0
0
mirror of https://github.com/go-gitea/gitea.git synced 2026-06-29 16:25:57 +02:00

20928 Commits

Author SHA1 Message Date
Lunny Xiao
efed07ac60
update 2026-05-16 14:05:51 -07:00
Lunny Xiao
71cb6e0f19
update 2026-05-16 13:43:45 -07:00
Lunny Xiao
2629569d3c
update 2026-05-16 12:59:56 -07:00
Lunny Xiao
73039ce895
fix lang file 2026-05-16 12:57:26 -07:00
Lunny Xiao
1136d6996d fix(issues): align const block in comment_meta_test.go for gci lint 2026-05-16 11:56:00 -07:00
Lunny Xiao
d56741a238 Merge branch 'main' into lunny/project_workflow 2026-05-16 00:04:36 -07:00
Lunny Xiao
baf88f7e8c
refactor project workflow frontend and add some tests 2026-05-16 00:04:13 -07:00
silverwind
b742fa7d6b
chore(renovate): enable dockerfile manager (#37719)
Enables Renovate's `dockerfile` manager so the base images in
`Dockerfile` and `Dockerfile.rootless`
(`docker.io/library/golang:1.26-alpine3.23`,
`docker.io/library/alpine:3.23`) get tracked alongside the other
dependencies. Updates are grouped under "docker dependencies" and follow
the existing weekly schedule.

---
This PR was written with the help of Claude Opus 4.7

Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: Nicolas <bircni@icloud.com>
2026-05-16 06:40:05 +00:00
Copilot
3607516ce2
refactor(org): simplify owner-team org repo creation logic (#37727)
This change cleans up org repo-creation authorization by making
owner-team membership sufficient regardless of `can_create_org_repo`,
and removes the now-obsolete doctor fix for owner teams.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: wxiaoguang <2114189+wxiaoguang@users.noreply.github.com>
2026-05-16 14:26:33 +08:00
Lunny Xiao
7e54514316
fix(oauth): bind token exchanges to the original client request (#37704) 2026-05-16 07:03:23 +02:00
Lunny Xiao
35c81e3166
fix 2026-05-15 21:20:18 -07:00
Lunny Xiao
b2f1106365 Merge branch 'main' into lunny/project_workflow 2026-05-15 15:10:01 -07:00
Lunny Xiao
59fe0ef4d9
fix 2026-05-15 15:09:49 -07:00
pandareen
ef801bb661
fix(auth): set User-Agent on avatar fetch and sync avatar on link-account register (#37564) (#37588)
## Summary

Fixes
[go-gitea/gitea#37564](https://github.com/go-gitea/gitea/issues/37564):
when an OIDC provider returns a `picture` claim, Gitea is supposed to
download that image as the user's avatar (if `[oauth2_client]
UPDATE_AVATAR = true`). Two latent bugs prevented this from working
consistently:

1. **Default Go User-Agent rejected by some image hosts.**
`oauth2UpdateAvatarIfNeed` used `http.Get`, which sends `User-Agent:
Go-http-client/1.1`. Hosts like `upload.wikimedia.org` reject that UA
with `403`, and every error path silently returned, so the user was left
with an identicon and **no log line** to diagnose the issue.
2. **Link-account *register* path skipped avatar sync.** First-time OIDC
sign-ins where auto-registration is disabled (or required a
username/password retype) go through `LinkAccountPostRegister`, which
created the user but never called `oauth2SignInSync`. So the avatar /
full name / SSH keys from the IdP were dropped on the floor for those
users, even though the existing-account-link path (`oauth2LinkAccount`)
and the auto-register path (`handleOAuth2SignIn`) both already did the
sync.

