx, repo.OwnerID, form.PushWhitelistTeams, false)
@@ -1066,6 +1109,23 @@ func EditBranchProtection(ctx *context.APIContext) {
 		} else {
 			approvalsWhitelistTeams = protectBranch.ApprovalsWhitelistTeamIDs
 		}
+		if form.BypassAllowlistTeams != nil {
+			bypassAllowlistTeams, err = organization.GetTeamIDsByNames(ctx, repo.OwnerID, form.BypassAllowlistTeams, false)
+			if err != nil {
+				if organization.IsErrTeamNotExist(err) {
+					ctx.APIError(http.StatusUnprocessableEntity, err)
+					return
+				}
+				ctx.APIErrorInternal(err)
+				return
+			}
+		} else {
+			bypassAllowlistTeams = protectBranch.BypassAllowlistTeamIDs
+		}
+	}
+	if !protectBranch.EnableBypassAllowlist {
+		bypassAllowlistUsers = nil
+		bypassAllowlistTeams = nil
 	}
 
 	err = git_model.UpdateProtectBranch(ctx, ctx.Repo.Repository, protectBranch, git_model.WhitelistOptions{
@@ -1077,6 +1137,8 @@ func EditBranchProtection(ctx *context.APIContext) {
 		MergeTeamIDs:     mergeWhitelistTeams,
 		ApprovalsUserIDs: approvalsWhitelistUsers,
 		ApprovalsTeamIDs: approvalsWhitelistTeams,
+		BypassUserIDs:    bypassAllowlistUsers,
+		BypassTeamIDs:    bypassAllowlistTeams,
 	})
 	if err != nil {
 		ctx.APIErrorInternal(err)
diff --git a/routers/api/v1/repo/collaborators.go b/routers/api/v1/repo/collaborators.go
index 7d9b290c2ab..b7938cb516d 100644
--- a/routers/api/v1/repo/collaborators.go
+++ b/routers/api/v1/repo/collaborators.go
@@ -9,18 +9,18 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
+	repo_service "gitea.dev/services/repository"
 )
 
 // ListCollaborators list a repository's collaborators
diff --git a/routers/api/v1/repo/commits.go b/routers/api/v1/repo/commits.go
index 008e5dc56da..0e66bae4304 100644
--- a/routers/api/v1/repo/commits.go
+++ b/routers/api/v1/repo/commits.go
@@ -10,15 +10,15 @@ import (
 	"strconv"
 	"time"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // GetSingleCommit get a commit via sha
diff --git a/routers/api/v1/repo/compare.go b/routers/api/v1/repo/compare.go
index 69dceb6db9d..081ea5e91b4 100644
--- a/routers/api/v1/repo/compare.go
+++ b/routers/api/v1/repo/compare.go
@@ -6,11 +6,11 @@ package repo
 import (
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // CompareDiff compare two branches or commits
diff --git a/routers/api/v1/repo/download.go b/routers/api/v1/repo/download.go
index 5ddda525f91..d9470d143ea 100644
--- a/routers/api/v1/repo/download.go
+++ b/routers/api/v1/repo/download.go
@@ -7,10 +7,10 @@ import (
 	"errors"
 	"net/http"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	archiver_service "code.gitea.io/gitea/services/repository/archiver"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	archiver_service "gitea.dev/services/repository/archiver"
 )
 
 func serveRepoArchive(ctx *context.APIContext, reqFileName string, paths []string) {
diff --git a/routers/api/v1/repo/file.go b/routers/api/v1/repo/file.go
index 9949928622c..5f0659dc818 100644
--- a/routers/api/v1/repo/file.go
+++ b/routers/api/v1/repo/file.go
@@ -14,22 +14,22 @@ import (
 	"strings"
 	"time"
 
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
-	pull_service "code.gitea.io/gitea/services/pull"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
+	pull_service "gitea.dev/services/pull"
+	files_service "gitea.dev/services/repository/files"
 )
 
 const giteaObjectTypeHeader = "X-Gitea-Object-Type"
diff --git a/routers/api/v1/repo/fork.go b/routers/api/v1/repo/fork.go
index 38a39528798..9d95f538743 100644
--- a/routers/api/v1/repo/fork.go
+++ b/routers/api/v1/repo/fork.go
@@ -8,19 +8,19 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	repo_service "gitea.dev/services/repository"
 )
 
 // ListForks list a repository's forks
diff --git a/routers/api/v1/repo/git_hook.go b/routers/api/v1/repo/git_hook.go
index 487c74e183c..a47c71320dc 100644
--- a/routers/api/v1/repo/git_hook.go
+++ b/routers/api/v1/repo/git_hook.go
@@ -7,11 +7,11 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // ListGitHooks list all Git hooks of a repository
diff --git a/routers/api/v1/repo/git_ref.go b/routers/api/v1/repo/git_ref.go
index a633514a8c8..6583e99e844 100644
--- a/routers/api/v1/repo/git_ref.go
+++ b/routers/api/v1/repo/git_ref.go
@@ -8,10 +8,10 @@ import (
 	"net/http"
 	"net/url"
 
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
 )
 
 // GetGitAllRefs get ref or an list all the refs of a repository
diff --git a/routers/api/v1/repo/hook.go b/routers/api/v1/repo/hook.go
index ac47e15d645..c247fc00390 100644
--- a/routers/api/v1/repo/hook.go
+++ b/routers/api/v1/repo/hook.go
@@ -7,19 +7,19 @@ package repo
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	webhook_service "code.gitea.io/gitea/services/webhook"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	webhook_module "gitea.dev/modules/webhook"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	webhook_service "gitea.dev/services/webhook"
 )
 
 // ListHooks list all hooks of a repository
diff --git a/routers/api/v1/repo/hook_test.go b/routers/api/v1/repo/hook_test.go
index 6b2c7627d09..f33ebb674eb 100644
--- a/routers/api/v1/repo/hook_test.go
+++ b/routers/api/v1/repo/hook_test.go
@@ -8,10 +8,10 @@ import (
 	"strconv"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/models/webhook"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/api/v1/repo/issue.go b/routers/api/v1/repo/issue.go
index 39ca7fb77e9..5d73cc3b312 100644
--- a/routers/api/v1/repo/issue.go
+++ b/routers/api/v1/repo/issue.go
@@ -12,25 +12,25 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	issue_indexer "code.gitea.io/gitea/modules/indexer/issues"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	issue_service "code.gitea.io/gitea/services/issue"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	issue_indexer "gitea.dev/modules/indexer/issues"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	issue_service "gitea.dev/services/issue"
 )
 
 // buildSearchIssuesRepoIDs builds the list of repository IDs for issue search based on query parameters.
@@ -47,9 +47,10 @@ func buildSearchIssuesRepoIDs(ctx *context.APIContext) (repoIDs []int64, allPubl
 		Actor:   ctx.Doer,
 	}
 	if ctx.IsSigned {
-		opts.Private = !ctx.PublicOnly
+		opts.Private = true
 		opts.AllLimited = true
 	}
+	opts.ApplyPublicOnly(ctx.PublicOnly)
 	if ctx.FormString("owner") != "" {
 		owner, err := user_model.GetUserByName(ctx, ctx.FormString("owner"))
 		if err != nil {
diff --git a/routers/api/v1/repo/issue_attachment.go b/routers/api/v1/repo/issue_attachment.go
index b6db388a221..00fa792771f 100644
--- a/routers/api/v1/repo/issue_attachment.go
+++ b/routers/api/v1/repo/issue_attachment.go
@@ -7,18 +7,18 @@ import (
 	"errors"
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	attachment_service "code.gitea.io/gitea/services/attachment"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	"code.gitea.io/gitea/services/convert"
-	issue_service "code.gitea.io/gitea/services/issue"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	attachment_service "gitea.dev/services/attachment"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	"gitea.dev/services/convert"
+	issue_service "gitea.dev/services/issue"
 )
 
 // GetIssueAttachment gets a single attachment of the issue
diff --git a/routers/api/v1/repo/issue_comment.go b/routers/api/v1/repo/issue_comment.go
index 5d79b2ec5ad..5b2d2084735 100644
--- a/routers/api/v1/repo/issue_comment.go
+++ b/routers/api/v1/repo/issue_comment.go
@@ -9,18 +9,18 @@ import (
 	"errors"
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	issue_service "code.gitea.io/gitea/services/issue"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	issue_service "gitea.dev/services/issue"
 )
 
 // ListIssueComments list all the comments of an issue
diff --git a/routers/api/v1/repo/issue_comment_attachment.go b/routers/api/v1/repo/issue_comment_attachment.go
index 9a1ce00f16b..d2650edb634 100644
--- a/routers/api/v1/repo/issue_comment_attachment.go
+++ b/routers/api/v1/repo/issue_comment_attachment.go
@@ -7,19 +7,19 @@ import (
 	"errors"
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	attachment_service "code.gitea.io/gitea/services/attachment"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	"code.gitea.io/gitea/services/convert"
-	issue_service "code.gitea.io/gitea/services/issue"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	attachment_service "gitea.dev/services/attachment"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	"gitea.dev/services/convert"
+	issue_service "gitea.dev/services/issue"
 )
 
 // GetIssueCommentAttachment gets a single attachment of the comment
diff --git a/routers/api/v1/repo/issue_dependency.go b/routers/api/v1/repo/issue_dependency.go
index 28cdbb30919..4912737c911 100644
--- a/routers/api/v1/repo/issue_dependency.go
+++ b/routers/api/v1/repo/issue_dependency.go
@@ -7,15 +7,15 @@ package repo
 import (
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // GetIssueDependencies list an issue's dependencies
diff --git a/routers/api/v1/repo/issue_label.go b/routers/api/v1/repo/issue_label.go
index 1ac545f41b6..ecf42688615 100644
--- a/routers/api/v1/repo/issue_label.go
+++ b/routers/api/v1/repo/issue_label.go
@@ -9,12 +9,12 @@ import (
 	"net/http"
 	"reflect"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	issue_service "code.gitea.io/gitea/services/issue"
+	issues_model "gitea.dev/models/issues"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	issue_service "gitea.dev/services/issue"
 )
 
 // ListIssueLabels list all the labels of an issue
diff --git a/routers/api/v1/repo/issue_lock.go b/routers/api/v1/repo/issue_lock.go
index 2f797a162ff..283b441fd20 100644
--- a/routers/api/v1/repo/issue_lock.go
+++ b/routers/api/v1/repo/issue_lock.go
@@ -7,10 +7,10 @@ import (
 	"errors"
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
+	issues_model "gitea.dev/models/issues"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
 )
 
 // LockIssue lock an issue
diff --git a/routers/api/v1/repo/issue_pin.go b/routers/api/v1/repo/issue_pin.go
index 45bdd875d20..b8cebfbb04e 100644
--- a/routers/api/v1/repo/issue_pin.go
+++ b/routers/api/v1/repo/issue_pin.go
@@ -6,10 +6,10 @@ package repo
 import (
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	issues_model "gitea.dev/models/issues"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // PinIssue pins a issue
diff --git a/routers/api/v1/repo/issue_reaction.go b/routers/api/v1/repo/issue_reaction.go
index 2c9efd91112..3662e63c71b 100644
--- a/routers/api/v1/repo/issue_reaction.go
+++ b/routers/api/v1/repo/issue_reaction.go
@@ -7,14 +7,14 @@ import (
 	"errors"
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	issue_service "code.gitea.io/gitea/services/issue"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	issue_service "gitea.dev/services/issue"
 )
 
 // GetIssueCommentReactions list reactions of a comment from an issue
diff --git a/routers/api/v1/repo/issue_stopwatch.go b/routers/api/v1/repo/issue_stopwatch.go
index 8818ab29727..36f24ed27ce 100644
--- a/routers/api/v1/repo/issue_stopwatch.go
+++ b/routers/api/v1/repo/issue_stopwatch.go
@@ -6,10 +6,10 @@ package repo
 import (
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // StartIssueStopwatch creates a stopwatch for the given issue.
diff --git a/routers/api/v1/repo/issue_subscription.go b/routers/api/v1/repo/issue_subscription.go
index 5df313752a8..b2480e88a5a 100644
--- a/routers/api/v1/repo/issue_subscription.go
+++ b/routers/api/v1/repo/issue_subscription.go
@@ -7,12 +7,12 @@ import (
 	"fmt"
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // AddIssueSubscription Subscribe user to issue
diff --git a/routers/api/v1/repo/issue_tracked_time.go b/routers/api/v1/repo/issue_tracked_time.go
index 7c1e77ccf5c..414b44f5246 100644
--- a/routers/api/v1/repo/issue_tracked_time.go
+++ b/routers/api/v1/repo/issue_tracked_time.go
@@ -8,15 +8,15 @@ import (
 	"net/http"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // ListTrackedTimes list all the tracked times of an issue
diff --git a/routers/api/v1/repo/key.go b/routers/api/v1/repo/key.go
index 8cb61e9e0c1..44471a4f73f 100644
--- a/routers/api/v1/repo/key.go
+++ b/routers/api/v1/repo/key.go
@@ -10,18 +10,18 @@ import (
 	"net/http"
 	"net/url"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // appendPrivateInformation appends the owner and key type information to api.PublicKey
diff --git a/routers/api/v1/repo/label.go b/routers/api/v1/repo/label.go
index 4f79d425953..aec82dce757 100644
--- a/routers/api/v1/repo/label.go
+++ b/routers/api/v1/repo/label.go
@@ -8,13 +8,13 @@ import (
 	"net/http"
 	"strconv"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/label"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/label"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // ListLabels list all the labels of a repository
diff --git a/routers/api/v1/repo/language.go b/routers/api/v1/repo/language.go
index 00789983ce7..8ba85a10654 100644
--- a/routers/api/v1/repo/language.go
+++ b/routers/api/v1/repo/language.go
@@ -8,9 +8,9 @@ import (
 	"net/http"
 	"strconv"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/services/context"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+	"gitea.dev/services/context"
 )
 
 type languageResponse []*repo_model.LanguageStat
diff --git a/routers/api/v1/repo/license.go b/routers/api/v1/repo/license.go
index 3040815e8ae..9680c420d44 100644
--- a/routers/api/v1/repo/license.go
+++ b/routers/api/v1/repo/license.go
@@ -6,9 +6,9 @@ package repo
 import (
 	"net/http"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/services/context"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+	"gitea.dev/services/context"
 )
 
 // GetLicenses returns licenses
diff --git a/routers/api/v1/repo/main_test.go b/routers/api/v1/repo/main_test.go
index 451f34d72ff..e3a8866933d 100644
--- a/routers/api/v1/repo/main_test.go
+++ b/routers/api/v1/repo/main_test.go
@@ -6,9 +6,9 @@ package repo
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
-	webhook_service "code.gitea.io/gitea/services/webhook"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	webhook_service "gitea.dev/services/webhook"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/api/v1/repo/migrate.go b/routers/api/v1/repo/migrate.go
index 7431493a3fc..65ef10777c4 100644
--- a/routers/api/v1/repo/migrate.go
+++ b/routers/api/v1/repo/migrate.go
@@ -10,26 +10,26 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/migrations"
-	notify_service "code.gitea.io/gitea/services/notify"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/migrations"
+	notify_service "gitea.dev/services/notify"
+	repo_service "gitea.dev/services/repository"
 )
 
 // Migrate migrate remote git repository to gitea
diff --git a/routers/api/v1/repo/milestone.go b/routers/api/v1/repo/milestone.go
index 2cd91b7caf9..8d325a90219 100644
--- a/routers/api/v1/repo/milestone.go
+++ b/routers/api/v1/repo/milestone.go
@@ -8,15 +8,15 @@ import (
 	"net/http"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // ListMilestones list milestones for a repository
diff --git a/routers/api/v1/repo/mirror.go b/routers/api/v1/repo/mirror.go
index ac2d8bba06a..53d47ff135e 100644
--- a/routers/api/v1/repo/mirror.go
+++ b/routers/api/v1/repo/mirror.go
@@ -6,21 +6,22 @@ package repo
 import (
 	"errors"
 	"net/http"
+	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/migrations"
-	mirror_service "code.gitea.io/gitea/services/mirror"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/migrations"
+	mirror_service "gitea.dev/services/mirror"
 )
 
 // MirrorSync adds a mirrored repository to the sync queue
@@ -101,6 +102,8 @@ func PushMirrorSync(ctx *context.APIContext) {
 	//     "$ref": "#/responses/forbidden"
 	//   "404":
 	//     "$ref": "#/responses/notFound"
+	//   "422":
+	//     "$ref": "#/responses/validationError"
 
 	if !setting.Mirror.Enabled {
 		ctx.APIError(http.StatusBadRequest, "Mirror feature is disabled")
@@ -112,14 +115,18 @@ func PushMirrorSync(ctx *context.APIContext) {
 		ctx.APIError(http.StatusNotFound, err)
 		return
 	}
+
+	failedPushMirrors := make([]string, 0)
 	for _, mirror := range pushMirrors {
 		ok := mirror_service.SyncPushMirror(ctx, mirror.ID)
 		if !ok {
-			ctx.APIErrorInternal(errors.New("error occurred when syncing push mirror " + mirror.RemoteName))
-			return
+			failedPushMirrors = append(failedPushMirrors, mirror.RemoteName)
 		}
 	}
-
+	if len(failedPushMirrors) != 0 {
+		ctx.APIError(http.StatusUnprocessableEntity, "error occurred when syncing push mirrors: "+strings.Join(failedPushMirrors, ", "))
+		return
+	}
 	ctx.Status(http.StatusOK)
 }
 
diff --git a/routers/api/v1/repo/mirror_test.go b/routers/api/v1/repo/mirror_test.go
new file mode 100644
index 00000000000..ce1538d66bf
--- /dev/null
+++ b/routers/api/v1/repo/mirror_test.go
@@ -0,0 +1,40 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package repo
+
+import (
+	"net/http"
+	"testing"
+
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/contexttest"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestPushMirrorSync verifies the endpoint attempts every push mirror instead
+// of aborting on the first failure, reporting all failed remotes with a 422.
+// Each remote name is not a configured git remote, so SyncPushMirror fails fast
+// without any network access.
+func TestPushMirrorSync(t *testing.T) {
+	unittest.PrepareTestEnv(t)
+	defer test.MockVariableValue(&setting.Mirror.Enabled, true)()
+
+	for _, remoteName := range []string{"broken_remote_1", "broken_remote_2"} {
+		assert.NoError(t, db.Insert(t.Context(), &repo_model.PushMirror{RepoID: 1, RemoteName: remoteName}))
+	}
+
+	ctx, resp := contexttest.MockAPIContext(t, "user2/repo1")
+	contexttest.LoadRepo(t, ctx, 1)
+
+	PushMirrorSync(ctx)
+
+	assert.Equal(t, http.StatusUnprocessableEntity, ctx.Resp.WrittenStatus())
+	assert.Contains(t, resp.Body.String(), "broken_remote_1")
+	assert.Contains(t, resp.Body.String(), "broken_remote_2")
+}
diff --git a/routers/api/v1/repo/notes.go b/routers/api/v1/repo/notes.go
index 87efb1caf26..d8fea56c4cd 100644
--- a/routers/api/v1/repo/notes.go
+++ b/routers/api/v1/repo/notes.go
@@ -7,10 +7,10 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // GetNote Get a note corresponding to a single commit from a repository
diff --git a/routers/api/v1/repo/patch.go b/routers/api/v1/repo/patch.go
index edb09fc08fa..4a016eef348 100644
--- a/routers/api/v1/repo/patch.go
+++ b/routers/api/v1/repo/patch.go
@@ -6,10 +6,10 @@ package repo
 import (
 	"net/http"
 
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/repository/files"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	"gitea.dev/services/repository/files"
 )
 
 // ApplyDiffPatch handles API call for applying a patch
diff --git a/routers/api/v1/repo/pull.go b/routers/api/v1/repo/pull.go
index 2426a6b3c2b..123c0c671a9 100644
--- a/routers/api/v1/repo/pull.go
+++ b/routers/api/v1/repo/pull.go
@@ -12,39 +12,39 @@ import (
 	"strings"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	pull_model "code.gitea.io/gitea/models/pull"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/routers/common"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/automerge"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/forms"
-	git_service "code.gitea.io/gitea/services/git"
-	"code.gitea.io/gitea/services/gitdiff"
-	issue_service "code.gitea.io/gitea/services/issue"
-	notify_service "code.gitea.io/gitea/services/notify"
-	pull_service "code.gitea.io/gitea/services/pull"
-	repo_service "code.gitea.io/gitea/services/repository"
+	activities_model "gitea.dev/models/activities"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	pull_model "gitea.dev/models/pull"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/routers/common"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/automerge"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/forms"
+	git_service "gitea.dev/services/git"
+	"gitea.dev/services/gitdiff"
+	issue_service "gitea.dev/services/issue"
+	notify_service "gitea.dev/services/notify"
+	pull_service "gitea.dev/services/pull"
+	repo_service "gitea.dev/services/repository"
 )
 
 // ListPullRequests returns a list of all PRs
@@ -996,7 +996,7 @@ func MergePullRequest(ctx *context.APIContext) {
 				return
 			}
 			if strings.Contains(err.Error(), "Wrong commit ID") {
-				ctx.JSON(http.StatusConflict, err)
+				ctx.APIError(http.StatusConflict, err)
 				return
 			}
 			ctx.APIErrorInternal(err)
@@ -1253,15 +1253,17 @@ func UpdatePullRequest(ctx *context.APIContext) {
 		return
 	}
 
-	rebase := ctx.FormString("style") == "rebase"
+	// keep API back-compat: when no style is given, default to "merge" rather than the repo's DefaultUpdateStyle,
+	// so existing API clients keep getting a merge update.
+	rebase := repo_model.UpdateStyle(ctx.FormString("style", string(repo_model.UpdateStyleMerge))) == repo_model.UpdateStyleRebase
 
-	allowedUpdateByMerge, allowedUpdateByRebase, err := pull_service.IsUserAllowedToUpdate(ctx, pr, ctx.Doer)
+	userUpdateStyles, err := pull_service.CheckUserAllowedToUpdate(ctx, pr, ctx.Doer)
 	if err != nil {
 		ctx.APIErrorInternal(err)
 		return
 	}
 
-	if (!allowedUpdateByMerge && !rebase) || (rebase && !allowedUpdateByRebase) {
+	if (rebase && !userUpdateStyles.RebaseAllowed) || (!rebase && !userUpdateStyles.MergeAllowed) {
 		ctx.Status(http.StatusForbidden)
 		return
 	}
diff --git a/routers/api/v1/repo/pull_review.go b/routers/api/v1/repo/pull_review.go
index a049a61aa9e..901e6b69c08 100644
--- a/routers/api/v1/repo/pull_review.go
+++ b/routers/api/v1/repo/pull_review.go
@@ -9,18 +9,18 @@ import (
 	"net/http"
 	"strings"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
 )
 
 // ListPullReviews lists all reviews of a pull request
diff --git a/routers/api/v1/repo/release.go b/routers/api/v1/repo/release.go
index 2eade9eab58..ee995f4402b 100644
--- a/routers/api/v1/repo/release.go
+++ b/routers/api/v1/repo/release.go
@@ -8,17 +8,17 @@ import (
 	"fmt"
 	"net/http"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	release_service "code.gitea.io/gitea/services/release"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	release_service "gitea.dev/services/release"
 )
 
 func canAccessReleaseDraft(ctx *context.APIContext) bool {
diff --git a/routers/api/v1/repo/release_attachment.go b/routers/api/v1/repo/release_attachment.go
index c0bf89a9d00..896c6d24ccb 100644
--- a/routers/api/v1/repo/release_attachment.go
+++ b/routers/api/v1/repo/release_attachment.go
@@ -8,16 +8,16 @@ import (
 	"net/http"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	attachment_service "code.gitea.io/gitea/services/attachment"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	"code.gitea.io/gitea/services/convert"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	attachment_service "gitea.dev/services/attachment"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	"gitea.dev/services/convert"
 )
 
 func checkReleaseMatchRepo(ctx *context.APIContext, releaseID int64) bool {
diff --git a/routers/api/v1/repo/release_tags.go b/routers/api/v1/repo/release_tags.go
index bca5871aa74..65338607c56 100644
--- a/routers/api/v1/repo/release_tags.go
+++ b/routers/api/v1/repo/release_tags.go
@@ -6,11 +6,11 @@ package repo
 import (
 	"net/http"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	release_service "code.gitea.io/gitea/services/release"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	release_service "gitea.dev/services/release"
 )
 
 // GetReleaseByTag get a single release of a repository by tag name
diff --git a/routers/api/v1/repo/repo.go b/routers/api/v1/repo/repo.go
index 8b0dc7c863b..e0e40086a56 100644
--- a/routers/api/v1/repo/repo.go
+++ b/routers/api/v1/repo/repo.go
@@ -13,34 +13,34 @@ import (
 	"strings"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/label"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	actions_service "code.gitea.io/gitea/services/actions"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	feed_service "code.gitea.io/gitea/services/feed"
-	"code.gitea.io/gitea/services/issue"
-	"code.gitea.io/gitea/services/migrations"
-	mirror_service "code.gitea.io/gitea/services/mirror"
-	repo_service "code.gitea.io/gitea/services/repository"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/label"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	actions_service "gitea.dev/services/actions"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	feed_service "gitea.dev/services/feed"
+	"gitea.dev/services/issue"
+	"gitea.dev/services/migrations"
+	mirror_service "gitea.dev/services/mirror"
+	repo_service "gitea.dev/services/repository"
 )
 
 // Search repositories via options
@@ -134,9 +134,6 @@ func Search(ctx *context.APIContext) {
 	//     "$ref": "#/responses/validationError"
 
 	private := ctx.IsSigned && (ctx.FormString("private") == "" || ctx.FormBool("private"))
-	if ctx.PublicOnly {
-		private = false
-	}
 
 	opts := repo_model.SearchRepoOptions{
 		ListOptions:        utils.GetListOptions(ctx),
@@ -152,6 +149,7 @@ func Search(ctx *context.APIContext) {
 		StarredByID:        ctx.FormInt64("starredBy"),
 		IncludeDescription: ctx.FormBool("includeDesc"),
 	}
+	opts.ApplyPublicOnly(ctx.PublicOnly)
 
 	if ctx.FormString("template") != "" {
 		opts.Template = optional.Some(ctx.FormBool("template"))
@@ -187,24 +185,11 @@ func Search(ctx *context.APIContext) {
 		opts.IsPrivate = optional.Some(ctx.FormBool("is_private"))
 	}
 
-	sortMode := ctx.FormString("sort")
-	if len(sortMode) > 0 {
-		sortOrder := ctx.FormString("order")
-		if len(sortOrder) == 0 {
-			sortOrder = "asc"
-		}
-		if searchModeMap, ok := repo_model.OrderByMap[sortOrder]; ok {
-			if orderBy, ok := searchModeMap[sortMode]; ok {
-				opts.OrderBy = orderBy
-			} else {
-				ctx.APIError(http.StatusUnprocessableEntity, fmt.Errorf("Invalid sort mode: \"%s\"", sortMode))
-				return
-			}
-		} else {
-			ctx.APIError(http.StatusUnprocessableEntity, fmt.Errorf("Invalid sort order: \"%s\"", sortOrder))
-			return
-		}
+	orderBy, ok := utils.ResolveSortOrder(ctx, repo_model.OrderByMap, "")
+	if !ok {
+		return
 	}
+	opts.OrderBy = orderBy
 
 	repos, count, err := repo_model.SearchRepository(ctx, opts)
 	if err != nil {
@@ -570,6 +555,10 @@ func GetByID(ctx *context.APIContext) {
 		}
 		return
 	}
+	if !ctx.TokenCanAccessRepo(repo) {
+		ctx.APIErrorNotFound()
+		return
+	}
 
 	permission, err := access_model.GetDoerRepoPermission(ctx, repo, ctx.Doer)
 	if err != nil {
@@ -898,10 +887,20 @@ func updateRepoUnits(ctx *context.APIContext, opts api.EditRepoOption) error {
 			optional.AssignPtrValue(changed, &config.AllowFastForwardOnly, opts.AllowFastForwardOnly)
 			optional.AssignPtrValue(changed, &config.AllowManualMerge, opts.AllowManualMerge)
 			optional.AssignPtrValue(changed, &config.AutodetectManualMerge, opts.AutodetectManualMerge)
+			optional.AssignPtrValue(changed, &config.AllowMergeUpdate, opts.AllowMergeUpdate)
 			optional.AssignPtrValue(changed, &config.AllowRebaseUpdate, opts.AllowRebaseUpdate)
 			optional.AssignPtrValue(changed, &config.DefaultDeleteBranchAfterMerge, opts.DefaultDeleteBranchAfterMerge)
 			optional.AssignPtrValue(changed, &config.DefaultAllowMaintainerEdit, opts.DefaultAllowMaintainerEdit)
 			optional.AssignPtrString(changed, &config.DefaultMergeStyle, opts.DefaultMergeStyle)
+			optional.AssignPtrString(changed, &config.DefaultUpdateStyle, opts.DefaultUpdateStyle)
+			// only validate update-style fields when the caller is actually changing one of them,
+			// so unrelated PATCH calls don't reject historical configs.
+			if opts.AllowMergeUpdate != nil || opts.AllowRebaseUpdate != nil || opts.DefaultUpdateStyle != nil {
+				if err := config.ValidateUpdateSettings(); err != nil {
+					ctx.APIError(http.StatusUnprocessableEntity, err)
+					return err
+				}
+			}
 			if *changed || mustInsertPullRequestUnit {
 				units = append(units, repo_model.RepoUnit{
 					RepoID: repo.ID,
@@ -1312,6 +1311,7 @@ func ListRepoActivityFeeds(ctx *context.APIContext) {
 		Date:           ctx.FormString("date"),
 		ListOptions:    listOptions,
 	}
+	opts.ApplyPublicOnly(ctx.PublicOnly)
 
 	feeds, count, err := feed_service.GetFeeds(ctx, opts)
 	if err != nil {
diff --git a/routers/api/v1/repo/repo_test.go b/routers/api/v1/repo/repo_test.go
index 97233f85dcf..f472dff895a 100644
--- a/routers/api/v1/repo/repo_test.go
+++ b/routers/api/v1/repo/repo_test.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/contexttest"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/api/v1/repo/star.go b/routers/api/v1/repo/star.go
index 46218e0e283..d5c37471ecb 100644
--- a/routers/api/v1/repo/star.go
+++ b/routers/api/v1/repo/star.go
@@ -6,11 +6,11 @@ package repo
 import (
 	"net/http"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	repo_model "gitea.dev/models/repo"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // ListStargazers list a repository's stargazers
diff --git a/routers/api/v1/repo/status.go b/routers/api/v1/repo/status.go
index 2b0e52818fc..9df2a32e72d 100644
--- a/routers/api/v1/repo/status.go
+++ b/routers/api/v1/repo/status.go
@@ -7,14 +7,14 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	commitstatus_service "code.gitea.io/gitea/services/repository/commitstatus"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	commitstatus_service "gitea.dev/services/repository/commitstatus"
 )
 
 // NewCommitStatus creates a new CommitStatus
diff --git a/routers/api/v1/repo/subscriber.go b/routers/api/v1/repo/subscriber.go
index 14f296a83d2..7f7428adcb0 100644
--- a/routers/api/v1/repo/subscriber.go
+++ b/routers/api/v1/repo/subscriber.go
@@ -6,11 +6,11 @@ package repo
 import (
 	"net/http"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	repo_model "gitea.dev/models/repo"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // ListSubscribers list a repo's subscribers (i.e. watchers)
diff --git a/routers/api/v1/repo/tag.go b/routers/api/v1/repo/tag.go
index 28bc508879b..796bdb10883 100644
--- a/routers/api/v1/repo/tag.go
+++ b/routers/api/v1/repo/tag.go
@@ -9,16 +9,16 @@ import (
 	"net/http"
 	"strings"
 
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	release_service "code.gitea.io/gitea/services/release"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	release_service "gitea.dev/services/release"
 )
 
 // ListTags list all the tags of a repository
diff --git a/routers/api/v1/repo/teams.go b/routers/api/v1/repo/teams.go
index cb0f026933e..1913bb6eecd 100644
--- a/routers/api/v1/repo/teams.go
+++ b/routers/api/v1/repo/teams.go
@@ -7,10 +7,10 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/organization"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	repo_service "gitea.dev/services/repository"
 )
 
 // ListTeams list a repository's teams
diff --git a/routers/api/v1/repo/topic.go b/routers/api/v1/repo/topic.go
index 9c4c22e0398..9009e1d8dbf 100644
--- a/routers/api/v1/repo/topic.go
+++ b/routers/api/v1/repo/topic.go
@@ -7,14 +7,14 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // ListTopics returns list of current topics for repo
diff --git a/routers/api/v1/repo/transfer.go b/routers/api/v1/repo/transfer.go
index cbf3d10c398..e2c124a86a5 100644
--- a/routers/api/v1/repo/transfer.go
+++ b/routers/api/v1/repo/transfer.go
@@ -8,18 +8,18 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	repo_service "gitea.dev/services/repository"
 )
 
 // Transfer transfers the ownership of a repository
diff --git a/routers/api/v1/repo/tree.go b/routers/api/v1/repo/tree.go
index dfd69600fb0..7c41a0e86d9 100644
--- a/routers/api/v1/repo/tree.go
+++ b/routers/api/v1/repo/tree.go
@@ -6,8 +6,8 @@ package repo
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/services/context"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	"gitea.dev/services/context"
+	files_service "gitea.dev/services/repository/files"
 )
 
 // GetTree get the tree of a repository.
diff --git a/routers/api/v1/repo/wiki.go b/routers/api/v1/repo/wiki.go
index a860665f511..e6fdd6afc60 100644
--- a/routers/api/v1/repo/wiki.go
+++ b/routers/api/v1/repo/wiki.go
@@ -9,17 +9,17 @@ import (
 	"net/http"
 	"net/url"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	notify_service "code.gitea.io/gitea/services/notify"
-	wiki_service "code.gitea.io/gitea/services/wiki"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	notify_service "gitea.dev/services/notify"
+	wiki_service "gitea.dev/services/wiki"
 )
 
 // NewWikiPage response for wiki create request
diff --git a/routers/api/v1/settings/settings.go b/routers/api/v1/settings/settings.go
index 94fbadeab01..b0571f6da21 100644
--- a/routers/api/v1/settings/settings.go
+++ b/routers/api/v1/settings/settings.go
@@ -6,9 +6,9 @@ package settings
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/context"
 )
 
 // GetGeneralUISettings returns instance's global settings for ui
diff --git a/routers/api/v1/shared/action.go b/routers/api/v1/shared/action.go
index 6f0c0248438..3dbe7008bec 100644
--- a/routers/api/v1/shared/action.go
+++ b/routers/api/v1/shared/action.go
@@ -7,19 +7,19 @@ import (
 	"fmt"
 	"net/http"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/webhook"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/webhook"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // ListJobs lists jobs for api route validated ownerID and repoID
@@ -36,11 +36,16 @@ func ListJobs(ctx *context.APIContext, ownerID, repoID, runID int64, runAttemptI
 		setting.PanicInDevOrTesting("ownerID and repoID should not be both set")
 	}
 	listOptions := utils.GetListOptions(ctx)
+	orderBy, ok := utils.ResolveSortOrder(ctx, actions_model.JobOrderByMap, actions_model.JobOrderByMap["asc"]["id"])
+	if !ok {
+		return
+	}
 	opts := actions_model.FindRunJobOptions{
 		OwnerID:     ownerID,
 		RepoID:      repoID,
 		RunID:       runID,
 		ListOptions: listOptions,
+		OrderBy:     orderBy,
 	}
 	if runID > 0 {
 		opts.RunAttemptID = runAttemptID
diff --git a/routers/api/v1/shared/block.go b/routers/api/v1/shared/block.go
index dfffe72bf06..e8190041aa5 100644
--- a/routers/api/v1/shared/block.go
+++ b/routers/api/v1/shared/block.go
@@ -7,13 +7,13 @@ import (
 	"errors"
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	user_service "code.gitea.io/gitea/services/user"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	user_service "gitea.dev/services/user"
 )
 
 func ListBlocks(ctx *context.APIContext, blocker *user_model.User) {
diff --git a/routers/api/v1/shared/runners.go b/routers/api/v1/shared/runners.go
index b2e07cf2182..329f17736eb 100644
--- a/routers/api/v1/shared/runners.go
+++ b/routers/api/v1/shared/runners.go
@@ -7,15 +7,15 @@ import (
 	"errors"
 	"net/http"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // RegistrationToken is response related to registration token
diff --git a/routers/api/v1/swagger/action.go b/routers/api/v1/swagger/action.go
index 328998db211..559c561e9fd 100644
--- a/routers/api/v1/swagger/action.go
+++ b/routers/api/v1/swagger/action.go
@@ -3,7 +3,7 @@
 
 package swagger
 
-import api "code.gitea.io/gitea/modules/structs"
+import api "gitea.dev/modules/structs"
 
 // SecretList
 // swagger:response SecretList
diff --git a/routers/api/v1/swagger/activity.go b/routers/api/v1/swagger/activity.go
index 95e1ba90359..0f17762fbee 100644
--- a/routers/api/v1/swagger/activity.go
+++ b/routers/api/v1/swagger/activity.go
@@ -4,7 +4,7 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 )
 
 // ActivityFeedsList
diff --git a/routers/api/v1/swagger/app.go b/routers/api/v1/swagger/app.go
index 6a08b118745..dc30cda6996 100644
--- a/routers/api/v1/swagger/app.go
+++ b/routers/api/v1/swagger/app.go
@@ -4,7 +4,7 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 )
 
 // OAuth2Application
diff --git a/routers/api/v1/swagger/cron.go b/routers/api/v1/swagger/cron.go
index 00cfbe0adba..9d6b8c48266 100644
--- a/routers/api/v1/swagger/cron.go
+++ b/routers/api/v1/swagger/cron.go
@@ -4,7 +4,7 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 )
 
 // CronList
diff --git a/routers/api/v1/swagger/issue.go b/routers/api/v1/swagger/issue.go
index 62458a34243..ea8858a8e30 100644
--- a/routers/api/v1/swagger/issue.go
+++ b/routers/api/v1/swagger/issue.go
@@ -4,7 +4,7 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 )
 
 // Issue
diff --git a/routers/api/v1/swagger/key.go b/routers/api/v1/swagger/key.go
index 83908335896..8e7b89a3c67 100644
--- a/routers/api/v1/swagger/key.go
+++ b/routers/api/v1/swagger/key.go
@@ -4,7 +4,7 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 )
 
 // PublicKey
diff --git a/routers/api/v1/swagger/misc.go b/routers/api/v1/swagger/misc.go
index df8a813dfb6..e999d89ec3d 100644
--- a/routers/api/v1/swagger/misc.go
+++ b/routers/api/v1/swagger/misc.go
@@ -4,7 +4,7 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 )
 
 // ServerVersion
diff --git a/routers/api/v1/swagger/nodeinfo.go b/routers/api/v1/swagger/nodeinfo.go
index 8650dfa0923..f217b24bcbc 100644
--- a/routers/api/v1/swagger/nodeinfo.go
+++ b/routers/api/v1/swagger/nodeinfo.go
@@ -4,7 +4,7 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 )
 
 // NodeInfo
diff --git a/routers/api/v1/swagger/notify.go b/routers/api/v1/swagger/notify.go
index 743d807a0a9..2d2939c3bbd 100644
--- a/routers/api/v1/swagger/notify.go
+++ b/routers/api/v1/swagger/notify.go
@@ -4,7 +4,7 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 )
 
 // NotificationThread
diff --git a/routers/api/v1/swagger/options.go b/routers/api/v1/swagger/options.go
index 1a442d11466..e59857682e4 100644
--- a/routers/api/v1/swagger/options.go
+++ b/routers/api/v1/swagger/options.go
@@ -4,8 +4,8 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/forms"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/forms"
 )
 
 // not actually a response, just a hack to get go-swagger to include definitions
diff --git a/routers/api/v1/swagger/org.go b/routers/api/v1/swagger/org.go
index 0105446b00a..f603555f0ff 100644
--- a/routers/api/v1/swagger/org.go
+++ b/routers/api/v1/swagger/org.go
@@ -4,7 +4,7 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 )
 
 // Organization
diff --git a/routers/api/v1/swagger/package.go b/routers/api/v1/swagger/package.go
index eada12d1eae..4f2b0b0d8d2 100644
--- a/routers/api/v1/swagger/package.go
+++ b/routers/api/v1/swagger/package.go
@@ -4,7 +4,7 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 )
 
 // Package
diff --git a/routers/api/v1/swagger/repo.go b/routers/api/v1/swagger/repo.go
index 9e20c0533b9..e9a3a158217 100644
--- a/routers/api/v1/swagger/repo.go
+++ b/routers/api/v1/swagger/repo.go
@@ -4,7 +4,7 @@
 package swagger
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 )
 
 // Repository
diff --git a/routers/api/v1/swagger/settings.go b/routers/api/v1/swagger/settings.go
index a9466699df3..07ddcfb04e6 100644
--- a/routers/api/v1/swagger/settings.go
+++ b/routers/api/v1/swagger/settings.go
@@ -3,7 +3,7 @@
 
 package swagger
 
-import api "code.gitea.io/gitea/modules/structs"
+import api "gitea.dev/modules/structs"
 
 // GeneralRepoSettings
 // swagger:response GeneralRepoSettings
diff --git a/routers/api/v1/swagger/user.go b/routers/api/v1/swagger/user.go
index e2ad511d2b9..16be01fd341 100644
--- a/routers/api/v1/swagger/user.go
+++ b/routers/api/v1/swagger/user.go
@@ -4,8 +4,8 @@
 package swagger
 
 import (
-	activities_model "code.gitea.io/gitea/models/activities"
-	api "code.gitea.io/gitea/modules/structs"
+	activities_model "gitea.dev/models/activities"
+	api "gitea.dev/modules/structs"
 )
 
 // User
diff --git a/routers/api/v1/user/action.go b/routers/api/v1/user/action.go
index 4de0b30d983..f5654908f0d 100644
--- a/routers/api/v1/user/action.go
+++ b/routers/api/v1/user/action.go
@@ -7,16 +7,16 @@ import (
 	"errors"
 	"net/http"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/shared"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	actions_service "code.gitea.io/gitea/services/actions"
-	"code.gitea.io/gitea/services/context"
-	secret_service "code.gitea.io/gitea/services/secrets"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/shared"
+	"gitea.dev/routers/api/v1/utils"
+	actions_service "gitea.dev/services/actions"
+	"gitea.dev/services/context"
+	secret_service "gitea.dev/services/secrets"
 )
 
 // create or update one secret of the user scope
@@ -429,6 +429,14 @@ func ListWorkflowJobs(ctx *context.APIContext) {
 	//   in: query
 	//   description: page size of results
 	//   type: integer
+	// - name: sort
+	//   in: query
+	//   description: sort jobs by attribute. Supported values are "id". Default is "id"
+	//   type: string
+	// - name: order
+	//   in: query
+	//   description: sort order, either "asc" (ascending) or "desc" (descending). Default is "asc"
+	//   type: string
 	// produces:
 	// - application/json
 	// responses:
@@ -438,6 +446,8 @@ func ListWorkflowJobs(ctx *context.APIContext) {
 	//     "$ref": "#/responses/error"
 	//   "404":
 	//     "$ref": "#/responses/notFound"
+	//   "422":
+	//     "$ref": "#/responses/validationError"
 
 	shared.ListJobs(ctx, ctx.Doer.ID, 0, 0, nil)
 }
diff --git a/routers/api/v1/user/app.go b/routers/api/v1/user/app.go
index 474680adec5..729c408a151 100644
--- a/routers/api/v1/user/app.go
+++ b/routers/api/v1/user/app.go
@@ -11,14 +11,14 @@ import (
 	"strconv"
 	"strings"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/forms"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/forms"
 )
 
 // ListAccessTokens list all the access tokens
diff --git a/routers/api/v1/user/avatar.go b/routers/api/v1/user/avatar.go
index 8f39319112f..d02ca87fb27 100644
--- a/routers/api/v1/user/avatar.go
+++ b/routers/api/v1/user/avatar.go
@@ -7,10 +7,10 @@ import (
 	"encoding/base64"
 	"net/http"
 
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	user_service "code.gitea.io/gitea/services/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	user_service "gitea.dev/services/user"
 )
 
 // UpdateAvatar updates the Avatar of a User
diff --git a/routers/api/v1/user/block.go b/routers/api/v1/user/block.go
index 8365188f605..268ef7da90f 100644
--- a/routers/api/v1/user/block.go
+++ b/routers/api/v1/user/block.go
@@ -4,8 +4,8 @@
 package user
 
 import (
-	"code.gitea.io/gitea/routers/api/v1/shared"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/routers/api/v1/shared"
+	"gitea.dev/services/context"
 )
 
 func ListBlocks(ctx *context.APIContext) {
diff --git a/routers/api/v1/user/email.go b/routers/api/v1/user/email.go
index 055e5ea4197..71b5a691c15 100644
--- a/routers/api/v1/user/email.go
+++ b/routers/api/v1/user/email.go
@@ -7,12 +7,12 @@ import (
 	"fmt"
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	user_service "code.gitea.io/gitea/services/user"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	user_service "gitea.dev/services/user"
 )
 
 // ListEmails list all of the authenticated user's email addresses
diff --git a/routers/api/v1/user/follower.go b/routers/api/v1/user/follower.go
index 5b31a00b76f..11f659c85a4 100644
--- a/routers/api/v1/user/follower.go
+++ b/routers/api/v1/user/follower.go
@@ -8,11 +8,11 @@ import (
 	"errors"
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 func responseAPIUsers(ctx *context.APIContext, users []*user_model.User) {
diff --git a/routers/api/v1/user/gpg_key.go b/routers/api/v1/user/gpg_key.go
index 39ded31bf48..bae4d7420f1 100644
--- a/routers/api/v1/user/gpg_key.go
+++ b/routers/api/v1/user/gpg_key.go
@@ -8,15 +8,15 @@ import (
 	"net/http"
 	"strings"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 func listGPGKeys(ctx *context.APIContext, uid int64, listOptions db.ListOptions) {
diff --git a/routers/api/v1/user/helper.go b/routers/api/v1/user/helper.go
index de3ec089df6..ce051e2d168 100644
--- a/routers/api/v1/user/helper.go
+++ b/routers/api/v1/user/helper.go
@@ -4,8 +4,8 @@
 package user
 
 import (
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/services/context"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/services/context"
 )
 
 // GetUserByPathParam get user by the path param name
diff --git a/routers/api/v1/user/hook.go b/routers/api/v1/user/hook.go
index 73c98ce746b..cc0b24a883b 100644
--- a/routers/api/v1/user/hook.go
+++ b/routers/api/v1/user/hook.go
@@ -6,11 +6,11 @@ package user
 import (
 	"net/http"
 
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	webhook_service "code.gitea.io/gitea/services/webhook"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	webhook_service "gitea.dev/services/webhook"
 )
 
 // ListHooks list the authenticated user's webhooks
diff --git a/routers/api/v1/user/key.go b/routers/api/v1/user/key.go
index ca58346413a..1a932c94af4 100644
--- a/routers/api/v1/user/key.go
+++ b/routers/api/v1/user/key.go
@@ -9,18 +9,18 @@ import (
 	"errors"
 	"net/http"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/api/v1/repo"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/api/v1/repo"
+	"gitea.dev/routers/api/v1/utils"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // appendPrivateInformation appends the owner and key type information to api.PublicKey
diff --git a/routers/api/v1/user/repo.go b/routers/api/v1/user/repo.go
index a664888dbf1..b9dbde73565 100644
--- a/routers/api/v1/user/repo.go
+++ b/routers/api/v1/user/repo.go
@@ -6,25 +6,28 @@ package user
 import (
 	"net/http"
 
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // listUserRepos - List the repositories owned by the given user.
 func listUserRepos(ctx *context.APIContext, u *user_model.User, private bool) {
 	opts := utils.GetListOptions(ctx)
 
-	repos, count, err := repo_model.GetUserRepositories(ctx, repo_model.SearchRepoOptions{
+	searchOpts := repo_model.SearchRepoOptions{
 		Actor:       u,
 		Private:     private,
 		ListOptions: opts,
 		OrderBy:     "id ASC",
-	})
+	}
+	searchOpts.ApplyPublicOnly(ctx.PublicOnly)
+
+	repos, count, err := repo_model.GetUserRepositories(ctx, searchOpts)
 	if err != nil {
 		ctx.APIErrorInternal(err)
 		return
@@ -79,8 +82,7 @@ func ListUserRepos(ctx *context.APIContext) {
 	//   "404":
 	//     "$ref": "#/responses/notFound"
 
-	private := ctx.IsSigned
-	listUserRepos(ctx, ctx.ContextUser, private)
+	listUserRepos(ctx, ctx.ContextUser, ctx.IsSigned)
 }
 
 // ListMyRepos - list the repositories you own or have access to.
@@ -110,6 +112,7 @@ func ListMyRepos(ctx *context.APIContext) {
 		Private:            ctx.IsSigned,
 		IncludeDescription: true,
 	}
+	opts.ApplyPublicOnly(ctx.PublicOnly)
 
 	repos, count, err := repo_model.SearchRepository(ctx, opts)
 	if err != nil {
diff --git a/routers/api/v1/user/runners.go b/routers/api/v1/user/runners.go
index 6db1d48069f..dcfc60c5b99 100644
--- a/routers/api/v1/user/runners.go
+++ b/routers/api/v1/user/runners.go
@@ -4,8 +4,8 @@
 package user
 
 import (
-	"code.gitea.io/gitea/routers/api/v1/shared"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/routers/api/v1/shared"
+	"gitea.dev/services/context"
 )
 
 // https://docs.github.com/en/rest/actions/self-hosted-runners?apiVersion=2022-11-28#create-a-registration-token-for-an-organization
diff --git a/routers/api/v1/user/settings.go b/routers/api/v1/user/settings.go
index d67c54b3397..d9dcb14e93a 100644
--- a/routers/api/v1/user/settings.go
+++ b/routers/api/v1/user/settings.go
@@ -6,12 +6,12 @@ package user
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/optional"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	user_service "code.gitea.io/gitea/services/user"
+	"gitea.dev/modules/optional"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	user_service "gitea.dev/services/user"
 )
 
 // GetUserSettings returns user settings
diff --git a/routers/api/v1/user/star.go b/routers/api/v1/user/star.go
index 50a54b2683e..7036a4f854b 100644
--- a/routers/api/v1/user/star.go
+++ b/routers/api/v1/user/star.go
@@ -8,23 +8,26 @@ import (
 	"errors"
 	"net/http"
 
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // getStarredRepos returns the repos that the user with the specified userID has
 // starred
 func getStarredRepos(ctx *context.APIContext, user *user_model.User, private bool) ([]*api.Repository, error) {
-	starredRepos, err := repo_model.GetStarredRepos(ctx, &repo_model.StarredReposOptions{
+	opts := &repo_model.StarredReposOptions{
 		ListOptions:    utils.GetListOptions(ctx),
 		StarrerID:      user.ID,
 		IncludePrivate: private,
-	})
+	}
+	opts.ApplyPublicOnly(ctx.PublicOnly)
+
+	starredRepos, err := repo_model.GetStarredRepos(ctx, opts)
 	if err != nil {
 		return nil, err
 	}
diff --git a/routers/api/v1/user/user.go b/routers/api/v1/user/user.go
index 005770c5713..d45ca11348d 100644
--- a/routers/api/v1/user/user.go
+++ b/routers/api/v1/user/user.go
@@ -7,13 +7,12 @@ package user
 import (
 	"net/http"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	feed_service "code.gitea.io/gitea/services/feed"
+	activities_model "gitea.dev/models/activities"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	feed_service "gitea.dev/services/feed"
 )
 
 // Search search users
@@ -69,19 +68,16 @@ func Search(ctx *context.APIContext) {
 		maxResults = 1
 		users = []*user_model.User{user_model.NewActionsUser()}
 	default:
-		var visible []structs.VisibleType
-		if ctx.PublicOnly {
-			visible = []structs.VisibleType{structs.VisibleTypePublic}
-		}
-		users, maxResults, err = user_model.SearchUsers(ctx, user_model.SearchUserOptions{
+		opts := user_model.SearchUserOptions{
 			Actor:         ctx.Doer,
 			Keyword:       ctx.FormTrim("q"),
 			UID:           uid,
 			Types:         []user_model.UserType{user_model.UserTypeIndividual},
 			SearchByEmail: true,
-			Visible:       visible,
 			ListOptions:   listOptions,
-		})
+		}
+		opts.ApplyPublicOnly(ctx.PublicOnly)
+		users, maxResults, err = user_model.SearchUsers(ctx, opts)
 		if err != nil {
 			ctx.JSON(http.StatusInternalServerError, map[string]any{
 				"ok":    false,
@@ -214,6 +210,7 @@ func ListUserActivityFeeds(ctx *context.APIContext) {
 		Date:            ctx.FormString("date"),
 		ListOptions:     listOptions,
 	}
+	opts.ApplyPublicOnly(ctx.PublicOnly)
 
 	feeds, count, err := feed_service.GetFeeds(ctx, opts)
 	if err != nil {
diff --git a/routers/api/v1/user/watch.go b/routers/api/v1/user/watch.go
index 9c11d5ca35d..94d3de84b8a 100644
--- a/routers/api/v1/user/watch.go
+++ b/routers/api/v1/user/watch.go
@@ -7,22 +7,25 @@ import (
 	"errors"
 	"net/http"
 
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/routers/api/v1/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // getWatchedRepos returns the repos that the user with the specified userID is watching
 func getWatchedRepos(ctx *context.APIContext, user *user_model.User, private bool) ([]*api.Repository, int64, error) {
-	watchedRepos, total, err := repo_model.GetWatchedRepos(ctx, &repo_model.WatchedReposOptions{
+	opts := &repo_model.WatchedReposOptions{
 		ListOptions:    utils.GetListOptions(ctx),
 		WatcherID:      user.ID,
 		IncludePrivate: private,
-	})
+	}
+	opts.ApplyPublicOnly(ctx.PublicOnly)
+
+	watchedRepos, total, err := repo_model.GetWatchedRepos(ctx, opts)
 	if err != nil {
 		return nil, 0, err
 	}
diff --git a/routers/api/v1/utils/git.go b/routers/api/v1/utils/git.go
index b872dcbd2cc..0123073d17f 100644
--- a/routers/api/v1/utils/git.go
+++ b/routers/api/v1/utils/git.go
@@ -6,12 +6,12 @@ package utils
 import (
 	"errors"
 
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/services/context"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/services/context"
 )
 
 type RefCommit struct {
diff --git a/routers/api/v1/utils/hook.go b/routers/api/v1/utils/hook.go
index 8dc19b63a8f..b0156b705a0 100644
--- a/routers/api/v1/utils/hook.go
+++ b/routers/api/v1/utils/hook.go
@@ -8,17 +8,17 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	"code.gitea.io/gitea/services/context"
-	webhook_service "code.gitea.io/gitea/services/webhook"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
+	webhook_module "gitea.dev/modules/webhook"
+	"gitea.dev/services/context"
+	webhook_service "gitea.dev/services/webhook"
 )
 
 // ListOwnerHooks lists the webhooks of the provided owner
diff --git a/routers/api/v1/utils/hook_test.go b/routers/api/v1/utils/hook_test.go
index e5e8ce07cec..9e7f3af9814 100644
--- a/routers/api/v1/utils/hook_test.go
+++ b/routers/api/v1/utils/hook_test.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/structs"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/api/v1/utils/main_test.go b/routers/api/v1/utils/main_test.go
index 4eace1f3694..2063b4be397 100644
--- a/routers/api/v1/utils/main_test.go
+++ b/routers/api/v1/utils/main_test.go
@@ -6,9 +6,9 @@ package utils
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
-	webhook_service "code.gitea.io/gitea/services/webhook"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	webhook_service "gitea.dev/services/webhook"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/api/v1/utils/page.go b/routers/api/v1/utils/page.go
index 2c7b64967ad..02de431aa35 100644
--- a/routers/api/v1/utils/page.go
+++ b/routers/api/v1/utils/page.go
@@ -4,9 +4,9 @@
 package utils
 
 import (
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	"gitea.dev/models/db"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // GetListOptions returns list options using the page and limit parameters
diff --git a/routers/api/v1/utils/sort.go b/routers/api/v1/utils/sort.go
new file mode 100644
index 00000000000..b5f819cdb6e
--- /dev/null
+++ b/routers/api/v1/utils/sort.go
@@ -0,0 +1,38 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package utils
+
+import (
+	"fmt"
+	"net/http"
+
+	"gitea.dev/models/db"
+	"gitea.dev/services/context"
+)
+
+// ResolveSortOrder reads "sort" and "order" query params and returns the matching
+// SearchOrderBy from orderByMap. When "sort" is absent, returns defaultOrder.
+// On invalid input it writes a 422 response and returns ok=false; callers should
+// then return immediately.
+func ResolveSortOrder(ctx *context.APIContext, orderByMap map[string]map[string]db.SearchOrderBy, defaultOrder db.SearchOrderBy) (db.SearchOrderBy, bool) {
+	sortMode := ctx.FormString("sort")
+	if sortMode == "" {
+		return defaultOrder, true
+	}
+	sortOrder := ctx.FormString("order")
+	if sortOrder == "" {
+		sortOrder = "asc"
+	}
+	orderMap, ok := orderByMap[sortOrder]
+	if !ok {
+		ctx.APIError(http.StatusUnprocessableEntity, fmt.Errorf("Invalid sort order: %q", sortOrder))
+		return "", false
+	}
+	orderBy, ok := orderMap[sortMode]
+	if !ok {
+		ctx.APIError(http.StatusUnprocessableEntity, fmt.Errorf("Invalid sort mode: %q", sortMode))
+		return "", false
+	}
+	return orderBy, true
+}
diff --git a/routers/api/v1/utils/sort_test.go b/routers/api/v1/utils/sort_test.go
new file mode 100644
index 00000000000..4885f10f8ce
--- /dev/null
+++ b/routers/api/v1/utils/sort_test.go
@@ -0,0 +1,44 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package utils
+
+import (
+	"net/http"
+	"testing"
+
+	"gitea.dev/models/db"
+	"gitea.dev/services/contexttest"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestResolveSortOrder(t *testing.T) {
+	m := map[string]map[string]db.SearchOrderBy{
+		"asc":  {"id": "id ASC"},
+		"desc": {"id": "id DESC"},
+	}
+	defaultOrder := db.SearchOrderBy("default")
+
+	cases := []struct {
+		path       string
+		wantOK     bool
+		wantOrder  db.SearchOrderBy
+		wantStatus int
+	}{
+		{"GET /", true, defaultOrder, 0},
+		{"GET /?sort=id", true, "id ASC", 0},
+		{"GET /?sort=id&order=desc", true, "id DESC", 0},
+		{"GET /?sort=bogus", false, "", http.StatusUnprocessableEntity},
+		{"GET /?sort=id&order=bogus", false, "", http.StatusUnprocessableEntity},
+	}
+	for _, tc := range cases {
+		t.Run(tc.path, func(t *testing.T) {
+			ctx, _ := contexttest.MockAPIContext(t, tc.path)
+			got, ok := ResolveSortOrder(ctx, m, defaultOrder)
+			assert.Equal(t, tc.wantOK, ok)
+			assert.Equal(t, tc.wantOrder, got)
+			assert.Equal(t, tc.wantStatus, ctx.Resp.WrittenStatus())
+		})
+	}
+}
diff --git a/routers/common/actions.go b/routers/common/actions.go
index 2b83e5d8423..6fc5da7b13c 100644
--- a/routers/common/actions.go
+++ b/routers/common/actions.go
@@ -7,12 +7,12 @@ import (
 	"fmt"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	actions_model "gitea.dev/models/actions"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/actions"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 func DownloadActionsRunJobLogsWithID(ctx *context.Base, ctxRepo *repo_model.Repository, runID, jobID int64) error {
diff --git a/routers/common/auth.go b/routers/common/auth.go
index 491ca6f8700..5aa8925b766 100644
--- a/routers/common/auth.go
+++ b/routers/common/auth.go
@@ -4,10 +4,10 @@
 package common
 
 import (
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/web/middleware"
-	auth_service "code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/context"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/web/middleware"
+	auth_service "gitea.dev/services/auth"
+	"gitea.dev/services/context"
 )
 
 type AuthResult struct {
diff --git a/routers/common/blockexpensive.go b/routers/common/blockexpensive.go
index 0407264b1e4..62cb1c70506 100644
--- a/routers/common/blockexpensive.go
+++ b/routers/common/blockexpensive.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/modules/web/routing"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/modules/web/routing"
 
 	"github.com/go-chi/chi/v5"
 )
diff --git a/routers/common/codesearch.go b/routers/common/codesearch.go
index 9bec448d7ec..7eb13742093 100644
--- a/routers/common/codesearch.go
+++ b/routers/common/codesearch.go
@@ -4,10 +4,10 @@
 package common
 
 import (
-	"code.gitea.io/gitea/modules/indexer"
-	code_indexer "code.gitea.io/gitea/modules/indexer/code"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/indexer"
+	code_indexer "gitea.dev/modules/indexer/code"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 func PrepareCodeSearch(ctx *context.Context) (ret struct {
diff --git a/routers/common/compare.go b/routers/common/compare.go
index 7e917c4df87..667a32a9657 100644
--- a/routers/common/compare.go
+++ b/routers/common/compare.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/util"
 )
 
 type CompareRouterReq struct {
@@ -129,7 +129,7 @@ func GetHeadOwnerAndRepo(ctx context.Context, baseRepo *repo_model.Repository, c
 	if compareReq.HeadOwner == baseRepo.Owner.Name {
 		headOwner = baseRepo.Owner
 	} else {
-		headOwner, err = user_model.GetUserOrOrgByName(ctx, compareReq.HeadOwner)
+		headOwner, err = user_model.GetUserByName(ctx, compareReq.HeadOwner)
 		if err != nil {
 			return nil, nil, err
 		}
diff --git a/routers/common/db.go b/routers/common/db.go
index 01c02614279..30ab0fcd713 100644
--- a/routers/common/db.go
+++ b/routers/common/db.go
@@ -8,15 +8,13 @@ import (
 	"errors"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/migrations"
-	system_model "code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/setting/config"
-	"code.gitea.io/gitea/services/versioned_migration"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations"
+	system_model "gitea.dev/models/system"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/setting/config"
+	"gitea.dev/services/versioned_migration"
 )
 
 // InitDBEngine In case of problems connecting to DB, retry connection. Eg, PGSQL in Docker Container on Synology
@@ -42,7 +40,7 @@ func InitDBEngine(ctx context.Context) (err error) {
 	return nil
 }
 
-func migrateWithSetting(ctx context.Context, x *xorm.Engine) error {
+func migrateWithSetting(ctx context.Context, x db.EngineMigration) error {
 	if setting.Database.AutoMigration {
 		return versioned_migration.Migrate(ctx, x)
 	}
diff --git a/routers/common/deadline.go b/routers/common/deadline.go
index 152e94597bc..b8a1449a687 100644
--- a/routers/common/deadline.go
+++ b/routers/common/deadline.go
@@ -6,8 +6,8 @@ package common
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 )
 
 func ParseDeadlineDateToEndOfDay(date string) (timeutil.TimeStamp, error) {
diff --git a/routers/common/errpage.go b/routers/common/errpage.go
index 9baf7915e1c..bb89070aaab 100644
--- a/routers/common/errpage.go
+++ b/routers/common/errpage.go
@@ -10,15 +10,15 @@ import (
 	"net/http"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/modules/web/routing"
-	"code.gitea.io/gitea/services/context"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/modules/web/routing"
+	"gitea.dev/services/context"
 )
 
 const tplStatus500 templates.TplName = "status/500"
diff --git a/routers/common/errpage_test.go b/routers/common/errpage_test.go
index b81803c0155..319ae7c1711 100644
--- a/routers/common/errpage_test.go
+++ b/routers/common/errpage_test.go
@@ -10,9 +10,9 @@ import (
 	"net/url"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/common/issue_filter.go b/routers/common/issue_filter.go
index caf1fefef54..4d93f2bd1ca 100644
--- a/routers/common/issue_filter.go
+++ b/routers/common/issue_filter.go
@@ -4,7 +4,7 @@
 package common
 
 import (
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/modules/optional"
 )
 
 func ParseIssueFilterStateIsClosed(state string) optional.Option[bool] {
diff --git a/routers/common/lfs.go b/routers/common/lfs.go
index 1d2b71394bf..39644c74273 100644
--- a/routers/common/lfs.go
+++ b/routers/common/lfs.go
@@ -6,8 +6,8 @@ package common
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/lfs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/lfs"
 )
 
 const RouterMockPointCommonLFS = "common-lfs"
diff --git a/routers/common/maintenancemode.go b/routers/common/maintenancemode.go
index adf099df573..39748e89340 100644
--- a/routers/common/maintenancemode.go
+++ b/routers/common/maintenancemode.go
@@ -7,8 +7,8 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/setting"
 )
 
 func MaintenanceModeHandler() func(h http.Handler) http.Handler {
diff --git a/routers/common/markup.go b/routers/common/markup.go
index 05f48c79027..3b626c7031f 100644
--- a/routers/common/markup.go
+++ b/routers/common/markup.go
@@ -10,14 +10,14 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/models/renderhelper"
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/renderhelper"
+	"gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 // RenderMarkup renders markup text for the /markup and /markdown endpoints
diff --git a/routers/common/middleware.go b/routers/common/middleware.go
index 3932a84b6d7..603e18e7bd6 100644
--- a/routers/common/middleware.go
+++ b/routers/common/middleware.go
@@ -8,15 +8,15 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/gtprof"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web/routing"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/gtprof"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web/routing"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/session"
 	"github.com/chi-middleware/proxy"
@@ -34,9 +34,7 @@ func ProtocolMiddlewares() (handlers []any) {
 		handlers = append(handlers, ForwardedHeadersHandler(setting.ReverseProxyLimit, setting.ReverseProxyTrustedProxies))
 	}
 
-	if setting.IsRouteLogEnabled() {
-		handlers = append(handlers, routing.NewLoggerHandler())
-	}
+	handlers = append(handlers, routing.NewRequestInfoHandler())
 
 	if setting.IsAccessLogEnabled() {
 		handlers = append(handlers, context.AccessLogger())
diff --git a/routers/common/pagetmpl.go b/routers/common/pagetmpl.go
index af86fb50382..f439b0057e3 100644
--- a/routers/common/pagetmpl.go
+++ b/routers/common/pagetmpl.go
@@ -8,12 +8,12 @@ import (
 	"errors"
 	"sync"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/log"
-	oauth2_source "code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/context"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/log"
+	oauth2_source "gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/context"
 )
 
 // StopwatchTmplInfo is a view on a stopwatch specifically for template rendering
diff --git a/routers/common/pagetmpl_test.go b/routers/common/pagetmpl_test.go
index bf81957233e..c2c23070df3 100644
--- a/routers/common/pagetmpl_test.go
+++ b/routers/common/pagetmpl_test.go
@@ -7,12 +7,12 @@ import (
 	"testing"
 	"time"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	oauth2_source "code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/context"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	oauth2_source "gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/context"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/routers/common/qos.go b/routers/common/qos.go
index fbde4192236..3fc76830b75 100644
--- a/routers/common/qos.go
+++ b/routers/common/qos.go
@@ -9,12 +9,12 @@ import (
 	"net/http"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/modules/web/routing"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/modules/web/routing"
 
 	"github.com/bohde/codel"
 	"github.com/go-chi/chi/v5"
diff --git a/routers/common/qos_test.go b/routers/common/qos_test.go
index 17dc9cb30c9..0f9ced2fb93 100644
--- a/routers/common/qos_test.go
+++ b/routers/common/qos_test.go
@@ -6,9 +6,9 @@ package common
 import (
 	"testing"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/contexttest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/contexttest"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/assert"
diff --git a/routers/common/redirect.go b/routers/common/redirect.go
index e9f14a6eb1e..f6e5d8786c2 100644
--- a/routers/common/redirect.go
+++ b/routers/common/redirect.go
@@ -6,7 +6,7 @@ package common
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/httplib"
+	"gitea.dev/modules/httplib"
 )
 
 // FetchRedirectDelegate helps the "fetch" requests to redirect to the correct location
diff --git a/routers/common/redirect_test.go b/routers/common/redirect_test.go
index c4e6d2e6c75..04b06f5dd5f 100644
--- a/routers/common/redirect_test.go
+++ b/routers/common/redirect_test.go
@@ -10,8 +10,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/common/serve.go b/routers/common/serve.go
index 9232d90c94f..5bb3f5316aa 100644
--- a/routers/common/serve.go
+++ b/routers/common/serve.go
@@ -7,13 +7,13 @@ import (
 	"path"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/services/context"
 )
 
 // ServeBlob download a git.Blob
diff --git a/routers/init.go b/routers/init.go
index e04b711c4d3..9385fac96a4 100644
--- a/routers/init.go
+++ b/routers/init.go
@@ -9,52 +9,52 @@ import (
 	"reflect"
 	"runtime"
 
-	"code.gitea.io/gitea/models"
-	authmodel "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/eventsource"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/external"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/ssh"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/svg"
-	"code.gitea.io/gitea/modules/system"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/modules/web/routing"
-	actions_router "code.gitea.io/gitea/routers/api/actions"
-	packages_router "code.gitea.io/gitea/routers/api/packages"
-	apiv1 "code.gitea.io/gitea/routers/api/v1"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/routers/private"
-	web_routers "code.gitea.io/gitea/routers/web"
-	actions_service "code.gitea.io/gitea/services/actions"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/automerge"
-	"code.gitea.io/gitea/services/cron"
-	feed_service "code.gitea.io/gitea/services/feed"
-	indexer_service "code.gitea.io/gitea/services/indexer"
-	"code.gitea.io/gitea/services/mailer"
-	mailer_incoming "code.gitea.io/gitea/services/mailer/incoming"
-	markup_service "code.gitea.io/gitea/services/markup"
-	repo_migrations "code.gitea.io/gitea/services/migrations"
-	mirror_service "code.gitea.io/gitea/services/mirror"
-	"code.gitea.io/gitea/services/oauth2_provider"
-	packages_spec "code.gitea.io/gitea/services/packages/pkgspec"
-	pull_service "code.gitea.io/gitea/services/pull"
-	release_service "code.gitea.io/gitea/services/release"
-	repo_service "code.gitea.io/gitea/services/repository"
-	"code.gitea.io/gitea/services/repository/archiver"
-	"code.gitea.io/gitea/services/task"
-	"code.gitea.io/gitea/services/uinotification"
-	"code.gitea.io/gitea/services/webhook"
+	"gitea.dev/models"
+	authmodel "gitea.dev/models/auth"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/eventsource"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/external"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/ssh"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/system"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/modules/web/routing"
+	actions_router "gitea.dev/routers/api/actions"
+	packages_router "gitea.dev/routers/api/packages"
+	apiv1 "gitea.dev/routers/api/v1"
+	"gitea.dev/routers/common"
+	"gitea.dev/routers/private"
+	web_routers "gitea.dev/routers/web"
+	actions_service "gitea.dev/services/actions"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/automerge"
+	"gitea.dev/services/cron"
+	feed_service "gitea.dev/services/feed"
+	indexer_service "gitea.dev/services/indexer"
+	"gitea.dev/services/mailer"
+	mailer_incoming "gitea.dev/services/mailer/incoming"
+	markup_service "gitea.dev/services/markup"
+	repo_migrations "gitea.dev/services/migrations"
+	mirror_service "gitea.dev/services/mirror"
+	"gitea.dev/services/oauth2_provider"
+	packages_spec "gitea.dev/services/packages/pkgspec"
+	pull_service "gitea.dev/services/pull"
+	release_service "gitea.dev/services/release"
+	repo_service "gitea.dev/services/repository"
+	"gitea.dev/services/repository/archiver"
+	"gitea.dev/services/task"
+	"gitea.dev/services/uinotification"
+	"gitea.dev/services/webhook"
 )
 
 func mustInit(fn func() error) {
diff --git a/routers/install/install.go b/routers/install/install.go
index 718ede6564d..8466caa2bf5 100644
--- a/routers/install/install.go
+++ b/routers/install/install.go
@@ -15,24 +15,24 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	db_install "code.gitea.io/gitea/models/db/install"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/password/hash"
-	"code.gitea.io/gitea/modules/generate"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/routers/common"
-	auth_service "code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/versioned_migration"
+	"gitea.dev/models/db"
+	db_install "gitea.dev/models/db/install"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/password/hash"
+	"gitea.dev/modules/generate"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/web"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/routers/common"
+	auth_service "gitea.dev/services/auth"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/versioned_migration"
 )
 
 const (
@@ -123,7 +123,7 @@ func Install(ctx *context.Context) {
 func checkDatabase(ctx *context.Context, form *forms.InstallForm) bool {
 	var err error
 
-	if (setting.Database.Type == "sqlite3") &&
+	if (setting.Database.Type == setting.DatabaseTypeSQLite3) &&
 		len(setting.Database.Path) == 0 {
 		ctx.Data["Err_DbPath"] = true
 		ctx.RenderWithErrDeprecated(ctx.Tr("install.err_empty_db_path"), tplInstall, form)
@@ -135,13 +135,8 @@ func checkDatabase(ctx *context.Context, form *forms.InstallForm) bool {
 	defer db.UnsetDefaultEngine()
 
 	if err = db.InitEngine(ctx); err != nil {
-		if strings.Contains(err.Error(), `Unknown database type: sqlite3`) {
-			ctx.Data["Err_DbType"] = true
-			ctx.RenderWithErrDeprecated(ctx.Tr("install.sqlite3_not_available", "https://docs.gitea.com/installation/install-from-binary"), tplInstall, form)
-		} else {
-			ctx.Data["Err_DbSetting"] = true
-			ctx.RenderWithErrDeprecated(ctx.Tr("install.invalid_db_setting", err), tplInstall, form)
-		}
+		ctx.Data["Err_DbSetting"] = true
+		ctx.RenderWithErrDeprecated(ctx.Tr("install.invalid_db_setting", err), tplInstall, form)
 		return false
 	}
 
diff --git a/routers/install/routes.go b/routers/install/routes.go
index 6fd511cbd18..f650c695729 100644
--- a/routers/install/routes.go
+++ b/routers/install/routes.go
@@ -8,13 +8,13 @@ import (
 	"html"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/routers/web/healthcheck"
-	"code.gitea.io/gitea/routers/web/misc"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/common"
+	"gitea.dev/routers/web/healthcheck"
+	"gitea.dev/routers/web/misc"
+	"gitea.dev/services/forms"
 )
 
 // Routes registers the installation routes
diff --git a/routers/install/routes_test.go b/routers/install/routes_test.go
index e8902ba3f1c..05413791e21 100644
--- a/routers/install/routes_test.go
+++ b/routers/install/routes_test.go
@@ -8,7 +8,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/private/actions.go b/routers/private/actions.go
index 696634b5e75..ea69b953bf7 100644
--- a/routers/private/actions.go
+++ b/routers/private/actions.go
@@ -9,14 +9,14 @@ import (
 	"net/http"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	actions_model "gitea.dev/models/actions"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 // GenerateActionsRunnerToken generates a new runner token for a given scope
diff --git a/routers/private/default_branch.go b/routers/private/default_branch.go
index c375d70dc6f..92866a4ece6 100644
--- a/routers/private/default_branch.go
+++ b/routers/private/default_branch.go
@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"net/http"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/private"
-	gitea_context "code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/private"
+	gitea_context "gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 )
 
 // SetDefaultBranch updates the default branch
diff --git a/routers/private/hook_post_receive.go b/routers/private/hook_post_receive.go
index 3d070a18abb..3cb9eac809b 100644
--- a/routers/private/hook_post_receive.go
+++ b/routers/private/hook_post_receive.go
@@ -8,25 +8,25 @@ import (
 	"fmt"
 	"net/http"
 
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/cachegroup"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	gitea_context "code.gitea.io/gitea/services/context"
-	pull_service "code.gitea.io/gitea/services/pull"
-	repo_service "code.gitea.io/gitea/services/repository"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/cachegroup"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	gitea_context "gitea.dev/services/context"
+	pull_service "gitea.dev/services/pull"
+	repo_service "gitea.dev/services/repository"
 )
 
 // HookPostReceive updates services and users
diff --git a/routers/private/hook_post_receive_test.go b/routers/private/hook_post_receive_test.go
index 23b8085e949..b18d9842e89 100644
--- a/routers/private/hook_post_receive_test.go
+++ b/routers/private/hook_post_receive_test.go
@@ -6,14 +6,14 @@ package private
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	pull_model "code.gitea.io/gitea/models/pull"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/private"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/services/contexttest"
+	issues_model "gitea.dev/models/issues"
+	pull_model "gitea.dev/models/pull"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/private"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/private/hook_pre_receive.go b/routers/private/hook_pre_receive.go
index 3936e223d56..91a02b0f367 100644
--- a/routers/private/hook_pre_receive.go
+++ b/routers/private/hook_pre_receive.go
@@ -9,23 +9,23 @@ import (
 	"net/http"
 	"os"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	perm_model "code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/agit"
-	gitea_context "code.gitea.io/gitea/services/context"
-	pull_service "code.gitea.io/gitea/services/pull"
+	asymkey_model "gitea.dev/models/asymkey"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	perm_model "gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/agit"
+	gitea_context "gitea.dev/services/context"
+	pull_service "gitea.dev/services/pull"
 )
 
 type preReceiveContext struct {
@@ -371,8 +371,8 @@ func preReceiveBranch(ctx *preReceiveContext, oldCommitID, newCommitID string, r
 			return
 		}
 
-		// If we're an admin for the repository we can ignore status checks, reviews and override protected files
-		if ctx.userPerm.IsAdmin() {
+		// If we can bypass branch protection we can ignore status checks, reviews and protected files
+		if git_model.CanBypassBranchProtection(ctx, protectBranch, ctx.user, ctx.userPerm.IsAdmin()) {
 			return
 		}
 
diff --git a/routers/private/hook_proc_receive.go b/routers/private/hook_proc_receive.go
index 4076a57dbaa..451a738097e 100644
--- a/routers/private/hook_proc_receive.go
+++ b/routers/private/hook_proc_receive.go
@@ -7,14 +7,14 @@ import (
 	"errors"
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/agit"
-	gitea_context "code.gitea.io/gitea/services/context"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/agit"
+	gitea_context "gitea.dev/services/context"
 )
 
 // HookProcReceive proc-receive hook - only handles agit Proc-Receive requests at present
diff --git a/routers/private/hook_verification.go b/routers/private/hook_verification.go
index fd26ba89e27..a21c12d4657 100644
--- a/routers/private/hook_verification.go
+++ b/routers/private/hook_verification.go
@@ -7,10 +7,10 @@ import (
 	"bufio"
 	"io"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	asymkey_service "gitea.dev/services/asymkey"
 )
 
 // This file contains commit verification functions for refs passed across in hooks
diff --git a/routers/private/hook_verification_test.go b/routers/private/hook_verification_test.go
index 8653e34daa4..30b309e917d 100644
--- a/routers/private/hook_verification_test.go
+++ b/routers/private/hook_verification_test.go
@@ -6,8 +6,8 @@ package private
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/private/internal.go b/routers/private/internal.go
index d4918455f19..36cd4429565 100644
--- a/routers/private/internal.go
+++ b/routers/private/internal.go
@@ -9,13 +9,13 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/routers/web/misc"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/common"
+	"gitea.dev/routers/web/misc"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/binding"
 	chi_middleware "github.com/go-chi/chi/v5/middleware"
diff --git a/routers/private/internal_repo.go b/routers/private/internal_repo.go
index e111d6689e0..52b8d80edb4 100644
--- a/routers/private/internal_repo.go
+++ b/routers/private/internal_repo.go
@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"net/http"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	gitea_context "code.gitea.io/gitea/services/context"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	gitea_context "gitea.dev/services/context"
 )
 
 // This file contains common functions relating to setting the Repository for the internal routes
diff --git a/routers/private/key.go b/routers/private/key.go
index 2be80477a9b..7f3804df6e0 100644
--- a/routers/private/key.go
+++ b/routers/private/key.go
@@ -6,10 +6,10 @@ package private
 import (
 	"net/http"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/services/context"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/services/context"
 )
 
 // UpdatePublicKeyInRepo update public key and deploy key updates
diff --git a/routers/private/mail.go b/routers/private/mail.go
index 6c33467af74..3f7fbb3966d 100644
--- a/routers/private/mail.go
+++ b/routers/private/mail.go
@@ -9,15 +9,15 @@ import (
 	"net/http"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/mailer"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
+	"gitea.dev/services/mailer"
+	sender_service "gitea.dev/services/mailer/sender"
 )
 
 // SendEmail pushes messages to mail queue
diff --git a/routers/private/main_test.go b/routers/private/main_test.go
index a6bec72b41d..478c25a9d76 100644
--- a/routers/private/main_test.go
+++ b/routers/private/main_test.go
@@ -6,7 +6,7 @@ package private
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/private/manager.go b/routers/private/manager.go
index b84919d1807..d2e8c3461b7 100644
--- a/routers/private/manager.go
+++ b/routers/private/manager.go
@@ -7,16 +7,16 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/graceful/releasereopen"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/graceful/releasereopen"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
 )
 
 // ReloadTemplates reloads all the templates
diff --git a/routers/private/manager_process.go b/routers/private/manager_process.go
index 9a0298a37c6..47cddf77067 100644
--- a/routers/private/manager_process.go
+++ b/routers/private/manager_process.go
@@ -11,10 +11,10 @@ import (
 	"runtime"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	process_module "code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	process_module "gitea.dev/modules/process"
+	"gitea.dev/services/context"
 )
 
 // Processes prints out the processes
diff --git a/routers/private/manager_unix.go b/routers/private/manager_unix.go
index 0c63ebc918f..8bb394c0ba1 100644
--- a/routers/private/manager_unix.go
+++ b/routers/private/manager_unix.go
@@ -8,8 +8,8 @@ package private
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/services/context"
 )
 
 // Restart causes the server to perform a graceful restart
diff --git a/routers/private/manager_windows.go b/routers/private/manager_windows.go
index f1b9365f528..c5201a03e95 100644
--- a/routers/private/manager_windows.go
+++ b/routers/private/manager_windows.go
@@ -8,9 +8,9 @@ package private
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/private"
+	"gitea.dev/services/context"
 )
 
 // Restart is not implemented for Windows based servers as they can't fork
diff --git a/routers/private/restore_repo.go b/routers/private/restore_repo.go
index 4e95d3071db..b88982f30a2 100644
--- a/routers/private/restore_repo.go
+++ b/routers/private/restore_repo.go
@@ -7,10 +7,10 @@ import (
 	"io"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/private"
-	myCtx "code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/migrations"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/private"
+	myCtx "gitea.dev/services/context"
+	"gitea.dev/services/migrations"
 )
 
 // RestoreRepo restore a repository from data
diff --git a/routers/private/serv.go b/routers/private/serv.go
index 7c6eb907fa7..7c7d0db5a6c 100644
--- a/routers/private/serv.go
+++ b/routers/private/serv.go
@@ -8,19 +8,19 @@ import (
 	"net/http"
 	"strings"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
-	wiki_service "code.gitea.io/gitea/services/wiki"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
+	wiki_service "gitea.dev/services/wiki"
 )
 
 // ServNoCommand returns information about the provided keyid
diff --git a/routers/private/ssh_log.go b/routers/private/ssh_log.go
index 5bec632ead9..fe40e0b030f 100644
--- a/routers/private/ssh_log.go
+++ b/routers/private/ssh_log.go
@@ -6,11 +6,11 @@ package private
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
 )
 
 // SSHLog hook to response ssh log
diff --git a/routers/web/admin/admin.go b/routers/web/admin/admin.go
index 0cd13acf601..d4e3015aace 100644
--- a/routers/web/admin/admin.go
+++ b/routers/web/admin/admin.go
@@ -12,23 +12,23 @@ import (
 	"strings"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/updatechecker"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/cron"
-	"code.gitea.io/gitea/services/forms"
-	release_service "code.gitea.io/gitea/services/release"
-	repo_service "code.gitea.io/gitea/services/repository"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/updatechecker"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/cron"
+	"gitea.dev/services/forms"
+	release_service "gitea.dev/services/release"
+	repo_service "gitea.dev/services/repository"
 )
 
 const (
diff --git a/routers/web/admin/admin_test.go b/routers/web/admin/admin_test.go
index 929faa19680..69e22a0d5e8 100644
--- a/routers/web/admin/admin_test.go
+++ b/routers/web/admin/admin_test.go
@@ -7,10 +7,10 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/routers/web/admin/applications.go b/routers/web/admin/applications.go
index 2f00bfc2862..926c04f9c37 100644
--- a/routers/web/admin/applications.go
+++ b/routers/web/admin/applications.go
@@ -6,12 +6,12 @@ package admin
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	user_setting "code.gitea.io/gitea/routers/web/user/setting"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	user_setting "gitea.dev/routers/web/user/setting"
+	"gitea.dev/services/context"
 )
 
 var (
diff --git a/routers/web/admin/auths.go b/routers/web/admin/auths.go
index c718eb34e05..3ba8c203553 100644
--- a/routers/web/admin/auths.go
+++ b/routers/web/admin/auths.go
@@ -12,22 +12,22 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/auth/pam"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	auth_service "code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/auth/source/ldap"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	pam_service "code.gitea.io/gitea/services/auth/source/pam"
-	"code.gitea.io/gitea/services/auth/source/smtp"
-	"code.gitea.io/gitea/services/auth/source/sspi"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/auth/pam"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	auth_service "gitea.dev/services/auth"
+	"gitea.dev/services/auth/source/ldap"
+	"gitea.dev/services/auth/source/oauth2"
+	pam_service "gitea.dev/services/auth/source/pam"
+	"gitea.dev/services/auth/source/smtp"
+	"gitea.dev/services/auth/source/sspi"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 const (
diff --git a/routers/web/admin/badges.go b/routers/web/admin/badges.go
index 8a5d3d3eb28..227e460b10d 100644
--- a/routers/web/admin/badges.go
+++ b/routers/web/admin/badges.go
@@ -9,15 +9,15 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 const (
diff --git a/routers/web/admin/config.go b/routers/web/admin/config.go
index 03a15b67134..d7c11843d5b 100644
--- a/routers/web/admin/config.go
+++ b/routers/web/admin/config.go
@@ -8,17 +8,17 @@ import (
 	"errors"
 	"net/http"
 
-	system_model "code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/setting/config"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/mailer"
+	system_model "gitea.dev/models/system"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/setting/config"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	"gitea.dev/services/mailer"
 
 	"gitea.com/go-chi/session"
 )
diff --git a/routers/web/admin/diagnosis.go b/routers/web/admin/diagnosis.go
index 205ab2f8ea1..e6d182f0bb0 100644
--- a/routers/web/admin/diagnosis.go
+++ b/routers/web/admin/diagnosis.go
@@ -9,10 +9,10 @@ import (
 	"runtime/pprof"
 	"time"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/tailmsg"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/tailmsg"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 func MonitorDiagnosis(ctx *context.Context) {
diff --git a/routers/web/admin/emails.go b/routers/web/admin/emails.go
index d608278f285..27b7745b3ff 100644
--- a/routers/web/admin/emails.go
+++ b/routers/web/admin/emails.go
@@ -8,14 +8,14 @@ import (
 	"net/http"
 	"net/url"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/user"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
+	"gitea.dev/services/user"
 )
 
 const (
diff --git a/routers/web/admin/hooks.go b/routers/web/admin/hooks.go
index 34dc0fc9b00..f1d65a6b5e4 100644
--- a/routers/web/admin/hooks.go
+++ b/routers/web/admin/hooks.go
@@ -6,11 +6,11 @@ package admin
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/admin/main_test.go b/routers/web/admin/main_test.go
index e1294ddbb40..44a9bb4e50b 100644
--- a/routers/web/admin/main_test.go
+++ b/routers/web/admin/main_test.go
@@ -6,7 +6,7 @@ package admin
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/web/admin/notice.go b/routers/web/admin/notice.go
index a09aa934215..47bcda7a803 100644
--- a/routers/web/admin/notice.go
+++ b/routers/web/admin/notice.go
@@ -8,12 +8,12 @@ import (
 	"net/http"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	system_model "code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	system_model "gitea.dev/models/system"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/admin/orgs.go b/routers/web/admin/orgs.go
index 62a8b30b133..1474038c915 100644
--- a/routers/web/admin/orgs.go
+++ b/routers/web/admin/orgs.go
@@ -5,13 +5,13 @@
 package admin
 
 import (
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/routers/web/explore"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/routers/web/explore"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/admin/packages.go b/routers/web/admin/packages.go
index f71a55a2190..1b6c6c2412b 100644
--- a/routers/web/admin/packages.go
+++ b/routers/web/admin/packages.go
@@ -8,14 +8,14 @@ import (
 	"net/url"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
-	packages_service "code.gitea.io/gitea/services/packages"
-	packages_cleanup_service "code.gitea.io/gitea/services/packages/cleanup"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
+	packages_service "gitea.dev/services/packages"
+	packages_cleanup_service "gitea.dev/services/packages/cleanup"
 )
 
 const (
diff --git a/routers/web/admin/perftrace.go b/routers/web/admin/perftrace.go
index 51ee57da10f..99ff3a759b7 100644
--- a/routers/web/admin/perftrace.go
+++ b/routers/web/admin/perftrace.go
@@ -6,8 +6,8 @@ package admin
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/tailmsg"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/tailmsg"
+	"gitea.dev/services/context"
 )
 
 func PerfTrace(ctx *context.Context) {
diff --git a/routers/web/admin/queue.go b/routers/web/admin/queue.go
index 59b17f88e69..e5ac55bdfcd 100644
--- a/routers/web/admin/queue.go
+++ b/routers/web/admin/queue.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"strconv"
 
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 func Queues(ctx *context.Context) {
diff --git a/routers/web/admin/queue_tester.go b/routers/web/admin/queue_tester.go
index 8f713b3bb16..be7cb687e4a 100644
--- a/routers/web/admin/queue_tester.go
+++ b/routers/web/admin/queue_tester.go
@@ -8,11 +8,11 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
 )
 
 var testQueueOnce sync.Once
diff --git a/routers/web/admin/repos.go b/routers/web/admin/repos.go
index 424219815c6..4f5e3ed842c 100644
--- a/routers/web/admin/repos.go
+++ b/routers/web/admin/repos.go
@@ -8,16 +8,16 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/routers/web/explore"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/routers/web/explore"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 )
 
 const (
diff --git a/routers/web/admin/stacktrace.go b/routers/web/admin/stacktrace.go
index 2b8c2fb4afb..79eaa64137b 100644
--- a/routers/web/admin/stacktrace.go
+++ b/routers/web/admin/stacktrace.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"runtime"
 
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 func monitorTraceCommon(ctx *context.Context) {
diff --git a/routers/web/admin/users.go b/routers/web/admin/users.go
index 19499fdab56..4b345945089 100644
--- a/routers/web/admin/users.go
+++ b/routers/web/admin/users.go
@@ -11,25 +11,25 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	org_model "code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/web/explore"
-	user_setting "code.gitea.io/gitea/routers/web/user/setting"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/mailer"
-	user_service "code.gitea.io/gitea/services/user"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	org_model "gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/password"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/web/explore"
+	user_setting "gitea.dev/routers/web/user/setting"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/mailer"
+	user_service "gitea.dev/services/user"
 )
 
 const (
diff --git a/routers/web/admin/users_test.go b/routers/web/admin/users_test.go
index f6f92378581..31e0a76849f 100644
--- a/routers/web/admin/users_test.go
+++ b/routers/web/admin/users_test.go
@@ -6,13 +6,13 @@ package admin
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/contexttest"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/contexttest"
+	"gitea.dev/services/forms"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/auth/2fa.go b/routers/web/auth/2fa.go
index 73b218d92df..77d90c4da14 100644
--- a/routers/web/auth/2fa.go
+++ b/routers/web/auth/2fa.go
@@ -7,14 +7,14 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/session"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/session"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 var (
diff --git a/routers/web/auth/auth.go b/routers/web/auth/auth.go
index 0503bd02f8e..63d069d31d3 100644
--- a/routers/web/auth/auth.go
+++ b/routers/web/auth/auth.go
@@ -12,28 +12,28 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/eventsource"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/session"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/modules/web/middleware"
-	auth_service "code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/externalaccount"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/mailer"
-	user_service "code.gitea.io/gitea/services/user"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/password"
+	"gitea.dev/modules/eventsource"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/session"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/modules/web/middleware"
+	auth_service "gitea.dev/services/auth"
+	"gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/context"
+	"gitea.dev/services/externalaccount"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/mailer"
+	user_service "gitea.dev/services/user"
 
 	"github.com/markbates/goth"
 )
diff --git a/routers/web/auth/auth_test.go b/routers/web/auth/auth_test.go
index a06e209e4f4..54104061614 100644
--- a/routers/web/auth/auth_test.go
+++ b/routers/web/auth/auth_test.go
@@ -10,14 +10,14 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/session"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/contexttest"
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/session"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/contexttest"
 
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/gothic"
diff --git a/routers/web/auth/linkaccount.go b/routers/web/auth/linkaccount.go
index ea3aa3f7cae..1885cc5fdf7 100644
--- a/routers/web/auth/linkaccount.go
+++ b/routers/web/auth/linkaccount.go
@@ -8,18 +8,18 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	auth_service "code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/externalaccount"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	auth_service "gitea.dev/services/auth"
+	"gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/context"
+	"gitea.dev/services/externalaccount"
+	"gitea.dev/services/forms"
 )
 
 var tplLinkAccount templates.TplName = "user/auth/link_account"
@@ -253,6 +253,11 @@ func LinkAccountPostRegister(ctx *context.Context) {
 		return
 	}
 
+	oauth2SignInSync(ctx, linkAccountData.AuthSourceID, u, linkAccountData.GothUser)
+	if ctx.Written() {
+		return
+	}
+
 	authSource, err := auth.GetSourceByID(ctx, linkAccountData.AuthSourceID)
 	if err != nil {
 		ctx.ServerError("GetSourceByID", err)
diff --git a/routers/web/auth/main_test.go b/routers/web/auth/main_test.go
index b438e5d5188..7b02e2a20af 100644
--- a/routers/web/auth/main_test.go
+++ b/routers/web/auth/main_test.go
@@ -6,7 +6,7 @@ package auth
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/web/auth/oauth.go b/routers/web/auth/oauth.go
index 3cbffc92e89..fd84a55abb1 100644
--- a/routers/web/auth/oauth.go
+++ b/routers/web/auth/oauth.go
@@ -13,21 +13,22 @@ import (
 	"net/url"
 	"sort"
 	"strings"
+	"time"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	auth_module "code.gitea.io/gitea/modules/auth"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/session"
-	"code.gitea.io/gitea/modules/setting"
-	source_service "code.gitea.io/gitea/services/auth/source"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/externalaccount"
-	user_service "code.gitea.io/gitea/services/user"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	auth_module "gitea.dev/modules/auth"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/session"
+	"gitea.dev/modules/setting"
+	source_service "gitea.dev/services/auth/source"
+	"gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/context"
+	"gitea.dev/services/externalaccount"
+	user_service "gitea.dev/services/user"
 
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/gothic"
@@ -320,21 +321,42 @@ func showLinkingLogin(ctx *context.Context, authSourceID int64, gothUser goth.Us
 	ctx.Redirect(setting.AppSubURL + "/user/link_account")
 }
 
-func oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) {
-	if setting.OAuth2Client.UpdateAvatar && len(url) > 0 {
-		resp, err := http.Get(url)
-		if err == nil {
-			defer func() {
-				_ = resp.Body.Close()
-			}()
-		}
-		// ignore any error
-		if err == nil && resp.StatusCode == http.StatusOK {
-			data, err := io.ReadAll(io.LimitReader(resp.Body, setting.Avatar.MaxFileSize+1))
-			if err == nil && int64(len(data)) <= setting.Avatar.MaxFileSize {
-				_ = user_service.UploadAvatar(ctx, u, data)
-			}
-		}
+var oauth2AvatarHTTPClient = &http.Client{Timeout: 30 * time.Second}
+
+func oauth2UpdateAvatarIfNeed(ctx *context.Context, avatarURL string, u *user_model.User) {
+	if !setting.OAuth2Client.UpdateAvatar || len(avatarURL) == 0 {
+		return
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, avatarURL, nil)
+	if err != nil {
+		log.Warn("invalid avatar URL %q: %v", avatarURL, err)
+		return
+	}
+	// Some hosts (e.g. Wikimedia) reject Go's default User-Agent.
+	req.Header.Set("User-Agent", "Gitea "+setting.AppVer)
+
+	resp, err := oauth2AvatarHTTPClient.Do(req)
+	if err != nil {
+		log.Warn("fetch %q failed: %v", avatarURL, err)
+		return
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		log.Warn("fetch %q returned status %d", avatarURL, resp.StatusCode)
+		return
+	}
+	data, err := io.ReadAll(io.LimitReader(resp.Body, setting.Avatar.MaxFileSize+1))
+	if err != nil {
+		log.Warn("read body from %q failed: %v", avatarURL, err)
+		return
+	}
+	if int64(len(data)) > setting.Avatar.MaxFileSize {
+		log.Warn("avatar from %q exceeds max size %d", avatarURL, setting.Avatar.MaxFileSize)
+		return
+	}
+	if err := user_service.UploadAvatar(ctx, u, data); err != nil {
+		log.Warn("UploadAvatar for user %q failed: %v", u.Name, err)
 	}
 }
 
@@ -537,17 +559,33 @@ func oAuth2UserLoginCallback(ctx *context.Context, authSource *auth.Source, requ
 	}
 
 	// search in external linked users
-	externalLoginUser := &user_model.ExternalLoginUser{
-		ExternalID:    gothUser.UserID,
-		LoginSourceID: authSource.ID,
-	}
-	hasUser, err = user_model.GetExternalLogin(request.Context(), externalLoginUser)
+	externalLoginUser, hasUser, err := user_model.GetExternalLogin(ctx, authSource.ID, gothUser.UserID)
 	if err != nil {
 		return nil, goth.User{}, err
 	}
 	if hasUser {
-		user, err = user_model.GetUserByID(request.Context(), externalLoginUser.UserID)
-		return user, gothUser, err
+		user, err = user_model.GetUserByID(ctx, externalLoginUser.UserID)
+		if err != nil && !user_model.IsErrUserNotExist(err) {
+			return nil, goth.User{}, err
+		}
+		if err == nil && user.IsIndividual() {
+			return user, gothUser, nil
+		}
+
+		// The external login record is stale: the linked user no longer exists, or it exists but is
+		// not an individual user (only individual users can sign in, so a link pointing at an
+		// organization, bot or remote user can never resolve). Remove it so the next sign-in can
+		// relink the external account to the correct user. Nothing is lost, because the link is
+		// recreated automatically on the next sign-in.
+		reason := "linked user does not exist"
+		if err == nil {
+			reason = fmt.Sprintf("linked user type is %d", user.Type)
+		}
+		log.Warn("Ignoring stale external login link [external-id=%s login-source-id=%d user-id=%d]: %s", externalLoginUser.ExternalID, externalLoginUser.LoginSourceID, externalLoginUser.UserID, reason)
+
+		if err := user_model.RemoveExternalLoginByExternalID(ctx, externalLoginUser.LoginSourceID, externalLoginUser.ExternalID); err != nil {
+			return nil, goth.User{}, err
+		}
 	}
 
 	// no user found to login
@@ -584,7 +622,15 @@ func buildOIDCEndSessionURL(ctx *context.Context, doer *user_model.User) string
 	// https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout
 	params := endSessionURL.Query()
 	params.Set("client_id", oauth2Cfg.ClientID)
-	params.Set("post_logout_redirect_uri", httplib.GuessCurrentAppURL(ctx))
+
+	// AWS Cognito uses "logout_uri" instead of the standard "post_logout_redirect_uri"
+	redirectURI := httplib.GuessCurrentAppURL(ctx)
+	if oauth2Cfg.Provider == oauth2.ProviderNameAwsCognito {
+		params.Set("logout_uri", redirectURI)
+	} else {
+		params.Set("post_logout_redirect_uri", redirectURI)
+	}
+
 	endSessionURL.RawQuery = params.Encode()
 	return endSessionURL.String()
 }
diff --git a/routers/web/auth/oauth2_provider.go b/routers/web/auth/oauth2_provider.go
index 05931d8f596..0ed20329b46 100644
--- a/routers/web/auth/oauth2_provider.go
+++ b/routers/web/auth/oauth2_provider.go
@@ -13,18 +13,18 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/httpauth"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	auth_service "code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/oauth2_provider"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/httpauth"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	auth_service "gitea.dev/services/auth"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/oauth2_provider"
 
 	"gitea.com/go-chi/binding"
 	jwt "github.com/golang-jwt/jwt/v5"
@@ -561,6 +561,13 @@ func handleRefreshToken(ctx *context.Context, form forms.AccessTokenForm, server
 		})
 		return
 	}
+	if grant.ApplicationID != app.ID {
+		handleAccessTokenError(ctx, oauth2_provider.AccessTokenError{
+			ErrorCode:        oauth2_provider.AccessTokenErrorCodeInvalidGrant,
+			ErrorDescription: "refresh token belongs to a different client",
+		})
+		return
+	}
 
 	// check if token got already used
 	if setting.OAuth2.InvalidateRefreshTokens && (grant.Counter != token.Counter || token.Counter == 0) {
@@ -630,6 +637,13 @@ func handleAuthorizationCode(ctx *context.Context, form forms.AccessTokenForm, s
 		})
 		return
 	}
+	if authorizationCode.RedirectURI != "" && form.RedirectURI != authorizationCode.RedirectURI {
+		handleAccessTokenError(ctx, oauth2_provider.AccessTokenError{
+			ErrorCode:        oauth2_provider.AccessTokenErrorCodeInvalidGrant,
+			ErrorDescription: "redirect_uri differs from the original authorization request",
+		})
+		return
+	}
 	// check if granted for this application
 	if authorizationCode.Grant.ApplicationID != app.ID {
 		handleAccessTokenError(ctx, oauth2_provider.AccessTokenError{
diff --git a/routers/web/auth/oauth_group_claims_test.go b/routers/web/auth/oauth_group_claims_test.go
index d3e5a4f3298..b434c068ed7 100644
--- a/routers/web/auth/oauth_group_claims_test.go
+++ b/routers/web/auth/oauth_group_claims_test.go
@@ -6,9 +6,9 @@ package auth
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	user_service "code.gitea.io/gitea/services/user"
+	"gitea.dev/modules/optional"
+	"gitea.dev/services/auth/source/oauth2"
+	user_service "gitea.dev/services/user"
 
 	"github.com/markbates/goth"
 	"github.com/stretchr/testify/assert"
diff --git a/routers/web/auth/oauth_signin_sync.go b/routers/web/auth/oauth_signin_sync.go
index 2f7a8eab580..a939a0e71ec 100644
--- a/routers/web/auth/oauth_signin_sync.go
+++ b/routers/web/auth/oauth_signin_sync.go
@@ -6,14 +6,14 @@ package auth
 import (
 	"fmt"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/context"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/context"
 
 	"github.com/markbates/goth"
 )
diff --git a/routers/web/auth/oauth_test.go b/routers/web/auth/oauth_test.go
index 36b0cf6eace..e605f00680a 100644
--- a/routers/web/auth/oauth_test.go
+++ b/routers/web/auth/oauth_test.go
@@ -6,10 +6,10 @@ package auth
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/services/oauth2_provider"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/services/oauth2_provider"
 
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/assert"
diff --git a/routers/web/auth/openid.go b/routers/web/auth/openid.go
index ec1af61ee99..7d67b2fa3f7 100644
--- a/routers/web/auth/openid.go
+++ b/routers/web/auth/openid.go
@@ -8,16 +8,16 @@ import (
 	"net/http"
 	"net/url"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/openid"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/openid"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 const (
diff --git a/routers/web/auth/password.go b/routers/web/auth/password.go
index 11e085f5b1e..a650f243ec7 100644
--- a/routers/web/auth/password.go
+++ b/routers/web/auth/password.go
@@ -7,19 +7,19 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/mailer"
-	user_service "code.gitea.io/gitea/services/user"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/password"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/mailer"
+	user_service "gitea.dev/services/user"
 )
 
 var (
diff --git a/routers/web/auth/webauthn.go b/routers/web/auth/webauthn.go
index cae726b8bf1..cf48091a37c 100644
--- a/routers/web/auth/webauthn.go
+++ b/routers/web/auth/webauthn.go
@@ -8,13 +8,13 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	wa "code.gitea.io/gitea/modules/auth/webauthn"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	wa "gitea.dev/modules/auth/webauthn"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 
 	"github.com/go-webauthn/webauthn/protocol"
 	"github.com/go-webauthn/webauthn/webauthn"
diff --git a/routers/web/base.go b/routers/web/base.go
index 6afcac62e23..23c027da5ca 100644
--- a/routers/web/base.go
+++ b/routers/web/base.go
@@ -12,14 +12,14 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/modules/assetfs"
-	"code.gitea.io/gitea/modules/avatar"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web/routing"
+	"gitea.dev/modules/assetfs"
+	"gitea.dev/modules/avatar"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web/routing"
 )
 
 func avatarStorageHandler(storageSetting *setting.Storage, prefix string, objStore storage.ObjectStorage) http.HandlerFunc {
diff --git a/routers/web/devtest/devtest.go b/routers/web/devtest/devtest.go
index af548430169..87c1ffdb2af 100644
--- a/routers/web/devtest/devtest.go
+++ b/routers/web/devtest/devtest.go
@@ -13,16 +13,16 @@ import (
 	"time"
 	"unicode"
 
-	"code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/badge"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/indexer/code"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/badge"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/indexer/code"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 // List all devtest templates, they will be used for e2e tests for the UI components
diff --git a/routers/web/devtest/mail_preview.go b/routers/web/devtest/mail_preview.go
index 7b1787d52bc..82a84ec03cb 100644
--- a/routers/web/devtest/mail_preview.go
+++ b/routers/web/devtest/mail_preview.go
@@ -7,12 +7,12 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/mailer"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	"gitea.dev/services/mailer"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func MailPreviewRender(ctx *context.Context) {
diff --git a/routers/web/devtest/mock_actions.go b/routers/web/devtest/mock_actions.go
index 83e9bef9c8e..69062ff6e78 100644
--- a/routers/web/devtest/mock_actions.go
+++ b/routers/web/devtest/mock_actions.go
@@ -12,14 +12,14 @@ import (
 	"strings"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/web/repo/actions"
-	"code.gitea.io/gitea/services/context"
+	actions_model "gitea.dev/models/actions"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/web/repo/actions"
+	"gitea.dev/services/context"
 )
 
 type generateMockStepsLogOptions struct {
@@ -271,6 +271,75 @@ func MockActionsRunsJobs(ctx *context.Context) {
 		}
 	}
 
+	if runID == 40 {
+		// Reusable workflow caller demo: same-repo caller (with a nested same-repo caller inside),
+		// alongside a flat cross-repo caller.
+		// Layout:
+		//   prepare           (regular, top-level)
+		//   local_caller      (caller, same-repo, expanded)
+		//     ├ lib_step      (regular)
+		//     └ inner_caller  (caller, same-repo nested, expanded)
+		//       └ deep_job    (regular)
+		//   cross_caller      (caller, cross-repo, expanded)
+		//     └ external_job  (regular)
+		//   final             (regular, needs local_caller + cross_caller)
+		const (
+			prepareID     = int64(400)
+			localCallerID = int64(401)
+			libStepID     = int64(402)
+			innerCallerID = int64(403)
+			deepJobID     = int64(404)
+			crossCallerID = int64(405)
+			externalJobID = int64(406)
+			finalID       = int64(407)
+		)
+
+		resp.State.Run.Jobs = []*actions.ViewJob{
+			{
+				ID: prepareID, Link: jobLink(prepareID), JobID: "prepare", Name: "prepare",
+				Status: actions_model.StatusSuccess.String(), Duration: "30s",
+			},
+			{
+				ID: localCallerID, Link: jobLink(localCallerID), JobID: "local_caller", Name: "local caller",
+				Status: actions_model.StatusRunning.String(), Duration: "5m",
+				Needs:            []string{"prepare"},
+				IsReusableCaller: true, CallUses: "./.gitea/workflows/lib.yml",
+			},
+			{
+				ID: libStepID, Link: jobLink(libStepID), JobID: "lib_step", Name: "lib step",
+				Status: actions_model.StatusSuccess.String(), Duration: "1m",
+				ParentJobID: localCallerID,
+			},
+			{
+				ID: innerCallerID, Link: jobLink(innerCallerID), JobID: "inner_caller", Name: "inner caller (nested)",
+				Status: actions_model.StatusRunning.String(), Duration: "4m",
+				ParentJobID:      localCallerID,
+				IsReusableCaller: true, CallUses: "./.gitea/workflows/inner.yml",
+			},
+			{
+				ID: deepJobID, Link: jobLink(deepJobID), JobID: "deep_job", Name: "deep job",
+				Status: actions_model.StatusRunning.String(), Duration: "2m",
+				ParentJobID: innerCallerID,
+			},
+			{
+				ID: crossCallerID, Link: jobLink(crossCallerID), JobID: "cross_caller", Name: "cross-repo caller",
+				Status: actions_model.StatusWaiting.String(), Duration: "0s",
+				Needs:            []string{"prepare"},
+				IsReusableCaller: true, CallUses: "user2/lib-repo/.gitea/workflows/external.yml@main",
+			},
+			{
+				ID: externalJobID, Link: jobLink(externalJobID), JobID: "external_job", Name: "external job",
+				Status: actions_model.StatusWaiting.String(), Duration: "0s",
+				ParentJobID: crossCallerID,
+			},
+			{
+				ID: finalID, Link: jobLink(finalID), JobID: "final", Name: "final",
+				Status: actions_model.StatusBlocked.String(), Duration: "0s",
+				Needs: []string{"local_caller", "cross_caller"},
+			},
+		}
+	}
+
 	fillViewRunResponseCurrentJob(ctx, resp)
 	ctx.JSON(http.StatusOK, resp)
 }
diff --git a/routers/web/events/events.go b/routers/web/events/events.go
index 52f20e07dc3..07375f77d50 100644
--- a/routers/web/events/events.go
+++ b/routers/web/events/events.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"time"
 
-	"code.gitea.io/gitea/modules/eventsource"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/routers/web/auth"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/eventsource"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/routers/web/auth"
+	"gitea.dev/services/context"
 )
 
 // Events listens for events
diff --git a/routers/web/explore/code.go b/routers/web/explore/code.go
index fc428d9ec94..7782d34cb91 100644
--- a/routers/web/explore/code.go
+++ b/routers/web/explore/code.go
@@ -7,13 +7,13 @@ import (
 	"net/http"
 	"slices"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	code_indexer "code.gitea.io/gitea/modules/indexer/code"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	code_indexer "gitea.dev/modules/indexer/code"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/explore/org.go b/routers/web/explore/org.go
index eabaa6646ab..621f6bd97a5 100644
--- a/routers/web/explore/org.go
+++ b/routers/web/explore/org.go
@@ -4,13 +4,13 @@
 package explore
 
 import (
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 // Organizations render explore organizations page
diff --git a/routers/web/explore/repo.go b/routers/web/explore/repo.go
index 0d5fea26977..2399aa58806 100644
--- a/routers/web/explore/repo.go
+++ b/routers/web/explore/repo.go
@@ -6,13 +6,13 @@ package explore
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/sitemap"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/sitemap"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/explore/topic.go b/routers/web/explore/topic.go
index be457df5874..aae0522b06e 100644
--- a/routers/web/explore/topic.go
+++ b/routers/web/explore/topic.go
@@ -6,11 +6,11 @@ package explore
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // TopicSearch search for creating topic
diff --git a/routers/web/explore/user.go b/routers/web/explore/user.go
index b88c13f7d4f..00217d662c1 100644
--- a/routers/web/explore/user.go
+++ b/routers/web/explore/user.go
@@ -7,17 +7,17 @@ import (
 	"bytes"
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/sitemap"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/sitemap"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/feed/branch.go b/routers/web/feed/branch.go
index eb7f6dc5bc5..e7a1cbbe4fe 100644
--- a/routers/web/feed/branch.go
+++ b/routers/web/feed/branch.go
@@ -4,12 +4,11 @@
 package feed
 
 import (
-	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/services/context"
 
 	"github.com/gorilla/feeds"
 )
@@ -39,14 +38,14 @@ func ShowBranchFeed(ctx *context.Context, repo *repo.Repository, formatType stri
 	for _, commit := range commits {
 		feed.Items = append(feed.Items, &feeds.Item{
 			Id:    commit.ID.String(),
-			Title: strings.TrimSpace(strings.Split(commit.Message(), "\n")[0]),
+			Title: commit.MessageTitle(),
 			Link:  &feeds.Link{Href: repo.HTMLURL() + "/commit/" + commit.ID.String()},
 			Author: &feeds.Author{
 				Name:  commit.Author.Name,
 				Email: commit.Author.Email,
 			},
-			Description: commit.Message(),
-			Content:     commit.Message(),
+			Description: commit.MessageUTF8(), // TODO: description can be shorten content
+			Content:     commit.MessageUTF8(),
 			Created:     commit.Committer.When,
 		})
 	}
diff --git a/routers/web/feed/convert.go b/routers/web/feed/convert.go
index 5d208bb2861..8f1dd8ec67f 100644
--- a/routers/web/feed/convert.go
+++ b/routers/web/feed/convert.go
@@ -12,15 +12,15 @@ import (
 	"strconv"
 	"strings"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/renderhelper"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/renderhelper"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 
 	"github.com/gorilla/feeds"
 )
diff --git a/routers/web/feed/file.go b/routers/web/feed/file.go
index 026c15c43a5..122d219b6ca 100644
--- a/routers/web/feed/file.go
+++ b/routers/web/feed/file.go
@@ -4,13 +4,12 @@
 package feed
 
 import (
-	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 
 	"github.com/gorilla/feeds"
 )
@@ -46,14 +45,14 @@ func ShowFileFeed(ctx *context.Context, repo *repo.Repository, formatType string
 	for _, commit := range commits {
 		feed.Items = append(feed.Items, &feeds.Item{
 			Id:    commit.ID.String(),
-			Title: strings.TrimSpace(strings.Split(commit.Message(), "\n")[0]),
+			Title: commit.MessageTitle(),
 			Link:  &feeds.Link{Href: repo.HTMLURL() + "/commit/" + commit.ID.String()},
 			Author: &feeds.Author{
 				Name:  commit.Author.Name,
 				Email: commit.Author.Email,
 			},
-			Description: commit.Message(),
-			Content:     commit.Message(),
+			Description: commit.MessageUTF8(), // TODO: description can be shorten content
+			Content:     commit.MessageUTF8(),
 			Created:     commit.Committer.When,
 		})
 	}
diff --git a/routers/web/feed/profile.go b/routers/web/feed/profile.go
index 3ca4890e353..0d237c9c742 100644
--- a/routers/web/feed/profile.go
+++ b/routers/web/feed/profile.go
@@ -6,12 +6,12 @@ package feed
 import (
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/renderhelper"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/services/context"
-	feed_service "code.gitea.io/gitea/services/feed"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/renderhelper"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/services/context"
+	feed_service "gitea.dev/services/feed"
 
 	"github.com/gorilla/feeds"
 )
diff --git a/routers/web/feed/profile_test.go b/routers/web/feed/profile_test.go
index bf9492b57b9..66216191cf8 100644
--- a/routers/web/feed/profile_test.go
+++ b/routers/web/feed/profile_test.go
@@ -5,10 +5,10 @@ package feed_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/routers/web/feed"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/routers/web/feed"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/feed/release.go b/routers/web/feed/release.go
index fb6e3add656..6767c502ff4 100644
--- a/routers/web/feed/release.go
+++ b/routers/web/feed/release.go
@@ -6,9 +6,9 @@ package feed
 import (
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/services/context"
 
 	"github.com/gorilla/feeds"
 )
diff --git a/routers/web/feed/render.go b/routers/web/feed/render.go
index 014da253bdf..21ae03a5951 100644
--- a/routers/web/feed/render.go
+++ b/routers/web/feed/render.go
@@ -4,7 +4,7 @@
 package feed
 
 import (
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/services/context"
 )
 
 // RenderBranchFeed render format for branch or file
diff --git a/routers/web/feed/repo.go b/routers/web/feed/repo.go
index 2e69fac7581..8c8946eec1a 100644
--- a/routers/web/feed/repo.go
+++ b/routers/web/feed/repo.go
@@ -6,10 +6,10 @@ package feed
 import (
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/services/context"
-	feed_service "code.gitea.io/gitea/services/feed"
+	activities_model "gitea.dev/models/activities"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/services/context"
+	feed_service "gitea.dev/services/feed"
 
 	"github.com/gorilla/feeds"
 )
diff --git a/routers/web/githttp.go b/routers/web/githttp.go
index c738b68c8d3..ed0287cc39d 100644
--- a/routers/web/githttp.go
+++ b/routers/web/githttp.go
@@ -4,8 +4,8 @@
 package web
 
 import (
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/web/repo"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/web/repo"
 )
 
 func addOwnerRepoGitHTTPRouters(m *web.Router, middlewares ...any) {
diff --git a/routers/web/goget.go b/routers/web/goget.go
index 67e0bee866c..ba8a311f954 100644
--- a/routers/web/goget.go
+++ b/routers/web/goget.go
@@ -11,10 +11,10 @@ import (
 	"path"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 func goGet(ctx *context.Context) {
diff --git a/routers/web/healthcheck/check.go b/routers/web/healthcheck/check.go
index 116aab886bc..747d588cb09 100644
--- a/routers/web/healthcheck/check.go
+++ b/routers/web/healthcheck/check.go
@@ -9,11 +9,11 @@ import (
 	"os"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 type status string
diff --git a/routers/web/home.go b/routers/web/home.go
index d14a7bab13f..7f1491a41d4 100644
--- a/routers/web/home.go
+++ b/routers/web/home.go
@@ -8,19 +8,19 @@ import (
 	"net/http"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/sitemap"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/routers/web/auth"
-	"code.gitea.io/gitea/routers/web/user"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/sitemap"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/routers/web/auth"
+	"gitea.dev/routers/web/user"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/metrics.go b/routers/web/metrics.go
index 46c13f0a244..8b0143e341b 100644
--- a/routers/web/metrics.go
+++ b/routers/web/metrics.go
@@ -7,7 +7,7 @@ import (
 	"crypto/subtle"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 )
diff --git a/routers/web/misc/markup.go b/routers/web/misc/markup.go
index f90cf3ffed0..964a00282f4 100644
--- a/routers/web/misc/markup.go
+++ b/routers/web/misc/markup.go
@@ -5,11 +5,11 @@
 package misc
 
 import (
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
 )
 
 // Markup render markup document to HTML
diff --git a/routers/web/misc/misc.go b/routers/web/misc/misc.go
index 0b939ee4352..0cfd7c0a492 100644
--- a/routers/web/misc/misc.go
+++ b/routers/web/misc/misc.go
@@ -9,15 +9,15 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 )
 
 func SiteManifest(w http.ResponseWriter, req *http.Request) {
diff --git a/routers/web/misc/swagger.go b/routers/web/misc/swagger.go
index 4abd4f042d6..0e65f599e8f 100644
--- a/routers/web/misc/swagger.go
+++ b/routers/web/misc/swagger.go
@@ -6,7 +6,7 @@ package misc
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/services/context"
 )
 
 func Swagger(ctx *context.Context) {
diff --git a/routers/web/misc/webtheme.go b/routers/web/misc/webtheme.go
index 76ddf4b567a..54ae592fc4b 100644
--- a/routers/web/misc/webtheme.go
+++ b/routers/web/misc/webtheme.go
@@ -6,13 +6,13 @@ package misc
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
-	user_service "code.gitea.io/gitea/services/user"
-	"code.gitea.io/gitea/services/webtheme"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
+	user_service "gitea.dev/services/user"
+	"gitea.dev/services/webtheme"
 )
 
 func WebThemeList(ctx *context.Context) {
diff --git a/routers/web/nodeinfo.go b/routers/web/nodeinfo.go
index 47856bf98bf..8d8b4044445 100644
--- a/routers/web/nodeinfo.go
+++ b/routers/web/nodeinfo.go
@@ -6,8 +6,8 @@ package web
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 type nodeInfoLinks struct {
diff --git a/routers/web/org/block.go b/routers/web/org/block.go
index e728e4dce5a..b5f068298a6 100644
--- a/routers/web/org/block.go
+++ b/routers/web/org/block.go
@@ -6,9 +6,9 @@ package org
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/templates"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/templates"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/org/home.go b/routers/web/org/home.go
index 56475c47f00..a88c8461767 100644
--- a/routers/web/org/home.go
+++ b/routers/web/org/home.go
@@ -8,18 +8,18 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/renderhelper"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/renderhelper"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
 )
 
 const tplOrgHome templates.TplName = "org/home"
diff --git a/routers/web/org/main_test.go b/routers/web/org/main_test.go
index 92237d6e884..f800ebbbf93 100644
--- a/routers/web/org/main_test.go
+++ b/routers/web/org/main_test.go
@@ -6,7 +6,7 @@ package org_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/web/org/members.go b/routers/web/org/members.go
index 5d7a0a28cde..4a7799a6e28 100644
--- a/routers/web/org/members.go
+++ b/routers/web/org/members.go
@@ -8,15 +8,15 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	org_service "code.gitea.io/gitea/services/org"
+	"gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	org_service "gitea.dev/services/org"
 )
 
 const (
@@ -31,10 +31,14 @@ func Members(ctx *context.Context) {
 	ctx.Data["PageIsOrgMembers"] = true
 
 	page := max(ctx.FormInt("page"), 1)
+	keyword := ctx.FormTrim("q")
+	ctx.Data["Keyword"] = keyword
 
 	opts := &organization.FindOrgMembersOpts{
-		Doer:  ctx.Doer,
-		OrgID: org.ID,
+		Doer:          ctx.Doer,
+		OrgID:         org.ID,
+		Keyword:       keyword,
+		SearchByEmail: true,
 	}
 
 	if ctx.Doer != nil {
@@ -58,9 +62,11 @@ func Members(ctx *context.Context) {
 		return
 	}
 
-	pager := context.NewPagination(total, setting.UI.MembersPagingNum, page, 5)
-	opts.ListOptions.Page = page
-	opts.ListOptions.PageSize = setting.UI.MembersPagingNum
+	pageSize := setting.UI.MembersPagingNum
+	pager := context.NewPagination(total, pageSize, page, 5)
+	pager.AddParamFromRequest(ctx.Req)
+	opts.ListOptions.Page = pager.Paginater.Current()
+	opts.ListOptions.PageSize = pageSize
 	members, membersIsPublic, err := organization.FindOrgMembers(ctx, opts)
 	if err != nil {
 		ctx.ServerError("GetMembers", err)
@@ -68,6 +74,8 @@ func Members(ctx *context.Context) {
 	}
 	ctx.Data["Page"] = pager
 	ctx.Data["Members"] = members
+	ctx.Data["MembersShown"] = len(members)
+	ctx.Data["MembersTotal"] = total
 	ctx.Data["MembersIsPublicMember"] = membersIsPublic
 	ctx.Data["MembersIsUserOrgOwner"] = organization.IsUserOrgOwner(ctx, members, org.ID)
 	ctx.Data["MembersTwoFaStatus"] = members.GetTwoFaStatus(ctx)
diff --git a/routers/web/org/mention.go b/routers/web/org/mention.go
index ad6cc8c8624..9331a1b8e8f 100644
--- a/routers/web/org/mention.go
+++ b/routers/web/org/mention.go
@@ -6,10 +6,10 @@ package org
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/modules/util"
-	shared_mention "code.gitea.io/gitea/routers/web/shared/mention"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/organization"
+	"gitea.dev/modules/util"
+	shared_mention "gitea.dev/routers/web/shared/mention"
+	"gitea.dev/services/context"
 )
 
 // GetMentionsInOwner returns JSON data for mention autocomplete on owner-level pages.
diff --git a/routers/web/org/org.go b/routers/web/org/org.go
index 36978ba65bd..e21d7e42ffe 100644
--- a/routers/web/org/org.go
+++ b/routers/web/org/org.go
@@ -8,15 +8,15 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 const (
diff --git a/routers/web/org/org_labels.go b/routers/web/org/org_labels.go
index 2a4aa7f557d..3c5e7af4487 100644
--- a/routers/web/org/org_labels.go
+++ b/routers/web/org/org_labels.go
@@ -6,15 +6,15 @@ package org
 import (
 	"errors"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/label"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	shared_label "code.gitea.io/gitea/routers/web/shared/label"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/label"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	shared_label "gitea.dev/routers/web/shared/label"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 // RetrieveLabels find all the labels of an organization
diff --git a/routers/web/org/projects.go b/routers/web/org/projects.go
index ae32be05757..0db668259c8 100644
--- a/routers/web/org/projects.go
+++ b/routers/web/org/projects.go
@@ -9,21 +9,21 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/web/shared/issue"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	project_service "code.gitea.io/gitea/services/projects"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/web/shared/issue"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	project_service "gitea.dev/services/projects"
 
 	"xorm.io/builder"
 )
diff --git a/routers/web/org/projects_test.go b/routers/web/org/projects_test.go
index 63bcefb6e2e..6bb827d5312 100644
--- a/routers/web/org/projects_test.go
+++ b/routers/web/org/projects_test.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/web/org"
-	"code.gitea.io/gitea/services/contexttest"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/web/org"
+	"gitea.dev/services/contexttest"
+	"gitea.dev/services/forms"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/org/setting.go b/routers/web/org/setting.go
index ca1da6617e5..2dafe88cc50 100644
--- a/routers/web/org/setting.go
+++ b/routers/web/org/setting.go
@@ -9,25 +9,25 @@ import (
 	"net/http"
 	"net/url"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	user_setting "code.gitea.io/gitea/routers/web/user/setting"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	org_service "code.gitea.io/gitea/services/org"
-	user_service "code.gitea.io/gitea/services/user"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	shared_user "gitea.dev/routers/web/shared/user"
+	user_setting "gitea.dev/routers/web/user/setting"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	org_service "gitea.dev/services/org"
+	user_service "gitea.dev/services/user"
 )
 
 const (
diff --git a/routers/web/org/setting_oauth2.go b/routers/web/org/setting_oauth2.go
index 0b1394a128a..538f0c7d463 100644
--- a/routers/web/org/setting_oauth2.go
+++ b/routers/web/org/setting_oauth2.go
@@ -7,13 +7,13 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	user_setting "code.gitea.io/gitea/routers/web/user/setting"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	shared_user "gitea.dev/routers/web/shared/user"
+	user_setting "gitea.dev/routers/web/user/setting"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/org/setting_packages.go b/routers/web/org/setting_packages.go
index ec80e2867c3..85cb1ff3b81 100644
--- a/routers/web/org/setting_packages.go
+++ b/routers/web/org/setting_packages.go
@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	shared "code.gitea.io/gitea/routers/web/shared/packages"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	shared "gitea.dev/routers/web/shared/packages"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/org/teams.go b/routers/web/org/teams.go
index 73124782990..a026f4aa073 100644
--- a/routers/web/org/teams.go
+++ b/routers/web/org/teams.go
@@ -13,23 +13,23 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	org_model "code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/forms"
-	org_service "code.gitea.io/gitea/services/org"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	org_model "gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/forms"
+	org_service "gitea.dev/services/org"
+	repo_service "gitea.dev/services/repository"
 )
 
 const (
diff --git a/routers/web/org/worktime.go b/routers/web/org/worktime.go
index bf8db1a9a1a..56d4b16933f 100644
--- a/routers/web/org/worktime.go
+++ b/routers/web/org/worktime.go
@@ -7,10 +7,10 @@ import (
 	"net/http"
 	"time"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/modules/templates"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/organization"
+	"gitea.dev/modules/templates"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
 )
 
 const tplByRepos templates.TplName = "org/worktime"
diff --git a/routers/web/passkey.go b/routers/web/passkey.go
index 0d10a69dfe6..22acb6e7e48 100644
--- a/routers/web/passkey.go
+++ b/routers/web/passkey.go
@@ -6,8 +6,8 @@ package web
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 type passkeyEndpointsType struct {
diff --git a/routers/web/repo/actions/actions.go b/routers/web/repo/actions/actions.go
index 1e9f596fc40..5ae0d14a6fc 100644
--- a/routers/web/repo/actions/actions.go
+++ b/routers/web/repo/actions/actions.go
@@ -7,28 +7,30 @@ import (
 	"bytes"
 	stdCtx "context"
 	"errors"
+	"fmt"
 	"net/http"
+	"net/url"
 	"slices"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/actions"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 
-	act_model "github.com/nektos/act/pkg/model"
+	act_model "gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -44,6 +46,14 @@ type WorkflowInfo struct {
 	Workflow *act_model.Workflow
 }
 
+// DisplayName returns the workflow name from the YAML file if present, otherwise the filename.
+func (w WorkflowInfo) DisplayName() string {
+	if w.Workflow != nil && w.Workflow.Name != "" {
+		return w.Workflow.Name
+	}
+	return w.Entry.Name()
+}
+
 // MustEnableActions check if actions are enabled in settings
 func MustEnableActions(ctx *context.Context) {
 	if !setting.Actions.Enabled {
@@ -82,12 +92,16 @@ func List(ctx *context.Context) {
 	if ctx.Written() {
 		return
 	}
+	otherWorkflows := prepareOtherWorkflows(ctx, workflows, curWorkflowID)
+	if ctx.Written() {
+		return
+	}
 	prepareWorkflowDispatchTemplate(ctx, workflows, curWorkflowID)
 	if ctx.Written() {
 		return
 	}
 
-	prepareWorkflowList(ctx, workflows)
+	prepareWorkflowList(ctx, workflows, otherWorkflows)
 	if ctx.Written() {
 		return
 	}
@@ -95,6 +109,31 @@ func List(ctx *context.Context) {
 	ctx.HTML(http.StatusOK, tplListActions)
 }
 
+// prepareOtherWorkflows surfaces historical runs whose workflow file no longer
+// exists on the default branch (renamed, removed, or only on other branches).
+func prepareOtherWorkflows(ctx *context.Context, workflows []WorkflowInfo, curWorkflowID string) []string {
+	listed := make(container.Set[string], len(workflows))
+	for _, w := range workflows {
+		listed.Add(w.Entry.Name())
+	}
+
+	var other []string
+	if ctx.Repo.Repository.NumActionRuns > 0 {
+		ids, err := actions_model.GetRunWorkflowIDs(ctx, ctx.Repo.Repository.ID)
+		if err != nil {
+			ctx.ServerError("GetRunWorkflowIDs", err)
+			return nil
+		}
+		other = container.FilterSlice(ids, func(id string) (string, bool) {
+			return id, id != "" && !listed.Contains(id)
+		})
+	}
+
+	ctx.Data["OtherWorkflows"] = other
+	ctx.Data["CurWorkflowIsListed"] = curWorkflowID == "" || listed.Contains(curWorkflowID)
+	return other
+}
+
 func WorkflowDispatchInputs(ctx *context.Context) {
 	ref := ctx.FormString("ref")
 	if ref == "" {
@@ -245,10 +284,11 @@ func prepareWorkflowDispatchTemplate(ctx *context.Context, workflowInfos []Workf
 	ctx.Data["Tags"] = tags
 }
 
-func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo) {
+func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo, otherWorkflows []string) {
 	actorID := ctx.FormInt64("actor")
 	status := ctx.FormInt("status")
 	workflowID := ctx.FormString("workflow")
+	branch := ctx.FormString("branch")
 	page := ctx.FormInt("page")
 	if page <= 0 {
 		page = 1
@@ -258,7 +298,8 @@ func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo) {
 	// they will be 0 by default, which indicates get all status or actors
 	ctx.Data["CurActor"] = actorID
 	ctx.Data["CurStatus"] = status
-	if actorID > 0 || status > int(actions_model.StatusUnknown) {
+	ctx.Data["CurBranch"] = branch
+	if actorID > 0 || status > int(actions_model.StatusUnknown) || branch != "" {
 		ctx.Data["IsFiltered"] = true
 	}
 
@@ -276,6 +317,9 @@ func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo) {
 	if actions_model.Status(status) != actions_model.StatusUnknown {
 		opts.Status = []actions_model.Status{actions_model.Status(status)}
 	}
+	if branch != "" {
+		opts.Ref = string(git.RefNameFromBranch(branch))
+	}
 
 	runs, total, err := db.FindAndCount[actions_model.ActionRun](ctx, opts)
 	if err != nil {
@@ -341,6 +385,12 @@ func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo) {
 
 	ctx.Data["Runs"] = runs
 
+	workflowNames := make(map[string]string, len(workflows))
+	for _, wf := range workflows {
+		workflowNames[wf.Entry.Name()] = wf.DisplayName()
+	}
+	ctx.Data["WorkflowNames"] = workflowNames
+
 	actors, err := actions_model.GetActors(ctx, ctx.Repo.Repository.ID)
 	if err != nil {
 		ctx.ServerError("GetActors", err)
@@ -350,10 +400,17 @@ func prepareWorkflowList(ctx *context.Context, workflows []WorkflowInfo) {
 
 	ctx.Data["StatusInfoList"] = actions_model.GetStatusInfoList(ctx, ctx.Locale)
 
+	runBranches, err := actions_model.GetRunBranches(ctx, ctx.Repo.Repository.ID)
+	if err != nil {
+		ctx.ServerError("GetRunBranches", err)
+		return
+	}
+	ctx.Data["RunBranches"] = runBranches
+
 	pager := context.NewPagination(total, opts.PageSize, opts.Page, 5)
 	pager.AddParamFromRequest(ctx.Req)
 	ctx.Data["Page"] = pager
-	ctx.Data["HasWorkflowsOrRuns"] = len(workflows) > 0 || len(runs) > 0
+	ctx.Data["HasWorkflowsOrRuns"] = len(workflows) > 0 || len(otherWorkflows) > 0 || len(runs) > 0
 
 	ctx.Data["CanWriteRepoUnitActions"] = ctx.Repo.Permission.CanWrite(unit.TypeActions)
 }
@@ -466,3 +523,13 @@ func decodeNode(node yaml.Node, out any) bool {
 	}
 	return true
 }
+
+func actionsListRedirectURL(repoLink, workflow, actor, status, branch string) string {
+	return fmt.Sprintf("%s/actions?workflow=%s&actor=%s&status=%s&branch=%s",
+		repoLink,
+		url.QueryEscape(workflow),
+		url.QueryEscape(actor),
+		url.QueryEscape(status),
+		url.QueryEscape(branch),
+	)
+}
diff --git a/routers/web/repo/actions/actions_test.go b/routers/web/repo/actions/actions_test.go
index 9e83ff0fbba..1f1040738bb 100644
--- a/routers/web/repo/actions/actions_test.go
+++ b/routers/web/repo/actions/actions_test.go
@@ -7,11 +7,11 @@ import (
 	"strings"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	unittest "code.gitea.io/gitea/models/unittest"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	unittest "gitea.dev/models/unittest"
 
-	act_model "github.com/nektos/act/pkg/model"
+	act_model "gitea.com/gitea/runner/act/model"
 	"github.com/stretchr/testify/assert"
 )
 
diff --git a/routers/web/repo/actions/badge.go b/routers/web/repo/actions/badge.go
index d268a8df8af..dd733dca6e7 100644
--- a/routers/web/repo/actions/badge.go
+++ b/routers/web/repo/actions/badge.go
@@ -9,11 +9,11 @@ import (
 	"path/filepath"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/badge"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/modules/badge"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 func GetWorkflowBadge(ctx *context.Context) {
diff --git a/routers/web/repo/actions/main_test.go b/routers/web/repo/actions/main_test.go
index a82f9c6672e..647914a1dd8 100644
--- a/routers/web/repo/actions/main_test.go
+++ b/routers/web/repo/actions/main_test.go
@@ -6,7 +6,7 @@ package actions
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/web/repo/actions/view.go b/routers/web/repo/actions/view.go
index e17d6b42d7a..da997444490 100644
--- a/routers/web/repo/actions/view.go
+++ b/routers/web/repo/actions/view.go
@@ -14,28 +14,29 @@ import (
 	"net/http"
 	"net/url"
 	"strconv"
+	"strings"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/common"
-	actions_service "code.gitea.io/gitea/services/actions"
-	context_module "code.gitea.io/gitea/services/context"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/actions"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/common"
+	actions_service "gitea.dev/services/actions"
+	context_module "gitea.dev/services/context"
 
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/model"
 )
 
 func findCurrentJobByPathParam(ctx *context_module.Context, jobs []*actions_model.ActionRunJob) (job *actions_model.ActionRunJob, hasPathParam bool) {
@@ -138,8 +139,7 @@ func resolveCurrentRunForView(ctx *context_module.Context) *actions_model.Action
 	var runByID, runByIndex *actions_model.ActionRun
 	var targetJobByIndex *actions_model.ActionRunJob
 
-	// Each run must have at least one job, so a valid job ID in the same run cannot be smaller than the run ID.
-	if !byIndex && jobNum >= runNum {
+	if !byIndex {
 		// Probe the repo-scoped job ID first and only accept it when the job exists and belongs to the same runNum.
 		job, err := actions_model.GetRunJobByRepoAndID(ctx, ctx.Repo.Repository.ID, jobNum)
 		if err != nil && !errors.Is(err, util.ErrNotExist) {
@@ -207,6 +207,16 @@ func View(ctx *context_module.Context) {
 	jobID := ctx.PathParamInt64("job")
 	ctx.Data["JobID"] = jobID // it can be 0 when no job (e.g.: run summary view)
 
+	// Browser tab title, ordered most-specific → least-specific so narrow tabs keep the useful part.
+	// Separator matches the " - " used by head.tmpl when joining to PageTitleCommon.
+	titleParts := []string{run.Title, run.WorkflowID}
+	if jobID > 0 {
+		if job, err := actions_model.GetRunJobByRunAndID(ctx, run.ID, jobID); err == nil && job.Name != "" {
+			titleParts = append([]string{job.Name}, titleParts...)
+		}
+	}
+	ctx.Data["Title"] = strings.Join(titleParts, " - ")
+
 	attemptNum := ctx.PathParamInt64("attempt")
 
 	// ActionsViewURL is the endpoint for viewing a run (job summary), a job, or a job attempt.
@@ -321,6 +331,12 @@ type ViewJob struct {
 	CanRerun bool     `json:"canRerun"`
 	Duration string   `json:"duration"`
 	Needs    []string `json:"needs,omitempty"`
+
+	ParentJobID int64 `json:"parentJobID"`
+
+	// Reusable workflow caller fields. Zero/empty for non-caller jobs.
+	IsReusableCaller bool   `json:"isReusableCaller"`
+	CallUses         string `json:"callUses,omitempty"`
 }
 
 type ViewRunAttempt struct {
@@ -405,19 +421,22 @@ func fillViewRunResponseSummary(ctx *context_module.Context, resp *ViewResponse,
 	resp.State.Run.Link = run.Link()
 	resp.State.Run.ViewLink = getRunViewLink(run, attempt)
 	resp.State.Run.Attempts = make([]*ViewRunAttempt, 0)
+	var effectiveStatus actions_model.Status
 	if attempt != nil {
+		effectiveStatus = attempt.Status
 		resp.State.Run.RunAttempt = attempt.Attempt
-		resp.State.Run.Status = attempt.Status.String()
-		resp.State.Run.Done = attempt.Status.IsDone()
 		resp.State.Run.Duration = attempt.Duration().String()
 		resp.State.Run.TriggeredAt = attempt.Created.AsTime().Unix()
 	} else {
-		resp.State.Run.Status = run.Status.String()
-		resp.State.Run.Done = run.Status.IsDone()
+		effectiveStatus = run.Status
 		resp.State.Run.Duration = run.Duration().String()
 		resp.State.Run.TriggeredAt = run.Created.AsTime().Unix()
 	}
-	resp.State.Run.CanCancel = isLatestAttempt && !resp.State.Run.Done && ctx.Repo.Permission.CanWrite(unit.TypeActions)
+	resp.State.Run.Status = effectiveStatus.String()
+	resp.State.Run.Done = effectiveStatus.IsDone()
+
+	// Hide the Cancel button once a cancel is already in cancelling progress
+	resp.State.Run.CanCancel = isLatestAttempt && !resp.State.Run.Done && !effectiveStatus.IsCancelling() && ctx.Repo.Permission.CanWrite(unit.TypeActions)
 	resp.State.Run.CanApprove = isLatestAttempt && run.NeedApproval && ctx.Repo.Permission.CanWrite(unit.TypeActions)
 	resp.State.Run.CanRerun = isLatestAttempt && resp.State.Run.Done && ctx.Repo.Permission.CanWrite(unit.TypeActions)
 	resp.State.Run.CanDeleteArtifact = resp.State.Run.Done && ctx.Repo.Permission.CanWrite(unit.TypeActions)
@@ -445,6 +464,10 @@ func fillViewRunResponseSummary(ctx *context_module.Context, resp *ViewResponse,
 			CanRerun: resp.State.Run.CanRerun,
 			Duration: v.Duration().String(),
 			Needs:    v.Needs,
+
+			IsReusableCaller: v.IsReusableCaller,
+			ParentJobID:      v.ParentJobID,
+			CallUses:         v.CallUses,
 		})
 	}
 
@@ -568,10 +591,14 @@ func convertToViewModel(ctx context.Context, locale translation.Locale, cursors
 	steps := actions.FullSteps(task)
 
 	for _, v := range steps {
+		status := v.Status
+		if task.Status == actions_model.StatusCancelling && status.IsRunning() {
+			status = actions_model.StatusCancelling
+		}
 		viewJobs = append(viewJobs, &ViewJobStep{
 			Summary:  v.Name,
 			Duration: v.Duration().String(),
-			Status:   v.Status.String(),
+			Status:   status.String(),
 		})
 	}
 
@@ -893,6 +920,7 @@ func getCurrentRunJobsByPathParam(ctx *context_module.Context) (*actions_model.A
 		ctx.NotFound(nil)
 		return nil, nil, nil
 	}
+	jobs.SortMatrixGroupsByName()
 
 	for _, job := range jobs {
 		job.Run = run
@@ -972,8 +1000,8 @@ func ArtifactsDownloadView(ctx *context_module.Context) {
 	// A v4 Artifact may only contain a single file
 	// Multiple files are uploaded as a single file archive
 	// All other cases fall back to the legacy v1–v3 zip handling below
-	if len(artifacts) == 1 && actions.IsArtifactV4(artifacts[0]) {
-		err := actions.DownloadArtifactV4(ctx.Base, artifacts[0])
+	if len(artifacts) == 1 && actions_service.IsArtifactV4(artifacts[0]) {
+		err := actions_service.DownloadArtifactV4(ctx.Base, artifacts[0])
 		if err != nil {
 			ctx.ServerError("DownloadArtifactV4", err)
 			return
@@ -1072,7 +1100,7 @@ func EnableWorkflowFile(ctx *context_module.Context) {
 func disableOrEnableWorkflowFile(ctx *context_module.Context, isEnable bool) {
 	workflow := ctx.FormString("workflow")
 	if len(workflow) == 0 {
-		ctx.ServerError("workflow", nil)
+		ctx.JSONError("workflow is required")
 		return
 	}
 
@@ -1096,14 +1124,14 @@ func disableOrEnableWorkflowFile(ctx *context_module.Context, isEnable bool) {
 		ctx.Flash.Success(ctx.Tr("actions.workflow.disable_success", workflow))
 	}
 
-	redirectURL := fmt.Sprintf("%s/actions?workflow=%s&actor=%s&status=%s", ctx.Repo.RepoLink, url.QueryEscape(workflow),
-		url.QueryEscape(ctx.FormString("actor")), url.QueryEscape(ctx.FormString("status")))
+	redirectURL := actionsListRedirectURL(ctx.Repo.RepoLink, workflow,
+		ctx.FormString("actor"), ctx.FormString("status"), ctx.FormString("branch"))
 	ctx.JSONRedirect(redirectURL)
 }
 
 func Run(ctx *context_module.Context) {
-	redirectURL := fmt.Sprintf("%s/actions?workflow=%s&actor=%s&status=%s", ctx.Repo.RepoLink, url.QueryEscape(ctx.FormString("workflow")),
-		url.QueryEscape(ctx.FormString("actor")), url.QueryEscape(ctx.FormString("status")))
+	redirectURL := actionsListRedirectURL(ctx.Repo.RepoLink, ctx.FormString("workflow"),
+		ctx.FormString("actor"), ctx.FormString("status"), ctx.FormString("branch"))
 
 	workflowID := ctx.FormString("workflow")
 	if len(workflowID) == 0 {
diff --git a/routers/web/repo/actions/view_test.go b/routers/web/repo/actions/view_test.go
index 7296ea68497..737ac5e1b3a 100644
--- a/routers/web/repo/actions/view_test.go
+++ b/routers/web/repo/actions/view_test.go
@@ -6,9 +6,9 @@ package actions
 import (
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/translation"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -45,3 +45,34 @@ func TestConvertToViewModel(t *testing.T) {
 	}
 	assert.Equal(t, expectedViewJobs, viewJobSteps)
 }
+
+func TestConvertToViewModelCancellingTaskDoesNotRenderRunningSteps(t *testing.T) {
+	task := &actions_model.ActionTask{
+		Status: actions_model.StatusCancelling,
+		Steps: []*actions_model.ActionTaskStep{
+			{Name: "Run step-name", Index: 0, Status: actions_model.StatusRunning, LogLength: 1},
+		},
+	}
+
+	viewJobSteps, _, err := convertToViewModel(t.Context(), translation.MockLocale{}, nil, task)
+	require.NoError(t, err)
+
+	expectedViewJobs := []*ViewJobStep{
+		{
+			Summary:  "Set up job",
+			Duration: "0s",
+			Status:   "success",
+		},
+		{
+			Summary:  "Run step-name",
+			Duration: "0s",
+			Status:   "cancelling",
+		},
+		{
+			Summary:  "Complete job",
+			Duration: "0s",
+			Status:   "waiting",
+		},
+	}
+	assert.Equal(t, expectedViewJobs, viewJobSteps)
+}
diff --git a/routers/web/repo/activity.go b/routers/web/repo/activity.go
index 420fa6d557f..432617f9952 100644
--- a/routers/web/repo/activity.go
+++ b/routers/web/repo/activity.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	activities_model "gitea.dev/models/activities"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/repo/attachment.go b/routers/web/repo/attachment.go
index bb2002521c5..6f2968691c3 100644
--- a/routers/web/repo/attachment.go
+++ b/routers/web/repo/attachment.go
@@ -6,21 +6,33 @@ package repo
 import (
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/services/attachment"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	repo_service "code.gitea.io/gitea/services/repository"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/services/attachment"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	repo_service "gitea.dev/services/repository"
 )
 
+func attachmentReadScope(unitType unit.Type) (auth_model.AccessTokenScope, bool) {
+	switch unitType {
+	case unit.TypeIssues, unit.TypePullRequests:
+		return auth_model.AccessTokenScopeReadIssue, true
+	case unit.TypeReleases:
+		return auth_model.AccessTokenScopeReadRepository, true
+	default:
+		return "", false
+	}
+}
+
 // UploadIssueAttachment response for Issue/PR attachments
 func UploadIssueAttachment(ctx *context.Context) {
 	uploadAttachment(ctx, ctx.Repo.Repository.ID, attachment.UploadAttachmentForIssue)
@@ -150,9 +162,12 @@ func ServeAttachment(ctx *context.Context, uuid string) {
 			return
 		}
 	} else { // If we have the linked type, we need to check access
-		var perm access_model.Permission
-		if ctx.Repo.Repository == nil {
-			repo, err := repo_model.GetRepositoryByID(ctx, repoID)
+		var (
+			perm access_model.Permission
+			repo = ctx.Repo.Repository
+		)
+		if repo == nil {
+			repo, err = repo_model.GetRepositoryByID(ctx, repoID)
 			if err != nil {
 				ctx.ServerError("GetRepositoryByID", err)
 				return
@@ -170,6 +185,13 @@ func ServeAttachment(ctx *context.Context, uuid string) {
 			ctx.HTTPError(http.StatusNotFound)
 			return
 		}
+
+		if requiredScope, ok := attachmentReadScope(unitType); ok {
+			context.CheckTokenScopes(ctx, repo, requiredScope)
+			if ctx.Written() {
+				return
+			}
+		}
 	}
 
 	if err := attach.IncreaseDownloadCount(ctx); err != nil {
diff --git a/routers/web/repo/blame.go b/routers/web/repo/blame.go
index 4fb61bee6da..6b97a58c17e 100644
--- a/routers/web/repo/blame.go
+++ b/routers/web/repo/blame.go
@@ -12,18 +12,18 @@ import (
 	"path"
 	"strconv"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/languagestats"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/highlight"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/languagestats"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/highlight"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 type blameRow struct {
@@ -231,7 +231,7 @@ func renderBlameFillFirstBlameRow(repoLink string, avatarUtils *templates.Avatar
 	br.PreviousSha = part.PreviousSha
 	br.PreviousShaURL = fmt.Sprintf("%s/blame/commit/%s/%s", repoLink, url.PathEscape(part.PreviousSha), util.PathEscapeSegments(part.PreviousPath))
 	br.CommitURL = fmt.Sprintf("%s/commit/%s", repoLink, url.PathEscape(part.Sha))
-	br.CommitMessage = commit.CommitMessage
+	br.CommitMessage = commit.MessageUTF8()
 	br.CommitSince = templates.TimeSince(commit.Author.When)
 }
 
diff --git a/routers/web/repo/branch.go b/routers/web/repo/branch.go
index ce0e0b03abf..aa3ad614c65 100644
--- a/routers/web/repo/branch.go
+++ b/routers/web/repo/branch.go
@@ -11,24 +11,24 @@ import (
 	"net/url"
 	"strings"
 
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	pull_service "code.gitea.io/gitea/services/pull"
-	release_service "code.gitea.io/gitea/services/release"
-	repo_service "code.gitea.io/gitea/services/repository"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	pull_service "gitea.dev/services/pull"
+	release_service "gitea.dev/services/release"
+	repo_service "gitea.dev/services/repository"
 )
 
 const (
diff --git a/routers/web/repo/code_frequency.go b/routers/web/repo/code_frequency.go
index 2b2dd5744a2..15281ea74a4 100644
--- a/routers/web/repo/code_frequency.go
+++ b/routers/web/repo/code_frequency.go
@@ -7,9 +7,9 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
-	contributors_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
+	contributors_service "gitea.dev/services/repository"
 )
 
 const (
diff --git a/routers/web/repo/commit.go b/routers/web/repo/commit.go
index 84b51bba5f4..0760cb4eeda 100644
--- a/routers/web/repo/commit.go
+++ b/routers/web/repo/commit.go
@@ -11,30 +11,30 @@ import (
 	"net/http"
 	"strings"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/renderhelper"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/context"
-	git_service "code.gitea.io/gitea/services/git"
-	"code.gitea.io/gitea/services/gitdiff"
-	repo_service "code.gitea.io/gitea/services/repository"
-	"code.gitea.io/gitea/services/repository/gitgraph"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/renderhelper"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/context"
+	git_service "gitea.dev/services/git"
+	"gitea.dev/services/gitdiff"
+	repo_service "gitea.dev/services/repository"
+	"gitea.dev/services/repository/gitgraph"
 )
 
 const (
@@ -349,7 +349,7 @@ func Diff(ctx *context.Context) {
 		parentCommitID = parentCommit.ID.String()
 	}
 	setCompareContext(ctx, parentCommit, commit, userName, repoName)
-	ctx.Data["Title"] = commit.Summary() + " · " + base.ShortSha(commitID)
+	ctx.Data["Title"] = commit.MessageTitle() + " · " + base.ShortSha(commitID)
 	ctx.Data["Commit"] = commit
 	ctx.Data["Diff"] = diff
 	ctx.Data["DiffBlobExcerptData"] = diffBlobExcerptData
diff --git a/routers/web/repo/common_recentbranches.go b/routers/web/repo/common_recentbranches.go
index c749f15755c..4006e032075 100644
--- a/routers/web/repo/common_recentbranches.go
+++ b/routers/web/repo/common_recentbranches.go
@@ -4,12 +4,12 @@
 package repo
 
 import (
-	git_model "code.gitea.io/gitea/models/git"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	unit_model "code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	git_model "gitea.dev/models/git"
+	access_model "gitea.dev/models/perm/access"
+	unit_model "gitea.dev/models/unit"
+	"gitea.dev/modules/log"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 )
 
 type RecentBranchesPromptDataStruct struct {
diff --git a/routers/web/repo/compare.go b/routers/web/repo/compare.go
index 83451843ceb..2b2848afd15 100644
--- a/routers/web/repo/compare.go
+++ b/routers/web/repo/compare.go
@@ -15,34 +15,34 @@ import (
 	"strings"
 	"unicode"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/charset"
-	csv_module "code.gitea.io/gitea/modules/csv"
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	git_service "code.gitea.io/gitea/services/git"
-	"code.gitea.io/gitea/services/gitdiff"
-	user_service "code.gitea.io/gitea/services/user"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/charset"
+	csv_module "gitea.dev/modules/csv"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	git_service "gitea.dev/services/git"
+	"gitea.dev/services/gitdiff"
+	user_service "gitea.dev/services/user"
 )
 
 const (
@@ -391,17 +391,14 @@ func prepareNewPullRequestTitleContent(ci *git_service.CompareInfo, commits []*g
 	if useFirstCommitAsTitle {
 		// the "commits" are from "ShowPrettyFormatLogToList", which is ordered from newest to oldest, here take the oldest one
 		c := commits[len(commits)-1]
-		title = strings.TrimSpace(c.UserCommit.Summary())
+		title = c.UserCommit.MessageTitle()
 	} else {
 		title = autoTitleFromBranchName(ci.HeadRef.ShortName())
 	}
 
 	if len(commits) == 1 {
-		// FIXME: GIT-COMMIT-MESSAGE-ENCODING: try to convert the encoding for commit message explicitly, ideally it should be done by a git commit struct method
 		c := commits[0]
-		_, content, _ = strings.Cut(strings.TrimSpace(c.UserCommit.CommitMessage), "\n")
-		content = strings.TrimSpace(content)
-		content = string(charset.ToUTF8([]byte(content), charset.ConvertOpts{}))
+		content = c.MessageBody()
 	}
 
 	var titleTrailer string
@@ -624,7 +621,6 @@ func (cpi *comparePageInfoType) prepareCreatePullRequestPage(ctx *context.Contex
 				return
 			}
 			ctx.Data["PullRequest"] = pr
-			ctx.HTML(http.StatusOK, tplCompareDiff)
 			return
 		}
 
diff --git a/routers/web/repo/compare_test.go b/routers/web/repo/compare_test.go
index 63b0f287e5a..d5b67ebe56e 100644
--- a/routers/web/repo/compare_test.go
+++ b/routers/web/repo/compare_test.go
@@ -6,16 +6,15 @@ package repo
 import (
 	"strings"
 	"testing"
-	"unicode/utf8"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	git_service "code.gitea.io/gitea/services/git"
-	"code.gitea.io/gitea/services/gitdiff"
+	asymkey_model "gitea.dev/models/asymkey"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	git_service "gitea.dev/services/git"
+	"gitea.dev/services/gitdiff"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -55,7 +54,7 @@ func TestNewPullRequestTitleContent(t *testing.T) {
 			SignCommit: &asymkey_model.SignCommit{
 				UserCommit: &user_model.UserCommit{
 					Commit: &git.Commit{
-						CommitMessage: msg,
+						CommitMessage: git.CommitMessage{MessageRaw: msg},
 					},
 				},
 			},
@@ -99,9 +98,9 @@ func TestNewPullRequestTitleContent(t *testing.T) {
 	assert.Equal(t, "title-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa…", title)
 	assert.Equal(t, "…aaaaaaaaa\n", content)
 
-	title, content = prepareNewPullRequestTitleContent(ci, []*git_model.SignCommitWithStatuses{mockCommit("a\xf0\xf0\xf0\nb\xf0\xf0\xf0")}, setting.RepoPRTitleSourceFirstCommit)
-	assert.Equal(t, "a?", title) // FIXME: GIT-COMMIT-MESSAGE-ENCODING: "title" doesn't use the same charset converting logic as "content"
-	assert.Equal(t, "b"+string(utf8.RuneError)+string(utf8.RuneError), content)
+	title, content = prepareNewPullRequestTitleContent(ci, []*git_model.SignCommitWithStatuses{mockCommit("title \xf0\nbody \xf0")}, setting.RepoPRTitleSourceFirstCommit)
+	assert.Equal(t, "title ð", title)
+	assert.Equal(t, "body ð", content)
 }
 
 func TestAutoTitleFromBranchName(t *testing.T) {
diff --git a/routers/web/repo/contributors.go b/routers/web/repo/contributors.go
index 93dec1f3503..941f934d11d 100644
--- a/routers/web/repo/contributors.go
+++ b/routers/web/repo/contributors.go
@@ -7,9 +7,9 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
-	contributors_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
+	contributors_service "gitea.dev/services/repository"
 )
 
 const (
diff --git a/routers/web/repo/download.go b/routers/web/repo/download.go
index 25166ea1d3d..e92e44532a9 100644
--- a/routers/web/repo/download.go
+++ b/routers/web/repo/download.go
@@ -7,17 +7,23 @@ package repo
 import (
 	"time"
 
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
+	auth_model "gitea.dev/models/auth"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
 )
 
+func checkDownloadTokenScope(ctx *context.Context) bool {
+	context.CheckRepoScopedToken(ctx, ctx.Repo.Repository, auth_model.Read)
+	return !ctx.Written()
+}
+
 // ServeBlobOrLFS download a git.Blob redirecting to LFS if necessary
 func ServeBlobOrLFS(ctx *context.Context, blob *git.Blob, lastModified *time.Time) error {
 	if httpcache.HandleGenericETagPrivateCache(ctx.Req, ctx.Resp, `"`+blob.ID.String()+`"`, lastModified) {
@@ -88,6 +94,10 @@ func getBlobForEntry(ctx *context.Context) (*git.Blob, *time.Time) {
 
 // SingleDownload download a file by repos path
 func SingleDownload(ctx *context.Context) {
+	if !checkDownloadTokenScope(ctx) {
+		return
+	}
+
 	blob, lastModified := getBlobForEntry(ctx)
 	if blob == nil {
 		return
@@ -100,6 +110,10 @@ func SingleDownload(ctx *context.Context) {
 
 // SingleDownloadOrLFS download a file by repos path redirecting to LFS if necessary
 func SingleDownloadOrLFS(ctx *context.Context) {
+	if !checkDownloadTokenScope(ctx) {
+		return
+	}
+
 	blob, lastModified := getBlobForEntry(ctx)
 	if blob == nil {
 		return
@@ -112,6 +126,10 @@ func SingleDownloadOrLFS(ctx *context.Context) {
 
 // DownloadByID download a file by sha1 ID
 func DownloadByID(ctx *context.Context) {
+	if !checkDownloadTokenScope(ctx) {
+		return
+	}
+
 	blob, err := ctx.Repo.GitRepo.GetBlob(ctx.PathParam("sha"))
 	if err != nil {
 		if git.IsErrNotExist(err) {
@@ -128,6 +146,10 @@ func DownloadByID(ctx *context.Context) {
 
 // DownloadByIDOrLFS download a file by sha1 ID taking account of LFS
 func DownloadByIDOrLFS(ctx *context.Context) {
+	if !checkDownloadTokenScope(ctx) {
+		return
+	}
+
 	blob, err := ctx.Repo.GitRepo.GetBlob(ctx.PathParam("sha"))
 	if err != nil {
 		if git.IsErrNotExist(err) {
diff --git a/routers/web/repo/editor.go b/routers/web/repo/editor.go
index 0aa32716836..95928d87032 100644
--- a/routers/web/repo/editor.go
+++ b/routers/web/repo/editor.go
@@ -11,21 +11,21 @@ import (
 	"path"
 	"strings"
 
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	"code.gitea.io/gitea/services/forms"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/issues"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	"gitea.dev/services/forms"
+	files_service "gitea.dev/services/repository/files"
 )
 
 const (
diff --git a/routers/web/repo/editor_apply_patch.go b/routers/web/repo/editor_apply_patch.go
index 111e0161f24..d87096cef29 100644
--- a/routers/web/repo/editor_apply_patch.go
+++ b/routers/web/repo/editor_apply_patch.go
@@ -7,10 +7,10 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/repository/files"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/repository/files"
 )
 
 func NewDiffPatch(ctx *context.Context) {
diff --git a/routers/web/repo/editor_cherry_pick.go b/routers/web/repo/editor_cherry_pick.go
index 605a35b1008..18138d32cd9 100644
--- a/routers/web/repo/editor_cherry_pick.go
+++ b/routers/web/repo/editor_cherry_pick.go
@@ -6,14 +6,13 @@ package repo
 import (
 	"bytes"
 	"net/http"
-	"strings"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/repository/files"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/repository/files"
 )
 
 func CherryPick(ctx *context.Context) {
@@ -33,10 +32,10 @@ func CherryPick(ctx *context.Context) {
 	if ctx.FormString("cherry-pick-type") == "revert" {
 		ctx.Data["CherryPickType"] = "revert"
 		ctx.Data["commit_summary"] = "revert " + ctx.PathParam("sha")
-		ctx.Data["commit_message"] = "revert " + cherryPickCommit.Message()
+		ctx.Data["commit_message"] = "revert " + cherryPickCommit.MessageUTF8()
 	} else {
 		ctx.Data["CherryPickType"] = "cherry-pick"
-		ctx.Data["commit_summary"], ctx.Data["commit_message"], _ = strings.Cut(cherryPickCommit.Message(), "\n")
+		ctx.Data["commit_summary"], ctx.Data["commit_message"] = cherryPickCommit.MessageTitle(), cherryPickCommit.MessageBody()
 	}
 
 	ctx.HTML(http.StatusOK, tplCherryPick)
diff --git a/routers/web/repo/editor_error.go b/routers/web/repo/editor_error.go
index f23b2738e5e..902f3e3c441 100644
--- a/routers/web/repo/editor_error.go
+++ b/routers/web/repo/editor_error.go
@@ -6,14 +6,14 @@ package repo
 import (
 	"errors"
 
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/utils"
-	context_service "code.gitea.io/gitea/services/context"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/utils"
+	context_service "gitea.dev/services/context"
+	files_service "gitea.dev/services/repository/files"
 )
 
 func errorAs[T error](v error) (e T, ok bool) {
diff --git a/routers/web/repo/editor_fork.go b/routers/web/repo/editor_fork.go
index b78a634c005..4e90af0243e 100644
--- a/routers/web/repo/editor_fork.go
+++ b/routers/web/repo/editor_fork.go
@@ -6,9 +6,9 @@ package repo
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 )
 
 const tplEditorFork templates.TplName = "repo/editor/fork"
diff --git a/routers/web/repo/editor_preview.go b/routers/web/repo/editor_preview.go
index ec1f41a0135..5fc0d38ccab 100644
--- a/routers/web/repo/editor_preview.go
+++ b/routers/web/repo/editor_preview.go
@@ -6,9 +6,9 @@ package repo
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
+	files_service "gitea.dev/services/repository/files"
 )
 
 func DiffPreviewPost(ctx *context.Context) {
diff --git a/routers/web/repo/editor_test.go b/routers/web/repo/editor_test.go
index 3ba75d5d706..73fc92e8a12 100644
--- a/routers/web/repo/editor_test.go
+++ b/routers/web/repo/editor_test.go
@@ -6,9 +6,9 @@ package repo
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/gitrepo"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/gitrepo"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/repo/editor_uploader.go b/routers/web/repo/editor_uploader.go
index 5ad07cda743..a6d5512b9c2 100644
--- a/routers/web/repo/editor_uploader.go
+++ b/routers/web/repo/editor_uploader.go
@@ -6,12 +6,12 @@ package repo
 import (
 	"net/http"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	files_service "gitea.dev/services/repository/files"
 )
 
 // UploadFileToServer upload file to server file dir not git
diff --git a/routers/web/repo/editor_util.go b/routers/web/repo/editor_util.go
index 7155b6e99dc..c23eee18fcd 100644
--- a/routers/web/repo/editor_util.go
+++ b/routers/web/repo/editor_util.go
@@ -10,17 +10,17 @@ import (
 	"strconv"
 	"strings"
 
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	context_service "code.gitea.io/gitea/services/context"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	context_service "gitea.dev/services/context"
 )
 
 // getUniquePatchBranchName Gets a unique branch name for a new patch branch
diff --git a/routers/web/repo/fork.go b/routers/web/repo/fork.go
index c2694e540f7..7b97e66bad7 100644
--- a/routers/web/repo/fork.go
+++ b/routers/web/repo/fork.go
@@ -8,21 +8,21 @@ import (
 	"net/http"
 	"net/url"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	repo_service "gitea.dev/services/repository"
 )
 
 const (
diff --git a/routers/web/repo/githttp.go b/routers/web/repo/githttp.go
index 928c78a61ff..c1c2ed5e86b 100644
--- a/routers/web/repo/githttp.go
+++ b/routers/web/repo/githttp.go
@@ -17,21 +17,21 @@ import (
 	"sync"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 
 	"github.com/go-chi/cors"
 )
@@ -180,8 +180,8 @@ func httpBase(ctx *context.Context, optGitService ...string) *serviceHandler {
 		}
 
 		if repoExist {
-			// Because of special ref "refs/for" (agit) , need delay write permission check
-			if git.DefaultFeatures().SupportProcReceive {
+			// Only the main code repo accepts refs/for pushes, so wiki pushes must keep write checks.
+			if git.DefaultFeatures().SupportProcReceive && !isWiki {
 				accessMode = perm.AccessModeRead
 			}
 
diff --git a/routers/web/repo/helper.go b/routers/web/repo/helper.go
index 7b92cba0fd3..49d79ec6926 100644
--- a/routers/web/repo/helper.go
+++ b/routers/web/repo/helper.go
@@ -4,8 +4,8 @@
 package repo
 
 import (
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/git"
+	"gitea.dev/services/context"
 )
 
 func HandleGitError(ctx *context.Context, msg string, err error) {
diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go
index 1e0abd6ed2b..e37484e2ad4 100644
--- a/routers/web/repo/issue.go
+++ b/routers/web/repo/issue.go
@@ -12,27 +12,27 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	project_model "code.gitea.io/gitea/models/project"
-	"code.gitea.io/gitea/models/renderhelper"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/optional"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/forms"
-	issue_service "code.gitea.io/gitea/services/issue"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	project_model "gitea.dev/models/project"
+	"gitea.dev/models/renderhelper"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/optional"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/forms"
+	issue_service "gitea.dev/services/issue"
 )
 
 const (
diff --git a/routers/web/repo/issue_comment.go b/routers/web/repo/issue_comment.go
index ccf9a3749cd..4681c2fecd9 100644
--- a/routers/web/repo/issue_comment.go
+++ b/routers/web/repo/issue_comment.go
@@ -10,24 +10,24 @@ import (
 	"net/http"
 	"strconv"
 
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/renderhelper"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/forms"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/renderhelper"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup/markdown"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/forms"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
 )
 
 // NewComment create a comment for issue
diff --git a/routers/web/repo/issue_content_history.go b/routers/web/repo/issue_content_history.go
index 01fb139c1af..08c27fdee34 100644
--- a/routers/web/repo/issue_content_history.go
+++ b/routers/web/repo/issue_content_history.go
@@ -10,12 +10,12 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/models/avatars"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/avatars"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 
 	"github.com/sergi/go-diff/diffmatchpatch"
 )
diff --git a/routers/web/repo/issue_dependency.go b/routers/web/repo/issue_dependency.go
index b5b252f8a14..78437b3736d 100644
--- a/routers/web/repo/issue_dependency.go
+++ b/routers/web/repo/issue_dependency.go
@@ -6,10 +6,10 @@ package repo
 import (
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 // AddDependency adds new dependencies
diff --git a/routers/web/repo/issue_label.go b/routers/web/repo/issue_label.go
index 72a316e98dd..cef75f4bbcb 100644
--- a/routers/web/repo/issue_label.go
+++ b/routers/web/repo/issue_label.go
@@ -7,19 +7,19 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/modules/label"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	shared_label "code.gitea.io/gitea/routers/web/shared/label"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	issue_service "code.gitea.io/gitea/services/issue"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	"gitea.dev/modules/label"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	shared_label "gitea.dev/routers/web/shared/label"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	issue_service "gitea.dev/services/issue"
 )
 
 const (
diff --git a/routers/web/repo/issue_label_test.go b/routers/web/repo/issue_label_test.go
index f4eca26f8ed..7e141b0a65a 100644
--- a/routers/web/repo/issue_label_test.go
+++ b/routers/web/repo/issue_label_test.go
@@ -9,14 +9,14 @@ import (
 	"strings"
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/contexttest"
-	"code.gitea.io/gitea/services/forms"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/contexttest"
+	"gitea.dev/services/forms"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/repo/issue_list.go b/routers/web/repo/issue_list.go
index fc891ac8e44..5ccef292a20 100644
--- a/routers/web/repo/issue_list.go
+++ b/routers/web/repo/issue_list.go
@@ -12,26 +12,26 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	issue_indexer "code.gitea.io/gitea/modules/indexer/issues"
-	db_indexer "code.gitea.io/gitea/modules/indexer/issues/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/routers/web/shared/issue"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	issue_indexer "gitea.dev/modules/indexer/issues"
+	db_indexer "gitea.dev/modules/indexer/issues/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/common"
+	"gitea.dev/routers/web/shared/issue"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
 )
 
 func retrieveProjectsForIssueList(ctx *context.Context, repo *repo_model.Repository) {
diff --git a/routers/web/repo/issue_lock.go b/routers/web/repo/issue_lock.go
index bc8aabd90b6..dfc7d51ebbc 100644
--- a/routers/web/repo/issue_lock.go
+++ b/routers/web/repo/issue_lock.go
@@ -4,10 +4,10 @@
 package repo
 
 import (
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 // LockIssue locks an issue. This would limit commenting abilities to
diff --git a/routers/web/repo/issue_new.go b/routers/web/repo/issue_new.go
index d442f2804f2..b6422900cb4 100644
--- a/routers/web/repo/issue_new.go
+++ b/routers/web/repo/issue_new.go
@@ -14,26 +14,26 @@ import (
 	"strconv"
 	"strings"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	issue_template "code.gitea.io/gitea/modules/issue/template"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/utils"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	"code.gitea.io/gitea/services/forms"
-	issue_service "code.gitea.io/gitea/services/issue"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	issue_template "gitea.dev/modules/issue/template"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/utils"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	"gitea.dev/services/forms"
+	issue_service "gitea.dev/services/issue"
 )
 
 // Tries to load and set an issue template. The first return value indicates if a template was loaded.
diff --git a/routers/web/repo/issue_page_meta.go b/routers/web/repo/issue_page_meta.go
index 428171dd0ee..3ef8826ce7b 100644
--- a/routers/web/repo/issue_page_meta.go
+++ b/routers/web/repo/issue_page_meta.go
@@ -8,18 +8,18 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/optional"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
 )
 
 type issueSidebarMilestoneData struct {
diff --git a/routers/web/repo/issue_pin.go b/routers/web/repo/issue_pin.go
index 8d3de90d25c..04c281908a4 100644
--- a/routers/web/repo/issue_pin.go
+++ b/routers/web/repo/issue_pin.go
@@ -6,11 +6,11 @@ package repo
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/services/context"
 )
 
 // IssuePinOrUnpin pin or unpin a Issue
diff --git a/routers/web/repo/issue_poster.go b/routers/web/repo/issue_poster.go
index 4f00f40a91f..09c941509f6 100644
--- a/routers/web/repo/issue_poster.go
+++ b/routers/web/repo/issue_poster.go
@@ -8,10 +8,10 @@ import (
 	"slices"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
 )
 
 type userSearchInfo struct {
diff --git a/routers/web/repo/issue_stopwatch.go b/routers/web/repo/issue_stopwatch.go
index 2de3a7cfecd..9b6d83f8c8a 100644
--- a/routers/web/repo/issue_stopwatch.go
+++ b/routers/web/repo/issue_stopwatch.go
@@ -4,10 +4,10 @@
 package repo
 
 import (
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/eventsource"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/eventsource"
+	"gitea.dev/services/context"
 )
 
 // IssueStartStopwatch creates a stopwatch for the given issue.
diff --git a/routers/web/repo/issue_suggestions.go b/routers/web/repo/issue_suggestions.go
index 592cc7b1d53..f5c3042faff 100644
--- a/routers/web/repo/issue_suggestions.go
+++ b/routers/web/repo/issue_suggestions.go
@@ -6,10 +6,10 @@ package repo
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/services/context"
-	issue_service "code.gitea.io/gitea/services/issue"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/optional"
+	"gitea.dev/services/context"
+	issue_service "gitea.dev/services/issue"
 )
 
 // IssueSuggestions returns a list of issue suggestions
diff --git a/routers/web/repo/issue_test.go b/routers/web/repo/issue_test.go
index f1d0aac72ff..bdfce6af5c9 100644
--- a/routers/web/repo/issue_test.go
+++ b/routers/web/repo/issue_test.go
@@ -6,7 +6,7 @@ package repo
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
+	issues_model "gitea.dev/models/issues"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/repo/issue_timetrack.go b/routers/web/repo/issue_timetrack.go
index e93a3107a3d..40f0ead68ab 100644
--- a/routers/web/repo/issue_timetrack.go
+++ b/routers/web/repo/issue_timetrack.go
@@ -8,13 +8,13 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	issue_service "code.gitea.io/gitea/services/issue"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	issue_service "gitea.dev/services/issue"
 )
 
 // AddTimeManually tracks time manually
diff --git a/routers/web/repo/issue_view.go b/routers/web/repo/issue_view.go
index 852b880ab05..b593ad5c34d 100644
--- a/routers/web/repo/issue_view.go
+++ b/routers/web/repo/issue_view.go
@@ -10,33 +10,34 @@ import (
 	"sort"
 	"strconv"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	project_model "code.gitea.io/gitea/models/project"
-	"code.gitea.io/gitea/models/renderhelper"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/emoji"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates/vars"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web/middleware"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
-	user_service "code.gitea.io/gitea/services/user"
+	activities_model "gitea.dev/models/activities"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	project_model "gitea.dev/models/project"
+	"gitea.dev/models/renderhelper"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/emoji"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/templates/vars"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web/middleware"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
+	user_service "gitea.dev/services/user"
 )
 
 // roleDescriptor returns the role descriptor for a comment in/with the given repo, poster and issue
@@ -484,26 +485,57 @@ func prepareIssueViewSidebarDependency(ctx *context.Context, issue *issues_model
 	ctx.Data["BlockingDependencies"], ctx.Data["BlockingDependenciesNotPermitted"] = checkBlockedByIssues(ctx, blocking)
 }
 
-func (prInfo *pullRequestViewInfo) prepareMergeBoxRequireSigning(ctx *context.Context) {
+func (prInfo *pullRequestViewInfo) prepareMergeBoxCommitSigning(ctx *context.Context) {
 	pull := prInfo.issue.PullRequest
-	willSign := false
+	data := prInfo.MergeBoxData
+
+	pb := prInfo.ProtectedBranchRule
+	data.requireSigned = pb != nil && pb.RequireSignedCommits
+
+	wontSignReason := ""
 	if ctx.Doer != nil {
 		sign, key, _, err := asymkey_service.SignMerge(ctx, pull, ctx.Doer, ctx.Repo.GitRepo)
-		willSign = sign
-		ctx.Data["SigningKeyMergeDisplay"] = asymkey_model.GetDisplaySigningKey(key)
+		data.willSign = sign
+		data.signingKeyMergeDisplay = asymkey_model.GetDisplaySigningKey(key)
 		if err != nil {
 			if asymkey_service.IsErrWontSign(err) {
-				ctx.Data["WontSignReason"] = err.(*asymkey_service.ErrWontSign).Reason
+				wontSignReason = string(err.(*asymkey_service.ErrWontSign).Reason)
 			} else {
-				ctx.Data["WontSignReason"] = "error"
+				wontSignReason = "error"
 				log.Error("Error whilst checking if could sign pr %d in repo %s. Error: %v", pull.ID, pull.BaseRepo.FullName(), err)
 			}
 		}
-	} else {
-		ctx.Data["WontSignReason"] = "not_signed_in"
 	}
-	ctx.Data["WillSign"] = willSign
-	prInfo.MergeBoxData.willSign = willSign
+
+	if data.willSign {
+		prInfo.MergeBoxData.infoMergePrompts.AddInfoItem(
+			svg.RenderHTML("octicon-lock", 16, "tw-text-green"),
+			ctx.Locale.Tr("repo.signing.will_sign", data.signingKeyMergeDisplay),
+		)
+	}
+
+	if !data.requireSigned {
+		if wontSignReason != "" {
+			data.infoMergePrompts.AddInfoItem(
+				svg.RenderHTML("octicon-unlock"),
+				ctx.Locale.Tr("repo.signing.wont_sign."+wontSignReason),
+			)
+		}
+		return
+	}
+
+	if data.requireSigned && !data.willSign {
+		data.infoProtectionBlockers.AddErrorItem(
+			svg.RenderHTML("octicon-x"),
+			ctx.Locale.Tr("repo.pulls.require_signed_wont_sign"),
+		)
+		if wontSignReason != "" {
+			data.infoProtectionBlockers.AddInfoItem(
+				svg.RenderHTML("octicon-unlock"),
+				ctx.Locale.Tr("repo.signing.wont_sign."+wontSignReason),
+			)
+		}
+	}
 }
 
 func prepareIssueViewSidebarWatch(ctx *context.Context, issue *issues_model.Issue) {
@@ -571,8 +603,7 @@ func (prInfo *pullRequestViewInfo) prepareMergeBoxDeleteBranch(ctx *context.Cont
 
 		isPullBranchDeletable = !exist
 	}
-	ctx.Data["IsPullBranchDeletable"] = isPullBranchDeletable
-	prInfo.MergeBoxData.isPullBranchDeletable = isPullBranchDeletable
+	prInfo.MergeBoxData.IsPullBranchDeletable = isPullBranchDeletable
 }
 
 func prepareIssueViewSidebarPin(ctx *context.Context, issue *issues_model.Issue) {
@@ -829,31 +860,19 @@ func (prInfo *pullRequestViewInfo) prepareMergeBox(ctx *context.Context, issue *
 	data := &pullMergeBoxData{}
 	prInfo.MergeBoxData = data
 
-	statusCheckData := prInfo.StatusCheckData
-	if statusCheckData == nil {
-		statusCheckData = &pullCommitStatusCheckData{} // make the following logic easier, no need to keep checking "nil"
-	}
-
 	canDelete := false
-	allowMerge := false
 	canWriteToHeadRepo := false
 
 	pull_service.StartPullRequestCheckOnView(ctx, pull)
 
 	if !prInfo.IsPullRequestBroken {
-		var err error
-		ctx.Data["UpdateAllowed"], ctx.Data["UpdateByRebaseAllowed"], err = pull_service.IsUserAllowedToUpdate(ctx, pull, ctx.Doer)
-		if err != nil {
-			ctx.ServerError("IsUserAllowedToUpdate", err)
+		data.ShowUpdatePullInfo = pull.CommitsBehind > 0 && !issue.IsClosed && !pull.IsChecking() && !pull.IsFilesConflicted() && !prInfo.IsPullRequestBroken
+		prInfo.preparePullUpdateActions(ctx)
+		if ctx.Written() {
 			return
 		}
 	}
 
-	if pull.IsFilesConflicted() {
-		ctx.Data["IsPullFilesConflicted"] = true
-		ctx.Data["ConflictedFiles"] = pull.ConflictedFiles
-	}
-
 	if ctx.IsSigned {
 		if err := pull.LoadHeadRepo(ctx); err != nil {
 			log.Error("LoadHeadRepo: %v", err)
@@ -888,7 +907,7 @@ func (prInfo *pullRequestViewInfo) prepareMergeBox(ctx *context.Context, issue *
 		if !canWriteToHeadRepo { // maintainers maybe allowed to push to head repo even if they can't write to it
 			canWriteToHeadRepo = pull.AllowMaintainerEdit && perm.CanWrite(unit.TypeCode)
 		}
-		allowMerge, err = pull_service.IsUserAllowedToMerge(ctx, pull, perm, ctx.Doer)
+		data.hasPermToMerge, err = pull_service.IsUserAllowedToMerge(ctx, pull, perm, ctx.Doer)
 		if err != nil {
 			ctx.ServerError("IsUserAllowedToMerge", err)
 			return
@@ -903,38 +922,13 @@ func (prInfo *pullRequestViewInfo) prepareMergeBox(ctx *context.Context, issue *
 	data.ReloadingInterval = util.Iif(pull.IsChecking(), 2000, 0)
 	data.ShowMergeInstructions = canWriteToHeadRepo
 	data.ShowPullCommands = pull.HeadRepo != nil && !pull.HasMerged && !issue.IsClosed
-	ctx.Data["AllowMerge"] = allowMerge
 
-	pb := prInfo.ProtectedBranchRule
-	if pb != nil {
-		pb.Repo = pull.BaseRepo
-		ctx.Data["ProtectedBranch"] = pb
-
-		data.isBlockedByApprovals = !issues_model.HasEnoughApprovals(ctx, pb, pull)
-		ctx.Data["IsBlockedByApprovals"] = data.isBlockedByApprovals
-
-		data.isBlockedByRejection = issues_model.MergeBlockedByRejectedReview(ctx, pb, pull)
-		ctx.Data["IsBlockedByRejection"] = data.isBlockedByRejection
-
-		data.isBlockedByOfficialReviewRequests = issues_model.MergeBlockedByOfficialReviewRequests(ctx, pb, pull)
-		ctx.Data["IsBlockedByOfficialReviewRequests"] = data.isBlockedByOfficialReviewRequests
-
-		data.isBlockedByOutdatedBranch = issues_model.MergeBlockedByOutdatedBranch(pb, pull)
-		ctx.Data["IsBlockedByOutdatedBranch"] = data.isBlockedByOutdatedBranch
-
-		data.isBlockedByChangedProtectedFiles = len(pull.ChangedProtectedFiles) != 0
-		ctx.Data["IsBlockedByChangedProtectedFiles"] = data.isBlockedByChangedProtectedFiles
-
-		data.requireSigned = pb.RequireSignedCommits
-		ctx.Data["RequireSigned"] = data.requireSigned
-
-		ctx.Data["GrantedApprovals"] = issues_model.GetGrantedApprovalsCount(ctx, pb, pull)
-		ctx.Data["ChangedProtectedFiles"] = pull.ChangedProtectedFiles
-		ctx.Data["ChangedProtectedFilesNum"] = len(pull.ChangedProtectedFiles)
-		ctx.Data["RequireApprovalsWhitelist"] = pb.EnableApprovalsWhitelist
+	prInfo.prepareMergeBoxProtectionChecks(ctx)
+	if ctx.Written() {
+		return
 	}
 
-	prInfo.prepareMergeBoxRequireSigning(ctx)
+	prInfo.prepareMergeBoxCommitSigning(ctx)
 	if ctx.Written() {
 		return
 	}
@@ -947,48 +941,145 @@ func (prInfo *pullRequestViewInfo) prepareMergeBox(ctx *context.Context, issue *
 	prConfig := issue.Repo.MustGetUnit(ctx, unit.TypePullRequests).PullRequestsConfig()
 	data.AutodetectManualMerge = prConfig.AutodetectManualMerge
 
-	stillCanManualMerge := func() bool {
-		if pull.HasMerged || issue.IsClosed || !ctx.IsSigned {
-			return false
-		}
-		if pull.IsStatusMergeable() || pull.IsWorkInProgress(ctx) || pull.IsChecking() {
-			return false
-		}
-		return allowMerge && prConfig.AllowManualMerge
-	}
-
-	ctx.Data["StillCanManualMerge"] = stillCanManualMerge()
-
-	enableStatusCheck := pb != nil && pb.EnableStatusCheck
-	ctx.Data["EnableStatusCheck"] = enableStatusCheck
-
 	// Only show the merge box if the PR is not merged, or the branch is deletable.
 	// Otherwise, there is nothing to do, because the PR view page already contains enough information.
-	data.ShowMergeBox = !pull.HasMerged || data.isPullBranchDeletable
+	data.ShowMergeBox = !pull.HasMerged || data.IsPullBranchDeletable
 
 	isRepoAdmin := ctx.IsSigned && (ctx.Repo.Permission.IsAdmin() || ctx.Doer.IsAdmin)
 
 	// admin can merge without checks, writer can merge when checks succeed
 	// admin and writer both can make an auto merge schedule (not affected by overridable blockers)
-	data.hasStatusCheckBlocker = enableStatusCheck && !statusCheckData.RequiredChecksState.IsSuccess()
+	data.hasStatusCheckBlocker = data.enableStatusCheck && !data.StatusCheckData.RequiredChecksState.IsSuccess()
 
 	// this logic is from:
 	// {{$notAllOverridableChecksOk := or .IsBlockedByApprovals .IsBlockedByRejection .IsBlockedByOfficialReviewRequests .IsBlockedByOutdatedBranch .IsBlockedByChangedProtectedFiles (and .EnableStatusCheck (not $requiredStatusCheckState.IsSuccess))}}
 	// HINT: if a PR's status is not mergeable, then it is a non-overridable blocker, such logic is handled separately (see IsStatusMergeable)
-	data.HasOverridableBlockers = data.isBlockedByApprovals || data.isBlockedByRejection ||
+	data.hasOverridableBlockers = data.isBlockedByApprovals || data.isBlockedByRejection ||
 		data.isBlockedByOfficialReviewRequests || data.isBlockedByOutdatedBranch || data.isBlockedByChangedProtectedFiles ||
 		data.hasStatusCheckBlocker
 
-	// this logic is from:
-	// {{$canMergeNow := and (or (and (not $.ProtectedBranch.BlockAdminMergeOverride) $.IsRepoAdmin) (not $notAllOverridableChecksOk)) (or (not .AllowMerge) (not .RequireSigned) .WillSign)}}
-	// HINT: legacy "(not .AllowMerge)" is not right (always false, does nothing), fixed here
+	data.canBypassProtection = isRepoAdmin
+	data.canBypassProtectionAsAdmin = isRepoAdmin
+	if ctx.IsSigned && prInfo.ProtectedBranchRule != nil {
+		data.canBypassProtection = git_model.CanBypassBranchProtection(ctx, prInfo.ProtectedBranchRule, ctx.Doer, isRepoAdmin)
+		data.canBypassProtectionAsAdmin = isRepoAdmin && !prInfo.ProtectedBranchRule.BlockAdminMergeOverride
+	}
+
 	// CanMergeNow means: if the doer has write permission, whether the PR can be merged now
-	adminCanOverrideBlockers := (pb == nil || !pb.BlockAdminMergeOverride) && isRepoAdmin
-	data.CanMergeNow = (!data.HasOverridableBlockers || adminCanOverrideBlockers) && // status checks are satisfied
+	data.canMergeNow = (!data.hasOverridableBlockers || data.canBypassProtection) && // status checks are satisfied
 		(!data.requireSigned || data.willSign) // signing requirement is satisfied
 
-	ctx.Data["PullMergeBoxData"] = prInfo.MergeBoxData
 	prInfo.prepareMergeBoxFormProps(ctx)
+	prInfo.prepareMergeBoxInfoItems(ctx)
+	prInfo.prepareMergeBoxIconColor()
+
+	ctx.Data["PullMergeBoxData"] = prInfo.MergeBoxData
+}
+
+func (prInfo *pullRequestViewInfo) preparePullUpdateActions(ctx *context.Context) {
+	pull := prInfo.issue.PullRequest
+	data := prInfo.MergeBoxData
+	userUpdateStyles, err := pull_service.CheckUserAllowedToUpdate(ctx, pull, ctx.Doer)
+	if err != nil {
+		ctx.ServerError("IsUserAllowedToUpdate", err)
+		return
+	}
+	if !userUpdateStyles.MergeAllowed && !userUpdateStyles.RebaseAllowed {
+		return
+	}
+
+	issueLink := prInfo.issue.Link()
+	mergeAction := &pullUpdateAction{
+		URL:  issueLink + "/update?style=merge",
+		Text: ctx.Tr("repo.pulls.update_branch"),
+	}
+	rebaseAction := &pullUpdateAction{
+		URL:  issueLink + "/update?style=rebase",
+		Text: ctx.Tr("repo.pulls.update_branch_rebase"),
+	}
+
+	if userUpdateStyles.MergeAllowed {
+		data.UpdateStyleOptions = append(data.UpdateStyleOptions, mergeAction)
+	}
+	if userUpdateStyles.RebaseAllowed {
+		data.UpdateStyleOptions = append(data.UpdateStyleOptions, rebaseAction)
+	}
+
+	if userUpdateStyles.DefaultUpdateStyle == repo_model.UpdateStyleRebase && userUpdateStyles.RebaseAllowed {
+		data.UpdatePrimaryAction = rebaseAction
+	} else if userUpdateStyles.DefaultUpdateStyle == repo_model.UpdateStyleMerge && userUpdateStyles.MergeAllowed {
+		data.UpdatePrimaryAction = mergeAction
+	} else {
+		data.UpdatePrimaryAction = data.UpdateStyleOptions[0]
+	}
+	data.UpdatePrimaryAction.Selected = true
+}
+
+func (prInfo *pullRequestViewInfo) prepareMergeBoxProtectionChecks(ctx *context.Context) {
+	pb, err := git_model.GetFirstMatchProtectedBranchRule(ctx, ctx.Repo.Repository.ID, prInfo.issue.PullRequest.BaseBranch)
+	if err != nil {
+		ctx.ServerError("GetFirstMatchProtectedBranchRule", err)
+		return
+	}
+	if pb != nil {
+		pb.Repo = prInfo.issue.PullRequest.BaseRepo
+		prInfo.ProtectedBranchRule = pb
+	}
+
+	prInfo.prepareMergeBoxStatusCheckData(ctx)
+	if ctx.Written() {
+		return
+	}
+
+	prInfo.prepareMergeBoxProtectedRules(ctx)
+	if ctx.Written() {
+		return
+	}
+}
+
+func (prInfo *pullRequestViewInfo) prepareMergeBoxProtectedRules(ctx *context.Context) {
+	pb := prInfo.ProtectedBranchRule
+	if pb == nil {
+		return
+	}
+
+	pull := prInfo.issue.PullRequest
+	data := prInfo.MergeBoxData
+
+	data.isBlockedByApprovals = !issues_model.HasEnoughApprovals(ctx, pb, pull)
+	if data.isBlockedByApprovals {
+		grantedApprovals := issues_model.GetGrantedApprovalsCount(ctx, pb, pull)
+		blockerInfo := ctx.Locale.Tr("repo.pulls.blocked_by_approvals", grantedApprovals, pb.RequiredApprovals)
+		if pb.EnableApprovalsWhitelist {
+			blockerInfo = ctx.Locale.Tr("repo.pulls.blocked_by_approvals_whitelisted", grantedApprovals, pb.RequiredApprovals)
+		}
+		data.infoProtectionBlockers.AddErrorItem(svg.RenderHTML("octicon-x"), blockerInfo)
+	}
+
+	data.isBlockedByRejection = issues_model.MergeBlockedByRejectedReview(ctx, pb, pull)
+	if data.isBlockedByRejection {
+		data.infoProtectionBlockers.AddErrorItem(svg.RenderHTML("octicon-x"), ctx.Locale.Tr("repo.pulls.blocked_by_rejection"))
+	}
+
+	data.isBlockedByOfficialReviewRequests = issues_model.MergeBlockedByOfficialReviewRequests(ctx, pb, pull)
+	if data.isBlockedByOfficialReviewRequests {
+		data.infoProtectionBlockers.AddErrorItem(svg.RenderHTML("octicon-x"), ctx.Locale.Tr("repo.pulls.blocked_by_official_review_requests"))
+	}
+
+	data.isBlockedByOutdatedBranch = issues_model.MergeBlockedByOutdatedBranch(pb, pull)
+	if data.isBlockedByOutdatedBranch {
+		data.infoProtectionBlockers.AddErrorItem(svg.RenderHTML("octicon-x"), ctx.Locale.Tr("repo.pulls.blocked_by_outdated_branch"))
+	}
+
+	data.isBlockedByChangedProtectedFiles = len(pull.ChangedProtectedFiles) != 0
+	if data.isBlockedByChangedProtectedFiles {
+		detailItems := escapeStringSliceToHTML(pull.ChangedProtectedFiles)
+		data.infoProtectionBlockers.AddErrorItem(
+			svg.RenderHTML("octicon-x"),
+			ctx.Locale.TrN(len(pull.ChangedProtectedFiles), "repo.pulls.blocked_by_changed_protected_files_1", "repo.pulls.blocked_by_changed_protected_files_n"),
+			detailItems,
+		)
+	}
 }
 
 func prepareIssueViewContent(ctx *context.Context, issue *issues_model.Issue) {
diff --git a/routers/web/repo/issue_watch.go b/routers/web/repo/issue_watch.go
index abb2a81d9e1..c00a8191977 100644
--- a/routers/web/repo/issue_watch.go
+++ b/routers/web/repo/issue_watch.go
@@ -6,10 +6,10 @@ package repo
 import (
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/repo/main_test.go b/routers/web/repo/main_test.go
index 6e469cf2ed7..1c0da7c431b 100644
--- a/routers/web/repo/main_test.go
+++ b/routers/web/repo/main_test.go
@@ -6,7 +6,7 @@ package repo
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/web/repo/mention.go b/routers/web/repo/mention.go
index 72bb50120bf..ca99d49f6fa 100644
--- a/routers/web/repo/mention.go
+++ b/routers/web/repo/mention.go
@@ -7,12 +7,12 @@ import (
 	"errors"
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
-	shared_mention "code.gitea.io/gitea/routers/web/shared/mention"
-	"code.gitea.io/gitea/services/context"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
+	shared_mention "gitea.dev/routers/web/shared/mention"
+	"gitea.dev/services/context"
 )
 
 // GetMentionsInRepo returns JSON data for mention autocomplete (assignees, participants, mentionable teams).
diff --git a/routers/web/repo/middlewares.go b/routers/web/repo/middlewares.go
index ee525a0db7a..8ae99fbbb74 100644
--- a/routers/web/repo/middlewares.go
+++ b/routers/web/repo/middlewares.go
@@ -6,14 +6,14 @@ package repo
 import (
 	"strconv"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/gitdiff"
-	user_service "code.gitea.io/gitea/services/user"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	"gitea.dev/services/gitdiff"
+	user_service "gitea.dev/services/user"
 )
 
 // SetEditorconfigIfExists set editor config as render variable
diff --git a/routers/web/repo/middlewares_test.go b/routers/web/repo/middlewares_test.go
index c6dc2e46157..35cd903c96a 100644
--- a/routers/web/repo/middlewares_test.go
+++ b/routers/web/repo/middlewares_test.go
@@ -6,9 +6,9 @@ package repo
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/services/contexttest"
-	"code.gitea.io/gitea/services/gitdiff"
+	"gitea.dev/models/unittest"
+	"gitea.dev/services/contexttest"
+	"gitea.dev/services/gitdiff"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/repo/migrate.go b/routers/web/repo/migrate.go
index bb6f1e6b7eb..c8666eecaae 100644
--- a/routers/web/repo/migrate.go
+++ b/routers/web/repo/migrate.go
@@ -9,24 +9,24 @@ import (
 	"net/url"
 	"strings"
 
-	admin_model "code.gitea.io/gitea/models/admin"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/migrations"
-	repo_service "code.gitea.io/gitea/services/repository"
-	"code.gitea.io/gitea/services/task"
+	admin_model "gitea.dev/models/admin"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/migrations"
+	repo_service "gitea.dev/services/repository"
+	"gitea.dev/services/task"
 )
 
 const (
diff --git a/routers/web/repo/milestone.go b/routers/web/repo/milestone.go
index 759b9910d84..ad3a71804c8 100644
--- a/routers/web/repo/milestone.go
+++ b/routers/web/repo/milestone.go
@@ -7,18 +7,18 @@ import (
 	"net/http"
 	"net/url"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/renderhelper"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/issue"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/renderhelper"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/issue"
 
 	"xorm.io/builder"
 )
diff --git a/routers/web/repo/packages.go b/routers/web/repo/packages.go
index 6dd54e42e2c..7715a5e436d 100644
--- a/routers/web/repo/packages.go
+++ b/routers/web/repo/packages.go
@@ -6,13 +6,13 @@ package repo
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/repo/projects.go b/routers/web/repo/projects.go
index 8690e754637..f6ff723dc07 100644
--- a/routers/web/repo/projects.go
+++ b/routers/web/repo/projects.go
@@ -9,26 +9,26 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	project_model "code.gitea.io/gitea/models/project"
-	"code.gitea.io/gitea/models/renderhelper"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/web/shared/issue"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	project_service "code.gitea.io/gitea/services/projects"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	project_model "gitea.dev/models/project"
+	"gitea.dev/models/renderhelper"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/web/shared/issue"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	project_service "gitea.dev/services/projects"
 )
 
 const (
diff --git a/routers/web/repo/projects_test.go b/routers/web/repo/projects_test.go
index d0690d9a4de..ad24b293eee 100644
--- a/routers/web/repo/projects_test.go
+++ b/routers/web/repo/projects_test.go
@@ -6,8 +6,8 @@ package repo
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/unittest"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/repo/pull.go b/routers/web/repo/pull.go
index 7406c1d1228..6862a3efc0f 100644
--- a/routers/web/repo/pull.go
+++ b/routers/web/repo/pull.go
@@ -9,54 +9,55 @@ import (
 	"errors"
 	"fmt"
 	"html"
+	"html/template"
 	"net/http"
 	"strconv"
 	"strings"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	pull_model "code.gitea.io/gitea/models/pull"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/emoji"
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/graceful"
-	issue_template "code.gitea.io/gitea/modules/issue/template"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/utils"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	actions_service "code.gitea.io/gitea/services/actions"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/automerge"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	"code.gitea.io/gitea/services/forms"
-	git_service "code.gitea.io/gitea/services/git"
-	"code.gitea.io/gitea/services/gitdiff"
-	notify_service "code.gitea.io/gitea/services/notify"
-	pull_service "code.gitea.io/gitea/services/pull"
-	repo_service "code.gitea.io/gitea/services/repository"
-	user_service "code.gitea.io/gitea/services/user"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	pull_model "gitea.dev/models/pull"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/emoji"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/graceful"
+	issue_template "gitea.dev/modules/issue/template"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/utils"
+	shared_user "gitea.dev/routers/web/shared/user"
+	actions_service "gitea.dev/services/actions"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/automerge"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	"gitea.dev/services/forms"
+	git_service "gitea.dev/services/git"
+	"gitea.dev/services/gitdiff"
+	notify_service "gitea.dev/services/notify"
+	pull_service "gitea.dev/services/pull"
+	repo_service "gitea.dev/services/repository"
+	user_service "gitea.dev/services/user"
 )
 
 const (
-	tplCompareDiff templates.TplName = "repo/diff/compare"
 	tplPullCommits templates.TplName = "repo/pulls/commits"
 	tplPullFiles   templates.TplName = "repo/pulls/files"
 
@@ -266,8 +267,24 @@ type pullMergeBoxData struct {
 	ShowMergeBox      bool
 	ReloadingInterval int
 
-	HasOverridableBlockers bool
-	CanMergeNow            bool
+	TimelineIconClass string
+
+	ClosedInfoTitle template.HTML
+	ClosedInfoBody  template.HTML
+
+	enableStatusCheck bool
+	StatusCheckData   *pullCommitStatusCheckData
+	ShowStatusCheck   bool
+
+	hasOverridableBlockers     bool
+	canMergeNow                bool // PR is mergeable, either no blocker, or doer can bypass the blockers
+	hasPermToMerge             bool // doer has permission to merge
+	canBypassProtection        bool
+	canBypassProtectionAsAdmin bool
+
+	ShowUpdatePullInfo  bool
+	UpdatePrimaryAction *pullUpdateAction
+	UpdateStyleOptions  []*pullUpdateAction
 
 	MergeFormProps        map[string]any
 	ShowPullCommands      bool
@@ -276,7 +293,7 @@ type pullMergeBoxData struct {
 
 	// don't expose unneeded fields to templates, need more refactoring changes
 	hasStatusCheckBlocker bool
-	isPullBranchDeletable bool
+	IsPullBranchDeletable bool
 
 	isBlockedByApprovals              bool
 	isBlockedByRejection              bool
@@ -284,6 +301,19 @@ type pullMergeBoxData struct {
 	isBlockedByOutdatedBranch         bool
 	isBlockedByChangedProtectedFiles  bool
 	requireSigned, willSign           bool
+	signingKeyMergeDisplay            string
+
+	infoCommitBlockers     pullMergeBoxInfoItemCollection
+	infoProtectionBlockers pullMergeBoxInfoItemCollection
+	infoMergePrompts       pullMergeBoxInfoItemCollection
+
+	InfoSections []*pullInfoSection
+}
+
+type pullUpdateAction struct {
+	URL      string
+	Text     template.HTML
+	Selected bool
 }
 
 // pullRequestViewInfo is a structured type for viewing pull request
@@ -299,9 +329,9 @@ type pullRequestViewInfo struct {
 
