Giteabot
798578115b
fix(deps): update npm dependencies, remove nolyfill ( #37968 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
|
[@eslint-community/eslint-plugin-eslint-comments](https://redirect.github.com/eslint-community/eslint-plugin-eslint-comments )
| [`4.7.1` →
`4.7.2`](https://renovatebot.com/diffs/npm/@eslint-community%2feslint-plugin-eslint-comments/4.7.1/4.7.2 )
|
|
|
| [@primer/octicons](https://primer.style/octicons )
([source](https://redirect.github.com/primer/octicons )) | [`19.26.0` →
`19.27.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.26.0/19.27.0 )
|
|
|
|
[@typescript-eslint/parser](https://typescript-eslint.io/packages/parser )
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser ))
| [`8.59.4` →
`8.60.0`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.59.4/8.60.0 )
|
|
|
|
[@vitest/eslint-plugin](https://redirect.github.com/vitest-dev/eslint-plugin-vitest )
| [`1.6.17` →
`1.6.18`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.17/1.6.18 )
|
|
|
| [dayjs](https://day.js.org )
([source](https://redirect.github.com/iamkun/dayjs )) | [`1.11.20` →
`1.11.21`](https://renovatebot.com/diffs/npm/dayjs/1.11.20/1.11.21 ) |
|
|
| [katex](https://katex.org )
([source](https://redirect.github.com/KaTeX/KaTeX )) | [`0.16.47` →
`0.17.0`](https://renovatebot.com/diffs/npm/katex/0.16.47/0.17.0 ) |
|
|
|
[material-icon-theme](https://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/main/README.md )
([source](https://redirect.github.com/material-extensions/vscode-material-icon-theme ))
| [`5.34.0` →
`5.35.0`](https://renovatebot.com/diffs/npm/material-icon-theme/5.34.0/5.35.0 )
|
|
|
| [pnpm](https://pnpm.io )
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm )) |
[`11.2.1` →
`11.4.0`](https://renovatebot.com/diffs/npm/pnpm/11.2.1/11.4.0 ) |
|
|
|
[rolldown-license-plugin](https://redirect.github.com/silverwind/rolldown-license-plugin )
| [`3.0.7` →
`3.0.8`](https://renovatebot.com/diffs/npm/rolldown-license-plugin/3.0.7/3.0.8 )
|
|
|
|
[typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint )
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint ))
| [`8.59.4` →
`8.60.0`](https://renovatebot.com/diffs/npm/typescript-eslint/8.59.4/8.60.0 )
|
|
|
| [updates](https://redirect.github.com/silverwind/updates ) |
[`17.16.13` →
`17.17.2`](https://renovatebot.com/diffs/npm/updates/17.16.13/17.17.2 ) |
|
|
| [vite](https://vite.dev )
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite ))
| [`8.0.13` →
`8.0.14`](https://renovatebot.com/diffs/npm/vite/8.0.13/8.0.14 ) |
|
|
| [vue](https://vuejs.org/ )
([source](https://redirect.github.com/vuejs/core )) | [`3.5.34` →
`3.5.35`](https://renovatebot.com/diffs/npm/vue/3.5.34/3.5.35 ) |
|
|
| [vue-tsc](https://redirect.github.com/vuejs/language-tools )
([source](https://redirect.github.com/vuejs/language-tools/tree/HEAD/packages/tsc ))
| [`3.3.1` →
`3.3.2`](https://renovatebot.com/diffs/npm/vue-tsc/3.3.1/3.3.2 ) |
|
|
---
### Release Notes
<details>
<summary>eslint-community/eslint-plugin-eslint-comments
(@​eslint-community/eslint-plugin-eslint-comments)</summary>
###
[`v4.7.2`](https://redirect.github.com/eslint-community/eslint-plugin-eslint-comments/releases/tag/v4.7.2 )
[Compare
Source](https://redirect.github.com/eslint-community/eslint-plugin-eslint-comments/compare/v4.7.1...v4.7.2 )
##### Bug Fixes
- **deps:** pin `modern-monaco` version to 0.4.0
([#​320](https://redirect.github.com/eslint-community/eslint-plugin-eslint-comments/issues/320 ))
([62a2c3a](62a2c3a4eehttps://redirect.github.com/eslint-community/eslint-plugin-eslint-comments/issues/311 ))
([42919d0](42919d06d8https://redirect.github.com/primer/octicons/blob/HEAD/CHANGELOG.md#19270 )
[Compare
Source](https://redirect.github.com/primer/octicons/compare/v19.26.0...v19.27.0 )
##### Minor Changes
- [#​1203](https://redirect.github.com/primer/octicons/pull/1203 )
[`a69618e4`](a69618e4b6https://redirect.github.com/ericwbailey )! -
Add flag icon
##### Patch Changes
- [#​1212](https://redirect.github.com/primer/octicons/pull/1212 )
[`02bd1ef8`](02bd1ef8d1https://redirect.github.com/ericwbailey )! -
remove hardcoded fill from flag icon
</details>
<details>
<summary>typescript-eslint/typescript-eslint
(@​typescript-eslint/parser)</summary>
###
[`v8.60.0`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8600-2026-05-25 )
[Compare
Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.59.4...v8.60.0 )
This was a version bump only for parser to align it with other projects,
there were no code changes.
See [GitHub
Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.0 )
for more information.
You can read about our [versioning
strategy](https://typescript-eslint.io/users/versioning ) and
[releases](https://typescript-eslint.io/users/releases ) on our website.
</details>
<details>
<summary>vitest-dev/eslint-plugin-vitest
(@​vitest/eslint-plugin)</summary>
###
[`v1.6.18`](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/releases/tag/v1.6.18 )
[Compare
Source](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/compare/v1.6.17...v1.6.18 )
##### 🐞 Bug Fixes
- Correct `requiresTypeChecking` metadata for four rules - by
[@​inglec-arista](https://redirect.github.com/inglec-arista ) in
[#​905](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/issues/905 )
[<samp>(e06a3)</samp>](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/commit/e06a3dc )
##### [View changes on
GitHub](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/compare/v1.6.17...v1.6.18 )
</details>
<details>
<summary>iamkun/dayjs (dayjs)</summary>
###
[`v1.11.21`](https://redirect.github.com/iamkun/dayjs/blob/HEAD/CHANGELOG.md#11121-2026-05-26 )
[Compare
Source](https://redirect.github.com/iamkun/dayjs/compare/v1.11.20...v1.11.21 )
##### Bug Fixes
- preserve unsupported year tokens in format
([#​3015](https://redirect.github.com/iamkun/dayjs/issues/3015 ))
([#​3016](https://redirect.github.com/iamkun/dayjs/issues/3016 ))
([8fda602](8fda602beahttps://redirect.github.com/KaTeX/KaTeX/blob/HEAD/CHANGELOG.md#0170-2026-05-22 )
[Compare
Source](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.47...v0.17.0 )
##### Performance Improvements
- simplify `defineFunction` to avoid destructuring, improve typing
([#​4222](https://redirect.github.com/KaTeX/KaTeX/issues/4222 ))
([fb604e6](fb604e6ba6https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.46...v0.16.47 )
(2026-05-16)
##### Bug Fixes
- correct size of `[` big delimiter
([#​4217](https://redirect.github.com/KaTeX/KaTeX/issues/4217 ))
([7ba0027](7ba0027d2fhttps://redirect.github.com/KaTeX/KaTeX/issues/4215 )
####
[0.16.46](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.45...v0.16.46 )
(2026-05-13)
##### Bug Fixes
- preserve math font in some styling commands
([#​4214](https://redirect.github.com/KaTeX/KaTeX/issues/4214 ))
([e9ee046](e9ee0464ddhttps://redirect.github.com/KaTeX/KaTeX/issues/4213 )
####
[0.16.45](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.44...v0.16.45 )
(2026-04-05)
##### Bug Fixes
- wrap vcenter mpadded in mrow for valid MathML
([#​4193](https://redirect.github.com/KaTeX/KaTeX/issues/4193 ))
([ee66b78](ee66b78d24https://redirect.github.com/KaTeX/KaTeX/issues/4078 )
####
[0.16.44](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.43...v0.16.44 )
(2026-03-27)
##### Bug Fixes
- remove extra \jot space at bottom of align/gather/etc.