## Changes

- `routers/web/auth/oauth.go` — `oauth2UpdateAvatarIfNeed` now uses
`http.NewRequest` + `http.DefaultClient.Do`, sets `User-Agent: Gitea
<version>`, and logs every failure path at `Warn` (invalid URL, fetch
error, non-200, body read error, oversize body, upload error). No silent
failures.
- `routers/web/auth/linkaccount.go` — `LinkAccountPostRegister` now
calls `oauth2SignInSync` after a successful user creation, mirroring the
auto-register and link-existing-account flows.
- `tests/integration/oauth_avatar_test.go` — new
`TestOAuth2AvatarFromPicture` integration test with five sub-cases:
- `AutoRegister_FetchesAvatarFromPictureWithGiteaUA` — happy path,
asserts `use_custom_avatar=true`, an avatar hash is set, exactly one
HTTP request was made, and the request carried a `Gitea ` UA. The mock
server enforces the UA prefix to mirror real-world hosts that reject
Go's default UA.
- `AutoRegister_NonOK_DoesNotUpdateAvatar` — server returns 403; user's
avatar must remain unset.
- `AutoRegister_EmptyPicture_NoFetch` — empty `picture` claim must not
trigger any HTTP request.
- `AutoRegister_UpdateAvatarFalse_NoFetch` — `UPDATE_AVATAR=false` must
not trigger any HTTP request.
- `LinkAccountRegister_FetchesAvatarFromPicture` — guards the
`linkaccount.go` fix; without the new `oauth2SignInSync` call this
assertion fails.

## Related

- Upstream issue: go-gitea/gitea#37564
--------------------------------------------

AI Editor was used in this PR

---------

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Nicolas <bircni@icloud.com>
2026-05-15 11:22:36 -07:00
wxiaoguang
59db4154eb
chore: clean up tests (#37715)
1. use MockVariableValue as much as possible
2. use wg.Go as much as possible instead of Add/Done
3. simplify global lock's DefaultLocker logic to make it easier to test
4. introduce a general approach for getting external service config in
CI
5. remove unclear & unnecessary "t.Skip"
6. use modern generic syntax for remaining "DecodeJSON" calls
7. clarify test result for "list gitignore templates" and "list
licenses"
2026-05-15 16:26:36 +02:00
Zettat123
cf0f25b798
fix(actions): deadlock between PrepareRunAndInsert and UpdateTaskByState (#37692)
Fix #36234

## Bug

Logs show `PrepareRunAndInsert: InsertRun: Error 1213: Deadlock found`,
which `handleWorkflows` silently swallows via `log.Error + continue`, so
the triggered run is dropped.

## Root cause

The path `UpdateRun -> UpdateRepoRunsNumbers` runs the following SQL
inside every status-changing transaction:

```sql
UPDATE repository
SET num_action_runs        = (SELECT count(*) FROM action_run WHERE repo_id = N),
    num_closed_action_runs = (SELECT count(*) FROM action_run WHERE repo_id = N AND status IN (...))
WHERE id = N;
```

On any DB that treats subqueries inside an UPDATE as locking reads, this
statement takes locks in two steps:

1. The outer UPDATE acquires an X lock on `repository[id=N]`
2. The embedded SELECT subqueries are evaluated as locking reads, taking
S locks on every `action_run` row matching `repo_id = N`

Two such concurrent transactions form a cycle via `repository[N]`:

| Tx | Holds | Wants | Blocked by |
|---|---|---|---|
| A: `PrepareRunAndInsert` (push trigger) | X on inserted `action_run`
row R_A; X on `repository[N]` (outer UPDATE already through step 1) | S
on `action_run` rows for repo N (subquery, step 2) | B's X lock on R_B |
| B: `UpdateTaskByState` (runner callback) | X on `action_run` row R_B
(from `UpdateRun`) | X on `repository[N]` (outer UPDATE, step 1) | A's X
lock on `repository[N]` |
| **Cycle** | A waits for R_B; B waits for `repository[N]` | | deadlock
error -> `handleWorkflows` swallows -> run lost |


PostgreSQL's MVCC reads do not take these locks and SQLite serializes
writers, so the symptom only surfaces on MySQL/MSSQL.

## Fix

Split `UpdateRepoRunsNumbers` into small SQLs to avoid locking reads and
move it out of DB transactions.

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Nicolas <bircni@icloud.com>
2026-05-15 08:39:18 +00:00
Lunny Xiao
f9b7b65371
fix(security): enforce wiki git writes and LFS token access at request time (#37695)
This PR fixes two permission-checking gaps in Git and LFS request
handling.