 	CompareInfo         git_service.CompareInfo
 	ProtectedBranchRule *git_model.ProtectedBranch
-	StatusCheckData     *pullCommitStatusCheckData
-	CommitStatuses      []*git_model.CommitStatus
 	MergeBoxData        *pullMergeBoxData
+
+	workInProgressPrefix string
 }
 
 func newPullRequestViewInfo() *pullRequestViewInfo {
@@ -339,7 +369,6 @@ func (prInfo *pullRequestViewInfo) prepareViewFillInfo(ctx *context.Context, bas
 	if ctx.Written() {
 		return
 	}
-	prInfo.prepareViewFillCommitStatusInfo(ctx)
 }
 
 func (prInfo *pullRequestViewInfo) prepareViewFillCompareInfo(ctx *context.Context, baseRef git.RefName) {
@@ -369,56 +398,47 @@ func (prInfo *pullRequestViewInfo) prepareViewFillCompareInfo(ctx *context.Conte
 		prInfo.IsPullRequestBroken = true
 	}
 
-	ctx.Data["IsPullRequestBroken"] = prInfo.IsPullRequestBroken
 	ctx.Data["NumCommits"] = len(prInfo.CompareInfo.Commits)
 	ctx.Data["NumFiles"] = prInfo.CompareInfo.NumFiles
 	prInfo.setTemplateDataMergeTarget(ctx)
 }
 
-func (prInfo *pullRequestViewInfo) prepareViewFillCommitStatusInfo(ctx *context.Context) {
+func (prInfo *pullRequestViewInfo) prepareMergeBoxStatusCheckData(ctx *context.Context) {
 	headCommitID := prInfo.CompareInfo.HeadCommitID
-	if headCommitID == "" {
+	if headCommitID == "" || prInfo.issue.IsClosed {
 		return
 	}
 
-	repo := ctx.Repo.Repository
+	data := prInfo.MergeBoxData
+
+	var pbRequiredContexts []string
+	data.enableStatusCheck = prInfo.ProtectedBranchRule != nil && prInfo.ProtectedBranchRule.EnableStatusCheck
+	if prInfo.ProtectedBranchRule != nil {
+		pbRequiredContexts = prInfo.ProtectedBranchRule.StatusCheckContexts
+	}
+
 	statusCheckData := &pullCommitStatusCheckData{}
-	prInfo.StatusCheckData = statusCheckData
+	data.StatusCheckData = statusCheckData
 
 	commitStatuses, err := git_model.GetLatestCommitStatus(ctx, ctx.Repo.Repository.ID, prInfo.CompareInfo.HeadCommitID, db.ListOptionsAll)
 	if err != nil {
-		ctx.ServerError("GetLatestCommitStatus", err)
-		return
+		log.Error("GetLatestCommitStatus: %v", err)
 	}
 	if !ctx.Repo.Permission.CanRead(unit.TypeActions) {
 		git_model.CommitStatusesHideActionsURL(ctx, commitStatuses)
 	}
-
-	prInfo.CommitStatuses = commitStatuses
-	statusCheckData.ApproveLink = fmt.Sprintf("%s/actions/approve-all-checks?commit_id=%s", repo.Link(), headCommitID)
-	statusCheckData.LatestCommitStatus = git_model.CalcCommitStatus(commitStatuses)
-	ctx.Data["LatestCommitStatuses"] = commitStatuses
-	ctx.Data["LatestCommitStatus"] = statusCheckData.LatestCommitStatus
-	ctx.Data["StatusCheckData"] = prInfo.StatusCheckData
-
-	prInfo.ProtectedBranchRule, err = git_model.GetFirstMatchProtectedBranchRule(ctx, ctx.Repo.Repository.ID, prInfo.issue.PullRequest.BaseBranch)
-	if err != nil {
-		ctx.ServerError("GetFirstMatchProtectedBranchRule", err)
-		return
+	combinedCommitStatus := git_model.CalcCommitStatus(commitStatuses)
+	statusCheckData.ApproveLink = fmt.Sprintf("%s/actions/approve-all-checks?commit_id=%s", ctx.Repo.Repository.Link(), headCommitID)
+	statusCheckData.PullCommitStatuses = commitStatuses
+	if combinedCommitStatus != nil {
+		statusCheckData.pullCommitStatusState = combinedCommitStatus.State
 	}
 
-	if !prInfo.issue.IsClosed {
-		prInfo.prepareViewFillCommitStatusInfoForOpen(ctx)
-	}
-}
+	data.ShowStatusCheck = data.enableStatusCheck || len(statusCheckData.PullCommitStatuses) > 0
 
-func (prInfo *pullRequestViewInfo) prepareViewFillCommitStatusInfoForOpen(ctx *context.Context) {
-	statusCheckData := prInfo.StatusCheckData
-	commitStatuses := prInfo.CommitStatuses
 	runs, err := actions_service.GetRunsFromCommitStatuses(ctx, commitStatuses)
 	if err != nil {
-		ctx.ServerError("GetRunsFromCommitStatuses", err)
-		return
+		log.Error("GetRunsFromCommitStatuses: %v", err)
 	}
 	for _, run := range runs {
 		if run.NeedApproval {
@@ -429,14 +449,8 @@ func (prInfo *pullRequestViewInfo) prepareViewFillCommitStatusInfoForOpen(ctx *c
 		statusCheckData.CanApprove = ctx.Repo.Permission.CanWrite(unit.TypeActions)
 	}
 
-	pb := prInfo.ProtectedBranchRule
-	enableStatusCheck := pb != nil && pb.EnableStatusCheck
-	if !enableStatusCheck {
-		return
-	}
-
 	var missingRequiredChecks []string
-	for _, requiredContext := range pb.StatusCheckContexts {
+	for _, requiredContext := range pbRequiredContexts {
 		contextFound := false
 		matchesRequiredContext := createRequiredContextMatcher(requiredContext)
 		for _, presentStatus := range commitStatuses {
@@ -453,7 +467,7 @@ func (prInfo *pullRequestViewInfo) prepareViewFillCommitStatusInfoForOpen(ctx *c
 	statusCheckData.MissingRequiredChecks = missingRequiredChecks
 
 	statusCheckData.IsContextRequired = func(context string) bool {
-		for _, c := range pb.StatusCheckContexts {
+		for _, c := range pbRequiredContexts {
 			if c == context {
 				return true
 			}
@@ -468,7 +482,21 @@ func (prInfo *pullRequestViewInfo) prepareViewFillCommitStatusInfoForOpen(ctx *c
 		}
 		return false
 	}
-	statusCheckData.RequiredChecksState = pull_service.MergeRequiredContextsCommitStatus(commitStatuses, pb.StatusCheckContexts)
+	statusCheckData.RequiredChecksState = pull_service.MergeRequiredContextsCommitStatus(commitStatuses, pbRequiredContexts)
+
+	if data.enableStatusCheck {
+		if statusCheckData.RequiredChecksState.IsError() || statusCheckData.RequiredChecksState.IsFailure() {
+			data.infoProtectionBlockers.AddErrorItem(
+				svg.RenderHTML("octicon-x"),
+				ctx.Locale.Tr("repo.pulls.required_status_check_failed"),
+			)
+		} else if !statusCheckData.RequiredChecksState.IsSuccess() {
+			data.infoProtectionBlockers.AddErrorItem(
+				svg.RenderHTML("octicon-x"),
+				ctx.Locale.Tr("repo.pulls.required_status_check_missing"),
+			)
+		}
+	}
 }
 
 // prepareViewMergedPullInfo show meta information for a merged pull request view page
@@ -485,14 +513,16 @@ type pullCommitStatusCheckData struct {
 	CanApprove              bool              // whether the user can approve workflow runs
 	ApproveLink             string            // link to approve all checks
 	RequiredChecksState     commitstatus.CommitStatusState
-	LatestCommitStatus      *git_model.CommitStatus
+
+	pullCommitStatusState commitstatus.CommitStatusState
+	PullCommitStatuses    []*git_model.CommitStatus
 }
 
 func (d *pullCommitStatusCheckData) CommitStatusCheckPrompt(locale translation.Locale) string {
 	if d.RequiredChecksState.IsPending() || len(d.MissingRequiredChecks) > 0 {
 		return locale.TrString("repo.pulls.status_checking")
 	} else if d.RequiredChecksState.IsSuccess() {
-		if d.LatestCommitStatus != nil && d.LatestCommitStatus.State.IsFailure() {
+		if d.pullCommitStatusState.IsFailure() {
 			return locale.TrString("repo.pulls.status_checks_failure_optional")
 		}
 		return locale.TrString("repo.pulls.status_checks_success")
@@ -548,10 +578,11 @@ func (prInfo *pullRequestViewInfo) prepareViewOpenPullInfo(ctx *context.Context)
 		ctx.Data["IsNothingToCompare"] = true
 	}
 
-	// this one is used by both sidebar and merge-box
+	// this one is used by: title edit, sidebar toggle, and merge-box toggle
+	prInfo.workInProgressPrefix = pull.GetWorkInProgressPrefix(ctx)
 	if pull.IsWorkInProgress(ctx) {
-		ctx.Data["IsPullWorkInProgress"] = true
-		ctx.Data["WorkInProgressPrefix"] = pull.GetWorkInProgressPrefix(ctx)
+		ctx.Data["IsPullWorkInProgress"] = prInfo.workInProgressPrefix != ""
+		ctx.Data["WorkInProgressPrefix"] = prInfo.workInProgressPrefix
 	}
 }
 
@@ -652,6 +683,8 @@ func indexCommit(commits []*git.Commit, commitID string) *git.Commit {
 
 // ViewPullFiles render pull request changed files list page
 func viewPullFiles(ctx *context.Context, beforeCommitID, afterCommitID string) {
+	var err error
+
 	ctx.Data["PageIsPullList"] = true
 	ctx.Data["PageIsPullFiles"] = true
 
@@ -676,44 +709,53 @@ func viewPullFiles(ctx *context.Context, beforeCommitID, afterCommitID string) {
 
 	headCommitID := prCompareInfo.HeadCommitID
 	isSingleCommit := beforeCommitID == "" && afterCommitID != ""
-	ctx.Data["IsShowingOnlySingleCommit"] = isSingleCommit
+	// FIXME: when afterCommitID==headCommitID, isSingleCommit and isShowAllCommits can be both true, which doesn't seem right
 	isShowAllCommits := (beforeCommitID == "" || beforeCommitID == prCompareInfo.CompareBase) && (afterCommitID == "" || afterCommitID == headCommitID)
+
+	ctx.Data["IsShowingOnlySingleCommit"] = isSingleCommit
 	ctx.Data["IsShowingAllCommits"] = isShowAllCommits
 
-	if afterCommitID == "" || afterCommitID == headCommitID {
-		afterCommitID = headCommitID
-	}
+	// "commits list" is half-open, half-closed: (base, head]
+	// * base commit is not in the list
+	// * if the PR is empty, the list is also empty (head commit is not in the list)
+
+	afterCommitID = util.IfZero(afterCommitID, headCommitID)
 	afterCommit := indexCommit(prCompareInfo.Commits, afterCommitID)
+	if afterCommit == nil && afterCommitID == headCommitID {
+		afterCommit, err = gitRepo.GetCommit(afterCommitID)
+		if err != nil {
+			ctx.ServerError("GetCommit(afterCommitID)", err)
+			return
+		}
+	}
 	if afterCommit == nil {
-		ctx.HTTPError(http.StatusBadRequest, "after commit not found in PR commits")
+		ctx.NotFound(nil)
 		return
 	}
 
 	var beforeCommit *git.Commit
-	var err error
-	if !isSingleCommit {
-		if beforeCommitID == "" || beforeCommitID == prCompareInfo.CompareBase {
-			beforeCommitID = prCompareInfo.CompareBase
-			// merge base commit is not in the list of the pull request commits
-			beforeCommit, err = gitRepo.GetCommit(beforeCommitID)
-			if err != nil {
-				ctx.ServerError("GetCommit", err)
-				return
-			}
-		} else {
-			beforeCommit = indexCommit(prCompareInfo.Commits, beforeCommitID)
-			if beforeCommit == nil {
-				ctx.HTTPError(http.StatusBadRequest, "before commit not found in PR commits")
-				return
-			}
-		}
-	} else {
+	if isSingleCommit {
 		beforeCommit, err = afterCommit.Parent(0)
 		if err != nil {
-			ctx.ServerError("Parent", err)
+			ctx.ServerError("afterCommit.Parent", err)
 			return
 		}
 		beforeCommitID = beforeCommit.ID.String()
+	} else {
+		beforeCommitID = util.IfZero(beforeCommitID, prCompareInfo.CompareBase)
+		beforeCommit = indexCommit(prCompareInfo.Commits, beforeCommitID)
+		if beforeCommit == nil && beforeCommitID == prCompareInfo.CompareBase {
+			// base commit is not in the list of the pull request commits
+			beforeCommit, err = gitRepo.GetCommit(beforeCommitID)
+			if err != nil {
+				ctx.ServerError("GetCommit(beforeCommitID)", err)
+				return
+			}
+		}
+	}
+	if beforeCommit == nil {
+		ctx.NotFound(nil)
+		return
 	}
 
 	ctx.Data["CompareInfo"] = prCompareInfo
@@ -934,8 +976,6 @@ func UpdatePullRequest(ctx *context.Context) {
 		return
 	}
 
-	rebase := ctx.FormString("style") == "rebase"
-
 	if err := issue.PullRequest.LoadBaseRepo(ctx); err != nil {
 		ctx.ServerError("LoadBaseRepo", err)
 		return
@@ -945,23 +985,22 @@ func UpdatePullRequest(ctx *context.Context) {
 		return
 	}
 
-	allowedUpdateByMerge, allowedUpdateByRebase, err := pull_service.IsUserAllowedToUpdate(ctx, issue.PullRequest, ctx.Doer)
+	userUpdateStyles, err := pull_service.CheckUserAllowedToUpdate(ctx, issue.PullRequest, ctx.Doer)
 	if err != nil {
 		ctx.ServerError("IsUserAllowedToMerge", err)
 		return
 	}
 
-	// ToDo: add check if maintainers are allowed to change branch ... (need migration & co)
-	if (!allowedUpdateByMerge && !rebase) || (rebase && !allowedUpdateByRebase) {
-		ctx.Flash.Error(ctx.Tr("repo.pulls.update_not_allowed"))
-		ctx.Redirect(issue.Link())
+	rebase := ctx.FormString("style", string(userUpdateStyles.DefaultUpdateStyle)) == string(repo_model.UpdateStyleRebase)
+	if (rebase && !userUpdateStyles.RebaseAllowed) || (!rebase && !userUpdateStyles.MergeAllowed) {
+		ctx.JSONError(ctx.Tr("repo.pulls.update_not_allowed"))
 		return
 	}
 
 	// default merge commit message
 	message := fmt.Sprintf("Merge branch '%s' into %s", issue.PullRequest.BaseBranch, issue.PullRequest.HeadBranch)
 
-	// The update process should not be cancelled by the user
+	// The update process should not be canceled by the user
 	// so we set the context to be a background context
 	if err = pull_service.Update(graceful.GetManager().ShutdownContext(), issue.PullRequest, ctx.Doer, message, rebase); err != nil {
 		if pull_service.IsErrMergeConflicts(err) {
@@ -975,8 +1014,7 @@ func UpdatePullRequest(ctx *context.Context) {
 				ctx.ServerError("UpdatePullRequest.HTMLString", err)
 				return
 			}
-			ctx.Flash.Error(flashError)
-			ctx.Redirect(issue.Link())
+			ctx.JSONError(flashError)
 			return
 		} else if pull_service.IsErrRebaseConflicts(err) {
 			conflictError := err.(pull_service.ErrRebaseConflicts)
@@ -989,19 +1027,18 @@ func UpdatePullRequest(ctx *context.Context) {
 				ctx.ServerError("UpdatePullRequest.HTMLString", err)
 				return
 			}
-			ctx.Flash.Error(flashError)
-			ctx.Redirect(issue.Link())
+			ctx.JSONError(flashError)
 			return
 		}
-		ctx.Flash.Error(err.Error())
-		ctx.Redirect(issue.Link())
+		log.Error("Update pull request failed: %v", err)
+		ctx.JSONError("Unable to update pull request")
 		return
 	}
 
-	time.Sleep(1 * time.Second)
+	time.Sleep(100 * time.Millisecond) // TODO: it is really questionable whether the Sleep is useful here, need to figure out
 
 	ctx.Flash.Success(ctx.Tr("repo.pulls.update_branch_success"))
-	ctx.Redirect(issue.Link())
+	ctx.JSONRedirect(issue.Link())
 }
 
 // MergePullRequest response for merging pull request
diff --git a/routers/web/repo/pull_merge_box.go b/routers/web/repo/pull_merge_box.go
new file mode 100644
index 00000000000..471909f4253
--- /dev/null
+++ b/routers/web/repo/pull_merge_box.go
@@ -0,0 +1,196 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package repo
+
+import (
+	"html/template"
+
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+)
+
+type pullMergeBoxInfoItem struct {
+	ItemClass   string
+	SvgIconHTML template.HTML
+	InfoHTML    template.HTML
+	ListItems   []template.HTML
+}
+
+type pullMergeBoxInfoItemCollection struct {
+	items []*pullMergeBoxInfoItem
+}
+
+type pullInfoSection struct {
+	InfoItems []*pullMergeBoxInfoItem
+}
+
+func escapeStringSliceToHTML(s []string) (ret []template.HTML) {
+	for _, v := range s {
+		ret = append(ret, template.HTML(template.HTMLEscapeString(v)))
+	}
+	return ret
+}
+
+func (c *pullMergeBoxInfoItemCollection) AddInfoItem(svg, info template.HTML, optItems ...[]template.HTML) {
+	c.items = append(c.items, &pullMergeBoxInfoItem{
+		SvgIconHTML: svg,
+		InfoHTML:    info,
+		ListItems:   util.OptionalArg(optItems),
+	})
+}
+
+func (c *pullMergeBoxInfoItemCollection) AddErrorItem(svg, info template.HTML, optItems ...[]template.HTML) {
+	c.items = append(c.items, &pullMergeBoxInfoItem{
+		ItemClass:   "tw-text-red",
+		SvgIconHTML: svg,
+		InfoHTML:    info,
+		ListItems:   util.OptionalArg(optItems),
+	})
+}
+
+func (prInfo *pullRequestViewInfo) prepareMergeBoxIconColor() {
+	pull := prInfo.issue.PullRequest
+	mergeBoxData := prInfo.MergeBoxData
+
+	showAsNormalColor := prInfo.issue.IsClosed || prInfo.workInProgressPrefix != "" || pull.IsEmpty() || pull.IsFilesConflicted()
+	showAsErrorColor := false
+	showAsWarningColor := pull.IsChecking()
+
+	if statusCheckData := mergeBoxData.StatusCheckData; statusCheckData != nil {
+		showAsErrorColor = statusCheckData.pullCommitStatusState.IsError() || statusCheckData.pullCommitStatusState.IsFailure() ||
+			statusCheckData.RequiredChecksState.IsError() || statusCheckData.RequiredChecksState.IsFailure()
+
+		showAsWarningColor = showAsWarningColor ||
+			statusCheckData.pullCommitStatusState.IsWarning() || statusCheckData.pullCommitStatusState.IsPending() ||
+			(mergeBoxData.enableStatusCheck && (statusCheckData.RequiredChecksState.IsWarning() || statusCheckData.RequiredChecksState.IsPending()))
+	}
+
+	hasBlockers := len(mergeBoxData.infoCommitBlockers.items) > 0 || len(mergeBoxData.infoProtectionBlockers.items) > 0
+
+	switch {
+	case pull.HasMerged:
+		prInfo.MergeBoxData.TimelineIconClass = "tw-text-purple"
+	case showAsNormalColor:
+		prInfo.MergeBoxData.TimelineIconClass = "tw-text-text-light"
+	case showAsErrorColor:
+		prInfo.MergeBoxData.TimelineIconClass = "tw-text-red"
+	case showAsWarningColor:
+		prInfo.MergeBoxData.TimelineIconClass = "tw-text-yellow"
+	case hasBlockers:
+		prInfo.MergeBoxData.TimelineIconClass = "tw-text-red"
+	case pull.IsStatusMergeable():
+		prInfo.MergeBoxData.TimelineIconClass = "tw-text-green"
+	default:
+		prInfo.MergeBoxData.TimelineIconClass = "tw-text-text-light"
+	}
+}
+
+func (prInfo *pullRequestViewInfo) prepareMergeBoxInfoItems(ctx *context.Context) {
+	pull := prInfo.issue.PullRequest
+	data := prInfo.MergeBoxData
+
+	if pull.HasMerged && data.IsPullBranchDeletable {
+		data.ClosedInfoTitle = ctx.Locale.Tr("repo.pulls.merged_success")
+		data.ClosedInfoBody = ctx.Locale.Tr("repo.pulls.merged_info_text", htmlutil.HTMLFormat("<code>%s</code>", prInfo.headTarget))
+		return
+	} else if prInfo.issue.IsClosed {
+		data.ClosedInfoTitle = ctx.Locale.Tr("repo.pulls.closed")
+		if prInfo.IsPullRequestBroken {
+			data.ClosedInfoBody = ctx.Locale.Tr("repo.pulls.cant_reopen_deleted_branch")
+		} else {
+			data.ClosedInfoBody = ctx.Locale.Tr("repo.pulls.reopen_to_merge")
+		}
+		return
+	}
+
+	if pull.IsFilesConflicted() {
+		detailItems := escapeStringSliceToHTML(pull.ConflictedFiles)
+		if len(detailItems) == 0 {
+			detailItems = append(detailItems, ctx.Locale.Tr("repo.pulls.files_conflicted_no_listed_files"))
+		}
+		if len(detailItems) > 10 {
+			detailItems = detailItems[:10]
+			detailItems = append(detailItems, "...")
+		}
+		prInfo.MergeBoxData.infoCommitBlockers.AddInfoItem(
+			svg.RenderHTML("octicon-x"),
+			ctx.Locale.Tr("repo.pulls.files_conflicted"),
+			detailItems,
+		)
+	}
+
+	if prInfo.IsPullRequestBroken {
+		prInfo.MergeBoxData.infoCommitBlockers.AddInfoItem(
+			svg.RenderHTML("octicon-x"),
+			ctx.Locale.Tr("repo.pulls.data_broken"),
+		)
+	}
+
+	if pull.IsChecking() {
+		prInfo.MergeBoxData.infoCommitBlockers.AddInfoItem(
+			svg.RenderHTML("gitea-running", 16, "rotate-clockwise"),
+			ctx.Locale.Tr("repo.pulls.is_checking"),
+		)
+	}
+
+	if pull.IsAncestor() {
+		prInfo.MergeBoxData.infoCommitBlockers.AddInfoItem(
+			svg.RenderHTML("octicon-alert"),
+			ctx.Locale.Tr("repo.pulls.is_ancestor"),
+		)
+	}
+
+	if !pull.IsStatusMergeable() {
+		// it is only a "protection" level blocker, it can be bypassed by admin (e.g.: manually merged)
+		if pull.IsEmpty() {
+			prInfo.MergeBoxData.infoProtectionBlockers.AddInfoItem(
+				svg.RenderHTML("octicon-alert"),
+				ctx.Locale.Tr("repo.pulls.is_empty"),
+			)
+		} else {
+			prInfo.MergeBoxData.infoProtectionBlockers.AddErrorItem(
+				svg.RenderHTML("octicon-x"),
+				ctx.Locale.Tr("repo.pulls.cannot_auto_merge_desc"),
+			)
+			prInfo.MergeBoxData.infoProtectionBlockers.AddInfoItem(
+				svg.RenderHTML("octicon-info"),
+				ctx.Locale.Tr("repo.pulls.cannot_auto_merge_helper"),
+			)
+		}
+	}
+
+	if !data.hasPermToMerge {
+		prInfo.MergeBoxData.infoProtectionBlockers.AddInfoItem(
+			svg.RenderHTML("octicon-info"),
+			ctx.Locale.Tr("repo.pulls.no_merge_access"),
+		)
+	}
+
+	if data.canMergeNow {
+		if data.hasOverridableBlockers {
+			prompt := ctx.Locale.Tr("repo.pulls.required_status_check_bypass_allowlist")
+			if data.canBypassProtectionAsAdmin {
+				prompt = ctx.Locale.Tr("repo.pulls.required_status_check_administrator")
+			}
+			prInfo.MergeBoxData.infoMergePrompts.AddInfoItem(
+				svg.RenderHTML("octicon-dot-fill"),
+				prompt,
+			)
+		} else if pull.IsStatusMergeable() || pull.IsEmpty() {
+			prInfo.MergeBoxData.infoMergePrompts.AddInfoItem(
+				svg.RenderHTML("octicon-check"),
+				ctx.Locale.Tr("repo.pulls.can_auto_merge_desc"),
+			)
+		}
+	}
+
+	if len(data.infoCommitBlockers.items) > 0 {
+		data.InfoSections = append(data.InfoSections, &pullInfoSection{data.infoCommitBlockers.items})
+	} else {
+		data.InfoSections = append(data.InfoSections, &pullInfoSection{data.infoProtectionBlockers.items})
+	}
+	data.InfoSections = append(data.InfoSections, &pullInfoSection{data.infoMergePrompts.items})
+}
diff --git a/routers/web/repo/pull_merge_form.go b/routers/web/repo/pull_merge_form.go
index b390fd69349..8fc236d4b4f 100644
--- a/routers/web/repo/pull_merge_form.go
+++ b/routers/web/repo/pull_merge_form.go
@@ -6,16 +6,24 @@ package repo
 import (
 	"html/template"
 
-	pull_model "code.gitea.io/gitea/models/pull"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
-	pull_service "code.gitea.io/gitea/services/pull"
+	pull_model "gitea.dev/models/pull"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
+	pull_service "gitea.dev/services/pull"
 )
 
 func (prInfo *pullRequestViewInfo) prepareMergeBoxFormProps(ctx *context.Context) {
 	pull := prInfo.issue.PullRequest
+	if pull.HasMerged || prInfo.issue.IsClosed {
+		return
+	}
+	if !prInfo.MergeBoxData.hasPermToMerge {
+		return
+	}
+
 	prConfig := ctx.Repo.Repository.MustGetUnit(ctx, unit.TypePullRequests).PullRequestsConfig()
 
 	// Check correct values and select default
@@ -68,8 +76,8 @@ func (prInfo *pullRequestViewInfo) prepareMergeBoxFormProps(ctx *context.Context
 		defaultSquashMergeCommitMessages = pull_service.GetSquashMergeCommitMessages(ctx, pull)
 	}
 
-	allOverridableChecksOk := !prInfo.MergeBoxData.HasOverridableBlockers
-	prInfo.MergeBoxData.MergeFormProps = map[string]any{
+	allOverridableChecksOk := !prInfo.MergeBoxData.hasOverridableBlockers
+	mergeFormProps := map[string]any{
 		"baseLink":                       prInfo.issue.Link(),
 		"textCancel":                     ctx.Locale.Tr("cancel"),
 		"textDeleteBranch":               ctx.Locale.Tr("repo.branch.delete", prInfo.headTarget),
@@ -80,11 +88,11 @@ func (prInfo *pullRequestViewInfo) prepareMergeBoxFormProps(ctx *context.Context
 		"textClearMergeMessageHint":      ctx.Locale.Tr("repo.pulls.clear_merge_message_hint"),
 		"textMergeCommitId":              ctx.Locale.Tr("repo.pulls.merge_commit_id"),
 
-		"canMergeNow":                   prInfo.MergeBoxData.CanMergeNow,
+		"canMergeNow":                   prInfo.MergeBoxData.canMergeNow,
 		"allOverridableChecksOk":        allOverridableChecksOk,
 		"emptyCommit":                   pull.IsEmpty(),
 		"pullHeadCommitID":              prInfo.CompareInfo.HeadCommitID,
-		"isPullBranchDeletable":         prInfo.MergeBoxData.isPullBranchDeletable,
+		"isPullBranchDeletable":         prInfo.MergeBoxData.IsPullBranchDeletable,
 		"defaultMergeStyle":             mergeStyle,
 		"defaultDeleteBranchAfterMerge": prConfig.DefaultDeleteBranchAfterMerge,
 		"mergeMessageFieldPlaceHolder":  ctx.Locale.Tr("repo.editor.commit_message_desc"),
@@ -95,53 +103,82 @@ func (prInfo *pullRequestViewInfo) prepareMergeBoxFormProps(ctx *context.Context
 	}
 
 	// if this pr can be merged now, then hide the auto merge
-	generalHideAutoMerge := prInfo.MergeBoxData.CanMergeNow && allOverridableChecksOk
+	generalHideAutoMerge := prInfo.MergeBoxData.canMergeNow && allOverridableChecksOk
 
-	prInfo.MergeBoxData.MergeFormProps["mergeStyles"] = []any{
-		map[string]any{
-			"name":                  "merge",
-			"allowed":               prConfig.AllowMerge,
-			"textDoMerge":           ctx.Locale.Tr("repo.pulls.merge_pull_request"),
-			"mergeTitleFieldText":   defaultMergeTitle,
-			"mergeMessageFieldText": defaultMergeBody,
-			"hideAutoMerge":         generalHideAutoMerge,
-		},
-		map[string]any{
-			"name":                  "rebase",
-			"allowed":               prConfig.AllowRebase,
-			"textDoMerge":           ctx.Locale.Tr("repo.pulls.rebase_merge_pull_request"),
-			"hideMergeMessageTexts": true,
-			"hideAutoMerge":         generalHideAutoMerge,
-		},
-		map[string]any{
-			"name":                  "rebase-merge",
-			"allowed":               prConfig.AllowRebaseMerge,
-			"textDoMerge":           ctx.Locale.Tr("repo.pulls.rebase_merge_commit_pull_request"),
-			"mergeTitleFieldText":   defaultMergeTitle,
-			"mergeMessageFieldText": defaultMergeBody,
-			"hideAutoMerge":         generalHideAutoMerge,
-		},
-		map[string]any{
-			"name":                  "squash",
-			"allowed":               prConfig.AllowSquash,
-			"textDoMerge":           ctx.Locale.Tr("repo.pulls.squash_merge_pull_request"),
-			"mergeTitleFieldText":   defaultSquashMergeTitle,
-			"mergeMessageFieldText": defaultSquashMergeCommitMessages + defaultSquashMergeBody,
-			"hideAutoMerge":         generalHideAutoMerge,
-		},
-		map[string]any{
-			"name":                  "fast-forward-only",
-			"allowed":               prConfig.AllowFastForwardOnly && pull.CommitsBehind == 0,
-			"textDoMerge":           ctx.Locale.Tr("repo.pulls.fast_forward_only_merge_pull_request"),
-			"hideMergeMessageTexts": true,
-			"hideAutoMerge":         generalHideAutoMerge,
-		},
-		map[string]any{
+	var mergeStyles []any
+	if pull.IsStatusMergeable() {
+		mergeStyles = []any{
+			map[string]any{
+				"name":                  "merge",
+				"allowed":               prConfig.AllowMerge,
+				"textDoMerge":           ctx.Locale.Tr("repo.pulls.merge_pull_request"),
+				"mergeTitleFieldText":   defaultMergeTitle,
+				"mergeMessageFieldText": defaultMergeBody,
+				"hideAutoMerge":         generalHideAutoMerge,
+			},
+			map[string]any{
+				"name":                  "rebase",
+				"allowed":               prConfig.AllowRebase,
+				"textDoMerge":           ctx.Locale.Tr("repo.pulls.rebase_merge_pull_request"),
+				"hideMergeMessageTexts": true,
+				"hideAutoMerge":         generalHideAutoMerge,
+			},
+			map[string]any{
+				"name":                  "rebase-merge",
+				"allowed":               prConfig.AllowRebaseMerge,
+				"textDoMerge":           ctx.Locale.Tr("repo.pulls.rebase_merge_commit_pull_request"),
+				"mergeTitleFieldText":   defaultMergeTitle,
+				"mergeMessageFieldText": defaultMergeBody,
+				"hideAutoMerge":         generalHideAutoMerge,
+			},
+			map[string]any{
+				"name":                  "squash",
+				"allowed":               prConfig.AllowSquash,
+				"textDoMerge":           ctx.Locale.Tr("repo.pulls.squash_merge_pull_request"),
+				"mergeTitleFieldText":   defaultSquashMergeTitle,
+				"mergeMessageFieldText": defaultSquashMergeCommitMessages + defaultSquashMergeBody,
+				"hideAutoMerge":         generalHideAutoMerge,
+			},
+			map[string]any{
+				"name":                  "fast-forward-only",
+				"allowed":               prConfig.AllowFastForwardOnly && pull.CommitsBehind == 0,
+				"textDoMerge":           ctx.Locale.Tr("repo.pulls.fast_forward_only_merge_pull_request"),
+				"hideMergeMessageTexts": true,
+				"hideAutoMerge":         generalHideAutoMerge,
+			},
+		}
+	}
+
+	// Manually Merged is not a well-known feature, it is used to mark a non-mergeable PR (already merged, conflicted) as merged
+	// To test it:
+	//  Enable "Manually Merged" feature in the Repository Settings
+	//  Create a pull request, either:
+	//  - Merge the pull request branch locally and push the merged commit to Gitea
+	//  - Make some conflicts between the base branch and the pull request branch
+	//  Then the Manually Merged form will be shown in the merge form
+	canUseManualMerge := !pull.IsWorkInProgress(ctx) && !pull.IsChecking() && prConfig.AllowManualMerge
+	if canUseManualMerge {
+		mergeStyles = append(mergeStyles, map[string]any{
 			"name":                  "manually-merged",
 			"allowed":               prConfig.AllowManualMerge,
 			"textDoMerge":           ctx.Locale.Tr("repo.pulls.merge_manually"),
 			"hideMergeMessageTexts": true,
 			"hideAutoMerge":         true,
-		},
+		})
+	}
+
+	if len(mergeStyles) > 0 {
+		mergeFormProps["mergeStyles"] = mergeStyles
+		prInfo.MergeBoxData.MergeFormProps = mergeFormProps
+	} else if pull.IsStatusMergeable() {
+		// no merge style was set in repo setting
+		prInfo.MergeBoxData.infoCommitBlockers.AddInfoItem(
+			svg.RenderHTML("octicon-x", 16, "tw-text-red"),
+			ctx.Locale.Tr("repo.pulls.no_merge_desc"),
+		)
+		prInfo.MergeBoxData.infoCommitBlockers.AddInfoItem(
+			svg.RenderHTML("octicon-info"),
+			ctx.Locale.Tr("repo.pulls.no_merge_helper"),
+		)
 	}
 }
diff --git a/routers/web/repo/pull_review.go b/routers/web/repo/pull_review.go
index bbcf6630b67..b71d4d27a9c 100644
--- a/routers/web/repo/pull_review.go
+++ b/routers/web/repo/pull_review.go
@@ -8,21 +8,21 @@ import (
 	"fmt"
 	"net/http"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	pull_model "code.gitea.io/gitea/models/pull"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	"code.gitea.io/gitea/services/forms"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
-	user_service "code.gitea.io/gitea/services/user"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	pull_model "gitea.dev/models/pull"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	"gitea.dev/services/forms"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
+	user_service "gitea.dev/services/user"
 )
 
 const (
diff --git a/routers/web/repo/pull_review_test.go b/routers/web/repo/pull_review_test.go
index 1b28cad5b60..c080d310aaf 100644
--- a/routers/web/repo/pull_review_test.go
+++ b/routers/web/repo/pull_review_test.go
@@ -8,13 +8,13 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/contexttest"
-	"code.gitea.io/gitea/services/pull"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
+	"gitea.dev/services/contexttest"
+	"gitea.dev/services/pull"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/routers/web/repo/recent_commits.go b/routers/web/repo/recent_commits.go
index 26601160625..0ac4d895dc0 100644
--- a/routers/web/repo/recent_commits.go
+++ b/routers/web/repo/recent_commits.go
@@ -6,8 +6,8 @@ package repo
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/repo/release.go b/routers/web/repo/release.go
index 288e107e53b..5e267cc1133 100644
--- a/routers/web/repo/release.go
+++ b/routers/web/repo/release.go
@@ -12,26 +12,26 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/renderhelper"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/web/feed"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/context/upload"
-	"code.gitea.io/gitea/services/forms"
-	release_service "code.gitea.io/gitea/services/release"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/renderhelper"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/web/feed"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	"gitea.dev/services/context/upload"
+	"gitea.dev/services/forms"
+	release_service "gitea.dev/services/release"
 )
 
 const (
diff --git a/routers/web/repo/release_test.go b/routers/web/repo/release_test.go
index d57886c2738..82f3115ee5d 100644
--- a/routers/web/repo/release_test.go
+++ b/routers/web/repo/release_test.go
@@ -6,14 +6,14 @@ package repo
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/contexttest"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/contexttest"
+	"gitea.dev/services/forms"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/routers/web/repo/render.go b/routers/web/repo/render.go
index 4a68c96aaa2..054e63635ec 100644
--- a/routers/web/repo/render.go
+++ b/routers/web/repo/render.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"path"
 
-	"code.gitea.io/gitea/models/renderhelper"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/renderhelper"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/services/context"
 )
 
 // RenderFile renders a file by repos path
diff --git a/routers/web/repo/repo.go b/routers/web/repo/repo.go
index c7813feae23..ba4828faf8b 100644
--- a/routers/web/repo/repo.go
+++ b/routers/web/repo/repo.go
@@ -11,29 +11,29 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/forms"
-	repo_service "code.gitea.io/gitea/services/repository"
-	archiver_service "code.gitea.io/gitea/services/repository/archiver"
-	commitstatus_service "code.gitea.io/gitea/services/repository/commitstatus"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/forms"
+	repo_service "gitea.dev/services/repository"
+	archiver_service "gitea.dev/services/repository/archiver"
+	commitstatus_service "gitea.dev/services/repository/commitstatus"
 )
 
 const (
@@ -364,6 +364,10 @@ func RedirectDownload(ctx *context.Context) {
 
 // Download an archive of a repository
 func Download(ctx *context.Context) {
+	if !checkDownloadTokenScope(ctx) {
+		return
+	}
+
 	aReq, err := archiver_service.NewRequest(ctx.Repo.Repository, ctx.Repo.GitRepo, ctx.PathParam("*"), ctx.FormStrings("path"))
 	if err != nil {
 		if errors.Is(err, util.ErrInvalidArgument) {
@@ -389,6 +393,10 @@ func Download(ctx *context.Context) {
 // a request that's already in-progress, but the archiver service will just
 // kind of drop it on the floor if this is the case.
 func InitiateDownload(ctx *context.Context) {
+	if !checkDownloadTokenScope(ctx) {
+		return
+	}
+
 	paths := ctx.FormStrings("path")
 	if setting.Repository.StreamArchives || len(paths) > 0 {
 		ctx.JSON(http.StatusOK, map[string]any{
diff --git a/routers/web/repo/search.go b/routers/web/repo/search.go
index 304a53abd83..411c30e0df8 100644
--- a/routers/web/repo/search.go
+++ b/routers/web/repo/search.go
@@ -6,14 +6,14 @@ package repo
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/git"
-	code_indexer "code.gitea.io/gitea/modules/indexer/code"
-	"code.gitea.io/gitea/modules/indexer/code/gitgrep"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/git"
+	code_indexer "gitea.dev/modules/indexer/code"
+	"gitea.dev/modules/indexer/code/gitgrep"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
 )
 
 const tplSearch templates.TplName = "repo/search"
diff --git a/routers/web/repo/setting/actions.go b/routers/web/repo/setting/actions.go
index 2237828d611..7c47537232c 100644
--- a/routers/web/repo/setting/actions.go
+++ b/routers/web/repo/setting/actions.go
@@ -6,17 +6,16 @@ package setting
 import (
 	"errors"
 	"net/http"
-	"strings"
 
-	"code.gitea.io/gitea/models/actions"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	shared_actions "code.gitea.io/gitea/routers/web/shared/actions"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/actions"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	shared_actions "gitea.dev/routers/web/shared/actions"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 )
 
 const tplRepoActionsGeneralSettings templates.TplName = "repo/settings/actions"
@@ -94,15 +93,12 @@ func ActionsUnitPost(ctx *context.Context) {
 }
 
 func AddCollaborativeOwner(ctx *context.Context) {
-	name := strings.ToLower(ctx.FormString("collaborative_owner"))
-
-	ownerID, err := user_model.GetUserOrOrgIDByName(ctx, name)
+	collUser, err := user_model.GetUserByName(ctx, ctx.FormString("collaborative_owner"))
 	if err != nil {
 		if errors.Is(err, util.ErrNotExist) {
-			ctx.Flash.Error(ctx.Tr("form.user_not_exist"))
-			ctx.JSONErrorNotFound()
+			ctx.JSONError(ctx.Tr("form.user_not_exist"))
 		} else {
-			ctx.ServerError("GetUserOrOrgIDByName", err)
+			ctx.ServerError("GetUserByName", err)
 		}
 		return
 	}
@@ -113,7 +109,7 @@ func AddCollaborativeOwner(ctx *context.Context) {
 		return
 	}
 	actionsCfg := actionsUnit.ActionsConfig()
-	actionsCfg.AddCollaborativeOwner(ownerID)
+	actionsCfg.AddCollaborativeOwner(collUser.ID)
 	if err := repo_model.UpdateRepoUnitConfig(ctx, actionsUnit); err != nil {
 		ctx.ServerError("UpdateRepoUnitConfig", err)
 		return
diff --git a/routers/web/repo/setting/avatar.go b/routers/web/repo/setting/avatar.go
index 504f57cfc2b..754e731a9b7 100644
--- a/routers/web/repo/setting/avatar.go
+++ b/routers/web/repo/setting/avatar.go
@@ -8,13 +8,13 @@ import (
 	"fmt"
 	"io"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	repo_service "gitea.dev/services/repository"
 )
 
 // UpdateAvatarSetting update repo's avatar
diff --git a/routers/web/repo/setting/collaboration.go b/routers/web/repo/setting/collaboration.go
index 177d10d165c..5682f4ffd10 100644
--- a/routers/web/repo/setting/collaboration.go
+++ b/routers/web/repo/setting/collaboration.go
@@ -8,16 +8,16 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/mailer"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
+	"gitea.dev/services/mailer"
+	repo_service "gitea.dev/services/repository"
 )
 
 // Collaboration render a repository's collaboration page
diff --git a/routers/web/repo/setting/default_branch.go b/routers/web/repo/setting/default_branch.go
index 044c9e556a5..204c4fa3cd8 100644
--- a/routers/web/repo/setting/default_branch.go
+++ b/routers/web/repo/setting/default_branch.go
@@ -6,12 +6,12 @@ package setting
 import (
 	"net/http"
 
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/routers/web/repo"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/routers/web/repo"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 )
 
 // SetDefaultBranchPost set default branch
diff --git a/routers/web/repo/setting/deploy_key.go b/routers/web/repo/setting/deploy_key.go
index ab54b8ccf5a..df4f43070a1 100644
--- a/routers/web/repo/setting/deploy_key.go
+++ b/routers/web/repo/setting/deploy_key.go
@@ -6,14 +6,14 @@ package setting
 import (
 	"net/http"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 // DeployKeys render the deploy keys list of a repository page
diff --git a/routers/web/repo/setting/git_hooks.go b/routers/web/repo/setting/git_hooks.go
index a5aa74dafad..9ea9e825ab3 100644
--- a/routers/web/repo/setting/git_hooks.go
+++ b/routers/web/repo/setting/git_hooks.go
@@ -6,9 +6,9 @@ package setting
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/routers/web/repo"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/git"
+	"gitea.dev/routers/web/repo"
+	"gitea.dev/services/context"
 )
 
 // GitHooks hooks of a repository
diff --git a/routers/web/repo/setting/lfs.go b/routers/web/repo/setting/lfs.go
index 06c482e65c8..72e512e1450 100644
--- a/routers/web/repo/setting/lfs.go
+++ b/routers/web/repo/setting/lfs.go
@@ -14,22 +14,22 @@ import (
 	"strconv"
 	"strings"
 
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/attribute"
-	"code.gitea.io/gitea/modules/git/pipeline"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/attribute"
+	"gitea.dev/modules/git/pipeline"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/repo/setting/main_test.go b/routers/web/repo/setting/main_test.go
index c414b853e51..770d7126811 100644
--- a/routers/web/repo/setting/main_test.go
+++ b/routers/web/repo/setting/main_test.go
@@ -6,7 +6,7 @@ package setting
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/web/repo/setting/protected_branch.go b/routers/web/repo/setting/protected_branch.go
index a5a25e6c4e0..ffc36ca62ce 100644
--- a/routers/web/repo/setting/protected_branch.go
+++ b/routers/web/repo/setting/protected_branch.go
@@ -12,22 +12,22 @@ import (
 	"strings"
 	"time"
 
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/web/repo"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	pull_service "code.gitea.io/gitea/services/pull"
-	"code.gitea.io/gitea/services/repository"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/web/repo"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	pull_service "gitea.dev/services/pull"
+	"gitea.dev/services/repository"
 )
 
 const (
@@ -83,6 +83,7 @@ func SettingsProtectedBranch(c *context.Context) {
 	c.Data["whitelist_users"] = strings.Join(base.Int64sToStrings(rule.WhitelistUserIDs), ",")
 	c.Data["force_push_allowlist_users"] = strings.Join(base.Int64sToStrings(rule.ForcePushAllowlistUserIDs), ",")
 	c.Data["merge_whitelist_users"] = strings.Join(base.Int64sToStrings(rule.MergeWhitelistUserIDs), ",")
+	c.Data["bypass_allowlist_users"] = strings.Join(base.Int64sToStrings(rule.BypassAllowlistUserIDs), ",")
 	c.Data["approvals_whitelist_users"] = strings.Join(base.Int64sToStrings(rule.ApprovalsWhitelistUserIDs), ",")
 	c.Data["status_check_contexts"] = strings.Join(rule.StatusCheckContexts, "\n")
 	contexts, _ := git_model.FindRepoRecentCommitStatusContexts(c, c.Repo.Repository.ID, 7*24*time.Hour) // Find last week status check contexts
@@ -98,6 +99,7 @@ func SettingsProtectedBranch(c *context.Context) {
 		c.Data["whitelist_teams"] = strings.Join(base.Int64sToStrings(rule.WhitelistTeamIDs), ",")
 		c.Data["force_push_allowlist_teams"] = strings.Join(base.Int64sToStrings(rule.ForcePushAllowlistTeamIDs), ",")
 		c.Data["merge_whitelist_teams"] = strings.Join(base.Int64sToStrings(rule.MergeWhitelistTeamIDs), ",")
+		c.Data["bypass_allowlist_teams"] = strings.Join(base.Int64sToStrings(rule.BypassAllowlistTeamIDs), ",")
 		c.Data["approvals_whitelist_teams"] = strings.Join(base.Int64sToStrings(rule.ApprovalsWhitelistTeamIDs), ",")
 	}
 
@@ -155,7 +157,7 @@ func SettingsProtectedBranchPost(ctx *context.Context) {
 		}
 	}
 
-	var whitelistUsers, whitelistTeams, forcePushAllowlistUsers, forcePushAllowlistTeams, mergeWhitelistUsers, mergeWhitelistTeams, approvalsWhitelistUsers, approvalsWhitelistTeams []int64
+	var whitelistUsers, whitelistTeams, forcePushAllowlistUsers, forcePushAllowlistTeams, mergeWhitelistUsers, mergeWhitelistTeams, approvalsWhitelistUsers, approvalsWhitelistTeams, bypassAllowlistUsers, bypassAllowlistTeams []int64
 	protectBranch.RuleName = f.RuleName
 	if f.RequiredApprovals < 0 {
 		ctx.Flash.Error(ctx.Tr("repo.settings.protected_branch_required_approvals_min"))
@@ -215,6 +217,16 @@ func SettingsProtectedBranchPost(ctx *context.Context) {
 		}
 	}
 
+	protectBranch.EnableBypassAllowlist = f.EnableBypassAllowlist
+	if f.EnableBypassAllowlist {
+		if strings.TrimSpace(f.BypassAllowlistUsers) != "" {
+			bypassAllowlistUsers, _ = base.StringsToInt64s(strings.Split(f.BypassAllowlistUsers, ","))
+		}
+		if strings.TrimSpace(f.BypassAllowlistTeams) != "" {
+			bypassAllowlistTeams, _ = base.StringsToInt64s(strings.Split(f.BypassAllowlistTeams, ","))
+		}
+	}
+
 	protectBranch.EnableStatusCheck = f.EnableStatusCheck
 	if f.EnableStatusCheck {
 		patterns := strings.Split(strings.ReplaceAll(f.StatusCheckContexts, "\r", "\n"), "\n")
@@ -271,6 +283,8 @@ func SettingsProtectedBranchPost(ctx *context.Context) {
 		MergeTeamIDs:     mergeWhitelistTeams,
 		ApprovalsUserIDs: approvalsWhitelistUsers,
 		ApprovalsTeamIDs: approvalsWhitelistTeams,
+		BypassUserIDs:    bypassAllowlistUsers,
+		BypassTeamIDs:    bypassAllowlistTeams,
 	}); err != nil {
 		ctx.ServerError("CreateOrUpdateProtectedBranch", err)
 		return
diff --git a/routers/web/repo/setting/protected_tag.go b/routers/web/repo/setting/protected_tag.go
index 4b560e6f224..51e64149aff 100644
--- a/routers/web/repo/setting/protected_tag.go
+++ b/routers/web/repo/setting/protected_tag.go
@@ -8,17 +8,17 @@ import (
 	"net/http"
 	"strings"
 
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 const (
diff --git a/routers/web/repo/setting/public_access.go b/routers/web/repo/setting/public_access.go
index 368d34294a2..15886b43548 100644
--- a/routers/web/repo/setting/public_access.go
+++ b/routers/web/repo/setting/public_access.go
@@ -8,12 +8,12 @@ import (
 	"slices"
 	"strconv"
 
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const tplRepoSettingsPublicAccess templates.TplName = "repo/settings/public_access"
diff --git a/routers/web/repo/setting/secrets.go b/routers/web/repo/setting/secrets.go
index 419aa268671..17675e56e79 100644
--- a/routers/web/repo/setting/secrets.go
+++ b/routers/web/repo/setting/secrets.go
@@ -7,11 +7,11 @@ import (
 	"errors"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	shared "code.gitea.io/gitea/routers/web/shared/secrets"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	shared "gitea.dev/routers/web/shared/secrets"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/repo/setting/setting.go b/routers/web/repo/setting/setting.go
index 816fd91cd8b..26607fb40bf 100644
--- a/routers/web/repo/setting/setting.go
+++ b/routers/web/repo/setting/setting.go
@@ -6,36 +6,37 @@ package setting
 
 import (
 	"errors"
+	"html/template"
 	"net/http"
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/indexer/code"
-	issue_indexer "code.gitea.io/gitea/modules/indexer/issues"
-	"code.gitea.io/gitea/modules/indexer/stats"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
-	"code.gitea.io/gitea/modules/web"
-	repo_router "code.gitea.io/gitea/routers/web/repo"
-	actions_service "code.gitea.io/gitea/services/actions"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/migrations"
-	mirror_service "code.gitea.io/gitea/services/mirror"
-	repo_service "code.gitea.io/gitea/services/repository"
-	wiki_service "code.gitea.io/gitea/services/wiki"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/indexer/code"
+	issue_indexer "gitea.dev/modules/indexer/issues"
+	"gitea.dev/modules/indexer/stats"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
+	"gitea.dev/modules/web"
+	repo_router "gitea.dev/routers/web/repo"
+	actions_service "gitea.dev/services/actions"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/migrations"
+	mirror_service "gitea.dev/services/mirror"
+	repo_service "gitea.dev/services/repository"
+	wiki_service "gitea.dev/services/wiki"
 
 	"xorm.io/xorm/convert"
 )
@@ -49,6 +50,12 @@ const (
 	tplDeployKeys      templates.TplName = "repo/settings/deploy_keys"
 )
 
+type selectOption struct {
+	Value    string
+	Text     template.HTML
+	Selected bool
+}
+
 // SettingsCtxData is a middleware that sets all the general context data for the
 // settings template.
 func SettingsCtxData(ctx *context.Context) {
@@ -66,6 +73,7 @@ func SettingsCtxData(ctx *context.Context) {
 	ctx.Data["SigningKeyAvailable"] = signing != nil
 	ctx.Data["SigningSettings"] = setting.Repository.Signing
 	ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled
+	preparePullRequestSettings(ctx)
 
 	if ctx.Doer.IsAdmin {
 		if setting.Indexer.RepoIndexerEnabled {
@@ -96,6 +104,35 @@ func SettingsCtxData(ctx *context.Context) {
 	}
 }
 
+func preparePullRequestSettings(ctx *context.Context) {
+	defaultUpdateStyle := repo_model.UpdateStyleMerge
+	if ctx.Repo.Repository.UnitEnabled(ctx, unit_model.TypePullRequests) {
+		prUnit := ctx.Repo.Repository.MustGetUnit(ctx, unit_model.TypePullRequests)
+		defaultUpdateStyle = util.IfZero(prUnit.PullRequestsConfig().DefaultUpdateStyle, repo_model.UpdateStyleMerge)
+	}
+
+	updateBranchText := ctx.Tr("repo.pulls.update_branch")
+	rebaseUpdateText := ctx.Tr("repo.pulls.update_branch_rebase")
+	defaultUpdateStyleText := updateBranchText
+	if defaultUpdateStyle == repo_model.UpdateStyleRebase {
+		defaultUpdateStyleText = rebaseUpdateText
+	}
+
+	ctx.Data["PullsDefaultUpdateStyleText"] = defaultUpdateStyleText
+	ctx.Data["PullsDefaultUpdateStyleOptions"] = []selectOption{
+		{
+			Value:    string(repo_model.UpdateStyleMerge),
+			Text:     updateBranchText,
+			Selected: defaultUpdateStyle == repo_model.UpdateStyleMerge,
+		},
+		{
+			Value:    string(repo_model.UpdateStyleRebase),
+			Text:     rebaseUpdateText,
+			Selected: defaultUpdateStyle == repo_model.UpdateStyleRebase,
+		},
+	}
+}
+
 // Settings show a repository's settings page
 func Settings(ctx *context.Context) {
 	ctx.HTML(http.StatusOK, tplSettingsOptions)
@@ -616,7 +653,8 @@ func handleSettingsPostAdvanced(ctx *context.Context) {
 	}
 
 	if form.EnablePulls && !unit_model.TypePullRequests.UnitGlobalDisabled() {
-		units = append(units, newRepoUnit(repo, unit_model.TypePullRequests, &repo_model.PullRequestsConfig{
+		defaultUpdateStyle := util.IfZero(repo_model.UpdateStyle(form.PullsDefaultUpdateStyle), repo_model.UpdateStyleMerge)
+		prConfig := &repo_model.PullRequestsConfig{
 			IgnoreWhitespaceConflicts:     form.PullsIgnoreWhitespace,
 			AllowMerge:                    form.PullsAllowMerge,
 			AllowRebase:                   form.PullsAllowRebase,
@@ -625,12 +663,20 @@ func handleSettingsPostAdvanced(ctx *context.Context) {
 			AllowFastForwardOnly:          form.PullsAllowFastForwardOnly,
 			AllowManualMerge:              form.PullsAllowManualMerge,
 			AutodetectManualMerge:         form.EnableAutodetectManualMerge,
+			AllowMergeUpdate:              form.PullsAllowMergeUpdate,
 			AllowRebaseUpdate:             form.PullsAllowRebaseUpdate,
+			DefaultUpdateStyle:            defaultUpdateStyle,
 			DefaultDeleteBranchAfterMerge: form.DefaultDeleteBranchAfterMerge,
 			DefaultMergeStyle:             repo_model.MergeStyle(form.PullsDefaultMergeStyle),
 			DefaultAllowMaintainerEdit:    form.DefaultAllowMaintainerEdit,
 			DefaultTargetBranch:           strings.TrimSpace(form.DefaultTargetBranch),
-		}))
+		}
+		if err := prConfig.ValidateUpdateSettings(); err != nil {
+			ctx.Flash.Error(err.Error())
+			ctx.Redirect(repo.Link() + "/settings")
+			return
+		}
+		units = append(units, newRepoUnit(repo, unit_model.TypePullRequests, prConfig))
 	} else if !unit_model.TypePullRequests.UnitGlobalDisabled() {
 		deleteUnitTypes = append(deleteUnitTypes, unit_model.TypePullRequests)
 	}
diff --git a/routers/web/repo/setting/settings_test.go b/routers/web/repo/setting/settings_test.go
index 154d01fda40..e86527536bb 100644
--- a/routers/web/repo/setting/settings_test.go
+++ b/routers/web/repo/setting/settings_test.go
@@ -7,21 +7,21 @@ import (
 	"net/http"
 	"testing"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/contexttest"
-	"code.gitea.io/gitea/services/forms"
-	mirror_service "code.gitea.io/gitea/services/mirror"
-	repo_service "code.gitea.io/gitea/services/repository"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/contexttest"
+	"gitea.dev/services/forms"
+	mirror_service "gitea.dev/services/mirror"
+	repo_service "gitea.dev/services/repository"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/routers/web/repo/setting/webhook.go b/routers/web/repo/setting/webhook.go
index 8c57a68b250..c52f5fc4b14 100644
--- a/routers/web/repo/setting/webhook.go
+++ b/routers/web/repo/setting/webhook.go
@@ -12,23 +12,23 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/forms"
-	webhook_service "code.gitea.io/gitea/services/webhook"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	webhook_module "gitea.dev/modules/webhook"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/forms"
+	webhook_service "gitea.dev/services/webhook"
 )
 
 const (
@@ -675,7 +675,7 @@ func TestWebhook(ctx *context.Context) {
 			ID:            objectFormat.EmptyObjectID(),
 			Author:        ghost.NewGitSig(),
 			Committer:     ghost.NewGitSig(),
-			CommitMessage: "This is a fake commit",
+			CommitMessage: git.CommitMessage{MessageRaw: "This is a fake commit"},
 		}
 	}
 
@@ -683,7 +683,7 @@ func TestWebhook(ctx *context.Context) {
 
 	apiCommit := &api.PayloadCommit{
 		ID:      commit.ID.String(),
-		Message: commit.Message(),
+		Message: commit.MessageUTF8(),
 		URL:     ctx.Repo.Repository.HTMLURL() + "/commit/" + url.PathEscape(commit.ID.String()),
 		Author: &api.PayloadUser{
 			Name:  commit.Author.Name,
diff --git a/routers/web/repo/star.go b/routers/web/repo/star.go
index c93c877d636..79ff8628236 100644
--- a/routers/web/repo/star.go
+++ b/routers/web/repo/star.go
@@ -6,9 +6,9 @@ package repo
 import (
 	"net/http"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const tplStarUnstar templates.TplName = "repo/header/star"
diff --git a/routers/web/repo/topic.go b/routers/web/repo/topic.go
index d81a695df97..1689d7ce380 100644
--- a/routers/web/repo/topic.go
+++ b/routers/web/repo/topic.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/services/context"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+	"gitea.dev/services/context"
 )
 
 // TopicsPost response for creating repository
diff --git a/routers/web/repo/transfer.go b/routers/web/repo/transfer.go
index a606e0343f1..b09ef7ccb2b 100644
--- a/routers/web/repo/transfer.go
+++ b/routers/web/repo/transfer.go
@@ -4,8 +4,8 @@
 package repo
 
 import (
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 )
 
 func acceptTransfer(ctx *context.Context) {
diff --git a/routers/web/repo/treelist.go b/routers/web/repo/treelist.go
index 8a3ed0a1c96..45889cbe5df 100644
--- a/routers/web/repo/treelist.go
+++ b/routers/web/repo/treelist.go
@@ -9,13 +9,13 @@ import (
 	"path"
 	"strings"
 
-	pull_model "code.gitea.io/gitea/models/pull"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/gitdiff"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	pull_model "gitea.dev/models/pull"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
+	"gitea.dev/services/context"
+	"gitea.dev/services/gitdiff"
+	files_service "gitea.dev/services/repository/files"
 
 	"github.com/go-enry/go-enry/v2"
 )
diff --git a/routers/web/repo/treelist_test.go b/routers/web/repo/treelist_test.go
index 019fe085d4b..be496933e86 100644
--- a/routers/web/repo/treelist_test.go
+++ b/routers/web/repo/treelist_test.go
@@ -7,10 +7,10 @@ import (
 	"html/template"
 	"testing"
 
-	pull_model "code.gitea.io/gitea/models/pull"
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/services/gitdiff"
+	pull_model "gitea.dev/models/pull"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
+	"gitea.dev/services/gitdiff"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index 2d95d5233e3..437eedc57f1 100644
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -16,29 +16,29 @@ import (
 	"strings"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	admin_model "code.gitea.io/gitea/models/admin"
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/util"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	activities_model "gitea.dev/models/activities"
+	admin_model "gitea.dev/models/admin"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/util"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 
 	_ "golang.org/x/image/bmp"  // for processing bmp images
 	_ "golang.org/x/image/webp" // for processing webp images
diff --git a/routers/web/repo/view_file.go b/routers/web/repo/view_file.go
index f6c97e83bba..6bbfc0cdeb0 100644
--- a/routers/web/repo/view_file.go
+++ b/routers/web/repo/view_file.go
@@ -11,21 +11,21 @@ import (
 	"path"
 	"strings"
 
-	git_model "code.gitea.io/gitea/models/git"
-	issue_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/renderhelper"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/attribute"
-	"code.gitea.io/gitea/modules/highlight"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	issue_service "code.gitea.io/gitea/services/issue"
+	git_model "gitea.dev/models/git"
+	issue_model "gitea.dev/models/issues"
+	"gitea.dev/models/renderhelper"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/actions"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/attribute"
+	"gitea.dev/modules/highlight"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	issue_service "gitea.dev/services/issue"
 )
 
 func prepareLatestCommitInfo(ctx *context.Context) bool {
diff --git a/routers/web/repo/view_home.go b/routers/web/repo/view_home.go
index cbdc65b6c0b..ae72ac14808 100644
--- a/routers/web/repo/view_home.go
+++ b/routers/web/repo/view_home.go
@@ -11,23 +11,23 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/svg"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/web/feed"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/web/feed"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 )
 
 func checkOutdatedBranch(ctx *context.Context) {
@@ -276,7 +276,7 @@ func handleRepoViewSubmodule(ctx *context.Context, commitSubmoduleFile *git.Comm
 	redirectLink := submoduleWebLink.CommitWebLink
 	if isViewHomeOnlyContent(ctx) {
 		ctx.Resp.Header().Set("Content-Type", "text/html; charset=utf-8")
-		_, _ = ctx.Resp.Write([]byte(htmlutil.HTMLFormat(`<a href="%s">%s</a>`, redirectLink, redirectLink)))
+		_, _ = htmlutil.HTMLPrintf(ctx.Resp, `<a href="%s">%s</a>`, redirectLink, redirectLink)
 	} else if !httplib.IsCurrentGiteaSiteURL(ctx, redirectLink) {
 		// don't auto-redirect to external URL, to avoid open redirect or phishing
 		ctx.Data["NotFoundPrompt"] = redirectLink
diff --git a/routers/web/repo/view_home_test.go b/routers/web/repo/view_home_test.go
index dd74ae560b4..b17c5f4f430 100644
--- a/routers/web/repo/view_home_test.go
+++ b/routers/web/repo/view_home_test.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	git_module "code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/unittest"
+	git_module "gitea.dev/modules/git"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/repo/view_readme.go b/routers/web/repo/view_readme.go
index 79ca9efc363..2e50755d4f7 100644
--- a/routers/web/repo/view_readme.go
+++ b/routers/web/repo/view_readme.go
@@ -13,14 +13,14 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/models/renderhelper"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/renderhelper"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 // locate a README for a tree in one of the supported paths.
diff --git a/routers/web/repo/view_readme_test.go b/routers/web/repo/view_readme_test.go
index 5f61b03fb80..43bee26450e 100644
--- a/routers/web/repo/view_readme_test.go
+++ b/routers/web/repo/view_readme_test.go
@@ -8,9 +8,9 @@ import (
 	"path"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/routers/web/repo/watch.go b/routers/web/repo/watch.go
index 616e1ee89c7..8d745cb91f8 100644
--- a/routers/web/repo/watch.go
+++ b/routers/web/repo/watch.go
@@ -6,9 +6,9 @@ package repo
 import (
 	"net/http"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const tplWatchUnwatch templates.TplName = "repo/header/watch"
diff --git a/routers/web/repo/webgit.go b/routers/web/repo/webgit.go
index 5f390197e72..b92b2ff76f3 100644
--- a/routers/web/repo/webgit.go
+++ b/routers/web/repo/webgit.go
@@ -4,12 +4,12 @@
 package repo
 
 import (
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	files_service "gitea.dev/services/repository/files"
 )
 
 func WebGitOperationCommonData(ctx *context.Context) {
diff --git a/routers/web/repo/wiki.go b/routers/web/repo/wiki.go
index 78fb0ca0af0..dcb0c25829f 100644
--- a/routers/web/repo/wiki.go
+++ b/routers/web/repo/wiki.go
@@ -13,28 +13,28 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/models/renderhelper"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	git_service "code.gitea.io/gitea/services/git"
-	notify_service "code.gitea.io/gitea/services/notify"
-	repo_service "code.gitea.io/gitea/services/repository"
-	wiki_service "code.gitea.io/gitea/services/wiki"
+	"gitea.dev/models/renderhelper"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	git_service "gitea.dev/services/git"
+	notify_service "gitea.dev/services/notify"
+	repo_service "gitea.dev/services/repository"
+	wiki_service "gitea.dev/services/wiki"
 )
 
 const (
@@ -496,7 +496,7 @@ func Wiki(ctx *context.Context) {
 		ctx.ServerError("GetCommitByPath", err)
 		return
 	}
-	ctx.Data["Author"] = lastCommit.Author
+	ctx.Data["Committer"] = lastCommit.Committer
 
 	ctx.HTML(http.StatusOK, tplWikiView)
 }
@@ -528,7 +528,7 @@ func WikiRevision(ctx *context.Context) {
 		ctx.ServerError("GetCommitByPath", err)
 		return
 	}
-	ctx.Data["Author"] = lastCommit.Author
+	ctx.Data["Committer"] = lastCommit.Committer
 
 	ctx.HTML(http.StatusOK, tplWikiRevision)
 }
@@ -587,7 +587,7 @@ func WikiPages(ctx *context.Context) {
 			Name:         displayName,
 			SubURL:       wiki_service.WebPathToURLPath(wikiName),
 			GitEntryName: entry.Entry.Name(),
-			UpdatedUnix:  timeutil.TimeStamp(entry.Commit.Author.When.Unix()),
+			UpdatedUnix:  timeutil.TimeStamp(entry.Commit.Committer.When.Unix()),
 		})
 	}
 	ctx.Data["Pages"] = pages
diff --git a/routers/web/repo/wiki_test.go b/routers/web/repo/wiki_test.go
index 409d7c9a05b..28702361e51 100644
--- a/routers/web/repo/wiki_test.go
+++ b/routers/web/repo/wiki_test.go
@@ -9,15 +9,15 @@ import (
 	"net/url"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/contexttest"
-	"code.gitea.io/gitea/services/forms"
-	repo_service "code.gitea.io/gitea/services/repository"
-	wiki_service "code.gitea.io/gitea/services/wiki"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/contexttest"
+	"gitea.dev/services/forms"
+	repo_service "gitea.dev/services/repository"
+	wiki_service "gitea.dev/services/wiki"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/routers/web/shared/actions/general.go b/routers/web/shared/actions/general.go
index 8a924f6e1fe..9db7bdf852f 100644
--- a/routers/web/shared/actions/general.go
+++ b/routers/web/shared/actions/general.go
@@ -8,13 +8,13 @@ import (
 	"slices"
 	"strconv"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/shared/actions/runners.go b/routers/web/shared/actions/runners.go
index 9d8b2f08eb1..f174bfb1cd4 100644
--- a/routers/web/shared/actions/runners.go
+++ b/routers/web/shared/actions/runners.go
@@ -4,21 +4,22 @@
 package actions
 
 import (
+	stdctx "context"
 	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 const (
@@ -158,6 +159,7 @@ func Runners(ctx *context.Context) {
 	ctx.Data["RunnerOwnerID"] = opts.OwnerID
 	ctx.Data["RunnerRepoID"] = opts.RepoID
 	ctx.Data["SortType"] = opts.Sort
+	ctx.Data["AllowBulkActions"] = rCtx.IsAdmin
 
 	pager := context.NewPagination(count, opts.PageSize, opts.Page, 5)
 
@@ -362,6 +364,76 @@ func RunnerUpdatePost(ctx *context.Context) {
 	ctx.JSONRedirect("")
 }
 
+// RunnerBulkActionPost performs a bulk action (delete/disable/enable) on multiple runners.
+// Admin-only: route must be mounted inside the admin runners group; defense-in-depth check below.
+func RunnerBulkActionPost(ctx *context.Context) {
+	rCtx, err := getRunnersCtx(ctx)
+	if err != nil {
+		ctx.ServerError("getRunnersCtx", err)
+		return
+	}
+
+	var runnerIDs []int64
+	if rCtx.IsAdmin {
+		// ATTENTION: it completely depends on the assumption that the doer is "site admin"
+		// So it doesn't do extra permission check to the runner IDs
+		// In the future, if you need to support such operation on non-admin pages, be careful!
+		runnerIDs = ctx.FormStringInt64s("ids")
+	} else {
+		ctx.HTTPError(http.StatusForbidden, "bulk actions are admin-only")
+		return
+	}
+
+	action := ctx.FormString("action")
+	var successKey, failedKey string
+	switch action {
+	case "delete":
+		successKey, failedKey = "actions.runners.delete_runner_success", "actions.runners.delete_runner_failed"
+	case "disable":
+		successKey, failedKey = "actions.runners.disable_runner_success", "actions.runners.disable_runner_failed"
+	case "enable":
+		successKey, failedKey = "actions.runners.enable_runner_success", "actions.runners.enable_runner_failed"
+	default:
+		ctx.HTTPError(http.StatusBadRequest, "invalid action")
+		return
+	}
+
+	runners, err := db.Find[actions_model.ActionRunner](ctx, &actions_model.FindRunnerOptions{IDs: runnerIDs})
+	if err != nil {
+		ctx.ServerError("FindRunners", err)
+		return
+	}
+
+	err = db.WithTx(ctx, func(txCtx stdctx.Context) error {
+		for _, r := range runners {
+			switch action {
+			case "delete":
+				if err := actions_model.DeleteRunner(txCtx, r.ID); err != nil {
+					return err
+				}
+			case "disable":
+				if err := actions_model.SetRunnerDisabled(txCtx, r, true); err != nil {
+					return err
+				}
+			case "enable":
+				if err := actions_model.SetRunnerDisabled(txCtx, r, false); err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		log.Warn("RunnerBulkActionPost.%s failed: %v, url: %s", action, err, ctx.Req.URL)
+		ctx.Flash.Error(ctx.Tr(failedKey))
+		ctx.JSONRedirect(rCtx.RedirectLink)
+		return
+	}
+
+	ctx.Flash.Success(ctx.Tr(successKey))
+	ctx.JSONRedirect(rCtx.RedirectLink)
+}
+
 func findActionsRunner(ctx *context.Context, rCtx *runnersCtx) *actions_model.ActionRunner {
 	runnerID := ctx.PathParamInt64("runnerid")
 	opts := &actions_model.FindRunnerOptions{
diff --git a/routers/web/shared/actions/variables.go b/routers/web/shared/actions/variables.go
index 8a8c49f415c..e26e2ba5d3b 100644
--- a/routers/web/shared/actions/variables.go
+++ b/routers/web/shared/actions/variables.go
@@ -7,16 +7,16 @@ import (
 	"errors"
 	"net/http"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	actions_service "code.gitea.io/gitea/services/actions"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	shared_user "gitea.dev/routers/web/shared/user"
+	actions_service "gitea.dev/services/actions"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 const (
diff --git a/routers/web/shared/issue/issue_label.go b/routers/web/shared/issue/issue_label.go
index e2eeaaf0afd..d8ebc987df1 100644
--- a/routers/web/shared/issue/issue_label.go
+++ b/routers/web/shared/issue/issue_label.go
@@ -6,11 +6,11 @@ package issue
 import (
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/services/context"
 )
 
 // PrepareFilterIssueLabels reads the "labels" query parameter, sets `ctx.Data["Labels"]` and `ctx.Data["SelectLabels"]`
diff --git a/routers/web/shared/label/label.go b/routers/web/shared/label/label.go
index 4a3c84e32ad..f1f166cc68a 100644
--- a/routers/web/shared/label/label.go
+++ b/routers/web/shared/label/label.go
@@ -4,10 +4,10 @@
 package label
 
 import (
-	"code.gitea.io/gitea/modules/label"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/modules/label"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 func GetLabelEditForm(ctx *context.Context) *forms.CreateLabelForm {
diff --git a/routers/web/shared/mention/mention.go b/routers/web/shared/mention/mention.go
index 5f163cb1462..df2826ae425 100644
--- a/routers/web/shared/mention/mention.go
+++ b/routers/web/shared/mention/mention.go
@@ -6,8 +6,8 @@ package mention
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
 )
 
 // Mention is the JSON structure returned by mention autocomplete endpoints.
diff --git a/routers/web/shared/packages/packages.go b/routers/web/shared/packages/packages.go
index a18dedf89c9..80267aaaf7a 100644
--- a/routers/web/shared/packages/packages.go
+++ b/routers/web/shared/packages/packages.go
@@ -8,16 +8,16 @@ import (
 	"net/http"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	cargo_service "code.gitea.io/gitea/services/packages/cargo"
-	container_service "code.gitea.io/gitea/services/packages/container"
+	packages_model "gitea.dev/models/packages"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	cargo_service "gitea.dev/services/packages/cargo"
+	container_service "gitea.dev/services/packages/container"
 )
 
 func SetPackagesContext(ctx *context.Context, owner *user_model.User) {
diff --git a/routers/web/shared/project/column.go b/routers/web/shared/project/column.go
index b6ffaea7f8a..8589bf7280d 100644
--- a/routers/web/shared/project/column.go
+++ b/routers/web/shared/project/column.go
@@ -4,9 +4,9 @@
 package project
 
 import (
-	project_model "code.gitea.io/gitea/models/project"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/services/context"
+	project_model "gitea.dev/models/project"
+	"gitea.dev/modules/json"
+	"gitea.dev/services/context"
 )
 
 // MoveColumns moves or keeps columns in a project and sorts them inside that project
diff --git a/routers/web/shared/secrets/secrets.go b/routers/web/shared/secrets/secrets.go
index c8842a67e90..53714364884 100644
--- a/routers/web/shared/secrets/secrets.go
+++ b/routers/web/shared/secrets/secrets.go
@@ -4,14 +4,14 @@
 package secrets
 
 import (
-	"code.gitea.io/gitea/models/db"
-	secret_model "code.gitea.io/gitea/models/secret"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	secret_service "code.gitea.io/gitea/services/secrets"
+	"gitea.dev/models/db"
+	secret_model "gitea.dev/models/secret"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	secret_service "gitea.dev/services/secrets"
 )
 
 func SetSecretsContext(ctx *context.Context, ownerID, repoID int64) {
diff --git a/routers/web/shared/user/block.go b/routers/web/shared/user/block.go
index beb8832da17..d08f2be6e88 100644
--- a/routers/web/shared/user/block.go
+++ b/routers/web/shared/user/block.go
@@ -6,13 +6,13 @@ package user
 import (
 	"errors"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	user_service "code.gitea.io/gitea/services/user"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	user_service "gitea.dev/services/user"
 )
 
 func BlockedUsers(ctx *context.Context, blocker *user_model.User) {
diff --git a/routers/web/shared/user/header.go b/routers/web/shared/user/header.go
index b1ff9db7a28..e4fd4643756 100644
--- a/routers/web/shared/user/header.go
+++ b/routers/web/shared/user/header.go
@@ -7,22 +7,22 @@ import (
 	"errors"
 	"net/url"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 )
 
 // prepareContextForProfileBigAvatar set the context for big avatar view on the profile page
diff --git a/routers/web/shared/user/helper.go b/routers/web/shared/user/helper.go
index 3fc39fd3ab9..129b5003764 100644
--- a/routers/web/shared/user/helper.go
+++ b/routers/web/shared/user/helper.go
@@ -8,7 +8,7 @@ import (
 	"slices"
 	"strconv"
 
-	"code.gitea.io/gitea/models/user"
+	"gitea.dev/models/user"
 )
 
 func MakeSelfOnTop(doer *user.User, users []*user.User) []*user.User {
diff --git a/routers/web/shared/user/helper_test.go b/routers/web/shared/user/helper_test.go
index ccdf536c137..563d383a4e3 100644
--- a/routers/web/shared/user/helper_test.go
+++ b/routers/web/shared/user/helper_test.go
@@ -6,7 +6,7 @@ package user
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/user"
+	"gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/swagger_json.go b/routers/web/swagger_json.go
index da41fd90133..201249cd921 100644
--- a/routers/web/swagger_json.go
+++ b/routers/web/swagger_json.go
@@ -6,8 +6,8 @@ package web
 import (
 	"html/template"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 // SwaggerV1Json render swagger v1 json
diff --git a/routers/web/user/avatar.go b/routers/web/user/avatar.go
index 2eca669194e..fa179758f63 100644
--- a/routers/web/user/avatar.go
+++ b/routers/web/user/avatar.go
@@ -6,10 +6,10 @@ package user
 import (
 	"time"
 
-	"code.gitea.io/gitea/models/avatars"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/avatars"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/services/context"
 )
 
 func cacheableRedirect(ctx *context.Context, location string) {
diff --git a/routers/web/user/code.go b/routers/web/user/code.go
index b4de516b3f7..ff2af15d803 100644
--- a/routers/web/user/code.go
+++ b/routers/web/user/code.go
@@ -7,14 +7,14 @@ import (
 	"net/http"
 	"slices"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	code_indexer "code.gitea.io/gitea/modules/indexer/code"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/routers/common"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	code_indexer "gitea.dev/modules/indexer/code"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/routers/common"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/user/heatmap.go b/routers/web/user/heatmap.go
index e81739e5b89..a9e7ac86ccf 100644
--- a/routers/web/user/heatmap.go
+++ b/routers/web/user/heatmap.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"net/url"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 func prepareHeatmapURL(ctx *context.Context) {
diff --git a/routers/web/user/home.go b/routers/web/user/home.go
index 12fb1ee71b0..3573a132414 100644
--- a/routers/web/user/home.go
+++ b/routers/web/user/home.go
@@ -14,33 +14,33 @@ import (
 	"strconv"
 	"strings"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/renderhelper"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/indexer"
-	issue_indexer "code.gitea.io/gitea/modules/indexer/issues"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/web/feed"
-	"code.gitea.io/gitea/routers/web/shared/issue"
-	"code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	feed_service "code.gitea.io/gitea/services/feed"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
+	activities_model "gitea.dev/models/activities"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/renderhelper"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/indexer"
+	issue_indexer "gitea.dev/modules/indexer/issues"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/web/feed"
+	"gitea.dev/routers/web/shared/issue"
+	"gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	feed_service "gitea.dev/services/feed"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
diff --git a/routers/web/user/home_test.go b/routers/web/user/home_test.go
index 5f3646769e8..8ea70d0bb4f 100644
--- a/routers/web/user/home_test.go
+++ b/routers/web/user/home_test.go
@@ -7,12 +7,12 @@ import (
 	"net/http"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/contexttest"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/user/main_test.go b/routers/web/user/main_test.go
index 8b6ae69296b..bcec936cbbd 100644
--- a/routers/web/user/main_test.go
+++ b/routers/web/user/main_test.go
@@ -6,7 +6,7 @@ package user
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/web/user/notification.go b/routers/web/user/notification.go
index 8133388c5de..95c66bd2ea9 100644
--- a/routers/web/user/notification.go
+++ b/routers/web/user/notification.go
@@ -8,23 +8,23 @@ import (
 	"net/http"
 	"strings"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
 )
 
 const (
diff --git a/routers/web/user/package.go b/routers/web/user/package.go
index d25dc45ba87..35a7ae88d06 100644
--- a/routers/web/user/package.go
+++ b/routers/web/user/package.go
@@ -10,32 +10,32 @@ import (
 	"net/url"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	org_model "code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	container_model "code.gitea.io/gitea/models/packages/container"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/optional"
-	alpine_module "code.gitea.io/gitea/modules/packages/alpine"
-	arch_module "code.gitea.io/gitea/modules/packages/arch"
-	container_module "code.gitea.io/gitea/modules/packages/container"
-	debian_module "code.gitea.io/gitea/modules/packages/debian"
-	rpm_module "code.gitea.io/gitea/modules/packages/rpm"
-	terraform_module "code.gitea.io/gitea/modules/packages/terraform"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	packages_helper "code.gitea.io/gitea/routers/api/packages/helper"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	packages_service "code.gitea.io/gitea/services/packages"
-	container_service "code.gitea.io/gitea/services/packages/container"
+	"gitea.dev/models/db"
+	org_model "gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	container_model "gitea.dev/models/packages/container"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/optional"
+	alpine_module "gitea.dev/modules/packages/alpine"
+	arch_module "gitea.dev/modules/packages/arch"
+	container_module "gitea.dev/modules/packages/container"
+	debian_module "gitea.dev/modules/packages/debian"
+	rpm_module "gitea.dev/modules/packages/rpm"
+	terraform_module "gitea.dev/modules/packages/terraform"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	packages_helper "gitea.dev/routers/api/packages/helper"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	packages_service "gitea.dev/services/packages"
+	container_service "gitea.dev/services/packages/container"
 
 	"github.com/google/uuid"
 )
diff --git a/routers/web/user/profile.go b/routers/web/user/profile.go
index b1d00520c2c..dfe9a12bc2f 100644
--- a/routers/web/user/profile.go
+++ b/routers/web/user/profile.go
@@ -10,24 +10,24 @@ import (
 	"path"
 	"strings"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/renderhelper"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/web/feed"
-	"code.gitea.io/gitea/routers/web/org"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	feed_service "code.gitea.io/gitea/services/feed"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/renderhelper"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/web/feed"
+	"gitea.dev/routers/web/org"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	feed_service "gitea.dev/services/feed"
 )
 
 const (
diff --git a/routers/web/user/search.go b/routers/web/user/search.go
index b2a15bf90eb..467333a6b57 100644
--- a/routers/web/user/search.go
+++ b/routers/web/user/search.go
@@ -6,12 +6,12 @@ package user
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // SearchCandidates searches candidate users for dropdown list
diff --git a/routers/web/user/setting/account.go b/routers/web/user/setting/account.go
index 23bdf33d5fa..1927efb7fe0 100644
--- a/routers/web/user/setting/account.go
+++ b/routers/web/user/setting/account.go
@@ -9,24 +9,24 @@ import (
 	"net/http"
 	"time"
 
-	org_model "code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/auth/source/db"
-	"code.gitea.io/gitea/services/auth/source/smtp"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/mailer"
-	"code.gitea.io/gitea/services/user"
+	org_model "gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/password"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/auth/source/db"
+	"gitea.dev/services/auth/source/smtp"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/mailer"
+	"gitea.dev/services/user"
 )
 
 const (
diff --git a/routers/web/user/setting/account_test.go b/routers/web/user/setting/account_test.go
index 9b8cffc868c..caf358f2c0c 100644
--- a/routers/web/user/setting/account_test.go
+++ b/routers/web/user/setting/account_test.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/contexttest"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/contexttest"
+	"gitea.dev/services/forms"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/user/setting/adopt.go b/routers/web/user/setting/adopt.go
index abf9d8c6db9..f2b04872f73 100644
--- a/routers/web/user/setting/adopt.go
+++ b/routers/web/user/setting/adopt.go
@@ -4,11 +4,11 @@
 package setting
 
 import (
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
-	repo_service "code.gitea.io/gitea/services/repository"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
+	repo_service "gitea.dev/services/repository"
 )
 
 // AdoptOrDeleteRepository adopts or deletes a repository
diff --git a/routers/web/user/setting/applications.go b/routers/web/user/setting/applications.go
index 9e33b487ea4..c50b96adb47 100644
--- a/routers/web/user/setting/applications.go
+++ b/routers/web/user/setting/applications.go
@@ -8,14 +8,14 @@ import (
 	"net/http"
 	"strings"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 const (
diff --git a/routers/web/user/setting/block.go b/routers/web/user/setting/block.go
index 1376c0417d0..e2fc8d8d9d7 100644
--- a/routers/web/user/setting/block.go
+++ b/routers/web/user/setting/block.go
@@ -6,10 +6,10 @@ package setting
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/user/setting/keys.go b/routers/web/user/setting/keys.go
index b82fa24a5df..2e26305e4f6 100644
--- a/routers/web/user/setting/keys.go
+++ b/routers/web/user/setting/keys.go
@@ -8,15 +8,15 @@ import (
 	"errors"
 	"net/http"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/web"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/web"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 const (
diff --git a/routers/web/user/setting/main_test.go b/routers/web/user/setting/main_test.go
index e398208d0da..5de9b48f3ec 100644
--- a/routers/web/user/setting/main_test.go
+++ b/routers/web/user/setting/main_test.go
@@ -6,7 +6,7 @@ package setting
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/web/user/setting/notifications.go b/routers/web/user/setting/notifications.go
index 8ff6f1d941f..ea206be55ee 100644
--- a/routers/web/user/setting/notifications.go
+++ b/routers/web/user/setting/notifications.go
@@ -6,13 +6,13 @@ package setting
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/user"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
+	"gitea.dev/services/user"
 )
 
 const tplSettingsNotifications templates.TplName = "user/settings/notifications"
diff --git a/routers/web/user/setting/oauth2.go b/routers/web/user/setting/oauth2.go
index 84cb34ea5e6..9a26353bc27 100644
--- a/routers/web/user/setting/oauth2.go
+++ b/routers/web/user/setting/oauth2.go
@@ -4,9 +4,9 @@
 package setting
 
 import (
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/user/setting/oauth2_common.go b/routers/web/user/setting/oauth2_common.go
index f460acce105..30b5ebe5caf 100644
--- a/routers/web/user/setting/oauth2_common.go
+++ b/routers/web/user/setting/oauth2_common.go
@@ -7,13 +7,13 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	shared_user "code.gitea.io/gitea/routers/web/shared/user"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/auth"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	shared_user "gitea.dev/routers/web/shared/user"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 type OAuth2CommonHandlers struct {
diff --git a/routers/web/user/setting/packages.go b/routers/web/user/setting/packages.go
index 66aa2413775..68491a39ffc 100644
--- a/routers/web/user/setting/packages.go
+++ b/routers/web/user/setting/packages.go
@@ -7,13 +7,13 @@ import (
 	"net/http"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
-	chef_module "code.gitea.io/gitea/modules/packages/chef"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	shared "code.gitea.io/gitea/routers/web/shared/packages"
-	"code.gitea.io/gitea/services/context"
+	user_model "gitea.dev/models/user"
+	chef_module "gitea.dev/modules/packages/chef"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	shared "gitea.dev/routers/web/shared/packages"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/user/setting/profile.go b/routers/web/user/setting/profile.go
index 88d8e75d0cd..57053a0861e 100644
--- a/routers/web/user/setting/profile.go
+++ b/routers/web/user/setting/profile.go
@@ -14,25 +14,25 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/models/avatars"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/typesniffer"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
-	user_service "code.gitea.io/gitea/services/user"
-	"code.gitea.io/gitea/services/webtheme"
+	"gitea.dev/models/avatars"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/typesniffer"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
+	user_service "gitea.dev/services/user"
+	"gitea.dev/services/webtheme"
 )
 
 const (
diff --git a/routers/web/user/setting/security/2fa.go b/routers/web/user/setting/security/2fa.go
index 8a02aa216cb..23fd6763fa7 100644
--- a/routers/web/user/setting/security/2fa.go
+++ b/routers/web/user/setting/security/2fa.go
@@ -12,14 +12,14 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/session"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/session"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 
 	"github.com/pquerna/otp"
 	"github.com/pquerna/otp/totp"
diff --git a/routers/web/user/setting/security/main_test.go b/routers/web/user/setting/security/main_test.go
index 2a27cd6dbfb..0fc03c56353 100644
--- a/routers/web/user/setting/security/main_test.go
+++ b/routers/web/user/setting/security/main_test.go
@@ -6,7 +6,7 @@ package security
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/routers/web/user/setting/security/openid.go b/routers/web/user/setting/security/openid.go
index f71bd518e39..9a506f36850 100644
--- a/routers/web/user/setting/security/openid.go
+++ b/routers/web/user/setting/security/openid.go
@@ -7,14 +7,14 @@ import (
 	"errors"
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/openid"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/openid"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 )
 
 // OpenIDPost response for change user's openid
diff --git a/routers/web/user/setting/security/openid_test.go b/routers/web/user/setting/security/openid_test.go
index 860639ea1c8..046e7357e1b 100644
--- a/routers/web/user/setting/security/openid_test.go
+++ b/routers/web/user/setting/security/openid_test.go
@@ -7,8 +7,8 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/unittest"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/routers/web/user/setting/security/security.go b/routers/web/user/setting/security/security.go
index 1b7efa27d5f..e573289b1fb 100644
--- a/routers/web/user/setting/security/security.go
+++ b/routers/web/user/setting/security/security.go
@@ -8,14 +8,14 @@ import (
 	"net/http"
 	"sort"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/context"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/user/setting/security/webauthn.go b/routers/web/user/setting/security/webauthn.go
index eb9f46af520..a265fcdd100 100644
--- a/routers/web/user/setting/security/webauthn.go
+++ b/routers/web/user/setting/security/webauthn.go
@@ -9,15 +9,15 @@ import (
 	"strconv"
 	"time"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	wa "code.gitea.io/gitea/modules/auth/webauthn"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/session"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	wa "gitea.dev/modules/auth/webauthn"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/session"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 
 	"github.com/go-webauthn/webauthn/protocol"
 	"github.com/go-webauthn/webauthn/webauthn"
diff --git a/routers/web/user/setting/settings.go b/routers/web/user/setting/settings.go
index e02ddc39af8..5241c5d913c 100644
--- a/routers/web/user/setting/settings.go
+++ b/routers/web/user/setting/settings.go
@@ -7,10 +7,10 @@ import (
 	"net/http"
 	"strconv"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 func SettingsCtxData(ctx *context.Context) {
diff --git a/routers/web/user/setting/webhooks.go b/routers/web/user/setting/webhooks.go
index 3c5d54cbc69..9f45f79bc07 100644
--- a/routers/web/user/setting/webhooks.go
+++ b/routers/web/user/setting/webhooks.go
@@ -6,11 +6,11 @@ package setting
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/context"
 )
 
 const (
diff --git a/routers/web/user/stop_watch.go b/routers/web/user/stop_watch.go
index 4bd8841573d..0c674cfe58c 100644
--- a/routers/web/user/stop_watch.go
+++ b/routers/web/user/stop_watch.go
@@ -6,10 +6,10 @@ package user
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 // GetStopwatches get all stopwatches
diff --git a/routers/web/web.go b/routers/web/web.go
index ecd75250d24..49a83c1fae5 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -7,46 +7,46 @@ import (
 	"net/http"
 	"strings"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/metrics"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/validation"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/modules/web/routing"
-	"code.gitea.io/gitea/modules/web/types"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/routers/web/admin"
-	"code.gitea.io/gitea/routers/web/auth"
-	"code.gitea.io/gitea/routers/web/devtest"
-	"code.gitea.io/gitea/routers/web/events"
-	"code.gitea.io/gitea/routers/web/explore"
-	"code.gitea.io/gitea/routers/web/feed"
-	"code.gitea.io/gitea/routers/web/healthcheck"
-	"code.gitea.io/gitea/routers/web/misc"
-	"code.gitea.io/gitea/routers/web/org"
-	"code.gitea.io/gitea/routers/web/repo"
-	"code.gitea.io/gitea/routers/web/repo/actions"
-	repo_setting "code.gitea.io/gitea/routers/web/repo/setting"
-	shared_actions "code.gitea.io/gitea/routers/web/shared/actions"
-	"code.gitea.io/gitea/routers/web/shared/project"
-	"code.gitea.io/gitea/routers/web/user"
-	user_setting "code.gitea.io/gitea/routers/web/user/setting"
-	"code.gitea.io/gitea/routers/web/user/setting/security"
-	auth_service "code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/forms"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/metrics"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/validation"
+	"gitea.dev/modules/web"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/modules/web/routing"
+	"gitea.dev/modules/web/types"
+	"gitea.dev/routers/common"
+	"gitea.dev/routers/web/admin"
+	"gitea.dev/routers/web/auth"
+	"gitea.dev/routers/web/devtest"
+	"gitea.dev/routers/web/events"
+	"gitea.dev/routers/web/explore"
+	"gitea.dev/routers/web/feed"
+	"gitea.dev/routers/web/healthcheck"
+	"gitea.dev/routers/web/misc"
+	"gitea.dev/routers/web/org"
+	"gitea.dev/routers/web/repo"
+	"gitea.dev/routers/web/repo/actions"
+	repo_setting "gitea.dev/routers/web/repo/setting"
+	shared_actions "gitea.dev/routers/web/shared/actions"
+	"gitea.dev/routers/web/shared/project"
+	"gitea.dev/routers/web/user"
+	user_setting "gitea.dev/routers/web/user/setting"
+	"gitea.dev/routers/web/user/setting/security"
+	auth_service "gitea.dev/services/auth"
+	"gitea.dev/services/context"
+	"gitea.dev/services/forms"
 
-	_ "code.gitea.io/gitea/modules/session" // to register all internal adapters
+	_ "gitea.dev/modules/session" // to register all internal adapters
 
 	"gitea.com/go-chi/captcha"
 	chi_middleware "github.com/go-chi/chi/v5/middleware"
@@ -863,6 +863,7 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
 		m.Group("/actions", func() {
 			m.Get("", misc.LocationRedirect("./actions/runners"))
 			addSettingsRunnersRoutes()
+			m.Post("/runners/bulk", shared_actions.RunnerBulkActionPost)
 			addSettingsVariablesRoutes()
 		})
 	}, adminReq, ctxDataSet("EnableOAuth2", setting.OAuth2.Enabled, "EnablePackages", setting.Packages.Enabled))
diff --git a/routers/web/webfinger.go b/routers/web/webfinger.go
index 9d65b48ac73..3ba5371e1e2 100644
--- a/routers/web/webfinger.go
+++ b/routers/web/webfinger.go
@@ -10,10 +10,10 @@ import (
 	"strconv"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 // https://datatracker.ietf.org/doc/html/draft-ietf-appsawg-webfinger-14#section-4.4
diff --git a/services/actions/approve.go b/services/actions/approve.go
index 552b055b706..31d77f01ae7 100644
--- a/services/actions/approve.go
+++ b/services/actions/approve.go
@@ -5,16 +5,22 @@ package actions
 
 import (
 	"context"
+	"errors"
+	"fmt"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
 )
 
 func ApproveRuns(ctx context.Context, repo *repo_model.Repository, doer *user_model.User, runIDs []int64) error {
 	updatedJobs := make([]*actions_model.ActionRunJob, 0)
 	cancelledConcurrencyJobs := make([]*actions_model.ActionRunJob, 0)
+	// Track runs whose reusable callers were just expanded so we can re-emit after the tx commits.
+	expandedCallerRunIDs := make(container.Set[int64])
 
 	err := db.WithTx(ctx, func(ctx context.Context) (err error) {
 		for _, runID := range runIDs {
@@ -31,6 +37,7 @@ func ApproveRuns(ctx context.Context, repo *repo_model.Repository, doer *user_mo
 			if err != nil {
 				return err
 			}
+
 			for _, job := range jobs {
 				// Skip jobs with `needs`: they stay blocked until their dependencies finish,
 				// at which point job_emitter will evaluate and start them.
@@ -43,14 +50,38 @@ func ApproveRuns(ctx context.Context, repo *repo_model.Repository, doer *user_mo
 					return err
 				}
 				cancelledConcurrencyJobs = append(cancelledConcurrencyJobs, jobsToCancel...)
-				if job.Status == actions_model.StatusWaiting {
-					n, err := actions_model.UpdateRunJob(ctx, job, nil, "status")
+				if job.Status != actions_model.StatusWaiting {
+					continue
+				}
+				n, err := actions_model.UpdateRunJob(ctx, job, nil, "status")
+				if err != nil {
+					return err
+				}
+				if n == 0 {
+					continue
+				}
+				updatedJobs = append(updatedJobs, job)
+
+				// A top-level reusable caller was just unblocked by approval, expand it
+				if job.IsReusableCaller && !job.IsExpanded {
+					attempt, has, err := run.GetLatestAttempt(ctx)
+					if err != nil {
+						return fmt.Errorf("get latest attempt of run %d: %w", run.ID, err)
+					}
+					if !has {
+						return errors.New("run has no attempt")
+					}
+					vars, err := actions_model.GetVariablesOfRun(ctx, run)
 					if err != nil {
 						return err
 					}
-					if n > 0 {
-						updatedJobs = append(updatedJobs, job)
+					if err := expandReusableWorkflowCaller(ctx, run, attempt, job, vars); err != nil {
+						return fmt.Errorf("expand caller %d on approval: %w", job.ID, err)
 					}
+					if err := actions_model.RefreshReusableCallerStatus(ctx, job); err != nil {
+						return fmt.Errorf("refresh caller %d status after approval-time expansion: %w", job.ID, err)
+					}
+					expandedCallerRunIDs.Add(run.ID)
 				}
 			}
 		}
@@ -60,6 +91,13 @@ func ApproveRuns(ctx context.Context, repo *repo_model.Repository, doer *user_mo
 		return err
 	}
 
+	// Re-emit AFTER the tx commits so the newly inserted callee rows transition Blocked -> Waiting.
+	for runID := range expandedCallerRunIDs {
+		if err := EmitJobsIfReadyByRun(runID); err != nil {
+			log.Error("emit run %d after approval-time caller expansion: %v", runID, err)
+		}
+	}
+
 	NotifyWorkflowJobsAndRunsStatusUpdate(ctx, updatedJobs)
 	NotifyWorkflowJobsAndRunsStatusUpdate(ctx, cancelledConcurrencyJobs)
 
diff --git a/services/actions/artifacts.go b/services/actions/artifacts.go
new file mode 100644
index 00000000000..012a49ddfb6
--- /dev/null
+++ b/services/actions/artifacts.go
@@ -0,0 +1,65 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"net/http"
+	"strings"
+
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/services/context"
+)
+
+// IsArtifactV4 detects whether the artifact is likely from v4.
+// V4 backend stores the files as a single combined zip file per artifact, and ensures ContentEncoding contains a slash
+// (otherwise this uses application/zip instead of the custom mime type), which is not the case for the old backend.
+func IsArtifactV4(art *actions_model.ActionArtifact) bool {
+	return strings.Contains(art.ContentEncodingOrType, "/")
+}
+
+func GetArtifactV4ServeDirectURL(art *actions_model.ActionArtifact, method string) (string, error) {
+	contentType := art.ContentEncodingOrType
+	u, err := storage.ActionsArtifacts.ServeDirectURL(art.StoragePath, art.ArtifactPath, method, &storage.ServeDirectOptions{ContentType: contentType})
+	if err != nil {
+		return "", err
+	}
+	return u.String(), nil
+}
+
+func DownloadArtifactV4ServeDirect(ctx *context.Base, art *actions_model.ActionArtifact) bool {
+	if !setting.Actions.ArtifactStorage.ServeDirect() {
+		return false
+	}
+	u, err := GetArtifactV4ServeDirectURL(art, ctx.Req.Method)
+	if err != nil {
+		log.Error("GetArtifactV4ServeDirectURL: %v", err)
+		return false
+	}
+	ctx.Redirect(u, http.StatusFound)
+	return true
+}
+
+func DownloadArtifactV4ReadStorage(ctx *context.Base, art *actions_model.ActionArtifact) error {
+	f, err := storage.ActionsArtifacts.Open(art.StoragePath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	httplib.ServeUserContentByFile(ctx.Req, ctx.Resp, f, httplib.ServeHeaderOptions{
+		Filename:    art.ArtifactPath,
+		ContentType: art.ContentEncodingOrType, // v4 guarantees that the field is Content-Type
+	})
+	return nil
+}
+
+func DownloadArtifactV4(ctx *context.Base, art *actions_model.ActionArtifact) error {
+	if DownloadArtifactV4ServeDirect(ctx, art) {
+		return nil
+	}
+	return DownloadArtifactV4ReadStorage(ctx, art)
+}
diff --git a/services/actions/auth.go b/services/actions/auth.go
index c742e19c601..6a160102f18 100644
--- a/services/actions/auth.go
+++ b/services/actions/auth.go
@@ -10,9 +10,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"github.com/golang-jwt/jwt/v5"
 )
diff --git a/services/actions/auth_test.go b/services/actions/auth_test.go
index 38d0ba7f822..85f2fb4e9ad 100644
--- a/services/actions/auth_test.go
+++ b/services/actions/auth_test.go
@@ -7,8 +7,8 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
 
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/stretchr/testify/assert"
diff --git a/services/actions/cleanup.go b/services/actions/cleanup.go
index f223c981255..dc8f13cdcb2 100644
--- a/services/actions/cleanup.go
+++ b/services/actions/cleanup.go
@@ -9,14 +9,14 @@ import (
 	"fmt"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	actions_module "code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/timeutil"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	actions_module "gitea.dev/modules/actions"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/timeutil"
 
 	"xorm.io/builder"
 )
@@ -144,7 +144,7 @@ func CleanupEphemeralRunners(ctx context.Context) error {
 		From(builder.Select("*").From("`action_runner`"), "`action_runner`"). // mysql needs this redundant subquery
 		Join("INNER", "`action_task`", "`action_task`.`runner_id` = `action_runner`.`id`").
 		Where(builder.Eq{"`action_runner`.`ephemeral`": true}).
-		And(builder.NotIn("`action_task`.`status`", actions_model.StatusWaiting, actions_model.StatusRunning, actions_model.StatusBlocked))
+		And(builder.NotIn("`action_task`.`status`", actions_model.StatusWaiting, actions_model.StatusRunning, actions_model.StatusBlocked, actions_model.StatusCancelling))
 	b := builder.Delete(builder.In("id", subQuery)).From("`action_runner`")
 	res, err := db.GetEngine(ctx).Exec(b)
 	if err != nil {
@@ -250,6 +250,8 @@ func DeleteRun(ctx context.Context, run *actions_model.ActionRun) error {
 		return err
 	}
 
+	actions_model.UpdateRepoRunsNumbers(ctx, repoID)
+
 	// Delete files on storage
 	for _, tas := range tasks {
 		removeTaskLog(ctx, tas)
diff --git a/services/actions/clear_tasks.go b/services/actions/clear_tasks.go
index 940f1d84544..6abce568ac2 100644
--- a/services/actions/clear_tasks.go
+++ b/services/actions/clear_tasks.go
@@ -8,31 +8,41 @@ import (
 	"fmt"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/actions"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
-// StopZombieTasks stops the task which have running status, but haven't been updated for a long time
+// StopZombieTasks stops tasks in running/cancelling status that haven't been updated for a long time
 func StopZombieTasks(ctx context.Context) error {
-	return stopTasks(ctx, actions_model.FindTaskOptions{
-		Status:        actions_model.StatusRunning,
+	return stopTasksByStatuses(ctx, actions_model.FindTaskOptions{
 		UpdatedBefore: timeutil.TimeStamp(time.Now().Add(-setting.Actions.ZombieTaskTimeout).Unix()),
-	})
+	}, actions_model.StatusRunning, actions_model.StatusCancelling)
 }
 
-// StopEndlessTasks stops the tasks which have running status and continuous updates, but don't end for a long time
+// StopEndlessTasks stops tasks in running/cancelling status with continuous updates that don't end for a long time
 func StopEndlessTasks(ctx context.Context) error {
-	return stopTasks(ctx, actions_model.FindTaskOptions{
-		Status:        actions_model.StatusRunning,
+	return stopTasksByStatuses(ctx, actions_model.FindTaskOptions{
 		StartedBefore: timeutil.TimeStamp(time.Now().Add(-setting.Actions.EndlessTaskTimeout).Unix()),
-	})
+	}, actions_model.StatusRunning, actions_model.StatusCancelling)
+}
+
+func stopTasksByStatuses(ctx context.Context, opts actions_model.FindTaskOptions, statuses ...actions_model.Status) error {
+	for _, status := range statuses {
+		optsByStatus := opts
+		optsByStatus.Status = status
+		if err := stopTasks(ctx, optsByStatus); err != nil {
+			return err
+		}
+	}
+
+	return nil
 }
 
 func CancelPreviousJobs(ctx context.Context, repoID int64, ref, workflowID string, event webhook_module.HookEventType) error {
@@ -59,7 +69,7 @@ func shouldBlockJobByConcurrency(ctx context.Context, job *actions_model.ActionR
 		return false, nil
 	}
 
-	attempts, jobs, err := actions_model.GetConcurrentRunAttemptsAndJobs(ctx, job.RepoID, job.ConcurrencyGroup, []actions_model.Status{actions_model.StatusRunning})
+	attempts, jobs, err := actions_model.GetConcurrentRunAttemptsAndJobs(ctx, job.RepoID, job.ConcurrencyGroup, []actions_model.Status{actions_model.StatusRunning, actions_model.StatusCancelling})
 	if err != nil {
 		return false, fmt.Errorf("GetConcurrentRunAttemptsAndJobs: %w", err)
 	}
@@ -89,7 +99,7 @@ func shouldBlockRunByConcurrency(ctx context.Context, attempt *actions_model.Act
 		return false, nil
 	}
 
-	attempts, jobs, err := actions_model.GetConcurrentRunAttemptsAndJobs(ctx, attempt.RepoID, attempt.ConcurrencyGroup, []actions_model.Status{actions_model.StatusRunning})
+	attempts, jobs, err := actions_model.GetConcurrentRunAttemptsAndJobs(ctx, attempt.RepoID, attempt.ConcurrencyGroup, []actions_model.Status{actions_model.StatusRunning, actions_model.StatusCancelling})
 	if err != nil {
 		return false, fmt.Errorf("find concurrent runs and jobs: %w", err)
 	}
@@ -123,7 +133,11 @@ func stopTasks(ctx context.Context, opts actions_model.FindTaskOptions) error {
 	jobs := make([]*actions_model.ActionRunJob, 0, len(tasks))
 	for _, task := range tasks {
 		if err := db.WithTx(ctx, func(ctx context.Context) error {
-			if err := actions_model.StopTask(ctx, task.ID, actions_model.StatusFailure); err != nil {
+			stopStatus := actions_model.StatusFailure
+			if task.Status == actions_model.StatusCancelling {
+				stopStatus = actions_model.StatusCancelled
+			}
+			if err := actions_model.StopTask(ctx, task.ID, stopStatus); err != nil {
 				return err
 			}
 			if err := task.LoadJob(ctx); err != nil {
@@ -157,44 +171,18 @@ func stopTasks(ctx context.Context, opts actions_model.FindTaskOptions) error {
 
 // CancelAbandonedJobs cancels jobs that have not been picked by any runner for a long time
 func CancelAbandonedJobs(ctx context.Context) error {
-	jobs, err := db.Find[actions_model.ActionRunJob](ctx, actions_model.FindRunJobOptions{
+	abandonedJobs, err := db.Find[actions_model.ActionRunJob](ctx, actions_model.FindRunJobOptions{
 		Statuses:      []actions_model.Status{actions_model.StatusWaiting, actions_model.StatusBlocked},
 		UpdatedBefore: timeutil.TimeStampNow().AddDuration(-setting.Actions.AbandonedJobTimeout),
 	})
 	if err != nil {
-		log.Warn("find abandoned tasks: %v", err)
+		log.Warn("find abandoned jobs: %v", err)
 		return err
 	}
 
-	now := timeutil.TimeStampNow()
-
-	updatedJobs := []*actions_model.ActionRunJob{}
-
-	for _, job := range jobs {
-		job.Status = actions_model.StatusCancelled
-		job.Stopped = now
-		updated := false
-		if err := db.WithTx(ctx, func(ctx context.Context) error {
-			n, err := actions_model.UpdateRunJob(ctx, job, nil, "status", "stopped")
-			if err != nil {
-				return err
-			}
-			if err := job.LoadAttributes(ctx); err != nil {
-				return err
-			}
-			updated = n > 0
-			return nil
-		}); err != nil {
-			log.Warn("cancel abandoned job %v: %v", job.ID, err)
-			// go on
-		}
-		if job.Run == nil || job.Run.Repo == nil {
-			continue // error occurs during loading attributes, the following code that depends on "Run.Repo" will fail, so ignore and skip
-		}
-		if updated {
-			CreateCommitStatusForRunJobs(ctx, job.Run, job)
-			updatedJobs = append(updatedJobs, job)
-		}
+	updatedJobs, err := actions_model.CancelJobs(ctx, abandonedJobs)
+	if err != nil {
+		log.Warn("cancel abandoned jobs: %v", err)
 	}
 
 	NotifyWorkflowJobsAndRunsStatusUpdate(ctx, updatedJobs)
diff --git a/services/actions/clear_tasks_test.go b/services/actions/clear_tasks_test.go
new file mode 100644
index 00000000000..899b73fa446
--- /dev/null
+++ b/services/actions/clear_tasks_test.go
@@ -0,0 +1,90 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"testing"
+
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func createConflictingCancellingJob(t *testing.T, concurrencyGroup string, runIndex int64) *actions_model.ActionRunJob {
+	t.Helper()
+
+	run := &actions_model.ActionRun{
+		RepoID:        1,
+		OwnerID:       2,
+		TriggerUserID: 2,
+		WorkflowID:    "test.yml",
+		Index:         runIndex,
+		Ref:           "refs/heads/main",
+		Status:        actions_model.StatusBlocked,
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	attempt := &actions_model.ActionRunAttempt{
+		RepoID:           run.RepoID,
+		RunID:            run.ID,
+		Attempt:          1,
+		TriggerUserID:    run.TriggerUserID,
+		Status:           actions_model.StatusBlocked,
+		ConcurrencyGroup: concurrencyGroup,
+	}
+	require.NoError(t, db.Insert(t.Context(), attempt))
+
+	job := &actions_model.ActionRunJob{
+		RunID:            run.ID,
+		RunAttemptID:     attempt.ID,
+		AttemptJobID:     1,
+		RepoID:           run.RepoID,
+		OwnerID:          run.OwnerID,
+		CommitSHA:        "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Name:             "conflicting-cancelling-job",
+		JobID:            "conflicting-cancelling-job",
+		Status:           actions_model.StatusCancelling,
+		ConcurrencyGroup: concurrencyGroup,
+	}
+	require.NoError(t, db.Insert(t.Context(), job))
+
+	return job
+}
+
+func TestShouldBlockJobByConcurrency_CancellingJobBlocks(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	const concurrencyGroup = "test-cancelling-job-blocks"
+	createConflictingCancellingJob(t, concurrencyGroup, 9903)
+
+	job := &actions_model.ActionRunJob{
+		RepoID:                 1,
+		RawConcurrency:         concurrencyGroup,
+		IsConcurrencyEvaluated: true,
+		ConcurrencyGroup:       concurrencyGroup,
+	}
+
+	shouldBlock, err := shouldBlockJobByConcurrency(t.Context(), job)
+	require.NoError(t, err)
+	assert.True(t, shouldBlock)
+}
+
+func TestShouldBlockRunByConcurrency_CancellingJobBlocks(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	const concurrencyGroup = "test-cancelling-run-blocks"
+	createConflictingCancellingJob(t, concurrencyGroup, 9904)
+
+	attempt := &actions_model.ActionRunAttempt{
+		RepoID:           1,
+		ConcurrencyGroup: concurrencyGroup,
+	}
+
+	shouldBlock, err := shouldBlockRunByConcurrency(t.Context(), attempt)
+	require.NoError(t, err)
+	assert.True(t, shouldBlock)
+}
diff --git a/services/actions/commit_status.go b/services/actions/commit_status.go
index 5a7f8f1f443..1e60b5506a3 100644
--- a/services/actions/commit_status.go
+++ b/services/actions/commit_status.go
@@ -10,18 +10,18 @@ import (
 	"path"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	actions_module "code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/actions/jobparser"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	commitstatus_service "code.gitea.io/gitea/services/repository/commitstatus"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	actions_module "gitea.dev/modules/actions"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
+	commitstatus_service "gitea.dev/services/repository/commitstatus"
 )
 
 // CreateCommitStatusForRunJobs creates a commit status for the given job if it has a supported event and related commit.
@@ -181,11 +181,13 @@ func toCommitStatusDescription(job *actions_model.ActionRunJob) string {
 	case actions_model.StatusFailure:
 		return fmt.Sprintf("Failing after %s", job.Duration())
 	case actions_model.StatusCancelled:
-		return "Has been cancelled"
+		return fmt.Sprintf("Canceled after %s", job.Duration())
 	case actions_model.StatusSkipped:
-		return "Has been skipped"
+		return "Skipped"
 	case actions_model.StatusRunning:
-		return "Has started running"
+		return "In progress"
+	case actions_model.StatusCancelling:
+		return "Canceling"
 	case actions_model.StatusWaiting:
 		return "Waiting to run"
 	case actions_model.StatusBlocked:
@@ -201,7 +203,7 @@ func toCommitStatus(status actions_model.Status) commitstatus.CommitStatusState
 		return commitstatus.CommitStatusSuccess
 	case actions_model.StatusFailure, actions_model.StatusCancelled:
 		return commitstatus.CommitStatusFailure
-	case actions_model.StatusWaiting, actions_model.StatusBlocked, actions_model.StatusRunning:
+	case actions_model.StatusWaiting, actions_model.StatusBlocked, actions_model.StatusRunning, actions_model.StatusCancelling:
 		return commitstatus.CommitStatusPending
 	case actions_model.StatusSkipped:
 		return commitstatus.CommitStatusSkipped
diff --git a/services/actions/commit_status_test.go b/services/actions/commit_status_test.go
index 6ff93933189..c6bcfddf18b 100644
--- a/services/actions/commit_status_test.go
+++ b/services/actions/commit_status_test.go
@@ -6,18 +6,42 @@ package actions
 import (
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/gitrepo"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	actions_module "gitea.dev/modules/actions"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func TestCommitStatusDescription(t *testing.T) {
+	cases := []struct {
+		status           actions_model.Status
+		started, stopped timeutil.TimeStamp
+		want             string
+	}{
+		{actions_model.StatusSuccess, 100, 102, "Successful in 2s"},
+		{actions_model.StatusFailure, 100, 130, "Failing after 30s"},
+		{actions_model.StatusCancelled, 100, 145, "Canceled after 45s"},
+		{actions_model.StatusCancelling, 0, 0, "Canceling"},
+		{actions_model.StatusSkipped, 0, 0, "Skipped"},
+		{actions_model.StatusRunning, 0, 0, "In progress"},
+		{actions_model.StatusWaiting, 0, 0, "Waiting to run"},
+		{actions_model.StatusBlocked, 0, 0, "Blocked by required conditions"},
+		{actions_model.StatusUnknown, 0, 0, "Unknown status: 0"},
+	}
+	for _, tc := range cases {
+		job := &actions_model.ActionRunJob{Status: tc.status, Started: tc.started, Stopped: tc.stopped}
+		assert.Equal(t, tc.want, toCommitStatusDescription(job), tc.status.String())
+	}
+}
+
 func TestCreateCommitStatus_Dedupe(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 
@@ -61,7 +85,7 @@ func TestCreateCommitStatus_Dedupe(t *testing.T) {
 	require.Len(t, statuses, 2)
 	assert.Equal(t, "Waiting to run", statuses[0].Description)
 	assert.Equal(t, commitstatus.CommitStatusPending, statuses[1].State)
-	assert.Equal(t, "Has started running", statuses[1].Description)
+	assert.Equal(t, "In progress", statuses[1].Description)
 	assert.Equal(t, expectedTargetURL, statuses[1].TargetURL)
 
 	require.NoError(t, createCommitStatus(t.Context(), repo, "push", commit.ID.String(), run, job))
@@ -75,6 +99,53 @@ func TestCreateCommitStatus_Dedupe(t *testing.T) {
 	assert.Equal(t, commitstatus.CommitStatusSuccess, statuses[2].State)
 }
 
+func TestGetCommitActionsStatusMap(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+	branch := unittest.AssertExistsAndLoadBean(t, &git_model.Branch{RepoID: repo.ID, Name: repo.DefaultBranch})
+
+	run := &actions_model.ActionRun{
+		RepoID: repo.ID, Repo: repo, OwnerID: repo.OwnerID, TriggerUserID: repo.OwnerID,
+		WorkflowID: "test.yaml", CommitSHA: branch.CommitID,
+	}
+	require.NoError(t, db.Insert(t.Context(), run))
+
+	cases := []struct {
+		jobName string
+		status  actions_model.Status
+	}{
+		{"running-job", actions_model.StatusRunning},
+		{"waiting-job", actions_model.StatusWaiting},
+		{"unknown-job", actions_model.StatusUnknown},
+	}
+	for _, tc := range cases {
+		job := &actions_model.ActionRunJob{
+			RunID: run.ID, RepoID: repo.ID, OwnerID: repo.OwnerID, Name: tc.jobName, Status: tc.status,
+		}
+		require.NoError(t, db.Insert(t.Context(), job))
+		require.NoError(t, createCommitStatus(t.Context(), repo, "push", branch.CommitID, run, job))
+	}
+
+	statuses, err := git_model.GetLatestCommitStatus(t.Context(), repo.ID, branch.CommitID, db.ListOptionsAll)
+	require.NoError(t, err)
+
+	info := actions_module.GetCommitActionsStatusMap(t.Context(), statuses)
+	got := map[string]string{}
+	for _, s := range statuses {
+		got[s.Context] = info.IconStatus(s)
+	}
+	for _, tc := range cases {
+		key := "test.yaml / " + tc.jobName + " (push)"
+		want := tc.status.String()
+		assert.Equal(t, want, got[key], "icon status for %s", tc.jobName)
+	}
+
+	// Nil receiver returns "" without panicking — used by callers that skip enrichment.
+	var nilInfo actions_module.CommitActionsStatusMap
+	assert.Empty(t, nilInfo.IconStatus(statuses[0]))
+}
+
 func findCommitStatusesForContext(t *testing.T, repoID int64, sha, context string) []*git_model.CommitStatus {
 	t.Helper()
 
diff --git a/services/actions/concurrency.go b/services/actions/concurrency.go
index e1ec5499309..0433278b755 100644
--- a/services/actions/concurrency.go
+++ b/services/actions/concurrency.go
@@ -7,12 +7,10 @@ import (
 	"context"
 	"fmt"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/actions/jobparser"
-	"code.gitea.io/gitea/modules/json"
-	api "code.gitea.io/gitea/modules/structs"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/modules/actions/jobparser"
 
-	act_model "github.com/nektos/act/pkg/model"
+	act_model "gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -29,7 +27,7 @@ func EvaluateRunConcurrencyFillModel(ctx context.Context, run *actions_model.Act
 	jobResults := map[string]*jobparser.JobResult{"": {}}
 	if inputs == nil {
 		var err error
-		inputs, err = getInputsFromRun(run)
+		inputs, err = getWorkflowDispatchInputsFromRun(run)
 		if err != nil {
 			return fmt.Errorf("get inputs: %w", err)
 		}
@@ -43,25 +41,6 @@ func EvaluateRunConcurrencyFillModel(ctx context.Context, run *actions_model.Act
 	return nil
 }
 
-func findJobNeedsAndFillJobResults(ctx context.Context, job *actions_model.ActionRunJob) (map[string]*jobparser.JobResult, error) {
-	taskNeeds, err := FindTaskNeeds(ctx, job)
-	if err != nil {
-		return nil, fmt.Errorf("find task needs: %w", err)
-	}
-	jobResults := make(map[string]*jobparser.JobResult, len(taskNeeds))
-	for jobID, taskNeed := range taskNeeds {
-		jobResult := &jobparser.JobResult{
-			Result:  taskNeed.Result.String(),
-			Outputs: taskNeed.Outputs,
-		}
-		jobResults[jobID] = jobResult
-	}
-	jobResults[job.JobID] = &jobparser.JobResult{
-		Needs: job.Needs,
-	}
-	return jobResults, nil
-}
-
 // EvaluateJobConcurrencyFillModel evaluates the expressions in a job-level concurrency,
 // and fills the job's model fields with `concurrency.group` and `concurrency.cancel-in-progress`.
 // Job-level concurrency may depend on other job's outputs (via `needs`): `concurrency.group: my-group-${{ needs.job1.outputs.out1 }}`
@@ -86,7 +65,7 @@ func EvaluateJobConcurrencyFillModel(ctx context.Context, run *actions_model.Act
 
 	if inputs == nil {
 		var err error
-		inputs, err = getInputsFromRun(run)
+		inputs, err = getInputsForJob(ctx, run, actionRunJob)
 		if err != nil {
 			return fmt.Errorf("get inputs: %w", err)
 		}
@@ -104,14 +83,3 @@ func EvaluateJobConcurrencyFillModel(ctx context.Context, run *actions_model.Act
 	actionRunJob.IsConcurrencyEvaluated = true
 	return nil
 }
-
-func getInputsFromRun(run *actions_model.ActionRun) (map[string]any, error) {
-	if run.Event != "workflow_dispatch" {
-		return map[string]any{}, nil
-	}
-	var payload api.WorkflowDispatchPayload
-	if err := json.Unmarshal([]byte(run.EventPayload), &payload); err != nil {
-		return nil, err
-	}
-	return payload.Inputs, nil
-}
diff --git a/services/actions/context.go b/services/actions/context.go
index 9250c409835..b92e179f949 100644
--- a/services/actions/context.go
+++ b/services/actions/context.go
@@ -8,17 +8,20 @@ import (
 	"fmt"
 	"strconv"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	actions_module "code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	actions_module "gitea.dev/modules/actions"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
 
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/model"
 )
 
 type GiteaContext map[string]any
@@ -96,6 +99,31 @@ func GenerateGiteaContext(ctx context.Context, run *actions_model.ActionRun, att
 	if job != nil {
 		gitContext["job"] = job.JobID
 		gitContext["run_attempt"] = strconv.FormatInt(job.Attempt, 10)
+
+		if job.ParentJobID > 0 {
+			// Inject the caller's resolved workflow_call inputs into gitea.event.inputs.
+			// The rest of gitea.event stays as the caller's actual trigger event (push/pull_request/etc.)
+			// to match GitHub's semantics (see https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#github-context).
+			// FIXME: If the run is triggered by "workflow_dispatch", the original inputs of "workflow_dispatch" will be overridden.
+			// If necessary, the caller can send these values to the called workflow via `with:`.
+			caller, err := actions_model.GetRunJobByRunAndID(ctx, job.RunID, job.ParentJobID)
+			if err != nil {
+				log.Error("GenerateGiteaContext: load caller job %d of job %d: %v", job.ParentJobID, job.ID, err)
+			} else if caller.CallPayload != "" {
+				var cp api.WorkflowCallPayload
+				if err := json.Unmarshal([]byte(caller.CallPayload), &cp); err != nil {
+					log.Error("GenerateGiteaContext: decode CallPayload of caller %d: %v", caller.ID, err)
+				} else if cp.Inputs != nil {
+					event["inputs"] = cp.Inputs
+				}
+			}
+
+			// Override gitea.event_name to "workflow_call", so that the runner-side `getEvaluatorInputs` can get inputs from event["inputs"].
+			// https://gitea.com/gitea/runner/src/commit/0b9f251b6abb30d5f292a49cfe0c611f7c26d857/act/runner/expression.go#L509
+			// FIXME: The trade-off is that `${{ gitea.event_name }}` inside a reusable workflow's child job reads "workflow_call"
+			// instead of the caller's real trigger event name (push/pull_request/etc.) This is a small deviation from GitHub spec.
+			gitContext["event_name"] = "workflow_call"
+		}
 	}
 
 	if attempt == nil {
@@ -125,7 +153,8 @@ type TaskNeed struct {
 	Outputs map[string]string
 }
 
-// FindTaskNeeds finds the `needs` for the task by the task's job
+// FindTaskNeeds finds the `needs` for the task by the task's job.
+// Lookup is scoped to the same ParentJobID.
 func FindTaskNeeds(ctx context.Context, job *actions_model.ActionRunJob) (map[string]*TaskNeed, error) {
 	if len(job.Needs) == 0 {
 		return nil, nil //nolint:nilnil // return nil when the job has no needs
@@ -144,8 +173,16 @@ func FindTaskNeeds(ctx context.Context, job *actions_model.ActionRunJob) (map[st
 	}
 
 	jobIDJobs := make(map[string][]*actions_model.ActionRunJob)
-	for _, job := range jobs {
-		jobIDJobs[job.JobID] = append(jobIDJobs[job.JobID], job)
+	// childrenByParent indexes every job by its ParentJobID
+	childrenByParent := make(map[int64][]*actions_model.ActionRunJob)
+	for _, candidate := range jobs {
+		if candidate.ParentJobID != 0 {
+			childrenByParent[candidate.ParentJobID] = append(childrenByParent[candidate.ParentJobID], candidate)
+		}
+		// `needs` references are scope-bound: only candidates in the same caller scope match.
+		if candidate.ParentJobID == job.ParentJobID {
+			jobIDJobs[candidate.JobID] = append(jobIDJobs[candidate.JobID], candidate)
+		}
 	}
 
 	ret := make(map[string]*TaskNeed, len(needs))
@@ -154,19 +191,19 @@ func FindTaskNeeds(ctx context.Context, job *actions_model.ActionRunJob) (map[st
 			continue
 		}
 		var jobOutputs map[string]string
-		for _, job := range jobsWithSameID {
-			taskID := job.EffectiveTaskID()
-			if taskID == 0 || !job.Status.IsDone() {
-				// it shouldn't happen
+		for _, candidate := range jobsWithSameID {
+			if !candidate.Status.IsDone() {
 				continue
 			}
-			got, err := actions_model.FindTaskOutputByTaskID(ctx, taskID)
-			if err != nil {
-				return nil, fmt.Errorf("FindTaskOutputByTaskID: %w", err)
+			var outputs map[string]string
+			var err error
+			if candidate.IsReusableCaller {
+				outputs, err = computeReusableCallerOutputs(ctx, candidate, childrenByParent)
+			} else {
+				outputs, err = loadJobTaskOutputs(ctx, candidate)
 			}
-			outputs := make(map[string]string, len(got))
-			for _, v := range got {
-				outputs[v.OutputKey] = v.OutputValue
+			if err != nil {
+				return nil, err
 			}
 			if len(jobOutputs) == 0 {
 				jobOutputs = outputs
@@ -182,6 +219,86 @@ func FindTaskNeeds(ctx context.Context, job *actions_model.ActionRunJob) (map[st
 	return ret, nil
 }
 
+// computeReusableCallerOutputs returns the workflow_call outputs of a reusable caller by recursing into its child subtree.
+func computeReusableCallerOutputs(ctx context.Context, caller *actions_model.ActionRunJob, childrenByParent map[int64][]*actions_model.ActionRunJob) (map[string]string, error) {
+	if !caller.IsExpanded {
+		//  A caller that was never expanded (e.g. Skipped because its `if:` was false) has no workflow_call outputs, return early.
+		return map[string]string{}, nil
+	}
+
+	directChildren := childrenByParent[caller.ID]
+
+	if err := caller.LoadRun(ctx); err != nil {
+		return nil, err
+	}
+	wcSpec, err := jobparser.ParseWorkflowCallSpec(caller.ReusableWorkflowContent)
+	if err != nil {
+		return nil, err
+	}
+	if len(wcSpec.Outputs) == 0 {
+		return map[string]string{}, nil
+	}
+
+	// Per-job outputs over the children of this caller.
+	jobOutputs := make(jobparser.JobOutputs, len(directChildren))
+	for _, child := range directChildren {
+		var outs map[string]string
+		switch {
+		case child.IsReusableCaller:
+			outs, err = computeReusableCallerOutputs(ctx, child, childrenByParent)
+		default:
+			outs, err = loadJobTaskOutputs(ctx, child)
+		}
+		if err != nil {
+			return nil, err
+		}
+		if existing, ok := jobOutputs[child.JobID]; ok {
+			jobOutputs[child.JobID] = mergeTwoOutputs(outs, existing)
+		} else {
+			jobOutputs[child.JobID] = outs
+		}
+	}
+
+	// build contexts for evaluating outputs
+	if err := caller.Run.LoadAttributes(ctx); err != nil {
+		return nil, err
+	}
+	gitCtx := GenerateGiteaContext(ctx, caller.Run, nil, caller)
+	vars, err := actions_model.GetVariablesOfRun(ctx, caller.Run)
+	if err != nil {
+		return nil, err
+	}
+	inputs := map[string]any{}
+	if caller.CallPayload != "" {
+		var p api.WorkflowCallPayload
+		if err := json.Unmarshal([]byte(caller.CallPayload), &p); err != nil {
+			return nil, fmt.Errorf("decode caller payload: %w", err)
+		}
+		if p.Inputs != nil {
+			inputs = p.Inputs
+		}
+	}
+
+	return jobparser.EvaluateWorkflowCallOutputs(wcSpec, gitCtx.ToGitHubContext(), vars, inputs, jobOutputs)
+}
+
+// loadJobTaskOutputs returns the task-output map of `job`.
+func loadJobTaskOutputs(ctx context.Context, job *actions_model.ActionRunJob) (map[string]string, error) {
+	tid := job.EffectiveTaskID()
+	if tid == 0 {
+		return map[string]string{}, nil
+	}
+	rows, err := actions_model.FindTaskOutputByTaskID(ctx, tid)
+	if err != nil {
+		return nil, fmt.Errorf("FindTaskOutputByTaskID: %w", err)
+	}
+	out := make(map[string]string, len(rows))
+	for _, r := range rows {
+		out[r.OutputKey] = r.OutputValue
+	}
+	return out, nil
+}
+
 // mergeTwoOutputs merges two outputs from two different ActionRunJobs
 // Values with the same output name may be overridden. The user should ensure the output names are unique.
 // See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#using-job-outputs-in-a-matrix-job
diff --git a/services/actions/context_test.go b/services/actions/context_test.go
index 22f9abcce81..252399a37d8 100644
--- a/services/actions/context_test.go
+++ b/services/actions/context_test.go
@@ -7,19 +7,20 @@ import (
 	"strconv"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/unittest"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
 
-	act_model "github.com/nektos/act/pkg/model"
+	act_model "gitea.com/gitea/runner/act/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestEvaluateRunConcurrency_RunIDFallback(t *testing.T) {
-	// Unit-level check that EvaluateRunConcurrencyFillModel resolves
-	// github.run_id from run.ID. The full-flow regression — that run.ID is
-	// non-zero by the time evaluation happens — is in
-	// TestPrepareRunAndInsert_ExpressionsSeeRunID.
+	// Unit-level check that EvaluateRunConcurrencyFillModel resolves github.run_id from run.ID.
+	// The full-flow regression (run.ID non-zero by evaluation time) is TestPrepareRunAndInsert_ExpressionsSeeRunID.
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	ctx := t.Context()
 
@@ -43,10 +44,8 @@ func TestEvaluateRunConcurrency_RunIDFallback(t *testing.T) {
 }
 
 func TestPrepareRunAndInsert_ExpressionsSeeRunID(t *testing.T) {
-	// Regression for the cross-branch concurrency leak: github.run_id must
-	// be available during BOTH jobparser.Parse (run-name) and workflow-level
-	// concurrency evaluation. Re-ordering db.Insert relative to either step
-	// would leave run.ID at 0 and break this test.
+	// Regression for the cross-branch concurrency leak: github.run_id must be available during both
+	// jobparser.Parse (run-name) and concurrency evaluation; inserting run after either leaves run.ID at 0.
 	assert.NoError(t, unittest.PrepareTestDatabase())
 	ctx := t.Context()
 
@@ -90,6 +89,219 @@ jobs:
 	assert.NotEmpty(t, persisted.RawConcurrency)
 }
 
+func TestComputeReusableCallerOutputs(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	var nextRunIndex int64 = 9001
+	insertRun := func(t *testing.T, workflowID string) *actions_model.ActionRun {
+		t.Helper()
+		run := &actions_model.ActionRun{
+			Title:         "reusable-out",
+			RepoID:        4,
+			Index:         nextRunIndex,
+			OwnerID:       1,
+			WorkflowID:    workflowID,
+			TriggerUserID: 1,
+			Ref:           "refs/heads/master",
+			CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+			Event:         "push",
+			TriggerEvent:  "push",
+			EventPayload:  "{}",
+			Status:        actions_model.StatusSuccess,
+		}
+		nextRunIndex++
+		require.NoError(t, db.Insert(ctx, run))
+		return run
+	}
+
+	insertCaller := func(t *testing.T, run *actions_model.ActionRun, jobID string, parentID int64, content, callPayload string) *actions_model.ActionRunJob {
+		t.Helper()
+		job := &actions_model.ActionRunJob{
+			RunID:                   run.ID,
+			RepoID:                  run.RepoID,
+			OwnerID:                 run.OwnerID,
+			CommitSHA:               run.CommitSHA,
+			Name:                    jobID,
+			JobID:                   jobID,
+			Attempt:                 1,
+			Status:                  actions_model.StatusSuccess,
+			ParentJobID:             parentID,
+			IsReusableCaller:        true,
+			IsExpanded:              true,
+			ReusableWorkflowContent: []byte(content),
+			CallPayload:             callPayload,
+		}
+		require.NoError(t, db.Insert(ctx, job))
+		return job
+	}
+
+	// Each call to insertChildJobAndTask with non-empty outputs allocates a fresh TaskID
+	// so its action_task_output rows stay isolated per subtest.
+	var nextTaskID int64 = 90001
+	insertChildJobAndTask := func(t *testing.T, run *actions_model.ActionRun, jobID string, parentID int64, outputs map[string]string) *actions_model.ActionRunJob {
+		t.Helper()
+		var taskID int64
+		if len(outputs) > 0 {
+			taskID = nextTaskID
+			nextTaskID++
+		}
+		job := &actions_model.ActionRunJob{
+			RunID:       run.ID,
+			RepoID:      run.RepoID,
+			OwnerID:     run.OwnerID,
+			CommitSHA:   run.CommitSHA,
+			Name:        jobID,
+			JobID:       jobID,
+			Attempt:     1,
+			Status:      actions_model.StatusSuccess,
+			ParentJobID: parentID,
+			TaskID:      taskID,
+		}
+		require.NoError(t, db.Insert(ctx, job))
+		for k, v := range outputs {
+			require.NoError(t, db.Insert(ctx, &actions_model.ActionTaskOutput{
+				TaskID:      taskID,
+				OutputKey:   k,
+				OutputValue: v,
+			}))
+		}
+		return job
+	}
+
+	// childrenByParentOfRun returns the run's jobs indexed by ParentJobID, the shape computeReusableCallerOutputs expects.
+	childrenByParentOfRun := func(t *testing.T, runID int64) map[int64][]*actions_model.ActionRunJob {
+		t.Helper()
+		all, err := db.Find[actions_model.ActionRunJob](ctx, actions_model.FindRunJobOptions{RunID: runID})
+		require.NoError(t, err)
+		index := make(map[int64][]*actions_model.ActionRunJob)
+		for _, j := range all {
+			if j.ParentJobID != 0 {
+				index[j.ParentJobID] = append(index[j.ParentJobID], j)
+			}
+		}
+		return index
+	}
+
+	t.Run("returns empty when callee declares no outputs", func(t *testing.T) {
+		run := insertRun(t, "no-outputs.yaml")
+		caller := insertCaller(t, run, "caller", 0, `on:
+  workflow_call:
+    outputs: {}
+`, "")
+		out, err := computeReusableCallerOutputs(ctx, caller, childrenByParentOfRun(t, run.ID))
+		require.NoError(t, err)
+		assert.Empty(t, out)
+	})
+
+	t.Run("unexpanded (skipped) caller yields empty outputs without error", func(t *testing.T) {
+		run := insertRun(t, "skipped-caller.yaml")
+		// A reusable caller skipped before expansion: IsExpanded=false, empty ReusableWorkflowContent, no children.
+		caller := &actions_model.ActionRunJob{
+			RunID:            run.ID,
+			RepoID:           run.RepoID,
+			OwnerID:          run.OwnerID,
+			CommitSHA:        run.CommitSHA,
+			Name:             "caller",
+			JobID:            "caller",
+			Attempt:          1,
+			Status:           actions_model.StatusSkipped,
+			IsReusableCaller: true,
+			IsExpanded:       false,
+		}
+		require.NoError(t, db.Insert(ctx, caller))
+		out, err := computeReusableCallerOutputs(ctx, caller, childrenByParentOfRun(t, run.ID))
+		require.NoError(t, err)
+		assert.Empty(t, out)
+	})
+
+	t.Run("literal output value passes through", func(t *testing.T) {
+		run := insertRun(t, "literal-out.yaml")
+		caller := insertCaller(t, run, "caller", 0, `on:
+  workflow_call:
+    outputs:
+      hello:
+        value: world
+`, "")
+		out, err := computeReusableCallerOutputs(ctx, caller, childrenByParentOfRun(t, run.ID))
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{"hello": "world"}, out)
+	})
+
+	t.Run("output expression reads child task outputs", func(t *testing.T) {
+		run := insertRun(t, "child-out.yaml")
+		caller := insertCaller(t, run, "caller", 0, `on:
+  workflow_call:
+    outputs:
+      result:
+        value: ${{ jobs.child.outputs.foo }}
+`, "")
+		insertChildJobAndTask(t, run, "child", caller.ID, map[string]string{"foo": "bar"})
+
+		out, err := computeReusableCallerOutputs(ctx, caller, childrenByParentOfRun(t, run.ID))
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{"result": "bar"}, out)
+	})
+
+	t.Run("CallPayload inputs reachable in output expression", func(t *testing.T) {
+		run := insertRun(t, "payload-out.yaml")
+		payload, err := json.Marshal(api.WorkflowCallPayload{
+			Inputs: map[string]any{"env": "staging"},
+		})
+		require.NoError(t, err)
+		caller := insertCaller(t, run, "caller", 0, `on:
+  workflow_call:
+    inputs:
+      env:
+        type: string
+    outputs:
+      env:
+        value: ${{ inputs.env }}
+`, string(payload))
+
+		out, err := computeReusableCallerOutputs(ctx, caller, childrenByParentOfRun(t, run.ID))
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{"env": "staging"}, out)
+	})
+
+	t.Run("nested caller outputs propagate to outer", func(t *testing.T) {
+		run := insertRun(t, "nested-out.yaml")
+		outer := insertCaller(t, run, "outer", 0, `on:
+  workflow_call:
+    outputs:
+      bubbled:
+        value: ${{ jobs.inner.outputs.up }}
+`, "")
+		inner := insertCaller(t, run, "inner", outer.ID, `on:
+  workflow_call:
+    outputs:
+      up:
+        value: ${{ jobs.leaf.outputs.foo }}
+`, "")
+		insertChildJobAndTask(t, run, "leaf", inner.ID, map[string]string{"foo": "bubble-value"})
+
+		out, err := computeReusableCallerOutputs(ctx, outer, childrenByParentOfRun(t, run.ID))
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{"bubbled": "bubble-value"}, out)
+	})
+
+	t.Run("matrix children with same JobID prefer non-empty values", func(t *testing.T) {
+		run := insertRun(t, "matrix-out.yaml")
+		caller := insertCaller(t, run, "caller", 0, `on:
+  workflow_call:
+    outputs:
+      foo:
+        value: ${{ jobs.matrix.outputs.foo }}
+`, "")
+		insertChildJobAndTask(t, run, "matrix", caller.ID, map[string]string{"foo": ""})
+		insertChildJobAndTask(t, run, "matrix", caller.ID, map[string]string{"foo": "filled"})
+
+		out, err := computeReusableCallerOutputs(ctx, caller, childrenByParentOfRun(t, run.ID))
+		require.NoError(t, err)
+		assert.Equal(t, map[string]string{"foo": "filled"}, out)
+	})
+}
+
 func TestFindTaskNeeds(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
 
diff --git a/services/actions/helper.go b/services/actions/helper.go
new file mode 100644
index 00000000000..37dbb326ed4
--- /dev/null
+++ b/services/actions/helper.go
@@ -0,0 +1,92 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"fmt"
+
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+)
+
+func getWorkflowDispatchInputsFromRun(run *actions_model.ActionRun) (map[string]any, error) {
+	if run.Event != "workflow_dispatch" {
+		return map[string]any{}, nil
+	}
+	var payload api.WorkflowDispatchPayload
+	if err := json.Unmarshal([]byte(run.EventPayload), &payload); err != nil {
+		return nil, err
+	}
+	return payload.Inputs, nil
+}
+
+// getInputsForJob returns the `inputs.*` top-level expression context for a job's evaluation.
+//   - For top-level jobs, it falls back to the run's dispatch inputs (empty for non-dispatch events)
+//   - For reusable workflow children (and nested callers), this is the direct parent caller's CallPayload.Inputs
+func getInputsForJob(ctx context.Context, run *actions_model.ActionRun, job *actions_model.ActionRunJob) (map[string]any, error) {
+	if job.ParentJobID == 0 {
+		return getWorkflowDispatchInputsFromRun(run)
+	}
+
+	caller, err := actions_model.GetRunJobByRunAndID(ctx, run.ID, job.ParentJobID)
+	if err != nil {
+		return nil, fmt.Errorf("load caller job %d: %w", job.ParentJobID, err)
+	}
+	if caller.CallPayload == "" {
+		// should not happen - a child job cannot reach this point if its caller's CallPayload hasn't been evaluated
+		return map[string]any{}, nil
+	}
+	var p api.WorkflowCallPayload
+	if err := json.Unmarshal([]byte(caller.CallPayload), &p); err != nil {
+		return nil, fmt.Errorf("decode caller %d payload: %w", caller.ID, err)
+	}
+	if p.Inputs == nil {
+		return map[string]any{}, nil
+	}
+	return p.Inputs, nil
+}
+
+// evaluateJobIf evaluates a job's `if:`
+func evaluateJobIf(ctx context.Context, run *actions_model.ActionRun, attempt *actions_model.ActionRunAttempt, job *actions_model.ActionRunJob, vars map[string]string, allNeedsSucceed bool) (bool, error) {
+	parsedJob, err := job.ParseJob()
+	if err != nil {
+		return false, err
+	}
+	// Empty `if:` reduces to implicit `success()` - true iff every need finished as Success.
+	if len(parsedJob.If.Value) == 0 {
+		return allNeedsSucceed, nil
+	}
+	jobResults, err := findJobNeedsAndFillJobResults(ctx, job)
+	if err != nil {
+		return false, err
+	}
+	inputs, err := getInputsForJob(ctx, run, job)
+	if err != nil {
+		return false, err
+	}
+	gitCtx := GenerateGiteaContext(ctx, run, attempt, job)
+	return jobparser.EvaluateJobIfExpression(job.JobID, parsedJob, gitCtx, jobResults, vars, inputs)
+}
+
+func findJobNeedsAndFillJobResults(ctx context.Context, job *actions_model.ActionRunJob) (map[string]*jobparser.JobResult, error) {
+	taskNeeds, err := FindTaskNeeds(ctx, job)
+	if err != nil {
+		return nil, fmt.Errorf("find task needs: %w", err)
+	}
+	jobResults := make(map[string]*jobparser.JobResult, len(taskNeeds))
+	for jobID, taskNeed := range taskNeeds {
+		jobResult := &jobparser.JobResult{
+			Result:  taskNeed.Result.String(),
+			Outputs: taskNeed.Outputs,
+		}
+		jobResults[jobID] = jobResult
+	}
+	jobResults[job.JobID] = &jobparser.JobResult{
+		Needs: job.Needs,
+	}
+	return jobResults, nil
+}
diff --git a/services/actions/init.go b/services/actions/init.go
index 7136da05ed8..9261c48f29f 100644
--- a/services/actions/init.go
+++ b/services/actions/init.go
@@ -10,13 +10,13 @@ import (
 	"os"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	notify_service "code.gitea.io/gitea/services/notify"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	notify_service "gitea.dev/services/notify"
 )
 
 func initGlobalRunnerToken(ctx context.Context) error {
diff --git a/services/actions/init_test.go b/services/actions/init_test.go
index 4db765839e0..e019907122d 100644
--- a/services/actions/init_test.go
+++ b/services/actions/init_test.go
@@ -7,10 +7,10 @@ import (
 	"os"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/util"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/actions/interface.go b/services/actions/interface.go
index 15e63810529..9df265c35b2 100644
--- a/services/actions/interface.go
+++ b/services/actions/interface.go
@@ -3,7 +3,7 @@
 
 package actions
 
-import "code.gitea.io/gitea/services/context"
+import "gitea.dev/services/context"
 
 // API for actions of a repository or organization
 type API interface {
diff --git a/services/actions/job_emitter.go b/services/actions/job_emitter.go
index 489b36a3a7d..9c9a408db0a 100644
--- a/services/actions/job_emitter.go
+++ b/services/actions/job_emitter.go
@@ -8,14 +8,14 @@ import (
 	"errors"
 	"fmt"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"xorm.io/builder"
 )
@@ -69,39 +69,48 @@ func checkJobsByRunID(ctx context.Context, runID int64) error {
 	if err != nil {
 		return fmt.Errorf("get action run: %w", err)
 	}
-	var jobs, updatedJobs, cancelledJobs []*actions_model.ActionRunJob
+	var result jobsCheckResult
 	if err := db.WithTx(ctx, func(ctx context.Context) error {
 		// check jobs of the current run
-		if js, ujs, cjs, err := checkJobsOfCurrentRunAttempt(ctx, run); err != nil {
+		r, err := checkJobsOfCurrentRunAttempt(ctx, run)
+		if err != nil {
 			return err
-		} else {
-			jobs = append(jobs, js...)
-			updatedJobs = append(updatedJobs, ujs...)
-			cancelledJobs = append(cancelledJobs, cjs...)
 		}
-		if js, ujs, cjs, err := checkRunConcurrency(ctx, run); err != nil {
+		result.merge(r)
+
+		r, err = checkRunConcurrency(ctx, run)
+		if err != nil {
 			return err
-		} else {
-			jobs = append(jobs, js...)
-			updatedJobs = append(updatedJobs, ujs...)
-			cancelledJobs = append(cancelledJobs, cjs...)
 		}
+		result.merge(r)
 		return nil
 	}); err != nil {
 		return err
 	}
-	NotifyWorkflowJobsAndRunsStatusUpdate(ctx, cancelledJobs)
-	EmitJobsIfReadyByJobs(cancelledJobs)
-	if err := createCommitStatusesForJobsByRun(ctx, jobs); err != nil {
+	// Re-emit AFTER the transaction commits; doing this inside WithTx would deadlock under
+	// immediate-mode queues (the inline handler reopens checkJobsByRunID and asks for a
+	// nested writer transaction while the outer one is still open).
+	emitted := make(container.Set[int64])
+	for _, rid := range result.RunIDsToReEmit {
+		if !emitted.Add(rid) {
+			continue
+		}
+		if err := EmitJobsIfReadyByRun(rid); err != nil {
+			log.Error("re-emit run %d after caller expansion: %v", rid, err)
+		}
+	}
+	NotifyWorkflowJobsAndRunsStatusUpdate(ctx, result.CancelledJobs)
+	EmitJobsIfReadyByJobs(result.CancelledJobs)
+	if err := createCommitStatusesForJobsByRun(ctx, result.Jobs); err != nil {
 		return err
 	}
-	NotifyWorkflowJobsStatusUpdate(ctx, updatedJobs...)
+	NotifyWorkflowJobsStatusUpdate(ctx, result.UpdatedJobs...)
 	runJobs := make(map[int64][]*actions_model.ActionRunJob)
-	for _, job := range jobs {
+	for _, job := range result.Jobs {
 		runJobs[job.RunID] = append(runJobs[job.RunID], job)
 	}
 	runUpdatedJobs := make(map[int64][]*actions_model.ActionRunJob)
-	for _, uj := range updatedJobs {
+	for _, uj := range result.UpdatedJobs {
 		runUpdatedJobs[uj.RunID] = append(runUpdatedJobs[uj.RunID], uj)
 	}
 	for runID, js := range runJobs {
@@ -158,20 +167,22 @@ func findBlockedRunIDByConcurrency(ctx context.Context, repoID int64, concurrenc
 	return 0, nil
 }
 
-func checkBlockedConcurrentRun(ctx context.Context, repoID, runID int64) (jobs, updatedJobs, cancelledJobs []*actions_model.ActionRunJob, err error) {
+func checkBlockedConcurrentRun(ctx context.Context, repoID, runID int64) (*jobsCheckResult, error) {
 	concurrentRun, err := actions_model.GetRunByRepoAndID(ctx, repoID, runID)
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("get run %d: %w", runID, err)
+		return nil, fmt.Errorf("get run %d: %w", runID, err)
 	}
 	if concurrentRun.NeedApproval {
-		return nil, nil, nil, nil
+		return &jobsCheckResult{}, nil
 	}
 
 	return checkJobsOfCurrentRunAttempt(ctx, concurrentRun)
 }
 
 // checkRunConcurrency rechecks runs blocked by concurrency that may become unblocked after the current run releases a workflow-level or job-level concurrency group.
-func checkRunConcurrency(ctx context.Context, run *actions_model.ActionRun) (jobs, updatedJobs, cancelledJobs []*actions_model.ActionRunJob, err error) {
+// RunIDsToReEmit propagates from inner checkJobsOfCurrentRunAttempt calls; see that function's doc.
+func checkRunConcurrency(ctx context.Context, run *actions_model.ActionRun) (*jobsCheckResult, error) {
+	result := &jobsCheckResult{}
 	checkedConcurrencyGroup := make(container.Set[string])
 
 	collect := func(concurrencyGroup string) error {
@@ -180,13 +191,11 @@ func checkRunConcurrency(ctx context.Context, run *actions_model.ActionRun) (job
 			return fmt.Errorf("find blocked run by concurrency: %w", err)
 		}
 		if concurrentRunID > 0 {
-			js, ujs, cjs, err := checkBlockedConcurrentRun(ctx, run.RepoID, concurrentRunID)
+			r, err := checkBlockedConcurrentRun(ctx, run.RepoID, concurrentRunID)
 			if err != nil {
 				return err
 			}
-			jobs = append(jobs, js...)
-			updatedJobs = append(updatedJobs, ujs...)
-			cancelledJobs = append(cancelledJobs, cjs...)
+			result.merge(r)
 		}
 		checkedConcurrencyGroup.Add(concurrencyGroup)
 		return nil
@@ -195,18 +204,18 @@ func checkRunConcurrency(ctx context.Context, run *actions_model.ActionRun) (job
 	// check run (workflow-level) concurrency
 	runConcurrencyGroup, _, err := run.GetEffectiveConcurrency(ctx)
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("GetEffectiveConcurrency: %w", err)
+		return nil, fmt.Errorf("GetEffectiveConcurrency: %w", err)
 	}
 	if runConcurrencyGroup != "" {
 		if err := collect(runConcurrencyGroup); err != nil {
-			return nil, nil, nil, err
+			return nil, err
 		}
 	}
 
 	// check job concurrency
 	runJobs, err := actions_model.GetLatestAttemptJobsByRepoAndRunID(ctx, run.RepoID, run.ID)
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("find run %d jobs: %w", run.ID, err)
+		return nil, fmt.Errorf("find run %d jobs: %w", run.ID, err)
 	}
 	for _, job := range runJobs {
 		if !job.Status.IsDone() {
@@ -216,24 +225,47 @@ func checkRunConcurrency(ctx context.Context, run *actions_model.ActionRun) (job
 			continue
 		}
 		if err := collect(job.ConcurrencyGroup); err != nil {
-			return nil, nil, nil, err
+			return nil, err
 		}
 	}
-	return jobs, updatedJobs, cancelledJobs, nil
+	return result, nil
 }
 
 // checkJobsOfCurrentRunAttempt resolves blocked jobs of the run's latest attempt.
-func checkJobsOfCurrentRunAttempt(ctx context.Context, run *actions_model.ActionRun) (jobs, updatedJobs, cancelledJobs []*actions_model.ActionRunJob, err error) {
-	jobs, err = actions_model.GetRunJobsByRunAndAttemptID(ctx, run.ID, run.LatestAttemptID)
+func checkJobsOfCurrentRunAttempt(ctx context.Context, run *actions_model.ActionRun) (*jobsCheckResult, error) {
+	jobs, err := actions_model.GetRunJobsByRunAndAttemptID(ctx, run.ID, run.LatestAttemptID)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, err
+	}
+	result := &jobsCheckResult{Jobs: jobs}
+
+	var attempt *actions_model.ActionRunAttempt
+	if run.LatestAttemptID > 0 {
+		attempt, err = actions_model.GetRunAttemptByRepoAndID(ctx, run.RepoID, run.LatestAttemptID)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// The resolver below only considers needs and job-level concurrency, so a run blocked
+	// solely by run-level concurrency would have its jobs unblocked here. checkRunConcurrency
+	// re-evaluates when the holding run finishes.
+	if run.Status.IsBlocked() && attempt != nil {
+		shouldBlock, err := shouldBlockRunByConcurrency(ctx, attempt)
+		if err != nil {
+			return nil, fmt.Errorf("shouldBlockRunByConcurrency: %w", err)
+		}
+		if shouldBlock {
+			return result, nil
+		}
 	}
 	vars, err := actions_model.GetVariablesOfRun(ctx, run)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, err
 	}
 	resolver := newJobStatusResolver(jobs, vars)
 
+	expandedAnyCaller := false
 	if err = db.WithTx(ctx, func(ctx context.Context) error {
 		for _, job := range jobs {
 			job.Run = run
@@ -241,22 +273,47 @@ func checkJobsOfCurrentRunAttempt(ctx context.Context, run *actions_model.Action
 
 		updates := resolver.Resolve(ctx)
 		for _, job := range jobs {
-			if status, ok := updates[job.ID]; ok {
-				job.Status = status
-				if n, err := actions_model.UpdateRunJob(ctx, job, builder.Eq{"status": actions_model.StatusBlocked}, "status"); err != nil {
-					return err
-				} else if n != 1 {
-					return fmt.Errorf("no affected for updating blocked job %v", job.ID)
-				}
-				updatedJobs = append(updatedJobs, job)
+			status, ok := updates[job.ID]
+			if !ok {
+				continue
 			}
+
+			if job.IsReusableCaller {
+				switch status {
+				case actions_model.StatusWaiting:
+					if err := expandReusableWorkflowCaller(ctx, run, attempt, job, vars); err != nil {
+						return fmt.Errorf("trigger caller-ready %d: %w", job.ID, err)
+					}
+					// expandReusableWorkflowCaller inserts children as Blocked. They need a follow-up resolver pass.
+					expandedAnyCaller = true
+				case actions_model.StatusSkipped:
+					job.Status = actions_model.StatusSkipped
+					if _, err := actions_model.UpdateRunJob(ctx, job, nil, "status"); err != nil {
+						return err
+					}
+				}
+				continue
+			}
+
+			// Non-caller: standard status update.
+			job.Status = status
+			if n, err := actions_model.UpdateRunJob(ctx, job, builder.Eq{"status": actions_model.StatusBlocked}, "status"); err != nil {
+				return err
+			} else if n != 1 {
+				return fmt.Errorf("no affected for updating blocked job %v", job.ID)
+			}
+			result.UpdatedJobs = append(result.UpdatedJobs, job)
 		}
 		return nil
 	}); err != nil {
-		return nil, nil, nil, err
+		return nil, err
 	}
 
-	return jobs, updatedJobs, resolver.cancelledJobs, nil
+	if expandedAnyCaller {
+		result.RunIDsToReEmit = append(result.RunIDsToReEmit, run.ID)
+	}
+	result.CancelledJobs = resolver.cancelledJobs
+	return result, nil
 }
 
 type jobStatusResolver struct {
@@ -268,10 +325,17 @@ type jobStatusResolver struct {
 }
 
 func newJobStatusResolver(jobs actions_model.ActionJobList, vars map[string]string) *jobStatusResolver {
-	idToJobs := make(map[string][]*actions_model.ActionRunJob, len(jobs))
+	// Scope-aware: needs are resolved within the same ParentJobID scope so the same
+	// JobID in different reusable workflow calls does not cross-link.
+	scopedIDToJobs := make(map[int64]map[string][]*actions_model.ActionRunJob)
 	jobMap := make(map[int64]*actions_model.ActionRunJob)
 	for _, job := range jobs {
-		idToJobs[job.JobID] = append(idToJobs[job.JobID], job)
+		scope := scopedIDToJobs[job.ParentJobID]
+		if scope == nil {
+			scope = make(map[string][]*actions_model.ActionRunJob)
+			scopedIDToJobs[job.ParentJobID] = scope
+		}
+		scope[job.JobID] = append(scope[job.JobID], job)
 		jobMap[job.ID] = job
 	}
 
@@ -279,8 +343,9 @@ func newJobStatusResolver(jobs actions_model.ActionJobList, vars map[string]stri
 	needs := make(map[int64][]int64, len(jobs))
 	for _, job := range jobs {
 		statuses[job.ID] = job.Status
+		scope := scopedIDToJobs[job.ParentJobID]
 		for _, need := range job.Needs {
-			for _, v := range idToJobs[need] {
+			for _, v := range scope[need] {
 				needs[job.ID] = append(needs[job.ID], v.ID)
 			}
 		}
@@ -322,14 +387,6 @@ func (r *jobStatusResolver) resolveCheckNeeds(id int64) (allDone, allSucceed boo
 	return allDone, allSucceed
 }
 
-func (r *jobStatusResolver) resolveJobHasIfCondition(actionRunJob *actions_model.ActionRunJob) (hasIf bool) {
-	// FIXME evaluate this on the server side
-	if job, err := actionRunJob.ParseJob(); err == nil {
-		return len(job.If.Value) > 0
-	}
-	return hasIf
-}
-
 func (r *jobStatusResolver) resolve(ctx context.Context) map[int64]actions_model.Status {
 	ret := map[int64]actions_model.Status{}
 	for id, status := range r.statuses {
@@ -337,6 +394,12 @@ func (r *jobStatusResolver) resolve(ctx context.Context) map[int64]actions_model
 		if status != actions_model.StatusBlocked {
 			continue
 		}
+		// A child of a caller cannot start until the caller has become "ready" (children inserted, CallPayload populated).
+		if actionRunJob.ParentJobID > 0 {
+			if parent, ok := r.jobMap[actionRunJob.ParentJobID]; ok && !parent.IsExpanded {
+				continue
+			}
+		}
 		allDone, allSucceed := r.resolveCheckNeeds(id)
 		if !allDone {
 			continue
@@ -347,18 +410,16 @@ func (r *jobStatusResolver) resolve(ctx context.Context) map[int64]actions_model
 		if err != nil {
 			// The err can be caused by different cases: database error, or syntax error, or the needed jobs haven't completed
 			// At the moment there is no way to distinguish them.
-			// Actually, for most cases, the error is caused by "syntax error" / "the needed jobs haven't completed (skipped?)"
 			// TODO: if workflow or concurrency expression has syntax error, there should be a user error message, need to show it to end users
 			log.Debug("updateConcurrencyEvaluationForJobWithNeeds failed, this job will stay blocked: job: %d, err: %v", id, err)
 			continue
 		}
 
-		shouldStartJob := true
-		if !allSucceed {
-			// Not all dependent jobs completed successfully:
-			// * if the job has "if" condition, it can be started, then the act_runner will evaluate the "if" condition.
-			// * otherwise, the job should be skipped.
-			shouldStartJob = r.resolveJobHasIfCondition(actionRunJob)
+		shouldStartJob, err := evaluateJobIf(ctx, actionRunJob.Run, nil, actionRunJob, r.vars, allSucceed)
+		if err != nil {
+			// TODO: surface deterministic expression errors to users by failing the job with a message.
+			log.Error("evaluateJobIf failed, job will stay blocked: job: %d, err: %v", id, err)
+			continue
 		}
 
 		newStatus := util.Iif(shouldStartJob, actions_model.StatusWaiting, actions_model.StatusSkipped)
@@ -402,3 +463,23 @@ func updateConcurrencyEvaluationForJobWithNeeds(ctx context.Context, actionRunJo
 	}
 	return nil
 }
+
+// jobsCheckResult bundles the output of the per-run job-check helpers.
+type jobsCheckResult struct {
+	// Jobs are all jobs of the run's latest attempt that were inspected.
+	Jobs []*actions_model.ActionRunJob
+	// UpdatedJobs are jobs whose status was transitioned out of Blocked in this pass.
+	UpdatedJobs []*actions_model.ActionRunJob
+	// CancelledJobs are jobs cancelled by job-level concurrency while preparing to start.
+	CancelledJobs []*actions_model.ActionRunJob
+	// RunIDsToReEmit are runs whose newly expanded reusable workflow callers need another resolver pass.
+	RunIDsToReEmit []int64
+}
+
+// merge appends another result's contents into r in place.
+func (r *jobsCheckResult) merge(other *jobsCheckResult) {
+	r.Jobs = append(r.Jobs, other.Jobs...)
+	r.UpdatedJobs = append(r.UpdatedJobs, other.UpdatedJobs...)
+	r.CancelledJobs = append(r.CancelledJobs, other.CancelledJobs...)
+	r.RunIDsToReEmit = append(r.RunIDsToReEmit, other.RunIDsToReEmit...)
+}
diff --git a/services/actions/job_emitter_test.go b/services/actions/job_emitter_test.go
index 11998e01b21..892ba6c2c5b 100644
--- a/services/actions/job_emitter_test.go
+++ b/services/actions/job_emitter_test.go
@@ -4,11 +4,14 @@
 package actions
 
 import (
+	"fmt"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -129,10 +132,48 @@ jobs:
 			want: map[int64]actions_model.Status{2: actions_model.StatusSkipped},
 		},
 	}
-	for _, tt := range tests {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+	stubRun := &actions_model.ActionRun{TriggerUser: &user_model.User{}, Repo: &repo_model.Repository{}}
+	for i, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			// Each subtest gets a unique RunID / RunAttemptID so jobs from different subtests don't bleed into each other's FindTaskNeeds queries
+			runID := int64(9001 + i)
+			attemptID := int64(9001 + i)
+
+			// Insert each test job (letting the DB assign IDs) and remember the testID -> dbID mapping so we can translate the expected map.
+			idMap := make(map[int64]int64, len(tt.jobs))
+			for _, j := range tt.jobs {
+				origID := j.ID
+				j.ID = 0
+				j.RunID = runID
+				j.RunAttemptID = attemptID
+				j.Run = stubRun
+
+				// The resolver evaluates Blocked jobs via evaluateJobIf, which needs a valid YAML payload;
+				// supply a minimal one when the case didn't.
+				if j.Status == actions_model.StatusBlocked && len(j.WorkflowPayload) == 0 {
+					j.WorkflowPayload = fmt.Appendf(nil, `name: test
+on: push
+jobs:
+  %s:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo
+`, j.JobID)
+				}
+
+				assert.NoError(t, db.Insert(ctx, j))
+				idMap[origID] = j.ID
+			}
+
+			want := make(map[int64]actions_model.Status, len(tt.want))
+			for k, v := range tt.want {
+				want[idMap[k]] = v
+			}
+
 			r := newJobStatusResolver(tt.jobs, nil)
-			assert.Equal(t, tt.want, r.Resolve(t.Context()))
+			assert.Equal(t, want, r.Resolve(ctx))
 		})
 	}
 }
@@ -221,10 +262,75 @@ func Test_checkRunConcurrency_NoDuplicateConcurrencyGroupCheck(t *testing.T) {
 	assert.NoError(t, db.Insert(ctx, jobBBlocked))
 
 	runA, _, _ = db.GetByID[actions_model.ActionRun](t.Context(), runA.ID)
-	jobs, _, _, err := checkRunConcurrency(ctx, runA)
+	result, err := checkRunConcurrency(ctx, runA)
 	assert.NoError(t, err)
 
-	if assert.Len(t, jobs, 1) {
-		assert.Equal(t, jobBBlocked.ID, jobs[0].ID)
+	if assert.Len(t, result.Jobs, 1) {
+		assert.Equal(t, jobBBlocked.ID, result.Jobs[0].ID)
 	}
 }
+
+// Test_checkJobsOfCurrentRunAttempt_RunLevelConcurrencyKeepsJobsBlocked verifies that
+// the resolver does not transition a job out of Blocked while another run still holds
+// the workflow-level concurrency group. Regression for #37446.
+func Test_checkJobsOfCurrentRunAttempt_RunLevelConcurrencyKeepsJobsBlocked(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	const group = "test-run-level-concurrency-keeps-blocked"
+
+	// Holder run: Running attempt in the concurrency group.
+	holderRun := &actions_model.ActionRun{
+		RepoID: 4, OwnerID: 1, TriggerUserID: 1,
+		WorkflowID: "test.yml", Index: 9911, Ref: "refs/heads/main",
+		Status: actions_model.StatusRunning,
+	}
+	assert.NoError(t, db.Insert(ctx, holderRun))
+	holderAttempt := &actions_model.ActionRunAttempt{
+		RepoID: 4, RunID: holderRun.ID, Attempt: 1,
+		Status: actions_model.StatusRunning, ConcurrencyGroup: group,
+	}
+	assert.NoError(t, db.Insert(ctx, holderAttempt))
+	_, err := db.Exec(ctx, "UPDATE `action_run` SET latest_attempt_id = ? WHERE id = ?", holderAttempt.ID, holderRun.ID)
+	assert.NoError(t, err)
+
+	// Blocked run: Blocked attempt in the same group, with one Blocked job that has
+	// no needs and no job-level concurrency. Without the run-level guard in
+	// checkJobsOfCurrentRunAttempt, the resolver would transition this job to Waiting.
+	blockedRun := &actions_model.ActionRun{
+		RepoID: 4, OwnerID: 1, TriggerUserID: 1,
+		WorkflowID: "test.yml", Index: 9912, Ref: "refs/heads/main",
+		Status: actions_model.StatusBlocked,
+	}
+	assert.NoError(t, db.Insert(ctx, blockedRun))
+	blockedAttempt := &actions_model.ActionRunAttempt{
+		RepoID: 4, RunID: blockedRun.ID, Attempt: 1,
+		Status: actions_model.StatusBlocked, ConcurrencyGroup: group,
+	}
+	assert.NoError(t, db.Insert(ctx, blockedAttempt))
+	_, err = db.Exec(ctx, "UPDATE `action_run` SET latest_attempt_id = ? WHERE id = ?", blockedAttempt.ID, blockedRun.ID)
+	assert.NoError(t, err)
+	blockedRun.LatestAttemptID = blockedAttempt.ID
+	blockedJob := &actions_model.ActionRunJob{
+		RunID: blockedRun.ID, RunAttemptID: blockedAttempt.ID, AttemptJobID: 1,
+		RepoID: 4, OwnerID: 1, JobID: "job1", Name: "job1",
+		Status: actions_model.StatusBlocked,
+		WorkflowPayload: []byte(`
+name: test
+on: push
+jobs:
+  job1:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo
+`),
+	}
+	assert.NoError(t, db.Insert(ctx, blockedJob))
+
+	result, err := checkJobsOfCurrentRunAttempt(ctx, blockedRun)
+	assert.NoError(t, err)
+	assert.Empty(t, result.UpdatedJobs)
+
+	refreshed := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: blockedJob.ID})
+	assert.Equal(t, actions_model.StatusBlocked, refreshed.Status)
+}
diff --git a/services/actions/notifier.go b/services/actions/notifier.go
index 4b2e87afad2..0ac24881a7c 100644
--- a/services/actions/notifier.go
+++ b/services/actions/notifier.go
@@ -7,24 +7,24 @@ import (
 	"context"
 	"errors"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	perm_model "code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	"code.gitea.io/gitea/services/convert"
-	notify_service "code.gitea.io/gitea/services/notify"
+	actions_model "gitea.dev/models/actions"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	perm_model "gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
+	"gitea.dev/services/convert"
+	notify_service "gitea.dev/services/notify"
 )
 
 type actionsNotifier struct {
@@ -687,7 +687,7 @@ func (n *actionsNotifier) AutoMergePullRequest(ctx context.Context, doer *user_m
 	n.MergePullRequest(ctx, doer, pr)
 }
 
-func (n *actionsNotifier) PullRequestSynchronized(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest) {
+func (n *actionsNotifier) PullRequestSynchronized(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest, before, after string) {
 	ctx = withMethod(ctx, "PullRequestSynchronized")
 
 	if err := pr.LoadIssue(ctx); err != nil {
@@ -703,6 +703,8 @@ func (n *actionsNotifier) PullRequestSynchronized(ctx context.Context, doer *use
 	newNotifyInput(pr.Issue.Repo, doer, webhook_module.HookEventPullRequestSync).
 		WithPayload(&api.PullRequestPayload{
 			Action:      api.HookIssueSynchronized,
+			Before:      before,
+			After:       after,
 			Index:       pr.Issue.Index,
 			PullRequest: convert.ToAPIPullRequest(ctx, pr, nil),
 			Repository:  convert.ToRepo(ctx, pr.Issue.Repo, access_model.Permission{AccessMode: perm_model.AccessModeNone}),
diff --git a/services/actions/notifier_helper.go b/services/actions/notifier_helper.go
index 4d2a7113b97..616cf3d5c28 100644
--- a/services/actions/notifier_helper.go
+++ b/services/actions/notifier_helper.go
@@ -10,25 +10,25 @@ import (
 	"slices"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	packages_model "code.gitea.io/gitea/models/packages"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	actions_module "code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	"code.gitea.io/gitea/services/convert"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	packages_model "gitea.dev/models/packages"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	actions_module "gitea.dev/modules/actions"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
+	"gitea.dev/services/convert"
 
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/model"
 )
 
 type methodCtxKeyType struct{}
@@ -256,7 +256,7 @@ func skipWorkflows(ctx context.Context, input *notifyInput, commit *git.Commit)
 				log.Debug("repo %s: skipped run for pr %v because of %s string", input.Repo.RelativePath(), input.PullRequest.Issue.ID, s)
 				return true
 			}
-			if strings.Contains(commit.CommitMessage, s) {
+			if strings.Contains(commit.MessageRaw, s) {
 				log.Debug("repo %s with commit %s: skipped run because of %s string", input.Repo.RelativePath(), commit.ID, s)
 				return true
 			}
@@ -320,7 +320,7 @@ func handleWorkflows(
 
 	for _, dwf := range detectedWorkflows {
 		run := &actions_model.ActionRun{
-			Title:             strings.SplitN(commit.CommitMessage, "\n", 2)[0],
+			Title:             commit.MessageTitle(),
 			RepoID:            input.Repo.ID,
 			Repo:              input.Repo,
 			OwnerID:           input.Repo.OwnerID,
@@ -483,7 +483,7 @@ func handleSchedules(
 		}
 
 		run := &actions_model.ActionSchedule{
-			Title:         strings.SplitN(commit.CommitMessage, "\n", 2)[0],
+			Title:         commit.MessageTitle(),
 			RepoID:        input.Repo.ID,
 			Repo:          input.Repo,
 			OwnerID:       input.Repo.OwnerID,
diff --git a/services/actions/notify.go b/services/actions/notify.go
index e8b05c9fecd..8d356960bae 100644
--- a/services/actions/notify.go
+++ b/services/actions/notify.go
@@ -6,9 +6,9 @@ package actions
 import (
 	"context"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/log"
-	notify_service "code.gitea.io/gitea/services/notify"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/modules/log"
+	notify_service "gitea.dev/services/notify"
 )
 
 // NotifyWorkflowJobsAndRunsStatusUpdate notifies status changes for a batch of jobs and the runs they affect.
@@ -18,8 +18,9 @@ func NotifyWorkflowJobsAndRunsStatusUpdate(ctx context.Context, jobs []*actions_
 		return
 	}
 
-	// The input jobs may belong to different runs, so track each affected run.
-	runs := make(map[int64]*actions_model.ActionRun, len(jobs))
+	// The input jobs may belong to different runs, so track each affected run ID
+	// and reload it later to avoid notifying with stale aggregate status.
+	runRepoIDs := make(map[int64]int64, len(jobs))
 	jobsByRunID := make(map[int64][]*actions_model.ActionRunJob)
 
 	for _, job := range jobs {
@@ -29,17 +30,15 @@ func NotifyWorkflowJobsAndRunsStatusUpdate(ctx context.Context, jobs []*actions_
 		}
 		CreateCommitStatusForRunJobs(ctx, job.Run, job)
 
-		if _, ok := runs[job.RunID]; !ok {
-			runs[job.RunID] = job.Run
-		}
+		runRepoIDs[job.RunID] = job.RepoID
 		if _, ok := jobsByRunID[job.RunID]; !ok {
 			jobsByRunID[job.RunID] = make([]*actions_model.ActionRunJob, 0)
 		}
 		jobsByRunID[job.RunID] = append(jobsByRunID[job.RunID], job)
 	}
 
-	for _, run := range runs {
-		NotifyWorkflowRunStatusUpdate(ctx, run)
+	for runID, repoID := range runRepoIDs {
+		NotifyWorkflowRunStatusUpdateWithReload(ctx, repoID, runID)
 	}
 
 	for _, jobs := range jobsByRunID {
@@ -78,7 +77,11 @@ func NotifyWorkflowRunStatusUpdate(ctx context.Context, run *actions_model.Actio
 		}
 		triggerUser = attempt.TriggerUser
 	}
+
 	notify_service.WorkflowRunStatusUpdate(ctx, run.Repo, triggerUser, run)
+
+	// Recomputes the repository's num_action_runs / num_closed_action_runs counters since the run's status changed
+	actions_model.UpdateRepoRunsNumbers(ctx, run.RepoID)
 }
 
 // NotifyWorkflowJobsStatusUpdate notifies status updates for jobs without task.
diff --git a/services/actions/permission_parser.go b/services/actions/permission_parser.go
index 8c06e27d4b3..a94bc466c23 100644
--- a/services/actions/permission_parser.go
+++ b/services/actions/permission_parser.go
@@ -4,11 +4,11 @@
 package actions
 
 import (
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/actions/jobparser"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/setting"
 
 	"go.yaml.in/yaml/v4"
 )
diff --git a/services/actions/permission_parser_test.go b/services/actions/permission_parser_test.go
index 9986814b485..e2e6990b007 100644
--- a/services/actions/permission_parser_test.go
+++ b/services/actions/permission_parser_test.go
@@ -6,10 +6,10 @@ package actions
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/actions/jobparser"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/actions/jobparser"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/actions/rerun.go b/services/actions/rerun.go
index f253181a8dd..1ef84608a0e 100644
--- a/services/actions/rerun.go
+++ b/services/actions/rerun.go
@@ -8,16 +8,17 @@ import (
 	"fmt"
 	"slices"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -42,6 +43,7 @@ func GetFailedJobsForRerun(allJobs []*actions_model.ActionRunJob) []*actions_mod
 // rather than one big outer transaction:
 //   - execRerunPlan performs slow work (loading variables, YAML unmarshal, concurrency expression evaluation)
 //     before opening its own transaction, so the tx stays focused on inserts/updates.
+//     (Exception: reusable workflow caller expansion runs inside the tx, see expandReusableWorkflowCaller's doc.)
 //   - The legacy backfill is idempotent-friendly: if it succeeds but a later stage fails, a subsequent rerun
 //     will observe run.LatestAttemptID != 0 and skip the backfill, continuing naturally. No data corruption
 //     or stuck state results from partial progress.
@@ -112,8 +114,19 @@ type rerunPlan struct {
 	run             *actions_model.ActionRun
 	templateAttempt *actions_model.ActionRunAttempt
 	templateJobs    actions_model.ActionJobList
-	rerunJobIDs     container.Set[string]
 	triggerUser     *user_model.User
+
+	// rerunAttemptJobIDs holds the AttemptJobIDs of jobs that will actually be re-run in the new attempt.
+	// If a job here is a reusable caller, the whole subtree under it will be re-run.
+	rerunAttemptJobIDs container.Set[int64]
+
+	// ancestorAttemptJobIDs holds the AttemptJobIDs of reusable caller jobs that have only some of their descendants being re-run:
+	// the caller itself is NOT re-run as a whole, it stays pass-through and its non-rerun children stay pass-through too.
+	ancestorAttemptJobIDs container.Set[int64]
+
+	// skipCloneTemplateJobIDs holds the template-attempt DB row IDs of descendants of any reusable caller in rerunAttemptJobIDs.
+	// These jobs should not be cloned, since the caller's lazy expansion will re-insert them fresh.
+	skipCloneTemplateJobIDs container.Set[int64]
 }
 
 // buildRerunPlan constructs a rerunPlan for the given workflow run without writing to the database.
@@ -151,6 +164,7 @@ func buildRerunPlan(ctx context.Context, run *actions_model.ActionRun, triggerUs
 	if err := plan.expandRerunJobIDs(jobsToRerun); err != nil {
 		return nil, err
 	}
+	plan.skipCloneTemplateJobIDs = plan.collectResetCallerDescendants()
 
 	return plan, nil
 }
@@ -188,6 +202,7 @@ func execRerunPlan(ctx context.Context, plan *rerunPlan) (*actions_model.ActionR
 
 	var newJobs, newJobsToRerun actions_model.ActionJobList
 	var cancelledConcurrencyJobs []*actions_model.ActionRunJob
+	var hasWaitingCallerJobs bool
 
 	err = db.WithTx(ctx, func(ctx context.Context) error {
 		newAttemptStatus, jobsToCancel, err := PrepareToStartRunWithConcurrency(ctx, newAttempt)
@@ -212,10 +227,30 @@ func execRerunPlan(ctx context.Context, plan *rerunPlan) (*actions_model.ActionR
 
 		hasWaitingJobs := false
 		newJobs = make(actions_model.ActionJobList, 0, len(plan.templateJobs))
-		newJobsToRerun = make(actions_model.ActionJobList, 0, len(plan.rerunJobIDs))
+		newJobsToRerun = make(actions_model.ActionJobList, 0, len(plan.rerunAttemptJobIDs))
+
+		// templateIDToNewID maps each template-attempt job's DB ID to its newly-inserted clone's DB ID
+		templateIDToNewID := make(map[int64]int64, len(plan.templateJobs))
+
 		for _, templateJob := range plan.templateJobs {
+			// descendants of a reset reusable caller are not cloned at all, the caller will re-insert them
+			if plan.skipCloneTemplateJobIDs.Contains(templateJob.ID) {
+				continue
+			}
+
 			newJob := cloneRunJobForAttempt(templateJob, newAttempt)
-			if plan.rerunJobIDs.Contains(templateJob.JobID) {
+
+			// Remap ParentJobID from template attempts's DB ID -> new attempt's DB ID.
+			if templateJob.ParentJobID != 0 {
+				newParentID, ok := templateIDToNewID[templateJob.ParentJobID]
+				if !ok {
+					return fmt.Errorf("clone order violation: parent job %d not yet cloned for child %d",
+						templateJob.ParentJobID, templateJob.ID)
+				}
+				newJob.ParentJobID = newParentID
+			}
+
+			if plan.rerunAttemptJobIDs.Contains(templateJob.AttemptJobID) {
 				shouldBlockJob := shouldBlock || plan.hasRerunDependency(templateJob)
 
 				newJob.Status = util.Iif(shouldBlockJob, actions_model.StatusBlocked, actions_model.StatusWaiting)
@@ -227,6 +262,11 @@ func execRerunPlan(ctx context.Context, plan *rerunPlan) (*actions_model.ActionR
 				newJob.ConcurrencyCancel = false
 				newJob.IsConcurrencyEvaluated = false
 
+				if templateJob.IsReusableCaller {
+					newJob.IsExpanded = false
+					newJob.CallPayload = ""
+				}
+
 				if newJob.RawConcurrency != "" && !shouldBlockJob {
 					if err := EvaluateJobConcurrencyFillModel(ctx, plan.run, newAttempt, newJob, vars, nil); err != nil {
 						return fmt.Errorf("evaluate job concurrency: %w", err)
@@ -242,17 +282,45 @@ func execRerunPlan(ctx context.Context, plan *rerunPlan) (*actions_model.ActionR
 			} else {
 				newJob.TaskID = 0
 				newJob.SourceTaskID = templateJob.EffectiveTaskID()
-				newJob.Started = templateJob.Started
-				newJob.Stopped = templateJob.Stopped
+
+				isAncestor := plan.ancestorAttemptJobIDs.Contains(templateJob.AttemptJobID)
+				newJob.Started = util.Iif(isAncestor, 0, templateJob.Started)
+				newJob.Stopped = util.Iif(isAncestor, 0, templateJob.Stopped)
 			}
 
 			if err := db.Insert(ctx, newJob); err != nil {
 				return err
 			}
-			hasWaitingJobs = hasWaitingJobs || newJob.Status == actions_model.StatusWaiting
+			templateIDToNewID[templateJob.ID] = newJob.ID
+
+			// expand reusable caller
+			if newJob.IsReusableCaller && newJob.Status == actions_model.StatusWaiting && !newJob.IsExpanded {
+				if err := expandReusableWorkflowCaller(ctx, plan.run, newAttempt, newJob, vars); err != nil {
+					return fmt.Errorf("inline trigger caller %d ready: %w", newJob.ID, err)
+				}
+				// refresh the caller status
+				if err := actions_model.RefreshReusableCallerStatus(ctx, newJob); err != nil {
+					return fmt.Errorf("refresh caller %d status: %w", newJob.ID, err)
+				}
+				hasWaitingCallerJobs = true
+			}
+
+			// A reusable caller is never dispatched to a runner, so it must not drive the task-version bump.
+			hasWaitingJobs = hasWaitingJobs || (newJob.Status == actions_model.StatusWaiting && !newJob.IsReusableCaller)
 			newJobs = append(newJobs, newJob)
 		}
 
+		// Refresh each ancestor's status from its now-fresh children.
+		// `newJobs` is appended top-down (caller before its children), so we walk it in reverse to refresh the deepest ancestor first.
+		for _, ancestor := range slices.Backward(newJobs) {
+			if !ancestor.IsReusableCaller || !plan.ancestorAttemptJobIDs.Contains(ancestor.AttemptJobID) {
+				continue
+			}
+			if err := actions_model.RefreshReusableCallerStatus(ctx, ancestor); err != nil {
+				return fmt.Errorf("refresh ancestor caller %d status: %w", ancestor.ID, err)
+			}
+		}
+
 		newAttempt.Status = actions_model.AggregateJobStatus(newJobsToRerun)
 		if err := actions_model.UpdateRunAttempt(ctx, newAttempt, "status"); err != nil {
 			return err
@@ -280,60 +348,149 @@ func execRerunPlan(ctx context.Context, plan *rerunPlan) (*actions_model.ActionR
 	CreateCommitStatusForRunJobs(ctx, plan.run, newJobs...)
 	NotifyWorkflowJobsAndRunsStatusUpdate(ctx, newJobsToRerun)
 
+	// Post-commit kick for expanded callers: let job_emitter resolve its child jobs
+	if hasWaitingCallerJobs {
+		if err := EmitJobsIfReadyByRun(plan.run.ID); err != nil {
+			log.Error("emit run %d after rerun: %v", plan.run.ID, err)
+		}
+	}
+
 	return newAttempt, nil
 }
 
+// expandRerunJobIDs computes rerunAttemptJobIDs and ancestorAttemptJobIDs from the user-selected jobsToRerun.
 func (p *rerunPlan) expandRerunJobIDs(jobsToRerun []*actions_model.ActionRunJob) error {
-	templateJobIDs := make(container.Set[string])
-	for _, job := range p.templateJobs {
-		templateJobIDs.Add(job.JobID)
-	}
-
+	// Empty jobsToRerun: rerun the whole latest attempt
 	if len(jobsToRerun) == 0 {
-		p.rerunJobIDs = templateJobIDs
+		all := make(container.Set[int64], len(p.templateJobs))
+		for _, job := range p.templateJobs {
+			all.Add(job.AttemptJobID)
+		}
+		p.rerunAttemptJobIDs = all
+		p.ancestorAttemptJobIDs = make(container.Set[int64])
 		return nil
 	}
 
-	rerunJobIDs := make(container.Set[string])
+	byID := make(map[int64]*actions_model.ActionRunJob, len(p.templateJobs))
+	byAttemptJobID := make(map[int64]*actions_model.ActionRunJob, len(p.templateJobs))
+	for _, job := range p.templateJobs {
+		byID[job.ID] = job
+		byAttemptJobID[job.AttemptJobID] = job
+	}
+
 	for _, job := range jobsToRerun {
-		if !templateJobIDs.Contains(job.JobID) {
+		if _, ok := byID[job.ID]; !ok {
 			return util.NewInvalidArgumentErrorf("job %q does not exist in the latest attempt", job.JobID)
 		}
-		rerunJobIDs.Add(job.JobID)
 	}
 
-	for {
-		found := false
-		for _, job := range p.templateJobs {
-			if rerunJobIDs.Contains(job.JobID) {
+	rerunSet := make(container.Set[int64])
+	ancestorSet := make(container.Set[int64])
+	queue := make([]*actions_model.ActionRunJob, 0, len(jobsToRerun))
+
+	for _, job := range jobsToRerun {
+		j := byID[job.ID]
+		rerunSet.Add(j.AttemptJobID)
+		queue = append(queue, j)
+	}
+
+	for len(queue) > 0 {
+		cur := queue[0]
+		queue = queue[1:]
+
+		// same-scope downstream: siblings whose Needs reference cur.JobID join the rerun set
+		for _, candidate := range p.templateJobs {
+			if candidate.ParentJobID != cur.ParentJobID {
 				continue
 			}
-			for _, need := range job.Needs {
-				if rerunJobIDs.Contains(need) {
-					found = true
-					rerunJobIDs.Add(job.JobID)
-					break
-				}
+			if rerunSet.Contains(candidate.AttemptJobID) || ancestorSet.Contains(candidate.AttemptJobID) {
+				continue
 			}
+			if !slices.Contains(candidate.Needs, cur.JobID) {
+				continue
+			}
+			rerunSet.Add(candidate.AttemptJobID)
+			queue = append(queue, candidate)
 		}
-		if !found {
-			break
+
+		// escalate to parent caller as an ancestor so its own siblings get checked next round
+		if cur.ParentJobID == 0 {
+			continue
+		}
+		parent, ok := byID[cur.ParentJobID]
+		if !ok {
+			continue
+		}
+		if rerunSet.Contains(parent.AttemptJobID) || ancestorSet.Contains(parent.AttemptJobID) {
+			continue
+		}
+		ancestorSet.Add(parent.AttemptJobID)
+		queue = append(queue, parent)
+	}
+
+	// remove entries whose parent-caller chain already has a rerunSet member
+	for atID := range ancestorSet {
+		cur := byAttemptJobID[atID]
+		for cur.ParentJobID != 0 {
+			parent, ok := byID[cur.ParentJobID]
+			if !ok {
+				break
+			}
+			if rerunSet.Contains(parent.AttemptJobID) {
+				delete(ancestorSet, atID)
+				break
+			}
+			cur = parent
 		}
 	}
 
-	p.rerunJobIDs = rerunJobIDs
+	p.rerunAttemptJobIDs = rerunSet
+	p.ancestorAttemptJobIDs = ancestorSet
 	return nil
 }
 
+// hasRerunDependency reports whether `job` has a needs-reference that points to a job which is itself being rerun (in rerunAttemptJobIDs)
+// or is an ancestor caller whose subtree is being rerun (in ancestorAttemptJobIDs).
+// Either case means `job` should start in Blocked status.
 func (p *rerunPlan) hasRerunDependency(job *actions_model.ActionRunJob) bool {
-	for _, need := range job.Needs {
-		if p.rerunJobIDs.Contains(need) {
+	if len(job.Needs) == 0 {
+		return false
+	}
+	needSet := container.SetOf(job.Needs...)
+	for _, sibling := range p.templateJobs {
+		if sibling.ParentJobID != job.ParentJobID {
+			continue
+		}
+		if !needSet.Contains(sibling.JobID) {
+			continue
+		}
+		if p.rerunAttemptJobIDs.Contains(sibling.AttemptJobID) || p.ancestorAttemptJobIDs.Contains(sibling.AttemptJobID) {
 			return true
 		}
 	}
 	return false
 }
 