([#​4184](https://redirect.github.com/KaTeX/KaTeX/issues/4184 ))
([3870ee9](3870ee913ehttps://redirect.github.com/KaTeX/KaTeX/compare/v0.16.42...v0.16.43 )
(2026-03-26)
##### Bug Fixes
- use makeEm() consistently to truncate long CSS decimals
([#​4181](https://redirect.github.com/KaTeX/KaTeX/issues/4181 ))
([0967dcc](0967dcc027https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.41...v0.16.42 )
(2026-03-24)
##### Features
- \underbracket and \overbracket
([#​4147](https://redirect.github.com/KaTeX/KaTeX/issues/4147 ))
([5be9abb](5be9abb0b4https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.40...v0.16.41 )
(2026-03-24)
##### Bug Fixes
- \sout in text mode
([#​4173](https://redirect.github.com/KaTeX/KaTeX/issues/4173 ))
([e748578](e748578b63https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.39...v0.16.40 )
(2026-03-20)
##### Bug Fixes
- **css:** specify position: relative for .katex
([#​4170](https://redirect.github.com/KaTeX/KaTeX/issues/4170 ))
([020f0d8](020f0d8956https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.38...v0.16.39 )
(2026-03-19)
##### Bug Fixes
- middle dot in text mode
([#​4169](https://redirect.github.com/KaTeX/KaTeX/issues/4169 ))
([edb45b0](edb45b0b17https://redirect.github.com/KaTeX/KaTeX/issues/3641 )
####
[0.16.38](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.37...v0.16.38 )
(2026-03-08)
##### Bug Fixes
- accent skew mixed with font specifiers
([#​4159](https://redirect.github.com/KaTeX/KaTeX/issues/4159 ))
([aea3375](aea33758d6https://redirect.github.com/KaTeX/KaTeX/issues/4121 )
####
[0.16.37](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.36...v0.16.37 )
(2026-03-06)
##### Bug Fixes
- negative-width `\hphantom` and symmetric `\smash`
([#​4153](https://redirect.github.com/KaTeX/KaTeX/issues/4153 ))
([d4799ca](d4799cae58https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.35...v0.16.36 )
(2026-03-06)
##### Bug Fixes
- contrib esm bloat
([#​4157](https://redirect.github.com/KaTeX/KaTeX/issues/4157 ))
([2bde1ad](2bde1adab2https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.34...v0.16.35 )
(2026-03-05)
##### Bug Fixes
- version number regression
([#​4155](https://redirect.github.com/KaTeX/KaTeX/issues/4155 ))
([db26b73](db26b73380https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.33...v0.16.34 )
(2026-03-05)
##### Bug Fixes
- emoji with variation selector
([#​4151](https://redirect.github.com/KaTeX/KaTeX/issues/4151 ))
([c2606e5](c2606e5db9https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.32...v0.16.33 )
(2026-02-23)
##### Bug Fixes
- **scss:** forward variables to fonts module
([#​4146](https://redirect.github.com/KaTeX/KaTeX/issues/4146 ))
([9349a64](9349a64a05https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.31...v0.16.32 )
(2026-02-22)
##### Bug Fixes
- italic separation in \mathnormal
([#​4143](https://redirect.github.com/KaTeX/KaTeX/issues/4143 ))
([71305a0](71305a0514https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.30...v0.16.31 )
(2026-02-22)
##### Bug Fixes
- `\*frac` sizing
([#​4137](https://redirect.github.com/KaTeX/KaTeX/issues/4137 ))
([ef51f18](ef51f18dedhttps://redirect.github.com/KaTeX/KaTeX/compare/v0.16.29...v0.16.30 )
(2026-02-22)
##### Bug Fixes
- no line breaks after `\not`
([#​4140](https://redirect.github.com/KaTeX/KaTeX/issues/4140 ))
([2d1ba86](2d1ba86143https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.28...v0.16.29 )
(2026-02-22)
##### Bug Fixes
- `\imath` and other `\html@mathml` macros in arguments
([#​4139](https://redirect.github.com/KaTeX/KaTeX/issues/4139 ))
([a850cce](a850cce7cchttps://redirect.github.com/KaTeX/KaTeX/compare/v0.16.27...v0.16.28 )
(2026-01-25)
##### Bug Fixes
- **type:** add missing types definition path to package.json
([#​4125](https://redirect.github.com/KaTeX/KaTeX/issues/4125 ))
([0ef8921](0ef8921d18https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.26...v0.16.27 )
(2025-12-07)
##### Features
- support equals sign and surrounding whitespace in \htmlData attribute
values
([#​4112](https://redirect.github.com/KaTeX/KaTeX/issues/4112 ))
([c77aaec](c77aaec00chttps://redirect.github.com/KaTeX/KaTeX/compare/v0.16.25...v0.16.26 )
(2025-12-07)
##### Bug Fixes
- \mathop followed by integral symbol
([6fbad18](6fbad18857https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.24...v0.16.25 )
(2025-10-13)
##### Features
- **css:** provide `katex-swap.css` that uses `font-display: swap`
([#​3940](https://redirect.github.com/KaTeX/KaTeX/issues/3940 ))
([b3f9ce6](b3f9ce691ehttps://redirect.github.com/KaTeX/KaTeX/issues/2242 )
####
[0.16.24](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.23...v0.16.24 )
(2025-10-12)
##### Features
- support hex colors with alpha
([#​4090](https://redirect.github.com/KaTeX/KaTeX/issues/4090 ))
([8c9b306](8c9b306396https://redirect.github.com/KaTeX/KaTeX/issues/4067 )
[#fA6](https://redirect.github.com/KaTeX/KaTeX/issues/fA6 )
[#fA6f1](https://redirect.github.com/KaTeX/KaTeX/issues/fA6f1 )
####
[0.16.23](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.22...v0.16.23 )
(2025-10-03)
##### Bug Fixes
- Support `\def` with arguments via `macros` option
([#​4087](https://redirect.github.com/KaTeX/KaTeX/issues/4087 ))
([80a8158](80a815856ahttps://redirect.github.com/KaTeX/KaTeX/compare/v0.16.21...v0.16.22 )
(2025-04-09)
##### Bug Fixes
- \relax in base or exponent of super/subscript
([#​4045](https://redirect.github.com/KaTeX/KaTeX/issues/4045 ))
([1f43c84](1f43c84a17https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.20...v0.16.21 )
(2025-01-17)
##### Bug Fixes
- escape \htmlData attribute name
([57914ad](57914ad91ehttps://redirect.github.com/KaTeX/KaTeX/compare/v0.16.19...v0.16.20 )
(2025-01-12)
##### Bug Fixes
- \providecommand does not overwrite existing macro
([#​4000](https://redirect.github.com/KaTeX/KaTeX/issues/4000 ))
([6d30fe4](6d30fe47b0https://redirect.github.com/KaTeX/KaTeX/issues/3928 )
####
[0.16.19](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.18...v0.16.19 )
(2024-12-29)
##### Bug Fixes
- **types:** improve `strict` function type
([#​4009](https://redirect.github.com/KaTeX/KaTeX/issues/4009 ))
([4228b4e](4228b4eb52https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.17...v0.16.18 )
(2024-12-18)
##### Bug Fixes
- Actually publish TypeScript type definitions
([#​4008](https://redirect.github.com/KaTeX/KaTeX/issues/4008 ))
([629b873](629b87354fhttps://redirect.github.com/KaTeX/KaTeX/compare/v0.16.16...v0.16.17 )
(2024-12-17)
##### Bug Fixes
- MathML combines multidigit numbers with sup/subscript, comma
separators, and multicharacter text when outputting to DOM
([#​3999](https://redirect.github.com/KaTeX/KaTeX/issues/3999 ))
([7d79e22](7d79e220f4https://redirect.github.com/KaTeX/KaTeX/issues/3995 )
####
[0.16.16](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.15...v0.16.16 )
(2024-12-17)
##### Features
- ESM exports, TypeScript types
([#​3992](https://redirect.github.com/KaTeX/KaTeX/issues/3992 ))
([ea9c173](ea9c173a0dhttps://redirect.github.com/KaTeX/KaTeX/compare/v0.16.14...v0.16.15 )
(2024-12-09)
##### Features
- italic sans-serif in math mode via `\mathsfit` command
([#​3998](https://redirect.github.com/KaTeX/KaTeX/issues/3998 ))
([2218901](22189018b6https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.13...v0.16.14 )
(2024-12-08)
##### Features
- \dddot and \ddddot support
([#​3834](https://redirect.github.com/KaTeX/KaTeX/issues/3834 ))
([bda35cd](bda35cdb0ahttps://redirect.github.com/KaTeX/KaTeX/issues/2744 )
####
[0.16.13](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.12...v0.16.13 )
(2024-12-08)
##### Bug Fixes
- `\vdots` and `\rule` support in text mode
([#​3997](https://redirect.github.com/KaTeX/KaTeX/issues/3997 ))
([0e08352](0e08352623https://redirect.github.com/KaTeX/KaTeX/issues/3990 )
####
[0.16.12](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.11...v0.16.12 )
(2024-12-08)
##### Features
- **css:** configurable margin for display math
([#​3638](https://redirect.github.com/KaTeX/KaTeX/issues/3638 ))
([3405001](3405001225https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.10...v0.16.11 )
(2024-07-02)
##### Features
- add \emph
([#​3963](https://redirect.github.com/KaTeX/KaTeX/issues/3963 ))
([9f34da4](9f34da4b3chttps://redirect.github.com/KaTeX/KaTeX/issues/3566 )
####
[0.16.10](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.9...v0.16.10 )
(2024-03-24)
##### Bug Fixes
- \edef bypassing maxExpand via exponential blowup
([e88b4c3](e88b4c357fc5897fcd1ffc5af64183https://redirect.github.com//datatracker.ietf.org/doc/html/rfc3986/issues/section-3 )
- maxExpand limit with Unicode sub/superscripts
([085e21b](085e21b5dahttps://redirect.github.com/KaTeX/KaTeX/compare/v0.16.8...v0.16.9 )
(2023-10-02)
##### Features
- Support bold Fraktur
([#​3777](https://redirect.github.com/KaTeX/KaTeX/issues/3777 ))
([240d5ae](240d5aede9https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.7...v0.16.8 )
(2023-06-24)
##### Features
- expose error length and raw error message on ParseError
([#​3820](https://redirect.github.com/KaTeX/KaTeX/issues/3820 ))
([710774a](710774aaebhttps://redirect.github.com/KaTeX/KaTeX/compare/v0.16.6...v0.16.7 )
(2023-04-28)
##### Bug Fixes
- **docs/support\_table.md:** delete redundant "varPsi"
([#​3814](https://redirect.github.com/KaTeX/KaTeX/issues/3814 ))
([33a1b98](33a1b98710https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.5...v0.16.6 )
