mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-03 17:37:53 +02:00
2aa754f28710dff24e2a8b4adec204b6fa5631f7
20878
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  ZPascalandI539231
|
2aa754f287 | fix: Remove yaml v3→v4 migration from this PR (moved to dedicated PR) | ||
 Pascal ZimmermannandGitHub
|
c5b51f954b | Merge branch 'main' into add-matrix-dynamic-job-input-support | ||
 GiteaBot
|
d8a45db3dd | [skip ci] Updated translations via Crowdin | ||
 
|
502d3c1f9d |
ci: tweak files-changed, add free-disk-space (#37819)
Reduces CI minutes consumption by narrowing the `files-changed` filters. - DB matrix (`pgsql`/`mysql`/`mssql`/`unit`) now runs only on real backend changes. `test-sqlite` stays gated on `actions`, so it remains the smoke check that validates CI-infra changes (composite-action edits, workflow edits, renovate action-pin bumps) without spinning up the full matrix. - Fix the `templates` filter: the SVG template linter is `tools/lint-templates-svg.ts`, so the `tools/lint-templates-*.js` glob matched nothing. - Add missed paths: `tsconfig.json` and `tools/generate-svg-vscode-extensions.json` to `frontend`, `eslint.json.config.ts` to `json`, and `.github/actions/docker-dryrun/**` to `docker`. --- This PR was written with the help of Claude Opus 4.7 --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> |
||
|
Pascal Zimmermann
|
a790f7aa4b | Merge branch 'main' into add-matrix-dynamic-job-input-support | ||
|
Pascal Zimmermann
|
9c8c05eb2e | fix: Adjust the jobparser and the matrix part | ||
|
|
a290d81eab |
ci: cap Elasticsearch heap in db-tests (#37816)
Elasticsearch JVM heap defaults to ~50% of detected host RAM, typically way too much for our little tests and it starved the other runner processes from memory. Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> |
||
 
|
570173b409 |
ci: add shellcheck linter (#37682)
- Adds `make lint-shell`. uses local `shellcheck` if its version matches, otherwise runs the pinned image via docker or podman - `.shellcheckrc` disables the most annoying rules - Fixes findings across existing scripts Fixes: #37648 Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: TheFox0x7 <thefox0x7@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> |
||
 
|
f0eb065df7 |
enhance(ui): add gap between file tree and diff on pr changes page (#37798)
### Before <img width="410" height="324" alt="file-tree-before" src="https://github.com/user-attachments/assets/cdc369a4-23b0-4f9c-8580-f87e84cb1400" /> ### After <img width="395" height="323" alt="file-tree-after" src="https://github.com/user-attachments/assets/dd4932a6-f7f6-4b44-82cf-bcfaadadc18c" /> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> |
||
|
12fcd78e8e |
build(snap): publish nightly version to snapcraft via actions (#37814)
The secret is added to the repo already. Right now this only publishes commits to main branch to the "latest/edge" snap channel, but if this is successful we can add more workflows/logic to be able to publish RCs/fully tagged versions too. --------- Co-authored-by: Nicolas <bircni@icloud.com> |
||
|
|
f95c210abe |
ci: split pgsql shards into plain jobs, dedupe setup actions (#37802)
1. Split the psql matrix jobs into composite actions. Matrix jobs that can skip do not work with required checks on GitHub because skipped and unskipped emit different job names (GitHub bug https://github.com/orgs/community/discussions/9141). 2. Dedupe node and go setup steps into composite actions Currently test-psql branch protection is disabled, will re-enable when merging this. --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Nicolas <bircni@icloud.com> |
||
|
|
7c12446c1f |
test(e2e): add comment, release, star, PR and fork tests (#37800)
Adds Playwright e2e coverage for five high-value workflows, each driven through semantic locators with API-based setup: - comment on and close an issue - publish a release - star and watch a repository - create a pull request from the compare page - fork a repository Also passes `autoInit: false` in existing tests that only exercise DB-backed units (issues, reactions, milestones, projects, events), skipping an unused initial commit to speed up their setup and reduce parallel git contention. --- This PR was written with the help of Claude Opus 4.7 --------- Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Nicolas <bircni@icloud.com> |
||
|
GiteabotandGitHub
|
4c37f4dacb | fix(deps): update module golang.org/x/net to v0.55.0 [security] (#37813) | ||
|
bc9d53a5a8 |
fix(issues): clear stale ReviewTypeRequest when submitting pending re… (#37809)
When SubmitReview updates an existing pending review in-place, it was not deleting the reviewer's ReviewTypeRequest row, unlike the CreateReview path. That leftover row causes AddReviewRequest to bail out silently, making the re-request icon in the PR sidebar a no-op. Fixes #37808 (Claude Opus 4.7) <!-- Before submitting: - Target the `main` branch; release branches are for backports only. - Use a Conventional Commits title, e.g. `fix(repo): handle empty branch names`. - Read the contributing guidelines: https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md - Documentation changes go to https://gitea.com/gitea/docs Describe your change below and link any issue it fixes. --> --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: Nicolas <bircni@icloud.com> |
||
|
bf1b54c3e3 |
fix(api): handle partial failures in push mirror synchronization gracefully (#37782)
This MR fixes an issue in the sync push mirrors endpoint. Previously, when triggering the synchronization of all push mirrors for a specific repository, the entire operation would stop if a single mirror failed for any reason. As a result, the remaining mirrors were not processed. With this fix, failures on individual push mirrors no longer abort the whole synchronization process. --------- Signed-off-by: Nicolas <bircni@icloud.com> Co-authored-by: Nicolas <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> |
||
|
Pascal Zimmermann
|
cfcb78a948 | fix: Adjust the jobparser functionality | ||
|
GiteabotandGitHub
|
9d737a6400 |
fix(deps): update module golang.org/x/crypto to v0.52.0 [security] (#37806)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.51.0` → `v0.52.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.51.0...refs/tags/v0.52.0) |  |  | --- ### Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent [CVE-2026-39833](https://nvd.nist.gov/vuln/detail/CVE-2026-39833) / [GO-2026-5005](https://pkg.go.dev/vuln/GO-2026-5005) <details> <summary>More information</summary> #### Details The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested. #### Severity Unknown #### References - [https://go.dev/issue/79436](https://go.dev/issue/79436) - [https://go.dev/cl/778640](https://go.dev/cl/778640) - [https://go.dev/cl/778641](https://go.dev/cl/778641) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5005) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent [CVE-2026-39832](https://nvd.nist.gov/vuln/detail/CVE-2026-39832) / [GO-2026-5006](https://pkg.go.dev/vuln/GO-2026-5006) <details> <summary>More information</summary> #### Details When adding a key to a remote agent constraint extensions such as restrict-destination-v00@​openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them. #### Severity Unknown #### References - [https://go.dev/issue/79435](https://go.dev/issue/79435) - [https://go.dev/cl/778642](https://go.dev/cl/778642) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5006) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh [CVE-2026-46597](https://nvd.nist.gov/vuln/detail/CVE-2026-46597) / [GO-2026-5013](https://pkg.go.dev/vuln/GO-2026-5013) <details> <summary>More