+// collectResetCallerDescendants walks p.templateJobs and returns the DB IDs of every transitive descendant of any reusable caller whose AttemptJobID is in p.rerunAttemptJobIDs.
+// These descendants must NOT be cloned by execRerunPlan: the reset caller will re-insert them with template-matched AttemptJobIDs.
+func (p *rerunPlan) collectResetCallerDescendants() container.Set[int64] {
+	out := make(container.Set[int64])
+	for _, tj := range p.templateJobs {
+		if !tj.IsReusableCaller || !p.rerunAttemptJobIDs.Contains(tj.AttemptJobID) {
+			continue
+		}
+		// If this caller's row ID is already in `out`, it means an outer caller has already covered its whole subtree.
+		// Skip the redundant walk.
+		if out.Contains(tj.ID) {
+			continue
+		}
+		for _, child := range actions_model.CollectAllDescendantJobs(tj, p.templateJobs) {
+			out.Add(child.ID)
+		}
+	}
+	return out
+}
+
 func cloneRunJobForAttempt(templateJob *actions_model.ActionRunJob, attempt *actions_model.ActionRunAttempt) *actions_model.ActionRunJob {
 	return &actions_model.ActionRunJob{
 		RunID:                  templateJob.RunID,
@@ -355,6 +512,17 @@ func cloneRunJobForAttempt(templateJob *actions_model.ActionRunJob, attempt *act
 		ConcurrencyGroup:       templateJob.ConcurrencyGroup,
 		ConcurrencyCancel:      templateJob.ConcurrencyCancel,
 		TokenPermissions:       templateJob.TokenPermissions,
+
+		// reusable workflow fields
+		IsReusableCaller:        templateJob.IsReusableCaller,
+		CallUses:                templateJob.CallUses,
+		ReusableWorkflowContent: slices.Clone(templateJob.ReusableWorkflowContent),
+		CallSecrets:             templateJob.CallSecrets,
+		CallPayload:             templateJob.CallPayload,
+		IsExpanded:              templateJob.IsExpanded,
+		ParentJobID:             templateJob.ParentJobID, // remapped by execRerunPlan
+		WorkflowSourceRepoID:    templateJob.WorkflowSourceRepoID,
+		WorkflowSourceCommitSHA: templateJob.WorkflowSourceCommitSHA,
 	}
 }
 
diff --git a/services/actions/rerun_test.go b/services/actions/rerun_test.go
index 30772980619..baa678a4403 100644
--- a/services/actions/rerun_test.go
+++ b/services/actions/rerun_test.go
@@ -6,9 +6,10 @@ package actions
 import (
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
+	actions_model "gitea.dev/models/actions"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -100,3 +101,242 @@ func TestRerunValidation(t *testing.T) {
 		assert.ErrorIs(t, err, util.ErrInvalidArgument)
 	})
 }
+
+func TestRerunPlan(t *testing.T) {
+	// "verify" appears in two scopes (inner caller under deploy, and top-level) so scope-blind matching would fail here.
+
+	//	build              id=101, attemptJobID=1
+	//	test               id=102, attemptJobID=2,  needs=[build]
+	//	deploy             id=103, attemptJobID=3,  caller
+	//	├── validate       id=104, attemptJobID=4,  parent=103
+	//	├── push           id=105, attemptJobID=5,  parent=103, needs=[validate]
+	//	├── verify         id=106, attemptJobID=6,  parent=103, caller, needs=[push]
+	//	│   ├── smoke-test id=107, attemptJobID=7,  parent=106
+	//	│   └── cleanup    id=108, attemptJobID=8,  parent=106, needs=[smoke-test]
+	//	└── finish-deploy  id=109, attemptJobID=9,  parent=103, needs=[verify]
+	//	verify             id=110, attemptJobID=10, needs=[deploy] (top-level, same JobID)
+
+	buildJob := templateJob(101, 1, "build", 0, false)
+	testJob := templateJob(102, 2, "test", 0, false, "build")
+	deployJob := templateJob(103, 3, "deploy", 0, true)
+	validateJob := templateJob(104, 4, "validate", 103, false)
+	pushJob := templateJob(105, 5, "push", 103, false, "validate")
+	verifyInnerJob := templateJob(106, 6, "verify", 103, true, "push")
+	smokeTestJob := templateJob(107, 7, "smoke-test", 106, false)
+	cleanupJob := templateJob(108, 8, "cleanup", 106, false, "smoke-test")
+	finishDeployJob := templateJob(109, 9, "finish-deploy", 103, false, "verify")
+	verifyTopJob := templateJob(110, 10, "verify", 0, false, "deploy")
+
+	jobs := []*actions_model.ActionRunJob{
+		buildJob, testJob, deployJob, validateJob, pushJob,
+		verifyInnerJob, smokeTestJob, cleanupJob,
+		finishDeployJob, verifyTopJob,
+	}
+
+	t.Run("ExpandRerunJobIDs", func(t *testing.T) {
+		t.Run("empty jobsToRerun reruns every template job, no ancestors", func(t *testing.T) {
+			plan := &rerunPlan{templateJobs: jobs}
+			require.NoError(t, plan.expandRerunJobIDs(nil))
+
+			assert.ElementsMatch(t, attemptJobIDsOf(jobs...), plan.rerunAttemptJobIDs.Values())
+			assert.Empty(t, plan.ancestorAttemptJobIDs)
+		})
+
+		t.Run("same-scope downstream BFS pulls in dependents", func(t *testing.T) {
+			// a -> b -> c (chain), d unrelated.
+			a := templateJob(101, 1, "a", 0, false)
+			b := templateJob(102, 2, "b", 0, false, "a")
+			c := templateJob(103, 3, "c", 0, false, "b")
+			d := templateJob(104, 4, "d", 0, false)
+			plan := &rerunPlan{templateJobs: []*actions_model.ActionRunJob{a, b, c, d}}
+			require.NoError(t, plan.expandRerunJobIDs([]*actions_model.ActionRunJob{a}))
+
+			assert.ElementsMatch(t, attemptJobIDsOf(a, b, c), plan.rerunAttemptJobIDs.Values())
+			assert.Empty(t, plan.ancestorAttemptJobIDs)
+		})
+
+		t.Run("rerun a deep child escalates across reusable scopes", func(t *testing.T) {
+			plan := &rerunPlan{templateJobs: jobs}
+			require.NoError(t, plan.expandRerunJobIDs([]*actions_model.ActionRunJob{smokeTestJob}))
+
+			// rerun: smoke-test (selected), cleanup (same-scope downstream),
+			// finish-deploy (deploy-scope sibling of inner verify ancestor),
+			// top-level verify (top-scope sibling of deploy ancestor).
+			assert.ElementsMatch(t,
+				attemptJobIDsOf(smokeTestJob, cleanupJob, finishDeployJob, verifyTopJob),
+				plan.rerunAttemptJobIDs.Values())
+
+			// ancestors: inner verify and deploy
+			assert.ElementsMatch(t, attemptJobIDsOf(verifyInnerJob, deployJob), plan.ancestorAttemptJobIDs.Values())
+		})
+
+		t.Run("rerun a top-level caller resets only itself and same-scope dependents", func(t *testing.T) {
+			plan := &rerunPlan{templateJobs: jobs}
+			require.NoError(t, plan.expandRerunJobIDs([]*actions_model.ActionRunJob{deployJob}))
+
+			// rerun: deploy (selected) + top-level verify (needs:[deploy]).
+			assert.ElementsMatch(t, attemptJobIDsOf(deployJob, verifyTopJob), plan.rerunAttemptJobIDs.Values())
+			// deploy is top-level so no ancestors.
+			assert.Empty(t, plan.ancestorAttemptJobIDs)
+		})
+
+		t.Run("rerun a nested caller escalates one level", func(t *testing.T) {
+			plan := &rerunPlan{templateJobs: jobs}
+			require.NoError(t, plan.expandRerunJobIDs([]*actions_model.ActionRunJob{verifyInnerJob}))
+
+			// inner verify (selected) -> finish-deploy (deploy-scope dep) -> top-level verify (top-scope dep of deploy).
+			assert.ElementsMatch(t,
+				attemptJobIDsOf(verifyInnerJob, finishDeployJob, verifyTopJob),
+				plan.rerunAttemptJobIDs.Values())
+			// deploy is the only ancestor (one level up from inner verify).
+			assert.ElementsMatch(t, attemptJobIDsOf(deployJob), plan.ancestorAttemptJobIDs.Values())
+		})
+
+		t.Run("selecting one same-name job leaves the other-scope same-name job alone", func(t *testing.T) {
+			// Selecting the top-level "verify" must not pull in the same-named inner one or its descendants.
+			plan := &rerunPlan{templateJobs: jobs}
+			require.NoError(t, plan.expandRerunJobIDs([]*actions_model.ActionRunJob{verifyTopJob}))
+
+			// Only the top-level verify is rerun.
+			assert.ElementsMatch(t, attemptJobIDsOf(verifyTopJob), plan.rerunAttemptJobIDs.Values())
+			assert.Empty(t, plan.ancestorAttemptJobIDs)
+		})
+
+		t.Run("a caller is rerun when a sibling it needs is selected", func(t *testing.T) {
+			plan := &rerunPlan{templateJobs: jobs}
+			require.NoError(t, plan.expandRerunJobIDs([]*actions_model.ActionRunJob{pushJob}))
+
+			assert.ElementsMatch(t,
+				attemptJobIDsOf(pushJob, verifyInnerJob, finishDeployJob, verifyTopJob),
+				plan.rerunAttemptJobIDs.Values())
+			assert.ElementsMatch(t, attemptJobIDsOf(deployJob), plan.ancestorAttemptJobIDs.Values())
+
+			// Confirm the downstream effect: verify(inner) is a reset caller, so its children's DB row IDs are marked for skip-clone.
+			assert.ElementsMatch(t, rowIDsOf(smokeTestJob, cleanupJob), plan.collectResetCallerDescendants().Values())
+		})
+
+		t.Run("multiple selections converge", func(t *testing.T) {
+			plan := &rerunPlan{templateJobs: jobs}
+			require.NoError(t, plan.expandRerunJobIDs([]*actions_model.ActionRunJob{deployJob, smokeTestJob}))
+
+			assert.ElementsMatch(t, attemptJobIDsOf(deployJob, smokeTestJob, cleanupJob, finishDeployJob, verifyTopJob), plan.rerunAttemptJobIDs.Values())
+			assert.Empty(t, plan.ancestorAttemptJobIDs)
+			assert.ElementsMatch(t,
+				rowIDsOf(validateJob, pushJob, verifyInnerJob, smokeTestJob, cleanupJob, finishDeployJob),
+				plan.collectResetCallerDescendants().Values())
+		})
+	})
+
+	t.Run("CollectResetCallerDescendants", func(t *testing.T) {
+		planWith := func(rerunJobs ...*actions_model.ActionRunJob) *rerunPlan {
+			set := make(container.Set[int64])
+			for _, j := range rerunJobs {
+				set.Add(j.AttemptJobID)
+			}
+			return &rerunPlan{templateJobs: jobs, rerunAttemptJobIDs: set}
+		}
+
+		t.Run("non-caller in reset set is ignored", func(t *testing.T) {
+			assert.Empty(t, planWith(smokeTestJob).collectResetCallerDescendants())
+		})
+
+		t.Run("caller in reset set returns transitive descendants", func(t *testing.T) {
+			out := planWith(deployJob).collectResetCallerDescendants()
+			assert.ElementsMatch(t,
+				rowIDsOf(validateJob, pushJob, verifyInnerJob, smokeTestJob, cleanupJob, finishDeployJob),
+				out.Values())
+		})
+
+		t.Run("multiple reset callers union their descendants", func(t *testing.T) {
+			out := planWith(deployJob, verifyInnerJob).collectResetCallerDescendants()
+			assert.ElementsMatch(t,
+				rowIDsOf(validateJob, pushJob, verifyInnerJob, smokeTestJob, cleanupJob, finishDeployJob),
+				out.Values())
+		})
+
+		t.Run("nested-only reset returns just the nested subtree", func(t *testing.T) {
+			out := planWith(verifyInnerJob).collectResetCallerDescendants()
+			assert.ElementsMatch(t, rowIDsOf(smokeTestJob, cleanupJob), out.Values())
+		})
+	})
+
+	t.Run("HasRerunDependency", func(t *testing.T) {
+		t.Run("no needs returns false", func(t *testing.T) {
+			plan := &rerunPlan{
+				templateJobs:          []*actions_model.ActionRunJob{buildJob},
+				rerunAttemptJobIDs:    make(container.Set[int64]),
+				ancestorAttemptJobIDs: make(container.Set[int64]),
+			}
+			assert.False(t, plan.hasRerunDependency(buildJob))
+		})
+
+		t.Run("dependency in rerun set returns true", func(t *testing.T) {
+			plan := &rerunPlan{
+				templateJobs:          jobs,
+				rerunAttemptJobIDs:    container.SetOf(smokeTestJob.AttemptJobID),
+				ancestorAttemptJobIDs: make(container.Set[int64]),
+			}
+			// cleanup `needs: [smoke-test]`, both in inner verify scope.
+			assert.True(t, plan.hasRerunDependency(cleanupJob))
+		})
+
+		t.Run("dependency in ancestor set returns true", func(t *testing.T) {
+			plan := &rerunPlan{
+				templateJobs:          jobs,
+				rerunAttemptJobIDs:    container.SetOf(attemptJobIDsOf(smokeTestJob, cleanupJob)...),
+				ancestorAttemptJobIDs: container.SetOf(verifyInnerJob.AttemptJobID),
+			}
+			assert.True(t, plan.hasRerunDependency(finishDeployJob))
+		})
+
+		t.Run("dependency on unrelated sibling returns false", func(t *testing.T) {
+			plan := &rerunPlan{
+				templateJobs:          jobs,
+				rerunAttemptJobIDs:    container.SetOf(smokeTestJob.AttemptJobID),
+				ancestorAttemptJobIDs: make(container.Set[int64]),
+			}
+			assert.False(t, plan.hasRerunDependency(pushJob))
+		})
+
+		t.Run("scope-bound: same JobID in another scope does not match", func(t *testing.T) {
+			plan := &rerunPlan{
+				templateJobs:          jobs,
+				rerunAttemptJobIDs:    container.SetOf(verifyTopJob.AttemptJobID),
+				ancestorAttemptJobIDs: make(container.Set[int64]),
+			}
+			assert.False(t, plan.hasRerunDependency(finishDeployJob))
+
+			// Sanity: swap to the inner verify and the same target now sees it.
+			plan.rerunAttemptJobIDs = container.SetOf(verifyInnerJob.AttemptJobID)
+			assert.True(t, plan.hasRerunDependency(finishDeployJob))
+		})
+	})
+}
+
+// templateJob is a small constructor for fixture jobs used by the rerunPlan unit tests.
+func templateJob(id, attemptJobID int64, jobID string, parentID int64, isCaller bool, needs ...string) *actions_model.ActionRunJob {
+	return &actions_model.ActionRunJob{
+		ID:               id,
+		AttemptJobID:     attemptJobID,
+		JobID:            jobID,
+		ParentJobID:      parentID,
+		IsReusableCaller: isCaller,
+		Needs:            needs,
+	}
+}
+
+func attemptJobIDsOf(jobs ...*actions_model.ActionRunJob) []int64 {
+	out := make([]int64, len(jobs))
+	for i, j := range jobs {
+		out[i] = j.AttemptJobID
+	}
+	return out
+}
+
+func rowIDsOf(jobs ...*actions_model.ActionRunJob) []int64 {
+	out := make([]int64, len(jobs))
+	for i, j := range jobs {
+		out[i] = j.ID
+	}
+	return out
+}
diff --git a/services/actions/reusable_workflow.go b/services/actions/reusable_workflow.go
new file mode 100644
index 00000000000..9b5ecdef6f4
--- /dev/null
+++ b/services/actions/reusable_workflow.go
@@ -0,0 +1,342 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"context"
+	"fmt"
+
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	perm_model "gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/convert"
+
+	"xorm.io/builder"
+)
+
+// MaxReusableCallLevels caps how deep a reusable workflow can nest:
+// a top-level caller may have at most MaxReusableCallLevels nested callers below it.
+const MaxReusableCallLevels = 9
+
+// loadReusableWorkflowSource resolves the workflow file referenced by a caller's `uses:` and returns its raw bytes,
+// along with the (repo_id, commit_sha) the file was loaded from.
+func loadReusableWorkflowSource(ctx context.Context, run *actions_model.ActionRun, caller *actions_model.ActionRunJob, ref *jobparser.UsesRef) (content []byte, sourceRepoID int64, sourceCommitSHA string, err error) {
+	if err := run.LoadAttributes(ctx); err != nil {
+		return nil, 0, "", err
+	}
+
+	switch ref.Kind {
+	case jobparser.UsesKindLocalSameRepo:
+		// `./` is resolved against the workflow file containing the `uses:` - i.e. the caller's own source repo + commit.
+		callerRepo, err := repo_model.GetRepositoryByID(ctx, caller.WorkflowSourceRepoID)
+		if err != nil {
+			return nil, 0, "", fmt.Errorf("look up caller source repo %d: %w", caller.WorkflowSourceRepoID, err)
+		}
+		bytes, resolvedSHA, err := readWorkflowFromRepo(ctx, callerRepo, caller.WorkflowSourceCommitSHA, ref.Path)
+		if err != nil {
+			return nil, 0, "", err
+		}
+		return bytes, callerRepo.ID, resolvedSHA, nil
+
+	case jobparser.UsesKindLocalCrossRepo:
+		repo, err := repo_model.GetRepositoryByOwnerAndName(ctx, ref.Owner, ref.Repo)
+		if err != nil {
+			return nil, 0, "", fmt.Errorf("look up cross-repo workflow source %q: %w", ref.Owner+"/"+ref.Repo, err)
+		}
+		ok, err := access_model.CanReadWorkflowCrossRepo(ctx, repo, run)
+		if err != nil {
+			return nil, 0, "", err
+		}
+		if !ok {
+			return nil, 0, "", fmt.Errorf("no permission to read reusable workflow from %s/%s", ref.Owner, ref.Repo)
+		}
+		bytes, resolvedSHA, err := readWorkflowFromRepo(ctx, repo, ref.Ref, ref.Path)
+		if err != nil {
+			return nil, 0, "", err
+		}
+		return bytes, repo.ID, resolvedSHA, nil
+	}
+	return nil, 0, "", fmt.Errorf("unsupported uses kind %d", ref.Kind)
+}
+
+// readWorkflowFromRepo loads a workflow file from `repo` at `refOrSHA` and returns its content plus the resolved commit SHA.
+func readWorkflowFromRepo(ctx context.Context, repo *repo_model.Repository, refOrSHA, path string) ([]byte, string, error) {
+	gitRepo, err := gitrepo.OpenRepository(ctx, repo)
+	if err != nil {
+		return nil, "", fmt.Errorf("open repo %s: %w", repo.FullName(), err)
+	}
+	defer gitRepo.Close()
+
+	commit, err := gitRepo.GetCommit(refOrSHA)
+	if err != nil {
+		return nil, "", fmt.Errorf("get commit %q in %s: %w", refOrSHA, repo.FullName(), err)
+	}
+	str, err := commit.GetFileContent(path, 1024*1024)
+	if err != nil {
+		return nil, "", fmt.Errorf("read %s@%s:%s: %w", repo.FullName(), refOrSHA, path, err)
+	}
+	return []byte(str), commit.ID.String(), nil
+}
+
+// checkCallerChain walks `caller`'s ancestor chain (via ParentJobID) and:
+//   - rejects cycles (caller.CallUses appearing in any ancestor's CallUses)
+//   - enforces MaxReusableCallLevels on the number of ancestors above `caller`
+//
+// Cycle detection is intentionally *syntactic* (string equality on CallUses), not semantic.
+// So `owner/repo/lib.yml@v1` and `owner/repo/lib.yml@refs/heads/v1` resolving to the same commit are NOT treated as the same node.
+// Going semantic (Owner, Repo, Path, ResolvedSHA tuples) would require extra git reads.
+func checkCallerChain(ctx context.Context, caller *actions_model.ActionRunJob) error {
+	if caller.ParentJobID == 0 {
+		return nil // top-level caller: depth 0, no ancestors to walk
+	}
+
+	visited := make(container.Set[string])
+	visited.Add(caller.CallUses)
+
+	depth := 0
+	current := caller
+	for current.ParentJobID != 0 {
+		next, err := actions_model.GetRunJobByRunAndID(ctx, current.RunID, current.ParentJobID)
+		if err != nil {
+			return fmt.Errorf("walk caller chain: %w", err)
+		}
+		current = next
+		depth++
+		if depth > MaxReusableCallLevels {
+			return fmt.Errorf("reusable workflow call exceeds the maximum nesting level of %d at %q", MaxReusableCallLevels, caller.CallUses)
+		}
+		if current.IsReusableCaller && current.CallUses != "" {
+			if visited.Contains(current.CallUses) {
+				return fmt.Errorf("reusable workflow call cycle detected: %q", current.CallUses)
+			}
+			visited.Add(current.CallUses)
+		}
+	}
+	return nil
+}
+
+// expandReusableWorkflowCaller loads and parses the target reusable workflow and inserts the caller's direct child jobs.
+// It expands only ONE level: a child that is itself a reusable caller is inserted Blocked and expanded later by a subsequent resolver pass.
+// It does NOT schedule a follow-up resolver pass; the caller of this function is responsible for emitting.
+//
+// All call sites (PrepareRunAndInsert, execRerunPlan, checkJobsOfCurrentRunAttempt, ApproveRuns) invoke this inside their enclosing write transaction,
+// because the caller row update and the child-row inserts must commit atomically.
+// Be aware this is not cheap inside a tx: it does a git read, YAML parsing, and `${{ }}` expression evaluation.
+// None of the call sites is hot: each caller is expanded once per attempt.
+func expandReusableWorkflowCaller(ctx context.Context, run *actions_model.ActionRun, attempt *actions_model.ActionRunAttempt, caller *actions_model.ActionRunJob, vars map[string]string) error {
+	// Already expanded by an earlier call, skip
+	if caller.IsExpanded {
+		return nil
+	}
+
+	// 1. Cycle + depth check via the ParentJobID chain.
+	if err := checkCallerChain(ctx, caller); err != nil {
+		return err
+	}
+
+	// 2. Parse the caller's own job (Uses, With, RawSecrets) from its WorkflowPayload.
+	parsedJob, err := caller.ParseJob()
+	if err != nil {
+		return fmt.Errorf("parse caller job %d: %w", caller.ID, err)
+	}
+
+	// 3. Load called-workflow source.
+	ref, err := jobparser.ParseUses(parsedJob.Uses)
+	if err != nil {
+		return fmt.Errorf("parse uses %q: %w", parsedJob.Uses, err)
+	}
+	content, contentSourceRepoID, contentSourceCommitSHA, err := loadReusableWorkflowSource(ctx, run, caller, ref)
+	if err != nil {
+		return err
+	}
+
+	// 4. Parse the called workflow's spec (used by both secret validation and input evaluation).
+	wcSpec, err := jobparser.ParseWorkflowCallSpec(content)
+	if err != nil {
+		return fmt.Errorf("parse called workflow spec: %w", err)
+	}
+
+	// 5. Resolve caller's `secrets:` and validate it against the callee's schema.
+	inherit, secretsMap, err := jobparser.ParseCallerSecrets(parsedJob.RawSecrets)
+	if err != nil {
+		return fmt.Errorf("caller secrets %q: %w", caller.JobID, err)
+	}
+	// Under `secrets: inherit` the caller forwards all of its own secrets verbatim and does NOT name them individually,
+	// so required-secret presence cannot be verified at expansion time and a missing required secret will surface at job runtime.
+	// This matches GitHub Actions' behavior.
+	if !inherit {
+		if err := jobparser.ValidateCallerSecrets(wcSpec, secretsMap); err != nil {
+			return fmt.Errorf("caller %q secrets: %w", caller.JobID, err)
+		}
+	}
+	switch {
+	case inherit:
+		caller.CallSecrets = jobparser.SecretsInherit
+	case len(secretsMap) > 0:
+		mapBytes, err := json.Marshal(secretsMap)
+		if err != nil {
+			return fmt.Errorf("marshal caller secret map: %w", err)
+		}
+		caller.CallSecrets = string(mapBytes)
+	}
+	caller.ReusableWorkflowContent = content
+
+	// 6. Evaluate caller's `with:`, then match against the callee schema.
+	workflowCallInputs := map[string]any{}
+	if len(wcSpec.Inputs) > 0 {
+		jobResults, err := findJobNeedsAndFillJobResults(ctx, caller)
+		if err != nil {
+			return fmt.Errorf("find caller needs: %w", err)
+		}
+		parentInputs, err := getInputsForJob(ctx, run, caller)
+		if err != nil {
+			return err
+		}
+		callerGitCtx := GenerateGiteaContext(ctx, run, attempt, caller)
+		evaluated, err := jobparser.EvaluateCallerWith(
+			caller.JobID, parsedJob,
+			callerGitCtx, jobResults, vars, parentInputs,
+		)
+		if err != nil {
+			return fmt.Errorf("evaluate caller with: %w", err)
+		}
+		workflowCallInputs, err = jobparser.MatchCallerInputsAgainstSpec(wcSpec, evaluated)
+		if err != nil {
+			return fmt.Errorf("caller %q inputs: %w", caller.JobID, err)
+		}
+	}
+
+	// 7. Build CallPayload (persisted in step 9).
+	callPayload, err := (&api.WorkflowCallPayload{
+		Workflow:   run.WorkflowID,
+		Ref:        run.Ref,
+		Repository: convert.ToRepo(ctx, run.Repo, access_model.Permission{AccessMode: perm_model.AccessModeNone}),
+		Sender:     convert.ToUserWithAccessMode(ctx, run.TriggerUser, perm_model.AccessModeNone),
+		Inputs:     workflowCallInputs,
+	}).JSONPayload()
+	if err != nil {
+		return fmt.Errorf("build call payload: %w", err)
+	}
+
+	// 8. Insert direct children of this caller.
+	existingChildren, err := actions_model.GetDirectChildJobsByParent(ctx, caller)
+	if err != nil {
+		return fmt.Errorf("get existing children of caller %d: %w", caller.ID, err)
+	}
+	if len(existingChildren) > 0 {
+		// Should not happen - child jobs cannot be expanded before the caller gets ready
+		return fmt.Errorf("invariant violation: caller %d has %d pre-existing children", caller.ID, len(existingChildren))
+	}
+	if err := insertCallerChildren(ctx, run, attempt, caller, content, contentSourceRepoID, contentSourceCommitSHA, vars, workflowCallInputs); err != nil {
+		return err
+	}
+
+	// 9. Update caller-related cols.
+	caller.CallPayload = string(callPayload)
+	caller.IsExpanded = true
+	n, err := actions_model.UpdateRunJob(ctx, caller,
+		builder.Eq{"is_expanded": false},
+		"call_secrets", "reusable_workflow_content", "call_payload", "is_expanded")
+	if err != nil {
+		return fmt.Errorf("commit caller %d expansion: %w", caller.ID, err)
+	}
+	if n == 0 {
+		return fmt.Errorf("caller %d already expanded by another writer", caller.ID)
+	}
+	return nil
+}
+
+// insertCallerChildren parses the called workflow with the caller's resolved inputs and inserts each parsed job.
+func insertCallerChildren(ctx context.Context, run *actions_model.ActionRun, attempt *actions_model.ActionRunAttempt, caller *actions_model.ActionRunJob, content []byte, sourceRepoID int64, sourceCommitSHA string, vars map[string]string, inputs map[string]any) error {
+	// Parse the called workflow with the caller's `inputs`
+	gitCtx := GenerateGiteaContext(ctx, run, attempt, nil)
+	if event, ok := gitCtx["event"].(map[string]any); ok {
+		event["inputs"] = inputs
+	}
+	gitCtx["event_name"] = "workflow_call"
+
+	childWorkflows, err := jobparser.Parse(content,
+		jobparser.WithVars(vars),
+		jobparser.WithGitContext(gitCtx.ToGitHubContext()),
+		jobparser.WithInputs(inputs),
+	)
+	if err != nil {
+		return fmt.Errorf("parse called workflow for caller %d: %w", caller.ID, err)
+	}
+	if len(childWorkflows) == 0 {
+		return fmt.Errorf("called workflow for caller %d (uses %q) has no jobs", caller.ID, caller.CallUses)
+	}
+
+	priorChildren, err := actions_model.GetPriorAttemptChildrenByParent(ctx, run.ID, attempt.ID, caller.AttemptJobID)
+	if err != nil {
+		return fmt.Errorf("lookup prior-attempt children of caller %d: %w", caller.ID, err)
+	}
+
+	for _, sw := range childWorkflows {
+		jobID, parsedChild := sw.Job()
+		if parsedChild == nil {
+			continue
+		}
+		needs := parsedChild.Needs()
+		if err := sw.SetJob(jobID, parsedChild.EraseNeeds()); err != nil {
+			return err
+		}
+		payload, err := sw.Marshal()
+		if err != nil {
+			return fmt.Errorf("marshal child %q under caller %d: %w", jobID, caller.ID, err)
+		}
+
+		parsedChild.Name = util.EllipsisDisplayString(parsedChild.Name, 255)
+
+		// AttemptJobID: prefer a prior-attempt match by (JobID, Name) and fall back to a fresh allocator value for newly-appearing logical jobs.
+		// The two-level key disambiguates matrix instances (same JobID, different Names) and distinct jobs that legally share the same Name (different JobIDs).
+		var attemptJobID int64
+		if priorChild, ok := priorChildren[jobID][parsedChild.Name]; ok {
+			attemptJobID = priorChild.AttemptJobID
+		} else {
+			attemptJobID, err = actions_model.GetNextAttemptJobID(ctx, run.ID)
+			if err != nil {
+				return fmt.Errorf("alloc attempt_job_id for child %q: %w", jobID, err)
+			}
+		}
+		child := &actions_model.ActionRunJob{
+			RunID:                   run.ID,
+			RunAttemptID:            attempt.ID,
+			RepoID:                  run.RepoID,
+			OwnerID:                 run.OwnerID,
+			CommitSHA:               run.CommitSHA,
+			IsForkPullRequest:       run.IsForkPullRequest,
+			Name:                    parsedChild.Name,
+			Attempt:                 attempt.Attempt,
+			WorkflowPayload:         payload,
+			JobID:                   jobID,
+			AttemptJobID:            attemptJobID,
+			Needs:                   needs,
+			RunsOn:                  parsedChild.RunsOn(),
+			Status:                  actions_model.StatusBlocked,
+			ParentJobID:             caller.ID,
+			WorkflowSourceRepoID:    sourceRepoID,
+			WorkflowSourceCommitSHA: sourceCommitSHA,
+		}
+		if perms := ExtractJobPermissionsFromWorkflow(sw, parsedChild); perms != nil {
+			child.TokenPermissions = perms
+		}
+		if parsedChild.Uses != "" {
+			child.IsReusableCaller = true
+			child.CallUses = parsedChild.Uses
+		}
+		if err := db.Insert(ctx, child); err != nil {
+			return fmt.Errorf("insert child %q under caller %d: %w", jobID, caller.ID, err)
+		}
+	}
+	return nil
+}
diff --git a/services/actions/reusable_workflow_test.go b/services/actions/reusable_workflow_test.go
new file mode 100644
index 00000000000..cadb26a851b
--- /dev/null
+++ b/services/actions/reusable_workflow_test.go
@@ -0,0 +1,134 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package actions
+
+import (
+	"fmt"
+	"testing"
+
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCheckCallerChain_Cycle(t *testing.T) {
+	t.Run("DirectCycle", func(t *testing.T) {
+		require.NoError(t, unittest.PrepareTestDatabase())
+		// A -> A: leaf's CallUses matches its direct parent's.
+		chain := buildCallerChain(t,
+			"./.gitea/workflows/a.yml",
+			"./.gitea/workflows/a.yml",
+		)
+		err := checkCallerChain(t.Context(), chain[len(chain)-1])
+		assert.ErrorContains(t, err, "cycle detected")
+	})
+
+	t.Run("IndirectCycle", func(t *testing.T) {
+		require.NoError(t, unittest.PrepareTestDatabase())
+		// A -> B -> A: leaf's CallUses matches its grandparent's.
+		chain := buildCallerChain(t,
+			"./.gitea/workflows/a.yml",
+			"./.gitea/workflows/b.yml",
+			"./.gitea/workflows/a.yml",
+		)
+		err := checkCallerChain(t.Context(), chain[len(chain)-1])
+		assert.ErrorContains(t, err, "cycle detected")
+	})
+
+	t.Run("NoCycle", func(t *testing.T) {
+		require.NoError(t, unittest.PrepareTestDatabase())
+		// Sanity: linear chain with distinct CallUses must not trip cycle detection.
+		chain := buildCallerChain(t,
+			"./.gitea/workflows/a.yml",
+			"./.gitea/workflows/b.yml",
+			"./.gitea/workflows/c.yml",
+		)
+		require.NoError(t, checkCallerChain(t.Context(), chain[len(chain)-1]))
+	})
+}
+
+func TestCheckCallerChain_DepthLimit(t *testing.T) {
+	// top + MaxReusableCallLevels nested callers is the longest accepted; one more exceeds the limit.
+	makeDistinctUses := func(n int) []string {
+		out := make([]string, n)
+		for i := range out {
+			out[i] = fmt.Sprintf("./.gitea/workflows/level%d.yml", i)
+		}
+		return out
+	}
+
+	t.Run("ExactlyAtLimit", func(t *testing.T) {
+		require.NoError(t, unittest.PrepareTestDatabase())
+		chain := buildCallerChain(t, makeDistinctUses(MaxReusableCallLevels+1)...)
+		require.NoError(t, checkCallerChain(t.Context(), chain[len(chain)-1]))
+	})
+
+	t.Run("OneOverLimit", func(t *testing.T) {
+		require.NoError(t, unittest.PrepareTestDatabase())
+		chain := buildCallerChain(t, makeDistinctUses(MaxReusableCallLevels+2)...)
+		err := checkCallerChain(t.Context(), chain[len(chain)-1])
+		assert.ErrorContains(t, err, "exceeds the maximum nesting level")
+	})
+}
+
+// buildCallerChain inserts a linear chain of reusable caller jobs in a single run+attempt.
+// callerUses[0] is the top-level caller (ParentJobID=0); each subsequent caller is inserted as a child of the previous one.
+// Returns the inserted jobs in order (index 0 = top, last = leaf).
+func buildCallerChain(t *testing.T, callerUses ...string) []*actions_model.ActionRunJob {
+	t.Helper()
+	require.NotEmpty(t, callerUses)
+	ctx := t.Context()
+
+	run := &actions_model.ActionRun{
+		Title:         "caller-chain-test",
+		RepoID:        4,
+		OwnerID:       1,
+		Index:         9601,
+		WorkflowID:    "test.yaml",
+		TriggerUserID: 1,
+		Ref:           "refs/heads/master",
+		CommitSHA:     "c2d72f548424103f01ee1dc02889c1e2bff816b0",
+		Event:         "push",
+		TriggerEvent:  "push",
+		EventPayload:  "{}",
+		Status:        actions_model.StatusRunning,
+	}
+	require.NoError(t, db.Insert(ctx, run))
+
+	attempt := &actions_model.ActionRunAttempt{
+		RepoID:        run.RepoID,
+		RunID:         run.ID,
+		Attempt:       1,
+		TriggerUserID: 1,
+		Status:        actions_model.StatusRunning,
+	}
+	require.NoError(t, db.Insert(ctx, attempt))
+
+	jobs := make([]*actions_model.ActionRunJob, 0, len(callerUses))
+	parentID := int64(0)
+	for i, uses := range callerUses {
+		job := &actions_model.ActionRunJob{
+			RunID:            run.ID,
+			RunAttemptID:     attempt.ID,
+			RepoID:           run.RepoID,
+			OwnerID:          run.OwnerID,
+			CommitSHA:        run.CommitSHA,
+			Name:             fmt.Sprintf("caller-%d", i),
+			JobID:            fmt.Sprintf("caller-%d", i),
+			Attempt:          1,
+			Status:           actions_model.StatusBlocked,
+			AttemptJobID:     int64(i + 1),
+			IsReusableCaller: true,
+			CallUses:         uses,
+			ParentJobID:      parentID,
+		}
+		require.NoError(t, db.Insert(ctx, job))
+		jobs = append(jobs, job)
+		parentID = job.ID
+	}
+	return jobs
+}
diff --git a/services/actions/run.go b/services/actions/run.go
index 162e3678aee..82335af8616 100644
--- a/services/actions/run.go
+++ b/services/actions/run.go
@@ -7,12 +7,13 @@ import (
 	"context"
 	"fmt"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/actions/jobparser"
-	"code.gitea.io/gitea/modules/util"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 
-	act_model "github.com/nektos/act/pkg/model"
+	act_model "gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -55,6 +56,7 @@ func PrepareRunAndInsert(ctx context.Context, content []byte, run *actions_model
 // The title will be cut off at 255 characters if it's longer than 255 characters.
 func InsertRun(ctx context.Context, run *actions_model.ActionRun, content []byte, vars map[string]string, inputs map[string]any, wfRawConcurrency *act_model.RawConcurrency) error {
 	var cancelledConcurrencyJobs []*actions_model.ActionRunJob
+	var hasWaitingCallerJobs bool
 	if err := db.WithTx(ctx, func(ctx context.Context) error {
 		index, err := db.GetNextResourceIndex(ctx, "action_run_index", run.RepoID)
 		if err != nil {
@@ -128,7 +130,7 @@ func InsertRun(ctx context.Context, run *actions_model.ActionRun, content []byte
 		runJobs := make([]*actions_model.ActionRunJob, 0, len(jobs))
 		var hasWaitingJobs bool
 
-		for i, v := range jobs {
+		for _, v := range jobs {
 			id, job := v.Job()
 			needs := job.Needs()
 			if err := v.SetJob(id, job.EraseNeeds()); err != nil {
@@ -136,30 +138,43 @@ func InsertRun(ctx context.Context, run *actions_model.ActionRun, content []byte
 			}
 			payload, _ := v.Marshal()
 
+			isReusableWorkflowCaller := job.Uses != ""
 			shouldBlockJob := runAttempt.Status == actions_model.StatusBlocked || len(needs) > 0 || run.NeedApproval
 
+			attemptJobID, err := actions_model.GetNextAttemptJobID(ctx, run.ID)
+			if err != nil {
+				return fmt.Errorf("alloc attempt_job_id: %w", err)
+			}
+
 			job.Name = util.EllipsisDisplayString(job.Name, 255)
 			runJob := &actions_model.ActionRunJob{
-				RunID:             run.ID,
-				RunAttemptID:      runAttempt.ID,
-				RepoID:            run.RepoID,
-				OwnerID:           run.OwnerID,
-				CommitSHA:         run.CommitSHA,
-				IsForkPullRequest: run.IsForkPullRequest,
-				Name:              job.Name,
-				Attempt:           runAttempt.Attempt,
-				WorkflowPayload:   payload,
-				JobID:             id,
-				AttemptJobID:      int64(i + 1),
-				Needs:             needs,
-				RunsOn:            job.RunsOn(),
-				Status:            util.Iif(shouldBlockJob, actions_model.StatusBlocked, actions_model.StatusWaiting),
+				RunID:                   run.ID,
+				RunAttemptID:            runAttempt.ID,
+				RepoID:                  run.RepoID,
+				OwnerID:                 run.OwnerID,
+				CommitSHA:               run.CommitSHA,
+				IsForkPullRequest:       run.IsForkPullRequest,
+				Name:                    job.Name,
+				Attempt:                 runAttempt.Attempt,
+				WorkflowPayload:         payload,
+				JobID:                   id,
+				AttemptJobID:            attemptJobID,
+				Needs:                   needs,
+				RunsOn:                  job.RunsOn(),
+				Status:                  util.Iif(shouldBlockJob, actions_model.StatusBlocked, actions_model.StatusWaiting),
+				WorkflowSourceRepoID:    run.RepoID,
+				WorkflowSourceCommitSHA: run.CommitSHA,
 			}
 			// Parse workflow/job permissions (no clamping here)
 			if perms := ExtractJobPermissionsFromWorkflow(v, job); perms != nil {
 				runJob.TokenPermissions = perms
 			}
 
+			if isReusableWorkflowCaller {
+				runJob.IsReusableCaller = true
+				runJob.CallUses = job.Uses
+			}
+
 			// check job concurrency
 			if job.RawConcurrency != nil {
 				rawConcurrency, err := yaml.Marshal(job.RawConcurrency)
@@ -188,11 +203,24 @@ func InsertRun(ctx context.Context, run *actions_model.ActionRun, content []byte
 				}
 			}
 
-			hasWaitingJobs = hasWaitingJobs || runJob.Status == actions_model.StatusWaiting
+			// A reusable caller is never dispatched to a runner, so it must not drive the task-version bump.
+			hasWaitingJobs = hasWaitingJobs || (runJob.Status == actions_model.StatusWaiting && !isReusableWorkflowCaller)
 			if err := db.Insert(ctx, runJob); err != nil {
 				return err
 			}
 
+			// expand reusable caller
+			if isReusableWorkflowCaller && runJob.Status == actions_model.StatusWaiting {
+				if err := expandReusableWorkflowCaller(ctx, run, runAttempt, runJob, vars); err != nil {
+					return fmt.Errorf("inline trigger caller %d ready: %w", runJob.ID, err)
+				}
+				// refresh the caller status
+				if err := actions_model.RefreshReusableCallerStatus(ctx, runJob); err != nil {
+					return fmt.Errorf("refresh caller %d status: %w", runJob.ID, err)
+				}
+				hasWaitingCallerJobs = true
+			}
+
 			runJobs = append(runJobs, runJob)
 		}
 
@@ -216,5 +244,12 @@ func InsertRun(ctx context.Context, run *actions_model.ActionRun, content []byte
 	NotifyWorkflowJobsAndRunsStatusUpdate(ctx, cancelledConcurrencyJobs)
 	EmitJobsIfReadyByJobs(cancelledConcurrencyJobs)
 
+	// Post-commit kick for expanded callers: let job_emitter resolve its child jobs
+	if hasWaitingCallerJobs {
+		if err := EmitJobsIfReadyByRun(run.ID); err != nil {
+			log.Error("emit run %d after InsertRun: %v", run.ID, err)
+		}
+	}
+
 	return nil
 }
diff --git a/services/actions/schedule_tasks.go b/services/actions/schedule_tasks.go
index 3a0dff490a4..5995d003bec 100644
--- a/services/actions/schedule_tasks.go
+++ b/services/actions/schedule_tasks.go
@@ -8,14 +8,14 @@ import (
 	"fmt"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 // StartScheduleTasks start the task
diff --git a/services/actions/schedule_tasks_test.go b/services/actions/schedule_tasks_test.go
index f2c7e656e65..ec68eb54fb6 100644
--- a/services/actions/schedule_tasks_test.go
+++ b/services/actions/schedule_tasks_test.go
@@ -6,7 +6,7 @@ package actions
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/actions/task.go b/services/actions/task.go
index 9dc3c9a34b7..ff54281cba7 100644
--- a/services/actions/task.go
+++ b/services/actions/task.go
@@ -8,11 +8,11 @@ import (
 	"errors"
 	"fmt"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	secret_model "code.gitea.io/gitea/models/secret"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	secret_model "gitea.dev/models/secret"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"google.golang.org/protobuf/types/known/structpb"
 )
 
@@ -35,7 +35,7 @@ func PickTask(ctx context.Context, runner *actions_model.ActionRunner) (*runnerv
 			return nil, false, err
 		}
 		if has {
-			if task.Status == actions_model.StatusWaiting || task.Status == actions_model.StatusRunning || task.Status == actions_model.StatusBlocked {
+			if task.Status.In(actions_model.StatusWaiting, actions_model.StatusRunning, actions_model.StatusBlocked, actions_model.StatusCancelling) {
 				return nil, false, nil
 			}
 			// task has been finished, remove it
diff --git a/services/actions/variables.go b/services/actions/variables.go
index 3593caa2c5e..811a512d25a 100644
--- a/services/actions/variables.go
+++ b/services/actions/variables.go
@@ -6,9 +6,9 @@ package actions
 import (
 	"context"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/modules/util"
-	secret_service "code.gitea.io/gitea/services/secrets"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/modules/util"
+	secret_service "gitea.dev/services/secrets"
 )
 
 func CreateVariable(ctx context.Context, ownerID, repoID int64, name, data, description string) (*actions_model.ActionVariable, error) {
diff --git a/services/actions/workflow.go b/services/actions/workflow.go
index b41741403fd..a748b0859ce 100644
--- a/services/actions/workflow.go
+++ b/services/actions/workflow.go
@@ -5,24 +5,23 @@ package actions
 
 import (
 	"fmt"
-	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/actions/jobparser"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/reqctx"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/actions"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/reqctx"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/model"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -98,7 +97,7 @@ func DispatchActionWorkflow(ctx reqctx.RequestContext, doer *user_model.User, re
 	var entry *git.TreeEntry
 
 	run := &actions_model.ActionRun{
-		Title:             strings.SplitN(runTargetCommit.CommitMessage, "\n", 2)[0],
+		Title:             runTargetCommit.MessageTitle(),
 		RepoID:            repo.ID,
 		Repo:              repo,
 		OwnerID:           repo.OwnerID,
@@ -141,11 +140,17 @@ func DispatchActionWorkflow(ctx reqctx.RequestContext, doer *user_model.User, re
 	workflow := &model.Workflow{
 		RawOn: singleWorkflow.RawOn,
 	}
+	workflowDispatch := workflow.WorkflowDispatchConfig()
+	if workflowDispatch == nil {
+		return 0, util.ErrorWrapTranslatable(
+			util.NewInvalidArgumentErrorf("workflow %q has no workflow_dispatch event trigger", workflowID),
+			"actions.workflow.has_no_workflow_dispatch", workflowID,
+		)
+	}
+
 	inputsWithDefaults := make(map[string]any)
-	if workflowDispatch := workflow.WorkflowDispatchConfig(); workflowDispatch != nil {
-		if err = processInputs(workflowDispatch, inputsWithDefaults); err != nil {
-			return 0, err
-		}
+	if err = processInputs(workflowDispatch, inputsWithDefaults); err != nil {
+		return 0, err
 	}
 
 	// ctx.Req.PostForm -> WorkflowDispatchPayload.Inputs -> ActionRun.EventPayload -> runner: ghc.Event
diff --git a/services/agit/agit.go b/services/agit/agit.go
index 55b98a65ae3..bccd89b0fe8 100644
--- a/services/agit/agit.go
+++ b/services/agit/agit.go
@@ -10,19 +10,19 @@ import (
 	"fmt"
 	"strings"
 
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/private"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	notify_service "code.gitea.io/gitea/services/notify"
-	pull_service "code.gitea.io/gitea/services/pull"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/private"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	notify_service "gitea.dev/services/notify"
+	pull_service "gitea.dev/services/pull"
 )
 
 func parseAgitPushOptionValue(s string) string {
@@ -150,17 +150,13 @@ func ProcReceive(ctx context.Context, repo *repo_model.Repository, gitRepo *git.
 				if err != nil {
 					return nil, fmt.Errorf("failed to get commit %s in repository: %s Error: %w", opts.NewCommitIDs[i], repo.FullName(), err)
 				}
-			}
-
-			// create a new pull request
-			if title == "" {
-				title = strings.Split(commit.CommitMessage, "\n")[0]
-			}
-			if description == "" {
-				_, description, _ = strings.Cut(commit.CommitMessage, "\n\n")
-			}
-			if description == "" {
-				description = title
+				// create a new pull request
+				if title == "" {
+					title = commit.MessageTitle()
+				}
+				if description == "" {
+					description = commit.MessageBody()
+				}
 			}
 
 			prIssue := &issues_model.Issue{
@@ -290,7 +286,7 @@ func ProcReceive(ctx context.Context, repo *repo_model.Repository, gitRepo *git.
 		} else if commentCreated {
 			notify_service.PullRequestPushCommits(ctx, pusher, pr, comment)
 		}
-		notify_service.PullRequestSynchronized(ctx, pusher, pr)
+		notify_service.PullRequestSynchronized(ctx, pusher, pr, oldCommitID, opts.NewCommitIDs[i])
 
 		results = append(results, private.HookProcReceiveRefResult{
 			OldOID:            oldCommitID,
diff --git a/services/agit/agit_test.go b/services/agit/agit_test.go
index 21224a41e94..81204fc7b79 100644
--- a/services/agit/agit_test.go
+++ b/services/agit/agit_test.go
@@ -6,8 +6,8 @@ package agit
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/asymkey/commit.go b/services/asymkey/commit.go
index 6286588a608..c10fe9d6983 100644
--- a/services/asymkey/commit.go
+++ b/services/asymkey/commit.go
@@ -9,14 +9,14 @@ import (
 	"slices"
 	"strings"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/cachegroup"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/cachegroup"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"github.com/42wim/sshsig"
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
diff --git a/services/asymkey/commit_test.go b/services/asymkey/commit_test.go
index 2dd08b5dd4c..e0ab47573b9 100644
--- a/services/asymkey/commit_test.go
+++ b/services/asymkey/commit_test.go
@@ -7,13 +7,13 @@ import (
 	"strings"
 	"testing"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/asymkey/deploy_key.go b/services/asymkey/deploy_key.go
index 04023f9ffb9..17c409dc012 100644
--- a/services/asymkey/deploy_key.go
+++ b/services/asymkey/deploy_key.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"fmt"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
 )
 
 // DeleteRepoDeployKeys deletes all deploy keys of a repository. permissions check should be done outside
diff --git a/services/asymkey/main_test.go b/services/asymkey/main_test.go
index 1cdc39933d4..b0e254c51b3 100644
--- a/services/asymkey/main_test.go
+++ b/services/asymkey/main_test.go
@@ -6,11 +6,11 @@ package asymkey
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/asymkey/sign.go b/services/asymkey/sign.go
index 8c28717e5d0..18deeee135b 100644
--- a/services/asymkey/sign.go
+++ b/services/asymkey/sign.go
@@ -9,18 +9,18 @@ import (
 	"os"
 	"strings"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
 )
 
 type signingMode string
diff --git a/services/asymkey/sign_test.go b/services/asymkey/sign_test.go
index fbcf078cf80..06480e8cb1d 100644
--- a/services/asymkey/sign_test.go
+++ b/services/asymkey/sign_test.go
@@ -6,7 +6,7 @@ package asymkey
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/asymkey/ssh_key.go b/services/asymkey/ssh_key.go
index 01fa7ff15ff..fc97a2e2aa1 100644
--- a/services/asymkey/ssh_key.go
+++ b/services/asymkey/ssh_key.go
@@ -6,9 +6,9 @@ package asymkey
 import (
 	"context"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
 )
 
 // DeletePublicKey deletes SSH key information both in database and authorized_keys file.
diff --git a/services/asymkey/ssh_key_authorized_keys.go b/services/asymkey/ssh_key_authorized_keys.go
index 5caa5bbfb61..e0d72cc61d2 100644
--- a/services/asymkey/ssh_key_authorized_keys.go
+++ b/services/asymkey/ssh_key_authorized_keys.go
@@ -10,10 +10,10 @@ import (
 	"path/filepath"
 	"time"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // RewriteAllPublicKeys removes any authorized key and rewrite all keys from database again.
diff --git a/services/asymkey/ssh_key_authorized_principals.go b/services/asymkey/ssh_key_authorized_principals.go
index b06d8d2a409..6ecb693bda7 100644
--- a/services/asymkey/ssh_key_authorized_principals.go
+++ b/services/asymkey/ssh_key_authorized_principals.go
@@ -13,11 +13,11 @@ import (
 	"strings"
 	"time"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // This file contains functions for creating authorized_principals files
diff --git a/services/asymkey/ssh_key_principals.go b/services/asymkey/ssh_key_principals.go
index 6493c1cc512..bfa7aa23af5 100644
--- a/services/asymkey/ssh_key_principals.go
+++ b/services/asymkey/ssh_key_principals.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"fmt"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	"gitea.dev/models/perm"
 )
 
 // AddPrincipalKey adds new principal to database and authorized_principals file.
diff --git a/services/asymkey/ssh_key_test.go b/services/asymkey/ssh_key_test.go
index b052050dc6b..936201e6564 100644
--- a/services/asymkey/ssh_key_test.go
+++ b/services/asymkey/ssh_key_test.go
@@ -6,11 +6,11 @@ package asymkey
 import (
 	"testing"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/attachment/attachment.go b/services/attachment/attachment.go
index a824cdb246e..372cfb62f9f 100644
--- a/services/attachment/attachment.go
+++ b/services/attachment/attachment.go
@@ -11,12 +11,12 @@ import (
 	"io"
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context/upload"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context/upload"
 
 	"github.com/google/uuid"
 )
diff --git a/services/attachment/attachment_test.go b/services/attachment/attachment_test.go
index 8ecac8d7a33..7df200769b9 100644
--- a/services/attachment/attachment_test.go
+++ b/services/attachment/attachment_test.go
@@ -8,11 +8,11 @@ import (
 	"path/filepath"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models/actions"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/auth/auth.go b/services/auth/auth.go
index ebe8277f77b..01ceeeed46d 100644
--- a/services/auth/auth.go
+++ b/services/auth/auth.go
@@ -9,13 +9,13 @@ import (
 	"fmt"
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/webauthn"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/session"
-	"code.gitea.io/gitea/modules/web/middleware"
-	user_service "code.gitea.io/gitea/services/user"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/webauthn"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/session"
+	"gitea.dev/modules/web/middleware"
+	user_service "gitea.dev/services/user"
 )
 
 type ErrUserAuthMessage string
diff --git a/services/auth/auth_token.go b/services/auth/auth_token.go
index 7fcf3ba0dff..655c76fe315 100644
--- a/services/auth/auth_token.go
+++ b/services/auth/auth_token.go
@@ -12,10 +12,10 @@ import (
 	"strings"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
 // Based on https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies
diff --git a/services/auth/auth_token_test.go b/services/auth/auth_token_test.go
index 6b04caab853..01b562eb6a6 100644
--- a/services/auth/auth_token_test.go
+++ b/services/auth/auth_token_test.go
@@ -7,9 +7,9 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/timeutil"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/auth/basic.go b/services/auth/basic.go
index e8a4a2e8f7f..c7db14e6e7e 100644
--- a/services/auth/basic.go
+++ b/services/auth/basic.go
@@ -7,14 +7,14 @@ package auth
 import (
 	"net/http"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/httpauth"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/httpauth"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
 // Ensure the struct implements the interface.
diff --git a/services/auth/group.go b/services/auth/group.go
index aecf43cb244..d9c2d74460e 100644
--- a/services/auth/group.go
+++ b/services/auth/group.go
@@ -7,7 +7,7 @@ import (
 	"net/http"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
+	user_model "gitea.dev/models/user"
 )
 
 // Ensure the struct implements the interface.
diff --git a/services/auth/httpsign.go b/services/auth/httpsign.go
index 130207c0eaf..929f5da6a4a 100644
--- a/services/auth/httpsign.go
+++ b/services/auth/httpsign.go
@@ -11,11 +11,11 @@ import (
 	"net/http"
 	"strings"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"github.com/42wim/httpsig"
 	"golang.org/x/crypto/ssh"
diff --git a/services/auth/interface.go b/services/auth/interface.go
index c4bed2b6401..30012fda5f6 100644
--- a/services/auth/interface.go
+++ b/services/auth/interface.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/session"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/session"
 )
 
 type DataStore = reqctx.ContextDataProvider
diff --git a/services/auth/main_test.go b/services/auth/main_test.go
index b81c39a1f25..fd7d07d17c0 100644
--- a/services/auth/main_test.go
+++ b/services/auth/main_test.go
@@ -6,7 +6,7 @@ package auth
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/auth/oauth2.go b/services/auth/oauth2.go
index 877237e96e7..a2f7d5d1e7f 100644
--- a/services/auth/oauth2.go
+++ b/services/auth/oauth2.go
@@ -11,16 +11,16 @@ import (
 	"strings"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/httpauth"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/actions"
-	"code.gitea.io/gitea/services/oauth2_provider"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/httpauth"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/actions"
+	"gitea.dev/services/oauth2_provider"
 )
 
 var _ Method = &OAuth2{}
diff --git a/services/auth/oauth2_test.go b/services/auth/oauth2_test.go
index 308da846b83..511bee7d218 100644
--- a/services/auth/oauth2_test.go
+++ b/services/auth/oauth2_test.go
@@ -6,10 +6,10 @@ package auth
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/services/actions"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/services/actions"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/auth/reverseproxy.go b/services/auth/reverseproxy.go
index e9b08d75f27..b08a447995c 100644
--- a/services/auth/reverseproxy.go
+++ b/services/auth/reverseproxy.go
@@ -8,10 +8,10 @@ import (
 	"net/http"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
 
 	gouuid "github.com/google/uuid"
 )
diff --git a/services/auth/session.go b/services/auth/session.go
index 5b6e4599b89..03c3b48c80b 100644
--- a/services/auth/session.go
+++ b/services/auth/session.go
@@ -6,8 +6,8 @@ package auth
 import (
 	"net/http"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
 )
 
 // Ensure the struct implements the interface.
diff --git a/services/auth/signin.go b/services/auth/signin.go
index a8fa0f17dda..b4ba50c2508 100644
--- a/services/auth/signin.go
+++ b/services/auth/signin.go
@@ -7,18 +7,18 @@ import (
 	"context"
 	"strings"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/auth/source/smtp"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/auth/source/smtp"
 
-	_ "code.gitea.io/gitea/services/auth/source/db"   // register the sources (and below)
-	_ "code.gitea.io/gitea/services/auth/source/ldap" // register the ldap source
-	_ "code.gitea.io/gitea/services/auth/source/pam"  // register the pam source
-	_ "code.gitea.io/gitea/services/auth/source/sspi" // register the sspi source
+	_ "gitea.dev/services/auth/source/db"   // register the sources (and below)
+	_ "gitea.dev/services/auth/source/ldap" // register the ldap source
+	_ "gitea.dev/services/auth/source/pam"  // register the pam source
+	_ "gitea.dev/services/auth/source/sspi" // register the sspi source
 )
 
 // UserSignIn validates user name and password.
diff --git a/services/auth/source.go b/services/auth/source.go
index 69b71a6deae..1b23f20e3cf 100644
--- a/services/auth/source.go
+++ b/services/auth/source.go
@@ -6,9 +6,9 @@ package auth
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
 )
 
 // DeleteSource deletes a AuthSource record in DB.
diff --git a/services/auth/source/db/assert_interface_test.go b/services/auth/source/db/assert_interface_test.go
index 62387c78f07..c45bd75219e 100644
--- a/services/auth/source/db/assert_interface_test.go
+++ b/services/auth/source/db/assert_interface_test.go
@@ -4,9 +4,9 @@
 package db_test
 
 import (
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/auth/source/db"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/auth/source/db"
 )
 
 // This test file exists to assert that our Source exposes the interfaces that we expect
diff --git a/services/auth/source/db/authenticate.go b/services/auth/source/db/authenticate.go
index 8160141863a..4029159abe0 100644
--- a/services/auth/source/db/authenticate.go
+++ b/services/auth/source/db/authenticate.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"fmt"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // ErrUserPasswordNotSet represents a "ErrUserPasswordNotSet" kind of error.
diff --git a/services/auth/source/db/source.go b/services/auth/source/db/source.go
index 90baa61f5bf..2dfcfdec859 100644
--- a/services/auth/source/db/source.go
+++ b/services/auth/source/db/source.go
@@ -6,8 +6,8 @@ package db
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
 )
 
 // Source is a password authentication service
diff --git a/services/auth/source/ldap/assert_interface_test.go b/services/auth/source/ldap/assert_interface_test.go
index 8e8accd6685..aafe51f9c65 100644
--- a/services/auth/source/ldap/assert_interface_test.go
+++ b/services/auth/source/ldap/assert_interface_test.go
@@ -4,9 +4,9 @@
 package ldap_test
 
 import (
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/auth/source/ldap"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/auth/source/ldap"
 )
 
 // This test file exists to assert that our Source exposes the interfaces that we expect
diff --git a/services/auth/source/ldap/source.go b/services/auth/source/ldap/source.go
index 81d4b5446bd..8e6f878bbe2 100644
--- a/services/auth/source/ldap/source.go
+++ b/services/auth/source/ldap/source.go
@@ -6,11 +6,11 @@ package ldap
 import (
 	"strings"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/secret"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/auth"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/secret"
+	"gitea.dev/modules/setting"
 )
 
 // .____     ________      _____ __________
diff --git a/services/auth/source/ldap/source_authenticate.go b/services/auth/source/ldap/source_authenticate.go
index 582841aebec..86e45fc0976 100644
--- a/services/auth/source/ldap/source_authenticate.go
+++ b/services/auth/source/ldap/source_authenticate.go
@@ -7,15 +7,15 @@ import (
 	"context"
 	"strings"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	auth_module "code.gitea.io/gitea/modules/auth"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	source_service "code.gitea.io/gitea/services/auth/source"
-	user_service "code.gitea.io/gitea/services/user"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	auth_module "gitea.dev/modules/auth"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	asymkey_service "gitea.dev/services/asymkey"
+	source_service "gitea.dev/services/auth/source"
+	user_service "gitea.dev/services/user"
 )
 
 // Authenticate queries if login/password is valid against the LDAP directory pool,
diff --git a/services/auth/source/ldap/source_search.go b/services/auth/source/ldap/source_search.go
index f6c032492fc..52aec7563f2 100644
--- a/services/auth/source/ldap/source_search.go
+++ b/services/auth/source/ldap/source_search.go
@@ -11,8 +11,8 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
 
 	"github.com/go-ldap/ldap/v3"
 )
@@ -116,11 +116,12 @@ func dial(source *Source) (*ldap.Conn, error) {
 		InsecureSkipVerify: source.SkipVerify,
 	}
 
+	hostPort := net.JoinHostPort(source.Host, strconv.Itoa(source.Port))
 	if source.SecurityProtocol == SecurityProtocolLDAPS {
-		return ldap.DialTLS("tcp", net.JoinHostPort(source.Host, strconv.Itoa(source.Port)), tlsConfig) //nolint:staticcheck // DialTLS is deprecated
+		return ldap.DialURL("ldaps://"+hostPort, ldap.DialWithTLSConfig(tlsConfig))
 	}
 
-	conn, err := ldap.Dial("tcp", net.JoinHostPort(source.Host, strconv.Itoa(source.Port))) //nolint:staticcheck // Dial is deprecated
+	conn, err := ldap.DialURL("ldap://" + hostPort)
 	if err != nil {
 		return nil, fmt.Errorf("error during Dial: %w", err)
 	}
diff --git a/services/auth/source/ldap/source_sync.go b/services/auth/source/ldap/source_sync.go
index 0c5fdac674a..63cf2c7d794 100644
--- a/services/auth/source/ldap/source_sync.go
+++ b/services/auth/source/ldap/source_sync.go
@@ -7,17 +7,17 @@ import (
 	"context"
 	"strings"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	auth_module "code.gitea.io/gitea/modules/auth"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	source_service "code.gitea.io/gitea/services/auth/source"
-	user_service "code.gitea.io/gitea/services/user"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	auth_module "gitea.dev/modules/auth"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	asymkey_service "gitea.dev/services/asymkey"
+	source_service "gitea.dev/services/auth/source"
+	user_service "gitea.dev/services/user"
 )
 
 // Sync causes this ldap source to synchronize its users with the db
diff --git a/services/auth/source/oauth2/additional_info_provider.go b/services/auth/source/oauth2/additional_info_provider.go
index fb31864aad4..5458138d31e 100644
--- a/services/auth/source/oauth2/additional_info_provider.go
+++ b/services/auth/source/oauth2/additional_info_provider.go
@@ -7,7 +7,7 @@ import (
 	"context"
 	"slices"
 
-	google_module "code.gitea.io/gitea/modules/google"
+	google_module "gitea.dev/modules/google"
 
 	"github.com/markbates/goth"
 	go_oauth2 "golang.org/x/oauth2"
diff --git a/services/auth/source/oauth2/additional_info_provider_test.go b/services/auth/source/oauth2/additional_info_provider_test.go
index 65e662ec9eb..fd73c346a59 100644
--- a/services/auth/source/oauth2/additional_info_provider_test.go
+++ b/services/auth/source/oauth2/additional_info_provider_test.go
@@ -7,9 +7,9 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/auth/source/oauth2/assert_interface_test.go b/services/auth/source/oauth2/assert_interface_test.go
index d870ac1dcd8..db2c36dde4d 100644
--- a/services/auth/source/oauth2/assert_interface_test.go
+++ b/services/auth/source/oauth2/assert_interface_test.go
@@ -4,9 +4,9 @@
 package oauth2_test
 
 import (
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/auth/source/oauth2"
 )
 
 // This test file exists to assert that our Source exposes the interfaces that we expect
diff --git a/services/auth/source/oauth2/init.go b/services/auth/source/oauth2/init.go
index 2a165bac85d..e67c695b4a0 100644
--- a/services/auth/source/oauth2/init.go
+++ b/services/auth/source/oauth2/init.go
@@ -9,11 +9,11 @@ import (
 	"net/http"
 	"sync"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
 
 	"github.com/google/uuid"
 	"github.com/gorilla/sessions"
@@ -72,7 +72,7 @@ func initOAuth2Sources(ctx context.Context) error {
 		}
 		err := oauth2Source.RegisterSource()
 		if err != nil {
-			log.Critical("Unable to register source: %s due to Error: %v.", source.Name, err)
+			log.Error("Unable to register source: %s due to Error: %v.", source.Name, err)
 		}
 	}
 	return nil
diff --git a/services/auth/source/oauth2/main_test.go b/services/auth/source/oauth2/main_test.go
index 57c74fd3e71..5d75c4d1e51 100644
--- a/services/auth/source/oauth2/main_test.go
+++ b/services/auth/source/oauth2/main_test.go
@@ -6,7 +6,7 @@ package oauth2
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/auth/source/oauth2/providers.go b/services/auth/source/oauth2/providers.go
index f719d23fc3a..a0cb886b699 100644
--- a/services/auth/source/oauth2/providers.go
+++ b/services/auth/source/oauth2/providers.go
@@ -13,11 +13,11 @@ import (
 	"slices"
 	"sort"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
 
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/providers/openidConnect"
diff --git a/services/auth/source/oauth2/providers_base.go b/services/auth/source/oauth2/providers_base.go
index bc761e9742a..bccea99ffa5 100644
--- a/services/auth/source/oauth2/providers_base.go
+++ b/services/auth/source/oauth2/providers_base.go
@@ -6,8 +6,8 @@ package oauth2
 import (
 	"html/template"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/svg"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/svg"
 )
 
 // BaseProvider represents a common base for Provider
diff --git a/services/auth/source/oauth2/providers_custom.go b/services/auth/source/oauth2/providers_custom.go
index 65cf538ad73..e9e8df02ea9 100644
--- a/services/auth/source/oauth2/providers_custom.go
+++ b/services/auth/source/oauth2/providers_custom.go
@@ -4,7 +4,7 @@
 package oauth2
 
 import (
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/providers/azureadv2"
@@ -120,4 +120,25 @@ func init() {
 			}), nil
 		},
 	))
+
+	RegisterGothProvider(&AwsCognitoProvider{})
 }
+
+const ProviderNameAwsCognito = "aws-cognito"
+
+// AwsCognitoProvider is a GothProvider for AWS Cognito (based on OpenID Connect)
+type AwsCognitoProvider struct {
+	OpenIDProvider
+}
+
+// Name provides the technical name for this provider
+func (c *AwsCognitoProvider) Name() string {
+	return ProviderNameAwsCognito
+}
+
+// DisplayName returns the friendly name for this provider
+func (c *AwsCognitoProvider) DisplayName() string {
+	return "AWS Cognito"
+}
+
+var _ GothProvider = &AwsCognitoProvider{}
diff --git a/services/auth/source/oauth2/providers_openid.go b/services/auth/source/oauth2/providers_openid.go
index 557fe6cb013..74bfa1acd45 100644
--- a/services/auth/source/oauth2/providers_openid.go
+++ b/services/auth/source/oauth2/providers_openid.go
@@ -6,9 +6,9 @@ package oauth2
 import (
 	"html/template"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/svg"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/svg"
 
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/providers/openidConnect"
diff --git a/services/auth/source/oauth2/providers_simple.go b/services/auth/source/oauth2/providers_simple.go
index e95323a62a2..a9052da1c52 100644
--- a/services/auth/source/oauth2/providers_simple.go
+++ b/services/auth/source/oauth2/providers_simple.go
@@ -4,7 +4,7 @@
 package oauth2
 
 import (
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/providers/azuread"
diff --git a/services/auth/source/oauth2/required_additional_info_failure_warning.go b/services/auth/source/oauth2/required_additional_info_failure_warning.go
index 5eee30207a3..61c03cf182f 100644
--- a/services/auth/source/oauth2/required_additional_info_failure_warning.go
+++ b/services/auth/source/oauth2/required_additional_info_failure_warning.go
@@ -4,9 +4,9 @@
 package oauth2
 
 import (
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/timeutil"
 )
 
 const (
diff --git a/services/auth/source/oauth2/source.go b/services/auth/source/oauth2/source.go
index 3f69c08fab8..da7f61200c2 100644
--- a/services/auth/source/oauth2/source.go
+++ b/services/auth/source/oauth2/source.go
@@ -4,8 +4,8 @@
 package oauth2
 
 import (
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/models/auth"
+	"gitea.dev/modules/json"
 )
 
 // Source holds configuration for the OAuth2 login source.
diff --git a/services/auth/source/oauth2/source_authenticate.go b/services/auth/source/oauth2/source_authenticate.go
index bbda35dee00..ca523806f42 100644
--- a/services/auth/source/oauth2/source_authenticate.go
+++ b/services/auth/source/oauth2/source_authenticate.go
@@ -6,8 +6,8 @@ package oauth2
 import (
 	"context"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/services/auth/source/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/services/auth/source/db"
 )
 
 // Authenticate falls back to the db authenticator
diff --git a/services/auth/source/oauth2/source_sync.go b/services/auth/source/oauth2/source_sync.go
index 445e281a06c..8fc58f9ae10 100644
--- a/services/auth/source/oauth2/source_sync.go
+++ b/services/auth/source/oauth2/source_sync.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"time"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
 
 	"github.com/markbates/goth"
 	"golang.org/x/oauth2"
diff --git a/services/auth/source/oauth2/source_sync_test.go b/services/auth/source/oauth2/source_sync_test.go
index 2927f3634b0..888ca55e507 100644
--- a/services/auth/source/oauth2/source_sync_test.go
+++ b/services/auth/source/oauth2/source_sync_test.go
@@ -6,9 +6,9 @@ package oauth2
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -57,12 +57,7 @@ func TestSource(t *testing.T) {
 			err := source.refresh(t.Context(), provider, e)
 			assert.NoError(t, err)
 
-			e := &user_model.ExternalLoginUser{
-				ExternalID:    e.ExternalID,
-				LoginSourceID: e.LoginSourceID,
-			}
-
-			ok, err := user_model.GetExternalLogin(t.Context(), e)
+			e, ok, err := user_model.GetExternalLogin(t.Context(), e.LoginSourceID, e.ExternalID)
 			assert.NoError(t, err)
 			assert.True(t, ok)
 			assert.Equal(t, "refresh", e.RefreshToken)
@@ -82,12 +77,7 @@ func TestSource(t *testing.T) {
 			})
 			assert.NoError(t, err)
 
-			e := &user_model.ExternalLoginUser{
-				ExternalID:    e.ExternalID,
-				LoginSourceID: e.LoginSourceID,
-			}
-
-			ok, err := user_model.GetExternalLogin(t.Context(), e)
+			e, ok, err := user_model.GetExternalLogin(t.Context(), e.LoginSourceID, e.ExternalID)
 			assert.NoError(t, err)
 			assert.True(t, ok)
 			assert.Empty(t, e.RefreshToken)
diff --git a/services/auth/source/oauth2/store.go b/services/auth/source/oauth2/store.go
index 7b6b26edc83..de01d8b2392 100644
--- a/services/auth/source/oauth2/store.go
+++ b/services/auth/source/oauth2/store.go
@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/log"
-	session_module "code.gitea.io/gitea/modules/session"
+	"gitea.dev/modules/log"
+	session_module "gitea.dev/modules/session"
 
 	"github.com/gorilla/sessions"
 )
diff --git a/services/auth/source/pam/assert_interface_test.go b/services/auth/source/pam/assert_interface_test.go
index 908d097d963..ea1b4f9d778 100644
--- a/services/auth/source/pam/assert_interface_test.go
+++ b/services/auth/source/pam/assert_interface_test.go
@@ -4,9 +4,9 @@
 package pam_test
 
 import (
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/auth/source/pam"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/auth/source/pam"
 )
 
 // This test file exists to assert that our Source exposes the interfaces that we expect
diff --git a/services/auth/source/pam/source.go b/services/auth/source/pam/source.go
index d1db6db9b7b..3f782e73cff 100644
--- a/services/auth/source/pam/source.go
+++ b/services/auth/source/pam/source.go
@@ -4,8 +4,8 @@
 package pam
 
 import (
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/models/auth"
+	"gitea.dev/modules/json"
 )
 
 // __________  _____      _____
diff --git a/services/auth/source/pam/source_authenticate.go b/services/auth/source/pam/source_authenticate.go
index fc290aa7714..510e1c2b93d 100644
--- a/services/auth/source/pam/source_authenticate.go
+++ b/services/auth/source/pam/source_authenticate.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/pam"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/pam"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
 
 	"github.com/google/uuid"
 )
diff --git a/services/auth/source/smtp/assert_interface_test.go b/services/auth/source/smtp/assert_interface_test.go
index 56edad0c71a..cb9c3e48b0d 100644
--- a/services/auth/source/smtp/assert_interface_test.go
+++ b/services/auth/source/smtp/assert_interface_test.go
@@ -4,9 +4,9 @@
 package smtp_test
 
 import (
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/auth/source/smtp"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/auth/source/smtp"
 )
 
 // This test file exists to assert that our Source exposes the interfaces that we expect
diff --git a/services/auth/source/smtp/source.go b/services/auth/source/smtp/source.go
index 2ae81ad4f25..13b4668e9df 100644
--- a/services/auth/source/smtp/source.go
+++ b/services/auth/source/smtp/source.go
@@ -4,8 +4,8 @@
 package smtp
 
 import (
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/models/auth"
+	"gitea.dev/modules/json"
 )
 
 //   _________   __________________________
diff --git a/services/auth/source/smtp/source_authenticate.go b/services/auth/source/smtp/source_authenticate.go
index de39c1d3a61..fbe3791bbab 100644
--- a/services/auth/source/smtp/source_authenticate.go
+++ b/services/auth/source/smtp/source_authenticate.go
@@ -10,10 +10,10 @@ import (
 	"net/textproto"
 	"strings"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/util"
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/util"
 )
 
 // Authenticate queries if the provided login/password is authenticates against the SMTP server
diff --git a/services/auth/source/source_group_sync.go b/services/auth/source/source_group_sync.go
index 9cb7d4165cc..0ca3fdd2cd1 100644
--- a/services/auth/source/source_group_sync.go
+++ b/services/auth/source/source_group_sync.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	org_service "code.gitea.io/gitea/services/org"
+	"gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	org_service "gitea.dev/services/org"
 )
 
 type syncType int
diff --git a/services/auth/source/sspi/assert_interface_test.go b/services/auth/source/sspi/assert_interface_test.go
index 03d836dd6f8..8706158b3cc 100644
--- a/services/auth/source/sspi/assert_interface_test.go
+++ b/services/auth/source/sspi/assert_interface_test.go
@@ -4,8 +4,8 @@
 package sspi_test
 
 import (
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/services/auth/source/sspi"
+	"gitea.dev/models/auth"
+	"gitea.dev/services/auth/source/sspi"
 )
 
 // This test file exists to assert that our Source exposes the interfaces that we expect
diff --git a/services/auth/source/sspi/source.go b/services/auth/source/sspi/source.go
index 3b7b5cb033b..267c269de60 100644
--- a/services/auth/source/sspi/source.go
+++ b/services/auth/source/sspi/source.go
@@ -4,8 +4,8 @@
 package sspi
 
 import (
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/models/auth"
+	"gitea.dev/modules/json"
 )
 
 //   _________ ___________________.___
diff --git a/services/auth/sspi.go b/services/auth/sspi.go
index c21978f55ae..5cec793d230 100644
--- a/services/auth/sspi.go
+++ b/services/auth/sspi.go
@@ -10,15 +10,15 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/services/auth/source/sspi"
-	gitea_context "code.gitea.io/gitea/services/context"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/services/auth/source/sspi"
+	gitea_context "gitea.dev/services/context"
 
 	gouuid "github.com/google/uuid"
 )
diff --git a/services/auth/sync.go b/services/auth/sync.go
index 7562ac812bd..0d95c174bb3 100644
--- a/services/auth/sync.go
+++ b/services/auth/sync.go
@@ -6,9 +6,9 @@ package auth
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
 )
 
 // SyncExternalUsers is used to synchronize users with external authorization source
diff --git a/services/automerge/automerge.go b/services/automerge/automerge.go
index 1629b2b95e5..bbbd9cf2d3e 100644
--- a/services/automerge/automerge.go
+++ b/services/automerge/automerge.go
@@ -10,23 +10,23 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	pull_model "code.gitea.io/gitea/models/pull"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/services/automergequeue"
-	notify_service "code.gitea.io/gitea/services/notify"
-	pull_service "code.gitea.io/gitea/services/pull"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	pull_model "gitea.dev/models/pull"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/queue"
+	"gitea.dev/services/automergequeue"
+	notify_service "gitea.dev/services/notify"
+	pull_service "gitea.dev/services/pull"
+	repo_service "gitea.dev/services/repository"
 )
 
 // Init runs the task queue to that handles auto merges
diff --git a/services/automerge/notify.go b/services/automerge/notify.go
index 8a1bb5fc90c..04526b2adc0 100644
--- a/services/automerge/notify.go
+++ b/services/automerge/notify.go
@@ -6,14 +6,14 @@ package automerge
 import (
 	"context"
 
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/services/automergequeue"
-	notify_service "code.gitea.io/gitea/services/notify"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/repository"
+	"gitea.dev/services/automergequeue"
+	notify_service "gitea.dev/services/notify"
 )
 
 type automergeNotifier struct {
diff --git a/services/automergequeue/automergequeue.go b/services/automergequeue/automergequeue.go
index 8cfdf3a5398..70556c2086f 100644
--- a/services/automergequeue/automergequeue.go
+++ b/services/automergequeue/automergequeue.go
@@ -8,10 +8,10 @@ import (
 	"errors"
 	"fmt"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
 )
 
 var AutoMergeQueue *queue.WorkerPoolQueue[string]
diff --git a/services/context/access_log.go b/services/context/access_log.go
index 9419106a07d..7d89269338a 100644
--- a/services/context/access_log.go
+++ b/services/context/access_log.go
@@ -12,10 +12,10 @@ import (
 	"time"
 	"unicode"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web/middleware"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web/middleware"
 )
 
 type accessLoggerTmplData struct {
diff --git a/services/context/access_log_test.go b/services/context/access_log_test.go
index 89ec90fd4f7..3be2e696f8d 100644
--- a/services/context/access_log_test.go
+++ b/services/context/access_log_test.go
@@ -10,8 +10,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/context/api.go b/services/context/api.go
index 3f9f3e1cdd2..97a97ecc550 100644
--- a/services/context/api.go
+++ b/services/context/api.go
@@ -13,17 +13,18 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	web_types "code.gitea.io/gitea/modules/web/types"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	web_types "gitea.dev/modules/web/types"
 )
 
 // APIContext is a specific context for API service
@@ -47,6 +48,12 @@ type APIContext struct {
 	PublicOnly bool // Whether the request is for a public endpoint
 }
 
+// TokenCanAccessRepo reports whether the current API token is allowed to access the repository.
+// A public-only token cannot reach a private repo; any other token is unrestricted by this check.
+func (ctx *APIContext) TokenCanAccessRepo(repo *repo_model.Repository) bool {
+	return repo == nil || !ctx.PublicOnly || !repo.IsPrivate
+}
+
 func init() {
 	web.RegisterResponseStatusProvider[*APIContext](func(req *http.Request) web_types.ResponseStatusProvider {
 		return req.Context().Value(apiContextKey).(*APIContext)
diff --git a/services/context/api_org.go b/services/context/api_org.go
index dad02b17190..f9d2633d0e1 100644
--- a/services/context/api_org.go
+++ b/services/context/api_org.go
@@ -3,7 +3,7 @@
 
 package context
 
-import "code.gitea.io/gitea/models/organization"
+import "gitea.dev/models/organization"
 
 // APIOrganization contains organization and team
 type APIOrganization struct {
diff --git a/services/context/api_test.go b/services/context/api_test.go
index 87d74004db4..8a628d4db2a 100644
--- a/services/context/api_test.go
+++ b/services/context/api_test.go
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/context/base.go b/services/context/base.go
index c5ec4b419a2..17b464e1c46 100644
--- a/services/context/base.go
+++ b/services/context/base.go
@@ -12,14 +12,14 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web/middleware"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web/middleware"
 )
 
 type BaseContextKeyType struct{}
diff --git a/services/context/base_form.go b/services/context/base_form.go
index b734ab199a5..088888b461e 100644
--- a/services/context/base_form.go
+++ b/services/context/base_form.go
@@ -7,9 +7,9 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/util"
 )
 
 // FormString returns the first value matching the provided key in the form as a string
diff --git a/services/context/base_path.go b/services/context/base_path.go
index 8c353f7acaf..9508190c0c1 100644
--- a/services/context/base_path.go
+++ b/services/context/base_path.go
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/go-chi/chi/v5"
 )
diff --git a/services/context/base_test.go b/services/context/base_test.go
index f9bbe717290..e842d75e9ac 100644
--- a/services/context/base_test.go
+++ b/services/context/base_test.go
@@ -8,7 +8,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/context/captcha.go b/services/context/captcha.go
index 50beddb2088..14589507aa0 100644
--- a/services/context/captcha.go
+++ b/services/context/captcha.go
@@ -8,14 +8,14 @@ import (
 	"image/color"
 	"sync"
 
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/hcaptcha"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/mcaptcha"
-	"code.gitea.io/gitea/modules/recaptcha"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/turnstile"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/hcaptcha"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/mcaptcha"
+	"gitea.dev/modules/recaptcha"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/turnstile"
 
 	"gitea.com/go-chi/captcha"
 )
diff --git a/services/context/context.go b/services/context/context.go
index e8b1663b221..2875bb46161 100644
--- a/services/context/context.go
+++ b/services/context/context.go
@@ -13,19 +13,19 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/httpcache"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/session"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/modules/web/middleware"
-	web_types "code.gitea.io/gitea/modules/web/types"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/httpcache"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/session"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/modules/web/middleware"
+	web_types "gitea.dev/modules/web/types"
 )
 
 // Render represents a template render
@@ -104,6 +104,7 @@ func NewTemplateContextForWeb(ctx reqctx.RequestContext, req *http.Request, loca
 	tmplCtx["AvatarUtils"] = templates.NewAvatarUtils(ctx)
 	tmplCtx["RenderUtils"] = templates.NewRenderUtils(ctx)
 	tmplCtx["MiscUtils"] = templates.NewMiscUtils(ctx)
+	tmplCtx["ActionsUtils"] = templates.NewActionsUtils(ctx)
 	tmplCtx["RootData"] = ctx.GetData()
 	tmplCtx["Consts"] = map[string]any{
 		"RepoUnitTypeCode":            unit.TypeCode,
diff --git a/services/context/context_cookie.go b/services/context/context_cookie.go
index a28ae3b33dd..af1ebe91bac 100644
--- a/services/context/context_cookie.go
+++ b/services/context/context_cookie.go
@@ -7,8 +7,8 @@ import (
 	"net/http"
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web/middleware"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/web/middleware"
 )
 
 const CookieNameFlash = "gitea_flash"
diff --git a/services/context/context_response.go b/services/context/context_response.go
index 1fd7a0b447f..d869c779594 100644
--- a/services/context/context_response.go
+++ b/services/context/context_response.go
@@ -16,14 +16,14 @@ import (
 	"syscall"
 	"time"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web/middleware"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web/middleware"
 )
 
 // RedirectToUser redirect to a differently-named user
diff --git a/services/context/context_template.go b/services/context/context_template.go
index e5f89822931..1b1788027ba 100644
--- a/services/context/context_template.go
+++ b/services/context/context_template.go
@@ -12,13 +12,13 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web/middleware"
-	oauth2_source "code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/webtheme"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web/middleware"
+	oauth2_source "gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/webtheme"
 )
 
 type TemplateContext map[string]any
diff --git a/services/context/context_test.go b/services/context/context_test.go
index aaf79de7163..cdc979b12cb 100644
--- a/services/context/context_test.go
+++ b/services/context/context_test.go
@@ -9,8 +9,8 @@ import (
 	"net/url"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/context/org.go b/services/context/org.go
index 96be5bcaa69..79dcfab5f2b 100644
--- a/services/context/org.go
+++ b/services/context/org.go
@@ -7,14 +7,14 @@ package context
 import (
 	"strings"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
 )
 
 // Organization contains organization context
diff --git a/services/context/package.go b/services/context/package.go
index 6ed9de43678..4918e124913 100644
--- a/services/context/package.go
+++ b/services/context/package.go
@@ -8,14 +8,14 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates"
+	"gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/templates"
 )
 
 // Package contains owner, access mode and optional the package descriptor
diff --git a/services/context/pagination.go b/services/context/pagination.go
index da27e617570..a6e83df6a15 100644
--- a/services/context/pagination.go
+++ b/services/context/pagination.go
@@ -12,8 +12,8 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/paginator"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/paginator"
 )
 
 // Pagination provides a pagination via paginator.Paginator and additional configurations for the link params used in rendering
diff --git a/services/context/pagination_test.go b/services/context/pagination_test.go
index 78359caa090..0ddef26ca3d 100644
--- a/services/context/pagination_test.go
+++ b/services/context/pagination_test.go
@@ -7,7 +7,7 @@ import (
 	"net/url"
 	"testing"
 
-	"code.gitea.io/gitea/modules/container"
+	"gitea.dev/modules/container"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/context/permission.go b/services/context/permission.go
index 1f40e261535..66452873aef 100644
--- a/services/context/permission.go
+++ b/services/context/permission.go
@@ -7,11 +7,44 @@ import (
 	"net/http"
 	"slices"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
 )
 
+// CheckTokenScopes checks whether the authenticated API token contains any of the given scopes.
+func CheckTokenScopes(ctx *Context, repo *repo_model.Repository, scopes ...auth_model.AccessTokenScope) {
+	if ctx.Data["IsApiToken"] != true {
+		return
+	}
+
+	scope, ok := ctx.Data["ApiTokenScope"].(auth_model.AccessTokenScope)
+	if !ok {
+		return
+	}
+
+	publicOnly, err := scope.PublicOnly()
+	if err != nil {
+		ctx.ServerError("PublicOnly", err)
+		return
+	}
+
+	if publicOnly && repo != nil && repo.IsPrivate {
+		ctx.HTTPError(http.StatusForbidden)
+		return
+	}
+
+	scopeMatched, err := scope.HasAnyScope(scopes...)
+	if err != nil {
+		ctx.ServerError("HasAnyScope", err)
+		return
+	}
+
+	if !scopeMatched {
+		ctx.HTTPError(http.StatusForbidden)
+	}
+}
+
 // RequireRepoAdmin returns a middleware for requiring repository admin permission
 func RequireRepoAdmin() func(ctx *Context) {
 	return func(ctx *Context) {
@@ -57,39 +90,7 @@ func RequireUnitReader(unitTypes ...unit.Type) func(ctx *Context) {
 	}
 }
 
-// CheckRepoScopedToken check whether personal access token has repo scope
+// CheckRepoScopedToken checks whether the authenticated API token has repo scope.
 func CheckRepoScopedToken(ctx *Context, repo *repo_model.Repository, level auth_model.AccessTokenScopeLevel) {
-	if !ctx.IsBasicAuth || ctx.Data["IsApiToken"] != true {
-		return
-	}
-
-	scope, ok := ctx.Data["ApiTokenScope"].(auth_model.AccessTokenScope)
-	if ok { // it's a personal access token but not oauth2 token
-		var scopeMatched bool
-
-		requiredScopes := auth_model.GetRequiredScopes(level, auth_model.AccessTokenScopeCategoryRepository)
-
-		// check if scope only applies to public resources
-		publicOnly, err := scope.PublicOnly()
-		if err != nil {
-			ctx.ServerError("HasScope", err)
-			return
-		}
-
-		if publicOnly && repo.IsPrivate {
-			ctx.HTTPError(http.StatusForbidden)
-			return
-		}
-
-		scopeMatched, err = scope.HasScope(requiredScopes...)
-		if err != nil {
-			ctx.ServerError("HasScope", err)
-			return
-		}
-
-		if !scopeMatched {
-			ctx.HTTPError(http.StatusForbidden)
-			return
-		}
-	}
+	CheckTokenScopes(ctx, repo, auth_model.GetRequiredScopes(level, auth_model.AccessTokenScopeCategoryRepository)...)
 }
diff --git a/services/context/private.go b/services/context/private.go
index d20e49f588e..2c0d21102ae 100644
--- a/services/context/private.go
+++ b/services/context/private.go
@@ -8,10 +8,10 @@ import (
 	"net/http"
 	"time"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/web"
-	web_types "code.gitea.io/gitea/modules/web/types"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/web"
+	web_types "gitea.dev/modules/web/types"
 )
 
 // PrivateContext represents a context for private routes
diff --git a/services/context/repo.go b/services/context/repo.go
index 4c31b07b347..9c7f20aadde 100644
--- a/services/context/repo.go
+++ b/services/context/repo.go
@@ -14,25 +14,25 @@ import (
 	"path"
 	"strings"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/httplib"
-	code_indexer "code.gitea.io/gitea/modules/indexer/code"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/httplib"
+	code_indexer "gitea.dev/modules/indexer/code"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	asymkey_service "gitea.dev/services/asymkey"
 
 	"github.com/editorconfig/editorconfig-core-go/v2"
 )
@@ -173,6 +173,16 @@ func PrepareCommitFormOptions(ctx *Context, doer *user_model.User, targetRepo *r
 		protectedBranch.Repo = targetRepo
 		canPushWithProtection = protectedBranch.CanUserPush(ctx, doer)
 		protectionRequireSigned = protectedBranch.RequireSignedCommits
+		// If branch-wide push is restricted, allow direct commit when the
+		// URL-derived tree path matches an unprotected file pattern. The
+		// pre-receive hook re-checks every path the commit actually touches
+		// (e.g. rename source and destination).
+		if !canPushWithProtection && ctx.Repo.TreePath != "" && protectedBranch.UnprotectedFilePatterns != "" {
+			globs := protectedBranch.GetUnprotectedFilePatterns()
+			if protectedBranch.IsUnprotectedFile(globs, ctx.Repo.TreePath) {
+				canPushWithProtection = true
+			}
+		}
 	}
 
 	targetGitRepo, closer, err := gitrepo.RepositoryFromContextOrOpen(ctx, targetRepo)
diff --git a/services/context/response.go b/services/context/response.go
index 10a51e04c59..eb5ddaf80a5 100644
--- a/services/context/response.go
+++ b/services/context/response.go
@@ -8,7 +8,7 @@ import (
 	"net"
 	"net/http"
 
-	web_types "code.gitea.io/gitea/modules/web/types"
+	web_types "gitea.dev/modules/web/types"
 )
 
 // ResponseWriter represents a response writer for HTTP
diff --git a/services/context/upload/upload.go b/services/context/upload/upload.go
index 3352bfa388f..f5282b64dd6 100644
--- a/services/context/upload/upload.go
+++ b/services/context/upload/upload.go
@@ -11,11 +11,11 @@ import (
 	"regexp"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/context"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/context"
 )
 
 // ErrFileTypeForbidden not allowed file type error
diff --git a/services/context/user.go b/services/context/user.go
index 138cdeae937..ad0876ebf00 100644
--- a/services/context/user.go
+++ b/services/context/user.go
@@ -8,7 +8,7 @@ import (
 	"net/http"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
+	user_model "gitea.dev/models/user"
 )
 
 // UserAssignmentWeb returns a middleware to handle context-user assignment for web routes
diff --git a/services/contexttest/context_tests.go b/services/contexttest/context_tests.go
index afa6a422a7a..1a6f4b01042 100644
--- a/services/contexttest/context_tests.go
+++ b/services/contexttest/context_tests.go
@@ -15,19 +15,19 @@ import (
 	"testing"
 	"time"
 
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	git_module "code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/session"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	git_module "gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/session"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/assert"
diff --git a/services/convert/action_test.go b/services/convert/action_test.go
index 9efc0e36a83..d9729e7b091 100644
--- a/services/convert/action_test.go
+++ b/services/convert/action_test.go
@@ -8,13 +8,14 @@ import (
 	"strings"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/util"
+	actions_model "gitea.dev/models/actions"
+	db "gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -124,3 +125,55 @@ func TestToActionWorkflowRun_UsesTriggerEvent(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "schedule", apiRun.Event)
 }
+
+func TestToActionWorkflowJob_StepStatusIsIndependentOfJobStatus(t *testing.T) {
+	assert.NoError(t, unittest.PrepareTestDatabase())
+	ctx := t.Context()
+
+	run := &actions_model.ActionRun{
+		ID:            9001,
+		RepoID:        2,
+		TriggerUserID: 1,
+		WorkflowID:    "test.yaml",
+		Index:         12345,
+		Ref:           "refs/heads/main",
+		Status:        actions_model.StatusFailure,
+	}
+	require.NoError(t, db.Insert(ctx, run))
+
+	task := &actions_model.ActionTask{
+		ID:     900102,
+		JobID:  9001,
+		RepoID: 2,
+		Status: actions_model.StatusFailure,
+	}
+	require.NoError(t, db.Insert(ctx, task))
+
+	job := &actions_model.ActionRunJob{
+		ID:      90010203,
+		RunID:   9001,
+		TaskID:  900102,
+		RepoID:  2,
+		Name:    "test-job-name",
+		Attempt: 1,
+		JobID:   "test-job-id",
+		Status:  actions_model.StatusFailure,
+	}
+	require.NoError(t, db.Insert(ctx, job))
+
+	require.NoError(t, db.Insert(ctx,
+		&actions_model.ActionTaskStep{TaskID: task.ID, RepoID: 2, Index: 0, Name: "step-success", Status: actions_model.StatusSuccess},
+		&actions_model.ActionTaskStep{TaskID: task.ID, RepoID: 2, Index: 1, Name: "step-failure", Status: actions_model.StatusFailure},
+	))
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
+
+	apiJob, err := ToActionWorkflowJob(ctx, repo, task, job)
+	require.NoError(t, err)
+	require.Len(t, apiJob.Steps, 2)
+
+	assert.Equal(t, "completed", apiJob.Steps[0].Status, "step 0 status")
+	assert.Equal(t, "success", apiJob.Steps[0].Conclusion, "step 0 conclusion (succeeded before the failure)")
+	assert.Equal(t, "completed", apiJob.Steps[1].Status, "step 1 status")
+	assert.Equal(t, "failure", apiJob.Steps[1].Conclusion, "step 1 conclusion")
+}
diff --git a/services/convert/activity.go b/services/convert/activity.go
index 7fc3a0eb825..3adaf9039e4 100644
--- a/services/convert/activity.go
+++ b/services/convert/activity.go
@@ -6,12 +6,12 @@ package convert
 import (
 	"context"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	perm_model "code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
+	activities_model "gitea.dev/models/activities"
+	perm_model "gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
 )
 
 func ToActivity(ctx context.Context, ac *activities_model.Action, doer *user_model.User) *api.Activity {
diff --git a/services/convert/attachment.go b/services/convert/attachment.go
index 4a8f10f7b02..5ab1fadd063 100644
--- a/services/convert/attachment.go
+++ b/services/convert/attachment.go
@@ -4,8 +4,8 @@
 package convert
 
 import (
-	repo_model "code.gitea.io/gitea/models/repo"
-	api "code.gitea.io/gitea/modules/structs"
+	repo_model "gitea.dev/models/repo"
+	api "gitea.dev/modules/structs"
 )
 
 func WebAssetDownloadURL(repo *repo_model.Repository, attach *repo_model.Attachment) string {
diff --git a/services/convert/convert.go b/services/convert/convert.go
index a7622644d82..bf029356e2c 100644
--- a/services/convert/convert.go
+++ b/services/convert/convert.go
@@ -11,34 +11,33 @@ import (
 	"net/url"
 	"path"
 	"strconv"
-	"strings"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/gitdiff"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/actions"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/gitdiff"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
-	"github.com/nektos/act/pkg/model"
+	"gitea.com/gitea/runner/act/model"
 )
 
 // ToEmail convert models.EmailAddress to api.Email
@@ -149,6 +148,7 @@ func ToBranchProtection(ctx context.Context, bp *git_model.ProtectedBranch, repo
 	forcePushAllowlistUsernames := getWhitelistEntities(readers, bp.ForcePushAllowlistUserIDs)
 	mergeWhitelistUsernames := getWhitelistEntities(readers, bp.MergeWhitelistUserIDs)
 	approvalsWhitelistUsernames := getWhitelistEntities(readers, bp.ApprovalsWhitelistUserIDs)
+	bypassAllowlistUsernames := getWhitelistEntities(readers, bp.BypassAllowlistUserIDs)
 
 	teamReaders, err := organization.GetTeamsWithAccessToAnyRepoUnit(ctx, repo.Owner.ID, repo.ID, perm.AccessModeRead, unit.TypeCode, unit.TypePullRequests)
 	if err != nil {
@@ -159,6 +159,7 @@ func ToBranchProtection(ctx context.Context, bp *git_model.ProtectedBranch, repo
 	forcePushAllowlistTeams := getWhitelistEntities(teamReaders, bp.ForcePushAllowlistTeamIDs)
 	mergeWhitelistTeams := getWhitelistEntities(teamReaders, bp.MergeWhitelistTeamIDs)
 	approvalsWhitelistTeams := getWhitelistEntities(teamReaders, bp.ApprovalsWhitelistTeamIDs)
+	bypassAllowlistTeams := getWhitelistEntities(teamReaders, bp.BypassAllowlistTeamIDs)
 
 	branchName := ""
 	if !git_model.IsRuleNameSpecial(bp.RuleName) {
@@ -182,6 +183,9 @@ func ToBranchProtection(ctx context.Context, bp *git_model.ProtectedBranch, repo
 		EnableMergeWhitelist:          bp.EnableMergeWhitelist,
 		MergeWhitelistUsernames:       mergeWhitelistUsernames,
 		MergeWhitelistTeams:           mergeWhitelistTeams,
+		EnableBypassAllowlist:         bp.EnableBypassAllowlist,
+		BypassAllowlistUsernames:      bypassAllowlistUsernames,
+		BypassAllowlistTeams:          bypassAllowlistTeams,
 		EnableStatusCheck:             bp.EnableStatusCheck,
 		StatusCheckContexts:           bp.StatusCheckContexts,
 		RequiredApprovals:             bp.RequiredApprovals,
@@ -215,7 +219,7 @@ func ToTag(repo *repo_model.Repository, t *git.Tag) *api.Tag {
 
 	return &api.Tag{
 		Name:       t.Name,
-		Message:    strings.TrimSpace(t.Message),
+		Message:    t.MessageUTF8(),
 		ID:         t.ID.String(),
 		Commit:     ToCommitMeta(repo, t),
 		ZipballURL: zipballURL,
@@ -315,33 +319,31 @@ func ToActionWorkflowRun(ctx context.Context, run *actions_model.ActionRun, atte
 	}, nil
 }
 
-func ToWorkflowRunAction(status actions_model.Status) string {
-	var action string
+func ToWorkflowRunAction(status actions_model.Status) (action string) {
 	switch status {
 	case actions_model.StatusWaiting, actions_model.StatusBlocked:
 		action = "requested"
 	case actions_model.StatusRunning:
 		action = "in_progress"
-	}
-	if status.IsDone() {
-		action = "completed"
+	default:
+		if status.IsDone() {
+			action = "completed"
+		} else {
+			setting.PanicInDevOrTesting("unknown action status: %v", status)
+		}
 	}
 	return action
 }
 
-func ToActionsStatus(status actions_model.Status) (string, string) {
-	var action string
-	var conclusion string
+func ToActionsStatus(status actions_model.Status) (action, conclusion string) {
 	switch status {
-	// This is a naming conflict of the webhook between Gitea and GitHub Actions
 	case actions_model.StatusWaiting:
-		action = "queued"
+		action = "queued" // "waiting" is a naming conflict of the webhook between Gitea and GitHub Actions
 	case actions_model.StatusBlocked:
-		action = "waiting"
+		action = "waiting" // naming conflict (as above)
 	case actions_model.StatusRunning:
 		action = "in_progress"
-	}
-	if status.IsDone() {
+	default:
 		action = "completed"
 		switch status {
 		case actions_model.StatusSuccess:
@@ -352,6 +354,8 @@ func ToActionsStatus(status actions_model.Status) (string, string) {
 			conclusion = "failure"
 		case actions_model.StatusSkipped:
 			conclusion = "skipped"
+		default:
+			setting.PanicInDevOrTesting("unknown action status: %v", status)
 		}
 	}
 	return action, conclusion
@@ -391,7 +395,7 @@ func ToActionWorkflowJob(ctx context.Context, repo *repo_model.Repository, task
 				runnerName = runner.Name
 			}
 			for i, step := range task.Steps {
-				stepStatus, stepConclusion := ToActionsStatus(job.Status)
+				stepStatus, stepConclusion := ToActionsStatus(step.Status)
 				steps = append(steps, &api.ActionWorkflowStep{
 					Name:        step.Name,
 					Number:      int64(i),
@@ -769,7 +773,7 @@ func ToAnnotatedTag(ctx context.Context, repo *repo_model.Repository, t *git.Tag
 		Tag:          t.Name,
 		SHA:          t.ID.String(),
 		Object:       ToAnnotatedTagObject(repo, c),
-		Message:      t.Message,
+		Message:      t.MessageUTF8(),
 		URL:          repo.APIURL() + "/git/tags/" + t.ID.String(),
 		Tagger:       ToCommitUser(t.Tagger),
 		Verification: ToVerification(ctx, c),
diff --git a/services/convert/git_commit.go b/services/convert/git_commit.go
index d809e3778d3..f19ec439115 100644
--- a/services/convert/git_commit.go
+++ b/services/convert/git_commit.go
@@ -8,14 +8,14 @@ import (
 	"net/url"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
-	ctx "code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/gitdiff"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
+	ctx "gitea.dev/services/context"
+	"gitea.dev/services/gitdiff"
 )
 
 // ToCommitUser convert a git.Signature to an api.CommitUser
@@ -56,7 +56,7 @@ func ToPayloadCommit(ctx context.Context, repo *repo_model.Repository, c *git.Co
 
 	return &api.PayloadCommit{
 		ID:      c.ID.String(),
-		Message: c.Message(),
+		Message: c.MessageUTF8(),
 		URL:     repo.HTMLURL() + "/commit/" + c.ID.String(),
 		Author: &api.PayloadUser{
 			Name:     c.Author.Name,
@@ -171,7 +171,7 @@ func ToCommit(ctx context.Context, repo *repo_model.Repository, gitRepo *git.Rep
 				},
 				Date: commit.Committer.When.Format(time.RFC3339),
 			},
-			Message: commit.Message(),
+			Message: commit.MessageUTF8(),
 			Tree: &api.CommitMeta{
 				URL:     repo.APIURL() + "/git/trees/" + url.PathEscape(commit.ID.String()),
 				SHA:     commit.ID.String(),
diff --git a/services/convert/git_commit_test.go b/services/convert/git_commit_test.go
index 66a427fadf6..fc77e4e8f97 100644
--- a/services/convert/git_commit_test.go
+++ b/services/convert/git_commit_test.go
@@ -7,10 +7,10 @@ import (
 	"testing"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -21,12 +21,12 @@ func TestToCommitMeta(t *testing.T) {
 	sha1 := git.Sha1ObjectFormat
 	signature := &git.Signature{Name: "Test Signature", Email: "test@email.com", When: time.Unix(0, 0)}
 	tag := &git.Tag{
-		Name:    "Test Tag",
-		ID:      sha1.EmptyObjectID(),
-		Object:  sha1.EmptyObjectID(),
-		Type:    "Test Type",
-		Tagger:  signature,
-		Message: "Test Message",
+		Name:          "Test Tag",
+		ID:            sha1.EmptyObjectID(),
+		Object:        sha1.EmptyObjectID(),
+		Type:          "Test Type",
+		Tagger:        signature,
+		CommitMessage: git.CommitMessage{MessageRaw: "Test Message"},
 	}
 
 	commitMeta := ToCommitMeta(headRepo, tag)
diff --git a/services/convert/issue.go b/services/convert/issue.go
index 8e3adaa82df..ab45bb7c033 100644
--- a/services/convert/issue.go
+++ b/services/convert/issue.go
@@ -9,16 +9,16 @@ import (
 	"net/url"
 	"strings"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/label"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/label"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
 )
 
 func ToIssue(ctx context.Context, doer *user_model.User, issue *issues_model.Issue) *api.Issue {
diff --git a/services/convert/issue_comment.go b/services/convert/issue_comment.go
index 9ad584a62f7..2f459224f19 100644
--- a/services/convert/issue_comment.go
+++ b/services/convert/issue_comment.go
@@ -6,12 +6,12 @@ package convert
 import (
 	"context"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
 )
 
 // ToAPIComment converts a issues_model.Comment to the api.Comment format for API usage
diff --git a/services/convert/issue_test.go b/services/convert/issue_test.go
index 109bf63e7db..091bdf79288 100644
--- a/services/convert/issue_test.go
+++ b/services/convert/issue_test.go
@@ -8,14 +8,14 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/convert/main_test.go b/services/convert/main_test.go
index 363cc4a97f5..6fc97a18ef1 100644
--- a/services/convert/main_test.go
+++ b/services/convert/main_test.go
@@ -6,9 +6,9 @@ package convert
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models/actions"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/convert/mirror.go b/services/convert/mirror.go
index 249ce2f9689..993c4844235 100644
--- a/services/convert/mirror.go
+++ b/services/convert/mirror.go
@@ -6,8 +6,8 @@ package convert
 import (
 	"context"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	api "code.gitea.io/gitea/modules/structs"
+	repo_model "gitea.dev/models/repo"
+	api "gitea.dev/modules/structs"
 )
 
 // ToPushMirror convert from repo_model.PushMirror and remoteAddress to api.TopicResponse
diff --git a/services/convert/notification.go b/services/convert/notification.go
index 3a1ae09dc5b..7ddd8ea5d14 100644
--- a/services/convert/notification.go
+++ b/services/convert/notification.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"net/url"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
+	activities_model "gitea.dev/models/activities"
+	access_model "gitea.dev/models/perm/access"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
 )
 
 // ToNotificationThread convert a Notification to api.NotificationThread
diff --git a/services/convert/notification_test.go b/services/convert/notification_test.go
index 0a4f9d6c0a0..5718258672e 100644
--- a/services/convert/notification_test.go
+++ b/services/convert/notification_test.go
@@ -6,13 +6,13 @@ package convert
 import (
 	"testing"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
+	activities_model "gitea.dev/models/activities"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/convert/package.go b/services/convert/package.go
index 2e5b15d84b2..b24f3e93416 100644
--- a/services/convert/package.go
+++ b/services/convert/package.go
@@ -6,10 +6,10 @@ package convert
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/packages"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models/packages"
+	access_model "gitea.dev/models/perm/access"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
 )
 
 // ToPackage convert a packages.PackageDescriptor to api.Package
diff --git a/services/convert/project.go b/services/convert/project.go
index b66de746cad..d984548e1b6 100644
--- a/services/convert/project.go
+++ b/services/convert/project.go
@@ -4,8 +4,8 @@
 package convert
 
 import (
-	project_model "code.gitea.io/gitea/models/project"
-	api "code.gitea.io/gitea/modules/structs"
+	project_model "gitea.dev/models/project"
+	api "gitea.dev/modules/structs"
 )
 
 // ToAPIProject converts a Project to API format
diff --git a/services/convert/pull.go b/services/convert/pull.go
index 5c7c99f2cef..cdc79eb88ff 100644
--- a/services/convert/pull.go
+++ b/services/convert/pull.go
@@ -7,21 +7,21 @@ import (
 	"context"
 	"fmt"
 
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/cachegroup"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/gitdiff"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/cachegroup"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/gitdiff"
 )
 
 // ToAPIPullRequest assumes following fields have been assigned with valid values:
diff --git a/services/convert/pull_review.go b/services/convert/pull_review.go
index ba0102cf1fd..553ff9d1d81 100644
--- a/services/convert/pull_review.go
+++ b/services/convert/pull_review.go
@@ -7,9 +7,9 @@ import (
 	"context"
 	"strings"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
 )
 
 // ToPullReview convert a review to api format
diff --git a/services/convert/pull_review_test.go b/services/convert/pull_review_test.go
index c6e1165991e..d65821b42cf 100644
--- a/services/convert/pull_review_test.go
+++ b/services/convert/pull_review_test.go
@@ -6,9 +6,9 @@ package convert
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/convert/pull_test.go b/services/convert/pull_test.go
index dc8e4c637e0..9d08ed59f18 100644
--- a/services/convert/pull_test.go
+++ b/services/convert/pull_test.go
@@ -6,12 +6,12 @@ package convert
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/structs"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/convert/release.go b/services/convert/release.go
index bfff53e62f4..74b39fbf531 100644
--- a/services/convert/release.go
+++ b/services/convert/release.go
@@ -6,8 +6,8 @@ package convert
 import (
 	"context"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	api "code.gitea.io/gitea/modules/structs"
+	repo_model "gitea.dev/models/repo"
+	api "gitea.dev/modules/structs"
 )
 
 // ToAPIRelease convert a repo_model.Release to api.Release
diff --git a/services/convert/release_test.go b/services/convert/release_test.go
index a03a90abc7f..614e2fb0c12 100644
--- a/services/convert/release_test.go
+++ b/services/convert/release_test.go
@@ -6,8 +6,8 @@ package convert
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/convert/repository.go b/services/convert/repository.go
index 503f6bb2a33..269399f6279 100644
--- a/services/convert/repository.go
+++ b/services/convert/repository.go
@@ -7,15 +7,15 @@ import (
 	"context"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
 )
 
 // ToRepo converts a Repository to api.Repository
@@ -98,11 +98,13 @@ func innerToRepo(ctx context.Context, repo *repo_model.Repository, permissionInR
 	allowRebaseMerge := false
 	allowSquash := false
 	allowFastForwardOnly := false
+	allowMergeUpdate := false
 	allowRebaseUpdate := false
 	allowManualMerge := true
 	autodetectManualMerge := false
 	defaultDeleteBranchAfterMerge := false
 	defaultMergeStyle := repo_model.MergeStyleMerge
+	defaultUpdateStyle := repo_model.UpdateStyleMerge
 	defaultAllowMaintainerEdit := false
 	defaultTargetBranch := ""
 	if unit, err := repo.GetUnit(ctx, unit_model.TypePullRequests); err == nil {
@@ -114,11 +116,13 @@ func innerToRepo(ctx context.Context, repo *repo_model.Repository, permissionInR
 		allowRebaseMerge = config.AllowRebaseMerge
 		allowSquash = config.AllowSquash
 		allowFastForwardOnly = config.AllowFastForwardOnly
+		allowMergeUpdate = config.AllowMergeUpdate
 		allowRebaseUpdate = config.AllowRebaseUpdate
 		allowManualMerge = config.AllowManualMerge
 		autodetectManualMerge = config.AutodetectManualMerge
 		defaultDeleteBranchAfterMerge = config.DefaultDeleteBranchAfterMerge
 		defaultMergeStyle = config.DefaultMergeStyle
+		defaultUpdateStyle = config.DefaultUpdateStyle
 		defaultAllowMaintainerEdit = config.DefaultAllowMaintainerEdit
 		defaultTargetBranch = config.DefaultTargetBranch
 	}
@@ -152,11 +156,13 @@ func innerToRepo(ctx context.Context, repo *repo_model.Repository, permissionInR
 
 	mirrorInterval := ""
 	var mirrorUpdated time.Time
+	var lastSync time.Time
 	if repo.IsMirror {
 		pullMirror, err := repo_model.GetMirrorByRepoID(ctx, repo.ID)
 		if err == nil {
 			mirrorInterval = pullMirror.Interval.String()
 			mirrorUpdated = pullMirror.UpdatedUnix.AsTime()
+			lastSync = pullMirror.LastSyncUnix.AsTime()
 		}
 	}
 
@@ -238,15 +244,18 @@ func innerToRepo(ctx context.Context, repo *repo_model.Repository, permissionInR
 		AllowRebaseMerge:              allowRebaseMerge,
 		AllowSquash:                   allowSquash,
 		AllowFastForwardOnly:          allowFastForwardOnly,
+		AllowMergeUpdate:              allowMergeUpdate,
 		AllowRebaseUpdate:             allowRebaseUpdate,
 		AllowManualMerge:              allowManualMerge,
 		AutodetectManualMerge:         autodetectManualMerge,
 		DefaultDeleteBranchAfterMerge: defaultDeleteBranchAfterMerge,
 		DefaultMergeStyle:             string(defaultMergeStyle),
+		DefaultUpdateStyle:            string(defaultUpdateStyle),
 		DefaultAllowMaintainerEdit:    defaultAllowMaintainerEdit,
 		DefaultTargetBranch:           defaultTargetBranch,
 		AvatarURL:                     repo.AvatarLink(ctx),
 		Internal:                      !repo.IsPrivate && repo.Owner.Visibility == api.VisibleTypePrivate,
+		MirrorLastSyncAt:              lastSync,
 		MirrorInterval:                mirrorInterval,
 		MirrorUpdated:                 mirrorUpdated,
 		RepoTransfer:                  transfer,
diff --git a/services/convert/status.go b/services/convert/status.go
index a8ef94d107d..02122281dfc 100644
--- a/services/convert/status.go
+++ b/services/convert/status.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"net/url"
 
-	git_model "code.gitea.io/gitea/models/git"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/commitstatus"
-	api "code.gitea.io/gitea/modules/structs"
+	git_model "gitea.dev/models/git"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/commitstatus"
+	api "gitea.dev/modules/structs"
 )
 
 // ToCommitStatus converts git_model.CommitStatus to api.CommitStatus
diff --git a/services/convert/user.go b/services/convert/user.go
index ce9b256061e..525eb46818a 100644
--- a/services/convert/user.go
+++ b/services/convert/user.go
@@ -6,9 +6,9 @@ package convert
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/perm"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models/perm"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
 )
 
 // ToUser convert user_model.User to api.User
diff --git a/services/convert/user_test.go b/services/convert/user_test.go
index 349b0058fe6..3ef7609f042 100644
--- a/services/convert/user_test.go
+++ b/services/convert/user_test.go
@@ -6,9 +6,9 @@ package convert
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/convert/utils.go b/services/convert/utils.go
index b59884ec508..07aac68f860 100644
--- a/services/convert/utils.go
+++ b/services/convert/utils.go
@@ -7,8 +7,8 @@ package convert
 import (
 	"strings"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
 )
 
 // ToCorrectPageSize makes sure page size is in allowed range.
diff --git a/services/convert/wiki.go b/services/convert/wiki.go
index 767bfdb88d0..749eb383a82 100644
--- a/services/convert/wiki.go
+++ b/services/convert/wiki.go
@@ -6,8 +6,8 @@ package convert
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
 )
 
 // ToWikiCommit convert a git commit into a WikiCommit
@@ -28,7 +28,7 @@ func ToWikiCommit(commit *git.Commit) *api.WikiCommit {
 			},
 			Date: commit.Committer.When.UTC().Format(time.RFC3339),
 		},
-		Message: commit.CommitMessage,
+		Message: commit.MessageUTF8(),
 	}
 }
 
diff --git a/services/cron/cron.go b/services/cron/cron.go
index a0b3c7b5ac2..92b7b6ed032 100644
--- a/services/cron/cron.go
+++ b/services/cron/cron.go
@@ -9,10 +9,10 @@ import (
 	"runtime/pprof"
 	"time"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/translation"
 
 	"github.com/go-co-op/gocron/v2"
 )
diff --git a/services/cron/setting.go b/services/cron/setting.go
index 6dad88830ab..afc4e76d99a 100644
--- a/services/cron/setting.go
+++ b/services/cron/setting.go
@@ -6,7 +6,7 @@ package cron
 import (
 	"time"
 
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/translation"
 )
 
 // Config represents a basic configuration interface that cron task
diff --git a/services/cron/tasks.go b/services/cron/tasks.go
index 4b0660d9e96..74ab23a3d13 100644
--- a/services/cron/tasks.go
+++ b/services/cron/tasks.go
@@ -11,15 +11,15 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	system_model "code.gitea.io/gitea/models/system"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/models/db"
+	system_model "gitea.dev/models/system"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation"
 
 	"github.com/go-co-op/gocron/v2"
 )
@@ -57,7 +57,7 @@ func (t *Task) IsEnabled() bool {
 
 // GetConfig will return a copy of the task's config
 func (t *Task) GetConfig() Config {
-	if reflect.TypeOf(t.config).Kind() == reflect.Ptr {
+	if reflect.TypeOf(t.config).Kind() == reflect.Pointer {
 		// Pointer:
 		return reflect.New(reflect.ValueOf(t.config).Elem().Type()).Interface().(Config)
 	}
diff --git a/services/cron/tasks_actions.go b/services/cron/tasks_actions.go
index 59cfe36d14f..323aa642607 100644
--- a/services/cron/tasks_actions.go
+++ b/services/cron/tasks_actions.go
@@ -6,9 +6,9 @@ package cron
 import (
 	"context"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	actions_service "code.gitea.io/gitea/services/actions"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	actions_service "gitea.dev/services/actions"
 )
 
 func initActionsTasks() {
diff --git a/services/cron/tasks_basic.go b/services/cron/tasks_basic.go
index c620959cc16..d76d873b368 100644
--- a/services/cron/tasks_basic.go
+++ b/services/cron/tasks_basic.go
@@ -7,18 +7,18 @@ import (
 	"context"
 	"time"
 
-	"code.gitea.io/gitea/models"
-	git_model "code.gitea.io/gitea/models/git"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/migrations"
-	mirror_service "code.gitea.io/gitea/services/mirror"
-	packages_cleanup_service "code.gitea.io/gitea/services/packages/cleanup"
-	repo_service "code.gitea.io/gitea/services/repository"
-	archiver_service "code.gitea.io/gitea/services/repository/archiver"
+	"gitea.dev/models"
+	git_model "gitea.dev/models/git"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/migrations"
+	mirror_service "gitea.dev/services/mirror"
+	packages_cleanup_service "gitea.dev/services/packages/cleanup"
+	repo_service "gitea.dev/services/repository"
+	archiver_service "gitea.dev/services/repository/archiver"
 )
 
 func registerUpdateMirrorTask() {
diff --git a/services/cron/tasks_extended.go b/services/cron/tasks_extended.go
index 74fb12430d1..b0706be1b13 100644
--- a/services/cron/tasks_extended.go
+++ b/services/cron/tasks_extended.go
@@ -7,17 +7,17 @@ import (
 	"context"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/system"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	issue_indexer "code.gitea.io/gitea/modules/indexer/issues"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/updatechecker"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	repo_service "code.gitea.io/gitea/services/repository"
-	archiver_service "code.gitea.io/gitea/services/repository/archiver"
-	user_service "code.gitea.io/gitea/services/user"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/system"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git/gitcmd"
+	issue_indexer "gitea.dev/modules/indexer/issues"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/updatechecker"
+	asymkey_service "gitea.dev/services/asymkey"
+	repo_service "gitea.dev/services/repository"
+	archiver_service "gitea.dev/services/repository/archiver"
+	user_service "gitea.dev/services/user"
 )
 
 func registerDeleteInactiveUsers() {
diff --git a/services/cron/tasks_extended_test.go b/services/cron/tasks_extended_test.go
index a3d40630a3c..7df8eb056b9 100644
--- a/services/cron/tasks_extended_test.go
+++ b/services/cron/tasks_extended_test.go
@@ -7,8 +7,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/doctor/actions.go b/services/doctor/actions.go
deleted file mode 100644
index 28e26c88ebe..00000000000
--- a/services/doctor/actions.go
+++ /dev/null
@@ -1,70 +0,0 @@
-// Copyright 2024 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package doctor
-
-import (
-	"context"
-	"fmt"
-
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	repo_service "code.gitea.io/gitea/services/repository"
-)
-
-func disableMirrorActionsUnit(ctx context.Context, logger log.Logger, autofix bool) error {
-	var reposToFix []*repo_model.Repository
-
-	for page := 1; ; page++ {
-		repos, _, err := repo_model.SearchRepository(ctx, repo_model.SearchRepoOptions{
-			ListOptions: db.ListOptions{
-				PageSize: repo_model.RepositoryListDefaultPageSize,
-				Page:     page,
-			},
-			Mirror: optional.Some(true),
-		})
-		if err != nil {
-			return fmt.Errorf("SearchRepository: %w", err)
-		}
-		if len(repos) == 0 {
-			break
-		}
-
-		for _, repo := range repos {
-			if repo.UnitEnabled(ctx, unit_model.TypeActions) {
-				reposToFix = append(reposToFix, repo)
-			}
-		}
-	}
-
-	if len(reposToFix) == 0 {
-		logger.Info("Found no mirror with actions unit enabled")
-	} else {
-		logger.Warn("Found %d mirrors with actions unit enabled", len(reposToFix))
-	}
-	if !autofix || len(reposToFix) == 0 {
-		return nil
-	}
-
-	for _, repo := range reposToFix {
-		if err := repo_service.UpdateRepositoryUnits(ctx, repo, nil, []unit_model.Type{unit_model.TypeActions}); err != nil {
-			return err
-		}
-	}
-	logger.Info("Fixed %d mirrors with actions unit enabled", len(reposToFix))
-
-	return nil
-}
-
-func init() {
-	Register(&Check{
-		Title:     "Disable the actions unit for all mirrors",
-		Name:      "disable-mirror-actions-unit",
-		IsDefault: false,
-		Run:       disableMirrorActionsUnit,
-		Priority:  9,
-	})
-}
diff --git a/services/doctor/authorizedkeys.go b/services/doctor/authorizedkeys.go
deleted file mode 100644
index fe1dc639e8b..00000000000
--- a/services/doctor/authorizedkeys.go
+++ /dev/null
@@ -1,100 +0,0 @@
-// Copyright 2020 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package doctor
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-)
-
-func checkAuthorizedKeys(ctx context.Context, logger log.Logger, autofix bool) error {
-	if setting.SSH.StartBuiltinServer || !setting.SSH.CreateAuthorizedKeysFile {
-		return nil
-	}
-
-	fPath := filepath.Join(setting.SSH.RootPath, "authorized_keys")
-	f, err := os.Open(fPath)
-	if err != nil {
-		if !autofix {
-			logger.Critical("Unable to open authorized_keys file. ERROR: %v", err)
-			return fmt.Errorf("Unable to open authorized_keys file. ERROR: %w", err)
-		}
-		logger.Warn("Unable to open authorized_keys. (ERROR: %v). Attempting to rewrite...", err)
-		if err = asymkey_service.RewriteAllPublicKeys(ctx); err != nil {
-			logger.Critical("Unable to rewrite authorized_keys file. ERROR: %v", err)
-			return fmt.Errorf("Unable to rewrite authorized_keys file. ERROR: %w", err)
-		}
-	}
-	defer f.Close()
-
-	linesInAuthorizedKeys := make(container.Set[string])
-
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		line := scanner.Text()
-		if strings.HasPrefix(line, asymkey_model.AuthorizedStringCommentPrefix) {
-			continue
-		}
-		linesInAuthorizedKeys.Add(line)
-	}
-	if err = scanner.Err(); err != nil {
-		return fmt.Errorf("scan: %w", err)
-	}
-	// although there is a "defer close" above, here close explicitly before the generating, because it needs to open the file for writing again
-	_ = f.Close()
-
-	// now we regenerate and check if there are any lines missing
-	regenerated := &bytes.Buffer{}
-	if err := asymkey_model.RegeneratePublicKeys(ctx, regenerated); err != nil {
-		logger.Critical("Unable to regenerate authorized_keys file. ERROR: %v", err)
-		return fmt.Errorf("Unable to regenerate authorized_keys file. ERROR: %w", err)
-	}
-	scanner = bufio.NewScanner(regenerated)
-	for scanner.Scan() {
-		line := scanner.Text()
-		if strings.HasPrefix(line, asymkey_model.AuthorizedStringCommentPrefix) {
-			continue
-		}
-		if linesInAuthorizedKeys.Contains(line) {
-			continue
-		}
-		if !autofix {
-			logger.Critical(
-				"authorized_keys file %q is out of date.\nRegenerate it with:\n\t\"%s\"\nor\n\t\"%s\"",
-				fPath,
-				"gitea admin regenerate keys",
-				"gitea doctor --run authorized-keys --fix")
-			return errors.New(`authorized_keys is out of date and should be regenerated with "gitea admin regenerate keys" or "gitea doctor --run authorized-keys --fix"`)
-		}
-		logger.Warn("authorized_keys is out of date. Attempting rewrite...")
-		err = asymkey_service.RewriteAllPublicKeys(ctx)
-		if err != nil {
-			logger.Critical("Unable to rewrite authorized_keys file. ERROR: %v", err)
-			return fmt.Errorf("Unable to rewrite authorized_keys file. ERROR: %w", err)
-		}
-	}
-	return nil
-}
-
-func init() {
-	Register(&Check{
-		Title:     "Check if OpenSSH authorized_keys file is up-to-date",
-		Name:      "authorized-keys",
-		IsDefault: true,
-		Run:       checkAuthorizedKeys,
-		Priority:  4,
-	})
-}
diff --git a/services/doctor/checkOldArchives.go b/services/doctor/checkOldArchives.go
deleted file mode 100644
index fa1a6ccb1d1..00000000000
--- a/services/doctor/checkOldArchives.go
+++ /dev/null
@@ -1,57 +0,0 @@
-// Copyright 2021 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package doctor
-
-import (
-	"context"
-
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-)
-
-func checkOldArchives(ctx context.Context, logger log.Logger, autofix bool) error {
-	numRepos := 0
-	numReposUpdated := 0
-	err := iterateRepositories(ctx, func(repo *repo_model.Repository) error {
-		if repo.IsEmpty {
-			return nil
-		}
-
-		isDir, err := gitrepo.IsRepoDirExist(ctx, repo, "archives")
-		if err != nil {
-			log.Warn("check if %s is directory failed: %v", repo.FullName(), err)
-		}
-		if isDir {
-			numRepos++
-			if autofix {
-				err := gitrepo.RemoveRepoFileOrDir(ctx, repo, "archives")
-				if err == nil {
-					numReposUpdated++
-				} else {
-					log.Warn("remove %s failed: %v", repo.FullName(), err)
-				}
-			}
-		}
-		return nil
-	})
-
-	if autofix {
-		logger.Info("%d / %d old archives in repository deleted", numReposUpdated, numRepos)
-	} else {
-		logger.Info("%d old archives in repository need to be deleted", numRepos)
-	}
-
-	return err
-}
-
-func init() {
-	Register(&Check{
-		Title:     "Check old archives",
-		Name:      "check-old-archives",
-		IsDefault: false,
-		Run:       checkOldArchives,
-		Priority:  7,
-	})
-}
diff --git a/services/doctor/dbconsistency.go b/services/doctor/dbconsistency.go
index d5a133d8b25..e5ff92a08f7 100644
--- a/services/doctor/dbconsistency.go
+++ b/services/doctor/dbconsistency.go
@@ -6,16 +6,16 @@ package doctor
 import (
 	"context"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/migrations"
-	repo_model "code.gitea.io/gitea/models/repo"
-	secret_model "code.gitea.io/gitea/models/secret"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	issue_service "code.gitea.io/gitea/services/issue"
+	actions_model "gitea.dev/models/actions"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/migrations"
+	repo_model "gitea.dev/models/repo"
+	secret_model "gitea.dev/models/secret"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	issue_service "gitea.dev/services/issue"
 )
 
 type consistencyCheck struct {
diff --git a/services/doctor/dbconsistency_test.go b/services/doctor/dbconsistency_test.go
index d2cf2c47254..4b77816f450 100644
--- a/services/doctor/dbconsistency_test.go
+++ b/services/doctor/dbconsistency_test.go
@@ -7,11 +7,11 @@ import (
 	"slices"
 	"testing"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/models/user"
+	"gitea.dev/modules/log"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/doctor/doctor.go b/services/doctor/doctor.go
index e7fe29d8ee4..4ac6b79e7d1 100644
--- a/services/doctor/doctor.go
+++ b/services/doctor/doctor.go
@@ -10,11 +10,11 @@ import (
 	"sort"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
 )
 
 // Check represents a Doctor check
diff --git a/services/doctor/fix8312.go b/services/doctor/fix8312.go
deleted file mode 100644
index 3e2ca68eb42..00000000000
--- a/services/doctor/fix8312.go
+++ /dev/null
@@ -1,61 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package doctor
-
-import (
-	"context"
-
-	"code.gitea.io/gitea/models/db"
-	org_model "code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/modules/log"
-	org_service "code.gitea.io/gitea/services/org"
-
-	"xorm.io/builder"
-)
-
-func fixOwnerTeamCreateOrgRepo(ctx context.Context, logger log.Logger, autofix bool) error {
-	count := 0
-
-	err := db.Iterate(
-		ctx,
-		builder.Eq{"authorize": perm.AccessModeOwner, "can_create_org_repo": false},
-		func(ctx context.Context, team *org_model.Team) error {
-			team.CanCreateOrgRepo = true
-			count++
-
-			if !autofix {
-				return nil
-			}
-
-			return org_service.UpdateTeam(ctx, team, false, false)
-		},
-	)
-	if err != nil {
-		logger.Critical("Unable to iterate across repounits to fix incorrect can_create_org_repo: Error %v", err)
-		return err
-	}
-
-	if !autofix {
-		if count == 0 {
-			logger.Info("Found no team with incorrect can_create_org_repo")
-		} else {
-			logger.Warn("Found %d teams with incorrect can_create_org_repo", count)
-		}
-		return nil
-	}
-	logger.Info("Fixed %d teams with incorrect can_create_org_repo", count)
-
-	return nil
-}
-
-func init() {
-	Register(&Check{
-		Title:     "Check for incorrect can_create_org_repo for org owner teams",
-		Name:      "fix-owner-team-create-org-repo",
-		IsDefault: false,
-		Run:       fixOwnerTeamCreateOrgRepo,
-		Priority:  7,
-	})
-}
diff --git a/services/doctor/heads.go b/services/doctor/heads.go
deleted file mode 100644
index 4d34b18e18b..00000000000
--- a/services/doctor/heads.go
+++ /dev/null
@@ -1,92 +0,0 @@
-// Copyright 2022 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package doctor
-
-import (
-	"context"
-
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-)
-
-func synchronizeRepoHeads(ctx context.Context, logger log.Logger, autofix bool) error {
-	numRepos := 0
-	numHeadsBroken := 0
-	numDefaultBranchesBroken := 0
-	numReposUpdated := 0
-	err := iterateRepositories(ctx, func(repo *repo_model.Repository) error {
-		numRepos++
-		_, _, defaultBranchErr := gitrepo.RunCmdString(ctx, repo,
-			gitcmd.NewCommand("rev-parse").AddDashesAndList(repo.DefaultBranch))
-
-		head, _, headErr := gitrepo.RunCmdString(ctx, repo,
-			gitcmd.NewCommand("symbolic-ref", "--short", "HEAD"))
-
-		// what we expect: default branch is valid, and HEAD points to it
-		if headErr == nil && defaultBranchErr == nil && head == repo.DefaultBranch {
-			return nil
-		}
-
-		if headErr != nil {
-			numHeadsBroken++
-		}
-		if defaultBranchErr != nil {
-			numDefaultBranchesBroken++
-		}
-
-		// if default branch is broken, let the user fix that in the UI
-		if defaultBranchErr != nil {
-			logger.Warn("Default branch for %s/%s doesn't point to a valid commit", repo.OwnerName, repo.Name)
-			return nil
-		}
-
-		// if we're not autofixing, that's all we can do
-		if !autofix {
-			return nil
-		}
-
-		// otherwise, let's try fixing HEAD
-		err := gitrepo.RunCmd(ctx, repo, gitcmd.NewCommand("symbolic-ref").AddDashesAndList("HEAD", git.BranchPrefix+repo.DefaultBranch))
-		if err != nil {
-			logger.Warn("Failed to fix HEAD for %s/%s: %v", repo.OwnerName, repo.Name, err)
-			return nil
-		}
-		numReposUpdated++
-		return nil
-	})
-	if err != nil {
-		logger.Critical("Error when fixing repo HEADs: %v", err)
-	}
-
-	if autofix {
-		logger.Info("Out of %d repos, HEADs for %d are now fixed and HEADS for %d are still broken", numRepos, numReposUpdated, numDefaultBranchesBroken+numHeadsBroken-numReposUpdated)
-	} else {
-		if numHeadsBroken == 0 && numDefaultBranchesBroken == 0 {
-			logger.Info("All %d repos have their HEADs in the correct state", numRepos)
-		} else {
-			if numHeadsBroken == 0 && numDefaultBranchesBroken != 0 {
-				logger.Critical("Default branches are broken for %d/%d repos", numDefaultBranchesBroken, numRepos)
-			} else if numHeadsBroken != 0 && numDefaultBranchesBroken == 0 {
-				logger.Warn("HEADs are broken for %d/%d repos", numHeadsBroken, numRepos)
-			} else {
-				logger.Critical("Out of %d repos, HEADS are broken for %d and default branches are broken for %d", numRepos, numHeadsBroken, numDefaultBranchesBroken)
-			}
-		}
-	}
-
-	return err
-}
-
-func init() {
-	Register(&Check{
-		Title:     "Synchronize repo HEADs",
-		Name:      "synchronize-repo-heads",
-		IsDefault: true,
-		Run:       synchronizeRepoHeads,
-		Priority:  7,
-	})
-}
diff --git a/services/doctor/lfs.go b/services/doctor/lfs.go
index a90f3944503..17085d0b481 100644
--- a/services/doctor/lfs.go
+++ b/services/doctor/lfs.go
@@ -8,9 +8,9 @@ import (
 	"errors"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/repository"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/repository"
 )
 
 func init() {
diff --git a/services/doctor/main_test.go b/services/doctor/main_test.go
index 0f365e21d08..79ff42f38c0 100644
--- a/services/doctor/main_test.go
+++ b/services/doctor/main_test.go
@@ -6,7 +6,7 @@ package doctor
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/doctor/misc.go b/services/doctor/misc.go
index 71f3efa4b1b..b097fa6ab46 100644
--- a/services/doctor/misc.go
+++ b/services/doctor/misc.go
@@ -7,13 +7,13 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/structs"
 
 	lru "github.com/hashicorp/golang-lru/v2"
 	"xorm.io/builder"
diff --git a/services/doctor/repository.go b/services/doctor/repository.go
index 359c4a17e0d..122e000cf2a 100644
--- a/services/doctor/repository.go
+++ b/services/doctor/repository.go
@@ -6,10 +6,10 @@ package doctor
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/storage"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/storage"
+	repo_service "gitea.dev/services/repository"
 
 	"xorm.io/builder"
 )
diff --git a/services/doctor/storage.go b/services/doctor/storage.go
index 77fc6d65dfa..29a70bc8626 100644
--- a/services/doctor/storage.go
+++ b/services/doctor/storage.go
@@ -9,16 +9,16 @@ import (
 	"io/fs"
 	"strings"
 
-	"code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/log"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/git"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/repo"
+	"gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/log"
+	packages_module "gitea.dev/modules/packages"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/util"
 )
 
 type commonStorageCheckOptions struct {
diff --git a/services/externalaccount/user.go b/services/externalaccount/user.go
index 1eddc4a5df3..1dfc993539e 100644
--- a/services/externalaccount/user.go
+++ b/services/externalaccount/user.go
@@ -8,10 +8,10 @@ import (
 	"strconv"
 	"strings"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/structs"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/structs"
 
 	"github.com/markbates/goth"
 )
diff --git a/services/feed/feed.go b/services/feed/feed.go
index 87ba224c892..92edd38097f 100644
--- a/services/feed/feed.go
+++ b/services/feed/feed.go
@@ -8,14 +8,14 @@ import (
 	"fmt"
 	"strings"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 func GetFeedsForDashboard(ctx context.Context, opts activities_model.GetFeedsOptions) (activities_model.ActionList, int64, error) {
diff --git a/services/feed/feed_test.go b/services/feed/feed_test.go
index 136344cd289..43cc0ca7503 100644
--- a/services/feed/feed_test.go
+++ b/services/feed/feed_test.go
@@ -6,11 +6,11 @@ package feed
 import (
 	"testing"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/feed/notifier.go b/services/feed/notifier.go
index c0de4d02de0..ae1968aefa3 100644
--- a/services/feed/notifier.go
+++ b/services/feed/notifier.go
@@ -9,16 +9,16 @@ import (
 	"path"
 	"strings"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/util"
-	notify_service "code.gitea.io/gitea/services/notify"
+	activities_model "gitea.dev/models/activities"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/util"
+	notify_service "gitea.dev/services/notify"
 )
 
 type actionNotifier struct {
diff --git a/services/feed/notifier_test.go b/services/feed/notifier_test.go
index ef70facd1e4..c3951ebec6f 100644
--- a/services/feed/notifier_test.go
+++ b/services/feed/notifier_test.go
@@ -7,13 +7,13 @@ import (
 	"strings"
 	"testing"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	activities_model "gitea.dev/models/activities"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/forms/admin.go b/services/forms/admin.go
index c90ddf7d543..993bd7a4f11 100644
--- a/services/forms/admin.go
+++ b/services/forms/admin.go
@@ -6,9 +6,9 @@ package forms
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/services/forms/auth_form.go b/services/forms/auth_form.go
index 651618cfad4..8de8accb210 100644
--- a/services/forms/auth_form.go
+++ b/services/forms/auth_form.go
@@ -6,8 +6,8 @@ package forms
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/services/forms/org.go b/services/forms/org.go
index 8a8106e8cf1..2aacf1b645d 100644
--- a/services/forms/org.go
+++ b/services/forms/org.go
@@ -7,9 +7,9 @@ package forms
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/services/forms/package_form.go b/services/forms/package_form.go
index d1a2b8587cc..0a2a0df8c76 100644
--- a/services/forms/package_form.go
+++ b/services/forms/package_form.go
@@ -6,8 +6,8 @@ package forms
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/services/forms/repo_branch_form.go b/services/forms/repo_branch_form.go
index 42e6c85c371..1b1098eb5a7 100644
--- a/services/forms/repo_branch_form.go
+++ b/services/forms/repo_branch_form.go
@@ -6,8 +6,8 @@ package forms
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/services/forms/repo_form.go b/services/forms/repo_form.go
index d8e019f8609..5b65369dd68 100644
--- a/services/forms/repo_form.go
+++ b/services/forms/repo_form.go
@@ -8,14 +8,14 @@ import (
 	"net/http"
 	"strings"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	project_model "code.gitea.io/gitea/models/project"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/webhook"
+	issues_model "gitea.dev/models/issues"
+	project_model "gitea.dev/models/project"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
+	"gitea.dev/services/webhook"
 
 	"gitea.com/go-chi/binding"
 )
@@ -142,7 +142,9 @@ type RepoSettingForm struct {
 	PullsAllowManualMerge            bool
 	PullsDefaultMergeStyle           string
 	EnableAutodetectManualMerge      bool
+	PullsAllowMergeUpdate            bool
 	PullsAllowRebaseUpdate           bool
+	PullsDefaultUpdateStyle          string
 	DefaultDeleteBranchAfterMerge    bool
 	DefaultAllowMaintainerEdit       bool
 	DefaultTargetBranch              string
@@ -179,6 +181,9 @@ type ProtectBranchForm struct {
 	EnableMergeWhitelist          bool
 	MergeWhitelistUsers           string
 	MergeWhitelistTeams           string
+	EnableBypassAllowlist         bool
+	BypassAllowlistUsers          string
+	BypassAllowlistTeams          string
 	EnableStatusCheck             bool
 	StatusCheckContexts           string
 	RequiredApprovals             int64
diff --git a/services/forms/repo_form_editor.go b/services/forms/repo_form_editor.go
index 3ad2eae75dc..392567ad4ff 100644
--- a/services/forms/repo_form_editor.go
+++ b/services/forms/repo_form_editor.go
@@ -6,9 +6,9 @@ package forms
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/services/forms/repo_form_test.go b/services/forms/repo_form_test.go
index 6f2c966dded..78cdd471506 100644
--- a/services/forms/repo_form_test.go
+++ b/services/forms/repo_form_test.go
@@ -6,7 +6,7 @@ package forms
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/forms/repo_tag_form.go b/services/forms/repo_tag_form.go
index 0135684737c..e7ec51d550b 100644
--- a/services/forms/repo_tag_form.go
+++ b/services/forms/repo_tag_form.go
@@ -6,8 +6,8 @@ package forms
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/services/forms/runner.go b/services/forms/runner.go
index 6abfc66fc27..2ea9862afbd 100644
--- a/services/forms/runner.go
+++ b/services/forms/runner.go
@@ -6,8 +6,8 @@ package forms
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/services/forms/user_form.go b/services/forms/user_form.go
index 3f65e8c551f..195c7469850 100644
--- a/services/forms/user_form.go
+++ b/services/forms/user_form.go
@@ -9,13 +9,13 @@ import (
 	"net/http"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/validation"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/validation"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/services/forms/user_form_auth_openid.go b/services/forms/user_form_auth_openid.go
index ca1c77e3208..8da80e4e1eb 100644
--- a/services/forms/user_form_auth_openid.go
+++ b/services/forms/user_form_auth_openid.go
@@ -6,8 +6,8 @@ package forms
 import (
 	"net/http"
 
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/services/context"
 
 	"gitea.com/go-chi/binding"
 )
diff --git a/services/forms/user_form_hidden_comments.go b/services/forms/user_form_hidden_comments.go
index 76382ddfdde..bd9822e0778 100644
--- a/services/forms/user_form_hidden_comments.go
+++ b/services/forms/user_form_hidden_comments.go
@@ -6,9 +6,9 @@ package forms
 import (
 	"math/big"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/services/context"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/log"
+	"gitea.dev/services/context"
 )
 
 type hiddenCommentTypeGroupsType map[string][]issues_model.CommentType
@@ -90,7 +90,7 @@ func UserHiddenCommentTypesFromRequest(ctx *context.Context) *big.Int {
 func IsUserHiddenCommentTypeGroupChecked(group string, hiddenCommentTypes *big.Int) (ret bool) {
 	commentTypes, ok := hiddenCommentTypeGroups[group]
 	if !ok {
-		log.Critical("the group map for hidden comment types is out of sync, unknown group: %v", group)
+		log.Error("the group map for hidden comment types is out of sync, unknown group: %v", group)
 		return false
 	}
 	if hiddenCommentTypes == nil {
diff --git a/services/forms/user_form_test.go b/services/forms/user_form_test.go
index c082f40294b..d62571c0d8d 100644
--- a/services/forms/user_form_test.go
+++ b/services/forms/user_form_test.go
@@ -6,9 +6,9 @@ package forms
 import (
 	"testing"
 
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/git/commit.go b/services/git/commit.go
index e4755ef93d7..5708e162b99 100644
--- a/services/git/commit.go
+++ b/services/git/commit.go
@@ -6,14 +6,14 @@ package git
 import (
 	"context"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	asymkey_service "gitea.dev/services/asymkey"
 )
 
 // ParseCommitsWithSignature checks if signaute of commits are corresponding to users gpg keys.
diff --git a/services/git/compare.go b/services/git/compare.go
index 6102d2418d9..23f6ffe75f0 100644
--- a/services/git/compare.go
+++ b/services/git/compare.go
@@ -8,10 +8,10 @@ import (
 	"errors"
 	"fmt"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/util"
 )
 
 // CompareInfo represents needed information for comparing references.
diff --git a/services/gitdiff/csv_test.go b/services/gitdiff/csv_test.go
index b45433d8c24..6bb04044a81 100644
--- a/services/gitdiff/csv_test.go
+++ b/services/gitdiff/csv_test.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 	"testing"
 
-	csv_module "code.gitea.io/gitea/modules/csv"
-	"code.gitea.io/gitea/modules/setting"
+	csv_module "gitea.dev/modules/csv"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/gitdiff/git_diff_tree.go b/services/gitdiff/git_diff_tree.go
index b4f26210be7..7ef9bc6165f 100644
--- a/services/gitdiff/git_diff_tree.go
+++ b/services/gitdiff/git_diff_tree.go
@@ -12,10 +12,10 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 type DiffTree struct {
diff --git a/services/gitdiff/git_diff_tree_test.go b/services/gitdiff/git_diff_tree_test.go
index c6e3fbab813..7b203160855 100644
--- a/services/gitdiff/git_diff_tree_test.go
+++ b/services/gitdiff/git_diff_tree_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/gitdiff/gitdiff.go b/services/gitdiff/gitdiff.go
index 5c85b50d337..686acb26295 100644
--- a/services/gitdiff/gitdiff.go
+++ b/services/gitdiff/gitdiff.go
@@ -18,27 +18,27 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	pull_model "code.gitea.io/gitea/models/pull"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/analyze"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/attribute"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/highlight"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/svg"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	pull_model "gitea.dev/models/pull"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/analyze"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/attribute"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/highlight"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/svg"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
 
 	"github.com/alecthomas/chroma/v2"
 	"github.com/sergi/go-diff/diffmatchpatch"
diff --git a/services/gitdiff/gitdiff_excerpt.go b/services/gitdiff/gitdiff_excerpt.go
index 4b1958fc11c..f5ff64830ff 100644
--- a/services/gitdiff/gitdiff_excerpt.go
+++ b/services/gitdiff/gitdiff_excerpt.go
@@ -10,7 +10,7 @@ import (
 	"html/template"
 	"io"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/alecthomas/chroma/v2"
 )
diff --git a/services/gitdiff/gitdiff_excerpt_test.go b/services/gitdiff/gitdiff_excerpt_test.go
index cb71e664627..3d94cde6a79 100644
--- a/services/gitdiff/gitdiff_excerpt_test.go
+++ b/services/gitdiff/gitdiff_excerpt_test.go
@@ -8,7 +8,7 @@ import (
 	"strconv"
 	"testing"
 
-	"code.gitea.io/gitea/modules/translation"
+	"gitea.dev/modules/translation"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/gitdiff/gitdiff_test.go b/services/gitdiff/gitdiff_test.go
index e1b358215f5..fd61a09972b 100644
--- a/services/gitdiff/gitdiff_test.go
+++ b/services/gitdiff/gitdiff_test.go
@@ -10,14 +10,14 @@ import (
 	"strings"
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	pull_model "code.gitea.io/gitea/models/pull"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
+	issues_model "gitea.dev/models/issues"
+	pull_model "gitea.dev/models/pull"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/gitdiff/highlightdiff.go b/services/gitdiff/highlightdiff.go
index 1de3963788e..fef61de24d0 100644
--- a/services/gitdiff/highlightdiff.go
+++ b/services/gitdiff/highlightdiff.go
@@ -6,10 +6,11 @@ package gitdiff
 import (
 	"bytes"
 	"html/template"
+	"slices"
 	"strings"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 
 	"github.com/sergi/go-diff/diffmatchpatch"
 )
@@ -385,8 +386,7 @@ func (hcd *highlightCodeDiff) recoverOneDiff(str string) template.HTML {
 	}
 
 	// close all opening tags
-	for i := len(tagStack) - 1; i >= 0; i-- {
-		tagToClose := tagStack[i]
+	for _, tagToClose := range slices.Backward(tagStack) {
 		// get the closing tag "</span>" from "<span class=...>" or "<span>"
 		pos := strings.IndexAny(tagToClose, " >")
 		// pos must be positive, because the tags were pushed by us
diff --git a/services/gitdiff/highlightdiff_test.go b/services/gitdiff/highlightdiff_test.go
index ea9a8829ed2..9036311bca0 100644
--- a/services/gitdiff/highlightdiff_test.go
+++ b/services/gitdiff/highlightdiff_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/highlight"
+	"gitea.dev/modules/highlight"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/gitdiff/main_test.go b/services/gitdiff/main_test.go
index cd9dcd8cd6f..3ec7f3ba02e 100644
--- a/services/gitdiff/main_test.go
+++ b/services/gitdiff/main_test.go
@@ -6,11 +6,11 @@ package gitdiff
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/gitdiff/submodule.go b/services/gitdiff/submodule.go
index 4347743e3d0..9fffd130609 100644
--- a/services/gitdiff/submodule.go
+++ b/services/gitdiff/submodule.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"html/template"
 
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/log"
 )
 
 type SubmoduleDiffInfo struct {
diff --git a/services/gitdiff/submodule_test.go b/services/gitdiff/submodule_test.go
index 9f2cf1d1c60..23afce33112 100644
--- a/services/gitdiff/submodule_test.go
+++ b/services/gitdiff/submodule_test.go
@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/indexer/indexer.go b/services/indexer/indexer.go
index 38dd012a51c..0e4f18736b1 100644
--- a/services/indexer/indexer.go
+++ b/services/indexer/indexer.go
@@ -4,10 +4,10 @@
 package indexer
 
 import (
-	code_indexer "code.gitea.io/gitea/modules/indexer/code"
-	issue_indexer "code.gitea.io/gitea/modules/indexer/issues"
-	stats_indexer "code.gitea.io/gitea/modules/indexer/stats"
-	notify_service "code.gitea.io/gitea/services/notify"
+	code_indexer "gitea.dev/modules/indexer/code"
+	issue_indexer "gitea.dev/modules/indexer/issues"
+	stats_indexer "gitea.dev/modules/indexer/stats"
+	notify_service "gitea.dev/services/notify"
 )
 
 // Init initialize the repo indexer
diff --git a/services/indexer/notify.go b/services/indexer/notify.go
index e2cfe477d3d..3bd68ebcda5 100644
--- a/services/indexer/notify.go
+++ b/services/indexer/notify.go
@@ -6,16 +6,16 @@ package indexer
 import (
 	"context"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	code_indexer "code.gitea.io/gitea/modules/indexer/code"
-	issue_indexer "code.gitea.io/gitea/modules/indexer/issues"
-	stats_indexer "code.gitea.io/gitea/modules/indexer/stats"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	notify_service "code.gitea.io/gitea/services/notify"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	code_indexer "gitea.dev/modules/indexer/code"
+	issue_indexer "gitea.dev/modules/indexer/issues"
+	stats_indexer "gitea.dev/modules/indexer/stats"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	notify_service "gitea.dev/services/notify"
 )
 
 type indexerNotifier struct {
diff --git a/services/issue/assignee.go b/services/issue/assignee.go
index 44024389cfc..a3d1879d856 100644
--- a/services/issue/assignee.go
+++ b/services/issue/assignee.go
@@ -6,12 +6,12 @@ package issue
 import (
 	"context"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	notify_service "code.gitea.io/gitea/services/notify"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	notify_service "gitea.dev/services/notify"
 )
 
 // DeleteNotPassedAssignee deletes all assignees who aren't passed via the "assignees" array
diff --git a/services/issue/assignee_test.go b/services/issue/assignee_test.go
index 4bf0884f521..d020df717dd 100644
--- a/services/issue/assignee_test.go
+++ b/services/issue/assignee_test.go
@@ -6,9 +6,9 @@ package issue
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/issue/comments.go b/services/issue/comments.go
index 3ce2e2a5e13..46964f5f1a3 100644
--- a/services/issue/comments.go
+++ b/services/issue/comments.go
@@ -8,17 +8,17 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/timeutil"
-	git_service "code.gitea.io/gitea/services/git"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/timeutil"
+	git_service "gitea.dev/services/git"
+	notify_service "gitea.dev/services/notify"
 )
 
 // CreateRefComment creates a commit reference comment to issue.
diff --git a/services/issue/commit.go b/services/issue/commit.go
index 68ccc906b66..0fb070d0c17 100644
--- a/services/issue/commit.go
+++ b/services/issue/commit.go
@@ -10,19 +10,20 @@ import (
 	"html"
 	"net/url"
 	"regexp"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/references"
-	"code.gitea.io/gitea/modules/repository"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/references"
+	"gitea.dev/modules/repository"
 )
 
 const (
@@ -123,9 +124,7 @@ func getIssueFromRef(ctx context.Context, repo *repo_model.Repository, index int
 // UpdateIssuesCommit checks if issues are manipulated by commit message.
 func UpdateIssuesCommit(ctx context.Context, doer *user_model.User, repo *repo_model.Repository, commits []*repository.PushCommit, branchName string) error {
 	// Commits are appended in the reverse order.
-	for i := len(commits) - 1; i >= 0; i-- {
-		c := commits[i]
-
+	for _, c := range slices.Backward(commits) {
 		type markKey struct {
 			ID     int64
 			Action references.XRefAction
diff --git a/services/issue/commit_test.go b/services/issue/commit_test.go
index 5950762c449..61e4b00cb21 100644
--- a/services/issue/commit_test.go
+++ b/services/issue/commit_test.go
@@ -6,13 +6,13 @@ package issue
 import (
 	"testing"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
+	activities_model "gitea.dev/models/activities"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/issue/content.go b/services/issue/content.go
index 68941829092..41f30e09983 100644
--- a/services/issue/content.go
+++ b/services/issue/content.go
@@ -6,10 +6,10 @@ package issue
 import (
 	"context"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	user_model "code.gitea.io/gitea/models/user"
-	notify_service "code.gitea.io/gitea/services/notify"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	user_model "gitea.dev/models/user"
+	notify_service "gitea.dev/services/notify"
 )
 
 // ChangeContent changes issue content, as the given user.
diff --git a/services/issue/issue.go b/services/issue/issue.go
index 2bece1c7bb8..1c7fb7761e2 100644
--- a/services/issue/issue.go
+++ b/services/issue/issue.go
@@ -7,19 +7,19 @@ import (
 	"context"
 	"fmt"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	system_model "code.gitea.io/gitea/models/system"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/storage"
-	notify_service "code.gitea.io/gitea/services/notify"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	system_model "gitea.dev/models/system"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/storage"
+	notify_service "gitea.dev/services/notify"
 )
 
 // NewIssue creates new issue with labels for repository.
diff --git a/services/issue/issue_test.go b/services/issue/issue_test.go
index 61ed13ed2fc..e8fae5a194c 100644
--- a/services/issue/issue_test.go
+++ b/services/issue/issue_test.go
@@ -6,10 +6,10 @@ package issue
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/issue/label.go b/services/issue/label.go
index 93a3c2588e5..2e788553a13 100644
--- a/services/issue/label.go
+++ b/services/issue/label.go
@@ -6,11 +6,11 @@ package issue
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	user_model "code.gitea.io/gitea/models/user"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	user_model "gitea.dev/models/user"
+	notify_service "gitea.dev/services/notify"
 )
 
 // ClearLabels clears all of an issue's labels
diff --git a/services/issue/label_test.go b/services/issue/label_test.go
index 093b16b53fe..04079c85d43 100644
--- a/services/issue/label_test.go
+++ b/services/issue/label_test.go
@@ -6,9 +6,9 @@ package issue
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/issue/main_test.go b/services/issue/main_test.go
index 819c5d98c3f..7c126d19521 100644
--- a/services/issue/main_test.go
+++ b/services/issue/main_test.go
@@ -6,10 +6,10 @@ package issue
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/issue/milestone.go b/services/issue/milestone.go
index 05aefad7523..d229a9e12e4 100644
--- a/services/issue/milestone.go
+++ b/services/issue/milestone.go
@@ -8,10 +8,10 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	notify_service "gitea.dev/services/notify"
 )
 
 func changeMilestoneAssign(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, oldMilestoneID int64) error {
diff --git a/services/issue/milestone_test.go b/services/issue/milestone_test.go
index 2ef482e23c2..e294647138f 100644
--- a/services/issue/milestone_test.go
+++ b/services/issue/milestone_test.go
@@ -6,9 +6,9 @@ package issue
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/issue/pull.go b/services/issue/pull.go
index 3fc9c335f93..055c1023b4b 100644
--- a/services/issue/pull.go
+++ b/services/issue/pull.go
@@ -8,13 +8,13 @@ import (
 	"fmt"
 	"slices"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	org_model "code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	issues_model "gitea.dev/models/issues"
+	org_model "gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 type ReviewRequestNotifier struct {
diff --git a/services/issue/reaction.go b/services/issue/reaction.go
index deb99169e1b..e06d8116431 100644
--- a/services/issue/reaction.go
+++ b/services/issue/reaction.go
@@ -6,8 +6,8 @@ package issue
 import (
 	"context"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
 )
 
 // CreateIssueReaction creates a reaction on an issue.
diff --git a/services/issue/reaction_test.go b/services/issue/reaction_test.go
index bf2e554d418..62bb9e691d0 100644
--- a/services/issue/reaction_test.go
+++ b/services/issue/reaction_test.go
@@ -6,11 +6,11 @@ package issue
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/issue/review_request.go b/services/issue/review_request.go
index 23fe9d171ee..d2826f85d65 100644
--- a/services/issue/review_request.go
+++ b/services/issue/review_request.go
@@ -6,15 +6,15 @@ package issue
 import (
 	"context"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	notify_service "code.gitea.io/gitea/services/notify"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	notify_service "gitea.dev/services/notify"
 )
 
 // ReviewRequest add or remove a review request from a user for this PR, and make comment for it.
diff --git a/services/issue/status.go b/services/issue/status.go
index fa59df93ba1..8ce44d5cd66 100644
--- a/services/issue/status.go
+++ b/services/issue/status.go
@@ -6,11 +6,11 @@ package issue
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	notify_service "gitea.dev/services/notify"
 )
 
 // CloseIssue close an issue.
diff --git a/services/issue/suggestion.go b/services/issue/suggestion.go
index 22eddb19042..58c0e9ae9c9 100644
--- a/services/issue/suggestion.go
+++ b/services/issue/suggestion.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"strconv"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/structs"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/structs"
 )
 
 func GetSuggestion(ctx context.Context, repo *repo_model.Repository, isPull optional.Option[bool], keyword string) ([]*structs.Issue, error) {
diff --git a/services/issue/suggestion_test.go b/services/issue/suggestion_test.go
index 9b23e5aca33..a6ce0bc8fd7 100644
--- a/services/issue/suggestion_test.go
+++ b/services/issue/suggestion_test.go
@@ -6,9 +6,9 @@ package issue
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/optional"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/optional"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/issue/template.go b/services/issue/template.go
index 99977c67cf8..c1a0ff2fdd2 100644
--- a/services/issue/template.go
+++ b/services/issue/template.go
@@ -9,14 +9,14 @@ import (
 	"path"
 	"strings"
 
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/issue/template"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/issue/template"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // templateDirCandidates issue templates directory
diff --git a/services/lfs/locks.go b/services/lfs/locks.go
index c2279edaf0a..fe3f4bdbec9 100644
--- a/services/lfs/locks.go
+++ b/services/lfs/locks.go
@@ -8,16 +8,16 @@ import (
 	"strconv"
 	"strings"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/json"
-	lfs_module "code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/convert"
+	auth_model "gitea.dev/models/auth"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/json"
+	lfs_module "gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/context"
+	"gitea.dev/services/convert"
 )
 
 func handleLockListOut(ctx *context.Context, repo *repo_model.Repository, lock *git_model.LFSLock, err error) {
diff --git a/services/lfs/server.go b/services/lfs/server.go
index 0d4243a47ea..6340b062521 100644
--- a/services/lfs/server.go
+++ b/services/lfs/server.go
@@ -18,21 +18,22 @@ import (
 	"strings"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	git_model "code.gitea.io/gitea/models/git"
-	perm_model "code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/httpauth"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
-	lfs_module "code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/services/context"
+	auth_model "gitea.dev/models/auth"
+	git_model "gitea.dev/models/git"
+	perm_model "gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/httpauth"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
+	lfs_module "gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 
 	"github.com/golang-jwt/jwt/v5"
 )
@@ -605,6 +606,18 @@ func handleLFSToken(ctx stdCtx.Context, tokenSHA string, target *repo_model.Repo
 		log.Error("Unable to GetUserById[%d]: Error: %v", claims.UserID, err)
 		return nil, err
 	}
+	if !u.IsActive || u.ProhibitLogin {
+		return nil, util.NewPermissionDeniedErrorf("not allowed to access any repository")
+	}
+
+	perm, err := access_model.GetDoerRepoPermission(ctx, target, u)
+	if err != nil {
+		log.Error("Unable to GetDoerRepoPermission for user[%d] repo[%d]: %v", claims.UserID, target.ID, err)
+		return nil, err
+	}
+	if !perm.CanAccess(mode, unit.TypeCode) {
+		return nil, util.NewPermissionDeniedErrorf("no permission to access the repository")
+	}
 	return u, nil
 }
 
diff --git a/services/lfs/server_test.go b/services/lfs/server_test.go
index e66e48cee8b..f7312d2a6b9 100644
--- a/services/lfs/server_test.go
+++ b/services/lfs/server_test.go
@@ -7,10 +7,12 @@ import (
 	"strings"
 	"testing"
 
-	perm_model "code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/db"
+	perm_model "gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -22,11 +24,15 @@ func TestMain(m *testing.M) {
 
 func TestAuthenticate(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
+	ctx, _ := contexttest.MockContext(t, "/")
+
 	repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 
-	token2, _ := GetLFSAuthTokenWithBearer(AuthTokenOptions{Op: "download", UserID: 2, RepoID: 1})
-	_, token2, _ = strings.Cut(token2, " ")
-	ctx, _ := contexttest.MockContext(t, "/")
+	getUserToken := func(op string, userID int64, repo *repo_model.Repository) string {
+		s, _ := GetLFSAuthTokenWithBearer(AuthTokenOptions{Op: op, UserID: userID, RepoID: repo.ID})
+		_, token, _ := strings.Cut(s, " ")
+		return token
+	}
 
 	t.Run("handleLFSToken", func(t *testing.T) {
 		u, err := handleLFSToken(ctx, "", repo1, perm_model.AccessModeRead)
@@ -37,15 +43,62 @@ func TestAuthenticate(t *testing.T) {
 		require.Error(t, err)
 		assert.Nil(t, u)
 
-		u, err = handleLFSToken(ctx, token2, repo1, perm_model.AccessModeRead)
+		u, err = handleLFSToken(ctx, getUserToken("download", 2, repo1), repo1, perm_model.AccessModeRead)
 		require.NoError(t, err)
 		assert.EqualValues(t, 2, u.ID)
 	})
 
 	t.Run("authenticate", func(t *testing.T) {
 		const prefixBearer = "Bearer "
+		token := getUserToken("download", 2, repo1)
 		assert.False(t, authenticate(ctx, repo1, "", true, false))
 		assert.False(t, authenticate(ctx, repo1, prefixBearer+"invalid", true, false))
-		assert.True(t, authenticate(ctx, repo1, prefixBearer+token2, true, false))
+		assert.True(t, authenticate(ctx, repo1, prefixBearer+token, true, false))
+	})
+
+	handleLFSTokenTestPerm := func(op string, userID int64, repo *repo_model.Repository, accessMode perm_model.AccessMode) error {
+		token := getUserToken(op, userID, repo)
+		u, err := handleLFSToken(ctx, token, repo, accessMode)
+		if err == nil {
+			assert.Equal(t, userID, u.ID)
+		}
+		return err
+	}
+
+	t.Run("handleLFSToken blocks prohibited users", func(t *testing.T) {
+		user37 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 37})
+
+		// prohibited user
+		assert.True(t, user37.ProhibitLogin)
+		err := handleLFSTokenTestPerm("download", 37, repo1, perm_model.AccessModeRead)
+		assert.ErrorContains(t, err, "not allowed to access any repository")
+
+		// normal user
+		_, _ = db.GetEngine(t.Context()).ID(37).Cols("prohibit_login").Update(&user_model.User{ProhibitLogin: false})
+		err = handleLFSTokenTestPerm("download", 37, repo1, perm_model.AccessModeRead)
+		assert.NoError(t, err)
+
+		// inactive user
+		_, _ = db.GetEngine(t.Context()).ID(37).Cols("is_active").Update(&user_model.User{IsActive: false})
+		err = handleLFSTokenTestPerm("download", 37, repo1, perm_model.AccessModeRead)
+		assert.ErrorContains(t, err, "not allowed to access any repository")
+	})
+
+	t.Run("handleLFSToken blocks users without repo access", func(t *testing.T) {
+		repo2 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
+		err := handleLFSTokenTestPerm("download", 10, repo2, perm_model.AccessModeRead)
+		assert.ErrorContains(t, err, "no permission to access the repository")
+	})
+
+	t.Run("handleLFSToken requires write access for uploads", func(t *testing.T) {
+		err := handleLFSTokenTestPerm("download", 10, repo1, perm_model.AccessModeRead)
+		assert.NoError(t, err)
+		err = handleLFSTokenTestPerm("upload", 10, repo1, perm_model.AccessModeWrite)
+		assert.ErrorContains(t, err, "no permission to access the repository")
+	})
+
+	t.Run("handleLFSToken allows writes for authorized users", func(t *testing.T) {
+		err := handleLFSTokenTestPerm("upload", 2, repo1, perm_model.AccessModeWrite)
+		assert.NoError(t, err)
 	})
 }
diff --git a/services/mailer/incoming/incoming.go b/services/mailer/incoming/incoming.go
index 495e246c917..eab7ad6c91f 100644
--- a/services/mailer/incoming/incoming.go
+++ b/services/mailer/incoming/incoming.go
@@ -9,46 +9,23 @@ import (
 	"errors"
 	"fmt"
 	net_mail "net/mail"
-	"regexp"
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/mailer/token"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/mailer/token"
 
-	"github.com/dimiro1/reply"
 	"github.com/emersion/go-imap"
 	"github.com/emersion/go-imap/client"
 	"github.com/jhillyerd/enmime/v2"
 )
 
-var (
-	addressTokenRegex   *regexp.Regexp
-	referenceTokenRegex *regexp.Regexp
-)
-
 func Init(ctx context.Context) error {
 	if !setting.IncomingEmail.Enabled {
 		return nil
 	}
-
-	var err error
-	addressTokenRegex, err = regexp.Compile(
-		fmt.Sprintf(
-			`\A%s\z`,
-			strings.Replace(regexp.QuoteMeta(setting.IncomingEmail.ReplyToAddress), regexp.QuoteMeta(setting.IncomingEmail.TokenPlaceholder), "(.+)", 1),
-		),
-	)
-	if err != nil {
-		return err
-	}
-	referenceTokenRegex, err = regexp.Compile(fmt.Sprintf(`\Areply-(.+)@%s\z`, regexp.QuoteMeta(setting.Domain)))
-	if err != nil {
-		return err
-	}
-
 	go func() {
 		ctx, _, finished := process.GetManager().AddTypedContext(ctx, "Incoming Email", process.SystemProcessType, true)
 		defer finished()
@@ -241,7 +218,7 @@ loop:
 					return nil
 				}
 
-				handlerType, user, payload, err := token.ExtractToken(ctx, t)
+				handlerType, user, payload, err := token.DecodeToken(ctx, t)
 				if err != nil {
 					if _, ok := err.(*token.ErrToken); ok {
 						log.Info("Invalid incoming email token: %v", err)
@@ -292,22 +269,31 @@ func isAutomaticReply(env *enmime.Envelope) bool {
 	return autoRespond != ""
 }
 
+func extractToken(s, tokenPrefix, tokenSuffix string) string {
+	if len(s) <= len(tokenPrefix)+len(tokenSuffix) {
+		return ""
+	}
+	prefix, suffix := s[0:len(tokenPrefix)], s[len(s)-len(tokenSuffix):]
+	if strings.EqualFold(prefix, tokenPrefix) && strings.EqualFold(suffix, tokenSuffix) {
+		return s[len(tokenPrefix) : len(s)-len(tokenSuffix)]
+	}
+	return ""
+}
+
 // searchTokenInHeaders looks for the token in To, Delivered-To and References
 func searchTokenInHeaders(env *enmime.Envelope) string {
-	if addressTokenRegex != nil {
-		to, _ := env.AddressList("To")
+	to, _ := env.AddressList("To")
 
-		token := searchTokenInAddresses(to)
-		if token != "" {
-			return token
-		}
+	token := searchTokenInAddresses(to)
+	if token != "" {
+		return token
+	}
 
-		deliveredTo, _ := env.AddressList("Delivered-To")
+	deliveredTo, _ := env.AddressList("Delivered-To")
 
-		token = searchTokenInAddresses(deliveredTo)
-		if token != "" {
-			return token
-		}
+	token = searchTokenInAddresses(deliveredTo)
+	if token != "" {
+		return token
 	}
 
 	references := env.GetHeader("References")
@@ -322,10 +308,9 @@ func searchTokenInHeaders(env *enmime.Envelope) string {
 		if end == -1 || begin > end {
 			break
 		}
-
-		match := referenceTokenRegex.FindStringSubmatch(references[begin:end])
-		if len(match) == 2 {
-			return match[1]
+		t := extractToken(references[begin:end], "reply-", "@"+setting.Domain)
+		if t != "" {
+			return t
 		}
 
 		references = references[end+1:]
@@ -336,15 +321,15 @@ func searchTokenInHeaders(env *enmime.Envelope) string {
 
 // searchTokenInAddresses looks for the token in an address
 func searchTokenInAddresses(addresses []*net_mail.Address) string {
-	for _, address := range addresses {
-		match := addressTokenRegex.FindStringSubmatch(address.Address)
-		if len(match) != 2 {
-			continue
-		}
-
-		return match[1]
+	tokenPrefix, tokenSuffix, _ := strings.Cut(setting.IncomingEmail.ReplyToAddress, setting.IncomingEmailTokenPlaceholder)
+	if tokenSuffix == "" {
+		return ""
+	}
+	for _, address := range addresses {
+		if t := extractToken(address.Address, tokenPrefix, tokenSuffix); t != "" {
+			return t
+		}
 	}
-
 	return ""
 }
 
@@ -370,7 +355,7 @@ func getContentFromMailReader(env *enmime.Envelope) *MailContent {
 	}
 
 	return &MailContent{
-		Content:     reply.FromText(env.Text),
+		Content:     extractReply(env.Text),
 		Attachments: attachments,
 	}
 }
diff --git a/services/mailer/incoming/incoming_handler.go b/services/mailer/incoming/incoming_handler.go
index 3c350e3d5da..2999985646b 100644
--- a/services/mailer/incoming/incoming_handler.go
+++ b/services/mailer/incoming/incoming_handler.go
@@ -9,19 +9,19 @@ import (
 	"errors"
 	"fmt"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	attachment_service "code.gitea.io/gitea/services/attachment"
-	"code.gitea.io/gitea/services/context/upload"
-	issue_service "code.gitea.io/gitea/services/issue"
-	incoming_payload "code.gitea.io/gitea/services/mailer/incoming/payload"
-	"code.gitea.io/gitea/services/mailer/token"
-	pull_service "code.gitea.io/gitea/services/pull"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	attachment_service "gitea.dev/services/attachment"
+	"gitea.dev/services/context/upload"
+	issue_service "gitea.dev/services/issue"
+	incoming_payload "gitea.dev/services/mailer/incoming/payload"
+	"gitea.dev/services/mailer/token"
+	pull_service "gitea.dev/services/pull"
 )
 
 type MailHandler interface {
diff --git a/services/mailer/incoming/incoming_test.go b/services/mailer/incoming/incoming_test.go
index 4403527de80..9588c9021ac 100644
--- a/services/mailer/incoming/incoming_test.go
+++ b/services/mailer/incoming/incoming_test.go
@@ -7,6 +7,8 @@ import (
 	"strings"
 	"testing"
 
+	"gitea.dev/modules/setting"
+
 	"github.com/jhillyerd/enmime/v2"
 	"github.com/stretchr/testify/assert"
 )
@@ -68,6 +70,18 @@ func TestIsAutomaticReply(t *testing.T) {
 	}
 }
 
+func TestSearchTokenInHeadersCaseInsensitive(t *testing.T) {
+	setting.IncomingEmail.ReplyToAddress = "InComing+%{token}@ExAmPle.com"
+	setting.Domain = "DoMain.com"
+	mkEnv := func(s string) *enmime.Envelope {
+		env, _ := enmime.ReadEnvelope(strings.NewReader(s + "\r\n\r\n"))
+		return env
+	}
+	assert.Equal(t, "abc", searchTokenInHeaders(mkEnv("To: incoming+abc@EXAMPLE.COM")))
+	assert.Equal(t, "abc", searchTokenInHeaders(mkEnv("Delivered-To: INCOMING+abc@example.com")))
+	assert.Equal(t, "abc", searchTokenInHeaders(mkEnv("References: <ReplY-abc@DomaiN.COM>")))
+}
+
 func TestGetContentFromMailReader(t *testing.T) {
 	mailString := "Content-Type: multipart/mixed; boundary=message-boundary\r\n" +
 		"\r\n" +
@@ -136,3 +150,56 @@ func TestGetContentFromMailReader(t *testing.T) {
 	assert.Equal(t, "mail content without signature", content.Content)
 	assert.Empty(t, content.Attachments)
 }
+
+func TestExtractReply(t *testing.T) {
+	cases := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{"plain text", "Email with only text.", "Email with only text."},
+		{"crlf normalized", "line one\r\nline two\r\n", "line one\nline two"},
+		{"trim blank lines", "\n\n\nactual reply\n\n\n", "actual reply"},
+		{"signature delimiter", "the reply\n--\nJohn Doe\nAcme", "the reply"},
+		{"rfc signature delimiter", "the reply\n-- \nJohn Doe", "the reply"},
+		{"mobile signature", "My answer is yes.\n\nSent from my iPhone", "My answer is yes."},
+		{"quote only kept", "> Email with only quote.", "> Email with only quote."},
+		{"leading quote kept", "> This is a quote.\n\nAnd this is some text.", "> This is a quote.\n\nAnd this is some text."},
+		{"trailing quote stripped", "My reply.\n\n> original line 1\n> original line 2", "My reply."},
+		{"attribution and quote", "Looks good.\n\nOn Mon, Jan 1, 2024 John <j@x.com> wrote:\n> please review", "Looks good."},
+		{"attribution without quote marks", "My reply.\n\nOn Wed, Sep 25, 2013, richard wrote:\noriginal text", "My reply."},
+		{"original message separator", "Foo\n\n-------- Original Message --------\n\nTHE END.", "Foo"},
+		{"outlook header block", "This is the actual reply.\n\nFrom: Some One <a@b.com>\nSent: Monday\nTo: Someone\nSubject: hi\n\nquoted body", "This is the actual reply."},
+		{"french attribution", "C'est super !\n\nLe 4 janv. 2016 19:03, \"Neil\" <a@b.com> a écrit :\n> quoted", "C'est super !"},
+		{"german attribution", "Hey :)\n\nAm 03.02.2016 3:35 schrieb Max <a@b.com>:\n> quoted", "Hey :)"},
+		{"cyrillic wrote verb", "Yes.\n\n6 октября 2014 lidel написал:\n> quoted", "Yes."},
+		{"localized signature", "My answer.\n\nEnvoyé depuis mon iPhone", "My answer."},
+		{"swedish header block", "Hi everyone!\n\nFrån: Foo <a@b.com>\nSkickat: den 5 juni\nTill: x@y.com\nÄmne: hi\n\nbody", "Hi everyone!"},
+		{"attribution only is empty", "On Mon, Jan 1, 2024 at 10:00 John <j@x.com> wrote:\n> please review", ""},
+		{"prose ending in wrote kept", "Hi Bob,\nThanks for the report you wrote\nI'll fix it.", "Hi Bob,\nThanks for the report you wrote\nI'll fix it."},
+		{"on with year and no time kept", "Hi,\nOn the 2024 roadmap we have three items.\nPlease review.", "Hi,\nOn the 2024 roadmap we have three items.\nPlease review."},
+		{"date prose kept", "Notes:\n5 issues 2024 fixed at 9:15 today\nmore notes", "Notes:\n5 issues 2024 fixed at 9:15 today\nmore notes"},
+		{"header needs from first", "Quick note:\nTo: which server?\nFrom: tests pass.\nThanks", "Quick note:\nTo: which server?\nFrom: tests pass.\nThanks"},
+		{"indented header block", "Reply text.\n\n  From: A <a@b.com>\n  Sent: Monday\n  To: x\n  Subject: hi\n\nbody", "Reply text."},
+		{"chinese signature", "回复内容\n\n發自我的iPhone", "回复内容"},
+		{"japanese signature", "返信します\n\niPhoneから送信", "返信します"},
+		{"chinese header block", "回复内容\n\n发件人：张三\n收件人：李四\n主题：你好\n\n原文", "回复内容"},
+		{"japanese header block", "本文です\n\n差出人：山田\n宛先：田中\n件名：こんにちは\n\n原文", "本文です"},
+		{"name-first attribution", "Okay.\n\nErlend <meta@x.com> schrieb am Di., 16. Aug. 2016\num 12:52 Uhr:\n> quoted", "Okay."},
+		{"chinese attribution", "你好，谢谢回复。\n\n在 2024年1月1日，张三 <z@x.com> 写道：\n> 原始内容", "你好，谢谢回复。"},
+		{"japanese attribution", "了解しました。\n\n田中さんは書きました：\n> 引用", "了解しました。"},
+		{"korean attribution", "감사합니다.\n\n홍길동님이 작성:\n> 인용", "감사합니다."},
+		{"email mention kept", "I asked Bob <bob@x.com> and he wrote back yes.\nSo we proceed.", "I asked Bob <bob@x.com> and he wrote back yes.\nSo we proceed."},
+		{"trailing mailbox glyph", "My reply here.\n\nᐧ", "My reply here."},
+		{"on with year and time prose kept", "On the 2024 roadmap we should meet at 10:00.\nI'll send invites.", "On the 2024 roadmap we should meet at 10:00.\nI'll send invites."},
+		{"spanish year and time prose kept", "El informe del 2024 estará listo a las 10:00.\nGracias.", "El informe del 2024 estará listo a las 10:00.\nGracias."},
+		{"chinese prose kept", "谢谢，已测试。\n发自我的内心的感谢", "谢谢，已测试。\n发自我的内心的感谢"},
+		{"korean prose kept", "확인했습니다.\n이 문서는 회사에서 보냄", "확인했습니다.\n이 문서는 회사에서 보냄"},
+		{"japanese prose kept", "了解しました。\n資料は会議から送信", "了解しました。\n資料は会議から送信"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.expected, extractReply(c.input))
+		})
+	}
+}
diff --git a/services/mailer/incoming/payload/payload.go b/services/mailer/incoming/payload/payload.go
index 00ada7826bd..01f7bd17107 100644
--- a/services/mailer/incoming/payload/payload.go
+++ b/services/mailer/incoming/payload/payload.go
@@ -6,8 +6,8 @@ package payload
 import (
 	"context"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/util"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/util"
 )
 
 const replyPayloadVersion1 byte = 1
diff --git a/services/mailer/incoming/reply.go b/services/mailer/incoming/reply.go
new file mode 100644
index 00000000000..3f27909ca02
--- /dev/null
+++ b/services/mailer/incoming/reply.go
@@ -0,0 +1,137 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package incoming
+
+import (
+	"regexp"
+	"strings"
+	"sync"
+
+	"gitea.dev/modules/util"
+)
+
+const (
+	yearToken = `\b\d{4}\b`            // 4-digit year
+	timeToken = `\b\d{1,2}[:.]\d{2}\b` // HH:MM or HH.MM
+	// "wrote" verbs ending an attribution line; CJK ones are matched without a
+	// preceding word-separator since those scripts don't space their words
+	wroteVerbs    = `wrote|writes|schrieb|skrev|napisał|escreveu|escribió|написал|пише|a écrit`
+	cjkWroteVerbs = `写道|寫道|書きました|작성`
+	// device names anchoring CJK mobile signatures, so prose isn't mistaken for one
+	cjkDevice = `iphone|ipad|ipod|android|galaxy|手机|手機|平板`
+)
+
+// forwarded-mail header fields across the common mail clients/locales. headerFromFields
+// (the "From"-equivalents) must begin a block; headerFields is the full set allowed to
+// follow. Matched as a prefix by headerLine, so adding a locale is a one-line change.
+var (
+	headerFromFields = []string{
+		"from", "fra", "de", "von", "da", "van", "från", "expéditeur",
+		"发件人", "寄件者", "差出人", "보낸사람",
+	}
+	headerFields = append([]string{
+		"to", "cc", "bcc", "sent", "date", "subject", "reply-to",
+		"til", "emne", "an", "betreff", "gesendet", "para", "assunto", "asunto",
+		"risposta", "inviato", "oggetto", "destinataire", "objet", "répondre à",
+		"aan", "onderwerp", "beantwoorden", "skickat", "till", "ämne",
+		"收件人", "主题", "主旨", "主題", "收件者", "抄送", "日期", "宛先", "件名", "받는사람", "제목",
+	}, headerFromFields...)
+)
+
+// patterns are compiled on first use so the incoming-mail feature adds nothing to startup.
+var patterns = sync.OnceValue(func() (ret struct {
+	signature, attribution, separator *regexp.Regexp
+},
+) {
+	// "-- " delimiter and common mobile footers with frequent localizations. The CJK
+	// forms require a device name so ordinary prose like "发自我的内心" or "会議から送信"
+	// is not mistaken for a signature.
+	ret.signature = regexp.MustCompile(`(?i)^(--|__|—` +
+		`|sent (from|via|with) .+|get outlook for .+` +
+		`|envoyé depuis mon .+|sendt fra min .+|von meinem .+|verzonden (met|vanaf) .+` +
+		`|(發|发)自我的.*(` + cjkDevice + `).*` +
+		`|.*(` + cjkDevice + `).*(から送信|에서 보냄|傳送|发送))$`)
+
+	// attribution introducing quoted history: a line ending in a "wrote:" verb
+	// (Latin/Cyrillic or CJK), a "Name <email> wrote" line, a lead word directly
+	// followed by a day number or weekday plus a year and a time, or an ISO-date-led
+	// line. The date phrasing, trailing colon and the email before the verb guard
+	// against prose (so "On the 2024 roadmap … at 10:00" is not an attribution).
+	ret.attribution = regexp.MustCompile(`(?i)^>*\s*(` +
+		`.*[\s">'](` + wroteVerbs + `)\s*[:：]` +
+		`|.*(` + cjkWroteVerbs + `)\s*[:：]` +
+		`|.*<\S+@\S+>\s+(` + wroteVerbs + `)\b.*` +
+		`|(on|at|le|am|el|em|den|il|op|dnia|w dniu)\b[\s,]*(\d|(?:mon|tue|wed|thu|fri|sat|sun)\b).*` + yearToken + `.*` + timeToken + `.*` +
+		`|\d{4}-\d{2}-\d{2}\b.*` + timeToken + `.*` +
+		`)$`)
+
+	// a dash/underscore rule line, or text fenced by dashes such as
+	// "-------- Original Message --------" or "-----Mensaje original-----"
+	ret.separator = regexp.MustCompile(`(?i)^\s*\*?\s*([-_]{5,}|-{2,}.+-{2,}|original message|forwarded message)\s*\*?\s*$`)
+	return ret
+})
+
+// extractReply returns the user-written part of a plain-text email body, dropping
+// quoted history, the reply attribution, signatures and forwarded headers. It is a
+// slim, dependency-free reimplementation based on github.com/dimiro1/reply (MIT),
+// covering the common mail-client formats and languages; bottom posting and
+// forwarded bodies are not handled.
+func extractReply(text string) string {
+	p := patterns()
+	lines := strings.Split(util.NormalizeStringEOL(text), "\n")
+
+	// cut at the first line that begins quoted history, a signature or a header block
+	for i := range lines {
+		trimmed := strings.TrimSpace(lines[i])
+		if p.signature.MatchString(trimmed) || p.attribution.MatchString(trimmed) ||
+			p.separator.MatchString(trimmed) || headerBlock(trimmed, lines[i+1:]) {
+			lines = lines[:i]
+			break
+		}
+	}
+
+	// drop the trailing block of quoted/blank lines, unless the whole body is quoted
+	end := len(lines)
+	for end > 0 {
+		// "ᐧ" is the trailing marker some mobile clients (Mailbox) append
+		if t := strings.TrimSpace(lines[end-1]); t != "" && t != "ᐧ" && !strings.HasPrefix(t, ">") {
+			break
+		}
+		end--
+	}
+	if end > 0 {
+		lines = lines[:end]
+	}
+
+	return strings.TrimSpace(strings.Join(lines, "\n"))
+}
+
+// headerBlock reports whether a forwarded-mail header block starts here: the
+// (already-trimmed) first line is a "From" field and the next non-blank line is
+// another field, so a lone "Subject:" sentence is not a boundary.
+func headerBlock(first string, rest []string) bool {
+	if !headerLine(first, headerFromFields) {
+		return false
+	}
+	for _, next := range rest {
+		if t := strings.TrimSpace(next); t != "" {
+			return headerLine(t, headerFields)
+		}
+	}
+	return false
+}
+
+// headerLine reports whether the already-trimmed line is a "Field:" header for one
+// of fields. An ASCII colon must be followed by a space so prose like "To:do this"
+// is ignored; the CJK fullwidth colon "：" needs no space.
+func headerLine(line string, fields []string) bool {
+	lower := strings.ToLower(line)
+	for _, field := range fields {
+		if rest, ok := strings.CutPrefix(lower, field); ok &&
+			(strings.HasPrefix(rest, ": ") || strings.HasPrefix(rest, "：")) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/services/mailer/mail.go b/services/mailer/mail.go
index a08ed71480c..4bbb8b15ed0 100644
--- a/services/mailer/mail.go
+++ b/services/mailer/mail.go
@@ -16,15 +16,15 @@ import (
 	"regexp"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/typesniffer"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/typesniffer"
+	sender_service "gitea.dev/services/mailer/sender"
 
 	"golang.org/x/net/html"
 )
diff --git a/services/mailer/mail_comment.go b/services/mailer/mail_comment.go
index e8d12e429d9..2e564fcb8f1 100644
--- a/services/mailer/mail_comment.go
+++ b/services/mailer/mail_comment.go
@@ -6,12 +6,12 @@ package mailer
 import (
 	"context"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	activities_model "gitea.dev/models/activities"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 // MailParticipantsComment sends new comment emails to repository watchers and mentioned people.
diff --git a/services/mailer/mail_issue.go b/services/mailer/mail_issue.go
index b854d61a1ae..482bb3c9aca 100644
--- a/services/mailer/mail_issue.go
+++ b/services/mailer/mail_issue.go
@@ -7,15 +7,15 @@ import (
 	"context"
 	"fmt"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	activities_model "gitea.dev/models/activities"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 const MailBatchSize = 100 // batch size used in mailIssueCommentBatch
diff --git a/services/mailer/mail_issue_common.go b/services/mailer/mail_issue_common.go
index 994df6707ae..816fb864d60 100644
--- a/services/mailer/mail_issue_common.go
+++ b/services/mailer/mail_issue_common.go
@@ -12,19 +12,19 @@ import (
 	"strings"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/renderhelper"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/emoji"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
-	incoming_payload "code.gitea.io/gitea/services/mailer/incoming/payload"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
-	"code.gitea.io/gitea/services/mailer/token"
+	activities_model "gitea.dev/models/activities"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/renderhelper"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/emoji"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+	incoming_payload "gitea.dev/services/mailer/incoming/payload"
+	sender_service "gitea.dev/services/mailer/sender"
+	"gitea.dev/services/mailer/token"
 )
 
 // maxEmailBodySize is the approximate maximum size of an email body in bytes
@@ -182,7 +182,7 @@ func composeIssueCommentMessages(ctx context.Context, comment *mailComment, lang
 				if err != nil {
 					log.Error("CreateToken failed: %v", err)
 				} else {
-					replyAddress := strings.Replace(setting.IncomingEmail.ReplyToAddress, setting.IncomingEmail.TokenPlaceholder, token, 1)
+					replyAddress := strings.Replace(setting.IncomingEmail.ReplyToAddress, setting.IncomingEmailTokenPlaceholder, token, 1)
 					msg.ReplyTo = replyAddress
 					msg.SetHeader("List-Post", fmt.Sprintf("<mailto:%s>", replyAddress))
 
@@ -194,7 +194,7 @@ func composeIssueCommentMessages(ctx context.Context, comment *mailComment, lang
 			if err != nil {
 				log.Error("CreateToken failed: %v", err)
 			} else {
-				unsubAddress := strings.Replace(setting.IncomingEmail.ReplyToAddress, setting.IncomingEmail.TokenPlaceholder, token, 1)
+				unsubAddress := strings.Replace(setting.IncomingEmail.ReplyToAddress, setting.IncomingEmailTokenPlaceholder, token, 1)
 				listUnsubscribe = append(listUnsubscribe, "<mailto:"+unsubAddress+">")
 			}
 		}
diff --git a/services/mailer/mail_release.go b/services/mailer/mail_release.go
index 1f940f33dfc..db45c201007 100644
--- a/services/mailer/mail_release.go
+++ b/services/mailer/mail_release.go
@@ -9,17 +9,17 @@ import (
 	"fmt"
 	"slices"
 
-	access_model "code.gitea.io/gitea/models/perm/access"
-	"code.gitea.io/gitea/models/renderhelper"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/translation"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
+	access_model "gitea.dev/models/perm/access"
+	"gitea.dev/models/renderhelper"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/translation"
+	sender_service "gitea.dev/services/mailer/sender"
 )
 
 const tplNewReleaseMail templates.TplName = "repo/release"
diff --git a/services/mailer/mail_release_test.go b/services/mailer/mail_release_test.go
index 6fc8587f984..e71b2132b6b 100644
--- a/services/mailer/mail_release_test.go
+++ b/services/mailer/mail_release_test.go
@@ -6,12 +6,12 @@ package mailer
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	sender_service "gitea.dev/services/mailer/sender"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/mailer/mail_repo.go b/services/mailer/mail_repo.go
index b5fdfbf2e48..2631a5c6e23 100644
--- a/services/mailer/mail_repo.go
+++ b/services/mailer/mail_repo.go
@@ -8,14 +8,14 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/translation"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/translation"
+	sender_service "gitea.dev/services/mailer/sender"
 )
 
 const (
diff --git a/services/mailer/mail_team_invite.go b/services/mailer/mail_team_invite.go
index 4819f299425..6d016ae81bf 100644
--- a/services/mailer/mail_team_invite.go
+++ b/services/mailer/mail_team_invite.go
@@ -10,13 +10,13 @@ import (
 	"fmt"
 	"net/url"
 
-	org_model "code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/translation"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
+	org_model "gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/translation"
+	sender_service "gitea.dev/services/mailer/sender"
 )
 
 const tplTeamInviteMail templates.TplName = "org/team_invite"
diff --git a/services/mailer/mail_test.go b/services/mailer/mail_test.go
index caa072725a4..cbe3bb08bbe 100644
--- a/services/mailer/mail_test.go
+++ b/services/mailer/mail_test.go
@@ -16,19 +16,19 @@ import (
 	"testing"
 	texttmpl "text/template"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	activities_model "code.gitea.io/gitea/models/activities"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/services/attachment"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
+	actions_model "gitea.dev/models/actions"
+	activities_model "gitea.dev/models/activities"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/attachment"
+	sender_service "gitea.dev/services/mailer/sender"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/mailer/mail_user.go b/services/mailer/mail_user.go
index 867a8b2a8f4..504b62e00ba 100644
--- a/services/mailer/mail_user.go
+++ b/services/mailer/mail_user.go
@@ -7,13 +7,13 @@ import (
 	"bytes"
 	"fmt"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/translation"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/translation"
+	sender_service "gitea.dev/services/mailer/sender"
 )
 
 const (
diff --git a/services/mailer/mail_workflow_run.go b/services/mailer/mail_workflow_run.go
index 18c13bcc755..aa2827bfa46 100644
--- a/services/mailer/mail_workflow_run.go
+++ b/services/mailer/mail_workflow_run.go
@@ -10,16 +10,16 @@ import (
 	"sort"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/services/convert"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
+	actions_model "gitea.dev/models/actions"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/translation"
+	"gitea.dev/services/convert"
+	sender_service "gitea.dev/services/mailer/sender"
 )
 
 const tplWorkflowRun templates.TplName = "repo/actions/workflow_run"
diff --git a/services/mailer/mailer.go b/services/mailer/mailer.go
index 05dd5d85880..d697f13956b 100644
--- a/services/mailer/mailer.go
+++ b/services/mailer/mailer.go
@@ -7,13 +7,13 @@ package mailer
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/templates"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/templates"
+	sender_service "gitea.dev/services/mailer/sender"
+	notify_service "gitea.dev/services/notify"
 )
 
 var mailQueue *queue.WorkerPoolQueue[*sender_service.Message]
diff --git a/services/mailer/main_test.go b/services/mailer/main_test.go
index 5591bea02b4..1933f8ed4df 100644
--- a/services/mailer/main_test.go
+++ b/services/mailer/main_test.go
@@ -6,10 +6,10 @@ package mailer
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/mailer/notify.go b/services/mailer/notify.go
index 5921021ce82..0ec7ab0142b 100644
--- a/services/mailer/notify.go
+++ b/services/mailer/notify.go
@@ -7,14 +7,14 @@ import (
 	"context"
 	"fmt"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	activities_model "code.gitea.io/gitea/models/activities"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	issue_service "code.gitea.io/gitea/services/issue"
-	notify_service "code.gitea.io/gitea/services/notify"
+	actions_model "gitea.dev/models/actions"
+	activities_model "gitea.dev/models/activities"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	issue_service "gitea.dev/services/issue"
+	notify_service "gitea.dev/services/notify"
 )
 
 type mailNotifier struct {
diff --git a/services/mailer/sender/dummy.go b/services/mailer/sender/dummy.go
index dd5f14abec2..1400ad76017 100644
--- a/services/mailer/sender/dummy.go
+++ b/services/mailer/sender/dummy.go
@@ -7,7 +7,7 @@ import (
 	"bytes"
 	"io"
 
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/log"
 )
 
 // DummySender Sender sendmail mail sender
diff --git a/services/mailer/sender/main_test.go b/services/mailer/sender/main_test.go
index c67057964fa..bd3d5f70001 100644
--- a/services/mailer/sender/main_test.go
+++ b/services/mailer/sender/main_test.go
@@ -6,7 +6,7 @@ package sender
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/mailer/sender/message.go b/services/mailer/sender/message.go
index 55f03e4f7ec..bf22ddef112 100644
--- a/services/mailer/sender/message.go
+++ b/services/mailer/sender/message.go
@@ -10,11 +10,11 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
-	"github.com/jaytaylor/html2text"
+	"github.com/Necoro/html2text"
 	gomail "github.com/wneessen/go-mail"
 )
 
diff --git a/services/mailer/sender/message_test.go b/services/mailer/sender/message_test.go
index ae153ebf05d..441fb818e88 100644
--- a/services/mailer/sender/message_test.go
+++ b/services/mailer/sender/message_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/mailer/sender/sendmail.go b/services/mailer/sender/sendmail.go
index 7064c60f976..6f7fadc31de 100644
--- a/services/mailer/sender/sendmail.go
+++ b/services/mailer/sender/sendmail.go
@@ -9,10 +9,10 @@ import (
 	"os/exec"
 	"strings"
 
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
 )
 
 // SendmailSender Sender sendmail mail sender
diff --git a/services/mailer/sender/smtp.go b/services/mailer/sender/smtp.go
index fa07803359c..dc29c0fa832 100644
--- a/services/mailer/sender/smtp.go
+++ b/services/mailer/sender/smtp.go
@@ -14,8 +14,8 @@ import (
 	"os"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 // SMTPSender Sender SMTP mail sender
diff --git a/services/mailer/token/token.go b/services/mailer/token/token.go
index 8a5a762d6b5..de9a60dd4c7 100644
--- a/services/mailer/token/token.go
+++ b/services/mailer/token/token.go
@@ -9,10 +9,11 @@ import (
 	"crypto/sha256"
 	"encoding/base32"
 	"fmt"
+	"strings"
 	"time"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
 )
 
 // A token is a verifiable container describing an action.
@@ -73,9 +74,11 @@ func CreateToken(ht HandlerType, user *user_model.User, data []byte) (string, er
 	return encodingWithoutPadding.EncodeToString(append([]byte{tokenVersion1}, packagedData...)), nil
 }
 
-// ExtractToken extracts the action/user tuple from the token and verifies the content
-func ExtractToken(ctx context.Context, token string) (HandlerType, *user_model.User, []byte, error) {
-	data, err := encodingWithoutPadding.DecodeString(token)
+// DecodeToken decodes the handler, user and payload from the token and verifies the content
+func DecodeToken(ctx context.Context, token string) (HandlerType, *user_model.User, []byte, error) {
+	// MTAs are permitted to alter the case of the local-part (RFC 5321 §2.4), so normalize
+	// to the base32 alphabet before decoding to survive a lowercased reply-to address.
+	data, err := encodingWithoutPadding.DecodeString(strings.ToUpper(token))
 	if err != nil {
 		return UnknownHandlerType, nil, nil, err
 	}
@@ -118,11 +121,11 @@ func ExtractToken(ctx context.Context, token string) (HandlerType, *user_model.U
 	return handlerType, user, innerPayload, nil
 }
 
-// generateHmac creates a trunkated HMAC for the given payload
+// generateHmac creates a truncated HMAC for the given payload
 func generateHmac(secret, payload []byte) []byte {
 	mac := crypto_hmac.New(sha256.New, secret)
 	mac.Write(payload)
 	hmac := mac.Sum(nil)
 
-	return hmac[:10] // RFC2104 recommends not using less then 80 bits
+	return hmac[:10] // RFC2104 recommends not using less than 80 bits
 }
diff --git a/services/markup/main_test.go b/services/markup/main_test.go
index d04a18bfa17..01985034b01 100644
--- a/services/markup/main_test.go
+++ b/services/markup/main_test.go
@@ -6,7 +6,7 @@ package markup
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/markup/renderhelper.go b/services/markup/renderhelper.go
index ea494146a7b..ac94cb6e5ef 100644
--- a/services/markup/renderhelper.go
+++ b/services/markup/renderhelper.go
@@ -6,9 +6,9 @@ package markup
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/markup"
-	gitea_context "code.gitea.io/gitea/services/context"
+	"gitea.dev/models/user"
+	"gitea.dev/modules/markup"
+	gitea_context "gitea.dev/services/context"
 )
 
 func FormalRenderHelperFuncs() *markup.RenderHelperFuncs {
diff --git a/services/markup/renderhelper_codepreview.go b/services/markup/renderhelper_codepreview.go
index fd2db0d10f5..962cced1a2e 100644
--- a/services/markup/renderhelper_codepreview.go
+++ b/services/markup/renderhelper_codepreview.go
@@ -10,17 +10,17 @@ import (
 	"html/template"
 	"strings"
 
-	"code.gitea.io/gitea/models/perm/access"
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/git/languagestats"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/indexer/code"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	gitea_context "code.gitea.io/gitea/services/context"
+	"gitea.dev/models/perm/access"
+	"gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/git/languagestats"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/indexer/code"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	gitea_context "gitea.dev/services/context"
 )
 
 func renderRepoFileCodePreview(ctx context.Context, opts markup.RenderCodePreviewOptions) (template.HTML, error) {
diff --git a/services/markup/renderhelper_codepreview_test.go b/services/markup/renderhelper_codepreview_test.go
index 94ed5b418aa..954b403654d 100644
--- a/services/markup/renderhelper_codepreview_test.go
+++ b/services/markup/renderhelper_codepreview_test.go
@@ -6,11 +6,11 @@ package markup
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/markup/renderhelper_issueicontitle.go b/services/markup/renderhelper_issueicontitle.go
index 651e2997e0a..6f315951749 100644
--- a/services/markup/renderhelper_issueicontitle.go
+++ b/services/markup/renderhelper_issueicontitle.go
@@ -9,13 +9,13 @@ import (
 	"fmt"
 	"html/template"
 
-	"code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm/access"
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/htmlutil"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/util"
-	gitea_context "code.gitea.io/gitea/services/context"
+	"gitea.dev/models/issues"
+	"gitea.dev/models/perm/access"
+	"gitea.dev/models/repo"
+	"gitea.dev/modules/htmlutil"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/util"
+	gitea_context "gitea.dev/services/context"
 )
 
 func renderRepoIssueIconTitle(ctx context.Context, opts markup.RenderIssueIconTitleOptions) (_ template.HTML, err error) {
diff --git a/services/markup/renderhelper_issueicontitle_test.go b/services/markup/renderhelper_issueicontitle_test.go
index 774c340d03d..91b3f242e87 100644
--- a/services/markup/renderhelper_issueicontitle_test.go
+++ b/services/markup/renderhelper_issueicontitle_test.go
@@ -6,12 +6,12 @@ package markup
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/templates"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/templates"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/markup/renderhelper_mention_test.go b/services/markup/renderhelper_mention_test.go
index 11aa7b2132e..d4b34c2011f 100644
--- a/services/markup/renderhelper_mention_test.go
+++ b/services/markup/renderhelper_mention_test.go
@@ -8,10 +8,10 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/models/user"
-	gitea_context "code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/unittest"
+	"gitea.dev/models/user"
+	gitea_context "gitea.dev/services/context"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/migrations/_mock_data/TestGitHubDownloadRepo/GET_%2Fapi%2Fv3%2Frepos%2Fgo-gitea%2Ftest_repo b/services/migrations/_mock_data/TestGitHubDownloadRepo/GET_%2Fapi%2Fv3%2Frepos%2Fgo-gitea%2Ftest_repo
index 0c8b08ab86b..ae9a33503ff 100644
--- a/services/migrations/_mock_data/TestGitHubDownloadRepo/GET_%2Fapi%2Fv3%2Frepos%2Fgo-gitea%2Ftest_repo
+++ b/services/migrations/_mock_data/TestGitHubDownloadRepo/GET_%2Fapi%2Fv3%2Frepos%2Fgo-gitea%2Ftest_repo
@@ -21,4 +21,4 @@ X-Ratelimit-Resource: core
 X-Ratelimit-Used: 65
 X-Xss-Protection: 0
 
-{"id":220672974,"node_id":"MDEwOlJlcG9zaXRvcnkyMjA2NzI5NzQ=","name":"test_repo","full_name":"go-gitea/test_repo","private":false,"owner":{"login":"go-gitea","id":12724356,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEyNzI0MzU2","avatar_url":"https://avatars.githubusercontent.com/u/12724356?v=4","gravatar_id":"","url":"https://api.github.com/users/go-gitea","html_url":"https://github.com/go-gitea","followers_url":"https://api.github.com/users/go-gitea/followers","following_url":"https://api.github.com/users/go-gitea/following{/other_user}","gists_url":"https://api.github.com/users/go-gitea/gists{/gist_id}","starred_url":"https://api.github.com/users/go-gitea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/go-gitea/subscriptions","organizations_url":"https://api.github.com/users/go-gitea/orgs","repos_url":"https://api.github.com/users/go-gitea/repos","events_url":"https://api.github.com/users/go-gitea/events{/privacy}","received_events_url":"https://api.github.com/users/go-gitea/received_events","type":"Organization","user_view_type":"public","site_admin":false},"html_url":"https://github.com/go-gitea/test_repo","description":"Test repository for testing migration from github to gitea","fork":false,"url":"https://api.github.com/repos/go-gitea/test_repo","forks_url":"https://api.github.com/repos/go-gitea/test_repo/forks","keys_url":"https://api.github.com/repos/go-gitea/test_repo/keys{/key_id}","collaborators_url":"https://api.github.com/repos/go-gitea/test_repo/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/go-gitea/test_repo/teams","hooks_url":"https://api.github.com/repos/go-gitea/test_repo/hooks","issue_events_url":"https://api.github.com/repos/go-gitea/test_repo/issues/events{/number}","events_url":"https://api.github.com/repos/go-gitea/test_repo/events","assignees_url":"https://api.github.com/repos/go-gitea/test_repo/assignees{/user}","branches_url":"https://api.github.com/repos/go-gitea/test_repo/branches{/branch}","tags_url":"https://api.github.com/repos/go-gitea/test_repo/tags","blobs_url":"https://api.github.com/repos/go-gitea/test_repo/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/go-gitea/test_repo/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/go-gitea/test_repo/git/refs{/sha}","trees_url":"https://api.github.com/repos/go-gitea/test_repo/git/trees{/sha}","statuses_url":"https://api.github.com/repos/go-gitea/test_repo/statuses/{sha}","languages_url":"https://api.github.com/repos/go-gitea/test_repo/languages","stargazers_url":"https://api.github.com/repos/go-gitea/test_repo/stargazers","contributors_url":"https://api.github.com/repos/go-gitea/test_repo/contributors","subscribers_url":"https://api.github.com/repos/go-gitea/test_repo/subscribers","subscription_url":"https://api.github.com/repos/go-gitea/test_repo/subscription","commits_url":"https://api.github.com/repos/go-gitea/test_repo/commits{/sha}","git_commits_url":"https://api.github.com/repos/go-gitea/test_repo/git/commits{/sha}","comments_url":"https://api.github.com/repos/go-gitea/test_repo/comments{/number}","issue_comment_url":"https://api.github.com/repos/go-gitea/test_repo/issues/comments{/number}","contents_url":"https://api.github.com/repos/go-gitea/test_repo/contents/{+path}","compare_url":"https://api.github.com/repos/go-gitea/test_repo/compare/{base}...{head}","merges_url":"https://api.github.com/repos/go-gitea/test_repo/merges","archive_url":"https://api.github.com/repos/go-gitea/test_repo/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/go-gitea/test_repo/downloads","issues_url":"https://api.github.com/repos/go-gitea/test_repo/issues{/number}","pulls_url":"https://api.github.com/repos/go-gitea/test_repo/pulls{/number}","milestones_url":"https://api.github.com/repos/go-gitea/test_repo/milestones{/number}","notifications_url":"https://api.github.com/repos/go-gitea/test_repo/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/go-gitea/test_repo/labels{/name}","releases_url":"https://api.github.com/repos/go-gitea/test_repo/releases{/id}","deployments_url":"https://api.github.com/repos/go-gitea/test_repo/deployments","created_at":"2019-11-09T16:49:20Z","updated_at":"2023-03-02T14:02:26Z","pushed_at":"2019-11-12T21:54:19Z","git_url":"git://github.com/go-gitea/test_repo.git","ssh_url":"git@github.com:go-gitea/test_repo.git","clone_url":"https://github.com/go-gitea/test_repo.git","svn_url":"https://github.com/go-gitea/test_repo","homepage":null,"size":1,"stargazers_count":3,"watchers_count":3,"language":null,"has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"has_discussions":false,"forks_count":3,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":3,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"allow_forking":true,"is_template":false,"web_commit_signoff_required":false,"has_pull_requests":true,"pull_request_creation_policy":"all","topics":["gitea"],"visibility":"public","forks":3,"open_issues":3,"watchers":3,"default_branch":"master","permissions":{"admin":false,"maintain":true,"push":true,"triage":true,"pull":true},"custom_properties":{"vanta_production_branch_name":"main"},"organization":{"login":"go-gitea","id":12724356,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEyNzI0MzU2","avatar_url":"https://avatars.githubusercontent.com/u/12724356?v=4","gravatar_id":"","url":"https://api.github.com/users/go-gitea","html_url":"https://github.com/go-gitea","followers_url":"https://api.github.com/users/go-gitea/followers","following_url":"https://api.github.com/users/go-gitea/following{/other_user}","gists_url":"https://api.github.com/users/go-gitea/gists{/gist_id}","starred_url":"https://api.github.com/users/go-gitea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/go-gitea/subscriptions","organizations_url":"https://api.github.com/users/go-gitea/orgs","repos_url":"https://api.github.com/users/go-gitea/repos","events_url":"https://api.github.com/users/go-gitea/events{/privacy}","received_events_url":"https://api.github.com/users/go-gitea/received_events","type":"Organization","user_view_type":"public","site_admin":false},"network_count":3,"subscribers_count":4}
\ No newline at end of file
+{"id":220672974,"node_id":"MDEwOlJlcG9zaXRvcnkyMjA2NzI5NzQ=","name":"test_repo","full_name":"go-gitea/test_repo","private":false,"owner":{"login":"go-gitea","id":12724356,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEyNzI0MzU2","avatar_url":"https://avatars.githubusercontent.com/u/12724356?v=4","gravatar_id":"","url":"https://api.github.com/users/go-gitea","html_url":"https://github.com/go-gitea","followers_url":"https://api.github.com/users/go-gitea/followers","following_url":"https://api.github.com/users/go-gitea/following{/other_user}","gists_url":"https://api.github.com/users/go-gitea/gists{/gist_id}","starred_url":"https://api.github.com/users/go-gitea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/go-gitea/subscriptions","organizations_url":"https://api.github.com/users/go-gitea/orgs","repos_url":"https://api.github.com/users/go-gitea/repos","events_url":"https://api.github.com/users/go-gitea/events{/privacy}","received_events_url":"https://api.github.com/users/go-gitea/received_events","type":"Organization","user_view_type":"public","site_admin":false},"html_url":"https://github.com/go-gitea/test_repo","description":"Test repository for testing migration from github to gitea","fork":false,"url":"https://api.github.com/repos/go-gitea/test_repo","forks_url":"https://api.github.com/repos/go-gitea/test_repo/forks","keys_url":"https://api.github.com/repos/go-gitea/test_repo/keys{/key_id}","collaborators_url":"https://api.github.com/repos/go-gitea/test_repo/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/go-gitea/test_repo/teams","hooks_url":"https://api.github.com/repos/go-gitea/test_repo/hooks","issue_events_url":"https://api.github.com/repos/go-gitea/test_repo/issues/events{/number}","events_url":"https://api.github.com/repos/go-gitea/test_repo/events","assignees_url":"https://api.github.com/repos/go-gitea/test_repo/assignees{/user}","branches_url":"https://api.github.com/repos/go-gitea/test_repo/branches{/branch}","tags_url":"https://api.github.com/repos/go-gitea/test_repo/tags","blobs_url":"https://api.github.com/repos/go-gitea/test_repo/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/go-gitea/test_repo/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/go-gitea/test_repo/git/refs{/sha}","trees_url":"https://api.github.com/repos/go-gitea/test_repo/git/trees{/sha}","statuses_url":"https://api.github.com/repos/go-gitea/test_repo/statuses/{sha}","languages_url":"https://api.github.com/repos/go-gitea/test_repo/languages","stargazers_url":"https://api.github.com/repos/go-gitea/test_repo/stargazers","contributors_url":"https://api.github.com/repos/go-gitea/test_repo/contributors","subscribers_url":"https://api.github.com/repos/go-gitea/test_repo/subscribers","subscription_url":"https://api.github.com/repos/go-gitea/test_repo/subscription","commits_url":"https://api.github.com/repos/go-gitea/test_repo/commits{/sha}","git_commits_url":"https://api.github.com/repos/go-gitea/test_repo/git/commits{/sha}","comments_url":"https://api.github.com/repos/go-gitea/test_repo/comments{/number}","issue_comment_url":"https://api.github.com/repos/go-gitea/test_repo/issues/comments{/number}","contents_url":"https://api.github.com/repos/go-gitea/test_repo/contents/{+path}","compare_url":"https://api.github.com/repos/go-gitea/test_repo/compare/{base}...{head}","merges_url":"https://api.github.com/repos/go-gitea/test_repo/merges","archive_url":"https://api.github.com/repos/go-gitea/test_repo/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/go-gitea/test_repo/downloads","issues_url":"https://api.github.com/repos/go-gitea/test_repo/issues{/number}","pulls_url":"https://api.github.com/repos/go-gitea/test_repo/pulls{/number}","milestones_url":"https://api.github.com/repos/go-gitea/test_repo/milestones{/number}","notifications_url":"https://api.github.com/repos/go-gitea/test_repo/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/go-gitea/test_repo/labels{/name}","releases_url":"https://api.github.com/repos/go-gitea/test_repo/releases{/id}","deployments_url":"https://api.github.com/repos/go-gitea/test_repo/deployments","created_at":"2019-11-09T16:49:20Z","updated_at":"2023-03-02T14:02:26Z","pushed_at":"2019-11-12T21:54:19Z","git_url":"git://github.com/go-gitea/test_repo.git","ssh_url":"git@github.com:go-gitea/test_repo.git","clone_url":"https://github.com/go-gitea/test_repo.git","svn_url":"https://github.com/go-gitea/test_repo","homepage":"https://gitea.com/test-repo","size":1,"stargazers_count":3,"watchers_count":3,"language":null,"has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"has_discussions":false,"forks_count":3,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":3,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"allow_forking":true,"is_template":false,"web_commit_signoff_required":false,"has_pull_requests":true,"pull_request_creation_policy":"all","topics":["gitea"],"visibility":"public","forks":3,"open_issues":3,"watchers":3,"default_branch":"master","permissions":{"admin":false,"maintain":true,"push":true,"triage":true,"pull":true},"custom_properties":{"vanta_production_branch_name":"main"},"organization":{"login":"go-gitea","id":12724356,"node_id":"MDEyOk9yZ2FuaXphdGlvbjEyNzI0MzU2","avatar_url":"https://avatars.githubusercontent.com/u/12724356?v=4","gravatar_id":"","url":"https://api.github.com/users/go-gitea","html_url":"https://github.com/go-gitea","followers_url":"https://api.github.com/users/go-gitea/followers","following_url":"https://api.github.com/users/go-gitea/following{/other_user}","gists_url":"https://api.github.com/users/go-gitea/gists{/gist_id}","starred_url":"https://api.github.com/users/go-gitea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/go-gitea/subscriptions","organizations_url":"https://api.github.com/users/go-gitea/orgs","repos_url":"https://api.github.com/users/go-gitea/repos","events_url":"https://api.github.com/users/go-gitea/events{/privacy}","received_events_url":"https://api.github.com/users/go-gitea/received_events","type":"Organization","user_view_type":"public","site_admin":false},"network_count":3,"subscribers_count":4}
\ No newline at end of file
diff --git a/services/migrations/_mock_data/TestGiteaDownloadRepo/GET_%2Fapi%2Fv1%2Frepos%2Fgitea%2Ftest_repo b/services/migrations/_mock_data/TestGiteaDownloadRepo/GET_%2Fapi%2Fv1%2Frepos%2Fgitea%2Ftest_repo
index 6f40be01f7e..b824ab27be3 100644
--- a/services/migrations/_mock_data/TestGiteaDownloadRepo/GET_%2Fapi%2Fv1%2Frepos%2Fgitea%2Ftest_repo
+++ b/services/migrations/_mock_data/TestGiteaDownloadRepo/GET_%2Fapi%2Fv1%2Frepos%2Fgitea%2Ftest_repo
@@ -4,4 +4,4 @@ Content-Type: application/json;charset=utf-8
 Vary: Origin
 X-Content-Type-Options: nosniff
 