(2023-04-17)
##### Bug Fixes
- Support `\let` via `macros` option
([#​3738](https://redirect.github.com/KaTeX/KaTeX/issues/3738 ))
([bdb0be2](bdb0be2017https://redirect.github.com/KaTeX/KaTeX/issues/3737 )
[#​3737](https://redirect.github.com/KaTeX/KaTeX/issues/3737 )
####
[0.16.5](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.4...v0.16.5 )
(2023-04-17)
##### Features
- \_\_defineFunction API exposing internal defineFunction
([#​3805](https://redirect.github.com/KaTeX/KaTeX/issues/3805 ))
([c7b1f84](c7b1f84b78https://redirect.github.com/KaTeX/KaTeX/issues/3756 )
####
[0.16.4](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.3...v0.16.4 )
(2022-12-07)
##### Bug Fixes
- space should prevent optional argument to \
([#​3746](https://redirect.github.com/KaTeX/KaTeX/issues/3746 ))
([a0deb34](a0deb3410fhttps://redirect.github.com/KaTeX/KaTeX/issues/3745 )
####
[0.16.3](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.2...v0.16.3 )
(2022-10-22)
##### Bug Fixes
- \hline after \cr
([#​3735](https://redirect.github.com/KaTeX/KaTeX/issues/3735 ))
([ebf6bf5](ebf6bf5b50https://redirect.github.com/KaTeX/KaTeX/issues/3734 )
####
[0.16.2](https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.1...v0.16.2 )
(2022-08-29)
##### Bug Fixes
- **auto-render:** concatenate content of successive text nodes
([#​3422](https://redirect.github.com/KaTeX/KaTeX/issues/3422 ))
([4d3fdd8](4d3fdd8647https://redirect.github.com/KaTeX/KaTeX/issues/3505 ))
([176552a](176552a691https://redirect.github.com/KaTeX/KaTeX/compare/v0.16.0...v0.16.1 )
(2022-08-28)
##### Bug Fixes
- Use SVGs for some stacked delims
([#​3686](https://redirect.github.com/KaTeX/KaTeX/issues/3686 ))
([8a65a2e](8a65a2e1fdhttps://redirect.github.com/material-extensions/vscode-material-icon-theme/blob/HEAD/CHANGELOG.md#v5350 )
[Compare
Source](https://redirect.github.com/material-extensions/vscode-material-icon-theme/compare/v5.34.0...v5.35.0 )
[compare
changes](https://redirect.github.com/material-extensions/vscode-material-icon-theme/compare/v5.34.0...v5.35.0 )
##### 🚀 Enhancements
- Add CAD file extensions to 3d icon mapping
([#​3436](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3436 ))
- Add tsdown icon
([#​3418](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3418 ))
- Add new icons for mrpack
([#​3439](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3439 ))
- Add support for vercel.ts icon (typed Vercel configuration)
([#​3441](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3441 ))
- Support jxl image file type
([#​3444](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3444 ))
- Add uiua file icon
([#​3408](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3408 ))
- Add folder associations for rust/cargo projects
([#​3447](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3447 ))
- **icon:** Add zed folder icon
([#​3442](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3442 ))
- **icon:** Add redis icon
([#​3450](https://redirect.github.com/material-extensions/vscode-material-icon-theme/pull/3450 ))
- Add more unit tests for writefile helper function
([9e4c98aa](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/9e4c98aa ))
- Include language IDs into the file icons
([c9a9d2ed](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/c9a9d2ed ))
- Update dependencies
([d7274c71](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/d7274c71 ))
##### 🩹 Fixes
- Add rootDir to tsconfig.declarations.json for TypeScript 6
([4f7f49e9](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/4f7f49e9 ))
- Correct typos in CONTRIBUTING.md
([4de4acf7](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/4de4acf7 ))
##### 💅 Refactors
- **core:** Rewrite toTitleCase for clarity and add tests
([33c0e614](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/33c0e614 ))
- Remove duplicate toTitleCase, consolidate imports
([e247951d](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/e247951d ))
##### 🏡 Chore
- Improve release process
([b959b483](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/b959b483 ))
##### ✅ Tests
- **core:** Add comprehensive tests for object helpers
([57f476c5](https://redirect.github.com/material-extensions/vscode-material-icon-theme/commit/57f476c5 ))
##### ❤️ Contributors
- Philipp Kief ([@​PKief](https://redirect.github.com/PKief ))
- Sayan Shankhari
([@​SayanShankhari](https://redirect.github.com/SayanShankhari ))
- Tymon Marek
([@​TymonMarek](https://redirect.github.com/TymonMarek ))
- Unteksi-ozar
([@​Unteksi-ozar](https://redirect.github.com/Unteksi-ozar ))
- 锐冰 SharpIce
([@​SharpIceX](https://redirect.github.com/SharpIceX ))
- El Mahdi Bennajah
([@​bennajah](https://redirect.github.com/bennajah ))
- Glitch714
([@​glitchplaysgames714](https://redirect.github.com/glitchplaysgames714 ))
- Andrin Haldner
([@​AHaldner](https://redirect.github.com/AHaldner ))
- Kaden Gruizenga ([@​kgruiz](https://redirect.github.com/kgruiz ))
</details>
<details>
<summary>pnpm/pnpm (pnpm)</summary>
###
[`v11.4.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1140 )
[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.3.0...v11.4.0 )
##### Minor Changes
- Treat tarball-integrity mismatches against the lockfile as a hard
failure by default. Previously, `pnpm install` (non-frozen) would log
`ERR_PNPM_TARBALL_INTEGRITY`, silently re-resolve from the registry, and
overwrite the locked integrity — which meant a compromised registry,
proxy, or republished version could substitute attacker-controlled
content on a clean machine even though the project shipped a committed
lockfile.
`pnpm install` now exits with `ERR_PNPM_TARBALL_INTEGRITY` and a hint
pointing at the new opt-in flag.
The only opt-in is **`pnpm install --update-checksums`** — narrowly
scoped to refreshing the locked integrity values from what the registry
currently serves. Mirrors yarn's flag of the same name. A warning still
prints when the bypass takes effect so the operation is auditable.
`--force` and `pnpm update` deliberately do **not** bypass the integrity
check. They are routine refresh operations; silently overwriting a
locked integrity in those flows would erase the protection a committed
lockfile is supposed to provide. `--frozen-lockfile` behavior is
unchanged. `--fix-lockfile` keeps its documented purpose (filling in
missing lockfile entries) and is also not a bypass.
- `pnpm runtime set <name> <version>` now saves the runtime to
`devEngines.runtime` by default instead of `engines.runtime`. Pass
`--save-prod` (or `-P`) to save it to `engines.runtime` instead
[#​11948](https://redirect.github.com/pnpm/pnpm/issues/11948 ).
##### Patch Changes
- Fix a credential disclosure issue where an unscoped `_authToken` (or
`_auth`, or `username` + `_password`, or `tokenHelper`) defined in one
source — `~/.npmrc`, `~/.config/pnpm/auth.ini`, a workspace `.npmrc`,
CLI flags, etc. — would be sent as an `Authorization` header to
whichever registry a different (potentially untrusted) source named. The
same fix extends to client TLS credentials (`cert`, `key`) so they
aren't presented to a registry their author didn't choose.
pnpm now rewrites each unscoped per-registry setting (`_authToken`,
`_auth`, `username`, `_password`, `tokenHelper`, `cert`, `key`) to its
URL-scoped form at load time, using the `registry=` value declared in
the same source (or the npmjs default registry if the source declares
none). A later layer overriding `registry=` therefore cannot pull an
unscoped credential along, because it is already pinned to the URL its
author intended. `ca`/`cafile` are intentionally not rescoped — they're
trust anchors, not credentials, and corporate MITM-proxy setups rely on
them applying globally.
Every rescope emits a deprecation warning telling the user where the
setting was pinned and how to write it directly. npm has rejected
unscoped credentials outright since `npm@9`, and pnpm intends to remove
support in a future major release. To target a specific registry, write
the setting URL-scoped (e.g. `//registry.example.com/:_authToken=...` or
`//registry.example.com/:cert=...`).
`@pnpm/network.auth-header`: removed the `defaultRegistry` parameter
from `createGetAuthHeaderByURI` and `getAuthHeadersFromCreds`. Now that
credentials are URL-scoped at load time, the merged `configByUri` never
contains the empty-string "default registry" placeholder slot, so
re-keying it onto the merged default registry is no longer needed.
- Fix `pnpm deploy` crashing with `ENOENT: ... lstat
'<deployDir>/node_modules'` when `configDependencies` declares pacquet
(`pacquet` or `@pnpm/pacquet`). The deploy directory never installs
config dependencies, so the install engine they designate isn't on disk
to invoke; the nested install now skips them.
- Reject git resolutions whose `commit` field is not a 40-character
hexadecimal SHA before invoking `git`. A malicious lockfile could
otherwise smuggle a value such as `--upload-pack=<command>` through `git
fetch` / `git checkout`, which on SSH or local-file transports executes
the supplied command.
- Limit concurrent project manifest reads while listing large workspaces
to avoid `EMFILE` errors.
- Reject patch files whose `diff --git` headers reference paths outside
the patched package directory. Previously a malicious `.patch` file
added via a pull request could write, delete, or rename arbitrary files
reachable by the user running `pnpm install`.