## What it changes

- keep wiki Git HTTP pushes on the normal write-permission path, even
when proc-receive support is enabled
- revalidate LFS bearer token requests against the current user state
and current repository permissions before allowing access
- add regression coverage for unauthorized wiki HTTP pushes
- add LFS tests for blocked users, revoked repository access, read-only
upload attempts, and valid write access

## Why

- wiki repositories should not inherit the relaxed refs/for handling
used for normal code repositories
- LFS authorization tokens should not remain usable after a user is
disabled or loses repository access

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-05-15 08:12:59 +00:00
agyss
5b3575a8be
fix(repo): /generate must sync the branch table for the new repo (#37693)
Two bugs in GenerateGitContent, the function behind
`POST /api/v1/repos/{owner}/{template}/generate`:

1. The new repository's refs were not written `branch` DB table
2. The function re-fetched the new repo row from the database
    but reassigned its local pointer

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-05-15 07:24:40 +00:00
Lunny Xiao
bacd181db4
fix lint 2026-05-14 22:26:50 -07:00
Lunny Xiao
cc25afa752 Merge branch 'main' into lunny/project_workflow 2026-05-14 22:20:49 -07:00
Kausthubh J Rao
5c887d68ca
feat(api): encrypt AWS creds (#37679)
## Description

As mentioned in #37654 `AWSSecretAccessKey` are not encrypted and stored as is.

## Update

Follow the existing `AuthToken` flow of setting the `Encrypted` fields,
`Decrypting` them later and `Clearing` them at the end.

Closes #37654

---------

Signed-off-by: Kausthubh J Rao <105716675+Exgene@users.noreply.github.com>
Co-authored-by: Lauris B <lauris@nix.lv>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-14 15:46:20 +03:00
GiteaBot
2450127c56 [skip ci] Updated translations via Crowdin 2026-05-14 01:11:01 +00:00
Lunny Xiao
929962833d
fix: snap build (main branch) (#37685)
1. make "pull" and "build" testable and debuggable
2. add more comments for how the build works
3. separate 1.26 and main build tags
4. fix incorrect tag describe (the current `snap info gitea` outputs
version 1.22)

Legacy logic is kept as is although some of them don't seem good (e.g.:
snap version grep, tag finding, etc)

---------

Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-05-13 17:31:47 -07:00
wxiaoguang
523822090c
chore: introduce HTMLBuilder (#37688) 2026-05-13 17:06:53 +00:00
wxiaoguang
701908a945
chore: clean up "contrib" dir (#37690)
1. remove useless files like "backport.go", "update_dependencies.sh"
2. remove outdated "init" scripts, only keep one in sysvinit, gentoo dir
is also kept because it still uses openrc
3. move "service" related config and scripts into "service" directory
2026-05-13 14:22:47 +00:00
Matt Schoen
a564f0587a
feat(api): add sort and order query parameters to job list endpoints (#37672)
Adds `sort` and `order` query parameters to all action job list API
endpoints (`/admin/actions/jobs`, `/repos/{owner}/{repo}/actions/jobs`,
`/repos/{owner}/{repo}/actions/runs/{run}/jobs`, `/user/actions/jobs`),
following the existing `OrderByMap` pattern used by repo/user search
endpoints.

- Default is `id` / `asc` (backwards compatible — matches previous DB
natural order)
- Only `id` sort field for now; the map is extensible for future fields
- Returns 422 for invalid sort/order values
- `ToOrders()` returns empty string when `OrderBy` is unset, so internal
callers (webhook dispatch, concurrency checks) are unaffected

Closes: #37666
Supersedes: #37667
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: silverwind <me@silverwind.io>
2026-05-13 13:11:02 +00:00
Nicolas
187daac598
fix: Sort action run jobs by JobID and Name with matrix examples (#37046)
Fix the sorting of jobs out of a matrix

## Before
<img width="415" height="487" alt="grafik"
src="https://github.com/user-attachments/assets/b628adb9-9158-4106-89f1-d8ecaa98f17d"
/>


## After

<img width="423" height="365" alt="grafik"
src="https://github.com/user-attachments/assets/d26223d5-96da-4bdc-bbfe-389101d28cc8"
/>

---------

Signed-off-by: Nicolas <bircni@icloud.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
2026-05-13 07:30:22 +00:00
wxiaoguang
3738809219
fix: catch and fix more lint problems (#37674)
Changes are done by "make lint-go-fix"
2026-05-13 09:00:41 +02:00
silverwind
ffd5e0698b
docs(agents): update AGENTS.md (#37684)
Add two rules to `AGENTS.md` for recurring issues.

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-13 08:27:22 +02:00
silverwind
79f7062d9e
fix(actions): run TransferLogs on UpdateLog{Rows:[], NoMore:true} (#37631)
`UpdateLog` short-circuits on `len(Rows)==0` before honoring `NoMore`,
so a final empty `UpdateLog{NoMore:true}` never runs `TransferLogs`. The
task's `dbfs_data` rows are then never moved to log storage and never
deleted.