-{"id":16268,"owner":{"id":3,"login":"gitea","login_name":"","source_id":0,"full_name":"","email":"","avatar_url":"https://gitea.com/avatars/35dea380390772b3130aafbac7ca49e6","html_url":"https://gitea.com/gitea","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2018-11-29T03:16:17Z","restricted":false,"active":false,"prohibit_login":false,"location":"Git Universe","website":"https://gitea.com","description":"Git with a cup of tea","visibility":"public","followers_count":100,"following_count":0,"starred_repos_count":0,"username":"gitea"},"name":"test_repo","full_name":"gitea/test_repo","description":"Test repository for testing migration from gitea to gitea","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":68,"language":"","languages_url":"https://gitea.com/api/v1/repos/gitea/test_repo/languages","html_url":"https://gitea.com/gitea/test_repo","url":"https://gitea.com/api/v1/repos/gitea/test_repo","link":"","ssh_url":"git@gitea.com:gitea/test_repo.git","clone_url":"https://gitea.com/gitea/test_repo.git","original_url":"","website":"","stars_count":1,"forks_count":2,"watchers_count":10,"open_issues_count":2,"open_pr_counter":2,"release_counter":2,"default_branch":"master","archived":false,"created_at":"2020-09-01T00:12:27Z","updated_at":"2020-09-01T18:03:41Z","archived_at":"1970-01-01T00:00:00Z","permissions":{"admin":false,"push":false,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"","has_releases":true,"has_packages":false,"has_actions":false,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":false,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":false,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":["gitea","test","migration","ci"],"licenses":[]}
\ No newline at end of file
+{"id":16268,"owner":{"id":3,"login":"gitea","login_name":"","source_id":0,"full_name":"","email":"","avatar_url":"https://gitea.com/avatars/35dea380390772b3130aafbac7ca49e6","html_url":"https://gitea.com/gitea","language":"","is_admin":false,"last_login":"0001-01-01T00:00:00Z","created":"2018-11-29T03:16:17Z","restricted":false,"active":false,"prohibit_login":false,"location":"Git Universe","website":"https://gitea.com","description":"Git with a cup of tea","visibility":"public","followers_count":100,"following_count":0,"starred_repos_count":0,"username":"gitea"},"name":"test_repo","full_name":"gitea/test_repo","description":"Test repository for testing migration from gitea to gitea","empty":false,"private":false,"fork":false,"template":false,"mirror":false,"size":68,"language":"","languages_url":"https://gitea.com/api/v1/repos/gitea/test_repo/languages","html_url":"https://gitea.com/gitea/test_repo","url":"https://gitea.com/api/v1/repos/gitea/test_repo","link":"","ssh_url":"git@gitea.com:gitea/test_repo.git","clone_url":"https://gitea.com/gitea/test_repo.git","original_url":"","website":"https://gitea.com/test-repo","stars_count":1,"forks_count":2,"watchers_count":10,"open_issues_count":2,"open_pr_counter":2,"release_counter":2,"default_branch":"master","archived":false,"created_at":"2020-09-01T00:12:27Z","updated_at":"2020-09-01T18:03:41Z","archived_at":"1970-01-01T00:00:00Z","permissions":{"admin":false,"push":false,"pull":true},"has_code":true,"has_issues":true,"internal_tracker":{"enable_time_tracker":true,"allow_only_contributors_to_track_time":true,"enable_issue_dependencies":true},"has_wiki":true,"has_pull_requests":true,"has_projects":true,"projects_mode":"","has_releases":true,"has_packages":false,"has_actions":false,"ignore_whitespace_conflicts":false,"allow_merge_commits":true,"allow_rebase":true,"allow_rebase_explicit":true,"allow_squash_merge":true,"allow_fast_forward_only_merge":false,"allow_rebase_update":true,"allow_manual_merge":false,"autodetect_manual_merge":false,"default_delete_branch_after_merge":false,"default_merge_style":"merge","default_allow_maintainer_edit":false,"avatar_url":"","internal":false,"mirror_interval":"","object_format_name":"sha1","mirror_updated":"0001-01-01T00:00:00Z","topics":["gitea","test","migration","ci"],"licenses":[]}
\ No newline at end of file
diff --git a/services/migrations/codebase.go b/services/migrations/codebase.go
index 240c7bcdc9e..97c6cfe7aa5 100644
--- a/services/migrations/codebase.go
+++ b/services/migrations/codebase.go
@@ -13,10 +13,10 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/proxy"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/proxy"
+	"gitea.dev/modules/structs"
 )
 
 var (
diff --git a/services/migrations/codebase_test.go b/services/migrations/codebase_test.go
index ae198b78c7e..4e8f6f830ee 100644
--- a/services/migrations/codebase_test.go
+++ b/services/migrations/codebase_test.go
@@ -11,8 +11,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/unittest"
-	base "code.gitea.io/gitea/modules/migration"
+	"gitea.dev/models/unittest"
+	base "gitea.dev/modules/migration"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/migrations/codecommit.go b/services/migrations/codecommit.go
index 188280273f7..2c2019470ac 100644
--- a/services/migrations/codecommit.go
+++ b/services/migrations/codecommit.go
@@ -10,10 +10,10 @@ import (
 	"strconv"
 	"strings"
 
-	git_module "code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/structs"
+	git_module "gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/structs"
 
 	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/codecommit"
diff --git a/services/migrations/common.go b/services/migrations/common.go
index d88518899d0..e9895d00c2b 100644
--- a/services/migrations/common.go
+++ b/services/migrations/common.go
@@ -7,10 +7,10 @@ import (
 	"fmt"
 	"strings"
 
-	system_model "code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
+	system_model "gitea.dev/models/system"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
 )
 
 // WarnAndNotice will log the provided message and send a repository notice
diff --git a/services/migrations/dump.go b/services/migrations/dump.go
index eb0367e9f94..949f2e79b85 100644
--- a/services/migrations/dump.go
+++ b/services/migrations/dump.go
@@ -16,17 +16,17 @@ import (
 	"strings"
 	"time"
 
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
 
 	"github.com/google/uuid"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 var _ base.Uploader = &RepositoryDumper{}
@@ -115,6 +115,7 @@ func (g *RepositoryDumper) CreateRepo(ctx context.Context, repo *base.Repository
 		"name":         repo.Name,
 		"owner":        repo.Owner,
 		"description":  repo.Description,
+		"website":      repo.Website,
 		"clone_addr":   opts.CloneAddr,
 		"original_url": repo.OriginalURL,
 		"is_private":   opts.Private,
diff --git a/services/migrations/error.go b/services/migrations/error.go
index db9b6b4c1e2..2dd5540f0ec 100644
--- a/services/migrations/error.go
+++ b/services/migrations/error.go
@@ -7,7 +7,7 @@ package migrations
 import (
 	"errors"
 
-	"github.com/google/go-github/v84/github"
+	"github.com/google/go-github/v88/github"
 )
 
 // ErrRepoNotCreated returns the error that repository not created
diff --git a/services/migrations/git.go b/services/migrations/git.go
index 1ed99499a16..c9b5eaaf840 100644
--- a/services/migrations/git.go
+++ b/services/migrations/git.go
@@ -6,7 +6,7 @@ package migrations
 import (
 	"context"
 
-	base "code.gitea.io/gitea/modules/migration"
+	base "gitea.dev/modules/migration"
 )
 
 var _ base.Downloader = &PlainGitDownloader{}
diff --git a/services/migrations/gitbucket.go b/services/migrations/gitbucket.go
index 4fe9e30a39c..026fa3c12b8 100644
--- a/services/migrations/gitbucket.go
+++ b/services/migrations/gitbucket.go
@@ -9,9 +9,9 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/structs"
 )
 
 var (
@@ -43,7 +43,7 @@ func (f *GitBucketDownloaderFactory) New(ctx context.Context, opts base.MigrateO
 	oldName := strings.TrimSuffix(fields[len(fields)-1], ".git")
 
 	log.Trace("Create GitBucket downloader. BaseURL: %s RepoOwner: %s RepoName: %s", baseURL, oldOwner, oldName)
-	return NewGitBucketDownloader(ctx, baseURL, opts.AuthUsername, opts.AuthPassword, opts.AuthToken, oldOwner, oldName), nil
+	return NewGitBucketDownloader(ctx, baseURL, opts.AuthUsername, opts.AuthPassword, opts.AuthToken, oldOwner, oldName)
 }
 
 // GitServiceType returns the type of git service
@@ -70,8 +70,11 @@ func (g *GitBucketDownloader) LogString() string {
 }
 
 // NewGitBucketDownloader creates a GitBucket downloader
-func NewGitBucketDownloader(ctx context.Context, baseURL, userName, password, token, repoOwner, repoName string) *GitBucketDownloader {
-	githubDownloader := NewGithubDownloaderV3(ctx, baseURL, userName, password, token, repoOwner, repoName)
+func NewGitBucketDownloader(ctx context.Context, baseURL, userName, password, token, repoOwner, repoName string) (*GitBucketDownloader, error) {
+	githubDownloader, err := NewGithubDownloaderV3(ctx, baseURL, userName, password, token, repoOwner, repoName)
+	if err != nil {
+		return nil, err
+	}
 	// Gitbucket 4.40 uses different internal hard-coded perPage values.
 	// Issues, PRs, and other major parts use 25.  Release page uses 10.
 	// Some API doesn't support paging yet.  Sounds difficult, but using
@@ -81,7 +84,7 @@ func NewGitBucketDownloader(ctx context.Context, baseURL, userName, password, to
 	githubDownloader.SkipReviews = true
 	return &GitBucketDownloader{
 		githubDownloader,
-	}
+	}, nil
 }
 
 // SupportGetRepoComments return true if it supports get repo comments
diff --git a/services/migrations/gitea_downloader.go b/services/migrations/gitea_downloader.go
index 5609e326301..c754d700903 100644
--- a/services/migrations/gitea_downloader.go
+++ b/services/migrations/gitea_downloader.go
@@ -13,11 +13,10 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/structs"
-
-	gitea_sdk "code.gitea.io/sdk/gitea"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/structs"
+	gitea_sdk "gitea.dev/sdk"
 )
 
 var (
@@ -67,6 +66,7 @@ func (f *GiteaDownloaderFactory) GitServiceType() structs.GitServiceType {
 // GiteaDownloader implements a Downloader interface to get repository information's
 type GiteaDownloader struct {
 	base.NullDownloader
+	ctx        context.Context
 	client     *gitea_sdk.Client
 	baseURL    string
 	repoOwner  string
@@ -84,7 +84,6 @@ func NewGiteaDownloader(ctx context.Context, baseURL, repoPath, username, passwo
 		baseURL,
 		gitea_sdk.SetToken(token),
 		gitea_sdk.SetBasicAuth(username, password),
-		gitea_sdk.SetContext(ctx),
 		gitea_sdk.SetHTTPClient(NewMigrationHTTPClient()),
 	)
 	if err != nil {
@@ -95,7 +94,7 @@ func NewGiteaDownloader(ctx context.Context, baseURL, repoPath, username, passwo
 	path := strings.Split(repoPath, "/")
 
 	paginationSupport := true
-	if err = giteaClient.CheckServerVersionConstraint(">=1.12"); err != nil {
+	if err = giteaClient.CheckServerVersionConstraint(ctx, ">=1.12"); err != nil {
 		paginationSupport = false
 	}
 
@@ -103,7 +102,7 @@ func NewGiteaDownloader(ctx context.Context, baseURL, repoPath, username, passwo
 	// (default would be 50 but this can differ)
 	maxPerPage := 10
 	// gitea instances >=1.13 can tell us what maximum they have
-	apiConf, _, err := giteaClient.GetGlobalAPISettings()
+	apiConf, _, err := giteaClient.Settings.GetGlobalAPISettings(ctx)
 	if err != nil {
 		log.Info("Unable to get global API settings. Ignoring these.")
 		log.Debug("giteaClient.GetGlobalAPISettings. Error: %v", err)
@@ -113,6 +112,7 @@ func NewGiteaDownloader(ctx context.Context, baseURL, repoPath, username, passwo
 	}
 
 	return &GiteaDownloader{
+		ctx:        ctx,
 		client:     giteaClient,
 		baseURL:    baseURL,
 		repoOwner:  path[0],
@@ -140,7 +140,7 @@ func (g *GiteaDownloader) GetRepoInfo(_ context.Context) (*base.Repository, erro
 		return nil, errors.New("error: GiteaDownloader is nil")
 	}
 
-	repo, _, err := g.client.GetRepo(g.repoOwner, g.repoName)
+	repo, _, err := g.client.Repositories.GetRepo(g.ctx, g.repoOwner, g.repoName)
 	if err != nil {
 		return nil, err
 	}
@@ -150,6 +150,7 @@ func (g *GiteaDownloader) GetRepoInfo(_ context.Context) (*base.Repository, erro
 		Owner:         repo.Owner.UserName,
 		IsPrivate:     repo.Private,
 		Description:   repo.Description,
+		Website:       repo.Website,
 		CloneURL:      repo.CloneURL,
 		OriginalURL:   repo.HTMLURL,
 		DefaultBranch: repo.DefaultBranch,
@@ -158,7 +159,7 @@ func (g *GiteaDownloader) GetRepoInfo(_ context.Context) (*base.Repository, erro
 
 // GetTopics return gitea topics
 func (g *GiteaDownloader) GetTopics(_ context.Context) ([]string, error) {
-	topics, _, err := g.client.ListRepoTopics(g.repoOwner, g.repoName, gitea_sdk.ListRepoTopicsOptions{})
+	topics, _, err := g.client.Repositories.ListRepoTopics(g.ctx, g.repoOwner, g.repoName, gitea_sdk.ListRepoTopicsOptions{})
 	return topics, err
 }
 
@@ -174,7 +175,7 @@ func (g *GiteaDownloader) GetMilestones(ctx context.Context) ([]*base.Milestone,
 		default:
 		}
 
-		ms, _, err := g.client.ListRepoMilestones(g.repoOwner, g.repoName, gitea_sdk.ListMilestoneOption{
+		ms, _, err := g.client.Repositories.ListMilestones(g.ctx, g.repoOwner, g.repoName, gitea_sdk.ListMilestoneOption{
 			ListOptions: gitea_sdk.ListOptions{
 				PageSize: g.maxPerPage,
 				Page:     i,
@@ -239,7 +240,7 @@ func (g *GiteaDownloader) GetLabels(ctx context.Context) ([]*base.Label, error)
 		default:
 		}
 
-		ls, _, err := g.client.ListRepoLabels(g.repoOwner, g.repoName, gitea_sdk.ListLabelsOptions{ListOptions: gitea_sdk.ListOptions{
+		ls, _, err := g.client.Repositories.ListRepoLabels(g.ctx, g.repoOwner, g.repoName, gitea_sdk.ListLabelsOptions{ListOptions: gitea_sdk.ListOptions{
 			PageSize: g.maxPerPage,
 			Page:     i,
 		}})
@@ -287,7 +288,7 @@ func (g *GiteaDownloader) convertGiteaRelease(rel *gitea_sdk.Release) *base.Rele
 			Created:       asset.Created,
 			DownloadURL:   &asset.DownloadURL,
 			DownloadFunc: func() (io.ReadCloser, error) {
-				asset, _, err := g.client.GetReleaseAttachment(g.repoOwner, g.repoName, rel.ID, assetID)
+				asset, _, err := g.client.Releases.GetReleaseAttachment(g.ctx, g.repoOwner, g.repoName, rel.ID, assetID)
 				if err != nil {
 					return nil, err
 				}
@@ -327,7 +328,7 @@ func (g *GiteaDownloader) GetReleases(ctx context.Context) ([]*base.Release, err
 		default:
 		}
 
-		rl, _, err := g.client.ListReleases(g.repoOwner, g.repoName, gitea_sdk.ListReleasesOptions{ListOptions: gitea_sdk.ListOptions{
+		rl, _, err := g.client.Releases.ListReleases(g.ctx, g.repoOwner, g.repoName, gitea_sdk.ListReleasesOptions{ListOptions: gitea_sdk.ListOptions{
 			PageSize: g.maxPerPage,
 			Page:     i,
 		}})
@@ -346,7 +347,7 @@ func (g *GiteaDownloader) GetReleases(ctx context.Context) ([]*base.Release, err
 }
 
 func (g *GiteaDownloader) getIssueReactions(ctx context.Context, index int64) ([]*base.Reaction, error) {
-	if err := g.client.CheckServerVersionConstraint(">=1.11"); err != nil {
+	if err := g.client.CheckServerVersionConstraint(g.ctx, ">=1.11"); err != nil {
 		log.Info("GiteaDownloader: instance to old, skip getIssueReactions")
 		return nil, nil
 	}
@@ -361,7 +362,7 @@ func (g *GiteaDownloader) getIssueReactions(ctx context.Context, index int64) ([
 		default:
 		}
 
-		reactions, _, err := g.client.ListIssueReactions(g.repoOwner, g.repoName, index, gitea_sdk.ListIssueReactionsOptions{ListOptions: gitea_sdk.ListOptions{
+		reactions, _, err := g.client.Issues.ListIssueReactions(g.ctx, g.repoOwner, g.repoName, index, gitea_sdk.ListIssueReactionsOptions{ListOptions: gitea_sdk.ListOptions{
 			PageSize: g.maxPerPage,
 			Page:     i,
 		}})
@@ -386,11 +387,11 @@ func (g *GiteaDownloader) getIssueReactions(ctx context.Context, index int64) ([
 
 func (g *GiteaDownloader) getCommentReactions(commentID int64) ([]*base.Reaction, error) {
 	var reactions []*base.Reaction
-	if err := g.client.CheckServerVersionConstraint(">=1.11"); err != nil {
+	if err := g.client.CheckServerVersionConstraint(g.ctx, ">=1.11"); err != nil {
 		log.Info("GiteaDownloader: instance to old, skip getCommentReactions")
 		return reactions, nil
 	}
-	rl, _, err := g.client.GetIssueCommentReactions(g.repoOwner, g.repoName, commentID)
+	rl, _, err := g.client.Issues.GetIssueCommentReactions(g.ctx, g.repoOwner, g.repoName, commentID)
 	if err != nil {
 		return nil, err
 	}
@@ -412,7 +413,7 @@ func (g *GiteaDownloader) GetIssues(ctx context.Context, page, perPage int) ([]*
 	}
 	allIssues := make([]*base.Issue, 0, perPage)
 
-	issues, _, err := g.client.ListRepoIssues(g.repoOwner, g.repoName, gitea_sdk.ListIssueOption{
+	issues, _, err := g.client.Issues.ListRepoIssues(g.ctx, g.repoOwner, g.repoName, gitea_sdk.ListIssueOption{
 		ListOptions: gitea_sdk.ListOptions{Page: page, PageSize: perPage},
 		State:       gitea_sdk.StateAll,
 		Type:        gitea_sdk.IssueTypeIssue,
@@ -480,7 +481,7 @@ func (g *GiteaDownloader) GetComments(ctx context.Context, commentable base.Comm
 		default:
 		}
 
-		comments, _, err := g.client.ListIssueComments(g.repoOwner, g.repoName, commentable.GetForeignIndex(), gitea_sdk.ListIssueCommentOptions{ListOptions: gitea_sdk.ListOptions{
+		comments, _, err := g.client.Issues.ListIssueComments(g.ctx, g.repoOwner, g.repoName, commentable.GetForeignIndex(), gitea_sdk.ListIssueCommentOptions{ListOptions: gitea_sdk.ListOptions{
 			PageSize: g.maxPerPage,
 			Page:     i,
 		}})
@@ -521,7 +522,7 @@ func (g *GiteaDownloader) GetPullRequests(ctx context.Context, page, perPage int
 	}
 	allPRs := make([]*base.PullRequest, 0, perPage)
 
-	prs, _, err := g.client.ListRepoPullRequests(g.repoOwner, g.repoName, gitea_sdk.ListPullRequestsOptions{
+	prs, _, err := g.client.PullRequests.ListRepoPullRequests(g.ctx, g.repoOwner, g.repoName, gitea_sdk.ListPullRequestsOptions{
 		ListOptions: gitea_sdk.ListOptions{
 			Page:     page,
 			PageSize: perPage,
@@ -636,7 +637,7 @@ func (g *GiteaDownloader) GetPullRequests(ctx context.Context, page, perPage int
 
 // GetReviews returns pull requests review
 func (g *GiteaDownloader) GetReviews(ctx context.Context, reviewable base.Reviewable) ([]*base.Review, error) {
-	if err := g.client.CheckServerVersionConstraint(">=1.12"); err != nil {
+	if err := g.client.CheckServerVersionConstraint(g.ctx, ">=1.12"); err != nil {
 		log.Info("GiteaDownloader: instance to old, skip GetReviews")
 		return nil, nil
 	}
@@ -651,7 +652,7 @@ func (g *GiteaDownloader) GetReviews(ctx context.Context, reviewable base.Review
 		default:
 		}
 
-		prl, _, err := g.client.ListPullReviews(g.repoOwner, g.repoName, reviewable.GetForeignIndex(), gitea_sdk.ListPullReviewsOptions{ListOptions: gitea_sdk.ListOptions{
+		prl, _, err := g.client.PullRequests.ListPullReviews(g.ctx, g.repoOwner, g.repoName, reviewable.GetForeignIndex(), gitea_sdk.ListPullReviewsOptions{ListOptions: gitea_sdk.ListOptions{
 			Page:     i,
 			PageSize: g.maxPerPage,
 		}})
@@ -666,7 +667,7 @@ func (g *GiteaDownloader) GetReviews(ctx context.Context, reviewable base.Review
 				continue
 			}
 
-			rcl, _, err := g.client.ListPullReviewComments(g.repoOwner, g.repoName, reviewable.GetForeignIndex(), pr.ID)
+			rcl, _, err := g.client.PullRequests.ListPullReviewComments(g.ctx, g.repoOwner, g.repoName, reviewable.GetForeignIndex(), pr.ID)
 			if err != nil {
 				return nil, err
 			}
diff --git a/services/migrations/gitea_downloader_test.go b/services/migrations/gitea_downloader_test.go
index d604ebdfbd5..e65aa024ee2 100644
--- a/services/migrations/gitea_downloader_test.go
+++ b/services/migrations/gitea_downloader_test.go
@@ -11,8 +11,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/unittest"
-	base "code.gitea.io/gitea/modules/migration"
+	"gitea.dev/models/unittest"
+	base "gitea.dev/modules/migration"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -38,6 +38,7 @@ func TestGiteaDownloadRepo(t *testing.T) {
 		Owner:         "gitea",
 		IsPrivate:     false,
 		Description:   "Test repository for testing migration from gitea to gitea",
+		Website:       mockServer.URL + "/test-repo",
 		CloneURL:      mockServer.URL + "/gitea/test_repo.git",
 		OriginalURL:   mockServer.URL + "/gitea/test_repo",
 		DefaultBranch: "master",
diff --git a/services/migrations/gitea_uploader.go b/services/migrations/gitea_uploader.go
index af9a0e0eaf6..d195d69e1e8 100644
--- a/services/migrations/gitea_uploader.go
+++ b/services/migrations/gitea_uploader.go
@@ -6,32 +6,33 @@ package migrations
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"strconv"
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/label"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/uri"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/pull"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/label"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/uri"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/pull"
+	repo_service "gitea.dev/services/repository"
 
 	"github.com/google/uuid"
 )
@@ -101,6 +102,7 @@ func (g *GiteaLocalUploader) CreateRepo(ctx context.Context, repo *base.Reposito
 		r, err = repo_service.CreateRepositoryDirectly(ctx, g.doer, owner, repo_service.CreateRepoOptions{
 			Name:           g.repoName,
 			Description:    repo.Description,
+			Website:        repo.Website,
 			OriginalURL:    repo.OriginalURL,
 			GitServiceType: opts.GitServiceType,
 			IsPrivate:      opts.Private || setting.Repository.ForcePrivate,
@@ -115,6 +117,7 @@ func (g *GiteaLocalUploader) CreateRepo(ctx context.Context, repo *base.Reposito
 	}
 	r.DefaultBranch = repo.DefaultBranch
 	r.Description = repo.Description
+	r.Website = repo.Website
 
 	r, err = repo_service.MigrateRepositoryGitData(ctx, owner, r, base.MigrateOptions{
 		RepoName:       g.repoName,
@@ -987,12 +990,15 @@ func (g *GiteaLocalUploader) remapUser(ctx context.Context, source user_model.Ex
 func (g *GiteaLocalUploader) remapLocalUser(ctx context.Context, source user_model.ExternalUserMigrated) (int64, error) {
 	userid, ok := g.userMap[source.GetExternalID()]
 	if !ok {
-		name, err := user_model.GetUserNameByID(ctx, source.GetExternalID())
-		if err != nil {
+		user, err := user_model.GetUserByID(ctx, source.GetExternalID())
+		if errors.Is(err, util.ErrNotExist) {
+			g.userMap[source.GetExternalID()] = userid
+			return 0, nil
+		} else if err != nil {
 			return 0, err
 		}
-		// let's not reuse an ID when the user was deleted or has a different user name
-		if name != source.GetExternalName() {
+		// let's not reuse an ID when the user was deleted or has a different username
+		if !util.AsciiEqualFold(user.Name, source.GetExternalName()) {
 			userid = 0
 		} else {
 			userid = source.GetExternalID()
diff --git a/services/migrations/gitea_uploader_test.go b/services/migrations/gitea_uploader_test.go
index 0b9f0eb9964..ce6b177a261 100644
--- a/services/migrations/gitea_uploader_test.go
+++ b/services/migrations/gitea_uploader_test.go
@@ -9,18 +9,19 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/graceful"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/structs"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/graceful"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/structs"
+	repo_service "gitea.dev/services/repository"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestGiteaUploadRepo(t *testing.T) {
@@ -31,14 +32,15 @@ func TestGiteaUploadRepo(t *testing.T) {
 
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
 
+	ctx := t.Context()
+	downloader, err := NewGithubDownloaderV3(ctx, "https://github.com", "", "", "", "go-xorm", "builder")
+	require.NoError(t, err)
 	var (
-		ctx        = t.Context()
-		downloader = NewGithubDownloaderV3(ctx, "https://github.com", "", "", "", "go-xorm", "builder")
-		repoName   = "builder-" + time.Now().Format("2006-01-02-15-04-05")
-		uploader   = NewGiteaLocalUploader(graceful.GetManager().HammerContext(), user, user.Name, repoName)
+		repoName = "builder-" + time.Now().Format("2006-01-02-15-04-05")
+		uploader = NewGiteaLocalUploader(graceful.GetManager().HammerContext(), user, user.Name, repoName)
 	)
 
-	err := migrateRepository(t.Context(), user, downloader, uploader, base.MigrateOptions{
+	err = migrateRepository(t.Context(), user, downloader, uploader, base.MigrateOptions{
 		CloneAddr:    "https://github.com/go-xorm/builder",
 		RepoName:     repoName,
 		AuthUsername: "",
diff --git a/services/migrations/github.go b/services/migrations/github.go
index 91e6b78ff79..b8bf6aee453 100644
--- a/services/migrations/github.go
+++ b/services/migrations/github.go
@@ -14,13 +14,13 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/proxy"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/proxy"
+	"gitea.dev/modules/structs"
 
-	"github.com/google/go-github/v84/github"
+	"github.com/google/go-github/v88/github"
 	"golang.org/x/oauth2"
 )
 
@@ -52,7 +52,7 @@ func (f *GithubDownloaderV3Factory) New(ctx context.Context, opts base.MigrateOp
 
 	log.Trace("Create github downloader BaseURL: %s %s/%s", baseURL, oldOwner, oldName)
 
-	return NewGithubDownloaderV3(ctx, baseURL, opts.AuthUsername, opts.AuthPassword, opts.AuthToken, oldOwner, oldName), nil
+	return NewGithubDownloaderV3(ctx, baseURL, opts.AuthUsername, opts.AuthPassword, opts.AuthToken, oldOwner, oldName)
 }
 
 // GitServiceType returns the type of git service
@@ -78,7 +78,7 @@ type GithubDownloaderV3 struct {
 }
 
 // NewGithubDownloaderV3 creates a github Downloader via github v3 API
-func NewGithubDownloaderV3(_ context.Context, baseURL, userName, password, token, repoOwner, repoName string) *GithubDownloaderV3 {
+func NewGithubDownloaderV3(_ context.Context, baseURL, userName, password, token, repoOwner, repoName string) (*GithubDownloaderV3, error) {
 	downloader := GithubDownloaderV3{
 		userName:   userName,
 		baseURL:    baseURL,
@@ -102,7 +102,9 @@ func NewGithubDownloaderV3(_ context.Context, baseURL, userName, password, token
 				},
 			}
 
-			downloader.addClient(client, baseURL)
+			if err := downloader.addClient(client, baseURL); err != nil {
+				return nil, err
+			}
 		}
 	} else {
 		transport := NewMigrationHTTPTransport()
@@ -113,9 +115,11 @@ func NewGithubDownloaderV3(_ context.Context, baseURL, userName, password, token
 		client := &http.Client{
 			Transport: transport,
 		}
-		downloader.addClient(client, baseURL)
+		if err := downloader.addClient(client, baseURL); err != nil {
+			return nil, err
+		}
 	}
-	return &downloader
+	return &downloader, nil
 }
 
 // String implements Stringer
@@ -130,13 +134,18 @@ func (g *GithubDownloaderV3) LogString() string {
 	return fmt.Sprintf("<GithubDownloaderV3 %s %s/%s>", g.baseURL, g.repoOwner, g.repoName)
 }
 
-func (g *GithubDownloaderV3) addClient(client *http.Client, baseURL string) {
-	githubClient := github.NewClient(client)
+func (g *GithubDownloaderV3) addClient(client *http.Client, baseURL string) error {
+	opts := []github.ClientOptionsFunc{github.WithHTTPClient(client)}
 	if baseURL != "https://github.com" {
-		githubClient, _ = githubClient.WithEnterpriseURLs(baseURL, baseURL)
+		opts = append(opts, github.WithEnterpriseURLs(baseURL, baseURL))
+	}
+	githubClient, err := github.NewClient(opts...)
+	if err != nil {
+		return err
 	}
 	g.clients = append(g.clients, githubClient)
 	g.rates = append(g.rates, nil)
+	return nil
 }
 
 func (g *GithubDownloaderV3) waitAndPickClient(ctx context.Context) {
@@ -205,6 +214,7 @@ func (g *GithubDownloaderV3) GetRepoInfo(ctx context.Context) (*base.Repository,
 		Name:          gr.GetName(),
 		IsPrivate:     gr.GetPrivate(),
 		Description:   gr.GetDescription(),
+		Website:       gr.GetHomepage(),
 		OriginalURL:   gr.GetHTMLURL(),
 		CloneURL:      gr.GetCloneURL(),
 		DefaultBranch: gr.GetDefaultBranch(),
diff --git a/services/migrations/github_test.go b/services/migrations/github_test.go
index 974a3bd8128..53ac4b8f99b 100644
--- a/services/migrations/github_test.go
+++ b/services/migrations/github_test.go
@@ -11,8 +11,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/unittest"
-	base "code.gitea.io/gitea/modules/migration"
+	"gitea.dev/models/unittest"
+	base "gitea.dev/modules/migration"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -30,8 +30,9 @@ func TestGitHubDownloadRepo(t *testing.T) {
 
 	GithubLimitRateRemaining = 3 // Wait at 3 remaining since we could have 3 CI in //
 	ctx := t.Context()
-	downloader := NewGithubDownloaderV3(ctx, mockServer.URL, "", "", token, "go-gitea", "test_repo")
-	err := downloader.RefreshRate(ctx)
+	downloader, err := NewGithubDownloaderV3(ctx, mockServer.URL, "", "", token, "go-gitea", "test_repo")
+	require.NoError(t, err)
+	err = downloader.RefreshRate(ctx)
 	require.NoError(t, err)
 
 	repo, err := downloader.GetRepoInfo(ctx)
@@ -40,6 +41,7 @@ func TestGitHubDownloadRepo(t *testing.T) {
 		Name:          "test_repo",
 		Owner:         "go-gitea",
 		Description:   "Test repository for testing migration from github to gitea",
+		Website:       "https://gitea.com/test-repo",
 		CloneURL:      "https://github.com/go-gitea/test_repo.git",
 		OriginalURL:   "https://github.com/go-gitea/test_repo",
 		DefaultBranch: "master",
diff --git a/services/migrations/gitlab.go b/services/migrations/gitlab.go
index ec49049f5e9..cf4c2f24e92 100644
--- a/services/migrations/gitlab.go
+++ b/services/migrations/gitlab.go
@@ -15,14 +15,14 @@ import (
 	"strings"
 	"time"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/structs"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/structs"
 
-	gitlab "gitlab.com/gitlab-org/api/client-go"
+	gitlab "gitlab.com/gitlab-org/api/client-go/v2"
 )
 
 var (
diff --git a/services/migrations/gitlab_test.go b/services/migrations/gitlab_test.go
index da664e436b8..f1c5423824a 100644
--- a/services/migrations/gitlab_test.go
+++ b/services/migrations/gitlab_test.go
@@ -14,12 +14,12 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/json"
-	base "code.gitea.io/gitea/modules/migration"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/json"
+	base "gitea.dev/modules/migration"
 
 	"github.com/stretchr/testify/assert"
-	gitlab "gitlab.com/gitlab-org/api/client-go"
+	gitlab "gitlab.com/gitlab-org/api/client-go/v2"
 )
 
 func TestGitlabDownloadRepo(t *testing.T) {
diff --git a/services/migrations/gogs.go b/services/migrations/gogs.go
index a4f84dbf72c..7a41851e145 100644
--- a/services/migrations/gogs.go
+++ b/services/migrations/gogs.go
@@ -11,9 +11,9 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/structs"
 
 	"github.com/gogs/go-gogs-client"
 )
diff --git a/services/migrations/gogs_test.go b/services/migrations/gogs_test.go
index 2dd7b00fb9d..196be94f832 100644
--- a/services/migrations/gogs_test.go
+++ b/services/migrations/gogs_test.go
@@ -10,8 +10,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/unittest"
-	base "code.gitea.io/gitea/modules/migration"
+	"gitea.dev/models/unittest"
+	base "gitea.dev/modules/migration"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/migrations/http_client.go b/services/migrations/http_client.go
index 0b997e08f4b..0d8b898a102 100644
--- a/services/migrations/http_client.go
+++ b/services/migrations/http_client.go
@@ -7,9 +7,9 @@ import (
 	"crypto/tls"
 	"net/http"
 
-	"code.gitea.io/gitea/modules/hostmatcher"
-	"code.gitea.io/gitea/modules/proxy"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/hostmatcher"
+	"gitea.dev/modules/proxy"
+	"gitea.dev/modules/setting"
 )
 
 // NewMigrationHTTPClient returns a HTTP client for migration
diff --git a/services/migrations/main_test.go b/services/migrations/main_test.go
index 8d8eb6459ff..d7230165a63 100644
--- a/services/migrations/main_test.go
+++ b/services/migrations/main_test.go
@@ -8,8 +8,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/unittest"
-	base "code.gitea.io/gitea/modules/migration"
+	"gitea.dev/models/unittest"
+	base "gitea.dev/modules/migration"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -210,6 +210,7 @@ func assertRepositoryEqual(t *testing.T, expected, actual *base.Repository) {
 	assert.Equal(t, expected.IsPrivate, actual.IsPrivate)
 	assert.Equal(t, expected.IsMirror, actual.IsMirror)
 	assert.Equal(t, expected.Description, actual.Description)
+	assert.Equal(t, expected.Website, actual.Website)
 	assert.Equal(t, expected.CloneURL, actual.CloneURL)
 	assert.Equal(t, expected.OriginalURL, actual.OriginalURL)
 	assert.Equal(t, expected.DefaultBranch, actual.DefaultBranch)
diff --git a/services/migrations/migrate.go b/services/migrations/migrate.go
index 0cdd96496dd..90b98b531bd 100644
--- a/services/migrations/migrate.go
+++ b/services/migrations/migrate.go
@@ -13,16 +13,16 @@ import (
 	"path/filepath"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	system_model "code.gitea.io/gitea/models/system"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/hostmatcher"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	system_model "gitea.dev/models/system"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/hostmatcher"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // MigrateOptions is equal to base.MigrateOptions
diff --git a/services/migrations/migrate_test.go b/services/migrations/migrate_test.go
index 315d1111890..7c95a488ba3 100644
--- a/services/migrations/migrate_test.go
+++ b/services/migrations/migrate_test.go
@@ -8,9 +8,9 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/migrations/onedev.go b/services/migrations/onedev.go
index a30e36c8b83..262b12cf1c2 100644
--- a/services/migrations/onedev.go
+++ b/services/migrations/onedev.go
@@ -13,10 +13,10 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/structs"
 
 	"github.com/hashicorp/go-version"
 )
diff --git a/services/migrations/onedev_test.go b/services/migrations/onedev_test.go
index 711242c41fc..6132c72d5a9 100644
--- a/services/migrations/onedev_test.go
+++ b/services/migrations/onedev_test.go
@@ -11,8 +11,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/unittest"
-	base "code.gitea.io/gitea/modules/migration"
+	"gitea.dev/models/unittest"
+	base "gitea.dev/modules/migration"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/migrations/restore.go b/services/migrations/restore.go
index 56862859350..cb34f681868 100644
--- a/services/migrations/restore.go
+++ b/services/migrations/restore.go
@@ -10,9 +10,9 @@ import (
 	"path/filepath"
 	"strconv"
 
-	base "code.gitea.io/gitea/modules/migration"
+	base "gitea.dev/modules/migration"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // RepositoryRestorer implements an Downloader from the local directory
@@ -75,6 +75,7 @@ func (r *RepositoryRestorer) GetRepoInfo(_ context.Context) (*base.Repository, e
 		Name:          r.repoName,
 		IsPrivate:     isPrivate,
 		Description:   opts["description"],
+		Website:       opts["website"],
 		OriginalURL:   opts["original_url"],
 		CloneURL:      filepath.Join(r.baseDir, "git"),
 		DefaultBranch: opts["default_branch"],
diff --git a/services/migrations/update.go b/services/migrations/update.go
index 4a49206f82e..b7ecb1e258d 100644
--- a/services/migrations/update.go
+++ b/services/migrations/update.go
@@ -6,11 +6,11 @@ package migrations
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/externalaccount"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/structs"
+	"gitea.dev/services/externalaccount"
 )
 
 // UpdateMigrationPosterID updates all migrated repositories' issues and comments posterID
diff --git a/services/mirror/mirror.go b/services/mirror/mirror.go
index 7fb7fabb753..ed3e09122a0 100644
--- a/services/mirror/mirror.go
+++ b/services/mirror/mirror.go
@@ -7,10 +7,10 @@ import (
 	"context"
 	"errors"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
 )
 
 // doMirrorSync causes this request to mirror itself
diff --git a/services/mirror/mirror_pull.go b/services/mirror/mirror_pull.go
index 9ce35f9eab6..db569c85501 100644
--- a/services/mirror/mirror_pull.go
+++ b/services/mirror/mirror_pull.go
@@ -9,25 +9,25 @@ import (
 	"strings"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	system_model "code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	giturl "code.gitea.io/gitea/modules/git/url"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/proxy"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/migrations"
-	notify_service "code.gitea.io/gitea/services/notify"
-	repo_service "code.gitea.io/gitea/services/repository"
+	repo_model "gitea.dev/models/repo"
+	system_model "gitea.dev/models/system"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	giturl "gitea.dev/modules/git/url"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/proxy"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/migrations"
+	notify_service "gitea.dev/services/notify"
+	repo_service "gitea.dev/services/repository"
 )
 
 // UpdateAddress writes new address to Git repository and database
@@ -305,6 +305,7 @@ func SyncPullMirror(ctx context.Context, repoID int64) bool {
 
 	log.Trace("SyncMirrors [repo: %-v]: Scheduling next update", m.Repo)
 	m.ScheduleNextUpdate()
+	m.LastSyncUnix = m.UpdatedUnix
 	if err = repo_model.UpdateMirror(ctx, m); err != nil {
 		log.Error("SyncMirrors [repo: %-v]: failed to UpdateMirror with next update date: %v", m.Repo, err)
 		return false
diff --git a/services/mirror/mirror_push.go b/services/mirror/mirror_push.go
index 844e18684b9..44a25825ee1 100644
--- a/services/mirror/mirror_push.go
+++ b/services/mirror/mirror_push.go
@@ -11,20 +11,20 @@ import (
 	"regexp"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/proxy"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/migrations"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/proxy"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/migrations"
+	repo_service "gitea.dev/services/repository"
 )
 
 var stripExitStatus = regexp.MustCompile(`exit status \d+ - `)
diff --git a/services/mirror/notifier.go b/services/mirror/notifier.go
index 93d904470d9..026205ffc22 100644
--- a/services/mirror/notifier.go
+++ b/services/mirror/notifier.go
@@ -6,10 +6,10 @@ package mirror
 import (
 	"context"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/repository"
-	notify_service "code.gitea.io/gitea/services/notify"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/repository"
+	notify_service "gitea.dev/services/notify"
 )
 
 func init() {
diff --git a/services/mirror/queue.go b/services/mirror/queue.go
index ca5e2c7272a..49bbbf1067e 100644
--- a/services/mirror/queue.go
+++ b/services/mirror/queue.go
@@ -4,10 +4,10 @@
 package mirror
 
 import (
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
 )
 
 var mirrorQueue *queue.WorkerPoolQueue[*SyncRequest]
diff --git a/services/notify/notifier.go b/services/notify/notifier.go
index 875a70e5644..513def7252b 100644
--- a/services/notify/notifier.go
+++ b/services/notify/notifier.go
@@ -6,14 +6,14 @@ package notify
 import (
 	"context"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/repository"
+	actions_model "gitea.dev/models/actions"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/repository"
 )
 
 // Notifier defines an interface to notify receiver
@@ -45,7 +45,7 @@ type Notifier interface {
 	NewPullRequest(ctx context.Context, pr *issues_model.PullRequest, mentions []*user_model.User)
 	MergePullRequest(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest)
 	AutoMergePullRequest(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest)
-	PullRequestSynchronized(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest)
+	PullRequestSynchronized(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest, before, after string)
 	PullRequestReview(ctx context.Context, pr *issues_model.PullRequest, review *issues_model.Review, comment *issues_model.Comment, mentions []*user_model.User)
 	PullRequestCodeComment(ctx context.Context, pr *issues_model.PullRequest, comment *issues_model.Comment, mentions []*user_model.User)
 	PullRequestChangeTargetBranch(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest, oldBranch string)
diff --git a/services/notify/notify.go b/services/notify/notify.go
index 152d53b01c9..b0de0b6a38e 100644
--- a/services/notify/notify.go
+++ b/services/notify/notify.go
@@ -6,15 +6,15 @@ package notify
 import (
 	"context"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/repository"
+	actions_model "gitea.dev/models/actions"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/repository"
 )
 
 var notifiers []Notifier
@@ -120,9 +120,9 @@ func NewPullRequest(ctx context.Context, pr *issues_model.PullRequest, mentions
 }
 
 // PullRequestSynchronized notifies Synchronized pull request
-func PullRequestSynchronized(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest) {
+func PullRequestSynchronized(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest, before, after string) {
 	for _, notifier := range notifiers {
-		notifier.PullRequestSynchronized(ctx, doer, pr)
+		notifier.PullRequestSynchronized(ctx, doer, pr, before, after)
 	}
 }
 
diff --git a/services/notify/null.go b/services/notify/null.go
index c3085d7c9eb..2ff1869cb28 100644
--- a/services/notify/null.go
+++ b/services/notify/null.go
@@ -6,14 +6,14 @@ package notify
 import (
 	"context"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/repository"
+	actions_model "gitea.dev/models/actions"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/repository"
 )
 
 // NullNotifier implements a blank notifier
@@ -63,7 +63,7 @@ func (*NullNotifier) AutoMergePullRequest(ctx context.Context, doer *user_model.
 }
 
 // PullRequestSynchronized places a place holder function
-func (*NullNotifier) PullRequestSynchronized(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest) {
+func (*NullNotifier) PullRequestSynchronized(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest, before, after string) {
 }
 
 // PullRequestChangeTargetBranch places a place holder function
diff --git a/services/oauth2_provider/access_token.go b/services/oauth2_provider/access_token.go
index 3a77c86d9e5..a577085eae0 100644
--- a/services/oauth2_provider/access_token.go
+++ b/services/oauth2_provider/access_token.go
@@ -10,15 +10,15 @@ import (
 	"strconv"
 	"strings"
 
-	auth "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	org_model "code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	auth "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	org_model "gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 
 	"github.com/golang-jwt/jwt/v5"
 )
diff --git a/services/oauth2_provider/init.go b/services/oauth2_provider/init.go
index c412bd64336..d325dc89bb2 100644
--- a/services/oauth2_provider/init.go
+++ b/services/oauth2_provider/init.go
@@ -6,7 +6,7 @@ package oauth2_provider
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/setting"
 )
 
 // Init initializes the oauth source
diff --git a/services/oauth2_provider/jwtsigningkey.go b/services/oauth2_provider/jwtsigningkey.go
index 4898d54166a..7ce37c5ef8c 100644
--- a/services/oauth2_provider/jwtsigningkey.go
+++ b/services/oauth2_provider/jwtsigningkey.go
@@ -18,9 +18,9 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/golang-jwt/jwt/v5"
 )
diff --git a/services/oauth2_provider/token.go b/services/oauth2_provider/token.go
index 935c4cc01f3..499865a90c8 100644
--- a/services/oauth2_provider/token.go
+++ b/services/oauth2_provider/token.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/golang-jwt/jwt/v5"
 )
diff --git a/services/org/org.go b/services/org/org.go
index 629b5acc443..2f2ee950311 100644
--- a/services/org/org.go
+++ b/services/org/org.go
@@ -7,20 +7,20 @@ import (
 	"context"
 	"fmt"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	org_model "code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	secret_model "code.gitea.io/gitea/models/secret"
-	user_model "code.gitea.io/gitea/models/user"
-	issue_indexer "code.gitea.io/gitea/modules/indexer/issues"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	repo_service "code.gitea.io/gitea/services/repository"
+	actions_model "gitea.dev/models/actions"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	org_model "gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	secret_model "gitea.dev/models/secret"
+	user_model "gitea.dev/models/user"
+	issue_indexer "gitea.dev/modules/indexer/issues"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	repo_service "gitea.dev/services/repository"
 )
 
 // deleteOrganization deletes models associated to an organization.
diff --git a/services/org/org_test.go b/services/org/org_test.go
index 9c0aa163df4..0d6f4f24890 100644
--- a/services/org/org_test.go
+++ b/services/org/org_test.go
@@ -6,12 +6,12 @@ package org
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/org/team.go b/services/org/team.go
index 6c92ee4f447..f3313e0edf5 100644
--- a/services/org/team.go
+++ b/services/org/team.go
@@ -9,18 +9,18 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	repo_service "gitea.dev/services/repository"
 
 	"xorm.io/builder"
 )
diff --git a/services/org/team_invite.go b/services/org/team_invite.go
index 3f28044dbf6..a326c7df44e 100644
--- a/services/org/team_invite.go
+++ b/services/org/team_invite.go
@@ -6,9 +6,9 @@ package org
 import (
 	"context"
 
-	org_model "code.gitea.io/gitea/models/organization"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/services/mailer"
+	org_model "gitea.dev/models/organization"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/services/mailer"
 )
 
 // CreateTeamInvite make a persistent invite in db and mail it
diff --git a/services/org/team_test.go b/services/org/team_test.go
index 5cb588b7dde..5275c377b9f 100644
--- a/services/org/team_test.go
+++ b/services/org/team_test.go
@@ -8,15 +8,15 @@ import (
 	"strings"
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/structs"
-	repo_service "code.gitea.io/gitea/services/repository"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/structs"
+	repo_service "gitea.dev/services/repository"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/org/user.go b/services/org/user.go
index 68582718582..754ffa44de0 100644
--- a/services/org/user.go
+++ b/services/org/user.go
@@ -8,11 +8,11 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
 )
 
 // RemoveOrgUser removes user from given organization.
diff --git a/services/org/user_test.go b/services/org/user_test.go
index 3df9d533560..17d94ba643f 100644
--- a/services/org/user_test.go
+++ b/services/org/user_test.go
@@ -6,9 +6,9 @@ package org
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/packages/alpine/repository.go b/services/packages/alpine/repository.go
index 277c1888747..146e9e4a028 100644
--- a/services/packages/alpine/repository.go
+++ b/services/packages/alpine/repository.go
@@ -20,15 +20,15 @@ import (
 	"io"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	alpine_model "code.gitea.io/gitea/models/packages/alpine"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	alpine_module "code.gitea.io/gitea/modules/packages/alpine"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	alpine_model "gitea.dev/models/packages/alpine"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	alpine_module "gitea.dev/modules/packages/alpine"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 )
 
 const (
diff --git a/services/packages/arch/repository.go b/services/packages/arch/repository.go
index 3a22db1b198..0dac17bf56c 100644
--- a/services/packages/arch/repository.go
+++ b/services/packages/arch/repository.go
@@ -16,16 +16,16 @@ import (
 	"strconv"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	arch_model "code.gitea.io/gitea/models/packages/arch"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	arch_module "code.gitea.io/gitea/modules/packages/arch"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	arch_model "gitea.dev/models/packages/arch"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	arch_module "gitea.dev/modules/packages/arch"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
diff --git a/services/packages/auth.go b/services/packages/auth.go
index dd1f68a7ee0..d0099ffb731 100644
--- a/services/packages/auth.go
+++ b/services/packages/auth.go
@@ -10,10 +10,10 @@ import (
 	"strings"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 
 	"github.com/golang-jwt/jwt/v5"
 )
diff --git a/services/packages/cargo/index.go b/services/packages/cargo/index.go
index 580d84ebc25..dd95e3001b4 100644
--- a/services/packages/cargo/index.go
+++ b/services/packages/cargo/index.go
@@ -12,17 +12,17 @@ import (
 	"path"
 	"strconv"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	cargo_module "code.gitea.io/gitea/modules/packages/cargo"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	repo_service "code.gitea.io/gitea/services/repository"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	cargo_module "gitea.dev/modules/packages/cargo"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	repo_service "gitea.dev/services/repository"
+	files_service "gitea.dev/services/repository/files"
 )
 
 const (
diff --git a/services/packages/cleanup/cleanup.go b/services/packages/cleanup/cleanup.go
index 5cff16fe402..3c3424c740b 100644
--- a/services/packages/cleanup/cleanup.go
+++ b/services/packages/cleanup/cleanup.go
@@ -8,19 +8,19 @@ import (
 	"fmt"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	packages_service "code.gitea.io/gitea/services/packages"
-	alpine_service "code.gitea.io/gitea/services/packages/alpine"
-	arch_service "code.gitea.io/gitea/services/packages/arch"
-	cargo_service "code.gitea.io/gitea/services/packages/cargo"
-	container_service "code.gitea.io/gitea/services/packages/container"
-	debian_service "code.gitea.io/gitea/services/packages/debian"
-	rpm_service "code.gitea.io/gitea/services/packages/rpm"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	packages_service "gitea.dev/services/packages"
+	alpine_service "gitea.dev/services/packages/alpine"
+	arch_service "gitea.dev/services/packages/arch"
+	cargo_service "gitea.dev/services/packages/cargo"
+	container_service "gitea.dev/services/packages/container"
+	debian_service "gitea.dev/services/packages/debian"
+	rpm_service "gitea.dev/services/packages/rpm"
 )
 
 // CleanupTask executes cleanup rules and cleanup expired package data
diff --git a/services/packages/container/blob_uploader.go b/services/packages/container/blob_uploader.go
index d2df2c814ad..8b6e55d56dd 100644
--- a/services/packages/container/blob_uploader.go
+++ b/services/packages/container/blob_uploader.go
@@ -9,10 +9,10 @@ import (
 	"io"
 	"os"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/tempdir"
+	packages_model "gitea.dev/models/packages"
+	packages_module "gitea.dev/modules/packages"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/tempdir"
 )
 
 var (
diff --git a/services/packages/container/cleanup.go b/services/packages/container/cleanup.go
index 263562a3967..7aab4769f35 100644
--- a/services/packages/container/cleanup.go
+++ b/services/packages/container/cleanup.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	container_model "code.gitea.io/gitea/models/packages/container"
-	"code.gitea.io/gitea/modules/optional"
-	container_module "code.gitea.io/gitea/modules/packages/container"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	container_model "gitea.dev/models/packages/container"
+	"gitea.dev/modules/optional"
+	container_module "gitea.dev/modules/packages/container"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/opencontainers/go-digest"
 )
diff --git a/services/packages/container/common.go b/services/packages/container/common.go
index d3e2996a52d..c359794d243 100644
--- a/services/packages/container/common.go
+++ b/services/packages/container/common.go
@@ -8,12 +8,12 @@ import (
 	"io"
 	"strings"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	container_service "code.gitea.io/gitea/models/packages/container"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/packages"
-	container_module "code.gitea.io/gitea/modules/packages/container"
+	packages_model "gitea.dev/models/packages"
+	container_service "gitea.dev/models/packages/container"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/packages"
+	container_module "gitea.dev/modules/packages/container"
 
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 )
diff --git a/services/packages/debian/repository.go b/services/packages/debian/repository.go
index 910f93b0344..7073d44e3e1 100644
--- a/services/packages/debian/repository.go
+++ b/services/packages/debian/repository.go
@@ -15,14 +15,14 @@ import (
 	"strings"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	debian_model "code.gitea.io/gitea/models/packages/debian"
-	user_model "code.gitea.io/gitea/models/user"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	debian_module "code.gitea.io/gitea/modules/packages/debian"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	debian_model "gitea.dev/models/packages/debian"
+	user_model "gitea.dev/models/user"
+	packages_module "gitea.dev/modules/packages"
+	debian_module "gitea.dev/modules/packages/debian"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
diff --git a/services/packages/package_update.go b/services/packages/package_update.go
index d0ec43b7484..880d0fd9127 100644
--- a/services/packages/package_update.go
+++ b/services/packages/package_update.go
@@ -7,13 +7,13 @@ import (
 	"context"
 	"fmt"
 
-	org_model "code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
+	org_model "gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
 )
 
 func LinkToRepository(ctx context.Context, pkg *packages_model.Package, repo *repo_model.Repository, doer *user_model.User) error {
diff --git a/services/packages/packages.go b/services/packages/packages.go
index 03b2803297f..abd4b4c54db 100644
--- a/services/packages/packages.go
+++ b/services/packages/packages.go
@@ -13,17 +13,18 @@ import (
 	"net/url"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	packages_module "gitea.dev/modules/packages"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	notify_service "gitea.dev/services/notify"
 )
 
 var (
@@ -78,8 +79,13 @@ func CreatePackageAndAddFile(ctx context.Context, pvci *PackageCreationInfo, pfc
 }
 
 // CreatePackageOrAddFileToExisting creates a package with a file or adds the file if the package exists already
-func CreatePackageOrAddFileToExisting(ctx context.Context, pvci *PackageCreationInfo, pfci *PackageFileCreationInfo) (*packages_model.PackageVersion, *packages_model.PackageFile, error) {
-	return createPackageAndAddFile(ctx, pvci, pfci, true)
+func CreatePackageOrAddFileToExisting(ctx context.Context, pvci *PackageCreationInfo, pfci *PackageFileCreationInfo) (pv *packages_model.PackageVersion, pf *packages_model.PackageFile, err error) {
+	lockKey := fmt.Sprintf("pkg-upsert-%v-%v-%v", pvci.PackageType, pvci.Name, pvci.Version)
+	err = globallock.LockAndDo(ctx, lockKey, func(ctx context.Context) error {
+		pv, pf, err = createPackageAndAddFile(ctx, pvci, pfci, true)
+		return err
+	})
+	return pv, pf, err
 }
 
 func createPackageAndAddFile(ctx context.Context, pvci *PackageCreationInfo, pfci *PackageFileCreationInfo, allowDuplicate bool) (*packages_model.PackageVersion, *packages_model.PackageFile, error) {
diff --git a/services/packages/pkgspec/manager.go b/services/packages/pkgspec/manager.go
index d2f33e0d47d..97c672a4815 100644
--- a/services/packages/pkgspec/manager.go
+++ b/services/packages/pkgspec/manager.go
@@ -4,9 +4,9 @@
 package pkgspec
 
 import (
-	packages_model "code.gitea.io/gitea/models/packages"
-	packages_service "code.gitea.io/gitea/services/packages"
-	"code.gitea.io/gitea/services/packages/terraform"
+	packages_model "gitea.dev/models/packages"
+	packages_service "gitea.dev/services/packages"
+	"gitea.dev/services/packages/terraform"
 )
 
 func InitManager() error {
diff --git a/services/packages/rpm/repository.go b/services/packages/rpm/repository.go
index ddf306b6987..5ea08bf0631 100644
--- a/services/packages/rpm/repository.go
+++ b/services/packages/rpm/repository.go
@@ -17,14 +17,14 @@ import (
 	"strings"
 	"time"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	rpm_model "code.gitea.io/gitea/models/packages/rpm"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	rpm_module "code.gitea.io/gitea/modules/packages/rpm"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	rpm_model "gitea.dev/models/packages/rpm"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	packages_module "gitea.dev/modules/packages"
+	rpm_module "gitea.dev/modules/packages/rpm"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
diff --git a/services/packages/rpm/sign.go b/services/packages/rpm/sign.go
index 820355a638d..e12c4a97c26 100644
--- a/services/packages/rpm/sign.go
+++ b/services/packages/rpm/sign.go
@@ -8,7 +8,7 @@ import (
 	"io"
 	"strings"
 
-	packages_module "code.gitea.io/gitea/modules/packages"
+	packages_module "gitea.dev/modules/packages"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/sassoftware/go-rpmutils"
diff --git a/services/packages/spec.go b/services/packages/spec.go
index 0815bdc98d2..3d5888e22f0 100644
--- a/services/packages/spec.go
+++ b/services/packages/spec.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"sync"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	user_model "code.gitea.io/gitea/models/user"
+	packages_model "gitea.dev/models/packages"
+	user_model "gitea.dev/models/user"
 )
 
 type nop struct{}
diff --git a/services/packages/terraform/spec.go b/services/packages/terraform/spec.go
index 982f29fb818..0aabbb3670b 100644
--- a/services/packages/terraform/spec.go
+++ b/services/packages/terraform/spec.go
@@ -6,12 +6,12 @@ package terraform
 import (
 	"context"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/optional"
-	terraform_module "code.gitea.io/gitea/modules/packages/terraform"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
+	packages_model "gitea.dev/models/packages"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/optional"
+	terraform_module "gitea.dev/modules/packages/terraform"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
 )
 
 type Specialization struct{}
diff --git a/services/packages/terraform/state.go b/services/packages/terraform/state.go
index cdd6f0c5935..d3d860e0d61 100644
--- a/services/packages/terraform/state.go
+++ b/services/packages/terraform/state.go
@@ -6,9 +6,9 @@ package terraform
 import (
 	"context"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/modules/optional"
-	terraform_module "code.gitea.io/gitea/modules/packages/terraform"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/modules/optional"
+	terraform_module "gitea.dev/modules/packages/terraform"
 )
 
 // IsLocked is a helper function to check if the terraform state is locked
diff --git a/services/projects/issue.go b/services/projects/issue.go
index 5c691a95eb8..01b263760b3 100644
--- a/services/projects/issue.go
+++ b/services/projects/issue.go
@@ -9,12 +9,12 @@ import (
 	"slices"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	project_model "code.gitea.io/gitea/models/project"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/optional"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	project_model "gitea.dev/models/project"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
 )
 
 // MoveIssuesOnProjectColumn moves or keeps issues in a column and sorts them inside that column
diff --git a/services/projects/issue_test.go b/services/projects/issue_test.go
index ec31b22b906..ac0ed2002da 100644
--- a/services/projects/issue_test.go
+++ b/services/projects/issue_test.go
@@ -6,13 +6,13 @@ package project
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	org_model "code.gitea.io/gitea/models/organization"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	org_model "gitea.dev/models/organization"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/projects/main_test.go b/services/projects/main_test.go
index d39c82a140e..c30b34f46d5 100644
--- a/services/projects/main_test.go
+++ b/services/projects/main_test.go
@@ -6,10 +6,10 @@ package project
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models/actions"
-	_ "code.gitea.io/gitea/models/activities"
+	_ "gitea.dev/models/actions"
+	_ "gitea.dev/models/activities"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/pull/check.go b/services/pull/check.go
index 241eb633b69..92021b7d1c4 100644
--- a/services/pull/check.go
+++ b/services/pull/check.go
@@ -11,27 +11,27 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	"code.gitea.io/gitea/models/pull"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/automergequeue"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	"gitea.dev/models/pull"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/automergequeue"
+	notify_service "gitea.dev/services/notify"
 )
 
 // prPatchCheckerQueue represents a queue to handle update pull request tests
@@ -139,7 +139,7 @@ const (
 //   - merge: both the head commits must be verified and Gitea must sign the merge commit.
 //   - rebase, rebase-merge, squash: Gitea rewrites the commits and signs each, so only Gitea's
 //     signing ability is checked.
-func CheckPullMergeable(stdCtx context.Context, doer *user_model.User, perm *access_model.Permission, pr *issues_model.PullRequest, mergeCheckType MergeCheckType, mergeStyle repo_model.MergeStyle, adminForceMerge bool) error {
+func CheckPullMergeable(stdCtx context.Context, doer *user_model.User, perm *access_model.Permission, pr *issues_model.PullRequest, mergeCheckType MergeCheckType, mergeStyle repo_model.MergeStyle, forceMerge bool) error {
 	return db.WithTx(stdCtx, func(ctx context.Context) error {
 		if pr.HasMerged {
 			return ErrHasMerged
@@ -176,21 +176,21 @@ func CheckPullMergeable(stdCtx context.Context, doer *user_model.User, perm *acc
 			return ErrIsChecking
 		}
 
-		if err := CheckPullBranchProtections(ctx, pr, false); err != nil {
-			if !errors.Is(err, ErrNotReadyToMerge) {
-				log.Error("Error whilst checking pull branch protection for %-v: %v", pr, err)
-				return err
+		if errProtection := CheckPullBranchProtections(ctx, pr, false); errProtection != nil {
+			if !errors.Is(errProtection, ErrNotReadyToMerge) {
+				log.Error("Error whilst checking pull branch protection for %-v: %v", pr, errProtection)
+				return errProtection
 			}
 
 			// Now the branch protection check failed, check whether the failure could be skipped (skip by setting err = nil)
 
 			// * when doing Auto Merge (Scheduled Merge After Checks Succeed), skip the branch protection check
 			if mergeCheckType == MergeCheckTypeAuto {
-				err = nil
+				errProtection = nil
 			}
 
-			// * if admin tries to "Force Merge", they could sometimes skip the branch protection check
-			if adminForceMerge {
+			// * if the doer tries to "Force Merge", check whether it is really allowed
+			if forceMerge {
 				isRepoAdmin, errForceMerge := access_model.IsUserRepoAdmin(ctx, pr.BaseRepo, doer)
 				if errForceMerge != nil {
 					return fmt.Errorf("IsUserRepoAdmin failed, repo: %v, doer: %v, err: %w", pr.BaseRepoID, doer.ID, errForceMerge)
@@ -201,16 +201,18 @@ func CheckPullMergeable(stdCtx context.Context, doer *user_model.User, perm *acc
 					return fmt.Errorf("GetFirstMatchProtectedBranchRule failed, repo: %v, base branch: %v, err: %w", pr.BaseRepoID, pr.BaseBranch, errForceMerge)
 				}
 
-				// if doer is admin and the "Force Merge" is not blocked, then clear the branch protection check error
-				blockAdminForceMerge := protectedBranchRule != nil && protectedBranchRule.BlockAdminMergeOverride
-				if isRepoAdmin && !blockAdminForceMerge {
-					err = nil
+				canForceMerge := isRepoAdmin
+				if protectedBranchRule != nil {
+					canForceMerge = git_model.CanBypassBranchProtection(ctx, protectedBranchRule, doer, isRepoAdmin)
+				}
+				if canForceMerge {
+					errProtection = nil
 				}
 			}
 
 			// If there is still a branch protection check error, return it
-			if err != nil {
-				return err
+			if errProtection != nil {
+				return errProtection
 			}
 		}
 
diff --git a/services/pull/check_test.go b/services/pull/check_test.go
index 506cd423015..ad4ade837b8 100644
--- a/services/pull/check_test.go
+++ b/services/pull/check_test.go
@@ -8,18 +8,18 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/pull"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/services/automergequeue"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/pull"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/automergequeue"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/pull/comment.go b/services/pull/comment.go
index 1d055a0c1f7..7cbd84b7d83 100644
--- a/services/pull/comment.go
+++ b/services/pull/comment.go
@@ -7,14 +7,14 @@ import (
 	"context"
 	"slices"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
 )
 
 const maxPushCommitsInCommentCount = 1000
diff --git a/services/pull/comment_test.go b/services/pull/comment_test.go
index 975aec66d1d..3d5b995e534 100644
--- a/services/pull/comment_test.go
+++ b/services/pull/comment_test.go
@@ -6,13 +6,13 @@ package pull
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/json"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/pull/commit_status.go b/services/pull/commit_status.go
index 656bcc50af7..6fafcf3b511 100644
--- a/services/pull/commit_status.go
+++ b/services/pull/commit_status.go
@@ -9,13 +9,13 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
 )
 
 // MergeRequiredContextsCommitStatus returns a commit status state for given required contexts
diff --git a/services/pull/commit_status_test.go b/services/pull/commit_status_test.go
index a58e788c044..612ae268cbe 100644
--- a/services/pull/commit_status_test.go
+++ b/services/pull/commit_status_test.go
@@ -7,8 +7,8 @@ package pull
 import (
 	"testing"
 
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/modules/commitstatus"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/modules/commitstatus"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/pull/edits.go b/services/pull/edits.go
index 193e385d2a9..6c9ee10c9a0 100644
--- a/services/pull/edits.go
+++ b/services/pull/edits.go
@@ -8,10 +8,10 @@ import (
 	"context"
 	"errors"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
 )
 
 var ErrUserHasNoPermissionForAction = errors.New("user not allowed to do this action")
diff --git a/services/pull/lfs.go b/services/pull/lfs.go
index 094b563b920..34d811a3c37 100644
--- a/services/pull/lfs.go
+++ b/services/pull/lfs.go
@@ -11,13 +11,13 @@ import (
 	"io"
 	"strconv"
 
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/git/pipeline"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/git/pipeline"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
 
 	"golang.org/x/sync/errgroup"
 )
diff --git a/services/pull/main_test.go b/services/pull/main_test.go
index efbb63a36ec..b73c70734ed 100644
--- a/services/pull/main_test.go
+++ b/services/pull/main_test.go
@@ -7,9 +7,9 @@ package pull
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models/actions"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/pull/merge.go b/services/pull/merge.go
index 1137296cae9..fe65c4d4480 100644
--- a/services/pull/merge.go
+++ b/services/pull/merge.go
@@ -16,27 +16,27 @@ import (
 	"strings"
 	"unicode"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	pull_model "code.gitea.io/gitea/models/pull"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/references"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	issue_service "code.gitea.io/gitea/services/issue"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	pull_model "gitea.dev/models/pull"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/references"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	issue_service "gitea.dev/services/issue"
+	notify_service "gitea.dev/services/notify"
 )
 
 // getMergeMessage composes the message used when merging a pull request.
diff --git a/services/pull/merge_ff_only.go b/services/pull/merge_ff_only.go
index 2ed09a71613..7920d97c101 100644
--- a/services/pull/merge_ff_only.go
+++ b/services/pull/merge_ff_only.go
@@ -4,9 +4,9 @@
 package pull
 
 import (
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
 )
 
 // doMergeStyleFastForwardOnly merges the tracking into the current HEAD - which is assumed to be staging branch (equal to the pr.BaseBranch)
diff --git a/services/pull/merge_merge.go b/services/pull/merge_merge.go
index 2bc1fb9a348..526aeb0e1a1 100644
--- a/services/pull/merge_merge.go
+++ b/services/pull/merge_merge.go
@@ -4,9 +4,9 @@
 package pull
 
 import (
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
 )
 
 // doMergeStyleMerge merges the tracking branch into the current HEAD - which is assumed to be the staging branch (equal to the pr.BaseBranch)
diff --git a/services/pull/merge_prepare.go b/services/pull/merge_prepare.go
index c23bfdc7f6a..37f5593e5d7 100644
--- a/services/pull/merge_prepare.go
+++ b/services/pull/merge_prepare.go
@@ -13,15 +13,15 @@ import (
 	"strings"
 	"time"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
+	asymkey_service "gitea.dev/services/asymkey"
 )
 
 type mergeContext struct {
diff --git a/services/pull/merge_rebase.go b/services/pull/merge_rebase.go
index 0224f7f1bd3..57b771e36c4 100644
--- a/services/pull/merge_rebase.go
+++ b/services/pull/merge_rebase.go
@@ -7,11 +7,11 @@ import (
 	"fmt"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
 )
 
 // getRebaseAmendMessage composes the message to amend commits in rebase merge of a pull request.
diff --git a/services/pull/merge_squash.go b/services/pull/merge_squash.go
index 0f716f4d771..67ec5bb81cf 100644
--- a/services/pull/merge_squash.go
+++ b/services/pull/merge_squash.go
@@ -6,13 +6,13 @@ package pull
 import (
 	"fmt"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
 )
 
 // doMergeStyleSquash gets a commit author signature for squash commits
diff --git a/services/pull/merge_tree.go b/services/pull/merge_tree.go
index 18d59fabd10..10bdcf99f97 100644
--- a/services/pull/merge_tree.go
+++ b/services/pull/merge_tree.go
@@ -8,11 +8,11 @@ import (
 	"errors"
 	"fmt"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
 )
 
 // checkConflictsMergeTree uses git merge-tree to check for conflicts and if none are found checks if the patch is empty
diff --git a/services/pull/merge_tree_test.go b/services/pull/merge_tree_test.go
index 6fa2cf7022e..91d6a9152f3 100644
--- a/services/pull/merge_tree_test.go
+++ b/services/pull/merge_tree_test.go
@@ -8,9 +8,9 @@ import (
 	"fmt"
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/git/gitcmd"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git/gitcmd"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/pull/patch.go b/services/pull/patch.go
index 114a437cbc3..3844072553c 100644
--- a/services/pull/patch.go
+++ b/services/pull/patch.go
@@ -12,15 +12,15 @@ import (
 	"path/filepath"
 	"strings"
 
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/util"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/util"
 )
 
 // DownloadDiffOrPatch will write the patch for the pr to the writer
diff --git a/services/pull/patch_unmerged.go b/services/pull/patch_unmerged.go
index 78a31a87049..447cf4e1b47 100644
--- a/services/pull/patch_unmerged.go
+++ b/services/pull/patch_unmerged.go
@@ -12,8 +12,8 @@ import (
 	"strconv"
 	"strings"
 
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
 )
 
 // lsFileLine is a Quadruplet struct (+error) representing a partially parsed line from ls-files
diff --git a/services/pull/protected_branch.go b/services/pull/protected_branch.go
index 68ae7bc2ed2..667a4b9d1c4 100644
--- a/services/pull/protected_branch.go
+++ b/services/pull/protected_branch.go
@@ -6,8 +6,8 @@ package pull
 import (
 	"context"
 
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
 )
 
 func CreateOrUpdateProtectedBranch(ctx context.Context, repo *repo_model.Repository,
diff --git a/services/pull/pull.go b/services/pull/pull.go
index b852dc2ed17..0d4a10ae9ef 100644
--- a/services/pull/pull.go
+++ b/services/pull/pull.go
@@ -9,32 +9,33 @@ import (
 	"fmt"
 	"io"
 	"regexp"
+	"slices"
 	"strings"
 	"time"
 	"unicode/utf8"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	git_service "code.gitea.io/gitea/services/git"
-	issue_service "code.gitea.io/gitea/services/issue"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	git_service "gitea.dev/services/git"
+	issue_service "gitea.dev/services/issue"
+	notify_service "gitea.dev/services/notify"
 )
 
 func getPullWorkingLockKey(prID int64) string {
@@ -478,7 +479,7 @@ func AddTestPullRequestTask(opts TestPullRequestOptions) {
 						}
 					}
 
-					notify_service.PullRequestSynchronized(ctx, opts.Doer, pr)
+					notify_service.PullRequestSynchronized(ctx, opts.Doer, pr, opts.OldCommitID, opts.NewCommitID)
 				}
 			}
 		}
@@ -845,9 +846,8 @@ func GetSquashMergeCommitMessages(ctx context.Context, pr *issues_model.PullRequ
 		// use PR's commit messages as squash commit message
 		// commits list is in reverse chronological order
 		maxMsgSize := setting.Repository.PullRequest.DefaultMergeMessageSize
-		for i := len(commits) - 1; i >= 0; i-- {
-			commit := commits[i]
-			msg := strings.TrimSpace(commit.CommitMessage)
+		for _, commit := range slices.Backward(commits) {
+			msg := strings.TrimSpace(commit.MessageUTF8())
 			if msg == "" {
 				continue
 			}
@@ -1074,7 +1074,7 @@ func GetPullCommits(ctx context.Context, baseGitRepo *git.Repository, doer *user
 		}
 
 		commits = append(commits, CommitInfo{
-			Summary:               commit.Summary(),
+			Summary:               commit.MessageTitle(),
 			CommitterOrAuthorName: committerOrAuthorName,
 			ID:                    commit.ID.String(),
 			ShortSha:              base.ShortSha(commit.ID.String()),
diff --git a/services/pull/pull_test.go b/services/pull/pull_test.go
index 1c03ab45ae2..0648cd383d5 100644
--- a/services/pull/pull_test.go
+++ b/services/pull/pull_test.go
@@ -7,11 +7,11 @@ package pull
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/gitrepo"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/gitrepo"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/pull/review.go b/services/pull/review.go
index cf9c7bf6f14..18abdb04cda 100644
--- a/services/pull/review.go
+++ b/services/pull/review.go
@@ -10,19 +10,19 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/gitdiff"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/gitdiff"
+	notify_service "gitea.dev/services/notify"
 )
 
 func isErrBlameNotFoundOrNotEnoughLines(err error) bool {
diff --git a/services/pull/review_test.go b/services/pull/review_test.go
index ddb2c04eaac..2254e304206 100644
--- a/services/pull/review_test.go
+++ b/services/pull/review_test.go
@@ -6,10 +6,10 @@ package pull_test
 import (
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	pull_service "code.gitea.io/gitea/services/pull"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	pull_service "gitea.dev/services/pull"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/pull/reviewer.go b/services/pull/reviewer.go
index 139aeeb9503..b98c85ebc3e 100644
--- a/services/pull/reviewer.go
+++ b/services/pull/reviewer.go
@@ -6,13 +6,13 @@ package pull
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
 
 	"xorm.io/builder"
 )
diff --git a/services/pull/reviewer_test.go b/services/pull/reviewer_test.go
index 9fab65ce720..81ca7891799 100644
--- a/services/pull/reviewer_test.go
+++ b/services/pull/reviewer_test.go
@@ -6,9 +6,9 @@ package pull_test
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	pull_service "code.gitea.io/gitea/services/pull"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	pull_service "gitea.dev/services/pull"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/pull/temp_repo.go b/services/pull/temp_repo.go
index d0da870241e..17bfd6a8087 100644
--- a/services/pull/temp_repo.go
+++ b/services/pull/temp_repo.go
@@ -11,13 +11,13 @@ import (
 	"os"
 	"path/filepath"
 
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
 )
 
 // Temporary repos created here use standard branch names to help simplify
diff --git a/services/pull/update.go b/services/pull/update.go
index 4033e11e2bc..15bb65ae7d5 100644
--- a/services/pull/update.go
+++ b/services/pull/update.go
@@ -8,16 +8,16 @@ import (
 	"errors"
 	"fmt"
 
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/repository"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/repository"
 )
 
 // Update updates pull request with base branch.
@@ -131,74 +131,82 @@ func isUserAllowedToPushOrForcePushInRepoBranch(ctx context.Context, user *user_
 	return pushAllowed, forcePushAllowed, nil
 }
 
-// IsUserAllowedToUpdate check if user is allowed to update PR with given permissions and branch protections
+// CheckUserAllowedToUpdate check if user is allowed to update PR with given permissions and branch protections
 // update PR means send new commits to PR head branch from base branch
-func IsUserAllowedToUpdate(ctx context.Context, pull *issues_model.PullRequest, user *user_model.User) (pushAllowed, rebaseAllowed bool, err error) {
+func CheckUserAllowedToUpdate(ctx context.Context, pull *issues_model.PullRequest, user *user_model.User) (ret struct {
+	MergeAllowed, RebaseAllowed bool
+	DefaultUpdateStyle          repo_model.UpdateStyle
+}, err error,
+) {
 	if user == nil {
-		return false, false, nil
+		return ret, nil
 	}
 	if err := pull.LoadBaseRepo(ctx); err != nil {
-		return false, false, err
+		return ret, err
 	}
 	if err := pull.LoadHeadRepo(ctx); err != nil {
-		return false, false, err
+		return ret, err
 	}
 
 	// 1. check whether pull request enabled.
 	prBaseUnit, err := pull.BaseRepo.GetUnit(ctx, unit.TypePullRequests)
 	if repo_model.IsErrUnitTypeNotExist(err) {
-		return false, false, nil // the PR unit is disabled in base repo means no update allowed
+		return ret, nil // the PR unit is disabled in base repo means no update allowed
 	} else if err != nil {
-		return false, false, fmt.Errorf("get base repo unit: %v", err)
+		return ret, fmt.Errorf("get base repo unit: %v", err)
 	}
 
 	// 2. only support Github style pull request
 	if pull.Flow == issues_model.PullRequestFlowAGit {
-		return false, false, nil
+		return ret, nil
 	}
 
 	// 3. check user push permission on head repository
-	pushAllowed, rebaseAllowed, err = isUserAllowedToPushOrForcePushInRepoBranch(ctx, user, pull.HeadRepo, pull.HeadBranch)
+	ret.MergeAllowed, ret.RebaseAllowed, err = isUserAllowedToPushOrForcePushInRepoBranch(ctx, user, pull.HeadRepo, pull.HeadBranch)
 	if err != nil {
-		return false, false, err
+		return ret, err
 	}
 
 	// 4. if the pull creator allows maintainer to edit, we need to check whether
 	// user is a maintainer (has permission to merge into base branch) and inherit pull request poster's permission
-	if pull.AllowMaintainerEdit && (!pushAllowed || !rebaseAllowed) {
+	if pull.AllowMaintainerEdit && (!ret.MergeAllowed || !ret.RebaseAllowed) {
 		baseRepoPerm, err := access_model.GetDoerRepoPermission(ctx, pull.BaseRepo, user)
 		if err != nil {
-			return false, false, err
+			return ret, err
 		}
 		userAllowedToMergePR, err := isUserAllowedToMergeInRepoBranch(ctx, pull.BaseRepoID, pull.BaseBranch, baseRepoPerm, user)
 		if err != nil {
-			return false, false, err
+			return ret, err
 		}
 		if userAllowedToMergePR {
 			// the user is maintainer (can merge PR), and this PR is allowed to be edited by maintainers,
 			// then the user should inherit the PR poster's push/rebase permission for the head branch
 			if err := pull.LoadIssue(ctx); err != nil {
-				return false, false, err
+				return ret, err
 			}
 			if err := pull.Issue.LoadPoster(ctx); err != nil {
-				return false, false, err
+				return ret, err
 			}
 			posterPushAllowed, posterRebaseAllowed, err := isUserAllowedToPushOrForcePushInRepoBranch(ctx, pull.Issue.Poster, pull.HeadRepo, pull.HeadBranch)
 			if err != nil {
-				return false, false, err
+				return ret, err
 			}
-			if !pushAllowed {
-				pushAllowed = posterPushAllowed
+			if !ret.MergeAllowed {
+				ret.MergeAllowed = posterPushAllowed
 			}
-			if !rebaseAllowed {
-				rebaseAllowed = posterRebaseAllowed
+			if !ret.RebaseAllowed {
+				ret.RebaseAllowed = posterRebaseAllowed
 			}
 		}
 	}
 
-	// 5. check base repository's AllowRebaseUpdate configuration
-	// it is a config in base repo but controls the head (fork) repo's "Update" behavior
-	return pushAllowed, rebaseAllowed && prBaseUnit.PullRequestsConfig().AllowRebaseUpdate, nil
+	// 5. apply base repository's update configuration; it is a config on the base repo,
+	// but it controls the head (fork) repo's "Update" behavior.
+	prConfig := prBaseUnit.PullRequestsConfig()
+	ret.MergeAllowed = ret.MergeAllowed && prConfig.AllowMergeUpdate
+	ret.RebaseAllowed = ret.RebaseAllowed && prConfig.AllowRebaseUpdate
+	ret.DefaultUpdateStyle = prConfig.DefaultUpdateStyle
+	return ret, nil
 }
 
 func syncCommitDivergence(ctx context.Context, pr *issues_model.PullRequest) error {
diff --git a/services/pull/update_rebase.go b/services/pull/update_rebase.go
index 6b90e5d7762..2479db54c16 100644
--- a/services/pull/update_rebase.go
+++ b/services/pull/update_rebase.go
@@ -8,14 +8,14 @@ import (
 	"fmt"
 	"strings"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
 )
 
 // updateHeadByRebaseOnToBase handles updating a PR's head branch by rebasing it on the PR current base branch
diff --git a/services/pull/update_test.go b/services/pull/update_test.go
index 0bb67544455..b340a7a5d57 100644
--- a/services/pull/update_test.go
+++ b/services/pull/update_test.go
@@ -4,17 +4,18 @@
 package pull
 
 import (
+	"context"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -23,11 +24,21 @@ import (
 func TestIsUserAllowedToUpdate(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
 
-	setRepoAllowRebaseUpdate := func(t *testing.T, repoID int64, allow bool) {
+	updatePRConfig := func(t *testing.T, repoID int64, update func(*repo_model.PullRequestsConfig)) {
 		repoUnit := unittest.AssertExistsAndLoadBean(t, &repo_model.RepoUnit{RepoID: repoID, Type: unit.TypePullRequests})
-		repoUnit.PullRequestsConfig().AllowRebaseUpdate = allow
+		update(repoUnit.PullRequestsConfig())
 		require.NoError(t, repo_model.UpdateRepoUnitConfig(t.Context(), repoUnit))
 	}
+	setRepoAllowRebaseUpdate := func(t *testing.T, repoID int64, allow bool) {
+		updatePRConfig(t, repoID, func(c *repo_model.PullRequestsConfig) { c.AllowRebaseUpdate = allow })
+	}
+	setRepoAllowMergeUpdate := func(t *testing.T, repoID int64, allow bool) {
+		updatePRConfig(t, repoID, func(c *repo_model.PullRequestsConfig) { c.AllowMergeUpdate = allow })
+	}
+	checkUserAllowedToUpdate := func(ctx context.Context, pull *issues_model.PullRequest, user *user_model.User) (bool, bool, repo_model.UpdateStyle, error) {
+		ret, err := CheckUserAllowedToUpdate(ctx, pull, user)
+		return ret.MergeAllowed, ret.RebaseAllowed, ret.DefaultUpdateStyle, err
+	}
 
 	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 
@@ -43,21 +54,33 @@ func TestIsUserAllowedToUpdate(t *testing.T) {
 		require.NoError(t, err)
 		defer db.DeleteByBean(t.Context(), protectedBranch)
 
-		pushAllowed, rebaseAllowed, err := IsUserAllowedToUpdate(t.Context(), pr2, user2)
+		pushAllowed, rebaseAllowed, defaultMergeStyle, err := checkUserAllowedToUpdate(t.Context(), pr2, user2)
 		assert.NoError(t, err)
 		assert.False(t, pushAllowed)
 		assert.False(t, rebaseAllowed)
+		assert.Equal(t, repo_model.UpdateStyleMerge, defaultMergeStyle)
 	})
 
 	t.Run("DisallowRebaseWhenConfigDisabled", func(t *testing.T) {
 		pr2 := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: 2})
 		setRepoAllowRebaseUpdate(t, pr2.BaseRepoID, false)
-		pushAllowed, rebaseAllowed, err := IsUserAllowedToUpdate(t.Context(), pr2, user2)
+		pushAllowed, rebaseAllowed, _, err := checkUserAllowedToUpdate(t.Context(), pr2, user2)
 		assert.NoError(t, err)
 		assert.True(t, pushAllowed)
 		assert.False(t, rebaseAllowed)
 	})
 
+	t.Run("DisallowMergeWhenConfigDisabled", func(t *testing.T) {
+		pr2 := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: 2})
+		setRepoAllowRebaseUpdate(t, pr2.BaseRepoID, true)
+		setRepoAllowMergeUpdate(t, pr2.BaseRepoID, false)
+		pushAllowed, rebaseAllowed, _, err := checkUserAllowedToUpdate(t.Context(), pr2, user2)
+		assert.NoError(t, err)
+		assert.False(t, pushAllowed)
+		assert.True(t, rebaseAllowed)
+		setRepoAllowMergeUpdate(t, pr2.BaseRepoID, true)
+	})
+
 	t.Run("ReadOnlyAccessDenied", func(t *testing.T) {
 		pr2 := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: 2})
 		user4 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
@@ -73,7 +96,7 @@ func TestIsUserAllowedToUpdate(t *testing.T) {
 		require.NoError(t, pr2.LoadHeadRepo(t.Context()))
 		assert.NoError(t, access_model.RecalculateUserAccess(t.Context(), pr2.HeadRepo, user4.ID))
 
-		pushAllowed, rebaseAllowed, err := IsUserAllowedToUpdate(t.Context(), pr2, user4)
+		pushAllowed, rebaseAllowed, _, err := checkUserAllowedToUpdate(t.Context(), pr2, user4)
 		assert.NoError(t, err)
 		assert.False(t, pushAllowed)
 		assert.False(t, rebaseAllowed)
@@ -91,7 +114,7 @@ func TestIsUserAllowedToUpdate(t *testing.T) {
 		require.NoError(t, err)
 		defer db.DeleteByBean(t.Context(), protectedBranch)
 
-		pushAllowed, rebaseAllowed, err := IsUserAllowedToUpdate(t.Context(), pr2, user2)
+		pushAllowed, rebaseAllowed, _, err := checkUserAllowedToUpdate(t.Context(), pr2, user2)
 		assert.NoError(t, err)
 		assert.True(t, pushAllowed)
 		assert.False(t, rebaseAllowed)
@@ -102,7 +125,7 @@ func TestIsUserAllowedToUpdate(t *testing.T) {
 	t.Run("MaintainerEditRespectsPosterPermissions", func(t *testing.T) {
 		pr3 := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: 3})
 		pr3.AllowMaintainerEdit = true
-		pushAllowed, rebaseAllowed, err := IsUserAllowedToUpdate(t.Context(), pr3, pr3Poster)
+		pushAllowed, rebaseAllowed, _, err := checkUserAllowedToUpdate(t.Context(), pr3, pr3Poster)
 		assert.NoError(t, err)
 		assert.False(t, pushAllowed)
 		assert.False(t, rebaseAllowed)
@@ -132,7 +155,7 @@ func TestIsUserAllowedToUpdate(t *testing.T) {
 		require.NoError(t, pr3.LoadHeadRepo(t.Context()))
 		assert.NoError(t, access_model.RecalculateUserAccess(t.Context(), pr3.HeadRepo, pr3Poster.ID))
 
-		pushAllowed, rebaseAllowed, err := IsUserAllowedToUpdate(t.Context(), pr3, pr3Poster)
+		pushAllowed, rebaseAllowed, _, err := checkUserAllowedToUpdate(t.Context(), pr3, pr3Poster)
 		assert.NoError(t, err)
 		assert.True(t, pushAllowed)
 		assert.True(t, rebaseAllowed)
@@ -164,7 +187,7 @@ func TestIsUserAllowedToUpdate(t *testing.T) {
 
 		setRepoAllowRebaseUpdate(t, pr3.BaseRepoID, false)
 
-		pushAllowed, rebaseAllowed, err := IsUserAllowedToUpdate(t.Context(), pr3, pr3Poster)
+		pushAllowed, rebaseAllowed, _, err := checkUserAllowedToUpdate(t.Context(), pr3, pr3Poster)
 		assert.NoError(t, err)
 		assert.True(t, pushAllowed)
 		assert.False(t, rebaseAllowed)
diff --git a/services/release/notes.go b/services/release/notes.go
index 92ee22e6043..b8baeb9620a 100644
--- a/services/release/notes.go
+++ b/services/release/notes.go
@@ -10,12 +10,12 @@ import (
 	"slices"
 	"strings"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/util"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/util"
 )
 
 // GenerateReleaseNotesOptions describes how to build release notes content.
diff --git a/services/release/notes_test.go b/services/release/notes_test.go
index 211c364debf..2922da424b5 100644
--- a/services/release/notes_test.go
+++ b/services/release/notes_test.go
@@ -6,13 +6,13 @@ package release
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/timeutil"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/timeutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/release/release.go b/services/release/release.go
index a4825011640..1be60731a93 100644
--- a/services/release/release.go
+++ b/services/release/release.go
@@ -9,21 +9,21 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	notify_service "gitea.dev/services/notify"
 )
 
 // ErrInvalidTagName represents a "InvalidTagName" kind of error.
diff --git a/services/release/release_test.go b/services/release/release_test.go
index ef495632a75..579d92f2f4b 100644
--- a/services/release/release_test.go
+++ b/services/release/release_test.go
@@ -8,13 +8,14 @@ import (
 	"testing"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/services/attachment"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/services/attachment"
 
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models/actions"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -138,6 +139,12 @@ func TestRelease_Update(t *testing.T) {
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
+	// Advance a mocked clock between create and update instead of sleeping, so the
+	// timestamp-sensitive assertions below stay deterministic.
+	fakeNow := time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)
+	defer timeutil.MockSet(fakeNow)()
+	advance := func() { fakeNow = fakeNow.Add(time.Second); timeutil.MockSet(fakeNow) }
+
 	// Test a changed release
 	assert.NoError(t, CreateRelease(gitRepo, &repo_model.Release{
 		RepoID:       repo.ID,
@@ -155,7 +162,7 @@ func TestRelease_Update(t *testing.T) {
 	release, err := repo_model.GetRelease(t.Context(), repo.ID, "v1.1.1")
 	assert.NoError(t, err)
 	releaseCreatedUnix := release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Note = "Changed note"
 	assert.NoError(t, UpdateRelease(t.Context(), user, gitRepo, release, nil, nil, nil))
 	release, err = repo_model.GetReleaseByID(t.Context(), release.ID)
@@ -179,7 +186,7 @@ func TestRelease_Update(t *testing.T) {
 	release, err = repo_model.GetRelease(t.Context(), repo.ID, "v1.2.1")
 	assert.NoError(t, err)
 	releaseCreatedUnix = release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Title = "Changed title"
 	assert.NoError(t, UpdateRelease(t.Context(), user, gitRepo, release, nil, nil, nil))
 	release, err = repo_model.GetReleaseByID(t.Context(), release.ID)
@@ -203,7 +210,7 @@ func TestRelease_Update(t *testing.T) {
 	release, err = repo_model.GetRelease(t.Context(), repo.ID, "v1.3.1")
 	assert.NoError(t, err)
 	releaseCreatedUnix = release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Title = "Changed title"
 	release.Note = "Changed note"
 	assert.NoError(t, UpdateRelease(t.Context(), user, gitRepo, release, nil, nil, nil))
@@ -280,6 +287,12 @@ func TestRelease_createTag(t *testing.T) {
 	assert.NoError(t, err)
 	defer gitRepo.Close()
 
+	// Advance a mocked clock between create and update instead of sleeping, so the
+	// timestamp-sensitive assertions below stay deterministic.
+	fakeNow := time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)
+	defer timeutil.MockSet(fakeNow)()
+	advance := func() { fakeNow = fakeNow.Add(time.Second); timeutil.MockSet(fakeNow) }
+
 	// Test a changed release
 	release := &repo_model.Release{
 		RepoID:       repo.ID,
@@ -298,7 +311,7 @@ func TestRelease_createTag(t *testing.T) {
 	assert.NoError(t, err)
 	assert.NotEmpty(t, release.CreatedUnix)
 	releaseCreatedUnix := release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Note = "Changed note"
 	_, err = createTag(t.Context(), gitRepo, release, "")
 	assert.NoError(t, err)
@@ -321,7 +334,7 @@ func TestRelease_createTag(t *testing.T) {
 	_, err = createTag(t.Context(), gitRepo, release, "")
 	assert.NoError(t, err)
 	releaseCreatedUnix = release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Title = "Changed title"
 	_, err = createTag(t.Context(), gitRepo, release, "")
 	assert.NoError(t, err)
@@ -344,7 +357,7 @@ func TestRelease_createTag(t *testing.T) {
 	_, err = createTag(t.Context(), gitRepo, release, "")
 	assert.NoError(t, err)
 	releaseCreatedUnix = release.CreatedUnix
-	time.Sleep(2 * time.Second) // sleep 2 seconds to ensure a different timestamp
+	advance()
 	release.Title = "Changed title"
 	release.Note = "Changed note"
 	_, err = createTag(t.Context(), gitRepo, release, "")
diff --git a/services/release/tag.go b/services/release/tag.go
index dae2b70f76b..2a880733916 100644
--- a/services/release/tag.go
+++ b/services/release/tag.go
@@ -8,12 +8,12 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
-	repo_module "code.gitea.io/gitea/modules/repository"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
+	repo_module "gitea.dev/modules/repository"
 
 	"xorm.io/builder"
 )
diff --git a/services/repository/adopt.go b/services/repository/adopt.go
index 1255967e599..a05cfb66dfd 100644
--- a/services/repository/adopt.go
+++ b/services/repository/adopt.go
@@ -11,19 +11,19 @@ import (
 	"path/filepath"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	notify_service "gitea.dev/services/notify"
 )
 
 func deleteFailedAdoptRepository(repoID int64) error {
diff --git a/services/repository/adopt_test.go b/services/repository/adopt_test.go
index a7de9180859..89a506f6690 100644
--- a/services/repository/adopt_test.go
+++ b/services/repository/adopt_test.go
@@ -9,12 +9,12 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/archiver/archiver.go b/services/repository/archiver/archiver.go
index f7069f226be..93e83b51de5 100644
--- a/services/repository/archiver/archiver.go
+++ b/services/repository/archiver/archiver.go
@@ -12,20 +12,20 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/util"
-	gitea_context "code.gitea.io/gitea/services/context"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/util"
+	gitea_context "gitea.dev/services/context"
 )
 
 // ArchiveRequest defines the parameters of an archive request, which notably
diff --git a/services/repository/archiver/archiver_test.go b/services/repository/archiver/archiver_test.go
index 6cc1856a9c9..16a4750a8b1 100644
--- a/services/repository/archiver/archiver_test.go
+++ b/services/repository/archiver/archiver_test.go
@@ -7,11 +7,11 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/contexttest"
 
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models/actions"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/repository/avatar.go b/services/repository/avatar.go
index 7ab6badfc34..fabe8dea637 100644
--- a/services/repository/avatar.go
+++ b/services/repository/avatar.go
@@ -9,11 +9,11 @@ import (
 	"io"
 	"strconv"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/avatar"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/storage"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/avatar"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/storage"
 )
 
 // UploadAvatar saves custom avatar for repository.
diff --git a/services/repository/avatar_test.go b/services/repository/avatar_test.go
index 6c7b9e6d26f..67f41a1b602 100644
--- a/services/repository/avatar_test.go
+++ b/services/repository/avatar_test.go
@@ -9,9 +9,9 @@ import (
 	"image/png"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/avatar"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/avatar"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/branch.go b/services/repository/branch.go
index dc17e4f2fe9..9ab485ca717 100644
--- a/services/repository/branch.go
+++ b/services/repository/branch.go
@@ -9,30 +9,30 @@ import (
 	"fmt"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/queue"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	actions_service "code.gitea.io/gitea/services/actions"
-	notify_service "code.gitea.io/gitea/services/notify"
-	release_service "code.gitea.io/gitea/services/release"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/queue"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
+	actions_service "gitea.dev/services/actions"
+	notify_service "gitea.dev/services/notify"
+	release_service "gitea.dev/services/release"
 
 	"xorm.io/builder"
 )
@@ -359,7 +359,7 @@ func SyncBranchesToDB(ctx context.Context, repoID, pusherID int64, branchNames,
 				RepoID:        repoID,
 				Name:          branchName,
 				CommitID:      commit.ID.String(),
-				CommitMessage: commit.Summary(),
+				CommitMessage: commit.MessageTitle(),
 				PusherID:      pusherID,
 				CommitTime:    timeutil.TimeStamp(commit.Committer.When.Unix()),
 			})
diff --git a/services/repository/cache.go b/services/repository/cache.go
index 4fc8d3ddf78..ff1955f1827 100644
--- a/services/repository/cache.go
+++ b/services/repository/cache.go
@@ -6,10 +6,10 @@ package repository
 import (
 	"context"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
 )
 
 // CacheRef cachhe last commit information of the branch or the tag
diff --git a/services/repository/check.go b/services/repository/check.go
index 4ae49d81f64..8f73186181f 100644
--- a/services/repository/check.go
+++ b/services/repository/check.go
@@ -9,14 +9,14 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	system_model "code.gitea.io/gitea/models/system"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	system_model "gitea.dev/models/system"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
 
 	"xorm.io/builder"
 )
diff --git a/services/repository/collaboration.go b/services/repository/collaboration.go
index cb56d90ae2b..9bbafb5c0c3 100644
--- a/services/repository/collaboration.go
+++ b/services/repository/collaboration.go
@@ -8,12 +8,12 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
 
 	"xorm.io/builder"
 )
diff --git a/services/repository/collaboration_test.go b/services/repository/collaboration_test.go
index 56d9d72e0a1..7cdd91b3847 100644
--- a/services/repository/collaboration_test.go
+++ b/services/repository/collaboration_test.go
@@ -6,13 +6,13 @@ package repository
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/commit.go b/services/repository/commit.go
index e8c0262ef41..3eb0e66b396 100644
--- a/services/repository/commit.go
+++ b/services/repository/commit.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/modules/util"
-	gitea_ctx "code.gitea.io/gitea/services/context"
+	"gitea.dev/modules/util"
+	gitea_ctx "gitea.dev/services/context"
 )
 
 type ContainedLinks struct { // TODO: better name?
diff --git a/services/repository/commitstatus/commitstatus.go b/services/repository/commitstatus/commitstatus.go
index 26a8c6140dd..63b31a1c4b4 100644
--- a/services/repository/commitstatus/commitstatus.go
+++ b/services/repository/commitstatus/commitstatus.go
@@ -9,18 +9,18 @@ import (
 	"fmt"
 	"slices"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/services/notify"
 )
 
 func getCacheKey(repoID int64, brancheName string) string {
diff --git a/services/repository/contributors_graph.go b/services/repository/contributors_graph.go
index 9953d61b8e7..503ce968c16 100644
--- a/services/repository/contributors_graph.go
+++ b/services/repository/contributors_graph.go
@@ -13,16 +13,16 @@ import (
 	"sync"
 	"time"
 
-	"code.gitea.io/gitea/models/avatars"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models/avatars"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
 )
 
 const (
diff --git a/services/repository/contributors_graph_test.go b/services/repository/contributors_graph_test.go
index efdecf4b813..fb9695c1d96 100644
--- a/services/repository/contributors_graph_test.go
+++ b/services/repository/contributors_graph_test.go
@@ -7,10 +7,10 @@ import (
 	"slices"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/setting"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/setting"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/create.go b/services/repository/create.go
index b0b1f4e7c76..636f4a803bc 100644
--- a/services/repository/create.go
+++ b/services/repository/create.go
@@ -12,32 +12,33 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	system_model "code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/options"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/templates/vars"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	system_model "gitea.dev/models/system"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/options"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/templates/vars"
+	"gitea.dev/modules/util"
 )
 
 // CreateRepoOptions contains the create repository options
 type CreateRepoOptions struct {
 	Name             string
 	Description      string
+	Website          string
 	OriginalURL      string
 	GitServiceType   api.GitServiceType
 	Gitignores       string
@@ -151,6 +152,16 @@ func initRepository(ctx context.Context, u *user_model.User, repo *repo_model.Re
 		return fmt.Errorf("createDelegateHooks: %w", err)
 	}
 
+	repo.DefaultBranch = util.IfZero(opts.DefaultBranch, setting.Repository.DefaultBranch)
+	repo.DefaultWikiBranch = setting.Repository.DefaultBranch
+	if !opts.AutoInit {
+		repo.IsEmpty = true
+	}
+
+	if err = repo_model.UpdateRepositoryColsNoAutoTime(ctx, repo, "is_empty", "default_branch", "default_wiki_branch"); err != nil {
+		return fmt.Errorf("updateRepository: %w", err)
+	}
+
 	// Initialize repository according to user's choice.
 	if opts.AutoInit {
 		tmpDir, cleanup, err := setting.AppDataTempDir("git-repo-content").MkdirTempRandom("repos-" + repo.Name)
@@ -164,39 +175,22 @@ func initRepository(ctx context.Context, u *user_model.User, repo *repo_model.Re
 		}
 
 		// Apply changes and commit.
-		if err = initRepoCommit(ctx, tmpDir, repo, u, opts.DefaultBranch); err != nil {
+		if err = initRepoCommit(ctx, tmpDir, repo, u); err != nil {
 			return fmt.Errorf("initRepoCommit: %w", err)
 		}
 	}
 
-	// Re-fetch the repository from database before updating it (else it would
-	// override changes that were done earlier with sql)
+	if err = gitrepo.SetDefaultBranch(ctx, repo, repo.DefaultBranch); err != nil {
+		return fmt.Errorf("setDefaultBranch: %w", err)
+	}
+
+	// Re-fetch the repository from database before updating it (keep changes that were done earlier with SQL)
 	if repo, err = repo_model.GetRepositoryByID(ctx, repo.ID); err != nil {
 		return fmt.Errorf("getRepositoryByID: %w", err)
 	}
 
-	if !opts.AutoInit {
-		repo.IsEmpty = true
-	}
-
-	repo.DefaultBranch = setting.Repository.DefaultBranch
-	repo.DefaultWikiBranch = setting.Repository.DefaultBranch
-
-	if len(opts.DefaultBranch) > 0 {
-		repo.DefaultBranch = opts.DefaultBranch
-		if err = gitrepo.SetDefaultBranch(ctx, repo, repo.DefaultBranch); err != nil {
-			return fmt.Errorf("setDefaultBranch: %w", err)
-		}
-
-		if !repo.IsEmpty {
-			if _, err := repo_module.SyncRepoBranches(ctx, repo.ID, u.ID); err != nil {
-				return fmt.Errorf("SyncRepoBranches: %w", err)
-			}
-		}
-	}
-
-	if err = repo_model.UpdateRepositoryColsNoAutoTime(ctx, repo, "is_empty", "default_branch", "default_wiki_branch"); err != nil {
-		return fmt.Errorf("updateRepository: %w", err)
+	if _, err := repo_module.SyncRepoBranches(ctx, repo.ID, u.ID); err != nil {
+		return fmt.Errorf("SyncRepoBranches: %w", err)
 	}
 
 	if err = repo_module.UpdateRepoSize(ctx, repo); err != nil {
@@ -242,6 +236,7 @@ func CreateRepositoryDirectly(ctx context.Context, doer, owner *user_model.User,
 		Name:                            opts.Name,
 		LowerName:                       strings.ToLower(opts.Name),
 		Description:                     opts.Description,
+		Website:                         opts.Website,
 		OriginalURL:                     opts.OriginalURL,
 		OriginalServiceType:             opts.GitServiceType,
 		IsPrivate:                       opts.IsPrivate,
diff --git a/services/repository/create_test.go b/services/repository/create_test.go
index b8c2ea59ddb..60f9f2b43b4 100644
--- a/services/repository/create_test.go
+++ b/services/repository/create_test.go
@@ -7,10 +7,10 @@ import (
 	"os"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/delete.go b/services/repository/delete.go
index aa16a968f71..d1b41f980bc 100644
--- a/services/repository/delete.go
+++ b/services/repository/delete.go
@@ -7,30 +7,30 @@ import (
 	"context"
 	"fmt"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	activities_model "code.gitea.io/gitea/models/activities"
-	admin_model "code.gitea.io/gitea/models/admin"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	secret_model "code.gitea.io/gitea/models/secret"
-	system_model "code.gitea.io/gitea/models/system"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/models/webhook"
-	actions_module "code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/storage"
-	actions_service "code.gitea.io/gitea/services/actions"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	issue_service "code.gitea.io/gitea/services/issue"
+	actions_model "gitea.dev/models/actions"
+	activities_model "gitea.dev/models/activities"
+	admin_model "gitea.dev/models/admin"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	access_model "gitea.dev/models/perm/access"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	secret_model "gitea.dev/models/secret"
+	system_model "gitea.dev/models/system"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/models/webhook"
+	actions_module "gitea.dev/modules/actions"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/storage"
+	actions_service "gitea.dev/services/actions"
+	asymkey_service "gitea.dev/services/asymkey"
+	issue_service "gitea.dev/services/issue"
 
 	"xorm.io/builder"
 )
diff --git a/services/repository/delete_test.go b/services/repository/delete_test.go
index f06373f24ab..b85ad107369 100644
--- a/services/repository/delete_test.go
+++ b/services/repository/delete_test.go
@@ -6,11 +6,11 @@ package repository_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	repo_service "gitea.dev/services/repository"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/files/cherry_pick.go b/services/repository/files/cherry_pick.go
index 5018327d0f2..479c76b965d 100644
--- a/services/repository/files/cherry_pick.go
+++ b/services/repository/files/cherry_pick.go
@@ -9,13 +9,13 @@ import (
 	"fmt"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/pull"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/structs"
+	"gitea.dev/services/pull"
 )
 
 // ErrCommitIDDoesNotMatch represents a "CommitIDDoesNotMatch" kind of error.
diff --git a/services/repository/files/commit.go b/services/repository/files/commit.go
index 2e279214949..2a941b0dd74 100644
--- a/services/repository/files/commit.go
+++ b/services/repository/files/commit.go
@@ -6,9 +6,9 @@ package files
 import (
 	"context"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/structs"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/structs"
+	asymkey_service "gitea.dev/services/asymkey"
 )
 
 // GetPayloadCommitVerification returns the verification information of a commit
diff --git a/services/repository/files/content.go b/services/repository/files/content.go
index 9b042f9e67a..42e8c193aa9 100644
--- a/services/repository/files/content.go
+++ b/services/repository/files/content.go
@@ -10,15 +10,15 @@ import (
 	"path"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/v1/utils"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/v1/utils"
 )
 
 // ContentType repo content type
@@ -179,7 +179,7 @@ func getFileContentsByEntryInternal(ctx context.Context, repo *repo_model.Reposi
 			}
 		}
 		if opts.IncludeCommitMessage {
-			contentsResponse.LastCommitMessage = new(lastCommit.Message())
+			contentsResponse.LastCommitMessage = new(lastCommit.MessageUTF8())
 		}
 	}
 
diff --git a/services/repository/files/content_test.go b/services/repository/files/content_test.go
index dda5572ad0a..52b7e8a013f 100644
--- a/services/repository/files/content_test.go
+++ b/services/repository/files/content_test.go
@@ -6,11 +6,11 @@ package files
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/unittest"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/contexttest"
 
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models/actions"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/files/diff.go b/services/repository/files/diff.go
index aa4b55a307d..ff52faa8ebb 100644
--- a/services/repository/files/diff.go
+++ b/services/repository/files/diff.go
@@ -7,8 +7,8 @@ import (
 	"context"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/services/gitdiff"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/services/gitdiff"
 )
 
 // GetDiffPreview produces and returns diff result of a file which is not yet committed.
diff --git a/services/repository/files/diff_test.go b/services/repository/files/diff_test.go
index 52958796210..373e283e227 100644
--- a/services/repository/files/diff_test.go
+++ b/services/repository/files/diff_test.go
@@ -6,11 +6,11 @@ package files
 import (
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/services/contexttest"
-	"code.gitea.io/gitea/services/gitdiff"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/json"
+	"gitea.dev/services/contexttest"
+	"gitea.dev/services/gitdiff"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/files/file.go b/services/repository/files/file.go
index f48e32b427b..df88ee4d892 100644
--- a/services/repository/files/file.go
+++ b/services/repository/files/file.go
@@ -11,12 +11,12 @@ import (
 	"strings"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/v1/utils"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/v1/utils"
 )
 
 func GetContentsListFromTreePaths(ctx context.Context, repo *repo_model.Repository, gitRepo *git.Repository, refCommit *utils.RefCommit, treePaths []string) (files []*api.ContentsResponse) {
@@ -110,7 +110,7 @@ func GetFileCommitResponse(repo *repo_model.Repository, commit *git.Commit) (*ap
 			},
 			Date: commit.Committer.When.UTC().Format(time.RFC3339),
 		},
-		Message: commit.Message(),
+		Message: commit.MessageUTF8(),
 		Tree: &api.CommitMeta{
 			URL: commitTreeURL.String(),
 			SHA: commit.Tree.ID.String(),
diff --git a/services/repository/files/patch.go b/services/repository/files/patch.go
index 10f923f2e14..8c797a24ec6 100644
--- a/services/repository/files/patch.go
+++ b/services/repository/files/patch.go
@@ -8,16 +8,16 @@ import (
 	"fmt"
 	"strings"
 
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	asymkey_service "gitea.dev/services/asymkey"
 )
 
 // ErrUserCannotCommit represents "UserCannotCommit" kind of error.
diff --git a/services/repository/files/temp_repo.go b/services/repository/files/temp_repo.go
index 5d5cc22513b..b36f5f192a8 100644
--- a/services/repository/files/temp_repo.go
+++ b/services/repository/files/temp_repo.go
@@ -14,17 +14,17 @@ import (
 	"strings"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	"code.gitea.io/gitea/services/gitdiff"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	asymkey_service "gitea.dev/services/asymkey"
+	"gitea.dev/services/gitdiff"
 )
 
 // TemporaryUploadRepository is a type to wrap our upload repositories as a shallow clone
diff --git a/services/repository/files/temp_repo_test.go b/services/repository/files/temp_repo_test.go
index 89e44e2721b..cb651674ea1 100644
--- a/services/repository/files/temp_repo_test.go
+++ b/services/repository/files/temp_repo_test.go
@@ -7,8 +7,8 @@ import (
 	"bytes"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
 
 	"github.com/stretchr/testify/require"
 )
diff --git a/services/repository/files/tree.go b/services/repository/files/tree.go
index fc361273388..7b822db0abd 100644
--- a/services/repository/files/tree.go
+++ b/services/repository/files/tree.go
@@ -12,13 +12,14 @@ import (
 	"sort"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
 )
 
 // ErrSHANotFound represents a "SHADoesNotMatch" kind of error.
@@ -164,7 +165,7 @@ func sortTreeViewNodes(nodes []*TreeViewNode) {
 		if a != b {
 			return a < b
 		}
-		return nodes[i].EntryName < nodes[j].EntryName
+		return base.NaturalSortCompare(nodes[i].EntryName, nodes[j].EntryName) < 0
 	})
 }
 
diff --git a/services/repository/files/tree_test.go b/services/repository/files/tree_test.go
index b85f65f431e..fe42bdb0541 100644
--- a/services/repository/files/tree_test.go
+++ b/services/repository/files/tree_test.go
@@ -7,11 +7,11 @@ import (
 	"html/template"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/fileicon"
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/contexttest"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/fileicon"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/contexttest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/files/update.go b/services/repository/files/update.go
index 3523b2d342c..8da9021a407 100644
--- a/services/repository/files/update.go
+++ b/services/repository/files/update.go
@@ -12,20 +12,20 @@ import (
 	"strings"
 	"time"
 
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/attribute"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/v1/utils"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	pull_service "code.gitea.io/gitea/services/pull"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/attribute"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/v1/utils"
+	asymkey_service "gitea.dev/services/asymkey"
+	pull_service "gitea.dev/services/pull"
 )
 
 // IdentityOptions for a person's identity like an author or committer
diff --git a/services/repository/files/upload.go b/services/repository/files/upload.go
index b783cbd01de..b131afb16d8 100644
--- a/services/repository/files/upload.go
+++ b/services/repository/files/upload.go
@@ -10,9 +10,9 @@ import (
 	"path"
 	"sync"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
 )
 
 // UploadRepoFileOptions contains the uploaded repository file options
diff --git a/services/repository/fork.go b/services/repository/fork.go
index 8cf41d56540..a469836da03 100644
--- a/services/repository/fork.go
+++ b/services/repository/fork.go
@@ -9,18 +9,18 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	notify_service "gitea.dev/services/notify"
 
 	"xorm.io/builder"
 )
diff --git a/services/repository/fork_test.go b/services/repository/fork_test.go
index 680a7f3207e..2549e695615 100644
--- a/services/repository/fork_test.go
+++ b/services/repository/fork_test.go
@@ -7,12 +7,12 @@ import (
 	"os"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/generate.go b/services/repository/generate.go
index 83e9c22e54e..361f7cc3d56 100644
--- a/services/repository/generate.go
+++ b/services/repository/generate.go
@@ -18,15 +18,15 @@ import (
 	"sync"
 	"time"
 
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/huandu/xstrings"
 )
@@ -207,6 +207,9 @@ func processGiteaTemplateFile(ctx context.Context, tmpDir string, templateRepo,
 }
 
 func generateRepoCommit(ctx context.Context, repo, templateRepo, generateRepo *repo_model.Repository, tmpDir string) error {
+	// set default branch based on whether it's specified in the newly generated repo or not
+	repo.DefaultBranch = util.IfZero(repo.DefaultBranch, util.IfZero(templateRepo.DefaultBranch, setting.Repository.DefaultBranch))
+
 	// Clone to temporary path and do the init commit.
 	if err := gitrepo.CloneRepoToLocal(ctx, templateRepo, tmpDir, git.CloneRepoOptions{
 		Depth:  1,
@@ -246,13 +249,7 @@ func generateRepoCommit(ctx context.Context, repo, templateRepo, generateRepo *r
 		return fmt.Errorf("failed to add submodules: %v", err)
 	}
 
-	// set default branch based on whether it's specified in the newly generated repo or not
-	defaultBranch := repo.DefaultBranch
-	if strings.TrimSpace(defaultBranch) == "" {
-		defaultBranch = templateRepo.DefaultBranch
-	}
-
-	return initRepoCommit(ctx, tmpDir, repo, repo.Owner, defaultBranch)
+	return initRepoCommit(ctx, tmpDir, repo, repo.Owner)
 }
 
 // GenerateGitContent generates git content from a template repository
@@ -266,17 +263,6 @@ func GenerateGitContent(ctx context.Context, templateRepo, generateRepo *repo_mo
 	if err = generateRepoCommit(ctx, generateRepo, templateRepo, generateRepo, tmpDir); err != nil {
 		return fmt.Errorf("generateRepoCommit: %w", err)
 	}
-
-	// re-fetch repo
-	if generateRepo, err = repo_model.GetRepositoryByID(ctx, generateRepo.ID); err != nil {
-		return fmt.Errorf("getRepositoryByID: %w", err)
-	}
-
-	// if there was no default branch supplied when generating the repo, use the default one from the template
-	if strings.TrimSpace(generateRepo.DefaultBranch) == "" {
-		generateRepo.DefaultBranch = templateRepo.DefaultBranch
-	}
-
 	if err = gitrepo.SetDefaultBranch(ctx, generateRepo, generateRepo.DefaultBranch); err != nil {
 		return fmt.Errorf("setDefaultBranch: %w", err)
 	}
@@ -291,6 +277,10 @@ func GenerateGitContent(ctx context.Context, templateRepo, generateRepo *repo_mo
 	if err := git_model.CopyLFS(ctx, generateRepo, templateRepo); err != nil {
 		return fmt.Errorf("failed to copy LFS: %w", err)
 	}
+
+	if _, err := repo_module.SyncRepoBranches(ctx, generateRepo.ID, 0); err != nil {
+		return fmt.Errorf("SyncRepoBranches: %w", err)
+	}
 	return nil
 }
 
diff --git a/services/repository/generate_test.go b/services/repository/generate_test.go
index 160dbb9a06b..d484f7360a9 100644
--- a/services/repository/generate_test.go
+++ b/services/repository/generate_test.go
@@ -9,7 +9,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
+	repo_model "gitea.dev/models/repo"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/repository/gitgraph/graph.go b/services/repository/gitgraph/graph.go
index 8d9bec47f85..ab0203f4d52 100644
--- a/services/repository/gitgraph/graph.go
+++ b/services/repository/gitgraph/graph.go
@@ -7,9 +7,9 @@ import (
 	"bufio"
 	"bytes"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
 )
 
 // GetCommitGraph return a list of commit (GraphItems) from all branches
diff --git a/services/repository/gitgraph/graph_models.go b/services/repository/gitgraph/graph_models.go
index fc2eb85b87f..82092f71f36 100644
--- a/services/repository/gitgraph/graph_models.go
+++ b/services/repository/gitgraph/graph_models.go
@@ -10,14 +10,14 @@ import (
 	"strings"
 	"time"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	asymkey_service "gitea.dev/services/asymkey"
 )
 
 // NewGraph creates a basic graph
diff --git a/services/repository/gitgraph/graph_test.go b/services/repository/gitgraph/graph_test.go
index 83813e7ba76..a6cc0ae048b 100644
--- a/services/repository/gitgraph/graph_test.go
+++ b/services/repository/gitgraph/graph_test.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/git"
+	"gitea.dev/modules/git"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/gitgraph/parser.go b/services/repository/gitgraph/parser.go
index 859deff1133..ca555218d48 100644
--- a/services/repository/gitgraph/parser.go
+++ b/services/repository/gitgraph/parser.go
@@ -6,6 +6,7 @@ package gitgraph
 import (
 	"bytes"
 	"fmt"
+	"slices"
 )
 
 // Parser represents a git graph parser. It is stateful containing the previous
@@ -163,8 +164,7 @@ func (parser *Parser) ParseGlyphs(glyphs []byte) {
 	// release unused colors
 	parser.releaseUnusedColors()
 
-	for i := len(glyphs) - 1; i >= 0; i-- {
-		glyph := glyphs[i]
+	for i, glyph := range slices.Backward(glyphs) {
 		switch glyph {
 		case '|':
 			fallthrough
diff --git a/services/repository/hooks.go b/services/repository/hooks.go
index c5bd3b8a7ea..c75c66af1ec 100644
--- a/services/repository/hooks.go
+++ b/services/repository/hooks.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
 
 	"xorm.io/builder"
 )
diff --git a/services/repository/init.go b/services/repository/init.go
index 6aeb5ec6446..e32041c647e 100644
--- a/services/repository/init.go
+++ b/services/repository/init.go
@@ -9,19 +9,18 @@ import (
 	"os"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	asymkey_service "gitea.dev/services/asymkey"
 )
 
 // initRepoCommit temporarily changes with work directory.
-func initRepoCommit(ctx context.Context, tmpPath string, repo *repo_model.Repository, u *user_model.User, defaultBranch string) (err error) {
+func initRepoCommit(ctx context.Context, tmpPath string, repo *repo_model.Repository, u *user_model.User) (err error) {
 	commitTimeStr := time.Now().Format(time.RFC3339)
 
 	sig := u.NewGitSig()
@@ -69,13 +68,9 @@ func initRepoCommit(ctx context.Context, tmpPath string, repo *repo_model.Reposi
 		return fmt.Errorf("git commit: %w", err)
 	}
 
-	if len(defaultBranch) == 0 {
-		defaultBranch = setting.Repository.DefaultBranch
-	}
-
 	if err := gitrepo.PushFromLocal(ctx, tmpPath, repo, git.PushOptions{
 		LocalRefName: "HEAD",
-		Branch:       defaultBranch,
+		Branch:       repo.DefaultBranch,
 		Env:          repo_module.InternalPushingEnvironment(u, repo),
 	}); err != nil {
 		log.Error("Failed to push back to HEAD Error: %v", err)
diff --git a/services/repository/lfs.go b/services/repository/lfs.go
index 5ef2dbdac44..08a5ab494e0 100644
--- a/services/repository/lfs.go
+++ b/services/repository/lfs.go
@@ -9,14 +9,14 @@ import (
 	"fmt"
 	"time"
 
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
 )
 
 // GarbageCollectLFSMetaObjectsOptions provides options for GarbageCollectLFSMetaObjects function
diff --git a/services/repository/lfs_test.go b/services/repository/lfs_test.go
index 1335d48cb1e..cfca83d8c25 100644
--- a/services/repository/lfs_test.go
+++ b/services/repository/lfs_test.go
@@ -8,14 +8,14 @@ import (
 	"testing"
 	"time"
 
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/test"
-	repo_service "code.gitea.io/gitea/services/repository"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/test"
+	repo_service "gitea.dev/services/repository"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/license.go b/services/repository/license.go
index 8622911fa24..61c58e72820 100644
--- a/services/repository/license.go
+++ b/services/repository/license.go
@@ -8,15 +8,15 @@ import (
 	"fmt"
 	"io"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/options"
-	"code.gitea.io/gitea/modules/queue"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/options"
+	"gitea.dev/modules/queue"
 
 	licenseclassifier "github.com/google/licenseclassifier/v2"
 )
diff --git a/services/repository/license_test.go b/services/repository/license_test.go
index eb897f3c031..a8a28cdf076 100644
--- a/services/repository/license_test.go
+++ b/services/repository/license_test.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"testing"
 
-	repo_module "code.gitea.io/gitea/modules/repository"
+	repo_module "gitea.dev/modules/repository"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/repository/main_test.go b/services/repository/main_test.go
index 7ad1540aee4..67217a43026 100644
--- a/services/repository/main_test.go
+++ b/services/repository/main_test.go
@@ -6,7 +6,7 @@ package repository
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/unittest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/repository/merge_upstream.go b/services/repository/merge_upstream.go
index 692b8013035..61f27b65421 100644
--- a/services/repository/merge_upstream.go
+++ b/services/repository/merge_upstream.go
@@ -7,15 +7,15 @@ import (
 	"errors"
 	"fmt"
 
-	issue_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/reqctx"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/pull"
+	issue_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/reqctx"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/pull"
 )
 
 // MergeUpstream merges the base repository's default branch into the fork repository's current branch.
diff --git a/services/repository/migrate.go b/services/repository/migrate.go
index a51791ed293..a0182769f42 100644
--- a/services/repository/migrate.go
+++ b/services/repository/migrate.go
@@ -10,21 +10,21 @@ import (
 	"net/http"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/migration"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/migration"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
 )
 
 func cloneWiki(ctx context.Context, repo *repo_model.Repository, opts migration.MigrateOptions, migrateTimeout time.Duration) (string, error) {
diff --git a/services/repository/push.go b/services/repository/push.go
index 7c68a7f1763..c0f4405d3ef 100644
--- a/services/repository/push.go
+++ b/services/repository/push.go
@@ -10,23 +10,23 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/cache"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/queue"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	issue_service "code.gitea.io/gitea/services/issue"
-	notify_service "code.gitea.io/gitea/services/notify"
-	pull_service "code.gitea.io/gitea/services/pull"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/cache"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/queue"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	issue_service "gitea.dev/services/issue"
+	notify_service "gitea.dev/services/notify"
+	pull_service "gitea.dev/services/pull"
 )
 
 // pushQueue represents a queue to handle update pull request tests
@@ -402,7 +402,7 @@ func pushUpdateAddTags(ctx context.Context, repo *repo_model.Repository, gitRepo
 		}
 
 		rel, has := relMap[lowerTag]
-		title, note := git.SplitCommitTitleBody(tag.Message, 255)
+		title, note := git.SplitCommitTitleBody(tag.MessageUTF8(), 255)
 		if !has {
 			rel = &repo_model.Release{
 				RepoID:       repo.ID,
diff --git a/services/repository/repo_team.go b/services/repository/repo_team.go
index 9a9df290f4b..3a11d1099d2 100644
--- a/services/repository/repo_team.go
+++ b/services/repository/repo_team.go
@@ -8,12 +8,12 @@ import (
 	"errors"
 	"fmt"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/setting"
 )
 
 // TeamAddRepository adds new repository to team of organization.
diff --git a/services/repository/repo_team_test.go b/services/repository/repo_team_test.go
index 1139d06cf87..f3451aaaff8 100644
--- a/services/repository/repo_team_test.go
+++ b/services/repository/repo_team_test.go
@@ -6,9 +6,9 @@ package repository
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/repository/repository.go b/services/repository/repository.go
index 2ac95ffe3aa..2aef796009e 100644
--- a/services/repository/repository.go
+++ b/services/repository/repository.go
@@ -9,25 +9,25 @@ import (
 	"fmt"
 	"strings"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/graceful"
-	issue_indexer "code.gitea.io/gitea/modules/indexer/issues"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	notify_service "code.gitea.io/gitea/services/notify"
-	pull_service "code.gitea.io/gitea/services/pull"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	"gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/graceful"
+	issue_indexer "gitea.dev/modules/indexer/issues"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	notify_service "gitea.dev/services/notify"
+	pull_service "gitea.dev/services/pull"
 )
 
 // WebSearchRepository represents a repository returned by web search
diff --git a/services/repository/repository_test.go b/services/repository/repository_test.go
index 5a879a6aa6c..debdfe5e5af 100644
--- a/services/repository/repository_test.go
+++ b/services/repository/repository_test.go
@@ -6,11 +6,11 @@ package repository
 import (
 	"testing"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/repository/setting.go b/services/repository/setting.go
index b6873691ebc..5182c9b20ec 100644
--- a/services/repository/setting.go
+++ b/services/repository/setting.go
@@ -7,11 +7,11 @@ import (
 	"context"
 	"slices"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/modules/log"
-	actions_service "code.gitea.io/gitea/services/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/modules/log"
+	actions_service "gitea.dev/services/actions"
 )
 
 // UpdateRepositoryUnits updates a repository's units
diff --git a/services/repository/template.go b/services/repository/template.go
index c49e2cdde02..96f7cdb4493 100644
--- a/services/repository/template.go
+++ b/services/repository/template.go
@@ -8,14 +8,14 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/log"
-	notify_service "code.gitea.io/gitea/services/notify"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/log"
+	notify_service "gitea.dev/services/notify"
 )
 
 // GenerateIssueLabels generates issue labels from a template repository
diff --git a/services/repository/transfer.go b/services/repository/transfer.go
index 217ecb0124d..76051ac4f71 100644
--- a/services/repository/transfer.go
+++ b/services/repository/transfer.go
@@ -8,21 +8,20 @@ import (
 	"fmt"
 	"strings"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	notify_service "code.gitea.io/gitea/services/notify"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/util"
+	notify_service "gitea.dev/services/notify"
 )
 
 type LimitReachedError struct{ Limit int }
@@ -62,8 +61,7 @@ func AcceptTransferOwnership(ctx context.Context, repo *repo_model.Repository, d
 		}
 
 		if !doer.CanCreateRepoIn(repoTransfer.Recipient) {
-			limit := util.Iif(repoTransfer.Recipient.MaxRepoCreation >= 0, repoTransfer.Recipient.MaxRepoCreation, setting.Repository.MaxCreationLimit)
-			return LimitReachedError{Limit: limit}
+			return LimitReachedError{Limit: repoTransfer.Recipient.MaxCreationLimit()}
 		}
 
 		if !repoTransfer.CanUserAcceptOrRejectTransfer(ctx, doer) {
@@ -120,7 +118,7 @@ func transferOwnership(ctx context.Context, doer *user_model.User, newOwnerName
 		if repoRenamed {
 			oldRelativePath, newRelativePath := repo_model.RelativePath(newOwnerName, repo.Name), repo_model.RelativePath(oldOwnerName, repo.Name)
 			if err := gitrepo.RenameRepository(ctx, repo_model.StorageRepo(oldRelativePath), repo_model.StorageRepo(newRelativePath)); err != nil {
-				log.Critical("Unable to move repository %s/%s directory from %s back to correct place %s: %v", oldOwnerName, repo.Name,
+				log.Error("Unable to move repository %s/%s directory from %s back to correct place %s: %v", oldOwnerName, repo.Name,
 					oldRelativePath, newRelativePath, err)
 			}
 		}
@@ -128,7 +126,7 @@ func transferOwnership(ctx context.Context, doer *user_model.User, newOwnerName
 		if wikiRenamed {
 			oldRelativePath, newRelativePath := repo_model.RelativeWikiPath(newOwnerName, repo.Name), repo_model.RelativeWikiPath(oldOwnerName, repo.Name)
 			if err := gitrepo.RenameRepository(ctx, repo_model.StorageRepo(oldRelativePath), repo_model.StorageRepo(newRelativePath)); err != nil {
-				log.Critical("Unable to move wiki for repository %s/%s directory from %s back to correct place %s: %v", oldOwnerName, repo.Name,
+				log.Error("Unable to move wiki for repository %s/%s directory from %s back to correct place %s: %v", oldOwnerName, repo.Name,
 					oldRelativePath, newRelativePath, err)
 			}
 		}
@@ -434,8 +432,7 @@ func StartRepositoryTransfer(ctx context.Context, doer, newOwner *user_model.Use
 	}
 
 	if !doer.CanForkRepoIn(newOwner) {
-		limit := util.Iif(newOwner.MaxRepoCreation >= 0, newOwner.MaxRepoCreation, setting.Repository.MaxCreationLimit)
-		return LimitReachedError{Limit: limit}
+		return LimitReachedError{Limit: newOwner.MaxCreationLimit()}
 	}
 
 	var isDirectTransfer bool
diff --git a/services/repository/transfer_test.go b/services/repository/transfer_test.go
index 8d73fef7f4b..85282a1135c 100644
--- a/services/repository/transfer_test.go
+++ b/services/repository/transfer_test.go
@@ -7,17 +7,17 @@ import (
 	"sync"
 	"testing"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/feed"
-	notify_service "code.gitea.io/gitea/services/notify"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/feed"
+	notify_service "gitea.dev/services/notify"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -133,6 +133,8 @@ func TestRepositoryTransferRejection(t *testing.T) {
 	require.NoError(t, unittest.PrepareTestDatabase())
 	// Set limit to 0 repositories so no repositories can be transferred
 	defer test.MockVariableValue(&setting.Repository.MaxCreationLimit, 0)()
+	defer test.MockVariableValue(&setting.Repository.UserMaxCreationLimit, 0)()
+	defer test.MockVariableValue(&setting.Repository.OrgMaxCreationLimit, 0)()
 
 	// Admin case
 	doerAdmin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
diff --git a/services/secrets/secrets.go b/services/secrets/secrets.go
index 1aec6e146da..af7f8977b44 100644
--- a/services/secrets/secrets.go
+++ b/services/secrets/secrets.go
@@ -6,8 +6,8 @@ package secrets
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	secret_model "code.gitea.io/gitea/models/secret"
+	"gitea.dev/models/db"
+	secret_model "gitea.dev/models/secret"
 )
 
 func CreateOrUpdateSecret(ctx context.Context, ownerID, repoID int64, name, data, description string) (*secret_model.Secret, bool, error) {
diff --git a/services/secrets/validation.go b/services/secrets/validation.go
index d3636ded847..6b711f63d82 100644
--- a/services/secrets/validation.go
+++ b/services/secrets/validation.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"sync"
 
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/util"
 )
 
 // https://docs.github.com/en/actions/learn-github-actions/variables#naming-conventions-for-configuration-variables
diff --git a/services/task/migrate.go b/services/task/migrate.go
index 9cef77a6c89..e8627d0c03e 100644
--- a/services/task/migrate.go
+++ b/services/task/migrate.go
@@ -10,20 +10,20 @@ import (
 	"strings"
 	"time"
 
-	admin_model "code.gitea.io/gitea/models/admin"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/migrations"
-	notify_service "code.gitea.io/gitea/services/notify"
+	admin_model "gitea.dev/models/admin"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/migration"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/migrations"
+	notify_service "gitea.dev/services/notify"
 )
 
 func handleCreateError(owner *user_model.User, err error) error {
@@ -45,7 +45,7 @@ func runMigrateTask(ctx context.Context, t *admin_model.Task) (err error) {
 	defer func(ctx context.Context) {
 		if e := recover(); e != nil {
 			err = fmt.Errorf("PANIC whilst trying to do migrate task: %v", e)
-			log.Critical("PANIC during runMigrateTask[%d] by DoerID[%d] to RepoID[%d] for OwnerID[%d]: %v\nStacktrace: %v", t.ID, t.DoerID, t.RepoID, t.OwnerID, e, log.Stack(2))
+			log.Error("PANIC during runMigrateTask[%d] by DoerID[%d] to RepoID[%d] for OwnerID[%d]: %v\nStacktrace: %v", t.ID, t.DoerID, t.RepoID, t.OwnerID, e, log.Stack(2))
 		}
 		if err == nil {
 			err = admin_model.FinishMigrateTask(ctx, t)
diff --git a/services/task/task.go b/services/task/task.go
index 86cf6a041fd..869e2427a4e 100644
--- a/services/task/task.go
+++ b/services/task/task.go
@@ -8,20 +8,20 @@ import (
 	"errors"
 	"fmt"
 
-	admin_model "code.gitea.io/gitea/models/admin"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/secret"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	repo_service "code.gitea.io/gitea/services/repository"
+	admin_model "gitea.dev/models/admin"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/secret"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	repo_service "gitea.dev/services/repository"
 )
 
 // taskQueue is a global queue of tasks
@@ -85,6 +85,11 @@ func CreateMigrateTask(ctx context.Context, doer, u *user_model.User, opts base.
 		return nil, err
 	}
 	opts.AuthToken = ""
+	opts.AWSSecretAccessKeyEncrypted, err = secret.EncryptSecret(setting.SecretKey, opts.AWSSecretAccessKey)
+	if err != nil {
+		return nil, err
+	}
+	opts.AWSSecretAccessKey = ""
 	bs, err := json.Marshal(&opts)
 	if err != nil {
 		return nil, err
diff --git a/services/uinotification/notify.go b/services/uinotification/notify.go
index dd3f1557c64..1a6caf6354d 100644
--- a/services/uinotification/notify.go
+++ b/services/uinotification/notify.go
@@ -6,16 +6,16 @@ package uinotification
 import (
 	"context"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/queue"
-	notify_service "code.gitea.io/gitea/services/notify"
+	activities_model "gitea.dev/models/activities"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/queue"
+	notify_service "gitea.dev/services/notify"
 )
 
 type (
diff --git a/services/user/avatar.go b/services/user/avatar.go
index 6a43681e9e8..f49a8526644 100644
--- a/services/user/avatar.go
+++ b/services/user/avatar.go
@@ -10,11 +10,11 @@ import (
 	"io"
 	"os"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/avatar"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/storage"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/avatar"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/storage"
 )
 
 // UploadAvatar saves custom avatar for user.
diff --git a/services/user/block.go b/services/user/block.go
index 7727780dfc9..19b4dfa5960 100644
--- a/services/user/block.go
+++ b/services/user/block.go
@@ -6,12 +6,12 @@ package user
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	org_model "code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	org_model "gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	repo_service "gitea.dev/services/repository"
 )
 
 func CanBlockUser(ctx context.Context, doer, blocker, blockee *user_model.User) bool {
diff --git a/services/user/block_test.go b/services/user/block_test.go
index 5dc6c1210de..dc90ddd7e2c 100644
--- a/services/user/block_test.go
+++ b/services/user/block_test.go
@@ -6,8 +6,8 @@ package user
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/user/delete.go b/services/user/delete.go
index e5c2908ada7..8679afaf124 100644
--- a/services/user/delete.go
+++ b/services/user/delete.go
@@ -8,19 +8,19 @@ import (
 	"fmt"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	activities_model "code.gitea.io/gitea/models/activities"
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	pull_model "code.gitea.io/gitea/models/pull"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
+	actions_model "gitea.dev/models/actions"
+	activities_model "gitea.dev/models/activities"
+	asymkey_model "gitea.dev/models/asymkey"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	pull_model "gitea.dev/models/pull"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
 
 	_ "image/jpeg" // Needed for jpeg support
 
diff --git a/services/user/email.go b/services/user/email.go
index 927e4b72341..09939fa5dd0 100644
--- a/services/user/email.go
+++ b/services/user/email.go
@@ -8,10 +8,10 @@ import (
 	"errors"
 	"strings"
 
-	"code.gitea.io/gitea/models/db"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/models/db"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 // ReplacePrimaryEmailAddress replaces the user's primary email address with the given email address.
diff --git a/services/user/email_test.go b/services/user/email_test.go
index 9fb0560b05e..809fb621c5b 100644
--- a/services/user/email_test.go
+++ b/services/user/email_test.go
@@ -6,8 +6,8 @@ package user
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/user/update.go b/services/user/update.go
index d7354542bf6..fe1693e1dfc 100644
--- a/services/user/update.go
+++ b/services/user/update.go
@@ -7,12 +7,12 @@ import (
 	"context"
 	"fmt"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	user_model "code.gitea.io/gitea/models/user"
-	password_module "code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
+	auth_model "gitea.dev/models/auth"
+	user_model "gitea.dev/models/user"
+	password_module "gitea.dev/modules/auth/password"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
 )
 
 type UpdateOptionField[T any] struct {
diff --git a/services/user/update_test.go b/services/user/update_test.go
index b81ac95783d..9d829ad7fd7 100644
--- a/services/user/update_test.go
+++ b/services/user/update_test.go
@@ -6,11 +6,11 @@ package user
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	password_module "code.gitea.io/gitea/modules/auth/password"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/structs"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	password_module "gitea.dev/modules/auth/password"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/user/user.go b/services/user/user.go
index 9b8bcf83c0b..91551fe2bec 100644
--- a/services/user/user.go
+++ b/services/user/user.go
@@ -10,24 +10,24 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	system_model "code.gitea.io/gitea/models/system"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/eventsource"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/agit"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	org_service "code.gitea.io/gitea/services/org"
-	"code.gitea.io/gitea/services/packages"
-	container_service "code.gitea.io/gitea/services/packages/container"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	system_model "gitea.dev/models/system"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/eventsource"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/agit"
+	asymkey_service "gitea.dev/services/asymkey"
+	org_service "gitea.dev/services/org"
+	"gitea.dev/services/packages"
+	container_service "gitea.dev/services/packages/container"
+	repo_service "gitea.dev/services/repository"
 )
 
 // RenameUser renames a user
@@ -108,7 +108,7 @@ func RenameUser(ctx context.Context, u *user_model.User, newUserName string, doe
 		u.Name = oldUserName
 		u.LowerName = strings.ToLower(oldUserName)
 		if err2 := util.Rename(user_model.UserPath(newUserName), user_model.UserPath(oldUserName)); err2 != nil && !os.IsNotExist(err2) {
-			log.Critical("Unable to rollback directory change during failed username change from: %s to: %s. DB Error: %v. Filesystem Error: %v", oldUserName, newUserName, err, err2)
+			log.Error("Unable to rollback directory change during failed username change from: %s to: %s. DB Error: %v. Filesystem Error: %v", oldUserName, newUserName, err, err2)
 			return fmt.Errorf("failed to rollback directory change during failed username change from: %s to: %s. DB Error: %w. Filesystem Error: %v", oldUserName, newUserName, err, err2)
 		}
 		return err
diff --git a/services/user/user_test.go b/services/user/user_test.go
index 4d8d448dcd5..a20694400f0 100644
--- a/services/user/user_test.go
+++ b/services/user/user_test.go
@@ -9,15 +9,15 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	org_service "code.gitea.io/gitea/services/org"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	org_service "gitea.dev/services/org"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/versioned_migration/migration.go b/services/versioned_migration/migration.go
index c064bf79137..cf92b9b66fa 100644
--- a/services/versioned_migration/migration.go
+++ b/services/versioned_migration/migration.go
@@ -6,13 +6,12 @@ package versioned_migration
 import (
 	"context"
 
-	"code.gitea.io/gitea/models/migrations"
-	"code.gitea.io/gitea/modules/globallock"
-
-	"xorm.io/xorm"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations"
+	"gitea.dev/modules/globallock"
 )
 
-func Migrate(ctx context.Context, x *xorm.Engine) error {
+func Migrate(ctx context.Context, x db.EngineMigration) error {
 	// only one instance can do the migration at the same time if there are multiple instances
 	release, err := globallock.Lock(ctx, "gitea_versioned_migration")
 	if err != nil {
diff --git a/services/webhook/deliver.go b/services/webhook/deliver.go
index 105d834b826..2858275cd51 100644
--- a/services/webhook/deliver.go
+++ b/services/webhook/deliver.go
@@ -19,19 +19,19 @@ import (
 	"sync"
 	"time"
 
-	user_model "code.gitea.io/gitea/models/user"
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/hostmatcher"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/proxy"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	user_model "gitea.dev/models/user"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/hostmatcher"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/proxy"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 func newDefaultRequest(ctx context.Context, w *webhook_model.Webhook, t *webhook_model.HookTask) (req *http.Request, body []byte, err error) {
diff --git a/services/webhook/deliver_test.go b/services/webhook/deliver_test.go
index 822184aa940..83d55072fc4 100644
--- a/services/webhook/deliver_test.go
+++ b/services/webhook/deliver_test.go
@@ -12,12 +12,12 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/unittest"
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/hostmatcher"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/models/unittest"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/hostmatcher"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/webhook/dingtalk.go b/services/webhook/dingtalk.go
index 955826544f6..0403fdaa0f6 100644
--- a/services/webhook/dingtalk.go
+++ b/services/webhook/dingtalk.go
@@ -10,11 +10,11 @@ import (
 	"net/url"
 	"strings"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 
 	dingtalk "gitea.com/lunny/dingtalk_webhook"
 )
diff --git a/services/webhook/dingtalk_test.go b/services/webhook/dingtalk_test.go
index 763d23048a5..afe391d8c5a 100644
--- a/services/webhook/dingtalk_test.go
+++ b/services/webhook/dingtalk_test.go
@@ -7,10 +7,10 @@ import (
 	"net/url"
 	"testing"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/json"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/webhook/discord.go b/services/webhook/discord.go
index c0af7c02433..9bbeab3fadc 100644
--- a/services/webhook/discord.go
+++ b/services/webhook/discord.go
@@ -13,14 +13,14 @@ import (
 	"strings"
 	"unicode/utf8"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 type (
diff --git a/services/webhook/discord_test.go b/services/webhook/discord_test.go
index 7f503e33747..162a15f707c 100644
--- a/services/webhook/discord_test.go
+++ b/services/webhook/discord_test.go
@@ -6,11 +6,11 @@ package webhook
 import (
 	"testing"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/webhook/feishu.go b/services/webhook/feishu.go
index ac581df85a3..18651ade4a2 100644
--- a/services/webhook/feishu.go
+++ b/services/webhook/feishu.go
@@ -13,10 +13,10 @@ import (
 	"strings"
 	"time"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 type (
diff --git a/services/webhook/feishu_test.go b/services/webhook/feishu_test.go
index 7e200ea1320..f8a5f7a983c 100644
--- a/services/webhook/feishu_test.go
+++ b/services/webhook/feishu_test.go
@@ -6,10 +6,10 @@ package webhook
 import (
 	"testing"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/json"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/webhook/general.go b/services/webhook/general.go
index 9572c926df8..021f979b8e4 100644
--- a/services/webhook/general.go
+++ b/services/webhook/general.go
@@ -9,13 +9,13 @@ import (
 	"net/url"
 	"strings"
 
-	user_model "code.gitea.io/gitea/models/user"
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	user_model "gitea.dev/models/user"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 type linkFormatter = func(string, string) string
diff --git a/services/webhook/general_test.go b/services/webhook/general_test.go
index ec735d785a5..879f0f620b7 100644
--- a/services/webhook/general_test.go
+++ b/services/webhook/general_test.go
@@ -6,7 +6,7 @@ package webhook
 import (
 	"testing"
 
-	api "code.gitea.io/gitea/modules/structs"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/services/webhook/main_test.go b/services/webhook/main_test.go
index 756b9db2308..bca21baaa66 100644
--- a/services/webhook/main_test.go
+++ b/services/webhook/main_test.go
@@ -6,12 +6,12 @@ package webhook
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/hostmatcher"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/hostmatcher"
+	"gitea.dev/modules/setting"
 
-	_ "code.gitea.io/gitea/models"
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models"
+	_ "gitea.dev/models/actions"
 )
 
 func TestMain(m *testing.M) {
diff --git a/services/webhook/matrix.go b/services/webhook/matrix.go
index fa01ecd0b19..e9dc17aeaf3 100644
--- a/services/webhook/matrix.go
+++ b/services/webhook/matrix.go
@@ -14,15 +14,15 @@ import (
 	"regexp"
 	"strings"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/base"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/base"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 func init() {
diff --git a/services/webhook/matrix_test.go b/services/webhook/matrix_test.go
index 59b78f42692..29b7affc193 100644
--- a/services/webhook/matrix_test.go
+++ b/services/webhook/matrix_test.go
@@ -7,10 +7,10 @@ import (
 	"strings"
 	"testing"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/json"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/webhook/msteams.go b/services/webhook/msteams.go
index 34db9037121..7024036da1e 100644
--- a/services/webhook/msteams.go
+++ b/services/webhook/msteams.go
@@ -11,11 +11,11 @@ import (
 	"strconv"
 	"strings"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 type (
diff --git a/services/webhook/msteams_test.go b/services/webhook/msteams_test.go
index 0d98b94bad1..cf7f9fbb9e8 100644
--- a/services/webhook/msteams_test.go
+++ b/services/webhook/msteams_test.go
@@ -6,10 +6,10 @@ package webhook
 import (
 	"testing"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/json"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/webhook/notifier.go b/services/webhook/notifier.go
index 7627935a321..95b771c48a6 100644
--- a/services/webhook/notifier.go
+++ b/services/webhook/notifier.go
@@ -7,26 +7,26 @@ import (
 	"context"
 	"errors"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/repository"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	"code.gitea.io/gitea/services/convert"
-	notify_service "code.gitea.io/gitea/services/notify"
+	actions_model "gitea.dev/models/actions"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
+	"gitea.dev/services/convert"
+	notify_service "gitea.dev/services/notify"
 )
 
 func init() {
@@ -818,7 +818,7 @@ func (m *webhookNotifier) CreateRef(ctx context.Context, pusher *user_model.User
 	}
 }
 
-func (m *webhookNotifier) PullRequestSynchronized(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest) {
+func (m *webhookNotifier) PullRequestSynchronized(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest, before, after string) {
 	if err := pr.LoadIssue(ctx); err != nil {
 		log.Error("LoadIssue: %v", err)
 		return
@@ -830,6 +830,8 @@ func (m *webhookNotifier) PullRequestSynchronized(ctx context.Context, doer *use
 
 	if err := PrepareWebhooks(ctx, EventSource{Repository: pr.Issue.Repo}, webhook_module.HookEventPullRequestSync, &api.PullRequestPayload{
 		Action:      api.HookIssueSynchronized,
+		Before:      before,
+		After:       after,
 		Index:       pr.Issue.Index,
 		PullRequest: convert.ToAPIPullRequest(ctx, pr, doer),
 		Repository:  convert.ToRepo(ctx, pr.Issue.Repo, access_model.Permission{AccessMode: perm.AccessModeOwner}),
diff --git a/services/webhook/packagist.go b/services/webhook/packagist.go
index e6a00b02933..f8c69292bfc 100644
--- a/services/webhook/packagist.go
+++ b/services/webhook/packagist.go
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"net/http"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 type (
diff --git a/services/webhook/packagist_test.go b/services/webhook/packagist_test.go
index 4e77f29edc0..28396d798e2 100644
--- a/services/webhook/packagist_test.go
+++ b/services/webhook/packagist_test.go
@@ -6,10 +6,10 @@ package webhook
 import (
 	"testing"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/json"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/webhook/payloader.go b/services/webhook/payloader.go
index b607bf32503..0abe5b89191 100644
--- a/services/webhook/payloader.go
+++ b/services/webhook/payloader.go
@@ -8,10 +8,10 @@ import (
 	"fmt"
 	"net/http"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/json"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 // payloadConvertor defines the interface to convert system payload to webhook payload
diff --git a/services/webhook/slack.go b/services/webhook/slack.go
index 94d41d21790..368a92607b9 100644
--- a/services/webhook/slack.go
+++ b/services/webhook/slack.go
@@ -10,13 +10,13 @@ import (
 	"regexp"
 	"strings"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 // SlackMeta contains the slack metadata
diff --git a/services/webhook/slack_test.go b/services/webhook/slack_test.go
index 839ed6f7708..ab1a3798c8b 100644
--- a/services/webhook/slack_test.go
+++ b/services/webhook/slack_test.go
@@ -6,10 +6,10 @@ package webhook
 import (
 	"testing"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/json"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/webhook/telegram.go b/services/webhook/telegram.go
index 8e9a53a5de5..99a0b417b8a 100644
--- a/services/webhook/telegram.go
+++ b/services/webhook/telegram.go
@@ -10,14 +10,14 @@ import (
 	"net/http"
 	"strings"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/markup"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/markup"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 type (
diff --git a/services/webhook/telegram_test.go b/services/webhook/telegram_test.go
index 3fa8e278368..7c8209577e9 100644
--- a/services/webhook/telegram_test.go
+++ b/services/webhook/telegram_test.go
@@ -6,10 +6,10 @@ package webhook
 import (
 	"testing"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/json"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/webhook/webhook.go b/services/webhook/webhook.go
index a35997dda09..5e8107772ac 100644
--- a/services/webhook/webhook.go
+++ b/services/webhook/webhook.go
@@ -9,20 +9,20 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/optional"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 type Requester func(context.Context, *webhook_model.Webhook, *webhook_model.HookTask) (req *http.Request, body []byte, err error)
diff --git a/services/webhook/webhook_test.go b/services/webhook/webhook_test.go
index 8522cce8eca..f20510c9a61 100644
--- a/services/webhook/webhook_test.go
+++ b/services/webhook/webhook_test.go
@@ -6,17 +6,17 @@ package webhook
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	"code.gitea.io/gitea/services/convert"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	webhook_module "gitea.dev/modules/webhook"
+	"gitea.dev/services/convert"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/services/webhook/wechatwork.go b/services/webhook/wechatwork.go
index cac6a700c02..938be3b499e 100644
--- a/services/webhook/wechatwork.go
+++ b/services/webhook/wechatwork.go
@@ -9,10 +9,10 @@ import (
 	"net/http"
 	"strings"
 
-	webhook_model "code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
+	webhook_model "gitea.dev/models/webhook"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
+	webhook_module "gitea.dev/modules/webhook"
 )
 
 type (
diff --git a/services/webtheme/webtheme.go b/services/webtheme/webtheme.go
index e82008c6871..3ce42936fe0 100644
--- a/services/webtheme/webtheme.go
+++ b/services/webtheme/webtheme.go
@@ -14,11 +14,11 @@ import (
 	"sync/atomic"
 	"time"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 )
 
 type themeCollectionStruct struct {
@@ -45,7 +45,7 @@ type ThemeMetaInfo struct {
 }
 
 func (info *ThemeMetaInfo) PublicAssetURI() string {
-	return public.AssetURI("css/theme-" + url.PathEscape(info.InternalName) + ".css")
+	return public.AssetURI("web_src/css/themes/theme-" + url.PathEscape(info.InternalName) + ".css")
 }
 
 func (info *ThemeMetaInfo) GetDescription() string {
diff --git a/services/wiki/wiki.go b/services/wiki/wiki.go
index 5bc62d451e8..9fcc5750ec9 100644
--- a/services/wiki/wiki.go
+++ b/services/wiki/wiki.go
@@ -9,20 +9,20 @@ import (
 	"fmt"
 	"os"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	system_model "code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/globallock"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/log"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	asymkey_service "code.gitea.io/gitea/services/asymkey"
-	repo_service "code.gitea.io/gitea/services/repository"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	system_model "gitea.dev/models/system"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/globallock"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/log"
+	repo_module "gitea.dev/modules/repository"
+	asymkey_service "gitea.dev/services/asymkey"
+	repo_service "gitea.dev/services/repository"
 )
 
 func getWikiWorkingLockKey(repoID int64) string {
diff --git a/services/wiki/wiki_path.go b/services/wiki/wiki_path.go
index a4dd3c709d5..58cb22b4691 100644
--- a/services/wiki/wiki_path.go
+++ b/services/wiki/wiki_path.go
@@ -8,11 +8,11 @@ import (
 	"path"
 	"strings"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/convert"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/convert"
 )
 
 // To define the wiki related concepts:
diff --git a/services/wiki/wiki_test.go b/services/wiki/wiki_test.go
index e571e093b6f..9b1160d7d99 100644
--- a/services/wiki/wiki_test.go
+++ b/services/wiki/wiki_test.go
@@ -8,14 +8,14 @@ import (
 	"strings"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	repo_service "code.gitea.io/gitea/services/repository"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	repo_service "gitea.dev/services/repository"
 
-	_ "code.gitea.io/gitea/models/actions"
+	_ "gitea.dev/models/actions"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/snap/part-gitea-build.sh b/snap/part-gitea-build.sh
new file mode 100755
index 00000000000..005162488fa
--- /dev/null
+++ b/snap/part-gitea-build.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+set -e
+
+if [ ! -f go.mod ] || [ ! -d snap ]; then
+  echo "This script should be run from the root of the gitea repository"
+  exit 1
+fi
+
+if [ -z "$SNAPCRAFT_PART_INSTALL" ]; then
+  SNAPCRAFT_PART_INSTALL="./dist/snap"
+  echo "* using mock install path: $SNAPCRAFT_PART_INSTALL"
+fi
+
+command -v pnpm >/dev/null 2>&1 || npm install -g pnpm
+
+# build tags for 1.26: "bindata sqlite sqlite_unlock_notify pam cert"
+# for 1.27: sqlite is not needed, "cert" seems doing nothing
+TAGS="bindata pam" make build
+
+install -D gitea "${SNAPCRAFT_PART_INSTALL}/gitea"
+cp -r options "${SNAPCRAFT_PART_INSTALL}/"
diff --git a/snap/part-gitea-pull.sh b/snap/part-gitea-pull.sh
new file mode 100755
index 00000000000..83fde11a129
--- /dev/null
+++ b/snap/part-gitea-pull.sh
@@ -0,0 +1,62 @@
+#!/bin/sh
+set -e
+
+if [ ! -f go.mod ] || [ ! -d snap ]; then
+  echo "This script should be run from the root of the gitea repository"
+  exit 1
+fi
+
+if [ -z "$SNAPCRAFT_PROJECT_NAME" ]; then
+  echo "No snapcraft build env, continue with mocking ...."
+  craftctl() { echo "* mocking craftctl: $*"; }
+  snap() { echo "* mocking snap: $*"; }
+else
+  echo "Add working directory to git safe.directory ..."
+  git config --global --add safe.directory "$PWD"
+fi
+
+# How it works:
+# * snapcraft.io checks out the default branch (e.g.: main during 1.27 dev period)
+# * "override-pull" step gets the latest tag by date (e.g.: v1.26.1)
+# * use "snap info gitea" to get the latest released tag
+#   * if the latest tag is not released to stable, checkout that tag and build it for "stable"
+#   * otherwise, build the main branch for "devel"
+# * "override-build" step uses build script from the checked out commit to build
+# This approach highly depends on the "main" branch's push.
+
+# To debug the logic:
+# * last_committed_tag=v1.26.1 last_released_tag=v1.26.0 ./snap/part-gitea-pull.sh
+#   it will checkout tag v1.26.1, and build that for "stable"
+# * last_committed_tag=v1.26.1 last_released_tag=v1.26.1 recent_tag=v1.27.0-dev-205 ./snap/part-gitea-pull.sh
+#   it will still use the current branch, and build it for "devel"
+
+[ -z "$last_committed_tag" ] && last_committed_tag="$(git for-each-ref --sort=taggerdate --format '%(tag)' refs/tags | tail -n 1)"
+[ -z "$last_released_tag" ] && last_released_tag="$(snap info gitea | awk '$1 == "latest/candidate:" { print $2 }')"
+
+if [ "${last_committed_tag}" != "${last_released_tag}" ]; then
+  # if the latest tag has not been released to stable, build that tag instead of default branch.
+  echo "Build last committed tag ${last_committed_tag} for new release, fetching and checking out ..."
+  git fetch --quiet
+  git checkout --quiet "${last_committed_tag}"
+  # HINT: after this, the "build" step will use that commit's "part-gitea-build.sh", but not this one's
+else
+  echo "Build current branch $(git branch --show-current) @ $(git rev-parse HEAD)"
+fi
+
+# possible tag names:
+# * v1.27.0-dev-205-gce089f498b
+# * v1.26.1
+# * v1.22.0-rc1-2816-gce089f498b
+# then normalize it to semver format: v1.2.3+dev.205.gce089f498b
+[ -z "$recent_tag" ] && recent_tag="$(git describe --always --tags)"
+echo "Use recent tag $recent_tag to determine version and grade"
+
+version_main="$(echo "$recent_tag" | cut -d'-' -f1)"
+version_ext="$(echo "$recent_tag" | cut -d'-' -s -f2- | sed -e 'y/-/./')"
+[ -n "$version_ext" ] && grade=devel || grade=stable
+
+version="${version_main}"
+[ -n "$version_ext" ] && version="${version}+${version_ext}"
+
+craftctl set version="$version"
+craftctl set grade="$grade"
diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml
index 9cad252e670..2fea108de1e 100644
--- a/snap/snapcraft.yaml
+++ b/snap/snapcraft.yaml
@@ -2,9 +2,9 @@ name: gitea
 summary: Gitea - A painless self-hosted Git service
 description: |
   The goal of this project is to make the easiest, fastest, and most painless
-  way of setting up a self-hosted Git service. With Go, this can be done with
-  an independent binary distribution across ALL platforms that Go supports,
-  including Linux, Mac OS X, Windows and ARM.
+  way of setting up a self-hosted Git service with GitHub-like experiences,
+  including issue tracking, code review, project management, wikis, package registry,
+  Gitea Actions and more.
 
 icon: public/assets/img/logo.png
 confinement: strict
@@ -53,32 +53,8 @@ parts:
     build-snaps: [ go/1.26/stable, node/24/stable ]
     build-environment:
       - LDFLAGS: ""
-    override-pull: |
-      craftctl default
-
-      git config --global --add safe.directory /root/parts/gitea/src
-      last_committed_tag="$(git for-each-ref --sort=taggerdate --format '%(tag)' refs/tags | tail -n 1)"
-      last_released_tag="$(snap info gitea | awk '$1 == "latest/candidate:" { print $2 }')"
-      # If the latest tag from the upstream project has not been released to
-      # stable, build that tag instead of master.
-      if [ "${last_committed_tag}" != "${last_released_tag}" ]; then
-        git fetch
-        git checkout "${last_committed_tag}"
-      fi
-
-      version="$(git describe --always | sed -e 's/-/+git/;y/-/./')"
-      [ -n "$(echo $version | grep "+git")" ] && grade=devel || grade=stable
-      craftctl set version="$version"
-      craftctl set grade="$grade"
-
-    override-build: |
-      set -x
-      sed -i 's/os.Getuid()/1/g' modules/setting/setting.go
-      npm install -g pnpm
-      TAGS="bindata sqlite sqlite_unlock_notify pam cert" make build
-      install -D gitea "${SNAPCRAFT_PART_INSTALL}/gitea"
-      cp -r options "${SNAPCRAFT_PART_INSTALL}/"
-
+    override-pull: craftctl default && ./snap/part-gitea-pull.sh
+    override-build: ./snap/part-gitea-build.sh
     prime:
       - -etc
       - -usr/lib/systemd
diff --git a/stylelint.config.js b/stylelint.config.ts
similarity index 91%
rename from stylelint.config.js
rename to stylelint.config.ts
index 0aee1a5dac2..d3baa1b4d0d 100644
--- a/stylelint.config.js
+++ b/stylelint.config.ts
@@ -1,6 +1,5 @@
-// @ts-check
-// TODO: Move to .ts after https://github.com/stylelint/stylelint/issues/8893 is fixed
 import {fileURLToPath} from 'node:url';
+import type {Config} from 'stylelint';
 
 const cssVarFiles = [
   fileURLToPath(new URL('web_src/css/base.css', import.meta.url)),
@@ -8,7 +7,6 @@ const cssVarFiles = [
   fileURLToPath(new URL('web_src/css/themes/theme-gitea-dark.css', import.meta.url)),
 ];
 
-/** @type {import('stylelint').Config} */
 export default {
   extends: 'stylelint-config-recommended',
   reportUnscopedDisables: true,
@@ -25,18 +23,6 @@ export default {
     '/web_src/fomantic',
   ],
   overrides: [
-    {
-      files: ['**/chroma/*', '**/codemirror/*', '**/console.css', 'font_i18n.css'],
-      rules: {
-        'scale-unlimited/declaration-strict-value': null,
-      },
-    },
-    {
-      files: ['**/chroma/*', '**/codemirror/*'],
-      rules: {
-        'block-no-empty': null,
-      },
-    },
     {
       files: ['**/*.vue'],
       customSyntax: 'postcss-html',
@@ -139,7 +125,7 @@ export default {
     'no-unknown-custom-media': null, // disabled until stylelint supports multi-file linting
     'no-unknown-custom-properties': null,  // disabled until stylelint supports multi-file linting
     'plugin/declaration-block-no-ignored-properties': true,
-    'scale-unlimited/declaration-strict-value': [['/color$/', 'font-weight'], {ignoreValues: '/^(inherit|transparent|unset|initial|currentcolor|none)$/', ignoreFunctions: true, disableFix: true, expandShorthand: true}],
+    'scale-unlimited/declaration-strict-value': [['/color$/', 'fill', 'stroke', 'font-weight'], {ignoreValues: '/^(inherit|transparent|unset|initial|currentcolor|none)$/', ignoreFunctions: true, disableFix: true, expandShorthand: true}],
     'selector-attribute-quotes': 'always',
     'selector-no-vendor-prefix': true,
     'selector-pseudo-element-colon-notation': 'double',
@@ -148,4 +134,4 @@ export default {
     'shorthand-property-no-redundant-values': true,
     'value-no-vendor-prefix': [true, {ignoreValues: ['box', 'inline-box']}],
   },
-};
+} satisfies Config;
diff --git a/templates/admin/actions.tmpl b/templates/admin/actions.tmpl
index 597863d73b1..1bddb674c03 100644
--- a/templates/admin/actions.tmpl
+++ b/templates/admin/actions.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin actions")}}
+{{template "admin/layout_head" (dict "pageClass" "admin actions")}}
 	<div class="admin-setting-content">
 	{{if eq .PageType "runners"}}
 		{{template "shared/actions/runner_list" .}}
diff --git a/templates/admin/applications/list.tmpl b/templates/admin/applications/list.tmpl
index cbb66b16053..efc4e6e0df8 100644
--- a/templates/admin/applications/list.tmpl
+++ b/templates/admin/applications/list.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin config")}}
+{{template "admin/layout_head" (dict "pageClass" "admin config")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 				{{ctx.Locale.Tr "settings.applications"}}
diff --git a/templates/admin/applications/oauth2_edit.tmpl b/templates/admin/applications/oauth2_edit.tmpl
index 668bfe06334..34ae0bf4bfb 100644
--- a/templates/admin/applications/oauth2_edit.tmpl
+++ b/templates/admin/applications/oauth2_edit.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin config")}}
+{{template "admin/layout_head" (dict "pageClass" "admin config")}}
 	<div class="admin-setting-content">
 
 		{{template "user/settings/applications_oauth2_edit_form" .}}
diff --git a/templates/admin/auth/edit.tmpl b/templates/admin/auth/edit.tmpl
index 60480ce82f7..40f19667b3c 100644
--- a/templates/admin/auth/edit.tmpl
+++ b/templates/admin/auth/edit.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin edit authentication")}}
+{{template "admin/layout_head" (dict "pageClass" "admin edit authentication")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.auths.edit"}}
diff --git a/templates/admin/auth/list.tmpl b/templates/admin/auth/list.tmpl
index 7296e955584..17795880ea5 100644
--- a/templates/admin/auth/list.tmpl
+++ b/templates/admin/auth/list.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin authentication")}}
+{{template "admin/layout_head" (dict "pageClass" "admin authentication")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.auths.auth_manage_panel"}} ({{ctx.Locale.Tr "admin.total" .Total}})
diff --git a/templates/admin/auth/new.tmpl b/templates/admin/auth/new.tmpl
index 256f648c6a2..6bc273c80df 100644
--- a/templates/admin/auth/new.tmpl
+++ b/templates/admin/auth/new.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin new authentication")}}
+{{template "admin/layout_head" (dict "pageClass" "admin new authentication")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.auths.new"}}
diff --git a/templates/admin/badge/edit.tmpl b/templates/admin/badge/edit.tmpl
index f2cdc4ad443..582ba60cd65 100644
--- a/templates/admin/badge/edit.tmpl
+++ b/templates/admin/badge/edit.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin edit badge")}}
+{{template "admin/layout_head" (dict "pageClass" "admin edit badge")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.badges.edit_badge"}}
diff --git a/templates/admin/badge/list.tmpl b/templates/admin/badge/list.tmpl
index 3020b7b25a1..691bc44811f 100644
--- a/templates/admin/badge/list.tmpl
+++ b/templates/admin/badge/list.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin badge")}}
+{{template "admin/layout_head" (dict "pageClass" "admin badge")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.badges.badges_manage_panel"}} ({{ctx.Locale.Tr "admin.total" .Total}})
diff --git a/templates/admin/badge/new.tmpl b/templates/admin/badge/new.tmpl
index 5b67bed3146..0c64c39608c 100644
--- a/templates/admin/badge/new.tmpl
+++ b/templates/admin/badge/new.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin new badge")}}
+{{template "admin/layout_head" (dict "pageClass" "admin new badge")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.badges.new_badge"}}
diff --git a/templates/admin/badge/users.tmpl b/templates/admin/badge/users.tmpl
index 711110ca68a..051de1b4666 100644
--- a/templates/admin/badge/users.tmpl
+++ b/templates/admin/badge/users.tmpl
@@ -1,11 +1,11 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin badge")}}
+{{template "admin/layout_head" (dict "pageClass" "admin badge")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{.Title}}
 		</h4>
 		<div class="ui attached segment">
-			<form class="ui form" action="{{.Link}}" method="post">
-				<div id="search-user-box" class="ui search input tw-align-middle">
+			<form class="ui form flex-text-block" action="{{.Link}}" method="post">
+				<div id="search-user-box" class="ui search input">
 					<input class="prompt" name="user" placeholder="{{ctx.Locale.Tr "search.user_kind"}}" autocomplete="off" autofocus required>
 				</div>
 				<button class="ui primary button">{{ctx.Locale.Tr "admin.badges.add_user"}}</button>
diff --git a/templates/admin/badge/view.tmpl b/templates/admin/badge/view.tmpl
index cbe5c7b7102..26d3d8dbe63 100644
--- a/templates/admin/badge/view.tmpl
+++ b/templates/admin/badge/view.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" .)}}
+{{template "admin/layout_head" (dict)}}
 
 <div class="admin-setting-content">
 	<div class="admin-responsive-columns">
diff --git a/templates/admin/config.tmpl b/templates/admin/config.tmpl
index c381c5bf1d0..ae37950fb51 100644
--- a/templates/admin/config.tmpl
+++ b/templates/admin/config.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin config")}}
+{{template "admin/layout_head" (dict "pageClass" "admin config")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.config.server_config"}}
diff --git a/templates/admin/config_settings/config_settings.tmpl b/templates/admin/config_settings/config_settings.tmpl
index 6d1db4f89fd..b12c2dc395b 100644
--- a/templates/admin/config_settings/config_settings.tmpl
+++ b/templates/admin/config_settings/config_settings.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin config" "dataGlobalInit" "initAdminConfigSettings")}}
+{{template "admin/layout_head" (dict "pageClass" "admin config" "dataGlobalInit" "initAdminConfigSettings")}}
 
 	{{template "admin/config_settings/avatars" .}}
 	{{template "admin/config_settings/repository" .}}
diff --git a/templates/admin/cron.tmpl b/templates/admin/cron.tmpl
index 8e44614d97a..457cdd52123 100644
--- a/templates/admin/cron.tmpl
+++ b/templates/admin/cron.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin monitor")}}
+{{template "admin/layout_head" (dict "pageClass" "admin monitor")}}
 <div class="admin-setting-content">
 	<h4 class="ui top attached header">
 		{{ctx.Locale.Tr "admin.monitor.cron"}}
diff --git a/templates/admin/dashboard.tmpl b/templates/admin/dashboard.tmpl
index f44dc243622..059ddd3c7e5 100644
--- a/templates/admin/dashboard.tmpl
+++ b/templates/admin/dashboard.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin dashboard")}}
+{{template "admin/layout_head" (dict "pageClass" "admin dashboard")}}
 	<div class="admin-setting-content">
 		{{if .NeedUpdate}}
 			<div class="ui negative message flash-error">
diff --git a/templates/admin/emails/list.tmpl b/templates/admin/emails/list.tmpl
index d597a2753f5..135b4da3a01 100644
--- a/templates/admin/emails/list.tmpl
+++ b/templates/admin/emails/list.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin user")}}
+{{template "admin/layout_head" (dict "pageClass" "admin user")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.emails.email_manage_panel"}} ({{ctx.Locale.Tr "admin.total" .Total}})
diff --git a/templates/admin/hook_new.tmpl b/templates/admin/hook_new.tmpl
index 37dcc49d535..d8df2054495 100644
--- a/templates/admin/hook_new.tmpl
+++ b/templates/admin/hook_new.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin settings new webhook")}}
+{{template "admin/layout_head" (dict "pageClass" "admin settings new webhook")}}
 	<div class="admin-setting-content">
 		{{$CustomHeaderTitle := ctx.Locale.Tr "admin.defaulthooks.update_webhook"}}
 		{{if .PageIsAdminDefaultHooksNew}}
@@ -8,6 +8,6 @@
 		{{else if .Webhook.IsSystemWebhook}}
 			{{$CustomHeaderTitle = ctx.Locale.Tr "admin.systemhooks.update_webhook"}}
 		{{end}}
-		{{template "webhook/new" (dict "ctxData" . "CustomHeaderTitle" $CustomHeaderTitle)}}
+		{{template "webhook/new" (dict "CustomHeaderTitle" $CustomHeaderTitle)}}
 	</div>
 {{template "admin/layout_footer" .}}
diff --git a/templates/admin/hooks.tmpl b/templates/admin/hooks.tmpl
index d5fdef68504..c36a9b10ebc 100644
--- a/templates/admin/hooks.tmpl
+++ b/templates/admin/hooks.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin hooks")}}
+{{template "admin/layout_head" (dict "pageClass" "admin hooks")}}
 	<div class="admin-setting-content">
 		{{template "repo/settings/webhook/base_list" .SystemWebhooks}}
 		{{template "repo/settings/webhook/base_list" .DefaultWebhooks}}
diff --git a/templates/admin/layout_head.tmpl b/templates/admin/layout_head.tmpl
index 397516da5da..ce989c40c89 100644
--- a/templates/admin/layout_head.tmpl
+++ b/templates/admin/layout_head.tmpl
@@ -1,9 +1,9 @@
-{{template "base/head" .ctxData}}
-<div role="main" aria-label="{{.ctxData.Title}}" class="page-content {{.pageClass}}" {{if .dataGlobalInit}}data-global-init="{{.dataGlobalInit}}"{{end}}>
+{{template "base/head" ctx.RootData}}
+<div role="main" aria-label="{{ctx.RootData.Title}}" class="page-content {{.pageClass}}" {{if .dataGlobalInit}}data-global-init="{{.dataGlobalInit}}"{{end}}>
 	<div class="ui container fluid padded flex-container">
-		{{template "admin/navbar" .ctxData}}
+		{{template "admin/navbar" ctx.RootData}}
 		<div class="flex-container-main">
-			{{template "base/alert" .ctxData}}
+			{{template "base/alert" ctx.RootData}}
 			{{/* block: admin-setting-content */}}
 
 {{if false}}{{/* to make html structure "likely" complete to prevent IDE warnings */}}
diff --git a/templates/admin/navbar.tmpl b/templates/admin/navbar.tmpl
index ce3048ed9fa..b6c9f155e9c 100644
--- a/templates/admin/navbar.tmpl
+++ b/templates/admin/navbar.tmpl
@@ -2,7 +2,7 @@
 	<div class="ui fluid vertical menu">
 		<div class="header item">{{ctx.Locale.Tr "admin.settings"}}</div>
 
-		<details class="item toggleable-item" {{if or .PageIsAdminDashboard .PageIsAdminSelfCheck}}open{{end}}>
+		<details class="item" {{if or .PageIsAdminDashboard .PageIsAdminSelfCheck}}open{{end}}>
 			<summary>{{ctx.Locale.Tr "admin.maintenance"}}</summary>
 			<div class="menu">
 				<a class="{{if .PageIsAdminDashboard}}active {{end}}item" href="{{AppSubUrl}}/-/admin">
@@ -13,7 +13,7 @@
 				</a>
 			</div>
 		</details>
-		<details class="item toggleable-item" {{if or .PageIsAdminUsers .PageIsAdminBadges .PageIsAdminEmails .PageIsAdminOrganizations .PageIsAdminAuthentications}}open{{end}}>
+		<details class="item" {{if or .PageIsAdminUsers .PageIsAdminBadges .PageIsAdminEmails .PageIsAdminOrganizations .PageIsAdminAuthentications}}open{{end}}>
 			<summary>{{ctx.Locale.Tr "admin.identity_access"}}</summary>
 			<div class="menu">
 				<a class="{{if .PageIsAdminAuthentications}}active {{end}}item" href="{{AppSubUrl}}/-/admin/auths">
@@ -33,7 +33,7 @@
 				</a>
 			</div>
 		</details>
-		<details class="item toggleable-item" {{if or .PageIsAdminRepositories (and .EnablePackages .PageIsAdminPackages)}}open{{end}}>
+		<details class="item" {{if or .PageIsAdminRepositories (and .EnablePackages .PageIsAdminPackages)}}open{{end}}>
 			<summary>{{ctx.Locale.Tr "admin.assets"}}</summary>
 			<div class="menu">
 				{{if .EnablePackages}}
@@ -48,7 +48,7 @@
 		</details>
 		<!-- Webhooks and OAuth can be both disabled here, so add this if statement to display different ui -->
 		{{if and (not DisableWebhooks) .EnableOAuth2}}
-			<details class="item toggleable-item" {{if or .PageIsAdminDefaultHooks .PageIsAdminSystemHooks .PageIsAdminApplications}}open{{end}}>
+			<details class="item" {{if or .PageIsAdminDefaultHooks .PageIsAdminSystemHooks .PageIsAdminApplications}}open{{end}}>
 				<summary>{{ctx.Locale.Tr "admin.integrations"}}</summary>
 				<div class="menu">
 					<a class="{{if .PageIsAdminApplications}}active {{end}}item" href="{{AppSubUrl}}/-/admin/applications">
@@ -72,7 +72,7 @@
 			{{end}}
 		{{end}}
 		{{if .EnableActions}}
-		<details class="item toggleable-item" {{if or .PageIsSharedSettingsRunners .PageIsSharedSettingsVariables}}open{{end}}>
+		<details class="item" {{if or .PageIsSharedSettingsRunners .PageIsSharedSettingsVariables}}open{{end}}>
 			<summary>{{ctx.Locale.Tr "actions.actions"}}</summary>
 			<div class="menu">
 				<a class="{{if .PageIsSharedSettingsRunners}}active {{end}}item" href="{{AppSubUrl}}/-/admin/actions/runners">
@@ -84,7 +84,7 @@
 			</div>
 		</details>
 		{{end}}
-		<details class="item toggleable-item" {{if or .PageIsAdminConfig}}open{{end}}>
+		<details class="item" {{if or .PageIsAdminConfig}}open{{end}}>
 			<summary>{{ctx.Locale.Tr "admin.config"}}</summary>
 			<div class="menu">
 				<a class="{{if .PageIsAdminConfigSummary}}active {{end}}item" href="{{AppSubUrl}}/-/admin/config">
@@ -98,7 +98,7 @@
 		<a class="{{if .PageIsAdminNotices}}active {{end}}item" href="{{AppSubUrl}}/-/admin/notices">
 			{{ctx.Locale.Tr "admin.notices"}}
 		</a>
-		<details class="item toggleable-item" {{if or .PageIsAdminMonitorStats .PageIsAdminMonitorCron .PageIsAdminMonitorQueue .PageIsAdminMonitorTrace}}open{{end}}>
+		<details class="item" {{if or .PageIsAdminMonitorStats .PageIsAdminMonitorCron .PageIsAdminMonitorQueue .PageIsAdminMonitorTrace}}open{{end}}>
 			<summary>{{ctx.Locale.Tr "admin.monitor"}}</summary>
 			<div class="menu">
 				<a class="{{if .PageIsAdminMonitorStats}}active {{end}}item" href="{{AppSubUrl}}/-/admin/monitor/stats">
diff --git a/templates/admin/notice.tmpl b/templates/admin/notice.tmpl
index 55ee9da8520..c4c29fc8306 100644
--- a/templates/admin/notice.tmpl
+++ b/templates/admin/notice.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin notice")}}
+{{template "admin/layout_head" (dict "pageClass" "admin notice")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.notices.system_notice_list"}} ({{ctx.Locale.Tr "admin.total" .Total}})
diff --git a/templates/admin/org/list.tmpl b/templates/admin/org/list.tmpl
index e6de93c5f81..ad2bb461670 100644
--- a/templates/admin/org/list.tmpl
+++ b/templates/admin/org/list.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin user")}}
+{{template "admin/layout_head" (dict "pageClass" "admin user")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.orgs.org_manage_panel"}} ({{ctx.Locale.Tr "admin.total" .Total}})
diff --git a/templates/admin/packages/list.tmpl b/templates/admin/packages/list.tmpl
index 8701cb0d57d..800f8dac5b0 100644
--- a/templates/admin/packages/list.tmpl
+++ b/templates/admin/packages/list.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin user")}}
+{{template "admin/layout_head" (dict "pageClass" "admin user")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.packages.package_manage_panel"}} ({{ctx.Locale.Tr "admin.total" .TotalCount}},
diff --git a/templates/admin/perftrace.tmpl b/templates/admin/perftrace.tmpl
index 2e09f14e46d..6b302f2996e 100644
--- a/templates/admin/perftrace.tmpl
+++ b/templates/admin/perftrace.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin monitor")}}
+{{template "admin/layout_head" (dict "pageClass" "admin monitor")}}
 
 <div class="admin-setting-content">
 	{{template "admin/trace_tabs" .}}
diff --git a/templates/admin/queue.tmpl b/templates/admin/queue.tmpl
index e6abd1e7945..b3804980ce1 100644
--- a/templates/admin/queue.tmpl
+++ b/templates/admin/queue.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin monitor")}}
+{{template "admin/layout_head" (dict "pageClass" "admin monitor")}}
 <div class="admin-setting-content">
 	<h4 class="ui top attached header">
 		{{ctx.Locale.Tr "admin.monitor.queues"}}
diff --git a/templates/admin/queue_manage.tmpl b/templates/admin/queue_manage.tmpl
index 73da9164cc1..a57273f0556 100644
--- a/templates/admin/queue_manage.tmpl
+++ b/templates/admin/queue_manage.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin monitor")}}
+{{template "admin/layout_head" (dict "pageClass" "admin monitor")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.monitor.queue" .Queue.GetName}}
diff --git a/templates/admin/repo/list.tmpl b/templates/admin/repo/list.tmpl
index c72daba3226..d366b8cb2d0 100644
--- a/templates/admin/repo/list.tmpl
+++ b/templates/admin/repo/list.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin")}}
+{{template "admin/layout_head" (dict "pageClass" "admin")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.repos.repo_manage_panel"}} ({{ctx.Locale.Tr "admin.total" .Total}})
diff --git a/templates/admin/repo/unadopted.tmpl b/templates/admin/repo/unadopted.tmpl
index e66add6ce8e..db27b11ac57 100644
--- a/templates/admin/repo/unadopted.tmpl
+++ b/templates/admin/repo/unadopted.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin")}}
+{{template "admin/layout_head" (dict "pageClass" "admin")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.repos.unadopted"}}
diff --git a/templates/admin/runners/edit.tmpl b/templates/admin/runners/edit.tmpl
index 1165c84b794..7d7fee15050 100644
--- a/templates/admin/runners/edit.tmpl
+++ b/templates/admin/runners/edit.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin runners")}}
+{{template "admin/layout_head" (dict "pageClass" "admin runners")}}
 	<div class="admin-setting-content">
 		{{template "shared/actions/runner_edit" .}}
 	</div>
diff --git a/templates/admin/self_check.tmpl b/templates/admin/self_check.tmpl
index a7f43f4e12d..31d6a5d516a 100644
--- a/templates/admin/self_check.tmpl
+++ b/templates/admin/self_check.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin")}}
+{{template "admin/layout_head" (dict "pageClass" "admin")}}
 
 <div class="admin-setting-content">
 	<h4 class="ui top attached header">
diff --git a/templates/admin/stacktrace.tmpl b/templates/admin/stacktrace.tmpl
index c5dde6b30c1..a74a3d3e417 100644
--- a/templates/admin/stacktrace.tmpl
+++ b/templates/admin/stacktrace.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin monitor")}}
+{{template "admin/layout_head" (dict "pageClass" "admin monitor")}}
 <div class="admin-setting-content">
 
 	{{template "admin/trace_tabs" .}}
diff --git a/templates/admin/stats.tmpl b/templates/admin/stats.tmpl
index bb6a86ac301..610c2860a35 100644
--- a/templates/admin/stats.tmpl
+++ b/templates/admin/stats.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin monitor")}}
+{{template "admin/layout_head" (dict "pageClass" "admin monitor")}}
 <div class="admin-setting-content">
 	<h4 class="ui top attached header">
 		{{ctx.Locale.Tr "admin.dashboard.statistic"}}
diff --git a/templates/admin/user/edit.tmpl b/templates/admin/user/edit.tmpl
index 83eac64fa04..0563cf63b4d 100644
--- a/templates/admin/user/edit.tmpl
+++ b/templates/admin/user/edit.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin edit user")}}
+{{template "admin/layout_head" (dict "pageClass" "admin edit user")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.users.edit_account"}}
diff --git a/templates/admin/user/list.tmpl b/templates/admin/user/list.tmpl
index 168603354db..db7cb4874f1 100644
--- a/templates/admin/user/list.tmpl
+++ b/templates/admin/user/list.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin user")}}
+{{template "admin/layout_head" (dict "pageClass" "admin user")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.users.user_manage_panel"}} ({{ctx.Locale.Tr "admin.total" .Total}})
diff --git a/templates/admin/user/new.tmpl b/templates/admin/user/new.tmpl
index 8af7f116a17..8fe91bd343e 100644
--- a/templates/admin/user/new.tmpl
+++ b/templates/admin/user/new.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin new user")}}
+{{template "admin/layout_head" (dict "pageClass" "admin new user")}}
 	<div class="admin-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "admin.users.new_account"}}
diff --git a/templates/admin/user/view.tmpl b/templates/admin/user/view.tmpl
index 67f9148e646..bb1b4991d8a 100644
--- a/templates/admin/user/view.tmpl
+++ b/templates/admin/user/view.tmpl
@@ -1,4 +1,4 @@
-{{template "admin/layout_head" (dict "ctxData" . "pageClass" "admin view user")}}
+{{template "admin/layout_head" (dict "pageClass" "admin view user")}}
 
 <div class="admin-setting-content">
 	<div class="admin-responsive-columns">
diff --git a/templates/base/footer.tmpl b/templates/base/footer.tmpl
index b7443345ada..542f6b3cf24 100644
--- a/templates/base/footer.tmpl
+++ b/templates/base/footer.tmpl
@@ -9,10 +9,10 @@
 	</div>
 	{{template "custom/body_outer_post" .}}
 	{{template "base/footer_content" .}}
-	{{ctx.ScriptImport "js/index.js" "module"}}
+	{{ctx.ScriptImport "web_src/js/index.ts" "module"}}
 	{{template "custom/footer" .}}
 	<script nonce="{{ctx.CspScriptNonce}}" type="module">
-	if (!window.config?.frontendInited) alert("Frontend is not initialized, check console errors or asset files.")
+	if (!window.config?.frontendInited && window.config?.runModeIsProd) alert("Frontend is not initialized, check console errors or asset files.");
 	</script>
 </body>
 </html>
diff --git a/templates/base/head_opengraph.tmpl b/templates/base/head_opengraph.tmpl
index 93624ea4b09..3de262f59f8 100644
--- a/templates/base/head_opengraph.tmpl
+++ b/templates/base/head_opengraph.tmpl
@@ -18,8 +18,7 @@
 		<meta property="og:title" content="{{.Title}}">
 		<meta property="og:url" content="{{ctx.AppFullLink $.Link}}">
 		{{if and .PageIsDiff .Commit}}
-			{{- $commitMessageParts := StringUtils.Cut .Commit.Message "\n" -}}
-			{{- $commitMessageBody := index $commitMessageParts 1 -}}
+			{{- $commitMessageBody := .Commit.MessageBody -}}
 			{{- if $commitMessageBody -}}
 				<meta property="og:description" content="{{StringUtils.EllipsisString $commitMessageBody 300}}">
 			{{- end -}}
diff --git a/templates/base/head_script.tmpl b/templates/base/head_script.tmpl
index 1f21c5bee53..f8e2798f55c 100644
--- a/templates/base/head_script.tmpl
+++ b/templates/base/head_script.tmpl
@@ -16,19 +16,19 @@ If you introduce mistakes in it, Gitea JavaScript code wouldn't run correctly.
 		notificationSettings: {{NotificationSettings}}, {{/*a map provided by NewFuncMap in helper.go*/}}
 		enableTimeTracking: {{EnableTimetracking}},
 		mermaidMaxSourceCharacters: {{MermaidMaxSourceCharacters}},
-		sharedWorkerUri: '{{AssetURI "js/eventsource.sharedworker.js"}}',
+		sharedWorkerUri: '{{AssetURI "web_src/js/eventsource.sharedworker.ts"}}',
 		{{/* this global i18n object should only contain general texts. for specialized texts, it should be provided inside the related modules by: (1) API response (2) HTML data-attribute (3) PageData */}}
 		i18n: {
-			copy_success: {{ctx.Locale.Tr "copy_success"}},
-			copy_error: {{ctx.Locale.Tr "copy_error"}},
 			error_occurred: {{ctx.Locale.Tr "error.occurred"}},
 			remove_label_str: {{ctx.Locale.Tr "remove_label_str"}},
 			modal_confirm: {{ctx.Locale.Tr "modal.confirm"}},
 			modal_cancel: {{ctx.Locale.Tr "modal.cancel"}},
 			more_items: {{ctx.Locale.Tr "more_items"}},
+			copy_success: {{ctx.Locale.Tr "copy_success"}},
+			copy_error: {{ctx.Locale.Tr "copy_error"}},
 		},
 	};
 	{{/* in case some pages don't render the pageData, we make sure it is an object to prevent null access */}}
 	window.config.pageData = window.config.pageData || {};
 </script>
-{{ctx.ScriptImport "js/iife.js"}}
+{{ctx.ScriptImport "web_src/js/iife.ts"}}
diff --git a/templates/base/head_style.tmpl b/templates/base/head_style.tmpl
index 4a4fb9d96f8..dba782f9bb9 100644
--- a/templates/base/head_style.tmpl
+++ b/templates/base/head_style.tmpl
@@ -1,2 +1,2 @@
-<link rel="stylesheet" href="{{AssetURI "css/index.css"}}">
+{{AssetCSSLinks "web_src/js/index.ts" "web_src/css/index.css"}}
 <link rel="stylesheet" href="{{ctx.CurrentWebTheme.PublicAssetURI}}">
diff --git a/templates/devtest/devtest-header.tmpl b/templates/devtest/devtest-header.tmpl
index c9d7b3047fe..ad153364e04 100644
--- a/templates/devtest/devtest-header.tmpl
+++ b/templates/devtest/devtest-header.tmpl
@@ -1,4 +1,4 @@
 {{template "base/head" ctx.RootData}}
-<link rel="stylesheet" href="{{AssetURI "css/devtest.css"}}">
+<link rel="stylesheet" href="{{AssetURI "web_src/css/devtest.css"}}">
 <div class="tw-hidden" data-global-init="initDevtestPage"></div>
 <div class="ui container tw-mt-4">{{template "base/alert" ctx.RootData}}</div>
diff --git a/templates/devtest/flex-list.tmpl b/templates/devtest/flex-list.tmpl
index de59473a703..22030202440 100644
--- a/templates/devtest/flex-list.tmpl
+++ b/templates/devtest/flex-list.tmpl
@@ -101,26 +101,27 @@
 				<div class="item">item 2</div>
 			</div>
 		</div>
-		<h3>Flex List (with "ui segment fitted")</h3>
-		<div class="ui attached segment fitted">
-			<div class="flex-divided-list">
+		<h3>Flex List (with "ui segment fitted", items have their own padding)</h3>
+		<div class="ui fitted segment">
+			<div class="flex-divided-list items-px-default">
 				<div class="item">item 1</div>
 				<div class="item">item 2</div>
+				<div class="item">item 3</div>
 			</div>
 		</div>
 
-		<h3>If parent provides border or padding:</h3>
-		<div class="container-segmented tw-border tw-border-secondary">
+		<h3>If parent provides padding or items need their own flex and/or padding:</h3>
+		<div class="tw-border tw-border-secondary">
 			<div class="tw-m-3">before divider</div>
 			<div class="divider"></div>
-			<div class="flex-divided-list">
+			<div class="flex-divided-list flex-items-block items-px-default">
 				<div class="item">item 1</div>
 				<div class="item">item 2</div>
 			</div>
 			<div class="divider"></div>
 			<div class="tw-m-3">after divider</div>
 		</div>
-		<div class="container-padded tw-border tw-border-secondary tw-p-4 tw-my-2">
+		<div class="tw-border tw-border-secondary tw-p-4 tw-my-2">
 			<div>before divider</div>
 			<div class="divider"></div>
 			<div class="flex-divided-list">
diff --git a/templates/devtest/repo-action-view.tmpl b/templates/devtest/repo-action-view.tmpl
index 2971039fc94..4e06f72cdd9 100644
--- a/templates/devtest/repo-action-view.tmpl
+++ b/templates/devtest/repo-action-view.tmpl
@@ -5,6 +5,7 @@
 		<a href="/devtest/repo-action-view/runs/20">Run:CanApprove</a>
 		<a href="/devtest/repo-action-view/runs/30">Run:CanRerunLatest</a>
 		<a href="/devtest/repo-action-view/runs/10/attempts/2">Run:PreviousAttempt</a>
+		<a href="/devtest/repo-action-view/runs/40">Run:ReusableCaller</a>
 	</div>
 	{{template "repo/actions/view_component" (dict
 		"JobID" (or .JobID 0)
diff --git a/templates/home.tmpl b/templates/home.tmpl
index 4d7e7b93274..0513520567e 100644
--- a/templates/home.tmpl
+++ b/templates/home.tmpl
@@ -43,7 +43,7 @@
 				{{svg "octicon-code"}} {{ctx.Locale.Tr "startpage.license"}}
 			</h1>
 			<p class="large tw-text-balance">
-				{{ctx.Locale.Tr "startpage.license_desc" "https://code.gitea.io/gitea" "code.gitea.io/gitea" "https://github.com/go-gitea/gitea"}}
+				{{ctx.Locale.Tr "startpage.license_desc" "https://gitea.dev" "gitea.dev" "https://github.com/go-gitea/gitea"}}
 			</p>
 		</div>
 	</div>
diff --git a/templates/mail/repo/issue/default.tmpl b/templates/mail/repo/issue/default.tmpl
index 6e70cb83cd9..44cdc563ad6 100644
--- a/templates/mail/repo/issue/default.tmpl
+++ b/templates/mail/repo/issue/default.tmpl
@@ -65,11 +65,12 @@
 		{{end -}}
 		{{if eq .ActionName "push"}}
 			<ul>
-			{{range .Comment.Commits}}
+			{{$repoURL := $.Comment.Issue.PullRequest.BaseRepo.HTMLURL}}
+			{{range $commit := $.Comment.Commits}}
 				<li>
-					<a href="{{$.Comment.Issue.PullRequest.BaseRepo.HTMLURL}}/commit/{{.ID}}">
-						{{ShortSha .ID.String}}
-					</a>  -  {{.Summary}}
+					<a href="{{$repoURL}}/commit/{{$commit.ID}}">
+						{{ShortSha $commit.ID.String}}
+					</a>  -  {{$commit.MessageTitle}}
 				</li>
 			{{end}}
 			</ul>
diff --git a/templates/org/member/members.tmpl b/templates/org/member/members.tmpl
index b8e88b837d5..ea637e76fbb 100644
--- a/templates/org/member/members.tmpl
+++ b/templates/org/member/members.tmpl
@@ -11,6 +11,17 @@
 			</div>
 			<div class="divider"></div>
 		{{end}}
+		<div class="ui small secondary filter menu">
+			<form id="org-member-search-form" class="ui form ignore-dirty tw-flex-1 tw-flex tw-items-center tw-gap-x-2">
+				<div class="ui small fluid action input tw-flex-1">
+					{{template "shared/search/input" dict "Value" .Keyword "Placeholder" (ctx.Locale.Tr "search.user_kind")}}
+					{{template "shared/search/button"}}
+				</div>
+			</form>
+			<div class="item tw-text-text-light">
+				{{ctx.Locale.Tr "org.members"}}: {{CountFmt .MembersShown}} / {{CountFmt .MembersTotal}}
+			</div>
+		</div>
 		<div class="flex-divided-list items-with-main">
 			{{range .Members}}
 				{{$isPublic := index $.MembersIsPublicMember .ID}}
@@ -67,6 +78,12 @@
 						{{end}}
 					</div>
 				</div>
+			{{else}}
+				<div class="flex-item">
+					<div class="flex-item-main">
+						{{ctx.Locale.Tr "search.no_results"}}
+					</div>
+				</div>
 			{{end}}
 		</div>
 		{{template "base/paginate" .}}
diff --git a/templates/org/settings/actions.tmpl b/templates/org/settings/actions.tmpl
index abb9c98435f..1abf895627b 100644
--- a/templates/org/settings/actions.tmpl
+++ b/templates/org/settings/actions.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings actions")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings actions")}}
 	<div class="org-setting-content">
 	{{if eq .PageType "runners"}}
 		{{template "shared/actions/runner_list" .}}
diff --git a/templates/org/settings/actions_general.tmpl b/templates/org/settings/actions_general.tmpl
index ebf9482f614..2d2c4a4ca0e 100644
--- a/templates/org/settings/actions_general.tmpl
+++ b/templates/org/settings/actions_general.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" .)}}
+{{template "org/settings/layout_head" (dict)}}
 <div class="org-setting-content">
 	{{template "shared/actions/owner_general_settings" .}}
 </div>
diff --git a/templates/org/settings/applications.tmpl b/templates/org/settings/applications.tmpl
index df5f4e9dbc1..eb12d3fa2ac 100644
--- a/templates/org/settings/applications.tmpl
+++ b/templates/org/settings/applications.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings options")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings options")}}
 			<div class="org-setting-content">
 				<h4 class="ui top attached header">
 					{{ctx.Locale.Tr "settings.applications"}}
diff --git a/templates/org/settings/applications_oauth2_edit.tmpl b/templates/org/settings/applications_oauth2_edit.tmpl
index 987803ac26a..7fdbc940587 100644
--- a/templates/org/settings/applications_oauth2_edit.tmpl
+++ b/templates/org/settings/applications_oauth2_edit.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings options")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings options")}}
 			<div class="org-setting-content">
 				{{template "user/settings/applications_oauth2_edit_form" .}}
 			</div>
diff --git a/templates/org/settings/blocked_users.tmpl b/templates/org/settings/blocked_users.tmpl
index eab5ec0007c..4444048f7a5 100644
--- a/templates/org/settings/blocked_users.tmpl
+++ b/templates/org/settings/blocked_users.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings blocked_users")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings blocked_users")}}
 <div class="org-setting-content">
 	{{template "shared/user/blocked_users" .}}
 </div>
diff --git a/templates/org/settings/hook_new.tmpl b/templates/org/settings/hook_new.tmpl
index f89ee5f2b85..11f71d9059b 100644
--- a/templates/org/settings/hook_new.tmpl
+++ b/templates/org/settings/hook_new.tmpl
@@ -1,7 +1,7 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings new webhook")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings new webhook")}}
 	<div class="org-setting-content">
 		{{$CustomHeaderTitle := ctx.Locale.Tr "repo.settings.update_webhook"}}
 		{{if .PageIsSettingsHooksNew}}{{$CustomHeaderTitle = ctx.Locale.Tr "repo.settings.add_webhook"}}{{end}}
-		{{template "webhook/new" (dict "ctxData" . "CustomHeaderTitle" $CustomHeaderTitle)}}
+		{{template "webhook/new" (dict "CustomHeaderTitle" $CustomHeaderTitle)}}
 	</div>
 {{template "org/settings/layout_footer" .}}
diff --git a/templates/org/settings/hooks.tmpl b/templates/org/settings/hooks.tmpl
index b05e22fe205..dbb1721fff7 100644
--- a/templates/org/settings/hooks.tmpl
+++ b/templates/org/settings/hooks.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings webhooks")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings webhooks")}}
 			<div class="org-setting-content">
 				{{template "repo/settings/webhook/base_list" .}}
 			</div>
diff --git a/templates/org/settings/labels.tmpl b/templates/org/settings/labels.tmpl
index 283b2199cb7..4246c7305e4 100644
--- a/templates/org/settings/labels.tmpl
+++ b/templates/org/settings/labels.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings labels")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings labels")}}
 <div class="org-setting-content">
 	<div class="flex-text-block">
 		<div class="tw-flex-1">
diff --git a/templates/org/settings/layout_head.tmpl b/templates/org/settings/layout_head.tmpl
index 31dad2c1412..97515d89efc 100644
--- a/templates/org/settings/layout_head.tmpl
+++ b/templates/org/settings/layout_head.tmpl
@@ -1,10 +1,10 @@
-{{template "base/head" .ctxData}}
-<div role="main" aria-label="{{.ctxData.Title}}" class="page-content {{.pageClass}}">
-	{{template "org/header" .ctxData}}
+{{template "base/head" ctx.RootData}}
+<div role="main" aria-label="{{ctx.RootData.Title}}" class="page-content {{.pageClass}}">
+	{{template "org/header" ctx.RootData}}
 	<div class="ui container flex-container">
-		{{template "org/settings/navbar" .ctxData}}
+		{{template "org/settings/navbar" ctx.RootData}}
 		<div class="flex-container-main">
-			{{template "base/alert" .ctxData}}
+			{{template "base/alert" ctx.RootData}}
 			{{/* block: org-setting-content */}}
 
 {{if false}}{{/* to make html structure "likely" complete to prevent IDE warnings */}}
diff --git a/templates/org/settings/navbar.tmpl b/templates/org/settings/navbar.tmpl
index 4c06b2cb1ba..b14b4248fc5 100644
--- a/templates/org/settings/navbar.tmpl
+++ b/templates/org/settings/navbar.tmpl
@@ -26,7 +26,7 @@
 		</a>
 		{{end}}
 		{{if .EnableActions}}
-		<details class="item toggleable-item" {{if or .PageIsOrgSettingsActionsGeneral .PageIsSharedSettingsRunners .PageIsSharedSettingsSecrets .PageIsSharedSettingsVariables}}open{{end}}>
+		<details class="item" {{if or .PageIsOrgSettingsActionsGeneral .PageIsSharedSettingsRunners .PageIsSharedSettingsSecrets .PageIsSharedSettingsVariables}}open{{end}}>
 			<summary>{{ctx.Locale.Tr "actions.actions"}}</summary>
 			<div class="menu">
 				<a class="{{if .PageIsOrgSettingsActionsGeneral}}active {{end}}item" href="{{.OrgLink}}/settings/actions">
diff --git a/templates/org/settings/options.tmpl b/templates/org/settings/options.tmpl
index 2c17e139376..614e861b09f 100644
--- a/templates/org/settings/options.tmpl
+++ b/templates/org/settings/options.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings options")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings options")}}
 