- Improve the log message that pnpm prints after auto-adding entries to
`minimumReleaseAgeExclude` when `minimumReleaseAge` is set without
`minimumReleaseAgeStrict`. The message previously referred to the
internal "loose mode" terminology, which wasn't searchable in the docs;
it now tells the user to set `minimumReleaseAgeStrict` to `true` if they
want these updates gated behind a prompt instead
[#​11747](https://redirect.github.com/pnpm/pnpm/issues/11747 ).
- Reject dependency aliases that contain path-traversal segments (such
as `@x/../../../../../.git/hooks`) when reading them from a package
manifest or symlinking them into `node_modules`. A malicious registry
package could otherwise use a transitive dependency key to make `pnpm
install` create symlinks at attacker-chosen paths outside the intended
`node_modules` directory.
- Reject `pnpm-lock.yaml` entries whose remote tarball `resolution:`
block is missing the `integrity` field. Previously the worker that
extracts a downloaded tarball skipped hash verification when no
integrity was supplied and minted a fresh one from the unverified bytes,
so an attacker who could both alter the lockfile (e.g. via a pull
request that strips `integrity:`) and serve modified content at the
referenced tarball URL could install a tampered package without any
error — including under `--frozen-lockfile`. pnpm now fails closed at
lockfile-read time with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`. Git-hosted
tarballs (`gitHosted: true` or a URL on codeload.github.com /
bitbucket.org / gitlab.com) and `file:` tarballs are exempt — the commit
SHA in a git-host URL and the user-controlled local path already anchor
the bytes.
- Validate `devEngines.runtime` and `engines.runtime` version ranges for
`node`, `deno`, and `bun` when `onFail` is set to `error` or `warn`.
Previously these settings only had an effect with `onFail: 'download'` —
the `error` and `warn` modes silently did nothing
[#​11818](https://redirect.github.com/pnpm/pnpm/issues/11818 ).
Violations now throw `ERR_PNPM_BAD_RUNTIME_VERSION`.
- Require provenance before treating trusted publisher metadata as the
strongest trust evidence.
###
[`v11.3.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1130 )
[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.2.2...v11.3.0 )
##### Minor Changes
- Added `pnpm stage` with `publish`, `list`, `view`, `approve`,
`reject`, and `download` subcommands for npm staged publishing.
- Added a new setting `trustLockfile`. When `true`, `pnpm install` skips
the supply-chain verification pass that re-applies `minimumReleaseAge` /
`trustPolicy='no-downgrade'` to every entry in the loaded lockfile. The
install treats the lockfile as already-trusted — useful for
closed-source projects where every commit comes from a trusted author.
Defaults to `false`; verification stays on by default. Set in
`pnpm-workspace.yaml`.
Also cut the memory footprint of the verification pass itself: the
per-(registry, name) trust-meta cache previously retained the full
packument — dependency graphs, scripts, README, and per-version
manifests — for the entire install. On large workspaces (`~4k` lockfile
entries with `minimumReleaseAge` + `trustPolicy: no-downgrade` enabled)
this could OOM CI runners with a 2GB heap cap. The cache now stores only
the fields the trust check actually reads (`time`, per-version
`_npmUser.trustedPublisher`, `dist.attestations.provenance`). The
abbreviated-metadata cache is similarly projected to just the
package-level `modified` field and the set of currently-listed version
names. Fixes
[#​11860](https://redirect.github.com/pnpm/pnpm/issues/11860 ).
- Implemented `pnpm pkg` command natively, following `npm pkg`
standards.
- Implemented `pnpm repo` command natively, following `npm repo`
standards.
- Implemented `pnpm set-script` (alias `ss`) natively. Adds or updates
an entry in the `scripts` field of the project manifest, supporting
`package.json`, `package.json5`, and `package.yaml` formats.
- Add a `skip-manifest-obfuscation` option for `pnpm pack` and `pnpm
publish`. When enabled, the original `packageManager` field and publish
lifecycle scripts are kept in the packed/published manifest instead of
being stripped. The pnpm-specific `pnpm` field continues to be omitted.
##### Patch Changes
- Fixed `pnpm dlx` failing with `ERR_PNPM_NO_IMPORTER_MANIFEST_FOUND`
when the installed package's CAS slot is missing its `package.json`.
Observed in the wild for `pnpm dlx node@runtime:<version>` when the GVS
slot was populated without the synthesized manifest runtime archives
need (they don't ship a `package.json` of their own, so the synthesized
one is the only way it gets there; an existing slot from an earlier code
path that skipped the synthesis stays incomplete). The bin link itself
is wired up from the resolution and remains valid, so `dlx` now falls
back to the scopeless package name when the slot's manifest is
unreadable — for single-bin packages (the dlx common case, including
every `runtime:` spec) this matches what `manifest.bin` would have
named. Multi-bin packages already require `--package=<spec> <bin>` to
disambiguate and don't enter this code path.
- Fixed non-determinism in `pnpm dedupe` and `pnpm install` when a
dependency graph contains packages with transitive peer dependencies on
each other (e.g. `@aws-sdk/client-sts` and `@aws-sdk/client-sso-oidc`)
and `auto-install-peers` is enabled. The lockfile no longer flips
between two equally-valid forms across consecutive runs. The root cause
was that `resolveDependencies` pushed onto its `pkgAddresses` /
`postponedResolutionsQueue` arrays from inside `Promise.all`-spawned
callbacks, so completion-order timing leaked into the array order and
downstream cyclic-peer suffix assignment. Fixes
[#​8155](https://redirect.github.com/pnpm/pnpm/issues/8155 ).
- Fixed a regression introduced by
[#​11711](https://redirect.github.com/pnpm/pnpm/pull/11711 ) where
`pnpm add <github-shorthand>` (and any other wanted-dependency whose
alias can't be parsed from the user-supplied spec, e.g. tarball URLs or
`pnpm/test-git-fetch#sha`) was silently dropped from the manifest update
and from `pendingBuilds`. The alias-keyed lookup added in that PR
couldn't find a `wantedDependency` whose `alias` was `undefined` at
parse time but resolved to a package name only after fetching, so the
entry never made it into `specsToUpsert`. Restored the original
index-based pairing between `directDependencies` and
`wantedDependencies`; the catalog-protocol preservation that PR was
originally fixing is unaffected because it's driven by
`rdd.catalogLookup.userSpecifiedBareSpecifier`, not by the lookup. Fixes
the three `rebuilds dependencies` / `rebuilds specific dependencies` /
`rebuild with pending option` failures in
`building/commands/test/build/index.ts`.
- Fixed `pnpm add --config` leaving orphan entries in
`pnpm-lock.env.yaml` (the optional subdependencies of the previously
resolved version of the updated config dependency).
###
[`v11.2.2`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1122 )
[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.2.1...v11.2.2 )
##### Patch Changes
- When the install engine is delegated to pacquet via
`configDependencies`, the user's CLI flags passed to `pnpm install`
(e.g. `--no-runtime`, `--prod`, `--dev`, `--no-optional`,
`--node-linker`, `--cpu`/`--os`/`--libc`, `--offline`,
`--prefer-offline`) are now forwarded to pacquet's `install` subcommand
verbatim. Previously pacquet was invoked with a fixed argument list, so
flags like `--no-runtime` were silently dropped. Flag forwarding is
gated on the command being `install`/`i`; `add`, `update`, and `dedupe`
still don't forward (their flag surface doesn't line up with pacquet's
`install`).
- Fixed `pnpm up` (and `pnpm add` / `pnpm remove`) failing with
`pacquet_package_manager::outdated_lockfile` when pacquet is declared in
`configDependencies`. pnpm now passes `--ignore-manifest-check` to
pacquet so its `--frozen-lockfile` check doesn't fire against the
(pre-mutation) `package.json` pnpm hasn't written yet
[#​11797](https://redirect.github.com/pnpm/pnpm/issues/11797 ).
Requires a pacquet release that supports the flag — bump
`PACQUET_VERSION` in the e2e tests once it ships.
</details>
<details>
<summary>silverwind/rolldown-license-plugin
(rolldown-license-plugin)</summary>
###
[`v3.0.8`](https://redirect.github.com/silverwind/rolldown-license-plugin/releases/tag/3.0.8 )
[Compare
Source](https://redirect.github.com/silverwind/rolldown-license-plugin/compare/3.0.7...3.0.8 )
- update deps (silverwind)
- swap path.join for template concat in I/O hot paths (silverwind)
- simplify license sort and allow-branch control flow (silverwind)
</details>
<details>
<summary>typescript-eslint/typescript-eslint
(typescript-eslint)</summary>
###
[`v8.60.0`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/typescript-eslint/CHANGELOG.md#8600-2026-05-25 )
[Compare
Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.59.4...v8.60.0 )
This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.
See [GitHub
Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.0 )
for more information.
You can read about our [versioning
strategy](https://typescript-eslint.io/users/versioning ) and
[releases](https://typescript-eslint.io/users/releases ) on our website.