information</summary> #### Details An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. #### Severity Unknown #### References - [https://go.dev/issue/79561](https://go.dev/issue/79561) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781620](https://go.dev/cl/781620) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5013) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh [CVE-2026-39828](https://nvd.nist.gov/vuln/detail/CVE-2026-39828) / [GO-2026-5014](https://pkg.go.dev/vuln/GO-2026-5014) <details> <summary>More information</summary> #### Details When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error. #### Severity Unknown #### References - [https://go.dev/issue/79562](https://go.dev/issue/79562) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781621](https://go.dev/cl/781621) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5014) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh [CVE-2026-39835](https://nvd.nist.gov/vuln/detail/CVE-2026-39835) / [GO-2026-5015](https://pkg.go.dev/vuln/GO-2026-5015) <details> <summary>More information</summary> #### Details SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil. #### Severity Unknown #### References - [https://go.dev/issue/79563](https://go.dev/issue/79563) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781660](https://go.dev/cl/781660) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5015) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh [CVE-2026-39827](https://nvd.nist.gov/vuln/detail/CVE-2026-39827) / [GO-2026-5016](https://pkg.go.dev/vuln/GO-2026-5016) <details> <summary>More information</summary> #### Details An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection. #### Severity Unknown #### References - [https://go.dev/issue/35127](https://go.dev/issue/35127) - [https://go.dev/cl/781320](https://go.dev/cl/781320) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5016) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh [CVE-2026-39830](https://nvd.nist.gov/vuln/detail/CVE-2026-39830) / [GO-2026-5017](https://pkg.go.dev/vuln/GO-2026-5017) <details> <summary>More information</summary> #### Details A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded. #### Severity Unknown #### References - [https://go.dev/issue/79564](https://go.dev/issue/79564) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781640](https://go.dev/cl/781640) - [https://go.dev/cl/781664](https://go.dev/cl/781664) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5017) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh [CVE-2026-39829](https://nvd.nist.gov/vuln/detail/CVE-2026-39829) / [GO-2026-5018](https://pkg.go.dev/vuln/GO-2026-5018) <details> <summary>More information</summary> #### Details The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2. #### Severity Unknown #### References - [https://go.dev/issue/79565](https://go.dev/issue/79565) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781641](https://go.dev/cl/781641) - [https://go.dev/cl/781661](https://go.dev/cl/781661) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5018) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh [CVE-2026-39831](https://nvd.nist.gov/vuln/detail/CVE-2026-39831) / [GO-2026-5019](https://pkg.go.dev/vuln/GO-2026-5019) <details> <summary>More information</summary> #### Details The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@​openssh.com, sk-ssh-ed25519@​openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback. #### Severity Unknown #### References - [https://go.dev/issue/79566](https://go.dev/issue/79566) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781662](https://go.dev/cl/781662) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5019) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh [CVE-2026-39834](https://nvd.nist.gov/vuln/detail/CVE-2026-39834) / [GO-2026-5020](https://pkg.go.dev/vuln/GO-2026-5020) <details> <summary>More information</summary> #### Details When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation. #### Severity Unknown #### References - [https://go.dev/issue/79567](https://go.dev/issue/79567) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781663](https://go.dev/cl/781663) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5020) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking auth bypass via unenforced @​revoked status in golang.org/x/crypto/ssh/knownhosts [CVE-2026-42508](https://nvd.nist.gov/vuln/detail/CVE-2026-42508) / [GO-2026-5021](https://pkg.go.dev/vuln/GO-2026-5021) <details> <summary>More information</summary> #### Details Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @​revoked. #### Severity Unknown #### References - [https://go.dev/issue/79568](https://go.dev/issue/79568) - [https://go.dev/cl/781220](https://go.dev/cl/781220) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5021) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh [CVE-2026-46595](https://nvd.nist.gov/vuln/detail/CVE-2026-46595) / [GO-2026-5023](https://pkg.go.dev/vuln/GO-2026-5023) <details> <summary>More information</summary> #### Details Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. #### Severity Unknown #### References - [https://go.dev/issue/79570](https://go.dev/issue/79570) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) - [https://go.dev/cl/781642](https://go.dev/cl/781642) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5023) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent [CVE-2026-46598](https://nvd.nist.gov/vuln/detail/CVE-2026-46598) / [GO-2026-5033](https://pkg.go.dev/vuln/GO-2026-5033) <details> <summary>More information</summary> #### Details For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used. #### Severity Unknown #### References - [https://go.dev/issue/79596](https://go.dev/issue/79596) - [https://go.dev/cl/781360](https://go.dev/cl/781360) - [https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5033) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> |
||
|
Pascal Zimmermann
|
f2f4f60057 | fix: Adjust the checks-backend case | ||
|
Pascal Zimmermann
|
c57e25a68b | fix Adjust the tests | ||
|
Pascal Zimmermann
|
d263b1f46f | feat: Merge the main branch | ||
|
|
8874ba739b |
fix(build): swagger css import (#37801)
Snap build failure caused by missed swagger ui css file. ``` :: [plugin vite:css] /build/gitea/parts/gitea/build/web_src/css/swagger-standalone.css:undefined:NaN :: Error: [postcss] ENOENT: no such file or directory, open '../../node_modules/swagger-ui-dist/swagger-ui.css' ``` Co-authored-by: silverwind <me@silverwind.io> |
||
|
b7e95cc48c |
feat: add copy button to action step header, improve other copy buttons (#37744)
- Adds a copy button to each action step header that copies the step's rendered log output to clipboard. - Extract a shared `copyToClipboard(target, content)` helper in `clipboard.ts` that adds SVG success/failure feedback. - `is-loading` height for the new helper is sourced from `--loading-size`. - Change actions log timestamp format to include seconds. The indented-markdown code-block fix has moved to #37748. <img width="244" height="165" alt="copystep" src="https://github.com/user-attachments/assets/ce286b51-f77b-4d82-b161-ca0aa7ec4fdc" /> <img width="187" height="150" alt="copybt" src="https://github.com/user-attachments/assets/5366b290-b776-496d-8dd4-58d5fa60be92" /> Fixes: https://github.com/go-gitea/gitea/issues/26116 --- This PR was written with the help of Claude Opus 4.7 --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> |
||
|
|
2e96e8227f |
style: misc UI fixes (#37691)