 <div class="ui segments org-setting-content">
 	<h4 class="ui top attached header">
diff --git a/templates/org/settings/packages.tmpl b/templates/org/settings/packages.tmpl
index 91106c3f15d..a73ab97a372 100644
--- a/templates/org/settings/packages.tmpl
+++ b/templates/org/settings/packages.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings packages")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings packages")}}
 			<div class="org-setting-content">
 				{{template "package/shared/cleanup_rules/list" .}}
 				{{template "package/shared/cargo" .}}
diff --git a/templates/org/settings/packages_cleanup_rules_edit.tmpl b/templates/org/settings/packages_cleanup_rules_edit.tmpl
index ff4c2dd6516..a6359416c0f 100644
--- a/templates/org/settings/packages_cleanup_rules_edit.tmpl
+++ b/templates/org/settings/packages_cleanup_rules_edit.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings packages")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings packages")}}
 			<div class="org-setting-content">
 				{{template "package/shared/cleanup_rules/edit" .}}
 			</div>
diff --git a/templates/org/settings/packages_cleanup_rules_preview.tmpl b/templates/org/settings/packages_cleanup_rules_preview.tmpl
index 5a2f0612251..973413c4404 100644
--- a/templates/org/settings/packages_cleanup_rules_preview.tmpl
+++ b/templates/org/settings/packages_cleanup_rules_preview.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings packages")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings packages")}}
 			<div class="org-setting-content">
 				{{template "package/shared/cleanup_rules/preview" .}}
 			</div>
diff --git a/templates/org/settings/runners_edit.tmpl b/templates/org/settings/runners_edit.tmpl
index acd67a4d7bd..b87c6c1091f 100644
--- a/templates/org/settings/runners_edit.tmpl
+++ b/templates/org/settings/runners_edit.tmpl
@@ -1,4 +1,4 @@
-{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings runners")}}
+{{template "org/settings/layout_head" (dict "pageClass" "organization settings runners")}}
 			<div class="org-setting-content">
 				{{template "shared/actions/runner_edit" .}}
 			</div>
diff --git a/templates/package/content/cargo.tmpl b/templates/package/content/cargo.tmpl
index ebb23e86597..5c04ab8aae9 100644
--- a/templates/package/content/cargo.tmpl
+++ b/templates/package/content/cargo.tmpl
@@ -27,7 +27,7 @@ git-fetch-with-cli = true</code></pre></div>
 	{{if or .PackageDescriptor.Metadata.Description .PackageDescriptor.Metadata.Readme}}
 		<h4 class="ui top attached header">{{ctx.Locale.Tr "packages.about"}}</h4>
 		{{if .PackageDescriptor.Metadata.Description}}<div class="ui attached segment">{{.PackageDescriptor.Metadata.Description}}</div>{{end}}
-		{{if .PackageDescriptor.Metadata.Readme}}<div class="ui attached segment">{{ctx.RenderUtils.MarkdownToHtml .PackageDescriptor.Metadata.Readme}}</div>{{end}}
+		{{if .PackageDescriptor.Metadata.Readme}}<div class="ui attached segment">{{ctx.RenderUtils.RenderPackageMarkdown .PackageDescriptor.Metadata.Readme .PackageDescriptor.Repository}}</div>{{end}}
 	{{end}}
 
 	{{if .PackageDescriptor.Metadata.Dependencies}}
diff --git a/templates/package/content/chef.tmpl b/templates/package/content/chef.tmpl
index d1c17d36a49..0912aff792c 100644
--- a/templates/package/content/chef.tmpl
+++ b/templates/package/content/chef.tmpl
@@ -20,7 +20,7 @@
 		<h4 class="ui top attached header">{{ctx.Locale.Tr "packages.about"}}</h4>
 		<div class="ui attached segment">
 			{{if .PackageDescriptor.Metadata.Description}}<p>{{.PackageDescriptor.Metadata.Description}}</p>{{end}}
-			{{if .PackageDescriptor.Metadata.LongDescription}}{{ctx.RenderUtils.MarkdownToHtml .PackageDescriptor.Metadata.LongDescription}}{{end}}
+			{{if .PackageDescriptor.Metadata.LongDescription}}{{ctx.RenderUtils.RenderPackageMarkdown .PackageDescriptor.Metadata.LongDescription .PackageDescriptor.Repository}}{{end}}
 		</div>
 	{{end}}
 
diff --git a/templates/package/content/composer.tmpl b/templates/package/content/composer.tmpl
index 2e8cfb77ebc..5bbc19e9f25 100644
--- a/templates/package/content/composer.tmpl
+++ b/templates/package/content/composer.tmpl
@@ -25,7 +25,7 @@
 	{{if or .PackageDescriptor.Metadata.Description .PackageDescriptor.Metadata.Comments}}
 		<h4 class="ui top attached header">{{ctx.Locale.Tr "packages.about"}}</h4>
 		{{if .PackageDescriptor.Metadata.Description}}<div class="ui attached segment">{{.PackageDescriptor.Metadata.Description}}</div>{{end}}
-		{{if .PackageDescriptor.Metadata.Readme}}<div class="ui attached segment markup markdown">{{ctx.RenderUtils.MarkdownToHtml .PackageDescriptor.Metadata.Readme}}</div>{{end}}
+		{{if .PackageDescriptor.Metadata.Readme}}<div class="ui attached segment">{{ctx.RenderUtils.RenderPackageMarkdown .PackageDescriptor.Metadata.Readme .PackageDescriptor.Repository}}</div>{{end}}
 		{{if .PackageDescriptor.Metadata.Comments}}<div class="ui attached segment">{{StringUtils.Join .PackageDescriptor.Metadata.Comments " "}}</div>{{end}}
 	{{end}}
 
diff --git a/templates/package/content/npm.tmpl b/templates/package/content/npm.tmpl
index 28bcf45ee87..89f4c940081 100644
--- a/templates/package/content/npm.tmpl
+++ b/templates/package/content/npm.tmpl
@@ -22,15 +22,8 @@
 
 	{{if or .PackageDescriptor.Metadata.Description .PackageDescriptor.Metadata.Readme}}
 		<h4 class="ui top attached header">{{ctx.Locale.Tr "packages.about"}}</h4>
-		<div class="ui attached segment">
-			{{if .PackageDescriptor.Metadata.Readme}}
-			<div class="markup markdown">
-				{{ctx.RenderUtils.MarkdownToHtml .PackageDescriptor.Metadata.Readme}}
-			</div>
-			{{else if .PackageDescriptor.Metadata.Description}}
-				{{.PackageDescriptor.Metadata.Description}}
-			{{end}}
-		</div>
+		{{if .PackageDescriptor.Metadata.Description}}<div class="ui attached segment">{{.PackageDescriptor.Metadata.Description}}</div>{{end}}
+		{{if .PackageDescriptor.Metadata.Readme}}<div class="ui attached segment">{{ctx.RenderUtils.RenderPackageMarkdown .PackageDescriptor.Metadata.Readme .PackageDescriptor.Repository .PackageDescriptor.Metadata.Repository.Directory}}</div>{{end}}
 	{{end}}
 
 	{{if or .PackageDescriptor.Metadata.Dependencies .PackageDescriptor.Metadata.DevelopmentDependencies .PackageDescriptor.Metadata.PeerDependencies .PackageDescriptor.Metadata.OptionalDependencies}}
diff --git a/templates/package/content/nuget.tmpl b/templates/package/content/nuget.tmpl
index 7f874044cc1..fc9a715a28e 100644
--- a/templates/package/content/nuget.tmpl
+++ b/templates/package/content/nuget.tmpl
@@ -18,9 +18,9 @@
 
 	{{if or .PackageDescriptor.Metadata.Description .PackageDescriptor.Metadata.ReleaseNotes .PackageDescriptor.Metadata.Readme}}
 		<h4 class="ui top attached header">{{ctx.Locale.Tr "packages.about"}}</h4>
-		{{if .PackageDescriptor.Metadata.Description}}<div class="ui attached segment">{{ctx.RenderUtils.MarkdownToHtml .PackageDescriptor.Metadata.Description}}</div>{{end}}
-		{{if .PackageDescriptor.Metadata.Readme}}<div class="ui attached segment markup markdown">{{ctx.RenderUtils.MarkdownToHtml .PackageDescriptor.Metadata.Readme}}</div>{{end}}
-		{{if .PackageDescriptor.Metadata.ReleaseNotes}}<div class="ui attached segment">{{ctx.RenderUtils.MarkdownToHtml .PackageDescriptor.Metadata.ReleaseNotes}}</div>{{end}}
+		{{if .PackageDescriptor.Metadata.Description}}<div class="ui attached segment">{{ctx.RenderUtils.RenderPackageMarkdown .PackageDescriptor.Metadata.Description .PackageDescriptor.Repository}}</div>{{end}}
+		{{if .PackageDescriptor.Metadata.Readme}}<div class="ui attached segment">{{ctx.RenderUtils.RenderPackageMarkdown .PackageDescriptor.Metadata.Readme .PackageDescriptor.Repository}}</div>{{end}}
+		{{if .PackageDescriptor.Metadata.ReleaseNotes}}<div class="ui attached segment">{{ctx.RenderUtils.RenderPackageMarkdown .PackageDescriptor.Metadata.ReleaseNotes .PackageDescriptor.Repository}}</div>{{end}}
 	{{end}}
 
 	{{if .PackageDescriptor.Metadata.Dependencies}}
diff --git a/templates/package/content/pub.tmpl b/templates/package/content/pub.tmpl
index 9eefcf71625..5dafa2db47e 100644
--- a/templates/package/content/pub.tmpl
+++ b/templates/package/content/pub.tmpl
@@ -14,6 +14,6 @@
 	{{if or .PackageDescriptor.Metadata.Description .PackageDescriptor.Metadata.Readme}}
 		<h4 class="ui top attached header">{{ctx.Locale.Tr "packages.about"}}</h4>
 		{{if .PackageDescriptor.Metadata.Description}}<div class="ui attached segment">{{.PackageDescriptor.Metadata.Description}}</div>{{end}}
-		{{if .PackageDescriptor.Metadata.Readme}}<div class="ui attached segment">{{ctx.RenderUtils.MarkdownToHtml .PackageDescriptor.Metadata.Readme}}</div>{{end}}
+		{{if .PackageDescriptor.Metadata.Readme}}<div class="ui attached segment">{{ctx.RenderUtils.RenderPackageMarkdown .PackageDescriptor.Metadata.Readme .PackageDescriptor.Repository}}</div>{{end}}
 	{{end}}
 {{end}}
diff --git a/templates/package/content/pypi.tmpl b/templates/package/content/pypi.tmpl
index 4afdc1b72a7..c570e60e6bf 100644
--- a/templates/package/content/pypi.tmpl
+++ b/templates/package/content/pypi.tmpl
@@ -16,9 +16,9 @@
 		<div class="ui attached segment">
 			<p>{{if .PackageDescriptor.Metadata.Summary}}{{.PackageDescriptor.Metadata.Summary}}{{end}}</p>
 			{{if .PackageDescriptor.Metadata.LongDescription}}
-				{{ctx.RenderUtils.MarkdownToHtml .PackageDescriptor.Metadata.LongDescription}}
+				{{ctx.RenderUtils.RenderPackageMarkdown .PackageDescriptor.Metadata.LongDescription .PackageDescriptor.Repository}}
 			{{else if .PackageDescriptor.Metadata.Description}}
-				{{ctx.RenderUtils.MarkdownToHtml .PackageDescriptor.Metadata.Description}}
+				{{ctx.RenderUtils.RenderPackageMarkdown .PackageDescriptor.Metadata.Description .PackageDescriptor.Repository}}
 			{{end}}
 		</div>
 	{{end}}
diff --git a/templates/package/settings.tmpl b/templates/package/settings.tmpl
index d4241e65410..0192376652e 100644
--- a/templates/package/settings.tmpl
+++ b/templates/package/settings.tmpl
@@ -10,12 +10,28 @@
 			{{template "user/overview/header" .}}
 		{{end}}
 		{{template "base/alert" .}}
-		<p><a href="{{.PackageDescriptor.PackageWebLink}}">{{.PackageDescriptor.Package.Name}}</a> / <strong>{{ctx.Locale.Tr "repo.settings"}}</strong></p>
+		<p>
+			<a href="{{.PackageDescriptor.PackageWebLink}}">{{.PackageDescriptor.Package.Name}}</a>
+			<span class="label-list">
+				{{template "package/shared/visibility_badge" dict "Package" .PackageDescriptor.Package "Owner" .PackageDescriptor.Owner}}
+			</span>
+			/ <strong>{{ctx.Locale.Tr "repo.settings"}}</strong>
+		</p>
+		<h4 class="ui top attached header">
+			{{ctx.Locale.Tr "packages.settings.visibility"}}
+		</h4>
+		<div class="ui attached segment">
+			<p>{{ctx.Locale.Tr "packages.settings.visibility.inherit"}}</p>
+			<a class="ui basic button" href="{{.ContextUser.SettingsLink}}">{{ctx.Locale.Tr "packages.settings.visibility.button"}}</a>
+		</div>
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "packages.settings.link"}}
 		</h4>
 		<div class="ui attached segment">
 			<p>{{ctx.Locale.Tr "packages.settings.link.description"}}</p>
+			<p>- {{ctx.Locale.Tr "packages.settings.link.notice1"}}</p>
+			<p>- {{ctx.Locale.Tr "packages.settings.link.notice2"}}</p>
+			<p>- {{ctx.Locale.Tr "packages.settings.link.notice3"}}</p>
 			<form class="ui form form-fetch-action ignore-dirty flex-text-block" action="{{.Link}}" method="post">
 				<input type="hidden" name="action" value="link">
 				<div data-global-init="initSearchRepoBox" class="ui search" data-uid="{{.PackageDescriptor.Owner.ID}}">
diff --git a/templates/package/shared/cleanup_rules/preview.tmpl b/templates/package/shared/cleanup_rules/preview.tmpl
index 0991a07fbc2..15ad94debd4 100644
--- a/templates/package/shared/cleanup_rules/preview.tmpl
+++ b/templates/package/shared/cleanup_rules/preview.tmpl
@@ -18,7 +18,12 @@
 			{{range .VersionsToRemove}}
 				<tr>
 					<td>{{.Package.Type.Name}}</td>
-					<td>{{.Package.Name}}</td>
+					<td>
+						{{.Package.Name}}
+						<span class="label-list">
+							{{template "package/shared/visibility_badge" dict "Package" .Package "Owner" .Owner}}
+						</span>
+					</td>
 					<td><a href="{{.VersionWebLink}}">{{.Version.Version}}</a></td>
 					<td><a href="{{.Creator.HomeLink}}">{{.Creator.Name}}</a></td>
 					<td>{{FileSize .CalculateBlobSize}}</td>
diff --git a/templates/package/shared/list.tmpl b/templates/package/shared/list.tmpl
index 54e2a2c20ec..69bd7acbe84 100644
--- a/templates/package/shared/list.tmpl
+++ b/templates/package/shared/list.tmpl
@@ -21,7 +21,10 @@
 			<div class="item-main">
 				<div class="item-title">
 					<a href="{{.VersionWebLink}}">{{.Package.Name}}</a>
-					<span class="ui label">{{svg .Package.Type.SVGName 16}} {{.Package.Type.Name}}</span>
+					<span class="label-list">
+						{{template "package/shared/visibility_badge" dict "Package" .Package "Owner" .Owner}}
+						<span class="ui label">{{svg .Package.Type.SVGName 16}} {{.Package.Type.Name}}</span>
+					</span>
 				</div>
 				<div class="item-body">
 					{{$timeStr := DateUtils.TimeSince .Version.CreatedUnix}}
diff --git a/templates/package/shared/versionlist.tmpl b/templates/package/shared/versionlist.tmpl
index 3ef9e790f17..a381f324fac 100644
--- a/templates/package/shared/versionlist.tmpl
+++ b/templates/package/shared/versionlist.tmpl
@@ -1,4 +1,10 @@
-<p><a href="{{.PackageDescriptor.PackageWebLink}}">{{.PackageDescriptor.Package.Name}}</a> / <strong>{{ctx.Locale.Tr "packages.versions"}}</strong></p>
+<p>
+	<a href="{{.PackageDescriptor.PackageWebLink}}">{{.PackageDescriptor.Package.Name}}</a>
+	<span class="label-list">
+		{{template "package/shared/visibility_badge" dict "Package" .PackageDescriptor.Package "Owner" .PackageDescriptor.Owner}}
+	</span>
+	/ <strong>{{ctx.Locale.Tr "packages.versions"}}</strong>
+</p>
 <form class="ui form ignore-dirty">
 	<div class="ui small fluid action input">
 		{{template "shared/search/input" dict "Value" .Query "Placeholder" (ctx.Locale.Tr "search.package_kind")}}
diff --git a/templates/package/shared/view.tmpl b/templates/package/shared/view.tmpl
index 9e32d5fdc2f..5bd093178bb 100644
--- a/templates/package/shared/view.tmpl
+++ b/templates/package/shared/view.tmpl
@@ -1,6 +1,11 @@
 <div class="issue-title-header">
 	{{$packageVersionLink := print $.PackageDescriptor.PackageWebLink "/" (PathEscape .PackageDescriptor.Version.LowerVersion)}}
-	<h1>{{.PackageDescriptor.Package.Name}} ({{.PackageDescriptor.Version.Version}})</h1>
+	<div class="tw-flex tw-flex-wrap tw-items-center tw-gap-2">
+		<h1 class="tw-mb-0">{{.PackageDescriptor.Package.Name}} ({{.PackageDescriptor.Version.Version}})</h1>
+		<span class="label-list">
+			{{template "package/shared/visibility_badge" dict "Package" .PackageDescriptor.Package "Owner" .PackageDescriptor.Owner}}
+		</span>
+	</div>
 	<div>
 		{{$timeStr := DateUtils.TimeSince .PackageDescriptor.Version.CreatedUnix}}
 		{{if .HasRepositoryAccess}}
diff --git a/templates/package/shared/visibility_badge.tmpl b/templates/package/shared/visibility_badge.tmpl
new file mode 100644
index 00000000000..0677391afc6
--- /dev/null
+++ b/templates/package/shared/visibility_badge.tmpl
@@ -0,0 +1,7 @@
+{{if .Package.IsInternal}}
+	<span class="ui basic label">{{ctx.Locale.Tr "repo.desc.internal"}}</span>
+{{else if .Owner.Visibility.IsPrivate}}
+	<span class="ui basic label">{{ctx.Locale.Tr "repo.desc.private"}}</span>
+{{else if .Owner.Visibility.IsLimited}}
+	<span class="ui basic label">{{ctx.Locale.Tr "repo.desc.internal"}}</span>
+{{end}}
diff --git a/templates/projects/view.tmpl b/templates/projects/view.tmpl
index 30056e211f1..8f4f1d60fda 100644
--- a/templates/projects/view.tmpl
+++ b/templates/projects/view.tmpl
@@ -134,16 +134,16 @@
 
 {{if $canWriteProject}}
 <div class="ui small modal" id="project-column-modal-edit">
-	<div class="header">edit</div>
+	<div class="header">{{ctx.Locale.Tr "repo.projects.column.edit"}}</div>
 	<div class="content">
 		<form class="ui form ignore-dirty" method="post" data-action-base-link="{{$.Link}}">
 			<input class="project-column-id" type="hidden" name="id">
 			<div class="required field">
-				<label class="project-column-title-label" for="project-column-title-input">title</label>
+				<label class="project-column-title-label" for="project-column-title-input">{{ctx.Locale.Tr "repo.projects.column.edit_title"}}</label>
 				<input id="project-column-title-input" name="title" required>
 			</div>
 			<div class="field">
-				<label class="project-column-color-label" for="project-column-color-input">color</label>
+				<label class="project-column-color-label" for="project-column-color-input">{{ctx.Locale.Tr "repo.projects.column.color"}}</label>
 				<div class="color-picker-combo" data-global-init="initColorPicker">
 					<input maxlength="7" placeholder="#c320f6" id="project-column-color-input" name="color">
 					{{template "repo/issue/label_precolors"}}
@@ -151,7 +151,7 @@
 			</div>
 			<div class="actions">
 				<button class="ui cancel button">{{ctx.Locale.Tr "settings.cancel"}}</button>
-				<button type="submit" class="ui primary button project-column-button-save">save</button>
+				<button type="submit" class="ui primary button project-column-button-save">{{ctx.Locale.Tr "save"}}</button>
 			</div>
 		</form>
 	</div>
diff --git a/templates/repo/actions/list.tmpl b/templates/repo/actions/list.tmpl
index 4fbc58592a0..1eec365cef9 100644
--- a/templates/repo/actions/list.tmpl
+++ b/templates/repo/actions/list.tmpl
@@ -7,11 +7,11 @@
 		{{if .HasWorkflowsOrRuns}}
 		<div class="flex-container">
 			<div class="flex-container-nav">
-				<div class="ui fluid vertical menu flex-items-block">
-					<a class="item {{if not $.CurWorkflow}}active{{end}}" href="?actor={{$.CurActor}}&status={{$.CurStatus}}">{{ctx.Locale.Tr "actions.runs.all_workflows"}}</a>
+				<div class="ui fluid vertical menu">
+					<a class="item {{if not $.CurWorkflow}}active{{end}}" href="?actor={{$.CurActor}}&status={{$.CurStatus}}&branch={{$.CurBranch}}">{{ctx.Locale.Tr "actions.runs.all_workflows"}}</a>
 					{{range .workflows}}
-						<a class="item {{if eq .Entry.Name $.CurWorkflow}}active{{end}}" href="?workflow={{.Entry.Name}}&actor={{$.CurActor}}&status={{$.CurStatus}}">
-							<span class="gt-ellipsis">{{.Entry.Name}}</span>
+						<a class="item flex-text-block {{if eq .Entry.Name $.CurWorkflow}}active{{end}}" href="?workflow={{.Entry.Name}}&actor={{$.CurActor}}&status={{$.CurStatus}}&branch={{$.CurBranch}}">
+							<span class="gt-ellipsis">{{.DisplayName}}</span>
 
 							{{if .ErrMsg}}
 								<span class="flex-text-inline" data-tooltip-content="{{.ErrMsg}}">{{svg "octicon-alert" 16 "tw-text-red"}}</span>
@@ -22,6 +22,23 @@
 							{{end}}
 						</a>
 					{{end}}
+					{{if .OtherWorkflows}}
+						<details class="item"{{if not $.CurWorkflowIsListed}} open{{end}}>
+							<summary data-tooltip-content="{{ctx.Locale.Tr "actions.runs.other_workflows_tooltip"}}">
+								<span class="flex-text-block">
+									{{ctx.Locale.Tr "actions.runs.other_workflows"}}
+									<span class="ui label">{{len .OtherWorkflows}}</span>
+								</span>
+							</summary>
+							<div class="menu items-full-width">
+								{{range .OtherWorkflows}}
+									<a class="item {{if eq . $.CurWorkflow}}active{{end}}" href="?workflow={{.}}&actor={{$.CurActor}}&status={{$.CurStatus}}">
+										<span class="gt-ellipsis">{{.}}</span>
+									</a>
+								{{end}}
+							</div>
+						</details>
+					{{end}}
 				</div>
 			</div>
 			<div class="flex-container-main">
@@ -37,11 +54,11 @@
 									<i class="icon">{{svg "octicon-search"}}</i>
 									<input type="text" placeholder="{{ctx.Locale.Tr "actions.runs.actor"}}">
 								</div>
-								<a class="item{{if not $.CurActor}} active{{end}}" href="?workflow={{$.CurWorkflow}}&status={{$.CurStatus}}&actor=0">
+								<a class="item{{if not $.CurActor}} selected{{end}}" href="?workflow={{$.CurWorkflow}}&status={{$.CurStatus}}&branch={{$.CurBranch}}&actor=0">
 									{{ctx.Locale.Tr "actions.runs.actors_no_select"}}
 								</a>
 								{{range .Actors}}
-									<a class="item{{if eq .ID $.CurActor}} active{{end}}" href="?workflow={{$.CurWorkflow}}&actor={{.ID}}&status={{$.CurStatus}}">
+									<a class="item{{if eq .ID $.CurActor}} selected{{end}}" href="?workflow={{$.CurWorkflow}}&actor={{.ID}}&status={{$.CurStatus}}&branch={{$.CurBranch}}">
 										{{ctx.AvatarUtils.Avatar . 20}} {{.GetDisplayName}}
 									</a>
 								{{end}}
@@ -56,22 +73,41 @@
 									<i class="icon">{{svg "octicon-search"}}</i>
 									<input type="text" placeholder="{{ctx.Locale.Tr "actions.runs.status"}}">
 								</div>
-								<a class="item{{if not $.CurStatus}} active{{end}}" href="?workflow={{$.CurWorkflow}}&actor={{$.CurActor}}&status=0">
+								<a class="item{{if not $.CurStatus}} selected{{end}}" href="?workflow={{$.CurWorkflow}}&actor={{$.CurActor}}&branch={{$.CurBranch}}&status=0">
 									{{ctx.Locale.Tr "actions.runs.status_no_select"}}
 								</a>
 								{{range .StatusInfoList}}
-									<a class="item{{if eq .Status $.CurStatus}} active{{end}}" href="?workflow={{$.CurWorkflow}}&actor={{$.CurActor}}&status={{.Status}}">
+									<a class="item{{if eq .Status $.CurStatus}} selected{{end}}" href="?workflow={{$.CurWorkflow}}&actor={{$.CurActor}}&status={{.Status}}&branch={{$.CurBranch}}">
 										{{.DisplayedStatus}}
 									</a>
 								{{end}}
 							</div>
 						</div>
+						<!-- Branch -->
+						<div class="ui{{if not .RunBranches}} disabled{{end}} dropdown jump item" data-test-id="filter-branch">
+							<span class="text">{{ctx.Locale.Tr "actions.runs.branch"}}</span>
+							{{svg "octicon-triangle-down" 14 "dropdown icon"}}
+							<div class="menu">
+								<div class="ui icon search input">
+									<i class="icon">{{svg "octicon-search"}}</i>
+									<input type="text" placeholder="{{ctx.Locale.Tr "actions.runs.branch"}}">
+								</div>
+								<a class="item{{if not $.CurBranch}} selected{{end}}" href="?workflow={{$.CurWorkflow}}&actor={{$.CurActor}}&status={{$.CurStatus}}">
+									{{ctx.Locale.Tr "actions.runs.branches_no_select"}}
+								</a>
+								{{range .RunBranches}}
+									<a class="item{{if eq . $.CurBranch}} selected{{end}}" href="?workflow={{$.CurWorkflow}}&actor={{$.CurActor}}&status={{$.CurStatus}}&branch={{.}}">
+										{{.}}
+									</a>
+								{{end}}
+							</div>
+						</div>
 
-						{{if .AllowDisableOrEnableWorkflow}}
+						{{if and .AllowDisableOrEnableWorkflow .CurWorkflowIsListed $.CurWorkflow}}
 						<button class="ui jump dropdown btn interact-bg tw-p-2">
 							{{svg "octicon-kebab-horizontal"}}
 							<div class="menu">
-								<a class="item link-action" data-url="{{$.Link}}/{{if .CurWorkflowDisabled}}enable{{else}}disable{{end}}?workflow={{$.CurWorkflow}}&actor={{.CurActor}}&status={{$.CurStatus}}">
+								<a class="item link-action" data-url="{{$.Link}}/{{if .CurWorkflowDisabled}}enable{{else}}disable{{end}}?workflow={{$.CurWorkflow}}&actor={{.CurActor}}&status={{$.CurStatus}}&branch={{$.CurBranch}}">
 									{{if .CurWorkflowDisabled}}{{ctx.Locale.Tr "actions.workflow.enable"}}{{else}}{{ctx.Locale.Tr "actions.workflow.disable"}}{{end}}
 								</a>
 							</div>
diff --git a/templates/repo/actions/runs_list.tmpl b/templates/repo/actions/runs_list.tmpl
index f60d480f8af..edc167e706b 100644
--- a/templates/repo/actions/runs_list.tmpl
+++ b/templates/repo/actions/runs_list.tmpl
@@ -8,7 +8,9 @@
 	{{range $run := .Runs}}
 		<div class="item tw-items-center">
 			<div class="item-leading">
-				{{template "repo/actions/status" (dict "status" $run.Status.String)}}
+				<span data-tooltip-content="{{ctx.Locale.Tr (printf "actions.status.%s" $run.Status.String)}}">
+					{{template "repo/icons/action_status" (dict "Status" $run.Status.String "IconVariant" "circle-fill")}}
+				</span>
 			</div>
 			<div class="item-main">
 				<span class="item-title" title="{{$run.Title}}">
@@ -19,7 +21,8 @@
 					{{end}}
 				</span>
 				<div class="item-body">
-					<span><b>{{if not $.CurWorkflow}}{{$run.WorkflowID}} {{end}}#{{$run.Index}}</b>:</span>
+					{{$workflowName := index $.WorkflowNames $run.WorkflowID}}
+					<span><b>{{if not $.CurWorkflow}}{{if $workflowName}}{{$workflowName}}{{else}}{{$run.WorkflowID}}{{end}} {{end}}#{{$run.Index}}</b>:</span>
 
 					{{- if $run.ScheduleID -}}
 						{{ctx.Locale.Tr "actions.runs.scheduled"}}
diff --git a/templates/repo/actions/status.tmpl b/templates/repo/actions/status.tmpl
deleted file mode 100644
index f44245086e0..00000000000
--- a/templates/repo/actions/status.tmpl
+++ /dev/null
@@ -1,23 +0,0 @@
-<!-- This template should be kept the same as web_src/js/components/ActionRunStatus.vue
-	Please also update the vue file above if this template is modified.
-	action status accepted: success, skipped, waiting, blocked, running, failure, cancelled, unknown
--->
-{{- $size := Iif .size .size 16 -}}
-{{- $className := Iif .className .className "" -}}
-<span data-tooltip-content="{{ctx.Locale.Tr (printf "actions.status.%s" .status)}}">
-{{if eq .status "success"}}
-	{{svg "octicon-check-circle-fill" $size (printf "tw-text-green %s" $className)}}
-{{else if eq .status "skipped"}}
-	{{svg "octicon-skip" $size (printf "tw-text-text-light %s" $className)}}
-{{else if eq .status "cancelled"}}
-	{{svg "octicon-stop" $size (printf "tw-text-text-light %s" $className)}}
-{{else if eq .status "waiting"}}
-	{{svg "octicon-circle" $size (printf "tw-text-text-light %s" $className)}}
-{{else if eq .status "blocked"}}
-	{{svg "octicon-blocked" $size (printf "tw-text-yellow %s" $className)}}
-{{else if eq .status "running"}}
-	{{svg "gitea-running" $size (printf "tw-text-yellow rotate-clockwise %s" $className)}}
-{{else}}{{/*failure, unknown*/}}
-	{{svg "octicon-x-circle-fill" $size (printf "tw-text-red %s" $className)}}
-{{end}}
-</span>
diff --git a/templates/repo/actions/view_component.tmpl b/templates/repo/actions/view_component.tmpl
index 67926276c0c..2ed47ad9df8 100644
--- a/templates/repo/actions/view_component.tmpl
+++ b/templates/repo/actions/view_component.tmpl
@@ -15,6 +15,8 @@
 		data-locale-runs-pushed-by="{{ctx.Locale.Tr "actions.runs.pushed_by"}}"
 		data-locale-summary="{{ctx.Locale.Tr "actions.runs.summary"}}"
 		data-locale-all-jobs="{{ctx.Locale.Tr "actions.runs.all_jobs"}}"
+		data-locale-expand-caller-jobs="{{ctx.Locale.Tr "actions.runs.expand_caller_jobs"}}"
+		data-locale-collapse-caller-jobs="{{ctx.Locale.Tr "actions.runs.collapse_caller_jobs"}}"
 		data-locale-triggered-via="{{ctx.Locale.Tr "actions.runs.triggered_via"}}"
 		data-locale-total-duration="{{ctx.Locale.Tr "actions.runs.total_duration"}}"
 		data-locale-run-details="{{ctx.Locale.Tr "actions.runs.run_details"}}"
@@ -22,6 +24,7 @@
 		data-locale-status-unknown="{{ctx.Locale.Tr "actions.status.unknown"}}"
 		data-locale-status-waiting="{{ctx.Locale.Tr "actions.status.waiting"}}"
 		data-locale-status-running="{{ctx.Locale.Tr "actions.status.running"}}"
+		data-locale-status-cancelling="{{ctx.Locale.Tr "actions.status.cancelling"}}"
 		data-locale-status-success="{{ctx.Locale.Tr "actions.status.success"}}"
 		data-locale-status-failure="{{ctx.Locale.Tr "actions.status.failure"}}"
 		data-locale-status-cancelled="{{ctx.Locale.Tr "actions.status.cancelled"}}"
@@ -35,7 +38,18 @@
 		data-locale-show-log-seconds="{{ctx.Locale.Tr "show_log_seconds"}}"
 		data-locale-show-full-screen="{{ctx.Locale.Tr "show_full_screen"}}"
 		data-locale-download-logs="{{ctx.Locale.Tr "download_logs"}}"
+		data-locale-copy-output="{{ctx.Locale.Tr "copy_output"}}"
 		data-locale-logs-always-auto-scroll="{{ctx.Locale.Tr "actions.logs.always_auto_scroll"}}"
 		data-locale-logs-always-expand-running="{{ctx.Locale.Tr "actions.logs.always_expand_running"}}"
+		data-locale-workflow-dependencies="{{ctx.Locale.Tr "actions.runs.workflow_dependencies"}}"
+		data-locale-graph-jobs-count-1="{{ctx.Locale.Tr "actions.runs.graph_jobs_count_1"}}"
+		data-locale-graph-jobs-count-n="{{ctx.Locale.Tr "actions.runs.graph_jobs_count_n"}}"
+		data-locale-graph-dependencies-count-1="{{ctx.Locale.Tr "actions.runs.graph_dependencies_count_1"}}"
+		data-locale-graph-dependencies-count-n="{{ctx.Locale.Tr "actions.runs.graph_dependencies_count_n"}}"
+		data-locale-graph-success-rate="{{ctx.Locale.Tr "actions.runs.graph_success_rate"}}"
+		data-locale-graph-zoom-in="{{ctx.Locale.Tr "actions.runs.graph_zoom_in"}}"
+		data-locale-graph-zoom-max="{{ctx.Locale.Tr "actions.runs.graph_zoom_max"}}"
+		data-locale-graph-zoom-out="{{ctx.Locale.Tr "actions.runs.graph_zoom_out"}}"
+		data-locale-graph-reset-view="{{ctx.Locale.Tr "actions.runs.graph_reset_view"}}"
 >
 </div>
diff --git a/templates/repo/actions/workflow_dispatch.tmpl b/templates/repo/actions/workflow_dispatch.tmpl
index a859f6886bb..ad9b0e94ccc 100644
--- a/templates/repo/actions/workflow_dispatch.tmpl
+++ b/templates/repo/actions/workflow_dispatch.tmpl
@@ -7,7 +7,7 @@
 </div>
 <div id="runWorkflowDispatchModal" class="ui tiny modal">
 	<div class="content">
-		<form id="runWorkflowDispatchForm" class="ui form ignore-dirty" action="{{$.Link}}/run?workflow={{$.CurWorkflow}}&actor={{$.CurActor}}&status={{.Status}}" method="post">
+		<form id="runWorkflowDispatchForm" class="ui form ignore-dirty" action="{{$.Link}}/run?workflow={{$.CurWorkflow}}&actor={{$.CurActor}}&status={{$.CurStatus}}&branch={{$.CurBranch}}" method="post">
 			<div class="ui inline field required tw-flex tw-items-center">
 				<span class="ui inline required field">
 					<label>{{ctx.Locale.Tr "actions.workflow.from_ref"}}:</label>
diff --git a/templates/repo/branch/list.tmpl b/templates/repo/branch/list.tmpl
index 40aefe5b113..7d8f2bfc5b8 100644
--- a/templates/repo/branch/list.tmpl
+++ b/templates/repo/branch/list.tmpl
@@ -29,8 +29,8 @@
 								</div>
 								<p class="info tw-flex tw-items-center tw-my-1">{{svg "octicon-git-commit" 16 "tw-mr-1"}}<a href="{{.RepoLink}}/commit/{{PathEscape .DefaultBranchBranch.DBBranch.CommitID}}">{{ShortSha .DefaultBranchBranch.DBBranch.CommitID}}</a> · <span class="commit-message">{{ctx.RenderUtils.RenderCommitMessage .DefaultBranchBranch.DBBranch.CommitMessage .Repository}}</span> · {{ctx.Locale.Tr "org.repo_updated"}} {{DateUtils.TimeSince .DefaultBranchBranch.DBBranch.CommitTime}}{{if .DefaultBranchBranch.DBBranch.Pusher}} &nbsp;{{template "shared/user/avatarlink" dict "user" .DefaultBranchBranch.DBBranch.Pusher}}{{template "shared/user/namelink" .DefaultBranchBranch.DBBranch.Pusher}}{{end}}</p>
 							</td>
-							{{/* FIXME: here and below, the tw-overflow-visible is not quite right but it is still needed the moment: to show the important buttons when the width is narrow */}}
-							<td class="tw-text-right tw-overflow-visible">
+							<td>
+								<div class="tw-flex tw-flex-wrap tw-justify-end">
 								{{if and $.IsWriter $.Repository.CanContentChange (not .IsDeleted)}}
 									<button class="btn interact-bg show-create-branch-modal tw-p-2"
 										data-modal="#create-branch-modal"
@@ -63,6 +63,7 @@
 										{{svg "octicon-pencil"}}
 									</button>
 								{{end}}
+								</div>
 							</td>
 						</tr>
 					</tbody>
@@ -71,9 +72,7 @@
 		{{end}}
 
 		<h4 class="ui top attached header">
-			<div class="flex-text-block">
-				{{ctx.Locale.Tr "repo.branches"}}
-			</div>
+			{{ctx.Locale.Tr "repo.branches"}}
 		</h4>
 
 		<div class="ui attached segment">
@@ -106,7 +105,7 @@
 								<p class="info tw-flex tw-items-center tw-my-1">{{svg "octicon-git-commit" 16 "tw-mr-1"}}<a href="{{$.RepoLink}}/commit/{{PathEscape .DBBranch.CommitID}}">{{ShortSha .DBBranch.CommitID}}</a> · <span class="commit-message">{{ctx.RenderUtils.RenderCommitMessage .DBBranch.CommitMessage $.Repository}}</span> · {{ctx.Locale.Tr "org.repo_updated"}} {{DateUtils.TimeSince .DBBranch.CommitTime}}{{if .DBBranch.Pusher}} &nbsp;{{template "shared/user/avatarlink" dict "user" .DBBranch.Pusher}} &nbsp;{{template "shared/user/namelink" .DBBranch.Pusher}}{{end}}</p>
 							{{end}}
 							</td>
-							<td class="two wide ui">
+							<td class="two wide">
 							{{if and (not .DBBranch.IsDeleted) $.DefaultBranchBranch}}
 								{{$tooltipDivergence := ""}}
 								{{if or .CommitsBehind .CommitsAhead}}
@@ -127,21 +126,21 @@
 								</div>
 							{{end}}
 							</td>
-							<td class="two wide tw-text-right">
+							<td class="three wide tw-text-right">
 								{{if not .LatestPullRequest}}
 									{{if .IsIncluded}}
 										<span class="ui orange large label" data-tooltip-content="{{ctx.Locale.Tr "repo.branch.included_desc"}}">
 											{{svg "octicon-git-pull-request"}} {{ctx.Locale.Tr "repo.branch.included"}}
 										</span>
 								{{else if and (not .DBBranch.IsDeleted) $.AllowsPulls (gt .CommitsAhead 0)}}
-									<a href="{{$.PullRequestCtx.MakeDefaultCompareLink .DBBranch.Name}}?expand=1">
-										<button id="new-pull-request" class="ui compact basic button tw-mr-0">{{if $.CanPull}}{{ctx.Locale.Tr "repo.pulls.compare_changes"}}{{else}}{{ctx.Locale.Tr "action.compare_branch"}}{{end}}</button>
+									<a class="ui compact basic button tw-m-0 tw-max-w-full" href="{{$.PullRequestCtx.MakeDefaultCompareLink .DBBranch.Name}}?expand=1">
+										<span class="gt-ellipsis">{{if $.CanPull}}{{ctx.Locale.Tr "repo.pulls.compare_changes"}}{{else}}{{ctx.Locale.Tr "action.compare_branch"}}{{end}}</span>
 									</a>
 									{{end}}
 								{{else if and .LatestPullRequest.HasMerged .MergeMovedOn}}
 									{{if and (not .DBBranch.IsDeleted) $.AllowsPulls (gt .CommitsAhead 0)}}
-									<a href="{{$.PullRequestCtx.MakeDefaultCompareLink .DBBranch.Name}}?expand=1">
-										<button id="new-pull-request" class="ui compact basic button tw-mr-0">{{if $.CanPull}}{{ctx.Locale.Tr "repo.pulls.compare_changes"}}{{else}}{{ctx.Locale.Tr "action.compare_branch"}}{{end}}</button>
+									<a class="ui compact basic button tw-m-0 tw-max-w-full" href="{{$.PullRequestCtx.MakeDefaultCompareLink .DBBranch.Name}}?expand=1">
+										<span class="gt-ellipsis">{{if $.CanPull}}{{ctx.Locale.Tr "repo.pulls.compare_changes"}}{{else}}{{ctx.Locale.Tr "action.compare_branch"}}{{end}}</span>
 									</a>
 									{{end}}
 								{{else}}
@@ -155,8 +154,8 @@
 									{{end}}
 								{{end}}
 							</td>
-							{{/* FIXME: here and above, the tw-overflow-visible is not quite right */}}
-							<td class="three wide tw-text-right tw-overflow-visible">
+							<td class="three wide">
+								<div class="tw-flex tw-flex-wrap tw-justify-end">
 								{{if and $.IsWriter $.Repository.CanContentChange (not .DBBranch.IsDeleted)}}
 									<button class="btn interact-bg tw-p-2 show-modal show-create-branch-modal"
 										data-branch-from="{{.DBBranch.Name}}"
@@ -202,6 +201,7 @@
 										</button>
 									{{end}}
 								{{end}}
+								</div>
 							</td>
 						</tr>
 					{{end}}
diff --git a/templates/repo/commit_page.tmpl b/templates/repo/commit_page.tmpl
index 8451a6f3cf1..9618eda7612 100644
--- a/templates/repo/commit_page.tmpl
+++ b/templates/repo/commit_page.tmpl
@@ -5,7 +5,7 @@
 	<div class="ui container fluid padded">
 		<div class="ui top attached header clearing segment tw-relative commit-header">
 			<div class="tw-flex tw-mb-4 tw-gap-1">
-				<h3 class="tw-mb-0 tw-flex-1"><span class="commit-summary" title="{{.Commit.Summary}}">{{ctx.RenderUtils.RenderCommitMessage .Commit.Message $.Repository}}</span>{{template "repo/commit_statuses" dict "Status" .CommitStatus "Statuses" .CommitStatuses "AdditionalClasses" "tw-inline"}}</h3>
+				<h3 class="tw-mb-0 tw-flex-1"><span class="commit-summary" title="{{.Commit.MessageTitle}}">{{ctx.RenderUtils.RenderCommitMessage .Commit.MessageUTF8 $.Repository}}</span>{{template "repo/commit_statuses" dict "Status" .CommitStatus "Statuses" .CommitStatuses "AdditionalClasses" "tw-inline"}}</h3>
 				{{if not $.PageIsWiki}}
 					<div class="commit-header-buttons">
 						<a class="ui primary tiny button" href="{{.SourcePath}}">
@@ -119,8 +119,8 @@
 					</div>
 				{{end}}
 			</div>
-			{{if IsMultilineCommitMessage .Commit.Message}}
-				<pre class="commit-body">{{ctx.RenderUtils.RenderCommitBody .Commit.Message $.Repository}}</pre>
+			{{if .Commit.MessageBody}}
+				<pre class="commit-body">{{ctx.RenderUtils.RenderCommitBody .Commit.MessageUTF8 $.Repository}}</pre>
 			{{end}}
 			{{template "repo/commit_load_branches_and_tags" .}}
 		</div>
@@ -139,8 +139,7 @@
 					<strong>{{.Commit.Author.Name}}</strong>
 				{{end}}
 			</div>
-
-			<span class="tw-text-text-light">{{DateUtils.TimeSince .Commit.Author.When}}</span>
+			<span class="tw-text-text-light">{{DateUtils.TimeSince .Commit.Committer.When}}</span>
 
 			<div class="flex-text-inline">
 				{{if or (ne .Commit.Committer.Name .Commit.Author.Name) (ne .Commit.Committer.Email .Commit.Author.Email)}}
diff --git a/templates/repo/commit_statuses.tmpl b/templates/repo/commit_statuses.tmpl
index 1bbfb331051..fb1e6fbf9bc 100644
--- a/templates/repo/commit_statuses.tmpl
+++ b/templates/repo/commit_statuses.tmpl
@@ -1,14 +1,16 @@
 {{if .Statuses}}
 	{{if and (eq (len .Statuses) 1) .Status.TargetURL}}
 		<a class="flex-text-inline tw-no-underline {{.AdditionalClasses}}" data-global-init="initCommitStatuses" href="{{.Status.TargetURL}}">
-			{{template "repo/commit_status" .Status}}
+			{{template "repo/icons/commit_status" .Status}}
 		</a>
 	{{else}}
 		<span class="flex-text-inline {{.AdditionalClasses}}" data-global-init="initCommitStatuses" tabindex="0">
-			{{template "repo/commit_status" .Status}}
+			{{template "repo/icons/commit_status" .Status}}
 		</span>
 	{{end}}
 	<div class="tippy-target">
-		{{template "repo/pulls/status" (dict "CommitStatuses" .Statuses "CommitStatus" .Status)}}
+		<div class="flex-divided-list items-px-default">
+			{{template "repo/pulls/status_items" (dict "CommitStatuses" .Statuses)}}
+		</div>
 	</div>
 {{end}}
diff --git a/templates/repo/commits_list.tmpl b/templates/repo/commits_list.tmpl
index d520c0fbcf7..e79d189b8d3 100644
--- a/templates/repo/commits_list.tmpl
+++ b/templates/repo/commits_list.tmpl
@@ -11,7 +11,7 @@
 		</thead>
 		<tbody class="commit-list">
 			{{$commitRepoLink := $.RepoLink}}{{if $.CommitRepoLink}}{{$commitRepoLink = $.CommitRepoLink}}{{end}}
-			{{range .Commits}}
+			{{range $commit := .Commits}}
 				<tr>
 					<td class="author">
 						<span class="author-wrapper">
@@ -38,18 +38,22 @@
 					<td class="message">
 						<span class="message-wrapper">
 						{{if $.PageIsWiki}}
-							<span class="commit-summary {{if gt .ParentCount 1}} grey text{{end}}" title="{{.Summary}}">{{.Summary | ctx.RenderUtils.RenderEmoji}}</span>
+							<span class="commit-summary {{if gt $commit.ParentCount 1}} grey text{{end}}" title="{{$commit.MessageTitle}}">
+								{{$commit.MessageTitle | ctx.RenderUtils.RenderEmoji}}
+							</span>
 						{{else}}
-							{{$commitLink:= printf "%s/commit/%s" $commitRepoLink (PathEscape .ID.String)}}
-							<span class="commit-summary {{if gt .ParentCount 1}} grey text{{end}}" title="{{.Summary}}">{{ctx.RenderUtils.RenderCommitMessageLinkSubject .Message $commitLink $.Repository}}</span>
+							{{$commitLink:= printf "%s/commit/%s" $commitRepoLink (PathEscape $commit.ID.String)}}
+							<span class="commit-summary {{if gt $commit.ParentCount 1}} grey text{{end}}" title="{{$commit.MessageTitle}}">
+								{{ctx.RenderUtils.RenderCommitMessageLinkSubject $commit.MessageUTF8 $commitLink $.Repository}}
+							</span>
 						{{end}}
 						</span>
-						{{if IsMultilineCommitMessage .Message}}
+						{{if $commit.MessageBody}}
 						<button class="ui button ellipsis-button" aria-expanded="false" data-global-click="onRepoEllipsisButtonClick">...</button>
 						{{end}}
 						{{template "repo/commit_statuses" dict "Status" .Status "Statuses" .Statuses}}
-						{{if IsMultilineCommitMessage .Message}}
-						<pre class="commit-body tw-hidden">{{ctx.RenderUtils.RenderCommitBody .Message $.Repository}}</pre>
+						{{if $commit.MessageBody}}
+						<pre class="commit-body tw-hidden">{{ctx.RenderUtils.RenderCommitBody $commit.MessageUTF8 $.Repository}}</pre>
 						{{end}}
 						{{if $.CommitsTagsMap}}
 							{{range (index $.CommitsTagsMap .ID.String)}}
diff --git a/templates/repo/commits_list_small.tmpl b/templates/repo/commits_list_small.tmpl
index 0470d1e9f50..c5f0d5b5900 100644
--- a/templates/repo/commits_list_small.tmpl
+++ b/templates/repo/commits_list_small.tmpl
@@ -1,6 +1,6 @@
 {{$index := 0}}
 <div class="timeline-item commits-list">
-{{range .comment.Commits}}
+{{range $commit := .comment.Commits}}
 	{{$tag := printf "%s-%d" $.comment.HashTag $index}}
 	{{$index = Eval $index "+" 1}}
 	<div class="flex-text-block" id="{{$tag}}">{{/*singular-commit*/}}
@@ -14,11 +14,11 @@
 		{{$commitBaseLink := printf "%s/commit" $.comment.Issue.PullRequest.BaseRepo.Link}}
 		{{$commitLink:= printf "%s/%s" $commitBaseLink (PathEscape .ID.String)}}
 
-		<span class="tw-flex-1 tw-font-mono gt-ellipsis" title="{{.Summary}}">
-			{{- ctx.RenderUtils.RenderCommitMessageLinkSubject .Message $commitLink $.comment.Issue.PullRequest.BaseRepo -}}
+		<span class="tw-flex-1 tw-font-mono gt-ellipsis" title="{{$commit.MessageTitle}}">
+			{{- ctx.RenderUtils.RenderCommitMessageLinkSubject $commit.MessageUTF8 $commitLink $.comment.Issue.PullRequest.BaseRepo -}}
 		</span>
 
-		{{if IsMultilineCommitMessage .Message}}
+		{{if $commit.MessageBody}}
 			<button class="ui button ellipsis-button show-panel toggle" data-panel="[data-singular-commit-body-for='{{$tag}}']">...</button>
 		{{end}}
 
@@ -27,9 +27,9 @@
 			{{template "repo/commit_sign_badge" dict "Commit" . "CommitBaseLink" $commitBaseLink "CommitSignVerification" .Verification}}
 		</span>
 	</div>
-	{{if IsMultilineCommitMessage .Message}}
+	{{if $commit.MessageBody}}
 	<pre class="commit-body tw-ml-[33px] tw-hidden" data-singular-commit-body-for="{{$tag}}">
-		{{- ctx.RenderUtils.RenderCommitBody .Message $.comment.Issue.PullRequest.BaseRepo -}}
+		{{- ctx.RenderUtils.RenderCommitBody $commit.MessageUTF8 $.comment.Issue.PullRequest.BaseRepo -}}
 	</pre>
 	{{end}}
 {{end}}
diff --git a/templates/repo/contributors.tmpl b/templates/repo/contributors.tmpl
index 882d8b205cf..2f7ddb8098c 100644
--- a/templates/repo/contributors.tmpl
+++ b/templates/repo/contributors.tmpl
@@ -10,6 +10,7 @@
 		data-locale-loading-title-failed="{{ctx.Locale.Tr "graphs.component_loading_failed" (ctx.Locale.Tr "graphs.contributors.what")}}"
 		data-locale-loading-info="{{ctx.Locale.Tr "graphs.component_loading_info"}}"
 		data-locale-component-failed-to-load="{{ctx.Locale.Tr "graphs.component_failed_to_load"}}"
+		data-locale-chart-zoom-hint="{{ctx.Locale.Tr "graphs.chart_zoom_hint"}}"
 	>
 	</div>
 {{end}}
diff --git a/templates/repo/diff/compare.tmpl b/templates/repo/diff/compare.tmpl
index 9ed4b73174d..9572715ac39 100644
--- a/templates/repo/diff/compare.tmpl
+++ b/templates/repo/diff/compare.tmpl
@@ -210,8 +210,8 @@
 					{{template "repo/issue/new_form" .}}
 				</div>
 			{{end}}
-		{{else}}{{/* not singed-in or not for pull-request */}}
-			{{if not .CommitCount}}
+		{{else}}{{/* not signed-in or not for pull-request */}}
+			{{if and (not .CommitCount) $.CompareInfo.CompareBase}}
 				<div class="ui segment">{{ctx.Locale.Tr "repo.commits.nothing_to_compare"}}</div>
 			{{end}}
 		{{end}}
diff --git a/templates/repo/editor/commit_form.tmpl b/templates/repo/editor/commit_form.tmpl
index 7fdd36b3bdf..d0c47e9bdd9 100644
--- a/templates/repo/editor/commit_form.tmpl
+++ b/templates/repo/editor/commit_form.tmpl
@@ -22,7 +22,7 @@
 				<label>{{ctx.Locale.Tr "repo.editor.signoff_desc"}}</label>
 			</div>
 		</div>
-		<div class="quick-pull-choice js-quick-pull-choice">
+		<div class="field quick-pull-choice js-quick-pull-choice">
 			<div class="field">
 				<div class="ui radio checkbox {{if not .CommitFormOptions.CanCommitToBranch}}disabled{{end}}">
 					<input type="radio" class="js-quick-pull-choice-option" name="commit_choice" value="direct" data-button-text="{{ctx.Locale.Tr "repo.editor.commit_changes"}}" {{if eq .commit_choice "direct"}}checked{{end}}>
@@ -30,9 +30,9 @@
 						{{svg "octicon-git-commit"}}
 						{{ctx.Locale.Tr "repo.editor.commit_directly_to_this_branch" .BranchName}}
 						{{if not .CommitFormOptions.CanCommitToBranch}}
-						<div class="ui visible small warning message">
+						<div class="tw-mt-2">
 							{{ctx.Locale.Tr "repo.editor.no_commit_to_branch"}}
-							<ul>
+							<ul class="tw-mb-0">
 								{{if not .CommitFormOptions.UserCanPush}}<li>{{ctx.Locale.Tr "repo.editor.user_no_push_to_branch"}}</li>{{end}}
 								{{if and .CommitFormOptions.RequireSigned (not .CommitFormOptions.WillSign)}}<li>{{ctx.Locale.Tr "repo.editor.require_signed_commit"}}</li>{{end}}
 							</ul>
diff --git a/templates/repo/icons/action_status.tmpl b/templates/repo/icons/action_status.tmpl
new file mode 100644
index 00000000000..1711c61b2bf
--- /dev/null
+++ b/templates/repo/icons/action_status.tmpl
@@ -0,0 +1,30 @@
+{{/* Status icons used for runs, jobs and steps.
+
+Template Attributes:
+* Status: one of success, skipped, waiting, blocked, running, failure, cancelled, cancelling, unknown
+* Size: icon size in pixels (default 16)
+* ClassName: additional CSS classes
+* IconVariant: "circle-fill" → octicon-check-circle-fill / octicon-x-circle-fill
+
+Keep this template in sync with web_src/js/components/ActionStatusIcon.vue.
+*/}}
+{{- $size := or .Size 16 -}}
+{{- $className := or .ClassName "" -}}
+{{- $circleFill := eq .IconVariant "circle-fill" -}}
+{{if eq .Status "success"}}
+	{{svg (Iif $circleFill "octicon-check-circle-fill" "octicon-check") $size (printf "tw-text-green %s" $className)}}
+{{else if eq .Status "skipped"}}
+	{{svg "octicon-skip" $size (printf "tw-text-text-light %s" $className)}}
+{{else if eq .Status "cancelled"}}
+	{{svg "octicon-stop" $size (printf "tw-text-text-light %s" $className)}}
+{{else if eq .Status "waiting"}}
+	{{svg "octicon-circle" $size (printf "tw-text-text-light %s" $className)}}
+{{else if eq .Status "blocked"}}
+	{{svg "octicon-blocked" $size (printf "tw-text-yellow %s" $className)}}
+{{else if eq .Status "running"}}
+	{{svg "gitea-running" $size (printf "tw-text-yellow rotate-clockwise %s" $className)}}
+{{else if eq .Status "cancelling"}}
+	{{svg "octicon-stop" $size (printf "tw-text-yellow %s" $className)}}
+{{else}}{{/*failure, unknown*/}}
+	{{svg (Iif $circleFill "octicon-x-circle-fill" "octicon-x") $size (printf "tw-text-red %s" $className)}}
+{{end}}
diff --git a/templates/repo/commit_status.tmpl b/templates/repo/icons/commit_status.tmpl
similarity index 100%
rename from templates/repo/commit_status.tmpl
rename to templates/repo/icons/commit_status.tmpl
diff --git a/templates/repo/issue/card.tmpl b/templates/repo/issue/card.tmpl
index 9600752036a..3c3a1dc0478 100644
--- a/templates/repo/issue/card.tmpl
+++ b/templates/repo/issue/card.tmpl
@@ -68,7 +68,7 @@
 			{{range $label := .Labels}}
 				{{$link := print $.Issue.Repo.Link "/issues"}}
 				{{$link = QueryBuild $link "labels" $label.ID}}
-				{{ctx.RenderUtils.RenderLabelWithLink $label $link}}
+				<a class="item" href="{{$link}}">{{ctx.RenderUtils.RenderLabel $label}}</a>
 			{{end}}
 		</div>
 		{{if .Assignees}}
diff --git a/templates/repo/issue/view_content.tmpl b/templates/repo/issue/view_content.tmpl
index 275dd47a76b..eaee1d87731 100644
--- a/templates/repo/issue/view_content.tmpl
+++ b/templates/repo/issue/view_content.tmpl
@@ -1,8 +1,8 @@
 <div class="issue-content">
 	{{$createdStr:= DateUtils.TimeSince .Issue.CreatedUnix}}
-	<div class="issue-content-left comment-list prevent-before-timeline">
-		<div class="ui timeline">
-			<div id="{{.Issue.HashTag}}" class="timeline-item comment first">
+	<div class="issue-content-left">
+		<div class="comment-list">
+			<div id="{{.Issue.HashTag}}" class="timeline-item comment issue-content-comment">
 				{{if .Issue.OriginalAuthor}}
 				<span class="timeline-avatar">
 					{{ctx.AvatarUtils.Avatar nil 40}}
@@ -171,14 +171,3 @@
 
 {{template "repo/issue/view_content/reference_issue_dialog" .}}
 {{template "shared/user/block_user_dialog" .}}
-
-<div class="ui g-modal-confirm delete modal">
-	<div class="header">
-		{{svg "octicon-trash"}}
-		{{ctx.Locale.Tr "repo.branch.delete" .HeadTarget}}
-	</div>
-	<div class="content">
-		<p>{{ctx.Locale.Tr "repo.branch.delete_desc"}}</p>
-	</div>
-	{{template "base/modal_actions_confirm" .}}
-</div>
diff --git a/templates/repo/issue/view_content/comments.tmpl b/templates/repo/issue/view_content/comments.tmpl
index 6a67ef754d7..2171b3616ff 100644
--- a/templates/repo/issue/view_content/comments.tmpl
+++ b/templates/repo/issue/view_content/comments.tmpl
@@ -86,7 +86,7 @@
 					{{template "shared/user/avatarlink" dict "user" .Poster}}
 				{{end}}
 				<span class="comment-text-line">
-					{{template "repo/issue/view_content/comments_authorlink" dict "ctxData" $ "comment" .}}
+					{{template "repo/issue/view_content/comments_authorlink" dict "comment" .}}
 					{{if .Issue.IsPull}}
 						{{ctx.Locale.Tr "repo.pulls.reopened_at" .EventTag $createdStr}}
 					{{else}}
@@ -101,7 +101,7 @@
 					{{template "shared/user/avatarlink" dict "user" .Poster}}
 				{{end}}
 				<span class="comment-text-line">
-					{{template "repo/issue/view_content/comments_authorlink" dict "ctxData" $ "comment" .}}
+					{{template "repo/issue/view_content/comments_authorlink" dict "comment" .}}
 					{{if .Issue.IsPull}}
 						{{ctx.Locale.Tr "repo.pulls.closed_at" .EventTag $createdStr}}
 					{{else}}
@@ -116,7 +116,7 @@
 					{{template "shared/user/avatarlink" dict "user" .Poster}}
 				{{end}}
 				<span class="comment-text-line">
-					{{template "repo/issue/view_content/comments_authorlink" dict "ctxData" $ "comment" .}}
+					{{template "repo/issue/view_content/comments_authorlink" dict "comment" .}}
 					{{$link := printf "%s/commit/%s" $.Repository.Link ($.Issue.PullRequest.MergedCommitID|PathEscape)}}
 					{{if eq $.Issue.PullRequest.Status 3}}
 						{{ctx.Locale.Tr "repo.issues.comment_manually_pull_merged_at" (HTMLFormat `<a class="ui sha" href="%[1]s"><b>%[2]s</b></a>` $link (ShortSha $.Issue.PullRequest.MergedCommitID)) (HTMLFormat "<b>%[1]s</b>" $.BaseTarget) $createdStr}}
@@ -169,7 +169,7 @@
 			</div>
 		{{else if eq .Type 7}}
 			{{if or .AddedLabels .RemovedLabels}}
-				<div class="timeline-item event with-labels-list-inline" id="{{.HashTag}}">
+				<div class="timeline-item event" id="{{.HashTag}}">
 					<span class="badge">{{svg "octicon-tag"}}</span>
 					{{template "shared/user/avatarlink" dict "user" .Poster}}
 					<span class="comment-text-line">
@@ -256,7 +256,7 @@
 					{{if not $timeStr}}{{$timeStr = .Content|Sec2Hour}}{{end}}
 					{{ctx.Locale.Tr "repo.issues.stop_tracking_history" $timeStr $createdStr}}
 				</span>
-				{{template "repo/issue/view_content/comments_delete_time" dict "ctxData" $ "comment" .}}
+				{{template "repo/issue/view_content/comments_delete_time" dict "comment" .}}
 			</div>
 		{{else if eq .Type 14}}
 			<div class="timeline-item event" id="{{.HashTag}}">
@@ -268,7 +268,7 @@
 					{{if not $timeStr}}{{$timeStr = .Content|Sec2Hour}}{{end}}
 					{{ctx.Locale.Tr "repo.issues.add_time_history" $timeStr $createdStr}}
 				</span>
-				{{template "repo/issue/view_content/comments_delete_time" dict "ctxData" $ "comment" .}}
+				{{template "repo/issue/view_content/comments_delete_time" dict "comment" .}}
 			</div>
 		{{else if eq .Type 15}}
 			<div class="timeline-item event" id="{{.HashTag}}">
@@ -362,7 +362,7 @@
 		{{else if eq .Type 22}}
 			<div class="timeline-item-group" id="{{.HashTag}}">
 				<div class="timeline-item event">
-					{{$reviewType := -1}}
+					{{$reviewType := 2}}{{/* default to "comment" type if the review record is missing */}}
 					{{if .Review}}{{$reviewType = .Review.Type}}{{end}}
 					{{if not .OriginalAuthor}}
 					{{/* Some timeline avatars need a offset to correctly align with their speech bubble.
@@ -372,15 +372,17 @@
 						{{ctx.AvatarUtils.Avatar .Poster 40}}
 					</a>
 					{{end}}
-					<span class="badge tw-text-white{{if eq $reviewType 1}}{{if .Review.Official}} tw-bg-green {{else}} tw-bg-grey{{end}}{{else if eq $reviewType 3}} tw-bg-red{{end}}">
-						{{if .Review}}{{svg (printf "octicon-%s" .Review.Type.Icon)}}{{end}}
+					<span class="badge tw-text-white {{if eq $reviewType 1}}{{Iif .Review.Official "tw-bg-green" "tw-bg-grey"}}{{else if eq $reviewType 3}}tw-bg-red{{end}}">
+						{{- if .Review -}}
+							{{- svg (printf "octicon-%s" .Review.Type.Icon) -}}
+						{{- else -}}
+							{{- svg "octicon-comment" -}}
+						{{- end -}}
 					</span>
 					<span class="comment-text-line">
-						{{template "repo/issue/view_content/comments_authorlink" dict "ctxData" $ "comment" .}}
+						{{template "repo/issue/view_content/comments_authorlink" dict "comment" .}}
 						{{if eq $reviewType 1}}
 							{{ctx.Locale.Tr "repo.issues.review.approve" $createdStr}}
-						{{else if eq $reviewType 2}}
-							{{ctx.Locale.Tr "repo.issues.review.comment" $createdStr}}
 						{{else if eq $reviewType 3}}
 							{{ctx.Locale.Tr "repo.issues.review.reject" $createdStr}}
 						{{else}}
@@ -488,7 +490,7 @@
 					{{template "shared/user/avatarlink" dict "user" .Poster}}
 				{{end}}
 				<span class="comment-text-line">
-					{{template "repo/issue/view_content/comments_authorlink" dict "ctxData" $ "comment" .}}
+					{{template "repo/issue/view_content/comments_authorlink" dict "comment" .}}
 					{{ctx.Locale.Tr "repo.pulls.change_target_branch_at" .OldRef .NewRef $createdStr}}
 				</span>
 			</div>
@@ -663,7 +665,7 @@
 			<div class="timeline-item event" id="{{.HashTag}}">
 				<span class="badge">{{svg "octicon-git-merge" 16}}</span>
 				<span class="comment-text-line">
-					{{template "repo/issue/view_content/comments_authorlink" dict "ctxData" $ "comment" .}}
+					{{template "repo/issue/view_content/comments_authorlink" dict "comment" .}}
 					{{if eq .Type 34}}{{ctx.Locale.Tr "repo.pulls.auto_merge_newly_scheduled_comment" $createdStr}}
 					{{else}}{{ctx.Locale.Tr "repo.pulls.auto_merge_canceled_schedule_comment" $createdStr}}{{end}}
 				</span>
diff --git a/templates/repo/issue/view_content/comments_authorlink.tmpl b/templates/repo/issue/view_content/comments_authorlink.tmpl
index fd07bd2b1cc..8e0645c983e 100644
--- a/templates/repo/issue/view_content/comments_authorlink.tmpl
+++ b/templates/repo/issue/view_content/comments_authorlink.tmpl
@@ -1,10 +1,10 @@
 {{if .comment.OriginalAuthor}}
 	<span class="tw-text-text">
-		{{svg (MigrationIcon .ctxData.Repository.GetOriginalURLHostname)}}
+		{{svg (MigrationIcon ctx.RootData.Repository.GetOriginalURLHostname)}}
 		{{.comment.OriginalAuthor}}
 	</span>
-	{{if .ctxData.Repository.OriginalURL}}
-		<span class="migrate">({{ctx.Locale.Tr "repo.migrated_from" .ctxData.Repository.OriginalURL .ctxData.Repository.GetOriginalURLHostname}})</span>
+	{{if ctx.RootData.Repository.OriginalURL}}
+		<span class="migrate">({{ctx.Locale.Tr "repo.migrated_from" ctx.RootData.Repository.OriginalURL ctx.RootData.Repository.GetOriginalURLHostname}})</span>
 	{{end}}
 {{else}}
 	{{template "shared/user/authorlink" .comment.Poster}}
diff --git a/templates/repo/issue/view_content/comments_delete_time.tmpl b/templates/repo/issue/view_content/comments_delete_time.tmpl
index 219d5fc2034..dfbbd5fd7a1 100644
--- a/templates/repo/issue/view_content/comments_delete_time.tmpl
+++ b/templates/repo/issue/view_content/comments_delete_time.tmpl
@@ -1,9 +1,9 @@
-{{if and .comment.Time (.ctxData.Repository.IsTimetrackerEnabled ctx)}} {{/* compatibility with time comments made before v1.14 */}}
+{{if and .comment.Time (ctx.RootData.Repository.IsTimetrackerEnabled ctx)}} {{/* compatibility with time comments made before v1.14 */}}
 	{{if (not .comment.Time.Deleted)}}
-		{{if (or .ctxData.IsAdmin (and .ctxData.IsSigned (eq .ctxData.SignedUserID .comment.PosterID)))}}
+		{{if (or ctx.RootData.IsAdmin (and ctx.RootData.IsSigned (eq ctx.RootData.SignedUserID .comment.PosterID)))}}
 			<span class="tw-ml-auto">
 				<button class="ui icon button compact mini link-action" data-tooltip-content="{{ctx.Locale.Tr "repo.issues.del_time"}}"
-								data-url="{{.ctxData.RepoLink}}/issues/{{.ctxData.Issue.Index}}/times/{{.comment.TimeID}}/delete?id={{.comment.Time.ID}}"
+								data-url="{{ctx.RootData.RepoLink}}/issues/{{ctx.RootData.Issue.Index}}/times/{{.comment.TimeID}}/delete?id={{.comment.Time.ID}}"
 								data-modal-confirm="{{ctx.Locale.Tr "repo.issues.del_time"}}"
 				>
 					{{svg "octicon-trash"}}
diff --git a/templates/repo/issue/view_content/context_menu.tmpl b/templates/repo/issue/view_content/context_menu.tmpl
index e28d20a2716..d3c2f8932e4 100644
--- a/templates/repo/issue/view_content/context_menu.tmpl
+++ b/templates/repo/issue/view_content/context_menu.tmpl
@@ -3,13 +3,13 @@
 		{{svg "octicon-kebab-horizontal"}}
 	</a>
 	<div class="menu">
-		{{$referenceUrl := ""}}
+		{{$referenceLink := ""}}
 		{{if .issue}}
-			{{$referenceUrl = printf "%s#%s" ctx.RootData.Issue.Link .item.HashTag}}
+			{{$referenceLink = printf "%s#%s" ctx.RootData.Issue.Link .item.HashTag}}
 		{{else}}
-			{{$referenceUrl = printf "%s/files#%s" ctx.RootData.Issue.Link .item.HashTag}}
+			{{$referenceLink = printf "%s/files#%s" ctx.RootData.Issue.Link .item.HashTag}}
 		{{end}}
-		<div class="item context js-aria-clickable" data-clipboard-text-type="url" data-clipboard-text="{{$referenceUrl}}">{{ctx.Locale.Tr "repo.issues.context.copy_link"}}</div>
+		<div class="item context js-aria-clickable" data-clipboard-text="{{ctx.AppFullLink}}{{$referenceLink}}">{{ctx.Locale.Tr "repo.issues.context.copy_link"}}</div>
 		<div class="item context js-aria-clickable" data-clipboard-target="#{{.item.HashTag}}-raw">{{ctx.Locale.Tr "repo.issues.context.copy_source"}}</div>
 		{{if ctx.RootData.IsSigned}}
 			{{$needDivider := false}}
@@ -17,7 +17,7 @@
 				{{$needDivider = true}}
 				<div class="item context js-aria-clickable quote-reply {{if .diff}}quote-reply-diff{{end}}" data-target="{{.item.HashTag}}-raw">{{ctx.Locale.Tr "repo.issues.context.quote_reply"}}</div>
 				{{if not ctx.Consts.RepoUnitTypeIssues.UnitGlobalDisabled}}
-					<div class="item context js-aria-clickable reference-issue" data-target="{{.item.HashTag}}-raw" data-modal="#reference-issue-modal" data-poster="{{.item.Poster.GetDisplayName}}" data-poster-username="{{.item.Poster.Name}}" data-reference="{{$referenceUrl}}">{{ctx.Locale.Tr "repo.issues.context.reference_issue"}}</div>
+					<div class="item context js-aria-clickable reference-issue" data-target="{{.item.HashTag}}-raw" data-modal="#reference-issue-modal" data-poster="{{.item.Poster.GetDisplayName}}" data-poster-username="{{.item.Poster.Name}}" data-reference="{{$referenceLink}}">{{ctx.Locale.Tr "repo.issues.context.reference_issue"}}</div>
 				{{end}}
 				{{if or ctx.RootData.Permission.IsAdmin .IsCommentPoster ctx.RootData.HasIssuesOrPullsWritePermission}}
 					<div class="divider"></div>
diff --git a/templates/repo/issue/view_content/pull_merge_box.tmpl b/templates/repo/issue/view_content/pull_merge_box.tmpl
index 768d3b31194..d1594a52dda 100644
--- a/templates/repo/issue/view_content/pull_merge_box.tmpl
+++ b/templates/repo/issue/view_content/pull_merge_box.tmpl
@@ -7,309 +7,75 @@
 		data-pull-link="{{$.Issue.Link}}"
 	{{end}}
 >
-	{{$statusCheckData := .StatusCheckData}}
-	{{$requiredStatusCheckState := $statusCheckData.RequiredChecksState}}
-	<div class="timeline-avatar {{if .Issue.PullRequest.HasMerged}}tw-text-purple
-	{{- else if .Issue.IsClosed}}tw-text-text-light
-	{{- else if .IsPullWorkInProgress}}tw-text-text-light
-	{{- else if .IsFilesConflicted}}tw-text-text-light
-	{{- else if .IsPullRequestBroken}}tw-text-red
-	{{- else if .IsBlockedByApprovals}}tw-text-red
-	{{- else if .IsBlockedByRejection}}tw-text-red
-	{{- else if .IsBlockedByOfficialReviewRequests}}tw-text-red
-	{{- else if .IsBlockedByOutdatedBranch}}tw-text-red
-	{{- else if .IsBlockedByChangedProtectedFiles}}tw-text-red
-	{{- else if and .EnableStatusCheck (or $requiredStatusCheckState.IsFailure $requiredStatusCheckState.IsError)}}tw-text-red
-	{{- else if and .EnableStatusCheck (or (not $.LatestCommitStatus) $requiredStatusCheckState.IsPending $requiredStatusCheckState.IsWarning)}}tw-text-yellow
-	{{- else if and .AllowMerge .RequireSigned (not .WillSign)}}tw-text-red
-	{{- else if .Issue.PullRequest.IsChecking}}tw-text-yellow
-	{{- else if .Issue.PullRequest.IsEmpty}}tw-text-text-light
-	{{- else if .Issue.PullRequest.IsStatusMergeable}}tw-text-green
-	{{- else}}tw-text-red{{end}}">{{svg "octicon-git-merge" 40}}</div>
+	<div class="timeline-avatar {{$data.TimelineIconClass}}">{{svg "octicon-git-merge" 40}}</div>
 	<div class="content">
-		{{if .LatestCommitStatus}}
-		<div class="ui attached segment fitted">
-		{{template "repo/pulls/status" (dict
-			"CommitStatus" .LatestCommitStatus
-			"CommitStatuses" .LatestCommitStatuses
-			"ShowHideChecks" true
-			"StatusCheckData" $statusCheckData
-		)}}
-		</div>
-		{{end}}
-		{{$showGeneralMergeForm := false}}
-		<div class="ui attached segment merge-section {{if not $.LatestCommitStatus}}avatar-content-left-arrow{{end}} flex-items-block">
-			{{if .Issue.PullRequest.HasMerged}}
-				{{if .IsPullBranchDeletable}}
-					<div class="item item-section text tw-flex-1">
-						<div class="item-section-left">
-							<h3 class="tw-mb-2">
-								{{ctx.Locale.Tr "repo.pulls.merged_success"}}
-							</h3>
-							<div class="merge-section-info">
-								{{ctx.Locale.Tr "repo.pulls.merged_info_text" (HTMLFormat "<code>%s</code>" .HeadTarget)}}
-							</div>
-						</div>
-						<div class="item-section-right">
+		<div class="ui segment fitted avatar-content-left-arrow">
+			<div class="merge-section flex-divided-list items-px-default">
+			{{if $data.ShowStatusCheck}}
+				{{template "repo/issue/view_content/pull_merge_status_checks" (dict "StatusCheckData" $data.StatusCheckData)}}
+			{{end}}
+
+			{{if $data.ClosedInfoTitle}}
+				<div class="item flex-left-right">
+					<div>
+						<h3 class="tw-mb-2">{{$data.ClosedInfoTitle}}</h3>
+						<div>{{$data.ClosedInfoBody}}</div>
+					</div>
+					{{if $data.IsPullBranchDeletable}}
+						<div>
 							<button class="ui button link-action delete-branch-after-merge" data-url="{{.DeleteBranchLink}}">{{ctx.Locale.Tr "repo.branch.delete_html"}}</button>
 						</div>
-					</div>
+					{{end}}
+				</div>
+			{{end}}
+			{{range $infoSection := $data.InfoSections}}
+				{{if $infoSection.InfoItems}}
+				<div class="item">
+					{{range $infoItem := $infoSection.InfoItems}}
+						<div class="flex-text-block {{$infoItem.ItemClass}}">{{$infoItem.SvgIconHTML}} {{$infoItem.InfoHTML}}</div>
+						{{if $infoItem.ListItems}}
+							<ul class="tw-pl-[36px]">{{/* align with the info icon and text */}}
+								{{range $listItem := $infoItem.ListItems}}
+									<li>{{$listItem}}</li>
+								{{end}}
+							</ul>
+						{{end}}
+					{{end}}
+				</div>
 				{{end}}
-			{{else if .Issue.IsClosed}}
-				<div class="item item-section text tw-flex-1">
-					<div class="item-section-left">
-						<h3 class="tw-mb-2">{{ctx.Locale.Tr "repo.pulls.closed"}}</h3>
-						<div class="merge-section-info">
-							{{if .IsPullRequestBroken}}
-								{{ctx.Locale.Tr "repo.pulls.cant_reopen_deleted_branch"}}
-							{{else}}
-								{{ctx.Locale.Tr "repo.pulls.reopen_to_merge"}}
-							{{end}}
-						</div>
-					</div>
-					{{if and .IsPullBranchDeletable (not .IsPullRequestBroken)}}
-						<div class="item-section-right">
-							<button class="ui button link-action delete-branch-after-merge" data-url="{{.DeleteBranchLink}}">{{ctx.Locale.Tr "repo.branch.delete_html"}}</button>
-						</div>
-					{{end}}
-				</div>
-			{{else if .IsPullFilesConflicted}}
+			{{end}}
+			{{if $data.ShowUpdatePullInfo}}
 				<div class="item">
-					{{svg "octicon-x"}}
-					{{ctx.Locale.Tr "repo.pulls.files_conflicted"}}
+					{{template "repo/issue/view_content/update_branch_by_merge" (dict "MergeBoxData" $data "IssueLink" $.Issue.Link)}}
 				</div>
-				<ul>
-					{{range .ConflictedFiles}}
-					<li>{{.}}</li>
-					{{else}}
-					<li>{{ctx.Locale.Tr "repo.pulls.files_conflicted_no_listed_files"}}</li>
-					{{end}}
-				</ul>
-			{{else if .IsPullRequestBroken}}
-				<div class="item">
-					{{svg "octicon-x"}}
-					{{ctx.Locale.Tr "repo.pulls.data_broken"}}
-				</div>
-			{{else if .IsPullWorkInProgress}}
-				<div class="item">
-					<div class="item-section-left flex-text-inline tw-flex-1">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.cannot_merge_work_in_progress"}}
+			{{end}}
+
+			{{if $.IsPullWorkInProgress}}
+				<div class="item flex-left-right">
+					<div class="flex-text-block">
+						{{svg "octicon-x"}} {{ctx.Locale.Tr "repo.pulls.cannot_merge_work_in_progress"}}
 					</div>
 					{{if or .HasIssuesOrPullsWritePermission .IsIssuePoster}}
-						<button class="ui compact button" data-global-init="initPullRequestWipToggle" data-title="{{.Issue.Title}}" data-wip-prefix="{{.WorkInProgressPrefix}}" data-update-url="{{.Issue.Link}}/title">
-							{{ctx.Locale.Tr "repo.pulls.remove_prefix" .WorkInProgressPrefix}}
-						</button>
-					{{end}}
-				</div>
-				{{template "repo/issue/view_content/update_branch_by_merge" $}}
-			{{else if .Issue.PullRequest.IsChecking}}
-				<div class="item">
-					{{svg "gitea-running" 16 "rotate-clockwise"}}
-					{{ctx.Locale.Tr "repo.pulls.is_checking"}}
-				</div>
-			{{else if .Issue.PullRequest.IsAncestor}}
-				<div class="item">
-					{{svg "octicon-alert"}}
-					{{ctx.Locale.Tr "repo.pulls.is_ancestor"}}
-				</div>
-			{{else if or .Issue.PullRequest.IsStatusMergeable .Issue.PullRequest.IsEmpty}}
-				{{if .IsBlockedByApprovals}}
-					<div class="item">
-						{{svg "octicon-x"}}
-						{{if .RequireApprovalsWhitelist}}
-							{{ctx.Locale.Tr "repo.pulls.blocked_by_approvals_whitelisted" .GrantedApprovals .ProtectedBranch.RequiredApprovals}}
-						{{else}}
-							{{ctx.Locale.Tr "repo.pulls.blocked_by_approvals" .GrantedApprovals .ProtectedBranch.RequiredApprovals}}
-						{{end}}
-					</div>
-				{{else if .IsBlockedByRejection}}
-					<div class="item">
-						{{svg "octicon-x"}}
-					{{ctx.Locale.Tr "repo.pulls.blocked_by_rejection"}}
-					</div>
-				{{else if .IsBlockedByOfficialReviewRequests}}
-					<div class="item">
-						{{svg "octicon-x"}}
-					{{ctx.Locale.Tr "repo.pulls.blocked_by_official_review_requests"}}
-					</div>
-				{{else if .IsBlockedByOutdatedBranch}}
-					<div class="item">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.blocked_by_outdated_branch"}}
-					</div>
-				{{else if .IsBlockedByChangedProtectedFiles}}
-					<div class="item">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.TrN $.ChangedProtectedFilesNum "repo.pulls.blocked_by_changed_protected_files_1" "repo.pulls.blocked_by_changed_protected_files_n"}}
-					</div>
-					<ul>
-						{{range .ChangedProtectedFiles}}
-						<li>{{.}}</li>
-						{{end}}
-					</ul>
-				{{else if and .EnableStatusCheck (or $requiredStatusCheckState.IsError $requiredStatusCheckState.IsFailure)}}
-					<div class="item">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.required_status_check_failed"}}
-					</div>
-				{{else if and .EnableStatusCheck (not $requiredStatusCheckState.IsSuccess)}}
-					<div class="item">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.required_status_check_missing"}}
-					</div>
-				{{else if and .AllowMerge .RequireSigned (not .WillSign)}}
-					<div class="item">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.require_signed_wont_sign"}}
-					</div>
-					<div class="item">
-						{{svg "octicon-unlock"}}
-						{{ctx.Locale.Tr (printf "repo.signing.wont_sign.%s" .WontSignReason)}}
-					</div>
-				{{end}}
-
-				{{$notAllOverridableChecksOk := $data.HasOverridableBlockers}}
-				{{$canMergeNow := $data.CanMergeNow}}
-
-				{{if $canMergeNow}}
-					{{if $notAllOverridableChecksOk}}
-						<div class="item">
-							{{svg "octicon-dot-fill"}}
-							{{ctx.Locale.Tr "repo.pulls.required_status_check_administrator"}}
-						</div>
-					{{else}}
-						<div class="item">
-							{{svg "octicon-check"}}
-							{{ctx.Locale.Tr "repo.pulls.can_auto_merge_desc"}}
-						</div>
-					{{end}}
-					{{if .WillSign}}
-						<div class="item">
-							{{svg "octicon-lock" 16 "tw-text-green"}}
-							{{ctx.Locale.Tr "repo.signing.will_sign" .SigningKeyMergeDisplay}}
-						</div>
-					{{else if .IsSigned}}
-						<div class="item">
-							{{svg "octicon-unlock"}}
-							{{ctx.Locale.Tr (printf "repo.signing.wont_sign.%s" .WontSignReason)}}
-						</div>
-					{{end}}
-				{{end}}
-
-				{{template "repo/issue/view_content/update_branch_by_merge" $}}
-
-				{{if .Issue.PullRequest.IsEmpty}}
-					<div class="divider"></div>
-					<div class="item">
-						{{svg "octicon-alert"}}
-						{{ctx.Locale.Tr "repo.pulls.is_empty"}}
-					</div>
-				{{end}}
-
-				{{if .AllowMerge}} {{/* user is allowed to merge */}}
-					{{if $data.MergeFormProps}}
-						<div class="divider"></div>
-						{{$showGeneralMergeForm = true}}
-						{{/* The merge form is a Vue component. After mounted, it has a button for choosing merge style, so make it have min-height to avoid layout shifting */}}
-						<div id="pull-request-merge-form" class="tw-min-h-[40px]" data-merge-form-props="{{JsonUtils.EncodeToString $data.MergeFormProps}}"></div>
-					{{else}}
-						{{/* no merge style was set in repo setting: not or ($prUnit.PullRequestsConfig.AllowMerge ...) */}}
-						<div class="divider"></div>
-						<div class="item tw-text-red">
-							{{svg "octicon-x"}}
-							{{ctx.Locale.Tr "repo.pulls.no_merge_desc"}}
-						</div>
-						<div class="item">
-							{{svg "octicon-info"}}
-							{{ctx.Locale.Tr "repo.pulls.no_merge_helper"}}
-						</div>
-					{{end}} {{/* end if the repo was set to use any merge style */}}
-				{{else}}
-					{{/* user is not allowed to merge */}}
-					<div class="divider"></div>
-					<div class="item">
-						{{svg "octicon-info"}}
-						{{ctx.Locale.Tr "repo.pulls.no_merge_access"}}
-					</div>
-				{{end}} {{/* end if user is allowed to merge or not */}}
-			{{else}}
-				{{/* Merge conflict without specific file. Suggest manual merge, only if all reviews and status checks OK. */}}
-				{{if .IsBlockedByApprovals}}
-					<div class="item tw-text-red">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.blocked_by_approvals" .GrantedApprovals .ProtectedBranch.RequiredApprovals}}
-					</div>
-				{{else if .IsBlockedByRejection}}
-					<div class="item tw-text-red">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.blocked_by_rejection"}}
-					</div>
-				{{else if .IsBlockedByOfficialReviewRequests}}
-					<div class="item tw-text-red">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.blocked_by_official_review_requests"}}
-					</div>
-				{{else if .IsBlockedByOutdatedBranch}}
-					<div class="item tw-text-red">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.blocked_by_outdated_branch"}}
-					</div>
-				{{else if .IsBlockedByChangedProtectedFiles}}
-					<div class="item tw-text-red">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.TrN $.ChangedProtectedFilesNum "repo.pulls.blocked_by_changed_protected_files_1" "repo.pulls.blocked_by_changed_protected_files_n"}}
-					</div>
-					<ul>
-						{{range .ChangedProtectedFiles}}
-						<li>{{.}}</li>
-						{{end}}
-					</ul>
-				{{else if and .EnableStatusCheck (not $requiredStatusCheckState.IsSuccess)}}
-					<div class="item tw-text-red">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.required_status_check_failed"}}
-					</div>
-				{{else if and .RequireSigned (not .WillSign)}}
-					<div class="item tw-text-red">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.require_signed_wont_sign"}}
-					</div>
-				{{else}}
-					<div class="item tw-text-red">
-						{{svg "octicon-x"}}
-						{{ctx.Locale.Tr "repo.pulls.cannot_auto_merge_desc"}}
-					</div>
-					<div class="item">
-						{{svg "octicon-info"}}
-						{{ctx.Locale.Tr "repo.pulls.cannot_auto_merge_helper"}}
-					</div>
-				{{end}}
-			{{end}}{{/* end if: pull request status */}}
-
-			{{/* Manually Merged is not a well-known feature, it is used to mark a non-mergeable PR (already merged, conflicted) as merged
-			To test it:
-			* Enable "Manually Merged" feature in the Repository Settings
-			* Create a pull request, either:
-			* - Merge the pull request branch locally and push the merged commit to Gitea
-			* - Make some conflicts between the base branch and the pull request branch
-			* Then the Manually Merged form will be shown in the merge form
-			*/}}
-			{{if and $.StillCanManualMerge (not $showGeneralMergeForm)}}
-				<div class="divider"></div>
-				<form class="ui form form-fetch-action" action="{{.Issue.Link}}/merge" method="post">{{/* another similar form is in PullRequestMergeForm.vue*/}}
-					<div class="field">
-						<input type="text" name="merge_commit_id" placeholder="{{ctx.Locale.Tr "repo.pulls.merge_commit_id"}}">
-					</div>
-					<button class="ui red button" type="submit" name="do" value="manually-merged">
-						{{ctx.Locale.Tr "repo.pulls.merge_manually"}}
+					<button class="ui compact button" data-global-init="initPullRequestWipToggle" data-title="{{.Issue.Title}}" data-wip-prefix="{{.WorkInProgressPrefix}}" data-update-url="{{.Issue.Link}}/title">
+						{{ctx.Locale.Tr "repo.pulls.remove_prefix" .WorkInProgressPrefix}}
 					</button>
-				</form>
+					{{end}}
+				</div>
+			{{end}}
+
+			{{if $data.MergeFormProps}}
+				{{/* The merge form is a Vue component. After mounted, it has a button for choosing merge style, so make it have min-height to avoid layout shifting */}}
+				<div class="item">
+					<div id="pull-request-merge-form" class="tw-min-h-[40px] tw-w-full" data-merge-form-props="{{JsonUtils.EncodeToString $data.MergeFormProps}}"></div>
+				</div>
 			{{end}}
 
 			{{if $data.ShowPullCommands}}
-				{{template "repo/issue/view_content/pull_merge_instruction" dict "PullRequest" .Issue.PullRequest "MergeBoxData" $data}}
+				<div class="item">
+					{{template "repo/issue/view_content/pull_merge_instruction" dict "PullRequest" .Issue.PullRequest "MergeBoxData" $data}}
+				</div>
 			{{end}}
+			</div>
 		</div>
 	</div>
 </div>
diff --git a/templates/repo/issue/view_content/pull_merge_instruction.tmpl b/templates/repo/issue/view_content/pull_merge_instruction.tmpl
index ad85c004505..b3a36f01d67 100644
--- a/templates/repo/issue/view_content/pull_merge_instruction.tmpl
+++ b/templates/repo/issue/view_content/pull_merge_instruction.tmpl
@@ -1,10 +1,14 @@
 {{$data := $.MergeBoxData}}
 {{$pull := $.PullRequest}}
-<div class="divider"></div>
 <details>
-	<summary>{{ctx.Locale.Tr "repo.pulls.cmd_instruction_hint"}}</summary>
-	<div class="tw-mt-2">
-		<div><h3>{{ctx.Locale.Tr "repo.pulls.cmd_instruction_checkout_title"}}</h3>{{ctx.Locale.Tr "repo.pulls.cmd_instruction_checkout_desc"}}</div>
+	<summary class="tw-pl-1">{{/* align with other item icon & text */}}
+		<span class="tw-pl-2">{{ctx.Locale.Tr "repo.pulls.cmd_instruction_hint"}}</span>
+	</summary>
+	<div class="tw-my-[5px]">
+		<div>
+			<h3 class="tw-m-0">{{ctx.Locale.Tr "repo.pulls.cmd_instruction_checkout_title"}}</h3>
+			{{ctx.Locale.Tr "repo.pulls.cmd_instruction_checkout_desc"}}
+		</div>
 		{{$localBranch := $pull.HeadBranch}}
 		{{if ne $pull.HeadRepo.ID $pull.BaseRepo.ID}}
 			{{$localBranch = print $pull.HeadRepo.OwnerName "-" $pull.HeadBranch}}
@@ -20,7 +24,7 @@
 		</div>
 		{{if $data.ShowMergeInstructions}}
 		<div>
-			<h3>{{ctx.Locale.Tr "repo.pulls.cmd_instruction_merge_title"}}</h3>
+			<h3 class="tw-m-0">{{ctx.Locale.Tr "repo.pulls.cmd_instruction_merge_title"}}</h3>
 			{{ctx.Locale.Tr "repo.pulls.cmd_instruction_merge_desc"}}
 			{{if not $data.AutodetectManualMerge}}
 				<div>{{ctx.Locale.Tr "repo.pulls.cmd_instruction_merge_warning"}}</div>
diff --git a/templates/repo/issue/view_content/pull_merge_status_checks.tmpl b/templates/repo/issue/view_content/pull_merge_status_checks.tmpl
new file mode 100644
index 00000000000..5bb48f20097
--- /dev/null
+++ b/templates/repo/issue/view_content/pull_merge_status_checks.tmpl
@@ -0,0 +1,34 @@
+{{/* Template Attributes:
+* StatusCheckData: see backend pullCommitStatusCheckData struct
+*/}}
+{{$statusCheckData := $.StatusCheckData}}
+{{if $statusCheckData}}
+	{{$commitStatuses := $statusCheckData.PullCommitStatuses}}
+	<div class="item flex-left-right commit-status-toggle">
+		<div>{{$statusCheckData.CommitStatusCheckPrompt ctx.Locale}}</div>
+		<button data-global-click="onCommitStatusChecksToggle" class="btn interact-fg"
+						data-show-all="{{ctx.Locale.Tr "repo.pulls.status_checks_show_all"}}"
+						data-hide-all="{{ctx.Locale.Tr "repo.pulls.status_checks_hide_all"}}"
+		>{{ctx.Locale.Tr "repo.pulls.status_checks_hide_all"}}</button>
+	</div>
+
+	{{if $statusCheckData.RequireApprovalRunCount}}
+	<div class="item flex-left-right" id="approve-status-checks">
+		<div>
+			<strong>{{ctx.Locale.Tr "repo.pulls.status_checks_need_approvals" $statusCheckData.RequireApprovalRunCount}}</strong>
+			<p>{{ctx.Locale.Tr "repo.pulls.status_checks_need_approvals_helper"}}</p>
+		</div>
+		{{if $statusCheckData.CanApprove}}
+		<button class="ui basic button link-action" data-url="{{$statusCheckData.ApproveLink}}">
+			{{ctx.Locale.Tr "repo.pulls.status_checks_approve_all"}}
+		</button>
+		{{end}}
+	</div>
+	{{end}}
+
+	<div class="item tw-p-0">
+		<div class="commit-status-list flex-divided-list items-px-default">
+			{{template "repo/pulls/status_items" (dict "CommitStatuses" $commitStatuses "StatusCheckData" $statusCheckData)}}
+		</div>
+	</div>
+{{end}}
diff --git a/templates/repo/issue/view_content/update_branch_by_merge.tmpl b/templates/repo/issue/view_content/update_branch_by_merge.tmpl
index f6fa66eba76..975133469ae 100644
--- a/templates/repo/issue/view_content/update_branch_by_merge.tmpl
+++ b/templates/repo/issue/view_content/update_branch_by_merge.tmpl
@@ -1,36 +1,24 @@
-{{if and (gt $.Issue.PullRequest.CommitsBehind 0) (not $.Issue.IsClosed) (not $.Issue.PullRequest.IsChecking) (not $.IsPullFilesConflicted) (not $.IsPullRequestBroken)}}
-	<div class="divider"></div>
-	<div class="item item-section">
-		<div class="item-section-left flex-text-inline">
-			{{svg "octicon-alert"}}
-			{{ctx.Locale.Tr "repo.pulls.outdated_with_base_branch"}}
-		</div>
-		<div class="item-section-right">
-			{{if and $.UpdateAllowed $.UpdateByRebaseAllowed}}
-				<div class="tw-inline-block">
-					<div id="update-pr-branch-with-base" class="ui buttons">
-						<button class="ui button" data-do="{{$.Issue.Link}}/update">
-							<span class="button-text">
-								{{ctx.Locale.Tr "repo.pulls.update_branch"}}
-							</span>
-						</button>
-						<div class="ui dropdown icon button">
-							{{svg "octicon-triangle-down"}}
-							<div class="menu">
-								<a class="item active selected" data-do="{{$.Issue.Link}}/update">{{ctx.Locale.Tr "repo.pulls.update_branch"}}</a>
-								<a class="item" data-do="{{$.Issue.Link}}/update?style=rebase">{{ctx.Locale.Tr "repo.pulls.update_branch_rebase"}}</a>
-							</div>
-						</div>
-					</div>
-				</div>
-			{{end}}
-			{{if and $.UpdateAllowed (not $.UpdateByRebaseAllowed)}}
-				<form action="{{$.Issue.Link}}/update" method="post" class="ui update-branch-form">
-					<button class="ui compact button">
-						<span class="ui text">{{ctx.Locale.Tr "repo.pulls.update_branch"}}</span>
-					</button>
-				</form>
-			{{end}}
-		</div>
+{{$data := $.MergeBoxData}}
+<div class="tw-w-full flex-left-right">
+	<div class="flex-text-block">
+		{{svg "octicon-alert"}}
+		{{ctx.Locale.Tr "repo.pulls.outdated_with_base_branch"}}
 	</div>
-{{end}}
+	{{if $data.UpdatePrimaryAction}}
+	<div class="ui buttons"{{if $data.UpdateStyleOptions}} data-global-init="initRepoPullRequestUpdate"{{end}}>
+		<button class="ui button link-action" data-url="{{$data.UpdatePrimaryAction.URL}}">
+			{{$data.UpdatePrimaryAction.Text}}
+		</button>
+		{{if gt (len $data.UpdateStyleOptions) 1}}
+		<div class="ui dropdown icon button">
+			{{svg "octicon-triangle-down"}}
+			<div class="menu">
+				{{range $data.UpdateStyleOptions}}
+					<a class="item {{if .Selected}}selected{{end}}" data-update-url="{{.URL}}">{{.Text}}</a>
+				{{end}}
+			</div>
+		</div>
+		{{end}}
+	</div>
+	{{end}}
+</div>
diff --git a/templates/repo/latest_commit.tmpl b/templates/repo/latest_commit.tmpl
index c8f1ad54928..c0518189b85 100644
--- a/templates/repo/latest_commit.tmpl
+++ b/templates/repo/latest_commit.tmpl
@@ -17,10 +17,11 @@
 	{{template "repo/commit_statuses" dict "Status" .LatestCommitStatus "Statuses" .LatestCommitStatuses}}
 
 	{{$commitLink:= printf "%s/commit/%s" .RepoLink (PathEscape .LatestCommit.ID.String)}}
-	<span class="grey commit-summary" title="{{.LatestCommit.Summary}}"><span class="message-wrapper">{{ctx.RenderUtils.RenderCommitMessageLinkSubject .LatestCommit.Message $commitLink $.Repository}}</span>
-		{{if IsMultilineCommitMessage .LatestCommit.Message}}
+	<span class="grey commit-summary" title="{{.LatestCommit.MessageTitle}}">
+		<span class="message-wrapper">{{ctx.RenderUtils.RenderCommitMessageLinkSubject .LatestCommit.MessageUTF8 $commitLink $.Repository}}</span>
+		{{if .LatestCommit.MessageBody}}
 			<button class="ui button ellipsis-button" aria-expanded="false" data-global-click="onRepoEllipsisButtonClick">...</button>
-			<pre class="commit-body tw-hidden">{{ctx.RenderUtils.RenderCommitBody .LatestCommit.Message $.Repository}}</pre>
+			<pre class="commit-body tw-hidden">{{ctx.RenderUtils.RenderCommitBody .LatestCommit.MessageUTF8 $.Repository}}</pre>
 		{{end}}
 	</span>
 {{end}}
diff --git a/templates/repo/pulls/status.tmpl b/templates/repo/pulls/status.tmpl
deleted file mode 100644
index 9f972be9d35..00000000000
--- a/templates/repo/pulls/status.tmpl
+++ /dev/null
@@ -1,63 +0,0 @@
-{{/* Template Attributes:
-* CommitStatus: summary of all commit status state
-* CommitStatuses: all commit status elements
-* ShowHideChecks: whether use a button to show/hide the checks
-* StatusCheckData: additional status check data, see backend pullCommitStatusCheckData struct
-*/}}
-{{$statusCheckData := .StatusCheckData}}
-{{if .CommitStatus}}
-<div class="commit-status-panel">
-	<div class="ui top attached header commit-status-header">
-		{{$statusCheckData.CommitStatusCheckPrompt ctx.Locale}}
-
-		{{if .ShowHideChecks}}
-		<div class="ui right">
-			<button class="commit-status-hide-checks btn interact-fg"
-			data-show-all="{{ctx.Locale.Tr "repo.pulls.status_checks_show_all"}}"
-			data-hide-all="{{ctx.Locale.Tr "repo.pulls.status_checks_hide_all"}}">
-			{{ctx.Locale.Tr "repo.pulls.status_checks_hide_all"}}</button>
-		</div>
-		{{end}}
-	</div>
-
-	{{if and $statusCheckData $statusCheckData.RequireApprovalRunCount}}
-		<div class="ui attached segment flex-left-right" id="approve-status-checks">
-			<div>
-				<strong>
-					{{ctx.Locale.Tr "repo.pulls.status_checks_need_approvals" $statusCheckData.RequireApprovalRunCount}}
-				</strong>
-				<p>{{ctx.Locale.Tr "repo.pulls.status_checks_need_approvals_helper"}}</p>
-			</div>
-			{{if $statusCheckData.CanApprove}}
-				<button class="ui basic button link-action" data-url="{{$statusCheckData.ApproveLink}}">
-					{{ctx.Locale.Tr "repo.pulls.status_checks_approve_all"}}
-				</button>
-			{{end}}
-		</div>
-	{{end}}
-
-	<div class="commit-status-list">
-		{{range .CommitStatuses}}
-			<div class="commit-status-item">
-				{{template "repo/commit_status" .}}
-				<div class="status-context gt-ellipsis">{{.Context}} <span class="tw-text-text-light-2">{{.Description}}</span></div>
-				<div class="ui status-details">
-					{{if and $statusCheckData $statusCheckData.IsContextRequired}}
-						{{if (call $statusCheckData.IsContextRequired .Context)}}<div class="ui label">{{ctx.Locale.Tr "repo.pulls.status_checks_requested"}}</div>{{end}}
-					{{end}}
-					<span>{{if .TargetURL}}<a href="{{.TargetURL}}">{{ctx.Locale.Tr "repo.pulls.status_checks_details"}}</a>{{end}}</span>
-				</div>
-			</div>
-		{{end}}
-		{{if $statusCheckData}}
-			{{range $statusCheckData.MissingRequiredChecks}}
-				<div class="commit-status-item">
-					{{svg "octicon-dot-fill" 18 "commit-status icon tw-text-yellow"}}
-					<div class="status-context gt-ellipsis">{{.}}</div>
-					<div class="ui label">{{ctx.Locale.Tr "repo.pulls.status_checks_requested"}}</div>
-				</div>
-			{{end}}
-		{{end}}
-	</div>
-</div>
-{{end}}
diff --git a/templates/repo/pulls/status_items.tmpl b/templates/repo/pulls/status_items.tmpl
new file mode 100644
index 00000000000..415f9a8a328
--- /dev/null
+++ b/templates/repo/pulls/status_items.tmpl
@@ -0,0 +1,38 @@
+{{/* Template Attributes:
+* CommitStatuses: all commit status elements
+* StatusCheckData: optional, additional status check data, see backend pullCommitStatusCheckData struct
+*/}}
+{{$statusCheckData := $.StatusCheckData}}
+{{$commitActionsStatuses :=  ctx.ActionsUtils.CommitStatusesToActionsStatuses $.CommitStatuses}}
+{{range $cs := $.CommitStatuses}}
+	<div class="item commit-status-item">
+		<div class="flex-text-block">
+			{{$actionStatus := $commitActionsStatuses.IconStatus $cs}}
+			{{if $actionStatus}}
+				{{template "repo/icons/action_status" (dict "Status" $actionStatus "Size" 18 "ClassName" "commit-status icon")}}
+			{{else}}
+				{{template "repo/icons/commit_status" $cs}}
+			{{end}}
+			<div class="status-context gt-ellipsis">
+				{{$cs.Context}} <span class="tw-text-text-light-2">{{$cs.Description}}</span>
+			</div>
+		</div>
+		<div class="status-details">
+			{{if and $statusCheckData $statusCheckData.IsContextRequired}}
+				{{if (call $statusCheckData.IsContextRequired $cs.Context)}}
+					<div class="ui label">{{ctx.Locale.Tr "repo.pulls.status_checks_requested"}}</div>
+				{{end}}
+			{{end}}
+			{{if $cs.TargetURL}}<a href="{{$cs.TargetURL}}">{{ctx.Locale.Tr "repo.pulls.status_checks_details"}}</a>{{end}}
+		</div>
+	</div>
+{{end}}
+{{range $missingCheck := $statusCheckData.MissingRequiredChecks}}
+	<div class="item commit-status-item">
+		<div class="flex-text-block">
+			{{svg "octicon-dot-fill" 16 "commit-status icon tw-text-yellow"}}
+			<div class="status-context gt-ellipsis">{{$missingCheck}}</div>
+		</div>
+		<div class="ui label">{{ctx.Locale.Tr "repo.pulls.status_checks_requested"}}</div>
+	</div>
+{{end}}
diff --git a/templates/repo/settings/actions.tmpl b/templates/repo/settings/actions.tmpl
index 5388de35af3..5754ce388d4 100644
--- a/templates/repo/settings/actions.tmpl
+++ b/templates/repo/settings/actions.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings actions")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings actions")}}
 	<div class="repo-setting-content">
 		{{if eq .PageType "runners"}}
 			{{template "shared/actions/runner_list" .}}
diff --git a/templates/repo/settings/actions_general.tmpl b/templates/repo/settings/actions_general.tmpl
index fec17bc7af3..0d55c546629 100644
--- a/templates/repo/settings/actions_general.tmpl
+++ b/templates/repo/settings/actions_general.tmpl
@@ -86,8 +86,8 @@
 	</div>
 	{{end}}
 	<div class="ui bottom attached segment">
-		<form class="ui form form-fetch-action" action="{{.Link}}/collaborative_owner/add" method="post">
-			<div id="search-user-box" class="ui search input tw-align-middle" data-include-orgs="true">
+		<form class="ui form form-fetch-action flex-text-block" action="{{.Link}}/collaborative_owner/add" method="post">
+			<div id="search-user-box" class="ui search input" data-include-orgs="true">
 				<input class="prompt" name="collaborative_owner" placeholder="{{ctx.Locale.Tr "search.user_kind"}}" autocomplete="off" autofocus required>
 			</div>
 			<button class="ui primary button">{{ctx.Locale.Tr "actions.general.add_collaborative_owner"}}</button>
diff --git a/templates/repo/settings/branches.tmpl b/templates/repo/settings/branches.tmpl
index d3f6f38e136..6ec80c057f5 100644
--- a/templates/repo/settings/branches.tmpl
+++ b/templates/repo/settings/branches.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings edit")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings edit")}}
 	<div class="repo-setting-content">
 		{{if .Repository.IsArchived}}
 			<div class="ui warning message tw-text-center">
diff --git a/templates/repo/settings/collaboration.tmpl b/templates/repo/settings/collaboration.tmpl
index 479448e6de7..48e3f3287e0 100644
--- a/templates/repo/settings/collaboration.tmpl
+++ b/templates/repo/settings/collaboration.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings collaboration")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings collaboration")}}
 	<div class="repo-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "repo.settings.collaboration"}}
@@ -39,8 +39,8 @@
 		</div>
 		{{end}}
 		<div class="ui bottom attached segment">
-			<form class="ui form" id="repo-collab-form" action="{{.Link}}" method="post">
-				<div id="search-user-box" class="ui search input tw-align-middle">
+			<form class="ui form flex-text-block" id="repo-collab-form" action="{{.Link}}" method="post">
+				<div id="search-user-box" class="ui search input">
 					<input class="prompt" name="collaborator" placeholder="{{ctx.Locale.Tr "search.user_kind"}}" autocomplete="off" autofocus required>
 				</div>
 				<button class="ui primary button">{{ctx.Locale.Tr "repo.settings.add_collaborator"}}</button>
@@ -106,8 +106,8 @@
 			{{end}}
 			<div class="ui bottom attached segment">
 				{{if $allowedToChangeTeams}}
-					<form class="ui form" id="repo-collab-team-form" action="{{.Link}}/team" method="post">
-						<div id="search-team-box" class="ui search input tw-align-middle" data-org-name="{{.OrgName}}">
+					<form class="ui form flex-text-block" id="repo-collab-team-form" action="{{.Link}}/team" method="post">
+						<div id="search-team-box" class="ui search input" data-org-name="{{.OrgName}}">
 							<input class="prompt" name="team" placeholder="{{ctx.Locale.Tr "search.team_kind"}}" autocomplete="off" required>
 						</div>
 						<button class="ui primary button">{{ctx.Locale.Tr "repo.settings.add_team"}}</button>
diff --git a/templates/repo/settings/deploy_keys.tmpl b/templates/repo/settings/deploy_keys.tmpl
index c4bffbbf08a..89a9df36678 100644
--- a/templates/repo/settings/deploy_keys.tmpl
+++ b/templates/repo/settings/deploy_keys.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings")}}
 	<div class="repo-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "repo.settings.deploy_keys"}}
diff --git a/templates/repo/settings/githook_edit.tmpl b/templates/repo/settings/githook_edit.tmpl
index b5374032983..07ea7fb4fd6 100644
--- a/templates/repo/settings/githook_edit.tmpl
+++ b/templates/repo/settings/githook_edit.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings edit githook")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings edit githook")}}
 	<div class="repo-setting-content">
 		<form class="ui form" action="{{.Link}}" method="post">
 			<h4 class="ui top attached header flex-left-right">
diff --git a/templates/repo/settings/githooks.tmpl b/templates/repo/settings/githooks.tmpl
index cd4fd6f31f3..77aa503a6bc 100644
--- a/templates/repo/settings/githooks.tmpl
+++ b/templates/repo/settings/githooks.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings githooks")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings githooks")}}
 	<div class="repo-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "repo.settings.githooks"}}
diff --git a/templates/repo/settings/layout_head.tmpl b/templates/repo/settings/layout_head.tmpl
index efec9bf8742..5f975b879eb 100644
--- a/templates/repo/settings/layout_head.tmpl
+++ b/templates/repo/settings/layout_head.tmpl
@@ -1,10 +1,10 @@
-{{template "base/head" .ctxData}}
-<div role="main" aria-label="{{.ctxData.Title}}" class="page-content {{.pageClass}}">
-	{{template "repo/header" .ctxData}}
+{{template "base/head" ctx.RootData}}
+<div role="main" aria-label="{{ctx.RootData.Title}}" class="page-content {{.pageClass}}">
+	{{template "repo/header" ctx.RootData}}
 	<div class="ui container flex-container">
-		{{template "repo/settings/navbar" .ctxData}}
+		{{template "repo/settings/navbar" ctx.RootData}}
 		<div class="flex-container-main">
-			{{template "base/alert" .ctxData}}
+			{{template "base/alert" ctx.RootData}}
 			{{/* block: repo-setting-content */}}
 
 {{if false}}{{/* to make html structure "likely" complete to prevent IDE warnings */}}
diff --git a/templates/repo/settings/lfs.tmpl b/templates/repo/settings/lfs.tmpl
index a3957ffd533..0b9f4aac22a 100644
--- a/templates/repo/settings/lfs.tmpl
+++ b/templates/repo/settings/lfs.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings lfs")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings lfs")}}
 	<div class="repo-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "repo.settings.lfs_filelist"}} ({{ctx.Locale.Tr "admin.total" .Total}})
diff --git a/templates/repo/settings/lfs_file.tmpl b/templates/repo/settings/lfs_file.tmpl
index e9f4afda264..b04dc16cdfb 100644
--- a/templates/repo/settings/lfs_file.tmpl
+++ b/templates/repo/settings/lfs_file.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings lfs")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings lfs")}}
 	<div class="user-main-content twelve wide column content repository file list">
 		<div class="tab-size-8 non-diff-file-content">
 			<h4 class="ui top attached header">
diff --git a/templates/repo/settings/lfs_file_find.tmpl b/templates/repo/settings/lfs_file_find.tmpl
index c19bd56e872..ddf98783dbb 100644
--- a/templates/repo/settings/lfs_file_find.tmpl
+++ b/templates/repo/settings/lfs_file_find.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings lfs")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings lfs")}}
 	<div class="user-main-content twelve wide column content repository file list">
 		<div class="tab-size-8 non-diff-file-content">
 			<h4 class="ui top attached header">
@@ -6,7 +6,7 @@
 			</h4>
 			<table id="lfs-files-find-table" class="ui attached segment single line table">
 				<tbody>
-					{{range .Results}}
+					{{range $lfsItem := .Results}}
 						<tr>
 							<td>
 								{{svg "octicon-file"}}
@@ -14,8 +14,8 @@
 							</td>
 							<td class="message">
 								<span class="truncate">
-									<a href="{{$.RepoLink}}/commit/{{.SHA}}" title="{{.Summary}}">
-										{{.Summary | ctx.RenderUtils.RenderEmoji}}
+									<a href="{{$.RepoLink}}/commit/{{.SHA}}" title="{{$lfsItem.Summary}}">
+										{{$lfsItem.Summary | ctx.RenderUtils.RenderEmoji}}
 									</a>
 								</span>
 							</td>
diff --git a/templates/repo/settings/lfs_locks.tmpl b/templates/repo/settings/lfs_locks.tmpl
index 55bb2ce1d34..f91ad46afb4 100644
--- a/templates/repo/settings/lfs_locks.tmpl
+++ b/templates/repo/settings/lfs_locks.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings lfs")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings lfs")}}
 	<div class="user-main-content twelve wide column content repository file list">
 		<div class="tab-size-8 non-diff-file-content">
 			<h4 class="ui top attached header">
diff --git a/templates/repo/settings/lfs_pointers.tmpl b/templates/repo/settings/lfs_pointers.tmpl
index 2138aadc53c..9e558c9af59 100644
--- a/templates/repo/settings/lfs_pointers.tmpl
+++ b/templates/repo/settings/lfs_pointers.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings lfs")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings lfs")}}
 	<div class="repo-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "repo.settings.lfs_pointers.found" .NumPointers .NumAssociated .NumNotAssociated .NumNoExist}}
diff --git a/templates/repo/settings/navbar.tmpl b/templates/repo/settings/navbar.tmpl
index ba25e34ba43..36ee39bc07c 100644
--- a/templates/repo/settings/navbar.tmpl
+++ b/templates/repo/settings/navbar.tmpl
@@ -38,7 +38,7 @@
 				</a>
 			{{end}}
 		{{end}}
-		<details class="item toggleable-item" {{if or .PageIsSharedSettingsRunners .PageIsSharedSettingsSecrets .PageIsSharedSettingsVariables .PageIsActionsSettingsGeneral}}open{{end}}>
+		<details class="item" {{if or .PageIsSharedSettingsRunners .PageIsSharedSettingsSecrets .PageIsSharedSettingsVariables .PageIsActionsSettingsGeneral}}open{{end}}>
 			<summary>{{ctx.Locale.Tr "actions.actions"}}</summary>
 			<div class="menu">
 				<a class="{{if .PageIsActionsSettingsGeneral}}active {{end}}item" href="{{.RepoLink}}/settings/actions/general">
diff --git a/templates/repo/settings/options.tmpl b/templates/repo/settings/options.tmpl
index 352469234bb..d4491e58d84 100644
--- a/templates/repo/settings/options.tmpl
+++ b/templates/repo/settings/options.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings options")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings options")}}
 	<div class="user-main-content twelve wide column">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "repo.settings.basic_settings"}}
@@ -617,10 +617,34 @@
 						</div>
 						<div class="field">
 							<div class="ui checkbox">
-								<input name="pulls_allow_rebase_update" type="checkbox" {{if or (not $pullRequestEnabled) ($prUnit.PullRequestsConfig.AllowRebaseUpdate)}}checked{{end}}>
+								<input name="pulls_allow_merge_update" type="checkbox" {{if $prUnit.PullRequestsConfig.AllowMergeUpdate}}checked{{end}}>
+								<label>{{ctx.Locale.Tr "repo.settings.pulls.allow_merge_update"}}</label>
+							</div>
+						</div>
+						<div class="field">
+							<div class="ui checkbox">
+								<input name="pulls_allow_rebase_update" type="checkbox" {{if $prUnit.PullRequestsConfig.AllowRebaseUpdate}}checked{{end}}>
 								<label>{{ctx.Locale.Tr "repo.settings.pulls.allow_rebase_update"}}</label>
 							</div>
 						</div>
+						<div class="field">
+							<label>{{ctx.Locale.Tr "repo.settings.pulls.default_update_style"}}</label>
+							<div class="ui dropdown selection">
+								<select name="pulls_default_update_style">
+									{{range .PullsDefaultUpdateStyleOptions}}
+										<option value="{{.Value}}" {{if .Selected}}selected{{end}}>{{.Text}}</option>
+									{{end}}
+								</select>{{svg "octicon-triangle-down" 14 "dropdown icon"}}
+								<div class="default text">
+									{{.PullsDefaultUpdateStyleText}}
+								</div>
+								<div class="menu">
+									{{range .PullsDefaultUpdateStyleOptions}}
+										<div class="item" data-value="{{.Value}}">{{.Text}}</div>
+									{{end}}
+								</div>
+							</div>
+						</div>
 						<div class="field">
 							<div class="ui checkbox">
 								<input name="default_delete_branch_after_merge" type="checkbox" {{if or (not $pullRequestEnabled) ($prUnit.PullRequestsConfig.DefaultDeleteBranchAfterMerge)}}checked{{end}}>
diff --git a/templates/repo/settings/protected_branch.tmpl b/templates/repo/settings/protected_branch.tmpl
index daa1d5f3f91..ae262c9500c 100644
--- a/templates/repo/settings/protected_branch.tmpl
+++ b/templates/repo/settings/protected_branch.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings branches")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings branches")}}
 	<div class="repo-setting-content">
 		<form class="ui form" action="{{.Link}}" method="post">
 			<h4 class="ui top attached header">
@@ -305,6 +305,49 @@
 					{{end}}
 					</div>
 				</div>
+				<h5 class="ui dividing header">{{ctx.Locale.Tr "repo.settings.protect_bypass_allowlist"}}</h5>
+				<div class="grouped fields">
+					<div class="field">
+						<div class="ui checkbox">
+							<input name="enable_bypass_allowlist" type="checkbox" class="toggle-target-enabled" data-target="#bypass_allowlist_box" {{if .Rule.EnableBypassAllowlist}}checked{{end}}>
+							<label>{{ctx.Locale.Tr "repo.settings.protect_enable_bypass_allowlist"}}</label>
+							<p class="help">{{ctx.Locale.Tr "repo.settings.protect_enable_bypass_allowlist_desc"}}</p>
+						</div>
+					</div>
+					<div id="bypass_allowlist_box" class="grouped fields {{if not .Rule.EnableBypassAllowlist}}disabled{{end}}">
+						<div class="checkbox-sub-item field">
+							<label>{{ctx.Locale.Tr "repo.settings.protect_bypass_allowlist_users"}}</label>
+							<div class="ui multiple search selection dropdown">
+								<input type="hidden" name="bypass_allowlist_users" value="{{.bypass_allowlist_users}}">
+								<div class="default text">{{ctx.Locale.Tr "search.user_kind"}}</div>
+								<div class="menu">
+								{{range .Users}}
+									<div class="item" data-value="{{.ID}}">
+										{{ctx.AvatarUtils.Avatar . 28 "mini"}}{{template "repo/search_name" .}}
+									</div>
+								{{end}}
+								</div>
+							</div>
+						</div>
+					{{if .Owner.IsOrganization}}
+						<div class="checkbox-sub-item field">
+							<label>{{ctx.Locale.Tr "repo.settings.protect_bypass_allowlist_teams"}}</label>
+							<div class="ui multiple search selection dropdown">
+								<input type="hidden" name="bypass_allowlist_teams" value="{{.bypass_allowlist_teams}}">
+								<div class="default text">{{ctx.Locale.Tr "search.team_kind"}}</div>
+								<div class="menu">
+								{{range .Teams}}
+									<div class="item" data-value="{{.ID}}">
+										{{svg "octicon-people"}}
+									{{.Name}}
+									</div>
+								{{end}}
+								</div>
+							</div>
+						</div>
+					{{end}}
+					</div>
+				</div>
 				<div class="field">
 					<div class="ui checkbox">
 						<input name="block_on_rejected_reviews" type="checkbox" {{if .Rule.BlockOnRejectedReviews}}checked{{end}}>
diff --git a/templates/repo/settings/public_access.tmpl b/templates/repo/settings/public_access.tmpl
index cfd9bf5cb17..de3fe0d9f0f 100644
--- a/templates/repo/settings/public_access.tmpl
+++ b/templates/repo/settings/public_access.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings")}}
 <div class="repo-setting-content">
 	<h4 class="ui top attached header">
 		{{ctx.Locale.Tr "repo.settings.public_access"}}
diff --git a/templates/repo/settings/runner_edit.tmpl b/templates/repo/settings/runner_edit.tmpl
index 8b76aead579..726f608d346 100644
--- a/templates/repo/settings/runner_edit.tmpl
+++ b/templates/repo/settings/runner_edit.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings runners")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings runners")}}
 	<div class="repo-setting-content">
 		{{template "shared/actions/runner_edit" .}}
 	</div>
diff --git a/templates/repo/settings/secrets.tmpl b/templates/repo/settings/secrets.tmpl
index 0b89639e79d..30d374685a2 100644
--- a/templates/repo/settings/secrets.tmpl
+++ b/templates/repo/settings/secrets.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings")}}
 	<div class="repo-setting-content">
 		{{template "shared/secrets/add_list" .}}
 	</div>
diff --git a/templates/repo/settings/tags.tmpl b/templates/repo/settings/tags.tmpl
index af03b3598f5..5abac11ebbd 100644
--- a/templates/repo/settings/tags.tmpl
+++ b/templates/repo/settings/tags.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings edit")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings edit")}}
 	<div class="repo-setting-content">
 		{{if .Repository.IsArchived}}
 			<div class="ui warning message tw-text-center">
diff --git a/templates/repo/settings/webhook/base.tmpl b/templates/repo/settings/webhook/base.tmpl
index 39bb7a9fe00..2a75edc3285 100644
--- a/templates/repo/settings/webhook/base.tmpl
+++ b/templates/repo/settings/webhook/base.tmpl
@@ -1,4 +1,4 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings webhooks")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings webhooks")}}
 	<div class="repo-setting-content">
 		{{template "repo/settings/webhook/base_list" .}}
 	</div>
diff --git a/templates/repo/settings/webhook/new.tmpl b/templates/repo/settings/webhook/new.tmpl
index b04a44213af..45db5fa0820 100644
--- a/templates/repo/settings/webhook/new.tmpl
+++ b/templates/repo/settings/webhook/new.tmpl
@@ -1,7 +1,7 @@
-{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings new webhook")}}
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings new webhook")}}
 	<div class="repo-setting-content">
 		{{$CustomHeaderTitle := ctx.Locale.Tr "repo.settings.update_webhook"}}
 		{{if .PageIsSettingsHooksNew}}{{$CustomHeaderTitle = ctx.Locale.Tr "repo.settings.add_webhook"}}{{end}}
-		{{template "webhook/new" (dict "ctxData" . "CustomHeaderTitle" $CustomHeaderTitle)}}
+		{{template "webhook/new" (dict "CustomHeaderTitle" $CustomHeaderTitle)}}
 	</div>
 {{template "repo/settings/layout_footer" .}}
diff --git a/templates/repo/view_content.tmpl b/templates/repo/view_content.tmpl
index 3413c09a6af..77e051d7d61 100644
--- a/templates/repo/view_content.tmpl
+++ b/templates/repo/view_content.tmpl
@@ -92,7 +92,7 @@
 			<button class="ui dropdown basic compact jump button tw-px-3" data-tooltip-content="{{ctx.Locale.Tr "repo.more_operations"}}">
 				{{svg "octicon-kebab-horizontal"}}
 				<div class="menu">
-					<a class="item" data-clipboard-text="{{.Repository.Link}}/src/commit/{{.CommitID}}/{{PathEscapeSegments .TreePath}}" data-clipboard-text-type="url">
+					<a class="item" data-clipboard-text="{{ctx.AppFullLink}}{{.Repository.Link}}/src/commit/{{.CommitID}}/{{PathEscapeSegments .TreePath}}">
 						{{svg "octicon-link" 16}}{{ctx.Locale.Tr "repo.file_copy_permalink"}}
 					</a>
 					{{if and (not $.DisableDownloadSourceArchives) $.RefFullName}}
diff --git a/templates/repo/view_list.tmpl b/templates/repo/view_list.tmpl
index 317c67611e7..e79eac1dd13 100644
--- a/templates/repo/view_list.tmpl
+++ b/templates/repo/view_list.tmpl
@@ -56,7 +56,7 @@
 			<div class="repo-file-cell message commit-summary {{if not $commit}}notready{{end}}">
 				{{if $commit}}
 					{{$commitLink := printf "%s/commit/%s" $.RepoLink (PathEscape $commit.ID.String)}}
-					{{ctx.RenderUtils.RenderCommitMessageLinkSubject $commit.Message $commitLink $.Repository}}
+					{{ctx.RenderUtils.RenderCommitMessageLinkSubject $commit.MessageUTF8 $commitLink $.Repository}}
 				{{else}}
 					… {{/* will be loaded again by LastCommitLoaderURL */}}
 				{{end}}
diff --git a/templates/repo/wiki/revision.tmpl b/templates/repo/wiki/revision.tmpl
index c59047a6404..a9df43ea468 100644
--- a/templates/repo/wiki/revision.tmpl
+++ b/templates/repo/wiki/revision.tmpl
@@ -9,8 +9,8 @@
 				<div class="tw-flex-1 gt-ellipsis">
 					{{$title}}
 					<div class="ui sub header gt-ellipsis">
-						{{$timeSince := DateUtils.TimeSince .Author.When}}
-						{{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince}}
+						{{$timeSince := DateUtils.TimeSince .Committer.When}}
+						{{ctx.Locale.Tr "repo.wiki.last_commit_info" .Committer.Name $timeSince}}
 					</div>
 				</div>
 			</div>
diff --git a/templates/repo/wiki/view.tmpl b/templates/repo/wiki/view.tmpl
index 4c7ef364d29..967a8814c96 100644
--- a/templates/repo/wiki/view.tmpl
+++ b/templates/repo/wiki/view.tmpl
@@ -37,8 +37,8 @@
 					<div class="tw-flex-1 gt-ellipsis">
 						{{$title}}
 						<div class="ui sub header gt-ellipsis">
-							{{$timeSince := DateUtils.TimeSince .Author.When}}
-							{{ctx.Locale.Tr "repo.wiki.last_commit_info" .Author.Name $timeSince}}
+							{{$timeSince := DateUtils.TimeSince .Committer.When}}
+							{{ctx.Locale.Tr "repo.wiki.last_commit_info" .Committer.Name $timeSince}}
 						</div>
 					</div>
 				</div>
diff --git a/templates/shared/actions/runner_list.tmpl b/templates/shared/actions/runner_list.tmpl
index 90eb4591d7a..1b287cdabc2 100644
--- a/templates/shared/actions/runner_list.tmpl
+++ b/templates/shared/actions/runner_list.tmpl
@@ -40,10 +40,28 @@
 			{{template "shared/search/combo" dict "Value" .Keyword "Placeholder" (ctx.Locale.Tr "search.runner_kind")}}
 		</form>
 	</div>
+	{{if .AllowBulkActions}}
+	<div class="ui attached segment tw-hidden" data-global-init="initRunnerBulkToolbar">
+		<form action="{{$.Link}}/bulk" method="post" class="form-fetch-action">
+			<input type="hidden" name="ids">
+			<button class="ui small button" name="action" value="disable">{{ctx.Locale.Tr "actions.runners.disable_runner"}} <span class="runner-bulk-count"></span></button>
+			<button class="ui small button" name="action" value="enable">{{ctx.Locale.Tr "actions.runners.enable_runner"}} <span class="runner-bulk-count"></span></button>
+			<button class="ui small red button" name="action" value="delete"
+				data-modal-confirm-header="{{ctx.Locale.Tr "actions.runners.delete_runner_header"}}"
+				data-modal-confirm-content="{{ctx.Locale.Tr "actions.runners.delete_runner_notice"}}"
+				>{{ctx.Locale.Tr "actions.runners.delete_runner"}} <span class="runner-bulk-count"></span>
+			</button>
+		</form>
+	</div>
+	{{end}}
+	{{if .Runners}}
 	<div class="ui attached table segment">
 		<table class="ui very basic table unstackable">
 			<thead>
 				<tr>
+					{{if .AllowBulkActions}}
+					<th class="tw-w-8"><div class="ui checkbox tw-flex"><input type="checkbox" class="runner-bulk-select-all" aria-label="{{ctx.Locale.Tr "admin.notices.select_all"}}"></div></th>
+					{{end}}
 					<th data-sortt-asc="online" data-sortt-desc="offline">
 						{{ctx.Locale.Tr "actions.runners.status"}}
 						{{SortArrow "online" "offline" .SortType false}}
@@ -66,6 +84,9 @@
 			<tbody>
 				{{range .Runners}}
 					<tr>
+						{{if $.AllowBulkActions}}
+						<td><div class="ui checkbox tw-flex"><input type="checkbox" class="runner-bulk-select" data-runner-id="{{.ID}}" aria-label="{{ctx.Locale.Tr "repo.issues.action_check"}}: {{.Name}}"></div></td>
+						{{end}}
 						<td>
 							<span class="ui label {{if .IsOnline}}green{{end}}">{{.StatusLocaleName ctx.Locale}}</span>
 							{{if .IsDisabled}}<span class="ui grey label">{{ctx.Locale.Tr "actions.runners.disabled"}}</span>{{end}}
@@ -84,15 +105,13 @@
 							{{end}}
 						</td>
 					</tr>
-				{{else}}
-					<tr>
-						<td class="tw-text-center" colspan="8">{{ctx.Locale.Tr "actions.runners.none"}}</td>
-					</tr>
 				{{end}}
 			</tbody>
 		</table>
 	</div>
+	{{else}}
+	<div class="ui attached segment tw-text-center">{{ctx.Locale.Tr "actions.runners.none"}}</div>
+	{{end}}
 
 	{{template "base/paginate" .}}
-
 </div>
diff --git a/templates/shared/issuelist.tmpl b/templates/shared/issuelist.tmpl
index 278860d35f1..11c4210b460 100644
--- a/templates/shared/issuelist.tmpl
+++ b/templates/shared/issuelist.tmpl
@@ -15,17 +15,19 @@
 
 			<div class="item-main">
 				<div class="item-header">
-					<div class="item-title">
-						<a class="tw-no-underline issue-title" href="{{if .Link}}{{.Link}}{{else}}{{$.Link}}/{{.Index}}{{end}}">{{.Title | ctx.RenderUtils.RenderIssueSimpleTitle}}</a>
+					<div>
+						<a class="issue-item-title" href="{{if .Link}}{{.Link}}{{else}}{{$.Link}}/{{.Index}}{{end}}">{{.Title | ctx.RenderUtils.RenderIssueSimpleTitle}}</a>
 						{{if .IsPull}}
 							{{if (index $.CommitStatuses .PullRequest.ID)}}
+								<span class="tw-align-[1px]">{{/* make the "flex" children align with parent "inline" */}}
 								{{template "repo/commit_statuses" dict "Status" (index $.CommitLastStatus .PullRequest.ID) "Statuses" (index $.CommitStatuses .PullRequest.ID)}}
+								</span>
 							{{end}}
 						{{end}}
 						<span class="labels-list">
-							{{range .Labels}}
-								<a href="?q={{$.Keyword}}&type={{$.ViewType}}&state={{$.State}}&labels={{.ID}}{{if ne $.listType "milestone"}}&milestone={{$.MilestoneID}}{{end}}&assignee={{$.AssigneeID}}&poster={{$.PosterID}}{{if $.ShowArchivedLabels}}&archived=true{{end}}">{{ctx.RenderUtils.RenderLabel .}}</a>
-							{{end}}
+							{{- range .Labels -}}
+								<a class="item" href="?q={{$.Keyword}}&type={{$.ViewType}}&state={{$.State}}&labels={{.ID}}{{if ne $.listType "milestone"}}&milestone={{$.MilestoneID}}{{end}}&assignee={{$.AssigneeID}}&poster={{$.PosterID}}{{if $.ShowArchivedLabels}}&archived=true{{end}}">{{ctx.RenderUtils.RenderLabel .}}</a>
+							{{- end -}}
 						</span>
 					</div>
 					{{if .TotalTrackedTime}}
diff --git a/templates/shared/repo/list.tmpl b/templates/shared/repo/list.tmpl
index 078e6e67bc9..af2f5d97003 100644
--- a/templates/shared/repo/list.tmpl
+++ b/templates/shared/repo/list.tmpl
@@ -47,8 +47,12 @@
 								<span {{if ge .NumStars 1000}}data-tooltip-content="{{.NumStars}}"{{end}}>{{CountFmt .NumStars}}</span>
 							</a>
 						{{end}}
+						<a class="flex-text-inline" href="{{.Link}}/pulls">
+							<span class="tw-contents" aria-label="{{ctx.Locale.Tr "repo.pulls"}}">{{svg "octicon-git-pull-request" 16}}</span>
+							<span {{if ge .NumOpenPulls 1000}}data-tooltip-content="{{.NumOpenPulls}}"{{end}}>{{CountFmt .NumOpenPulls}}</span>
+						</a>
 						<a class="flex-text-inline" href="{{.Link}}/forks">
-							<span class="tw-contents" aria-label="{{ctx.Locale.Tr "repo.forks"}}">{{svg "octicon-git-branch" 16}}</span>
+							<span class="tw-contents" aria-label="{{ctx.Locale.Tr "repo.forks"}}">{{svg "octicon-repo-forked" 16}}</span>
 							<span {{if ge .NumForks 1000}}data-tooltip-content="{{.NumForks}}"{{end}}>{{CountFmt .NumForks}}</span>
 						</a>
 					</div>
diff --git a/templates/swagger/openapi-viewer.tmpl b/templates/swagger/openapi-viewer.tmpl
index 792364157d7..2e3e9bf1499 100644
--- a/templates/swagger/openapi-viewer.tmpl
+++ b/templates/swagger/openapi-viewer.tmpl
@@ -4,14 +4,14 @@
 		{{ctx.HeadMetaContentSecurityPolicy}}
 		<title>Gitea API</title>
 		<link rel="stylesheet" href="{{ctx.CurrentWebTheme.PublicAssetURI}}">
-		{{/* HINT: SWAGGER-CSS-IMPORT: import swagger styles ahead to avoid UI flicker (e.g.: the swagger-back-link element) */}}
-		<link rel="stylesheet" href="{{AssetURI "css/swagger.css"}}">
+		{{/* HINT: SWAGGER-CSS-IMPORT: load swagger styles ahead to avoid flicker (e.g. the swagger-back-link) */}}
+		{{AssetCSSLinks "web_src/js/swagger.ts" "web_src/css/swagger-standalone.css"}}
 	</head>
 	<body>
 		{{/* TODO: add Help & Glossary to help users understand the API, and explain some concepts like "Owner" */}}
 		<a class="swagger-back-link" href="{{AppSubUrl}}/">{{svg "octicon-reply"}}{{ctx.Locale.Tr "return_to_gitea"}}</a>
 		<div id="swagger-ui" data-source="{{AppSubUrl}}/swagger.v1.json"></div>
 		<footer class="page-footer"></footer>
-		{{ctx.ScriptImport "js/swagger.js" "module"}}
+		{{ctx.ScriptImport "web_src/js/swagger.ts" "module"}}
 	</body>
 </html>
diff --git a/templates/swagger/v1_json.tmpl b/templates/swagger/v1_json.tmpl
index 26d45940f25..20c7abd3454 100644
--- a/templates/swagger/v1_json.tmpl
+++ b/templates/swagger/v1_json.tmpl
@@ -49,6 +49,18 @@
             "description": "page size of results",
             "name": "limit",
             "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "sort jobs by attribute. Supported values are \"id\". Default is \"id\"",
+            "name": "sort",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "sort order, either \"asc\" (ascending) or \"desc\" (descending). Default is \"asc\"",
+            "name": "order",
+            "in": "query"
           }
         ],
         "responses": {
@@ -60,6 +72,9 @@
           },
           "404": {
             "$ref": "#/responses/notFound"
+          },
+          "422": {
+            "$ref": "#/responses/validationError"
           }
         }
       }
@@ -4918,6 +4933,18 @@
             "description": "page size of results",
             "name": "limit",
             "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "sort jobs by attribute. Supported values are \"id\". Default is \"id\"",
+            "name": "sort",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "sort order, either \"asc\" (ascending) or \"desc\" (descending). Default is \"asc\"",
+            "name": "order",
+            "in": "query"
           }
         ],
         "responses": {
@@ -4929,6 +4956,9 @@
           },
           "404": {
             "$ref": "#/responses/notFound"
+          },
+          "422": {
+            "$ref": "#/responses/validationError"
           }
         }
       }
@@ -5646,6 +5676,18 @@
             "description": "page size of results",
             "name": "limit",
             "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "sort jobs by attribute. Supported values are \"id\". Default is \"id\"",
+            "name": "sort",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "sort order, either \"asc\" (ascending) or \"desc\" (descending). Default is \"asc\"",
+            "name": "order",
+            "in": "query"
           }
         ],
         "responses": {
@@ -5657,6 +5699,9 @@
           },
           "404": {
             "$ref": "#/responses/notFound"
+          },
+          "422": {
+            "$ref": "#/responses/validationError"
           }
         }
       }
@@ -15601,6 +15646,9 @@
           },
           "404": {
             "$ref": "#/responses/notFound"
+          },
+          "422": {
+            "$ref": "#/responses/validationError"
           }
         }
       }
@@ -18911,6 +18959,18 @@
             "description": "page size of results",
             "name": "limit",
             "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "sort jobs by attribute. Supported values are \"id\". Default is \"id\"",
+            "name": "sort",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "description": "sort order, either \"asc\" (ascending) or \"desc\" (descending). Default is \"asc\"",
+            "name": "order",
+            "in": "query"
           }
         ],
         "responses": {
@@ -18922,6 +18982,9 @@
           },
           "404": {
             "$ref": "#/responses/notFound"
+          },
+          "422": {
+            "$ref": "#/responses/validationError"
           }
         }
       }
@@ -21536,7 +21599,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "AccessToken": {
       "type": "object",
@@ -21584,7 +21647,7 @@
           "x-go-name": "TokenLastEight"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionArtifact": {
       "description": "ActionArtifact represents a ActionArtifact",
@@ -21635,7 +21698,7 @@
           "$ref": "#/definitions/ActionWorkflowRun"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionArtifactsResponse": {
       "description": "ActionArtifactsResponse returns ActionArtifacts",
@@ -21654,7 +21717,7 @@
           "x-go-name": "TotalCount"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionRunner": {
       "description": "ActionRunner represents a Runner",
@@ -21693,7 +21756,7 @@
           "x-go-name": "Status"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionRunnerLabel": {
       "description": "ActionRunnerLabel represents a Runner Label",
@@ -21713,7 +21776,7 @@
           "x-go-name": "Type"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionRunnersResponse": {
       "description": "ActionRunnersResponse returns Runners",
@@ -21732,7 +21795,7 @@
           "x-go-name": "TotalCount"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionTask": {
       "description": "ActionTask represents a ActionTask",
@@ -21806,7 +21869,7 @@
           "x-go-name": "WorkflowID"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionTaskResponse": {
       "description": "ActionTaskResponse returns a ActionTask",
@@ -21827,7 +21890,7 @@
           "x-go-name": "Entries"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionVariable": {
       "description": "ActionVariable return value of the query API",
@@ -21861,7 +21924,7 @@
           "x-go-name": "RepoID"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionWorkflow": {
       "description": "ActionWorkflow represents a ActionWorkflow",
@@ -21918,7 +21981,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionWorkflowJob": {
       "description": "ActionWorkflowJob represents a WorkflowJob",
@@ -22010,7 +22073,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionWorkflowJobsResponse": {
       "description": "ActionWorkflowJobsResponse returns ActionWorkflowJobs",
@@ -22029,7 +22092,7 @@
           "x-go-name": "TotalCount"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionWorkflowResponse": {
       "description": "ActionWorkflowResponse returns a ActionWorkflow",
@@ -22048,7 +22111,7 @@
           "x-go-name": "Workflows"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionWorkflowRun": {
       "description": "ActionWorkflowRun represents a WorkflowRun",
@@ -22139,7 +22202,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionWorkflowRunsResponse": {
       "description": "ActionWorkflowRunsResponse returns ActionWorkflowRuns",
@@ -22158,7 +22221,7 @@
           "x-go-name": "Entries"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ActionWorkflowStep": {
       "description": "ActionWorkflowStep represents a step of a WorkflowJob",
@@ -22192,7 +22255,7 @@
           "x-go-name": "Status"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Activity": {
       "type": "object",
@@ -22292,7 +22355,7 @@
           "x-go-name": "UserID"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "AddCollaboratorOption": {
       "description": "AddCollaboratorOption options when adding a user as a collaborator of a repository",
@@ -22310,7 +22373,7 @@
           "x-go-name": "Permission"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "AddTimeOption": {
       "description": "AddTimeOption options for adding time to an issue",
@@ -22336,7 +22399,7 @@
           "x-go-name": "User"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "AnnotatedTag": {
       "description": "AnnotatedTag represents an annotated tag",
@@ -22372,7 +22435,7 @@
           "$ref": "#/definitions/PayloadCommitVerification"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "AnnotatedTagObject": {
       "description": "AnnotatedTagObject contains meta information of the tag object",
@@ -22394,7 +22457,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ApplyDiffPatchFileOptions": {
       "description": "ApplyDiffPatchFileOptions options for applying a diff patch\nNote: `author` and `committer` are optional (if only one is given, it will be used for the other, otherwise the authenticated user will be used)",
@@ -22442,7 +22505,7 @@
           "x-go-name": "Signoff"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Attachment": {
       "description": "Attachment a generic attachment",
@@ -22487,7 +22550,7 @@
           "x-go-name": "UUID"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Badge": {
       "description": "Badge represents a user badge",
@@ -22511,7 +22574,7 @@
           "x-go-name": "Slug"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Branch": {
       "description": "Branch represents a repository branch",
@@ -22565,7 +22628,7 @@
           "x-go-name": "UserCanPush"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "BranchProtection": {
       "description": "BranchProtection represents a branch protection for a repository",
@@ -22606,6 +22669,20 @@
           "type": "string",
           "x-go-name": "BranchName"
         },
+        "bypass_allowlist_teams": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "x-go-name": "BypassAllowlistTeams"
+        },
+        "bypass_allowlist_usernames": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "x-go-name": "BypassAllowlistUsernames"
+        },
         "created_at": {
           "type": "string",
           "format": "date-time",
@@ -22619,6 +22696,10 @@
           "type": "boolean",
           "x-go-name": "EnableApprovalsWhitelist"
         },
+        "enable_bypass_allowlist": {
+          "type": "boolean",
+          "x-go-name": "EnableBypassAllowlist"
+        },
         "enable_force_push": {
           "type": "boolean",
           "x-go-name": "EnableForcePush"
@@ -22738,7 +22819,7 @@
           "x-go-name": "Updated"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ChangeFileOperation": {
       "description": "ChangeFileOperation for creating, updating or deleting a file",
@@ -22781,7 +22862,7 @@
           "x-go-name": "SHA"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ChangeFilesOptions": {
       "description": "ChangeFilesOptions options for creating, updating or deleting multiple files\nNote: `author` and `committer` are optional (if only one is given, it will be used for the other, otherwise the authenticated user will be used)",
@@ -22833,7 +22914,7 @@
           "x-go-name": "Signoff"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ChangedFile": {
       "description": "ChangedFile store information about files affected by the pull request",
@@ -22888,7 +22969,7 @@
           "x-go-name": "Status"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CombinedStatus": {
       "description": "CombinedStatus holds the combined state of several statuses for a single commit",
@@ -22941,7 +23022,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Comment": {
       "description": "Comment represents a comment on a commit or issue",
@@ -23006,7 +23087,7 @@
           "$ref": "#/definitions/User"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Commit": {
       "type": "object",
@@ -23061,7 +23142,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CommitAffectedFiles": {
       "description": "CommitAffectedFiles store information about files affected by the commit",
@@ -23078,7 +23159,7 @@
           "x-go-name": "Status"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CommitDateOptions": {
       "description": "CommitDateOptions store dates for GIT_AUTHOR_DATE and GIT_COMMITTER_DATE",
@@ -23095,7 +23176,7 @@
           "x-go-name": "Committer"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CommitMeta": {
       "type": "object",
@@ -23117,7 +23198,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CommitStats": {
       "description": "CommitStats is statistics for a RepoCommit",
@@ -23142,7 +23223,7 @@
           "x-go-name": "Total"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CommitStatus": {
       "description": "CommitStatus holds a single status of a single Commit",
@@ -23202,7 +23283,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CommitUser": {
       "type": "object",
@@ -23224,7 +23305,7 @@
           "x-go-name": "Name"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Compare": {
       "type": "object",
@@ -23243,7 +23324,7 @@
           "x-go-name": "TotalCommits"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ContentsExtResponse": {
       "type": "object",
@@ -23260,7 +23341,7 @@
           "$ref": "#/definitions/ContentsResponse"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ContentsResponse": {
       "description": "ContentsResponse contains information about a repo's entry's (dir, file, symlink, submodule) metadata and content",
@@ -23367,7 +23448,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateAccessTokenOption": {
       "description": "CreateAccessTokenOption options when create access token",
@@ -23399,7 +23480,7 @@
           ]
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateActionWorkflowDispatch": {
       "description": "CreateActionWorkflowDispatch represents the payload for triggering a workflow dispatch event",
@@ -23421,7 +23502,7 @@
           "example": "refs/heads/main"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateBranchProtectionOption": {
       "description": "CreateBranchProtectionOption options for creating a branch protection",
@@ -23462,6 +23543,20 @@
           "type": "string",
           "x-go-name": "BranchName"
         },
+        "bypass_allowlist_teams": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "x-go-name": "BypassAllowlistTeams"
+        },
+        "bypass_allowlist_usernames": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "x-go-name": "BypassAllowlistUsernames"
+        },
         "dismiss_stale_approvals": {
           "type": "boolean",
           "x-go-name": "DismissStaleApprovals"
@@ -23470,6 +23565,10 @@
           "type": "boolean",
           "x-go-name": "EnableApprovalsWhitelist"
         },
+        "enable_bypass_allowlist": {
+          "type": "boolean",
+          "x-go-name": "EnableBypassAllowlist"
+        },
         "enable_force_push": {
           "type": "boolean",
           "x-go-name": "EnableForcePush"
@@ -23582,7 +23681,7 @@
           "x-go-name": "UnprotectedFilePatterns"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateBranchRepoOption": {
       "description": "CreateBranchRepoOption options when creating a branch in a repository",
@@ -23610,7 +23709,7 @@
           "x-go-name": "OldRefName"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateEmailOption": {
       "description": "CreateEmailOption options when creating email addresses",
@@ -23625,7 +23724,7 @@
           "x-go-name": "Emails"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateFileOptions": {
       "description": "CreateFileOptions options for creating a file\nNote: `author` and `committer` are optional (if only one is given, it will be used for the other, otherwise the authenticated user will be used)",
@@ -23674,7 +23773,7 @@
           "x-go-name": "Signoff"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateForkOption": {
       "description": "CreateForkOption options for creating a fork",
@@ -23691,7 +23790,7 @@
           "x-go-name": "Organization"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateGPGKeyOption": {
       "description": "CreateGPGKeyOption options create user GPG key",
@@ -23712,7 +23811,7 @@
           "x-go-name": "Signature"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateHookOption": {
       "description": "CreateHookOption options when create a hook",
@@ -23770,7 +23869,7 @@
           "x-go-name": "Type"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateHookOptionConfig": {
       "description": "CreateHookOptionConfig has all config options in it\nrequired are \"content_type\" and \"url\" Required",
@@ -23778,7 +23877,7 @@
       "additionalProperties": {
         "type": "string"
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateIssueCommentOption": {
       "description": "CreateIssueCommentOption options for creating a comment on an issue",
@@ -23792,7 +23891,7 @@
           "x-go-name": "Body"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateIssueOption": {
       "description": "CreateIssueOption options to create one issue",
@@ -23859,7 +23958,7 @@
           "x-go-name": "Title"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateKeyOption": {
       "description": "CreateKeyOption options when creating a key",
@@ -23887,7 +23986,7 @@
           "x-go-name": "Title"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateLabelOption": {
       "description": "CreateLabelOption options for creating a label",
@@ -23922,7 +24021,7 @@
           "x-go-name": "Name"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateMilestoneOption": {
       "description": "CreateMilestoneOption options for creating a milestone",
@@ -23952,7 +24051,7 @@
           "x-go-name": "Title"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateOAuth2ApplicationOptions": {
       "description": "CreateOAuth2ApplicationOptions holds options to create an oauth2 application",
@@ -23982,7 +24081,7 @@
           "x-go-name": "SkipSecondaryAuthorization"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateOrUpdateSecretOption": {
       "description": "CreateOrUpdateSecretOption options when creating or updating secret",
@@ -24002,7 +24101,7 @@
           "x-go-name": "Description"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateOrgOption": {
       "description": "CreateOrgOption options for creating an organization",
@@ -24058,7 +24157,7 @@
           "x-go-name": "Website"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreatePullRequestOption": {
       "description": "CreatePullRequestOption options when creating a pull request",
@@ -24139,7 +24238,7 @@
           "x-go-name": "Title"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreatePullReviewComment": {
       "description": "CreatePullReviewComment represent a review comment for creation api",
@@ -24167,7 +24266,7 @@
           "x-go-name": "Path"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreatePullReviewCommentReplyOptions": {
       "description": "CreatePullReviewCommentReplyOptions are options to reply to a pull request review comment",
@@ -24178,7 +24277,7 @@
           "x-go-name": "Body"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreatePullReviewOptions": {
       "description": "CreatePullReviewOptions are options to create a pull request review",
@@ -24212,7 +24311,7 @@
           "x-go-name": "Event"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreatePushMirrorOption": {
       "type": "object",
@@ -24244,7 +24343,7 @@
           "x-go-name": "SyncOnCommit"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateReleaseOption": {
       "description": "CreateReleaseOption options when creating a release",
@@ -24288,7 +24387,7 @@
           "x-go-name": "Target"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateRepoOption": {
       "description": "CreateRepoOption options when creating repository",
@@ -24370,7 +24469,7 @@
           "x-go-name": "TrustModel"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateStatusOption": {
       "description": "CreateStatusOption holds the information needed to create a new CommitStatus for a Commit",
@@ -24406,7 +24505,7 @@
           "x-go-name": "TargetURL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateTagOption": {
       "description": "CreateTagOption options when creating a tag",
@@ -24430,7 +24529,7 @@
           "x-go-name": "Target"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateTagProtectionOption": {
       "description": "CreateTagProtectionOption options for creating a tag protection",
@@ -24458,7 +24557,7 @@
           "x-go-name": "WhitelistUsernames"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateTeamOption": {
       "description": "CreateTeamOption options for creating a team",
@@ -24524,7 +24623,7 @@
           "example": "{\"repo.actions\",\"repo.packages\",\"repo.code\":\"read\",\"repo.issues\":\"write\",\"repo.ext_issues\":\"none\",\"repo.wiki\":\"admin\",\"repo.pulls\":\"owner\",\"repo.releases\":\"none\",\"repo.projects\":\"none\",\"repo.ext_wiki\":\"none\"}"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateUserOption": {
       "description": "CreateUserOption create user options",
@@ -24599,7 +24698,7 @@
           "x-go-name": "Visibility"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateVariableOption": {
       "description": "CreateVariableOption the option when creating variable",
@@ -24619,7 +24718,7 @@
           "x-go-name": "Value"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "CreateWikiPageOptions": {
       "description": "CreateWikiPageOptions form for creating wiki",
@@ -24641,7 +24740,7 @@
           "x-go-name": "Title"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Cron": {
       "description": "Cron represents a Cron task",
@@ -24676,7 +24775,7 @@
           "x-go-name": "Schedule"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "DeleteEmailOption": {
       "description": "DeleteEmailOption options when deleting email addresses",
@@ -24691,7 +24790,7 @@
           "x-go-name": "Emails"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "DeleteFileOptions": {
       "description": "DeleteFileOptions options for deleting a file\nNote: `author` and `committer` are optional (if only one is given, it will be used for the other, otherwise the authenticated user will be used)",
@@ -24740,7 +24839,7 @@
           "x-go-name": "Signoff"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "DeployKey": {
       "description": "DeployKey a deploy key",
@@ -24792,7 +24891,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "DismissPullReviewOptions": {
       "description": "DismissPullReviewOptions are options to dismiss a pull request review",
@@ -24807,7 +24906,7 @@
           "x-go-name": "Priors"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditActionRunnerOption": {
       "type": "object",
@@ -24821,7 +24920,7 @@
           "x-go-name": "Disabled"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditAttachmentOptions": {
       "description": "EditAttachmentOptions options for editing attachments",
@@ -24833,7 +24932,7 @@
           "x-go-name": "Name"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditBranchProtectionOption": {
       "description": "EditBranchProtectionOption options for editing a branch protection",
@@ -24869,6 +24968,20 @@
           "type": "boolean",
           "x-go-name": "BlockOnRejectedReviews"
         },
+        "bypass_allowlist_teams": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "x-go-name": "BypassAllowlistTeams"
+        },
+        "bypass_allowlist_usernames": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "x-go-name": "BypassAllowlistUsernames"
+        },
         "dismiss_stale_approvals": {
           "type": "boolean",
           "x-go-name": "DismissStaleApprovals"
@@ -24877,6 +24990,10 @@
           "type": "boolean",
           "x-go-name": "EnableApprovalsWhitelist"
         },
+        "enable_bypass_allowlist": {
+          "type": "boolean",
+          "x-go-name": "EnableBypassAllowlist"
+        },
         "enable_force_push": {
           "type": "boolean",
           "x-go-name": "EnableForcePush"
@@ -24985,7 +25102,7 @@
           "x-go-name": "UnprotectedFilePatterns"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditDeadlineOption": {
       "description": "EditDeadlineOption options for creating a deadline",
@@ -25000,7 +25117,7 @@
           "x-go-name": "Deadline"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditGitHookOption": {
       "description": "EditGitHookOption options when modifying one Git hook",
@@ -25012,7 +25129,7 @@
           "x-go-name": "Content"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditHookOption": {
       "description": "EditHookOption options when modify one hook",
@@ -25055,7 +25172,7 @@
           "x-go-name": "Name"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditIssueCommentOption": {
       "description": "EditIssueCommentOption options for editing a comment",
@@ -25069,7 +25186,7 @@
           "x-go-name": "Body"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditIssueOption": {
       "description": "EditIssueOption options for editing an issue",
@@ -25133,7 +25250,7 @@
           "x-go-name": "RemoveDeadline"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditLabelOption": {
       "description": "EditLabelOption options for editing a label",
@@ -25165,7 +25282,7 @@
           "x-go-name": "Name"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditMilestoneOption": {
       "description": "EditMilestoneOption options for editing a milestone",
@@ -25197,7 +25314,7 @@
           "x-go-name": "Title"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditOrgOption": {
       "description": "EditOrgOption options for editing an organization",
@@ -25245,7 +25362,7 @@
           "x-go-name": "Website"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditPullRequestOption": {
       "description": "EditPullRequestOption options when modify pull request",
@@ -25321,7 +25438,7 @@
           "x-go-name": "RemoveDeadline"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditReactionOption": {
       "description": "EditReactionOption contain the reaction type",
@@ -25333,7 +25450,7 @@
           "x-go-name": "Reaction"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditReleaseOption": {
       "description": "EditReleaseOption options when editing a release",
@@ -25370,7 +25487,7 @@
           "x-go-name": "Target"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditRepoOption": {
       "description": "EditRepoOption options when editing a repository's properties",
@@ -25391,6 +25508,11 @@
           "type": "boolean",
           "x-go-name": "AllowMerge"
         },
+        "allow_merge_update": {
+          "description": "either `true` to allow updating pull request branch by merge, or `false` to prevent it.",
+          "type": "boolean",
+          "x-go-name": "AllowMergeUpdate"
+        },
         "allow_rebase": {
           "description": "either `true` to allow rebase-merging pull requests, or `false` to prevent rebase-merging.",
           "type": "boolean",
@@ -25441,6 +25563,11 @@
           "type": "string",
           "x-go-name": "DefaultMergeStyle"
         },
+        "default_update_style": {
+          "description": "set to an update style to be used by this repository: \"merge\" or \"rebase\".",
+          "type": "string",
+          "x-go-name": "DefaultUpdateStyle"
+        },
         "description": {
           "description": "a short description of the repository.",
           "type": "string",
@@ -25552,7 +25679,7 @@
           "x-go-name": "Website"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditTagProtectionOption": {
       "description": "EditTagProtectionOption options for editing a tag protection",
@@ -25580,7 +25707,7 @@
           "x-go-name": "WhitelistUsernames"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditTeamOption": {
       "description": "EditTeamOption options for editing a team",
@@ -25653,7 +25780,7 @@
           }
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "EditUserOption": {
       "description": "EditUserOption edit user options",
@@ -25762,7 +25889,7 @@
           "x-go-name": "Website"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Email": {
       "description": "Email an email address belonging to a user",
@@ -25795,7 +25922,7 @@
           "x-go-name": "Verified"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ExternalTracker": {
       "description": "ExternalTracker represents settings for external tracker",
@@ -25822,7 +25949,7 @@
           "x-go-name": "ExternalTrackerURL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ExternalWiki": {
       "description": "ExternalWiki represents setting for external wiki",
@@ -25834,7 +25961,7 @@
           "x-go-name": "ExternalWikiURL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "FileCommitResponse": {
       "type": "object",
@@ -25883,7 +26010,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "FileDeleteResponse": {
       "description": "FileDeleteResponse contains information about a repo's file that was deleted",
@@ -25900,7 +26027,7 @@
           "$ref": "#/definitions/PayloadCommitVerification"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "FileLinksResponse": {
       "description": "FileLinksResponse contains the links for a repo's file",
@@ -25922,7 +26049,7 @@
           "x-go-name": "Self"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "FileResponse": {
       "description": "FileResponse contains information about a repo's file",
@@ -25938,7 +26065,7 @@
           "$ref": "#/definitions/PayloadCommitVerification"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "FilesResponse": {
       "description": "FilesResponse contains information about multiple files from a repo",
@@ -25959,7 +26086,7 @@
           "$ref": "#/definitions/PayloadCommitVerification"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GPGKey": {
       "description": "GPGKey a user GPG key to sign commit and tag in repository",
@@ -26038,7 +26165,7 @@
           "x-go-name": "Verified"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GPGKeyEmail": {
       "description": "GPGKeyEmail an email attached to a GPGKey",
@@ -26055,7 +26182,7 @@
           "x-go-name": "Verified"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GeneralAPISettings": {
       "description": "GeneralAPISettings contains global api settings exposed by it",
@@ -26092,7 +26219,7 @@
           "x-go-name": "MaxResponseItems"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GeneralAttachmentSettings": {
       "description": "GeneralAttachmentSettings contains global Attachment settings exposed by API",
@@ -26121,7 +26248,7 @@
           "x-go-name": "MaxSize"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GeneralRepoSettings": {
       "description": "GeneralRepoSettings contains global repository settings exposed by API",
@@ -26158,7 +26285,7 @@
           "x-go-name": "TimeTrackingDisabled"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GeneralUISettings": {
       "description": "GeneralUISettings contains global ui settings exposed by API",
@@ -26186,7 +26313,7 @@
           "x-go-name": "DefaultTheme"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GenerateRepoOption": {
       "description": "GenerateRepoOption options when creating a repository using a template",
@@ -26257,7 +26384,7 @@
           "x-go-name": "Webhooks"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GetFilesOptions": {
       "description": "GetFilesOptions options for retrieving metadate and content of multiple files",
@@ -26272,7 +26399,7 @@
           "x-go-name": "Files"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GitBlobResponse": {
       "description": "GitBlobResponse represents a git blob",
@@ -26316,7 +26443,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GitEntry": {
       "description": "GitEntry represents a git tree",
@@ -26354,7 +26481,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GitHook": {
       "description": "GitHook represents a Git repository hook",
@@ -26376,7 +26503,7 @@
           "x-go-name": "Name"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GitObject": {
       "type": "object",
@@ -26398,7 +26525,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GitTreeResponse": {
       "description": "GitTreeResponse returns a git tree",
@@ -26440,7 +26567,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "GitignoreTemplateInfo": {
       "description": "GitignoreTemplateInfo name and text of a gitignore template",
@@ -26457,7 +26584,7 @@
           "x-go-name": "Source"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Hook": {
       "description": "Hook a hook is a web hook when one repository changed",
@@ -26521,7 +26648,7 @@
           "x-go-name": "Updated"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Identity": {
       "description": "Identity for a person's identity like an author or committer",
@@ -26538,7 +26665,7 @@
           "x-go-name": "Name"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "InternalTracker": {
       "description": "InternalTracker represents settings for internal tracker",
@@ -26560,7 +26687,7 @@
           "x-go-name": "EnableTimeTracker"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Issue": {
       "description": "Issue represents an issue in a repository",
@@ -26703,7 +26830,7 @@
           "$ref": "#/definitions/User"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "IssueConfig": {
       "type": "object",
@@ -26720,7 +26847,7 @@
           "x-go-name": "ContactLinks"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "IssueConfigContactLink": {
       "type": "object",
@@ -26738,7 +26865,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "IssueConfigValidation": {
       "type": "object",
@@ -26752,7 +26879,7 @@
           "x-go-name": "Valid"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "IssueDeadline": {
       "description": "IssueDeadline represents an issue deadline",
@@ -26764,7 +26891,7 @@
           "x-go-name": "Deadline"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "IssueFormField": {
       "description": "IssueFormField represents a form field",
@@ -26809,7 +26936,7 @@
           "x-go-name": "Visible"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "IssueLabelsOption": {
       "description": "IssueLabelsOption a collection of labels",
@@ -26822,7 +26949,7 @@
           "x-go-name": "Labels"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "IssueMeta": {
       "description": "IssueMeta basic issue information",
@@ -26843,7 +26970,7 @@
           "x-go-name": "Name"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "IssueTemplate": {
       "description": "IssueTemplate represents an issue template for a repository",
@@ -26887,14 +27014,14 @@
           "x-go-name": "Title"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "IssueTemplateStringSlice": {
       "type": "array",
       "items": {
         "type": "string"
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Label": {
       "description": "Label a label to an issue or a pr",
@@ -26937,7 +27064,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "LabelTemplate": {
       "description": "LabelTemplate info of a Label template",
@@ -26964,7 +27091,7 @@
           "x-go-name": "Name"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "LicenseTemplateInfo": {
       "description": "LicensesInfo contains information about a License",
@@ -26996,7 +27123,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "LicensesTemplateListEntry": {
       "description": "LicensesListEntry is used for the API",
@@ -27018,7 +27145,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "LockIssueOption": {
       "description": "LockIssueOption options to lock an issue",
@@ -27029,7 +27156,7 @@
           "x-go-name": "Reason"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "MarkdownOption": {
       "description": "MarkdownOption markdown options",
@@ -27052,7 +27179,7 @@
           "type": "boolean"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "MarkupOption": {
       "description": "MarkupOption markup options",
@@ -27079,7 +27206,7 @@
           "type": "boolean"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "MergePullRequestOption": {
       "description": "MergePullRequestForm form for merging Pull Request",
@@ -27130,7 +27257,7 @@
         }
       },
       "x-go-name": "MergePullRequestForm",
-      "x-go-package": "code.gitea.io/gitea/services/forms"
+      "x-go-package": "gitea.dev/services/forms"
     },
     "MergeUpstreamRequest": {
       "type": "object",
@@ -27144,7 +27271,7 @@
           "x-go-name": "FfOnly"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "MergeUpstreamResponse": {
       "type": "object",
@@ -27154,7 +27281,7 @@
           "x-go-name": "MergeStyle"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "MigrateRepoOptions": {
       "description": "MigrateRepoOptions options for migrating repository's\nthis is used to interact with api v1",
@@ -27267,7 +27394,7 @@
           "x-go-name": "Wiki"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Milestone": {
       "description": "Milestone milestone is a collection of issues on one repository",
@@ -27332,7 +27459,7 @@
           "x-go-name": "Updated"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "NewIssuePinsAllowed": {
       "description": "NewIssuePinsAllowed represents an API response that says if new Issue Pins are allowed",
@@ -27347,7 +27474,7 @@
           "x-go-name": "PullRequests"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "NodeInfo": {
       "description": "NodeInfo contains standardized way of exposing metadata about a server running one of the distributed social networks",
@@ -27386,7 +27513,7 @@
           "x-go-name": "Version"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "NodeInfoServices": {
       "description": "NodeInfoServices contains the third party sites this server can connect to via their application API",
@@ -27409,7 +27536,7 @@
           "x-go-name": "Outbound"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "NodeInfoSoftware": {
       "description": "NodeInfoSoftware contains Metadata about server software in use",
@@ -27436,7 +27563,7 @@
           "x-go-name": "Version"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "NodeInfoUsage": {
       "description": "NodeInfoUsage contains usage statistics for this server",
@@ -27458,7 +27585,7 @@
           "$ref": "#/definitions/NodeInfoUsageUsers"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "NodeInfoUsageUsers": {
       "description": "NodeInfoUsageUsers contains statistics about the users of this server",
@@ -27483,7 +27610,7 @@
           "x-go-name": "Total"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Note": {
       "description": "Note contains information related to a git note",
@@ -27498,7 +27625,7 @@
           "x-go-name": "Message"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "NotificationCount": {
       "description": "NotificationCount number of unread notifications",
@@ -27511,7 +27638,7 @@
           "x-go-name": "New"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "NotificationSubject": {
       "description": "NotificationSubject contains the notification subject (Issue/Pull/Commit)",
@@ -27566,7 +27693,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "NotificationThread": {
       "description": "NotificationThread expose Notification on API",
@@ -27606,7 +27733,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "OAuth2Application": {
       "type": "object",
@@ -27658,7 +27785,7 @@
           "x-go-name": "SkipSecondaryAuthorization"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Organization": {
       "description": "Organization represents an organization",
@@ -27727,7 +27854,7 @@
           "x-go-name": "Website"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "OrganizationPermissions": {
       "description": "OrganizationPermissions list different users permissions on an organization",
@@ -27759,7 +27886,7 @@
           "x-go-name": "IsOwner"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PRBranchInfo": {
       "description": "PRBranchInfo information about a branch",
@@ -27790,7 +27917,7 @@
           "x-go-name": "Sha"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Package": {
       "description": "Package represents a package",
@@ -27837,7 +27964,7 @@
           "x-go-name": "Version"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PackageFile": {
       "description": "PackageFile represents a package file",
@@ -27881,7 +28008,7 @@
           "x-go-name": "Size"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PayloadCommit": {
       "description": "PayloadCommit represents a commit",
@@ -27941,7 +28068,7 @@
           "$ref": "#/definitions/PayloadCommitVerification"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PayloadCommitVerification": {
       "description": "PayloadCommitVerification represents the GPG verification of a commit",
@@ -27971,7 +28098,7 @@
           "x-go-name": "Verified"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PayloadUser": {
       "description": "PayloadUser represents the author or committer of a commit",
@@ -27993,7 +28120,7 @@
           "x-go-name": "UserName"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Permission": {
       "description": "Permission represents a set of permissions",
@@ -28012,7 +28139,7 @@
           "x-go-name": "Push"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Project": {
       "description": "Project represents a project",
@@ -28073,7 +28200,7 @@
           "x-go-name": "Updated"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PublicKey": {
       "description": "PublicKey publickey is a user key to push code to repository",
@@ -28130,7 +28257,7 @@
           "$ref": "#/definitions/User"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PullRequest": {
       "description": "PullRequest represents a pull request",
@@ -28341,7 +28468,7 @@
           "$ref": "#/definitions/User"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PullRequestMeta": {
       "description": "PullRequestMeta PR info if an issue is a PR",
@@ -28365,7 +28492,7 @@
           "x-go-name": "Merged"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PullReview": {
       "description": "PullReview represents a pull request review",
@@ -28440,7 +28567,7 @@
           "$ref": "#/definitions/User"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PullReviewComment": {
       "description": "PullReviewComment represents a comment on a pull request review",
@@ -28511,7 +28638,7 @@
           "$ref": "#/definitions/User"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PullReviewRequestOptions": {
       "description": "PullReviewRequestOptions are options to add or remove pull request review requests",
@@ -28532,7 +28659,7 @@
           "x-go-name": "TeamReviewers"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "PushMirror": {
       "description": "PushMirror represents information of a push mirror",
@@ -28579,7 +28706,7 @@
           "x-go-name": "SyncOnCommit"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Reaction": {
       "description": "Reaction contain one reaction",
@@ -28599,7 +28726,7 @@
           "$ref": "#/definitions/User"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Reference": {
       "type": "object",
@@ -28619,7 +28746,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Release": {
       "description": "Release represents a repository release",
@@ -28708,7 +28835,7 @@
           "x-go-name": "ZipURL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "RenameBranchRepoOption": {
       "description": "RenameBranchRepoOption options when renaming a branch in a repository",
@@ -28724,7 +28851,7 @@
           "x-go-name": "Name"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "RenameOrgOption": {
       "description": "RenameOrgOption options when renaming an organization",
@@ -28740,7 +28867,7 @@
           "x-go-name": "NewName"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "RenameUserOption": {
       "description": "RenameUserOption options when renaming a user",
@@ -28756,7 +28883,7 @@
           "x-go-name": "NewName"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "RepoCollaboratorPermission": {
       "description": "RepoCollaboratorPermission to get repository permission for a collaborator",
@@ -28784,7 +28911,7 @@
           "$ref": "#/definitions/User"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "RepoCommit": {
       "type": "object",
@@ -28813,7 +28940,7 @@
           "$ref": "#/definitions/PayloadCommitVerification"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "RepoTopicOptions": {
       "description": "RepoTopicOptions a collection of repo topic names",
@@ -28828,7 +28955,7 @@
           "x-go-name": "Topics"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "RepoTransfer": {
       "description": "RepoTransfer represents a pending repo transfer",
@@ -28848,7 +28975,7 @@
           "x-go-name": "Teams"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Repository": {
       "description": "Repository represents a repository",
@@ -28866,6 +28993,10 @@
           "type": "boolean",
           "x-go-name": "AllowMerge"
         },
+        "allow_merge_update": {
+          "type": "boolean",
+          "x-go-name": "AllowMergeUpdate"
+        },
         "allow_rebase": {
           "type": "boolean",
           "x-go-name": "AllowRebase"
@@ -28933,6 +29064,10 @@
           "type": "string",
           "x-go-name": "DefaultTargetBranch"
         },
+        "default_update_style": {
+          "type": "string",
+          "x-go-name": "DefaultUpdateStyle"
+        },
         "description": {
           "type": "string",
           "x-go-name": "Description"
@@ -29039,6 +29174,11 @@
           "type": "string",
           "x-go-name": "MirrorInterval"
         },
+        "mirror_last_sync_at": {
+          "type": "string",
+          "format": "date-time",
+          "x-go-name": "MirrorLastSyncAt"
+        },
         "mirror_updated": {
           "type": "string",
           "format": "date-time",
@@ -29141,7 +29281,7 @@
           "x-go-name": "Website"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "RepositoryMeta": {
       "description": "RepositoryMeta basic repository information",
@@ -29165,7 +29305,7 @@
           "x-go-name": "Owner"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "RunDetails": {
       "description": "RunDetails returns workflow_dispatch runid and url",
@@ -29185,7 +29325,7 @@
           "x-go-name": "WorkflowRunID"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "SearchResults": {
       "description": "SearchResults results of a successful search",
@@ -29205,7 +29345,7 @@
           "x-go-name": "OK"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Secret": {
       "description": "Secret represents a secret",
@@ -29227,7 +29367,7 @@
           "x-go-name": "Name"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "ServerVersion": {
       "description": "ServerVersion wraps the version of the server",
@@ -29239,7 +29379,7 @@
           "x-go-name": "Version"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "StopWatch": {
       "description": "StopWatch represent a running stopwatch",
@@ -29283,7 +29423,7 @@
           "x-go-name": "Seconds"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "SubmitPullReviewOptions": {
       "description": "SubmitPullReviewOptions are options to submit a pending pull request review",
@@ -29306,7 +29446,7 @@
           "x-go-name": "Event"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Tag": {
       "description": "Tag represents a repository tag",
@@ -29341,7 +29481,7 @@
           "x-go-name": "ZipballURL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "TagProtection": {
       "description": "TagProtection represents a tag protection",
@@ -29385,7 +29525,7 @@
           "x-go-name": "WhitelistUsernames"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "Team": {
       "description": "Team represents a team in an organization",
@@ -29467,13 +29607,13 @@
           }
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "TimeStamp": {
       "description": "TimeStamp defines a timestamp",
       "type": "integer",
       "format": "int64",
-      "x-go-package": "code.gitea.io/gitea/modules/timeutil"
+      "x-go-package": "gitea.dev/modules/timeutil"
     },
     "TimelineComment": {
       "description": "TimelineComment represents a timeline comment (comment of any type) on a commit or issue",
@@ -29599,7 +29739,7 @@
           "$ref": "#/definitions/User"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "TopicName": {
       "description": "TopicName a list of repo topic names",
@@ -29614,7 +29754,7 @@
           "x-go-name": "TopicNames"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "TopicResponse": {
       "description": "TopicResponse for returning topics",
@@ -29650,7 +29790,7 @@
           "x-go-name": "Updated"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "TrackedTime": {
       "description": "TrackedTime worked time for an issue / pr",
@@ -29694,7 +29834,7 @@
           "x-go-name": "UserName"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "TransferRepoOption": {
       "description": "TransferRepoOption options when transfer a repository's ownership",
@@ -29717,7 +29857,7 @@
           "x-go-name": "TeamIDs"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "UpdateBranchProtectionPriories": {
       "description": "UpdateBranchProtectionPriories a list to update the branch protection rule priorities",
@@ -29732,7 +29872,7 @@
           "x-go-name": "IDs"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "UpdateBranchRepoOption": {
       "description": "UpdateBranchRepoOption options when updating a branch reference in a repository",
@@ -29757,7 +29897,7 @@
           "x-go-name": "OldCommitID"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "UpdateFileOptions": {
       "description": "UpdateFileOptions options for updating or creating a file\nNote: `author` and `committer` are optional (if only one is given, it will be used for the other, otherwise the authenticated user will be used)",
@@ -29816,7 +29956,7 @@
           "x-go-name": "Signoff"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "UpdateRepoAvatarOption": {
       "description": "UpdateRepoAvatarUserOption options when updating the repo avatar",
@@ -29828,7 +29968,7 @@
           "x-go-name": "Image"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "UpdateUserAvatarOption": {
       "description": "UpdateUserAvatarUserOption options when updating the user avatar",
@@ -29840,7 +29980,7 @@
           "x-go-name": "Image"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "UpdateVariableOption": {
       "description": "UpdateVariableOption the option when updating variable",
@@ -29865,7 +30005,7 @@
           "x-go-name": "Value"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "User": {
       "description": "User represents a user",
@@ -29992,7 +30132,7 @@
           "x-go-name": "Website"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "UserBadgeOption": {
       "description": "UserBadgeOption options for link between users and badges",
@@ -30010,7 +30150,7 @@
           ]
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "UserHeatmapData": {
       "description": "UserHeatmapData represents the data needed to create a heatmap",
@@ -30025,7 +30165,7 @@
           "$ref": "#/definitions/TimeStamp"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/models/activities"
+      "x-go-package": "gitea.dev/models/activities"
     },
     "UserSettings": {
       "description": "UserSettings represents user settings",
@@ -30069,7 +30209,7 @@
           "x-go-name": "Website"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "UserSettingsOptions": {
       "description": "UserSettingsOptions represents options to change user settings",
@@ -30113,7 +30253,7 @@
           "x-go-name": "Website"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "WatchInfo": {
       "description": "WatchInfo represents an API watch status of one repository",
@@ -30150,7 +30290,7 @@
           "x-go-name": "URL"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "WikiCommit": {
       "description": "WikiCommit page commit/revision",
@@ -30173,7 +30313,7 @@
           "x-go-name": "ID"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "WikiCommitList": {
       "description": "WikiCommitList commit/revision list",
@@ -30194,7 +30334,7 @@
           "x-go-name": "Count"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "WikiPage": {
       "description": "WikiPage a wiki page",
@@ -30240,7 +30380,7 @@
           "x-go-name": "Title"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     },
     "WikiPageMetaData": {
       "description": "WikiPageMetaData wiki page meta information",
@@ -30265,7 +30405,7 @@
           "x-go-name": "Title"
         }
       },
-      "x-go-package": "code.gitea.io/gitea/modules/structs"
+      "x-go-package": "gitea.dev/modules/structs"
     }
   },
   "responses": {
diff --git a/templates/swagger/v1_openapi3_json.tmpl b/templates/swagger/v1_openapi3_json.tmpl
index 33adff75e0d..0a15c8eba49 100644
--- a/templates/swagger/v1_openapi3_json.tmpl
+++ b/templates/swagger/v1_openapi3_json.tmpl
@@ -1757,7 +1757,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "AccessLevelName": {
         "enum": [
@@ -1815,7 +1815,7 @@
         },
         "title": "AccessToken represents an API access token.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionArtifact": {
         "description": "ActionArtifact represents a ActionArtifact",
@@ -1868,7 +1868,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionArtifactsResponse": {
         "description": "ActionArtifactsResponse returns ActionArtifacts",
@@ -1887,7 +1887,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionRunner": {
         "description": "ActionRunner represents a Runner",
@@ -1926,7 +1926,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionRunnerLabel": {
         "description": "ActionRunnerLabel represents a Runner Label",
@@ -1946,7 +1946,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionRunnersResponse": {
         "description": "ActionRunnersResponse returns Runners",
@@ -1965,7 +1965,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionTask": {
         "description": "ActionTask represents a ActionTask",
@@ -2040,7 +2040,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionTaskResponse": {
         "description": "ActionTaskResponse returns a ActionTask",
@@ -2061,7 +2061,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionVariable": {
         "description": "ActionVariable return value of the query API",
@@ -2095,7 +2095,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionWorkflow": {
         "description": "ActionWorkflow represents a ActionWorkflow",
@@ -2155,7 +2155,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionWorkflowJob": {
         "description": "ActionWorkflowJob represents a WorkflowJob",
@@ -2250,7 +2250,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionWorkflowJobsResponse": {
         "description": "ActionWorkflowJobsResponse returns ActionWorkflowJobs",
@@ -2269,7 +2269,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionWorkflowResponse": {
         "description": "ActionWorkflowResponse returns a ActionWorkflow",
@@ -2288,7 +2288,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionWorkflowRun": {
         "description": "ActionWorkflowRun represents a WorkflowRun",
@@ -2382,7 +2382,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionWorkflowRunsResponse": {
         "description": "ActionWorkflowRunsResponse returns ActionWorkflowRuns",
@@ -2401,7 +2401,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ActionWorkflowStep": {
         "description": "ActionWorkflowStep represents a step of a WorkflowJob",
@@ -2435,7 +2435,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Activity": {
         "properties": {
@@ -2535,7 +2535,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "AddCollaboratorOption": {
         "description": "AddCollaboratorOption options when adding a user as a collaborator of a repository",
@@ -2550,7 +2550,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "AddTimeOption": {
         "description": "AddTimeOption options for adding time to an issue",
@@ -2576,7 +2576,7 @@
           "time"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "AnnotatedTag": {
         "description": "AnnotatedTag represents an annotated tag",
@@ -2613,7 +2613,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "AnnotatedTagObject": {
         "description": "AnnotatedTagObject contains meta information of the tag object",
@@ -2636,7 +2636,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ApplyDiffPatchFileOptions": {
         "description": "ApplyDiffPatchFileOptions options for applying a diff patch\nNote: `author` and `committer` are optional (if only one is given, it will be used for the other, otherwise the authenticated user will be used)",
@@ -2684,7 +2684,7 @@
           "content"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Attachment": {
         "description": "Attachment a generic attachment",
@@ -2730,7 +2730,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Badge": {
         "description": "Badge represents a user badge",
@@ -2755,7 +2755,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Branch": {
         "description": "Branch represents a repository branch",
@@ -2809,7 +2809,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "BranchProtection": {
         "description": "BranchProtection represents a branch protection for a repository",
@@ -2850,6 +2850,20 @@
             "type": "string",
             "x-go-name": "BranchName"
           },
+          "bypass_allowlist_teams": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array",
+            "x-go-name": "BypassAllowlistTeams"
+          },
+          "bypass_allowlist_usernames": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array",
+            "x-go-name": "BypassAllowlistUsernames"
+          },
           "created_at": {
             "format": "date-time",
             "type": "string",
@@ -2863,6 +2877,10 @@
             "type": "boolean",
             "x-go-name": "EnableApprovalsWhitelist"
           },
+          "enable_bypass_allowlist": {
+            "type": "boolean",
+            "x-go-name": "EnableBypassAllowlist"
+          },
           "enable_force_push": {
             "type": "boolean",
             "x-go-name": "EnableForcePush"
@@ -2983,7 +3001,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ChangeFileOperation": {
         "description": "ChangeFileOperation for creating, updating or deleting a file",
@@ -3026,7 +3044,7 @@
           "path"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ChangeFilesOptions": {
         "description": "ChangeFilesOptions options for creating, updating or deleting multiple files\nNote: `author` and `committer` are optional (if only one is given, it will be used for the other, otherwise the authenticated user will be used)",
@@ -3078,7 +3096,7 @@
           "files"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ChangedFile": {
         "description": "ChangedFile store information about files affected by the pull request",
@@ -3136,7 +3154,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CombinedStatus": {
         "description": "CombinedStatus holds the combined state of several statuses for a single commit",
@@ -3185,7 +3203,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Comment": {
         "description": "Comment represents a comment on a commit or issue",
@@ -3253,7 +3271,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Commit": {
         "properties": {
@@ -3310,7 +3328,7 @@
         },
         "title": "Commit contains information generated from a Git commit.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CommitAffectedFiles": {
         "description": "CommitAffectedFiles store information about files affected by the commit",
@@ -3327,7 +3345,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CommitDateOptions": {
         "description": "CommitDateOptions store dates for GIT_AUTHOR_DATE and GIT_COMMITTER_DATE",
@@ -3344,7 +3362,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CommitMeta": {
         "properties": {
@@ -3367,7 +3385,7 @@
         },
         "title": "CommitMeta contains meta information of a commit in terms of API.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CommitStats": {
         "description": "CommitStats is statistics for a RepoCommit",
@@ -3392,7 +3410,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CommitStatus": {
         "description": "CommitStatus holds a single status of a single Commit",
@@ -3448,7 +3466,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CommitStatusState": {
         "enum": [
@@ -3481,7 +3499,7 @@
         },
         "title": "CommitUser contains information of a user in the context of a commit.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Compare": {
         "properties": {
@@ -3500,7 +3518,7 @@
         },
         "title": "Compare represents a comparison between two commits.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ContentsExtResponse": {
         "properties": {
@@ -3517,7 +3535,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ContentsResponse": {
         "description": "ContentsResponse contains information about a repo's entry's (dir, file, symlink, submodule) metadata and content",
@@ -3629,7 +3647,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateAccessTokenOption": {
         "description": "CreateAccessTokenOption options when create access token",
@@ -3661,7 +3679,7 @@
           "name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateActionWorkflowDispatch": {
         "description": "CreateActionWorkflowDispatch represents the payload for triggering a workflow dispatch event",
@@ -3683,7 +3701,7 @@
           "ref"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateBranchProtectionOption": {
         "description": "CreateBranchProtectionOption options for creating a branch protection",
@@ -3724,6 +3742,20 @@
             "type": "string",
             "x-go-name": "BranchName"
           },
+          "bypass_allowlist_teams": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array",
+            "x-go-name": "BypassAllowlistTeams"
+          },
+          "bypass_allowlist_usernames": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array",
+            "x-go-name": "BypassAllowlistUsernames"
+          },
           "dismiss_stale_approvals": {
             "type": "boolean",
             "x-go-name": "DismissStaleApprovals"
@@ -3732,6 +3764,10 @@
             "type": "boolean",
             "x-go-name": "EnableApprovalsWhitelist"
           },
+          "enable_bypass_allowlist": {
+            "type": "boolean",
+            "x-go-name": "EnableBypassAllowlist"
+          },
           "enable_force_push": {
             "type": "boolean",
             "x-go-name": "EnableForcePush"
@@ -3845,7 +3881,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateBranchRepoOption": {
         "description": "CreateBranchRepoOption options when creating a branch in a repository",
@@ -3874,7 +3910,7 @@
           "new_branch_name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateEmailOption": {
         "description": "CreateEmailOption options when creating email addresses",
@@ -3889,7 +3925,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateFileOptions": {
         "description": "CreateFileOptions options for creating a file\nNote: `author` and `committer` are optional (if only one is given, it will be used for the other, otherwise the authenticated user will be used)",
@@ -3938,7 +3974,7 @@
           "content"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateForkOption": {
         "description": "CreateForkOption options for creating a fork",
@@ -3955,7 +3991,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateGPGKeyOption": {
         "description": "CreateGPGKeyOption options create user GPG key",
@@ -3976,7 +4012,7 @@
           "armored_public_key"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateHookOption": {
         "description": "CreateHookOption options when create a hook",
@@ -4034,7 +4070,7 @@
           "config"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateHookOptionConfig": {
         "additionalProperties": {
@@ -4042,7 +4078,7 @@
         },
         "description": "CreateHookOptionConfig has all config options in it\nrequired are \"content_type\" and \"url\" Required",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateIssueCommentOption": {
         "description": "CreateIssueCommentOption options for creating a comment on an issue",
@@ -4056,7 +4092,7 @@
           "body"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateIssueOption": {
         "description": "CreateIssueOption options to create one issue",
@@ -4124,7 +4160,7 @@
           "title"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateKeyOption": {
         "description": "CreateKeyOption options when creating a key",
@@ -4152,7 +4188,7 @@
           "key"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateLabelOption": {
         "description": "CreateLabelOption options for creating a label",
@@ -4187,7 +4223,7 @@
           "color"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateMilestoneOption": {
         "description": "CreateMilestoneOption options for creating a milestone",
@@ -4212,7 +4248,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateOAuth2ApplicationOptions": {
         "description": "CreateOAuth2ApplicationOptions holds options to create an oauth2 application",
@@ -4242,7 +4278,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateOrUpdateSecretOption": {
         "description": "CreateOrUpdateSecretOption options when creating or updating secret",
@@ -4262,7 +4298,7 @@
           "data"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateOrgOption": {
         "description": "CreateOrgOption options for creating an organization",
@@ -4315,7 +4351,7 @@
           "username"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreatePullRequestOption": {
         "description": "CreatePullRequestOption options when creating a pull request",
@@ -4396,7 +4432,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreatePullReviewComment": {
         "description": "CreatePullReviewComment represent a review comment for creation api",
@@ -4424,7 +4460,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreatePullReviewCommentReplyOptions": {
         "description": "CreatePullReviewCommentReplyOptions are options to reply to a pull request review comment",
@@ -4435,7 +4471,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreatePullReviewOptions": {
         "description": "CreatePullReviewOptions are options to create a pull request review",
@@ -4460,7 +4496,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreatePushMirrorOption": {
         "properties": {
@@ -4492,7 +4528,7 @@
         },
         "title": "CreatePushMirrorOption represents need information to create a push mirror of a repository.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateReleaseOption": {
         "description": "CreateReleaseOption options when creating a release",
@@ -4536,7 +4572,7 @@
           "tag_name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateRepoOption": {
         "description": "CreateRepoOption options when creating repository",
@@ -4616,7 +4652,7 @@
           "name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateStatusOption": {
         "description": "CreateStatusOption holds the information needed to create a new CommitStatus for a Commit",
@@ -4647,7 +4683,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateTagOption": {
         "description": "CreateTagOption options when creating a tag",
@@ -4671,7 +4707,7 @@
           "tag_name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateTagProtectionOption": {
         "description": "CreateTagProtectionOption options for creating a tag protection",
@@ -4699,7 +4735,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateTeamOption": {
         "description": "CreateTeamOption options for creating a team",
@@ -4758,7 +4794,7 @@
           "name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateUserOption": {
         "description": "CreateUserOption create user options",
@@ -4830,7 +4866,7 @@
           "email"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateVariableOption": {
         "description": "CreateVariableOption the option when creating variable",
@@ -4850,7 +4886,7 @@
           "value"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "CreateWikiPageOptions": {
         "description": "CreateWikiPageOptions form for creating wiki",
@@ -4872,7 +4908,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Cron": {
         "description": "Cron represents a Cron task",
@@ -4907,7 +4943,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "DeleteEmailOption": {
         "description": "DeleteEmailOption options when deleting email addresses",
@@ -4922,7 +4958,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "DeleteFileOptions": {
         "description": "DeleteFileOptions options for deleting a file\nNote: `author` and `committer` are optional (if only one is given, it will be used for the other, otherwise the authenticated user will be used)",
@@ -4971,7 +5007,7 @@
           "sha"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "DeployKey": {
         "description": "DeployKey a deploy key",
@@ -5024,7 +5060,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "DismissPullReviewOptions": {
         "description": "DismissPullReviewOptions are options to dismiss a pull request review",
@@ -5039,7 +5075,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditActionRunnerOption": {
         "properties": {
@@ -5053,7 +5089,7 @@
         ],
         "title": "EditActionRunnerOption represents the editable fields for a runner.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditAttachmentOptions": {
         "description": "EditAttachmentOptions options for editing attachments",
@@ -5065,7 +5101,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditBranchProtectionOption": {
         "description": "EditBranchProtectionOption options for editing a branch protection",
@@ -5100,6 +5136,20 @@
             "type": "boolean",
             "x-go-name": "BlockOnRejectedReviews"
           },
+          "bypass_allowlist_teams": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array",
+            "x-go-name": "BypassAllowlistTeams"
+          },
+          "bypass_allowlist_usernames": {
+            "items": {
+              "type": "string"
+            },
+            "type": "array",
+            "x-go-name": "BypassAllowlistUsernames"
+          },
           "dismiss_stale_approvals": {
             "type": "boolean",
             "x-go-name": "DismissStaleApprovals"
@@ -5108,6 +5158,10 @@
             "type": "boolean",
             "x-go-name": "EnableApprovalsWhitelist"
           },
+          "enable_bypass_allowlist": {
+            "type": "boolean",
+            "x-go-name": "EnableBypassAllowlist"
+          },
           "enable_force_push": {
             "type": "boolean",
             "x-go-name": "EnableForcePush"
@@ -5217,7 +5271,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditDeadlineOption": {
         "description": "EditDeadlineOption options for creating a deadline",
@@ -5232,7 +5286,7 @@
           "due_date"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditGitHookOption": {
         "description": "EditGitHookOption options when modifying one Git hook",
@@ -5244,7 +5298,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditHookOption": {
         "description": "EditHookOption options when modify one hook",
@@ -5287,7 +5341,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditIssueCommentOption": {
         "description": "EditIssueCommentOption options for editing a comment",
@@ -5301,7 +5355,7 @@
           "body"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditIssueOption": {
         "description": "EditIssueOption options for editing an issue",
@@ -5366,7 +5420,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditLabelOption": {
         "description": "EditLabelOption options for editing a label",
@@ -5398,7 +5452,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditMilestoneOption": {
         "description": "EditMilestoneOption options for editing a milestone",
@@ -5429,7 +5483,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditOrgOption": {
         "description": "EditOrgOption options for editing an organization",
@@ -5474,7 +5528,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditPullRequestOption": {
         "description": "EditPullRequestOption options when modify pull request",
@@ -5550,7 +5604,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditReactionOption": {
         "description": "EditReactionOption contain the reaction type",
@@ -5562,7 +5616,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditReleaseOption": {
         "description": "EditReleaseOption options when editing a release",
@@ -5599,7 +5653,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditRepoOption": {
         "description": "EditRepoOption options when editing a repository's properties",
@@ -5619,6 +5673,11 @@
             "type": "boolean",
             "x-go-name": "AllowMerge"
           },
+          "allow_merge_update": {
+            "description": "either `true` to allow updating pull request branch by merge, or `false` to prevent it.",
+            "type": "boolean",
+            "x-go-name": "AllowMergeUpdate"
+          },
           "allow_rebase": {
             "description": "either `true` to allow rebase-merging pull requests, or `false` to prevent rebase-merging.",
             "type": "boolean",
@@ -5669,6 +5728,11 @@
             "type": "string",
             "x-go-name": "DefaultMergeStyle"
           },
+          "default_update_style": {
+            "description": "set to an update style to be used by this repository: \"merge\" or \"rebase\".",
+            "type": "string",
+            "x-go-name": "DefaultUpdateStyle"
+          },
           "description": {
             "description": "a short description of the repository.",
             "type": "string",
@@ -5781,7 +5845,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditTagProtectionOption": {
         "description": "EditTagProtectionOption options for editing a tag protection",
@@ -5809,7 +5873,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditTeamOption": {
         "description": "EditTeamOption options for editing a team",
@@ -5875,7 +5939,7 @@
           "name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "EditUserOption": {
         "description": "EditUserOption edit user options",
@@ -5981,7 +6045,7 @@
           "login_name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Email": {
         "description": "Email an email address belonging to a user",
@@ -6014,7 +6078,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ExternalTracker": {
         "description": "ExternalTracker represents settings for external tracker",
@@ -6042,7 +6106,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ExternalWiki": {
         "description": "ExternalWiki represents setting for external wiki",
@@ -6055,7 +6119,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "FileCommitResponse": {
         "properties": {
@@ -6106,7 +6170,7 @@
         },
         "title": "FileCommitResponse contains information generated from a Git commit for a repo's file.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "FileDeleteResponse": {
         "description": "FileDeleteResponse contains information about a repo's file that was deleted",
@@ -6123,7 +6187,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "FileLinksResponse": {
         "description": "FileLinksResponse contains the links for a repo's file",
@@ -6145,7 +6209,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "FileResponse": {
         "description": "FileResponse contains information about a repo's file",
@@ -6161,7 +6225,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "FilesResponse": {
         "description": "FilesResponse contains information about multiple files from a repo",
@@ -6182,7 +6246,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GPGKey": {
         "description": "GPGKey a user GPG key to sign commit and tag in repository",
@@ -6261,7 +6325,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GPGKeyEmail": {
         "description": "GPGKeyEmail an email attached to a GPGKey",
@@ -6278,7 +6342,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GeneralAPISettings": {
         "description": "GeneralAPISettings contains global api settings exposed by it",
@@ -6315,7 +6379,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GeneralAttachmentSettings": {
         "description": "GeneralAttachmentSettings contains global Attachment settings exposed by API",
@@ -6344,7 +6408,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GeneralRepoSettings": {
         "description": "GeneralRepoSettings contains global repository settings exposed by API",
@@ -6381,7 +6445,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GeneralUISettings": {
         "description": "GeneralUISettings contains global ui settings exposed by API",
@@ -6409,7 +6473,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GenerateRepoOption": {
         "description": "GenerateRepoOption options when creating a repository using a template",
@@ -6480,7 +6544,7 @@
           "name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GetFilesOptions": {
         "description": "GetFilesOptions options for retrieving metadate and content of multiple files",
@@ -6495,7 +6559,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GitBlobResponse": {
         "description": "GitBlobResponse represents a git blob",
@@ -6540,7 +6604,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GitEntry": {
         "description": "GitEntry represents a git tree",
@@ -6579,7 +6643,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GitHook": {
         "description": "GitHook represents a Git repository hook",
@@ -6601,7 +6665,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GitObject": {
         "properties": {
@@ -6624,7 +6688,7 @@
         },
         "title": "GitObject represents a Git object.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GitTreeResponse": {
         "description": "GitTreeResponse returns a git tree",
@@ -6667,7 +6731,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "GitignoreTemplateInfo": {
         "description": "GitignoreTemplateInfo name and text of a gitignore template",
@@ -6684,7 +6748,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Hook": {
         "description": "Hook a hook is a web hook when one repository changed",
@@ -6748,7 +6812,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Identity": {
         "description": "Identity for a person's identity like an author or committer",
@@ -6765,7 +6829,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "InternalTracker": {
         "description": "InternalTracker represents settings for internal tracker",
@@ -6787,7 +6851,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Issue": {
         "description": "Issue represents an issue in a repository",
@@ -6926,7 +6990,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "IssueConfig": {
         "properties": {
@@ -6943,7 +7007,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "IssueConfigContactLink": {
         "properties": {
@@ -6962,7 +7026,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "IssueConfigValidation": {
         "properties": {
@@ -6976,7 +7040,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "IssueDeadline": {
         "description": "IssueDeadline represents an issue deadline",
@@ -6988,7 +7052,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "IssueFormField": {
         "description": "IssueFormField represents a form field",
@@ -7033,7 +7097,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "IssueLabelsOption": {
         "description": "IssueLabelsOption a collection of labels",
@@ -7046,7 +7110,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "IssueMeta": {
         "description": "IssueMeta basic issue information",
@@ -7067,7 +7131,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "IssueTemplate": {
         "description": "IssueTemplate represents an issue template for a repository",
@@ -7111,14 +7175,14 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "IssueTemplateStringSlice": {
         "items": {
           "type": "string"
         },
         "type": "array",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Label": {
         "description": "Label a label to an issue or a pr",
@@ -7162,7 +7226,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "LabelTemplate": {
         "description": "LabelTemplate info of a Label template",
@@ -7189,7 +7253,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "LicenseTemplateInfo": {
         "description": "LicensesInfo contains information about a License",
@@ -7222,7 +7286,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "LicensesTemplateListEntry": {
         "description": "LicensesListEntry is used for the API",
@@ -7245,7 +7309,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "LockIssueOption": {
         "description": "LockIssueOption options to lock an issue",
@@ -7256,7 +7320,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "MarkdownOption": {
         "description": "MarkdownOption markdown options",
@@ -7280,7 +7344,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "MarkupOption": {
         "description": "MarkupOption markup options",
@@ -7308,7 +7372,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "MergePullRequestOption": {
         "description": "MergePullRequestForm form for merging Pull Request",
@@ -7359,7 +7423,7 @@
         ],
         "type": "object",
         "x-go-name": "MergePullRequestForm",
-        "x-go-package": "code.gitea.io/gitea/services/forms"
+        "x-go-package": "gitea.dev/services/forms"
       },
       "MergeUpstreamRequest": {
         "properties": {
@@ -7373,7 +7437,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "MergeUpstreamResponse": {
         "properties": {
@@ -7383,7 +7447,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "MigrateRepoOptions": {
         "description": "MigrateRepoOptions options for migrating repository's\nthis is used to interact with api v1",
@@ -7497,7 +7561,7 @@
           "repo_name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Milestone": {
         "description": "Milestone milestone is a collection of issues on one repository",
@@ -7560,7 +7624,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "NewIssuePinsAllowed": {
         "description": "NewIssuePinsAllowed represents an API response that says if new Issue Pins are allowed",
@@ -7575,7 +7639,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "NodeInfo": {
         "description": "NodeInfo contains standardized way of exposing metadata about a server running one of the distributed social networks",
@@ -7614,7 +7678,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "NodeInfoServices": {
         "description": "NodeInfoServices contains the third party sites this server can connect to via their application API",
@@ -7637,7 +7701,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "NodeInfoSoftware": {
         "description": "NodeInfoSoftware contains Metadata about server software in use",
@@ -7664,7 +7728,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "NodeInfoUsage": {
         "description": "NodeInfoUsage contains usage statistics for this server",
@@ -7686,7 +7750,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "NodeInfoUsageUsers": {
         "description": "NodeInfoUsageUsers contains statistics about the users of this server",
@@ -7711,7 +7775,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Note": {
         "description": "Note contains information related to a git note",
@@ -7726,7 +7790,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "NotificationCount": {
         "description": "NotificationCount number of unread notifications",
@@ -7739,7 +7803,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "NotificationSubject": {
         "description": "NotificationSubject contains the notification subject (Issue/Pull/Commit)",
@@ -7798,7 +7862,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "NotificationThread": {
         "description": "NotificationThread expose Notification on API",
@@ -7839,7 +7903,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "OAuth2Application": {
         "properties": {
@@ -7891,7 +7955,7 @@
         },
         "title": "OAuth2Application represents an OAuth2 application.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ObjectFormatName": {
         "enum": [
@@ -7966,7 +8030,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "OrganizationPermissions": {
         "description": "OrganizationPermissions list different users permissions on an organization",
@@ -7998,7 +8062,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PRBranchInfo": {
         "description": "PRBranchInfo information about a branch",
@@ -8029,7 +8093,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Package": {
         "description": "Package represents a package",
@@ -8077,7 +8141,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PackageFile": {
         "description": "PackageFile represents a package file",
@@ -8121,7 +8185,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PayloadCommit": {
         "description": "PayloadCommit represents a commit",
@@ -8182,7 +8246,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PayloadCommitVerification": {
         "description": "PayloadCommitVerification represents the GPG verification of a commit",
@@ -8212,7 +8276,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PayloadUser": {
         "description": "PayloadUser represents the author or committer of a commit",
@@ -8234,7 +8298,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Permission": {
         "description": "Permission represents a set of permissions",
@@ -8253,7 +8317,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Project": {
         "description": "Project represents a project",
@@ -8314,7 +8378,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PublicKey": {
         "description": "PublicKey publickey is a user key to push code to repository",
@@ -8372,7 +8436,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PullRequest": {
         "description": "PullRequest represents a pull request",
@@ -8585,7 +8649,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PullRequestMeta": {
         "description": "PullRequestMeta PR info if an issue is a PR",
@@ -8610,7 +8674,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PullReview": {
         "description": "PullReview represents a pull request review",
@@ -8678,7 +8742,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PullReviewComment": {
         "description": "PullReviewComment represents a comment on a pull request review",
@@ -8751,7 +8815,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PullReviewRequestOptions": {
         "description": "PullReviewRequestOptions are options to add or remove pull request review requests",
@@ -8772,7 +8836,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "PushMirror": {
         "description": "PushMirror represents information of a push mirror",
@@ -8819,7 +8883,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Reaction": {
         "description": "Reaction contain one reaction",
@@ -8839,7 +8903,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Reference": {
         "properties": {
@@ -8860,7 +8924,7 @@
         },
         "title": "Reference represents a Git reference.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Release": {
         "description": "Release represents a repository release",
@@ -8954,7 +9018,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "RenameBranchRepoOption": {
         "description": "RenameBranchRepoOption options when renaming a branch in a repository",
@@ -8970,7 +9034,7 @@
           "name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "RenameOrgOption": {
         "description": "RenameOrgOption options when renaming an organization",
@@ -8986,7 +9050,7 @@
           "new_name"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "RenameUserOption": {
         "description": "RenameUserOption options when renaming a user",
@@ -9002,7 +9066,7 @@
           "new_username"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "RepoCollaboratorPermission": {
         "description": "RepoCollaboratorPermission to get repository permission for a collaborator",
@@ -9025,7 +9089,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "RepoCommit": {
         "properties": {
@@ -9055,7 +9119,7 @@
         },
         "title": "RepoCommit contains information of a commit in the context of a repository.",
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "RepoTopicOptions": {
         "description": "RepoTopicOptions a collection of repo topic names",
@@ -9070,7 +9134,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "RepoTransfer": {
         "description": "RepoTransfer represents a pending repo transfer",
@@ -9090,7 +9154,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "RepoWritePermission": {
         "enum": [
@@ -9115,6 +9179,10 @@
             "type": "boolean",
             "x-go-name": "AllowMerge"
           },
+          "allow_merge_update": {
+            "type": "boolean",
+            "x-go-name": "AllowMergeUpdate"
+          },
           "allow_rebase": {
             "type": "boolean",
             "x-go-name": "AllowRebase"
@@ -9184,6 +9252,10 @@
             "type": "string",
             "x-go-name": "DefaultTargetBranch"
           },
+          "default_update_style": {
+            "type": "string",
+            "x-go-name": "DefaultUpdateStyle"
+          },
           "description": {
             "type": "string",
             "x-go-name": "Description"
@@ -9292,6 +9364,11 @@
             "type": "string",
             "x-go-name": "MirrorInterval"
           },
+          "mirror_last_sync_at": {
+            "format": "date-time",
+            "type": "string",
+            "x-go-name": "MirrorLastSyncAt"
+          },
           "mirror_updated": {
             "format": "date-time",
             "type": "string",
@@ -9396,7 +9473,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "RepositoryMeta": {
         "description": "RepositoryMeta basic repository information",
@@ -9420,7 +9497,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ReviewStateType": {
         "enum": [
@@ -9452,7 +9529,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "SearchResults": {
         "description": "SearchResults results of a successful search",
@@ -9472,7 +9549,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Secret": {
         "description": "Secret represents a secret",
@@ -9494,7 +9571,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "ServerVersion": {
         "description": "ServerVersion wraps the version of the server",
@@ -9506,7 +9583,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "StateType": {
         "enum": [
@@ -9557,7 +9634,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "SubmitPullReviewOptions": {
         "description": "SubmitPullReviewOptions are options to submit a pending pull request review",
@@ -9571,7 +9648,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Tag": {
         "description": "Tag represents a repository tag",
@@ -9608,7 +9685,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "TagProtection": {
         "description": "TagProtection represents a tag protection",
@@ -9652,7 +9729,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "Team": {
         "description": "Team represents a team in an organization",
@@ -9725,13 +9802,13 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "TimeStamp": {
         "description": "TimeStamp defines a timestamp",
         "format": "int64",
         "type": "integer",
-        "x-go-package": "code.gitea.io/gitea/modules/timeutil"
+        "x-go-package": "gitea.dev/modules/timeutil"
       },
       "TimelineComment": {
         "description": "TimelineComment represents a timeline comment (comment of any type) on a commit or issue",
@@ -9860,7 +9937,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "TopicName": {
         "description": "TopicName a list of repo topic names",
@@ -9875,7 +9952,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "TopicResponse": {
         "description": "TopicResponse for returning topics",
@@ -9911,7 +9988,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "TrackedTime": {
         "description": "TrackedTime worked time for an issue / pr",
@@ -9957,7 +10034,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "TransferRepoOption": {
         "description": "TransferRepoOption options when transfer a repository's ownership",
@@ -9980,7 +10057,7 @@
           "new_owner"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "UpdateBranchProtectionPriories": {
         "description": "UpdateBranchProtectionPriories a list to update the branch protection rule priorities",
@@ -9995,7 +10072,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "UpdateBranchRepoOption": {
         "description": "UpdateBranchRepoOption options when updating a branch reference in a repository",
@@ -10020,7 +10097,7 @@
           "new_commit_id"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "UpdateFileOptions": {
         "description": "UpdateFileOptions options for updating or creating a file\nNote: `author` and `committer` are optional (if only one is given, it will be used for the other, otherwise the authenticated user will be used)",
@@ -10079,7 +10156,7 @@
           "content"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "UpdateRepoAvatarOption": {
         "description": "UpdateRepoAvatarUserOption options when updating the repo avatar",
@@ -10091,7 +10168,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "UpdateUserAvatarOption": {
         "description": "UpdateUserAvatarUserOption options when updating the user avatar",
@@ -10103,7 +10180,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "UpdateVariableOption": {
         "description": "UpdateVariableOption the option when updating variable",
@@ -10128,7 +10205,7 @@
           "value"
         ],
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "User": {
         "description": "User represents a user",
@@ -10254,7 +10331,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "UserBadgeOption": {
         "description": "UserBadgeOption options for link between users and badges",
@@ -10272,7 +10349,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "UserHeatmapData": {
         "description": "UserHeatmapData represents the data needed to create a heatmap",
@@ -10287,7 +10364,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/models/activities"
+        "x-go-package": "gitea.dev/models/activities"
       },
       "UserSettings": {
         "description": "UserSettings represents user settings",
@@ -10331,7 +10408,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "UserSettingsOptions": {
         "description": "UserSettingsOptions represents options to change user settings",
@@ -10375,7 +10452,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "UserVisibility": {
         "enum": [
@@ -10422,7 +10499,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "WikiCommit": {
         "description": "WikiCommit page commit/revision",
@@ -10445,7 +10522,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "WikiCommitList": {
         "description": "WikiCommitList commit/revision list",
@@ -10466,7 +10543,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "WikiPage": {
         "description": "WikiPage a wiki page",
@@ -10514,7 +10591,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       },
       "WikiPageMetaData": {
         "description": "WikiPageMetaData wiki page meta information",
@@ -10541,7 +10618,7 @@
           }
         },
         "type": "object",
-        "x-go-package": "code.gitea.io/gitea/modules/structs"
+        "x-go-package": "gitea.dev/modules/structs"
       }
     },
     "securitySchemes": {
@@ -10625,6 +10702,22 @@
             "schema": {
               "type": "integer"
             }
+          },
+          {
+            "description": "sort jobs by attribute. Supported values are \"id\". Default is \"id\"",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "sort order, either \"asc\" (ascending) or \"desc\" (descending). Default is \"asc\"",
+            "in": "query",
+            "name": "order",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -10636,6 +10729,9 @@
           },
           "404": {
             "$ref": "#/components/responses/notFound"
+          },
+          "422": {
+            "$ref": "#/components/responses/validationError"
           }
         },
         "summary": "Lists all jobs",
@@ -15723,6 +15819,22 @@
             "schema": {
               "type": "integer"
             }
+          },
+          {
+            "description": "sort jobs by attribute. Supported values are \"id\". Default is \"id\"",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "sort order, either \"asc\" (ascending) or \"desc\" (descending). Default is \"asc\"",
+            "in": "query",
+            "name": "order",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -15734,6 +15846,9 @@
           },
           "404": {
             "$ref": "#/components/responses/notFound"
+          },
+          "422": {
+            "$ref": "#/components/responses/validationError"
           }
         },
         "summary": "Lists all jobs for a repository",
@@ -16521,6 +16636,22 @@
             "schema": {
               "type": "integer"
             }
+          },
+          {
+            "description": "sort jobs by attribute. Supported values are \"id\". Default is \"id\"",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "sort order, either \"asc\" (ascending) or \"desc\" (descending). Default is \"asc\"",
+            "in": "query",
+            "name": "order",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -16532,6 +16663,9 @@
           },
           "404": {
             "$ref": "#/components/responses/notFound"
+          },
+          "422": {
+            "$ref": "#/components/responses/validationError"
           }
         },
         "summary": "Lists all jobs for a workflow run",
@@ -27312,6 +27446,9 @@
           },
           "404": {
             "$ref": "#/components/responses/notFound"
+          },
+          "422": {
+            "$ref": "#/components/responses/validationError"
           }
         },
         "summary": "Sync all push mirrored repository",
@@ -30879,6 +31016,22 @@
             "schema": {
               "type": "integer"
             }
+          },
+          {
+            "description": "sort jobs by attribute. Supported values are \"id\". Default is \"id\"",
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "sort order, either \"asc\" (ascending) or \"desc\" (descending). Default is \"asc\"",
+            "in": "query",
+            "name": "order",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -30890,6 +31043,9 @@
           },
           "404": {
             "$ref": "#/components/responses/notFound"
+          },
+          "422": {
+            "$ref": "#/components/responses/validationError"
           }
         },
         "summary": "Get workflow jobs",
diff --git a/templates/user/dashboard/feeds.tmpl b/templates/user/dashboard/feeds.tmpl
index 03f03b176da..9afb61887cf 100644
--- a/templates/user/dashboard/feeds.tmpl
+++ b/templates/user/dashboard/feeds.tmpl
@@ -88,13 +88,13 @@
 					{{$repoLink := (.GetRepoLink ctx)}}
 					{{$repo := .Repo}}
 					<div class="tw-flex tw-flex-col tw-gap-1">
-						{{range $push.Commits}}
+						{{range $pushCommit := $push.Commits}}
 							{{$commitLink := printf "%s/commit/%s" $repoLink .Sha1}}
 							<div class="flex-text-block">
 								<img loading="lazy" alt class="ui avatar" src="{{$push.AvatarLink ctx .AuthorEmail}}" title="{{.AuthorName}}" width="16" height="16">
 								<a class="ui sha label" href="{{$commitLink}}">{{ShortSha .Sha1}}</a>
 								<span class="tw-inline-block tw-truncate">
-									{{ctx.RenderUtils.RenderCommitMessage .Message $repo}}
+									{{ctx.RenderUtils.RenderCommitMessage $pushCommit.Message $repo}}
 								</span>
 							</div>
 						{{end}}
@@ -107,7 +107,7 @@
 				{{else if .GetOpType.InActions "create_pull_request"}}
 					<span class="tw-inline-block tw-truncate issue title">{{index .GetIssueInfos 1 | ctx.RenderUtils.RenderIssueSimpleTitle}}</span>
 				{{else if .GetOpType.InActions "comment_issue" "approve_pull_request" "reject_pull_request" "comment_pull"}}
-					<a href="{{.GetCommentLink ctx}}" class="tw-inline-block tw-truncate tw-self-start issue title">{{(.GetIssueTitle ctx) | ctx.RenderUtils.RenderIssueSimpleTitle}}</a>
+					<a href="{{.GetCommentLink ctx}}" class="tw-inline-block tw-truncate tw-max-w-full tw-self-start issue title">{{(.GetIssueTitle ctx) | ctx.RenderUtils.RenderIssueSimpleTitle}}</a>
 					{{$comment := index .GetIssueInfos 1}}
 					{{if $comment}}
 						<div class="render-content markup truncated-markup">{{ctx.RenderUtils.MarkdownToHtml $comment}}</div>
diff --git a/templates/user/settings/account.tmpl b/templates/user/settings/account.tmpl
index aabdbbb8cbf..1b58f711ec0 100644
--- a/templates/user/settings/account.tmpl
+++ b/templates/user/settings/account.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings account")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings account")}}
 	<div class="user-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "settings.password"}}
diff --git a/templates/user/settings/actions.tmpl b/templates/user/settings/actions.tmpl
index abc54433835..5ba550abf07 100644
--- a/templates/user/settings/actions.tmpl
+++ b/templates/user/settings/actions.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings actions")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings actions")}}
 	<div class="user-setting-content">
 	{{if eq .PageType "secrets"}}
 		{{template "shared/secrets/add_list" .}}
diff --git a/templates/user/settings/actions_general.tmpl b/templates/user/settings/actions_general.tmpl
index 86ad0d1dd38..03bd449f851 100644
--- a/templates/user/settings/actions_general.tmpl
+++ b/templates/user/settings/actions_general.tmpl
@@ -1,3 +1,3 @@
-{{template "user/settings/layout_head" (dict "ctxData" .)}}
+{{template "user/settings/layout_head" (dict)}}
 {{template "shared/actions/owner_general_settings" .}}
 {{template "user/settings/layout_footer" .}}
diff --git a/templates/user/settings/appearance.tmpl b/templates/user/settings/appearance.tmpl
index 139ddab943d..ecce437af72 100644
--- a/templates/user/settings/appearance.tmpl
+++ b/templates/user/settings/appearance.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings")}}
 	<div class="user-setting-content">
 