</details>
<details>
<summary>silverwind/updates (updates)</summary>
###
[`v17.17.2`](https://redirect.github.com/silverwind/updates/releases/tag/17.17.2 )
[Compare
Source](https://redirect.github.com/silverwind/updates/compare/17.17.1...17.17.2 )
- Read github env tokens lazily instead of at import (silverwind)
###
[`v17.17.1`](https://redirect.github.com/silverwind/updates/releases/tag/17.17.1 )
[Compare
Source](https://redirect.github.com/silverwind/updates/compare/17.17.0...17.17.1 )
- Scope GitHub token fallback to GitHub hosts only (silverwind)
###
[`v17.17.0`](https://redirect.github.com/silverwind/updates/releases/tag/17.17.0 )
[Compare
Source](https://redirect.github.com/silverwind/updates/compare/17.16.13...17.17.0 )
- update deps (silverwind)
- Add per-package `overrides` config option
([#​140](https://redirect.github.com/silverwind/updates/issues/140 ))
(silverwind)
- fix three bugs in range/tag handling (silverwind)
</details>
<details>
<summary>vitejs/vite (vite)</summary>
###
[`v8.0.14`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-8014-2026-05-21-small )
[Compare
Source](https://redirect.github.com/vitejs/vite/compare/v8.0.13...v8.0.14 )
##### Features
- update rolldown to 1.0.2
([#​22484](https://redirect.github.com/vitejs/vite/issues/22484 ))
([96efc88](96efc88570https://redirect.github.com/vitejs/vite/issues/22471 ))
([98b8163](98b8163213https://redirect.github.com/vitejs/vite/issues/22450 ))
([e8e9a34](e8e9a34dcfhttps://redirect.github.com/vitejs/vite/issues/22480 ))
([5d94d1b](5d94d1bffdhttps://redirect.github.com/vitejs/vite/issues/22342 ))
([b3132da](b3132daceahttps://redirect.github.com/vitejs/vite/issues/22470 ))
([7cb728e](7cb728eb622c69495f25https://redirect.github.com/vitejs/vite/issues/22310 ))
([0ae2844](0ae2844ab6https://redirect.github.com/vitejs/vite/issues/22449 ))
([ebf39a0](ebf39a0432https://redirect.github.com/vuejs/core/blob/HEAD/CHANGELOG.md#3535-2026-05-27 )
[Compare
Source](https://redirect.github.com/vuejs/core/compare/v3.5.34...v3.5.35 )
##### Bug Fixes
- **compiler-core:** avoid double processing v-for keys with v-memo
([#​14861](https://redirect.github.com/vuejs/core/issues/14861 ))
([34a0ded](34a0ded4d2https://redirect.github.com/vuejs/core/issues/14859 )
- **compiler-sfc:** resolve top-level exports from files registered as
global types
([#​14805](https://redirect.github.com/vuejs/core/issues/14805 ))
([3d077f2](3d077f26e3nuxt/nuxt#33694 ](https://redirect.github.com/nuxt/nuxt/issues/33694 )
- **runtime-core:** avoid repeated hydration mismatch checks
([#​14857](https://redirect.github.com/vuejs/core/issues/14857 ))
([170fc95](170fc95eb6https://redirect.github.com/vuejs/core/issues/14855 )
- **runtime-core:** skip idle persisted transition hooks in keep-alive
moves
([#​14865](https://redirect.github.com/vuejs/core/issues/14865 ))
([80fc139](80fc139f90https://redirect.github.com/vuejs/core/issues/14031 )
- **server-renderer:** propagate sync errors from `ssrRenderSuspense`
([#​14804](https://redirect.github.com/vuejs/core/issues/14804 ))
([4760997](47609975e2nuxt/nuxt#28162 ](https://redirect.github.com/nuxt/nuxt/issues/28162 )
- **teleport:** skip child unmount when pending mount discarded
([#​14876](https://redirect.github.com/vuejs/core/issues/14876 ))
([#​14877](https://redirect.github.com/vuejs/core/issues/14877 ))
([584beb1](584beb1262https://redirect.github.com/vuejs/core/issues/14860 ))
([5734fe9](5734fe97f6https://redirect.github.com/vuejs/core/issues/14828 ))
([bb18dc8](bb18dc8e56https://redirect.github.com/vuejs/core/issues/14821 ))
([1b7a2cc](1b7a2cc15chttps://redirect.github.com/vuejs/language-tools/blob/HEAD/CHANGELOG.md#332-2026-05-25 )
[Compare
Source](https://redirect.github.com/vuejs/language-tools/compare/v3.3.1...v3.3.2 )
##### language-core
- **feat:** preserve literal types for inline `v-for` sources
([#​6067](https://redirect.github.com/vuejs/language-tools/issues/6067 ))
- Thanks to [@​kkesidis](https://redirect.github.com/kkesidis )!
- **fix:** align `v-bind` shorthand identifier skipping with
interpolation - Thanks to
[@​KazariEX](https://redirect.github.com/KazariEX )!
##### vscode
- **feat:** transform tsserver content
([#​6062](https://redirect.github.com/vuejs/language-tools/issues/6062 ))
- Thanks to [@​KazariEX](https://redirect.github.com/KazariEX )!
- **fix:** do not mark trailing slash in capitalized self-closing tags
as invalid
([#​6065](https://redirect.github.com/vuejs/language-tools/issues/6065 ))
- Thanks to [@​suisanka](https://redirect.github.com/suisanka )!
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Only on Monday (`* * * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions ) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
---------
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
2026-06-02 07:18:20 +02:00
Giteabot
9aa4e897e7
chore(deps): update tool dependencies ( #37965 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [github.com/air-verse/air](https://redirect.github.com/air-verse/air )
| `v1.65.2` → `v1.65.3` |
|
|
|
[github.com/editorconfig-checker/editorconfig-checker/v3](https://redirect.github.com/editorconfig-checker/editorconfig-checker )
| `v3.6.1` → `v3.7.0` |
|
|
---
### Release Notes
<details>
<summary>air-verse/air (github.com/air-verse/air)</summary>
###
[`v1.65.3`](https://redirect.github.com/air-verse/air/releases/tag/v1.65.3 )
[Compare
Source](https://redirect.github.com/air-verse/air/compare/v1.65.2...v1.65.3 )
##### What's Changed
- Extend stale workflow timeout by
[@​xiantang](https://redirect.github.com/xiantang ) in
[#​903](https://redirect.github.com/air-verse/air/pull/903 )
- Increase stale workflow operation limit by
[@​xiantang](https://redirect.github.com/xiantang ) in
[#​904](https://redirect.github.com/air-verse/air/pull/904 )
- Add review guidelines for coding agents by
[@​xiantang](https://redirect.github.com/xiantang ) in
[#​905](https://redirect.github.com/air-verse/air/pull/905 )
- Add configurable color output mode by
[@​xiantang](https://redirect.github.com/xiantang ) in
[#​907](https://redirect.github.com/air-verse/air/pull/907 )
- fix: rewatch files after atomic saves by
[@​xiantang](https://redirect.github.com/xiantang ) in
[#​908](https://redirect.github.com/air-verse/air/pull/908 )
- follow-up: fix watcher recovery after atomic saves by
[@​xiantang](https://redirect.github.com/xiantang ) in
[#​909](https://redirect.github.com/air-verse/air/pull/909 )
- Accept .config/air.toml by
[@​bersace](https://redirect.github.com/bersace ) in
[#​716](https://redirect.github.com/air-verse/air/pull/716 )
- fix: keep built binary after app shutdown by
[@​mariusvniekerk](https://redirect.github.com/mariusvniekerk ) in
[#​911](https://redirect.github.com/air-verse/air/pull/911 )
##### New Contributors
- [@​bersace](https://redirect.github.com/bersace ) made their
first contribution in
[#​716](https://redirect.github.com/air-verse/air/pull/716 )
**Full Changelog**:
<https://github.com/air-verse/air/compare/v1.65.2...v1.65.3 >
</details>
<details>
<summary>editorconfig-checker/editorconfig-checker
(github.com/editorconfig-checker/editorconfig-checker/v3)</summary>
###
[`v3.7.0`](https://redirect.github.com/editorconfig-checker/editorconfig-checker/releases/tag/v3.7.0 )
[Compare
Source](https://redirect.github.com/editorconfig-checker/editorconfig-checker/compare/v3.6.1...v3.7.0 )
##### Features
- **files:** expand glob patterns in passed-file args
([#​190](https://redirect.github.com/editorconfig-checker/editorconfig-checker/issues/190 ))
([#​558](https://redirect.github.com/editorconfig-checker/editorconfig-checker/issues/558 ))
([4c0f326](4c0f326cfahttps://redirect.github.com/editorconfig-checker/editorconfig-checker/issues/557 ))
([9f4014c](9f4014ce09https://redirect.github.com/editorconfig-checker/editorconfig-checker/issues/550 ))
([f47b30c](f47b30c967https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2026-06-01 21:05:09 +00:00
Lunny Xiao
0a3e7483a4
chore: Move gitea sdk from code.gitea.io/sdk/gitea -> gitea.dev/sdk ( #37855 )
...
- Use gitea.dev/sdk instead of code.gitea.io/sdk/gitea
- Use gitea.dev/actions-proto-def instead of
code.gitea.io/actions-proto-def
2026-05-27 16:23:44 -07:00
Lunny Xiao
61b1a39efe
chore: Move import path from code.gitea.io/gitea to gitea.dev ( #37873 )
2026-05-26 15:49:31 -07:00
Giteabot
2775158024
chore(deps): update module github.com/air-verse/air to v1.65.2 ( #37840 )
...