- Action view sidebar: rename `job-brief-item` to `action-view-sidebar-item`, fix trash icon overflow on long artifact names, align artifact and workflow hover styles with the jobs list - Branches: expand new PR button cell to three wide so the button is not clipped on narrow viewports - Dashboard feed: add `tw-max-w-full` so long issue titles truncate - Reactions: tighten label padding <img width="261" height="65" alt="Screenshot 2026-05-13 at 16 18 33" src="https://github.com/user-attachments/assets/ecfe8f37-4a65-4839-b8c0-defccc85482c" /> <img width="154" height="126" alt="Screenshot 2026-05-13 at 16 19 25" src="https://github.com/user-attachments/assets/41302134-d1b7-401a-be2d-79173adb6d17" /> <img width="405" height="378" alt="Screenshot 2026-05-13 at 16 47 18" src="https://github.com/user-attachments/assets/e2c5cdd4-f11d-498c-b17e-c74c80c0ddf7" /> <img width="206" height="149" alt="Screenshot 2026-05-13 at 16 55 53" src="https://github.com/user-attachments/assets/7787125d-04b1-4500-b9b8-2637845509d6" /> <img width="858" height="135" alt="Screenshot 2026-05-13 at 16 58 41" src="https://github.com/user-attachments/assets/cb5bdf56-3891-469d-aa77-ea38855958c1" /> <img width="434" height="128" alt="Screenshot 2026-05-13 at 17 00 43" src="https://github.com/user-attachments/assets/60f2c34d-b345-4813-8f6d-a95bf51021b4" /> --- This PR was written with the help of Claude Opus 4.7 --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
|
93b8fdcd68 |
ci: shard tests and reduce redundant work (#37618)
Critical path ~25:42 → ~19:56 (−22%), ~0% CI minutes. - `test-pgsql` shards 2-way. Branch protection: replace `test-pgsql` with `test-pgsql-shards (1)` + `test-pgsql-shards (2)`; `test-unit`, sqlite/mysql/mssql unchanged — pgsql dominates the critical path. - `test-unit` runs `bindata` then `bindata gogit` sequentially. cache-seeder pre-warms the race-instrumented test compile cache and the integration test binary so PR jobs warm-start. - Cache writes restricted to cache-seeder; PR jobs use `actions/cache/restore`. Defends against PR cache poisoning and frees the 10 GB cap from PR churn. - `go-cache` action: dropped the `cache-name` input. One gobuild cache, one golangci-lint cache. Seeder lint job restores but doesn't save gobuild, so only one writer populates it. - `tools/test-integration.sh` shards the integration binary via `-test.list`; `TestMain` short-circuits DB init in list mode. `TestAPILFSNotStarted` / `TestAPILFSLocksNotStarted` switched to `test.MockVariableValue` — latent `setting.LFS.StartServer` global-state leak uncovered by sharding. --- This PR was written with the help of Claude Opus 4.7 --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> |
||
|
silverwindandGitHub
|
33c60ad7b2 | chore: simplify issue and pull request templates (#37799) | ||
|
NicolasandGitHub
|
2fde11dfbb | chore: Update 1.26.2 changelog in main (#37796) | ||
|
|
552c29a259 |
fix(actions): make artifact signature payloads unambiguous (#37707)
This PR hardens artifact URL signing by encoding signature inputs in an unambiguous binary payload before computing the HMAC. What it changes: - replace direct concatenation-style signing inputs with explicit payload builders - encode string fields with a length prefix before appending their bytes - encode integer fields as fixed-width binary values instead of decimal text - apply the same hardening to both: - Actions Artifact V4 signing in `routers/api/actions/artifactsv4.go` - artifact download signing in `routers/api/v1/repo/action.go` - add regression tests that verify distinct field combinations produce distinct payloads and signatures Why: The previous signing logic built HMAC inputs by appending multiple fields without a strongly structured representation. That kind of construction can create ambiguity at field boundaries, where different parameter combinations may serialize into the same byte stream for signing. This change removes that ambiguity by constructing a deterministic payload format with explicit boundaries between fields. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> |
||
|
Lunny XiaoandGitHub
|
304f8a551a | chore: Update giteabot to fix failure when backport (#37789) | ||
|
GiteabotandGitHub
|
42e167b054 |
fix(deps): update module github.com/go-git/go-git/v5 to v5.19.1 [security] (#37786)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/go-git/go-git/v5](https://redirect.github.com/go-git/go-git) | `v5.19.0` → `v5.19.1` |  |  | --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> |
||
|
9c8d55daf8 |
fix(pull): handle empty pull request files view to allow reviews (#37783)
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
  
|
7e436972f9 |
fix(markup): make RenderString never fail (#37779)
Fix #37778 --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: wxiaoguang <2114189+wxiaoguang@users.noreply.github.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> |
||
|
Pascal Zimmermann
|
3f27d054f8 | fix: Handle the merge conflicts | ||
|
|
621aa67e7d |
fix(markup): wrap indented code blocks for the code-copy button (#37748)
Indented (4-space) code blocks were emitted by goldmark's default renderer as plain `<pre><code>` without the `code-block-container` wrapper that the JS `initMarkupCodeCopy` keys on. As a result, only fenced code blocks received the copy button. Register `ast.KindCodeBlock` with a renderer that produces the same wrapper as the highlighting renderer so both syntaxes get the button. Extends `TestMarkdownFencedCodeBlock` to assert the wrapper is emitted for indented blocks (and that HTML inside is escaped). Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
Lunny XiaoandGitHub
|
171df0c9ff | fix(permissions): Fix reading permission (#37769) | ||
|
dbf4828169 |
fix: add natural sort to sortTreeViewNodes (#37772)
Aligns the sorting behavior of view-file-tree with repo-files-table. Attachment below： <img width="427" height="713" alt="fix-bug-sort" src="https://github.com/user-attachments/assets/0da7d7b6-3970-459d-b3c0-f57200dc73b7" /> --------- Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Nicolas <bircni@icloud.com> |
||
|
wxiaoguangandGitHub
|
5ad70f79ba |
fix: package creation unique conflict (#37774)
fix #30973 |
||
|
GiteabotandGitHub
|
343eaa8940 |
fix(deps): update npm dependencies (#37768)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [katex](https://katex.org) ([source](https://redirect.github.com/KaTeX/KaTeX)) | [`0.16.45` → `0.16.46`](https://renovatebot.com/diffs/npm/katex/0.16.45/0.16.46) |  |  | | [vue-tsc](https://redirect.github.com/vuejs/language-tools) ([source](https://redirect.github.com/vuejs/language-tools/tree/HEAD/packages/tsc)) | [`3.2.8` → `3.2.9`](https://renovatebot.com/diffs/npm/vue-tsc/3.2.8/3.2.9) |  |  | |
||
|
GiteabotandGitHub
|
0b7fc8a579 |
fix(deps): update module gitlab.com/gitlab-org/api/client-go/v2 to v2.26.0 (#37771)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go) | `v2.25.0` → `v2.26.0` |  |  | |
||
|
|
a1de9e57c2 |
ci: split giteabot workflow (#37770)
## What This PR updates the giteabot workflows to use the newer action version that supports selecting individual checks, and splits the workflow into two separate jobs: - `giteabot backport` runs only the `backport` check on pushes to `main` - `giteabot` handles the remaining bot tasks on PR-related events, scheduled runs, and manual dispatch ## Why Previously, the single workflow handled both backporting and the other maintenance tasks together. With the new giteabot action supporting configurable checks, splitting the workflow makes the triggers clearer and avoids running non-backport maintenance on every push to `main`. ## Changes - upgrade `go-gitea/giteabot` to a revision that supports the `checks` input - move the `main` branch `push` trigger into a dedicated backport workflow - keep non-backport automation in the existing workflow - add a `workflow_dispatch` input so non-backport checks can be selected manually when needed --- Helped by a coding agent with Codex 5.4 --------- Co-authored-by: Nicolas <bircni@icloud.com> |
||