Fix: let `NoMore=true` with no new rows fall through to `TransferLogs`.
Bail when the runner has outrun the server (`Index > ack`) even with
`NoMore`, since archiving a log with a gap is worse than retrying.
Always call `WriteLogs` so `offset==0` bootstraps an empty DBFS file in
the no-output case (otherwise `TransferLogs` would fail at `dbfs.Open`).

Fixes: https://github.com/go-gitea/gitea/issues/37623
Ref: https://gitea.com/gitea/runner/pulls/952
Ref: https://gitea.com/gitea/runner/pulls/950
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-13 05:18:07 +00:00
GiteaBot
f01953e764 [skip ci] Updated translations via Crowdin 2026-05-13 01:09:44 +00:00
Giteabot
6a27066269
fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [mermaid](https://redirect.github.com/mermaid-js/mermaid) | [`11.14.0`
→ `11.15.0`](https://renovatebot.com/diffs/npm/mermaid/11.14.0/11.15.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/mermaid/11.15.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mermaid/11.14.0/11.15.0?slim=true)
|

---

### Mermaid: Improper sanitization of `classDefs` in diagrams leads to
CSS injection
[CVE-2026-41148](https://nvd.nist.gov/vuln/detail/CVE-2026-41148) /
[GHSA-xcj9-5m2h-648r](https://redirect.github.com/advisories/GHSA-xcj9-5m2h-648r)

<details>
<summary>More information</summary>

#### Details
##### Details

The state diagram and any other diagram type that routes user-controlled
style strings through createCssStyles parser for Mermaid v11.14.0 and
earlier captures `classDef` values with an unrestricted regex:

```jison
// packages/mermaid/src/diagrams/state/parser/stateDiagram.jison:83
<CLASSDEFID>[^\n]*   { this.popState(); return 'CLASSDEF_STYLEOPTS' }
```

The value passes unsanitized through `addStyleClass()` ->
`createCssStyles()` -> `style.innerHTML` (mermaidAPI.ts:418). A `}` in
the value closes the generated CSS selector, and everything after
becomes a new CSS rule on the page.

##### PoC

```
stateDiagram-v2 
      classDef x }*{ background-image: url("http://media.giphy.com/media/SggILpMXO7Xt6/giphy.gif")}
```

Live demo:

<https://mermaid.live/edit#pako:eNpFjzFvgzAQhf-KdVNbEcBgMHhtlkqtOnSJKi8ONsYKBmRMlRTx3-skanvTfbp7996t0IxSAYPZC6_2Rmgn7O4rQ00v5nmvWnRG29OKjqI5aTcug9wZK7RiaHH9A4fO-4kliVXSiFibqbvEzWjvnHxo_fI6vR3e6cGXyX2qTcvhcYMItDMSmHeLisAqZ8UVYeUDQhx8p6ziwEIrhTtx4MNVM4nhcxztrywE0h2wVvRzoGWS_z_8rahBKvcckntgmN5OAFvhDIzUNCZZQXCR5nVaZkUEF2BVFpOcEkoxxhUuyRbB980yjStapKHqoKFlhvPtB7BFZEU>

##### Patches

This has been patched in:

-
[v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
(see
[e9b0f34d8d82a6260077764ee45e1d7d90957a0f](e9b0f34d8d))
-
[v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
(see
[8fead23c59166b7bab6a39eac81acebee2859102](8fead23c59))

##### Workarounds

Setting [`"securityLevel":
"sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)
will prevent this, by rendering the mermaid diagram in a sandboxed
`<iframe>`.

##### Impact

Enables page defacement, user tracking via `url()` callbacks, and DOM
attribute exfiltration via CSS `:has()` selectors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r)
-
[8fead23c59)
-
[e9b0f34d8d)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
-
[https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
-
[https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)
-
[https://github.com/advisories/GHSA-xcj9-5m2h-648r](https://redirect.github.com/advisories/GHSA-xcj9-5m2h-648r)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-xcj9-5m2h-648r)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid: Improper sanitization of `classDef` in state diagrams leads
to HTML injection
[CVE-2026-41149](https://nvd.nist.gov/vuln/detail/CVE-2026-41149) /
[GHSA-ghcm-xqfw-q4vr](https://redirect.github.com/advisories/GHSA-ghcm-xqfw-q4vr)

<details>
<summary>More information</summary>

#### Details
##### Impact

Under the default configuration, Mermaid state diagram's `classDef`
allow DOM injection that escapes the SVG, although `<script>` tags are
removed, preventing XSS.