 		<!-- Theme -->
diff --git a/templates/user/settings/applications.tmpl b/templates/user/settings/applications.tmpl
index 4f1c1bbd82e..195a2c3a57d 100644
--- a/templates/user/settings/applications.tmpl
+++ b/templates/user/settings/applications.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings applications")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings applications")}}
 	<div class="user-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "settings.manage_access_token"}}
diff --git a/templates/user/settings/applications_oauth2_edit.tmpl b/templates/user/settings/applications_oauth2_edit.tmpl
index 2858ecd0ee5..05ed2a5766d 100644
--- a/templates/user/settings/applications_oauth2_edit.tmpl
+++ b/templates/user/settings/applications_oauth2_edit.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings applications")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings applications")}}
 	<div class="user-setting-content">
 
 		{{template "user/settings/applications_oauth2_edit_form" .}}
diff --git a/templates/user/settings/blocked_users.tmpl b/templates/user/settings/blocked_users.tmpl
index e495b85f581..0d77968a421 100644
--- a/templates/user/settings/blocked_users.tmpl
+++ b/templates/user/settings/blocked_users.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings blocked_users")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings blocked_users")}}
 	<div class="user-setting-content">
 		{{template "shared/user/blocked_users" .}}
 	</div>
diff --git a/templates/user/settings/hook_new.tmpl b/templates/user/settings/hook_new.tmpl
index be21f59b9c4..b093a39cd12 100644
--- a/templates/user/settings/hook_new.tmpl
+++ b/templates/user/settings/hook_new.tmpl
@@ -1,7 +1,7 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings new webhook")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings new webhook")}}
 	<div class="user-setting-content">
 		{{$CustomHeaderTitle := ctx.Locale.Tr "repo.settings.update_webhook"}}
 		{{if .PageIsSettingsHooksNew}}{{$CustomHeaderTitle = ctx.Locale.Tr "repo.settings.add_webhook"}}{{end}}
-		{{template "webhook/new" (dict "ctxData" . "CustomHeaderTitle" $CustomHeaderTitle)}}
+		{{template "webhook/new" (dict "CustomHeaderTitle" $CustomHeaderTitle)}}
 	</div>
 {{template "user/settings/layout_footer" .}}
diff --git a/templates/user/settings/hooks.tmpl b/templates/user/settings/hooks.tmpl
index e2d18001f22..a31aba7ac60 100644
--- a/templates/user/settings/hooks.tmpl
+++ b/templates/user/settings/hooks.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings webhooks")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings webhooks")}}
 	<div class="user-setting-content">
 		{{template "repo/settings/webhook/base_list" .}}
 	</div>
diff --git a/templates/user/settings/keys.tmpl b/templates/user/settings/keys.tmpl
index e0f5e426ae4..c9678850d2f 100644
--- a/templates/user/settings/keys.tmpl
+++ b/templates/user/settings/keys.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings sshkeys")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings sshkeys")}}
 	<div class="user-setting-content">
 		{{if not ($.UserDisabledFeatures.Contains "manage_ssh_keys")}}
 			{{template "user/settings/keys_ssh" .}}
diff --git a/templates/user/settings/layout_head.tmpl b/templates/user/settings/layout_head.tmpl
index dce496e7fae..48b90782d72 100644
--- a/templates/user/settings/layout_head.tmpl
+++ b/templates/user/settings/layout_head.tmpl
@@ -1,9 +1,9 @@
-{{template "base/head" .ctxData}}
-<div role="main" aria-label="{{.ctxData.Title}}" class="page-content {{.pageClass}}">
+{{template "base/head" ctx.RootData}}
+<div role="main" aria-label="{{ctx.RootData.Title}}" class="page-content {{.pageClass}}">
 	<div class="ui container flex-container">
-		{{template "user/settings/navbar" .ctxData}}
+		{{template "user/settings/navbar" ctx.RootData}}
 		<div class="flex-container-main">
-			{{template "base/alert" .ctxData}}
+			{{template "base/alert" ctx.RootData}}
 			{{/* block: user-setting-content */}}
 
 {{if false}}{{/* to make html structure "likely" complete to prevent IDE warnings */}}
diff --git a/templates/user/settings/navbar.tmpl b/templates/user/settings/navbar.tmpl
index e2bc72ca5f9..aa634392759 100644
--- a/templates/user/settings/navbar.tmpl
+++ b/templates/user/settings/navbar.tmpl
@@ -34,7 +34,7 @@
 		</a>
 		{{end}}
 		{{if .EnableActions}}
-		<details class="item toggleable-item" {{if or .PageIsUserSettingsActionsGeneral .PageIsSharedSettingsRunners .PageIsSharedSettingsSecrets .PageIsSharedSettingsVariables}}open{{end}}>
+		<details class="item" {{if or .PageIsUserSettingsActionsGeneral .PageIsSharedSettingsRunners .PageIsSharedSettingsSecrets .PageIsSharedSettingsVariables}}open{{end}}>
 			<summary>{{ctx.Locale.Tr "actions.actions"}}</summary>
 			<div class="menu">
 				<a class="{{if .PageIsUserSettingsActionsGeneral}}active {{end}}item" href="{{AppSubUrl}}/user/settings/actions/general">
diff --git a/templates/user/settings/notifications.tmpl b/templates/user/settings/notifications.tmpl
index b57b63ac424..421bc3f0de2 100644
--- a/templates/user/settings/notifications.tmpl
+++ b/templates/user/settings/notifications.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings")}}
 	<div class="user-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "notifications"}}
diff --git a/templates/user/settings/organization.tmpl b/templates/user/settings/organization.tmpl
index 0b1873bda0f..166f34f54a2 100644
--- a/templates/user/settings/organization.tmpl
+++ b/templates/user/settings/organization.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings organization")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings organization")}}
 	<div class="user-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "settings.orgs"}}
diff --git a/templates/user/settings/packages.tmpl b/templates/user/settings/packages.tmpl
index ef4a7c8be28..1773ebbcfc5 100644
--- a/templates/user/settings/packages.tmpl
+++ b/templates/user/settings/packages.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings packages")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings packages")}}
 	<div class="user-setting-content">
 		{{template "package/shared/cleanup_rules/list" .}}
 		{{template "package/shared/cargo" .}}
diff --git a/templates/user/settings/packages_cleanup_rules_edit.tmpl b/templates/user/settings/packages_cleanup_rules_edit.tmpl
index 522b524882c..40e1a2c588a 100644
--- a/templates/user/settings/packages_cleanup_rules_edit.tmpl
+++ b/templates/user/settings/packages_cleanup_rules_edit.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings packages")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings packages")}}
 	<div class="user-setting-content">
 		{{template "package/shared/cleanup_rules/edit" .}}
 	</div>
diff --git a/templates/user/settings/packages_cleanup_rules_preview.tmpl b/templates/user/settings/packages_cleanup_rules_preview.tmpl
index d99aee4b9a4..3f3a1f07f82 100644
--- a/templates/user/settings/packages_cleanup_rules_preview.tmpl
+++ b/templates/user/settings/packages_cleanup_rules_preview.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user packages admin")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user packages admin")}}
 	<div class="user-setting-content">
 		{{template "package/shared/cleanup_rules/preview" .}}
 	</div>
diff --git a/templates/user/settings/profile.tmpl b/templates/user/settings/profile.tmpl
index 0f88f712759..bd39e0a1b4a 100644
--- a/templates/user/settings/profile.tmpl
+++ b/templates/user/settings/profile.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings profile")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings profile")}}
 	<div class="user-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "settings.public_profile"}}
diff --git a/templates/user/settings/repos.tmpl b/templates/user/settings/repos.tmpl
index e6b7d99bd7b..ae1f53b6a48 100644
--- a/templates/user/settings/repos.tmpl
+++ b/templates/user/settings/repos.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings repos")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings repos")}}
 	<div class="user-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "settings.repos"}}
diff --git a/templates/user/settings/runner_edit.tmpl b/templates/user/settings/runner_edit.tmpl
index 90c58c16da6..03e6cb4c04b 100644
--- a/templates/user/settings/runner_edit.tmpl
+++ b/templates/user/settings/runner_edit.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings runners")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings runners")}}
 	<div class="user-setting-content">
 		{{template "shared/actions/runner_edit" .}}
 	</div>
diff --git a/templates/user/settings/security/security.tmpl b/templates/user/settings/security/security.tmpl
index d9403cfc261..90e44ba9416 100644
--- a/templates/user/settings/security/security.tmpl
+++ b/templates/user/settings/security/security.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings security")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings security")}}
 	{{if not ($.UserDisabledFeatures.Contains "manage_mfa" "manage_credentials")}}
 	<div class="user-setting-content">
 		{{if not ($.UserDisabledFeatures.Contains "manage_mfa")}}
diff --git a/templates/user/settings/security/twofa_enroll.tmpl b/templates/user/settings/security/twofa_enroll.tmpl
index 6232bd7827d..76d1cfdc99c 100644
--- a/templates/user/settings/security/twofa_enroll.tmpl
+++ b/templates/user/settings/security/twofa_enroll.tmpl
@@ -1,4 +1,4 @@
-{{template "user/settings/layout_head" (dict "ctxData" . "pageClass" "user settings twofa")}}
+{{template "user/settings/layout_head" (dict "pageClass" "user settings twofa")}}
 	<div class="user-setting-content">
 		<h4 class="ui top attached header">
 			{{ctx.Locale.Tr "settings.twofa_enroll"}}
diff --git a/templates/webhook/new.tmpl b/templates/webhook/new.tmpl
index b83499aa9cc..2cded883655 100644
--- a/templates/webhook/new.tmpl
+++ b/templates/webhook/new.tmpl
@@ -2,24 +2,24 @@
 	{{.CustomHeaderTitle}}
 	<div class="ui right type dropdown">
 		<div class="text flex-text-inline">
-			{{template "shared/webhook/icon" (dict "Size" 20 "HookType" .ctxData.HookType)}}
-			{{ctx.Locale.Tr (print "repo.settings.web_hook_name_" .ctxData.HookType)}}
+			{{template "shared/webhook/icon" (dict "Size" 20 "HookType" ctx.RootData.HookType)}}
+			{{ctx.Locale.Tr (print "repo.settings.web_hook_name_" ctx.RootData.HookType)}}
 		</div>
 		{{svg "octicon-triangle-down" 14 "dropdown icon"}}
-		{{template "repo/settings/webhook/link_menu" .ctxData}}
+		{{template "repo/settings/webhook/link_menu" ctx.RootData}}
 	</div>
 </h4>
 <div class="ui attached segment">
-	{{template "repo/settings/webhook/gitea" .ctxData}}
-	{{template "repo/settings/webhook/gogs" .ctxData}}
-	{{template "repo/settings/webhook/slack" .ctxData}}
-	{{template "repo/settings/webhook/discord" .ctxData}}
-	{{template "repo/settings/webhook/dingtalk" .ctxData}}
-	{{template "repo/settings/webhook/telegram" .ctxData}}
-	{{template "repo/settings/webhook/msteams" .ctxData}}
-	{{template "repo/settings/webhook/feishu" .ctxData}}
-	{{template "repo/settings/webhook/matrix" .ctxData}}
-	{{template "repo/settings/webhook/wechatwork" .ctxData}}
-	{{template "repo/settings/webhook/packagist" .ctxData}}
+	{{template "repo/settings/webhook/gitea" ctx.RootData}}
+	{{template "repo/settings/webhook/gogs" ctx.RootData}}
+	{{template "repo/settings/webhook/slack" ctx.RootData}}
+	{{template "repo/settings/webhook/discord" ctx.RootData}}
+	{{template "repo/settings/webhook/dingtalk" ctx.RootData}}
+	{{template "repo/settings/webhook/telegram" ctx.RootData}}
+	{{template "repo/settings/webhook/msteams" ctx.RootData}}
+	{{template "repo/settings/webhook/feishu" ctx.RootData}}
+	{{template "repo/settings/webhook/matrix" ctx.RootData}}
+	{{template "repo/settings/webhook/wechatwork" ctx.RootData}}
+	{{template "repo/settings/webhook/packagist" ctx.RootData}}
 </div>
-{{template "repo/settings/webhook/history" .ctxData}}
+{{template "repo/settings/webhook/history" ctx.RootData}}
diff --git a/tests/e2e/events.test.ts b/tests/e2e/events.test.ts
index c7cfef6e9c2..54b4774a5cc 100644
--- a/tests/e2e/events.test.ts
+++ b/tests/e2e/events.test.ts
@@ -12,7 +12,7 @@ test.describe('events', () => {
 
     // Create repo and login in parallel — repo is needed for the issue, login for the event stream
     await Promise.all([
-      apiCreateRepo(request, {name: repoName, headers: apiUserHeaders(owner)}),
+      apiCreateRepo(request, {name: repoName, autoInit: false, headers: apiUserHeaders(owner)}),
       loginUser(page, owner),
     ]);
     await page.goto('/');
@@ -36,7 +36,7 @@ test.describe('events', () => {
     await Promise.all([
       loginUser(page, name),
       (async () => {
-        await apiCreateRepo(request, {name, headers});
+        await apiCreateRepo(request, {name, autoInit: false, headers});
         await apiCreateIssue(request, {owner: name, repo: name, title: 'events stopwatch test', headers});
         await apiStartStopwatch(request, name, name, 1, {headers});
       })(),
diff --git a/tests/e2e/fork.test.ts b/tests/e2e/fork.test.ts
new file mode 100644
index 00000000000..77ccda1242e
--- /dev/null
+++ b/tests/e2e/fork.test.ts
@@ -0,0 +1,18 @@
+import {env} from 'node:process';
+import {test, expect} from '@playwright/test';
+import {login, apiCreateRepo, apiCreateUser, apiUserHeaders, randomString} from './utils.ts';
+
+test('fork a repository', async ({page, request}) => {
+  const upstream = `fork-owner-${randomString(8)}`;
+  const repoName = `e2e-fork-${randomString(8)}`;
+  await apiCreateUser(request, upstream);
+  await Promise.all([
+    apiCreateRepo(request, {name: repoName, headers: apiUserHeaders(upstream)}),
+    login(page),
+  ]);
+  await page.goto(`/${upstream}/${repoName}/fork`);
+
+  await page.getByRole('button', {name: 'Fork Repository'}).click();
+  await page.waitForURL(new RegExp(`/${env.GITEA_TEST_E2E_USER}/${repoName}$`));
+  await expect(page.getByRole('link', {name: `${upstream}/${repoName}`})).toBeVisible();
+});
diff --git a/tests/e2e/issue-comment.test.ts b/tests/e2e/issue-comment.test.ts
new file mode 100644
index 00000000000..414e0567ce2
--- /dev/null
+++ b/tests/e2e/issue-comment.test.ts
@@ -0,0 +1,26 @@
+import {env} from 'node:process';
+import {test, expect} from '@playwright/test';
+import {login, apiCreateRepo, apiCreateIssue, randomString} from './utils.ts';
+
+test('comment on and close an issue', async ({page, request}) => {
+  const repoName = `e2e-issue-comment-${randomString(8)}`;
+  const owner = env.GITEA_TEST_E2E_USER;
+  await apiCreateRepo(request, {name: repoName, autoInit: false});
+  await Promise.all([
+    apiCreateIssue(request, {owner, repo: repoName, title: 'Comment test'}),
+    login(page),
+  ]);
+  await page.goto(`/${owner}/${repoName}/issues/1`);
+
+  const body = `e2e-comment-${randomString(8)}`;
+  await page.getByPlaceholder('Leave a comment').fill(body);
+  // exact match: the status button reads "Close with Comment" while the box has content, which substring-matches "Comment"
+  await page.getByRole('button', {name: 'Comment', exact: true}).click();
+  await expect(page.locator('.comment-body').filter({hasText: body})).toBeVisible();
+
+  // wait for the form to re-initialize (the empty box disables the comment button); a close click
+  // before that does a native submit which lands on a raw JSON page instead of reloading the issue
+  await expect(page.getByRole('button', {name: 'Comment', exact: true})).toBeDisabled();
+  await page.getByRole('button', {name: 'Close Issue'}).click();
+  await expect(page.getByRole('button', {name: 'Reopen Issue'})).toBeVisible();
+});
diff --git a/tests/e2e/issue-project.test.ts b/tests/e2e/issue-project.test.ts
index b1fed72a6f9..1595cfadc5a 100644
--- a/tests/e2e/issue-project.test.ts
+++ b/tests/e2e/issue-project.test.ts
@@ -5,7 +5,7 @@ import {login, apiCreateRepo, apiCreateIssue, apiDeleteRepo, createProject, crea
 test('assign issue to project and change column', async ({page}) => {
   const repoName = `e2e-issue-project-${randomString(8)}`;
   const user = env.GITEA_TEST_E2E_USER;
-  await Promise.all([login(page), apiCreateRepo(page.request, {name: repoName})]);
+  await Promise.all([login(page), apiCreateRepo(page.request, {name: repoName, autoInit: false})]);
   await page.goto(`/${user}/${repoName}/projects/new`);
   await page.locator('input[name="title"]').fill('Kanban Board');
   await page.getByRole('button', {name: 'Create Project'}).click();
@@ -33,7 +33,7 @@ test('create a project', async ({page}) => {
   const projectTitle = 'Test Project';
 
   await login(page);
-  await apiCreateRepo(page.request, {name: repoName});
+  await apiCreateRepo(page.request, {name: repoName, autoInit: false});
 
   try {
     // Navigate to new project page
@@ -62,7 +62,7 @@ test('assign issue to multiple projects via sidebar', async ({page}) => {
   const issueTitle = 'Test issue for multiple projects';
 
   await login(page);
-  await apiCreateRepo(page.request, {name: repoName});
+  await apiCreateRepo(page.request, {name: repoName, autoInit: false});
 
   try {
     // Create two projects via UI
@@ -112,7 +112,7 @@ test('create issue with multiple projects pre-selected', async ({page}) => {
   const issueTitle = 'Issue with multiple projects';
 
   await login(page);
-  await apiCreateRepo(page.request, {name: repoName});
+  await apiCreateRepo(page.request, {name: repoName, autoInit: false});
 
   try {
     // Create two projects via UI
@@ -163,7 +163,7 @@ test('filter issues by multiple projects in issue list', async ({page}) => {
   const project2Title = 'Filter Project B';
 
   await login(page);
-  await apiCreateRepo(page.request, {name: repoName});
+  await apiCreateRepo(page.request, {name: repoName, autoInit: false});
 
   try {
     // Create two projects via UI
@@ -229,7 +229,7 @@ test('remove issue from one project keeping others', async ({page}) => {
   const issueTitle = 'Issue to modify projects';
 
   await login(page);
-  await apiCreateRepo(page.request, {name: repoName});
+  await apiCreateRepo(page.request, {name: repoName, autoInit: false});
 
   try {
     // Create two projects via UI
@@ -288,7 +288,7 @@ test('filter issues with no project using project=-1', async ({page}) => {
   const projectTitle = 'Some Project';
 
   await login(page);
-  await apiCreateRepo(page.request, {name: repoName});
+  await apiCreateRepo(page.request, {name: repoName, autoInit: false});
 
   try {
     // Create a project via UI
@@ -349,7 +349,7 @@ test('close project and view in closed projects list', async ({page}) => {
   const closedProjectTitle = 'Project To Close';
 
   await login(page);
-  await apiCreateRepo(page.request, {name: repoName});
+  await apiCreateRepo(page.request, {name: repoName, autoInit: false});
 
   try {
     // Create two projects via UI
@@ -404,7 +404,7 @@ test('select projects on new issue page shows in sidebar', async ({page}) => {
   const project2Title = 'Project Two';
 
   await login(page);
-  await apiCreateRepo(page.request, {name: repoName});
+  await apiCreateRepo(page.request, {name: repoName, autoInit: false});
 
   try {
     // Create two projects
diff --git a/tests/e2e/licenses.test.ts b/tests/e2e/licenses.test.ts
index b347ad95e2e..30db43c4673 100644
--- a/tests/e2e/licenses.test.ts
+++ b/tests/e2e/licenses.test.ts
@@ -5,5 +5,5 @@ test('licenses.txt', async ({page}) => {
   expect(resp?.status()).toBe(200);
   const content = await resp!.text();
   expect(content).toContain('@vue/');
-  expect(content).toContain('code.gitea.io/');
+  expect(content).toContain('gitea.dev/');
 });
diff --git a/tests/e2e/mermaid.test.ts b/tests/e2e/mermaid.test.ts
new file mode 100644
index 00000000000..1523577eaa7
--- /dev/null
+++ b/tests/e2e/mermaid.test.ts
@@ -0,0 +1,17 @@
+import {env} from 'node:process';
+import {expect, test} from '@playwright/test';
+import {apiCreateRepo, apiCreateIssue, assertNoJsError, randomString} from './utils.ts';
+
+test('mermaid diagram in issue', async ({page, request}) => {
+  const repoName = `e2e-mermaid-${randomString(8)}`;
+  const owner = env.GITEA_TEST_E2E_USER;
+  await apiCreateRepo(request, {name: repoName, autoInit: false});
+  const body = '```mermaid\nflowchart LR\n  Alpha --> Beta\n  Beta --> Gamma\n```\n';
+  const {index} = await apiCreateIssue(request, {owner, repo: repoName, title: 'mermaid test', body});
+  await page.goto(`/${owner}/${repoName}/issues/${index}`);
+
+  const svg = page.frameLocator('iframe.markup-content-iframe').locator('svg');
+  await expect(svg).toContainText(/Alpha[\s\S]*Beta[\s\S]*Gamma/);
+
+  await assertNoJsError(page);
+});
diff --git a/tests/e2e/milestone.test.ts b/tests/e2e/milestone.test.ts
index 5a688fb1282..106381e64f0 100644
--- a/tests/e2e/milestone.test.ts
+++ b/tests/e2e/milestone.test.ts
@@ -4,7 +4,7 @@ import {login, apiCreateRepo, randomString} from './utils.ts';
 
 test('create a milestone', async ({page}) => {
   const repoName = `e2e-milestone-${randomString(8)}`;
-  await Promise.all([login(page), apiCreateRepo(page.request, {name: repoName})]);
+  await Promise.all([login(page), apiCreateRepo(page.request, {name: repoName, autoInit: false})]);
   await page.goto(`/${env.GITEA_TEST_E2E_USER}/${repoName}/milestones/new`);
   await page.getByPlaceholder('Title').fill('Test Milestone');
   await page.getByRole('button', {name: 'Create Milestone'}).click();
diff --git a/tests/e2e/org.test.ts b/tests/e2e/org.test.ts
index a3d09081b81..2bf43792d36 100644
--- a/tests/e2e/org.test.ts
+++ b/tests/e2e/org.test.ts
@@ -1,5 +1,5 @@
 import {test, expect} from '@playwright/test';
-import {login, apiDeleteOrg, randomString} from './utils.ts';
+import {login, apiCreateOrg, apiCreateTeam, apiCreateUser, apiDeleteOrg, randomString} from './utils.ts';
 
 test('create an organization', async ({page}) => {
   const orgName = `e2e-org-${randomString(8)}`;
@@ -11,3 +11,24 @@ test('create an organization', async ({page}) => {
   // delete via API because of issues related to form-fetch-action
   await apiDeleteOrg(page.request, orgName);
 });
+
+test('add team member search', async ({page, request}) => {
+  const orgName = `team-add-${randomString(8)}`;
+  const teamName = `team-add-${randomString(8)}`;
+  const userName = `team-add-${randomString(8)}`;
+
+  await Promise.all([
+    (async () => {
+      await apiCreateOrg(request, orgName);
+      await apiCreateTeam(request, orgName, teamName);
+    })(),
+    apiCreateUser(request, userName),
+    login(page),
+  ]);
+
+  await page.goto(`/org/${orgName}/teams/${teamName}`);
+  const input = page.locator('#search-user-box input.prompt');
+  await input.fill(userName.slice(-6));
+  const result = page.locator('#search-user-box .results .result').first();
+  await expect(result).toContainText(userName);
+});
diff --git a/tests/e2e/pr-create.test.ts b/tests/e2e/pr-create.test.ts
new file mode 100644
index 00000000000..592512683fc
--- /dev/null
+++ b/tests/e2e/pr-create.test.ts
@@ -0,0 +1,23 @@
+import {env} from 'node:process';
+import {test, expect} from '@playwright/test';
+import {login, apiCreateRepo, apiCreateFile, randomString} from './utils.ts';
+
+test('create a pull request from the compare page', async ({page, request}) => {
+  const repoName = `e2e-pr-create-${randomString(8)}`;
+  const owner = env.GITEA_TEST_E2E_USER;
+  await apiCreateRepo(request, {name: repoName});
+  await Promise.all([
+    apiCreateFile(request, owner, repoName, 'feat.txt', 'feature content\n', {branch: 'main', newBranch: 'feat'}),
+    login(page),
+  ]);
+  // expand=1 renders the PR form directly, skipping the "New Pull Request" toggle click
+  await page.goto(`/${owner}/${repoName}/compare/main...feat?expand=1`);
+
+  const title = `e2e-pr-${randomString(8)}`;
+  await page.getByPlaceholder('Title').fill(title);
+  await page.getByRole('button', {name: 'Create Pull Request'}).click();
+
+  // commit, not full load: the PR title heading is server-rendered, so the assertion can resolve before the heavy diff/timeline finishes
+  await page.waitForURL(new RegExp(`/${owner}/${repoName}/pulls/\\d+$`), {waitUntil: 'commit'});
+  await expect(page.getByRole('heading', {name: title})).toBeVisible();
+});
diff --git a/tests/e2e/reactions.test.ts b/tests/e2e/reactions.test.ts
index 603cae8298e..a6b61837416 100644
--- a/tests/e2e/reactions.test.ts
+++ b/tests/e2e/reactions.test.ts
@@ -5,14 +5,14 @@ import {login, apiCreateRepo, apiCreateIssue, randomString} from './utils.ts';
 test('toggle issue reactions', async ({page, request}) => {
   const repoName = `e2e-reactions-${randomString(8)}`;
   const owner = env.GITEA_TEST_E2E_USER;
-  await apiCreateRepo(request, {name: repoName});
+  await apiCreateRepo(request, {name: repoName, autoInit: false});
   await Promise.all([
     apiCreateIssue(request, {owner, repo: repoName, title: 'Reaction test'}),
     login(page),
   ]);
   await page.goto(`/${owner}/${repoName}/issues/1`);
 
-  const issueComment = page.locator('.timeline-item.comment.first');
+  const issueComment = page.locator('.timeline-item.comment.issue-content-comment');
 
   const reactionPicker = issueComment.locator('.select-reaction');
   await reactionPicker.click();
diff --git a/tests/e2e/release.test.ts b/tests/e2e/release.test.ts
new file mode 100644
index 00000000000..219a16d2c5f
--- /dev/null
+++ b/tests/e2e/release.test.ts
@@ -0,0 +1,19 @@
+import {env} from 'node:process';
+import {test, expect} from '@playwright/test';
+import {login, apiCreateRepo, randomString} from './utils.ts';
+
+test('create a release', async ({page, request}) => {
+  const repoName = `e2e-release-${randomString(8)}`;
+  const owner = env.GITEA_TEST_E2E_USER;
+  await Promise.all([apiCreateRepo(request, {name: repoName}), login(page)]);
+  await page.goto(`/${owner}/${repoName}/releases/new`);
+
+  const tag = `v1.0.0-${randomString(8)}`;
+  const title = `e2e-release-${randomString(8)}`;
+  await page.getByLabel('Tag name').fill(tag);
+  await page.getByLabel('Release title').fill(title);
+  await page.getByRole('button', {name: 'Publish Release'}).click();
+
+  await page.waitForURL(new RegExp(`/${owner}/${repoName}/releases$`));
+  await expect(page.locator('.release-list-title')).toContainText(title);
+});
diff --git a/tests/e2e/repo-collab.test.ts b/tests/e2e/repo-collab.test.ts
new file mode 100644
index 00000000000..4efdc85c6a1
--- /dev/null
+++ b/tests/e2e/repo-collab.test.ts
@@ -0,0 +1,24 @@
+import {env} from 'node:process';
+import {test, expect} from '@playwright/test';
+import {apiCreateRepo, apiCreateUser, login, randomString} from './utils.ts';
+
+test('add collaborator search', async ({page, request}) => {
+  const userName = `repo-collab-${randomString(8)}`;
+  const repoName = `repo-collab-${randomString(8)}`;
+
+  await Promise.all([
+    apiCreateUser(request, userName),
+    apiCreateRepo(request, {name: repoName, autoInit: false}),
+    login(page),
+  ]);
+
+  await page.goto(`/${env.GITEA_TEST_E2E_USER}/${repoName}/settings/collaboration`);
+  const input = page.locator('#search-user-box input.prompt');
+  await input.fill(userName.slice(-6));
+  const result = page.locator('#search-user-box .results .result').first();
+  await expect(result).toContainText(userName);
+  await result.click();
+  await expect(input).toHaveValue(userName);
+  await page.getByRole('button', {name: 'Add Collaborator'}).click();
+  await expect(page.locator('body')).toContainText(userName);
+});
diff --git a/tests/e2e/repo-star-watch.test.ts b/tests/e2e/repo-star-watch.test.ts
new file mode 100644
index 00000000000..d5f84491651
--- /dev/null
+++ b/tests/e2e/repo-star-watch.test.ts
@@ -0,0 +1,20 @@
+import {test, expect} from '@playwright/test';
+import {login, apiCreateRepo, apiCreateUser, apiUserHeaders, randomString} from './utils.ts';
+
+test('star and watch a repository', async ({page, request}) => {
+  const owner = `sw-owner-${randomString(8)}`;
+  const repoName = `e2e-star-watch-${randomString(8)}`;
+  await apiCreateUser(request, owner);
+  await Promise.all([
+    apiCreateRepo(request, {name: repoName, autoInit: false, headers: apiUserHeaders(owner)}),
+    login(page),
+  ]);
+  await page.goto(`/${owner}/${repoName}`);
+
+  // exact match so "Star"/"Watch" don't also match "Unstar"/"Unwatch"
+  await page.getByRole('button', {name: 'Star', exact: true}).click();
+  await expect(page.getByRole('button', {name: 'Unstar'})).toBeVisible();
+
+  await page.getByRole('button', {name: 'Watch', exact: true}).click();
+  await expect(page.getByRole('button', {name: 'Unwatch'})).toBeVisible();
+});
diff --git a/tests/e2e/utils.ts b/tests/e2e/utils.ts
index 666b3b7f90a..8dcd6aedae2 100644
--- a/tests/e2e/utils.ts
+++ b/tests/e2e/utils.ts
@@ -47,6 +47,20 @@ export async function apiCreateRepo(requestContext: APIRequestContext, {name, au
   }), 'apiCreateRepo');
 }
 
+export async function apiCreateOrg(requestContext: APIRequestContext, name: string, {headers}: {headers?: Record<string, string>} = {}) {
+  await apiRetry(() => requestContext.post(`${baseUrl()}/api/v1/orgs`, {
+    headers: headers || apiHeaders(),
+    data: {username: name},
+  }), 'apiCreateOrg');
+}
+
+export async function apiCreateTeam(requestContext: APIRequestContext, org: string, name: string, {permission = 'read', units = ['repo.code'], headers}: {permission?: string; units?: Array<string>; headers?: Record<string, string>} = {}) {
+  await apiRetry(() => requestContext.post(`${baseUrl()}/api/v1/orgs/${org}/teams`, {
+    headers: headers || apiHeaders(),
+    data: {name, permission, units},
+  }), 'apiCreateTeam');
+}
+
 export async function apiStartStopwatch(requestContext: APIRequestContext, owner: string, repo: string, issueIndex: number, {headers}: {headers?: Record<string, string>} = {}) {
   await apiRetry(() => requestContext.post(`${baseUrl()}/api/v1/repos/${owner}/${repo}/issues/${issueIndex}/stopwatch/start`, {
     headers: headers || apiHeaders(),
diff --git a/tests/fuzz/fuzz_test.go b/tests/fuzz/fuzz_test.go
index e7b832412ab..71797796361 100644
--- a/tests/fuzz/fuzz_test.go
+++ b/tests/fuzz/fuzz_test.go
@@ -8,9 +8,9 @@ import (
 	"io"
 	"testing"
 
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/markdown"
-	"code.gitea.io/gitea/modules/setting"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/markdown"
+	"gitea.dev/modules/setting"
 )
 
 func newFuzzRenderContext() *markup.RenderContext {
diff --git a/tests/gitea-repositories-meta/user2/commits_search_test.git/config b/tests/gitea-repositories-meta/user2/commits_search_test.git/config
index bfbada5989c..6fc27333b12 100644
--- a/tests/gitea-repositories-meta/user2/commits_search_test.git/config
+++ b/tests/gitea-repositories-meta/user2/commits_search_test.git/config
@@ -3,6 +3,6 @@
 	filemode = true
 	bare = true
 [remote "origin"]
-	url = /home/mura/go/src/code.gitea.io/gitea/tests/gitea-repositories-meta/user2/commits_search_test/
+	url = /home/mura/go/src/gitea.dev/tests/gitea-repositories-meta/user2/commits_search_test/
 	fetch = +refs/*:refs/*
 	mirror = true
diff --git a/tests/integration/actions_approve_test.go b/tests/integration/actions_approve_test.go
index 1964ff44d5a..3c9f7a341c0 100644
--- a/tests/integration/actions_approve_test.go
+++ b/tests/integration/actions_approve_test.go
@@ -11,12 +11,12 @@ import (
 	"testing"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/actions_concurrency_test.go b/tests/integration/actions_concurrency_test.go
index 6460af0fd26..47b9112534a 100644
--- a/tests/integration/actions_concurrency_test.go
+++ b/tests/integration/actions_concurrency_test.go
@@ -11,20 +11,20 @@ import (
 	"testing"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	actions_web "code.gitea.io/gitea/routers/web/repo/actions"
-	actions_service "code.gitea.io/gitea/services/actions"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	webhook_module "gitea.dev/modules/webhook"
+	actions_web "gitea.dev/routers/web/repo/actions"
+	actions_service "gitea.dev/services/actions"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -1560,6 +1560,9 @@ jobs:
 		// run2 is blocked because it is blocked by workflow1's concurrency group "test-group"
 		assert.Equal(t, actions_model.StatusBlocked, run2.Status)
 
+		// complete wf1-job1
+		runner.execTask(t, w1j1Task, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
+
 		// mock time
 		fakeNow := now.Add(setting.Actions.AbandonedJobTimeout)
 		timeutil.MockSet(fakeNow)
diff --git a/tests/integration/actions_delete_run_test.go b/tests/integration/actions_delete_run_test.go
index 096921faaca..dc8f67d70e4 100644
--- a/tests/integration/actions_delete_run_test.go
+++ b/tests/integration/actions_delete_run_test.go
@@ -11,14 +11,14 @@ import (
 	"testing"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/routers/web/repo/actions"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/routers/web/repo/actions"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"github.com/stretchr/testify/assert"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
diff --git a/tests/integration/actions_inputs_test.go b/tests/integration/actions_inputs_test.go
index 9e29be34329..52f214a1c76 100644
--- a/tests/integration/actions_inputs_test.go
+++ b/tests/integration/actions_inputs_test.go
@@ -9,11 +9,11 @@ import (
 	"net/url"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/actions_job_test.go b/tests/integration/actions_job_test.go
index 3e1fd50eb58..b472d9b8e18 100644
--- a/tests/integration/actions_job_test.go
+++ b/tests/integration/actions_job_test.go
@@ -13,20 +13,20 @@ import (
 	"testing"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	actions_service "code.gitea.io/gitea/services/actions"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	actions_service "gitea.dev/services/actions"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"connectrpc.com/connect"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/actions_job_token_test.go b/tests/integration/actions_job_token_test.go
index 421dec17d92..e85201e8299 100644
--- a/tests/integration/actions_job_token_test.go
+++ b/tests/integration/actions_job_token_test.go
@@ -12,19 +12,19 @@ import (
 	"strconv"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	org_model "code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/tests"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	org_model "gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/actions_list_filter_test.go b/tests/integration/actions_list_filter_test.go
new file mode 100644
index 00000000000..65020363622
--- /dev/null
+++ b/tests/integration/actions_list_filter_test.go
@@ -0,0 +1,68 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/tests"
+
+	"github.com/PuerkitoBio/goquery"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestActionsListFilters(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	user5 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
+	session := loginUser(t, user5.Name)
+	actionsURL := fmt.Sprintf("/%s/%s/actions", user5.Name, repo.Name)
+
+	t.Run("BranchDropdownListsBranches", func(t *testing.T) {
+		req := NewRequest(t, "GET", actionsURL)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+
+		var labels []string
+		htmlDoc.doc.Find(`[data-test-id="filter-branch"] .menu a.item`).Each(func(_ int, a *goquery.Selection) {
+			labels = append(labels, strings.TrimSpace(a.Text()))
+		})
+		assert.Contains(t, labels, "master")
+	})
+
+	t.Run("FilterByBranch", func(t *testing.T) {
+		req := NewRequest(t, "GET", actionsURL+"?branch=master")
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+
+		refs := htmlDoc.doc.Find(".run-list .run-list-ref")
+		assert.Positive(t, refs.Length(), "filtered run list should not be empty")
+		refs.Each(func(_ int, sel *goquery.Selection) {
+			assert.Equal(t, "master", strings.TrimSpace(sel.Text()))
+		})
+	})
+
+	t.Run("PaginationPreservesFilters", func(t *testing.T) {
+		req := NewRequest(t, "GET", actionsURL+"?branch=master&limit=1")
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+
+		pageLinks := htmlDoc.doc.Find(".pagination a[href]")
+		assert.Positive(t, pageLinks.Length(), "pagination should be rendered")
+		pageLinks.Each(func(_ int, a *goquery.Selection) {
+			u, err := url.Parse(a.AttrOr("href", ""))
+			require.NoError(t, err)
+			assert.Equal(t, "master", u.Query().Get("branch"), "pagination link must preserve branch filter")
+		})
+	})
+}
diff --git a/tests/integration/actions_log_finalize_test.go b/tests/integration/actions_log_finalize_test.go
new file mode 100644
index 00000000000..134f96bda7b
--- /dev/null
+++ b/tests/integration/actions_log_finalize_test.go
@@ -0,0 +1,91 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"fmt"
+	"net/url"
+	"os"
+	"testing"
+
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/dbfs"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	actions_module "gitea.dev/modules/actions"
+	"gitea.dev/modules/storage"
+
+	"connectrpc.com/connect"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Regression for https://gitea.com/gitea/runner/issues/950: a runner that
+// finalizes a task with no log output sends UpdateLog{Rows:[], NoMore:true}.
+// The previous short-circuit on len(Rows)==0 skipped TransferLogs, leaving
+// an orphan dbfs_data row. Verify the row is now archived and removed.
+func TestActionsLogFinalizeWithoutRows(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, _ *url.URL) {
+		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		session := loginUser(t, user2.Name)
+		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
+
+		apiRepo := createActionsTestRepo(t, token, "actions-finalize-no-rows", false)
+		repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiRepo.ID})
+
+		runner := newMockRunner()
+		runner.registerAsRepoRunner(t, user2.Name, repo.Name, "mock-runner", []string{"ubuntu-latest"}, false)
+
+		const wfTreePath = ".gitea/workflows/finalize-no-rows.yml"
+		wfFileContent := fmt.Sprintf(`name: finalize-no-rows
+on:
+  push:
+    paths:
+      - '%s'
+jobs:
+  job1:
+    runs-on: ubuntu-latest
+    steps:
+      - run: noop
+`, wfTreePath)
+		createWorkflowFile(t, token, user2.Name, repo.Name, wfTreePath, getWorkflowCreateFileOptions(user2, repo.DefaultBranch, "trigger", wfFileContent))
+
+		task := runner.fetchTask(t)
+
+		resp, err := runner.client.runnerServiceClient.UpdateLog(t.Context(), connect.NewRequest(&runnerv1.UpdateLogRequest{
+			TaskId: task.Id,
+			Index:  0,
+			Rows:   nil,
+			NoMore: true,
+		}))
+		require.NoError(t, err)
+		assert.EqualValues(t, 0, resp.Msg.AckIndex)
+
+		freshTask := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionTask{ID: task.Id})
+		require.True(t, freshTask.LogInStorage, "log_in_storage must flip after empty NoMore=true")
+
+		_, err = storage.Actions.Stat(freshTask.LogFilename)
+		assert.NoError(t, err, "archived log must exist in storage")
+
+		_, err = dbfs.Open(t.Context(), actions_module.DBFSPrefix+freshTask.LogFilename)
+		assert.ErrorIs(t, err, os.ErrNotExist, "DBFS row must be cleaned up after TransferLogs")
+
+		// The runner re-sends its final UpdateLog when the response was lost.
+		// A sealed log must ack the re-send and still reject new appended rows.
+		t.Run("re-sent finalize is idempotent", func(t *testing.T) {
+			finalize := &runnerv1.UpdateLogRequest{TaskId: task.Id, Index: 0, Rows: nil, NoMore: true}
+			resp, err := runner.client.runnerServiceClient.UpdateLog(t.Context(), connect.NewRequest(finalize))
+			require.NoError(t, err)
+			assert.EqualValues(t, 0, resp.Msg.AckIndex)
+
+			_, err = runner.client.runnerServiceClient.UpdateLog(t.Context(), connect.NewRequest(&runnerv1.UpdateLogRequest{
+				TaskId: task.Id, Index: 0, Rows: []*runnerv1.LogRow{{Content: "late"}}, NoMore: true,
+			}))
+			require.Error(t, err, "appending rows past the seal must be rejected")
+		})
+	})
+}
diff --git a/tests/integration/actions_log_test.go b/tests/integration/actions_log_test.go
index 4a48f865bc8..a8cbc130580 100644
--- a/tests/integration/actions_log_test.go
+++ b/tests/integration/actions_log_test.go
@@ -11,16 +11,16 @@ import (
 	"testing"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/test"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/test"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"github.com/stretchr/testify/assert"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
diff --git a/tests/integration/actions_rerun_test.go b/tests/integration/actions_rerun_test.go
index 24c2d726ebd..b088a2379a0 100644
--- a/tests/integration/actions_rerun_test.go
+++ b/tests/integration/actions_rerun_test.go
@@ -11,20 +11,20 @@ import (
 	"testing"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/actions/jobparser"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/timeutil"
-	actions_web "code.gitea.io/gitea/routers/web/repo/actions"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/actions/jobparser"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/timeutil"
+	actions_web "gitea.dev/routers/web/repo/actions"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
diff --git a/tests/integration/actions_reusable_workflow_test.go b/tests/integration/actions_reusable_workflow_test.go
new file mode 100644
index 00000000000..39e14b6d7da
--- /dev/null
+++ b/tests/integration/actions_reusable_workflow_test.go
@@ -0,0 +1,782 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestActionsReusableWorkflow(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		user2Session := loginUser(t, user2.Name)
+		user2Token := getTokenForLoggedInUser(t, user2Session, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
+		user4 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
+		user4Session := loginUser(t, user4.Name)
+		user4Token := getTokenForLoggedInUser(t, user4Session, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
+
+		t.Run("Same-repo reusable workflow", func(t *testing.T) {
+			apiRepo := createActionsTestRepo(t, user2Token, "workflow-call-test", false)
+			repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiRepo.ID})
+
+			defaultRunner := newMockRunner()
+			defaultRunner.registerAsRepoRunner(t, repo.OwnerName, repo.Name, "mock-default-runner", []string{"ubuntu-latest"}, false)
+			customRunner := newMockRunner()
+			customRunner.registerAsRepoRunner(t, repo.OwnerName, repo.Name, "mock-custom-runner", []string{"custom-os"}, false)
+
+			// add a variable for test
+			req := NewRequestWithJSON(t, "POST",
+				fmt.Sprintf("/api/v1/repos/%s/%s/actions/variables/myvar", repo.OwnerName, repo.Name), &api.CreateVariableOption{
+					Value: "abcdef",
+				}).
+				AddTokenAuth(user2Token)
+			MakeRequest(t, req, http.StatusCreated)
+			// add a secret for test
+			req = NewRequestWithJSON(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/%s/actions/secrets/mysecret", repo.OwnerName, repo.Name), api.CreateOrUpdateSecretOption{
+				Data: "secRET-t0Ken",
+			}).AddTokenAuth(user2Token)
+			MakeRequest(t, req, http.StatusCreated)
+
+			createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/reusable1.yaml",
+				`name: Reusable1
+on:
+  workflow_call:
+    inputs:
+      str_input:
+        type: string
+      num_input:
+       type: number
+      bool_input:
+       type: boolean
+      parent_var:
+        type: string
+      needs_out:
+        type: string
+    secrets:
+      PARENT_TOKEN:
+    outputs:
+      r1_out:
+        value: ${{ jobs.reusable1_job2.outputs.r1j2_out }}
+
+jobs:
+  reusable1_job1:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo 'reusable1_job1'
+
+  reusable1_job2:
+    needs: [reusable1_job1]
+    outputs:
+      r1j2_out: ${{ steps.gen_r1j2_output.outputs.out }}
+    runs-on: custom-os
+    steps:
+      - id: gen_r1j2_output
+        run: |
+          echo "out=r1j2_out_data" >> "$GITHUB_OUTPUT"
+
+  reusable1_job3:
+    needs: [reusable1_job2]
+    uses: ./.gitea/workflows/reusable2.yaml
+    with:
+      msg: ${{ inputs.str_input }}
+`)
+
+			createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/reusable2.yaml",
+				`name: Reusable2
+on:
+  workflow_call:
+    inputs:
+      msg:
+        type: string
+
+jobs:
+  reusable2_job1:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo ${{ inputs.msg }}
+`)
+
+			createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/caller.yaml",
+				`name: Caller
+on:
+  push:
+    paths:
+      - '.gitea/workflows/caller.yaml'
+jobs:
+  caller_job1:
+    runs-on: ubuntu-latest
+    outputs:
+      prepared: ${{ steps.gen_output.outputs.pd }}
+    steps:
+      - id: gen_output
+        run: |
+          echo "pd=prepared_data" >> "$GITHUB_OUTPUT"
+
+  caller_job2:
+    needs: [caller_job1]
+    uses: './.gitea/workflows/reusable1.yaml'
+    with:
+      str_input: 'from_caller_job2'
+      num_input: ${{ 2.3e2 }}
+      bool_input: ${{ gitea.event_name == 'push' }}
+      parent_var: ${{ vars.myvar }}
+      needs_out: ${{ needs.caller_job1.outputs.prepared }}
+    secrets:
+      PARENT_TOKEN: ${{ secrets.mysecret }}
+
+  caller_job3:
+    needs: [caller_job2]
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          echo ${{ needs.caller_job1.outputs.r1_out }}
+`)
+
+			var (
+				runID                                int64
+				callerJob2ID, callerJob2AttemptJobID int64
+				callerJob3AttemptJobID               int64
+				r1Job2ID, r1Job2AttemptJobID         int64
+				r1Job3ID, r1Job3AttemptJobID         int64
+				r2Job1AttemptJobID                   int64
+			)
+
+			t.Run("Check initialized jobs", func(t *testing.T) {
+				// run
+				assert.Equal(t, 1, unittest.GetCount(t, &actions_model.ActionRun{RepoID: repo.ID}))
+				run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{RepoID: repo.ID})
+				runID = run.ID
+
+				// caller_job1
+				assert.Equal(t, 3, unittest.GetCount(t, &actions_model.ActionRunJob{RunID: runID}))
+				callerJob1 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "caller_job1"})
+				assert.Equal(t, actions_model.StatusWaiting, callerJob1.Status)
+				assert.False(t, callerJob1.IsReusableCaller)
+
+				// caller_job2
+				callerJob2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "caller_job2"})
+				callerJob2ID = callerJob2.ID
+				callerJob2AttemptJobID = callerJob2.AttemptJobID
+				assert.Equal(t, actions_model.StatusBlocked, callerJob2.Status)
+				assert.True(t, callerJob2.IsReusableCaller)
+
+				// caller_job3
+				callerJob3 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "caller_job3"})
+				callerJob3AttemptJobID = callerJob3.AttemptJobID
+				assert.Equal(t, actions_model.StatusBlocked, callerJob3.Status)
+				assert.False(t, callerJob3.IsReusableCaller)
+			})
+
+			t.Run("First run", func(t *testing.T) {
+				callerJob1Task := defaultRunner.fetchTask(t) // for caller_job1
+				_, callerJob1, _ := getTaskAndJobAndRunByTaskID(t, callerJob1Task.Id)
+				assert.Equal(t, "caller_job1", callerJob1.JobID)
+				defaultRunner.fetchNoTask(t)
+				defaultRunner.execTask(t, callerJob1Task, &mockTaskOutcome{
+					result: runnerv1.Result_RESULT_SUCCESS,
+					outputs: map[string]string{
+						"prepared": "prepared_data",
+					},
+				})
+
+				r1Job1Task := defaultRunner.fetchTask(t) // for reusable1_job1
+				_, r1Job1, _ := getTaskAndJobAndRunByTaskID(t, r1Job1Task.Id)
+				assert.Equal(t, "reusable1_job1", r1Job1.JobID)
+				assert.Equal(t, callerJob2ID, r1Job1.ParentJobID)
+				payload := getWorkflowCallPayloadFromTask(t, r1Job1Task)
+				if assert.Len(t, payload.Inputs, 5) {
+					assert.Equal(t, "from_caller_job2", payload.Inputs["str_input"])
+					assert.EqualValues(t, 230, payload.Inputs["num_input"])
+					assert.Equal(t, true, payload.Inputs["bool_input"])
+					assert.Equal(t, "abcdef", payload.Inputs["parent_var"])
+					assert.Equal(t, "prepared_data", payload.Inputs["needs_out"])
+				}
+				if assert.Len(t, r1Job1Task.Secrets, 3) {
+					assert.Contains(t, r1Job1Task.Secrets, "GITEA_TOKEN")
+					assert.Contains(t, r1Job1Task.Secrets, "GITHUB_TOKEN")
+					assert.Equal(t, "secRET-t0Ken", r1Job1Task.Secrets["PARENT_TOKEN"])
+				}
+				customRunner.fetchNoTask(t)
+				defaultRunner.execTask(t, r1Job1Task, &mockTaskOutcome{
+					result: runnerv1.Result_RESULT_SUCCESS,
+				})
+
+				// reusable1_job3 (a nested caller) needs reusable1_job2, so it stays Blocked until r1j2 succeeds.
+				r1Job3Pre := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "reusable1_job3"})
+				assert.Equal(t, actions_model.StatusBlocked, r1Job3Pre.Status)
+				assert.False(t, r1Job3Pre.IsExpanded)
+				assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRunJob{RunID: runID, JobID: "reusable2_job1"}))
+
+				r1Job2Task := customRunner.fetchTask(t) // for reusable1_job2
+				_, r1Job2, _ := getTaskAndJobAndRunByTaskID(t, r1Job2Task.Id)
+				assert.Equal(t, "reusable1_job2", r1Job2.JobID)
+				r1Job2ID = r1Job2.ID
+				r1Job2AttemptJobID = r1Job2.AttemptJobID
+				if assert.Len(t, r1Job2Task.Needs, 1) {
+					assert.Contains(t, r1Job2Task.Needs, "reusable1_job1")
+					assert.Equal(t, runnerv1.Result_RESULT_SUCCESS, r1Job2Task.Needs["reusable1_job1"].Result)
+				}
+				customRunner.execTask(t, r1Job2Task, &mockTaskOutcome{
+					result: runnerv1.Result_RESULT_SUCCESS,
+					outputs: map[string]string{
+						"r1j2_out": "r1j2_out_data",
+					},
+				})
+
+				// Now reusable1_job3 expands and reusable2_job1 becomes runnable.
+				r1Job3 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "reusable1_job3"})
+				assert.True(t, r1Job3.IsReusableCaller)
+				assert.True(t, r1Job3.IsExpanded)
+				assert.Equal(t, callerJob2ID, r1Job3.ParentJobID)
+				r1Job3ID = r1Job3.ID
+				r1Job3AttemptJobID = r1Job3.AttemptJobID
+				r2Job1 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, JobID: "reusable2_job1"})
+				assert.Equal(t, r1Job3ID, r2Job1.ParentJobID)
+				r2Job1AttemptJobID = r2Job1.AttemptJobID
+
+				r2Job1Task := defaultRunner.fetchTask(t) // for reusable2_job1
+				_, fetchedR2Job1, _ := getTaskAndJobAndRunByTaskID(t, r2Job1Task.Id)
+				assert.Equal(t, "reusable2_job1", fetchedR2Job1.JobID)
+				assert.Equal(t, r1Job3ID, fetchedR2Job1.ParentJobID)
+				r2Job1Payload := getWorkflowCallPayloadFromTask(t, r2Job1Task)
+				if assert.Len(t, r2Job1Payload.Inputs, 1) {
+					assert.Equal(t, "from_caller_job2", r2Job1Payload.Inputs["msg"])
+				}
+				defaultRunner.execTask(t, r2Job1Task, &mockTaskOutcome{
+					result: runnerv1.Result_RESULT_SUCCESS,
+				})
+
+				callerJob2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: callerJob2ID})
+				assert.Equal(t, actions_model.StatusSuccess, callerJob2.Status)
+
+				callerJob3Task := defaultRunner.fetchTask(t) // for caller_job3
+				_, callerJob3, _ := getTaskAndJobAndRunByTaskID(t, callerJob3Task.Id)
+				assert.Equal(t, "caller_job3", callerJob3.JobID)
+				if assert.Len(t, callerJob3Task.Needs, 1) {
+					assert.Contains(t, callerJob3Task.Needs, "caller_job2")
+					assert.Equal(t, runnerv1.Result_RESULT_SUCCESS, callerJob3Task.Needs["caller_job2"].Result)
+					if assert.Len(t, callerJob3Task.Needs["caller_job2"].Outputs, 1) {
+						assert.Equal(t, "r1j2_out_data", callerJob3Task.Needs["caller_job2"].Outputs["r1_out"])
+					}
+				}
+				defaultRunner.execTask(t, callerJob3Task, &mockTaskOutcome{
+					result: runnerv1.Result_RESULT_SUCCESS,
+				})
+				callerRun := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
+				assert.Equal(t, actions_model.StatusSuccess, callerRun.Status)
+			})
+
+			t.Run("Rerun 'reusable1_job2'", func(t *testing.T) {
+				req = NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/jobs/%d/rerun", repo.OwnerName, repo.Name, runID, r1Job2ID))
+				user2Session.MakeRequest(t, req, http.StatusOK)
+
+				run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
+				assert.Equal(t, actions_model.StatusWaiting, run.Status)
+				attempt2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunAttempt{RunID: runID, Attempt: 2})
+				assert.Equal(t, actions_model.StatusWaiting, attempt2.Status)
+				callerJob2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, AttemptJobID: callerJob2AttemptJobID})
+				assert.Equal(t, actions_model.StatusWaiting, callerJob2.Status)
+				callerJob3 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, AttemptJobID: callerJob3AttemptJobID})
+				assert.Equal(t, actions_model.StatusBlocked, callerJob3.Status)
+
+				// reusable1_job3 needs reusable1_job2, so rerunning r1j2 pulls r1j3 (and its subtree) into the rerun set
+				r1Job3Attempt2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, AttemptJobID: r1Job3AttemptJobID})
+				assert.Equal(t, actions_model.StatusBlocked, r1Job3Attempt2.Status)
+				assert.True(t, r1Job3Attempt2.IsReusableCaller)
+				assert.False(t, r1Job3Attempt2.IsExpanded)
+				assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, JobID: "reusable2_job1"}))
+
+				defaultRunner.fetchNoTask(t)
+				r1Job2Task := customRunner.fetchTask(t)
+				_, r1Job2, _ := getTaskAndJobAndRunByTaskID(t, r1Job2Task.Id)
+				assert.Equal(t, "reusable1_job2", r1Job2.JobID)
+				assert.Equal(t, callerJob2.ID, r1Job2.ParentJobID)
+				assert.Equal(t, r1Job2AttemptJobID, r1Job2.AttemptJobID)
+				assert.Equal(t, actions_model.StatusRunning, r1Job2.Status)
+				run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
+				assert.Equal(t, actions_model.StatusRunning, run.Status)
+				customRunner.execTask(t, r1Job2Task, &mockTaskOutcome{
+					result: runnerv1.Result_RESULT_SUCCESS,
+					outputs: map[string]string{
+						"r1j2_out": "r1j2_out_data_updated",
+					},
+				})
+
+				// r1j3 expands again. Its child reuses the AttemptJobID from attempt 1
+				r1Job3Attempt2 = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, AttemptJobID: r1Job3AttemptJobID})
+				assert.True(t, r1Job3Attempt2.IsExpanded)
+				r2Job1Attempt2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, JobID: "reusable2_job1"})
+				assert.Equal(t, r2Job1AttemptJobID, r2Job1Attempt2.AttemptJobID)
+				assert.Equal(t, r1Job3Attempt2.ID, r2Job1Attempt2.ParentJobID)
+
+				r2Job1Task := defaultRunner.fetchTask(t)
+				_, fetchedR2Job1, _ := getTaskAndJobAndRunByTaskID(t, r2Job1Task.Id)
+				assert.Equal(t, "reusable2_job1", fetchedR2Job1.JobID)
+				defaultRunner.execTask(t, r2Job1Task, &mockTaskOutcome{
+					result: runnerv1.Result_RESULT_SUCCESS,
+				})
+
+				callerJob2 = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: callerJob2.ID})
+				assert.Equal(t, actions_model.StatusSuccess, callerJob2.Status)
+
+				callerJob3Task := defaultRunner.fetchTask(t)
+				_, callerJob3, _ = getTaskAndJobAndRunByTaskID(t, callerJob3Task.Id)
+				assert.Equal(t, "caller_job3", callerJob3.JobID)
+				if assert.Len(t, callerJob3Task.Needs, 1) {
+					assert.Contains(t, callerJob3Task.Needs, "caller_job2")
+					assert.Equal(t, runnerv1.Result_RESULT_SUCCESS, callerJob3Task.Needs["caller_job2"].Result)
+					if assert.Len(t, callerJob3Task.Needs["caller_job2"].Outputs, 1) {
+						assert.Equal(t, "r1j2_out_data_updated", callerJob3Task.Needs["caller_job2"].Outputs["r1_out"])
+					}
+				}
+				defaultRunner.execTask(t, callerJob3Task, &mockTaskOutcome{
+					result: runnerv1.Result_RESULT_SUCCESS,
+				})
+				attempt2 = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunAttempt{RunID: runID, Attempt: 2})
+				assert.Equal(t, actions_model.StatusSuccess, attempt2.Status)
+				run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
+				assert.Equal(t, actions_model.StatusSuccess, run.Status)
+			})
+		})
+
+		t.Run("Cross-repo reusable workflow with collaborative owner", func(t *testing.T) {
+			// libRepo: private, owned by user2.
+			libAPIRepo := createActionsTestRepo(t, user2Token, "reusable-lib-private", true)
+			libRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: libAPIRepo.ID})
+			createRepoWorkflowFile(t, user2, user2Token, libRepo, ".gitea/workflows/reusable_lib.yaml",
+				`name: ReusableLib
+on:
+  workflow_call:
+    inputs:
+      from:
+        type: string
+
+jobs:
+  lib_job:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo hello-${{ inputs.from }}
+`)
+
+			// consumerRepo: private, owned by user4.
+			consumerAPIRepo := createActionsTestRepo(t, user4Token, "workflow-call-cross-repo", true)
+			consumerRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: consumerAPIRepo.ID})
+
+			runner := newMockRunner()
+			runner.registerAsRepoRunner(t, consumerRepo.OwnerName, consumerRepo.Name, "mock-cross-runner", []string{"ubuntu-latest"}, false)
+
+			createRepoWorkflowFile(t, user4, user4Token, consumerRepo, ".gitea/workflows/cross-caller.yaml",
+				`name: CrossCaller
+on: push
+jobs:
+  cross_job:
+    uses: user2/reusable-lib-private/.gitea/workflows/reusable_lib.yaml@main
+    with:
+      from: 'consumer'
+`)
+
+			// Phase 1: no grant. The cross-repo read check fails, and NO ActionRun row gets persisted.
+			assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRun{RepoID: consumerRepo.ID}))
+			runner.fetchNoTask(t)
+
+			// Phase 2: user2 (libRepo owner) adds user4 (consumer owner) as a Collaborative Owner of libRepo.
+			addCollabReq := NewRequestWithValues(t, "POST",
+				fmt.Sprintf("/%s/%s/settings/actions/general/collaborative_owner/add", libRepo.OwnerName, libRepo.Name),
+				map[string]string{"collaborative_owner": user4.Name})
+			user2Session.MakeRequest(t, addCollabReq, http.StatusOK)
+
+			// Phase 3: trigger the workflow again
+			createRepoWorkflowFile(t, user4, user4Token, consumerRepo, "marker.txt", "trigger after grant")
+
+			run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{RepoID: consumerRepo.ID})
+			crossJob := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID, JobID: "cross_job"})
+			assert.True(t, crossJob.IsReusableCaller)
+			assert.True(t, crossJob.IsExpanded)
+			assert.Equal(t, actions_model.StatusWaiting, crossJob.Status)
+
+			libJobTask := runner.fetchTask(t)
+			_, fetchedLibJob, _ := getTaskAndJobAndRunByTaskID(t, libJobTask.Id)
+			assert.Equal(t, "lib_job", fetchedLibJob.JobID)
+			assert.Equal(t, crossJob.ID, fetchedLibJob.ParentJobID)
+			assert.Equal(t, consumerRepo.ID, fetchedLibJob.RepoID)
+			payload := getWorkflowCallPayloadFromTask(t, libJobTask)
+			if assert.Len(t, payload.Inputs, 1) {
+				assert.Equal(t, "consumer", payload.Inputs["from"])
+			}
+			crossJob = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: crossJob.ID})
+			assert.Equal(t, actions_model.StatusRunning, crossJob.Status)
+			runner.execTask(t, libJobTask, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
+
+			crossJob = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{ID: crossJob.ID})
+			assert.Equal(t, actions_model.StatusSuccess, crossJob.Status)
+			run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: run.ID})
+			assert.Equal(t, actions_model.StatusSuccess, run.Status)
+		})
+
+		t.Run("Public caller denied private target even with collaborative owner", func(t *testing.T) {
+			// Isolates the run.Repo.IsPrivate gate: a public caller must be denied a private target even with a
+			// collaborative-owner grant, since allowing it would expose private workflow content in a public run.
+
+			// libRepo: private, owned by user2.
+			libAPIRepo := createActionsTestRepo(t, user2Token, "reusable-lib-public-denied", true)
+			libRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: libAPIRepo.ID})
+			createRepoWorkflowFile(t, user2, user2Token, libRepo, ".gitea/workflows/reusable_lib.yaml",
+				`name: ReusableLib
+on:
+  workflow_call:
+
+jobs:
+  lib_job:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo hello
+`)
+
+			// Grant first: user2 adds user4 as a collaborative owner of the private libRepo, so the grant is
+			// satisfied and the public-caller gate is the only thing that can deny access.
+			addCollabReq := NewRequestWithValues(t, "POST",
+				fmt.Sprintf("/%s/%s/settings/actions/general/collaborative_owner/add", libRepo.OwnerName, libRepo.Name),
+				map[string]string{"collaborative_owner": user4.Name})
+			user2Session.MakeRequest(t, addCollabReq, http.StatusOK)
+
+			// consumerRepo: public, owned by user4.
+			consumerAPIRepo := createActionsTestRepo(t, user4Token, "workflow-call-public-denied", false)
+			consumerRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: consumerAPIRepo.ID})
+
+			runner := newMockRunner()
+			runner.registerAsRepoRunner(t, consumerRepo.OwnerName, consumerRepo.Name, "mock-public-denied-runner", []string{"ubuntu-latest"}, false)
+
+			createRepoWorkflowFile(t, user4, user4Token, consumerRepo, ".gitea/workflows/cross-caller.yaml",
+				`name: CrossCaller
+on: push
+jobs:
+  cross_job:
+    uses: user2/reusable-lib-public-denied/.gitea/workflows/reusable_lib.yaml@main
+`)
+
+			// Denied: the cross-repo read check fails for the public caller, so NO ActionRun is persisted and no task is dispatched.
+			assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRun{RepoID: consumerRepo.ID}))
+			runner.fetchNoTask(t)
+		})
+
+		t.Run("Cross-repo callee with same-repo nested uses", func(t *testing.T) {
+			// A same-repo `uses: ./...` inside a cross-repo reusable callee must resolve relative to the callee's own repo (matching GitHub's behavior), not the original triggering repo.
+
+			// Place a util.yaml with a distinguishable job name in BOTH repos to detect mis-resolution.
+
+			libAPIRepo := createActionsTestRepo(t, user2Token, "reusable-lib-nested", false)
+			libRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: libAPIRepo.ID})
+			createRepoWorkflowFile(t, user2, user2Token, libRepo, ".gitea/workflows/util.yaml",
+				`name: UtilLib
+on:
+  workflow_call:
+
+jobs:
+  util_lib_job:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo from-lib
+`)
+			createRepoWorkflowFile(t, user2, user2Token, libRepo, ".gitea/workflows/lib.yaml",
+				`name: LibNested
+on:
+  workflow_call:
+
+jobs:
+  call_util_in_lib:
+    uses: ./.gitea/workflows/util.yaml
+`)
+
+			consumerAPIRepo := createActionsTestRepo(t, user4Token, "consumer-nested-uses", false)
+			consumerRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: consumerAPIRepo.ID})
+
+			// A *different* util.yaml in the consumer repo: if `./` mis-resolves we'd see this job's name.
+			createRepoWorkflowFile(t, user4, user4Token, consumerRepo, ".gitea/workflows/util.yaml",
+				`name: UtilConsumer
+on:
+  workflow_call:
+
+jobs:
+  util_consumer_job:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo from-consumer
+`)
+
+			runner := newMockRunner()
+			runner.registerAsRepoRunner(t, consumerRepo.OwnerName, consumerRepo.Name, "mock-nested-runner", []string{"ubuntu-latest"}, false)
+
+			createRepoWorkflowFile(t, user4, user4Token, consumerRepo, ".gitea/workflows/caller.yaml",
+				`name: NestedCaller
+on: push
+jobs:
+  cross_job:
+    uses: user2/reusable-lib-nested/.gitea/workflows/lib.yaml@main
+`)
+
+			run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{RepoID: consumerRepo.ID})
+			crossJob := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID, JobID: "cross_job"})
+			assert.True(t, crossJob.IsReusableCaller)
+			assert.True(t, crossJob.IsExpanded)
+
+			// cross_job's children come from libRepo/lib.yaml - their source must be libRepo + libRepo's commit.
+			libHead, err := gitrepo.GetBranchCommitID(t.Context(), libRepo, libRepo.DefaultBranch)
+			require.NoError(t, err)
+			callUtilJob := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID, JobID: "call_util_in_lib", ParentJobID: crossJob.ID})
+			assert.True(t, callUtilJob.IsReusableCaller)
+			assert.Equal(t, libRepo.ID, callUtilJob.WorkflowSourceRepoID)
+			assert.Equal(t, libHead, callUtilJob.WorkflowSourceCommitSHA)
+
+			// call_util_in_lib has `uses: ./.gitea/workflows/util.yaml`, so its children should come from libRepo/util.yaml
+			assert.True(t, callUtilJob.IsExpanded)
+			unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: run.ID, JobID: "util_lib_job", ParentJobID: callUtilJob.ID})
+			unittest.AssertNotExistsBean(t, &actions_model.ActionRunJob{RunID: run.ID, JobID: "util_consumer_job"})
+		})
+
+		t.Run("Missing callee file", func(t *testing.T) {
+			// A caller workflow references a callee path that does not exist in the repo.
+
+			apiRepo := createActionsTestRepo(t, user2Token, "caller-missing-callee", false)
+			repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiRepo.ID})
+
+			createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/caller.yaml",
+				`name: Caller
+on: push
+jobs:
+  plain_job:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo 'job'
+  call_missing:
+    uses: ./.gitea/workflows/does-not-exist.yml
+`)
+
+			assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRun{RepoID: repo.ID}))
+		})
+
+		t.Run("Fork PR with secrets: inherit does not leak base repo secrets", func(t *testing.T) {
+			// user2 owns the base repo, configures a secret, and registers a reusable workflow that declares a required secret.
+			// The caller workflow uses `secrets: inherit`.
+
+			apiBaseRepo := createActionsTestRepo(t, user2Token, "fork-pr-inherit-test", false)
+			baseRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiBaseRepo.ID})
+			user2APICtx := NewAPITestContext(t, baseRepo.OwnerName, baseRepo.Name, auth_model.AccessTokenScopeWriteRepository)
+			defer doAPIDeleteRepository(user2APICtx)(t)
+
+			// Real secret that must never reach a fork PR task.
+			req := NewRequestWithJSON(t, "PUT",
+				fmt.Sprintf("/api/v1/repos/%s/%s/actions/secrets/leaked_secret", baseRepo.OwnerName, baseRepo.Name),
+				api.CreateOrUpdateSecretOption{Data: "MUST-NOT-LEAK"}).AddTokenAuth(user2Token)
+			MakeRequest(t, req, http.StatusCreated)
+
+			runner := newMockRunner()
+			runner.registerAsRepoRunner(t, baseRepo.OwnerName, baseRepo.Name, "mock-fork-runner", []string{"ubuntu-latest"}, false)
+
+			createRepoWorkflowFile(t, user2, user2Token, baseRepo, ".gitea/workflows/reusable.yaml",
+				`name: Reusable
+on:
+  workflow_call:
+    secrets:
+      leaked_secret:
+
+jobs:
+  callee:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo
+`)
+			createRepoWorkflowFile(t, user2, user2Token, baseRepo, ".gitea/workflows/caller.yaml",
+				`name: Caller
+on: pull_request
+jobs:
+  call_reusable:
+    uses: ./.gitea/workflows/reusable.yaml
+    secrets: inherit
+`)
+
+			// user4 forks
+			req = NewRequestWithJSON(t, "POST",
+				fmt.Sprintf("/api/v1/repos/%s/%s/forks", baseRepo.OwnerName, baseRepo.Name),
+				&api.CreateForkOption{Name: new("fork-pr-inherit-test-fork")}).AddTokenAuth(user4Token)
+			resp := MakeRequest(t, req, http.StatusAccepted)
+			apiForkRepo := DecodeJSON(t, resp, &api.Repository{})
+			forkRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiForkRepo.ID})
+			user4APICtx := NewAPITestContext(t, user4.Name, forkRepo.Name, auth_model.AccessTokenScopeWriteRepository)
+			defer doAPIDeleteRepository(user4APICtx)(t)
+
+			// user4 pushes a change on the fork and opens a PR to base
+			doAPICreateFile(user4APICtx, "user4-fix.txt", &api.CreateFileOptions{
+				FileOptions: api.FileOptions{
+					NewBranchName: "user4/branch",
+					Message:       "create user4-fix.txt",
+					Author:        api.Identity{Name: user4.Name, Email: user4.Email},
+					Committer:     api.Identity{Name: user4.Name, Email: user4.Email},
+					Dates:         api.CommitDateOptions{Author: time.Now(), Committer: time.Now()},
+				},
+				ContentBase64: base64.StdEncoding.EncodeToString([]byte("fix")),
+			})(t)
+			doAPICreatePullRequest(user4APICtx, baseRepo.OwnerName, baseRepo.Name, baseRepo.DefaultBranch, user4.Name+":user4/branch")(t)
+
+			// Approve the fork PR run.
+			forkRun := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{RepoID: baseRepo.ID, TriggerUserID: user4.ID})
+			assert.True(t, forkRun.IsForkPullRequest)
+			req = NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/approve", baseRepo.OwnerName, baseRepo.Name, forkRun.ID))
+			user2Session.MakeRequest(t, req, http.StatusOK)
+
+			task := runner.fetchTask(t)
+			_, taskJob, taskRun := getTaskAndJobAndRunByTaskID(t, task.Id)
+			assert.Equal(t, "callee", taskJob.JobID)
+			assert.Equal(t, forkRun.ID, taskRun.ID)
+
+			// Only the auto-issued tokens should be present. The user-defined `leaked_secret` must not appear.
+			assert.Contains(t, task.Secrets, "GITEA_TOKEN")
+			assert.Contains(t, task.Secrets, "GITHUB_TOKEN")
+			assert.NotContains(t, task.Secrets, "leaked_secret")
+			for name, value := range task.Secrets {
+				assert.NotEqual(t, "MUST-NOT-LEAK", value, "secret %q leaked the base repo's secret value into a fork PR task", name)
+			}
+
+			runner.execTask(t, task, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
+		})
+
+		t.Run("Caller alternates expanding across attempts", func(t *testing.T) {
+			apiRepo := createActionsTestRepo(t, user2Token, "caller-walkback-test", false)
+			repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiRepo.ID})
+
+			runner := newMockRunner()
+			runner.registerAsRepoRunner(t, repo.OwnerName, repo.Name, "mock-walkback-runner", []string{"ubuntu-latest"}, false)
+
+			// Scenario:
+			//   attempt 1: gate succeeds -> caller expands -> inner runs (records inner.AttemptJobID = N)
+			//   attempt 2: rerun gate, mock Failure -> caller is Skipped without expanding (no children inserted)
+			//   attempt 3: rerun gate, mock Success -> caller expands again -> inner.AttemptJobID must equal N
+
+			createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/lib.yaml",
+				`name: Lib
+on:
+  workflow_call:
+
+jobs:
+  inner:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo inner
+`)
+			createRepoWorkflowFile(t, user2, user2Token, repo, ".gitea/workflows/main.yaml",
+				`name: Main
+on:
+  push:
+    paths:
+      - '.gitea/workflows/main.yaml'
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo gate
+
+  caller:
+    needs: [gate]
+    uses: ./.gitea/workflows/lib.yaml
+`)
+
+			run := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{RepoID: repo.ID})
+			runID := run.ID
+
+			latestAttempt := func() *actions_model.ActionRunAttempt {
+				r := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
+				return unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunAttempt{ID: r.LatestAttemptID})
+			}
+			jobInLatest := func(jobID string) *actions_model.ActionRunJob {
+				a := latestAttempt()
+				return unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: a.ID, JobID: jobID})
+			}
+
+			// attempt 1: gate Success -> caller expands -> inner runs
+			gate1Task := runner.fetchTask(t)
+			_, gate1, _ := getTaskAndJobAndRunByTaskID(t, gate1Task.Id)
+			assert.Equal(t, "gate", gate1.JobID)
+			runner.execTask(t, gate1Task, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
+
+			inner1Task := runner.fetchTask(t)
+			_, inner1, _ := getTaskAndJobAndRunByTaskID(t, inner1Task.Id)
+			assert.Equal(t, "inner", inner1.JobID)
+			innerAttemptJobID := inner1.AttemptJobID
+			callerAttempt1 := jobInLatest("caller")
+			assert.True(t, callerAttempt1.IsExpanded)
+			assert.Equal(t, callerAttempt1.ID, inner1.ParentJobID)
+			runner.execTask(t, inner1Task, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
+
+			run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
+			assert.Equal(t, actions_model.StatusSuccess, run.Status)
+
+			// attempt 2: rerun gate, mock Failure -> caller stays unexpanded (Skipped)
+			gateLatest := jobInLatest("gate")
+			req := NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/jobs/%d/rerun", repo.OwnerName, repo.Name, runID, gateLatest.ID))
+			user2Session.MakeRequest(t, req, http.StatusOK)
+
+			gate2Task := runner.fetchTask(t)
+			_, gate2, _ := getTaskAndJobAndRunByTaskID(t, gate2Task.Id)
+			assert.Equal(t, "gate", gate2.JobID)
+			runner.execTask(t, gate2Task, &mockTaskOutcome{result: runnerv1.Result_RESULT_FAILURE})
+
+			runner.fetchNoTask(t) // no inner because caller did not expand
+			attempt2 := latestAttempt()
+			assert.Equal(t, actions_model.StatusFailure, attempt2.Status)
+			callerAttempt2 := jobInLatest("caller")
+			assert.Equal(t, actions_model.StatusSkipped, callerAttempt2.Status)
+			assert.False(t, callerAttempt2.IsExpanded)
+			assert.Equal(t, 0, unittest.GetCount(t, &actions_model.ActionRunJob{RunID: runID, RunAttemptID: attempt2.ID, JobID: "inner"}))
+
+			// attempt 3: rerun gate, mock Success -> caller expands and inner reuses attempt 1's AttemptJobID
+			gateLatest = jobInLatest("gate")
+			req = NewRequest(t, "POST", fmt.Sprintf("/%s/%s/actions/runs/%d/jobs/%d/rerun", repo.OwnerName, repo.Name, runID, gateLatest.ID))
+			user2Session.MakeRequest(t, req, http.StatusOK)
+
+			gate3Task := runner.fetchTask(t)
+			runner.execTask(t, gate3Task, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
+
+			inner3Task := runner.fetchTask(t)
+			_, inner3, _ := getTaskAndJobAndRunByTaskID(t, inner3Task.Id)
+			assert.Equal(t, "inner", inner3.JobID)
+			assert.Equal(t, innerAttemptJobID, inner3.AttemptJobID)
+			runner.execTask(t, inner3Task, &mockTaskOutcome{result: runnerv1.Result_RESULT_SUCCESS})
+
+			run = unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRun{ID: runID})
+			assert.Equal(t, actions_model.StatusSuccess, run.Status)
+		})
+	})
+}
+
+// token must belong to u (the commit identity) and have write access to repo. Reuse the caller's
+// existing token rather than logging in per call, which would re-run bcrypt password verification each time.
+func createRepoWorkflowFile(t *testing.T, u *user_model.User, token string, repo *repo_model.Repository, treePath, content string) {
+	opts := getWorkflowCreateFileOptions(u, repo.DefaultBranch, "create "+treePath, content)
+	createWorkflowFile(t, token, repo.OwnerName, repo.Name, treePath, opts)
+}
+
+func getWorkflowCallPayloadFromTask(t *testing.T, runnerTask *runnerv1.Task) *api.WorkflowCallPayload {
+	eventJSON, err := runnerTask.GetContext().Fields["event"].GetStructValue().MarshalJSON()
+	assert.NoError(t, err)
+	var payload api.WorkflowCallPayload
+	assert.NoError(t, json.Unmarshal(eventJSON, &payload))
+	return &payload
+}
diff --git a/tests/integration/actions_route_test.go b/tests/integration/actions_route_test.go
index 66a00a6773f..1591a17ae0a 100644
--- a/tests/integration/actions_route_test.go
+++ b/tests/integration/actions_route_test.go
@@ -9,15 +9,15 @@ import (
 	"net/url"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	actions_web "code.gitea.io/gitea/routers/web/repo/actions"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	actions_web "gitea.dev/routers/web/repo/actions"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -160,6 +160,10 @@ func testActionsRouteForLegacyIndexBasedURL(t *testing.T) {
 	collisionJobIdx0 := mkJob(2600, collisionRun.ID, "legacy-collision-job-1", collisionRun.CommitSHA)
 	collisionJobIdx1 := mkJob(2601, collisionRun.ID, "legacy-collision-job-2", collisionRun.CommitSHA)
 
+	// A run whose job has a smaller ID than the run itself (job_id < run_id)
+	jobSmallerThanRunRun := mkRun(5000, 5500, "legacy route job before run", "aaa007")
+	jobSmallerThanRunJob := mkJob(4500, jobSmallerThanRunRun.ID, "legacy-job-before-run-job", jobSmallerThanRunRun.CommitSHA)
+
 	// A small ID-based run/job pair that collides with a different legacy run/job index pair.
 	ambiguousIDRun := mkRun(3, 1, "legacy route ambiguous id", "aaa005")
 	ambiguousIDJob := mkJob(4, ambiguousIDRun.ID, "legacy-ambiguous-id-job", ambiguousIDRun.CommitSHA)
@@ -182,11 +186,12 @@ func testActionsRouteForLegacyIndexBasedURL(t *testing.T) {
 	targetAmbiguousLegacyJob := ambiguousLegacyJobs[int(ambiguousIDJob.ID)]
 
 	insertBeansWithExplicitIDs(t, "action_run",
-		smallIDRun, otherSmallRun, normalRun, ambiguousIDRun, ambiguousLegacyRun, collisionRun,
+		smallIDRun, otherSmallRun, normalRun, ambiguousIDRun, ambiguousLegacyRun, collisionRun, jobSmallerThanRunRun,
 	)
 	insertBeansWithExplicitIDs(t, "action_run_job",
 		smallIDJob, otherSmallJob, normalRunJob, ambiguousIDJob, collisionJobIdx0, collisionJobIdx1,
 		ambiguousLegacyJobIdx0, ambiguousLegacyJobIdx1, ambiguousLegacyJobIdx2, ambiguousLegacyJobIdx3, ambiguousLegacyJobIdx4, ambiguousLegacyJobIdx5,
+		jobSmallerThanRunJob,
 	)
 
 	t.Run("OnlyRunID", func(t *testing.T) {
@@ -220,6 +225,9 @@ func testActionsRouteForLegacyIndexBasedURL(t *testing.T) {
 		user2Session.MakeRequest(t, req, http.StatusOK)
 		req = NewRequest(t, "GET", fmt.Sprintf("/%s/%s/actions/runs/%d/jobs/%d", user2.Name, repo.Name, normalRun.ID, normalRunJob.ID))
 		user2Session.MakeRequest(t, req, http.StatusOK)
+		// URL must resolve even when job_id < run_id.
+		req = NewRequest(t, "GET", fmt.Sprintf("/%s/%s/actions/runs/%d/jobs/%d", user2.Name, repo.Name, jobSmallerThanRunRun.ID, jobSmallerThanRunJob.ID))
+		user2Session.MakeRequest(t, req, http.StatusOK)
 	})
 
 	t.Run("RunIndexAndJobIndex", func(t *testing.T) {
diff --git a/tests/integration/actions_runner_modify_test.go b/tests/integration/actions_runner_modify_test.go
index eb5206f73d6..f9614d69873 100644
--- a/tests/integration/actions_runner_modify_test.go
+++ b/tests/integration/actions_runner_modify_test.go
@@ -6,14 +6,16 @@ package integration
 import (
 	"fmt"
 	"net/http"
+	"strings"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/tests"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -163,4 +165,55 @@ func TestActionsRunnerModify(t *testing.T) {
 			assertSuccess(t, sessionAdmin, adminWebURL, globalRunner.ID)
 		})
 	})
+
+	t.Run("BulkAction", func(t *testing.T) {
+		// Previous subtests deleted all runners; create a fresh set scoped to this subtest.
+		require.NoError(t, actions_model.CreateRunner(ctx, &actions_model.ActionRunner{Name: "bulk-runner-1", TokenHash: "e", UUID: "e"}))
+		require.NoError(t, actions_model.CreateRunner(ctx, &actions_model.ActionRunner{Name: "bulk-runner-2", TokenHash: "f", UUID: "f"}))
+		require.NoError(t, actions_model.CreateRunner(ctx, &actions_model.ActionRunner{Name: "bulk-runner-3", TokenHash: "g", UUID: "g"}))
+		r1 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{Name: "bulk-runner-1"})
+		r2 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{Name: "bulk-runner-2"})
+		r3 := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{Name: "bulk-runner-3"})
+		allIDs := []int64{r1.ID, r2.ID, r3.ID}
+		bulkURL := adminWebURL + "/bulk"
+		doBulk := func(t *testing.T, sess *TestSession, action string, ids []int64, expectedStatus int) {
+			req := NewRequestWithValues(t, "POST", bulkURL, map[string]string{
+				"action": action,
+				"ids":    strings.Join(base.Int64sToStrings(ids), ","),
+			})
+			sess.MakeRequest(t, req, expectedStatus)
+		}
+
+		t.Run("NonAdminForbidden", func(t *testing.T) {
+			doBulk(t, sessionUser2, "disable", allIDs, http.StatusForbidden)
+			for _, id := range allIDs {
+				v := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: id})
+				assert.False(t, v.IsDisabled, "runner %d should not have been disabled", id)
+			}
+		})
+
+		t.Run("InvalidAction", func(t *testing.T) {
+			doBulk(t, sessionAdmin, "evict", allIDs, http.StatusBadRequest)
+		})
+
+		t.Run("DisableEnable", func(t *testing.T) {
+			doBulk(t, sessionAdmin, "disable", allIDs, http.StatusOK)
+			for _, id := range allIDs {
+				v := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: id})
+				assert.True(t, v.IsDisabled, "runner %d should be disabled", id)
+			}
+			doBulk(t, sessionAdmin, "enable", allIDs, http.StatusOK)
+			for _, id := range allIDs {
+				v := unittest.AssertExistsAndLoadBean(t, &actions_model.ActionRunner{ID: id})
+				assert.False(t, v.IsDisabled, "runner %d should be enabled", id)
+			}
+		})
+
+		t.Run("Delete", func(t *testing.T) {
+			doBulk(t, sessionAdmin, "delete", allIDs, http.StatusOK)
+			for _, id := range allIDs {
+				unittest.AssertNotExistsBean(t, &actions_model.ActionRunner{ID: id})
+			}
+		})
+	})
 }
diff --git a/tests/integration/actions_runner_test.go b/tests/integration/actions_runner_test.go
index e9a0a96ca81..017b3a3f1b4 100644
--- a/tests/integration/actions_runner_test.go
+++ b/tests/integration/actions_runner_test.go
@@ -10,13 +10,13 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/setting"
+	pingv1 "gitea.dev/actions-proto-go/ping/v1"
+	"gitea.dev/actions-proto-go/ping/v1/pingv1connect"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	"gitea.dev/actions-proto-go/runner/v1/runnerv1connect"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/setting"
 
-	pingv1 "code.gitea.io/actions-proto-go/ping/v1"
-	"code.gitea.io/actions-proto-go/ping/v1/pingv1connect"
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
-	"code.gitea.io/actions-proto-go/runner/v1/runnerv1connect"
 	"connectrpc.com/connect"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/actions_schedule_test.go b/tests/integration/actions_schedule_test.go
index 43c44ede55d..438e6307fb1 100644
--- a/tests/integration/actions_schedule_test.go
+++ b/tests/integration/actions_schedule_test.go
@@ -9,19 +9,19 @@ import (
 	"strings"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/migration"
-	api "code.gitea.io/gitea/modules/structs"
-	mirror_service "code.gitea.io/gitea/services/mirror"
-	repo_service "code.gitea.io/gitea/services/repository"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/migration"
+	api "gitea.dev/modules/structs"
+	mirror_service "gitea.dev/services/mirror"
+	repo_service "gitea.dev/services/repository"
+	files_service "gitea.dev/services/repository/files"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/actions_settings_test.go b/tests/integration/actions_settings_test.go
index bf4d8cb7484..dd39ed28607 100644
--- a/tests/integration/actions_settings_test.go
+++ b/tests/integration/actions_settings_test.go
@@ -9,10 +9,10 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/actions_trigger_test.go b/tests/integration/actions_trigger_test.go
index 4d88d42f367..cd87bc8b1a0 100644
--- a/tests/integration/actions_trigger_test.go
+++ b/tests/integration/actions_trigger_test.go
@@ -12,30 +12,30 @@ import (
 	"testing"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	actions_module "code.gitea.io/gitea/modules/actions"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/timeutil"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
-	release_service "code.gitea.io/gitea/services/release"
-	repo_service "code.gitea.io/gitea/services/repository"
-	commitstatus_service "code.gitea.io/gitea/services/repository/commitstatus"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	actions_module "gitea.dev/modules/actions"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/timeutil"
+	webhook_module "gitea.dev/modules/webhook"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
+	release_service "gitea.dev/services/release"
+	repo_service "gitea.dev/services/repository"
+	commitstatus_service "gitea.dev/services/repository/commitstatus"
+	files_service "gitea.dev/services/repository/files"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -931,6 +931,76 @@ jobs:
 	})
 }
 
+func TestWorkflowDispatchPublicApiRequiresWorkflowDispatchTrigger(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+		session := loginUser(t, user2.Name)
+		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
+
+		repo, err := repo_service.CreateRepository(t.Context(), user2, user2, repo_service.CreateRepoOptions{
+			Name:          "workflow-dispatch-requires-trigger",
+			Description:   "test workflow dispatch requires workflow_dispatch",
+			AutoInit:      true,
+			Gitignores:    "Go",
+			License:       "MIT",
+			Readme:        "Default",
+			DefaultBranch: "main",
+			IsPrivate:     false,
+		})
+		require.NoError(t, err)
+		require.NotNil(t, repo)
+
+		addWorkflowToBaseResp, err := files_service.ChangeRepoFiles(t.Context(), repo, user2, &files_service.ChangeRepoFilesOptions{
+			Files: []*files_service.ChangeRepoFile{
+				{
+					Operation: "create",
+					TreePath:  ".gitea/workflows/push-only.yml",
+					ContentReader: strings.NewReader(`
+on:
+  push:
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo helloworld
+`),
+				},
+			},
+			Message:   "add workflow",
+			OldBranch: "main",
+			NewBranch: "main",
+			Author: &files_service.IdentityOptions{
+				GitUserName:  user2.Name,
+				GitUserEmail: user2.Email,
+			},
+			Committer: &files_service.IdentityOptions{
+				GitUserName:  user2.Name,
+				GitUserEmail: user2.Email,
+			},
+			Dates: &files_service.CommitDateOptions{
+				Author:    time.Now(),
+				Committer: time.Now(),
+			},
+		})
+		require.NoError(t, err)
+		require.NotNil(t, addWorkflowToBaseResp)
+
+		values := url.Values{}
+		values.Set("ref", "main")
+		req := NewRequestWithURLValues(t, "POST", fmt.Sprintf("/api/v1/repos/%s/actions/workflows/push-only.yml/dispatches", repo.FullName()), values).
+			AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusUnprocessableEntity)
+		apiError := DecodeJSON(t, resp, &api.APIError{})
+		assert.Contains(t, apiError.Message, "has no workflow_dispatch event trigger")
+
+		unittest.AssertNotExistsBean(t, &actions_model.ActionRun{
+			RepoID:     repo.ID,
+			Event:      "workflow_dispatch",
+			WorkflowID: "push-only.yml",
+		})
+	})
+}
+
 func TestWorkflowDispatchPublicApiWithInputs(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
@@ -1801,7 +1871,7 @@ jobs:
 		testEditFile(t, session, "user2", repoName, repo.DefaultBranch, "dir1/dir1.txt", "11")
 		// update by rebase
 		req := NewRequest(t, "POST", fmt.Sprintf("/%s/%s/pulls/%d/update?style=rebase", "user2", repoName, apiPull.Index))
-		session.MakeRequest(t, req, http.StatusSeeOther)
+		session.MakeRequest(t, req, http.StatusOK)
 		runner.fetchNoTask(t)
 	})
 }
diff --git a/tests/integration/actions_variables_test.go b/tests/integration/actions_variables_test.go
index b884b32ebf2..85ec717e527 100644
--- a/tests/integration/actions_variables_test.go
+++ b/tests/integration/actions_variables_test.go
@@ -8,12 +8,12 @@ import (
 	"net/http"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/tests"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/admin_config_test.go b/tests/integration/admin_config_test.go
index 5f882e8a550..f077b3a84ec 100644
--- a/tests/integration/admin_config_test.go
+++ b/tests/integration/admin_config_test.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/setting/config"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/system"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/setting/config"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/admin_user_test.go b/tests/integration/admin_user_test.go
index 82db96c6941..64bb04f03f4 100644
--- a/tests/integration/admin_user_test.go
+++ b/tests/integration/admin_user_test.go
@@ -9,9 +9,9 @@ import (
 	"strconv"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_actions_artifact_test.go b/tests/integration/api_actions_artifact_test.go
index 0a4a63c551a..9e8444525ff 100644
--- a/tests/integration/api_actions_artifact_test.go
+++ b/tests/integration/api_actions_artifact_test.go
@@ -16,13 +16,13 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/tests"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/tests"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -149,7 +149,7 @@ func TestActionsArtifactDownload(t *testing.T) {
 	assert.Contains(t, listResp.Value[artifactIdx].FileContainerResourceURL, "/api/actions_pipeline/_apis/pipelines/workflows/791/artifacts")
 
 	idx := strings.Index(listResp.Value[artifactIdx].FileContainerResourceURL, "/api/actions_pipeline/_apis/pipelines/")
-	url := listResp.Value[artifactIdx].FileContainerResourceURL[idx+1:] + "?itemPath=artifact-download"
+	url := listResp.Value[artifactIdx].FileContainerResourceURL[idx:] + "?itemPath=artifact-download"
 	req = NewRequest(t, "GET", url).
 		AddTokenAuth("8061e833a55f6fc0157c98b883e91fcfeeb1a71a")
 	resp = MakeRequest(t, req, http.StatusOK)
@@ -245,7 +245,7 @@ func TestActionsArtifactDownloadMultiFiles(t *testing.T) {
 	assert.Contains(t, fileContainerResourceURL, "/api/actions_pipeline/_apis/pipelines/workflows/791/artifacts")
 
 	idx := strings.Index(fileContainerResourceURL, "/api/actions_pipeline/_apis/pipelines/")
-	url := fileContainerResourceURL[idx+1:] + "?itemPath=" + testArtifactName
+	url := fileContainerResourceURL[idx:] + "?itemPath=" + testArtifactName
 	req = NewRequest(t, "GET", url).
 		AddTokenAuth("8061e833a55f6fc0157c98b883e91fcfeeb1a71a")
 	resp = MakeRequest(t, req, http.StatusOK)
@@ -323,7 +323,7 @@ func TestActionsArtifactOverwrite(t *testing.T) {
 		listResp := DecodeJSON(t, resp, &listArtifactsResponse{})
 
 		idx := strings.Index(listResp.Value[0].FileContainerResourceURL, "/api/actions_pipeline/_apis/pipelines/")
-		url := listResp.Value[0].FileContainerResourceURL[idx+1:] + "?itemPath=artifact-download"
+		url := listResp.Value[0].FileContainerResourceURL[idx:] + "?itemPath=artifact-download"
 		req = NewRequest(t, "GET", url).
 			AddTokenAuth("8061e833a55f6fc0157c98b883e91fcfeeb1a71a")
 		resp = MakeRequest(t, req, http.StatusOK)
@@ -380,7 +380,7 @@ func TestActionsArtifactOverwrite(t *testing.T) {
 		assert.Equal(t, "artifact-download", uploadedItem.Name)
 
 		idx := strings.Index(uploadedItem.FileContainerResourceURL, "/api/actions_pipeline/_apis/pipelines/")
-		url := uploadedItem.FileContainerResourceURL[idx+1:] + "?itemPath=artifact-download"
+		url := uploadedItem.FileContainerResourceURL[idx:] + "?itemPath=artifact-download"
 		req = NewRequest(t, "GET", url).
 			AddTokenAuth("8061e833a55f6fc0157c98b883e91fcfeeb1a71a")
 		resp = MakeRequest(t, req, http.StatusOK)
diff --git a/tests/integration/api_actions_artifact_v4_test.go b/tests/integration/api_actions_artifact_v4_test.go
index b1deec094f8..acefc9eeb87 100644
--- a/tests/integration/api_actions_artifact_v4_test.go
+++ b/tests/integration/api_actions_artifact_v4_test.go
@@ -18,21 +18,21 @@ import (
 	"testing"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/api/actions"
-	actions_service "code.gitea.io/gitea/services/actions"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/api/actions"
+	actions_service "gitea.dev/services/actions"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -398,7 +398,7 @@ func TestActionsArtifactV4UploadSingleFileWithChunksOutOfOrder(t *testing.T) {
 				defer test.MockVariableValue(&setting.Actions.ArtifactStorage.AzureBlobConfig.ServeDirect, entry.serveDirect)()
 			default:
 				if entry.serveDirect {
-					t.Skip()
+					t.Skip("for non-serve-direct only")
 				}
 			}
 			// acquire artifact upload url
@@ -529,7 +529,7 @@ func TestActionsArtifactV4DownloadSingle(t *testing.T) {
 				defer test.MockVariableValue(&setting.Actions.ArtifactStorage.MinioConfig.ServeDirect, entry.ServeDirect)()
 			default:
 				if entry.ServeDirect {
-					t.Skip()
+					t.Skip("for non-serve-direct only")
 				}
 			}
 
diff --git a/tests/integration/api_actions_permission_test.go b/tests/integration/api_actions_permission_test.go
index 2c0aaa43e8c..90908662966 100644
--- a/tests/integration/api_actions_permission_test.go
+++ b/tests/integration/api_actions_permission_test.go
@@ -7,10 +7,10 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_actions_run_test.go b/tests/integration/api_actions_run_test.go
index 22fa6ba2eaf..fbb34ca4a79 100644
--- a/tests/integration/api_actions_run_test.go
+++ b/tests/integration/api_actions_run_test.go
@@ -9,15 +9,15 @@ import (
 	"slices"
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/tests"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -327,6 +327,30 @@ func testAPIActionsListUserWorkflows(t *testing.T) {
 			assert.NotEmpty(t, job.HTMLURL, "html_url should be populated via batch-loaded repo")
 		}
 	})
+
+	t.Run("JobsDefaultOrderAsc", func(t *testing.T) {
+		req := NewRequest(t, "GET", "/api/v1/user/actions/jobs").AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusOK)
+		jobs := DecodeJSON(t, resp, &api.ActionWorkflowJobsResponse{})
+
+		assert.GreaterOrEqual(t, len(jobs.Entries), 2, "need at least 2 jobs to verify ordering")
+		for i := 1; i < len(jobs.Entries); i++ {
+			assert.Less(t, jobs.Entries[i-1].ID, jobs.Entries[i].ID,
+				"jobs should be ordered by ID ascending by default")
+		}
+	})
+
+	t.Run("JobsOrderedByIDDesc", func(t *testing.T) {
+		req := NewRequest(t, "GET", "/api/v1/user/actions/jobs?sort=id&order=desc").AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusOK)
+		jobs := DecodeJSON(t, resp, &api.ActionWorkflowJobsResponse{})
+
+		assert.GreaterOrEqual(t, len(jobs.Entries), 2, "need at least 2 jobs to verify ordering")
+		for i := 1; i < len(jobs.Entries); i++ {
+			assert.Greater(t, jobs.Entries[i-1].ID, jobs.Entries[i].ID,
+				"jobs should be ordered by ID descending")
+		}
+	})
 }
 
 func testAPIActionsListRepoWorkflows(t *testing.T) {
diff --git a/tests/integration/api_actions_runner_test.go b/tests/integration/api_actions_runner_test.go
index f32e2af890d..216511795b2 100644
--- a/tests/integration/api_actions_runner_test.go
+++ b/tests/integration/api_actions_runner_test.go
@@ -9,9 +9,9 @@ import (
 	"slices"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/api_admin_org_test.go b/tests/integration/api_admin_org_test.go
index 6019be70c6a..8fefe51ba9a 100644
--- a/tests/integration/api_admin_org_test.go
+++ b/tests/integration/api_admin_org_test.go
@@ -8,11 +8,11 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_admin_test.go b/tests/integration/api_admin_test.go
index 291cd21984a..c02137a326b 100644
--- a/tests/integration/api_admin_test.go
+++ b/tests/integration/api_admin_test.go
@@ -9,15 +9,16 @@ import (
 	"testing"
 	"time"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/glob"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	asymkey_model "gitea.dev/models/asymkey"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/glob"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -335,11 +336,7 @@ func TestAPICron(t *testing.T) {
 
 func TestAPICreateUser_NotAllowedEmailDomain(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	setting.Service.EmailDomainAllowList = []glob.Glob{glob.MustCompile("example.org")}
-	defer func() {
-		setting.Service.EmailDomainAllowList = []glob.Glob{}
-	}()
+	defer test.MockVariableValue(&setting.Service.EmailDomainAllowList, []glob.Glob{glob.MustCompile("example.org")})()
 
 	adminUsername := "user1"
 	token := getUserToken(t, adminUsername, auth_model.AccessTokenScopeWriteAdmin)
@@ -360,11 +357,7 @@ func TestAPICreateUser_NotAllowedEmailDomain(t *testing.T) {
 
 func TestAPIEditUser_NotAllowedEmailDomain(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	setting.Service.EmailDomainAllowList = []glob.Glob{glob.MustCompile("example.org")}
-	defer func() {
-		setting.Service.EmailDomainAllowList = []glob.Glob{}
-	}()
+	defer test.MockVariableValue(&setting.Service.EmailDomainAllowList, []glob.Glob{glob.MustCompile("example.org")})()
 
 	adminUsername := "user1"
 	token := getUserToken(t, adminUsername, auth_model.AccessTokenScopeWriteAdmin)
diff --git a/tests/integration/api_auth_test.go b/tests/integration/api_auth_test.go
index a6ff6a65199..1d0aec6b23d 100644
--- a/tests/integration/api_auth_test.go
+++ b/tests/integration/api_auth_test.go
@@ -7,7 +7,7 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_branch_test.go b/tests/integration/api_branch_test.go
index 5bf53605498..c4946f05e37 100644
--- a/tests/integration/api_branch_test.go
+++ b/tests/integration/api_branch_test.go
@@ -11,11 +11,11 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -348,7 +348,7 @@ func TestAPIUpdateBranchReference(t *testing.T) {
 
 func testAPIRenameBranch(t *testing.T, doerName, ownerName, repoName, from, to string, expectedHTTPStatus int) *httptest.ResponseRecorder {
 	token := getUserToken(t, doerName, auth_model.AccessTokenScopeWriteRepository)
-	req := NewRequestWithJSON(t, "PATCH", "api/v1/repos/"+ownerName+"/"+repoName+"/branches/"+from, &api.RenameBranchRepoOption{
+	req := NewRequestWithJSON(t, "PATCH", "/api/v1/repos/"+ownerName+"/"+repoName+"/branches/"+from, &api.RenameBranchRepoOption{
 		Name: to,
 	}).AddTokenAuth(token)
 	return MakeRequest(t, req, expectedHTTPStatus)
@@ -356,7 +356,11 @@ func testAPIRenameBranch(t *testing.T, doerName, ownerName, repoName, from, to s
 
 func TestAPIBranchProtection(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
+	t.Run("Basic", testAPIBranchProtectionBasic)
+	t.Run("BypassAllowlistValidation", testAPIBranchProtectionBypassAllowlistValidation)
+}
 
+func testAPIBranchProtectionBasic(t *testing.T) {
 	// Can create branch protection on branch that not exist
 	testAPICreateBranchProtection(t, "non-existing/branch", 1, http.StatusCreated)
 	testAPIGetBranchProtection(t, "non-existing/branch", http.StatusOK)
@@ -406,6 +410,35 @@ func TestAPIBranchProtection(t *testing.T) {
 	testAPIDeleteBranch(t, "no-such-branch", http.StatusNotFound) // non-existing branch, not exist in git or DB
 }
 
+func testAPIBranchProtectionBypassAllowlistValidation(t *testing.T) {
+	token := getUserToken(t, "user2", auth_model.AccessTokenScopeWriteRepository)
+
+	t.Run("IgnoreInvalidBypassUsernamesWhenDisabled", func(t *testing.T) {
+		ruleName := "bypass-disabled-invalid-user"
+		req := NewRequestWithJSON(t, "POST", "/api/v1/repos/user2/repo1/branch_protections", &api.CreateBranchProtectionOption{
+			RuleName:                 ruleName,
+			EnableBypassAllowlist:    false,
+			BypassAllowlistUsernames: []string{"nonexistent-user"},
+		}).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusCreated)
+		testAPIDeleteBranchProtection(t, ruleName, http.StatusNoContent)
+	})
+
+	t.Run("IgnoreInvalidBypassTeamsWhenDisabled", func(t *testing.T) {
+		ruleName := "bypass-disabled-invalid-team"
+		req := NewRequestWithJSON(t, "POST", "/api/v1/repos/org3/repo3/branch_protections", &api.CreateBranchProtectionOption{
+			RuleName:              ruleName,
+			EnableBypassAllowlist: false,
+			BypassAllowlistTeams:  []string{"nonexistent-team"},
+		}).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusCreated)
+
+		deleteReq := NewRequestf(t, "DELETE", "/api/v1/repos/org3/repo3/branch_protections/%s", ruleName).
+			AddTokenAuth(token)
+		MakeRequest(t, deleteReq, http.StatusNoContent)
+	})
+}
+
 func TestAPICreateBranchWithSyncBranches(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
diff --git a/tests/integration/api_comment_attachment_test.go b/tests/integration/api_comment_attachment_test.go
index 657b1637ac2..302b6f58fed 100644
--- a/tests/integration/api_comment_attachment_test.go
+++ b/tests/integration/api_comment_attachment_test.go
@@ -10,14 +10,14 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/convert"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_comment_test.go b/tests/integration/api_comment_test.go
index 138d1d2e9bf..8ef14256d6b 100644
--- a/tests/integration/api_comment_test.go
+++ b/tests/integration/api_comment_test.go
@@ -9,14 +9,14 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/convert"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_fork_test.go b/tests/integration/api_fork_test.go
index f99cc29fabd..cf0a2e4384c 100644
--- a/tests/integration/api_fork_test.go
+++ b/tests/integration/api_fork_test.go
@@ -7,14 +7,14 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	org_model "code.gitea.io/gitea/models/organization"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	org_service "code.gitea.io/gitea/services/org"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	org_model "gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	org_service "gitea.dev/services/org"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_gitignore_templates_test.go b/tests/integration/api_gitignore_templates_test.go
index 95e450b6953..50e224bf67f 100644
--- a/tests/integration/api_gitignore_templates_test.go
+++ b/tests/integration/api_gitignore_templates_test.go
@@ -7,10 +7,10 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/options"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/options"
+	repo_module "gitea.dev/modules/repository"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -21,8 +21,9 @@ func TestAPIListGitignoresTemplates(t *testing.T) {
 	req := NewRequest(t, "GET", "/api/v1/gitignore/templates")
 	resp := MakeRequest(t, req, http.StatusOK)
 
-	// This tests if the API returns a list of strings
-	DecodeJSON(t, resp, []string{})
+	templateList := DecodeJSON(t, resp, []string{}) // this is a very long list
+	assert.Contains(t, templateList, "C++")
+	assert.Contains(t, templateList, "Go")
 }
 
 func TestAPIGetGitignoreTemplateInfo(t *testing.T) {
diff --git a/tests/integration/api_gpg_keys_test.go b/tests/integration/api_gpg_keys_test.go
index a5cee1d8a7d..a2a19d58888 100644
--- a/tests/integration/api_gpg_keys_test.go
+++ b/tests/integration/api_gpg_keys_test.go
@@ -9,9 +9,9 @@ import (
 	"strconv"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_helper_for_declarative_test.go b/tests/integration/api_helper_for_declarative_test.go
index 77ce392b4ba..f9d36d29985 100644
--- a/tests/integration/api_helper_for_declarative_test.go
+++ b/tests/integration/api_helper_for_declarative_test.go
@@ -12,13 +12,13 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/queue"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/forms"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/queue"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/forms"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_httpsig_test.go b/tests/integration/api_httpsig_test.go
index 284307597ba..a011a55c54b 100644
--- a/tests/integration/api_httpsig_test.go
+++ b/tests/integration/api_httpsig_test.go
@@ -9,11 +9,11 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/42wim/httpsig"
 	"golang.org/x/crypto/ssh"
diff --git a/tests/integration/api_issue_attachment_test.go b/tests/integration/api_issue_attachment_test.go
index 3475c37ee4f..eb0db160079 100644
--- a/tests/integration/api_issue_attachment_test.go
+++ b/tests/integration/api_issue_attachment_test.go
@@ -10,13 +10,13 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_issue_config_test.go b/tests/integration/api_issue_config_test.go
index 31dfa9ce92b..4227f33237d 100644
--- a/tests/integration/api_issue_config_test.go
+++ b/tests/integration/api_issue_config_test.go
@@ -8,14 +8,15 @@ import (
 	"net/http"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func createIssueConfig(t *testing.T, user *user_model.User, repo *repo_model.Repository, issueConfig map[string]any) {
@@ -176,3 +177,19 @@ func TestAPIRepoValidateIssueConfig(t *testing.T) {
 		assert.NotEmpty(t, issueConfigValidation.Message)
 	})
 }
+
+func TestAPIRepoIssueConfigRequiresCodeUnit(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 24})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	token := getUserToken(t, user.Name, auth_model.AccessTokenScopeReadRepository)
+
+	for _, path := range []string{
+		fmt.Sprintf("/api/v1/repos/%s/issue_config", repo.FullName()),
+		fmt.Sprintf("/api/v1/repos/%s/issue_config/validate", repo.FullName()),
+	} {
+		req := NewRequest(t, "GET", path).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusForbidden)
+	}
+}
diff --git a/tests/integration/api_issue_dependency_test.go b/tests/integration/api_issue_dependency_test.go
index fc2615be42f..a6a9be34bce 100644
--- a/tests/integration/api_issue_dependency_test.go
+++ b/tests/integration/api_issue_dependency_test.go
@@ -8,18 +8,18 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	repo_service "code.gitea.io/gitea/services/repository"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	repo_service "gitea.dev/services/repository"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_issue_label_test.go b/tests/integration/api_issue_label_test.go
index 0e522d3e83e..611b5da6cc7 100644
--- a/tests/integration/api_issue_label_test.go
+++ b/tests/integration/api_issue_label_test.go
@@ -9,12 +9,12 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_issue_lock_test.go b/tests/integration/api_issue_lock_test.go
index 47b1f2cf0da..86f7b0eab23 100644
--- a/tests/integration/api_issue_lock_test.go
+++ b/tests/integration/api_issue_lock_test.go
@@ -8,13 +8,13 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_issue_milestone_test.go b/tests/integration/api_issue_milestone_test.go
index 7f16db163d0..b5526bf0d04 100644
--- a/tests/integration/api_issue_milestone_test.go
+++ b/tests/integration/api_issue_milestone_test.go
@@ -8,13 +8,13 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_issue_pin_test.go b/tests/integration/api_issue_pin_test.go
index 47026449d79..3b10ee4087b 100644
--- a/tests/integration/api_issue_pin_test.go
+++ b/tests/integration/api_issue_pin_test.go
@@ -8,13 +8,13 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_issue_reaction_test.go b/tests/integration/api_issue_reaction_test.go
index 503caf8a725..daa7bb4d17b 100644
--- a/tests/integration/api_issue_reaction_test.go
+++ b/tests/integration/api_issue_reaction_test.go
@@ -9,14 +9,14 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/convert"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_issue_stopwatch_test.go b/tests/integration/api_issue_stopwatch_test.go
index 970597bd8f4..225c64e5942 100644
--- a/tests/integration/api_issue_stopwatch_test.go
+++ b/tests/integration/api_issue_stopwatch_test.go
@@ -7,13 +7,13 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_issue_subscription_test.go b/tests/integration/api_issue_subscription_test.go
index 3862a138948..34fe8c2a69e 100644
--- a/tests/integration/api_issue_subscription_test.go
+++ b/tests/integration/api_issue_subscription_test.go
@@ -8,13 +8,13 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -39,8 +39,7 @@ func TestAPIIssueSubscriptions(t *testing.T) {
 		req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d/subscriptions/check", issueRepo.OwnerName, issueRepo.Name, issue.Index)).
 			AddTokenAuth(token)
 		resp := MakeRequest(t, req, http.StatusOK)
-		wi := new(api.WatchInfo)
-		DecodeJSON(t, resp, wi)
+		wi := DecodeJSON(t, resp, &api.WatchInfo{})
 
 		assert.Equal(t, isWatching, wi.Subscribed)
 		assert.Equal(t, !isWatching, wi.Ignored)
diff --git a/tests/integration/api_issue_templates_test.go b/tests/integration/api_issue_templates_test.go
index 452ff1c9d29..5ed4023b72f 100644
--- a/tests/integration/api_issue_templates_test.go
+++ b/tests/integration/api_issue_templates_test.go
@@ -8,10 +8,12 @@ import (
 	"net/url"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -49,3 +51,19 @@ about: bar
 		assert.Equal(t, "error occurs when parsing issue template: count=2", resp.Header().Get("X-Gitea-Warning"))
 	})
 }
+
+func TestAPIIssueTemplateRequiresCodeUnit(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 24})
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	token := getUserToken(t, user.Name, auth_model.AccessTokenScopeReadRepository)
+	issueTemplatesURL := "/api/v1/repos/" + repo.FullName() + "/issue_templates"
+	languagesURL := "/api/v1/repos/" + repo.FullName() + "/languages"
+
+	req := NewRequest(t, "GET", issueTemplatesURL).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+
+	req = NewRequest(t, "GET", languagesURL).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+}
diff --git a/tests/integration/api_issue_test.go b/tests/integration/api_issue_test.go
index f8b6ab4dd90..67a7e2b5901 100644
--- a/tests/integration/api_issue_test.go
+++ b/tests/integration/api_issue_test.go
@@ -12,15 +12,15 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -108,7 +108,7 @@ func testAPIListIssuesPublicOnly(t *testing.T) {
 
 	publicOnlyToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadIssue, auth_model.AccessTokenScopePublicOnly)
 	req = NewRequest(t, "GET", link.String()).AddTokenAuth(publicOnlyToken)
-	MakeRequest(t, req, http.StatusForbidden)
+	MakeRequest(t, req, http.StatusNotFound)
 }
 
 func testAPICreateIssue(t *testing.T) {
@@ -149,16 +149,16 @@ func testAPICreateIssue(t *testing.T) {
 }
 
 func testAPICreateIssueParallel(t *testing.T) {
-	// FIXME: There seems to be a bug in github.com/mattn/go-sqlite3 with sqlite_unlock_notify, when doing concurrent writes to the same database,
+	// HINT: There seems to be a bug in github.com/mattn/go-sqlite3 with sqlite_unlock_notify, when doing concurrent writes to the same database,
 	// some requests may get stuck in "go-sqlite3.(*SQLiteRows).Next", "go-sqlite3.(*SQLiteStmt).exec" and "go-sqlite3.unlock_notify_wait",
-	// because the "unlock_notify_wait" never returns and the internal lock never gets releases.
+	// because the "unlock_notify_wait" never returns and the internal lock never gets released.
 	//
 	// The trigger is: a previous test created issues and made the real issue indexer queue start processing, then this test does concurrent writing.
 	// Adding this "Sleep" makes go-sqlite3 "finish" some internal operations before concurrent writes and then won't get stuck.
 	// To reproduce: make a new test run these 2 tests enough times:
 	// > func testBug() { for i := 0; i < 100; i++ { testAPICreateIssue(t); testAPICreateIssueParallel(t) } }
 	// Usually the test gets stuck in fewer than 10 iterations without this "sleep".
-	time.Sleep(time.Second)
+	time.Sleep(100 * time.Millisecond)
 
 	const body, title = "apiTestBody", "apiTestTitle"
 
@@ -171,9 +171,8 @@ func testAPICreateIssueParallel(t *testing.T) {
 
 	var wg sync.WaitGroup
 	for i := range 10 {
-		wg.Add(1)
-		go func(parentT *testing.T, i int) {
-			parentT.Run(fmt.Sprintf("ParallelCreateIssue_%d", i), func(t *testing.T) {
+		wg.Go(func() {
+			t.Run(fmt.Sprintf("ParallelCreateIssue_%d", i), func(t *testing.T) {
 				newTitle := title + strconv.Itoa(i)
 				newBody := body + strconv.Itoa(i)
 				req := NewRequestWithJSON(t, "POST", urlStr, &api.CreateIssueOption{
@@ -192,10 +191,8 @@ func testAPICreateIssueParallel(t *testing.T) {
 					Content:    newBody,
 					Title:      newTitle,
 				})
-
-				wg.Done()
 			})
-		}(t, i)
+		})
 	}
 	wg.Wait()
 }
@@ -513,15 +510,14 @@ func testAPIIssueProjects(t *testing.T) {
 		Projects: []int64{1},
 	}).AddTokenAuth(token)
 	resp := MakeRequest(t, req, http.StatusCreated)
-	var apiIssue api.Issue
-	DecodeJSON(t, resp, &apiIssue)
+	apiIssue := DecodeJSON(t, resp, &api.Issue{})
 	assert.Len(t, apiIssue.Projects, 1)
 	assert.EqualValues(t, 1, apiIssue.Projects[0].ID)
 
 	// Get issue should include projects
 	req = NewRequest(t, "GET", fmt.Sprintf("%s/%d", urlStr, apiIssue.Index)).AddTokenAuth(token)
 	resp = MakeRequest(t, req, http.StatusOK)
-	DecodeJSON(t, resp, &apiIssue)
+	apiIssue = DecodeJSON(t, resp, &api.Issue{})
 	assert.Len(t, apiIssue.Projects, 1)
 	assert.EqualValues(t, 1, apiIssue.Projects[0].ID)
 
@@ -531,7 +527,7 @@ func testAPIIssueProjects(t *testing.T) {
 		Projects: &emptyProjects,
 	}).AddTokenAuth(token)
 	resp = MakeRequest(t, req, http.StatusCreated)
-	DecodeJSON(t, resp, &apiIssue)
+	apiIssue = DecodeJSON(t, resp, &api.Issue{})
 	assert.Empty(t, apiIssue.Projects)
 
 	// Edit issue to add project back
@@ -540,7 +536,7 @@ func testAPIIssueProjects(t *testing.T) {
 		Projects: &projects,
 	}).AddTokenAuth(token)
 	resp = MakeRequest(t, req, http.StatusCreated)
-	DecodeJSON(t, resp, &apiIssue)
+	apiIssue = DecodeJSON(t, resp, &api.Issue{})
 	assert.Len(t, apiIssue.Projects, 1)
 	assert.EqualValues(t, 1, apiIssue.Projects[0].ID)
 
diff --git a/tests/integration/api_issue_tracked_time_test.go b/tests/integration/api_issue_tracked_time_test.go
index 2bb9d765a6a..fcbe4dfa519 100644
--- a/tests/integration/api_issue_tracked_time_test.go
+++ b/tests/integration/api_issue_tracked_time_test.go
@@ -9,12 +9,12 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_keys_test.go b/tests/integration/api_keys_test.go
index 7ea273ac166..d2c5d389284 100644
--- a/tests/integration/api_keys_test.go
+++ b/tests/integration/api_keys_test.go
@@ -9,14 +9,14 @@ import (
 	"net/url"
 	"testing"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	asymkey_model "gitea.dev/models/asymkey"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_label_templates_test.go b/tests/integration/api_label_templates_test.go
index bb070fc1598..66d4b864260 100644
--- a/tests/integration/api_label_templates_test.go
+++ b/tests/integration/api_label_templates_test.go
@@ -9,9 +9,9 @@ import (
 	"strings"
 	"testing"
 
-	repo_module "code.gitea.io/gitea/modules/repository"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	repo_module "gitea.dev/modules/repository"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_license_templates_test.go b/tests/integration/api_license_templates_test.go
index d0c6274f1a6..2f3d3b08305 100644
--- a/tests/integration/api_license_templates_test.go
+++ b/tests/integration/api_license_templates_test.go
@@ -8,10 +8,11 @@ import (
 	"net/url"
 	"testing"
 
-	"code.gitea.io/gitea/modules/options"
-	repo_module "code.gitea.io/gitea/modules/repository"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/options"
+	repo_module "gitea.dev/modules/repository"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -22,8 +23,12 @@ func TestAPIListLicenseTemplates(t *testing.T) {
 	req := NewRequest(t, "GET", "/api/v1/licenses")
 	resp := MakeRequest(t, req, http.StatusOK)
 
-	// This tests if the API returns a list of strings
-	DecodeJSON(t, resp, []api.LicensesTemplateListEntry{})
+	licenseList := DecodeJSON(t, resp, []api.LicensesTemplateListEntry{})
+	assert.Contains(t, licenseList, api.LicensesTemplateListEntry{
+		Key:  "MIT",
+		Name: "MIT",
+		URL:  setting.AppURL + "api/v1/licenses/MIT",
+	})
 }
 
 func TestAPIGetLicenseTemplateInfo(t *testing.T) {
diff --git a/tests/integration/api_notification_test.go b/tests/integration/api_notification_test.go
index 275521572d4..2a856d4da42 100644
--- a/tests/integration/api_notification_test.go
+++ b/tests/integration/api_notification_test.go
@@ -8,13 +8,13 @@ import (
 	"net/http"
 	"testing"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	activities_model "gitea.dev/models/activities"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -209,3 +209,23 @@ func TestAPINotificationPUT(t *testing.T) {
 	assert.True(t, apiNL[0].Unread)
 	assert.False(t, apiNL[0].Pinned)
 }
+
+func TestAPINotificationPublicOnly(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	thread5 := unittest.AssertExistsAndLoadBean(t, &activities_model.Notification{ID: 5})
+
+	token := getUserToken(t, user2.Name, auth_model.AccessTokenScopeReadNotification, auth_model.AccessTokenScopePublicOnly)
+	req := NewRequest(t, "GET", "/api/v1/notifications").
+		AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+
+	req = NewRequest(t, "GET", "/api/v1/notifications/new").
+		AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+
+	req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/notifications/threads/%d", thread5.ID)).
+		AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+}
diff --git a/tests/integration/api_oauth2_apps_test.go b/tests/integration/api_oauth2_apps_test.go
index 32b732b2a83..fde89dd3037 100644
--- a/tests/integration/api_oauth2_apps_test.go
+++ b/tests/integration/api_oauth2_apps_test.go
@@ -8,13 +8,13 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/api_org_avatar_test.go b/tests/integration/api_org_avatar_test.go
index 62c54e67061..e6137a342ec 100644
--- a/tests/integration/api_org_avatar_test.go
+++ b/tests/integration/api_org_avatar_test.go
@@ -10,10 +10,10 @@ import (
 	"path/filepath"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_org_test.go b/tests/integration/api_org_test.go
index fb2e1712c62..3306c6539cb 100644
--- a/tests/integration/api_org_test.go
+++ b/tests/integration/api_org_test.go
@@ -10,17 +10,17 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	org_model "code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	org_model "gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/api_packages_alpine_test.go b/tests/integration/api_packages_alpine_test.go
index 3395fad2134..0fe158e7f04 100644
--- a/tests/integration/api_packages_alpine_test.go
+++ b/tests/integration/api_packages_alpine_test.go
@@ -14,12 +14,12 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	alpine_module "code.gitea.io/gitea/modules/packages/alpine"
-	alpine_service "code.gitea.io/gitea/services/packages/alpine"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	alpine_module "gitea.dev/modules/packages/alpine"
+	alpine_service "gitea.dev/services/packages/alpine"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_arch_test.go b/tests/integration/api_packages_arch_test.go
index 4acb7451566..ece8b27f4c6 100644
--- a/tests/integration/api_packages_arch_test.go
+++ b/tests/integration/api_packages_arch_test.go
@@ -12,13 +12,13 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	arch_module "code.gitea.io/gitea/modules/packages/arch"
-	"code.gitea.io/gitea/modules/test"
-	arch_service "code.gitea.io/gitea/services/packages/arch"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	arch_module "gitea.dev/modules/packages/arch"
+	"gitea.dev/modules/test"
+	arch_service "gitea.dev/services/packages/arch"
+	"gitea.dev/tests"
 
 	"github.com/klauspost/compress/zstd"
 	"github.com/stretchr/testify/assert"
diff --git a/tests/integration/api_packages_cargo_test.go b/tests/integration/api_packages_cargo_test.go
index 055d56fe790..37693ecfdc2 100644
--- a/tests/integration/api_packages_cargo_test.go
+++ b/tests/integration/api_packages_cargo_test.go
@@ -12,17 +12,17 @@ import (
 	neturl "net/url"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/json"
-	cargo_module "code.gitea.io/gitea/modules/packages/cargo"
-	"code.gitea.io/gitea/modules/setting"
-	cargo_router "code.gitea.io/gitea/routers/api/packages/cargo"
-	cargo_service "code.gitea.io/gitea/services/packages/cargo"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	cargo_module "gitea.dev/modules/packages/cargo"
+	"gitea.dev/modules/setting"
+	cargo_router "gitea.dev/routers/api/packages/cargo"
+	cargo_service "gitea.dev/services/packages/cargo"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_chef_test.go b/tests/integration/api_packages_chef_test.go
index cceed8566bf..f179baac3de 100644
--- a/tests/integration/api_packages_chef_test.go
+++ b/tests/integration/api_packages_chef_test.go
@@ -25,13 +25,13 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	chef_module "code.gitea.io/gitea/modules/packages/chef"
-	"code.gitea.io/gitea/modules/setting"
-	chef_router "code.gitea.io/gitea/routers/api/packages/chef"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	chef_module "gitea.dev/modules/packages/chef"
+	"gitea.dev/modules/setting"
+	chef_router "gitea.dev/routers/api/packages/chef"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_composer_test.go b/tests/integration/api_packages_composer_test.go
index a56f2dd39b6..cfc42f9e187 100644
--- a/tests/integration/api_packages_composer_test.go
+++ b/tests/integration/api_packages_composer_test.go
@@ -10,15 +10,15 @@ import (
 	neturl "net/url"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	composer_module "code.gitea.io/gitea/modules/packages/composer"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/routers/api/packages/composer"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	composer_module "gitea.dev/modules/packages/composer"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/routers/api/packages/composer"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -27,6 +27,8 @@ func TestPackageComposer(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	otherUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+	privateUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 31})
 
 	vendorName := "gitea"
 	projectName := "composer-package"
@@ -243,5 +245,83 @@ func TestPackageComposer(t *testing.T) {
 		assert.Equal(t, repo1.HTMLURL(), pkgs[0].Source.URL)
 		assert.Equal(t, "git", pkgs[0].Source.Type)
 		assert.Equal(t, packageVersion, pkgs[0].Source.Reference)
+
+		// Private repository links remain visible to callers who can access the repository.
+		repo2 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
+		err = packages.SetRepositoryLink(t.Context(), userPkgs[0].ID, repo2.ID)
+		assert.NoError(t, err)
+
+		req = NewRequest(t, "GET", fmt.Sprintf("%s/p2/%s/%s.json", url, vendorName, projectName)).
+			AddBasicAuth(user.Name)
+		resp = MakeRequest(t, req, http.StatusOK)
+
+		result = DecodeJSON(t, resp, &composer.PackageMetadataResponse{})
+		pkgs = result.Packages[packageName]
+		assert.Len(t, pkgs, 1)
+		assert.Equal(t, repo2.HTMLURL(), pkgs[0].Source.URL)
+		assert.Equal(t, "git", pkgs[0].Source.Type)
+		assert.Equal(t, packageVersion, pkgs[0].Source.Reference)
+
+		// Callers without repository access still get the package metadata, but not the private source URL.
+		req = NewRequest(t, "GET", fmt.Sprintf("%s/p2/%s/%s.json", url, vendorName, projectName)).
+			AddBasicAuth(otherUser.Name)
+		resp = MakeRequest(t, req, http.StatusOK)
+
+		result = DecodeJSON(t, resp, &composer.PackageMetadataResponse{})
+		pkgs = result.Packages[packageName]
+		assert.Len(t, pkgs, 1)
+		assert.Empty(t, pkgs[0].Source.URL)
+		assert.Empty(t, pkgs[0].Source.Type)
+		assert.Empty(t, pkgs[0].Source.Reference)
+	})
+
+	t.Run("WebVisibilityBadge", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		listReq := NewRequest(t, "GET", fmt.Sprintf("/%s/-/packages", user.Name)).
+			AddBasicAuth(user.Name)
+		listResp := MakeRequest(t, listReq, http.StatusOK)
+		listDoc := NewHTMLParser(t, bytes.NewReader(listResp.Body.Bytes()))
+		assert.Equal(t, 0, listDoc.Find(".item-title .ui.basic.label").Length())
+
+		viewReq := NewRequest(t, "GET", fmt.Sprintf("/%s/-/packages/composer/%s/%s", user.Name, neturl.PathEscape(packageName), neturl.PathEscape(packageVersion))).
+			AddBasicAuth(user.Name)
+		viewResp := MakeRequest(t, viewReq, http.StatusOK)
+		viewDoc := NewHTMLParser(t, bytes.NewReader(viewResp.Body.Bytes()))
+		assert.Equal(t, 0, viewDoc.Find(".issue-title-header .ui.basic.label").Length())
+
+		privatePackageName := privateUser.Name + "/private-composer-package"
+		privatePackageVersion := "1.0.0"
+		privateContent := test.WriteZipArchive(map[string]string{
+			"composer.json": `{
+				"name": "` + privatePackageName + `",
+				"description": "Private Package",
+				"type": "` + packageType + `",
+				"license": "` + packageLicense + `",
+				"authors": [
+					{
+						"name": "` + packageAuthor + `"
+					}
+				]
+			}`,
+		}).Bytes()
+		privateUploadURL := fmt.Sprintf("%sapi/packages/%s/composer?version=%s", setting.AppURL, privateUser.Name, privatePackageVersion)
+
+		uploadReq := NewRequestWithBody(t, "PUT", privateUploadURL, bytes.NewReader(privateContent)).
+			AddBasicAuth(privateUser.Name)
+		MakeRequest(t, uploadReq, http.StatusCreated)
+		privateSession := loginUser(t, privateUser.Name)
+
+		privateListReq := NewRequest(t, "GET", fmt.Sprintf("/%s/-/packages", privateUser.Name))
+		privateListResp := privateSession.MakeRequest(t, privateListReq, http.StatusOK)
+		privateListDoc := NewHTMLParser(t, bytes.NewReader(privateListResp.Body.Bytes()))
+		assert.Equal(t, 1, privateListDoc.Find(".item-title .ui.basic.label").Length())
+		assert.Equal(t, "Private", privateListDoc.Find(".item-title .ui.basic.label").First().Text())
+
+		privateViewReq := NewRequest(t, "GET", fmt.Sprintf("/%s/-/packages/composer/%s/%s", privateUser.Name, neturl.PathEscape(privatePackageName), neturl.PathEscape(privatePackageVersion)))
+		privateViewResp := privateSession.MakeRequest(t, privateViewReq, http.StatusOK)
+		privateViewDoc := NewHTMLParser(t, bytes.NewReader(privateViewResp.Body.Bytes()))
+		assert.Equal(t, 1, privateViewDoc.Find(".issue-title-header .ui.basic.label").Length())
+		assert.Equal(t, "Private", privateViewDoc.Find(".issue-title-header .ui.basic.label").First().Text())
 	})
 }
diff --git a/tests/integration/api_packages_conan_test.go b/tests/integration/api_packages_conan_test.go
index 7422e8f5186..27d57fc479d 100644
--- a/tests/integration/api_packages_conan_test.go
+++ b/tests/integration/api_packages_conan_test.go
@@ -11,16 +11,16 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/packages"
-	conan_model "code.gitea.io/gitea/models/packages/conan"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	conan_module "code.gitea.io/gitea/modules/packages/conan"
-	"code.gitea.io/gitea/modules/setting"
-	conan_router "code.gitea.io/gitea/routers/api/packages/conan"
-	package_service "code.gitea.io/gitea/services/packages"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/packages"
+	conan_model "gitea.dev/models/packages/conan"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	conan_module "gitea.dev/modules/packages/conan"
+	"gitea.dev/modules/setting"
+	conan_router "gitea.dev/routers/api/packages/conan"
+	package_service "gitea.dev/services/packages"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_conda_test.go b/tests/integration/api_packages_conda_test.go
index 874fc4657f5..23f88abff4b 100644
--- a/tests/integration/api_packages_conda_test.go
+++ b/tests/integration/api_packages_conda_test.go
@@ -11,13 +11,13 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	conda_module "code.gitea.io/gitea/modules/packages/conda"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/zstd"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	conda_module "gitea.dev/modules/packages/conda"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/zstd"
+	"gitea.dev/tests"
 
 	"github.com/dsnet/compress/bzip2"
 	"github.com/stretchr/testify/assert"
diff --git a/tests/integration/api_packages_container_test.go b/tests/integration/api_packages_container_test.go
index 93dd100680b..298064de57c 100644
--- a/tests/integration/api_packages_container_test.go
+++ b/tests/integration/api_packages_container_test.go
@@ -15,16 +15,16 @@ import (
 	"sync"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	container_module "code.gitea.io/gitea/modules/packages/container"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	package_service "code.gitea.io/gitea/services/packages"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	container_module "gitea.dev/modules/packages/container"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	package_service "gitea.dev/services/packages"
+	"gitea.dev/tests"
 
 	oci "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/stretchr/testify/assert"
@@ -766,20 +766,16 @@ func TestPackageContainer(t *testing.T) {
 
 		var wg sync.WaitGroup
 		for i := range 10 {
-			wg.Add(1)
-
 			content := []byte{byte(i)}
 			digest := fmt.Sprintf("sha256:%x", sha256.Sum256(content))
 
-			go func() {
-				defer wg.Done()
-
+			wg.Go(func() {
 				req := NewRequestWithBody(t, "POST", fmt.Sprintf("%s/blobs/uploads?digest=%s", url, digest), bytes.NewReader(content)).
 					AddTokenAuth(userToken)
 				resp := MakeRequest(t, req, http.StatusCreated)
 
 				assert.Equal(t, digest, resp.Header().Get("Docker-Content-Digest"))
-			}()
+			})
 		}
 		wg.Wait()
 	})
diff --git a/tests/integration/api_packages_cran_test.go b/tests/integration/api_packages_cran_test.go
index d21ffb88792..f1c2c63ce36 100644
--- a/tests/integration/api_packages_cran_test.go
+++ b/tests/integration/api_packages_cran_test.go
@@ -11,12 +11,12 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	cran_module "code.gitea.io/gitea/modules/packages/cran"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	cran_module "gitea.dev/modules/packages/cran"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_debian_test.go b/tests/integration/api_packages_debian_test.go
index 663bfb9e67e..76b59199d39 100644
--- a/tests/integration/api_packages_debian_test.go
+++ b/tests/integration/api_packages_debian_test.go
@@ -14,13 +14,13 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/base"
-	debian_module "code.gitea.io/gitea/modules/packages/debian"
-	packages_cleanup_service "code.gitea.io/gitea/services/packages/cleanup"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/base"
+	debian_module "gitea.dev/modules/packages/debian"
+	packages_cleanup_service "gitea.dev/services/packages/cleanup"
+	"gitea.dev/tests"
 
 	"github.com/blakesmith/ar"
 	"github.com/stretchr/testify/assert"
diff --git a/tests/integration/api_packages_generic_test.go b/tests/integration/api_packages_generic_test.go
index 8ff51033c7b..f9a933b09f9 100644
--- a/tests/integration/api_packages_generic_test.go
+++ b/tests/integration/api_packages_generic_test.go
@@ -12,12 +12,12 @@ import (
 	neturl "net/url"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_goproxy_test.go b/tests/integration/api_packages_goproxy_test.go
index a91a6655450..615aaed5327 100644
--- a/tests/integration/api_packages_goproxy_test.go
+++ b/tests/integration/api_packages_goproxy_test.go
@@ -10,11 +10,11 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_helm_test.go b/tests/integration/api_packages_helm_test.go
index 02df4ae906d..f66676b81d4 100644
--- a/tests/integration/api_packages_helm_test.go
+++ b/tests/integration/api_packages_helm_test.go
@@ -12,15 +12,15 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	helm_module "code.gitea.io/gitea/modules/packages/helm"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	helm_module "gitea.dev/modules/packages/helm"
+	"gitea.dev/modules/setting"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestPackageHelm(t *testing.T) {
diff --git a/tests/integration/api_packages_maven_test.go b/tests/integration/api_packages_maven_test.go
index 468b32f2b8a..65d6844bbd0 100644
--- a/tests/integration/api_packages_maven_test.go
+++ b/tests/integration/api_packages_maven_test.go
@@ -12,12 +12,12 @@ import (
 	"sync"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/packages/maven"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/packages/maven"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -321,11 +321,9 @@ func TestPackageMavenConcurrent(t *testing.T) {
 
 		var wg sync.WaitGroup
 		for i := range 10 {
-			wg.Add(1)
-			go func(i int) {
+			wg.Go(func() {
 				putFile(t, fmt.Sprintf("/%s/%s.jar", packageVersion, strconv.Itoa(i)), "test", http.StatusCreated)
-				wg.Done()
-			}(i)
+			})
 		}
 		wg.Wait()
 	})
diff --git a/tests/integration/api_packages_npm_test.go b/tests/integration/api_packages_npm_test.go
index 92f9b61081b..1159b64da87 100644
--- a/tests/integration/api_packages_npm_test.go
+++ b/tests/integration/api_packages_npm_test.go
@@ -11,15 +11,17 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/packages/npm"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/packages"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/packages/npm"
+	"gitea.dev/modules/setting"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestPackageNpm(t *testing.T) {
@@ -39,6 +41,7 @@ func TestPackageNpm(t *testing.T) {
 	packageBinPath := "./cli.sh"
 	repoType := "gitea"
 	repoURL := "http://localhost:3000/gitea/test.git"
+	repoDirectory := "package-subdir"
 
 	data := "H4sIAAAAAAAA/ytITM5OTE/VL4DQelnF+XkMVAYGBgZmJiYK2MRBwNDcSIHB2NTMwNDQzMwAqA7IMDUxA9LUdgg2UFpcklgEdAql5kD8ogCnhwio5lJQUMpLzE1VslJQcihOzi9I1S9JLS7RhSYIJR2QgrLUouLM/DyQGkM9Az1D3YIiqExKanFyUWZBCVQ2BKhVwQVJDKwosbQkI78IJO/tZ+LsbRykxFXLNdA+HwWjYBSMgpENACgAbtAACAAA"
 
@@ -67,8 +70,10 @@ func TestPackageNpm(t *testing.T) {
 					},
 					"repository": {
 						"type": "` + repoType + `",
-						"url": "` + repoURL + `"
+						"url": "` + repoURL + `",
+						"directory": "` + repoDirectory + `"
 					},
+					"readme": "[docs](docs/usage.md)\n![logo](logo.png)",
 					"peerDependencies": {
 						"tea": "2.x",
 						"soy-milk": "1.2"
@@ -282,6 +287,28 @@ func TestPackageNpm(t *testing.T) {
 		}
 	})
 
+	t.Run("WebViewReadmeRepoLinks", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		pvs, err := packages.GetVersionsByPackageType(t.Context(), user.ID, packages.TypeNpm)
+		assert.NoError(t, err)
+		require.Len(t, pvs, 1)
+
+		// link the package to a repository so README relative links resolve against
+		// repository files instead of the site root
+		repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+		assert.NoError(t, packages.SetRepositoryLink(t.Context(), pvs[0].PackageID, repo.ID))
+
+		req := NewRequest(t, "GET", fmt.Sprintf("/%s/-/packages/npm/%s/%s", user.Name, url.PathEscape(packageName), packageVersion)).
+			AddBasicAuth(user.Name)
+		resp := MakeRequest(t, req, http.StatusOK)
+		doc := NewHTMLParser(t, resp.Body)
+		rendered, _ := doc.Find(".markup.markdown").Html()
+		assertHTMLEq(t, `<p dir="auto"><a href="/user2/repo1/src/branch/master/package-subdir/docs/usage.md" rel="nofollow">docs</a>
+<a href="/user2/repo1/src/branch/master/package-subdir/logo.png" rel="nofollow noopener" target="_blank"><img src="/user2/repo1/media/branch/master/package-subdir/logo.png" alt="logo" loading="lazy"/></a></p>
+`, rendered)
+	})
+
 	t.Run("Delete", func(t *testing.T) {
 		defer tests.PrintCurrentTest(t)()
 
diff --git a/tests/integration/api_packages_nuget_test.go b/tests/integration/api_packages_nuget_test.go
index 47aa069f794..be5b4463060 100644
--- a/tests/integration/api_packages_nuget_test.go
+++ b/tests/integration/api_packages_nuget_test.go
@@ -18,17 +18,17 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	nuget_module "code.gitea.io/gitea/modules/packages/nuget"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/routers/api/packages/nuget"
-	packageService "code.gitea.io/gitea/services/packages"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	nuget_module "gitea.dev/modules/packages/nuget"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/routers/api/packages/nuget"
+	packageService "gitea.dev/services/packages"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_pub_test.go b/tests/integration/api_packages_pub_test.go
index 9873248a431..b5829b68323 100644
--- a/tests/integration/api_packages_pub_test.go
+++ b/tests/integration/api_packages_pub_test.go
@@ -15,12 +15,12 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	pub_module "code.gitea.io/gitea/modules/packages/pub"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	pub_module "gitea.dev/modules/packages/pub"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_pypi_test.go b/tests/integration/api_packages_pypi_test.go
index 67786b3e03c..cae33f55c65 100644
--- a/tests/integration/api_packages_pypi_test.go
+++ b/tests/integration/api_packages_pypi_test.go
@@ -13,11 +13,11 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/packages/pypi"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/packages/pypi"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_rpm_test.go b/tests/integration/api_packages_rpm_test.go
index 493964ebbc3..5b2b5bb0c6c 100644
--- a/tests/integration/api_packages_rpm_test.go
+++ b/tests/integration/api_packages_rpm_test.go
@@ -16,13 +16,13 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	rpm_module "code.gitea.io/gitea/modules/packages/rpm"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	rpm_module "gitea.dev/modules/packages/rpm"
+	"gitea.dev/modules/setting"
+	"gitea.dev/tests"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/sassoftware/go-rpmutils"
diff --git a/tests/integration/api_packages_rubygems_test.go b/tests/integration/api_packages_rubygems_test.go
index 6236f13714d..252cdf6b05f 100644
--- a/tests/integration/api_packages_rubygems_test.go
+++ b/tests/integration/api_packages_rubygems_test.go
@@ -15,11 +15,11 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/packages/rubygems"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/packages/rubygems"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_swift_test.go b/tests/integration/api_packages_swift_test.go
index aa5b93f67be..83452244e3e 100644
--- a/tests/integration/api_packages_swift_test.go
+++ b/tests/integration/api_packages_swift_test.go
@@ -12,14 +12,14 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	swift_module "code.gitea.io/gitea/modules/packages/swift"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	swift_router "code.gitea.io/gitea/routers/api/packages/swift"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	swift_module "gitea.dev/modules/packages/swift"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	swift_router "gitea.dev/routers/api/packages/swift"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/api_packages_terraform_test.go b/tests/integration/api_packages_terraform_test.go
index 3f39aa5bfca..c823923692a 100644
--- a/tests/integration/api_packages_terraform_test.go
+++ b/tests/integration/api_packages_terraform_test.go
@@ -9,10 +9,10 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/tests"
 
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
diff --git a/tests/integration/api_packages_test.go b/tests/integration/api_packages_test.go
index f49cbb9a258..6dba3e125e7 100644
--- a/tests/integration/api_packages_test.go
+++ b/tests/integration/api_packages_test.go
@@ -12,19 +12,19 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	container_module "code.gitea.io/gitea/modules/packages/container"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	packages_service "code.gitea.io/gitea/services/packages"
-	packages_cleanup_service "code.gitea.io/gitea/services/packages/cleanup"
-	repo_service "code.gitea.io/gitea/services/repository"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	container_module "gitea.dev/modules/packages/container"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	packages_service "gitea.dev/services/packages"
+	packages_cleanup_service "gitea.dev/services/packages/cleanup"
+	repo_service "gitea.dev/services/repository"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_packages_vagrant_test.go b/tests/integration/api_packages_vagrant_test.go
index 86c1f066119..ebdfd078c73 100644
--- a/tests/integration/api_packages_vagrant_test.go
+++ b/tests/integration/api_packages_vagrant_test.go
@@ -12,13 +12,13 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	vagrant_module "code.gitea.io/gitea/modules/packages/vagrant"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	vagrant_module "gitea.dev/modules/packages/vagrant"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_private_serv_test.go b/tests/integration/api_private_serv_test.go
index 43bf9c02ad9..fcac2174af8 100644
--- a/tests/integration/api_private_serv_test.go
+++ b/tests/integration/api_private_serv_test.go
@@ -8,9 +8,9 @@ import (
 	"net/url"
 	"testing"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/modules/private"
+	asymkey_model "gitea.dev/models/asymkey"
+	"gitea.dev/models/perm"
+	"gitea.dev/modules/private"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_public_only_test.go b/tests/integration/api_public_only_test.go
new file mode 100644
index 00000000000..13a764fcc55
--- /dev/null
+++ b/tests/integration/api_public_only_test.go
@@ -0,0 +1,107 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"net/http"
+	"testing"
+
+	auth_model "gitea.dev/models/auth"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAPIUserReposPublicOnly(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	token := getUserToken(t, "user2", auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadRepository, auth_model.AccessTokenScopePublicOnly)
+	req := NewRequest(t, "GET", "/api/v1/user/repos").
+		AddTokenAuth(token)
+	resp := MakeRequest(t, req, http.StatusOK)
+
+	var repos []api.Repository
+	DecodeJSON(t, resp, &repos)
+	assert.NotEmpty(t, repos)
+	for _, repo := range repos {
+		assert.False(t, repo.Private)
+	}
+	assert.NotContains(t, repoNames(repos), "user2/repo2")
+
+	req = NewRequest(t, "GET", "/api/v1/users/user2/repos").
+		AddTokenAuth(token)
+	resp = MakeRequest(t, req, http.StatusOK)
+	DecodeJSON(t, resp, &repos)
+	assert.NotEmpty(t, repos)
+	for _, repo := range repos {
+		assert.False(t, repo.Private)
+	}
+	assert.NotContains(t, repoNames(repos), "user2/repo2")
+}
+
+func repoNames(repos []api.Repository) []string {
+	names := make([]string, 0, len(repos))
+	for _, repo := range repos {
+		names = append(names, repo.FullName)
+	}
+	return names
+}
+
+func TestAPIRepoByIDPublicOnly(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	token := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository, auth_model.AccessTokenScopePublicOnly)
+	req := NewRequest(t, "GET", "/api/v1/repositories/1").
+		AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusOK)
+
+	req = NewRequest(t, "GET", "/api/v1/repositories/2").
+		AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusNotFound)
+}
+
+func TestAPIActivityFeedsPublicOnly(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	token := getUserToken(t, "user2", auth_model.AccessTokenScopeReadUser)
+	req := NewRequest(t, "GET", "/api/v1/users/user2/activities/feeds").
+		AddTokenAuth(token)
+	resp := MakeRequest(t, req, http.StatusOK)
+	var activities []api.Activity
+	DecodeJSON(t, resp, &activities)
+	assert.NotEmpty(t, activities)
+
+	publicToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopePublicOnly)
+	req = NewRequest(t, "GET", "/api/v1/users/user2/activities/feeds").
+		AddTokenAuth(publicToken)
+	resp = MakeRequest(t, req, http.StatusOK)
+	DecodeJSON(t, resp, &activities)
+	assertPublicActivitiesOnly(t, activities)
+
+	orgToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadOrganization)
+	req = NewRequest(t, "GET", "/api/v1/orgs/org3/activities/feeds").
+		AddTokenAuth(orgToken)
+	resp = MakeRequest(t, req, http.StatusOK)
+	DecodeJSON(t, resp, &activities)
+	assert.NotEmpty(t, activities)
+
+	publicOrgToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadOrganization, auth_model.AccessTokenScopePublicOnly)
+	req = NewRequest(t, "GET", "/api/v1/orgs/org3/activities/feeds").
+		AddTokenAuth(publicOrgToken)
+	resp = MakeRequest(t, req, http.StatusOK)
+	DecodeJSON(t, resp, &activities)
+	assertPublicActivitiesOnly(t, activities)
+}
+
+func assertPublicActivitiesOnly(t *testing.T, activities []api.Activity) {
+	t.Helper()
+
+	for _, activity := range activities {
+		assert.False(t, activity.IsPrivate)
+		if activity.Repo != nil {
+			assert.False(t, activity.Repo.Private)
+		}
+	}
+}
diff --git a/tests/integration/api_pull_commits_test.go b/tests/integration/api_pull_commits_test.go
index fd077b1e7c1..3c326046228 100644
--- a/tests/integration/api_pull_commits_test.go
+++ b/tests/integration/api_pull_commits_test.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/api_pull_review_test.go b/tests/integration/api_pull_review_test.go
index c1ab87405bf..f7c7bdde160 100644
--- a/tests/integration/api_pull_review_test.go
+++ b/tests/integration/api_pull_review_test.go
@@ -8,19 +8,19 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/json"
-	api "code.gitea.io/gitea/modules/structs"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	api "gitea.dev/modules/structs"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -556,9 +556,7 @@ func testAPIPullReviewCommentReply(t *testing.T) {
 	// happy path
 	req := NewRequestWithJSON(t, http.MethodPost, url, &api.CreatePullReviewCommentReplyOptions{Body: "the reply"}).AddTokenAuth(token)
 	resp := MakeRequest(t, req, http.StatusCreated)
-
-	var reply api.PullReviewComment
-	DecodeJSON(t, resp, &reply)
+	reply := DecodeJSON(t, resp, &api.PullReviewComment{})
 	assert.Equal(t, "the reply", reply.Body)
 	assert.Equal(t, parent.ReviewID, reply.ReviewID)
 	assert.Equal(t, "README.md", reply.Path)
diff --git a/tests/integration/api_pull_test.go b/tests/integration/api_pull_test.go
index 4bc419e5e43..e9ccbe45831 100644
--- a/tests/integration/api_pull_test.go
+++ b/tests/integration/api_pull_test.go
@@ -13,24 +13,24 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/services/forms"
-	"code.gitea.io/gitea/services/gitdiff"
-	issue_service "code.gitea.io/gitea/services/issue"
-	pull_service "code.gitea.io/gitea/services/pull"
-	repo_service "code.gitea.io/gitea/services/repository"
-	files_service "code.gitea.io/gitea/services/repository/files"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/convert"
+	"gitea.dev/services/forms"
+	"gitea.dev/services/gitdiff"
+	issue_service "gitea.dev/services/issue"
+	pull_service "gitea.dev/services/pull"
+	repo_service "gitea.dev/services/repository"
+	files_service "gitea.dev/services/repository/files"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -155,8 +155,7 @@ func TestAPIViewPullsByBaseHead(t *testing.T) {
 		AddTokenAuth(ctx.Token)
 	resp := ctx.Session.MakeRequest(t, req, http.StatusOK)
 
-	pull := &api.PullRequest{}
-	DecodeJSON(t, resp, pull)
+	pull := DecodeJSON(t, resp, &api.PullRequest{})
 	assert.EqualValues(t, 3, pull.Index)
 	assert.EqualValues(t, 2, pull.ID)
 
@@ -394,10 +393,8 @@ func TestAPICreatePullWithFieldsSuccess(t *testing.T) {
 
 	req := NewRequestWithJSON(t, http.MethodPost, fmt.Sprintf("/api/v1/repos/%s/%s/pulls", owner10.Name, repo10.Name), opts).
 		AddTokenAuth(token)
-
-	res := MakeRequest(t, req, http.StatusCreated)
-	pull := new(api.PullRequest)
-	DecodeJSON(t, res, pull)
+	resp := MakeRequest(t, req, http.StatusCreated)
+	pull := DecodeJSON(t, resp, &api.PullRequest{})
 
 	assert.NotNil(t, pull.Milestone)
 	assert.Equal(t, opts.Milestone, pull.Milestone.ID)
diff --git a/tests/integration/api_releases_attachment_test.go b/tests/integration/api_releases_attachment_test.go
index f6698fbb5e7..c94ece43869 100644
--- a/tests/integration/api_releases_attachment_test.go
+++ b/tests/integration/api_releases_attachment_test.go
@@ -8,13 +8,13 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_releases_test.go b/tests/integration/api_releases_test.go
index 7135f2ca365..51cf3e23646 100644
--- a/tests/integration/api_releases_test.go
+++ b/tests/integration/api_releases_test.go
@@ -14,17 +14,17 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_archive_test.go b/tests/integration/api_repo_archive_test.go
index 97c2c0d54b5..6e12c55ac71 100644
--- a/tests/integration/api_repo_archive_test.go
+++ b/tests/integration/api_repo_archive_test.go
@@ -11,13 +11,13 @@ import (
 	"regexp"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_avatar_test.go b/tests/integration/api_repo_avatar_test.go
index e4d0e06d003..cab82584496 100644
--- a/tests/integration/api_repo_avatar_test.go
+++ b/tests/integration/api_repo_avatar_test.go
@@ -11,13 +11,13 @@ import (
 	"path/filepath"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_branch_test.go b/tests/integration/api_repo_branch_test.go
index 2438db72c5a..188da619fb9 100644
--- a/tests/integration/api_repo_branch_test.go
+++ b/tests/integration/api_repo_branch_test.go
@@ -11,14 +11,14 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -29,10 +29,10 @@ func TestAPIRepoBranchesPlain(t *testing.T) {
 		user1 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
 		session := loginUser(t, user1.LowerName)
 
-		// public only token should be forbidden
+		// public-only token cannot see a private repo
 		publicOnlyToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopePublicOnly, auth_model.AccessTokenScopeWriteRepository)
 		link, _ := url.Parse(fmt.Sprintf("/api/v1/repos/org3/%s/branches", repo3.Name)) // a plain repo
-		MakeRequest(t, NewRequest(t, "GET", link.String()).AddTokenAuth(publicOnlyToken), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "GET", link.String()).AddTokenAuth(publicOnlyToken), http.StatusNotFound)
 
 		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
 		resp := MakeRequest(t, NewRequest(t, "GET", link.String()).AddTokenAuth(token), http.StatusOK)
@@ -46,7 +46,7 @@ func TestAPIRepoBranchesPlain(t *testing.T) {
 		assert.Equal(t, "master", branches[1].Name)
 
 		link2, _ := url.Parse(fmt.Sprintf("/api/v1/repos/org3/%s/branches/test_branch", repo3.Name))
-		MakeRequest(t, NewRequest(t, "GET", link2.String()).AddTokenAuth(publicOnlyToken), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "GET", link2.String()).AddTokenAuth(publicOnlyToken), http.StatusNotFound)
 
 		resp = MakeRequest(t, NewRequest(t, "GET", link2.String()).AddTokenAuth(token), http.StatusOK)
 		bs, err = io.ReadAll(resp.Body)
@@ -55,7 +55,7 @@ func TestAPIRepoBranchesPlain(t *testing.T) {
 		assert.NoError(t, json.Unmarshal(bs, &branch))
 		assert.Equal(t, "test_branch", branch.Name)
 
-		MakeRequest(t, NewRequest(t, "POST", link.String()).AddTokenAuth(publicOnlyToken), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "POST", link.String()).AddTokenAuth(publicOnlyToken), http.StatusNotFound)
 
 		req := NewRequest(t, "POST", link.String()).AddTokenAuth(token)
 		req.Header.Add("Content-Type", "application/json")
@@ -81,7 +81,7 @@ func TestAPIRepoBranchesPlain(t *testing.T) {
 
 		link3, _ := url.Parse(fmt.Sprintf("/api/v1/repos/org3/%s/branches/test_branch2", repo3.Name))
 		MakeRequest(t, NewRequest(t, "DELETE", link3.String()), http.StatusNotFound)
-		MakeRequest(t, NewRequest(t, "DELETE", link3.String()).AddTokenAuth(publicOnlyToken), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "DELETE", link3.String()).AddTokenAuth(publicOnlyToken), http.StatusNotFound)
 
 		MakeRequest(t, NewRequest(t, "DELETE", link3.String()).AddTokenAuth(token), http.StatusNoContent)
 		assert.NoError(t, err)
diff --git a/tests/integration/api_repo_collaborator_test.go b/tests/integration/api_repo_collaborator_test.go
index f5474b1ed86..00afa3ea479 100644
--- a/tests/integration/api_repo_collaborator_test.go
+++ b/tests/integration/api_repo_collaborator_test.go
@@ -7,13 +7,13 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_compare_test.go b/tests/integration/api_repo_compare_test.go
index 8aa0035b0a9..0d8cec77767 100644
--- a/tests/integration/api_repo_compare_test.go
+++ b/tests/integration/api_repo_compare_test.go
@@ -8,12 +8,12 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/api_repo_edit_test.go b/tests/integration/api_repo_edit_test.go
index e37b214fa88..d30063bdf9e 100644
--- a/tests/integration/api_repo_edit_test.go
+++ b/tests/integration/api_repo_edit_test.go
@@ -10,14 +10,15 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	api "code.gitea.io/gitea/modules/structs"
-	mirror_service "code.gitea.io/gitea/services/mirror"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	api "gitea.dev/modules/structs"
+	mirror_service "gitea.dev/services/mirror"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -69,6 +70,9 @@ func getRepoEditOptionFromRepo(repo *repo_model.Repository) *api.EditRepoOption
 	allowRebaseMerge := false
 	allowSquash := false
 	allowFastForwardOnly := false
+	allowMergeUpdate := false
+	allowRebaseUpdate := false
+	defaultUpdateStyle := string(repo_model.UpdateStyleMerge)
 	if unit, err := repo.GetUnit(ctx, unit_model.TypePullRequests); err == nil {
 		config := unit.PullRequestsConfig()
 		hasPullRequests = true
@@ -78,6 +82,9 @@ func getRepoEditOptionFromRepo(repo *repo_model.Repository) *api.EditRepoOption
 		allowRebaseMerge = config.AllowRebaseMerge
 		allowSquash = config.AllowSquash
 		allowFastForwardOnly = config.AllowFastForwardOnly
+		allowMergeUpdate = config.AllowMergeUpdate
+		allowRebaseUpdate = config.AllowRebaseUpdate
+		defaultUpdateStyle = string(config.DefaultUpdateStyle)
 	}
 	archived := repo.IsArchived
 	hasProjects := false
@@ -122,6 +129,9 @@ func getRepoEditOptionFromRepo(repo *repo_model.Repository) *api.EditRepoOption
 		AllowRebaseMerge:          &allowRebaseMerge,
 		AllowSquash:               &allowSquash,
 		AllowFastForwardOnly:      &allowFastForwardOnly,
+		AllowMergeUpdate:          &allowMergeUpdate,
+		AllowRebaseUpdate:         &allowRebaseUpdate,
+		DefaultUpdateStyle:        &defaultUpdateStyle,
 		Archived:                  &archived,
 	}
 }
@@ -148,6 +158,9 @@ func getNewRepoEditOption(opts *api.EditRepoOption) *api.EditRepoOption {
 	allowRebase := !*opts.AllowRebase
 	allowRebaseMerge := !*opts.AllowRebaseMerge
 	allowSquash := !*opts.AllowSquash
+	allowMergeUpdate := false
+	allowRebaseUpdate := true
+	defaultUpdateStyle := string(repo_model.UpdateStyleRebase)
 	archived := !*opts.Archived
 
 	return &api.EditRepoOption{
@@ -169,6 +182,9 @@ func getNewRepoEditOption(opts *api.EditRepoOption) *api.EditRepoOption {
 		AllowRebase:               &allowRebase,
 		AllowRebaseMerge:          &allowRebaseMerge,
 		AllowSquash:               &allowSquash,
+		AllowMergeUpdate:          &allowMergeUpdate,
+		AllowRebaseUpdate:         &allowRebaseUpdate,
+		DefaultUpdateStyle:        &defaultUpdateStyle,
 		Archived:                  &archived,
 	}
 }
@@ -488,3 +504,31 @@ func TestAPIRepoEdit(t *testing.T) {
 		assert.Equal(t, token, password)
 	})
 }
+
+func TestAPIRepoEditPullUpdateSettingsValidation(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+
+	session := loginUser(t, user2.Name)
+	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
+	repoURL := fmt.Sprintf("/api/v1/repos/%s/%s", user2.Name, repo1.Name)
+
+	allowMergeUpdate := false
+	allowRebaseUpdate := false
+	req := NewRequestWithJSON(t, "PATCH", repoURL, &api.EditRepoOption{
+		AllowMergeUpdate:  &allowMergeUpdate,
+		AllowRebaseUpdate: &allowRebaseUpdate,
+	}).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusUnprocessableEntity)
+
+	allowRebaseUpdate = true
+	defaultUpdateStyle := string(repo_model.UpdateStyleMerge)
+	req = NewRequestWithJSON(t, "PATCH", repoURL, &api.EditRepoOption{
+		AllowMergeUpdate:   &allowMergeUpdate,
+		AllowRebaseUpdate:  &allowRebaseUpdate,
+		DefaultUpdateStyle: &defaultUpdateStyle,
+	}).AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusUnprocessableEntity)
+}
diff --git a/tests/integration/api_repo_file_create_test.go b/tests/integration/api_repo_file_create_test.go
index 26cc0aad0e6..107a039e9d5 100644
--- a/tests/integration/api_repo_file_create_test.go
+++ b/tests/integration/api_repo_file_create_test.go
@@ -12,14 +12,14 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/context"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_file_delete_test.go b/tests/integration/api_repo_file_delete_test.go
index 96ca39dab9e..293977f6bf4 100644
--- a/tests/integration/api_repo_file_delete_test.go
+++ b/tests/integration/api_repo_file_delete_test.go
@@ -9,11 +9,11 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_file_diffpatch_test.go b/tests/integration/api_repo_file_diffpatch_test.go
index 928ea3bfb8e..fdae6c910ac 100644
--- a/tests/integration/api_repo_file_diffpatch_test.go
+++ b/tests/integration/api_repo_file_diffpatch_test.go
@@ -9,11 +9,11 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_file_get_test.go b/tests/integration/api_repo_file_get_test.go
index ec50cf52f49..267983409de 100644
--- a/tests/integration/api_repo_file_get_test.go
+++ b/tests/integration/api_repo_file_get_test.go
@@ -8,8 +8,8 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -42,8 +42,8 @@ func TestAPIGetRawFileOrLFS(t *testing.T) {
 			lfs := lfsCommitAndPushTest(t, dstPath, testFileSizeSmall)[0]
 
 			reqLFS := NewRequest(t, "GET", "/api/v1/repos/user2/repo-lfs-test/media/"+lfs).AddTokenAuth(httpContext.Token)
-			respLFS := MakeRequestNilResponseRecorder(t, reqLFS, http.StatusOK)
-			assert.Equal(t, testFileSizeSmall, respLFS.Length)
+			respLFS := MakeRequest(t, reqLFS, http.StatusOK)
+			assert.Equal(t, testFileSizeSmall, respLFS.Body.Len())
 		})
 	})
 }
diff --git a/tests/integration/api_repo_file_helpers.go b/tests/integration/api_repo_file_helpers.go
index 9a4c4486646..e5cf8b9228f 100644
--- a/tests/integration/api_repo_file_helpers.go
+++ b/tests/integration/api_repo_file_helpers.go
@@ -9,11 +9,11 @@ import (
 	"strings"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	repo_model "gitea.dev/models/repo"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	files_service "gitea.dev/services/repository/files"
 
 	"github.com/stretchr/testify/require"
 )
diff --git a/tests/integration/api_repo_file_update_test.go b/tests/integration/api_repo_file_update_test.go
index 4098beeefd9..d2a191e12a8 100644
--- a/tests/integration/api_repo_file_update_test.go
+++ b/tests/integration/api_repo_file_update_test.go
@@ -11,14 +11,14 @@ import (
 	"path"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/context"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_files_change_test.go b/tests/integration/api_repo_files_change_test.go
index d5189440831..c0306feae3f 100644
--- a/tests/integration/api_repo_files_change_test.go
+++ b/tests/integration/api_repo_files_change_test.go
@@ -10,14 +10,14 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/context"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/context"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_files_get_test.go b/tests/integration/api_repo_files_get_test.go
index 3d299cd655e..3fbdce9f68d 100644
--- a/tests/integration/api_repo_files_get_test.go
+++ b/tests/integration/api_repo_files_get_test.go
@@ -9,17 +9,17 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/api_repo_get_contents_list_test.go b/tests/integration/api_repo_get_contents_list_test.go
index 0b8bc5a8dc8..52a3a163f19 100644
--- a/tests/integration/api_repo_get_contents_list_test.go
+++ b/tests/integration/api_repo_get_contents_list_test.go
@@ -10,14 +10,14 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	repo_service "code.gitea.io/gitea/services/repository"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	repo_service "gitea.dev/services/repository"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_get_contents_test.go b/tests/integration/api_repo_get_contents_test.go
index bc9a17ff8d2..61d4bba1a41 100644
--- a/tests/integration/api_repo_get_contents_test.go
+++ b/tests/integration/api_repo_get_contents_test.go
@@ -11,14 +11,14 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	repo_service "code.gitea.io/gitea/services/repository"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	repo_service "gitea.dev/services/repository"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/api_repo_git_blobs_test.go b/tests/integration/api_repo_git_blobs_test.go
index d8270ad9f36..887a7366845 100644
--- a/tests/integration/api_repo_git_blobs_test.go
+++ b/tests/integration/api_repo_git_blobs_test.go
@@ -7,12 +7,12 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_git_commits_test.go b/tests/integration/api_repo_git_commits_test.go
index 2c09026c906..504d8e933c2 100644
--- a/tests/integration/api_repo_git_commits_test.go
+++ b/tests/integration/api_repo_git_commits_test.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_git_hook_test.go b/tests/integration/api_repo_git_hook_test.go
index d8254c6c614..01a17c7b08b 100644
--- a/tests/integration/api_repo_git_hook_test.go
+++ b/tests/integration/api_repo_git_hook_test.go
@@ -8,14 +8,14 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_git_notes_test.go b/tests/integration/api_repo_git_notes_test.go
index 912b4f75c77..8cb531e792c 100644
--- a/tests/integration/api_repo_git_notes_test.go
+++ b/tests/integration/api_repo_git_notes_test.go
@@ -8,10 +8,10 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_git_ref_test.go b/tests/integration/api_repo_git_ref_test.go
index 875752ae3fd..fc43c4eac69 100644
--- a/tests/integration/api_repo_git_ref_test.go
+++ b/tests/integration/api_repo_git_ref_test.go
@@ -7,10 +7,10 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/tests"
 )
 
 func TestAPIReposGitRefs(t *testing.T) {
diff --git a/tests/integration/api_repo_git_tags_test.go b/tests/integration/api_repo_git_tags_test.go
index 9ce1fb6fc17..33a2d6c7e8a 100644
--- a/tests/integration/api_repo_git_tags_test.go
+++ b/tests/integration/api_repo_git_tags_test.go
@@ -8,13 +8,13 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_git_trees_test.go b/tests/integration/api_repo_git_trees_test.go
index 5cfce1044d9..f4528927795 100644
--- a/tests/integration/api_repo_git_trees_test.go
+++ b/tests/integration/api_repo_git_trees_test.go
@@ -7,12 +7,12 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/api_repo_hook_test.go b/tests/integration/api_repo_hook_test.go
index e34b3f80f9c..72972aa8cd9 100644
--- a/tests/integration/api_repo_hook_test.go
+++ b/tests/integration/api_repo_hook_test.go
@@ -8,12 +8,12 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_languages_test.go b/tests/integration/api_repo_languages_test.go
index 89744067d7d..7d16fe4a9da 100644
--- a/tests/integration/api_repo_languages_test.go
+++ b/tests/integration/api_repo_languages_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_lfs_locks_test.go b/tests/integration/api_repo_lfs_locks_test.go
index 460b32a7dd7..f1a38334c1e 100644
--- a/tests/integration/api_repo_lfs_locks_test.go
+++ b/tests/integration/api_repo_lfs_locks_test.go
@@ -9,20 +9,21 @@ import (
 	"testing"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
 
 func TestAPILFSLocksNotStarted(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-	setting.LFS.StartServer = false
+	defer test.MockVariableValue(&setting.LFS.StartServer, false)()
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 
@@ -38,7 +39,7 @@ func TestAPILFSLocksNotStarted(t *testing.T) {
 
 func TestAPILFSLocksNotLogin(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-	setting.LFS.StartServer = true
+	defer test.MockVariableValue(&setting.LFS.StartServer, true)()
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
 
@@ -51,7 +52,7 @@ func TestAPILFSLocksNotLogin(t *testing.T) {
 
 func TestAPILFSLocksLogged(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-	setting.LFS.StartServer = true
+	defer test.MockVariableValue(&setting.LFS.StartServer, true)()
 	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}) // in org 3
 	user4 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4}) // in org 3
 
diff --git a/tests/integration/api_repo_lfs_migrate_test.go b/tests/integration/api_repo_lfs_migrate_test.go
index 6ca6f9afabe..5a92d6dea69 100644
--- a/tests/integration/api_repo_lfs_migrate_test.go
+++ b/tests/integration/api_repo_lfs_migrate_test.go
@@ -8,25 +8,23 @@ import (
 	"path"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/migrations"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/migrations"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
 
 func TestAPIRepoLFSMigrateLocal(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	oldImportLocalPaths := setting.ImportLocalPaths
-	oldAllowLocalNetworks := setting.Migrations.AllowLocalNetworks
-	setting.ImportLocalPaths = true
-	setting.Migrations.AllowLocalNetworks = true
+	defer test.MockVariableValue(&setting.ImportLocalPaths, true)()
+	defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
 	assert.NoError(t, migrations.Init())
 
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
@@ -47,8 +45,4 @@ func TestAPIRepoLFSMigrateLocal(t *testing.T) {
 	assert.True(t, ok)
 	ok, _ = store.Verify(lfs.Pointer{Oid: "d6f175817f886ec6fbbc1515326465fa96c3bfd54a4ea06cfd6dbbd8340e0152", Size: 6})
 	assert.True(t, ok)
-
-	setting.ImportLocalPaths = oldImportLocalPaths
-	setting.Migrations.AllowLocalNetworks = oldAllowLocalNetworks
-	assert.NoError(t, migrations.Init()) // reset old migration settings
 }
diff --git a/tests/integration/api_repo_lfs_test.go b/tests/integration/api_repo_lfs_test.go
index 47bf244ee68..5dc8671e2ae 100644
--- a/tests/integration/api_repo_lfs_test.go
+++ b/tests/integration/api_repo_lfs_test.go
@@ -11,16 +11,16 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -28,8 +28,7 @@ import (
 
 func TestAPILFSNotStarted(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	setting.LFS.StartServer = false
+	defer test.MockVariableValue(&setting.LFS.StartServer, false)()
 
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
@@ -48,8 +47,7 @@ func TestAPILFSNotStarted(t *testing.T) {
 
 func TestAPILFSMediaType(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	setting.LFS.StartServer = true
+	defer test.MockVariableValue(&setting.LFS.StartServer, true)()
 
 	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
@@ -72,8 +70,7 @@ func createLFSTestRepository(t *testing.T, repoName string) *repo_model.Reposito
 
 func TestAPILFSBatch(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	setting.LFS.StartServer = true
+	defer test.MockVariableValue(&setting.LFS.StartServer, true)()
 
 	repo := createLFSTestRepository(t, "lfs-batch-repo")
 
@@ -326,8 +323,7 @@ func TestAPILFSBatch(t *testing.T) {
 
 func TestAPILFSUpload(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	setting.LFS.StartServer = true
+	defer test.MockVariableValue(&setting.LFS.StartServer, true)()
 
 	repo := createLFSTestRepository(t, "lfs-upload-repo")
 	oid := storeObjectInRepo(t, repo.ID, "dummy3")
@@ -428,8 +424,7 @@ func TestAPILFSUpload(t *testing.T) {
 
 func TestAPILFSVerify(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	setting.LFS.StartServer = true
+	defer test.MockVariableValue(&setting.LFS.StartServer, true)()
 
 	repo := createLFSTestRepository(t, "lfs-verify-repo")
 	oid := storeObjectInRepo(t, repo.ID, "dummy3")
diff --git a/tests/integration/api_repo_license_test.go b/tests/integration/api_repo_license_test.go
index 31358a1e3f6..33a0444a36b 100644
--- a/tests/integration/api_repo_license_test.go
+++ b/tests/integration/api_repo_license_test.go
@@ -10,9 +10,9 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
+	auth_model "gitea.dev/models/auth"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_raw_test.go b/tests/integration/api_repo_raw_test.go
index e9d741925f0..106ed001fe8 100644
--- a/tests/integration/api_repo_raw_test.go
+++ b/tests/integration/api_repo_raw_test.go
@@ -7,10 +7,10 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_secrets_test.go b/tests/integration/api_repo_secrets_test.go
index dc37e2beb60..580b4736b10 100644
--- a/tests/integration/api_repo_secrets_test.go
+++ b/tests/integration/api_repo_secrets_test.go
@@ -8,12 +8,12 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 )
 
 func TestAPIRepoSecrets(t *testing.T) {
diff --git a/tests/integration/api_repo_tags_test.go b/tests/integration/api_repo_tags_test.go
index 03dafafb2d6..55b25c40349 100644
--- a/tests/integration/api_repo_tags_test.go
+++ b/tests/integration/api_repo_tags_test.go
@@ -8,14 +8,15 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestAPIRepoTags(t *testing.T) {
@@ -35,24 +36,22 @@ func TestAPIRepoTags(t *testing.T) {
 
 	assert.Len(t, tags, 1)
 	assert.Equal(t, "v1.1", tags[0].Name)
-	assert.Equal(t, "Initial commit", tags[0].Message)
+	assert.Equal(t, "Initial commit\n", tags[0].Message)
 	assert.Equal(t, "65f1bf27bc3bf70f64657658635e66094edbcb4d", tags[0].Commit.SHA)
 	assert.Equal(t, setting.AppURL+"api/v1/repos/user2/repo1/git/commits/65f1bf27bc3bf70f64657658635e66094edbcb4d", tags[0].Commit.URL)
 	assert.Equal(t, setting.AppURL+"user2/repo1/archive/v1.1.zip", tags[0].ZipballURL)
 	assert.Equal(t, setting.AppURL+"user2/repo1/archive/v1.1.tar.gz", tags[0].TarballURL)
 
 	newTag := createNewTagUsingAPI(t, token, user.Name, repoName, "gitea/22", "", "nice!\nand some text")
+	assert.Equal(t, "nice!\nand some text\n", newTag.Message) // git message standard: there will always be a newline at the end of the message
+
 	resp = MakeRequest(t, req, http.StatusOK)
 	tags = DecodeJSON(t, resp, []*api.Tag{})
-	assert.Len(t, tags, 2)
-	for _, tag := range tags {
-		if tag.Name != "v1.1" {
-			assert.Equal(t, newTag.Name, tag.Name)
-			assert.Equal(t, newTag.Message, tag.Message)
-			assert.Equal(t, "nice!\nand some text", tag.Message)
-			assert.Equal(t, newTag.Commit.SHA, tag.Commit.SHA)
-		}
-	}
+	require.Len(t, tags, 2)
+	respTag := tags[0]
+	assert.Equal(t, newTag.Name, respTag.Name)
+	assert.Equal(t, newTag.Message, respTag.Message)
+	assert.Equal(t, newTag.Commit.SHA, respTag.Commit.SHA)
 
 	// get created tag
 	req = NewRequestf(t, "GET", "/api/v1/repos/%s/%s/tags/%s", user.Name, repoName, newTag.Name).
diff --git a/tests/integration/api_repo_teams_test.go b/tests/integration/api_repo_teams_test.go
index 042712165bd..506270e3ac3 100644
--- a/tests/integration/api_repo_teams_test.go
+++ b/tests/integration/api_repo_teams_test.go
@@ -8,14 +8,14 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_test.go b/tests/integration/api_repo_test.go
index 6b9cef58ae8..45d904c2614 100644
--- a/tests/integration/api_repo_test.go
+++ b/tests/integration/api_repo_test.go
@@ -9,18 +9,21 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	unit_model "code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	repo_service "code.gitea.io/gitea/services/repository"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	unit_model "gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/migrations"
+	repo_service "gitea.dev/services/repository"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestAPIUserReposNotLogin(t *testing.T) {
@@ -60,11 +63,7 @@ func TestAPISearchRepo(t *testing.T) {
 	user4 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 20})
 	orgUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 17})
 
-	oldAPIDefaultNum := setting.API.DefaultPagingNum
-	defer func() {
-		setting.API.DefaultPagingNum = oldAPIDefaultNum
-	}()
-	setting.API.DefaultPagingNum = 10
+	defer test.MockVariableValue(&setting.API.DefaultPagingNum, 10)()
 
 	// Map of expected results, where key is user for login
 	type expectedResults map[*user_model.User]struct {
@@ -352,45 +351,52 @@ func TestAPIGetRepoByIDUnauthorized(t *testing.T) {
 }
 
 func TestAPIRepoMigrate(t *testing.T) {
-	testCases := []struct {
-		ctxUserID, userID  int64
-		cloneURL, repoName string
-		expectedStatus     int
-	}{
-		{ctxUserID: 1, userID: 2, cloneURL: "https://github.com/go-gitea/test_repo.git", repoName: "git-admin", expectedStatus: http.StatusCreated},
-		{ctxUserID: 2, userID: 2, cloneURL: "https://github.com/go-gitea/test_repo.git", repoName: "git-own", expectedStatus: http.StatusCreated},
-		{ctxUserID: 2, userID: 1, cloneURL: "https://github.com/go-gitea/test_repo.git", repoName: "git-bad", expectedStatus: http.StatusForbidden},
-		{ctxUserID: 2, userID: 3, cloneURL: "https://github.com/go-gitea/test_repo.git", repoName: "git-org", expectedStatus: http.StatusCreated},
-		{ctxUserID: 2, userID: 6, cloneURL: "https://github.com/go-gitea/test_repo.git", repoName: "git-bad-org", expectedStatus: http.StatusForbidden},
-		{ctxUserID: 2, userID: 3, cloneURL: "https://localhost:3000/user/test_repo.git", repoName: "private-ip", expectedStatus: http.StatusUnprocessableEntity},
-		{ctxUserID: 2, userID: 3, cloneURL: "https://10.0.0.1/user/test_repo.git", repoName: "private-ip", expectedStatus: http.StatusUnprocessableEntity},
-	}
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		// migrate from a local fixture repo (user2/repo1) via the live listener so the test runs offline
+		repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+		cloneAddr := fmt.Sprintf("%s%s/%s.git", u.String(), repo1.OwnerName, repo1.Name)
 
-	defer tests.PrepareTestEnv(t)()
-	for _, testCase := range testCases {
-		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: testCase.ctxUserID})
-		session := loginUser(t, user.Name)
-		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
-		req := NewRequestWithJSON(t, "POST", "/api/v1/repos/migrate", &api.MigrateRepoOptions{
-			CloneAddr:   testCase.cloneURL,
-			RepoOwnerID: testCase.userID,
-			RepoName:    testCase.repoName,
-		}).AddTokenAuth(token)
-		resp := MakeRequest(t, req, NoExpectedStatus)
-		if resp.Code == http.StatusUnprocessableEntity {
-			respJSON := DecodeJSON(t, resp, map[string]string{})
-			switch respJSON["message"] {
-			case "Remote visit addressed rate limitation.":
-				t.Log("test hit github rate limitation")
-			case "You can not import from disallowed hosts.":
-				assert.Equal(t, "private-ip", testCase.repoName)
-			default:
-				assert.FailNow(t, "unexpected error", "unexpected error '%v' on url '%s'", respJSON["message"], testCase.cloneURL)
+		t.Run("Permitted", func(t *testing.T) {
+			// migrations.Init builds the host allowlist from AllowLocalNetworks, so set it first
+			defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
+			require.NoError(t, migrations.Init())
+			for _, testCase := range []struct {
+				ctxUserID, ownerID int64
+				repoName           string
+				expectedStatus     int
+			}{
+				{ctxUserID: 1, ownerID: 2, repoName: "git-admin", expectedStatus: http.StatusCreated},
+				{ctxUserID: 2, ownerID: 2, repoName: "git-own", expectedStatus: http.StatusCreated},
+				{ctxUserID: 2, ownerID: 1, repoName: "git-bad", expectedStatus: http.StatusForbidden},
+				{ctxUserID: 2, ownerID: 3, repoName: "git-org", expectedStatus: http.StatusCreated},
+				{ctxUserID: 2, ownerID: 6, repoName: "git-bad-org", expectedStatus: http.StatusForbidden},
+			} {
+				user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: testCase.ctxUserID})
+				token := getTokenForLoggedInUser(t, loginUser(t, user.Name), auth_model.AccessTokenScopeWriteRepository)
+				req := NewRequestWithJSON(t, "POST", "/api/v1/repos/migrate", &api.MigrateRepoOptions{
+					CloneAddr:   cloneAddr,
+					RepoOwnerID: testCase.ownerID,
+					RepoName:    testCase.repoName,
+				}).AddTokenAuth(token)
+				MakeRequest(t, req, testCase.expectedStatus)
 			}
-		} else {
-			assert.Equal(t, testCase.expectedStatus, resp.Code)
-		}
-	}
+		})
+
+		t.Run("DisallowedHost", func(t *testing.T) {
+			defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, false)()
+			require.NoError(t, migrations.Init())
+			token := getTokenForLoggedInUser(t, loginUser(t, "user2"), auth_model.AccessTokenScopeWriteRepository)
+			for _, cloneURL := range []string{"https://localhost:3000/user/test_repo.git", "https://10.0.0.1/user/test_repo.git"} {
+				req := NewRequestWithJSON(t, "POST", "/api/v1/repos/migrate", &api.MigrateRepoOptions{
+					CloneAddr:   cloneURL,
+					RepoOwnerID: 3,
+					RepoName:    "private-ip",
+				}).AddTokenAuth(token)
+				resp := MakeRequest(t, req, http.StatusUnprocessableEntity)
+				assert.Equal(t, "You can not import from disallowed hosts.", DecodeJSON(t, resp, map[string]string{})["message"])
+			}
+		})
+	})
 }
 
 func TestAPIRepoMigrateConflict(t *testing.T) {
@@ -536,7 +542,6 @@ func TestAPIRepoTransfer(t *testing.T) {
 	session := loginUser(t, user.Name)
 	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
 	repoName := "moveME"
-	apiRepo := new(api.Repository)
 	req := NewRequestWithJSON(t, "POST", "/api/v1/user/repos", &api.CreateRepoOption{
 		Name:        repoName,
 		Description: "repo move around",
@@ -545,7 +550,7 @@ func TestAPIRepoTransfer(t *testing.T) {
 		AutoInit:    true,
 	}).AddTokenAuth(token)
 	resp := MakeRequest(t, req, http.StatusCreated)
-	DecodeJSON(t, resp, apiRepo)
+	apiRepo := DecodeJSON(t, resp, &api.Repository{})
 
 	// start testing
 	for _, testCase := range testCases {
@@ -571,7 +576,6 @@ func transfer(t *testing.T) *repo_model.Repository {
 	session := loginUser(t, user.Name)
 	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
 	repoName := "moveME"
-	apiRepo := new(api.Repository)
 	req := NewRequestWithJSON(t, "POST", "/api/v1/user/repos", &api.CreateRepoOption{
 		Name:        repoName,
 		Description: "repo move around",
@@ -581,7 +585,7 @@ func transfer(t *testing.T) *repo_model.Repository {
 	}).AddTokenAuth(token)
 
 	resp := MakeRequest(t, req, http.StatusCreated)
-	DecodeJSON(t, resp, apiRepo)
+	apiRepo := DecodeJSON(t, resp, &api.Repository{})
 
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: apiRepo.ID})
 	req = NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/transfer", repo.OwnerName, repo.Name), &api.TransferRepoOption{
@@ -616,8 +620,7 @@ func TestAPIAcceptTransfer(t *testing.T) {
 	req = NewRequest(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/transfer/accept", repo.OwnerName, repo.Name)).
 		AddTokenAuth(token)
 	resp := MakeRequest(t, req, http.StatusAccepted)
-	apiRepo := new(api.Repository)
-	DecodeJSON(t, resp, apiRepo)
+	apiRepo := DecodeJSON(t, resp, &api.Repository{})
 	assert.Equal(t, "user4", apiRepo.Owner.UserName)
 }
 
@@ -645,8 +648,7 @@ func TestAPIRejectTransfer(t *testing.T) {
 	req = NewRequest(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/transfer/reject", repo.OwnerName, repo.Name)).
 		AddTokenAuth(token)
 	resp := MakeRequest(t, req, http.StatusOK)
-	apiRepo := new(api.Repository)
-	DecodeJSON(t, resp, apiRepo)
+	apiRepo := DecodeJSON(t, resp, &api.Repository{})
 	assert.Equal(t, "user2", apiRepo.Owner.UserName)
 }
 
@@ -659,8 +661,17 @@ func TestAPIGenerateRepo(t *testing.T) {
 
 	templateRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 44})
 
+	assertGeneratedRepoIsUsable := func(t *testing.T, ownerName string, repo *api.Repository) {
+		t.Helper()
+		assert.NotEmpty(t, repo.DefaultBranch)
+
+		req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/branches/%s", ownerName, repo.Name, repo.DefaultBranch).AddTokenAuth(token)
+		resp := MakeRequest(t, req, http.StatusOK)
+		branch := DecodeJSON(t, resp, &api.Branch{})
+		assert.Equal(t, repo.DefaultBranch, branch.Name)
+	}
+
 	// user
-	repo := new(api.Repository)
 	req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/generate", templateRepo.OwnerName, templateRepo.Name), &api.GenerateRepoOption{
 		Owner:       user.Name,
 		Name:        "new-repo",
@@ -669,9 +680,10 @@ func TestAPIGenerateRepo(t *testing.T) {
 		GitContent:  true,
 	}).AddTokenAuth(token)
 	resp := MakeRequest(t, req, http.StatusCreated)
-	DecodeJSON(t, resp, repo)
+	apiRepo := DecodeJSON(t, resp, &api.Repository{})
 
-	assert.Equal(t, "new-repo", repo.Name)
+	assert.Equal(t, "new-repo", apiRepo.Name)
+	assertGeneratedRepoIsUsable(t, user.Name, apiRepo)
 
 	// org
 	req = NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/generate", templateRepo.OwnerName, templateRepo.Name), &api.GenerateRepoOption{
@@ -682,9 +694,10 @@ func TestAPIGenerateRepo(t *testing.T) {
 		GitContent:  true,
 	}).AddTokenAuth(token)
 	resp = MakeRequest(t, req, http.StatusCreated)
-	DecodeJSON(t, resp, repo)
+	apiRepo = DecodeJSON(t, resp, &api.Repository{})
 
-	assert.Equal(t, "new-repo", repo.Name)
+	assert.Equal(t, "new-repo", apiRepo.Name)
+	assertGeneratedRepoIsUsable(t, "org3", apiRepo)
 }
 
 func TestAPIRepoGetReviewers(t *testing.T) {
diff --git a/tests/integration/api_repo_topic_test.go b/tests/integration/api_repo_topic_test.go
index d0e490d0c9a..650e9df4e9d 100644
--- a/tests/integration/api_repo_topic_test.go
+++ b/tests/integration/api_repo_topic_test.go
@@ -9,12 +9,12 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_repo_variables_test.go b/tests/integration/api_repo_variables_test.go
index b5c88af279a..bedde0aa715 100644
--- a/tests/integration/api_repo_variables_test.go
+++ b/tests/integration/api_repo_variables_test.go
@@ -8,12 +8,12 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 )
 
 func TestAPIRepoVariables(t *testing.T) {
diff --git a/tests/integration/api_settings_test.go b/tests/integration/api_settings_test.go
index 89b9ae75094..e5c7b9ad5cb 100644
--- a/tests/integration/api_settings_test.go
+++ b/tests/integration/api_settings_test.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_team_test.go b/tests/integration/api_team_test.go
index baf41ef4608..7f35d59669b 100644
--- a/tests/integration/api_team_test.go
+++ b/tests/integration/api_team_test.go
@@ -9,16 +9,16 @@ import (
 	"sort"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/convert"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_team_user_test.go b/tests/integration/api_team_user_test.go
index c5aad98b5b2..46e7d9ad600 100644
--- a/tests/integration/api_team_user_test.go
+++ b/tests/integration/api_team_user_test.go
@@ -8,12 +8,12 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/convert"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/convert"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_token_test.go b/tests/integration/api_token_test.go
index 55354958414..a96fae23991 100644
--- a/tests/integration/api_token_test.go
+++ b/tests/integration/api_token_test.go
@@ -8,12 +8,12 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/log"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_twofa_test.go b/tests/integration/api_twofa_test.go
index ae23d2b8ffe..d8d8fa44971 100644
--- a/tests/integration/api_twofa_test.go
+++ b/tests/integration/api_twofa_test.go
@@ -8,10 +8,10 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/tests"
 