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/ ) |
[Confidence](https://docs.renovatebot.com/merge-confidence/ ) |
|---|---|---|---|
| [github.com/air-verse/air](https://redirect.github.com/air-verse/air )
| `v1.65.1` → `v1.65.2` |
|
|
---
### Release Notes
<details>
<summary>air-verse/air (github.com/air-verse/air)</summary>
###
[`v1.65.2`](https://redirect.github.com/air-verse/air/releases/tag/v1.65.2 )
[Compare
Source](https://redirect.github.com/air-verse/air/compare/v1.65.1...v1.65.2 )
##### What's Changed
- docs: clarify Go install binary path by
[@​xiantang](https://redirect.github.com/xiantang ) in
[#​900](https://redirect.github.com/air-verse/air/pull/900 )
- fix: keep app running until rebuild succeeds by
[@​mariusvniekerk](https://redirect.github.com/mariusvniekerk ) in
[#​897](https://redirect.github.com/air-verse/air/pull/897 )
- docs: add Scoop install instructions by
[@​xiantang](https://redirect.github.com/xiantang ) in
[#​901](https://redirect.github.com/air-verse/air/pull/901 )
- Resolve root directory if symlinked by
[@​caleb-fringer](https://redirect.github.com/caleb-fringer ) in
[#​742](https://redirect.github.com/air-verse/air/pull/742 )
- Add stale issue workflow by
[@​xiantang](https://redirect.github.com/xiantang ) in
[#​902](https://redirect.github.com/air-verse/air/pull/902 )
##### New Contributors
- [@​mariusvniekerk](https://redirect.github.com/mariusvniekerk )
made their first contribution in
[#​897](https://redirect.github.com/air-verse/air/pull/897 )
- [@​caleb-fringer](https://redirect.github.com/caleb-fringer )
made their first contribution in
[#​742](https://redirect.github.com/air-verse/air/pull/742 )
**Full Changelog**:
<https://github.com/air-verse/air/compare/v1.65.1...v1.65.2 >
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- Only on Monday (`* * * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-05-25 13:54:24 +00:00
Nicolas
cdee9f5e10
ci: sync PR labels from the conventional-commit title ( #37784 )
...
Syncs `type/*` and `pr/breaking` labels from the PR title (Conventional
Commits) and folds the existing title lint into the same workflow so
labeling only runs once the title is valid.
- `tools/pr-title.ts`: shared title parser and label mapping.
- `tools/set-pr-labels.ts`: adds/removes labels via the GitHub API.
`type/*` and `pr/breaking` are fully synced (added and removed);
`skip-changelog` (chore/ci) and `topic/build` (build) are only added,
never auto-removed, so manual labeling is preserved.
- `pull-labeler.yml` now hosts `lint-pr-title` and `set-pr-labels`
(`needs: lint-pr-title`) under `pull_request_target`, required so fork
PRs get a writable token. Base-branch checkout only; no PR-head code
runs in the elevated context.
- Removes the superseded `pull-pr-title.yml` and the CI-only
`lint-pr-title` Makefile target.
---------
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>
2026-05-23 16:12:12 +02:00
silverwind
570173b409
ci: add shellcheck linter ( #37682 )
...
- Adds `make lint-shell`. uses local `shellcheck` if its version
matches, otherwise runs the pinned image via docker or podman
- `.shellcheckrc` disables the most annoying rules
- Fixes findings across existing scripts
Fixes : #37648
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>
Co-authored-by: Nicolas <bircni@icloud.com>
2026-05-22 20:22:04 +00:00
silverwind
93b8fdcd68
ci: shard tests and reduce redundant work ( #37618 )
...
Critical path ~25:42 → ~19:56 (−22%), ~0% CI minutes.
- `test-pgsql` shards 2-way. Branch protection: replace `test-pgsql`
with `test-pgsql-shards (1)` + `test-pgsql-shards (2)`; `test-unit`,
sqlite/mysql/mssql unchanged — pgsql dominates the critical path.
- `test-unit` runs `bindata` then `bindata gogit` sequentially.
cache-seeder pre-warms the race-instrumented test compile cache and the
integration test binary so PR jobs warm-start.
- Cache writes restricted to cache-seeder; PR jobs use
`actions/cache/restore`. Defends against PR cache poisoning and frees
the 10 GB cap from PR churn.
- `go-cache` action: dropped the `cache-name` input. One gobuild cache,
one golangci-lint cache. Seeder lint job restores but doesn't save
gobuild, so only one writer populates it.
- `tools/test-integration.sh` shards the integration binary via
`-test.list`; `TestMain` short-circuits DB init in list mode.
`TestAPILFSNotStarted` / `TestAPILFSLocksNotStarted` switched to
`test.MockVariableValue` — latent `setting.LFS.StartServer` global-state
leak uncovered by sharding.
---
This PR was written with the help of Claude Opus 4.7
---------
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Nicolas <bircni@icloud.com>
2026-05-21 06:58:41 +02:00
silverwind
83151e98cc
ci: narrow files-changed frontend filter ( #37749 )
...
Drop the broad `tools/*.{js,ts}` globs from the `frontend` filter so
edits to CI-only or backend helper scripts in `tools/` stop triggering
frontend and e2e jobs. Only `tools/generate-svg.ts` is kept.
Also renames `tools/lint-pr-title.js` to `.ts` for consistency, drops
the empty root `*.js` glob, fixes stray indentation in the `dockerfile`
filter and adds missing `setup-node`.
---
This PR was written with the help of Claude Opus 4.7
---------
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-18 05:38:40 +00:00
silverwind
02be228ed6
ci: add zizmor to lint-actions ( #37720 )
...
Adds [zizmor](https://docs.zizmor.sh/ ) to `make lint-actions` with
`--min-confidence=medium`. Fixes the remaining findings:
- Pin floating-tag service images in `pull-db-tests.yml` to
`tag@sha256:digest`
- Move `github.ref` / `github.ref_name` (and surrounding secrets/step
outputs for consistency) out of `run:` into `env:`
---
This PR was written with the help of Claude Opus 4.7
---------
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: Giteabot <teabot@gitea.io>
2026-05-16 10:38:46 +02:00
TheFox0x7
c78c84c3ca
test(e2e): run playwright via container ( #37300 )
...
Enable running playwright tests on unsupported platforms as well
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-10 09:16:02 +00:00
silverwind
a61598884f
feat(editor): broaden language detection in web code editor ( #37619 )
...
Use
https://github.com/github-linguist/linguist/blob/main/lib/linguist/languages.yml
to substantially improve syntax higlighting in Codemirror. File is
generated on-demand only.
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-10 04:51:46 +00:00
silverwind
a5d81d9ce2
perf: replace goheader linter with custom check ( #37599 )
...
Replace the [slow `goheader` linter](https://github.com/denis-tingaikin/go-header/issues/70 ) with a
custom check.
Local go lint time is down from 247s to 32s. 6 new files that were
previously undetected because of `//go:build ignore` are fixed. The exit
code of the make target preserves the golangci-lint exit code, if
present.
Also refactors and consolidates the linting targets.
Signed-off-by: silverwind <me@silverwind.io>
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Giteabot <teabot@gitea.io>
2026-05-08 23:39:35 +02:00
silverwind
82d40296b0
chore(deps): bump tool deps and pin, update golangci-lint ( #37574 )
...
1. Pin all makefile go deps to exact version, renovate will bump them in the future
2. Bump all deps and golangci-lint and fix all new issues, most are from modernize
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-08 04:49:34 +00:00
silverwind
b4085c7e3c
build: update pnpm to v11 ( #37591 )
...
Update to https://github.com/pnpm/pnpm/releases/tag/v11.0.0
- move all pnpm settings to `pnpm-workspace.yaml`, pnpm v11 only reads
that file
- drop redundant or no-op settings
- disable `strictDepBuilds` to avoid having to manually specify deps
with build scripts, this is equivalent to v10 where it will not execute
and warn.
- add workarounds for https://github.com/SukkaW/nolyfill/issues/119
- remove dead eslintrc entry
---
This PR was written with the help of Claude Opus 4.7
---------
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-05-08 04:17:20 +00:00
wxiaoguang
a39af1a829
refactor: use modernc sqlite driver as default ( #37562 )
...
The mattn driver is still kept, can be enabled by
TAGS="sqlite_mattn sqlite_unlock_notify"
---------
Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>
2026-05-06 18:57:59 +00:00
Nicolas
45ffe5aa6a
ci: lint PR titles with commitlint ( #37498 )
...
## Summary
- Enforce **Conventional Commits** on PR titles (PRs are squash-merged,
so the PR title becomes the final commit message).
- Add a local `make lint-pr-title` target so contributors can validate
titles before pushing.
## Why
We squash-merge PRs, which means the final repository history is largely
shaped by **PR titles**. Enforcing a consistent Conventional Commits
format makes:
- **Release notes & changelogs easier to generate** (types like `feat` /
`fix` can be grouped automatically).
- **History easier to scan** (uniform structure, optional scopes,
explicit breaking changes via `!`).
- **Automation more reliable** (future tooling can infer category and
scope from the title).
## PR title format
```text
type(scope)!: subject
type: one of build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test
scope: optional (e.g. web, api, actions, repo, …)
!: optional, indicates a breaking change
subject: short, imperative, no trailing period
```
## Examples
```text
feat(web): add dark mode toggle
fix(api): avoid panic when repo is missing
chore(ci): lint PR titles with commitlint
refactor(templates): reduce duplication in repo list rendering
feat!: remove legacy OAuth endpoint
```
## Local testing
```text
make deps-frontend
make lint-pr-title PR_TITLE="feat(web): add dark mode toggle"
```
---------
Signed-off-by: Nicolas <bircni@icloud.com>
Co-authored-by: nb <nb@users.noreply.local>
Co-authored-by: GPT-5.2 <gpt-5.2@openai.com>
2026-05-05 17:24:09 +00:00
silverwind
762154cbd7
fix: Fix nolyfill for renovate ( #37537 )
...