|
GiteaBot
|
78d744aa01 | [skip ci] Updated translations via Crowdin | ||
|
|
f2a1271f16 |
fix: Unify public-only token filtering in API queries and repo access checks (#37118)
This PR closes remaining `public-only` token gaps in the API by making the restriction apply consistently across repository, organization, activity, notification, and authenticated `/api/v1/user/...` routes. Previously, `public-only` tokens were still able to: - receive private results from some list/search/self endpoints, - access repository data through ID-based lookups, - and reach several authenticated self routes that should remain unavailable for public-only access. This change treats `public-only` as a cross-cutting visibility boundary: - list/search endpoints now filter private resources consistently, - repository lookups enforce the same restriction even when addressed indirectly, - and self routes that inherently expose or mutate private account state now reject `public-only` tokens. --- Generated by a coding agent with Codex 5.2 --------- Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> |
||
|
GiteabotandGitHub
|
81b544c279 |
fix(deps): update module google.golang.org/grpc to v1.81.1 (#37762)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) | `v1.81.0` → `v1.81.1` |  |  | --- ### Release Notes <details> <summary>grpc/grpc-go (google.golang.org/grpc)</summary> ### [`v1.81.1`](https://redirect.github.com/grpc/grpc-go/releases/tag/v1.81.1): Release 1.81.1 [Compare Source](https://redirect.github.com/grpc/grpc-go/compare/v1.81.0...v1.81.1) ### Security - xds/rbac: Fix a potential authorization bypass caused by incorrectly falling through URI/DNS SANs to Subject Distinguished Name (DN) when matching the authenticated principal name. With this fix, only the first non-empty identity source will be used, as per [gRFC A41](https://redirect.github.com/grpc/proposal/blob/master/A41-xds-rbac.md). ([#​9111](https://redirect.github.com/grpc/grpc-go/issues/9111)) - Special Thanks: [@​al4an444](https://redirect.github.com/al4an444) ### Bug Fixes - otel: Segregate client and server RPC information used for metrics and traces, to avoid one overwriting the other. ([#​9081](https://redirect.github.com/grpc/grpc-go/issues/9081)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> |
||
|
wxiaoguangandGitHub
|
ff1b8b2b92 |
chore: make DefaultTitleSource default to auto to match GitHub (#37767)
It is a changed (breaking) behavior introduced in 1.26, no need to have such a breaking change. |
||
|
|
985ca76db0 |
ci: fix cache-related issues (#37761)
Fixes two recurring CI failures: 1. `cache-seeder.yml` lint-backend missing a `make generate-go` before linting with `TAGS=bindata`, and `pull-compliance.yml` lint-on-demand failing its post-step pnpm cache save when no pnpm-using conditional step runs. 2. Drops `cache: pnpm` from lint-on-demand and adds `make generate-go` to cache-seeder's lint job. --- This PR was written with the help of Claude Opus 4.7 --------- Signed-off-by: silverwind <me@silverwind.io> Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com> |
||
|
wxiaoguangandGitHub
|
c37b5241d7 |
chore: fix tests (#37760)
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> |
||
|
|
912afcaa51 |
refactor(waitgroup): replace Add/Done goroutines with WaitGroup.Go (#37764)
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: wxiaoguang <2114189+wxiaoguang@users.noreply.github.com> |
||
|
|
e60ca35d52 |
fix(deps): update go dependencies (#37752)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | code.gitea.io/sdk/gitea | `v0.25.0` → `v0.25.1` |  |  | require | patch | | | [gitea.com/gitea/runner](https://gitea.com/gitea/runner) | `v1.0.0` → `v1.0.3` |  |  | require | patch | `v1.0.4` | | [github.com/getkin/kin-openapi](https://redirect.github.com/getkin/kin-openapi) | `v0.137.0` → `v0.138.0` |  |  | require | minor | | | [github.com/go-co-op/gocron/v2](https://redirect.github.com/go-co-op/gocron) | `v2.21.1` → `v2.21.2` |  |  | require | patch | | | [github.com/go-webauthn/webauthn](https://redirect.github.com/go-webauthn/webauthn) | `v0.17.2` → `v0.17.3` |  |  | require | patch | | | [github.com/google/pprof](https://redirect.github.com/google/pprof) | `545e8a4` → `92041b7` |  |  | require | digest | | | [github.com/wneessen/go-mail](https://redirect.github.com/wneessen/go-mail) | `v0.7.2` → `v0.7.3` |  |  | require | patch | | | [gitlab.com/gitlab-org/api/client-go/v2](https://gitlab.com/gitlab-org/api/client-go) | `v2.24.1` → `v2.25.0` |  |  | require | minor | `v2.27.0` (+2) | | [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) | [`v0.50.0` → `v0.51.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.50.0...refs/tags/v0.51.0) |  |  | require | minor | | | [golang.org/x/image](https://pkg.go.dev/golang.org/x/image) | [`v0.39.0` → `v0.40.0`](https://cs.opensource.google/go/x/image/+/refs/tags/v0.39.0...refs/tags/v0.40.0) |  |  | require | minor | | | [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.53.0` → `v0.54.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.53.0...refs/tags/v0.54.0) |  |  | require | minor | | | [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.36.0` → `v0.37.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.36.0...refs/tags/v0.37.0) |  |  | require | minor | | | [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `v1.50.0` → `v1.50.1` |  |  | require | patch | | --- ### Release Notes <details> <summary>gitea/runner (gitea.com/gitea/runner)</summary> ### [`v1.0.3`](https://gitea.com/gitea/runner/releases/tag/v1.0.3) [Compare Source](https://gitea.com/gitea/runner/compare/v1.0.2...v1.0.3) #### Changelog - fix: isolate per-task runner envs ([#​959](https://redirect.github.com/gitea/runner/issues/959)) - fix(deps): update module github.com/opencontainers/selinux to v1.14.1 ([#​955](https://redirect.github.com/gitea/runner/issues/955)) - fix(deps): update mergo to v1.0.2 (now `dario.cat/mergo`) ([#​954](https://redirect.github.com/gitea/runner/issues/954)) - fix: ensure `dbfs_data` is cleaned up after task completion ([#​952](https://redirect.github.com/gitea/runner/issues/952)) - fix(artifactcache): preserve cache key case to stop redundant uploads ([#​947](https://redirect.github.com/gitea/runner/issues/947)) - fix(deps): update module golang.org/x/term to v0.43.0 ([#​948](https://redirect.github.com/gitea/runner/issues/948)) ### [`v1.0.2`](https://gitea.com/gitea/runner/releases/tag/v1.0.2) [Compare Source](https://gitea.com/gitea/runner/compare/v1.0.1...v1.0.2) #### Changelog - fix: overwrite read-only files when copying action directories ([#​942](https://redirect.github.com/gitea/runner/issues/942)) - docs: add apparmor=rootlesskit in security\_opt ([#​937](https://redirect.github.com/gitea/runner/issues/937)) - fix: serialize action-cache reads to prevent worktree race ([#​938](https://redirect.github.com/gitea/runner/issues/938)) - feat: remove emojis from runner logging, add `Starting job container` group ([#​940](https://redirect.github.com/gitea/runner/issues/940)) ### [`v1.0.1`](https://gitea.com/gitea/runner/releases/tag/v1.0.1) [Compare Source](https://gitea.com/gitea/runner/compare/v1.0.0...v1.0.1) #### Changelog - [`dff63b3`](https://redirect.github.com/gitea/runner/commit/dff63b3ecc4320d340d3b5511f91a65eb2e2e6c2) fix(deps): update module github.com/go-git/go-git/v5 to v5.19.0 ([#​934](https://redirect.github.com/gitea/runner/issues/934)) - [`a5d9fe9`](https://redirect.github.com/gitea/runner/commit/a5d9fe965120c0b398a6349005dd9a73eb6e511c) fix(deps): update module