 	"github.com/pquerna/otp/totp"
 	"github.com/stretchr/testify/assert"
diff --git a/tests/integration/api_user_avatar_test.go b/tests/integration/api_user_avatar_test.go
index 8c002d7a338..8d82e7e1cbc 100644
--- a/tests/integration/api_user_avatar_test.go
+++ b/tests/integration/api_user_avatar_test.go
@@ -10,10 +10,10 @@ import (
 	"path/filepath"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_user_block_test.go b/tests/integration/api_user_block_test.go
index 5e0f06c26df..56dc81cc0f1 100644
--- a/tests/integration/api_user_block_test.go
+++ b/tests/integration/api_user_block_test.go
@@ -8,12 +8,12 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_user_email_test.go b/tests/integration/api_user_email_test.go
index 804f35aff3d..74b4d22a38e 100644
--- a/tests/integration/api_user_email_test.go
+++ b/tests/integration/api_user_email_test.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_user_follow_test.go b/tests/integration/api_user_follow_test.go
index 39aae37e6f8..6a7b135b801 100644
--- a/tests/integration/api_user_follow_test.go
+++ b/tests/integration/api_user_follow_test.go
@@ -8,11 +8,11 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_user_heatmap_test.go b/tests/integration/api_user_heatmap_test.go
index ed7113bf464..ebf6548a63f 100644
--- a/tests/integration/api_user_heatmap_test.go
+++ b/tests/integration/api_user_heatmap_test.go
@@ -9,10 +9,10 @@ import (
 	"testing"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/tests"
+	activities_model "gitea.dev/models/activities"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_user_info_test.go b/tests/integration/api_user_info_test.go
index 93903eac741..7ca2a3fbf38 100644
--- a/tests/integration/api_user_info_test.go
+++ b/tests/integration/api_user_info_test.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_user_org_perm_test.go b/tests/integration/api_user_org_perm_test.go
index 4dc369d135e..d31abdfeb37 100644
--- a/tests/integration/api_user_org_perm_test.go
+++ b/tests/integration/api_user_org_perm_test.go
@@ -8,9 +8,9 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_user_orgs_test.go b/tests/integration/api_user_orgs_test.go
index 3e8e17c28ae..54291f42728 100644
--- a/tests/integration/api_user_orgs_test.go
+++ b/tests/integration/api_user_orgs_test.go
@@ -8,11 +8,11 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -154,3 +154,44 @@ func TestMyOrgs(t *testing.T) {
 		},
 	}, orgs)
 }
+
+func TestMyOrgsPublicOnly(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	normalUsername := "user2"
+	token := getUserToken(t, normalUsername, auth_model.AccessTokenScopeReadOrganization, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopePublicOnly)
+	req := NewRequest(t, "GET", "/api/v1/user/orgs").
+		AddTokenAuth(token)
+	resp := MakeRequest(t, req, http.StatusOK)
+	var orgs []*api.Organization
+	DecodeJSON(t, resp, &orgs)
+	org3 := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "org3"})
+	org17 := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "org17"})
+
+	assert.Equal(t, []*api.Organization{
+		{
+			ID:          17,
+			Name:        org17.Name,
+			UserName:    org17.Name,
+			FullName:    org17.FullName,
+			Email:       org17.Email,
+			AvatarURL:   org17.AvatarLink(t.Context()),
+			Description: "",
+			Website:     "",
+			Location:    "",
+			Visibility:  "public",
+		},
+		{
+			ID:          3,
+			Name:        org3.Name,
+			UserName:    org3.Name,
+			FullName:    org3.FullName,
+			Email:       org3.Email,
+			AvatarURL:   org3.AvatarLink(t.Context()),
+			Description: "",
+			Website:     "",
+			Location:    "",
+			Visibility:  "public",
+		},
+	}, orgs)
+}
diff --git a/tests/integration/api_user_public_only_test.go b/tests/integration/api_user_public_only_test.go
new file mode 100644
index 00000000000..be315072d79
--- /dev/null
+++ b/tests/integration/api_user_public_only_test.go
@@ -0,0 +1,177 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"net/http"
+	"testing"
+
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAPIPublicOnlySelfUserRoutes(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	privateUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user31"})
+	require.True(t, privateUser.Visibility.IsPrivate())
+
+	privateSession := loginUser(t, privateUser.Name)
+	privateReadUserToken := getTokenForLoggedInUser(t, privateSession,
+		auth_model.AccessTokenScopePublicOnly,
+		auth_model.AccessTokenScopeReadUser,
+	)
+	privateWriteUserToken := getTokenForLoggedInUser(t, privateSession,
+		auth_model.AccessTokenScopePublicOnly,
+		auth_model.AccessTokenScopeWriteUser,
+	)
+
+	t.Run("PrivateProfileForbidden", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/users/user31").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+	})
+
+	t.Run("PrivateSensitiveSelfRoutesForbidden", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/settings").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+		hideEmail := true
+		settingsReq := NewRequestWithJSON(t, "PATCH", "/api/v1/user/settings", &api.UserSettingsOptions{
+			HideEmail: &hideEmail,
+		}).AddTokenAuth(privateWriteUserToken)
+		MakeRequest(t, settingsReq, http.StatusForbidden)
+
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/emails").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+		emailReq := NewRequestWithJSON(t, "POST", "/api/v1/user/emails", &api.CreateEmailOption{
+			Emails: []string{"user31-public-only@example.com"},
+		}).AddTokenAuth(privateWriteUserToken)
+		MakeRequest(t, emailReq, http.StatusForbidden)
+
+		keyReq := NewRequestWithJSON(t, "POST", "/api/v1/user/keys", api.CreateKeyOption{
+			Title: "public-only-private-key",
+			Key:   "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4cn+iXnA4KvcQYSV88vGn0Yi91vG47t1P7okprVmhNTkipNRIHWr6WdCO4VDr/cvsRkuVJAsLO2enwjGWWueOO6BodiBgyAOZ/5t5nJNMCNuLGT5UIo/RI1b0WRQwxEZTRjt6mFNw6lH14wRd8ulsr9toSWBPMOGWoYs1PDeDL0JuTjL+tr1SZi/EyxCngpYszKdXllJEHyI79KQgeD0Vt3pTrkbNVTOEcCNqZePSVmUH8X8Vhugz3bnE0/iE9Pb5fkWO9c4AnM1FgI/8Bvp27Fw2ShryIXuR6kKvUqhVMTuOSDHwu6A8jLE5Owt3GAYugDpDYuwTVNGrHLXKpPzrGGPE/jPmaLCMZcsdkec95dYeU3zKODEm8UQZFhmJmDeWVJ36nGrGZHL4J5aTTaeFUJmmXDaJYiJ+K2/ioKgXqnXvltu0A9R8/LGy4nrTJRr4JMLuJFoUXvGm1gXQ70w2LSpk6yl71RNC0hCtsBe8BP8IhYCM0EP5jh7eCMQZNvM= nocomment",
+		}).AddTokenAuth(privateWriteUserToken)
+		MakeRequest(t, keyReq, http.StatusForbidden)
+
+		oauthReq := NewRequestWithJSON(t, "POST", "/api/v1/user/applications/oauth2", &api.CreateOAuth2ApplicationOptions{
+			Name:               "public-only-private-oauth-app",
+			RedirectURIs:       []string{"https://example.com/callback"},
+			ConfidentialClient: true,
+		}).AddTokenAuth(privateWriteUserToken)
+		MakeRequest(t, oauthReq, http.StatusForbidden)
+
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/gpg_keys").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+		gpgKeyReq := NewRequestWithJSON(t, "POST", "/api/v1/user/gpg_keys", &api.CreateGPGKeyOption{
+			ArmoredKey: "-----BEGIN PGP PUBLIC KEY BLOCK-----\ncomment\n-----END PGP PUBLIC KEY BLOCK-----",
+		}).AddTokenAuth(privateWriteUserToken)
+		MakeRequest(t, gpgKeyReq, http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/gpg_key_token").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+		gpgVerifyReq := NewRequestWithJSON(t, "POST", "/api/v1/user/gpg_key_verify", &api.VerifyGPGKeyOption{
+			KeyID:     "deadbeef",
+			Signature: "invalid-signature",
+		}).AddTokenAuth(privateWriteUserToken)
+		MakeRequest(t, gpgVerifyReq, http.StatusForbidden)
+
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/actions/variables").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "DELETE", "/api/v1/user/actions/secrets/PRIVATE_SECRET").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
+		variableReq := NewRequestWithJSON(t, "POST", "/api/v1/user/actions/variables/PRIVATE_VAR", api.CreateVariableOption{
+			Value:       "private-value",
+			Description: "must stay private",
+		}).AddTokenAuth(privateWriteUserToken)
+		MakeRequest(t, variableReq, http.StatusForbidden)
+
+		MakeRequest(t, NewRequest(t, "POST", "/api/v1/user/actions/runners/registration-token").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
+
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/hooks").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+		hookReq := NewRequestWithJSON(t, "POST", "/api/v1/user/hooks", api.CreateHookOption{
+			Type: "gitea",
+			Config: api.CreateHookOptionConfig{
+				"content_type": "json",
+				"url":          "http://example.com/",
+			},
+			Name: "public-only-private-hook",
+		}).AddTokenAuth(privateWriteUserToken)
+		MakeRequest(t, hookReq, http.StatusForbidden)
+
+		avatarReq := NewRequestWithJSON(t, "POST", "/api/v1/user/avatar", &api.UpdateUserAvatarOption{
+			Image: "aGVsbG8=",
+		}).AddTokenAuth(privateWriteUserToken)
+		MakeRequest(t, avatarReq, http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "DELETE", "/api/v1/user/avatar").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/times").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/stopwatches").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/subscriptions").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/teams").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/blocks").AddTokenAuth(privateReadUserToken), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "PUT", "/api/v1/user/blocks/user2").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
+
+		MakeRequest(t, NewRequest(t, "PUT", "/api/v1/user/following/user2").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "DELETE", "/api/v1/user/following/user2").AddTokenAuth(privateWriteUserToken), http.StatusForbidden)
+	})
+
+	t.Run("PublicRepoRoutesFilterAndRejectMutations", func(t *testing.T) {
+		defer tests.PrintCurrentTest(t)()
+
+		publicSession := loginUser(t, "user2")
+		fullWriteRepoToken := getTokenForLoggedInUser(t, publicSession,
+			auth_model.AccessTokenScopeWriteUser,
+			auth_model.AccessTokenScopeWriteRepository,
+		)
+		publicOnlyReadRepoToken := getTokenForLoggedInUser(t, publicSession,
+			auth_model.AccessTokenScopePublicOnly,
+			auth_model.AccessTokenScopeReadUser,
+			auth_model.AccessTokenScopeReadRepository,
+		)
+		publicOnlyWriteRepoToken := getTokenForLoggedInUser(t, publicSession,
+			auth_model.AccessTokenScopePublicOnly,
+			auth_model.AccessTokenScopeWriteUser,
+			auth_model.AccessTokenScopeWriteRepository,
+		)
+
+		publicRepoName := "public-only-visible-self-repo"
+		privateRepoName := "public-only-hidden-self-repo"
+
+		resp := MakeRequest(t, NewRequestWithJSON(t, "POST", "/api/v1/user/repos", &api.CreateRepoOption{
+			Name:    publicRepoName,
+			Private: false,
+		}).AddTokenAuth(fullWriteRepoToken), http.StatusCreated)
+		publicRepo := DecodeJSON(t, resp, &api.Repository{})
+		require.Equal(t, "user2/"+publicRepoName, publicRepo.FullName)
+
+		resp = MakeRequest(t, NewRequestWithJSON(t, "POST", "/api/v1/user/repos", &api.CreateRepoOption{
+			Name:    privateRepoName,
+			Private: true,
+		}).AddTokenAuth(fullWriteRepoToken), http.StatusCreated)
+		privateRepo := DecodeJSON(t, resp, &api.Repository{})
+		require.Equal(t, "user2/"+privateRepoName, privateRepo.FullName)
+
+		MakeRequest(t, NewRequest(t, "GET", "/api/v1/repos/user2/"+privateRepoName).AddTokenAuth(publicOnlyReadRepoToken), http.StatusNotFound)
+
+		resp = MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/repos").AddTokenAuth(publicOnlyReadRepoToken), http.StatusOK)
+		repos := DecodeJSON(t, resp, []api.Repository{})
+
+		foundPublicRepo := false
+		for _, repo := range repos {
+			require.NotEqual(t, privateRepo.FullName, repo.FullName)
+			if repo.FullName == publicRepo.FullName {
+				foundPublicRepo = true
+			}
+		}
+		require.True(t, foundPublicRepo)
+
+		MakeRequest(t, NewRequestWithJSON(t, "POST", "/api/v1/user/repos", &api.CreateRepoOption{
+			Name:    "public-only-rejected-self-repo",
+			Private: false,
+		}).AddTokenAuth(publicOnlyWriteRepoToken), http.StatusForbidden)
+	})
+}
diff --git a/tests/integration/api_user_search_test.go b/tests/integration/api_user_search_test.go
index 4b0fbcae200..2e8e552a1a4 100644
--- a/tests/integration/api_user_search_test.go
+++ b/tests/integration/api_user_search_test.go
@@ -7,11 +7,11 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/api_user_secrets_test.go b/tests/integration/api_user_secrets_test.go
index 0d2439c3cbb..cfc42f3b6a3 100644
--- a/tests/integration/api_user_secrets_test.go
+++ b/tests/integration/api_user_secrets_test.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 )
 
 func TestAPIUserSecrets(t *testing.T) {
diff --git a/tests/integration/api_user_star_test.go b/tests/integration/api_user_star_test.go
index 65422a4f983..056d4cd70fc 100644
--- a/tests/integration/api_user_star_test.go
+++ b/tests/integration/api_user_star_test.go
@@ -8,15 +8,16 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestAPIStar(t *testing.T) {
@@ -153,3 +154,24 @@ func TestAPIStarDisabled(t *testing.T) {
 		MakeRequest(t, req, http.StatusForbidden)
 	})
 }
+
+func TestAPIStarPublicOnly(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	token := getUserToken(t, "user2", auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadRepository, auth_model.AccessTokenScopePublicOnly)
+	req := NewRequest(t, "GET", "/api/v1/user/starred").
+		AddTokenAuth(token)
+	resp := MakeRequest(t, req, http.StatusOK)
+
+	repos := DecodeJSON(t, resp, []api.Repository{})
+	if assert.Len(t, repos, 1) {
+		assert.Equal(t, "user5/repo4", repos[0].FullName)
+	}
+
+	req = NewRequest(t, "GET", "/api/v1/users/user2/starred").
+		AddTokenAuth(token)
+	resp = MakeRequest(t, req, http.StatusOK)
+	repos = DecodeJSON(t, resp, []api.Repository{})
+	require.Len(t, repos, 1)
+	assert.Equal(t, "user5/repo4", repos[0].FullName)
+}
diff --git a/tests/integration/api_user_update_test.go b/tests/integration/api_user_update_test.go
index af5481cfd5f..a3cdc2558af 100644
--- a/tests/integration/api_user_update_test.go
+++ b/tests/integration/api_user_update_test.go
@@ -7,8 +7,8 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/tests"
 )
 
 func TestAPIUpdateUser(t *testing.T) {
diff --git a/tests/integration/api_user_variables_test.go b/tests/integration/api_user_variables_test.go
index d430c9e21d6..00805ae3fe4 100644
--- a/tests/integration/api_user_variables_test.go
+++ b/tests/integration/api_user_variables_test.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 )
 
 func TestAPIUserVariables(t *testing.T) {
diff --git a/tests/integration/api_user_watch_test.go b/tests/integration/api_user_watch_test.go
index 002b8a10e69..073eb0ed0b7 100644
--- a/tests/integration/api_user_watch_test.go
+++ b/tests/integration/api_user_watch_test.go
@@ -8,11 +8,11 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -92,3 +92,28 @@ func TestAPIWatch(t *testing.T) {
 		MakeRequest(t, req, http.StatusNoContent)
 	})
 }
+
+func TestAPIWatchPublicOnly(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	session := loginUser(t, "user1")
+	writeRepoToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeReadUser)
+	publicOnlyToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopePublicOnly, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadRepository)
+
+	MakeRequest(t, NewRequest(t, "PUT", "/api/v1/repos/user2/repo1/subscription").AddTokenAuth(writeRepoToken), http.StatusOK)
+	MakeRequest(t, NewRequest(t, "PUT", "/api/v1/repos/user2/repo2/subscription").AddTokenAuth(writeRepoToken), http.StatusOK)
+
+	resp := MakeRequest(t, NewRequest(t, "GET", "/api/v1/user/subscriptions").AddTokenAuth(publicOnlyToken), http.StatusOK)
+	repos := DecodeJSON(t, resp, []api.Repository{})
+	for _, r := range repos {
+		assert.False(t, r.Private, "private repo %s leaked via /user/subscriptions", r.FullName)
+	}
+	assert.NotContains(t, repoNames(repos), "user2/repo2")
+
+	resp = MakeRequest(t, NewRequest(t, "GET", "/api/v1/users/user1/subscriptions").AddTokenAuth(publicOnlyToken), http.StatusOK)
+	repos = DecodeJSON(t, resp, []api.Repository{})
+	for _, r := range repos {
+		assert.False(t, r.Private, "private repo %s leaked via /users/{username}/subscriptions", r.FullName)
+	}
+	assert.NotContains(t, repoNames(repos), "user2/repo2")
+}
diff --git a/tests/integration/api_wiki_test.go b/tests/integration/api_wiki_test.go
index 697a1a2ccbe..2ae617c6cff 100644
--- a/tests/integration/api_wiki_test.go
+++ b/tests/integration/api_wiki_test.go
@@ -9,9 +9,9 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/attachment_test.go b/tests/integration/attachment_test.go
index db6928beac2..cb97d3c692c 100644
--- a/tests/integration/attachment_test.go
+++ b/tests/integration/attachment_test.go
@@ -14,18 +14,28 @@ import (
 	"strings"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/web"
-	route_web "code.gitea.io/gitea/routers/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/web"
+	route_web "gitea.dev/routers/web"
+	"gitea.dev/services/context"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+type attachmentScopeCase struct {
+	name                  string
+	url                   string
+	readIssueStatus       int
+	readRepoStatus        int
+	publicOnlyIssueStatus int
+	publicOnlyRepoStatus  int
+}
+
 func testGeneratePngBytes() []byte {
 	myImage := image.NewRGBA(image.Rect(0, 0, 32, 32))
 	var buff bytes.Buffer
@@ -96,18 +106,18 @@ func testUploadAttachmentDeleteTemp(t *testing.T) {
 	defer web.RouteMock(route_web.RouterMockPointBeforeWebRoutes, func(resp http.ResponseWriter, req *http.Request) {
 		tmpFileCountDuringUpload = countTmpFile()
 	})()
-	_ = testCreateIssueAttachment(t, session, "user2/repo1", "image.png", testGeneratePngBytes(), http.StatusOK)
+	_ = testCreateIssueAttachment(t, session, "/user2/repo1", "image.png", testGeneratePngBytes(), http.StatusOK)
 	assert.Equal(t, 1, tmpFileCountDuringUpload, "the temp file should exist when uploaded size exceeds the parse form's max memory")
 	assert.Equal(t, 0, countTmpFile(), "the temp file should be deleted after upload")
 }
 
 func testCreateAnonymousAttachment(t *testing.T) {
 	session := emptyTestSession(t)
-	testCreateIssueAttachment(t, session, "user2/repo1", "image.png", testGeneratePngBytes(), http.StatusSeeOther)
+	testCreateIssueAttachment(t, session, "/user2/repo1", "image.png", testGeneratePngBytes(), http.StatusSeeOther)
 }
 
 func testCreateUser2IssueAttachment(t *testing.T) {
-	const repoURL = "user2/repo1"
+	const repoURL = "/user2/repo1"
 	session := loginUser(t, "user2")
 	uuid := testCreateIssueAttachment(t, session, repoURL, "image.png", testGeneratePngBytes(), http.StatusOK)
 
@@ -177,7 +187,7 @@ func testGetAttachment(t *testing.T) {
 }
 
 func testDeleteAttachmentPermissions(t *testing.T) {
-	const repoURL = "user2/repo1"
+	const repoURL = "/user2/repo1"
 
 	ownerSession := loginUser(t, "user2")
 	readonlySession := loginUser(t, "user5")
@@ -191,12 +201,109 @@ func testDeleteAttachmentPermissions(t *testing.T) {
 	testCreateReleaseAttachment(t, readonlySession, repoURL, "reader-release.png", testGeneratePngBytes(), http.StatusNotFound)
 
 	crossRepoUUID := testCreateIssueAttachment(t, ownerSession, repoURL, "cross-repo.png", testGeneratePngBytes(), http.StatusOK)
-	testDeleteIssueAttachment(t, ownerSession, "user2/repo2", crossRepoUUID, http.StatusBadRequest)
+	testDeleteIssueAttachment(t, ownerSession, "/user2/repo2", crossRepoUUID, http.StatusBadRequest)
 	testDeleteIssueAttachment(t, ownerSession, repoURL, crossRepoUUID, http.StatusOK)
 
 	releaseUUID := testCreateReleaseAttachment(t, ownerSession, repoURL, "reader-release.png", testGeneratePngBytes(), http.StatusOK)
 	testDeleteReleaseAttachment(t, ownerSession, repoURL, releaseUUID, http.StatusOK)
 
 	// test deleting release attachment from another repo
-	testDeleteReleaseAttachment(t, ownerSession, "user2/repo2", crossRepoUUID, http.StatusBadRequest)
+	testDeleteReleaseAttachment(t, ownerSession, "/user2/repo2", crossRepoUUID, http.StatusBadRequest)
+}
+
+func TestAttachmentTokenScopes(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	for _, uuid := range []string{
+		"a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11",
+		"a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a12",
+		"a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a19",
+		"a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a22",
+	} {
+		_, err := storage.Attachments.Save(repo_model.AttachmentRelativePath(uuid), strings.NewReader("hello world"), -1)
+		require.NoError(t, err)
+	}
+
+	readIssueToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadIssue)
+	readRepoToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository)
+	miscToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadMisc)
+	publicOnlyIssueToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadIssue, auth_model.AccessTokenScopePublicOnly)
+	publicOnlyRepoToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository, auth_model.AccessTokenScopePublicOnly)
+
+	cases := []attachmentScopeCase{
+		{
+			name:                  "GlobalPublicIssueAttachment",
+			url:                   "/attachments/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11",
+			readIssueStatus:       http.StatusOK,
+			readRepoStatus:        http.StatusForbidden,
+			publicOnlyIssueStatus: http.StatusOK,
+			publicOnlyRepoStatus:  http.StatusForbidden,
+		},
+		{
+			name:                  "RepoPublicIssueAttachment",
+			url:                   "/user2/repo1/attachments/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11",
+			readIssueStatus:       http.StatusOK,
+			readRepoStatus:        http.StatusForbidden,
+			publicOnlyIssueStatus: http.StatusOK,
+			publicOnlyRepoStatus:  http.StatusForbidden,
+		},
+		{
+			name:                  "GlobalPrivateIssueAttachment",
+			url:                   "/attachments/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a12",
+			readIssueStatus:       http.StatusOK,
+			readRepoStatus:        http.StatusForbidden,
+			publicOnlyIssueStatus: http.StatusForbidden,
+			publicOnlyRepoStatus:  http.StatusForbidden,
+		},
+		{
+			name:                  "RepoPrivateIssueAttachment",
+			url:                   "/user2/repo2/attachments/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a12",
+			readIssueStatus:       http.StatusOK,
+			readRepoStatus:        http.StatusForbidden,
+			publicOnlyIssueStatus: http.StatusForbidden,
+			publicOnlyRepoStatus:  http.StatusForbidden,
+		},
+		{
+			name:                  "GlobalPublicReleaseAttachment",
+			url:                   "/attachments/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a19",
+			readIssueStatus:       http.StatusForbidden,
+			readRepoStatus:        http.StatusOK,
+			publicOnlyIssueStatus: http.StatusForbidden,
+			publicOnlyRepoStatus:  http.StatusOK,
+		},
+		{
+			name:                  "RepoPublicReleaseAttachment",
+			url:                   "/user2/repo1/releases/attachments/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a19",
+			readIssueStatus:       http.StatusForbidden,
+			readRepoStatus:        http.StatusOK,
+			publicOnlyIssueStatus: http.StatusForbidden,
+			publicOnlyRepoStatus:  http.StatusOK,
+		},
+		{
+			name:                  "GlobalPrivateReleaseAttachment",
+			url:                   "/attachments/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a22",
+			readIssueStatus:       http.StatusForbidden,
+			readRepoStatus:        http.StatusOK,
+			publicOnlyIssueStatus: http.StatusForbidden,
+			publicOnlyRepoStatus:  http.StatusForbidden,
+		},
+		{
+			name:                  "RepoPrivateReleaseAttachment",
+			url:                   "/user2/repo2/releases/attachments/a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a22",
+			readIssueStatus:       http.StatusForbidden,
+			readRepoStatus:        http.StatusOK,
+			publicOnlyIssueStatus: http.StatusForbidden,
+			publicOnlyRepoStatus:  http.StatusForbidden,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			MakeRequest(t, NewRequest(t, "GET", tc.url).AddTokenAuth(miscToken), http.StatusForbidden)
+			MakeRequest(t, NewRequest(t, "GET", tc.url).AddTokenAuth(readIssueToken), tc.readIssueStatus)
+			MakeRequest(t, NewRequest(t, "GET", tc.url).AddTokenAuth(readRepoToken), tc.readRepoStatus)
+			MakeRequest(t, NewRequest(t, "GET", tc.url).AddTokenAuth(publicOnlyIssueToken), tc.publicOnlyIssueStatus)
+			MakeRequest(t, NewRequest(t, "GET", tc.url).AddTokenAuth(publicOnlyRepoToken), tc.publicOnlyRepoStatus)
+		})
+	}
 }
diff --git a/tests/integration/auth_ldap_test.go b/tests/integration/auth_ldap_test.go
index 43d593f16a3..467d5059436 100644
--- a/tests/integration/auth_ldap_test.go
+++ b/tests/integration/auth_ldap_test.go
@@ -11,19 +11,19 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/auth"
-	"code.gitea.io/gitea/services/auth/source/ldap"
-	org_service "code.gitea.io/gitea/services/org"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/auth"
+	"gitea.dev/services/auth/source/ldap"
+	org_service "gitea.dev/services/org"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/auth_oauth2_test.go b/tests/integration/auth_oauth2_test.go
index e977a7dc489..bcd49811494 100644
--- a/tests/integration/auth_oauth2_test.go
+++ b/tests/integration/auth_oauth2_test.go
@@ -12,14 +12,14 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -130,8 +130,73 @@ func TestMigrateAzureADV2ToOIDC(t *testing.T) {
 	})
 }
 
+func TestOIDCIgnoresStaleExternalLoginLinks(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+	defer test.MockVariableValue(&setting.OAuth2Client.EnableAutoRegistration, true)()
+	defer test.MockVariableValue(&setting.OAuth2Client.AccountLinking, setting.OAuth2AccountLinkingAuto)()
+	defer test.MockVariableValue(&setting.OAuth2Client.Username, setting.OAuth2UsernameEmail)()
+
+	setup := func(t *testing.T, sourceName, sub, userName, email string) (*auth_model.Source, *user_model.User) {
+		t.Helper()
+		srv := newFakeOIDCServerWithProfile(t, sub, sub+"-oid", email, "OIDC Test User")
+		addOAuth2Source(t, sourceName, oauth2.Source{
+			Provider:                      "openidConnect",
+			ClientID:                      "test-client-id",
+			ClientSecret:                  "test-client-secret",
+			OpenIDConnectAutoDiscoveryURL: srv.URL + "/.well-known/openid-configuration",
+		})
+		authSource, err := auth_model.GetActiveOAuth2SourceByAuthName(t.Context(), sourceName)
+		require.NoError(t, err)
+		correctUser := &user_model.User{Name: userName, Email: email}
+		require.NoError(t, user_model.CreateUser(t.Context(), correctUser, &user_model.Meta{}))
+		return authSource, correctUser
+	}
+
+	// assertRelinked signs in via OIDC and asserts the stale link now points at the correct individual user.
+	assertRelinked := func(t *testing.T, authSource *auth_model.Source, sub string, correctUser *user_model.User) {
+		t.Helper()
+		doOIDCSignIn(t, authSource.Name)
+		// external_login_user has no "id" column, so order by the primary key instead
+		externalLink := unittest.AssertExistsAndLoadBean(t, &user_model.ExternalLoginUser{ExternalID: sub, LoginSourceID: authSource.ID}, unittest.OrderBy("external_id ASC"))
+		assert.Equal(t, correctUser.ID, externalLink.UserID)
+		assert.Equal(t, correctUser.Email, externalLink.Email)
+		assert.Equal(t, "OIDC Test User", externalLink.Name)
+	}
+
+	t.Run("organization", func(t *testing.T) {
+		const sub, userName, email = "oidc-stale-org-link-sub", "guizar_m", "guizar_m@example.com"
+		authSource, correctUser := setup(t, "test-oidc-stale-org-link", sub, userName, email)
+		org := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 3, Type: user_model.UserTypeOrganization})
+		require.NoError(t, user_model.LinkExternalToUser(t.Context(), org, &user_model.ExternalLoginUser{
+			ExternalID:    sub,
+			UserID:        org.ID,
+			LoginSourceID: authSource.ID,
+			Provider:      authSource.Name,
+		}))
+		assertRelinked(t, authSource, sub, correctUser)
+	})
+
+	t.Run("deleted user", func(t *testing.T) {
+		const sub, userName, email = "oidc-stale-deleted-link-sub", "guizar_d", "guizar_d@example.com"
+		const deletedUserID = 999999
+		authSource, correctUser := setup(t, "test-oidc-stale-deleted", sub, userName, email)
+		// link the external account to a user id that does not exist, simulating a deleted user
+		require.NoError(t, user_model.LinkExternalToUser(t.Context(), &user_model.User{ID: deletedUserID}, &user_model.ExternalLoginUser{
+			ExternalID:    sub,
+			UserID:        deletedUserID,
+			LoginSourceID: authSource.ID,
+			Provider:      authSource.Name,
+		}))
+		assertRelinked(t, authSource, sub, correctUser)
+	})
+}
+
 // newFakeOIDCServer starts an httptest.Server that implements the minimum OIDC endpoints needed to complete a sign-in flow:
 func newFakeOIDCServer(t *testing.T, sub, oid string) *httptest.Server {
+	return newFakeOIDCServerWithProfile(t, sub, oid, sub+"@example.com", "OIDC Test User")
+}
+
+func newFakeOIDCServerWithProfile(t *testing.T, sub, oid, email, name string) *httptest.Server {
 	t.Helper()
 
 	var srv *httptest.Server
@@ -169,8 +234,8 @@ func newFakeOIDCServer(t *testing.T, sub, oid string) *httptest.Server {
 			// sub MUST match the id_token sub; goth rejects mismatches.
 			_ = json.NewEncoder(w).Encode(map[string]any{
 				"sub":   sub,
-				"email": sub + "@example.com",
-				"name":  "OIDC Test User",
+				"email": email,
+				"name":  name,
 			})
 		default:
 			http.NotFound(w, r)
diff --git a/tests/integration/branches_test.go b/tests/integration/branches_test.go
index 83d9811baba..22b1549252d 100644
--- a/tests/integration/branches_test.go
+++ b/tests/integration/branches_test.go
@@ -8,10 +8,11 @@ import (
 	"net/url"
 	"testing"
 
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/translation"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestViewBranches(t *testing.T) {
@@ -57,9 +58,7 @@ func branchAction(t *testing.T, button string) (*HTMLDoc, string) {
 
 	htmlDoc := NewHTMLParser(t, resp.Body)
 	link, exists := htmlDoc.doc.Find(button).Attr("data-url")
-	if !assert.True(t, exists, "The template has changed") {
-		t.Skip()
-	}
+	require.True(t, exists, "The template has changed")
 
 	req = NewRequest(t, "POST", link)
 	session.MakeRequest(t, req, http.StatusOK)
diff --git a/tests/integration/change_default_branch_test.go b/tests/integration/change_default_branch_test.go
index 4a9ba6c4b53..bcc517cbe94 100644
--- a/tests/integration/change_default_branch_test.go
+++ b/tests/integration/change_default_branch_test.go
@@ -9,11 +9,11 @@ import (
 	"strconv"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/tests"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/cmd_keys_test.go b/tests/integration/cmd_keys_test.go
index b71d023f72f..91b0d1eea02 100644
--- a/tests/integration/cmd_keys_test.go
+++ b/tests/integration/cmd_keys_test.go
@@ -8,9 +8,9 @@ import (
 	"net/url"
 	"testing"
 
-	"code.gitea.io/gitea/cmd"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
+	"gitea.dev/cmd"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/urfave/cli/v3"
diff --git a/tests/integration/compare_test.go b/tests/integration/compare_test.go
index 5e50fcf0431..6c00b3fa0eb 100644
--- a/tests/integration/compare_test.go
+++ b/tests/integration/compare_test.go
@@ -10,13 +10,13 @@ import (
 	"strings"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/test"
-	repo_service "code.gitea.io/gitea/services/repository"
-	"code.gitea.io/gitea/tests"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/test"
+	repo_service "gitea.dev/services/repository"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/config_instance_test.go b/tests/integration/config_instance_test.go
index c9aa7ab745b..a5def9c3c7b 100644
--- a/tests/integration/config_instance_test.go
+++ b/tests/integration/config_instance_test.go
@@ -8,11 +8,11 @@ import (
 	"testing"
 	"time"
 
-	system_model "code.gitea.io/gitea/models/system"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/setting/config"
-	"code.gitea.io/gitea/tests"
+	system_model "gitea.dev/models/system"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/setting/config"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/cors_test.go b/tests/integration/cors_test.go
index 25dfbabf41e..6904886abdb 100644
--- a/tests/integration/cors_test.go
+++ b/tests/integration/cors_test.go
@@ -7,10 +7,10 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/routers"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/routers"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/create_no_session_test.go b/tests/integration/create_no_session_test.go
index 5797c0ff40a..a03e7e4da5a 100644
--- a/tests/integration/create_no_session_test.go
+++ b/tests/integration/create_no_session_test.go
@@ -10,10 +10,11 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/routers"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/routers"
+	"gitea.dev/tests"
 
 	"gitea.com/go-chi/session"
 	"github.com/stretchr/testify/assert"
@@ -52,16 +53,11 @@ func sessionFileExist(t *testing.T, tmpDir, sessionID string) bool {
 
 func TestSessionFileCreation(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	oldSessionConfig := setting.SessionConfig.ProviderConfig
-	defer func() {
-		setting.SessionConfig.ProviderConfig = oldSessionConfig
-		testWebRoutes = routers.NormalRoutes()
-	}()
+	defer test.MockVariableValue(&setting.SessionConfig.ProviderConfig)()
+	defer test.MockVariableValue(&testWebRoutes)()
 
 	var config session.Options
-
-	err := json.Unmarshal([]byte(oldSessionConfig), &config)
+	err := json.Unmarshal([]byte(setting.SessionConfig.ProviderConfig), &config)
 	assert.NoError(t, err)
 
 	config.Provider = "file"
diff --git a/tests/integration/db_collation_test.go b/tests/integration/db_collation_test.go
index 4f922f8a39c..5380b91b238 100644
--- a/tests/integration/db_collation_test.go
+++ b/tests/integration/db_collation_test.go
@@ -6,10 +6,10 @@ package integration
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/delete_user_test.go b/tests/integration/delete_user_test.go
index 0c31e928a33..68b3f985dce 100644
--- a/tests/integration/delete_user_test.go
+++ b/tests/integration/delete_user_test.go
@@ -7,13 +7,13 @@ import (
 	"net/http"
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/organization"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/tests"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/tests"
 )
 
 func assertUserDeleted(t *testing.T, userID int64) {
diff --git a/tests/integration/download_test.go b/tests/integration/download_test.go
index 3e7be98b093..1ec2a67c7a9 100644
--- a/tests/integration/download_test.go
+++ b/tests/integration/download_test.go
@@ -7,13 +7,22 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
 
+type downloadScopeCase struct {
+	name         string
+	method       string
+	url          string
+	withScope    int
+	publicOnlyOK bool
+}
+
 func TestDownloadRepoContent(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
@@ -71,3 +80,132 @@ func TestDownloadRepoContent(t *testing.T) {
 		assert.Equal(t, "application/xml", resp.Header().Get("Content-Type"))
 	})
 }
+
+func TestDownloadRepoContentTokenScopes(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	ownerReadToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository)
+	miscToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadMisc)
+	publicOnlyToken := getUserToken(t, "user2", auth_model.AccessTokenScopeReadRepository, auth_model.AccessTokenScopePublicOnly)
+
+	cases := []downloadScopeCase{
+		{
+			name:         "PublicArchiveDownload",
+			method:       http.MethodGet,
+			url:          "/user2/repo1/archive/master.tar.gz",
+			withScope:    http.StatusOK,
+			publicOnlyOK: true,
+		},
+		{
+			name:         "PrivateArchiveDownload",
+			method:       http.MethodGet,
+			url:          "/user2/repo2/archive/master.tar.gz",
+			withScope:    http.StatusOK,
+			publicOnlyOK: false,
+		},
+		{
+			name:         "PublicArchiveInitiate",
+			method:       http.MethodPost,
+			url:          "/user2/repo1/archive/master.tar.gz",
+			withScope:    http.StatusOK,
+			publicOnlyOK: true,
+		},
+		{
+			name:         "PrivateArchiveInitiate",
+			method:       http.MethodPost,
+			url:          "/user2/repo2/archive/master.tar.gz",
+			withScope:    http.StatusOK,
+			publicOnlyOK: false,
+		},
+		{
+			name:         "PublicRawBlob",
+			method:       http.MethodGet,
+			url:          "/user2/repo1/raw/blob/4b4851ad51df6a7d9f25c979345979eaeb5b349f",
+			withScope:    http.StatusOK,
+			publicOnlyOK: true,
+		},
+		{
+			name:         "PublicRawBranch",
+			method:       http.MethodGet,
+			url:          "/user2/repo1/raw/branch/master/README.md",
+			withScope:    http.StatusOK,
+			publicOnlyOK: true,
+		},
+		{
+			name:         "PublicRawTag",
+			method:       http.MethodGet,
+			url:          "/user2/repo1/raw/tag/v1.1/README.md",
+			withScope:    http.StatusOK,
+			publicOnlyOK: true,
+		},
+		{
+			name:         "PublicRawCommit",
+			method:       http.MethodGet,
+			url:          "/user2/repo1/raw/commit/65f1bf27bc3bf70f64657658635e66094edbcb4d/README.md",
+			withScope:    http.StatusOK,
+			publicOnlyOK: true,
+		},
+		{
+			name:         "PublicMediaBlob",
+			method:       http.MethodGet,
+			url:          "/user2/repo1/media/blob/4b4851ad51df6a7d9f25c979345979eaeb5b349f",
+			withScope:    http.StatusOK,
+			publicOnlyOK: true,
+		},
+		{
+			name:         "PublicMediaBranch",
+			method:       http.MethodGet,
+			url:          "/user2/repo1/media/branch/master/README.md",
+			withScope:    http.StatusOK,
+			publicOnlyOK: true,
+		},
+		{
+			name:         "PublicMediaTag",
+			method:       http.MethodGet,
+			url:          "/user2/repo1/media/tag/v1.1/README.md",
+			withScope:    http.StatusOK,
+			publicOnlyOK: true,
+		},
+		{
+			name:         "PublicMediaCommit",
+			method:       http.MethodGet,
+			url:          "/user2/repo1/media/commit/65f1bf27bc3bf70f64657658635e66094edbcb4d/README.md",
+			withScope:    http.StatusOK,
+			publicOnlyOK: true,
+		},
+		{
+			name:         "PrivateRawBranch",
+			method:       http.MethodGet,
+			url:          "/user2/repo2/raw/branch/master/test.xml",
+			withScope:    http.StatusOK,
+			publicOnlyOK: false,
+		},
+		{
+			name:         "PrivateRawBlob",
+			method:       http.MethodGet,
+			url:          "/user2/repo2/raw/blob/6395b68e1feebb1e4c657b4f9f6ba2676a283c0b",
+			withScope:    http.StatusOK,
+			publicOnlyOK: false,
+		},
+		{
+			name:         "PrivateMediaBranch",
+			method:       http.MethodGet,
+			url:          "/user2/repo2/media/branch/master/test.xml",
+			withScope:    http.StatusOK,
+			publicOnlyOK: false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			MakeRequest(t, NewRequest(t, tc.method, tc.url).AddTokenAuth(miscToken), http.StatusForbidden)
+			MakeRequest(t, NewRequest(t, tc.method, tc.url).AddTokenAuth(ownerReadToken), tc.withScope)
+
+			publicOnlyStatus := http.StatusForbidden
+			if tc.publicOnlyOK {
+				publicOnlyStatus = tc.withScope
+			}
+			MakeRequest(t, NewRequest(t, tc.method, tc.url).AddTokenAuth(publicOnlyToken), publicOnlyStatus)
+		})
+	}
+}
diff --git a/tests/integration/dump_restore_test.go b/tests/integration/dump_restore_test.go
index d2d43075c3c..92e0ed4664f 100644
--- a/tests/integration/dump_restore_test.go
+++ b/tests/integration/dump_restore_test.go
@@ -13,31 +13,25 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	base "code.gitea.io/gitea/modules/migration"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/migrations"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	base "gitea.dev/modules/migration"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/migrations"
 
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestDumpRestore(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
-		AllowLocalNetworks := setting.Migrations.AllowLocalNetworks
-		setting.Migrations.AllowLocalNetworks = true
-		AppVer := setting.AppVer
 		// Gitea SDK (go-sdk) need to parse the AppVer from server response, so we must set it to a valid version string.
-		setting.AppVer = "1.16.0"
-		defer func() {
-			setting.Migrations.AllowLocalNetworks = AllowLocalNetworks
-			setting.AppVer = AppVer
-		}()
-
+		defer test.MockVariableValue(&setting.AppVer, "1.16.0")()
+		defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
 		assert.NoError(t, migrations.Init())
 
 		reponame := "repo1"
diff --git a/tests/integration/editor_test.go b/tests/integration/editor_test.go
index 18b3a9400d7..ea4900b823e 100644
--- a/tests/integration/editor_test.go
+++ b/tests/integration/editor_test.go
@@ -16,15 +16,15 @@ import (
 	"strings"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/tests"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -98,6 +98,42 @@ func testEditorProtectedBranch(t *testing.T) {
 	resp := testEditorActionPostRequest(t, session, "/user2/repo1/_new/master/", map[string]string{"tree_path": "test-protected-branch.txt", "commit_choice": "direct"})
 	assert.Equal(t, http.StatusBadRequest, resp.Code)
 	assert.Equal(t, `Cannot commit to protected branch "master".`, test.ParseJSONError(resp.Body.Bytes()).ErrorMessage)
+
+	// Change "master" branch to mark files under "docs/" as unprotected
+	req = NewRequestWithValues(t, "POST", "/user2/repo1/settings/branches/edit", map[string]string{
+		"rule_name":                 "master",
+		"protected_file_patterns":   "",
+		"unprotected_file_patterns": "docs/*.md",
+		"enable_push":               "true",
+	})
+	session.MakeRequest(t, req, http.StatusSeeOther)
+	flashMsg = session.GetCookieFlashMessage()
+	assert.Equal(t, `Branch protection for rule "master" has been updated.`, flashMsg.SuccessMsg)
+
+	resp = testEditorActionPostRequest(t, session, "/user2/repo1/_new/master/docs/new.md", map[string]string{"tree_path": "docs/new.md", "commit_choice": "direct"})
+	assert.Equal(t, http.StatusOK, resp.Code)
+	assert.Contains(t, resp.Body.String(), `"redirect":"/user2/repo1/src/branch/master/docs/new.md"`)
+
+	// Form's destination (renamed.md) is decided by the pre-receive hook, not the controller.
+	resp = testEditorActionPostRequest(t, session, "/user2/repo1/_edit/master/docs/new.md", map[string]string{
+		"content":       "renamed via editor",
+		"commit_choice": "direct",
+		"tree_path":     "docs/renamed.md",
+	})
+	assert.Equal(t, http.StatusOK, resp.Code)
+	assert.Contains(t, resp.Body.String(), `"redirect":"/user2/repo1/src/branch/master/docs/renamed.md"`)
+
+	// Protected source path: controller rejects up-front regardless of unprotected destination.
+	resp = testEditorActionPostRequest(t, session, "/user2/repo1/_edit/master/README.md", map[string]string{
+		"commit_choice": "direct",
+		"tree_path":     "docs/from-readme.md",
+	})
+	assert.Equal(t, http.StatusBadRequest, resp.Code)
+	assert.Equal(t, `Cannot commit to protected branch "master".`, test.ParseJSONError(resp.Body.Bytes()).ErrorMessage)
+
+	resp = testEditorActionPostRequest(t, session, "/user2/repo1/_delete/master/README.md", map[string]string{"commit_choice": "direct"})
+	assert.Equal(t, http.StatusBadRequest, resp.Code)
+	assert.Equal(t, `Cannot commit to protected branch "master".`, test.ParseJSONError(resp.Body.Bytes()).ErrorMessage)
 }
 
 func testEditorActionPostRequest(t *testing.T, session *TestSession, requestPath string, params map[string]string) *httptest.ResponseRecorder {
@@ -124,7 +160,7 @@ func testEditorActionEdit(t *testing.T, session *TestSession, user, repo, editor
 	resp := testEditorActionPostRequest(t, session, fmt.Sprintf("/%s/%s/%s/%s/%s", user, repo, editorAction, branch, filePath), params)
 	assert.Equal(t, http.StatusOK, resp.Code)
 	assert.NotEmpty(t, test.RedirectURL(resp))
-	req := NewRequest(t, "GET", path.Join(user, repo, "raw/branch", newBranchName, params["tree_path"]))
+	req := NewRequest(t, "GET", "/"+path.Join(user, repo, "raw/branch", newBranchName, params["tree_path"]))
 	resp = session.MakeRequest(t, req, http.StatusOK)
 	assert.Equal(t, params["content"], resp.Body.String())
 	return resp
@@ -330,18 +366,18 @@ index 0000000000..bbbbbbbbbb
 func testForkToEditFile(t *testing.T, session *TestSession, user, owner, repo, branch, filePath string) {
 	forkToEdit := func(t *testing.T, session *TestSession, owner, repo, operation, branch, filePath string) {
 		// visit the base repo, see the "Add File" button
-		req := NewRequest(t, "GET", path.Join(owner, repo))
+		req := NewRequest(t, "GET", "/"+path.Join(owner, repo))
 		resp := session.MakeRequest(t, req, http.StatusOK)
 		htmlDoc := NewHTMLParser(t, resp.Body)
 		AssertHTMLElement(t, htmlDoc, ".repo-add-file", 1)
 
 		// attempt to edit a file, see the guideline page
-		req = NewRequest(t, "GET", path.Join(owner, repo, operation, branch, filePath))
+		req = NewRequest(t, "GET", "/"+path.Join(owner, repo, operation, branch, filePath))
 		resp = session.MakeRequest(t, req, http.StatusOK)
 		assert.Contains(t, resp.Body.String(), "Fork Repository to Propose Changes")
 
 		// fork the repository
-		req = NewRequest(t, "POST", path.Join(owner, repo, "_fork", branch))
+		req = NewRequest(t, "POST", "/"+path.Join(owner, repo, "_fork", branch))
 		resp = session.MakeRequest(t, req, http.StatusOK)
 		assert.JSONEq(t, `{"redirect":""}`, resp.Body.String())
 	}
@@ -351,7 +387,7 @@ func testForkToEditFile(t *testing.T, session *TestSession, user, owner, repo, b
 		forkToEdit(t, session, owner, repo, "_edit", branch, filePath)
 
 		// Archive the repository
-		req := NewRequestWithValues(t, "POST", path.Join(user, repo, "settings"),
+		req := NewRequestWithValues(t, "POST", "/"+path.Join(user, repo, "settings"),
 			map[string]string{
 				"repo_name": repo,
 				"action":    "archive",
@@ -360,12 +396,12 @@ func testForkToEditFile(t *testing.T, session *TestSession, user, owner, repo, b
 		session.MakeRequest(t, req, http.StatusSeeOther)
 
 		// Check editing archived repository is disabled
-		req = NewRequest(t, "GET", path.Join(owner, repo, "_edit", branch, filePath)).SetHeader("Accept", "text/html")
+		req = NewRequest(t, "GET", "/"+path.Join(owner, repo, "_edit", branch, filePath)).SetHeader("Accept", "text/html")
 		resp := session.MakeRequest(t, req, http.StatusNotFound)
 		assert.Contains(t, resp.Body.String(), "You have forked this repository but your fork is not editable.")
 
 		// Unfork the repository
-		req = NewRequestWithValues(t, "POST", path.Join(user, repo, "settings"),
+		req = NewRequestWithValues(t, "POST", "/"+path.Join(user, repo, "settings"),
 			map[string]string{
 				"repo_name": repo,
 				"action":    "convert_fork",
@@ -381,7 +417,7 @@ func testForkToEditFile(t *testing.T, session *TestSession, user, owner, repo, b
 
 	t.Run("CheckBaseRepoForm", func(t *testing.T) {
 		// the base repo's edit form should have the correct action and upload links (pointing to the forked repo)
-		req := NewRequest(t, "GET", path.Join(owner, repo, "_upload", branch, filePath)+"?foo=bar")
+		req := NewRequest(t, "GET", "/"+path.Join(owner, repo, "_upload", branch, filePath)+"?foo=bar")
 		resp := session.MakeRequest(t, req, http.StatusOK)
 		htmlDoc := NewHTMLParser(t, resp.Body)
 
@@ -399,7 +435,7 @@ func testForkToEditFile(t *testing.T, session *TestSession, user, owner, repo, b
 	})
 
 	t.Run("ViewBaseEditFormAndCommitToFork", func(t *testing.T) {
-		req := NewRequest(t, "GET", path.Join(owner, repo, "_edit", branch, filePath))
+		req := NewRequest(t, "GET", "/"+path.Join(owner, repo, "_edit", branch, filePath))
 		resp := session.MakeRequest(t, req, http.StatusOK)
 		htmlDoc := NewHTMLParser(t, resp.Body)
 		editRequestForm := map[string]string{
@@ -437,16 +473,16 @@ func testEditFileNotAllowed(t *testing.T) {
 	for _, operation := range operations {
 		t.Run(operation, func(t *testing.T) {
 			// Branch does not exist
-			targetLink := path.Join("user2", "repo1", operation, "missing", "README.md")
+			targetLink := path.Join("/user2/repo1", operation, "missing", "README.md")
 			sessionUser1.MakeRequest(t, NewRequest(t, "GET", targetLink), http.StatusNotFound)
 
 			// Private repository
-			targetLink = path.Join("user2", "repo2", operation, "master", "Home.md")
+			targetLink = path.Join("/user2/repo2", operation, "master", "Home.md")
 			sessionUser1.MakeRequest(t, NewRequest(t, "GET", targetLink), http.StatusOK)
 			sessionUser4.MakeRequest(t, NewRequest(t, "GET", targetLink), http.StatusNotFound)
 
 			// Empty repository
-			targetLink = path.Join("org41", "repo61", operation, "master", "README.md")
+			targetLink = path.Join("/org41/repo61", operation, "master", "README.md")
 			sessionUser1.MakeRequest(t, NewRequest(t, "GET", targetLink), http.StatusNotFound)
 		})
 	}
diff --git a/tests/integration/empty_repo_test.go b/tests/integration/empty_repo_test.go
index de2a2b73745..24b30e69ff5 100644
--- a/tests/integration/empty_repo_test.go
+++ b/tests/integration/empty_repo_test.go
@@ -13,17 +13,17 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/ephemeral_actions_runner_deletion_test.go b/tests/integration/ephemeral_actions_runner_deletion_test.go
index 40f8c643a83..4922ddf5798 100644
--- a/tests/integration/ephemeral_actions_runner_deletion_test.go
+++ b/tests/integration/ephemeral_actions_runner_deletion_test.go
@@ -6,13 +6,13 @@ package integration
 import (
 	"testing"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/util"
-	repo_service "code.gitea.io/gitea/services/repository"
-	user_service "code.gitea.io/gitea/services/user"
-	"code.gitea.io/gitea/tests"
+	actions_model "gitea.dev/models/actions"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/util"
+	repo_service "gitea.dev/services/repository"
+	user_service "gitea.dev/services/user"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/eventsource_test.go b/tests/integration/eventsource_test.go
index e0dbd0b23f1..5800afb1dc9 100644
--- a/tests/integration/eventsource_test.go
+++ b/tests/integration/eventsource_test.go
@@ -9,14 +9,14 @@ import (
 	"testing"
 	"time"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/eventsource"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	activities_model "gitea.dev/models/activities"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/eventsource"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/explore_repos_test.go b/tests/integration/explore_repos_test.go
index 1e3ab314fd4..c8348d9c395 100644
--- a/tests/integration/explore_repos_test.go
+++ b/tests/integration/explore_repos_test.go
@@ -7,7 +7,7 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/explore_user_test.go b/tests/integration/explore_user_test.go
index 441d89cea54..e9fddc71cfb 100644
--- a/tests/integration/explore_user_test.go
+++ b/tests/integration/explore_user_test.go
@@ -7,7 +7,7 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/feed_repo_test.go b/tests/integration/feed_repo_test.go
index 2915b9b3f4a..59189bf070a 100644
--- a/tests/integration/feed_repo_test.go
+++ b/tests/integration/feed_repo_test.go
@@ -8,7 +8,7 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/feed_user_test.go b/tests/integration/feed_user_test.go
index 4315c67f483..87068c2f543 100644
--- a/tests/integration/feed_user_test.go
+++ b/tests/integration/feed_user_test.go
@@ -8,7 +8,7 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/git_general_test.go b/tests/integration/git_general_test.go
index b82dd600217..30ccff49ab2 100644
--- a/tests/integration/git_general_test.go
+++ b/tests/integration/git_general_test.go
@@ -5,7 +5,6 @@ package integration
 
 import (
 	"context"
-	"encoding/hex"
 	"fmt"
 	"io"
 	mathRand "math/rand/v2"
@@ -21,19 +20,19 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/kballard/go-shellquote"
 	"github.com/stretchr/testify/assert"
@@ -246,8 +245,8 @@ func rawTest(t *testing.T, ctx *APITestContext, little, big, littleLFS, bigLFS s
 
 		// Request raw paths
 		req := NewRequest(t, "GET", path.Join("/", username, reponame, "/raw/branch/master/", little))
-		resp := session.MakeRequestNilResponseRecorder(t, req, http.StatusOK)
-		assert.Equal(t, testFileSizeSmall, resp.Length)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		assert.Equal(t, testFileSizeSmall, resp.Body.Len())
 
 		if setting.LFS.StartServer {
 			req = NewRequest(t, "GET", path.Join("/", username, reponame, "/raw/branch/master/", littleLFS))
@@ -261,8 +260,8 @@ func rawTest(t *testing.T, ctx *APITestContext, little, big, littleLFS, bigLFS s
 
 		if !testing.Short() {
 			req = NewRequest(t, "GET", path.Join("/", username, reponame, "/raw/branch/master/", big))
-			resp := session.MakeRequestNilResponseRecorder(t, req, http.StatusOK)
-			assert.Equal(t, testFileSizeLarge, resp.Length)
+			resp := session.MakeRequest(t, req, http.StatusOK)
+			assert.Equal(t, testFileSizeLarge, resp.Body.Len())
 
 			if setting.LFS.StartServer {
 				req = NewRequest(t, "GET", path.Join("/", username, reponame, "/raw/branch/master/", bigLFS))
@@ -287,22 +286,22 @@ func mediaTest(t *testing.T, ctx *APITestContext, little, big, littleLFS, bigLFS
 
 		// Request media paths
 		req := NewRequest(t, "GET", path.Join("/", username, reponame, "/media/branch/master/", little))
-		resp := session.MakeRequestNilResponseRecorder(t, req, http.StatusOK)
-		assert.Equal(t, testFileSizeSmall, resp.Length)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		assert.Equal(t, testFileSizeSmall, resp.Body.Len())
 
 		req = NewRequest(t, "GET", path.Join("/", username, reponame, "/media/branch/master/", littleLFS))
-		resp = session.MakeRequestNilResponseRecorder(t, req, http.StatusOK)
-		assert.Equal(t, testFileSizeSmall, resp.Length)
+		resp = session.MakeRequest(t, req, http.StatusOK)
+		assert.Equal(t, testFileSizeSmall, resp.Body.Len())
 
 		if !testing.Short() {
 			req = NewRequest(t, "GET", path.Join("/", username, reponame, "/media/branch/master/", big))
-			resp = session.MakeRequestNilResponseRecorder(t, req, http.StatusOK)
-			assert.Equal(t, testFileSizeLarge, resp.Length)
+			resp = session.MakeRequest(t, req, http.StatusOK)
+			assert.Equal(t, testFileSizeLarge, resp.Body.Len())
 
 			if setting.LFS.StartServer {
 				req = NewRequest(t, "GET", path.Join("/", username, reponame, "/media/branch/master/", bigLFS))
-				resp = session.MakeRequestNilResponseRecorder(t, req, http.StatusOK)
-				assert.Equal(t, testFileSizeLarge, resp.Length)
+				resp = session.MakeRequest(t, req, http.StatusOK)
+				assert.Equal(t, testFileSizeLarge, resp.Body.Len())
 			}
 		}
 	})
@@ -560,13 +559,11 @@ func doMergeFork(ctx, baseCtx APITestContext, baseBranch, headBranch string) fun
 		t.Run("EnsureCanSeePull", doEnsureCanSeePull(baseCtx, pr))
 
 		// Then get the diff string
-		var diffHash string
-		var diffLength int
+		var diffContent string
 		t.Run("GetDiff", func(t *testing.T) {
 			req := NewRequest(t, "GET", fmt.Sprintf("/%s/%s/pulls/%d.diff", url.PathEscape(baseCtx.Username), url.PathEscape(baseCtx.Reponame), pr.Index))
-			resp := ctx.Session.MakeRequestNilResponseHashSumRecorder(t, req, http.StatusOK)
-			diffHash = string(resp.Hash.Sum(nil))
-			diffLength = resp.Length
+			resp := ctx.Session.MakeRequest(t, req, http.StatusOK)
+			diffContent = resp.Body.String()
 		})
 
 		// Now: Merge the PR & make sure that doesn't break the PR page or change its diff
@@ -578,17 +575,17 @@ func doMergeFork(ctx, baseCtx APITestContext, baseBranch, headBranch string) fun
 			assert.NoError(t, err)
 			assert.Equal(t, oldMergeBase, pr2.MergeBase)
 		})
-		t.Run("EnsurDiffNoChange", doEnsureDiffNoChange(baseCtx, pr, diffHash, diffLength))
+		t.Run("EnsurDiffNoChange", doEnsureDiffNoChange(baseCtx, pr, diffContent))
 
 		// Then: Delete the head branch & make sure that doesn't break the PR page or change its diff
 		t.Run("DeleteHeadBranch", doBranchDelete(baseCtx, baseCtx.Username, baseCtx.Reponame, headBranch))
 		t.Run("EnsureCanSeePull", doEnsureCanSeePull(baseCtx, pr))
-		t.Run("EnsureDiffNoChange", doEnsureDiffNoChange(baseCtx, pr, diffHash, diffLength))
+		t.Run("EnsureDiffNoChange", doEnsureDiffNoChange(baseCtx, pr, diffContent))
 
 		// Delete the head repository & make sure that doesn't break the PR page or change its diff
 		t.Run("DeleteHeadRepository", doAPIDeleteRepository(ctx))
 		t.Run("EnsureCanSeePull", doEnsureCanSeePull(baseCtx, pr))
-		t.Run("EnsureDiffNoChange", doEnsureDiffNoChange(baseCtx, pr, diffHash, diffLength))
+		t.Run("EnsureDiffNoChange", doEnsureDiffNoChange(baseCtx, pr, diffContent))
 	}
 }
 
@@ -632,15 +629,12 @@ func doEnsureCanSeePull(ctx APITestContext, pr api.PullRequest) func(t *testing.
 	}
 }
 
-func doEnsureDiffNoChange(ctx APITestContext, pr api.PullRequest, diffHash string, diffLength int) func(t *testing.T) {
+func doEnsureDiffNoChange(ctx APITestContext, pr api.PullRequest, diffContent string) func(t *testing.T) {
 	return func(t *testing.T) {
 		req := NewRequest(t, "GET", fmt.Sprintf("/%s/%s/pulls/%d.diff", url.PathEscape(ctx.Username), url.PathEscape(ctx.Reponame), pr.Index))
-		resp := ctx.Session.MakeRequestNilResponseHashSumRecorder(t, req, http.StatusOK)
-		actual := string(resp.Hash.Sum(nil))
-		actualLength := resp.Length
-
-		equal := diffHash == actual
-		assert.True(t, equal, "Unexpected change in the diff string: expected hash: %s size: %d but was actually: %s size: %d", hex.EncodeToString([]byte(diffHash)), diffLength, hex.EncodeToString([]byte(actual)), actualLength)
+		resp := ctx.Session.MakeRequest(t, req, http.StatusOK)
+		actual := resp.Body.String()
+		assert.Equal(t, diffContent, actual)
 	}
 }
 
diff --git a/tests/integration/git_helper_for_declarative_test.go b/tests/integration/git_helper_for_declarative_test.go
index 8c58e59115b..3b374a094ee 100644
--- a/tests/integration/git_helper_for_declarative_test.go
+++ b/tests/integration/git_helper_for_declarative_test.go
@@ -15,12 +15,12 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/ssh"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/ssh"
+	"gitea.dev/modules/util"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/git_lfs_ssh_test.go b/tests/integration/git_lfs_ssh_test.go
index d2f34ef10b2..e185c27a805 100644
--- a/tests/integration/git_lfs_ssh_test.go
+++ b/tests/integration/git_lfs_ssh_test.go
@@ -12,12 +12,13 @@ import (
 	"sync"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/common"
-	"code.gitea.io/gitea/services/context"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/common"
+	"gitea.dev/services/context"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -45,7 +46,7 @@ func TestGitLFSSSH(t *testing.T) {
 			cfg, err := setting.CfgProvider.PrepareSaving()
 			require.NoError(t, err)
 			cfg.Section("server").Key("LFS_ALLOW_PURE_SSH").SetValue("true")
-			setting.LFS.AllowPureSSH = true
+			defer test.MockVariableValue(&setting.LFS.AllowPureSSH, true)()
 			require.NoError(t, cfg.Save())
 
 			_, _, cmdErr := gitcmd.NewCommand("config", "lfs.sshtransfer", "always").
diff --git a/tests/integration/git_misc_test.go b/tests/integration/git_misc_test.go
index c830086e3fa..4747d2bd095 100644
--- a/tests/integration/git_misc_test.go
+++ b/tests/integration/git_misc_test.go
@@ -10,15 +10,15 @@ import (
 	"sync"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	files_service "gitea.dev/services/repository/files"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -63,17 +63,14 @@ func TestDataAsyncDoubleRead_Issue29101(t *testing.T) {
 
 		var data1, data2 []byte
 		wg := sync.WaitGroup{}
-		wg.Add(2)
-		go func() {
+		wg.Go(func() {
 			data1, _ = io.ReadAll(r1)
 			assert.NoError(t, err)
-			wg.Done()
-		}()
-		go func() {
+		})
+		wg.Go(func() {
 			data2, _ = io.ReadAll(r2)
 			assert.NoError(t, err)
-			wg.Done()
-		}()
+		})
 		wg.Wait()
 		assert.Equal(t, testContent, data1)
 		assert.Equal(t, testContent, data2)
diff --git a/tests/integration/git_push_test.go b/tests/integration/git_push_test.go
index 5d54eaed122..eee80b191cb 100644
--- a/tests/integration/git_push_test.go
+++ b/tests/integration/git_push_test.go
@@ -8,14 +8,14 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	repo_service "code.gitea.io/gitea/services/repository"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	repo_service "gitea.dev/services/repository"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/git_smart_http_test.go b/tests/integration/git_smart_http_test.go
index b74eb528c08..dfbda5c701d 100644
--- a/tests/integration/git_smart_http_test.go
+++ b/tests/integration/git_smart_http_test.go
@@ -9,9 +9,12 @@ import (
 	"net/url"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -20,6 +23,7 @@ import (
 func TestGitSmartHTTP(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		testGitSmartHTTP(t, u)
+		testGitSmartHTTPTokenScopes(t)
 		testRenamedRepoRedirect(t)
 		testGitArchiveRemote(t, u)
 	})
@@ -80,6 +84,42 @@ func testGitSmartHTTP(t *testing.T, u *url.URL) {
 	}
 }
 
+func testGitSmartHTTPTokenScopes(t *testing.T) {
+	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2, OwnerName: "user2", Name: "repo2"})
+	require.True(t, repo.IsPrivate)
+
+	session := loginUser(t, "user2")
+	badToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadNotification)
+	readToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadRepository)
+	writeToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
+	publicOnlyToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopePublicOnly, auth_model.AccessTokenScopeReadRepository)
+
+	t.Run("upload-pack requires read repository scope", func(t *testing.T) {
+		path := "/user2/repo2/info/refs?service=git-upload-pack"
+
+		MakeRequest(t, NewRequest(t, "GET", path).AddBasicAuth(badToken, "x-oauth-basic"), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "GET", path).AddTokenAuth(badToken), http.StatusForbidden)
+
+		resp := MakeRequest(t, NewRequest(t, "GET", path).AddTokenAuth(readToken), http.StatusOK)
+		assert.Contains(t, resp.Body.String(), "refs/heads/master")
+	})
+
+	t.Run("receive-pack requires write repository scope", func(t *testing.T) {
+		path := "/user2/repo2/info/refs?service=git-receive-pack"
+
+		MakeRequest(t, NewRequest(t, "GET", path).AddBasicAuth(readToken, "x-oauth-basic"), http.StatusForbidden)
+		MakeRequest(t, NewRequest(t, "GET", path).AddTokenAuth(readToken), http.StatusForbidden)
+
+		resp := MakeRequest(t, NewRequest(t, "GET", path).AddTokenAuth(writeToken), http.StatusOK)
+		assert.Contains(t, resp.Body.String(), "refs/heads/master")
+	})
+
+	t.Run("public-only scope rejects private repo", func(t *testing.T) {
+		path := "/user2/repo2/info/refs?service=git-upload-pack"
+		MakeRequest(t, NewRequest(t, "GET", path).AddTokenAuth(publicOnlyToken), http.StatusForbidden)
+	})
+}
+
 func testRenamedRepoRedirect(t *testing.T) {
 	defer test.MockVariableValue(&setting.Service.RequireSignInViewStrict, true)()
 
diff --git a/tests/integration/git_ssh_redirect_test.go b/tests/integration/git_ssh_redirect_test.go
index 3ae2652412c..033c6cc0c02 100644
--- a/tests/integration/git_ssh_redirect_test.go
+++ b/tests/integration/git_ssh_redirect_test.go
@@ -9,8 +9,8 @@ import (
 	"os"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/structs"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/goget_test.go b/tests/integration/goget_test.go
index 854f8d7a2db..21ae6fb13bb 100644
--- a/tests/integration/goget_test.go
+++ b/tests/integration/goget_test.go
@@ -8,8 +8,9 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -36,12 +37,7 @@ func TestGoGet(t *testing.T) {
 
 func TestGoGetForSSH(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	old := setting.Repository.GoGetCloneURLProtocol
-	defer func() {
-		setting.Repository.GoGetCloneURLProtocol = old
-	}()
-	setting.Repository.GoGetCloneURLProtocol = "ssh"
+	defer test.MockVariableValue(&setting.Repository.GoGetCloneURLProtocol, "ssh")()
 
 	req := NewRequest(t, "GET", "/blah/glah/plah?go-get=1")
 	resp := MakeRequest(t, req, http.StatusOK)
diff --git a/tests/integration/gpg_ssh_git_test.go b/tests/integration/gpg_ssh_git_test.go
index a8ec79cd9d4..3b9bc29d1df 100644
--- a/tests/integration/gpg_ssh_git_test.go
+++ b/tests/integration/gpg_ssh_git_test.go
@@ -15,14 +15,14 @@ import (
 	"path/filepath"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/process"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/process"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
diff --git a/tests/integration/heatmap_test.go b/tests/integration/heatmap_test.go
index 4e0c02dd0f1..11387c80ff9 100644
--- a/tests/integration/heatmap_test.go
+++ b/tests/integration/heatmap_test.go
@@ -8,8 +8,8 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/html_helper.go b/tests/integration/html_helper.go
index c2045453e65..cefe5592c4a 100644
--- a/tests/integration/html_helper.go
+++ b/tests/integration/html_helper.go
@@ -5,10 +5,13 @@ package integration
 
 import (
 	"io"
+	"slices"
+	"strings"
 	"testing"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
+	"golang.org/x/net/html"
 )
 
 // HTMLDoc struct
@@ -47,3 +50,39 @@ func AssertHTMLElement[T int | bool](t testing.TB, doc *HTMLDoc, selector string
 		assert.Equal(t, v, sel.Length())
 	}
 }
+
+func assertHTMLEq(t testing.TB, expected, actual string) {
+	t.Helper()
+	if expected == actual {
+		return
+	}
+	exp, err := html.Parse(strings.NewReader(expected))
+	if !assert.NoError(t, err) {
+		return
+	}
+	act, err := html.Parse(strings.NewReader(actual))
+	if !assert.NoError(t, err) {
+		return
+	}
+	var normalize func(n *html.Node)
+	normalize = func(n *html.Node) {
+		slices.SortFunc(n.Attr, func(a, b html.Attribute) int {
+			if cmp := strings.Compare(a.Namespace, b.Namespace); cmp != 0 {
+				return cmp
+			}
+			if cmp := strings.Compare(a.Key, b.Key); cmp != 0 {
+				return cmp
+			}
+			return strings.Compare(a.Val, b.Val)
+		})
+		for c := n.FirstChild; c != nil; c = c.NextSibling {
+			normalize(c)
+		}
+	}
+	normalize(exp)
+	normalize(act)
+	var expNormalized, actNormalized strings.Builder
+	assert.NoError(t, html.Render(&expNormalized, exp))
+	assert.NoError(t, html.Render(&actNormalized, act))
+	assert.Equal(t, expNormalized.String(), actNormalized.String())
+}
diff --git a/tests/integration/incoming_email_test.go b/tests/integration/incoming_email_test.go
index 09872fe8577..08dec041e1b 100644
--- a/tests/integration/incoming_email_test.go
+++ b/tests/integration/incoming_email_test.go
@@ -12,15 +12,15 @@ import (
 	"testing"
 	"time"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/mailer/incoming"
-	incoming_payload "code.gitea.io/gitea/services/mailer/incoming/payload"
-	sender_service "code.gitea.io/gitea/services/mailer/sender"
-	token_service "code.gitea.io/gitea/services/mailer/token"
-	"code.gitea.io/gitea/tests"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/services/mailer/incoming"
+	incoming_payload "gitea.dev/services/mailer/incoming/payload"
+	sender_service "gitea.dev/services/mailer/sender"
+	token_service "gitea.dev/services/mailer/token"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -66,7 +66,14 @@ func TestIncomingEmail(t *testing.T) {
 			assert.NoError(t, err)
 			assert.NotEmpty(t, token)
 
-			ht, u, p, err := token_service.ExtractToken(t.Context(), token)
+			ht, u, p, err := token_service.DecodeToken(t.Context(), token)
+			assert.NoError(t, err)
+			assert.Equal(t, token_service.ReplyHandlerType, ht)
+			assert.Equal(t, user.ID, u.ID)
+			assert.Equal(t, payload, p)
+
+			// MTAs may lowercase the local-part of the reply-to address (RFC 5321 §2.4).
+			ht, u, p, err = token_service.DecodeToken(t.Context(), strings.ToLower(token))
 			assert.NoError(t, err)
 			assert.Equal(t, token_service.ReplyHandlerType, ht)
 			assert.Equal(t, user.ID, u.ID)
@@ -189,7 +196,7 @@ func TestIncomingEmail(t *testing.T) {
 				assert.NoError(t, err)
 
 				msg := sender_service.NewMessageFrom(
-					strings.Replace(setting.IncomingEmail.ReplyToAddress, setting.IncomingEmail.TokenPlaceholder, token, 1),
+					strings.Replace(setting.IncomingEmail.ReplyToAddress, setting.IncomingEmailTokenPlaceholder, token, 1),
 					"",
 					user.Email,
 					"",
diff --git a/tests/integration/integration_test.go b/tests/integration/integration_test.go
index 62aea184f36..9c42366832f 100644
--- a/tests/integration/integration_test.go
+++ b/tests/integration/integration_test.go
@@ -7,9 +7,8 @@ import (
 	"bytes"
 	"context"
 	"encoding/base64"
+	"flag"
 	"fmt"
-	"hash"
-	"hash/fnv"
 	"io"
 	"net/http"
 	"net/http/cookiejar"
@@ -21,65 +20,26 @@ import (
 	"sync/atomic"
 	"testing"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/testlogger"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/modules/web/middleware"
-	"code.gitea.io/gitea/routers"
-	gitea_context "code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/testlogger"
+	"gitea.dev/modules/util"
+	"gitea.dev/modules/web"
+	"gitea.dev/modules/web/middleware"
+	"gitea.dev/routers"
+	gitea_context "gitea.dev/services/context"
+	"gitea.dev/tests"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"github.com/xeipuuv/gojsonschema"
 )
 
 var testWebRoutes *web.Router
 
-type NilResponseRecorder struct {
-	httptest.ResponseRecorder
-	Length int
-}
-
-func (n *NilResponseRecorder) Write(b []byte) (int, error) {
-	n.Length += len(b)
-	return len(b), nil
-}
-
-// NewRecorder returns an initialized ResponseRecorder.
-func NewNilResponseRecorder() *NilResponseRecorder {
-	return &NilResponseRecorder{
-		ResponseRecorder: *httptest.NewRecorder(),
-	}
-}
-
-type NilResponseHashSumRecorder struct {
-	httptest.ResponseRecorder
-	Hash   hash.Hash
-	Length int
-}
-
-func (n *NilResponseHashSumRecorder) Write(b []byte) (int, error) {
-	_, _ = n.Hash.Write(b)
-	n.Length += len(b)
-	return len(b), nil
-}
-
-// NewRecorder returns an initialized ResponseRecorder.
-func NewNilResponseHashSumRecorder() *NilResponseHashSumRecorder {
-	return &NilResponseHashSumRecorder{
-		Hash:             fnv.New32(),
-		ResponseRecorder: *httptest.NewRecorder(),
-	}
-}
-
 func testMain(m *testing.M) int {
 	defer log.GetManager().Close()
 
@@ -116,6 +76,11 @@ func testMain(m *testing.M) int {
 }
 
 func TestMain(m *testing.M) {
+	// -test.list must skip InitIntegrationTest, which requires a database.
+	flag.Parse()
+	if flag.Lookup("test.list").Value.String() != "" {
+		os.Exit(m.Run())
+	}
 	os.Exit(testMain(m))
 }
 
@@ -171,42 +136,6 @@ func (s *TestSession) MakeRequest(t testing.TB, rw *RequestWrapper, expectedStat
 	return resp
 }
 
-func (s *TestSession) MakeRequestNilResponseRecorder(t testing.TB, rw *RequestWrapper, expectedStatus int) *NilResponseRecorder {
-	t.Helper()
-	req := rw.Request
-	baseURL, err := url.Parse(setting.AppURL)
-	assert.NoError(t, err)
-	for _, c := range s.jar.Cookies(baseURL) {
-		req.AddCookie(c)
-	}
-	resp := MakeRequestNilResponseRecorder(t, rw, expectedStatus)
-
-	ch := http.Header{}
-	ch.Add("Cookie", strings.Join(resp.Header()["Set-Cookie"], ";"))
-	cr := http.Request{Header: ch}
-	s.jar.SetCookies(baseURL, cr.Cookies())
-
-	return resp
-}
-
-func (s *TestSession) MakeRequestNilResponseHashSumRecorder(t testing.TB, rw *RequestWrapper, expectedStatus int) *NilResponseHashSumRecorder {
-	t.Helper()
-	req := rw.Request
-	baseURL, err := url.Parse(setting.AppURL)
-	assert.NoError(t, err)
-	for _, c := range s.jar.Cookies(baseURL) {
-		req.AddCookie(c)
-	}
-	resp := MakeRequestNilResponseHashSumRecorder(t, rw, expectedStatus)
-
-	ch := http.Header{}
-	ch.Add("Cookie", strings.Join(resp.Header()["Set-Cookie"], ";"))
-	cr := http.Request{Header: ch}
-	s.jar.SetCookies(baseURL, cr.Cookies())
-
-	return resp
-}
-
 const userPassword = "password"
 
 func emptyTestSession(t testing.TB) *TestSession {
@@ -262,7 +191,11 @@ func getTokenForLoggedInUser(t testing.TB, session *TestSession, scopes ...auth.
 	req := NewRequestWithURLValues(t, "POST", "/user/settings/applications", urlValues)
 	session.MakeRequest(t, req, http.StatusSeeOther)
 	flashes := session.GetCookieFlashMessage()
-	return flashes.InfoMsg
+	assert.NotNil(t, flashes)
+	if flashes != nil {
+		return flashes.InfoMsg
+	}
+	return ""
 }
 
 type RequestWrapper struct {
@@ -326,14 +259,18 @@ func NewRequestWithJSON(t testing.TB, method, urlStr string, v any) *RequestWrap
 
 func NewRequestWithBody(t testing.TB, method, urlStr string, body io.Reader) *RequestWrapper {
 	t.Helper()
-	if !strings.HasPrefix(urlStr, "http") && !strings.HasPrefix(urlStr, "/") {
-		urlStr = "/" + urlStr
+	if !strings.HasPrefix(urlStr, "http:") && !strings.HasPrefix(urlStr, "https:") && !strings.HasPrefix(urlStr, "/") {
+		t.Fatalf("invalid url str: %s", urlStr)
 	}
 	req, err := http.NewRequest(method, urlStr, body)
-	require.NoError(t, err)
+	assert.NoError(t, err)
 	if req.URL.User != nil {
 		req.Header.Set("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(req.URL.User.String())))
 	}
+	req.RequestURI = req.URL.Path
+	if req.URL.RawQuery != "" {
+		req.RequestURI += "?" + req.URL.RawQuery
+	}
 	return &RequestWrapper{req}
 }
 
@@ -354,35 +291,8 @@ func MakeRequest(t testing.TB, rw *RequestWrapper, expectedStatus int) *httptest
 	if expectedStatus != NoExpectedStatus {
 		if expectedStatus != recorder.Code {
 			logUnexpectedResponse(t, recorder)
-			require.Equal(t, expectedStatus, recorder.Code, "Request: %s %s", req.Method, req.URL.String())
-		}
-	}
-	return recorder
-}
-
-func MakeRequestNilResponseRecorder(t testing.TB, rw *RequestWrapper, expectedStatus int) *NilResponseRecorder {
-	t.Helper()
-	req := rw.Request
-	recorder := NewNilResponseRecorder()
-	testWebRoutes.ServeHTTP(recorder, req)
-	if expectedStatus != NoExpectedStatus {
-		if !assert.Equal(t, expectedStatus, recorder.Code,
-			"Request: %s %s", req.Method, req.URL.String()) {
-			logUnexpectedResponse(t, &recorder.ResponseRecorder)
-		}
-	}
-	return recorder
-}
-
-func MakeRequestNilResponseHashSumRecorder(t testing.TB, rw *RequestWrapper, expectedStatus int) *NilResponseHashSumRecorder {
-	t.Helper()
-	req := rw.Request
-	recorder := NewNilResponseHashSumRecorder()
-	testWebRoutes.ServeHTTP(recorder, req)
-	if expectedStatus != NoExpectedStatus {
-		if !assert.Equal(t, expectedStatus, recorder.Code,
-			"Request: %s %s", req.Method, req.URL.String()) {
-			logUnexpectedResponse(t, &recorder.ResponseRecorder)
+			// don't use "require" which exits the test case and makes "wait group" wait forever
+			assert.Equal(t, expectedStatus, recorder.Code, "Request: %s %s", req.Method, req.URL.String())
 		}
 	}
 	return recorder
@@ -418,25 +328,7 @@ func DecodeJSON[T any](t testing.TB, resp *httptest.ResponseRecorder, v T) (ret
 
 	// FIXME: JSON-KEY-CASE: for testing purpose only, because many structs don't provide `json` tags, they just use capitalized field names
 	decoder := json.NewDecoderCaseInsensitive(resp.Body)
-	require.NoError(t, decoder.Decode(&v))
+	// don't use "require" which exits the test case and makes "wait group" wait forever
+	assert.NoError(t, decoder.Decode(&v))
 	return v
 }
-
-func VerifyJSONSchema(t testing.TB, resp *httptest.ResponseRecorder, schemaFile string) {
-	t.Helper()
-
-	schemaFilePath := filepath.Join(filepath.Dir(setting.AppPath), "tests", "integration", "schemas", schemaFile)
-	_, schemaFileErr := os.Stat(schemaFilePath)
-	assert.NoError(t, schemaFileErr)
-
-	schema, schemaFileReadErr := os.ReadFile(schemaFilePath)
-	assert.NoError(t, schemaFileReadErr)
-	assert.NotEmpty(t, schema)
-
-	nodeinfoSchema := gojsonschema.NewStringLoader(string(schema))
-	nodeinfoString := gojsonschema.NewStringLoader(resp.Body.String())
-	result, schemaValidationErr := gojsonschema.Validate(nodeinfoSchema, nodeinfoString)
-	assert.NoError(t, schemaValidationErr)
-	assert.Empty(t, result.Errors())
-	assert.True(t, result.Valid())
-}
diff --git a/tests/integration/issue_test.go b/tests/integration/issue_test.go
index 29a1d665af5..aaeba60d8e9 100644
--- a/tests/integration/issue_test.go
+++ b/tests/integration/issue_test.go
@@ -14,18 +14,18 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/indexer/issues"
-	"code.gitea.io/gitea/modules/references"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/indexer/issues"
+	"gitea.dev/modules/references"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
@@ -34,7 +34,7 @@ import (
 func getIssuesSelection(t testing.TB, htmlDoc *HTMLDoc) *goquery.Selection {
 	issueList := htmlDoc.doc.Find("#issue-list")
 	assert.Equal(t, 1, issueList.Length())
-	return issueList.Find(".item").Find(".issue-title")
+	return issueList.Find(".item").Find(".issue-item-title")
 }
 
 func getIssue(t *testing.T, repoID int64, issueSelection *goquery.Selection) *issues_model.Issue {
@@ -123,7 +123,7 @@ func TestNoLoginViewIssue(t *testing.T) {
 }
 
 func testNewIssue(t *testing.T, session *TestSession, user, repo, title, content string) string {
-	req := NewRequest(t, "GET", path.Join(user, repo, "issues", "new"))
+	req := NewRequest(t, "GET", "/"+path.Join(user, repo, "issues", "new"))
 	resp := session.MakeRequest(t, req, http.StatusOK)
 
 	htmlDoc := NewHTMLParser(t, resp.Body)
@@ -667,7 +667,7 @@ func TestUpdateIssueDeadline(t *testing.T) {
 	assert.Equal(t, api.StateOpen, issueBefore.State())
 
 	session := loginUser(t, owner.Name)
-	urlStr := fmt.Sprintf("%s/%s/issues/%d/deadline", owner.Name, repoBefore.Name, issueBefore.Index)
+	urlStr := fmt.Sprintf("/%s/%s/issues/%d/deadline", owner.Name, repoBefore.Name, issueBefore.Index)
 
 	req := NewRequestWithValues(t, "POST", urlStr, map[string]string{"deadline": "2022-04-06"})
 	session.MakeRequest(t, req, http.StatusOK)
@@ -687,14 +687,14 @@ func TestIssueReferenceURL(t *testing.T) {
 	issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 1})
 	repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: issue.RepoID})
 
-	req := NewRequest(t, "GET", fmt.Sprintf("%s/issues/%d", repo.FullName(), issue.Index))
+	req := NewRequest(t, "GET", fmt.Sprintf("%s/issues/%d", repo.Link(), issue.Index))
 	resp := session.MakeRequest(t, req, http.StatusOK)
 	htmlDoc := NewHTMLParser(t, resp.Body)
 
 	// the "reference" uses relative URLs, then JS code will convert them to absolute URLs for current origin, in case users are using multiple domains
-	ref, _ := htmlDoc.Find(`.timeline-item.comment.first .reference-issue`).Attr("data-reference")
+	ref, _ := htmlDoc.Find(`.timeline-item.comment.issue-content-comment .reference-issue`).Attr("data-reference")
 	assert.Equal(t, "/user2/repo1/issues/1#issue-1", ref)
 
-	ref, _ = htmlDoc.Find(`.timeline-item.comment:not(.first) .reference-issue`).Attr("data-reference")
+	ref, _ = htmlDoc.Find(`.timeline-item.comment:not(.issue-content-comment) .reference-issue`).Attr("data-reference")
 	assert.Equal(t, "/user2/repo1/issues/1#issuecomment-2", ref)
 }
diff --git a/tests/integration/issue_timetrack_test.go b/tests/integration/issue_timetrack_test.go
index 0a3188fca01..9c3c22e8fd9 100644
--- a/tests/integration/issue_timetrack_test.go
+++ b/tests/integration/issue_timetrack_test.go
@@ -8,9 +8,9 @@ import (
 	"net/http"
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/tests"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/lfs_getobject_test.go b/tests/integration/lfs_getobject_test.go
index 72bad4cc91d..ddc23ccd051 100644
--- a/tests/integration/lfs_getobject_test.go
+++ b/tests/integration/lfs_getobject_test.go
@@ -11,15 +11,15 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/auth"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/routers/web"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/auth"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/routers/web"
+	"gitea.dev/tests"
 
 	gzipp "github.com/klauspost/compress/gzip"
 	"github.com/stretchr/testify/assert"
diff --git a/tests/integration/lfs_local_endpoint_test.go b/tests/integration/lfs_local_endpoint_test.go
index e67f0712a32..3418963741b 100644
--- a/tests/integration/lfs_local_endpoint_test.go
+++ b/tests/integration/lfs_local_endpoint_test.go
@@ -9,8 +9,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/lfs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/lfs_view_test.go b/tests/integration/lfs_view_test.go
index bbfbb0e6ec0..203887fbf97 100644
--- a/tests/integration/lfs_view_test.go
+++ b/tests/integration/lfs_view_test.go
@@ -9,14 +9,14 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/lfs"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/db"
+	"gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/lfs"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -129,8 +129,7 @@ func TestLFSLockView(t *testing.T) {
 		req.Header.Set("Accept", lfs.AcceptHeader)
 		req.Header.Set("Content-Type", lfs.MediaType)
 		resp := session.MakeRequest(t, req, http.StatusCreated)
-		lockResp := &api.LFSLockResponse{}
-		DecodeJSON(t, resp, lockResp)
+		lockResp := DecodeJSON(t, resp, &api.LFSLockResponse{})
 		lockID = lockResp.Lock.ID
 	}
 	defer func() {
diff --git a/tests/integration/linguist_test.go b/tests/integration/linguist_test.go
index 8f924f0ffb3..67850cbf131 100644
--- a/tests/integration/linguist_test.go
+++ b/tests/integration/linguist_test.go
@@ -10,14 +10,14 @@ import (
 	"testing"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/indexer/stats"
-	"code.gitea.io/gitea/modules/queue"
-	repo_service "code.gitea.io/gitea/services/repository"
-	files_service "code.gitea.io/gitea/services/repository/files"
-	"code.gitea.io/gitea/tests"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/indexer/stats"
+	"gitea.dev/modules/queue"
+	repo_service "gitea.dev/services/repository"
+	files_service "gitea.dev/services/repository/files"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/links_test.go b/tests/integration/links_test.go
index 733a3e045a0..a3198a6759c 100644
--- a/tests/integration/links_test.go
+++ b/tests/integration/links_test.go
@@ -9,10 +9,10 @@ import (
 	"path"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/manual_merge_test.go b/tests/integration/manual_merge_test.go
index 7f931b620b2..ae94101844a 100644
--- a/tests/integration/manual_merge_test.go
+++ b/tests/integration/manual_merge_test.go
@@ -10,14 +10,14 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/markup_external_test.go b/tests/integration/markup_external_test.go
index 97ef7e0b22a..9217fd7e5a7 100644
--- a/tests/integration/markup_external_test.go
+++ b/tests/integration/markup_external_test.go
@@ -9,16 +9,16 @@ import (
 	"strings"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/charset"
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/markup/external"
-	"code.gitea.io/gitea/modules/public"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/charset"
+	"gitea.dev/modules/markup"
+	"gitea.dev/modules/markup/external"
+	"gitea.dev/modules/public"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -109,8 +109,8 @@ func TestExternalMarkupRenderer(t *testing.T) {
 				assert.Equal(t, "frame-src 'self'; sandbox allow-scripts allow-popups", respSub.Header().Get("Content-Security-Policy"))
 				// FIXME: actually here is a bug (legacy design problem), the "PostProcess" will escape "<script>" tag, but it indeed is the sanitizer's job
 				assert.Equal(t,
-					`<script nonce crossorigin src="`+public.AssetURI("js/external-render-helper.js")+`" id="gitea-external-render-helper" data-render-query-string=""></script>`+
-						`<link rel="stylesheet" href="`+public.AssetURI("css/theme-gitea-auto.css")+`">`+
+					`<script nonce crossorigin src="`+public.AssetURI("web_src/js/external-render-helper.ts")+`" id="gitea-external-render-helper" data-render-query-string=""></script>`+
+						`<link rel="stylesheet" href="`+public.AssetURI("web_src/css/themes/theme-gitea-auto.css")+`">`+
 						`<div><any attr="val">&lt;script&gt;&lt;/script&gt;</any></div>`,
 					respSub.Body.String(),
 				)
@@ -137,8 +137,8 @@ func TestExternalMarkupRenderer(t *testing.T) {
 				req := NewRequest(t, "GET", "/user2/repo1/render/branch/master/html.no-sanitizer?a=1%2f2")
 				respSub := MakeRequest(t, req, http.StatusOK)
 				assert.Equal(t,
-					`<script nonce crossorigin src="`+public.AssetURI("js/external-render-helper.js")+`" id="gitea-external-render-helper" data-render-query-string="a=1%2f2"></script>`+
-						`<link rel="stylesheet" href="`+public.AssetURI("css/theme-gitea-auto.css")+`">`+
+					`<script nonce crossorigin src="`+public.AssetURI("web_src/js/external-render-helper.ts")+`" id="gitea-external-render-helper" data-render-query-string="a=1%2f2"></script>`+
+						`<link rel="stylesheet" href="`+public.AssetURI("web_src/css/themes/theme-gitea-auto.css")+`">`+
 						`<script>foo("raw")</script>`,
 					respSub.Body.String(),
 				)
diff --git a/tests/integration/migrate_test.go b/tests/integration/migrate_test.go
index 613c5b9acac..57e1e2b3417 100644
--- a/tests/integration/migrate_test.go
+++ b/tests/integration/migrate_test.go
@@ -17,18 +17,19 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/migrations"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/migrations"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -36,12 +37,10 @@ import (
 
 func TestMigrateLocalPath(t *testing.T) {
 	assert.NoError(t, unittest.PrepareTestDatabase())
+	defer test.MockVariableValue(&setting.ImportLocalPaths, true)()
 
 	adminUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user1"})
 
-	old := setting.ImportLocalPaths
-	setting.ImportLocalPaths = true
-
 	basePath := t.TempDir()
 
 	lowercasePath := filepath.Join(basePath, "lowercase")
@@ -57,22 +56,13 @@ func TestMigrateLocalPath(t *testing.T) {
 
 	err = migrations.IsMigrateURLAllowed(mixedcasePath, adminUser)
 	assert.NoError(t, err, "case mixedcase path")
-
-	setting.ImportLocalPaths = old
 }
 
 func TestMigrateGiteaForm(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
-		AllowLocalNetworks := setting.Migrations.AllowLocalNetworks
-		setting.Migrations.AllowLocalNetworks = true
-		AppVer := setting.AppVer
 		// Gitea SDK (go-sdk) need to parse the AppVer from server response, so we must set it to a valid version string.
-		setting.AppVer = "1.16.0"
-		defer func() {
-			setting.Migrations.AllowLocalNetworks = AllowLocalNetworks
-			setting.AppVer = AppVer
-			migrations.Init()
-		}()
+		defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
+		defer test.MockVariableValue(&setting.AppVer, "1.16.0")()
 		assert.NoError(t, migrations.Init())
 
 		ownerName := "user2"
@@ -232,14 +222,8 @@ done
 
 func Test_MigrateFromGiteaToGitea(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	AllowLocalNetworks := setting.Migrations.AllowLocalNetworks
-	setting.Migrations.AllowLocalNetworks = true
-	defer func() {
-		setting.Migrations.AllowLocalNetworks = AllowLocalNetworks
-		migrations.Init()
-	}()
-	require.NoError(t, migrations.Init())
+	defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
+	assert.NoError(t, migrations.Init())
 
 	mockServer := setupGiteaMockServer(t)
 
diff --git a/tests/integration/migration-test/migration_test.go b/tests/integration/migration-test/migration_test.go
index d28442b7140..23567ba3485 100644
--- a/tests/integration/migration-test/migration_test.go
+++ b/tests/integration/migration-test/migration_test.go
@@ -17,21 +17,20 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/migrations"
-	migrate_base "code.gitea.io/gitea/models/migrations/base"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/testlogger"
+	"gitea.dev/models/db"
+	"gitea.dev/models/migrations"
+	migrate_base "gitea.dev/models/migrations/base"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/testlogger"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"xorm.io/xorm"
 )
 
-var currentEngine *xorm.Engine
+var currentEngine db.EngineMigration
 
 func initMigrationTest(t *testing.T) func() {
 	testlogger.Init()
@@ -148,7 +147,7 @@ func restoreOldDB(t *testing.T, version string) {
 	_ = sqlDB.Close()
 }
 
-func wrappedMigrate(ctx context.Context, x *xorm.Engine) error {
+func wrappedMigrate(ctx context.Context, x db.EngineMigration) error {
 	currentEngine = x
 	return migrations.Migrate(ctx, x)
 }
@@ -165,7 +164,7 @@ func doMigrationTest(t *testing.T, version string) {
 
 	beans, _ := db.NamesToBean()
 
-	err = db.InitEngineWithMigration(t.Context(), func(ctx context.Context, x *xorm.Engine) error {
+	err = db.InitEngineWithMigration(t.Context(), func(ctx context.Context, x db.EngineMigration) error {
 		currentEngine = x
 		return migrate_base.RecreateTables(beans...)(x)
 	})
@@ -173,7 +172,7 @@ func doMigrationTest(t *testing.T, version string) {
 	currentEngine.Close()
 
 	// We do this a second time to ensure that there is not a problem with retained indices
-	err = db.InitEngineWithMigration(t.Context(), func(ctx context.Context, x *xorm.Engine) error {
+	err = db.InitEngineWithMigration(t.Context(), func(ctx context.Context, x db.EngineMigration) error {
 		currentEngine = x
 		return migrate_base.RecreateTables(beans...)(x)
 	})
diff --git a/tests/integration/mirror_pull_test.go b/tests/integration/mirror_pull_test.go
index 7902dc10cbf..0fd6647b957 100644
--- a/tests/integration/mirror_pull_test.go
+++ b/tests/integration/mirror_pull_test.go
@@ -7,17 +7,17 @@ import (
 	"slices"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/migration"
-	mirror_service "code.gitea.io/gitea/services/mirror"
-	release_service "code.gitea.io/gitea/services/release"
-	repo_service "code.gitea.io/gitea/services/repository"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/migration"
+	mirror_service "gitea.dev/services/mirror"
+	release_service "gitea.dev/services/release"
+	repo_service "gitea.dev/services/repository"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -93,6 +93,9 @@ func TestMirrorPull(t *testing.T) {
 	ok := mirror_service.SyncPullMirror(ctx, mirrorRepo.ID)
 	assert.True(t, ok)
 
+	mirror := unittest.AssertExistsAndLoadBean(t, &repo_model.Mirror{RepoID: mirrorRepo.ID})
+	assert.Equal(t, mirror.UpdatedUnix, mirror.LastSyncUnix)
+
 	// actually there is a tag in the source repo, so after "sync", that tag will also come into the mirror
 	initCount++
 
@@ -110,4 +113,14 @@ func TestMirrorPull(t *testing.T) {
 	count, err = db.Count[repo_model.Release](t.Context(), findOptions)
 	assert.NoError(t, err)
 	assert.Equal(t, initCount, count)
+
+	mirror = unittest.AssertExistsAndLoadBean(t, &repo_model.Mirror{RepoID: mirrorRepo.ID})
+	lastMirrorSync := mirror.LastSyncUnix
+	assert.NoError(t, mirror_service.UpdateAddress(ctx, mirror, repoPath+"-missing"))
+
+	ok = mirror_service.SyncPullMirror(ctx, mirrorRepo.ID)
+	assert.False(t, ok)
+
+	mirror = unittest.AssertExistsAndLoadBean(t, &repo_model.Mirror{RepoID: mirrorRepo.ID})
+	assert.Equal(t, lastMirrorSync, mirror.LastSyncUnix)
 }
diff --git a/tests/integration/mirror_push_test.go b/tests/integration/mirror_push_test.go
index ef38846d62a..f0a9228e03e 100644
--- a/tests/integration/mirror_push_test.go
+++ b/tests/integration/mirror_push_test.go
@@ -11,17 +11,18 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/services/migrations"
-	mirror_service "code.gitea.io/gitea/services/mirror"
-	repo_service "code.gitea.io/gitea/services/repository"
-	wiki_service "code.gitea.io/gitea/services/wiki"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/migrations"
+	mirror_service "gitea.dev/services/mirror"
+	repo_service "gitea.dev/services/repository"
+	wiki_service "gitea.dev/services/wiki"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -35,7 +36,7 @@ func TestMirrorPushWikiDefaultBranchMismatch(t *testing.T) {
 }
 
 func testMirrorPush(t *testing.T, u *url.URL) {
-	setting.Migrations.AllowLocalNetworks = true
+	defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
 	assert.NoError(t, migrations.Init())
 
 	_ = db.TruncateBeans(t.Context(), &repo_model.PushMirror{})
@@ -83,7 +84,7 @@ func testMirrorPush(t *testing.T, u *url.URL) {
 }
 
 func testMirrorPushWikiDefaultBranchMismatch(t *testing.T, u *url.URL) {
-	setting.Migrations.AllowLocalNetworks = true
+	defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
 	assert.NoError(t, migrations.Init())
 
 	_ = db.TruncateBeans(t.Context(), &repo_model.PushMirror{})
@@ -154,7 +155,7 @@ func doUpdatePushMirror(t *testing.T, session *TestSession, owner, repo string,
 
 func TestRepoSettingPushMirrorUpdate(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-	setting.Migrations.AllowLocalNetworks = true
+	defer test.MockVariableValue(&setting.Migrations.AllowLocalNetworks, true)()
 	assert.NoError(t, migrations.Init())
 
 	session := loginUser(t, "user2")
diff --git a/tests/integration/nonascii_branches_test.go b/tests/integration/nonascii_branches_test.go
index 89b03507797..bf5b34d0d75 100644
--- a/tests/integration/nonascii_branches_test.go
+++ b/tests/integration/nonascii_branches_test.go
@@ -10,7 +10,7 @@ import (
 	"path"
 	"testing"
 
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/require"
 )
diff --git a/tests/integration/oauth_avatar_test.go b/tests/integration/oauth_avatar_test.go
new file mode 100644
index 00000000000..4987fa70d27
--- /dev/null
+++ b/tests/integration/oauth_avatar_test.go
@@ -0,0 +1,92 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"net/http"
+	"testing"
+
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers/web/auth"
+	"gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/context"
+	"gitea.dev/tests"
+
+	"github.com/markbates/goth"
+	"github.com/markbates/goth/gothic"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOAuth2AvatarFromPicture(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+	defer test.MockVariableValue(&setting.OAuth2Client.UpdateAvatar, true)()
+
+	mockServer := createOAuth2MockProvider()
+	defer mockServer.Close()
+	addOAuth2Source(t, "test-oidc-avatar", oauth2.Source{
+		Provider:                      "openidConnect",
+		ClientID:                      "test-client-id",
+		OpenIDConnectAutoDiscoveryURL: mockServer.URL + "/.well-known/openid-configuration",
+	})
+	authSource, err := auth_model.GetActiveOAuth2SourceByAuthName(t.Context(), "test-oidc-avatar")
+	require.NoError(t, err)
+	providerName := authSource.Cfg.(*oauth2.Source).Provider
+
+	t.Run("AutoRegister", func(t *testing.T) {
+		defer test.MockVariableValue(&setting.OAuth2Client.Username, "")()
+		defer test.MockVariableValue(&setting.OAuth2Client.EnableAutoRegistration, true)()
+		defer test.MockVariableValue(&gothic.CompleteUserAuth, func(res http.ResponseWriter, req *http.Request) (goth.User, error) {
+			return goth.User{
+				Provider:  providerName,
+				UserID:    "oidc-user-ua-pic",
+				Email:     "oidc-user-ua-pic@example.com",
+				Name:      "OIDC UA Pic",
+				AvatarURL: mockServer.URL + "/avatar.png",
+			}, nil
+		})()
+
+		req := NewRequest(t, "GET", "/user/oauth2/test-oidc-avatar/callback?code=XYZ&state=XYZ")
+		emptyTestSession(t).MakeRequest(t, req, http.StatusSeeOther)
+
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LoginName: "oidc-user-ua-pic"})
+		assert.True(t, user.UseCustomAvatar, "avatar must sync (requires Gitea UA)")
+		assert.NotEmpty(t, user.Avatar)
+	})
+
+	t.Run("LinkAccountRegister", func(t *testing.T) {
+		const newUserName = "oidc-link-register"
+		defer web.RouteMockReset()
+		web.RouteMock(web.MockAfterMiddlewares, func(ctx *context.Context) {
+			require.NoError(t, auth.Oauth2SetLinkAccountData(ctx, auth.LinkAccountData{
+				AuthSourceID: authSource.ID,
+				GothUser: goth.User{
+					Provider:  providerName,
+					UserID:    "oidc-link-register-sub",
+					Email:     "oidc-link-register-a@example.com",
+					Name:      "OIDC Link Register",
+					AvatarURL: mockServer.URL + "/avatar.png",
+				},
+			}))
+		})
+
+		req := NewRequestWithValues(t, "POST", "/user/link_account_signup", map[string]string{
+			"user_name": newUserName,
+			"email":     "oidc-link-register-b@example.com",
+			"password":  "AVeryStrongPassword!1",
+			"retype":    "AVeryStrongPassword!1",
+		})
+		emptyTestSession(t).MakeRequest(t, req, http.StatusSeeOther)
+
+		user := unittest.AssertExistsAndLoadBean(t, &user_model.User{LowerName: newUserName})
+		require.Equal(t, auth_model.OAuth2, user.LoginType)
+		assert.True(t, user.UseCustomAvatar, "register-link flow must sync avatar from `picture` claim")
+		assert.NotEmpty(t, user.Avatar)
+	})
+}
diff --git a/tests/integration/oauth_test.go b/tests/integration/oauth_test.go
index 5ec5fa7dcd3..ee9eb838a35 100644
--- a/tests/integration/oauth_test.go
+++ b/tests/integration/oauth_test.go
@@ -5,8 +5,11 @@ package integration
 
 import (
 	"bytes"
+	"crypto/sha256"
 	"encoding/base64"
 	"fmt"
+	"image"
+	"image/png"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -14,20 +17,20 @@ import (
 	"strings"
 	"testing"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/timeutil"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/oauth2_provider"
-	"code.gitea.io/gitea/tests"
+	asymkey_model "gitea.dev/models/asymkey"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/timeutil"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/auth/source/oauth2"
+	"gitea.dev/services/oauth2_provider"
+	"gitea.dev/tests"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/markbates/goth"
@@ -56,6 +59,46 @@ func testOAuth2PrepareTestCode(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func createOAuthTestApplication(t *testing.T, userName, name string, redirectURIs []string) *api.OAuth2Application {
+	t.Helper()
+	req := NewRequestWithJSON(t, "POST", "/api/v1/user/applications/oauth2", &api.CreateOAuth2ApplicationOptions{
+		Name:               name,
+		RedirectURIs:       redirectURIs,
+		ConfidentialClient: true,
+	}).AddBasicAuth(userName)
+	resp := MakeRequest(t, req, http.StatusCreated)
+	created := DecodeJSON(t, resp, &api.OAuth2Application{})
+	require.NotEmpty(t, created.ClientID)
+	require.NotEmpty(t, created.ClientSecret)
+	return created
+}
+
+func issueOAuthAuthorizationCode(t *testing.T, user *user_model.User, app *api.OAuth2Application, redirectURI, scope string) (string, string) {
+	t.Helper()
+
+	grant := &auth_model.OAuth2Grant{
+		ApplicationID: app.ID,
+		UserID:        user.ID,
+		Scope:         scope,
+	}
+	require.NoError(t, db.Insert(t.Context(), grant))
+
+	verifier := "phase3-verifier-" + util.FastCryptoRandomHex(12)
+	challengeBytes := sha256.Sum256([]byte(verifier))
+	code := "phase3-code-" + util.FastCryptoRandomHex(10)
+
+	require.NoError(t, db.Insert(t.Context(), &auth_model.OAuth2AuthorizationCode{
+		GrantID:             grant.ID,
+		Code:                code,
+		CodeChallenge:       base64.RawURLEncoding.EncodeToString(challengeBytes[:]),
+		CodeChallengeMethod: "S256",
+		RedirectURI:         redirectURI,
+		ValidUntil:          timeutil.TimeStampNow() + 86400,
+	}))
+
+	return code, verifier
+}
+
 func TestOAuth2(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
 
@@ -70,12 +113,14 @@ func TestOAuth2(t *testing.T) {
 		t.Run("AuthorizeRedirectWithExistingGrant", testAuthorizeRedirectWithExistingGrant)
 		t.Run("AuthorizePKCERequiredForPublicClient", testAuthorizePKCERequiredForPublicClient)
 		t.Run("AccessTokenExchange", testAccessTokenExchange)
+		t.Run("AccessTokenExchangeRedirectURIMismatch", testAccessTokenExchangeRedirectURIMismatch)
 		t.Run("AccessTokenExchangeWithPublicClient", testAccessTokenExchangeWithPublicClient)
 		t.Run("AccessTokenExchangeJSON", testAccessTokenExchangeJSON)
 		t.Run("AccessTokenExchangeWithoutPKCE", testAccessTokenExchangeWithoutPKCE)
 		t.Run("AccessTokenExchangeWithInvalidCredentials", testAccessTokenExchangeWithInvalidCredentials)
 		t.Run("AccessTokenExchangeWithBasicAuth", testAccessTokenExchangeWithBasicAuth)
 		t.Run("RefreshTokenInvalidation", testRefreshTokenInvalidation)
+		t.Run("RefreshTokenCrossClientUsage", testRefreshTokenCrossClientUsage)
 		t.Run("OAuthIntrospection", testOAuthIntrospection)
 		t.Run("OAuthGrantScopesReadUserFailRepos", testOAuthGrantScopesReadUserFailRepos)
 		t.Run("OAuthGrantScopesBasicRespectsWriteUser", testOAuthGrantScopesBasicRespectsWriteUser)
@@ -223,12 +268,43 @@ func testAccessTokenExchange(t *testing.T) {
 	assert.Greater(t, len(parsed.RefreshToken), 10)
 }
 
+func testAccessTokenExchangeRedirectURIMismatch(t *testing.T) {
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	redirectURIs := []string{"https://phase3.example/callback", "https://phase3.example/callback-alt"}
+	app := createOAuthTestApplication(t, user.Name, "phase3-redirect-uri-guard", redirectURIs)
+	code, verifier := issueOAuthAuthorizationCode(t, user, app, redirectURIs[0], "openid profile")
+
+	req := NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
+		"grant_type":    "authorization_code",
+		"client_id":     app.ClientID,
+		"client_secret": app.ClientSecret,
+		"redirect_uri":  redirectURIs[1],
+		"code":          code,
+		"code_verifier": verifier,
+	})
+	resp := MakeRequest(t, req, http.StatusBadRequest)
+	parsedError := new(oauth2_provider.AccessTokenError)
+	assert.NoError(t, json.Unmarshal(resp.Body.Bytes(), parsedError))
+	assert.Equal(t, "invalid_grant", string(parsedError.ErrorCode))
+	assert.Equal(t, "redirect_uri differs from the original authorization request", parsedError.ErrorDescription)
+
+	req = NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
+		"grant_type":    "authorization_code",
+		"client_id":     app.ClientID,
+		"client_secret": app.ClientSecret,
+		"redirect_uri":  redirectURIs[0],
+		"code":          code,
+		"code_verifier": verifier,
+	})
+	MakeRequest(t, req, http.StatusOK)
+}
+
 func testAccessTokenExchangeWithPublicClient(t *testing.T) {
 	testOAuth2PrepareTestCode(t)
 	req := NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
 		"grant_type":    "authorization_code",
 		"client_id":     "ce5a1322-42a7-11ed-b878-0242ac120002",
-		"redirect_uri":  "http://127.0.0.1",
+		"redirect_uri":  "http://127.0.0.1/",
 		"code":          "authcodepublic",
 		"code_verifier": "N1Zo9-8Rfwhkt68r1r29ty8YwIraXR8eh_1Qwxg7yQXsonBt",
 	})
@@ -523,6 +599,54 @@ func testRefreshTokenInvalidation(t *testing.T) {
 	assert.Equal(t, "token was already used", parsedError.ErrorDescription)
 }
 
+func testRefreshTokenCrossClientUsage(t *testing.T) {
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	primaryApp := createOAuthTestApplication(t, user.Name, "phase3-refresh-token-primary", []string{"https://phase3.example/refresh-primary"})
+	secondaryApp := createOAuthTestApplication(t, user.Name, "refresh-token-client-guard", []string{"https://alt-client.example/oauth/callback"})
+	code, verifier := issueOAuthAuthorizationCode(t, user, primaryApp, primaryApp.RedirectURIs[0], "openid profile")
+
+	req := NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
+		"grant_type":    "authorization_code",
+		"client_id":     primaryApp.ClientID,
+		"client_secret": primaryApp.ClientSecret,
+		"redirect_uri":  primaryApp.RedirectURIs[0],
+		"code":          code,
+		"code_verifier": verifier,
+	})
+	resp := MakeRequest(t, req, http.StatusOK)
+	type response struct {
+		AccessToken  string `json:"access_token"`
+		TokenType    string `json:"token_type"`
+		ExpiresIn    int64  `json:"expires_in"`
+		RefreshToken string `json:"refresh_token"`
+	}
+	parsed := new(response)
+	assert.NoError(t, json.Unmarshal(resp.Body.Bytes(), parsed))
+	assert.NotEmpty(t, parsed.RefreshToken)
+
+	req = NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
+		"grant_type":    "refresh_token",
+		"client_id":     secondaryApp.ClientID,
+		"client_secret": secondaryApp.ClientSecret,
+		"redirect_uri":  secondaryApp.RedirectURIs[0],
+		"refresh_token": parsed.RefreshToken,
+	})
+	resp = MakeRequest(t, req, http.StatusBadRequest)
+	parsedError := new(oauth2_provider.AccessTokenError)
+	assert.NoError(t, json.Unmarshal(resp.Body.Bytes(), parsedError))
+	assert.Equal(t, "invalid_grant", string(parsedError.ErrorCode))
+	assert.Equal(t, "refresh token belongs to a different client", parsedError.ErrorDescription)
+
+	req = NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
+		"grant_type":    "refresh_token",
+		"client_id":     primaryApp.ClientID,
+		"client_secret": primaryApp.ClientSecret,
+		"redirect_uri":  primaryApp.RedirectURIs[0],
+		"refresh_token": parsed.RefreshToken,
+	})
+	MakeRequest(t, req, http.StatusOK)
+}
+
 func testOAuthIntrospection(t *testing.T) {
 	testOAuth2PrepareTestCode(t)
 	req := NewRequestWithValues(t, "POST", "/login/oauth/access_token", map[string]string{
@@ -1062,6 +1186,13 @@ func createOAuth2MockProvider() *httptest.Server {
 	var mockServer *httptest.Server
 	mockServer = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
+		case "/avatar.png":
+			if !strings.HasPrefix(r.Header.Get("User-Agent"), "Gitea ") {
+				http.Error(w, "user agent doesn't match", http.StatusForbidden)
+				return
+			}
+			w.Header().Set("Content-Type", "image/png")
+			_ = png.Encode(w, image.NewRGBA(image.Rect(0, 0, 8, 8)))
 		case "/.well-known/openid-configuration":
 			_, _ = w.Write([]byte(`{
 				"issuer": "` + mockServer.URL + `",
diff --git a/tests/integration/org_count_test.go b/tests/integration/org_count_test.go
index 6a2cf53ed48..687ec65463e 100644
--- a/tests/integration/org_count_test.go
+++ b/tests/integration/org_count_test.go
@@ -7,13 +7,13 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/org_profile_test.go b/tests/integration/org_profile_test.go
index 73cafd85c2b..60d80f07637 100644
--- a/tests/integration/org_profile_test.go
+++ b/tests/integration/org_profile_test.go
@@ -11,10 +11,10 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers/web/shared/user"
+	auth_model "gitea.dev/models/auth"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers/web/shared/user"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -66,7 +66,7 @@ func testOrgProfile(t *testing.T, u *url.URL) {
 	createTestProfile(t, "org3", user.RepoNameProfilePrivate, contentPrivateReadme)
 
 	// Anonymous User
-	req := NewRequest(t, "GET", "org3")
+	req := NewRequest(t, "GET", "/org3")
 	resp := MakeRequest(t, req, http.StatusOK)
 	bodyString := util.UnsafeBytesToString(resp.Body.Bytes())
 	assert.Contains(t, bodyString, contentPublicReadme)
@@ -74,7 +74,7 @@ func testOrgProfile(t *testing.T, u *url.URL) {
 
 	// Logged in but not member
 	session := loginUser(t, "user24")
-	req = NewRequest(t, "GET", "org3")
+	req = NewRequest(t, "GET", "/org3")
 	resp = session.MakeRequest(t, req, http.StatusOK)
 	bodyString = util.UnsafeBytesToString(resp.Body.Bytes())
 	assert.Contains(t, bodyString, contentPublicReadme)
diff --git a/tests/integration/org_project_test.go b/tests/integration/org_project_test.go
index 8c55a437578..c4ec402a3f1 100644
--- a/tests/integration/org_project_test.go
+++ b/tests/integration/org_project_test.go
@@ -8,8 +8,8 @@ import (
 	"slices"
 	"testing"
 
-	unit_model "code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/tests"
+	unit_model "gitea.dev/models/unit"
+	"gitea.dev/tests"
 )
 
 func TestOrgProjectAccess(t *testing.T) {
diff --git a/tests/integration/org_team_invite_test.go b/tests/integration/org_team_invite_test.go
index 9dafbce2aad..42780a844c9 100644
--- a/tests/integration/org_team_invite_test.go
+++ b/tests/integration/org_team_invite_test.go
@@ -10,22 +10,17 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
 
 func TestOrgTeamEmailInvite(t *testing.T) {
-	if setting.MailService == nil {
-		t.Skip()
-		return
-	}
-
 	defer tests.PrepareTestEnv(t)()
 
 	org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
@@ -68,11 +63,6 @@ func TestOrgTeamEmailInvite(t *testing.T) {
 
 // Check that users are redirected to accept the invitation correctly after login
 func TestOrgTeamEmailInviteRedirectsExistingUser(t *testing.T) {
-	if setting.MailService == nil {
-		t.Skip()
-		return
-	}
-
 	defer tests.PrepareTestEnv(t)()
 
 	org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
@@ -139,11 +129,6 @@ func TestOrgTeamEmailInviteRedirectsExistingUser(t *testing.T) {
 
 // Check that newly signed up users are redirected to accept the invitation correctly
 func TestOrgTeamEmailInviteRedirectsNewUser(t *testing.T) {
-	if setting.MailService == nil {
-		t.Skip()
-		return
-	}
-
 	defer tests.PrepareTestEnv(t)()
 
 	org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
@@ -211,11 +196,6 @@ func TestOrgTeamEmailInviteRedirectsNewUser(t *testing.T) {
 
 // Check that users are redirected correctly after confirming their email
 func TestOrgTeamEmailInviteRedirectsNewUserWithActivation(t *testing.T) {
-	if setting.MailService == nil {
-		t.Skip()
-		return
-	}
-
 	// enable email confirmation temporarily
 	defer test.MockVariableValue(&setting.Service.RegisterEmailConfirm, true)()
 	defer tests.PrepareTestEnv(t)()
@@ -281,11 +261,6 @@ func TestOrgTeamEmailInviteRedirectsNewUserWithActivation(t *testing.T) {
 // For example: an invite may have been created before the user account was created, but they may be
 // accepting the invite after having created an account separately
 func TestOrgTeamEmailInviteRedirectsExistingUserWithLogin(t *testing.T) {
-	if setting.MailService == nil {
-		t.Skip()
-		return
-	}
-
 	defer tests.PrepareTestEnv(t)()
 
 	org := unittest.AssertExistsAndLoadBean(t, &organization.Organization{ID: 3})
diff --git a/tests/integration/org_test.go b/tests/integration/org_test.go
index e34bc60635c..27629d0fa0e 100644
--- a/tests/integration/org_test.go
+++ b/tests/integration/org_test.go
@@ -9,17 +9,17 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
diff --git a/tests/integration/org_worktime_test.go b/tests/integration/org_worktime_test.go
index 9d2280ac7ef..91bdb45f473 100644
--- a/tests/integration/org_worktime_test.go
+++ b/tests/integration/org_worktime_test.go
@@ -6,8 +6,8 @@ package integration_test
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/unittest"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/unittest"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/packages_service_test.go b/tests/integration/packages_service_test.go
index 361950cb107..172b5ab5e18 100644
--- a/tests/integration/packages_service_test.go
+++ b/tests/integration/packages_service_test.go
@@ -7,12 +7,12 @@ import (
 	"bytes"
 	"testing"
 
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	packages_module "code.gitea.io/gitea/modules/packages"
-	packages_service "code.gitea.io/gitea/services/packages"
-	"code.gitea.io/gitea/tests"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	packages_module "gitea.dev/modules/packages"
+	packages_service "gitea.dev/services/packages"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/privateactivity_test.go b/tests/integration/privateactivity_test.go
index 4db483a0748..0ce590e276c 100644
--- a/tests/integration/privateactivity_test.go
+++ b/tests/integration/privateactivity_test.go
@@ -8,13 +8,13 @@ import (
 	"net/http"
 	"testing"
 
-	activities_model "code.gitea.io/gitea/models/activities"
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	activities_model "gitea.dev/models/activities"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/project_test.go b/tests/integration/project_test.go
index 516f2acec70..5a0c1ef5455 100644
--- a/tests/integration/project_test.go
+++ b/tests/integration/project_test.go
@@ -10,13 +10,13 @@ import (
 	"strings"
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	project_model "code.gitea.io/gitea/models/project"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/tests"
+	issues_model "gitea.dev/models/issues"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/tests"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
diff --git a/tests/integration/pull_comment_test.go b/tests/integration/pull_comment_test.go
index 56ef9972adc..c550bd582d8 100644
--- a/tests/integration/pull_comment_test.go
+++ b/tests/integration/pull_comment_test.go
@@ -11,9 +11,9 @@ import (
 	"testing"
 	"time"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/unittest"
-	issues_service "code.gitea.io/gitea/services/issue"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/unittest"
+	issues_service "gitea.dev/services/issue"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/pull_commit_test.go b/tests/integration/pull_commit_test.go
index 702bddfcef5..938be5f0442 100644
--- a/tests/integration/pull_commit_test.go
+++ b/tests/integration/pull_commit_test.go
@@ -7,8 +7,8 @@ import (
 	"net/http"
 	"testing"
 
-	pull_service "code.gitea.io/gitea/services/pull"
-	"code.gitea.io/gitea/tests"
+	pull_service "gitea.dev/services/pull"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/pull_compare_test.go b/tests/integration/pull_compare_test.go
index da00b3fd566..69bb22d2a97 100644
--- a/tests/integration/pull_compare_test.go
+++ b/tests/integration/pull_compare_test.go
@@ -9,12 +9,12 @@ import (
 	"net/url"
 	"testing"
 
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/test"
-	repo_service "code.gitea.io/gitea/services/repository"
-	"code.gitea.io/gitea/tests"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/test"
+	repo_service "gitea.dev/services/repository"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/pull_create_test.go b/tests/integration/pull_create_test.go
index fa10158a57c..eaee27652a8 100644
--- a/tests/integration/pull_create_test.go
+++ b/tests/integration/pull_create_test.go
@@ -14,19 +14,19 @@ import (
 	"sync"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git/gitcmd"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
 
 func testPullCreate(t *testing.T, session *TestSession, user, repo string, toSelf bool, targetBranch, sourceBranch, title string) *httptest.ResponseRecorder {
-	req := NewRequest(t, "GET", path.Join(user, repo))
+	req := NewRequest(t, "GET", "/"+path.Join(user, repo))
 	resp := session.MakeRequest(t, req, http.StatusOK)
 
 	// Click the PR button to create a pull
diff --git a/tests/integration/pull_diff_test.go b/tests/integration/pull_diff_test.go
index 134ae2c0edb..ea97a134b24 100644
--- a/tests/integration/pull_diff_test.go
+++ b/tests/integration/pull_diff_test.go
@@ -7,7 +7,7 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/tests"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
diff --git a/tests/integration/pull_merge_test.go b/tests/integration/pull_merge_test.go
index 3d24c4c3264..8469057620e 100644
--- a/tests/integration/pull_merge_test.go
+++ b/tests/integration/pull_merge_test.go
@@ -16,31 +16,33 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	issues_model "code.gitea.io/gitea/models/issues"
-	pull_model "code.gitea.io/gitea/models/pull"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/queue"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/automerge"
-	"code.gitea.io/gitea/services/automergequeue"
-	"code.gitea.io/gitea/services/forms"
-	pull_service "code.gitea.io/gitea/services/pull"
-	repo_service "code.gitea.io/gitea/services/repository"
-	commitstatus_service "code.gitea.io/gitea/services/repository/commitstatus"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	pull_model "gitea.dev/models/pull"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/queue"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/automerge"
+	"gitea.dev/services/automergequeue"
+	"gitea.dev/services/forms"
+	pull_service "gitea.dev/services/pull"
+	repo_service "gitea.dev/services/repository"
+	commitstatus_service "gitea.dev/services/repository/commitstatus"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -80,7 +82,7 @@ func testPullMerge(t *testing.T, session *TestSession, user, repo, pullNum strin
 }
 
 func testPullCleanUp(t *testing.T, session *TestSession, user, repo, pullnum string) *httptest.ResponseRecorder {
-	req := NewRequest(t, "GET", path.Join(user, repo, "pulls", pullnum))
+	req := NewRequest(t, "GET", "/"+path.Join(user, repo, "pulls", pullnum))
 	resp := session.MakeRequest(t, req, http.StatusOK)
 
 	// Click the little button to create a pull
@@ -322,11 +324,8 @@ func TestCantMergeWorkInProgress(t *testing.T) {
 		req := NewRequest(t, "GET", test.RedirectURL(resp))
 		resp = session.MakeRequest(t, req, http.StatusOK)
 		htmlDoc := NewHTMLParser(t, resp.Body)
-		text := strings.TrimSpace(htmlDoc.doc.Find(".merge-section > .item").Last().Text())
-		assert.NotEmpty(t, text, "Can't find WIP text")
-
-		assert.Contains(t, text, translation.NewLocale("en-US").TrString("repo.pulls.cannot_merge_work_in_progress"), "Unable to find WIP text")
-		assert.Contains(t, text, "[wip]", "Unable to find WIP text")
+		wipToggleButtonCount := htmlDoc.Find(`.merge-section > .item button[data-global-init="initPullRequestWipToggle"]`).Length()
+		assert.Equal(t, 1, wipToggleButtonCount)
 	})
 }
 
@@ -1095,6 +1094,71 @@ func TestPullNonMergeForAdminWithBranchProtection(t *testing.T) {
 	})
 }
 
+func TestPullForceMergeForBypassAllowlistUser(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		ownerSession := loginUser(t, "user2")
+		ownerCtx := NewAPITestContext(t, "user2", "repo1", auth_model.AccessTokenScopeWriteRepository)
+
+		bypassUser := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user4"})
+		doAPIAddCollaborator(ownerCtx, bypassUser.Name, perm.AccessModeWrite)(t)
+
+		bypassSession := loginUser(t, bypassUser.Name)
+		forkedName := "repo1-bypass-allowlist"
+		testRepoFork(t, bypassSession, "user2", "repo1", bypassUser.Name, forkedName, "")
+		defer testDeleteRepository(t, bypassSession, bypassUser.Name, forkedName)
+
+		testEditFile(t, bypassSession, bypassUser.Name, forkedName, "master", "README.md", "Hello, World (Bypass Allowlist)\n")
+		resp := testPullCreate(t, bypassSession, bypassUser.Name, forkedName, false, "master", "master", "Bypass allowlist merge test pull")
+		pullURL := test.RedirectURL(resp)
+		elem := strings.Split(pullURL, "/")
+		assert.Equal(t, "pulls", elem[3])
+
+		prIndex, err := strconv.ParseInt(elem[4], 10, 64)
+		assert.NoError(t, err)
+
+		pbCreateReq := NewRequestWithValues(t, "POST", "/user2/repo1/settings/branches/edit", map[string]string{
+			"rule_name":                  "master",
+			"enable_push":                "all",
+			"enable_status_check":        "true",
+			"status_check_contexts":      "gitea/actions",
+			"block_admin_merge_override": "true",
+			"enable_bypass_allowlist":    "on",
+			"bypass_allowlist_users":     strconv.FormatInt(bypassUser.ID, 10),
+		})
+		ownerSession.MakeRequest(t, pbCreateReq, http.StatusSeeOther)
+		defer testAPIDeleteBranchProtection(t, "master", http.StatusNoContent)
+
+		token := getTokenForLoggedInUser(t, bypassSession, auth_model.AccessTokenScopeWriteRepository)
+
+		resp = bypassSession.MakeRequest(t, NewRequest(t, "GET", pullURL), http.StatusOK)
+		htmlDoc := NewHTMLParser(t, resp.Body)
+		assert.Contains(t, htmlDoc.doc.Find(".merge-section").Text(), "You are allowed to bypass branch protection rules for this merge.")
+		mergeFormProps, exists := htmlDoc.doc.Find("#pull-request-merge-form").Attr("data-merge-form-props")
+		require.True(t, exists)
+		var mergeForm map[string]any
+		require.NoError(t, json.Unmarshal([]byte(mergeFormProps), &mergeForm))
+		assert.Equal(t, true, mergeForm["canMergeNow"])
+		assert.Equal(t, false, mergeForm["allOverridableChecksOk"])
+
+		mergeReq := func(forceMerge bool) *RequestWrapper {
+			return NewRequestWithValues(t, "POST", fmt.Sprintf("/api/v1/repos/user2/repo1/pulls/%d/merge", prIndex), map[string]string{
+				"head_commit_id":            "",
+				"merge_when_checks_succeed": "false",
+				"force_merge":               strconv.FormatBool(forceMerge),
+				"do":                        "rebase",
+			}).AddTokenAuth(token)
+		}
+
+		bypassSession.MakeRequest(t, mergeReq(false), http.StatusMethodNotAllowed)
+		bypassSession.MakeRequest(t, mergeReq(true), http.StatusOK)
+
+		baseRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{OwnerName: "user2", Name: "repo1"})
+		pr, err := issues_model.GetPullRequestByIndex(t.Context(), baseRepo.ID, prIndex)
+		assert.NoError(t, err)
+		assert.True(t, pr.HasMerged)
+	})
+}
+
 func TestPullSquashMergeEmpty(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		session := loginUser(t, "user1") // FIXME: don't use admin user for testing
diff --git a/tests/integration/pull_review_test.go b/tests/integration/pull_review_test.go
index 7edbd0b9ce7..2ab2787e921 100644
--- a/tests/integration/pull_review_test.go
+++ b/tests/integration/pull_review_test.go
@@ -11,17 +11,17 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/test"
-	issue_service "code.gitea.io/gitea/services/issue"
-	repo_service "code.gitea.io/gitea/services/repository"
-	files_service "code.gitea.io/gitea/services/repository/files"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/test"
+	issue_service "gitea.dev/services/issue"
+	repo_service "gitea.dev/services/repository"
+	files_service "gitea.dev/services/repository/files"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -264,13 +264,13 @@ func testSubmitReview(t *testing.T, session *TestSession, owner, repo, pullNumbe
 		"type":      reviewType,
 	}
 
-	submitURL := path.Join(owner, repo, "pulls", pullNumber, "files", "reviews", "submit")
+	submitURL := "/" + path.Join(owner, repo, "pulls", pullNumber, "files", "reviews", "submit")
 	req := NewRequestWithValues(t, "POST", submitURL, options)
 	return session.MakeRequest(t, req, expectedSubmitStatus)
 }
 
 func testIssueClose(t *testing.T, session *TestSession, owner, repo, issueNumber string) *httptest.ResponseRecorder {
-	closeURL := path.Join(owner, repo, "issues", issueNumber, "comments")
+	closeURL := "/" + path.Join(owner, repo, "issues", issueNumber, "comments")
 
 	options := map[string]string{
 		"status": "close",
diff --git a/tests/integration/pull_status_test.go b/tests/integration/pull_status_test.go
index 3b8924b6e6d..a6305299699 100644
--- a/tests/integration/pull_status_test.go
+++ b/tests/integration/pull_status_test.go
@@ -11,16 +11,16 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/services/pull"
+	auth_model "gitea.dev/models/auth"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/services/pull"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -31,8 +31,7 @@ func TestPullCreate_CommitStatus(t *testing.T) {
 		testRepoFork(t, session, "user2", "repo1", "user1", "repo1", "")
 		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "status1", "README.md", "status1")
 
-		url := path.Join("user1", "repo1", "compare", "master...status1")
-		req := NewRequestWithValues(t, "POST", url,
+		req := NewRequestWithValues(t, "POST", "/user1/repo1/compare/master...status1",
 			map[string]string{
 				"title": "pull request from status1",
 			},
@@ -121,8 +120,7 @@ func TestPullCreate_EmptyChangesWithDifferentCommits(t *testing.T) {
 		testEditFileToNewBranch(t, session, "user1", "repo1", "master", "status1", "README.md", "status1")
 		testEditFile(t, session, "user1", "repo1", "status1", "README.md", "# repo1\n\nDescription for repo1")
 
-		url := path.Join("user1", "repo1", "compare", "master...status1")
-		req := NewRequestWithValues(t, "POST", url,
+		req := NewRequestWithValues(t, "POST", "/user1/repo1/compare/master...status1",
 			map[string]string{
 				"title": "pull request from status1",
 			},
@@ -134,6 +132,7 @@ func TestPullCreate_EmptyChangesWithDifferentCommits(t *testing.T) {
 		doc := NewHTMLParser(t, resp.Body)
 
 		text := strings.TrimSpace(doc.doc.Find(".merge-section").Text())
+		assert.Contains(t, text, "The changes on this branch are already on the target branch. This will be an empty commit.")
 		assert.Contains(t, text, "This pull request can be merged automatically.")
 	})
 }
@@ -141,21 +140,29 @@ func TestPullCreate_EmptyChangesWithDifferentCommits(t *testing.T) {
 func TestPullCreate_EmptyChangesWithSameCommits(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, u *url.URL) {
 		session := loginUser(t, "user1")
-		testRepoFork(t, session, "user2", "repo1", "user1", "repo1", "")
-		testCreateBranch(t, session, "user1", "repo1", "branch/master", "status1", http.StatusSeeOther)
-		url := path.Join("user1", "repo1", "compare", "master...status1")
-		req := NewRequestWithValues(t, "POST", url,
-			map[string]string{
-				"title": "pull request from status1",
-			},
-		)
-		session.MakeRequest(t, req, http.StatusOK)
-		req = NewRequest(t, "GET", "/user1/repo1/pulls/1")
-		resp := session.MakeRequest(t, req, http.StatusOK)
-		doc := NewHTMLParser(t, resp.Body)
 
+		testCreateBranch(t, session, "user2", "repo1", "branch/master", "empty-pr-branch", http.StatusSeeOther)
+		resp := testPullCreateDirectly(t, session, createPullRequestOptions{
+			BaseRepoOwner: "user2",
+			BaseRepoName:  "repo1",
+			BaseBranch:    "master",
+			HeadBranch:    "empty-pr-branch",
+			Title:         "empty pr test",
+		})
+		prURL := test.RedirectURL(resp)
+
+		// check the "merge box" text
+		req := NewRequest(t, "GET", prURL)
+		resp = session.MakeRequest(t, req, http.StatusOK)
+		doc := NewHTMLParser(t, resp.Body)
 		text := strings.TrimSpace(doc.doc.Find(".merge-section").Text())
 		assert.Contains(t, text, "This branch is already included in the target branch. There is nothing to merge.")
+
+		// check the "files" tab content
+		req = NewRequest(t, "GET", prURL+"/files")
+		resp = session.MakeRequest(t, req, http.StatusOK)
+		doc = NewHTMLParser(t, resp.Body)
+		assert.Equal(t, "Diff Content Not Available", strings.TrimSpace(doc.Find("#diff-container").Text()))
 	})
 }
 
diff --git a/tests/integration/pull_update_test.go b/tests/integration/pull_update_test.go
index 73262af9689..db3c61cfa89 100644
--- a/tests/integration/pull_update_test.go
+++ b/tests/integration/pull_update_test.go
@@ -10,17 +10,17 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	issues_model "code.gitea.io/gitea/models/issues"
-	"code.gitea.io/gitea/models/perm"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/gitrepo"
-	pull_service "code.gitea.io/gitea/services/pull"
-	repo_service "code.gitea.io/gitea/services/repository"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/perm"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/gitrepo"
+	pull_service "gitea.dev/services/pull"
+	repo_service "gitea.dev/services/repository"
+	files_service "gitea.dev/services/repository/files"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -61,14 +61,34 @@ func TestAPIPullUpdate(t *testing.T) {
 	})
 }
 
-func enableRepoAllowUpdateWithRebase(t *testing.T, repoID int64, allow bool) {
+func updateRepoPullRequestConfig(t *testing.T, repoID int64, update func(*repo_model.PullRequestsConfig)) {
 	t.Helper()
 
 	repoUnit := unittest.AssertExistsAndLoadBean(t, &repo_model.RepoUnit{RepoID: repoID, Type: unit.TypePullRequests})
-	repoUnit.PullRequestsConfig().AllowRebaseUpdate = allow
+	update(repoUnit.PullRequestsConfig())
 	assert.NoError(t, repo_model.UpdateRepoUnitConfig(t.Context(), repoUnit))
 }
 
+func enableRepoAllowUpdateWithRebase(t *testing.T, repoID int64, allow bool) {
+	updateRepoPullRequestConfig(t, repoID, func(c *repo_model.PullRequestsConfig) { c.AllowRebaseUpdate = allow })
+}
+
+// setupOutdatedPRWithConfig creates an outdated PR (user2 base, org26 fork), loads its
+// base repo, head repo, and issue, then applies the supplied PullRequestsConfig mutation.
+func setupOutdatedPRWithConfig(t *testing.T, mutate func(*repo_model.PullRequestsConfig)) *issues_model.PullRequest {
+	t.Helper()
+	user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	org26 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 26})
+	pr := createOutdatedPR(t, user, org26)
+	require.NoError(t, pr.LoadBaseRepo(t.Context()))
+	require.NoError(t, pr.LoadHeadRepo(t.Context()))
+	require.NoError(t, pr.LoadIssue(t.Context()))
+	if mutate != nil {
+		updateRepoPullRequestConfig(t, pr.BaseRepo.ID, mutate)
+	}
+	return pr
+}
+
 func TestAPIPullUpdateByRebase(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, giteaURL *url.URL) {
 		// Create PR to test
@@ -120,6 +140,46 @@ func TestAPIPullUpdateByRebase(t *testing.T) {
 	})
 }
 
+// TestAPIPullUpdateStyleSettings first checks that a disabled explicit style is
+// forbidden, then guards back-compat: even when the repo's DefaultUpdateStyle is
+// rebase, an API call with no `style` parameter must still perform a merge
+// update so existing API clients don't silently flip behavior.
+func TestAPIPullUpdateStyleSettings(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, giteaURL *url.URL) {
+		pr := setupOutdatedPRWithConfig(t, func(c *repo_model.PullRequestsConfig) {
+			c.AllowMergeUpdate = false
+			c.AllowRebaseUpdate = true
+			c.DefaultUpdateStyle = repo_model.UpdateStyleRebase
+		})
+
+		user40 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 40})
+		require.NoError(t, repo_service.AddOrUpdateCollaborator(t.Context(), pr.BaseRepo, user40, perm.AccessModeWrite))
+		require.NoError(t, repo_service.AddOrUpdateCollaborator(t.Context(), pr.HeadRepo, user40, perm.AccessModeWrite))
+
+		session := loginUser(t, "user40")
+		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
+
+		req := NewRequestf(t, "POST", "/api/v1/repos/%s/%s/pulls/%d/update?style=merge", pr.BaseRepo.OwnerName, pr.BaseRepo.Name, pr.Issue.Index).
+			AddTokenAuth(token)
+		session.MakeRequest(t, req, http.StatusForbidden)
+
+		updateRepoPullRequestConfig(t, pr.BaseRepo.ID, func(c *repo_model.PullRequestsConfig) {
+			c.AllowMergeUpdate = true
+		})
+
+		req = NewRequestf(t, "POST", "/api/v1/repos/%s/%s/pulls/%d/update", pr.BaseRepo.OwnerName, pr.BaseRepo.Name, pr.Issue.Index).
+			AddTokenAuth(token)
+		session.MakeRequest(t, req, http.StatusOK)
+
+		// merge update produces a merge commit on top of the head commit (Ahead=2),
+		// rebase update would replay the head commit alone (Ahead=1).
+		diffCount, err := gitrepo.GetDivergingCommits(t.Context(), pr.BaseRepo, pr.BaseBranch, pr.GetGitHeadRefName())
+		require.NoError(t, err)
+		assert.Equal(t, 0, diffCount.Behind)
+		assert.Equal(t, 2, diffCount.Ahead)
+	})
+}
+
 func createOutdatedPR(t *testing.T, actor, forkOrg *user_model.User) *issues_model.PullRequest {
 	baseRepo, err := repo_service.CreateRepository(t.Context(), actor, actor, repo_service.CreateRepoOptions{
 		Name:        "repo-pr-update",
diff --git a/tests/integration/release_test.go b/tests/integration/release_test.go
index de86a3f3480..320661420ed 100644
--- a/tests/integration/release_test.go
+++ b/tests/integration/release_test.go
@@ -8,12 +8,12 @@ import (
 	"net/http"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/tests"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/translation"
+	"gitea.dev/tests"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
@@ -104,13 +104,7 @@ func TestCreateReleaseDraft(t *testing.T) {
 
 func TestCreateReleasePaging(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	oldAPIDefaultNum := setting.API.DefaultPagingNum
-	defer func() {
-		setting.API.DefaultPagingNum = oldAPIDefaultNum
-	}()
-	setting.API.DefaultPagingNum = 10
-
+	defer test.MockVariableValue(&setting.API.DefaultPagingNum, 10)()
 	session := loginUser(t, "user2")
 	// Create enough releases to have paging
 	for i := range 12 {
diff --git a/tests/integration/rename_branch_test.go b/tests/integration/rename_branch_test.go
index 00ad6546e31..807381cc019 100644
--- a/tests/integration/rename_branch_test.go
+++ b/tests/integration/rename_branch_test.go
@@ -8,10 +8,10 @@ import (
 	"net/url"
 	"testing"
 
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/tests"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/repo_activity_test.go b/tests/integration/repo_activity_test.go
index 7781fd0511c..a3bfaff0b28 100644
--- a/tests/integration/repo_activity_test.go
+++ b/tests/integration/repo_activity_test.go
@@ -9,10 +9,10 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/test"
+	"gitea.dev/models/db"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/test"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/repo_archive_test.go b/tests/integration/repo_archive_test.go
index 4c190121b87..fd8403496c5 100644
--- a/tests/integration/repo_archive_test.go
+++ b/tests/integration/repo_archive_test.go
@@ -8,11 +8,11 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/routers"
-	"code.gitea.io/gitea/routers/web"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/routers"
+	"gitea.dev/routers/web"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/repo_branch_test.go b/tests/integration/repo_branch_test.go
index 6cf9990d2ea..7a9f1c81308 100644
--- a/tests/integration/repo_branch_test.go
+++ b/tests/integration/repo_branch_test.go
@@ -11,17 +11,17 @@ import (
 	"strings"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/translation"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/translation"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
 )
 
 func testCreateBranch(t testing.TB, session *TestSession, user, repo, oldRefSubURL, newBranchName string, expectedStatus int) string {
-	req := NewRequestWithValues(t, "POST", path.Join(user, repo, "branches/_new", oldRefSubURL), map[string]string{
+	req := NewRequestWithValues(t, "POST", "/"+path.Join(user, repo, "branches/_new", oldRefSubURL), map[string]string{
 		"new_branch_name": newBranchName,
 	})
 	resp := session.MakeRequest(t, req, expectedStatus)
@@ -221,7 +221,7 @@ func prepareRepoPR(t *testing.T, baseSession, headSession *TestSession, baseRepo
 
 func checkRecentlyPushedNewBranches(t *testing.T, session *TestSession, repoPath string, expected []string) {
 	branches := make([]string, 0, 2)
-	req := NewRequest(t, "GET", repoPath)
+	req := NewRequest(t, "GET", "/"+repoPath)
 	resp := session.MakeRequest(t, req, http.StatusOK)
 	doc := NewHTMLParser(t, resp.Body)
 	doc.doc.Find(".ui.positive.message div a").Each(func(index int, branch *goquery.Selection) {
diff --git a/tests/integration/repo_commits_search_test.go b/tests/integration/repo_commits_search_test.go
index 9b05e363991..28202e99775 100644
--- a/tests/integration/repo_commits_search_test.go
+++ b/tests/integration/repo_commits_search_test.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/repo_commits_test.go b/tests/integration/repo_commits_test.go
index 3bcea83f438..9335ef70656 100644
--- a/tests/integration/repo_commits_test.go
+++ b/tests/integration/repo_commits_test.go
@@ -11,14 +11,14 @@ import (
 	"sync"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
@@ -69,6 +69,28 @@ func TestRepoCommits(t *testing.T) {
 		assert.Equal(t, "6543", strings.TrimSpace(authorElem.Text()))
 	})
 
+	t.Run("CommitPageUsesCommitterDate", func(t *testing.T) {
+		const (
+			commitID              = "5099b81332712fe655e34e8dd63574f503f61811"
+			expectedCommitterTime = "2017-08-06T19:56:13+02:00"
+			authorTime            = "2017-08-06T19:55:01+02:00"
+		)
+
+		req := NewRequest(t, "GET", "/user2/repo16/commits/branch/master")
+		resp := session.MakeRequest(t, req, http.StatusOK)
+		doc := NewHTMLParser(t, resp.Body)
+
+		var commitListTime string
+		doc.doc.Find("#commits-table tbody tr").EachWithBreak(func(_ int, row *goquery.Selection) bool {
+			if path.Base(row.Find(".commit-id-short").AttrOr("href", "")) != commitID {
+				return true
+			}
+			commitListTime = row.Find("td").Eq(3).Find("relative-time").AttrOr("datetime", "")
+			return false
+		})
+		require.Equal(t, expectedCommitterTime, commitListTime)
+	})
+
 	t.Run("LastCommitNonExistingCommiter", func(t *testing.T) {
 		req := NewRequest(t, "GET", "/user2/repo1/src/branch/branch2")
 		resp := session.MakeRequest(t, req, http.StatusOK)
@@ -180,14 +202,12 @@ func TestRepoCommitsStatusParallel(t *testing.T) {
 
 	var wg sync.WaitGroup
 	for i := range 10 {
-		wg.Add(1)
-		go func(parentT *testing.T, i int) {
-			parentT.Run(fmt.Sprintf("ParallelCreateStatus_%d", i), func(t *testing.T) {
+		wg.Go(func() {
+			t.Run(fmt.Sprintf("ParallelCreateStatus_%d", i), func(t *testing.T) {
 				ctx := NewAPITestContext(t, "user2", "repo1", auth_model.AccessTokenScopeWriteRepository)
 				doAPICreateCommitStatusTest(ctx, path.Base(commitURL), commitstatus.CommitStatusPending, "testci")(t)
-				wg.Done()
 			})
-		}(t, i)
+		})
 	}
 	wg.Wait()
 }
diff --git a/tests/integration/repo_fork_test.go b/tests/integration/repo_fork_test.go
index fd6a0eac7ac..5c34b83aa1a 100644
--- a/tests/integration/repo_fork_test.go
+++ b/tests/integration/repo_fork_test.go
@@ -10,13 +10,13 @@ import (
 	"strconv"
 	"testing"
 
-	org_model "code.gitea.io/gitea/models/organization"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	org_service "code.gitea.io/gitea/services/org"
-	"code.gitea.io/gitea/tests"
+	org_model "gitea.dev/models/organization"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	org_service "gitea.dev/services/org"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/repo_generate_test.go b/tests/integration/repo_generate_test.go
index be4d5a036b8..e3dfa699816 100644
--- a/tests/integration/repo_generate_test.go
+++ b/tests/integration/repo_generate_test.go
@@ -11,10 +11,10 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/repo_merge_upstream_test.go b/tests/integration/repo_merge_upstream_test.go
index e0e47e1a038..44b3c748c10 100644
--- a/tests/integration/repo_merge_upstream_test.go
+++ b/tests/integration/repo_merge_upstream_test.go
@@ -11,13 +11,13 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	api "code.gitea.io/gitea/modules/structs"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/repo_migrate_test.go b/tests/integration/repo_migrate_test.go
index 98ad112fcc5..c6ba0669b0c 100644
--- a/tests/integration/repo_migrate_test.go
+++ b/tests/integration/repo_migrate_test.go
@@ -9,8 +9,8 @@ import (
 	"net/http/httptest"
 	"testing"
 
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/repo_search_test.go b/tests/integration/repo_search_test.go
index eafb6009904..1b396ed2386 100644
--- a/tests/integration/repo_search_test.go
+++ b/tests/integration/repo_search_test.go
@@ -7,10 +7,11 @@ import (
 	"net/http"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	code_indexer "code.gitea.io/gitea/modules/indexer/code"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/tests"
+	repo_model "gitea.dev/models/repo"
+	code_indexer "gitea.dev/modules/indexer/code"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
@@ -35,8 +36,8 @@ func TestSearchRepo(t *testing.T) {
 
 	testSearch(t, "/user2/repo1/search?q=Description&page=1", []string{"README.md"})
 
-	setting.Indexer.IncludePatterns = setting.IndexerGlobFromString("**.txt")
-	setting.Indexer.ExcludePatterns = setting.IndexerGlobFromString("**/y/**")
+	defer test.MockVariableValue(&setting.Indexer.IncludePatterns, setting.IndexerGlobFromString("**.txt"))()
+	defer test.MockVariableValue(&setting.Indexer.ExcludePatterns, setting.IndexerGlobFromString("**/y/**"))()
 
 	repo, err = repo_model.GetRepositoryByOwnerAndName(t.Context(), "user2", "glob")
 	assert.NoError(t, err)
diff --git a/tests/integration/repo_tag_test.go b/tests/integration/repo_tag_test.go
index eef83a794e2..a045b174b3a 100644
--- a/tests/integration/repo_tag_test.go
+++ b/tests/integration/repo_tag_test.go
@@ -9,16 +9,16 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	git_model "code.gitea.io/gitea/models/git"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/git/gitcmd"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/release"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	git_model "gitea.dev/models/git"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/git/gitcmd"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/release"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/repo_test.go b/tests/integration/repo_test.go
index b036ffff355..462f790585a 100644
--- a/tests/integration/repo_test.go
+++ b/tests/integration/repo_test.go
@@ -13,17 +13,17 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
-	repo_service "code.gitea.io/gitea/services/repository"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
+	repo_service "gitea.dev/services/repository"
+	"gitea.dev/tests"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
@@ -133,13 +133,11 @@ func testViewRepoWithCache(t *testing.T) {
 	// no last commit cache
 	testView(t)
 	// enable last commit cache for all repositories
-	oldCommitsCount := setting.CacheService.LastCommit.CommitsCount
-	setting.CacheService.LastCommit.CommitsCount = 0
+	defer test.MockVariableValue(&setting.CacheService.LastCommit.CommitsCount, 0)()
 	// first view will not hit the cache
 	testView(t)
 	// second view will hit the cache
 	testView(t)
-	setting.CacheService.LastCommit.CommitsCount = oldCommitsCount
 }
 
 func testViewRepoPrivate(t *testing.T) {
diff --git a/tests/integration/repo_topic_test.go b/tests/integration/repo_topic_test.go
index 522a774c4d2..3dfaa37d056 100644
--- a/tests/integration/repo_topic_test.go
+++ b/tests/integration/repo_topic_test.go
@@ -8,8 +8,8 @@ import (
 	"net/url"
 	"testing"
 
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/repo_visibility_test.go b/tests/integration/repo_visibility_test.go
index f9a2ab83695..a666e497236 100644
--- a/tests/integration/repo_visibility_test.go
+++ b/tests/integration/repo_visibility_test.go
@@ -7,10 +7,10 @@ import (
 	"net/http"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/repo_watch_test.go b/tests/integration/repo_watch_test.go
index ef3028f2936..e54f4df6aa4 100644
--- a/tests/integration/repo_watch_test.go
+++ b/tests/integration/repo_watch_test.go
@@ -7,15 +7,16 @@ import (
 	"net/url"
 	"testing"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/setting"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
 )
 
 func TestRepoWatch(t *testing.T) {
 	onGiteaRun(t, func(t *testing.T, giteaURL *url.URL) {
 		// Test round-trip auto-watch
-		setting.Service.AutoWatchOnChanges = true
+		defer test.MockVariableValue(&setting.Service.AutoWatchOnChanges, true)()
 		session := loginUser(t, "user2")
 		unittest.AssertNotExistsBean(t, &repo_model.Watch{UserID: 2, RepoID: 3})
 		testEditFile(t, session, "org3", "repo3", "master", "README.md", "Hello, World (Edited for watch)\n")
diff --git a/tests/integration/repo_webhook_test.go b/tests/integration/repo_webhook_test.go
index 12a11d45bd1..af309674cd7 100644
--- a/tests/integration/repo_webhook_test.go
+++ b/tests/integration/repo_webhook_test.go
@@ -15,26 +15,26 @@ import (
 	"testing"
 	"time"
 
-	actions_model "code.gitea.io/gitea/models/actions"
-	auth_model "code.gitea.io/gitea/models/auth"
-	db_model "code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/perm"
-	"code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/models/webhook"
-	"code.gitea.io/gitea/modules/commitstatus"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/json"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	webhook_module "code.gitea.io/gitea/modules/webhook"
-	"code.gitea.io/gitea/services/actions"
-	"code.gitea.io/gitea/tests"
+	runnerv1 "gitea.dev/actions-proto-go/runner/v1"
+	actions_model "gitea.dev/models/actions"
+	auth_model "gitea.dev/models/auth"
+	db_model "gitea.dev/models/db"
+	"gitea.dev/models/perm"
+	"gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/models/webhook"
+	"gitea.dev/modules/commitstatus"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/json"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	webhook_module "gitea.dev/modules/webhook"
+	"gitea.dev/services/actions"
+	"gitea.dev/tests"
 
-	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/repofiles_change_test.go b/tests/integration/repofiles_change_test.go
index 5de973aaccb..05f9b027d3e 100644
--- a/tests/integration/repofiles_change_test.go
+++ b/tests/integration/repofiles_change_test.go
@@ -12,13 +12,13 @@ import (
 	"testing"
 	"time"
 
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/gitrepo"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/services/contexttest"
-	files_service "code.gitea.io/gitea/services/repository/files"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/gitrepo"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/services/contexttest"
+	files_service "gitea.dev/services/repository/files"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/session_test.go b/tests/integration/session_test.go
index 981b88ae452..7529eee469f 100644
--- a/tests/integration/session_test.go
+++ b/tests/integration/session_test.go
@@ -6,9 +6,9 @@ package integration
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/auth"
+	"gitea.dev/models/unittest"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/setting_test.go b/tests/integration/setting_test.go
index 64fd28c5e9e..b6e72488d12 100644
--- a/tests/integration/setting_test.go
+++ b/tests/integration/setting_test.go
@@ -7,18 +7,16 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
 
 func TestSettingShowUserEmailExplore(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	showUserEmail := setting.UI.ShowUserEmail
-	setting.UI.ShowUserEmail = true
+	defer test.MockVariableValue(&setting.UI.ShowUserEmail, true)()
 
 	session := loginUser(t, "user2")
 	req := NewRequest(t, "GET", "/explore/users?sort=alphabetically")
@@ -38,8 +36,6 @@ func TestSettingShowUserEmailExplore(t *testing.T) {
 		htmlDoc.doc.Find(".explore.users").Text(),
 		"user34@example.com",
 	)
-
-	setting.UI.ShowUserEmail = showUserEmail
 }
 
 func TestSettingShowUserEmailProfile(t *testing.T) {
diff --git a/tests/integration/signin_test.go b/tests/integration/signin_test.go
index 5d5420d95d4..ab1167ce2cd 100644
--- a/tests/integration/signin_test.go
+++ b/tests/integration/signin_test.go
@@ -9,18 +9,18 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers"
-	"code.gitea.io/gitea/routers/web/auth"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/translation"
+	"gitea.dev/modules/web"
+	"gitea.dev/routers"
+	"gitea.dev/routers/web/auth"
+	"gitea.dev/services/context"
+	"gitea.dev/tests"
 
 	"github.com/markbates/goth"
 	"github.com/stretchr/testify/assert"
diff --git a/tests/integration/signout_test.go b/tests/integration/signout_test.go
index ff35dcf7a50..fcaf30da075 100644
--- a/tests/integration/signout_test.go
+++ b/tests/integration/signout_test.go
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/signup_test.go b/tests/integration/signup_test.go
index 06c513f6167..125bdf1daa2 100644
--- a/tests/integration/signup_test.go
+++ b/tests/integration/signup_test.go
@@ -9,13 +9,13 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/db"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/translation"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/ssh_key_test.go b/tests/integration/ssh_key_test.go
index 1625dc3756d..9b5eaee880b 100644
--- a/tests/integration/ssh_key_test.go
+++ b/tests/integration/ssh_key_test.go
@@ -12,9 +12,9 @@ import (
 	"testing"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/git"
+	api "gitea.dev/modules/structs"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/timetracking_test.go b/tests/integration/timetracking_test.go
index 3dec6db2e84..92e76a399ce 100644
--- a/tests/integration/timetracking_test.go
+++ b/tests/integration/timetracking_test.go
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -37,7 +37,7 @@ func TestViewTimetrackingControls(t *testing.T) {
 }
 
 func testViewTimetrackingControls(t *testing.T, session *TestSession, user, repo, issue string, canTrackTime bool) {
-	req := NewRequest(t, "GET", path.Join(user, repo, "issues", issue))
+	req := NewRequest(t, "GET", "/"+path.Join(user, repo, "issues", issue))
 	resp := session.MakeRequest(t, req, http.StatusOK)
 
 	htmlDoc := NewHTMLParser(t, resp.Body)
@@ -45,7 +45,7 @@ func testViewTimetrackingControls(t *testing.T, session *TestSession, user, repo
 	AssertHTMLElement(t, htmlDoc, ".issue-start-time", canTrackTime)
 	AssertHTMLElement(t, htmlDoc, ".issue-add-time", canTrackTime)
 
-	issueLink := path.Join(user, repo, "issues", issue)
+	issueLink := "/" + path.Join(user, repo, "issues", issue)
 	reqStart := NewRequest(t, "POST", path.Join(issueLink, "times", "stopwatch", "start"))
 	if canTrackTime {
 		session.MakeRequest(t, reqStart, http.StatusOK)
diff --git a/tests/integration/user_avatar_test.go b/tests/integration/user_avatar_test.go
index add1554b7ac..3f5674f8ad9 100644
--- a/tests/integration/user_avatar_test.go
+++ b/tests/integration/user_avatar_test.go
@@ -11,10 +11,10 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/avatar"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/avatar"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
diff --git a/tests/integration/user_settings_test.go b/tests/integration/user_settings_test.go
index b0e23b6e7ff..3ccb6d95220 100644
--- a/tests/integration/user_settings_test.go
+++ b/tests/integration/user_settings_test.go
@@ -8,10 +8,10 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/user_test.go b/tests/integration/user_test.go
index f1eaf898896..83af9e0bf83 100644
--- a/tests/integration/user_test.go
+++ b/tests/integration/user_test.go
@@ -8,18 +8,18 @@ import (
 	"strings"
 	"testing"
 
-	asymkey_model "code.gitea.io/gitea/models/asymkey"
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/db"
-	issues_model "code.gitea.io/gitea/models/issues"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/translation"
-	"code.gitea.io/gitea/tests"
+	asymkey_model "gitea.dev/models/asymkey"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/translation"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/version_test.go b/tests/integration/version_test.go
index ca716d47192..631c7c1e25b 100644
--- a/tests/integration/version_test.go
+++ b/tests/integration/version_test.go
@@ -7,17 +7,17 @@ import (
 	"net/http"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
 
 func TestVersion(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	setting.AppVer = "test-version-1"
+	defer test.MockVariableValue(&setting.AppVer, "test-version-1")()
 	req := NewRequest(t, "GET", "/api/v1/version")
 	resp := MakeRequest(t, req, http.StatusOK)
 
diff --git a/tests/integration/view_test.go b/tests/integration/view_test.go
index 4dbf7717050..7c5a2525ebc 100644
--- a/tests/integration/view_test.go
+++ b/tests/integration/view_test.go
@@ -9,11 +9,11 @@ import (
 	"strings"
 	"testing"
 
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/tests"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/web"
+	"gitea.dev/services/context"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/integration/wiki_test.go b/tests/integration/wiki_test.go
index 5718156ffad..0c1b00e5076 100644
--- a/tests/integration/wiki_test.go
+++ b/tests/integration/wiki_test.go
@@ -11,54 +11,19 @@ import (
 	"strings"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/modules/git"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/git/gitcmd"
+	"gitea.dev/tests"
 
 	"github.com/PuerkitoBio/goquery"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
-func assertFileExist(t *testing.T, p string) {
-	exist, err := util.IsExist(p)
-	assert.NoError(t, err)
-	assert.True(t, exist)
-}
-
-func assertFileEqual(t *testing.T, p string, content []byte) {
-	bs, err := os.ReadFile(p)
-	assert.NoError(t, err)
-	assert.Equal(t, content, bs)
-}
-
-func TestRepoCloneWiki(t *testing.T) {
-	onGiteaRun(t, func(t *testing.T, u *url.URL) {
-		defer tests.PrepareTestEnv(t)()
-
-		dstPath := t.TempDir()
-
-		r := u.String() + "user2/repo1.wiki.git"
-		u, _ = url.Parse(r)
-		u.User = url.UserPassword("user2", userPassword)
-		t.Run("Clone", func(t *testing.T) {
-			assert.NoError(t, git.Clone(t.Context(), u.String(), dstPath, git.CloneRepoOptions{}))
-			assertFileEqual(t, filepath.Join(dstPath, "Home.md"), []byte("# Home page\n\nThis is the home page!\n"))
-			assertFileExist(t, filepath.Join(dstPath, "Page-With-Image.md"))
-			assertFileExist(t, filepath.Join(dstPath, "Page-With-Spaced-Name.md"))
-			assertFileExist(t, filepath.Join(dstPath, "images"))
-			assertFileExist(t, filepath.Join(dstPath, "files/Non-Renderable-File.zip"))
-			assertFileExist(t, filepath.Join(dstPath, "jpeg.jpg"))
-		})
-	})
-}
-
-func Test_RepoWikiPages(t *testing.T) {
+func TestRepoWikiPages(t *testing.T) {
 	defer tests.PrepareTestEnv(t)()
-
-	url := "/user2/repo1/wiki/?action=_pages"
-	req := NewRequest(t, "GET", url)
+	req := NewRequest(t, "GET", "/user2/repo1/wiki/?action=_pages")
 	resp := MakeRequest(t, req, http.StatusOK)
 
 	doc := NewHTMLParser(t, resp.Body)
@@ -74,45 +39,72 @@ func Test_RepoWikiPages(t *testing.T) {
 	})
 }
 
-func Test_WikiClone(t *testing.T) {
-	onGiteaRun(t, func(t *testing.T, u *url.URL) {
-		username := "user2"
-		reponame := "repo1"
-		wikiPath := username + "/" + reponame + ".wiki.git"
-		keyname := "my-testing-key"
-		baseAPITestContext := NewAPITestContext(t, username, "repo1", auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
+func testRepoWikiCloneHTTP(t *testing.T, u *url.URL) {
+	// When proc-receive support is enabled globally, the HTTP receive-pack pre-check
+	// must still require write access for wiki repositories. Exercise this with a
+	// normal wiki push because the regression is about the pre-check, not agit refs.
+	require.True(t, git.DefaultFeatures().SupportProcReceive) // modern git should all support proc-receive
 
-		u.Path = wikiPath
+	wikiURL := *u
+	wikiURL.Path = "/user2/repo1.wiki.git"
 
-		t.Run("Clone HTTP", func(t *testing.T) {
-			defer tests.PrintCurrentTest(t)()
+	dstLocalPath := t.TempDir()
 
-			dstLocalPath := t.TempDir()
-			assert.NoError(t, git.Clone(t.Context(), u.String(), dstLocalPath, git.CloneRepoOptions{}))
-			content, err := os.ReadFile(filepath.Join(dstLocalPath, "Home.md"))
-			assert.NoError(t, err)
-			assert.Equal(t, "# Home page\n\nThis is the home page!\n", string(content))
-		})
+	// reader can clone
+	wikiURL.User = url.UserPassword("user20", userPassword)
+	require.NoError(t, git.Clone(t.Context(), wikiURL.String(), dstLocalPath, git.CloneRepoOptions{}))
+	_, _, runErr := gitcmd.NewCommand("fast-import").WithDir(dstLocalPath).WithStdinBytes([]byte(`commit refs/heads/master
+committer unauthorized-user <user20@example.com> 1714310400 +0000
+data <<EOM
+dummy-message
+EOM
+from refs/heads/master^0
+M 100644 inline Home.md
+data <<EOF
+changed-content
+EOF
+`)).RunStdString(t.Context())
+	require.NoError(t, runErr)
 
-		t.Run("Clone SSH", func(t *testing.T) {
-			defer tests.PrintCurrentTest(t)()
+	content, err := os.ReadFile(filepath.Join(dstLocalPath, "Home.md"))
+	assert.NoError(t, err)
+	assert.Equal(t, "# Home page\n\nThis is the home page!\n", string(content))
 
-			dstLocalPath := t.TempDir()
-			sshURL := createSSHUrl(wikiPath, u)
+	// reader can't push
+	_, _, runErr = gitcmd.NewCommand("push", "origin", "refs/heads/master").WithDir(dstLocalPath).RunStdString(t.Context())
+	assert.True(t, gitcmd.StderrContains(runErr, "remote: Repository not found\n"))
+	req := NewRequest(t, "GET", "/user2/repo1/wiki/raw/Home.md")
+	resp := MakeRequest(t, req, http.StatusOK)
+	assert.Contains(t, resp.Body.String(), "This is the home page!")
 
-			withKeyFile(t, keyname, func(keyFile string) {
-				var keyID int64
-				t.Run("CreateUserKey", doAPICreateUserKey(baseAPITestContext, "test-key", keyFile, func(t *testing.T, key api.PublicKey) {
-					keyID = key.ID
-				}))
-				assert.NotZero(t, keyID)
+	// owner can push
+	wikiURL.User = url.UserPassword("user2", userPassword)
+	_, _, runErr = gitcmd.NewCommand("remote", "add", "origin-owner").AddDynamicArguments(wikiURL.String()).WithDir(dstLocalPath).RunStdString(t.Context())
+	require.NoError(t, runErr)
+	_, _, runErr = gitcmd.NewCommand("push", "origin-owner", "refs/heads/master").WithDir(dstLocalPath).RunStdString(t.Context())
+	assert.NoError(t, runErr)
+	req = NewRequest(t, "GET", "/user2/repo1/wiki/raw/Home.md")
+	resp = MakeRequest(t, req, http.StatusOK)
+	assert.Equal(t, "changed-content", strings.TrimSpace(resp.Body.String()))
+}
 
-				// Setup clone folder
-				assert.NoError(t, git.Clone(t.Context(), sshURL.String(), dstLocalPath, git.CloneRepoOptions{}))
-				content, err := os.ReadFile(filepath.Join(dstLocalPath, "Home.md"))
-				assert.NoError(t, err)
-				assert.Equal(t, "# Home page\n\nThis is the home page!\n", string(content))
-			})
-		})
+func testRepoWikiCloneSSH(t *testing.T, u *url.URL) {
+	dstLocalPath := t.TempDir()
+	baseAPITestContext := NewAPITestContext(t, "user2", "repo1", auth_model.AccessTokenScopeWriteRepository, auth_model.AccessTokenScopeWriteUser)
+	sshURL := createSSHUrl("/user2/repo1.wiki.git", u)
+
+	withKeyFile(t, "my-testing-key", func(keyFile string) {
+		t.Run("CreateUserKey", doAPICreateUserKey(baseAPITestContext, "test-key", keyFile))
+		assert.NoError(t, git.Clone(t.Context(), sshURL.String(), dstLocalPath, git.CloneRepoOptions{}))
+		content, err := os.ReadFile(filepath.Join(dstLocalPath, "Home.md"))
+		assert.NoError(t, err)
+		assert.Equal(t, "# Home page\n\nThis is the home page!\n", string(content))
+	})
+}
+
+func TestRepoWikiClonePush(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		t.Run("SSH", func(t *testing.T) { testRepoWikiCloneSSH(t, u) })
+		t.Run("HTTP", func(t *testing.T) { testRepoWikiCloneHTTP(t, u) })
 	})
 }
diff --git a/tests/integration/workflow_run_api_check_test.go b/tests/integration/workflow_run_api_check_test.go
index d7390b3ac17..a43dc78cf2c 100644
--- a/tests/integration/workflow_run_api_check_test.go
+++ b/tests/integration/workflow_run_api_check_test.go
@@ -9,9 +9,9 @@ import (
 	"net/url"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	api "code.gitea.io/gitea/modules/structs"
-	"code.gitea.io/gitea/tests"
+	auth_model "gitea.dev/models/auth"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
 )
diff --git a/tests/test_utils.go b/tests/test_utils.go
index 11e5ac24344..d7f520e405d 100644
--- a/tests/test_utils.go
+++ b/tests/test_utils.go
@@ -7,16 +7,16 @@ import (
 	"path/filepath"
 	"testing"
 
-	"code.gitea.io/gitea/models/db"
-	packages_model "code.gitea.io/gitea/models/packages"
-	"code.gitea.io/gitea/models/unittest"
-	"code.gitea.io/gitea/modules/git"
-	"code.gitea.io/gitea/modules/graceful"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/testlogger"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/routers"
+	"gitea.dev/models/db"
+	packages_model "gitea.dev/models/packages"
+	"gitea.dev/models/unittest"
+	"gitea.dev/modules/git"
+	"gitea.dev/modules/graceful"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/testlogger"
+	"gitea.dev/modules/util"
+	"gitea.dev/routers"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -36,6 +36,7 @@ func InitIntegrationTest() error {
 		return err
 	}
 
+	setting.Database.SlowQueryThreshold = 0
 	setting.LoadDBSetting()
 	cleanupDb, err := unittest.ResetTestDatabase()
 	if err != nil {
diff --git a/tools/ci-tools.ts b/tools/ci-tools.ts
new file mode 100644
index 00000000000..4562643247d
--- /dev/null
+++ b/tools/ci-tools.ts
@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+import {argv, env, exit} from 'node:process';
+
+const allowedTypes = [
+  'build',
+  'chore',
+  'ci',
+  'docs',
+  'enhance',
+  'feat',
+  'fix',
+  'perf',
+  'refactor',
+  'revert',
+  'style',
+  'test',
+] as const;
+type CommitType = typeof allowedTypes[number];
+
+const allowedTypesList = allowedTypes.join(', ');
+const titlePattern = new RegExp(`^(${allowedTypes.join('|')})(\\([\\w/.-]+\\))?(!)?: .+$`);
+
+function parsePrTitle(title: string): {type: CommitType; breaking: boolean} | null {
+  const match = titlePattern.exec(title);
+  return match ? {type: match[1] as CommitType, breaking: Boolean(match[3])} : null;
+}
+
+const breakingLabel = 'pr/breaking';
+
+// Mutually exclusive type labels, fully synced with the title type (added and removed).
+const typeLabels: Partial<Record<CommitType, string>> = {
+  feat: 'type/feature',
+  enhance: 'type/enhancement',
+  fix: 'type/bug',
+  docs: 'type/docs',
+  test: 'type/testing',
+};
+
+// Non-type labels, only added, never auto-removed, so manual labeling is not clobbered.
+const extraLabels: Partial<Record<CommitType, string>> = {
+  chore: 'skip-changelog',
+  ci: 'skip-changelog',
+  build: 'topic/build',
+};
+
+// Labels this tool may remove when the title no longer implies them.
+const removableLabels = [...Object.values(typeLabels), breakingLabel];
+
+function labelsForPrTitle(title: string): string[] {
+  const parsed = parsePrTitle(title);
+  if (!parsed) return [];
+  return [typeLabels[parsed.type], extraLabels[parsed.type], parsed.breaking ? breakingLabel : undefined]
+    .filter((label): label is string => label !== undefined);
+}
+
+// Command: validate PR_TITLE against the allowed Conventional Commits format.
+function lintPrTitle(): void {
+  if (!env.PR_TITLE) {
+    console.error('Missing PR_TITLE');
+    exit(1);
+  }
+  if (!parsePrTitle(env.PR_TITLE)) {
+    console.error(`Invalid PR title: ${env.PR_TITLE}`);
+    console.error('Expected format: type(scope): subject (scope optional, append "!" for breaking changes)');
+    console.error(`Allowed types: ${allowedTypesList}`);
+    exit(1);
+  }
+}
+
+// Command: sync the title-derived labels onto the PR via the GitHub API.
+async function setPrLabels(): Promise<void> {
+  if (!env.PR_TITLE || !env.GITHUB_TOKEN || !env.GITHUB_REPOSITORY || !env.PR_NUMBER) {
+    console.error('set-pr-labels requires PR_TITLE, GITHUB_TOKEN, GITHUB_REPOSITORY and PR_NUMBER');
+    exit(1);
+  }
+
+  const labelsUrl = `https://api.github.com/repos/${env.GITHUB_REPOSITORY}/issues/${env.PR_NUMBER}/labels`;
+
+  async function request(url: string, method = 'GET', body?: unknown): Promise<Response> {
+    const response = await fetch(url, {
+      method,
+      headers: {
+        Accept: 'application/vnd.github+json',
+        Authorization: `Bearer ${env.GITHUB_TOKEN}`,
+        'X-GitHub-Api-Version': '2022-11-28',
+        ...(body ? {'Content-Type': 'application/json'} : {}),
+      },
+      body: body ? JSON.stringify(body) : undefined,
+    });
+    if (!response.ok) {
+      throw new Error(`GitHub API ${method} ${url} failed (${response.status}): ${await response.text()}`);
+    }
+    return response;
+  }
+
+  const desired = labelsForPrTitle(env.PR_TITLE);
+  const response = await request(`${labelsUrl}?per_page=100`);
+  const current = ((await response.json()) as Array<{name: string}>).map((label) => label.name);
+
+  const toAdd = desired.filter((name) => !current.includes(name));
+  const toRemove = removableLabels.filter((name) => current.includes(name) && !desired.includes(name));
+
+  if (toAdd.length) {
+    await request(labelsUrl, 'POST', {labels: toAdd});
+    console.info(`Added labels: ${toAdd.join(', ')}`);
+  }
+  for (const name of toRemove) {
+    await request(`${labelsUrl}/${encodeURIComponent(name)}`, 'DELETE');
+    console.info(`Removed label: ${name}`);
+  }
+  if (!toAdd.length && !toRemove.length) {
+    console.info('PR labels already in sync');
+  }
+}
+
+const commands: Record<string, () => void | Promise<void>> = {
+  'lint-pr-title': lintPrTitle,
+  'set-pr-labels': setPrLabels,
+};
+
+const command = argv[2];
+const handler = commands[command];
+if (!handler) {
+  console.error(`Usage: ci-tools.ts <${Object.keys(commands).join('|')}>`);
+  exit(1);
+}
+
+try {
+  await handler();
+} catch (error) {
+  console.error(error instanceof Error ? error.message : error);
+  exit(1);
+}
diff --git a/tools/generate-codemirror-languages.ts b/tools/generate-codemirror-languages.ts
new file mode 100755
index 00000000000..28636dee82c
--- /dev/null
+++ b/tools/generate-codemirror-languages.ts
@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+import {load as parseYaml} from 'js-yaml';
+import {writeFile} from 'node:fs/promises';
+import {languages as cmLanguages} from '@codemirror/language-data';
+
+const linguistUrl = 'https://raw.githubusercontent.com/github-linguist/linguist/main/lib/linguist/languages.yml';
+
+const renames: Record<string, string> = {
+  'Protocol Buffer': 'ProtoBuf',
+};
+
+// Languages whose entry is constructed manually in the runtime; skip during generation.
+const skipNames = new Set(['Dockerfile', 'Markdown']);
+
+// Extensions claimed by several unrelated languages with no good default; strip globally.
+const ambiguousExt = new Set(['cgi', 'fcgi', 'inc']);
+
+// Per-language drops for non-text formats (.frm = binary VB6 forms) or where Linguist's
+// primary owner conflicts with a more specialised CodeMirror mode (.spec → RPM Spec).
+const excludeExt: Record<string, string[]> = {
+  'INI': ['frm'],
+  'Python': ['spec'],
+  'Ruby': ['spec'],
+};
+
+// Per-CM-language additions for filenames Linguist classifies as separate languages
+// (.editorconfig, .gitconfig, .npmrc) or omits entirely (Snakefile).
+const extraFilenames: Record<string, string[]> = {
+  'Properties files': ['.editorconfig', '.gitconfig', '.npmrc'],
+  'Python': ['Snakefile'],
+};
+
+// Per-CM-language additions widely used in practice but absent from Linguist's list.
+const extraExtensions: Record<string, string[]> = {
+  'Properties files': ['conf'],
+};
+
+type LinguistEntry = {
+  type: string;
+  extensions?: string[];
+  filenames?: string[];
+};
+
+type CmLanguage = {
+  name: string;
+  extensions: string[];
+  filenames: string[];
+};
+
+const res = await fetch(linguistUrl);
+if (!res.ok) throw new Error(`fetch ${linguistUrl} failed: ${res.status}`);
+const linguist = parseYaml(await res.text()) as Record<string, LinguistEntry>;
+
+const cmByAlias = new Map<string, string>();
+// Map of extension -> the CM language that originally owns it. Used to prevent Linguist
+// from broadening one language's extension claim into another's territory (e.g. Linguist's
+// PLSQL lists .sql, but CM's SQL is the canonical owner).
+const cmOriginalExtOwner = new Map<string, string>();
+for (const lang of cmLanguages) {
+  cmByAlias.set(lang.name.toLowerCase(), lang.name);
+  for (const a of lang.alias) cmByAlias.set(a.toLowerCase(), lang.name);
+  for (const ext of lang.extensions) {
+    if (!cmOriginalExtOwner.has(ext)) cmOriginalExtOwner.set(ext, lang.name);
+  }
+}
+
+const out: CmLanguage[] = [];
+const seen = new Set<string>();
+for (const [linguistName, entry] of Object.entries(linguist)) {
+  const cmName = renames[linguistName] ?? cmByAlias.get(linguistName.toLowerCase());
+  // Multiple Linguist entries can alias to the same CM language (e.g. JSON5 → JSON).
+  if (!cmName || skipNames.has(cmName) || seen.has(cmName)) continue;
+  seen.add(cmName);
+  const exExt = new Set(excludeExt[linguistName]);
+  // CodeMirror's matchFilename uses /\.([^.]+)$/, so multi-dot extensions like
+  // ".cmake.in" can't match as extensions and are dropped here.
+  const extensions = (entry.extensions ?? [])
+    .map((e) => e.replace(/^\./, ''))
+    .filter((e) => {
+      if (e.includes('.') || ambiguousExt.has(e) || exExt.has(e)) return false;
+      const owner = cmOriginalExtOwner.get(e);
+      return !owner || owner === cmName;
+    });
+  out.push({
+    name: cmName,
+    extensions: [...extensions, ...(extraExtensions[cmName] ?? [])],
+    filenames: [...(entry.filenames ?? []), ...(extraFilenames[cmName] ?? [])],
+  });
+}
+
+out.sort((a, b) => a.name.localeCompare(b.name));
+
+const outPath = new URL('../assets/codemirror-languages.json', import.meta.url);
+await writeFile(outPath, `${JSON.stringify(out, null, 2)}\n`);
+console.info(`wrote ${out.length} languages to ${outPath.pathname}`);
diff --git a/tools/lint-go-all.go b/tools/lint-go-all.go
new file mode 100644
index 00000000000..0193baccf27
--- /dev/null
+++ b/tools/lint-go-all.go
@@ -0,0 +1,104 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package main
+
+import (
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+)
+
+func lintGoHeader() bool {
+	headerRE := regexp.MustCompile(`^(// (Copyright [^\n]+|All rights reserved\.)\n)*// Copyright \d{4} (The Gogs Authors|The Gitea Authors|Gitea Authors|Gitea)\.( All rights reserved\.)?\n(// (Copyright [^\n]+|All rights reserved\.)\n)*// SPDX-License-Identifier: [\w.-]+`)
+	generatedRE := regexp.MustCompile(`(?m)^// (Code|This file is) [Gg]enerated.*DO NOT EDIT`)
+	skipDirs := map[string]bool{
+		".git":         true,
+		".venv":        true,
+		"node_modules": true,
+		"public":       true,
+		"vendor":       true,
+		"web_src":      true,
+	}
+	root, bad := ".", 0
+	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
+			if rel, _ := filepath.Rel(root, path); skipDirs[filepath.ToSlash(rel)] {
+				return fs.SkipDir
+			}
+			return nil
+		}
+		if !strings.HasSuffix(path, ".go") {
+			return nil
+		}
+		f, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		data, err := io.ReadAll(io.LimitReader(f, 512))
+		_ = f.Close()
+		if err != nil {
+			return err
+		}
+		if generatedRE.Match(data) {
+			return nil
+		}
+		if !headerRE.Match(data) {
+			_, _ = fmt.Fprintf(os.Stderr, "%s: missing or invalid copyright header\n", path)
+			bad++
+		}
+		return nil
+	})
+	if err != nil {
+		_, _ = fmt.Fprintln(os.Stderr, err)
+	}
+	return err == nil && bad == 0
+}
+
+func runCmd(env []string, name string, args []string) bool {
+	cmd := exec.Command(name, args...)
+	cmd.Env = append(os.Environ(), env...)
+	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
+	if err := cmd.Run(); err != nil {
+		_, _ = fmt.Fprintln(os.Stderr, err)
+		return false
+	}
+	return true
+}
+
+func main() {
+	// 'go run' can not have distinct GOOS/GOARCH for its build and run steps,
+	// so install a pre-compiled binary and run it for different target platforms.
+	_, _ = os.Unsetenv("GOOS"), os.Unsetenv("GOARCH")
+
+	envGolangciLintPackage := os.Getenv("GOLANGCI_LINT_PACKAGE")
+	envGo := os.Getenv("GO")
+	if envGo == "" || envGolangciLintPackage == "" {
+		_, _ = fmt.Fprintln(os.Stderr, "Environment variables GO and GOLANGCI_LINT_PACKAGE must be set")
+		os.Exit(1)
+	}
+	if !runCmd(nil, envGo, []string{"install", envGolangciLintPackage}) {
+		os.Exit(1)
+	}
+
+	_, _ = fmt.Fprintln(os.Stdout, "lint go header ...")
+	succeed := lintGoHeader()
+	_, _ = fmt.Fprintln(os.Stdout, "lint for linux ...")
+	succeed = runCmd([]string{"GOOS=linux", "TAGS=bindata"}, "golangci-lint", append([]string{"run", "--build-tags=linux,bindata"}, os.Args[1:]...)) && succeed
+	if os.Getenv("CI") != "" {
+		// only lint for other platforms when in CI, to keep local lint fast
+		_, _ = fmt.Fprintln(os.Stdout, "lint for windows ...")
+		succeed = runCmd([]string{"GOOS=windows", "TAGS=gogit"}, "golangci-lint", append([]string{"run", "--build-tags=windows,gogit"}, os.Args[1:]...)) && succeed
+	}
+	if !succeed {
+		os.Exit(1)
+	}
+}
diff --git a/tools/lint-shell.sh b/tools/lint-shell.sh
new file mode 100755
index 00000000000..dac838e8338
--- /dev/null
+++ b/tools/lint-shell.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+set -euo pipefail
+
+CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-docker}"
+VERSION=$(echo "$SHELLCHECK_IMAGE" | sed -E 's/.*:v([0-9.]+)@.*/\1/')
+
+if hash shellcheck 2>/dev/null && shellcheck --version | grep -qx "version: $VERSION"; then
+  exec shellcheck --color=always "$@"
+else
+  exec "$CONTAINER_RUNTIME" run --rm -v "$PWD":/mnt -w /mnt "$SHELLCHECK_IMAGE" --color=always "$@"
+fi
diff --git a/tools/test-e2e.sh b/tools/test-e2e.sh
index 39405387b5b..be3e848ee1d 100755
--- a/tools/test-e2e.sh
+++ b/tools/test-e2e.sh
@@ -1,13 +1,101 @@
 #!/bin/bash
 set -euo pipefail
 
+CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-docker}"
+CONTAINER_NAME="gitea-e2e-runner-$$"
+
+free_port() {
+  node -e "const s=require('net').createServer();s.listen(0,'127.0.0.1',()=>{process.stdout.write(String(s.address().port));s.close()})"
+}
+
+detect_playwright_mode() {
+  if [ "${PLAYWRIGHT_MODE:-auto}" = "local" ] || [ "${PLAYWRIGHT_MODE:-auto}" = "container" ]; then
+    return
+  fi
+
+  PLAYWRIGHT_MODE="local"
+
+  if [ "$(uname -s)" = "Linux" ]; then
+    # playwright only supports ubuntu/debian officially
+    if ! grep -qE '^ID(_LIKE)?=.*(ubuntu|debian)' /etc/os-release 2>/dev/null; then
+        PLAYWRIGHT_MODE="container"
+    fi
+  fi
+}
+
+wait_for_container() {
+  local max_wait=30
+  local elapsed=0
+  echo "Waiting for container to start..."
+  while ! (echo > "/dev/tcp/127.0.0.1/$PLAYWRIGHT_SERVER_PORT") 2>/dev/null; do
+    if [ "$("$CONTAINER_RUNTIME" inspect -f '{{.State.Running}}' "$CONTAINER_NAME" 2>/dev/null)" != "true" ]; then
+      echo "Error: container exited before becoming ready." >&2
+      "$CONTAINER_RUNTIME" logs "$CONTAINER_NAME" >&2 || true
+      return 1
+    fi
+    if [ "$elapsed" -ge "$max_wait" ]; then
+      echo "Error: container did not become ready after ${max_wait}s." >&2
+      "$CONTAINER_RUNTIME" logs "$CONTAINER_NAME" >&2 || true
+      return 1
+    fi
+    sleep 1
+    elapsed=$((elapsed + 1))
+  done
+  echo "Container is ready."
+}
+
+CMD="${1:-run}"
+if [ "$CMD" = "install" ] || [ "$CMD" = "run" ]; then
+  [ $# -gt 0 ] && shift
+else
+  CMD="run"
+fi
+
+detect_playwright_mode
+
+if [ "$PLAYWRIGHT_MODE" = "container" ]; then
+  if ! command -v "$CONTAINER_RUNTIME" >/dev/null 2>&1; then
+    echo "error: PLAYWRIGHT_MODE=container but '$CONTAINER_RUNTIME' is not installed." >&2
+    echo "Install docker/podman or set CONTAINER_RUNTIME to an available runtime." >&2
+    exit 1
+  fi
+  PLAYWRIGHT_VERSION=$(sed -n 's/.*"@playwright\/test"[[:space:]]*:[[:space:]]*"[^[:digit:]]*\([^"]*\)".*/\1/p' package.json)
+  if ! [[ "$PLAYWRIGHT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then
+    echo "error: invalid @playwright/test version in package.json: '${PLAYWRIGHT_VERSION}'" >&2
+    exit 1
+  fi
+  PLAYWRIGHT_IMAGE="mcr.microsoft.com/playwright:v${PLAYWRIGHT_VERSION}-noble"
+fi
+
+if [ "$CMD" = "install" ]; then
+  if [ "$PLAYWRIGHT_MODE" = "local" ]; then
+    # on GitHub Actions VMs, playwright's system deps are pre-installed
+    if [ -z "${GITHUB_ACTIONS:-}" ]; then
+      # shellcheck disable=SC2086 # flag string
+      pnpm exec playwright install --with-deps chromium firefox ${PLAYWRIGHT_FLAGS:-}
+    else
+      # shellcheck disable=SC2086 # flag string
+      pnpm exec playwright install chromium firefox ${PLAYWRIGHT_FLAGS:-}
+    fi
+  else
+    echo "Running playwright in container as host distro is not supported by playwright directly"
+    if ! "$CONTAINER_RUNTIME" image inspect "$PLAYWRIGHT_IMAGE" >/dev/null 2>&1; then
+      "$CONTAINER_RUNTIME" pull "$PLAYWRIGHT_IMAGE"
+    fi
+  fi
+  exit 0
+fi
+
 # Create isolated work directory
 WORK_DIR=$(mktemp -d)
 
 # Find a random free port
-FREE_PORT=$(node -e "const s=require('net').createServer();s.listen(0,'127.0.0.1',()=>{process.stdout.write(String(s.address().port));s.close()})")
+FREE_PORT=$(free_port)
 
 cleanup() {
+  if [ "$PLAYWRIGHT_MODE" = "container" ]; then
+    "$CONTAINER_RUNTIME" stop "$CONTAINER_NAME" >/dev/null 2>&1 || true
+  fi
   if [ -n "${SERVER_PID:-}" ]; then
     kill "$SERVER_PID" 2>/dev/null || true
     wait "$SERVER_PID" 2>/dev/null || true
@@ -16,6 +104,16 @@ cleanup() {
 }
 trap cleanup EXIT
 
+if [ "$PLAYWRIGHT_MODE" = "container" ]; then
+  PLAYWRIGHT_SERVER_PORT=$(free_port)
+  # --network=host: container needs host loopback to reach gitea.
+  "$CONTAINER_RUNTIME" run --network=host --name "$CONTAINER_NAME" -d --rm --init --workdir /home/pwuser --user pwuser "$PLAYWRIGHT_IMAGE" /bin/sh -c "npx -y playwright@${PLAYWRIGHT_VERSION} run-server --port ${PLAYWRIGHT_SERVER_PORT} --host 0.0.0.0"
+
+  if ! wait_for_container; then
+    exit 1
+  fi
+fi
+
 # Write config file for isolated instance
 mkdir -p "$WORK_DIR/custom/conf"
 cat > "$WORK_DIR/custom/conf/app.ini" <<EOF
@@ -112,4 +210,7 @@ export GITEA_TEST_E2E_PASSWORD
 export GITEA_TEST_E2E_EMAIL
 export GITEA_TEST_E2E_TIMEOUT_FACTOR
 
+if [ "$PLAYWRIGHT_MODE" = "container" ]; then
+  export PW_TEST_CONNECT_WS_ENDPOINT="ws://127.0.0.1:${PLAYWRIGHT_SERVER_PORT}/"
+fi
 pnpm exec playwright test "$@"
diff --git a/tools/test-integration.sh b/tools/test-integration.sh
new file mode 100755
index 00000000000..8e9cac51b1b
--- /dev/null
+++ b/tools/test-integration.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+set -euo pipefail
+
+# Run a compiled *.test binary. When TEST_SHARD is set, enumerate top-level
+# tests via -test.list and run only the shard's slice; TestMain skips
+# environment setup in -test.list mode. Without TEST_SHARD, runs the binary
+# directly.
+
+BINARY=${1:?usage: $0 BINARY}
+
+if [ -z "${TEST_SHARD:-}" ]; then
+  exec "$BINARY"
+fi
+
+if ! [[ "${TEST_TOTAL_SHARDS:-}" =~ ^[1-9][0-9]*$ ]]; then
+  echo "TEST_TOTAL_SHARDS must be a positive integer, got: ${TEST_TOTAL_SHARDS:-}" >&2
+  exit 2
+fi
+if ! [[ "$TEST_SHARD" =~ ^[1-9][0-9]*$ ]] || [ "$TEST_SHARD" -gt "$TEST_TOTAL_SHARDS" ]; then
+  echo "TEST_SHARD must be in [1, $TEST_TOTAL_SHARDS], got: $TEST_SHARD" >&2
+  exit 2
+fi
+
+NAMES=$("$BINARY" -test.list='^Test' | LC_ALL=C sort -u | awk -v r=$((TEST_SHARD - 1)) -v t="$TEST_TOTAL_SHARDS" '(NR - 1) % t == r')
+if [ -z "$NAMES" ]; then
+  echo "shard $TEST_SHARD/$TEST_TOTAL_SHARDS has no tests assigned" >&2
+  exit 1
+fi
+PATTERN=$(echo "$NAMES" | paste -sd '|' -)
+echo "Running shard $TEST_SHARD/$TEST_TOTAL_SHARDS ($(echo "$NAMES" | wc -l | tr -d ' ') tests)"
+exec "$BINARY" -test.run "^($PATTERN)\$"
diff --git a/uv.lock b/uv.lock
index 608ec69f7f1..a14f9745a4e 100644
--- a/uv.lock
+++ b/uv.lock
@@ -4,14 +4,14 @@ requires-python = ">=3.10"
 
 [[package]]
 name = "click"
-version = "8.3.2"
+version = "8.3.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/57/75/31212c6bf2503fdf920d87fee5d7a86a2e3bcf444984126f13d8e4016804/click-8.3.2.tar.gz", hash = "sha256:14162b8b3b3550a7d479eafa77dfd3c38d9dc8951f6f69c78913a8f9a7540fd5", size = 302856, upload-time = "2026-04-03T19:14:45.118Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/bb/63/f9e1ea081ce35720d8b92acde70daaedace594dc93b693c869e0d5910718/click-8.3.3.tar.gz", hash = "sha256:398329ad4837b2ff7cbe1dd166a4c0f8900c3ca3a218de04466f38f6497f18a2", size = 328061, upload-time = "2026-04-22T15:11:27.506Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e4/20/71885d8b97d4f3dde17b1fdb92dbd4908b00541c5a3379787137285f602e/click-8.3.2-py3-none-any.whl", hash = "sha256:1924d2c27c5653561cd2cae4548d1406039cb79b858b747cfea24924bbc1616d", size = 108379, upload-time = "2026-04-03T19:14:43.505Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/44/c1221527f6a71a01ec6fbad7fa78f1d50dfa02217385cf0fa3eec7087d59/click-8.3.3-py3-none-any.whl", hash = "sha256:a2bf429bb3033c89fa4936ffb35d5cb471e3719e1f3c8a7c3fff0b8314305613", size = 110502, upload-time = "2026-04-22T15:11:25.044Z" },
 ]
 
 [[package]]
@@ -93,6 +93,7 @@ source = { virtual = "." }
 dev = [
     { name = "djlint" },
     { name = "yamllint" },
+    { name = "zizmor" },
 ]
 
 [package.metadata]
@@ -101,6 +102,7 @@ dev = [
 dev = [
     { name = "djlint", specifier = "==1.36.4" },
     { name = "yamllint", specifier = "==1.38.0" },
+    { name = "zizmor", specifier = "==1.25.2" },
 ]
 
 [[package]]
@@ -127,11 +129,11 @@ wheels = [
 
 [[package]]
 name = "pathspec"
-version = "1.0.4"
+version = "1.1.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/fa/36/e27608899f9b8d4dff0617b2d9ab17ca5608956ca44461ac14ac48b44015/pathspec-1.0.4.tar.gz", hash = "sha256:0210e2ae8a21a9137c0d470578cb0e595af87edaa6ebf12ff176f14a02e0e645", size = 131200, upload-time = "2026-01-27T03:59:46.938Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5a/82/42f767fc1c1143d6fd36efb827202a2d997a375e160a71eb2888a925aac1/pathspec-1.1.1.tar.gz", hash = "sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a", size = 135180, upload-time = "2026-04-27T01:46:08.907Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ef/3c/2c197d226f9ea224a9ab8d197933f9da0ae0aac5b6e0f884e2b8d9c8e9f7/pathspec-1.0.4-py3-none-any.whl", hash = "sha256:fb6ae2fd4e7c921a165808a552060e722767cfa526f99ca5156ed2ce45a5c723", size = 55206, upload-time = "2026-01-27T03:59:45.137Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/d9/7fb5aa316bc299258e68c73ba3bddbc499654a07f151cba08f6153988714/pathspec-1.1.1-py3-none-any.whl", hash = "sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189", size = 57328, upload-time = "2026-04-27T01:46:07.06Z" },
 ]
 
 [[package]]
@@ -415,3 +417,21 @@ sdist = { url = "https://files.pythonhosted.org/packages/28/a0/8fc2d68e132cf918f
 wheels = [
     { url = "https://files.pythonhosted.org/packages/05/92/aed08e68de6e6a3d7c2328ce7388072cd6affc26e2917197430b646aed02/yamllint-1.38.0-py3-none-any.whl", hash = "sha256:fc394a5b3be980a4062607b8fdddc0843f4fa394152b6da21722f5d59013c220", size = 68940, upload-time = "2026-01-13T07:47:51.343Z" },
 ]
+
+[[package]]
+name = "zizmor"
+version = "1.25.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b3/41/8987d546e3101cc76748b2f1b0ccda58e244773ef5124d39e7e749e3d6e4/zizmor-1.25.2.tar.gz", hash = "sha256:f26ffeb16659c8922c7b08203ca5a4f8bf5e1a7e8d190734961c40877cf778ea", size = 517794, upload-time = "2026-05-16T06:28:43.816Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dc/bd/84108a92ccbfda0d28efc11f382997c7a767b58863bf4a550634b8cf0211/zizmor-1.25.2-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:17cc8cfd9d472e8b11945a869c198d25cfdf4a33f36fa7a1f9674099f5fb509d", size = 9115548, upload-time = "2026-05-16T06:28:33.591Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/c0/66453a2553a66286a96ca32d75e3e6bcc94ce7f907cd5f8c2c3fce55315e/zizmor-1.25.2-py3-none-macosx_11_0_arm64.whl", hash = "sha256:d3e301eb4465e2da77857cf01ab4ef0184cf3818e826800b270ab01ae7338977", size = 8665071, upload-time = "2026-05-16T06:28:30.861Z" },
+    { url = "https://files.pythonhosted.org/packages/52/3e/d60939d1cc4907c0d021a7c46362aab5e8045550bb09157d56c070e43568/zizmor-1.25.2-py3-none-manylinux_2_24_aarch64.whl", hash = "sha256:cf64374149b567c9373228b76c8e77a389b4071899f84b82c36ee50fab894e79", size = 8842884, upload-time = "2026-05-16T06:28:26.041Z" },
+    { url = "https://files.pythonhosted.org/packages/46/82/f3e8d9b6d941194f2558591b449c106d46a16ea566b95eccff3a83bf6acc/zizmor-1.25.2-py3-none-manylinux_2_28_armv7l.whl", hash = "sha256:0beba1601be08bd00c9277e6ed4b026e125b26b379d86d6d98eb708409b3050d", size = 8449741, upload-time = "2026-05-16T06:28:45.424Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/13/445bc98acc2c976d6b8f8ca59b9c09f055adb5ffb3445d99af8ff7efcb4f/zizmor-1.25.2-py3-none-manylinux_2_28_x86_64.whl", hash = "sha256:c4246f1344d8dbeffc044d7bb11b131773a7db7eb57d9073c45942dfd3543a1f", size = 9285184, upload-time = "2026-05-16T06:28:39.21Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/78/fc7717c706bde7531b2fde12003994fbc04c47ab4f91aa6ca9b3b24b30fd/zizmor-1.25.2-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:dbb1b5c85b8de8eaa0227c6620f06c8e4fbd0a4da2086e218bc225c0bef0923d", size = 8886579, upload-time = "2026-05-16T06:28:51.384Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/bc/a46f11377cdc145c625d62d88c30fead56f9d29bc31652069a1a0eaed6c2/zizmor-1.25.2-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:d670a1e2f00b3cd56febd145bc1a0b2c4caf1cbe5dad8128721843fa877e2d2e", size = 8413576, upload-time = "2026-05-16T06:28:36.376Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/3b/0fd93b77171c8f229e8e1304eecc9931bf3009f722c57967d545d9f151b6/zizmor-1.25.2-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:b75c84d7387389f95edadbe859fb2aaf0a360c5b080932cc53e92ae1db6f09ef", size = 9378162, upload-time = "2026-05-16T06:28:41.999Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/3f/dcb85fb9a0d87794847f9043f9db9bb4d274cf4b8077604bc13850c8fdb4/zizmor-1.25.2-py3-none-win32.whl", hash = "sha256:aa9f4c43b499c55339c3ef2e885133c5017cd9a18d76d9335541203cfa5ae1e7", size = 7548509, upload-time = "2026-05-16T06:28:28.828Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/81/1cb088098bd53f9b910098b0c19d06dc587acf328a170ef8afd1cd93b482/zizmor-1.25.2-py3-none-win_amd64.whl", hash = "sha256:af55bd9bd119ea8cbce2a7addc3922503019de32c1fe31106d70b3dc77d77908", size = 8609822, upload-time = "2026-05-16T06:28:48.078Z" },
+]
diff --git a/vite.config.ts b/vite.config.ts
index 53717813a10..e077fed6aec 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -267,7 +267,6 @@ export default defineConfig(commonViteOpts({
     manifest: true,
     rolldownOptions: {
       input: {
-        // FIXME: INCORRECT-VITE-MANIFEST-PARSER: the "css importing" logic in backend is wrong
         index: join(import.meta.dirname, 'web_src/js/index.ts'),
         swagger: join(import.meta.dirname, 'web_src/js/swagger.ts'),
         'external-render-frontend': join(import.meta.dirname, 'web_src/js/external-render-frontend.ts'),
diff --git a/web_src/css/base.css b/web_src/css/base.css
index 6724fced7b3..49ddca57a30 100644
--- a/web_src/css/base.css
+++ b/web_src/css/base.css
@@ -305,6 +305,15 @@ a.suppressed:hover {
   color: inherit;
 }
 
+/* keyboard focus ring for interactive elements */
+a:focus-visible,
+button:focus-visible,
+.ui.button:focus-visible,
+[role="button"]:focus-visible {
+  outline: 2px solid var(--color-primary);
+  outline-offset: -2px;
+}
+
 a.silenced:hover {
   text-decoration-line: none;
 }
@@ -341,9 +350,7 @@ a.label,
   width: 16px;
   height: 16px;
   mask-size: cover;
-  -webkit-mask-size: cover;
   mask-image: var(--select-arrows);
-  -webkit-mask-image: var(--select-arrows);
   background: currentcolor;
 }
 
@@ -375,16 +382,6 @@ a.label,
   color: var(--color-text-light-2);
 }
 
-/* styles from removed fomantic transition module */
-.hidden.transition {
-  visibility: hidden;
-  display: none;
-}
-.visible.transition {
-  display: block !important;
-  visibility: visible !important;
-}
-
 .ui.comments .comment .metadata {
   color: var(--color-text-light-2);
 }
@@ -431,11 +428,6 @@ img.ui.avatar,
   margin-top: calc(var(--page-spacing) - 1rem);
 }
 
-.ui.message.flash-message pre {
-  white-space: pre-line;
-  margin: 0;
-}
-
 .ui .header > i + .content {
   padding-left: 0.75rem;
   vertical-align: middle;
@@ -479,10 +471,6 @@ img.ui.avatar,
   color: var(--color-text) !important;
 }
 
-.ui .border {
-  border: 1px solid;
-}
-
 .user-menu > .item {
   width: 100%;
   border-radius: 0 !important;
diff --git a/web_src/css/features/console.css b/web_src/css/features/console.css
index e2d3327cfa5..17f3275aceb 100644
--- a/web_src/css/features/console.css
+++ b/web_src/css/features/console.css
@@ -1,4 +1,5 @@
 /* Based on https://github.com/buildkite/terminal-to-html/blob/697ff23bd8dc48b9d23f11f259f5256dae2455f0/assets/terminal.css */
+/* stylelint-disable scale-unlimited/declaration-strict-value -- terminal ANSI palette uses literal hex values */
 