Run `nolyfill` as a renovate post-upgrade step alongside `make svg`, so
npm dep bumps keep `pnpm.overrides` in sync.
---
This PR was written with the help of Claude Opus 4.7
---------
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-04 21:39:20 +00:00
wxiaoguang
deb31d3f30
Refactor database connection ( #37496 )
...
Clean up legacy copied&pasted code, introduce the unique "database
connection" function. Move migration testing helper function
PrepareTestEnv to a separate package.
By the way, remove "shadow connection secrets" tricks: showing
connection string on UI is useless
---------
Co-authored-by: Nicolas <bircni@icloud.com>
2026-05-01 15:38:38 +00:00
wxiaoguang
1721c235a7
Refactor CI workflows ( #37487 )
...
1. only trigger docker-dryrun arm64&riscv64 when dockerfile changes
2. de-duplicate "contents: read" permission for most workflows
3. merge various "lint-*" jobs into one job
4. add missing lint targets to the "lint" (all) target
2026-05-01 02:15:01 +08:00
Icy Avocado
81692ceafa
Allow multiple projects per issue and pull requests ( #36784 )
...
Add ability to add and remove multiple projects per issue
and pull request.
Resolve #12974
---------
Signed-off-by: Icy Avocado <avocado@ovacoda.com>
Co-authored-by: Tyrone Yeh <siryeh@gmail.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: OpenCode (gpt-5.2-codex) <opencode@openai.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-04-30 22:38:05 +08:00
silverwind
d57d06335d
Refactor integration tests infrastructure ( #37462 )
...
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-04-29 16:37:38 +00:00
Myers Carpenter
9e031eb3df
Serve OpenAPI 3.0 spec at /openapi.v1.json ( #37038 )
...
Add a build-time conversion step that transforms the existing Swagger
2.0 spec into an OpenAPI 3.0 spec. The OAS3 spec is served alongside the
existing Swagger 2.0 spec, enabling API clients that require OAS3 to
generate code directly from Gitea's API.
This is not to be an answer to how gitea handles OAS3 long term,
but a way to use what we have to move a step forward.
---------
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-04-29 20:47:52 +08:00
silverwind
99cd4f6b22
Integrate renovate bot for all dependency updates ( #37050 )
...
Replaces Dependabot with Renovate. The new setup:
- One PR per ecosystem (GitHub Actions, Go modules + Makefile go-tool
pins, npm, Python via uv, Nix flake), opened weekly on Mondays with a
5-day release-age cooldown. Vulnerability PRs ship next-day via daily
cron + Renovate's `vulnerabilityAlerts` schedule bypass.
- All `uses:` action refs SHA-pinned with patch-level version comments
(same format as #36971 , which this supersedes);
`helpers:pinGitHubActionDigests` keeps future bumps in that format.
- `renovatebot/github-action` runtime image pinned via the
upstream-recommended `RENOVATE_VERSION` env + magic comment +
`customManagers:githubActionsVersions` preset, so Renovate keeps the pin
updated.
- Custom regex manager tracks the `*_PACKAGE ?= <import-path>@<version>`
lines in `Makefile` (golangci-lint, swagger, actionlint, etc.) and
groups them into the same Go PR via `matchDatasources: ["go"]`.
- Post-upgrade tasks regenerate `assets/go-licenses.json` (`make tidy`)
and the SVG sprite (`make svg`), gated by an env-level command
allowlist.
- Replaces the standalone `cron-flake-updater` workflow — Renovate's nix
manager tracks `flake.nix` inputs and produces the same `flake.lock`
bump PRs on the regular weekly schedule.
- npm and gomod-replace pins live in `renovate.json5` only;
`updates@17.16.3` reads them from there too, so the standalone
`updates.config.ts` is gone and one source of truth covers both tools.
Fixes: https://github.com/go-gitea/gitea/issues/33386
Signed-off-by: silverwind <me@silverwind.io>
Signed-off-by: TheFox0x7 <thefox0x7@gmail.com>
Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>
Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: Giteabot <teabot@gitea.io>
2026-04-26 14:25:22 +00:00
silverwind
b6ea666fd4
Revert "Add WebKit to e2e test matrix ( #37298 )" ( #37315 )
...
Reverts: #37298
Ref:
https://github.com/go-gitea/gitea/actions/runs/24661464168/job/72108324223?pr=37312
WebKit on Linux has a long history of flakiness in Playwright CI runs,
and the exact "WebKit encountered an internal error" class of failures
has been reported repeatedly and closed without a real fix (typically
stale/no-repro, or worked around by retries):
- https://github.com/microsoft/playwright/issues/34450
- https://github.com/microsoft/playwright/issues/35773
- https://github.com/microsoft/playwright/issues/35870
- https://github.com/microsoft/playwright/issues/35293
- https://github.com/microsoft/playwright/issues/38838
Keeping chromium and firefox in the e2e matrix.
---
This PR was written with the help of Claude Opus 4.7
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-04-20 19:49:38 +00:00
silverwind
6f761219b2
Add WebKit to e2e test matrix ( #37298 )
...
Verified locally with 50 runs, averaging 9 seconds per local test suite
run. Total suite took 15s.
`--with-deps` is needed because webkit's dependencies are not
pre-installed on GHA runners (as opposed to firefox/chrome which are
preinstalled).
---
This PR was written with the help of Claude Opus 4.7
---------
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: Nicolas <bircni@icloud.com>
2026-04-19 19:09:43 +00:00
silverwind
a9108ab6aa
Replace custom Go formatter with golangci-lint fmt ( #37194 )
...
Use `golangci-lint fmt` to format code, replacing the previous custom
formatter tool. https://github.com/daixiang0/gci is used to order the
imports.
`make fmt` performs ~13% faster while consuming ~57% less cpu while
formatting for me.
`GOFUMPT_PACKAGE` is gone because it's using the builtin package from
golangci-lint.
Co-authored-by: Claude (claude-opus-4-6) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-04-17 17:45:22 +00:00
silverwind
d80640fa5d
Add e2e reaction test, improve accessibility, enable parallel testing ( #37081 )
...
Add a new e2e test for toggling issue reactions via the reaction picker
dropdown.
Add `aria-label` attributes to improve reaction accessibility:
- Add `aria-label="Reaction"` to the reaction picker dropdown
- Add `role="group"` with `aria-label="Reactions"` to the reactions
container, giving it a semantic identity for screen readers
- Include the reaction key in each reaction button's `aria-label` (e.g.
`+1: user1, user2`) so screen readers announce which reaction a button
represents
E2e test improvements:
- Simplify `randomString` to use `Math.random` instead of `node:crypto`
- Replace `generatePassword` with a static password, remove unused
`clickDropdownItem`
- Enable `fullyParallel: true` and `workers: '50%'` in Playwright config
- Run both chromium and firefox in all environments (not just CI)
- Parallelize `login` and `apiCreateRepo` setup where possible
- Use dedicated test user in `user-settings` test for concurrency safety
Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
2026-04-03 17:20:44 +00:00
silverwind
3a9cab034b
Update JS dependencies and misc tweaks ( #37064 )
...
- Update all JS deps
- Regenerate SVGs
- Add new eslint rules from unicorn
- Update typescript config for 6.0, remove deprecated options in favor
of `strict` with disablements, remove implicit dom libs.
- Set vite log level during `watch-frontend` to `warn` to avoid
confusing URLs or HMR spam from the dev server to keep the log concise.
Overridable via `FRONTEND_DEV_LOG_LEVEL`.
Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
2026-04-01 20:15:02 +02:00
silverwind
a20e182067
Update Go dependencies ( #36781 )
...
Update all non-locked Go dependencies and pin incompatible ones.
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-04-01 11:26:52 +08:00
silverwind
e15219d810
Raise minimum Node.js version to 22.18.0 ( #37058 )
...
Remove the experimental strip types check and `NODE_VARS` mechanism from
the Makefile, as Node.js 22.18.0+ has native TypeScript type stripping
support.
https://nodejs.org/en/blog/release/v22.18.0 was released 8 months ago
and has now trickled into all major Linux distros like Alpine 3.23+.
---
This PR was written with the help of Claude Opus 4.6
Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
2026-03-31 16:50:51 +00:00
silverwind
d8da91a7f2
Update golangci-lint to v2.11.4 ( #37059 )
...
Update golangci-lint from v2.11.2 to v2.11.4 and fix new `modernize`
lint warnings:
- Use `strings.Builder` instead of string concatenation in loop
(`evaluator.go`)
- Use `atomic.Int64` instead of `int64` with atomic free functions
(`logchecker.go`, `timer_test.go`, `integration_test.go`)
---
This PR was written with the help of Claude Opus 4.6
Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
2026-03-31 16:22:23 +00:00
silverwind
0ec66b5380
Migrate from webpack to vite ( #37002 )
...
Replace webpack with Vite 8 as the frontend bundler. Frontend build is
around 3-4 times faster than before. Will work on all platforms
including riscv64 (via wasm).
`iife.js` is a classic render-blocking script in `<head>` (handles web
components/early DOM setup). `index.js` is loaded as a `type="module"`
script in the footer. All other JS chunks are also module scripts
(supported in all browsers since 2018).
Entry filenames are content-hashed (e.g. `index.C6Z2MRVQ.js`) and
resolved at runtime via the Vite manifest, eliminating the `?v=` cache
busting (which was unreliable in some scenarios like vscode dev build).