github.com/opencontainers/selinux to v1.14.0 ([#​928](https://redirect.github.com/gitea/runner/issues/928)) - [`d607f3b`](https://redirect.github.com/gitea/runner/commit/d607f3b342e351197691a08795189972071d6374) test: clean up dead/stale fixtures and bump test container images ([#​932](https://redirect.github.com/gitea/runner/issues/932)) - [`5e59402`](https://redirect.github.com/gitea/runner/commit/5e59402fb2ad128c3f3008d4c41c7d3d03ed3f19) fix: re-fetch cached reusable workflow on every run ([#​930](https://redirect.github.com/gitea/runner/issues/930)) - [`dfeb463`](https://redirect.github.com/gitea/runner/commit/dfeb463904e768bb33086563d620a1925c278618) chore(deps): update docker docker tag to v29 ([#​924](https://redirect.github.com/gitea/runner/issues/924)) </details> <details> <summary>getkin/kin-openapi (github.com/getkin/kin-openapi)</summary> ### [`v0.138.0`](https://redirect.github.com/getkin/kin-openapi/releases/tag/v0.138.0) [Compare Source](https://redirect.github.com/getkin/kin-openapi/compare/v0.137.0...v0.138.0) #### What's Changed - openapi3gen: clear nullable on exported component bodies by [@​0-don](https://redirect.github.com/0-don) in [#​1164](https://redirect.github.com/getkin/kin-openapi/pull/1164) - openapi3: add test for issue [#​927](https://redirect.github.com/getkin/kin-openapi/issues/927) (nullable not respected on $ref schemas) by [@​fenollp](https://redirect.github.com/fenollp) in [#​1165](https://redirect.github.com/getkin/kin-openapi/pull/1165) - test: move public-API tests to external \_test packages by [@​fenollp](https://redirect.github.com/fenollp) in [#​1168](https://redirect.github.com/getkin/kin-openapi/pull/1168) - feat(openapi3): add per-type validation errors with cluster wrappers by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1166](https://redirect.github.com/getkin/kin-openapi/pull/1166) - feat(openapi3conv): canonicalization pass for 3.0 -> 3.x by [@​reuvenharrison](https://redirect.github.com/reuvenharrison) in [#​1162](https://redirect.github.com/getkin/kin-openapi/pull/1162) - openapi3conv: test Upgrade on many documents by [@​fenollp](https://redirect.github.com/fenollp) in [#​1169](https://redirect.github.com/getkin/kin-openapi/pull/1169) **Full Changelog**: <https://github.com/getkin/kin-openapi/compare/v0.137.0...v0.138.0> </details> <details> <summary>go-co-op/gocron (github.com/go-co-op/gocron/v2)</summary> ### [`v2.21.2`](https://redirect.github.com/go-co-op/gocron/releases/tag/v2.21.2) [Compare Source](https://redirect.github.com/go-co-op/gocron/compare/v2.21.1...v2.21.2) #### What's Changed - fix: defer WithLimitedRuns job removal until task completes ([#​925](https://redirect.github.com/go-co-op/gocron/issues/925)) by [@​SAY-5](https://redirect.github.com/SAY-5) in [#​926](https://redirect.github.com/go-co-op/gocron/pull/926) #### New Contributors - [@​SAY-5](https://redirect.github.com/SAY-5) made their first contribution in [#​926](https://redirect.github.com/go-co-op/gocron/pull/926) **Full Changelog**: <https://github.com/go-co-op/gocron/compare/v2.21.1...v2.21.2> </details> <details> <summary>go-webauthn/webauthn (github.com/go-webauthn/webauthn)</summary> ### [`v0.17.3`](https://redirect.github.com/go-webauthn/webauthn/blob/HEAD/CHANGELOG.md#v0173-2026-05-09) [Compare Source](https://redirect.github.com/go-webauthn/webauthn/compare/v0.17.2...v0.17.3) ##### Dependency Updates This release just contains updates to dependencies. </details> <details> <summary>wneessen/go-mail (github.com/wneessen/go-mail)</summary> ### [`v0.7.3`](https://redirect.github.com/wneessen/go-mail/releases/tag/v0.7.3): : Skippable UTF-8 support, improved Base64LineBreaker, binary size reducing, fixes and more [Compare Source](https://redirect.github.com/wneessen/go-mail/compare/v0.7.2...v0.7.3) Welcome to go-mail v0.7.3! 🎉 This release brings some cool improvements, new features, and fixes to go-mail. We hope you enjoy it! #### Notable changes/improvements/features/fixes ##### Deadline fix for connections to a TLS port without TLS PR [#​521](https://redirect.github.com/wneessen/go-mail/issues/521) fixes a missing deadline in the `Client` that could cause a deadlock for connections to a TLS port without TLS enabled. Thanks to [@​james-d-elliott](https://redirect.github.com/james-d-elliott) for finding and fixing this issue! ##### Preseve EHLO and HELO errors PR [#​528](https://redirect.github.com/wneessen/go-mail/issues/528) fixes an error for cases in which both the HELO and EHLO fail during a client connect. In this case the first error would be overwritten by the 2nd action, potentially deleting valuable information. In go-mail v0.7.3 both errors are now combined. Thanks to [@​Yanhu007](https://redirect.github.com/Yanhu007) for their contribution! ##### Improved Base64LineBreaker In PR [#​512](https://redirect.github.com/wneessen/go-mail/issues/512) [@​srpvpn](https://redirect.github.com/srpvpn) refactored the `Base64LineBreaker` type to be more performant and easier to read by removing the recursion. Thanks for your contribution! ##### Reduce binary size by making text/template and html/template support optional In PR [#​518](https://redirect.github.com/wneessen/go-mail/issues/518) [@​sblinch](https://redirect.github.com/sblinch) introduced a new compile time flag `gomailnotpl` which will make the `text/template` and `html/template` optional. Background is, that using `reflect.Value.Method` or `reflect.Value.MethodByName` prevents Go from performing full dead-code elimination because any exported method of any struct in the codebase could potentially be referenced at runtime. Unfortunately `text/template` and `html/template` do exactly this to allow method invocation from within templates. So in case your code does not need template support, you can use the new compile flag to remove the support for both packages completely and same some bytes in the resulting binary. Thanks for your contribution! ##### Fix nil pointer panic in partWriter PR [#​543](https://redirect.github.com/wneessen/go-mail/issues/543) fixes a potential nil pointer panic in the partWriter in case the underlying `io.Writer` returns an error during a multipart message write. Thanks to [@​UgurTheG](https://redirect.github.com/UgurTheG) for reporting and fixing the issue! ##### Provide access to HELO responses in the SMTP client PR [#​530](https://redirect.github.com/wneessen/go-mail/issues/530) adds support to access the HELO/EHLO responses via the `smtp.Client`. This feature is useful when using an SMTP servers pool behind a load balancer, to know which instance took the job. Thanks to [@​maxatome](https://redirect.github.com/maxatome) for submitting this feature! ##### Multiple addresses support in ReplyTo header PR [#​517](https://redirect.github.com/wneessen/go-mail/issues/517) adds support for multiple `Reply-To` addresses within a `Msg`, as permitted in RFC5322. Thanks to [@​christian-heusel](https://redirect.github.com/christian-heusel) for pointing this out and for comitting the PR! ##### Support to disable SMTPUTF8 in the MAIL FROM even if the server announces it PR [#​548](https://redirect.github.com/wneessen/go-mail/issues/548) adds support for skipping the `SMTPUTF8` extension to `MAIL FROM` commands. By default, when a server announces `SMTPUTF8` support in the EHLO, go-mail will add `SMTPUTF8` to the `MAIL FROM` command. As pointed out in [#​545](https://redirect.github.com/wneessen/go-mail/issues/545), some SMTP servers (e. g. specific MS Exchange versions) announce the SMTPUTF8 extension in the EHLO response but when adding the SMTPUTF8 to the MAIL FROM, they will fail with an error. The PR introduces a new `WithoutSMTPUTF8()` option for the `Client` which will make sure to skip the SMTPUTF8 extension in the MAIL FROM, even if the server announced it previously. Thanks [@​mkalus](https://redirect.github.com/mkalus) for reporting this issue and for their detailed analysis in [#​545](https://redirect.github.com/wneessen/go-mail/issues/545). #### What's Changed - minor fix for func ResetWithSMTPClient and DialAndSendWithContext by [@​sarff](https://redirect.github.com/sarff) in [#​500](https://redirect.github.com/wneessen/go-mail/pull/500) - Refactored `SendWithSMTPClient` to improve error handling and added test cases by [@​wneessen](https://redirect.github.com/wneessen) in [#​502](https://redirect.github.com/wneessen/go-mail/pull/502) - Refactored test and validation logic for message content checks by [@​wneessen](https://redirect.github.com/wneessen) in [#​503](https://redirect.github.com/wneessen/go-mail/pull/503) - Fix a docstring typo by [@​mitar](https://redirect.github.com/mitar) in [#​505](https://redirect.github.com/wneessen/go-mail/pull/505) - Upstream sync: prevent test failures due to expired test certificate by [@​wneessen](https://redirect.github.com/wneessen) in [#​522](https://redirect.github.com/wneessen/go-mail/pull/522) - fix: deadline not set for initial connection read by [@​james-d-elliott](https://redirect.github.com/james-d-elliott) in [#​521](https://redirect.github.com/wneessen/go-mail/pull/521) - Add deadlock test for client connections by [@​wneessen](https://redirect.github.com/wneessen) in [#​525](https://redirect.github.com/wneessen/go-mail/pull/525) - fix: preserve EHLO error when both EHLO and HELO fail by [@​Yanhu007](https://redirect.github.com/Yanhu007) in [#​528](https://redirect.github.com/wneessen/go-mail/pull/528) - refactor: remove recursion from base64LineBreaker.Write by [@​srpvpn](https://redirect.github.com/srpvpn) in [#​512](https://redirect.github.com/wneessen/go-mail/pull/512) - Make text/template support optional to allow dead-code elimination by [@​sblinch](https://redirect.github.com/sblinch) in [#​518](https://redirect.github.com/wneessen/go-mail/pull/518) - fix: prevent nil pointer panic in writeBody when partWriter is nil by [@​UgurTheG](https://redirect.github.com/UgurTheG) in [#​543](https://redirect.github.com/wneessen/go-mail/pull/543) - feat: add (\*smtp.Client).HelloResponse method to get EHLO/HELO response by [@​maxatome](https://redirect.github.com/maxatome) in [#​530](https://redirect.github.com/wneessen/go-mail/pull/530) - feat: add option to skip SMTPUTF8 in "MAIL FROM" commands by [@​wneessen](https://redirect.github.com/wneessen) in [#​548](https://redirect.github.com/wneessen/go-mail/pull/548) - Allow multiple Addresses in ReplyTo Header and add GetReplyTo() by [@​christian-heusel](https://redirect.github.com/christian-heusel) in [#​517](https://redirect.github.com/wneessen/go-mail/pull/517) #### CI/CD maintenance changes - Bump golang.org/x/text from 0.29.0 to 0.30.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​501](https://redirect.github.com/wneessen/go-mail/pull/501) - Bump golang.org/x/text from 0.30.0 to 0.31.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​506](https://redirect.github.com/wneessen/go-mail/pull/506) - Bump golang.org/x/text from 0.31.0 to 0.32.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​509](https://redirect.github.com/wneessen/go-mail/pull/509) - Bump Go and `golang.org/x/text` module versions by [@​wneessen](https://redirect.github.com/wneessen) in [#​526](https://redirect.github.com/wneessen/go-mail/pull/526) - Bump golang.org/x/text from 0.35.0 to 0.36.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​527](https://redirect.github.com/wneessen/go-mail/pull/527) - Updated `.golangci.toml` for linter exclusions on specific use cases by [@​wneessen](https://redirect.github.com/wneessen) in [#​523](https://redirect.github.com/wneessen/go-mail/pull/523) - Updated CI configuration for Go and OS versions in workflows by [@​wneessen](https://redirect.github.com/wneessen) in [#​524](https://redirect.github.com/wneessen/go-mail/pull/524) - Bump golangci/golangci-lint-action from 7.0.0 to 9.2.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​535](https://redirect.github.com/wneessen/go-mail/pull/535) - Bump ossf/scorecard-action from 2.4.0 to 2.4.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​534](https://redirect.github.com/wneessen/go-mail/pull/534) - Bump fsfe/reuse-action from 5.0.0 to 6.0.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​533](https://redirect.github.com/wneessen/go-mail/pull/533) - Bump vmactions/freebsd-vm from 1.1.5 to 1.4.5 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​532](https://redirect.github.com/wneessen/go-mail/pull/532) - Bump step-security/harden-runner from 2.10.2 to 2.19.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​531](https://redirect.github.com/wneessen/go-mail/pull/531) - Bump actions/dependency-review-action from 4.5.0 to 4.9.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​540](https://redirect.github.com/wneessen/go-mail/pull/540) - Bump actions/setup-go from 5.2.0 to 6.4.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​539](https://redirect.github.com/wneessen/go-mail/pull/539) - Bump codecov/codecov-action from 5.1.1 to 6.0.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​538](https://redirect.github.com/wneessen/go-mail/pull/538) - Bump actions/upload-artifact from 4.5.0 to 7.0.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​537](https://redirect.github.com/wneessen/go-mail/pull/537) - Bump github/codeql-action from 3.27.9 to 4.35.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​536](https://redirect.github.com/wneessen/go-mail/pull/536) - Bump step-security/harden-runner from 2.19.0 to 2.19.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​541](https://redirect.github.com/wneessen/go-mail/pull/541) - Bump golang.org/x/text from 0.36.0 to 0.37.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​547](https://redirect.github.com/wneessen/go-mail/pull/547) - Bump actions/dependency-review-action from 4.9.0 to 5.0.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​546](https://redirect.github.com/wneessen/go-mail/pull/546) - Bump github/codeql-action from 4.35.3 to 4.35.4 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​544](https://redirect.github.com/wneessen/go-mail/pull/544) #### New Contributors - [@​mitar](https://redirect.github.com/mitar) made their first contribution in [#​505](https://redirect.github.com/wneessen/go-mail/pull/505) - [@​Yanhu007](https://redirect.github.com/Yanhu007) made their first contribution in [#​528](https://redirect.github.com/wneessen/go-mail/pull/528) - [@​srpvpn](https://redirect.github.com/srpvpn) made their first contribution in [#​512](https://redirect.github.com/wneessen/go-mail/pull/512) - [@​sblinch](https://redirect.github.com/sblinch) made their first contribution in [#​518](https://redirect.github.com/wneessen/go-mail/pull/518) - [@​UgurTheG](https://redirect.github.com/UgurTheG) made their first contribution in [#​543](https://redirect.github.com/wneessen/go-mail/pull/543) - [@​maxatome](https://redirect.github.com/maxatome) made their first contribution in [#​530](https://redirect.github.com/wneessen/go-mail/pull/530) - [@​christian-heusel](https://redirect.github.com/christian-heusel) made their first contribution in [#​517](https://redirect.github.com/wneessen/go-mail/pull/517) **Full Changelog**: <https://github.com/wneessen/go-mail/compare/v0.7.2...v0.7.3> </details> <details> <summary>gitlab-org/api/client-go (gitlab.com/gitlab-org/api/client-go/v2)</summary> ### [`v2.25.