 .console {
   background: var(--color-console-bg);
diff --git a/web_src/css/features/gitgraph.css b/web_src/css/features/gitgraph.css
index 1e19c826563..575c6bb8f69 100644
--- a/web_src/css/features/gitgraph.css
+++ b/web_src/css/features/gitgraph.css
@@ -84,162 +84,82 @@
   fill: var(--color-secondary-dark-5);
 }
 
+#git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-0 {
+  stroke: var(--color-series-16-0);
+  fill: var(--color-series-16-0);
+}
+
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-1 {
-  stroke: #499a37;
-  fill: #499a37;
+  stroke: var(--color-series-16-1);
+  fill: var(--color-series-16-1);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-2 {
-  stroke: #ce4751;
-  fill: #ce4751;
+  stroke: var(--color-series-16-2);
+  fill: var(--color-series-16-2);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-3 {
-  stroke: #8f9121;
-  fill: #8f9121;
+  stroke: var(--color-series-16-3);
+  fill: var(--color-series-16-3);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-4 {
-  stroke: #ac32a6;
-  fill: #ac32a6;
+  stroke: var(--color-series-16-4);
+  fill: var(--color-series-16-4);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-5 {
-  stroke: #7445e9;
-  fill: #7445e9;
+  stroke: var(--color-series-16-5);
+  fill: var(--color-series-16-5);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-6 {
-  stroke: #c67d28;
-  fill: #c67d28;
+  stroke: var(--color-series-16-6);
+  fill: var(--color-series-16-6);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-7 {
-  stroke: #4db392;
-  fill: #4db392;
+  stroke: var(--color-series-16-7);
+  fill: var(--color-series-16-7);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-8 {
-  stroke: #aa4d30;
-  fill: #aa4d30;
+  stroke: var(--color-series-16-8);
+  fill: var(--color-series-16-8);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-9 {
-  stroke: #2a6f84;
-  fill: #2a6f84;
+  stroke: var(--color-series-16-9);
+  fill: var(--color-series-16-9);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-10 {
-  stroke: #c45327;
-  fill: #c45327;
+  stroke: var(--color-series-16-10);
+  fill: var(--color-series-16-10);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-11 {
-  stroke: #3d965c;
-  fill: #3d965c;
+  stroke: var(--color-series-16-11);
+  fill: var(--color-series-16-11);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-12 {
-  stroke: #792a93;
-  fill: #792a93;
+  stroke: var(--color-series-16-12);
+  fill: var(--color-series-16-12);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-13 {
-  stroke: #439d73;
-  fill: #439d73;
+  stroke: var(--color-series-16-13);
+  fill: var(--color-series-16-13);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-14 {
-  stroke: #103aad;
-  fill: #103aad;
+  stroke: var(--color-series-16-14);
+  fill: var(--color-series-16-14);
 }
 
 #git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-15 {
-  stroke: #982e85;
-  fill: #982e85;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.flow-color-16-0 {
-  stroke: #7db233;
-  fill: #7db233;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-1 {
-  stroke: #5ac144;
-  fill: #5ac144;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-2 {
-  stroke: #ed5a8b;
-  fill: #ed5a8b;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-3 {
-  stroke: #ced049;
-  fill: #ced048;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-4 {
-  stroke: #db61d7;
-  fill: #db62d6;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-5 {
-  stroke: #8455f9;
-  fill: #8455f9;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-6 {
-  stroke: #e6a151;
-  fill: #e6a151;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-7 {
-  stroke: #44daaa;
-  fill: #44daaa;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-8 {
-  stroke: #dd7a5c;
-  fill: #dd7a5c;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-9 {
-  stroke: #38859c;
-  fill: #38859c;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-10 {
-  stroke: #d95520;
-  fill: #d95520;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-11 {
-  stroke: #42ae68;
-  fill: #42ae68;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-12 {
-  stroke: #9126b5;
-  fill: #9126b5;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-13 {
-  stroke: #4ab080;
-  fill: #4ab080;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-14 {
-  stroke: #284fb8;
-  fill: #284fb8;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-15 {
-  stroke: #971c80;
-  fill: #971c80;
-}
-
-#git-graph-container:not(.monochrome) #rel-container .flow-group.highlight.flow-color-16-0 {
-  stroke: #87ca28;
-  fill: #87ca28;
+  stroke: var(--color-series-16-15);
+  fill: var(--color-series-16-15);
 }
diff --git a/web_src/css/font_i18n.css b/web_src/css/font_i18n.css
index 0ac4c83b588..f2c820dd647 100644
--- a/web_src/css/font_i18n.css
+++ b/web_src/css/font_i18n.css
@@ -51,7 +51,7 @@
     local("SourceHanSans-Light"), local("Yu Gothic Regular"),
     local("YuGothic Regular"), local("Droid Sans Japanese"), local("Meiryo"),
     local("MS PGothic");
-  font-weight: 300;
+  font-weight: 300; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -66,7 +66,7 @@
     local("SourceHanSans-Regular"), local("Yu Gothic Medium"),
     local("YuGothic Medium"), local("Droid Sans Japanese"), local("Meiryo"),
     local("MS PGothic");
-  font-weight: 400;
+  font-weight: 400; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -81,7 +81,7 @@
     local("SourceHanSans-Medium"), local("Yu Gothic Medium"),
     local("YuGothic Medium"), local("Droid Sans Japanese"), local("Meiryo"),
     local("MS PGothic");
-  font-weight: 500;
+  font-weight: 500; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -95,7 +95,7 @@
     local("NotoSansCJKJP-Bold"), local("Source Han Sans Bold"),
     local("SourceHanSans-Bold"), local("Yu Gothic Bold"), local("YuGothic Bold"),
     local("Droid Sans Japanese"), local("Meiryo Bold"), local("MS PGothic");
-  font-weight: 600;
+  font-weight: 600; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -124,7 +124,7 @@
     local("NotoSansCJKSC-Light"), local("HiraginoSansGB-W3"),
     local("Hiragino Sans GB W3"), local("Microsoft YaHei Light"),
     local("Heiti SC Light"), local("SimHei");
-  font-weight: 300;
+  font-weight: 300; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -137,7 +137,7 @@
     local("NotoSansCJKSC-Regular"), local("HiraginoSansGB-W3"),
     local("Hiragino Sans GB W3"), local("Microsoft YaHei"),
     local("Heiti SC Light"), local("SimHei");
-  font-weight: 400;
+  font-weight: 400; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -150,7 +150,7 @@
     local("NotoSansCJKSC-Medium"), local("HiraginoSansGB-W3"),
     local("Hiragino Sans GB W3"), local("Microsoft YaHei"),
     local("Heiti SC Light"), local("SimHei");
-  font-weight: 500;
+  font-weight: 500; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -163,7 +163,7 @@
     local("NotoSansCJKSC-Bold"), local("HiraginoSansGB-W6"),
     local("Hiragino Sans GB W6"), local("Microsoft YaHei Bold"),
     local("Heiti SC Medium"), local("SimHei");
-  font-weight: 600;
+  font-weight: 600; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -192,7 +192,7 @@
     local("NotoSansCJKTC-Light"), local("HiraginoSansTC-W3"),
     local("Hiragino Sans TC W3"), local("Microsoft JhengHei Light"),
     local("Heiti TC Light"), local("PMingLiU");
-  font-weight: 300;
+  font-weight: 300; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -205,7 +205,7 @@
     local("NotoSansCJKTC-Regular"), local("HiraginoSansTC-W3"),
     local("Hiragino Sans TC W3"), local("Microsoft JhengHei"),
     local("Heiti TC Light"), local("PMingLiU");
-  font-weight: 400;
+  font-weight: 400; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -218,7 +218,7 @@
     local("NotoSansCJKTC-Medium"), local("HiraginoSansTC-W3"),
     local("Hiragino Sans TC W3"), local("Microsoft JhengHei"),
     local("Heiti TC Light"), local("PMingLiU");
-  font-weight: 500;
+  font-weight: 500; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -231,7 +231,7 @@
     local("NotoSansCJKTC-Bold"), local("HiraginoSansTC-W6"),
     local("Hiragino Sans TC W6"), local("Microsoft JhengHei Bold"),
     local("Heiti TC Medium"), local("PMingLiU");
-  font-weight: 600;
+  font-weight: 600; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -262,7 +262,7 @@
     local("NotoSansCJKTC-Light"), local("HiraginoSansTC-W3"),
     local("Hiragino Sans TC W3"), local("Microsoft JhengHei Light"),
     local("Heiti TC Light"), local("PMingLiU_HKSCS"), local("PMingLiU");
-  font-weight: 300;
+  font-weight: 300; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -277,7 +277,7 @@
     local("NotoSansCJKTC-Regular"), local("HiraginoSansTC-W3"),
     local("Hiragino Sans TC W3"), local("Microsoft JhengHei"),
     local("Heiti TC Light"), local("PMingLiU_HKSCS"), local("PMingLiU");
-  font-weight: 400;
+  font-weight: 400; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -292,7 +292,7 @@
     local("NotoSansCJKTC-Medium"), local("HiraginoSansTC-W3"),
     local("Hiragino Sans TC W3"), local("Microsoft JhengHei"),
     local("Heiti TC Light"), local("PMingLiU_HKSCS"), local("PMingLiU");
-  font-weight: 500;
+  font-weight: 500; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -307,7 +307,7 @@
     local("NotoSansCJKTC-Bold"), local("HiraginoSansTC-W6"),
     local("Hiragino Sans TC W6"), local("Microsoft JhengHei Bold"),
     local("Heiti TC Medium"), local("PMingLiU_HKSCS"), local("PMingLiU");
-  font-weight: 600;
+  font-weight: 600; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -335,7 +335,7 @@
     local("SourceHanSansK-Light"), local("Noto Sans CJK KR Light"),
     local("NotoSansCJKKR-Light"), local("NanumBarunGothic Light"),
     local("Malgun Gothic Semilight"), local("Nanum Gothic"), local("Dotum");
-  font-weight: 300;
+  font-weight: 300; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -347,7 +347,7 @@
     local("SourceHanSansK-Regular"), local("Noto Sans CJK KR Regular"),
     local("NotoSansCJKKR-Regular"), local("NanumBarunGothic"),
     local("Malgun Gothic"), local("Nanum Gothic"), local("Dotum");
-  font-weight: 400;
+  font-weight: 400; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -359,7 +359,7 @@
     local("SourceHanSansK-Medium"), local("Noto Sans CJK KR Medium"),
     local("NotoSansCJKKR-Medium"), local("NanumBarunGothic"),
     local("Malgun Gothic"), local("Nanum Gothic"), local("Dotum");
-  font-weight: 500;
+  font-weight: 500; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
@@ -371,7 +371,7 @@
     local("SourceHanSansK-Bold"), local("Noto Sans CJK KR Bold"),
     local("NotoSansCJKKR-Bold"), local("NanumBarunGothic Bold"),
     local("Malgun Gothic Bold"), local("Nanum Gothic Bold"), local("Dotum");
-  font-weight: 600;
+  font-weight: 600; /* stylelint-disable-line scale-unlimited/declaration-strict-value */
   unicode-range: U+11??, U+2E80-4DBF, U+4E00-9FFF, U+A960-A97F, U+AC00-D7FF,
     U+F900-FAFF, U+FE00-FE6F, U+FF00-FFEF, U+1F2??, U+2????;
 }
diff --git a/web_src/css/index.css b/web_src/css/index.css
index 06f7101af95..89ad63ba1a8 100644
--- a/web_src/css/index.css
+++ b/web_src/css/index.css
@@ -22,8 +22,9 @@
 @import "./modules/tab.css";
 @import "./modules/form.css";
 @import "./modules/dropdown.css";
-@import "./modules/shortcut.css";
+@import "./modules/transition.css";
 
+@import "./modules/shortcut.css";
 @import "./modules/tippy.css";
 @import "./modules/breadcrumb.css";
 @import "./modules/comment.css";
diff --git a/web_src/css/modules/animations.css b/web_src/css/modules/animations.css
index 65d7a90e971..4b68f486667 100644
--- a/web_src/css/modules/animations.css
+++ b/web_src/css/modules/animations.css
@@ -13,6 +13,7 @@
 }
 
 .btn.is-loading > *,
+.btn-octicon.is-loading > *,
 .button.is-loading > * {
   opacity: 0;
 }
@@ -23,7 +24,7 @@
   display: block;
   left: 50%;
   top: 50%;
-  height: min(4em, 66.6%);
+  height: var(--loading-size, min(4em, 66.6%));
   width: fit-content; /* compat: safari - https://bugs.webkit.org/show_bug.cgi?id=267625 */
   aspect-ratio: 1;
   transform: translate(-50%, -50%);
@@ -100,13 +101,6 @@ code.language-math.is-loading::after {
   animation: pulse-1p5 200ms linear;
 }
 
-.ui.modal,
-.ui.dimmer.transition {
-  animation-name: fadein;
-  animation-duration: 100ms;
-  animation-timing-function: ease-in-out;
-}
-
 .rotate-clockwise {
   animation: rotate-clockwise-keyframes 1s linear infinite;
 }
diff --git a/web_src/css/modules/button.css b/web_src/css/modules/button.css
index 9b509f8cd40..f3ece502712 100644
--- a/web_src/css/modules/button.css
+++ b/web_src/css/modules/button.css
@@ -21,10 +21,6 @@
   white-space: nowrap;
 }
 
-.ui.button:focus-visible {
-  box-shadow: inset 0 0 0 2px currentcolor;
-}
-
 @media (max-width: 767.98px) {
   .ui.button {
     white-space: normal;
diff --git a/web_src/css/modules/checkbox.css b/web_src/css/modules/checkbox.css
index f24b91df07b..a90082c1a7a 100644
--- a/web_src/css/modules/checkbox.css
+++ b/web_src/css/modules/checkbox.css
@@ -35,13 +35,9 @@ input[type="checkbox"]::before {
   height: var(--checkbox-size);
   clip-path: inset(var(--checkbox-size) 0 0 0);
   mask-image: var(--checkbox-mask-checked);
-  -webkit-mask-image: var(--checkbox-mask-checked);
   mask-size: 75%;
-  -webkit-mask-size: 75%;
   mask-repeat: no-repeat;
-  -webkit-mask-repeat: no-repeat;
   mask-position: center;
-  -webkit-mask-position: center;
 }
 
 input[type="checkbox"]:checked,
@@ -67,9 +63,7 @@ input[type="radio"]:disabled:checked {
 input[type="checkbox"]:indeterminate::before {
   clip-path: inset(0);
   mask-image: var(--checkbox-mask-indeterminate);
-  -webkit-mask-image: var(--checkbox-mask-indeterminate);
   mask-size: 75%;
-  -webkit-mask-size: 75%;
 }
 
 .ui.checkbox {
@@ -105,6 +99,7 @@ input[type="checkbox"]:indeterminate::before {
   vertical-align: middle;
 }
 
+.ui.disabled.checkbox input,
 .ui.disabled.checkbox label,
 .ui.checkbox input[disabled] ~ label {
   cursor: default !important;
diff --git a/web_src/css/modules/codeeditor.css b/web_src/css/modules/codeeditor.css
index 558ba7a44fc..3212c04c830 100644
--- a/web_src/css/modules/codeeditor.css
+++ b/web_src/css/modules/codeeditor.css
@@ -127,8 +127,6 @@
   background-color: currentcolor;
   mask-image: var(--octicon-x);
   mask-size: cover;
-  -webkit-mask-image: var(--octicon-x);
-  -webkit-mask-size: cover;
   border-radius: var(--border-radius);
 }
 
diff --git a/web_src/css/modules/dropdown.css b/web_src/css/modules/dropdown.css
index 62ca91e61f2..9d3dc48adae 100644
--- a/web_src/css/modules/dropdown.css
+++ b/web_src/css/modules/dropdown.css
@@ -209,7 +209,6 @@ select.ui.dropdown {
   overflow-x: hidden;
   overflow-y: auto;
   backface-visibility: hidden;
-  -webkit-overflow-scrolling: touch;
   border-top-width: 0 !important;
   outline: none;
   margin: 0 -1px;
@@ -379,7 +378,6 @@ select.ui.dropdown {
   overflow-x: hidden;
   overflow-y: auto;
   backface-visibility: hidden;
-  -webkit-overflow-scrolling: touch;
 }
 
 @media only screen and (max-width: 767.98px) {
@@ -653,7 +651,6 @@ select.ui.dropdown {
   overflow-x: hidden;
   overflow-y: auto;
   backface-visibility: hidden;
-  -webkit-overflow-scrolling: touch;
   min-width: 100% !important;
   width: auto !important;
 }
diff --git a/web_src/css/modules/label.css b/web_src/css/modules/label.css
index 29b669fd9b0..fb522fe5281 100644
--- a/web_src/css/modules/label.css
+++ b/web_src/css/modules/label.css
@@ -258,30 +258,37 @@ a.ui.ui.ui.grey.label:hover {
   font-size: 1rem;
 }
 
-/* To let labels break up and wrap across multiple lines (issue title, comment event), use "display: contents here" to apply parent layout.
-If the labels-list itself needs some layouts, use extra classes or "tw" helpers. */
+/* labels-list layout: span.labels-list > a.item > span.ui.label,
+by default, the labels list is rendered as "display: inline",
+it can also be rendered as flex by adding flex-related classes (the general ".item" selector also applies) */
 .labels-list {
-  display: contents;
-  font-size: var(--font-size-label); /* it must match the label font size, otherwise the height mismatches */
+  max-width: 100%; /* for ellipsis */
+  font-size: var(--font-size-label); /* must match the label font size, otherwise the height mismatches */
 }
 
-.labels-list a {
-  display: inline-flex;
+.labels-list > .item {
   max-width: 100%; /* for ellipsis */
 }
 
+.labels-list a:hover {
+  text-decoration: none;
+}
+
 .labels-list .ui.label {
   min-height: 20px;
   padding-top: 0;
   padding-bottom: 0;
 }
 
-.with-labels-list-inline .labels-list .ui.label + .ui.label {
-  margin-left: var(--gap-inline);
+/* to align with different font sizes, these styles need to be written separately */
+#issue-list .labels-list > .item {
+  margin-right: 4px; /* margin-right (not margin-left) keeps wrapped labels left-aligned */
+  vertical-align: 2.5px; /* compensates inline-flex baseline so labels center with text */
 }
 
-.with-labels-list-inline .labels-list .ui.label {
-  line-height: var(--line-height-default);
+.timeline-item .labels-list > .item {
+  margin-right: 4px;
+  vertical-align: 1.5px;
 }
 
 /* Scoped labels with different colors on left and right */
diff --git a/web_src/css/modules/menu.css b/web_src/css/modules/menu.css
index d371fe00e23..458d47fad0f 100644
--- a/web_src/css/modules/menu.css
+++ b/web_src/css/modules/menu.css
@@ -311,6 +311,7 @@
 .ui.vertical.menu .item > .menu {
   margin: 0.5em -1.14285714em 0;
 }
+
 .ui.vertical.menu .menu .item {
   background: none;
   padding: 0.5em 1.33333333em;
diff --git a/web_src/css/modules/message.css b/web_src/css/modules/message.css
index bb0965a077f..61ce04666c2 100644
--- a/web_src/css/modules/message.css
+++ b/web_src/css/modules/message.css
@@ -31,6 +31,11 @@ details.ui.message:not(:has(pre)) summary {
   cursor: text;
 }
 
+.ui.message.flash-message pre {
+  white-space: pre-line;
+  margin: 0;
+}
+
 .ui.message:first-child {
   margin-top: 0;
 }
diff --git a/web_src/css/modules/segment.css b/web_src/css/modules/segment.css
index adb514be599..7bb8a52dc86 100644
--- a/web_src/css/modules/segment.css
+++ b/web_src/css/modules/segment.css
@@ -179,13 +179,8 @@
   margin-bottom: 1rem;
 }
 
-.ui.fitted.segment:not(.horizontally) {
-  padding-top: 0;
-  padding-bottom: 0;
-}
-.ui.fitted.segment:not(.vertically) {
-  padding-left: 0;
-  padding-right: 0;
+.ui.fitted.segment {
+  padding: 0;
 }
 
 .ui.segments .segment,
diff --git a/web_src/css/modules/transition.css b/web_src/css/modules/transition.css
new file mode 100644
index 00000000000..3031c217f7a
--- /dev/null
+++ b/web_src/css/modules/transition.css
@@ -0,0 +1,24 @@
+/* styles for Fomantic transition (toggle): dimmer, modal, dropdown menu */
+
+/* this is the only place using "hidden" and "visible" classes, it can safely work with tailwind without prefix in the future */
+.ui.modal.transition.hidden,
+.ui.dropdown > .menu.transition.hidden {
+  display: none;
+  visibility: hidden;
+}
+
+.ui.modal.transition.visible,
+.ui.dropdown > .menu.transition.visible {
+  display: block;
+  visibility: visible;
+}
+
+/* dimmer uses "active" but not "hidden/visible" classes, no special classes for it here */
+
+/* only modal and dimmer need animation, dropdown menu doesn't */
+.ui.modal.transition,
+.ui.dimmer.transition {
+  animation-name: fadein;
+  animation-duration: 100ms;
+  animation-timing-function: ease-in-out;
+}
diff --git a/web_src/css/repo.css b/web_src/css/repo.css
index 26ef377e623..b47e03b8ce4 100644
--- a/web_src/css/repo.css
+++ b/web_src/css/repo.css
@@ -1,9 +1,9 @@
 .repo-header {
-  margin: 1em 0 0.5em;
+  padding: 1em 0 0.25em;
 }
 
-.repo-header .secondary-info {
-  margin-top: 0.5rem;
+.secondary-nav .secondary-info {
+  margin-top: 0.25em;
   font-size: 12px;
 }
 
@@ -423,28 +423,14 @@ td .commit-summary {
   margin-right: 5px;
 }
 
-.repository.view.issue .comment-list:not(.prevent-before-timeline)::before {
-  display: block;
-  content: "";
-  position: absolute;
-  margin-top: 12px;
-  margin-bottom: 14px;
-  top: 0;
-  bottom: 0;
-  left: 96px;
-  width: 2px;
-  background-color: var(--color-timeline);
-  z-index: -1;
-}
-
-.repository.view.issue .comment-list .timeline {
+.repository.view.issue .comment-list {
   position: relative;
   display: block;
   margin-left: 40px;
   padding-left: 16px;
 }
 
-.repository.view.issue .comment-list .timeline::before { /* ciara */
+.repository.view.issue .comment-list::before {
   display: block;
   content: "";
   position: absolute;
@@ -530,10 +516,8 @@ td .commit-summary {
 }
 
 .repository.view.issue .comment-list .timeline-item .comment-text-line {
-  /* TODO: this "line-height" is not ideal (actually it is abused), many layouts depend on this magic value,
-      for example: alignment of the header arrow and the avatar, view PR commit list left icon layout, dismiss review with reason, etc */
-  line-height: 32px;
   color: var(--color-text-light);
+  flex: 1;
   min-width: 0;
 }
 
@@ -596,31 +580,6 @@ td .commit-summary {
   }
 }
 
-.repository.view.issue .comment-list .comment .merge-section {
-  background-color: var(--color-box-body);
-}
-
-.repository.view.issue .comment-list .comment .merge-section .item-section {
-  display: flex;
-  flex-wrap: wrap;
-  align-items: center;
-  justify-content: space-between;
-  padding: 0;
-  gap: 0.5em;
-}
-
-.repository.view.issue .comment-list .comment .merge-section .divider {
-  margin-left: -1rem;
-  width: calc(100% + 2rem);
-}
-
-.merge-section-info code {
-  border: 1px solid var(--color-light-border);
-  border-radius: var(--border-radius);
-  padding: 2px 4px;
-  background: var(--color-light);
-}
-
 .repository.view.issue .comment-list .comment .no-content {
   color: var(--color-text-light-2);
   font-style: italic;
@@ -685,11 +644,6 @@ td .commit-summary {
   align-items: center;
 }
 
-.repository.view.issue .comment-list .event > .comment-text-line {
-  flex: 1;
-  min-width: 0;
-}
-
 .repository.view.issue .comment-list .event > .detail {
   margin-left: 15px;
   width: 100%;
@@ -1089,7 +1043,7 @@ td .commit-summary {
 /* if the element is for a checkbox, then it should have a padding-left to align to the checkbox's text */
 .repository.settings.branches .branch-protection .ui.checkbox .help,
 .repository.settings.branches .branch-protection .checkbox-sub-item {
-  padding-left: 26px;
+  padding-left: 20px;
 }
 
 .repository.settings.branches .branch-protection .status-check-matched-mark {
@@ -1343,6 +1297,7 @@ td .commit-summary {
   display: flex;
   align-items: center;
   gap: 6px;
+  flex-wrap: wrap;
 }
 
 .comment-header-right {
@@ -1623,6 +1578,7 @@ tbody.commit-list {
 
 #diff-container {
   display: flex;
+  gap: var(--page-spacing);
 }
 
 #diff-file-boxes {
@@ -1869,26 +1825,23 @@ tbody.commit-list {
 }
 
 @media (max-width: 767.98px) {
-  .repository.view.issue .comment-list .timeline,
+  .repository.view.issue .comment-list,
   .repository.view.issue .comment-list .timeline-item {
     margin-left: 0;
   }
-  .repository.view.issue .comment-list .timeline::before {
+  .repository.view.issue .comment-list::before {
     left: 14px;
   }
-  .repository.view.issue .comment-list .timeline .inline-timeline-avatar {
+  .repository.view.issue .comment-list .inline-timeline-avatar {
     display: flex;
     margin-bottom: auto;
     margin-left: 6px;
     margin-right: 2px;
   }
-  .repository.view.issue .comment-list .timeline .comment-header {
-    padding-left: 4px;
-  }
   /* Don't show the general avatar, we show the inline avatar on mobile.
    * And don't show the role labels, there's no place for that. */
-  .repository.view.issue .comment-list .timeline .timeline-avatar,
-  .repository.view.issue .comment-list .timeline .comment-header-right .role-label {
+  .repository.view.issue .comment-list .timeline-avatar,
+  .repository.view.issue .comment-list .comment-header-right .role-label {
     display: none;
   }
   .commit-header h3 {
@@ -1933,46 +1886,16 @@ tbody.commit-list {
   max-height: 240px; /* fit exactly 6 items, commit-status-item.height * 6 */
   overflow-x: hidden;
   transition: max-height .2s;
+  width: 100%;
 }
 
 .commit-status-item {
   height: 40px;
-  padding: 0 10px;
   display: flex;
-  gap: 8px;
+  gap: var(--gap-block);
   align-items: center;
-}
-
-.commit-status-item + .commit-status-item {
-  border-top: 1px solid var(--color-secondary);
-}
-
-.commit-status-item .commit-status {
-  flex-shrink: 0;
-}
-
-.commit-status-item .status-context {
-  color: var(--color-text);
-  flex: 1;
-}
-
-.commit-status-item .status-details {
-  display: flex;
-  align-items: center;
-  justify-content: flex-end;
-  gap: 8px;
-}
-
-@media (max-width: 767.98px) {
-  .commit-status-item .status-details {
-    flex-direction: column;
-    align-items: flex-end;
-    justify-content: center;
-  }
-}
-
-.commit-status-item .status-details > span {
-  padding-right: 0.5em; /* To match the alignment with the "required" label */
+  justify-content: space-between;
+  flex-wrap: wrap;
 }
 
 .username-display {
diff --git a/web_src/css/repo/issue-list.css b/web_src/css/repo/issue-list.css
index 1248984bd2b..1a635f20199 100644
--- a/web_src/css/repo/issue-list.css
+++ b/web_src/css/repo/issue-list.css
@@ -34,6 +34,14 @@
   }
 }
 
+#issue-list .issue-item-title {
+  font-size: 16px;
+  font-weight: var(--font-weight-semibold);
+  color: var(--color-text);
+  text-decoration: none;
+  overflow-wrap: anywhere;
+}
+
 #issue-list .branches {
   display: inline-flex;
 }
diff --git a/web_src/css/repo/reactions.css b/web_src/css/repo/reactions.css
index f7db80fbbcc..d016da73ca8 100644
--- a/web_src/css/repo/reactions.css
+++ b/web_src/css/repo/reactions.css
@@ -5,12 +5,12 @@
 }
 
 .timeline-item .conversation-holder .bottom-reactions {
-  margin: 1em 0 0 36px;
+  margin: 1em 0 0 24px;
   padding-bottom: 8px;
 }
 
 .bottom-reactions .ui.label {
-  padding: 5px 8px;
+  padding: 2px 6px;
   font-weight: var(--font-weight-normal);
 }
 
diff --git a/web_src/css/review.css b/web_src/css/review.css
index f192b0322be..76e98386db9 100644
--- a/web_src/css/review.css
+++ b/web_src/css/review.css
@@ -26,9 +26,7 @@
   height: 14px;
   background-color: var(--color-yellow); /* TODO: maybe it needs a new kind of color, there is no suitable "warning" color in the current palette */
   mask-image: var(--octicon-alert-fill);
-  -webkit-mask-image: var(--octicon-alert-fill);
   mask-size: contain;
-  -webkit-mask-size: contain;
 }
 
 .repository .diff-file-box .code-diff td.lines-escape {
diff --git a/web_src/css/shared/flex-list.css b/web_src/css/shared/flex-list.css
index 93a3a1b3f90..1acaa362e22 100644
--- a/web_src/css/shared/flex-list.css
+++ b/web_src/css/shared/flex-list.css
@@ -9,17 +9,23 @@
   margin: 0;
 }
 
-/* items have dividers between them, the dividers align with items (use parent padding) */
-.flex-divided-list {
-  list-style: none;
+/* items have dividers between them, the dividers align with items */
+.flex-divided-list,
+.flex-divided-list > .item.flex-divided-list {
   display: flex;
   flex-direction: column;
+  align-items: stretch;
+  gap: 0;
 }
 
 .flex-divided-list > .item {
   padding: 10px 0;
 }
 
+.flex-divided-list > .divider {
+  margin: 0;
+}
+
 .flex-divided-list > .item + .item {
   border-top: 1px solid var(--color-secondary);
 }
@@ -68,8 +74,6 @@
   display: inline-flex;
   flex-wrap: wrap;
   align-items: center;
-  /* labels are under effect of this gap here because they are display:contents. Ideally we should make wrapping
-     of labels work without display: contents and set this to a static value again. */
   gap: var(--gap-inline);
   max-width: 100%;
   color: var(--color-text);
@@ -99,21 +103,15 @@
 }
 
 /* special rules to make the list work with existing UI elements */
-.container-segmented > .flex-divided-list > .item {
-  padding-left: 1em;
+.flex-divided-list.items-px-default > .item {
+  padding-left: 1em; /* matches ".ui.segment" padding */
   padding-right: 1em;
 }
 
-.ui.segment.fitted > .flex-divided-list > .item {
-  padding: 1em;
-}
-
-.container-padded > .flex-divided-list > .item:first-child,
 .ui.segment:not(.fitted) > .flex-divided-list > .item:first-child {
   padding-top: 0;
 }
 
-.container-padded > .flex-divided-list > .item:last-child,
 .ui.segment:not(.fitted) > .flex-divided-list > .item:last-child {
   padding-bottom: 0;
 }
@@ -126,7 +124,3 @@
 .flex-divided-list + .divider {
   margin-top: 0;
 }
-
-.container-padded > .flex-divided-list + .divider {
-  margin-top: 10px;
-}
diff --git a/web_src/css/shared/settings.css b/web_src/css/shared/settings.css
index 33f88615e02..fa2ac9c4ef6 100644
--- a/web_src/css/shared/settings.css
+++ b/web_src/css/shared/settings.css
@@ -1,37 +1,53 @@
-details.toggleable-item {
-  user-select: none !important;
-  padding: 0 !important;
+.ui.vertical.menu > details.item {
+  user-select: none;
+  padding: 0;
 }
 
-details.toggleable-item .menu {
-  margin: 4px 0 10px !important;
-}
-
-details.toggleable-item summary {
+.ui.vertical.menu > details.item summary {
   display: flex;
-  justify-content: space-between;
+  justify-content: space-between; /* make the "::after" right-aligned */
   align-items: center;
-  padding: 0.92857143em 1.14285714em;
+  padding: 16px 13px; /* match Fomantic menu item padding */
 }
 
-details.toggleable-item summary::marker, /* Chrome, Edge, Firefox */
-details.toggleable-item summary::-webkit-details-marker /* Safari */ {
+.ui.vertical.menu > details.item > summary::marker, /* Chrome, Edge, Firefox */
+.ui.vertical.menu > details.item > summary::-webkit-details-marker /* Safari */ {
   display: none;
 }
 
-details.toggleable-item summary::after {
+.ui.vertical.menu > details.item > summary::after {
   transition: transform 0.25s ease;
   content: "";
   width: 14px;
   height: 14px;
   mask-size: cover;
-  -webkit-mask-size: cover;
   mask-image: var(--octicon-chevron-right);
-  -webkit-mask-image: var(--octicon-chevron-right);
   background: currentcolor;
   border: 1px solid var(--color-body); /* workaround https://bugzilla.mozilla.org/show_bug.cgi?id=1671784 */
 }
 
-details.toggleable-item[open] summary::after {
+.ui.vertical.menu > details.item[open] > summary::after {
   transform: rotate(90deg);
 }
+
+/* default toggleable details menu: items don't have menu item padding, don't change background color on hover or active */
+.ui.vertical.menu > details.item > .menu {
+  margin: 0 0 10px; /* only need the space between the current details menu and next item */
+}
+
+/* full width toggleable details menu: items have menu item padding, change background color on hover and active */
+.ui.vertical.menu > details.item > .menu.items-full-width {
+  margin: 0;
+}
+
+.ui.vertical.menu > details.item > .menu.items-full-width > .item {
+  padding: 16px 13px; /* match Fomantic menu item padding */
+}
+
+.ui.vertical.menu > details.item > .menu.items-full-width > .item.active {
+  background: var(--color-active);
+}
+
+.ui.vertical.menu > details.item > .menu.items-full-width > .item:hover {
+  background: var(--color-hover); /* ".ui.vertical.menu .menu .item" resets the hover background, so we need to add it again */
+}
diff --git a/web_src/css/swagger-render.css b/web_src/css/swagger-render.css
index 1def667e505..6b6c4105a37 100644
--- a/web_src/css/swagger-render.css
+++ b/web_src/css/swagger-render.css
@@ -1,4 +1,4 @@
-@import "../../node_modules/swagger-ui-dist/swagger-ui.css";
+@import "swagger-ui-dist/swagger-ui.css";
 
 html,
 html body,
diff --git a/web_src/css/themes/theme-gitea-dark.css b/web_src/css/themes/theme-gitea-dark.css
index 188a30cae06..f07d94cc635 100644
--- a/web_src/css/themes/theme-gitea-dark.css
+++ b/web_src/css/themes/theme-gitea-dark.css
@@ -141,6 +141,23 @@ gitea-theme-meta-info {
   --color-ansi-bright-magenta: #d74397;
   --color-ansi-bright-cyan: #00b6ad;
   --color-ansi-bright-white: var(--color-console-fg);
+  /* 16-color series */
+  --color-series-16-0: #7db233;
+  --color-series-16-1: #499a37;
+  --color-series-16-2: #ce4751;
+  --color-series-16-3: #8f9121;
+  --color-series-16-4: #ac32a6;
+  --color-series-16-5: #7445e9;
+  --color-series-16-6: #c67d28;
+  --color-series-16-7: #4db392;
+  --color-series-16-8: #aa4d30;
+  --color-series-16-9: #2a6f84;
+  --color-series-16-10: #c45327;
+  --color-series-16-11: #3d965c;
+  --color-series-16-12: #792a93;
+  --color-series-16-13: #439d73;
+  --color-series-16-14: #103aad;
+  --color-series-16-15: #982e85;
   /* other colors */
   --color-grey: #3d3f44;
   --color-grey-light: #898d96;
diff --git a/web_src/css/themes/theme-gitea-light.css b/web_src/css/themes/theme-gitea-light.css
index fb9b8979da3..1bd7dd08483 100644
--- a/web_src/css/themes/theme-gitea-light.css
+++ b/web_src/css/themes/theme-gitea-light.css
@@ -141,6 +141,23 @@ gitea-theme-meta-info {
   --color-ansi-bright-magenta: #d74397;
   --color-ansi-bright-cyan: #00b6ad;
   --color-ansi-bright-white: var(--color-console-fg);
+  /* 16-color series */
+  --color-series-16-0: #7db233;
+  --color-series-16-1: #499a37;
+  --color-series-16-2: #ce4751;
+  --color-series-16-3: #8f9121;
+  --color-series-16-4: #ac32a6;
+  --color-series-16-5: #7445e9;
+  --color-series-16-6: #c67d28;
+  --color-series-16-7: #4db392;
+  --color-series-16-8: #aa4d30;
+  --color-series-16-9: #2a6f84;
+  --color-series-16-10: #c45327;
+  --color-series-16-11: #3d965c;
+  --color-series-16-12: #792a93;
+  --color-series-16-13: #439d73;
+  --color-series-16-14: #103aad;
+  --color-series-16-15: #982e85;
   /* other colors */
   --color-grey: #697077;
   --color-grey-light: #7c838a;
diff --git a/web_src/fomantic/build/components/search.js b/web_src/fomantic/build/components/search.js
deleted file mode 100644
index 6f2c7ee699e..00000000000
--- a/web_src/fomantic/build/components/search.js
+++ /dev/null
@@ -1,1565 +0,0 @@
-/*!
- * # Fomantic-UI - Search
- * http://github.com/fomantic/Fomantic-UI/
- *
- *
- * Released under the MIT license
- * http://opensource.org/licenses/MIT
- *
- */
-
-;(function ($, window, document, undefined) {
-
-'use strict';
-
-$.isFunction = $.isFunction || function(obj) {
-  return typeof obj === "function" && typeof obj.nodeType !== "number";
-};
-
-window = (typeof window != 'undefined' && window.Math == Math)
-  ? window
-  : (typeof self != 'undefined' && self.Math == Math)
-    ? self
-    : Function('return this')()
-;
-
-$.fn.search = function(parameters) {
-  var
-    $allModules     = $(this),
-    moduleSelector  = $allModules.selector || '',
-
-    time            = new Date().getTime(),
-    performance     = [],
-
-    query           = arguments[0],
-    methodInvoked   = (typeof query == 'string'),
-    queryArguments  = [].slice.call(arguments, 1),
-    returnedValue
-  ;
-  $(this)
-    .each(function() {
-      var
-        settings          = ( $.isPlainObject(parameters) )
-          ? $.extend(true, {}, $.fn.search.settings, parameters)
-          : $.extend({}, $.fn.search.settings),
-
-        className        = settings.className,
-        metadata         = settings.metadata,
-        regExp           = settings.regExp,
-        fields           = settings.fields,
-        selector         = settings.selector,
-        error            = settings.error,
-        namespace        = settings.namespace,
-
-        eventNamespace   = '.' + namespace,
-        moduleNamespace  = namespace + '-module',
-
-        $module          = $(this),
-        $prompt          = $module.find(selector.prompt),
-        $searchButton    = $module.find(selector.searchButton),
-        $results         = $module.find(selector.results),
-        $result          = $module.find(selector.result),
-        $category        = $module.find(selector.category),
-
-        element          = this,
-        instance         = $module.data(moduleNamespace),
-
-        disabledBubbled  = false,
-        resultsDismissed = false,
-
-        module
-      ;
-
-      module = {
-
-        initialize: function() {
-          module.verbose('Initializing module');
-          module.get.settings();
-          module.determine.searchFields();
-          module.bind.events();
-          module.set.type();
-          module.create.results();
-          module.instantiate();
-        },
-        instantiate: function() {
-          module.verbose('Storing instance of module', module);
-          instance = module;
-          $module
-            .data(moduleNamespace, module)
-          ;
-        },
-        destroy: function() {
-          module.verbose('Destroying instance');
-          $module
-            .off(eventNamespace)
-            .removeData(moduleNamespace)
-          ;
-        },
-
-        refresh: function() {
-          module.debug('Refreshing selector cache');
-          $prompt         = $module.find(selector.prompt);
-          $searchButton   = $module.find(selector.searchButton);
-          $category       = $module.find(selector.category);
-          $results        = $module.find(selector.results);
-          $result         = $module.find(selector.result);
-        },
-
-        refreshResults: function() {
-          $results = $module.find(selector.results);
-          $result  = $module.find(selector.result);
-        },
-
-        bind: {
-          events: function() {
-            module.verbose('Binding events to search');
-            if(settings.automatic) {
-              $module
-                .on(module.get.inputEvent() + eventNamespace, selector.prompt, module.event.input)
-              ;
-              $prompt
-                .attr('autocomplete', 'off')
-              ;
-            }
-            $module
-              // prompt
-              .on('focus'     + eventNamespace, selector.prompt, module.event.focus)
-              .on('blur'      + eventNamespace, selector.prompt, module.event.blur)
-              .on('keydown'   + eventNamespace, selector.prompt, module.handleKeyboard)
-              // search button
-              .on('click'     + eventNamespace, selector.searchButton, module.query)
-              // results
-              .on('mousedown' + eventNamespace, selector.results, module.event.result.mousedown)
-              .on('mouseup'   + eventNamespace, selector.results, module.event.result.mouseup)
-              .on('click'     + eventNamespace, selector.result,  module.event.result.click)
-            ;
-          }
-        },
-
-        determine: {
-          searchFields: function() {
-            // this makes sure $.extend does not add specified search fields to default fields
-            // this is the only setting which should not extend defaults
-            if(parameters && parameters.searchFields !== undefined) {
-              settings.searchFields = parameters.searchFields;
-            }
-          }
-        },
-
-        event: {
-          input: function() {
-            if(settings.searchDelay) {
-              clearTimeout(module.timer);
-              module.timer = setTimeout(function() {
-                if(module.is.focused()) {
-                  module.query();
-                }
-              }, settings.searchDelay);
-            }
-            else {
-              module.query();
-            }
-          },
-          focus: function() {
-            module.set.focus();
-            if(settings.searchOnFocus && module.has.minimumCharacters() ) {
-              module.query(function() {
-                if(module.can.show() ) {
-                  module.showResults();
-                }
-              });
-            }
-          },
-          blur: function(event) {
-            var
-              pageLostFocus = (document.activeElement === this),
-              callback      = function() {
-                module.cancel.query();
-                module.remove.focus();
-                module.timer = setTimeout(module.hideResults, settings.hideDelay);
-              }
-            ;
-            if(pageLostFocus) {
-              return;
-            }
-            resultsDismissed = false;
-            if(module.resultsClicked) {
-              module.debug('Determining if user action caused search to close');
-              $module
-                .one('click.close' + eventNamespace, selector.results, function(event) {
-                  if(module.is.inMessage(event) || disabledBubbled) {
-                    $prompt.focus();
-                    return;
-                  }
-                  disabledBubbled = false;
-                  if( !module.is.animating() && !module.is.hidden()) {
-                    callback();
-                  }
-                })
-              ;
-            }
-            else {
-              module.debug('Input blurred without user action, closing results');
-              callback();
-            }
-          },
-          result: {
-            mousedown: function() {
-              module.resultsClicked = true;
-            },
-            mouseup: function() {
-              module.resultsClicked = false;
-            },
-            click: function(event) {
-              module.debug('Search result selected');
-              var
-                $result = $(this),
-                $title  = $result.find(selector.title).eq(0),
-                $link   = $result.is('a[href]')
-                  ? $result
-                  : $result.find('a[href]').eq(0),
-                href    = $link.attr('href')   || false,
-                target  = $link.attr('target') || false,
-                // title is used for result lookup
-                value   = ($title.length > 0)
-                  ? $title.text()
-                  : false,
-                results = module.get.results(),
-                result  = $result.data(metadata.result) || module.get.result(value, results)
-              ;
-              if(value) {
-                module.set.value(value);
-              }
-              if( $.isFunction(settings.onSelect) ) {
-                if(settings.onSelect.call(element, result, results) === false) {
-                  module.debug('Custom onSelect callback cancelled default select action');
-                  disabledBubbled = true;
-                  return;
-                }
-              }
-              module.hideResults();
-              if(href) {
-                event.preventDefault();
-                module.verbose('Opening search link found in result', $link);
-                if(target == '_blank' || event.ctrlKey) {
-                  window.open(href);
-                }
-                else {
-                  window.location.href = (href);
-                }
-              }
-            }
-          }
-        },
-        ensureVisible: function ensureVisible($el) {
-          var elTop, elBottom, resultsScrollTop, resultsHeight;
-
-          elTop = $el.position().top;
-          elBottom = elTop + $el.outerHeight(true);
-
-          resultsScrollTop = $results.scrollTop();
-          resultsHeight = $results.height()
-            parseInt($results.css('paddingTop'), 0) +
-            parseInt($results.css('paddingBottom'), 0);
-            
-          if (elTop < 0) {
-            $results.scrollTop(resultsScrollTop + elTop);
-          }
-
-          else if (resultsHeight < elBottom) {
-            $results.scrollTop(resultsScrollTop + (elBottom - resultsHeight));
-          }
-        },
-        handleKeyboard: function(event) {
-          var
-            // force selector refresh
-            $result         = $module.find(selector.result),
-            $category       = $module.find(selector.category),
-            $activeResult   = $result.filter('.' + className.active),
-            currentIndex    = $result.index( $activeResult ),
-            resultSize      = $result.length,
-            hasActiveResult = $activeResult.length > 0,
-
-            keyCode         = event.which,
-            keys            = {
-              backspace : 8,
-              enter     : 13,
-              escape    : 27,
-              upArrow   : 38,
-              downArrow : 40
-            },
-            newIndex
-          ;
-          // search shortcuts
-          if(keyCode == keys.escape) {
-            module.verbose('Escape key pressed, blurring search field');
-            module.hideResults();
-            resultsDismissed = true;
-          }
-          if( module.is.visible() ) {
-            if(keyCode == keys.enter) {
-              module.verbose('Enter key pressed, selecting active result');
-              if( $result.filter('.' + className.active).length > 0 ) {
-                module.event.result.click.call($result.filter('.' + className.active), event);
-                event.preventDefault();
-                return false;
-              }
-            }
-            else if(keyCode == keys.upArrow && hasActiveResult) {
-              module.verbose('Up key pressed, changing active result');
-              newIndex = (currentIndex - 1 < 0)
-                ? currentIndex
-                : currentIndex - 1
-              ;
-              $category
-                .removeClass(className.active)
-              ;
-              $result
-                .removeClass(className.active)
-                .eq(newIndex)
-                  .addClass(className.active)
-                  .closest($category)
-                    .addClass(className.active)
-              ;
-              module.ensureVisible($result.eq(newIndex));
-              event.preventDefault();
-            }
-            else if(keyCode == keys.downArrow) {
-              module.verbose('Down key pressed, changing active result');
-              newIndex = (currentIndex + 1 >= resultSize)
-                ? currentIndex
-                : currentIndex + 1
-              ;
-              $category
-                .removeClass(className.active)
-              ;
-              $result
-                .removeClass(className.active)
-                .eq(newIndex)
-                  .addClass(className.active)
-                  .closest($category)
-                    .addClass(className.active)
-              ;
-              module.ensureVisible($result.eq(newIndex));
-              event.preventDefault();
-            }
-          }
-          else {
-            // query shortcuts
-            if(keyCode == keys.enter) {
-              module.verbose('Enter key pressed, executing query');
-              module.query();
-              module.set.buttonPressed();
-              $prompt.one('keyup', module.remove.buttonFocus);
-            }
-          }
-        },
-
-        setup: {
-          api: function(searchTerm, callback) {
-            var
-              apiSettings = {
-                debug             : settings.debug,
-                on                : false,
-                cache             : settings.cache,
-                action            : 'search',
-                urlData           : {
-                  query : searchTerm
-                },
-                onSuccess         : function(response) {
-                  module.parse.response.call(element, response, searchTerm);
-                  callback();
-                },
-                onFailure         : function() {
-                  module.displayMessage(error.serverError);
-                  callback();
-                },
-                onAbort : function(response) {
-                },
-                onError           : module.error
-              }
-            ;
-            $.extend(true, apiSettings, settings.apiSettings);
-            module.verbose('Setting up API request', apiSettings);
-            $module.api(apiSettings);
-          }
-        },
-
-        can: {
-          useAPI: function() {
-            return $.fn.api !== undefined;
-          },
-          show: function() {
-            return module.is.focused() && !module.is.visible() && !module.is.empty();
-          },
-          transition: function() {
-            return settings.transition && $.fn.transition !== undefined && $module.transition('is supported');
-          }
-        },
-
-        is: {
-          animating: function() {
-            return $results.hasClass(className.animating);
-          },
-          hidden: function() {
-            return $results.hasClass(className.hidden);
-          },
-          inMessage: function(event) {
-            if(!event.target) {
-              return;
-            }
-            var
-              $target = $(event.target),
-              isInDOM = $.contains(document.documentElement, event.target)
-            ;
-            return (isInDOM && $target.closest(selector.message).length > 0);
-          },
-          empty: function() {
-            return ($results.html() === '');
-          },
-          visible: function() {
-            return ($results.filter(':visible').length > 0);
-          },
-          focused: function() {
-            return ($prompt.filter(':focus').length > 0);
-          }
-        },
-
-        get: {
-          settings: function() {
-            if($.isPlainObject(parameters) && parameters.searchFullText) {
-              settings.fullTextSearch = parameters.searchFullText;
-              module.error(settings.error.oldSearchSyntax, element);
-            }
-            if (settings.ignoreDiacritics && !String.prototype.normalize) {
-              settings.ignoreDiacritics = false;
-              module.error(error.noNormalize, element);
-            }
-          },
-          inputEvent: function() {
-            var
-              prompt = $prompt[0],
-              inputEvent   = (prompt !== undefined && prompt.oninput !== undefined)
-                ? 'input'
-                : (prompt !== undefined && prompt.onpropertychange !== undefined)
-                  ? 'propertychange'
-                  : 'keyup'
-            ;
-            return inputEvent;
-          },
-          value: function() {
-            return $prompt.val();
-          },
-          results: function() {
-            var
-              results = $module.data(metadata.results)
-            ;
-            return results;
-          },
-          result: function(value, results) {
-            var
-              result       = false
-            ;
-            value = (value !== undefined)
-              ? value
-              : module.get.value()
-            ;
-            results = (results !== undefined)
-              ? results
-              : module.get.results()
-            ;
-            if(settings.type === 'category') {
-              module.debug('Finding result that matches', value);
-              $.each(results, function(index, category) {
-                if(Array.isArray(category.results)) {
-                  result = module.search.object(value, category.results)[0];
-                  // don't continue searching if a result is found
-                  if(result) {
-                    return false;
-                  }
-                }
-              });
-            }
-            else {
-              module.debug('Finding result in results object', value);
-              result = module.search.object(value, results)[0];
-            }
-            return result || false;
-          },
-        },
-
-        select: {
-          firstResult: function() {
-            module.verbose('Selecting first result');
-            $result.first().addClass(className.active);
-          }
-        },
-
-        set: {
-          focus: function() {
-            $module.addClass(className.focus);
-          },
-          loading: function() {
-            $module.addClass(className.loading);
-          },
-          value: function(value) {
-            module.verbose('Setting search input value', value);
-            $prompt
-              .val(value)
-            ;
-          },
-          type: function(type) {
-            type = type || settings.type;
-            if(settings.type == 'category') {
-              $module.addClass(settings.type);
-            }
-          },
-          buttonPressed: function() {
-            $searchButton.addClass(className.pressed);
-          }
-        },
-
-        remove: {
-          loading: function() {
-            $module.removeClass(className.loading);
-          },
-          focus: function() {
-            $module.removeClass(className.focus);
-          },
-          buttonPressed: function() {
-            $searchButton.removeClass(className.pressed);
-          },
-          diacritics: function(text) {
-            return settings.ignoreDiacritics ?  text.normalize('NFD').replace(/[\u0300-\u036f]/g, '') : text;
-          }
-        },
-
-        query: function(callback) {
-          callback = $.isFunction(callback)
-            ? callback
-            : function(){}
-          ;
-          var
-            searchTerm = module.get.value(),
-            cache = module.read.cache(searchTerm)
-          ;
-          callback = callback || function() {};
-          if( module.has.minimumCharacters() )  {
-            if(cache) {
-              module.debug('Reading result from cache', searchTerm);
-              module.save.results(cache.results);
-              module.addResults(cache.html);
-              module.inject.id(cache.results);
-              callback();
-            }
-            else {
-              module.debug('Querying for', searchTerm);
-              if($.isPlainObject(settings.source) || Array.isArray(settings.source)) {
-                module.search.local(searchTerm);
-                callback();
-              }
-              else if( module.can.useAPI() ) {
-                module.search.remote(searchTerm, callback);
-              }
-              else {
-                module.error(error.source);
-                callback();
-              }
-            }
-            settings.onSearchQuery.call(element, searchTerm);
-          }
-          else {
-            module.hideResults();
-          }
-        },
-
-        search: {
-          local: function(searchTerm) {
-            var
-              results = module.search.object(searchTerm, settings.source),
-              searchHTML
-            ;
-            module.set.loading();
-            module.save.results(results);
-            module.debug('Returned full local search results', results);
-            if(settings.maxResults > 0) {
-              module.debug('Using specified max results', results);
-              results = results.slice(0, settings.maxResults);
-            }
-            if(settings.type == 'category') {
-              results = module.create.categoryResults(results);
-            }
-            searchHTML = module.generateResults({
-              results: results
-            });
-            module.remove.loading();
-            module.addResults(searchHTML);
-            module.inject.id(results);
-            module.write.cache(searchTerm, {
-              html    : searchHTML,
-              results : results
-            });
-          },
-          remote: function(searchTerm, callback) {
-            callback = $.isFunction(callback)
-              ? callback
-              : function(){}
-            ;
-            if($module.api('is loading')) {
-              $module.api('abort');
-            }
-            module.setup.api(searchTerm, callback);
-            $module
-              .api('query')
-            ;
-          },
-          object: function(searchTerm, source, searchFields) {
-            searchTerm = module.remove.diacritics(String(searchTerm));
-            var
-              results      = [],
-              exactResults = [],
-              fuzzyResults = [],
-              searchExp    = searchTerm.replace(regExp.escape, '\\$&'),
-              matchRegExp  = new RegExp(regExp.beginsWith + searchExp, 'i'),
-
-              // avoid duplicates when pushing results
-              addResult = function(array, result) {
-                var
-                  notResult      = ($.inArray(result, results) == -1),
-                  notFuzzyResult = ($.inArray(result, fuzzyResults) == -1),
-                  notExactResults = ($.inArray(result, exactResults) == -1)
-                ;
-                if(notResult && notFuzzyResult && notExactResults) {
-                  array.push(result);
-                }
-              }
-            ;
-            source = source || settings.source;
-            searchFields = (searchFields !== undefined)
-              ? searchFields
-              : settings.searchFields
-            ;
-
-            // search fields should be array to loop correctly
-            if(!Array.isArray(searchFields)) {
-              searchFields = [searchFields];
-            }
-
-            // exit conditions if no source
-            if(source === undefined || source === false) {
-              module.error(error.source);
-              return [];
-            }
-            // iterate through search fields looking for matches
-            $.each(searchFields, function(index, field) {
-              $.each(source, function(label, content) {
-                var
-                  fieldExists = (typeof content[field] == 'string') || (typeof content[field] == 'number')
-                ;
-                if(fieldExists) {
-                  var text;
-                  if (typeof content[field] === 'string'){  
-                      text = module.remove.diacritics(content[field]);
-                  } else {
-                      text = content[field].toString(); 
-                  }
-                  if( text.search(matchRegExp) !== -1) {
-                    // content starts with value (first in results)
-                    addResult(results, content);
-                  }
-                  else if(settings.fullTextSearch === 'exact' && module.exactSearch(searchTerm, text) ) {
-                    // content fuzzy matches (last in results)
-                    addResult(exactResults, content);
-                  }
-                  else if(settings.fullTextSearch == true && module.fuzzySearch(searchTerm, text) ) {
-                    // content fuzzy matches (last in results)
-                    addResult(fuzzyResults, content);
-                  }
-                }
-              });
-            });
-            $.merge(exactResults, fuzzyResults);
-            $.merge(results, exactResults);
-            return results;
-          }
-        },
-        exactSearch: function (query, term) {
-          query = query.toLowerCase();
-          term  = term.toLowerCase();
-          return term.indexOf(query) > -1;
-        },
-        fuzzySearch: function(query, term) {
-          var
-            termLength  = term.length,
-            queryLength = query.length
-          ;
-          if(typeof query !== 'string') {
-            return false;
-          }
-          query = query.toLowerCase();
-          term  = term.toLowerCase();
-          if(queryLength > termLength) {
-            return false;
-          }
-          if(queryLength === termLength) {
-            return (query === term);
-          }
-          search: for (var characterIndex = 0, nextCharacterIndex = 0; characterIndex < queryLength; characterIndex++) {
-            var
-              queryCharacter = query.charCodeAt(characterIndex)
-            ;
-            while(nextCharacterIndex < termLength) {
-              if(term.charCodeAt(nextCharacterIndex++) === queryCharacter) {
-                continue search;
-              }
-            }
-            return false;
-          }
-          return true;
-        },
-
-        parse: {
-          response: function(response, searchTerm) {
-            if(Array.isArray(response)){
-                var o={};
-                o[fields.results]=response;
-                response = o;
-            }
-            var
-              searchHTML = module.generateResults(response)
-            ;
-            module.verbose('Parsing server response', response);
-            if(response !== undefined) {
-              if(searchTerm !== undefined && response[fields.results] !== undefined) {
-                module.addResults(searchHTML);
-                module.inject.id(response[fields.results]);
-                module.write.cache(searchTerm, {
-                  html    : searchHTML,
-                  results : response[fields.results]
-                });
-                module.save.results(response[fields.results]);
-              }
-            }
-          }
-        },
-
-        cancel: {
-          query: function() {
-            if( module.can.useAPI() ) {
-              $module.api('abort');
-            }
-          }
-        },
-
-        has: {
-          minimumCharacters: function() {
-            var
-              searchTerm    = module.get.value(),
-              numCharacters = searchTerm.length
-            ;
-            return (numCharacters >= settings.minCharacters);
-          },
-          results: function() {
-            if($results.length === 0) {
-              return false;
-            }
-            var
-              html = $results.html()
-            ;
-            return html != '';
-          }
-        },
-
-        clear: {
-          cache: function(value) {
-            var
-              cache = $module.data(metadata.cache)
-            ;
-            if(!value) {
-              module.debug('Clearing cache', value);
-              $module.removeData(metadata.cache);
-            }
-            else if(value && cache && cache[value]) {
-              module.debug('Removing value from cache', value);
-              delete cache[value];
-              $module.data(metadata.cache, cache);
-            }
-          }
-        },
-
-        read: {
-          cache: function(name) {
-            var
-              cache = $module.data(metadata.cache)
-            ;
-            if(settings.cache) {
-              module.verbose('Checking cache for generated html for query', name);
-              return (typeof cache == 'object') && (cache[name] !== undefined)
-                ? cache[name]
-                : false
-              ;
-            }
-            return false;
-          }
-        },
-
-        create: {
-          categoryResults: function(results) {
-            var
-              categoryResults = {}
-            ;
-            $.each(results, function(index, result) {
-              if(!result.category) {
-                return;
-              }
-              if(categoryResults[result.category] === undefined) {
-                module.verbose('Creating new category of results', result.category);
-                categoryResults[result.category] = {
-                  name    : result.category,
-                  results : [result]
-                };
-              }
-              else {
-                categoryResults[result.category].results.push(result);
-              }
-            });
-            return categoryResults;
-          },
-          id: function(resultIndex, categoryIndex) {
-            var
-              resultID      = (resultIndex + 1), // not zero indexed
-              letterID,
-              id
-            ;
-            if(categoryIndex !== undefined) {
-              // start char code for "A"
-              letterID = String.fromCharCode(97 + categoryIndex);
-              id          = letterID + resultID;
-              module.verbose('Creating category result id', id);
-            }
-            else {
-              id = resultID;
-              module.verbose('Creating result id', id);
-            }
-            return id;
-          },
-          results: function() {
-            if($results.length === 0) {
-              $results = $('<div />')
-                .addClass(className.results)
-                .appendTo($module)
-              ;
-            }
-          }
-        },
-
-        inject: {
-          result: function(result, resultIndex, categoryIndex) {
-            module.verbose('Injecting result into results');
-            var
-              $selectedResult = (categoryIndex !== undefined)
-                ? $results
-                    .children().eq(categoryIndex)
-                      .children(selector.results)
-                        .first()
-                        .children(selector.result)
-                          .eq(resultIndex)
-                : $results
-                    .children(selector.result).eq(resultIndex)
-            ;
-            module.verbose('Injecting results metadata', $selectedResult);
-            $selectedResult
-              .data(metadata.result, result)
-            ;
-          },
-          id: function(results) {
-            module.debug('Injecting unique ids into results');
-            var
-              // since results may be object, we must use counters
-              categoryIndex = 0,
-              resultIndex   = 0
-            ;
-            if(settings.type === 'category') {
-              // iterate through each category result
-              $.each(results, function(index, category) {
-                if(category.results.length > 0){
-                  resultIndex = 0;
-                  $.each(category.results, function(index, result) {
-                    if(result.id === undefined) {
-                      result.id = module.create.id(resultIndex, categoryIndex);
-                    }
-                    module.inject.result(result, resultIndex, categoryIndex);
-                    resultIndex++;
-                  });
-                  categoryIndex++;
-                }
-              });
-            }
-            else {
-              // top level
-              $.each(results, function(index, result) {
-                if(result.id === undefined) {
-                  result.id = module.create.id(resultIndex);
-                }
-                module.inject.result(result, resultIndex);
-                resultIndex++;
-              });
-            }
-            return results;
-          }
-        },
-
-        save: {
-          results: function(results) {
-            module.verbose('Saving current search results to metadata', results);
-            $module.data(metadata.results, results);
-          }
-        },
-
-        write: {
-          cache: function(name, value) {
-            var
-              cache = ($module.data(metadata.cache) !== undefined)
-                ? $module.data(metadata.cache)
-                : {}
-            ;
-            if(settings.cache) {
-              module.verbose('Writing generated html to cache', name, value);
-              cache[name] = value;
-              $module
-                .data(metadata.cache, cache)
-              ;
-            }
-          }
-        },
-
-        addResults: function(html) {
-          if( $.isFunction(settings.onResultsAdd) ) {
-            if( settings.onResultsAdd.call($results, html) === false ) {
-              module.debug('onResultsAdd callback cancelled default action');
-              return false;
-            }
-          }
-          if(html) {
-            $results
-              .html(html)
-            ;
-            module.refreshResults();
-            if(settings.selectFirstResult) {
-              module.select.firstResult();
-            }
-            module.showResults();
-          }
-          else {
-            module.hideResults(function() {
-              $results.empty();
-            });
-          }
-        },
-
-        showResults: function(callback) {
-          callback = $.isFunction(callback)
-            ? callback
-            : function(){}
-          ;
-          if(resultsDismissed) {
-            return;
-          }
-          if(!module.is.visible() && module.has.results()) {
-            if( module.can.transition() ) {
-              module.debug('Showing results with css animations');
-              $results
-                .transition({
-                  animation  : settings.transition + ' in',
-                  debug      : settings.debug,
-                  verbose    : settings.verbose,
-                  duration   : settings.duration,
-                  onShow     : function() {
-                    var $firstResult = $module.find(selector.result).eq(0);
-                    if($firstResult.length > 0) {
-                      module.ensureVisible($firstResult);
-                    }
-                  },
-                  onComplete : function() {
-                    callback();
-                  },
-                  queue      : true
-                })
-              ;
-            }
-            else {
-              module.debug('Showing results with javascript');
-              $results
-                .stop()
-                .fadeIn(settings.duration, settings.easing)
-              ;
-            }
-            settings.onResultsOpen.call($results);
-          }
-        },
-        hideResults: function(callback) {
-          callback = $.isFunction(callback)
-            ? callback
-            : function(){}
-          ;
-          if( module.is.visible() ) {
-            if( module.can.transition() ) {
-              module.debug('Hiding results with css animations');
-              $results
-                .transition({
-                  animation  : settings.transition + ' out',
-                  debug      : settings.debug,
-                  verbose    : settings.verbose,
-                  duration   : settings.duration,
-                  onComplete : function() {
-                    callback();
-                  },
-                  queue      : true
-                })
-              ;
-            }
-            else {
-              module.debug('Hiding results with javascript');
-              $results
-                .stop()
-                .fadeOut(settings.duration, settings.easing)
-              ;
-            }
-            settings.onResultsClose.call($results);
-          }
-        },
-
-        generateResults: function(response) {
-          module.debug('Generating html from response', response);
-          var
-            template       = settings.templates[settings.type],
-            isProperObject = ($.isPlainObject(response[fields.results]) && !$.isEmptyObject(response[fields.results])),
-            isProperArray  = (Array.isArray(response[fields.results]) && response[fields.results].length > 0),
-            html           = ''
-          ;
-          if(isProperObject || isProperArray ) {
-            if(settings.maxResults > 0) {
-              if(isProperObject) {
-                if(settings.type == 'standard') {
-                  module.error(error.maxResults);
-                }
-              }
-              else {
-                response[fields.results] = response[fields.results].slice(0, settings.maxResults);
-              }
-            }
-            if($.isFunction(template)) {
-              html = template(response, fields, settings.preserveHTML);
-            }
-            else {
-              module.error(error.noTemplate, false);
-            }
-          }
-          else if(settings.showNoResults) {
-            html = module.displayMessage(error.noResults, 'empty', error.noResultsHeader);
-          }
-          settings.onResults.call(element, response);
-          return html;
-        },
-
-        displayMessage: function(text, type, header) {
-          type = type || 'standard';
-          module.debug('Displaying message', text, type, header);
-          module.addResults( settings.templates.message(text, type, header) );
-          return settings.templates.message(text, type, header);
-        },
-
-        setting: function(name, value) {
-          if( $.isPlainObject(name) ) {
-            $.extend(true, settings, name);
-          }
-          else if(value !== undefined) {
-            settings[name] = value;
-          }
-          else {
-            return settings[name];
-          }
-        },
-        internal: function(name, value) {
-          if( $.isPlainObject(name) ) {
-            $.extend(true, module, name);
-          }
-          else if(value !== undefined) {
-            module[name] = value;
-          }
-          else {
-            return module[name];
-          }
-        },
-        debug: function() {
-          if(!settings.silent && settings.debug) {
-            if(settings.performance) {
-              module.performance.log(arguments);
-            }
-            else {
-              module.debug = Function.prototype.bind.call(console.info, console, settings.name + ':');
-              module.debug.apply(console, arguments);
-            }
-          }
-        },
-        verbose: function() {
-          if(!settings.silent && settings.verbose && settings.debug) {
-            if(settings.performance) {
-              module.performance.log(arguments);
-            }
-            else {
-              module.verbose = Function.prototype.bind.call(console.info, console, settings.name + ':');
-              module.verbose.apply(console, arguments);
-            }
-          }
-        },
-        error: function() {
-          if(!settings.silent) {
-            module.error = Function.prototype.bind.call(console.error, console, settings.name + ':');
-            module.error.apply(console, arguments);
-          }
-        },
-        performance: {
-          log: function(message) {
-            var
-              currentTime,
-              executionTime,
-              previousTime
-            ;
-            if(settings.performance) {
-              currentTime   = new Date().getTime();
-              previousTime  = time || currentTime;
-              executionTime = currentTime - previousTime;
-              time          = currentTime;
-              performance.push({
-                'Name'           : message[0],
-                'Arguments'      : [].slice.call(message, 1) || '',
-                'Element'        : element,
-                'Execution Time' : executionTime
-              });
-            }
-            clearTimeout(module.performance.timer);
-            module.performance.timer = setTimeout(module.performance.display, 500);
-          },
-          display: function() {
-            var
-              title = settings.name + ':',
-              totalTime = 0
-            ;
-            time = false;
-            clearTimeout(module.performance.timer);
-            $.each(performance, function(index, data) {
-              totalTime += data['Execution Time'];
-            });
-            title += ' ' + totalTime + 'ms';
-            if(moduleSelector) {
-              title += ' \'' + moduleSelector + '\'';
-            }
-            if($allModules.length > 1) {
-              title += ' ' + '(' + $allModules.length + ')';
-            }
-            if( (console.group !== undefined || console.table !== undefined) && performance.length > 0) {
-              console.groupCollapsed(title);
-              if(console.table) {
-                console.table(performance);
-              }
-              else {
-                $.each(performance, function(index, data) {
-                  console.log(data['Name'] + ': ' + data['Execution Time']+'ms');
-                });
-              }
-              console.groupEnd();
-            }
-            performance = [];
-          }
-        },
-        invoke: function(query, passedArguments, context) {
-          var
-            object = instance,
-            maxDepth,
-            found,
-            response
-          ;
-          passedArguments = passedArguments || queryArguments;
-          context         = element         || context;
-          if(typeof query == 'string' && object !== undefined) {
-            query    = query.split(/[\. ]/);
-            maxDepth = query.length - 1;
-            $.each(query, function(depth, value) {
-              var camelCaseValue = (depth != maxDepth)
-                ? value + query[depth + 1].charAt(0).toUpperCase() + query[depth + 1].slice(1)
-                : query
-              ;
-              if( $.isPlainObject( object[camelCaseValue] ) && (depth != maxDepth) ) {
-                object = object[camelCaseValue];
-              }
-              else if( object[camelCaseValue] !== undefined ) {
-                found = object[camelCaseValue];
-                return false;
-              }
-              else if( $.isPlainObject( object[value] ) && (depth != maxDepth) ) {
-                object = object[value];
-              }
-              else if( object[value] !== undefined ) {
-                found = object[value];
-                return false;
-              }
-              else {
-                return false;
-              }
-            });
-          }
-          if( $.isFunction( found ) ) {
-            response = found.apply(context, passedArguments);
-          }
-          else if(found !== undefined) {
-            response = found;
-          }
-          if(Array.isArray(returnedValue)) {
-            returnedValue.push(response);
-          }
-          else if(returnedValue !== undefined) {
-            returnedValue = [returnedValue, response];
-          }
-          else if(response !== undefined) {
-            returnedValue = response;
-          }
-          return found;
-        }
-      };
-      if(methodInvoked) {
-        if(instance === undefined) {
-          module.initialize();
-        }
-        module.invoke(query);
-      }
-      else {
-        if(instance !== undefined) {
-          instance.invoke('destroy');
-        }
-        module.initialize();
-      }
-
-    })
-  ;
-
-  return (returnedValue !== undefined)
-    ? returnedValue
-    : this
-  ;
-};
-
-$.fn.search.settings = {
-
-  name              : 'Search',
-  namespace         : 'search',
-
-  silent            : false,
-  debug             : false,
-  verbose           : false,
-  performance       : true,
-
-  // template to use (specified in settings.templates)
-  type              : 'standard',
-
-  // minimum characters required to search
-  minCharacters     : 1,
-
-  // whether to select first result after searching automatically
-  selectFirstResult : false,
-
-  // API config
-  apiSettings       : false,
-
-  // object to search
-  source            : false,
-
-  // Whether search should query current term on focus
-  searchOnFocus     : true,
-
-  // fields to search
-  searchFields   : [
-    'id',
-    'title',
-    'description'
-  ],
-
-  // field to display in standard results template
-  displayField   : '',
-
-  // search anywhere in value (set to 'exact' to require exact matches
-  fullTextSearch : 'exact',
-
-  // match results also if they contain diacritics of the same base character (for example searching for "a" will also match "á" or "â" or "à", etc...)
-  ignoreDiacritics : false,
-
-  // whether to add events to prompt automatically
-  automatic      : true,
-
-  // delay before hiding menu after blur
-  hideDelay      : 0,
-
-  // delay before searching
-  searchDelay    : 200,
-
-  // maximum results returned from search
-  maxResults     : 7,
-
-  // whether to store lookups in local cache
-  cache          : true,
-
-  // whether no results errors should be shown
-  showNoResults  : true,
-
-  // preserve possible html of resultset values
-  preserveHTML   : true,
-
-  // transition settings
-  transition     : 'scale',
-  duration       : 200,
-  easing         : 'easeOutExpo',
-
-  // callbacks
-  onSelect       : false,
-  onResultsAdd   : false,
-
-  onSearchQuery  : function(query){},
-  onResults      : function(response){},
-
-  onResultsOpen  : function(){},
-  onResultsClose : function(){},
-
-  className: {
-    animating : 'animating',
-    active    : 'active',
-    empty     : 'empty',
-    focus     : 'focus',
-    hidden    : 'hidden',
-    loading   : 'loading',
-    results   : 'results',
-    pressed   : 'down'
-  },
-
-  error : {
-    source          : 'Cannot search. No source used, and Semantic API module was not included',
-    noResultsHeader : 'No Results',
-    noResults       : 'Your search returned no results',
-    logging         : 'Error in debug logging, exiting.',
-    noEndpoint      : 'No search endpoint was specified',
-    noTemplate      : 'A valid template name was not specified.',
-    oldSearchSyntax : 'searchFullText setting has been renamed fullTextSearch for consistency, please adjust your settings.',
-    serverError     : 'There was an issue querying the server.',
-    maxResults      : 'Results must be an array to use maxResults setting',
-    method          : 'The method you called is not defined.',
-    noNormalize     : '"ignoreDiacritics" setting will be ignored. Browser does not support String().normalize(). You may consider including <https://cdn.jsdelivr.net/npm/unorm@1.4.1/lib/unorm.min.js> as a polyfill.'
-  },
-
-  metadata: {
-    cache   : 'cache',
-    results : 'results',
-    result  : 'result'
-  },
-
-  regExp: {
-    escape     : /[\-\[\]\/\{\}\(\)\*\+\?\.\\\^\$\|]/g,
-    beginsWith : '(?:\s|^)'
-  },
-
-  // maps api response attributes to internal representation
-  fields: {
-    categories      : 'results',     // array of categories (category view)
-    categoryName    : 'name',        // name of category (category view)
-    categoryResults : 'results',     // array of results (category view)
-    description     : 'description', // result description
-    image           : 'image',       // result image
-    price           : 'price',       // result price
-    results         : 'results',     // array of results (standard)
-    title           : 'title',       // result title
-    url             : 'url',         // result url
-    action          : 'action',      // "view more" object name
-    actionText      : 'text',        // "view more" text
-    actionURL       : 'url'          // "view more" url
-  },
-
-  selector : {
-    prompt       : '.prompt',
-    searchButton : '.search.button',
-    results      : '.results',
-    message      : '.results > .message',
-    category     : '.category',
-    result       : '.result',
-    title        : '.title, .name'
-  },
-
-  templates: {
-    escape: function(string, preserveHTML) {
-      if (preserveHTML){
-        return string;
-      }
-      var
-        badChars     = /[<>"'`]/g,
-        shouldEscape = /[&<>"'`]/,
-        escape       = {
-          "<": "&lt;",
-          ">": "&gt;",
-          '"': "&quot;",
-          "'": "&#x27;",
-          "`": "&#x60;"
-        },
-        escapedChar  = function(chr) {
-          return escape[chr];
-        }
-      ;
-      if(shouldEscape.test(string)) {
-        string = string.replace(/&(?![a-z0-9#]{1,6};)/, "&amp;");
-        return string.replace(badChars, escapedChar);
-      }
-      return string;
-    },
-    message: function(message, type, header) {
-      var
-        html = ''
-      ;
-      if(message !== undefined && type !== undefined) {
-        html +=  ''
-          + '<div class="message ' + type + '">'
-        ;
-        if(header) {
-          html += ''
-          + '<div class="header">' + header + '</div>'
-          ;
-        }
-        html += ' <div class="description">' + message + '</div>';
-        html += '</div>';
-      }
-      return html;
-    },
-    category: function(response, fields, preserveHTML) {
-      var
-        html = '',
-        escape = $.fn.search.settings.templates.escape
-      ;
-      if(response[fields.categoryResults] !== undefined) {
-
-        // each category
-        $.each(response[fields.categoryResults], function(index, category) {
-          if(category[fields.results] !== undefined && category.results.length > 0) {
-
-            html  += '<div class="category">';
-
-            if(category[fields.categoryName] !== undefined) {
-              html += '<div class="name">' + escape(category[fields.categoryName], preserveHTML) + '</div>';
-            }
-
-            // each item inside category
-            html += '<div class="results">';
-            $.each(category.results, function(index, result) {
-              if(result[fields.url]) {
-                html  += '<a class="result" href="' + result[fields.url].replace(/"/g,"") + '">';
-              }
-              else {
-                html  += '<a class="result">';
-              }
-              if(result[fields.image] !== undefined) {
-                html += ''
-                  + '<div class="image">'
-                  + ' <img src="' + result[fields.image].replace(/"/g,"") + '">'
-                  + '</div>'
-                ;
-              }
-              html += '<div class="content">';
-              if(result[fields.price] !== undefined) {
-                html += '<div class="price">' + escape(result[fields.price], preserveHTML) + '</div>';
-              }
-              if(result[fields.title] !== undefined) {
-                html += '<div class="title">' + escape(result[fields.title], preserveHTML) + '</div>';
-              }
-              if(result[fields.description] !== undefined) {
-                html += '<div class="description">' + escape(result[fields.description], preserveHTML) + '</div>';
-              }
-              html  += ''
-                + '</div>'
-              ;
-              html += '</a>';
-            });
-            html += '</div>';
-            html  += ''
-              + '</div>'
-            ;
-          }
-        });
-        if(response[fields.action]) {
-          if(fields.actionURL === false) {
-            html += ''
-            + '<div class="action">'
-            +   escape(response[fields.action][fields.actionText], preserveHTML)
-            + '</div>';
-          } else {
-            html += ''
-            + '<a href="' + response[fields.action][fields.actionURL].replace(/"/g,"") + '" class="action">'
-            +   escape(response[fields.action][fields.actionText], preserveHTML)
-            + '</a>';
-          }
-        }
-        return html;
-      }
-      return false;
-    },
-    standard: function(response, fields, preserveHTML) {
-      var
-        html = '',
-        escape = $.fn.search.settings.templates.escape
-      ;
-      if(response[fields.results] !== undefined) {
-
-        // each result
-        $.each(response[fields.results], function(index, result) {
-          if(result[fields.url]) {
-            html  += '<a class="result" href="' + result[fields.url].replace(/"/g,"") + '">';
-          }
-          else {
-            html  += '<a class="result">';
-          }
-          if(result[fields.image] !== undefined) {
-            html += ''
-              + '<div class="image">'
-              + ' <img src="' + result[fields.image].replace(/"/g,"") + '">'
-              + '</div>'
-            ;
-          }
-          html += '<div class="content">';
-          if(result[fields.price] !== undefined) {
-            html += '<div class="price">' + escape(result[fields.price], preserveHTML) + '</div>';
-          }
-          if(result[fields.title] !== undefined) {
-            html += '<div class="title">' + escape(result[fields.title], preserveHTML) + '</div>';
-          }
-          if(result[fields.description] !== undefined) {
-            html += '<div class="description">' + escape(result[fields.description], preserveHTML) + '</div>';
-          }
-          html  += ''
-            + '</div>'
-          ;
-          html += '</a>';
-        });
-        if(response[fields.action]) {
-          if(fields.actionURL === false) {
-            html += ''
-            + '<div class="action">'
-            +   escape(response[fields.action][fields.actionText], preserveHTML)
-            + '</div>';
-          } else {
-            html += ''
-            + '<a href="' + response[fields.action][fields.actionURL].replace(/"/g,"") + '" class="action">'
-            +   escape(response[fields.action][fields.actionText], preserveHTML)
-            + '</a>';
-          }
-        }
-        return html;
-      }
-      return false;
-    }
-  }
-};
-
-})( jQuery, window, document );
diff --git a/web_src/fomantic/build/fomantic.js b/web_src/fomantic/build/fomantic.js
index c903fd1633a..8cc8652482b 100644
--- a/web_src/fomantic/build/fomantic.js
+++ b/web_src/fomantic/build/fomantic.js
@@ -1,6 +1,5 @@
 import './components/api.js';
 import './components/dropdown.js';
 import './components/modal.js';
-import './components/search.js';
 
 // Hard-forked from Fomantic UI 2.8.7, patches are commented with "GITEA-PATCH"
diff --git a/web_src/fomantic/theme.config.less b/web_src/fomantic/theme.config.less
index 632ddce07f9..8507c4af9b0 100644
--- a/web_src/fomantic/theme.config.less
+++ b/web_src/fomantic/theme.config.less
@@ -44,7 +44,6 @@
 @progress   : 'default';
 @slider     : 'default';
 @rating     : 'default';
-@search     : 'default';
 @shape      : 'default';
 @sidebar    : 'default';
 @sticky     : 'default';
diff --git a/web_src/js/components/ActionRunJobView.vue b/web_src/js/components/ActionRunJobView.vue
index bce1d079c7e..835518ecb8e 100644
--- a/web_src/js/components/ActionRunJobView.vue
+++ b/web_src/js/components/ActionRunJobView.vue
@@ -1,20 +1,23 @@
 <script setup lang="ts">
-import {nextTick, onBeforeUnmount, onMounted, ref, toRefs, watch} from 'vue';
+import {computed, nextTick, onBeforeUnmount, onMounted, ref, toRefs, watch} from 'vue';
 import {SvgIcon} from '../svg.ts';
-import ActionRunStatus from './ActionRunStatus.vue';
+import ActionStatusIcon from './ActionStatusIcon.vue';
+import WorkflowGraph from './WorkflowGraph.vue';
 import {addDelegatedEventListener, createElementFromAttrs, toggleElem} from '../utils/dom.ts';
-import {formatDatetime} from '../utils/time.ts';
+import {formatDatetime, formatDatetimeISO} from '../utils/time.ts';
 import {POST} from '../modules/fetch.ts';
+import {copyToClipboardWithFeedback} from '../modules/clipboard.ts';
 import type {IntervalId} from '../types.ts';
 import {toggleFullScreen} from '../utils.ts';
 import {localUserSettings} from '../modules/user-settings.ts';
-import type {ActionsArtifact, ActionsRun, ActionsRunStatus} from '../modules/gitea-actions.ts';
+import type {ActionsArtifact, ActionsJob, ActionsRun, ActionsStatus} from '../modules/gitea-actions.ts';
 import {
   type ActionRunViewStore,
+  collectCallerChildJobs,
   createLogLineMessage,
   type LogLine,
   type LogLineCommand,
-  parseLogLineCommand
+  parseLogLineCommand,
 } from './ActionRunView.ts';
 
 function isLogElementInViewport(el: Element, {extraViewPortHeight}={extraViewPortHeight: 0}): boolean {
@@ -26,7 +29,7 @@ function isLogElementInViewport(el: Element, {extraViewPortHeight}={extraViewPor
 type Step = {
   summary: string,
   duration: string,
-  status: ActionsRunStatus,
+  status: ActionsStatus,
 }
 
 type JobStepState = {
@@ -115,6 +118,15 @@ const currentJob = ref<CurrentJob>({
 const stepsContainer = ref<HTMLElement | null>(null);
 const jobStepLogs = ref<Array<StepContainerElement | undefined>>([]);
 
+// Reusable workflow caller view: when the selected job is a caller node, the right pane
+// shows the children list rather than step logs (callers don't run on a runner).
+const selectedJob = computed<ActionsJob | undefined>(() => (run.value.jobs || []).find((it) => it.id === props.jobId));
+const isCallerJob = computed(() => Boolean(selectedJob.value?.isReusableCaller));
+const callerChildJobs = computed<ActionsJob[]>(() => {
+  if (!isCallerJob.value) return [];
+  return collectCallerChildJobs(run.value.jobs || [], props.jobId);
+});
+
 watch(optionAlwaysAutoScroll, () => {
   saveLocaleStorageOptions();
 });
@@ -196,10 +208,25 @@ function beginLogGroup(stepIndex: number, startTime: number, line: LogLine, cmd:
 }
 
 // end a log group
-function endLogGroup(stepIndex: number, startTime: number, line: LogLine, cmd: LogLineCommand) {
+function endLogGroup(stepIndex: number) {
   const el = getJobStepLogsContainer(stepIndex);
   el._stepLogsActiveContainer = undefined;
-  el.append(createLogLine(stepIndex, startTime, line, cmd));
+}
+
+async function copyStepOutput(event: MouseEvent, stepIndex: number) {
+  await copyToClipboardWithFeedback(event.currentTarget as HTMLElement, async () => {
+    const data = await fetchJobData([{step: stepIndex, cursor: null, expanded: true}]);
+    const stepLog = data.logs.stepsLog?.find((s) => s.step === stepIndex);
+    const lines: string[] = [];
+    for (const line of stepLog?.lines ?? []) {
+      const cmd = parseLogLineCommand(line);
+      if (cmd?.name === 'hidden' || cmd?.name === 'endgroup') continue;
+      const ts = formatDatetimeISO(line.timestamp);
+      const msg = createLogLineMessage(line, cmd).textContent ?? '';
+      lines.push(`${ts} ${msg}`);
+    }
+    return lines.join('\n');
+  });
 }
 
 // show/hide the step logs for a step
@@ -217,7 +244,7 @@ function createLogLine(stepIndex: number, startTime: number, line: LogLine, cmd:
     String(line.index),
   );
   const logTimeStamp = createElementFromAttrs('span', {class: 'log-time-stamp'},
-    formatDatetime(new Date(line.timestamp * 1000)), // for "Show timestamps"
+    formatDatetime(line.timestamp * 1000), // for "Show timestamps"
   );
   const logMsg = createLogLineMessage(line, cmd);
   const seconds = Math.floor(line.timestamp - startTime);
@@ -253,7 +280,7 @@ function appendLogs(stepIndex: number, startTime: number, logLines: LogLine[]) {
         beginLogGroup(stepIndex, startTime, line, cmd);
         continue;
       case 'endgroup':
-        endLogGroup(stepIndex, startTime, line, cmd);
+        endLogGroup(stepIndex);
         continue;
     }
     // the active logs container may change during the loop, for example: entering and leaving a group
@@ -262,17 +289,14 @@ function appendLogs(stepIndex: number, startTime: number, logLines: LogLine[]) {
   }
 }
 
-async function fetchJobData(abortController: AbortController): Promise<JobData> {
-  const logCursors = currentJobStepsStates.value.map((it, idx) => {
-    // cursor is used to indicate the last position of the logs
-    // it's only used by backend, frontend just reads it and passes it back, it can be any type.
-    // for example: make cursor=null means the first time to fetch logs, cursor=eof means no more logs, etc
-    return {step: idx, cursor: it.cursor, expanded: it.expanded};
-  });
-  const resp = await POST(props.actionsViewUrl, {
-    signal: abortController.signal,
-    data: {logCursors},
-  });
+// "cursor" is used to indicate the last position of the logs.
+// It's only used by backend, frontend just reads it and passes it back, it can be any type.
+// Frontend knows nothing about its type, never uses its value.
+// For example: backend can make cursor=null means the first time to fetch logs, cursor=1234 for a position, cursor=eof for no more logs, etc.
+type LogCursor = {step: number, cursor: any, expanded: boolean};
+
+async function fetchJobData(logCursors: LogCursor[], signal?: AbortSignal): Promise<JobData> {
+  const resp = await POST(props.actionsViewUrl, {signal, data: {logCursors}});
   return await resp.json();
 }
 
@@ -287,7 +311,8 @@ async function loadJob() {
   const abortController = new AbortController();
   loadingAbortController = abortController;
   try {
-    const runJobResp = await fetchJobData(abortController);
+    const logCursors = currentJobStepsStates.value.map((it, idx) => ({step: idx, cursor: it.cursor, expanded: it.expanded}));
+    const runJobResp = await fetchJobData(logCursors, abortController.signal);
     if (loadingAbortController !== abortController) return;
 
     // FIXME: this logic is quite hacky and dirty, it should be refactored in a better way in the future
@@ -353,11 +378,11 @@ async function loadJob() {
   }
 }
 
-function isDone(status: ActionsRunStatus) {
+function isDone(status: ActionsStatus) {
   return ['success', 'skipped', 'failure', 'cancelled'].includes(status);
 }
 
-function isExpandable(status: ActionsRunStatus) {
+function isExpandable(status: ActionsStatus) {
   return ['success', 'running', 'failure', 'cancelled'].includes(status);
 }
 
@@ -403,16 +428,22 @@ async function hashChangeListener() {
 <template>
   <div class="job-info-header">
     <div class="job-info-header-left gt-ellipsis">
-      <h3 class="job-info-header-title gt-ellipsis">
-        {{ currentJob.title }}
-      </h3>
+      <div class="job-info-header-title-row">
+        <h3 class="job-info-header-title gt-ellipsis">
+          {{ isCallerJob ? selectedJob?.name : currentJob.title }}
+        </h3>
+        <span v-if="isCallerJob && selectedJob?.callUses" class="ui label job-info-header-uses">
+          <span>uses:</span>
+          <span class="gt-ellipsis">{{ selectedJob.callUses }}</span>
+        </span>
+      </div>
       <p class="job-info-header-detail">
-        {{ currentJob.detail }}
+        {{ isCallerJob && selectedJob ? locale.status[selectedJob.status] : currentJob.detail }}
       </p>
     </div>
     <div class="job-info-header-right">
       <div class="ui top right pointing dropdown custom jump item" @click.stop="menuVisible = !menuVisible" @keyup.enter="menuVisible = !menuVisible">
-        <button class="ui button tw-px-3">
+        <button class="btn interact-bg tw-p-2">
           <SvgIcon name="octicon-gear" :size="18"/>
         </button>
         <div class="menu transition action-job-menu" :class="{visible: menuVisible}" v-if="menuVisible" v-cloak>
@@ -446,8 +477,22 @@ async function hashChangeListener() {
       </div>
     </div>
   </div>
+  <!-- Caller (reusable workflow) view: render the direct children's dependency graph,
+       mirroring the run summary's WorkflowGraph but scoped to this caller's subtree.
+       The caller's name + uses path + status all live in job-info-header above. -->
+  <div class="caller-children-container" v-if="isCallerJob">
+    <WorkflowGraph
+      v-if="callerChildJobs.length > 0"
+      :store="store"
+      :jobs="callerChildJobs"
+      :run-link="run.link"
+      :workflow-id="`${run.workflowID}#caller-${props.jobId}`"
+      :locale="locale"
+    />
+  </div>
+
   <!-- always create the node because we have our own event listeners on it, don't use "v-if" -->
-  <div class="job-step-container" ref="stepsContainer" v-show="currentJob.steps.length">
+  <div class="job-step-container" ref="stepsContainer" v-show="!isCallerJob && currentJob.steps.length">
     <div class="job-step-section" v-for="(jobStep, stepIdx) in currentJob.steps" :key="stepIdx">
       <div
         class="job-step-summary"
@@ -460,15 +505,25 @@ async function hashChangeListener() {
         <SvgIcon
           v-if="isDone(run.status) && currentJobStepsStates[stepIdx].expanded && currentJobStepsStates[stepIdx].cursor === null"
           name="gitea-running"
-          class="tw-mr-2 rotate-clockwise"
+          class="rotate-clockwise"
         />
         <SvgIcon
           v-else
-          :name="currentJobStepsStates[stepIdx].expanded ? 'octicon-chevron-down' : 'octicon-chevron-right'"
-          :class="['tw-mr-2', !isExpandable(jobStep.status) && 'tw-invisible']"
+          name="octicon-chevron-right"
+          class="tw-mr-2 step-summary-chevron"
+          :class="{'tw-invisible': !isExpandable(jobStep.status)}"
         />
-        <ActionRunStatus :status="jobStep.status" class="tw-mr-2"/>
+        <ActionStatusIcon :status="jobStep.status" icon-variant="circle-fill"/>
         <span class="step-summary-msg gt-ellipsis">{{ jobStep.summary }}</span>
+        <button
+          v-if="isExpandable(jobStep.status)"
+          class="btn interact-fg step-copy-btn"
+          :aria-label="locale.copyOutput"
+          :data-tooltip-content="locale.copyOutput"
+          @click.stop="copyStepOutput($event, stepIdx)"
+        >
+          <SvgIcon name="octicon-copy" :size="14"/>
+        </button>
         <span class="step-summary-duration">{{ jobStep.duration }}</span>
       </div>
       <!-- the log elements could be a lot, do not use v-if to destroy/reconstruct the DOM,
@@ -523,7 +578,8 @@ async function hashChangeListener() {
   border-radius: 3px;
 }
 
-.job-info-header:has(+ .job-step-container) {
+.job-info-header:has(+ .job-step-container),
+.job-info-header:has(+ .caller-children-container) {
   border-radius: var(--border-radius) var(--border-radius) 0 0;
 }
 
@@ -540,6 +596,29 @@ async function hashChangeListener() {
 
 .job-info-header-left {
   flex: 1;
+  min-width: 0;
+}
+
+.job-info-header-title-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-width: 0;
+}
+
+.job-info-header-uses {
+  display: inline-flex !important;
+  align-items: baseline;
+  gap: 4px;
+  min-width: 0;
+}
+
+.caller-children-container {
+  flex: 1;
+  display: flex;
+  flex-direction: column;
+  border-top: 1px solid var(--color-console-border);
+  color: var(--color-console-fg);
 }
 
 .job-step-container {
@@ -553,6 +632,7 @@ async function hashChangeListener() {
   padding: 5px 10px;
   display: flex;
   align-items: center;
+  gap: 8px;
   border-radius: var(--border-radius);
 }
 
@@ -565,12 +645,32 @@ async function hashChangeListener() {
   background: var(--color-console-hover-bg);
 }
 
+.job-step-container .job-step-summary .step-summary-chevron {
+  transition: transform 0.1s ease;
+}
+
+.job-step-container .job-step-summary.selected .step-summary-chevron {
+  transform: rotate(90deg);
+}
+
 .job-step-container .job-step-summary .step-summary-msg {
   flex: 1;
 }
 
-.job-step-container .job-step-summary .step-summary-duration {
-  margin-left: 16px;
+.job-step-container .job-step-summary .step-copy-btn {
+  visibility: hidden;
+  margin: 0 4px;
+}
+
+.job-step-container .job-step-summary:hover .step-copy-btn,
+.job-step-container .job-step-summary.selected .step-copy-btn {
+  visibility: visible;
+}
+
+@media (hover: none) {
+  .job-step-container .job-step-summary:focus-within .step-copy-btn {
+    visibility: visible;
+  }
 }
 
 .job-step-container .job-step-summary.selected {
@@ -708,13 +808,25 @@ async function hashChangeListener() {
 }
 
 .job-log-group-summary {
+  cursor: pointer;
   position: relative;
+  display: list-item;
+  list-style: disclosure-closed inside;
+  padding-left: 58px; /* line-num gutter (48px) + log-msg margin (10px), so the marker sits in the content column */
+}
+
+.job-log-group[open] > .job-log-group-summary {
+  list-style-type: disclosure-open;
 }
 
 .job-log-group-summary > .job-log-line {
   position: absolute;
   inset: 0;
-  z-index: -1; /* to avoid hiding the triangle of the "details" element */
+  z-index: -1; /* sit behind the disclosure marker */
   overflow: hidden;
 }
+
+.job-log-group-summary > .job-log-line .log-msg {
+  margin-left: 21px;
+}
 </style>
diff --git a/web_src/js/components/ActionRunSummaryView.vue b/web_src/js/components/ActionRunSummaryView.vue
index a50ccaf5b6f..17b7e2802e1 100644
--- a/web_src/js/components/ActionRunSummaryView.vue
+++ b/web_src/js/components/ActionRunSummaryView.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import ActionRunStatus from './ActionRunStatus.vue';
+import ActionStatusIcon from './ActionStatusIcon.vue';
 import WorkflowGraph from './WorkflowGraph.vue';
 import type {ActionRunViewStore} from "./ActionRunView.ts";
 import {computed, onBeforeUnmount, onMounted, toRefs} from "vue";
@@ -18,6 +18,10 @@ const {currentRun: run} = toRefs(props.store.viewData);
 
 const isRerun = computed(() => run.value.runAttempt > 1);
 
+// The summary's dependency graph is the workflow's top-level shape: a reusable caller
+// renders as a single node, its expanded children belong to the caller's own detail page.
+const topLevelJobs = computed(() => (run.value.jobs || []).filter((j) => !j.parentJobID));
+
 const triggerUser = computed(() => {
   const currentAttempt = run.value.attempts.find((attempt) => attempt.current);
   if (currentAttempt) {
@@ -45,20 +49,21 @@ onBeforeUnmount(() => {
           <a v-if="triggerUser.link" class="muted" :href="triggerUser.link">{{ triggerUser.name }}</a>
           <span v-else class="muted">{{ triggerUser.name }}</span>
         </template>
-        <span>•</span> 
+        <span>•</span>
         <relative-time :datetime="run.triggeredAt || ''" prefix=""/>
       </div>
       <div class="flex-text-block">
-        <ActionRunStatus :locale-status="locale.status[run.status]" :status="run.status" :size="16"/>
+        <ActionStatusIcon :locale-status="locale.status[run.status]" :status="run.status" :size="16" icon-variant="circle-fill"/>
         <span>{{ locale.status[run.status] }}</span> • <span>{{ locale.totalDuration }} {{ run.duration || '–' }}</span>
       </div>
     </div>
     <WorkflowGraph
-      v-if="run.jobs.length > 0"
+      v-if="topLevelJobs.length > 0"
       :store="store"
-      :jobs="run.jobs"
+      :jobs="topLevelJobs"
       :run-link="run.link"
       :workflow-id="run.workflowID"
+      :locale="locale"
     />
   </div>
 </template>
diff --git a/web_src/js/components/ActionRunView.test.ts b/web_src/js/components/ActionRunView.test.ts
index 1f972b73c0d..b625b15e717 100644
--- a/web_src/js/components/ActionRunView.test.ts
+++ b/web_src/js/components/ActionRunView.test.ts
@@ -16,6 +16,7 @@ test('LogLineMessage', () => {
     '::warning file=test.js,line=1::foo': '<span class="log-msg log-cmd-warning"><span class="log-msg-label">Warning:</span><span> foo</span></span>',
     '::notice::foo': '<span class="log-msg log-cmd-notice"><span class="log-msg-label">Notice:</span><span> foo</span></span>',
     '::debug::foo': '<span class="log-msg log-cmd-debug"><span class="log-msg-label">Debug:</span><span> foo</span></span>',
+    '##[command] foo': '<span class="log-msg log-cmd-command"> foo</span>',
     '[command] foo': '<span class="log-msg log-cmd-command"> foo</span>',
 
     // hidden is special, it is actually skipped before creating
diff --git a/web_src/js/components/ActionRunView.ts b/web_src/js/components/ActionRunView.ts
index 1bc1844dc1d..e9b929444fd 100644
--- a/web_src/js/components/ActionRunView.ts
+++ b/web_src/js/components/ActionRunView.ts
@@ -1,7 +1,7 @@
 import {createElementFromAttrs} from '../utils/dom.ts';
 import {renderAnsi} from '../render/ansi.ts';
 import {reactive} from 'vue';
-import type {ActionsArtifact, ActionsJob, ActionsRun, ActionsRunStatus} from '../modules/gitea-actions.ts';
+import type {ActionsArtifact, ActionsJob, ActionsRun, ActionsStatus} from '../modules/gitea-actions.ts';
 import type {IntervalId} from '../types.ts';
 import {POST} from '../modules/fetch.ts';
 
@@ -20,6 +20,7 @@ const LogLinePrefixCommandMap: Record<string, LogLineCommandName> = {
   '##[warning]': 'warning',
   '##[notice]': 'notice',
   '##[debug]': 'debug',
+  '##[command]': 'command',
   '[command]': 'command',
 
   // https://github.com/actions/toolkit/blob/master/docs/commands.md
@@ -87,6 +88,28 @@ export function createLogLineMessage(line: LogLine, cmd: LogLineCommand | null)
   return logMsg;
 }
 
+// buildJobsByParentJobID groups jobs by their parentJobID (0 = top level).
+// Useful for rendering the reusable-workflow caller/child tree in the sidebar.
+export function buildJobsByParentJobID(jobs: ActionsJob[]): Map<number, ActionsJob[]> {
+  const childrenByParent = new Map<number, ActionsJob[]>();
+  for (const job of jobs) {
+    const parentID = job.parentJobID || 0;
+    const existing = childrenByParent.get(parentID);
+    if (existing) {
+      existing.push(job);
+    } else {
+      childrenByParent.set(parentID, [job]);
+    }
+  }
+  return childrenByParent;
+}
+
+// collectCallerChildJobs returns the direct children of a caller job.
+export function collectCallerChildJobs(jobs: ActionsJob[], callerJobID: number): ActionsJob[] {
+  if (!callerJobID) return [];
+  return buildJobsByParentJobID(jobs).get(callerJobID) || [];
+}
+
 export function createEmptyActionsRun(): ActionsRun {
   return {
     repoId: 0,
@@ -94,7 +117,7 @@ export function createEmptyActionsRun(): ActionsRun {
     viewLink: '',
     title: '',
     titleHTML: '',
-    status: '' as ActionsRunStatus, // do not show the status before initialized, otherwise it would show an incorrect "error" icon
+    status: '' as ActionsStatus, // do not show the status before initialized, otherwise it would show an incorrect "error" icon
     canCancel: false,
     canApprove: false,
     canRerun: false,
@@ -160,7 +183,7 @@ export function createActionRunViewStore(viewUrl: string) {
     }
   };
 
-  return reactive({
+  return {
     viewData,
 
     async startPollingCurrentRun() {
@@ -177,7 +200,7 @@ export function createActionRunViewStore(viewUrl: string) {
       clearInterval(intervalID);
       intervalID = null;
     },
-  });
+  };
 }
 
 export type ActionRunViewStore = ReturnType<typeof createActionRunViewStore>;
diff --git a/web_src/js/components/ActionRunStatus.vue b/web_src/js/components/ActionStatusIcon.vue
similarity index 58%
rename from web_src/js/components/ActionRunStatus.vue
rename to web_src/js/components/ActionStatusIcon.vue
index 0069c5faf77..12da669ac4d 100644
--- a/web_src/js/components/ActionRunStatus.vue
+++ b/web_src/js/components/ActionStatusIcon.vue
@@ -1,30 +1,33 @@
-<!-- This vue should be kept the same as templates/repo/actions/status.tmpl
-    Please also update the template file above if this vue is modified.
-    action status accepted: success, skipped, waiting, blocked, running, failure, cancelled, unknown
+<!-- Keep in sync with templates/repo/icons/action_status.tmpl.
+    action status accepted: success, skipped, waiting, blocked, running, failure, cancelled, cancelling, unknown.
 -->
 <script lang="ts" setup>
 import {SvgIcon} from '../svg.ts';
 
-withDefaults(defineProps<{
-  status: 'success' | 'skipped' | 'waiting' | 'blocked' | 'running' | 'failure' | 'cancelled' | 'unknown',
+const props = withDefaults(defineProps<{
+  status: 'success' | 'skipped' | 'waiting' | 'blocked' | 'running' | 'failure' | 'cancelled' | 'cancelling' | 'unknown',
   size?: number,
   className?: string,
   localeStatus?: string,
+  iconVariant?: 'circle-fill' | '',
 }>(), {
   size: 16,
   className: '',
   localeStatus: undefined,
+  iconVariant: '',
 });
+const circleFill = props.iconVariant === 'circle-fill';
 </script>
 
 <template>
   <span :data-tooltip-content="localeStatus ?? status" v-if="status">
-    <SvgIcon name="octicon-check-circle-fill" class="tw-text-green" :size="size" :class="className" v-if="status === 'success'"/>
+    <SvgIcon :name="circleFill ? 'octicon-check-circle-fill' : 'octicon-check'" class="tw-text-green" :size="size" :class="className" v-if="status === 'success'"/>
     <SvgIcon name="octicon-skip" class="tw-text-text-light" :size="size" :class="className" v-else-if="status === 'skipped'"/>
     <SvgIcon name="octicon-stop" class="tw-text-text-light" :size="size" :class="className" v-else-if="status === 'cancelled'"/>
     <SvgIcon name="octicon-circle" class="tw-text-text-light" :size="size" :class="className" v-else-if="status === 'waiting'"/>
     <SvgIcon name="octicon-blocked" class="tw-text-yellow" :size="size" :class="className" v-else-if="status === 'blocked'"/>
     <SvgIcon name="gitea-running" class="tw-text-yellow" :size="size" :class="'rotate-clockwise ' + className" v-else-if="status === 'running'"/>
-    <SvgIcon name="octicon-x-circle-fill" class="tw-text-red" :size="size" v-else/><!-- failure, unknown -->
+    <SvgIcon name="octicon-stop" class="tw-text-yellow" :size="size" :class="className" v-else-if="status === 'cancelling'"/>
+    <SvgIcon :name="circleFill ? 'octicon-x-circle-fill' : 'octicon-x'" class="tw-text-red" :size="size" :class="className" v-else/><!-- failure, unknown -->
   </span>
 </template>
diff --git a/web_src/js/components/PullRequestMergeForm.vue b/web_src/js/components/PullRequestMergeForm.vue
index d2835fe163d..95fe0f1beb4 100644
--- a/web_src/js/components/PullRequestMergeForm.vue
+++ b/web_src/js/components/PullRequestMergeForm.vue
@@ -7,6 +7,8 @@ const props = defineProps<{
   mergeFormProps: any, // TODO: this is a huge object, need to be refactored in the future
 }>();
 
+const mergeStyleManuallyMerged = 'manually-merged';
+
 const mergeForm = props.mergeFormProps;
 
 const mergeTitleFieldValue = shallowRef('');
@@ -29,10 +31,17 @@ const showMergeStyleMenu = shallowRef(false);
 const showActionForm = shallowRef(false);
 
 const mergeButtonStyleClass = computed(() => {
+  if (mergeStyle.value === mergeStyleManuallyMerged) return 'red';
   if (mergeForm.allOverridableChecksOk) return 'primary';
   return autoMergeWhenSucceed.value ? 'primary' : 'red';
 });
 
+const mergeSelectStyleClass = computed(() => {
+  if (mergeForm.emptyCommit) return '';
+  if (mergeStyle.value === mergeStyleManuallyMerged) return 'red';
+  return 'primary';
+});
+
 const forceMerge = computed(() => {
   return mergeForm.canMergeNow && !mergeForm.allOverridableChecksOk;
 });
@@ -115,30 +124,32 @@ function clearMergeMessage() {
         </div>
       </template>
 
-      <div class="field" v-if="mergeStyle === 'manually-merged'">
+      <div class="field" v-if="mergeStyle === mergeStyleManuallyMerged">
         <input type="text" name="merge_commit_id" :placeholder="mergeForm.textMergeCommitId">
       </div>
 
-      <button class="ui button" :class="mergeButtonStyleClass" type="submit" name="do" :value="mergeStyle">
-        {{ mergeStyleDetail.textDoMerge }}
-        <template v-if="autoMergeWhenSucceed">
-          {{ mergeForm.textAutoMergeButtonWhenSucceed }}
-        </template>
-      </button>
+      <div class="flex-text-block tw-gap-3">
+        <button class="ui button" :class="mergeButtonStyleClass" type="submit" name="do" :value="mergeStyle">
+          {{ mergeStyleDetail.textDoMerge }}
+          <template v-if="autoMergeWhenSucceed">
+            {{ mergeForm.textAutoMergeButtonWhenSucceed }}
+          </template>
+        </button>
 
-      <button class="ui button merge-cancel" @click="toggleActionForm(false)">
-        {{ mergeForm.textCancel }}
-      </button>
+        <button class="ui button merge-cancel" type="button" @click="toggleActionForm(false)">
+          {{ mergeForm.textCancel }}
+        </button>
 
-      <div class="ui checkbox tw-ml-1" v-if="mergeForm.isPullBranchDeletable">
-        <input name="delete_branch_after_merge" type="checkbox" v-model="deleteBranchAfterMerge" id="delete-branch-after-merge">
-        <label for="delete-branch-after-merge">{{ mergeForm.textDeleteBranch }}</label>
+        <div class="ui checkbox" v-if="mergeForm.isPullBranchDeletable">
+          <input name="delete_branch_after_merge" type="checkbox" v-model="deleteBranchAfterMerge" id="delete-branch-after-merge">
+          <label for="delete-branch-after-merge">{{ mergeForm.textDeleteBranch }}</label>
+        </div>
       </div>
     </form>
 
     <div v-if="!showActionForm" class="tw-flex">
       <!-- the merge button -->
-      <div class="ui buttons merge-button" :class="[mergeForm.emptyCommit ? '' : mergeForm.allOverridableChecksOk ? 'primary' : 'red']" @click="toggleActionForm(true)">
+      <div class="ui buttons merge-button" :class="mergeSelectStyleClass" @click="toggleActionForm(true)">
         <button class="ui button">
           <svg-icon name="octicon-git-merge"/>
           <span class="button-text">
diff --git a/web_src/js/components/RepoActionView.vue b/web_src/js/components/RepoActionView.vue
index 4d20392dacc..dc24a74f6ba 100644
--- a/web_src/js/components/RepoActionView.vue
+++ b/web_src/js/components/RepoActionView.vue
@@ -1,12 +1,12 @@
 <script setup lang="ts">
 import {SvgIcon} from '../svg.ts';
-import ActionRunStatus from './ActionRunStatus.vue';
-import {toRefs} from 'vue';
+import ActionStatusIcon from './ActionStatusIcon.vue';
+import {computed, ref, toRefs} from 'vue';
 import {POST, DELETE} from '../modules/fetch.ts';
 import ActionRunSummaryView from './ActionRunSummaryView.vue';
 import ActionRunJobView from './ActionRunJobView.vue';
-import type {ActionsRunAttempt} from '../modules/gitea-actions.ts';
-import {createActionRunViewStore} from './ActionRunView.ts';
+import type {ActionsJob, ActionsRunAttempt} from '../modules/gitea-actions.ts';
+import {buildJobsByParentJobID, createActionRunViewStore} from './ActionRunView.ts';
 import {buildArtifactTooltipHtml} from './ActionRunArtifacts.ts';
 
 defineOptions({
@@ -23,6 +23,62 @@ const locale = props.locale;
 const store = createActionRunViewStore(props.actionsViewUrl);
 const {currentRun: run, runArtifacts: artifacts} = toRefs(store.viewData);
 
+type JobListItem = {
+  job: ActionsJob;
+  depth: number;
+  hasChildren: boolean;
+};
+
+// Caller jobs default to collapsed. Membership in this set means "user has manually expanded this caller"
+const expandedJobIDs = ref(new Set<number>());
+
+function toggleExpandedJob(jobID: number) {
+  const next = new Set(expandedJobIDs.value);
+  if (next.has(jobID)) {
+    next.delete(jobID);
+  } else {
+    next.add(jobID);
+  }
+  expandedJobIDs.value = next;
+}
+
+// When a child job is currently selected, force-expand the chain of caller ancestors
+const forcedExpandedJobIDs = computed(() => {
+  const expanded = new Set<number>();
+  if (!props.jobId) return expanded;
+  const jobsByID = new Map((run.value.jobs || []).map((job) => [job.id, job]));
+  let cur = jobsByID.get(props.jobId);
+  while (cur?.parentJobID) {
+    expanded.add(cur.parentJobID);
+    cur = jobsByID.get(cur.parentJobID);
+  }
+  return expanded;
+});
+
+function isJobCollapsed(jobID: number) {
+  return !expandedJobIDs.value.has(jobID) && !forcedExpandedJobIDs.value.has(jobID);
+}
+
+const visibleJobListItems = computed<JobListItem[]>(() => {
+  const jobs = [...(run.value.jobs || [])].sort((a, b) => a.id - b.id);
+  const childrenByParent = buildJobsByParentJobID(jobs);
+
+  const result: JobListItem[] = [];
+  const stack: Array<{job: ActionsJob; depth: number}> = [];
+  const top = childrenByParent.get(0) || [];
+  for (let i = top.length - 1; i >= 0; i--) stack.push({job: top[i], depth: 0});
+
+  while (stack.length > 0) {
+    const {job, depth} = stack.pop()!;
+    const children = childrenByParent.get(job.id) || [];
+    const hasChildren = children.length > 0;
+    result.push({job, depth, hasChildren});
+    if (hasChildren && isJobCollapsed(job.id)) continue;
+    for (let i = children.length - 1; i >= 0; i--) stack.push({job: children[i], depth: depth + 1});
+  }
+  return result;
+});
+
 function formatAttemptTitle(attempt: ActionsRunAttempt) {
   return attempt.latest ? `${locale.latestAttempt} #${attempt.attempt}` : `${locale.attempt} #${attempt.attempt}`;
 }
@@ -56,7 +112,7 @@ async function deleteArtifact(name: string) {
     <div class="action-view-header">
       <div class="action-info-summary">
         <div class="action-info-summary-title">
-          <ActionRunStatus :locale-status="locale.status[run.status]" :status="run.status" :size="20"/>
+          <ActionStatusIcon :locale-status="locale.status[run.status]" :status="run.status" :size="20" icon-variant="circle-fill"/>
           <!-- eslint-disable-next-line vue/no-v-html -->
           <h2 class="action-info-summary-title-text" v-html="run.titleHTML"/>
         </div>
@@ -105,7 +161,7 @@ async function deleteArtifact(name: string) {
                 </div>
                 <div class="flex-text-block tw-pl-[20px]">
                   <span class="flex-text-inline tw-flex-shrink-0">
-                    <ActionRunStatus :locale-status="locale.status[attempt.status]" :status="attempt.status" :size="14" class="flex-text-block"/>
+                    <ActionStatusIcon :locale-status="locale.status[attempt.status]" :status="attempt.status" :size="14" class="flex-text-block" icon-variant="circle-fill"/>
                     <span>{{ locale.status[attempt.status] }}</span>
                   </span>
                   <span>•</span>
@@ -142,35 +198,54 @@ async function deleteArtifact(name: string) {
     <div class="action-view-body">
       <div class="action-view-left">
         <!-- summary -->
-        <a class="job-brief-item silenced" :href="run.viewLink" :class="!props.jobId ? 'selected' : ''">
-          <SvgIcon name="octicon-home"/>
-          <span class="gt-ellipsis">{{ locale.summary }}</span>
-        </a>
+        <div class="flex-items-block action-view-sidebar-list">
+          <a class="item silenced" :href="run.viewLink" :class="!props.jobId ? 'selected' : ''">
+            <SvgIcon name="octicon-home"/>
+            <span class="gt-ellipsis">{{ locale.summary }}</span>
+          </a>
+        </div>
 
         <!-- jobs list -->
         <div class="ui divider"/>
         <div class="left-list-header">{{ locale.allJobs }}</div>
-        <!-- unlike other lists, the items have paddings already -->
-        <ul class="ui relaxed list flex-items-block tw-p-0">
-          <li class="item job-brief-item" v-for="job in run.jobs" :key="job.id" :class="props.jobId === job.id ? 'selected' : ''">
-            <a class="tw-contents silenced" :href="job.link">
-              <ActionRunStatus :locale-status="locale.status[job.status]" :status="job.status"/>
-              <span class="tw-flex-1 gt-ellipsis">{{ job.name }}</span>
-              <SvgIcon name="octicon-sync" role="button" :data-tooltip-content="locale.rerun" class="tw-cursor-pointer link-action interact-fg" :data-url="`${run.link}/jobs/${job.id}/rerun`" v-if="job.canRerun"/>
-              <span>{{ job.duration }}</span>
+        <div class="flex-items-block action-view-sidebar-list">
+          <div
+            class="item job-brief-item"
+            :class="{'selected': props.jobId === item.job.id}"
+            :style="{paddingLeft: `${10 + item.depth * 16}px`}"
+            v-for="item in visibleJobListItems"
+            :key="item.job.id"
+          >
+            <a class="tw-contents silenced" :href="item.job.link">
+              <ActionStatusIcon :locale-status="locale.status[item.job.status]" :status="item.job.status" icon-variant="circle-fill"/>
+              <span class="tw-min-w-0 gt-ellipsis">{{ item.job.name }}</span>
+              <SvgIcon name="octicon-sync" role="button" :data-tooltip-content="locale.rerun" class="job-rerun-button tw-cursor-pointer link-action interact-fg" :data-url="`${run.link}/jobs/${item.job.id}/rerun`" v-if="item.job.canRerun"/>
+              <span class="job-duration">{{ item.job.duration }}</span>
             </a>
-          </li>
-        </ul>
+            <button
+              v-if="item.hasChildren"
+              type="button"
+              class="job-brief-toggle"
+              :class="{'collapsed': isJobCollapsed(item.job.id)}"
+              @click="toggleExpandedJob(item.job.id)"
+              :title="isJobCollapsed(item.job.id) ? locale.expandCallerJobs : locale.collapseCallerJobs"
+              :aria-label="isJobCollapsed(item.job.id) ? locale.expandCallerJobs : locale.collapseCallerJobs"
+              :aria-expanded="!isJobCollapsed(item.job.id)"
+            >
+              <SvgIcon name="octicon-chevron-down" :size="14"/>
+            </button>
+          </div>
+        </div>
 
         <!-- artifacts list -->
         <template v-if="artifacts.length > 0">
           <div class="ui divider"/>
           <div class="left-list-header">{{ locale.artifactsTitle }} ({{ artifacts.length }})</div>
-          <ul class="ui relaxed list flex-items-block">
-            <li class="item" v-for="artifact in artifacts" :key="artifact.name">
+          <div class="flex-items-block action-view-sidebar-list">
+            <div class="item" v-for="artifact in artifacts" :key="artifact.name">
               <template v-if="artifact.status !== 'expired'">
                 <a
-                  class="tw-flex-1 flex-text-block muted" target="_blank"
+                  class="tw-flex-1 tw-min-w-0 flex-text-block silenced" target="_blank"
                   :href="buildArtifactLink(artifact.name)"
                   :data-tooltip-content="buildArtifactTooltipHtml(artifact, locale.artifactExpiresAt)"
                   data-tooltip-render="html"
@@ -179,7 +254,7 @@ async function deleteArtifact(name: string) {
                   <SvgIcon name="octicon-file" class="tw-text-text-light"/>
                   <span class="tw-flex-1 gt-ellipsis">{{ artifact.name }}</span>
                 </a>
-                <a v-if="run.canDeleteArtifact" class="muted" @click="deleteArtifact(artifact.name)">
+                <a v-if="run.canDeleteArtifact" class="silenced" @click="deleteArtifact(artifact.name)">
                   <SvgIcon name="octicon-trash"/>
                 </a>
               </template>
@@ -188,21 +263,21 @@ async function deleteArtifact(name: string) {
                 <span class="tw-flex-1 gt-ellipsis">{{ artifact.name }}</span>
                 <span class="ui label tw-flex-shrink-0">{{ locale.artifactExpired }}</span>
               </span>
-            </li>
-          </ul>
+            </div>
+          </div>
         </template>
 
         <!-- run details -->
         <div class="ui divider"/>
         <div class="left-list-header">{{ locale.runDetails }}</div>
-        <ul class="ui relaxed list">
-          <li class="item">
-            <a class="flex-text-block" :href="`${run.link}/workflow`">
+        <div class="flex-items-block action-view-sidebar-list">
+          <div class="item">
+            <a class="flex-text-block silenced" :href="`${run.link}/workflow`">
               <SvgIcon name="octicon-file-code" class="tw-text-text"/>
               <span class="gt-ellipsis">{{ locale.workflowFile }}</span>
             </a>
-          </li>
-        </ul>
+          </div>
+        </div>
       </div>
 
       <div class="action-view-right">
@@ -309,29 +384,72 @@ async function deleteArtifact(name: string) {
   color: var(--color-text-light-2);
 }
 
-.action-view-left .ui.relaxed.list {
+.action-view-sidebar-list {
   margin: var(--gap-block) 0;
-  padding-left: 10px;
 }
 
-.job-brief-item {
+.action-view-sidebar-list:first-child {
+  margin-top: 0;
+}
+
+.action-view-sidebar-list > .item {
   padding: 6px 10px;
   border-radius: var(--border-radius);
-  display: flex;
-  flex-wrap: nowrap;
-  align-items: center;
-  gap: var(--gap-block);
 }
 
-.job-brief-item:hover {
+.action-view-sidebar-list > .item:hover {
   background-color: var(--color-hover);
 }
 
-.job-brief-item.selected {
+.action-view-sidebar-list > .item.selected {
   font-weight: var(--font-weight-bold);
   background-color: var(--color-active);
 }
 
+.job-brief-toggle {
+  border: none;
+  padding: 0;
+  background: transparent;
+  cursor: pointer;
+  color: inherit;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+  /* the icon is always chevron-down; flip to chevron-up when expanded */
+  transition: transform 0.15s ease;
+  /* sit right after the job name; rerun/duration float to the right via auto-margin */
+  order: 1;
+}
+
+.job-brief-toggle:not(.collapsed) {
+  transform: rotate(180deg);
+}
+
+/* push rerun/duration to the right edge; only one is visible at a time (hover swap),
+   the visible one absorbs the free space via auto-margin */
+.action-view-sidebar-list > .item .job-rerun-button,
+.action-view-sidebar-list > .item .job-duration {
+  order: 2;
+  margin-left: auto;
+}
+
+/* the re-run button replaces the duration on hover or job-link focus */
+.action-view-sidebar-list > .item .job-rerun-button {
+  display: none;
+}
+
+.action-view-sidebar-list > .item:hover .job-rerun-button,
+.action-view-sidebar-list > .item:has(a:focus) .job-rerun-button {
+  display: inline-flex;
+}
+
+/* only swap out the duration when a re-run button exists to take its place */
+.action-view-sidebar-list > .item:hover .job-rerun-button ~ .job-duration,
+.action-view-sidebar-list > .item:has(a:focus) .job-rerun-button ~ .job-duration {
+  display: none;
+}
+
 /* ================ */
 /* action view right */
 
diff --git a/web_src/js/components/RepoContributors.vue b/web_src/js/components/RepoContributors.vue
index 3fd34081e04..d4d5190c6e6 100644
--- a/web_src/js/components/RepoContributors.vue
+++ b/web_src/js/components/RepoContributors.vue
@@ -270,7 +270,7 @@ export default defineComponent({
         plugins: {
           title: {
             display: type === 'main',
-            text: 'drag: zoom, shift+drag: pan, double click: reset zoom',
+            text: this.locale.chartZoomHint,
             position: 'top',
             align: 'center',
           },
diff --git a/web_src/js/components/WorkflowGraph.vue b/web_src/js/components/WorkflowGraph.vue
index 260f20f1cfb..27ba960feb6 100644
--- a/web_src/js/components/WorkflowGraph.vue
+++ b/web_src/js/components/WorkflowGraph.vue
@@ -1,17 +1,18 @@
 <script setup lang="ts">
 import {computed, onMounted, onUnmounted, ref, watch} from 'vue';
 import {SvgIcon} from '../svg.ts';
-import ActionRunStatus from './ActionRunStatus.vue';
+import ActionStatusIcon from './ActionStatusIcon.vue';
 import {localUserSettings} from '../modules/user-settings.ts';
 import {isPlainClick} from '../utils/dom.ts';
+import {trN} from '../modules/i18n.ts';
 import {debounce} from 'throttle-debounce';
-import type {ActionsJob, ActionsRunStatus} from '../modules/gitea-actions.ts';
+import type {ActionsJob, ActionsStatus} from '../modules/gitea-actions.ts';
 import type {ActionRunViewStore} from './ActionRunView.ts';
 
 interface JobNode {
   id: number;
   name: string;
-  status: ActionsRunStatus;
+  status: ActionsStatus;
   duration: string;
 
   x: number;
@@ -43,6 +44,7 @@ const props = defineProps<{
   jobs: ActionsJob[];
   runLink: string;
   workflowId: string;
+  locale: Record<string, string>;
 }>()
 
 const settingKeyStates = 'actions-graph-states';
@@ -113,7 +115,8 @@ const jobsWithLayout = computed<JobNode[]>(() => {
     let maxJobsPerLevel = 0;
 
     props.jobs.forEach(job => {
-      const level = levels.get(job.name) || levels.get(job.jobId) || 0;
+      // `?? 0`, not `|| 0`: a root job's level is 0, which `||` would wrongly discard.
+      const level = levels.get(scopedKey(job)) ?? 0;
 
       if (!jobsByLevel[level]) {
         jobsByLevel[level] = [];
@@ -162,75 +165,87 @@ const jobsWithLayout = computed<JobNode[]>(() => {
   }
 });
 
+// scopedKey identifies a job within its reusable-workflow call scope so that the same
+// JobID in different reusable calls does not collide.
+function scopedKey(job: {parentJobID: number; jobId: string}): string {
+  return `${job.parentJobID || 0}:${job.jobId}`;
+}
+
 function buildDirectNeedsMap(jobs: ActionsJob[]): Map<string, string[]> {
-  const directNeedsByJobId = new Map<string, string[]>();
-  const dependentsByJobId = new Map<string, Set<string>>();
+  // The map keys/values are scoped keys, not bare jobIds, so we keep edge construction
+  // accurate when reusable workflows reuse common job names like "build" / "test".
+  const directNeedsByScopedKey = new Map<string, string[]>();
+  const dependentsByScopedKey = new Map<string, Set<string>>();
 
   for (const job of jobs) {
-    const needs = job.needs || [];
-    directNeedsByJobId.set(job.jobId, needs);
+    const fromKey = scopedKey(job);
+    const needKeys = (job.needs || []).map((n) => `${job.parentJobID || 0}:${n}`);
+    directNeedsByScopedKey.set(fromKey, needKeys);
 
-    for (const need of needs) {
-      if (!dependentsByJobId.has(need)) {
-        dependentsByJobId.set(need, new Set());
+    for (const needKey of needKeys) {
+      if (!dependentsByScopedKey.has(needKey)) {
+        dependentsByScopedKey.set(needKey, new Set());
       }
-      dependentsByJobId.get(need)!.add(job.jobId);
+      dependentsByScopedKey.get(needKey)!.add(fromKey);
     }
   }
 
   const reachabilityCache = new Map<string, boolean>();
 
-  function canReach(fromJobId: string, toJobId: string): boolean {
-    const cacheKey = `${fromJobId}->${toJobId}`;
+  function canReach(fromKey: string, toKey: string): boolean {
+    const cacheKey = `${fromKey}->${toKey}`;
     if (reachabilityCache.has(cacheKey)) {
       return reachabilityCache.get(cacheKey)!;
     }
 
     const visited = new Set<string>();
-    const stack = [...(dependentsByJobId.get(fromJobId) || [])];
+    const stack = [...(dependentsByScopedKey.get(fromKey) || [])];
 
     while (stack.length > 0) {
       const current = stack.pop()!;
-      if (current === toJobId) {
+      if (current === toKey) {
         reachabilityCache.set(cacheKey, true);
         return true;
       }
       if (visited.has(current)) continue;
       visited.add(current);
-      stack.push(...(dependentsByJobId.get(current) || []));
+      stack.push(...(dependentsByScopedKey.get(current) || []));
     }
 
     reachabilityCache.set(cacheKey, false);
     return false;
   }
 
-  const reducedNeedsByJobId = new Map<string, string[]>();
-  for (const [jobId, needs] of directNeedsByJobId.entries()) {
-    reducedNeedsByJobId.set(jobId, needs.filter((need) => {
+  const reducedNeedsByScopedKey = new Map<string, string[]>();
+  for (const [fromKey, needs] of directNeedsByScopedKey.entries()) {
+    reducedNeedsByScopedKey.set(fromKey, needs.filter((need) => {
       return !needs.some((otherNeed) => otherNeed !== need && canReach(need, otherNeed));
     }));
   }
 
-  return reducedNeedsByJobId;
+  return reducedNeedsByScopedKey;
 }
 
-const directNeedsByJobId = computed(() => buildDirectNeedsMap(props.jobs));
+const directNeedsByScopedKey = computed(() => buildDirectNeedsMap(props.jobs));
 
 const edges = computed<Edge[]>(() => {
   const edgesList: Edge[] = [];
-  const jobsByJobId = new Map<string, ActionsJob[]>();
+  // Store every job per scoped key, not just one: matrix-expanded jobs share same jobId
+  const jobsByScopedKey = new Map<string, ActionsJob[]>();
 
   for (const job of props.jobs) {
-    if (!jobsByJobId.has(job.jobId)) {
-      jobsByJobId.set(job.jobId, []);
+    const key = scopedKey(job);
+    const existing = jobsByScopedKey.get(key);
+    if (existing) {
+      existing.push(job);
+    } else {
+      jobsByScopedKey.set(key, [job]);
     }
-    jobsByJobId.get(job.jobId)!.push(job);
   }
 
   for (const job of props.jobs) {
-    for (const need of directNeedsByJobId.value.get(job.jobId) || []) {
-      const upstreamJobs = jobsByJobId.get(need) || [];
-      for (const upstreamJob of upstreamJobs) {
+    for (const needKey of directNeedsByScopedKey.value.get(scopedKey(job)) || []) {
+      for (const upstreamJob of jobsByScopedKey.get(needKey) || []) {
         edgesList.push({
           fromId: upstreamJob.id,
           toId: job.id,
@@ -344,6 +359,12 @@ const graphMetrics = computed(() => {
   };
 })
 
+const graphStats = computed(() => [
+  trN(props.jobs.length, props.locale.graphJobsCount1, props.locale.graphJobsCountN),
+  trN(edges.value.length, props.locale.graphDependenciesCount1, props.locale.graphDependenciesCountN),
+  props.locale.graphSuccessRate.replace('%s', graphMetrics.value.successRate),
+].join(' • '))
+
 const nodeHeight = 52;
 const verticalSpacing = 90;
 const margin = 40;
@@ -461,10 +482,11 @@ const nodesWithOutgoingEdge = computed(() => {
 
 
 function computeJobLevels(jobs: ActionsJob[]): Map<string, number> {
-  const jobMap = new Map<string, ActionsJob>()
+  // Scope-aware: each job is keyed by `${parentJobID}:${jobId}` so the same JobID
+  // in different reusable workflow calls does not cross-link in the level graph.
+  const jobMap = new Map<string, ActionsJob>();
   jobs.forEach(job => {
-    jobMap.set(job.name, job);
-    if (job.jobId) jobMap.set(job.jobId, job);
+    jobMap.set(scopedKey(job), job);
   });
 
   const levels = new Map<string, number>();
@@ -472,60 +494,59 @@ function computeJobLevels(jobs: ActionsJob[]): Map<string, number> {
   const recursionStack = new Set<string>();
   const MAX_DEPTH = 100;
 
-  function dfs(jobNameOrId: string, depth: number = 0): number {
+  function dfs(scoped: string, depth: number = 0): number {
     if (depth > MAX_DEPTH) {
-      console.error(`Max recursion depth (${MAX_DEPTH}) reached for: ${jobNameOrId}`);
+      console.error(`Max recursion depth (${MAX_DEPTH}) reached for: ${scoped}`);
       return 0;
     }
 
-    if (recursionStack.has(jobNameOrId)) {
-      console.error(`Cycle detected involving: ${jobNameOrId}`);
+    if (recursionStack.has(scoped)) {
+      console.error(`Cycle detected involving: ${scoped}`);
       return 0;
     }
 
-    if (visited.has(jobNameOrId)) {
-      return levels.get(jobNameOrId) || 0;
+    if (visited.has(scoped)) {
+      return levels.get(scoped) || 0;
     }
 
-    recursionStack.add(jobNameOrId);
-    visited.add(jobNameOrId);
+    recursionStack.add(scoped);
+    visited.add(scoped);
 
-    const job = jobMap.get(jobNameOrId);
+    const job = jobMap.get(scoped);
     if (!job) {
-      recursionStack.delete(jobNameOrId);
+      recursionStack.delete(scoped);
       return 0;
     }
 
     if (!job.needs?.length) {
-      levels.set(job.jobId, 0);
-      recursionStack.delete(jobNameOrId);
+      levels.set(scoped, 0);
+      recursionStack.delete(scoped);
       return 0;
     }
 
     let maxLevel = -1;
     for (const need of job.needs) {
-      const needJob = jobMap.get(need);
+      const needScoped = `${job.parentJobID || 0}:${need}`;
+      const needJob = jobMap.get(needScoped);
       if (!needJob) continue;
 
-      const needLevel = dfs(need, depth + 1);
+      const needLevel = dfs(needScoped, depth + 1);
       maxLevel = Math.max(maxLevel, needLevel);
     }
 
-    const level = maxLevel + 1
-    levels.set(job.name, level);
-    if (job.jobId && job.jobId !== job.name) {
-      levels.set(job.jobId, level);
-    }
+    const level = maxLevel + 1;
+    levels.set(scoped, level);
 
-    recursionStack.delete(jobNameOrId);
+    recursionStack.delete(scoped);
     return level;
   }
 
   jobs.forEach(job => {
-    if (!visited.has(job.name) && !visited.has(job.jobId)) {
-      dfs(job.name);
+    const sk = scopedKey(job);
+    if (!visited.has(sk)) {
+      dfs(sk);
     }
-  })
+  });
 
   return levels;
 }
@@ -543,27 +564,22 @@ function onNodeClick(job: JobNode, event: MouseEvent) {
 <template>
   <div class="workflow-graph" v-if="jobs.length > 0">
     <div class="graph-header">
-      <h4 class="graph-title">Workflow Dependencies</h4>
-      <div class="graph-stats">
-        {{ jobs.length }} jobs • {{ edges.length }} dependencies
-        <span v-if="graphMetrics">
-          • <span class="graph-metrics">{{ graphMetrics.successRate }} success</span>
-        </span>
-      </div>
+      <h4 class="graph-title">{{ locale.workflowDependencies }}</h4>
+      <div class="graph-stats">{{ graphStats }}</div>
       <div class="flex-text-block">
         <button
           type="button"
           @click="zoomIn"
           class="ui compact tiny icon button"
           :disabled="!canZoomIn"
-          :title="canZoomIn ? 'Zoom in (Ctrl/Cmd + scroll on graph)' : 'Already at 100% zoom'"
+          :title="canZoomIn ? locale.graphZoomIn : locale.graphZoomMax"
         >
           <SvgIcon name="octicon-zoom-in" :size="12"/>
         </button>
-        <button type="button" @click="resetView" class="ui compact tiny icon button" title="Reset view">
+        <button type="button" @click="resetView" class="ui compact tiny icon button" :title="locale.graphResetView">
           <SvgIcon name="octicon-sync" :size="12"/>
         </button>
-        <button type="button" @click="zoomOut" class="ui compact tiny icon button" title="Zoom out (Ctrl/Cmd + scroll on graph)">
+        <button type="button" @click="zoomOut" class="ui compact tiny icon button" :title="locale.graphZoomOut">
           <SvgIcon name="octicon-zoom-out" :size="12"/>
         </button>
       </div>
@@ -641,7 +657,7 @@ function onNodeClick(job: JobNode, event: MouseEvent) {
             class="job-status-fg-obj"
           >
             <div class="job-status-icon-wrap">
-              <ActionRunStatus :status="job.status"/>
+              <ActionStatusIcon :status="job.status" icon-variant="circle-fill"/>
             </div>
           </foreignObject>
 
@@ -701,11 +717,6 @@ function onNodeClick(job: JobNode, event: MouseEvent) {
   white-space: nowrap;
 }
 
-.graph-metrics {
-  color: var(--color-primary);
-  font-weight: var(--font-weight-medium);
-}
-
 .graph-container {
   flex: 1;
   overflow: hidden;
diff --git a/web_src/js/features/admin/common.ts b/web_src/js/features/admin/common.ts
index f0c0f5bee69..6125578a7a0 100644
--- a/web_src/js/features/admin/common.ts
+++ b/web_src/js/features/admin/common.ts
@@ -3,6 +3,7 @@ import {hideElem, queryElems, showElem, toggleElem} from '../../utils/dom.ts';
 import {POST} from '../../modules/fetch.ts';
 import {showFomanticModal} from '../../modules/fomantic/modal.ts';
 import {pathEscape} from '../../utils/url.ts';
+import {registerGlobalInitFunc} from '../../modules/observer.ts';
 
 const {appSubUrl} = window.config;
 
@@ -23,6 +24,41 @@ export function initAdminCommon(): void {
   initAdminUser();
   initAdminAuthentication();
   initAdminNotice();
+  registerGlobalInitFunc('initRunnerBulkToolbar', initAdminRunnerBulk);
+}
+
+function initAdminRunnerBulk(toolbar: HTMLElement) {
+  const actionButtons = toolbar.querySelectorAll<HTMLButtonElement>('.runner-bulk-action');
+  const formRunnerIds = toolbar.querySelector<HTMLInputElement>('form input[name="ids"]')!;
+  const rowCheckboxes = document.querySelectorAll<HTMLInputElement>('.runner-bulk-select');
+  const selectAll = document.querySelector<HTMLInputElement>('.runner-bulk-select-all');
+  if (!selectAll) return;
+
+  const refresh = () => {
+    const checked = Array.from(rowCheckboxes).filter((c) => c.checked);
+    toggleElem(toolbar, checked.length > 0);
+    for (const btn of actionButtons) {
+      btn.querySelector<HTMLElement>('.runner-bulk-count')!.textContent = `(${checked.length})`;
+    }
+    selectAll.checked = checked.length > 0 && checked.length === rowCheckboxes.length;
+    selectAll.indeterminate = checked.length > 0 && checked.length < rowCheckboxes.length;
+  };
+
+  selectAll.addEventListener('change', () => {
+    for (const cb of rowCheckboxes) cb.checked = selectAll.checked;
+    refresh();
+  });
+  for (const cb of rowCheckboxes) cb.addEventListener('change', refresh);
+  refresh();
+
+  const collectSelectedIds = () => {
+    const ids = [];
+    for (const cb of rowCheckboxes) {
+      if (cb.checked) ids.push(cb.getAttribute('data-runner-id')!);
+    }
+    return ids.join(',');
+  };
+  formRunnerIds.value = collectSelectedIds();
 }
 
 function initAdminUser() {
@@ -86,6 +122,7 @@ function initAdminAuthentication() {
     const provider = document.querySelector<HTMLInputElement>('#oauth2_provider')!.value;
     switch (provider) {
       case 'openidConnect':
+      case 'aws-cognito':
         document.querySelector<HTMLInputElement>('.open_id_connect_auto_discovery_url input')!.setAttribute('required', 'required');
         showElem('.open_id_connect_auto_discovery_url');
         showElem('.open_id_connect_external_id_claim');
diff --git a/web_src/js/features/clipboard.ts b/web_src/js/features/clipboard.ts
deleted file mode 100644
index 8dbaab62aac..00000000000
--- a/web_src/js/features/clipboard.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import {showTemporaryTooltip} from '../modules/tippy.ts';
-import {toAbsoluteUrl} from '../utils.ts';
-import {clippie} from 'clippie';
-
-const {copy_success, copy_error} = window.config.i18n;
-
-// Enable clipboard copy from HTML attributes. These properties are supported:
-// - data-clipboard-text: Direct text to copy
-// - data-clipboard-target: Holds a selector for an element. "value" of <input> or <textarea>, or "textContent" of <div> will be copied
-// - data-clipboard-text-type: When set to 'url' will convert relative to absolute urls
-export function initGlobalCopyToClipboardListener() {
-  document.addEventListener('click', async (e) => {
-    const target = (e.target as HTMLElement).closest('[data-clipboard-text], [data-clipboard-target]');
-    if (!target) return;
-
-    e.preventDefault();
-
-    let text = target.getAttribute('data-clipboard-text');
-    if (text === null) {
-      const textSelector = target.getAttribute('data-clipboard-target')!;
-      const textTarget = document.querySelector(textSelector)!;
-      if (textTarget.nodeName === 'INPUT' || textTarget.nodeName === 'TEXTAREA') {
-        text = (textTarget as HTMLInputElement | HTMLTextAreaElement).value;
-      } else if (textTarget.nodeName === 'DIV') {
-        text = textTarget.textContent;
-      } else {
-        throw new Error(`Unsupported element for clipboard target: ${textSelector}`);
-      }
-    }
-
-    if (text && target.getAttribute('data-clipboard-text-type') === 'url') {
-      text = toAbsoluteUrl(text);
-    }
-
-    if (text) {
-      const success = await clippie(text);
-      showTemporaryTooltip(target, success ? copy_success : copy_error);
-    }
-  });
-}
diff --git a/web_src/js/features/common-fetch-action.ts b/web_src/js/features/common-fetch-action.ts
index 96bc2e2adb3..3481d240f27 100644
--- a/web_src/js/features/common-fetch-action.ts
+++ b/web_src/js/features/common-fetch-action.ts
@@ -1,7 +1,7 @@
 import {GET, request} from '../modules/fetch.ts';
 import {hideToastsAll, showErrorToast} from '../modules/toast.ts';
 import {addDelegatedEventListener, createElementFromHTML} from '../utils/dom.ts';
-import {errorMessage} from '../modules/errors.ts';
+import {errorMessage, errorName} from '../modules/errors.ts';
 import {confirmModal, createConfirmModal} from './comp/ConfirmModal.ts';
 import {ignoreAreYouSure} from '../vendor/jquery.are-you-sure.ts';
 import {registerGlobalSelectorFunc} from '../modules/observer.ts';
@@ -16,6 +16,7 @@ type FetchActionOpts = {
   url: string;
   headers?: HeadersInit;
   body?: FormData;
+  formSubmitter?: HTMLElement | null;
 
   // pseudo selectors/commands to update the current page with the response text when the response is text (html)
   // e.g.: "$this", "$innerHTML", "$closest(tr) td .the-class", "$body #the-id"
@@ -122,7 +123,7 @@ function buildFetchActionUrl(el: HTMLElement, opt: FetchActionOpts) {
 async function performActionRequest(el: HTMLElement, opt: FetchActionOpts) {
   const attrIsLoading = 'data-fetch-is-loading';
   if (el.getAttribute(attrIsLoading)) return;
-  if (!await confirmFetchAction(el)) return;
+  if (!await confirmFetchAction(opt.formSubmitter ?? el)) return;
 
   el.setAttribute(attrIsLoading, 'true');
   toggleLoadingIndicator(el, opt, true);
@@ -138,7 +139,7 @@ async function performActionRequest(el: HTMLElement, opt: FetchActionOpts) {
     }
     await handleFetchActionError(resp);
   } catch (err) {
-    if ((err as Error).name !== 'AbortError') {
+    if (errorName(err) !== 'AbortError') {
       console.error(`Fetch action request error:`, err);
       showErrorToast(`Error: ${errorMessage(err)}`);
     }
@@ -181,6 +182,7 @@ function prepareFormFetchActionOpts(formEl: HTMLFormElement, opts: SubmitFormFet
     method: formMethodUpper,
     url: reqUrl,
     body: reqBody,
+    formSubmitter: opts.formSubmitter,
     loadingIndicator: '$this', // for form submit, by default, the loading indicator is the whole form
     successSync: formEl.getAttribute('data-fetch-sync') ?? '', // by default, no fetch sync for form submit
   };
diff --git a/web_src/js/features/comp/SearchRepoBox.ts b/web_src/js/features/comp/SearchRepoBox.ts
index c87240b67a5..51227bf509f 100644
--- a/web_src/js/features/comp/SearchRepoBox.ts
+++ b/web_src/js/features/comp/SearchRepoBox.ts
@@ -1,31 +1,16 @@
-import {fomanticQuery} from '../../modules/fomantic/base.ts';
-import {htmlEscape} from '../../utils/html.ts';
+import {attachSearchBox} from '../../modules/search.ts';
 
 const {appSubUrl} = window.config;
 
+type RepoSearchResponse = {data: Array<{repository: {full_name: string}}>};
+
 export function initCompSearchRepoBox(el: HTMLElement) {
   const uid = el.getAttribute('data-uid');
   const exclusive = el.getAttribute('data-exclusive');
   let url = `${appSubUrl}/repo/search?q={query}&uid=${uid}`;
-  if (exclusive === 'true') {
-    url += `&exclusive=true`;
-  }
-  fomanticQuery(el).search({
-    minCharacters: 2,
-    apiSettings: {
-      url,
-      onResponse(response: any) {
-        const items = [];
-        for (const item of response.data) {
-          items.push({
-            title: htmlEscape(item.repository.full_name.split('/')[1]),
-            description: htmlEscape(item.repository.full_name),
-          });
-        }
-        return {results: items};
-      },
-    },
-    searchFields: ['full_name'],
-    showNoResults: false,
-  });
+  if (exclusive === 'true') url += `&exclusive=true`;
+  attachSearchBox(el, url, (response: RepoSearchResponse) => response.data.map((item) => ({
+    title: item.repository.full_name.split('/')[1],
+    description: item.repository.full_name,
+  })));
 }
diff --git a/web_src/js/features/comp/SearchUserBox.ts b/web_src/js/features/comp/SearchUserBox.ts
index f5680078a3e..739b5c59943 100644
--- a/web_src/js/features/comp/SearchUserBox.ts
+++ b/web_src/js/features/comp/SearchUserBox.ts
@@ -1,49 +1,30 @@
-import {htmlEscape} from '../../utils/html.ts';
-import {fomanticQuery} from '../../modules/fomantic/base.ts';
+import {attachSearchBox, type SearchResult} from '../../modules/search.ts';
 
 const {appSubUrl} = window.config;
 const looksLikeEmailAddressCheck = /^\S+@\S+$/;
 
+type UserSearchResponse = {data: Array<{login: string; avatar_url: string; full_name: string}>};
+
 export function initCompSearchUserBox() {
-  const searchUserBox = document.querySelector('#search-user-box');
-  if (!searchUserBox) return;
+  const box = document.querySelector<HTMLElement>('#search-user-box');
+  if (!box) return;
 
-  const allowEmailInput = searchUserBox.getAttribute('data-allow-email') === 'true';
-  const allowEmailDescription = searchUserBox.getAttribute('data-allow-email-description') ?? undefined;
-  const includeOrgs = searchUserBox.getAttribute('data-include-orgs') === 'true';
-  fomanticQuery(searchUserBox).search({
-    minCharacters: 2,
-    apiSettings: {
-      url: `${appSubUrl}/user/search_candidates?q={query}&orgs=${includeOrgs}`,
-      onResponse(response: any) {
-        const resultItems = [];
-        const searchQuery = searchUserBox.querySelector('input')!.value;
-        const searchQueryUppercase = searchQuery.toUpperCase();
-        for (const item of response.data) {
-          const resultItem = {
-            title: item.login,
-            image: item.avatar_url,
-            description: htmlEscape(item.full_name),
-          };
-          if (searchQueryUppercase === item.login.toUpperCase()) {
-            resultItems.unshift(resultItem); // add the exact match to the top
-          } else {
-            resultItems.push(resultItem);
-          }
-        }
+  const allowEmailInput = box.getAttribute('data-allow-email') === 'true';
+  const allowEmailDescription = box.getAttribute('data-allow-email-description') ?? undefined;
+  const includeOrgs = box.getAttribute('data-include-orgs') === 'true';
+  const url = `${appSubUrl}/user/search_candidates?q={query}&orgs=${includeOrgs}`;
 
-        if (allowEmailInput && !resultItems.length && looksLikeEmailAddressCheck.test(searchQuery)) {
-          const resultItem = {
-            title: searchQuery,
-            description: allowEmailDescription,
-          };
-          resultItems.push(resultItem);
-        }
-
-        return {results: resultItems};
-      },
-    },
-    searchFields: ['login', 'full_name'],
-    showNoResults: false,
+  attachSearchBox(box, url, (response: UserSearchResponse, query) => {
+    const items: SearchResult[] = [];
+    const queryUpper = query.toUpperCase();
+    for (const item of response.data) {
+      const result: SearchResult = {title: item.login, image: item.avatar_url, description: item.full_name};
+      if (queryUpper === item.login.toUpperCase()) items.unshift(result); // exact match floats to top
+      else items.push(result);
+    }
+    if (allowEmailInput && !items.length && looksLikeEmailAddressCheck.test(query)) {
+      items.push({title: query, description: allowEmailDescription});
+    }
+    return items;
   });
 }
diff --git a/web_src/js/features/contributors.ts b/web_src/js/features/contributors.ts
index d28d18eacc2..7f6d21f34be 100644
--- a/web_src/js/features/contributors.ts
+++ b/web_src/js/features/contributors.ts
@@ -20,6 +20,7 @@ export async function initRepoContributors() {
         loadingTitle: el.getAttribute('data-locale-loading-title'),
         loadingTitleFailed: el.getAttribute('data-locale-loading-title-failed'),
         loadingInfo: el.getAttribute('data-locale-loading-info'),
+        chartZoomHint: el.getAttribute('data-locale-chart-zoom-hint'),
       },
     });
     View.mount(el);
diff --git a/web_src/js/features/copycontent.ts b/web_src/js/features/copycontent.ts
index 74e98cf95e0..32ea95632d7 100644
--- a/web_src/js/features/copycontent.ts
+++ b/web_src/js/features/copycontent.ts
@@ -1,54 +1,25 @@
-import {clippie} from 'clippie';
-import {showTemporaryTooltip} from '../modules/tippy.ts';
+import {copyToClipboardWithFeedback} from '../modules/clipboard.ts';
 import {convertImage} from '../utils.ts';
 import {GET} from '../modules/fetch.ts';
 import {registerGlobalEventFunc} from '../modules/observer.ts';
 
-const {i18n} = window.config;
-
 export function initCopyContent() {
   registerGlobalEventFunc('click', 'onCopyContentButtonClick', async (btn: HTMLElement) => {
     if (btn.classList.contains('disabled') || btn.classList.contains('is-loading')) return;
-    const rawFileLink = btn.getAttribute('data-raw-file-link');
-
-    let content, isRasterImage = false;
-
-    // when "data-raw-link" is present, we perform a fetch. this is either because
-    // the text to copy is not in the DOM, or it is an image that should be
-    // fetched to copy in full resolution
-    if (rawFileLink) {
-      btn.classList.add('is-loading', 'loading-icon-2px');
-      try {
-        const res = await GET(rawFileLink, {credentials: 'include', redirect: 'follow'});
-        const contentType = res.headers.get('content-type')!;
-
-        if (contentType.startsWith('image/') && !contentType.startsWith('image/svg')) {
-          isRasterImage = true;
-          content = await res.blob();
-        } else {
-          content = await res.text();
-        }
-      } catch {
-        return showTemporaryTooltip(btn, i18n.copy_error);
-      } finally {
-        btn.classList.remove('is-loading', 'loading-icon-2px');
+    await copyToClipboardWithFeedback(btn, async () => {
+      const rawFileLink = btn.getAttribute('data-raw-file-link');
+      if (!rawFileLink) {
+        const lineEls = document.querySelectorAll('.file-view .lines-code');
+        return Array.from(lineEls, (el) => el.textContent).join('');
       }
-    } else { // text, read from DOM
-      const lineEls = document.querySelectorAll('.file-view .lines-code');
-      content = Array.from(lineEls, (el) => el.textContent).join('');
-    }
-
-    // try copy original first, if that fails, and it's an image, convert it to png
-    const success = await clippie(content);
-    if (success) {
-      showTemporaryTooltip(btn, i18n.copy_success);
-    } else {
-      if (isRasterImage) {
-        const success = await clippie(await convertImage(content as Blob, 'image/png'));
-        showTemporaryTooltip(btn, success ? i18n.copy_success : i18n.copy_error);
-      } else {
-        showTemporaryTooltip(btn, i18n.copy_error);
+      const res = await GET(rawFileLink, {credentials: 'include', redirect: 'follow'});
+      const contentType = res.headers.get('content-type')!;
+      if (contentType.startsWith('image/') && !contentType.startsWith('image/svg')) {
+        // browsers only accept image/png in the clipboard, convert other raster formats
+        const blob = await res.blob();
+        return contentType === 'image/png' ? blob : convertImage(blob, 'image/png');
       }
-    }
+      return await res.text();
+    });
   });
 }
diff --git a/web_src/js/features/dropzone.ts b/web_src/js/features/dropzone.ts
index 84076dc93b8..fcde16e8454 100644
--- a/web_src/js/features/dropzone.ts
+++ b/web_src/js/features/dropzone.ts
@@ -1,7 +1,6 @@
 import {svg} from '../svg.ts';
 import {html} from '../utils/html.ts';
-import {clippie} from 'clippie';
-import {showTemporaryTooltip} from '../modules/tippy.ts';
+import {copyToClipboardWithFeedback} from '../modules/clipboard.ts';
 import {GET, POST} from '../modules/fetch.ts';
 import {showErrorToast} from '../modules/toast.ts';
 import {createElementFromHTML, createElementFromAttrs} from '../utils/dom.ts';
@@ -9,8 +8,6 @@ import {errorMessage} from '../modules/errors.ts';
 import {isImageFile, isVideoFile} from '../utils.ts';
 import type Dropzone from '@deltablot/dropzone';
 
-const {i18n} = window.config;
-
 type CustomDropzoneFile = Dropzone.DropzoneFile & {uuid: string};
 
 // dropzone has its owner event dispatcher (emitter)
@@ -48,14 +45,13 @@ export function generateMarkdownLinkForAttachment(file: Partial<CustomDropzoneFi
 function addCopyLink(file: Partial<CustomDropzoneFile>) {
   // Create a "Copy Link" element, to conveniently copy the image or file link as Markdown to the clipboard
   // The "<a>" element has a hardcoded cursor: pointer because the default is overridden by .dropzone
-  const copyLinkEl = createElementFromHTML(`
+  const copyLinkEl = createElementFromHTML<HTMLDivElement>(`
 <div class="tw-text-center">
   <a href="#" class="tw-cursor-pointer">${svg('octicon-copy', 14)} Copy link</a>
 </div>`);
   copyLinkEl.addEventListener('click', async (e) => {
     e.preventDefault();
-    const success = await clippie(generateMarkdownLinkForAttachment(file));
-    showTemporaryTooltip(e.target as Element, success ? i18n.copy_success : i18n.copy_error);
+    await copyToClipboardWithFeedback(copyLinkEl, generateMarkdownLinkForAttachment(file));
   });
   file.previewTemplate!.append(copyLinkEl);
 }
diff --git a/web_src/js/features/repo-actions.ts b/web_src/js/features/repo-actions.ts
index 0393b7433e8..1b994992481 100644
--- a/web_src/js/features/repo-actions.ts
+++ b/web_src/js/features/repo-actions.ts
@@ -27,6 +27,8 @@ export function initRepositoryActionView() {
       pushedBy: el.getAttribute('data-locale-runs-pushed-by'),
       summary: el.getAttribute('data-locale-summary'),
       allJobs: el.getAttribute('data-locale-all-jobs'),
+      expandCallerJobs: el.getAttribute('data-locale-expand-caller-jobs'),
+      collapseCallerJobs: el.getAttribute('data-locale-collapse-caller-jobs'),
       triggeredVia: el.getAttribute('data-locale-triggered-via'),
       totalDuration: el.getAttribute('data-locale-total-duration'),
       artifactsTitle: el.getAttribute('data-locale-artifacts-title'),
@@ -37,10 +39,12 @@ export function initRepositoryActionView() {
       showLogSeconds: el.getAttribute('data-locale-show-log-seconds'),
       showFullScreen: el.getAttribute('data-locale-show-full-screen'),
       downloadLogs: el.getAttribute('data-locale-download-logs'),
+      copyOutput: el.getAttribute('data-locale-copy-output'),
       status: {
         unknown: el.getAttribute('data-locale-status-unknown'),
         waiting: el.getAttribute('data-locale-status-waiting'),
         running: el.getAttribute('data-locale-status-running'),
+        cancelling: el.getAttribute('data-locale-status-cancelling'),
         success: el.getAttribute('data-locale-status-success'),
         failure: el.getAttribute('data-locale-status-failure'),
         cancelled: el.getAttribute('data-locale-status-cancelled'),
@@ -51,6 +55,16 @@ export function initRepositoryActionView() {
       logsAlwaysExpandRunning: el.getAttribute('data-locale-logs-always-expand-running'),
       workflowFile: el.getAttribute('data-locale-workflow-file'),
       runDetails: el.getAttribute('data-locale-run-details'),
+      workflowDependencies: el.getAttribute('data-locale-workflow-dependencies'),
+      graphJobsCount1: el.getAttribute('data-locale-graph-jobs-count-1'),
+      graphJobsCountN: el.getAttribute('data-locale-graph-jobs-count-n'),
+      graphDependenciesCount1: el.getAttribute('data-locale-graph-dependencies-count-1'),
+      graphDependenciesCountN: el.getAttribute('data-locale-graph-dependencies-count-n'),
+      graphSuccessRate: el.getAttribute('data-locale-graph-success-rate'),
+      graphZoomIn: el.getAttribute('data-locale-graph-zoom-in'),
+      graphZoomMax: el.getAttribute('data-locale-graph-zoom-max'),
+      graphZoomOut: el.getAttribute('data-locale-graph-zoom-out'),
+      graphResetView: el.getAttribute('data-locale-graph-reset-view'),
     },
   });
   view.mount(el);
diff --git a/web_src/js/features/repo-code.ts b/web_src/js/features/repo-code.ts
index c2dc86cea50..64574cc4c0b 100644
--- a/web_src/js/features/repo-code.ts
+++ b/web_src/js/features/repo-code.ts
@@ -41,9 +41,8 @@ function selectRange(range: string): Element | null {
   const updateCopyPermalinkUrl = function (anchor: string) {
     if (!copyPermalink) return;
     let link = copyPermalink.getAttribute('data-url')!;
-    link = `${link.replace(/#L\d+$|#L\d+-L\d+$/, '')}#${anchor}`;
+    link = `${window.location.origin}${link.replace(/#L\d+$|#L\d+-L\d+$/, '')}#${anchor}`;
     copyPermalink.setAttribute('data-clipboard-text', link);
-    copyPermalink.setAttribute('data-clipboard-text-type', 'url');
   };
 
   const rangeFields = range ? range.split('-') : [];
diff --git a/web_src/js/features/repo-common.ts b/web_src/js/features/repo-common.ts
index 65b89cf2612..50d0db36738 100644
--- a/web_src/js/features/repo-common.ts
+++ b/web_src/js/features/repo-common.ts
@@ -5,7 +5,6 @@ import {showErrorToast} from '../modules/toast.ts';
 import {sleep} from '../utils.ts';
 import RepoActivityTopAuthors from '../components/RepoActivityTopAuthors.vue';
 import {createApp} from 'vue';
-import {toOriginUrl} from '../utils/url.ts';
 import {createTippy} from '../modules/tippy.ts';
 import {localUserSettings} from '../modules/user-settings.ts';
 
@@ -79,7 +78,8 @@ function initCloneSchemeUrlSelection(parent: Element) {
     const isTea = scheme === 'tea';
 
     if (tabHttps) {
-      tabHttps.textContent = window.origin.split(':')[0].toUpperCase(); // show "HTTP" or "HTTPS"
+      const link = tabHttps.getAttribute('data-link')!;
+      tabHttps.textContent = link.split(':')[0].toUpperCase(); // show "HTTP" or "HTTPS"
       tabHttps.classList.toggle('active', isHttps);
     }
     if (tabSsh) {
@@ -99,7 +99,7 @@ function initCloneSchemeUrlSelection(parent: Element) {
     }
 
     if (!tab) return;
-    const link = toOriginUrl(tab.getAttribute('data-link')!);
+    const link = tab.getAttribute('data-link')!;
 
     for (const el of document.querySelectorAll('.js-clone-url')) {
       if (el.nodeName === 'INPUT') {
diff --git a/web_src/js/features/repo-issue-content.ts b/web_src/js/features/repo-issue-content.ts
index 865d4305e46..e385d5b1e8b 100644
--- a/web_src/js/features/repo-issue-content.ts
+++ b/web_src/js/features/repo-issue-content.ts
@@ -94,7 +94,7 @@ function showContentHistoryDetail(issueBaseUrl: string, commentId: string, histo
 function showContentHistoryMenu(issueBaseUrl: string, elCommentItem: Element, commentId: string) {
   const elHeaderLeft = elCommentItem.querySelector('.comment-header-left')!;
   const menuHtml = `
-  <div class="ui dropdown interact-fg content-history-menu" data-comment-id="${commentId}">
+  <div class="ui dropdown interact-fg content-history-menu tw-flex-shrink-0" data-comment-id="${commentId}">
     &bull; ${i18nTextEdited}${svg('octicon-triangle-down', 14, 'dropdown icon')}
     <div class="menu">
     </div>
@@ -127,7 +127,7 @@ export async function initRepoIssueContentHistory() {
   const issuePageInfo = parseIssuePageInfo();
   if (!issuePageInfo.issueNumber) return;
 
-  const elIssueDescription = document.querySelector('.repository.issue .timeline-item.comment.first'); // issue(PR) main content
+  const elIssueDescription = document.querySelector('.repository.issue .timeline-item.comment.issue-content-comment'); // issue(PR) main content
   const elComments = document.querySelectorAll('.repository.issue .comment-list .comment'); // includes: issue(PR) comments, review comments, code comments
   if (!elIssueDescription && !elComments.length) return;
 
diff --git a/web_src/js/features/repo-issue-pull.ts b/web_src/js/features/repo-issue-pull.ts
index 33e072a1a5e..7a72d267fce 100644
--- a/web_src/js/features/repo-issue-pull.ts
+++ b/web_src/js/features/repo-issue-pull.ts
@@ -1,62 +1,28 @@
 import {createApp} from 'vue';
-import {GET, POST} from '../modules/fetch.ts';
+import {GET} from '../modules/fetch.ts';
 import {fomanticQuery} from '../modules/fomantic/base.ts';
 import {createElementFromHTML} from '../utils/dom.ts';
+import {registerGlobalEventFunc} from '../modules/observer.ts';
 
-function initRepoPullRequestUpdate(el: HTMLElement) {
-  const prUpdateButtonContainer = el.querySelector('#update-pr-branch-with-base');
-  if (!prUpdateButtonContainer) return;
+export function initRepoPullRequestUpdate(el: HTMLElement) {
+  const elDropdown = el.querySelector(':scope > .ui.dropdown');
+  if (!elDropdown) return;
+  const elButton = el.querySelector<HTMLButtonElement>(':scope > button')!;
 
-  const prUpdateButton = prUpdateButtonContainer.querySelector<HTMLButtonElement>(':scope > button')!;
-  const prUpdateDropdown = prUpdateButtonContainer.querySelector(':scope > .ui.dropdown')!;
-  prUpdateButton.addEventListener('click', async function (e) {
-    e.preventDefault();
-    this.classList.add('is-loading');
-    let response: Response | undefined;
-    try {
-      response = await POST(this.getAttribute('data-do')!);
-    } catch (error) {
-      console.error(error);
-    } finally {
-      this.classList.remove('is-loading');
-    }
-    let data: Record<string, any> | undefined;
-    try {
-      data = await response?.json(); // the response is probably not a JSON
-    } catch (error) {
-      console.error(error);
-    }
-    if (data?.redirect) {
-      window.location.href = data.redirect;
-    } else {
-      window.location.reload();
-    }
-  });
-
-  fomanticQuery(prUpdateDropdown).dropdown({
+  fomanticQuery(elDropdown).dropdown({
     onChange(_text: string, _value: string, $choice: any) {
       const choiceEl = $choice[0];
-      const url = choiceEl.getAttribute('data-do');
-      if (url) {
-        const buttonText = prUpdateButton.querySelector('.button-text');
-        if (buttonText) {
-          buttonText.textContent = choiceEl.textContent;
-        }
-        prUpdateButton.setAttribute('data-do', url);
-      }
+      elButton.textContent = choiceEl.textContent;
+      elButton.setAttribute('data-url', choiceEl.getAttribute('data-update-url'));
     },
   });
 }
 
-function initRepoPullRequestCommitStatus(el: HTMLElement) {
-  for (const btn of el.querySelectorAll('.commit-status-hide-checks')) {
-    const panel = btn.closest('.commit-status-panel')!;
-    const list = panel.querySelector<HTMLElement>('.commit-status-list')!;
-    btn.addEventListener('click', () => {
-      list.style.maxHeight = list.style.maxHeight ? '' : '0px'; // toggle
-      btn.textContent = btn.getAttribute(list.style.maxHeight ? 'data-show-all' : 'data-hide-all');
-    });
-  }
+function onCommitStatusChecksToggle(btn: HTMLElement) {
+  const panel = btn.closest('.commit-status-toggle')!.parentElement!;
+  const list = panel.querySelector<HTMLElement>('.commit-status-list')!;
+  list.style.maxHeight = list.style.maxHeight ? '' : '0px'; // toggle
+  btn.textContent = btn.getAttribute(list.style.maxHeight ? 'data-show-all' : 'data-hide-all');
 }
 
 async function initRepoPullRequestMergeForm(box: HTMLElement) {
@@ -70,8 +36,7 @@ async function initRepoPullRequestMergeForm(box: HTMLElement) {
 }
 
 export function initRepoPullMergeBox(el: HTMLElement) {
-  initRepoPullRequestCommitStatus(el);
-  initRepoPullRequestUpdate(el);
+  registerGlobalEventFunc('click', 'onCommitStatusChecksToggle', onCommitStatusChecksToggle);
   initRepoPullRequestMergeForm(el);
 
   const reloadingIntervalValue = el.getAttribute('data-pull-merge-box-reloading-interval');
diff --git a/web_src/js/features/repo-legacy.ts b/web_src/js/features/repo-legacy.ts
index fc92242b406..db91529535c 100644
--- a/web_src/js/features/repo-legacy.ts
+++ b/web_src/js/features/repo-legacy.ts
@@ -17,7 +17,7 @@ import {initRepoMilestone} from './repo-milestone.ts';
 import {initRepoNew} from './repo-new.ts';
 import {createApp} from 'vue';
 import RepoBranchTagSelector from '../components/RepoBranchTagSelector.vue';
-import {initRepoPullMergeBox} from './repo-issue-pull.ts';
+import {initRepoPullMergeBox, initRepoPullRequestUpdate} from './repo-issue-pull.ts';
 
 function initRepoBranchTagSelector() {
   registerGlobalInitFunc('initRepoBranchTagSelector', async (elRoot: HTMLInputElement) => {
@@ -38,6 +38,9 @@ export function initBranchSelectorTabs() {
 }
 
 export function initRepository() {
+  registerGlobalInitFunc('initRepoPullMergeBox', initRepoPullMergeBox);
+  registerGlobalInitFunc('initRepoPullRequestUpdate', initRepoPullRequestUpdate);
+
   const pageContent = document.querySelector('.page-content.repository');
   if (!pageContent) return;
 
@@ -68,8 +71,6 @@ export function initRepository() {
     initRepoIssueCommentDelete();
     initRepoIssueCodeCommentCancel();
     initCompReactionSelector();
-
-    registerGlobalInitFunc('initRepoPullMergeBox', initRepoPullMergeBox);
   }
 
   initUnicodeEscapeButton();
diff --git a/web_src/js/features/repo-settings.ts b/web_src/js/features/repo-settings.ts
index f3b95178f3a..f003200c3ea 100644
--- a/web_src/js/features/repo-settings.ts
+++ b/web_src/js/features/repo-settings.ts
@@ -3,6 +3,7 @@ import {onInputDebounce, queryElems, toggleElem} from '../utils/dom.ts';
 import {POST} from '../modules/fetch.ts';
 import {initRepoSettingsBranchesDrag} from './repo-settings-branches.ts';
 import {fomanticQuery} from '../modules/fomantic/base.ts';
+import {attachSearchBox} from '../modules/search.ts';
 import {globMatch} from '../utils/glob.ts';
 
 const {appSubUrl} = window.config;
@@ -45,29 +46,17 @@ function initRepoSettingsCollaboration() {
   }
 }
 
-function initRepoSettingsSearchTeamBox() {
-  const searchTeamBox = document.querySelector('#search-team-box');
-  if (!searchTeamBox) return;
+type TeamSearchResponse = {data: Array<{name: string; permission: string}>};
 
-  fomanticQuery(searchTeamBox).search({
-    minCharacters: 2,
-    searchFields: ['name', 'description'],
-    showNoResults: false,
-    rawResponse: true,
-    apiSettings: {
-      url: `${appSubUrl}/org/${searchTeamBox.getAttribute('data-org-name')}/teams/-/search?q={query}`,
-      onResponse(response: any) {
-        const items: Array<Record<string, any>> = [];
-        for (const item of response.data) {
-          items.push({
-            title: item.name,
-            description: `${item.permission} access`, // TODO: translate this string
-          });
-        }
-        return {results: items};
-      },
-    },
-  });
+function initRepoSettingsSearchTeamBox() {
+  const box = document.querySelector<HTMLElement>('#search-team-box');
+  if (!box) return;
+
+  const url = `${appSubUrl}/org/${box.getAttribute('data-org-name')}/teams/-/search?q={query}`;
+  attachSearchBox(box, url, (response: TeamSearchResponse) => response.data.map((item) => ({
+    title: item.name,
+    description: `${item.permission} access`, // TODO: translate this string
+  })));
 }
 
 function initRepoSettingsGitHook() {
diff --git a/web_src/js/index.ts b/web_src/js/index.ts
index cb2b56a5bd5..094caefb7e0 100644
--- a/web_src/js/index.ts
+++ b/web_src/js/index.ts
@@ -2,7 +2,8 @@ import '../fomantic/build/fomantic.js';
 import '../css/index.css';
 
 import {initDashboardRepoList} from './features/dashboard.ts';
-import {initGlobalCopyToClipboardListener} from './features/clipboard.ts';
+import {initGlobalCopyToClipboardListener} from './modules/clipboard.ts';
+import {initCopyContent} from './features/copycontent.ts';
 import {initRepoGraphGit} from './features/repo-graph.ts';
 import {initHeatmap} from './features/heatmap.ts';
 import {initImageDiff} from './features/imagediff.ts';
@@ -40,7 +41,6 @@ import {initRepoBranchButton} from './features/repo-branch.ts';
 import {initCommonOrganization} from './features/common-organization.ts';
 import {initRepoWikiForm} from './features/repo-wiki.ts';
 import {initRepository, initBranchSelectorTabs} from './features/repo-legacy.ts';
-import {initCopyContent} from './features/copycontent.ts';
 import {initCaptcha} from './features/captcha.ts';
 import {initRepositoryActionView} from './features/repo-actions.ts';
 import {initGlobalTooltips} from './modules/tippy.ts';
diff --git a/web_src/js/modules/clipboard.ts b/web_src/js/modules/clipboard.ts
new file mode 100644
index 00000000000..19a76a32ca7
--- /dev/null
+++ b/web_src/js/modules/clipboard.ts
@@ -0,0 +1,90 @@
+import {clippie, type ClippieContent} from 'clippie';
+import {showTemporaryTooltip} from './tippy.ts';
+import {sleep} from '../utils.ts';
+import {svg} from '../svg.ts';
+import {createElementFromHTML} from '../utils/dom.ts';
+
+const {copy_success, copy_error} = window.config.i18n;
+const pendingFeedback = new WeakSet<HTMLElement>();
+
+/** copy the copiable content to clipboard, return "true" on success, otherwise "false" */
+export async function copyToClipboard(content: ClippieContent): Promise<boolean> {
+  return await clippie(content);
+}
+
+/** Copy `content` to the clipboard. `target` is used to:
+ *  - avoid duplicate copy actions (especially when the content will be fetched from an async function)
+ *  - provide feedback to end users (its `.octicon-copy` is swapped to show success/fail feedback, or a tooltip if it has none)
+ *  When `content` is a function, `target` also shows a spinner while it resolves. */
+export async function copyToClipboardWithFeedback(target: HTMLElement, content: ClippieContent | (() => Promise<ClippieContent>)) {
+  if (pendingFeedback.has(target)) return;
+  pendingFeedback.add(target);
+
+  let success = false;
+  const feedbackSvg = target.querySelector<SVGElement>('.octicon-copy');
+
+  // prepare copiable "content"
+  try {
+    if (typeof content === 'function') {
+      if (feedbackSvg) target.style.setProperty('--loading-size', `${feedbackSvg.getAttribute('width')!}px`);
+      target.classList.add('is-loading', 'loading-icon-2px');
+      try {
+        content = await content();
+      } finally {
+        target.classList.remove('is-loading', 'loading-icon-2px');
+        target.style.removeProperty('--loading-size');
+      }
+    }
+    success = await copyToClipboard(content);
+  } catch (err) {
+    console.error(err);
+  }
+
+  // show feedback
+  if (feedbackSvg) {
+    const restore = replaceWithFeedbackSvg(feedbackSvg, success);
+    await sleep(1000);
+    restore();
+  } else {
+    showTemporaryTooltip(target, success ? copy_success : copy_error);
+  }
+
+  pendingFeedback.delete(target);
+}
+
+function replaceWithFeedbackSvg(origSvg: SVGElement, success: boolean): () => void {
+  const size = Number(origSvg.getAttribute('width')!);
+  const {icon, color} = success ?
+    {icon: 'octicon-check', color: 'tw-text-green'} as const :
+    {icon: 'octicon-x', color: 'tw-text-red'} as const;
+  const newSvg = createElementFromHTML<SVGElement>(svg(icon, size, color));
+  origSvg.replaceWith(newSvg);
+  return () => newSvg.replaceWith(origSvg);
+}
+
+// Enable clipboard copy from HTML attributes. These properties are supported:
+// - data-clipboard-text: Direct text to copy
+// - data-clipboard-target: Holds a selector for an element. "value" of <input> or <textarea>, or "textContent" of <div> will be copied
+export function initGlobalCopyToClipboardListener() {
+  document.addEventListener('click', async (e) => {
+    const target = (e.target as HTMLElement).closest<HTMLElement>('[data-clipboard-text], [data-clipboard-target]');
+    if (!target) return;
+
+    e.preventDefault();
+
+    let text = target.getAttribute('data-clipboard-text');
+    if (text === null) {
+      const textSelector = target.getAttribute('data-clipboard-target')!;
+      const textTarget = document.querySelector(textSelector)!;
+      if (textTarget.nodeName === 'INPUT' || textTarget.nodeName === 'TEXTAREA') {
+        text = (textTarget as HTMLInputElement | HTMLTextAreaElement).value;
+      } else if (textTarget.nodeName === 'DIV') {
+        text = textTarget.textContent;
+      } else {
+        throw new Error(`Unsupported element for clipboard target: ${textSelector}`);
+      }
+    }
+    // now, text can not be null
+    await copyToClipboardWithFeedback(target, text);
+  });
+}
diff --git a/web_src/js/modules/codeeditor/context-menu.ts b/web_src/js/modules/codeeditor/context-menu.ts
index aa620f1c9e7..ee9eeab64d3 100644
--- a/web_src/js/modules/codeeditor/context-menu.ts
+++ b/web_src/js/modules/codeeditor/context-menu.ts
@@ -1,5 +1,5 @@
-import {clippie} from 'clippie';
 import {createTippy} from '../tippy.ts';
+import {copyToClipboard} from '../clipboard.ts';
 import {keySymbols} from '../../utils.ts';
 import {goToDefinitionAt} from './utils.ts';
 import type {Instance} from 'tippy.js';
@@ -95,13 +95,13 @@ function buildMenuItems(cm: CodemirrorModules, view: EditorView, togglePalette:
     'separator',
     {label: 'Cut', keys: 'Mod+X', disabled: !hasSelection, run: async (v) => {
       const {from, to} = v.state.selection.main;
-      if (await clippie(v.state.doc.sliceString(from, to))) {
+      if (await copyToClipboard(v.state.doc.sliceString(from, to))) {
         v.dispatch({changes: {from, to}});
       }
     }},
     {label: 'Copy', keys: 'Mod+C', disabled: !hasSelection, run: async (v) => {
       const {from, to} = v.state.selection.main;
-      await clippie(v.state.doc.sliceString(from, to));
+      await copyToClipboard(v.state.doc.sliceString(from, to));
     }},
     {label: 'Paste', keys: 'Mod+V', run: async (view) => {
       try {
diff --git a/web_src/js/modules/codeeditor/main.test.ts b/web_src/js/modules/codeeditor/main.test.ts
new file mode 100644
index 00000000000..8eef2baa972
--- /dev/null
+++ b/web_src/js/modules/codeeditor/main.test.ts
@@ -0,0 +1,54 @@
+import {buildLanguageDescriptions, importCodemirror} from './main.ts';
+
+test('matchFilename — language detection covers extended rules', async () => {
+  const cm = await importCodemirror();
+  const list = buildLanguageDescriptions(cm);
+  const match = (filename: string) =>
+    cm.language.LanguageDescription.matchFilename(list, filename)?.name;
+
+  // Linguist-supplied filenames + extensions
+  expect(match('.bashrc')).toBe('Shell');
+  expect(match('PKGBUILD')).toBe('Shell');
+  expect(match('foo.zsh')).toBe('Shell');
+  expect(match('Cargo.lock')).toBe('TOML');
+  expect(match('Gemfile')).toBe('Ruby');
+  expect(match('foo.gemspec')).toBe('Ruby');
+  expect(match('foo.psgi')).toBe('Perl');
+  expect(match('foo.pyi')).toBe('Python');
+  expect(match('foo.webmanifest')).toBe('JSON');
+  expect(match('foo.tcc')).toBe('C++');
+
+  // Script-side extras (extraFilenames / extraExtensions)
+  expect(match('.editorconfig')).toBe('Properties files');
+  expect(match('foo.conf')).toBe('Properties files');
+  expect(match('Snakefile')).toBe('Python');
+
+  // Custom Gitea entries override language-data
+  expect(match('Containerfile.test')).toBe('Dockerfile');
+  expect(match('Dockerfile.dev')).toBe('Dockerfile');
+  expect(match('Makefile.am')).toBe('Makefile');
+  expect(match('foo.mk')).toBe('Makefile');
+  expect(match('.env.local')).toBe('Dotenv');
+  expect(match('foo.json5')).toBe('JSON5');
+  expect(match('foo.mdown')).toBe('Markdown');
+
+  // Filename regex wins over extension match
+  expect(match('nginx.conf')).toBe('Nginx');
+
+  // .spec routes to RPM Spec via excludeExt redirect
+  expect(match('foo.spec')).toBe('RPM Spec');
+
+  // CM original ownership preserved against Linguist's broader claims (.sql is SQL,
+  // not PLSQL, even though Linguist's PLSQL extension list includes it).
+  expect(match('foo.sql')).toBe('SQL');
+  expect(match('foo.h')).toBe('C');
+  expect(match('foo.mm')).toBe('Objective-C++');
+
+  // Globally ambiguous extensions fall through to plain text
+  expect(match('foo.cgi')).toBeUndefined();
+  expect(match('foo.inc')).toBeUndefined();
+
+  // Smoke: existing language-data entries still resolve
+  expect(match('foo.go')).toBe('Go');
+  expect(match('foo.tsx')).toBe('TSX');
+});
diff --git a/web_src/js/modules/codeeditor/main.ts b/web_src/js/modules/codeeditor/main.ts
index e847f357cb3..8feea2b4753 100644
--- a/web_src/js/modules/codeeditor/main.ts
+++ b/web_src/js/modules/codeeditor/main.ts
@@ -41,10 +41,12 @@ export type CodemirrorEditor = {
   };
 };
 
+type LinguistLanguage = {name: string; extensions: string[]; filenames: string[]};
+
 export type CodemirrorModules = Awaited<ReturnType<typeof importCodemirror>>;
 
-async function importCodemirror() {
-  const [autocomplete, commands, language, languageData, lint, search, state, view, highlight, indentMarkers, vscodeKeymap] = await Promise.all([
+export async function importCodemirror() {
+  const [autocomplete, commands, language, languageData, lint, search, state, view, highlight, indentMarkers, vscodeKeymap, linguist] = await Promise.all([
     import('@codemirror/autocomplete'),
     import('@codemirror/commands'),
     import('@codemirror/language'),
@@ -56,8 +58,77 @@ async function importCodemirror() {
     import('@lezer/highlight'),
     import('@replit/codemirror-indentation-markers'),
     import('@replit/codemirror-vscode-keymap'),
+    import('../../../../assets/codemirror-languages.json'),
   ]);
-  return {autocomplete, commands, language, languageData, lint, search, state, view, highlight, indentMarkers, vscodeKeymap};
+  return {autocomplete, commands, language, languageData, lint, search, state, view, highlight, indentMarkers, vscodeKeymap, linguistLanguages: linguist.default as LinguistLanguage[]};
+}
+
+const escapeRegex = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const filenameUnion = (filenames: string[]) =>
+  filenames.length ? new RegExp(`^(${filenames.map(escapeRegex).join('|')})$`) : undefined;
+
+export function buildLanguageDescriptions(cm: CodemirrorModules): LanguageDescription[] {
+  const list: LanguageDescription[] = [
+    ...buildBaseLanguages(cm),
+    cm.language.LanguageDescription.of({
+      name: 'Markdown', extensions: ['md', 'markdown', 'mkd', 'mdown', 'mdwn', 'mkdn', 'mkdown'],
+      load: async () => (await import('@codemirror/lang-markdown')).markdown({codeLanguages: list}),
+    }),
+    cm.language.LanguageDescription.of({
+      name: 'Dockerfile', extensions: ['dockerfile', 'containerfile'],
+      filename: /^(Containerfile|Dockerfile)(\..+)?$/i,
+      load: async () => new cm.language.LanguageSupport(cm.language.StreamLanguage.define((await import('@codemirror/legacy-modes/mode/dockerfile')).dockerFile)),
+    }),
+    cm.language.LanguageDescription.of({
+      name: 'Elixir', extensions: ['ex', 'exs'],
+      load: async () => (await import('codemirror-lang-elixir')).elixir(),
+    }),
+    cm.language.LanguageDescription.of({
+      name: 'Nix', extensions: ['nix'],
+      load: async () => (await import('@replit/codemirror-lang-nix')).nix(),
+    }),
+    cm.language.LanguageDescription.of({
+      name: 'Svelte', extensions: ['svelte'],
+      load: async () => (await import('@replit/codemirror-lang-svelte')).svelte(),
+    }),
+    cm.language.LanguageDescription.of({
+      name: 'Makefile', extensions: ['mk', 'mak', 'make'], filename: /^(GNU|BSD)?[Mm]akefile(\..+)?$/,
+      load: async () => new cm.language.LanguageSupport(cm.language.StreamLanguage.define((await import('@codemirror/legacy-modes/mode/shell')).shell)),
+    }),
+    cm.language.LanguageDescription.of({
+      name: 'Dotenv', extensions: ['env'], filename: /^\.env(\..*)?$/,
+      load: async () => new cm.language.LanguageSupport(cm.language.StreamLanguage.define((await import('@codemirror/legacy-modes/mode/shell')).shell)),
+    }),
+    cm.language.LanguageDescription.of({
+      name: 'JSON5', extensions: ['json5', 'jsonc'],
+      load: async () => (await import('@codemirror/lang-json')).json(),
+    }),
+  ];
+  return list;
+}
+
+// Languages that the JSON omits because they're constructed manually above.
+const customNames = new Set(['Dockerfile', 'Markdown']);
+
+let baseLanguagesCache: LanguageDescription[] | null = null;
+function buildBaseLanguages(cm: CodemirrorModules): LanguageDescription[] {
+  if (baseLanguagesCache) return baseLanguagesCache;
+  const loadByName = new Map<string, LanguageDescription['load']>(
+    cm.languageData.languages.map((l: LanguageDescription) => [l.name, l.load.bind(l)]),
+  );
+  const overrides = cm.linguistLanguages
+    .filter((l) => loadByName.has(l.name))
+    .map((l) => cm.language.LanguageDescription.of({
+      name: l.name,
+      extensions: l.extensions,
+      filename: filenameUnion(l.filenames),
+      load: loadByName.get(l.name)!,
+    }));
+  const overrideNames = new Set(overrides.map((o) => o.name));
+  const fallback = cm.languageData.languages.filter(
+    (l: LanguageDescription) => !overrideNames.has(l.name) && !customNames.has(l.name),
+  );
+  return baseLanguagesCache = [...overrides, ...fallback];
 }
 
 function togglePreviewDisplay(previewable: boolean): void {
@@ -85,38 +156,7 @@ export async function createCodeEditor(textarea: HTMLTextAreaElement, filenameIn
   const previewableExts = new Set(config.previewableExtensions || []);
   const lineWrapExts = config.lineWrapExtensions || [];
   const cm = await importCodemirror();
-
-  const languageDescriptions: LanguageDescription[] = [
-    ...cm.languageData.languages.filter((l: LanguageDescription) => l.name !== 'Markdown'),
-    cm.language.LanguageDescription.of({
-      name: 'Markdown', extensions: ['md', 'markdown', 'mkd'],
-      load: async () => (await import('@codemirror/lang-markdown')).markdown({codeLanguages: languageDescriptions}),
-    }),
-    cm.language.LanguageDescription.of({
-      name: 'Elixir', extensions: ['ex', 'exs'],
-      load: async () => (await import('codemirror-lang-elixir')).elixir(),
-    }),
-    cm.language.LanguageDescription.of({
-      name: 'Nix', extensions: ['nix'],
-      load: async () => (await import('@replit/codemirror-lang-nix')).nix(),
-    }),
-    cm.language.LanguageDescription.of({
-      name: 'Svelte', extensions: ['svelte'],
-      load: async () => (await import('@replit/codemirror-lang-svelte')).svelte(),
-    }),
-    cm.language.LanguageDescription.of({
-      name: 'Makefile', filename: /^(GNUm|M|m)akefile$/,
-      load: async () => new cm.language.LanguageSupport(cm.language.StreamLanguage.define((await import('@codemirror/legacy-modes/mode/shell')).shell)),
-    }),
-    cm.language.LanguageDescription.of({
-      name: 'Dotenv', extensions: ['env'], filename: /^\.env(\..*)?$/,
-      load: async () => new cm.language.LanguageSupport(cm.language.StreamLanguage.define((await import('@codemirror/legacy-modes/mode/shell')).shell)),
-    }),
-    cm.language.LanguageDescription.of({
-      name: 'JSON5', extensions: ['json5', 'jsonc'],
-      load: async () => (await import('@codemirror/lang-json')).json(),
-    }),
-  ];
+  const languageDescriptions = buildLanguageDescriptions(cm);
   const matchedLang = cm.language.LanguageDescription.matchFilename(languageDescriptions, config.filename);
 
   const container = document.createElement('div');
diff --git a/web_src/js/modules/errors.ts b/web_src/js/modules/errors.ts
index d4fb549cfed..4b6504dc99b 100644
--- a/web_src/js/modules/errors.ts
+++ b/web_src/js/modules/errors.ts
@@ -2,10 +2,16 @@
 import {html} from '../utils/html.ts';
 import type {Intent} from '../types.ts';
 
+/** Extract a message string from an unknown caught value. */
 export function errorMessage(err: unknown): string {
   return (err as Error)?.message || String(err);
 }
 
+/** Extract a name string from an unknown caught value. */
+export function errorName(err: unknown): string {
+  return (err as Error)?.name ?? '';
+}
+
 export function showGlobalErrorMessage(msg: string, msgType: Intent = 'error', details?: string) {
   const parentContainer = document.querySelector('.page-content') ?? document.body;
   if (!parentContainer) {
diff --git a/web_src/js/modules/gitea-actions.ts b/web_src/js/modules/gitea-actions.ts
index e1dbfcede3b..005138a4d4d 100644
--- a/web_src/js/modules/gitea-actions.ts
+++ b/web_src/js/modules/gitea-actions.ts
@@ -1,5 +1,5 @@
 // see "models/actions/status.go", if it needs to be used somewhere else, move it to a shared file like "types/actions.ts"
-export type ActionsRunStatus = 'unknown' | 'waiting' | 'running' | 'success' | 'failure' | 'cancelled' | 'skipped' | 'blocked';
+export type ActionsStatus = 'unknown' | 'waiting' | 'running' | 'cancelling' | 'success' | 'failure' | 'cancelled' | 'skipped' | 'blocked';
 export type ActionsArtifactStatus = 'expired' | 'completed';
 
 export type ActionsRun = {
@@ -8,7 +8,7 @@ export type ActionsRun = {
   viewLink: string,
   title: string,
   titleHTML: string,
-  status: ActionsRunStatus,
+  status: ActionsStatus,
   canCancel: boolean,
   canApprove: boolean,
   canRerun: boolean,
@@ -43,7 +43,7 @@ export type ActionsRun = {
 
 export type ActionsRunAttempt = {
   attempt: number;
-  status: ActionsRunStatus;
+  status: ActionsStatus;
   done: boolean;
   link: string;
   current: boolean;
@@ -58,10 +58,14 @@ export type ActionsJob = {
   link: string;
   jobId: string;
   name: string;
-  status: ActionsRunStatus;
+  status: ActionsStatus;
   canRerun: boolean;
   needs?: string[];
   duration: string;
+
+  isReusableCaller: boolean;
+  parentJobID: number; // 0 for top-level jobs.
+  callUses?: string;
 };
 
 export type ActionsArtifact = {
diff --git a/web_src/js/modules/i18n.test.ts b/web_src/js/modules/i18n.test.ts
new file mode 100644
index 00000000000..0cea2d0f6d1
--- /dev/null
+++ b/web_src/js/modules/i18n.test.ts
@@ -0,0 +1,15 @@
+import {trN} from './i18n.ts';
+import {getCurrentLocale} from '../utils.ts';
+
+vi.mock('../utils.ts', () => ({getCurrentLocale: vi.fn()}));
+
+test('trN', () => {
+  vi.mocked(getCurrentLocale).mockReturnValue('en-US');
+  expect(trN(0, '%d job', '%d jobs')).toEqual('0 jobs');
+  expect(trN(1, '%d job', '%d jobs')).toEqual('1 job');
+  expect(trN(2, '%d job', '%d jobs')).toEqual('2 jobs');
+  expect(trN(1000, '%d job', '%d jobs')).toEqual('1000 jobs');
+  // languages without a distinct singular always use the plural form
+  vi.mocked(getCurrentLocale).mockReturnValue('zh-CN');
+  expect(trN(1, '%d job', '%d jobs')).toEqual('1 jobs');
+});
diff --git a/web_src/js/modules/i18n.ts b/web_src/js/modules/i18n.ts
new file mode 100644
index 00000000000..f31b88c856c
--- /dev/null
+++ b/web_src/js/modules/i18n.ts
@@ -0,0 +1,7 @@
+import {getCurrentLocale} from '../utils.ts';
+
+/** frontend `Locale.TrN`: pick the `_1` or `_n` form for `count` and interpolate `%d` */
+export function trN(count: number, form1: string, formN: string): string {
+  const form = new Intl.PluralRules(getCurrentLocale()).select(count) === 'one' ? form1 : formN;
+  return form.replace('%d', String(count));
+}
diff --git a/web_src/js/modules/search.ts b/web_src/js/modules/search.ts
new file mode 100644
index 00000000000..835053f646c
--- /dev/null
+++ b/web_src/js/modules/search.ts
@@ -0,0 +1,116 @@
+import {debounce} from 'throttle-debounce';
+import {GET} from './fetch.ts';
+import {errorName} from './errors.ts';
+import {html, htmlRaw} from '../utils/html.ts';
+import {urlQueryEscape} from '../utils/url.ts';
+
+export type SearchResult = {
+  title: string;
+  description?: string;
+  image?: string;
+};
+
+function buildResultHTML(result: SearchResult): string {
+  const img = result.image ? html`<div class="image"><img src="${result.image}" alt=""></div>` : '';
+  const desc = result.description ? html`<div class="description">${result.description}</div>` : '';
+  return html`${htmlRaw(img)}<div class="content"><div class="title">${result.title}</div>${htmlRaw(desc)}</div>`;
+}
+
+function buildResultElement(result: SearchResult): HTMLElement {
+  const item = document.createElement('div');
+  item.className = 'result';
+  item.innerHTML = buildResultHTML(result);
+  return item;
+}
+
+// single delegated outside-click handler; each attachSearchBox registers a {container, hide} entry
+const outsideClickBoxes = new Set<{container: HTMLElement; hide: () => void}>();
+document.addEventListener('click', (event) => {
+  for (const box of outsideClickBoxes) {
+    if (!box.container.contains(event.target as Node)) box.hide();
+  }
+});
+
+/** Attach an API-driven autocomplete to `container`. `parse` maps the raw JSON response into the rendered result list. The selected result's title is written to the input on selection. */
+export function attachSearchBox<T = unknown>(container: HTMLElement, url: string, parse: (raw: T, query: string) => SearchResult[], {minCharacters = 2}: {minCharacters?: number} = {}): void {
+  const input = container.querySelector<HTMLInputElement>('input.prompt') ?? container.querySelector<HTMLInputElement>('input');
+  if (!input) return;
+
+  let resultsEl = container.querySelector<HTMLElement>(':scope > .results');
+  if (!resultsEl) {
+    resultsEl = document.createElement('div');
+    resultsEl.className = 'results';
+    container.append(resultsEl);
+  }
+  const itemResults = new Map<HTMLElement, SearchResult>();
+  let fetchController: AbortController | null = null;
+
+  const hide = () => {
+    fetchController?.abort();
+    resultsEl.style.display = 'none';
+    resultsEl.replaceChildren();
+    itemResults.clear();
+  };
+
+  const render = (results: SearchResult[]) => {
+    if (!results.length) return hide();
+    itemResults.clear();
+    resultsEl.replaceChildren(...results.map((result) => {
+      const item = buildResultElement(result);
+      itemResults.set(item, result);
+      return item;
+    }));
+    resultsEl.style.display = 'block';
+  };
+
+  const select = (item: HTMLElement) => {
+    input.value = itemResults.get(item)!.title;
+    input.dispatchEvent(new Event('change', {bubbles: true}));
+    hide();
+  };
+
+  const search = debounce(200, async (query: string) => {
+    fetchController?.abort();
+    if (query.length < minCharacters) return hide();
+    const ctrl = (fetchController = new AbortController());
+    try {
+      const response = await GET(url.replaceAll('{query}', urlQueryEscape(query)), {signal: ctrl.signal});
+      if (!response.ok) return hide();
+      const results = parse(await response.json(), query);
+      // only render if the fetch wasn't aborted (e.g. by hide()) and the input still matches
+      if (!ctrl.signal.aborted && input.value === query) render(results);
+    } catch (err) {
+      if (errorName(err) !== 'AbortError') hide();
+    }
+  });
+  // cancel + hide ensures a debounced fetch scheduled before any of these can't fire afterwards
+  const dismiss = () => { search.cancel(); hide() };
+
+  input.addEventListener('input', () => search(input.value));
+  input.addEventListener('focus', () => { if (itemResults.size) resultsEl.style.display = 'block'; });
+  input.addEventListener('blur', () => { search.cancel(); setTimeout(hide, 150) }); // hide deferred so a result mousedown can land first
+  input.addEventListener('keydown', (event) => {
+    const resultEls = Array.from(resultsEl.querySelectorAll<HTMLElement>('.result'));
+    if (!resultEls.length) return;
+    const index = resultEls.findIndex((item) => item.classList.contains('active'));
+    if (event.key === 'ArrowDown' || event.key === 'ArrowUp') {
+      event.preventDefault();
+      resultEls[index]?.classList.remove('active');
+      const next = event.key === 'ArrowDown' ? (index + 1) % resultEls.length : index <= 0 ? resultEls.length - 1 : index - 1;
+      resultEls[next].classList.add('active');
+    } else if (event.key === 'Enter' && index >= 0) {
+      event.preventDefault();
+      select(resultEls[index]);
+    } else if (event.key === 'Escape') {
+      dismiss();
+    }
+  });
+  // mousedown fires before input blur so the selection registers before blur-hide kicks in
+  resultsEl.addEventListener('mousedown', (event) => {
+    const target = (event.target as HTMLElement).closest<HTMLElement>('.result');
+    if (!target) return;
+    event.preventDefault();
+    select(target);
+  });
+  outsideClickBoxes.add({container, hide: dismiss});
+}
diff --git a/web_src/js/swagger.ts b/web_src/js/swagger.ts
index ee0fd289367..c73002a6f13 100644
--- a/web_src/js/swagger.ts
+++ b/web_src/js/swagger.ts
@@ -1,5 +1,3 @@
-// FIXME: INCORRECT-VITE-MANIFEST-PARSER: it just happens to work for current dependencies
-// If this module depends on another one and that one imports "swagger.css", then {{AssetURI "css/swagger.css"}} won't work
 import '../css/swagger-standalone.css';
 import {initSwaggerUI} from './render/swagger.ts';
 
diff --git a/web_src/js/utils/time.ts b/web_src/js/utils/time.ts
index 994c8c8f3ba..cc005a13048 100644
--- a/web_src/js/utils/time.ts
+++ b/web_src/js/utils/time.ts
@@ -65,18 +65,25 @@ export function fillEmptyStartDaysWithZeroes(startDays: number[], data: DayDataO
 
 let dateFormat: Intl.DateTimeFormat;
 
-/** Format a Date object to document's locale, but with 24h format from user's current locale because this
- *  option is a personal preference of the user, not something that the document's locale should dictate. */
+// ISO 8601 UTC with 7-digit fractional seconds, matching Go's `2006-01-02T15:04:05.0000000Z07:00`
+export function formatDatetimeISO(unixSeconds: number): string {
+  const base = new Date(unixSeconds * 1000).toISOString().slice(0, 19);
+  const frac = unixSeconds - Math.floor(unixSeconds);
+  const fracInt = Math.floor(frac * 10_000_000);
+  return `${base}.${String(fracInt).padStart(7, '0')}Z`;
+}
+
+/** Format a Date to a localized format, for example "21 May 2026, 14:30:45". */
 export function formatDatetime(date: Date | number): string {
   if (!dateFormat) {
-    // TODO: replace `hour12` with `Intl.Locale.prototype.getHourCycles` once there is broad browser support
     dateFormat = new Intl.DateTimeFormat(getCurrentLocale(), {
-      day: 'numeric',
+      day: '2-digit',
       month: 'short',
       year: 'numeric',
-      hour: 'numeric',
-      hour12: !Number.isInteger(Number(new Intl.DateTimeFormat([], {hour: 'numeric'}).format())),
+      hour: '2-digit',
+      hourCycle: new Intl.DateTimeFormat([], {hour: 'numeric'}).resolvedOptions().hourCycle === 'h12' ? 'h12' : 'h23',
       minute: '2-digit',
+      second: '2-digit',
     });
   }
   return dateFormat.format(date);
diff --git a/web_src/js/utils/url.test.ts b/web_src/js/utils/url.test.ts
index a2e73393753..0a7e27ca619 100644
--- a/web_src/js/utils/url.test.ts
+++ b/web_src/js/utils/url.test.ts
@@ -1,4 +1,4 @@
-import {linkifyURLs, pathEscape, pathEscapeSegments, toOriginUrl, urlQueryEscape} from './url.ts';
+import {linkifyURLs, pathEscape, pathEscapeSegments, urlQueryEscape} from './url.ts';
 
 describe('escape', () => {
   const queryNonAscii = " !\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~";
@@ -45,19 +45,3 @@ test('linkifyURLs', () => {
   expect(linkifyURLs('https://evil.com/\nonclick=alert(1)')).toEqual(`${link('https://evil.com/')}\nonclick=alert(1)`);
   expect(linkifyURLs('https://evil.com/&#34;onmouseover=alert(1)')).toEqual(`${link('https://evil.com/&#34;onmouseover=alert')}(1)`);
 });
-
-test('toOriginUrl', () => {
-  const oldLocation = String(window.location);
-  for (const origin of ['https://example.com', 'https://example.com:3000']) {
-    window.location.assign(`${origin}/`);
-    expect(toOriginUrl('/')).toEqual(`${origin}/`);
-    expect(toOriginUrl('/org/repo.git')).toEqual(`${origin}/org/repo.git`);
-    expect(toOriginUrl('https://another.com')).toEqual(`${origin}/`);
-    expect(toOriginUrl('https://another.com/')).toEqual(`${origin}/`);
-    expect(toOriginUrl('https://another.com/org/repo.git')).toEqual(`${origin}/org/repo.git`);
-    expect(toOriginUrl('https://another.com:4000')).toEqual(`${origin}/`);
-    expect(toOriginUrl('https://another.com:4000/')).toEqual(`${origin}/`);
-    expect(toOriginUrl('https://another.com:4000/org/repo.git')).toEqual(`${origin}/org/repo.git`);
-  }
-  window.location.assign(oldLocation);
-});
diff --git a/web_src/js/utils/url.ts b/web_src/js/utils/url.ts
index 927f0937a4f..84328faf249 100644
--- a/web_src/js/utils/url.ts
+++ b/web_src/js/utils/url.ts
@@ -57,19 +57,3 @@ export function linkifyURLs(html: string): string {
     return `<a href="${cleanUrl}" target="_blank">${cleanUrl}</a>${trailing}`; // eslint-disable-line github/unescaped-html-literal
   });
 }
-
-/** Convert an absolute or relative URL to an absolute URL with the current origin. It only
- *  processes absolute HTTP/HTTPS URLs or relative URLs like '/xxx' or '//host/xxx'. */
-export function toOriginUrl(urlStr: string) {
-  try {
-    if (urlStr.startsWith('http://') || urlStr.startsWith('https://') || urlStr.startsWith('/')) {
-      const {origin, protocol, hostname, port} = window.location;
-      const url = new URL(urlStr, origin);
-      url.protocol = protocol;
-      url.hostname = hostname;
-      url.port = port || (protocol === 'https:' ? '443' : '80');
-      return url.toString();
-    }
-  } catch {}
-  return urlStr;
-}
diff --git a/web_src/js/vitest.setup.ts b/web_src/js/vitest.setup.ts
index 190196cabd6..a6ec019ff8a 100644
--- a/web_src/js/vitest.setup.ts
+++ b/web_src/js/vitest.setup.ts
@@ -16,5 +16,3 @@ window.config = {
 };
 
 window.testModules = {};
-
-export {}; // mark as module for top-level await