Replaces: https://github.com/go-gitea/gitea/pull/36896
Fixes: https://github.com/go-gitea/gitea/issues/17793
Signed-off-by: silverwind <me@silverwind.io>
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-03-29 10:24:30 +00:00
silverwind
de478c4b6f
Add e2e tests for server push events ( #36879 )
...
Add e2e tests for the three server push features:
- **Notification count**: verifies badge appears when another user
creates an issue
- **Stopwatch**: verifies stopwatch element is rendered when a stopwatch
is active
- **Logout propagation**: verifies logout in one tab triggers redirect
in another
Tests are transport-agnostic in preparation for a future WebSocket
migration.
---------
Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-03-27 11:49:11 +01:00
silverwind
b3c6917463
Update JS dependencies ( #37001 )
...
- Update all JS dependencies via `make update-js`
- `webpack-cli` 6 to 7: remove `--disable-interpret` from Makefile
- Fix lint: remove unnecessary type args, `toThrowError` to `toThrow`
- Fix duplicate CSS selector detected by `stylelint` 17.6.0
- Change `updates.config.ts` to use `pin`, needed for `tailwindcss`
- Pin `typescript` pending typescript-eslint/typescript-eslint#12123
---------
Co-authored-by: Claude (claude-opus-4-6) <noreply@anthropic.com>
Co-authored-by: Giteabot <teabot@gitea.io>
2026-03-27 04:39:24 +01:00
silverwind
6e8f78ae27
Enable eslint concurrency ( #36878 )
...
Add `--concurrency 2` to all ESLint invocations in the Makefile. ESLint
v9 supports multi-threaded linting via worker threads.
Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
2026-03-10 17:05:52 +00:00
Nicolas
8d06a9425e
Update minimum go version to 1.26.1, golangci-lint to 2.11.2, fix test style ( #36876 )
...
Hey, I bumped Go to 1.26.1 and fixed a couple of things I ran into while
poking around.
### Changes
- Bump go.mod from 1.26.0 to 1.26.1 (security patch)
- Bump golangci-lint from v2.10.1 to v2.11.2
- Run make tidy, fmt, lint-go
---------
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
2026-03-10 06:26:52 +00:00
silverwind
b52d745d0a
Filter out untracked files from spellchecking ( #36756 )
...
The integration tests leave some log files around and they were
triggering the spellchecker:
```
$ make lint-spell
tests/integration/gitea-integration-sqlite/log/gitea.log:316:69: "addres" is a misspelling of "address"
tests/integration/gitea-integration-sqlite/log/gitea.log:794:69: "addres" is a misspelling of "address"
tests/integration/gitea-integration-sqlite/log/gitea.log:1248:69: "addres" is a misspelling of "address"
tests/integration/gitea-integration-sqlite/log/gitea.log:2070:69: "addres" is a misspelling of "address"
```
With this change, untracked and ignored files will no longer be
spellchecked.
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 23:06:31 +00:00
silverwind
f7f55a356f
Update tool dependencies and fix new lint issues ( #36702 )
...
## Summary
- Update golangci-lint v2.9.0 → v2.10.1, misspell v0.7.0 → v0.8.0,
actionlint v1.7.10 → v1.7.11
- Fix 20 new QF1012 staticcheck findings by using `fmt.Fprintf` instead
of `WriteString(fmt.Sprintf(...))`
- Fix SA1019: replace deprecated `ecdsa.PublicKey` field access with
`PublicKey.Bytes()` for JWK encoding, with SEC 1 validation and curve
derived from signing algorithm
- Add unit test for `ToJWK()` covering P-256, P-384, and P-521 curves,
also verifying correct coordinate padding per RFC 7518
- Remove dead staticcheck linter exclusion for "argument x is
overwritten before first use"
## Test plan
- [x] `make lint-go` passes with 0 issues
- [x] `go test ./services/oauth2_provider/ -run
TestECDSASigningKeyToJWK` passes for all curves
🤖 Generated with [Claude Code](https://claude.com/claude-code )
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 19:13:19 +00:00
silverwind
18e0746b7b
Rework e2e tests ( #36634 )
...
- Replace the e2e tests initialization with a simple bash script,
removing the previous Go harness.
- `make test-e2e` is the single entry point. It always starts a fully
isolated ephemeral Gitea instance with its own temp directory, SQLite
database, and config — no interference with the developer's running
instance.
- A separate `gitea-e2e` binary is built via `EXECUTABLE_E2E` using
`TEST_TAGS` (auto-includes sqlite with `CGO_ENABLED=1`), keeping the
developer's regular `gitea` binary untouched.
- No more split into database-specific e2e tests. Test timeouts are
strict, can be relaxed later if needed.
- Simplified and streamlined the playwright config and test files.
- Remove all output generation of playwright and all references to
visual testing.
- Tests run on Chrome locally, Chrome + Firefox on CI.
- Simplified CI workflow — visible separate steps for frontend, backend,
and test execution.
- All exported env vars use `GITEA_TEST_E2E_*` prefix.
- Use `GITEA_TEST_E2E_FLAGS` to pass flags to playwright, e.g.
`GITEA_TEST_E2E_FLAGS="--ui" make test-e2e` for UI mode or
`GITEA_TEST_E2E_FLAGS="--headed" make test-e2e` for headed mode.
- Use `GITEA_TEST_E2E_DEBUG=1 make test-e2e` to show Gitea server
output.
---------
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-20 16:26:47 -08:00
silverwind
87f7291909
Make security-check informational only ( #36681 )
...
Change `security-check` not break the build which is a major
inconvenience as it breaks CI on all PRs.
https://github.com/go-gitea/gitea/security/dependabot already provides a
clean overview of outstanding security issues in dependencies and I'm
using it all the time to find and update vulnerable dependencies.
2026-02-20 16:40:07 +01:00
silverwind
5e9b9b33d1
Clean up Makefile, tests and legacy code ( #36638 )
...
This simplifies the Makefile by removing the whole-file wrapping that
creates a tempdir introduced by
https://github.com/go-gitea/gitea/pull/11126 . REPO_TEST_DIR is removed
as well.
Also clean up a lot of legacy code: unnecessary XSS test, incorrect test
env init, unused "_old_uid" hack, etc
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-02-19 01:23:32 +00:00
silverwind
b9d323c3d8
Replace google/go-licenses with custom generation ( #36575 )
...
Rewrite `build/generate-go-licenses.go` to use `go list -m -json all`
and read license files directly from the Go module cache instead of
relying on the buggy `google/go-licenses` tool.
This removes the need for CGO, GOOS=linux, and the intermediate temp
directory, while being like 100 times faster than before:
```
$ rm assets/go-licenses.json && time make assets/go-licenses.json
go run build/generate-go-licenses.go assets/go-licenses.json
make assets/go-licenses.json 0.21s user 0.22s system 173% cpu 0.247 total
---------
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-18 04:13:26 +00:00
silverwind
45ee571693
Update to go 1.26.0 and golangci-lint 2.9.0 ( #36588 )
2026-02-11 18:37:13 +01:00
silverwind
7292ae1ed5
Update JS deps, remove knip, misc tweaks ( #36499 )
...
- Update all JS deps
- Enable a few more stylelint stylistic rules and fix issues
- Remove knip, it raised another false-positive, this tool is not worth
it when you have to babysit it like that
- Exclude @eslint/json from updating as it requires unreleased eslint 10
([ref](https://github.com/eslint/json/issues/207 ))
- Update labeler config for new eslint filenames
- Adjust `make help` output
- Add type checking in `stylelint.config.ts`
2026-01-31 20:58:23 +08:00
wxiaoguang
07ada3666b
chore: add comments for "api/healthz", clean up test env ( #36481 )
...
GITEA_UNIT_TESTS_LOG_SQL is renamed to GITEA_TEST_LOG_SQL
2026-01-30 10:23:38 +08:00
silverwind
12a81d38c1
Add knip linter ( #36442 )
...
This adds [knip](https://github.com/webpro-nl/knip ), a tool to find
unused files, dependencies and exports in JS. Fixed all discovered
issues.
1. knip apparently has some issue resolving imports from `d.ts` to `.ts`
so I worked around it by moving the two affected types to where they are
used.
2. I don't know why `modules/fomantic/dropdown.ts` had a new typescript
error, but I fixed it.
3. Use named export for `EsbuildPlugin`, I think this was added
recently.
2026-01-24 12:52:13 +00:00
silverwind
a608b9e1e3
Update tool dependencies ( #36445 )
...
Updates all dependencies in `Makefile`. The go fix was done
automatically, I just altered the variable name.
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-01-24 09:58:28 +01:00
silverwind
5f91c51fa5
Remove node-check and go-check, support node prerelease versions ( #36382 )
...
1. Remove those checks for the sake of build performance and because go
and node will fail anyways if their versions are incorrect.
3. Support pre-release Node version for determining NODE_VARS.
2. Update to the chinese READMEs to mention `pnpm` which is already
present in english README.
---------
Co-authored-by: techknowlogick <techknowlogick@gitea.com>
Co-authored-by: Giteabot <teabot@gitea.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-01-22 09:30:02 +01:00
Lunny Xiao
ffea9a27c3
Convert locale files from ini to json format ( #35489 )
...
Migrate from the current INI format to JSON for translations. JSON is
widely supported, including by platforms such as Crowdin and Weblate.
2025-12-19 09:50:48 -08:00