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.25.0) [Compare Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.24.1...v2.25.0) #### 2.25.0 ##### 🚀 Features - feat: Add GraphQL API support for security attributes and categories ([!2856](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2856)) by [Caleb Madara](https://gitlab.com/calebmadara58) ##### 🔄 Other Changes - chore(deps): update dependency golangci-lint to v2.12.1 ([!2880](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2880)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) - Resolve lint errors on `main` causing pipeline failures ([!2882](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2882)) by [Patrick Rice](https://gitlab.com/PatrickRice) - chore(deps): update dependency golangci-lint to v2.12.0 ([!2879](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2879)) by [GitLab Dependency Bot](https://gitlab.com/gitlab-dependency-update-bot) ### [2.25.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.24.1...v2.25.0) (2026-05-11) ##### Features * Add GraphQL API support for security attributes and categories ([8496635](https://gitlab.com/gitlab-org/api/client-go/commit/84966353d99e83e975bd23c83fec1b7023cfd621)) </details> <details> <summary>cznic/sqlite (modernc.org/sqlite)</summary> ### [`v1.50.1`](https://gitlab.com/cznic/sqlite/compare/v1.50.0...v1.50.1) [Compare Source](https://gitlab.com/cznic/sqlite/compare/v1.50.0...v1.50.1) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: silverwind <me@silverwind.io> |
||
|
GiteabotandGitHub
|
4ee8266519 |
chore(deps): update action dependencies (#37751)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pnpm/action-setup](https://redirect.github.com/pnpm/action-setup) | action | patch | `v6.0.5` → `v6.0.8` | | [renovatebot/github-action](https://redirect.github.com/renovatebot/github-action) | action | patch | `v46.1.13` → `v46.1.14` | --- ### Release Notes <details> <summary>pnpm/action-setup (pnpm/action-setup)</summary> ### [`v6.0.8`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.8) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8) ##### What's Changed - docs(README): fix `cache_dependency_path` type by [@​haines](https://redirect.github.com/haines) in [#​257](https://redirect.github.com/pnpm/action-setup/pull/257) - fix: drop patchPnpmEnv so standalone+self-update works on Windows by [@​zkochan](https://redirect.github.com/zkochan) in [#​258](https://redirect.github.com/pnpm/action-setup/pull/258) - fix: update pnpm to 11.1.1 by [@​mungodewar](https://redirect.github.com/mungodewar) in [#​248](https://redirect.github.com/pnpm/action-setup/pull/248) ##### New Contributors - [@​mungodewar](https://redirect.github.com/mungodewar) made their first contribution in [#​248](https://redirect.github.com/pnpm/action-setup/pull/248) **Full Changelog**: <https://github.com/pnpm/action-setup/compare/v6.0.7...v6.0.8> ### [`v6.0.7`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.7) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7) ##### What's Changed - fix: honor devEngines.packageManager.onFail=error ([#​252](https://redirect.github.com/pnpm/action-setup/issues/252)) by [@​zkochan](https://redirect.github.com/zkochan) in [#​254](https://redirect.github.com/pnpm/action-setup/pull/254) - fix: restore inputs from state in post by [@​haines](https://redirect.github.com/haines) in [#​255](https://redirect.github.com/pnpm/action-setup/pull/255) - fix: self-update bootstrap to packageManager-pinned version ([#​233](https://redirect.github.com/pnpm/action-setup/issues/233)) by [@​zkochan](https://redirect.github.com/zkochan) in [#​256](https://redirect.github.com/pnpm/action-setup/pull/256) ##### New Contributors - [@​haines](https://redirect.github.com/haines) made their first contribution in [#​255](https://redirect.github.com/pnpm/action-setup/pull/255) **Full Changelog**: <https://github.com/pnpm/action-setup/compare/v6.0.6...v6.0.7> ### [`v6.0.6`](https://redirect.github.com/pnpm/action-setup/releases/tag/v6.0.6) [Compare Source](https://redirect.github.com/pnpm/action-setup/compare/v6.0.5...v6.0.6) ##### What's Changed - fix: bin\_dest output points to self-updated pnpm, not bootstrap by [@​zkochan](https://redirect.github.com/zkochan) in [#​249](https://redirect.github.com/pnpm/action-setup/pull/249) **Full Changelog**: <https://github.com/pnpm/action-setup/compare/v6.0.5...v6.0.6> </details> <details> <summary>renovatebot/github-action (renovatebot/github-action)</summary> ### [`v46.1.14`](https://redirect.github.com/renovatebot/github-action/releases/tag/v46.1.14) [Compare Source](https://redirect.github.com/renovatebot/github-action/compare/v46.1.13...v46.1.14) ##### Documentation - Revise Fine-grained Personal Access Tokens section ([#​1030](https://redirect.github.com/renovatebot/github-action/issues/1030)) ([fef7882](https://redirect.github.com/renovatebot/github-action/commit/fef7882e2c7377fd438898944dd399f6d7be271e)) - set `RENOVATE_PLATFORM_COMMIT` to `enabled` ([#​1029](https://redirect.github.com/renovatebot/github-action/issues/1029)) ([9d07dfa](https://redirect.github.com/renovatebot/github-action/commit/9d07dfa4f7a8ee66518d1b08f33ae9814d244dda)) - update references to renovatebot/github-action to v46.1.13 ([9a41b99](https://redirect.github.com/renovatebot/github-action/commit/9a41b990c5902829643afc33fd4d5a6f536b36cf)) ##### Miscellaneous Chores - cleanup ([8abcd0e](https://redirect.github.com/renovatebot/github-action/commit/8abcd0e9f084bb83d0df844052c4b31b39f60ef2)) - **deps:** update commitlint monorepo to v20.5.3 ([a4e124d](https://redirect.github.com/renovatebot/github-action/commit/a4e124de37c0841853e802687889d3ddb86e4f54)) - **deps:** update dependency globals to v17.6.0 ([d5ca6d4](https://redirect.github.com/renovatebot/github-action/commit/d5ca6d4cf379c9db32366fd12dfb619d7baffa36)) - **deps:** update dependency typescript-eslint to v8.59.1 ([1dd2319](https://redirect.github.com/renovatebot/github-action/commit/1dd2319cb41680fb027ac17b8703e7fdb3f35e35)) - enable pnpm `minimumReleaseAge` ([00a8327](https://redirect.github.com/renovatebot/github-action/commit/00a83273b5ee2973abb913a7bc81e3ee6cbcebd2)) ##### Build System - **deps:** lock file maintenance ([f6821a2](https://redirect.github.com/renovatebot/github-action/commit/f6821a23ac87497dc0625f5c60001d5eb85d23ef)) ##### Continuous Integration - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.160.7 ([1189f69](https://redirect.github.com/renovatebot/github-action/commit/1189f69d1f9835d1c90b27a3b0f679e21f0e1d20)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.162.0 ([43d0a48](https://redirect.github.com/renovatebot/github-action/commit/43d0a48b2590acc66b04f9c04fe44d8b66210d76)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.163.0 ([61a1654](https://redirect.github.com/renovatebot/github-action/commit/61a1654b1a1e4ce5e9bb0905af986b1357b0d427)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.163.1 ([4226876](https://redirect.github.com/renovatebot/github-action/commit/42268768581691fe71bebc5d4a54e979b343d643)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.163.2 ([b3318e0](https://redirect.github.com/renovatebot/github-action/commit/b3318e0a24aa6e5849ee6e2783ae9d048b8ffb3e)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.163.4 ([09fe3e9](https://redirect.github.com/renovatebot/github-action/commit/09fe3e9361ed5b46f5871b3d3d30b89138fb8cd7)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.164.0 ([5736585](https://redirect.github.com/renovatebot/github-action/commit/5736585dd1f36606bb51e36580751eb8b2f927aa)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.164.1 ([8b164cc](https://redirect.github.com/renovatebot/github-action/commit/8b164cce79c2d3e1b0378b414055aa32c2e2396b)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.164.2 ([44728cc](https://redirect.github.com/renovatebot/github-action/commit/44728cc6496f5d57c674def5fe4437bf43dfb744)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.165.0 ([bde1da1](https://redirect.github.com/renovatebot/github-action/commit/bde1da1de34c74300c4145d5d36145ab0ac403a3)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.166.0 ([#​1031](https://redirect.github.com/renovatebot/github-action/issues/1031)) ([4b957d1](https://redirect.github.com/renovatebot/github-action/commit/4b957d1cabe8967b8d3d4d1d5e72c336f93acc2c)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.166.2 ([499cfeb](https://redirect.github.com/renovatebot/github-action/commit/499cfeb9d6d64e295dbabdc03d6811302dfb44d0)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.166.3 ([fe8a943](https://redirect.github.com/renovatebot/github-action/commit/fe8a9436e271c3ae9d0134419fbbbf57fe901665)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.167.0 ([f8ca6db](https://redirect.github.com/renovatebot/github-action/commit/f8ca6db77039c7b2df300bf1c0008bb6ca48feb9)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.168.4 ([2e15d66](https://redirect.github.com/renovatebot/github-action/commit/2e15d66203e5e5669337f080d41d707e2e30245c)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.168.5 ([a87ee3d](https://redirect.github.com/renovatebot/github-action/commit/a87ee3d8ae59775aeabb41bff8b9dffa2a9850dd)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.168.6 ([683e7dd](https://redirect.github.com/renovatebot/github-action/commit/683e7dd082e83899dad9e727c8b22e9c472523eb)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.169.0 ([f6166e7](https://redirect.github.com/renovatebot/github-action/commit/f6166e7f7b6e4e444589ac774306a55697362bed)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.169.4 ([f1f81f9](https://redirect.github.com/renovatebot/github-action/commit/f1f81f959e2f65dfc38f6a71c5720914ad73c37c)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.0 ([5473f54](https://redirect.github.com/renovatebot/github-action/commit/5473f54a8f760978d6a2cec08a5e261ce8f0b35e)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.12 ([b47aa13](https://redirect.github.com/renovatebot/github-action/commit/b47aa135111049a8f220c25f98f281cac991a585)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.13 ([7e8834d](https://redirect.github.com/renovatebot/github-action/commit/7e8834d80efbe46cdcd336f7d8335e94bf5d85e6)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.14 ([9b5f9e6](https://redirect.github.com/renovatebot/github-action/commit/9b5f9e6c8f97c2064cef2ba7b7459f424722c8f6)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.15 ([98631e8](https://redirect.github.com/renovatebot/github-action/commit/98631e88b8dfa52ea1da739e21e1969f04e88051)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.16 ([ab997a9](https://redirect.github.com/renovatebot/github-action/commit/ab997a9588a5a8c80507974d19166d0db4087947)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.17 ([24a51e0](https://redirect.github.com/renovatebot/github-action/commit/24a51e0fd8b1677ce32e8c45c661af3f0b5680c6)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.18 ([f82d2cd](https://redirect.github.com/renovatebot/github-action/commit/f82d2cd716eb8043a8f8d8458cdcff924d64e4a1)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.19 ([3d684f2](https://redirect.github.com/renovatebot/github-action/commit/3d684f2e0788a79e4b276480aaf841539b1899de)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.20 ([d7afc6b](https://redirect.github.com/renovatebot/github-action/commit/d7afc6be62e2f314c2e76e6310125bf53563e19d)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.3 ([306f0c9](https://redirect.github.com/renovatebot/github-action/commit/306f0c9105ab6cd95a0d354b1539d51731646012)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.8 ([f0eea19](https://redirect.github.com/renovatebot/github-action/commit/f0eea19bf3bb50cd26effe5e04e7d78d4c7f56b3)) - **deps:** update ghcr.io/renovatebot/renovate docker tag to v43.170.9 ([f3af74e](https://redirect.github.com/renovatebot/github-action/commit/f3af74eb2fa5d6b11658e5b26cf601faf2963d37)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> |
||
|
GiteabotandGitHub
|
3d95a2f028 |
fix(deps): update module github.com/google/go-github/v85 to v86 (#37754)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/google/go-github/v85](https://redirect.github.com/google/go-github) | `v85.0.0` → `v86.0.0` |  |  | --- ### Release Notes <details> <summary>google/go-github (github.com/google/go-github/v85)</summary> ### [`v86.0.0`](https://redirect.github.com/google/go-github/releases/tag/v86.0.0) [Compare Source](https://redirect.github.com/google/go-github/compare/v85.0.0...v86.0.0) This release contains the following breaking API changes: - feat!: Refactor request context ([#​4151](https://redirect.github.com/google/go-github/issues/4151)) BREAKING CHANGE: All internal calls now provide `Context` via the `Request` itself. - feat!: Add OIDC authentication support to `PrivateRegistries` ([#​4159](https://redirect.github.com/google/go-github/issues/4159)) BREAKING CHANGE: `PrivateRegistriesService` is updated to API version `2026-03-10` with struct and response changes. ...and the following additional changes: - chore: Bump version of `go-github` to `v86.0.0` ([#​4198](https://redirect.github.com/google/go-github/issues/4198)) - test: Fix invalid JSON payloads in actions workflow runs tests ([#​4197](https://redirect.github.com/google/go-github/issues/4197)) - feat: Add repo download contents sentinel errors ([#​4192](https://redirect.github.com/google/go-github/issues/4192)) - chore: Fix `otel` module name ([#​4187](https://redirect.github.com/google/go-github/issues/4187)) - feat: Add typed Copilot metrics download helpers ([#​4177](https://redirect.github.com/google/go-github/issues/4177)) - feat: Add `deploy_keys_enabled_for_repositories` and secret scanning custom link fields to `Organization` struct ([#​4188](https://redirect.github.com/google/go-github/issues/4188)) - refactor: Use `testJSONBody` helper for request body assertions in tests ([#​4183](https://redirect.github.com/google/go-github/issues/4183)) - build(deps): Bump github.com/getkin/kin-openapi from 0.135.0 to 0.137.0 in /tools ([#​4184](https://redirect.github.com/google/go-github/issues/4184)) - fix: Include `RetryAfter` in `AbuseRateLimitError.Error` output ([#​4181](https://redirect.github.com/google/go-github/issues/4181)) - fix: Handle string-typed reviewer `ID` in Ruleset API responses ([#​4178](https://redirect.github.com/google/go-github/issues/4178)) - feat: Add `ArchivedAt` field to `Organization` struct ([#​4179](https://redirect.github.com/google/go-github/issues/4179)) - feat: Add Copilot coding agent and content exclusion org endpoints ([#​4176](https://redirect.github.com/google/go-github/issues/4176)) - chore: Bump go-github from v84 to v85 in /scrape ([#​4174](https://redirect.github.com/google/go-github/issues/4174)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Monday (`* * * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> |
||
|
|
83151e98cc |
ci: narrow files-changed frontend filter (#37749)
Drop the broad `tools/*.{js,ts}` globs from the `frontend` filter so
edits to CI-only or backend helper scripts in `tools/` stop triggering
frontend and e2e jobs. Only `tools/generate-svg.ts` is kept.
Also renames `tools/lint-pr-title.js` to `.ts` for consistency, drops
the empty root `*.js` glob, fixes stray indentation in the `dockerfile`
filter and adds missing `setup-node`.
---
This PR was written with the help of Claude Opus 4.7
---------
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
|