##### Proof-of-concept

```
stateDiagram-v2
  classDef xss fill:red</style></svg><style>*{x:x;y:y;overflow:visible!important;contain:none!important;transform:none!important;filter:none!important;clip-path:none!important}</style><div style="x:x;y:y;color:red;font:5em/1 monospace;display:grid;place-items:center;z-index:2147483647;width:100vw;height:100vh;position:fixed;top:0;left:0;background:black">HACKED</div><svg><style>a:b
  [*] --> A:::xss
```

##### Patches

-
[v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
(see
[37ff937f1da2e19f882fd1db01235db4d01f4056](37ff937f1d))
-
[v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
(see
[4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3](4e2d512bf5))

##### Workarounds

If you can not update to a patched version, setting [`"securityLevel":
"sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)
will prevent this, by rendering the mermaid diagram in a sandboxed
`<iframe>`.

##### Credits

Thanks to @&#8203;zsxsoft from @&#8203;KeenSecurityLab for reporting
this vulnerability.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr)
-
[37ff937f1d)
-
[4e2d512bf5)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
-
[https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
-
[https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)
-
[https://github.com/advisories/GHSA-ghcm-xqfw-q4vr](https://redirect.github.com/advisories/GHSA-ghcm-xqfw-q4vr)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-ghcm-xqfw-q4vr)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid: Improper sanitization of configuration leads to CSS
injection
[CVE-2026-41159](https://nvd.nist.gov/vuln/detail/CVE-2026-41159) /
[GHSA-87f9-hvmw-gh4p](https://redirect.github.com/advisories/GHSA-87f9-hvmw-gh4p)

<details>
<summary>More information</summary>

#### Details
##### Impact

Mermaid's default configuration allows injecting CSS that applies
outside of the Mermaid diagram via the `fontFamily`, `themeCSS`, and
`altFontFamily` configuration options.

Live demo:
[mermaid.live](https://mermaid.live/edit#pako:eNpNjktLxDAUhf9KvFBR6JS-60QQfODKlUvJ5k6TtsEmKTHFGUP-u-mI6Nmdy3fOPR56wwVQSBIvtXSUeAaD0e4ZlZxPDChhcLxFfwiEauOuLq_9Afv30ZpVczpaITS5kGox1qF2gfSeBwYhJAnThAyz-ewntI68vG5-0z3Z7e7IA9OQwmglB-rsKlJQwircLPgNZeAmocTPAi4GXGfHgOkQYwvqN2PUbzJuGSegA84f0a0LRyeeJI4W_xChubCPcbQD2pwbgHo4Aq2aKmvbqq3zoiu7pizqFE6RybN9VFfFY1HWXRVS-Dr_zLObrt7_V_gGGXZlGg)

Example code:

```
%%{init: {"fontFamily": "x;a{b} :not(&){background:green !important} c{d}"}}%%
flowchart LR
    A --> B
```

The injected CSS exploits stylis's `&` (scope reference) handling.
`:not(&)` escapes the `#mermaid-xxx` automatic scoping, applying styles
to all page elements. Global at-rules (`@font-face`, `@keyframes`,
`@counter-style`) are also injectable as stylis hoists them to top
level.

This allows page defacement and DOM attribute exfiltration via CSS
`:has()` selectors.

##### Patches

-
[v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
(see
[64769738d5b59211e1decb471ffbaca8afec51aa](64769738d5))
-
[v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
(see
[a9d9f0d8eb790349121508688cd338253fd80d76](a9d9f0d8eb))

##### Workarounds

If you can't upgrade mermaid, you can set the
[`secure`](https://mermaid.js.org/config/schema-docs/config.html#secure)
config value in the mermaid config to avoid allowing diagrams to modify
`fontFamily`, `themeCSS`, `altFontFamily`, and `themeVariables`.

Setting [`"securityLevel":
"sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)
will also prevent this.

##### Credits

Reported by @&#8203;zsxsoft on behalf of @&#8203;KeenSecurityLab

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p)
-
[64769738d5)
-
[a9d9f0d8eb)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
-
[https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
-
[https://github.com/advisories/GHSA-87f9-hvmw-gh4p](https://redirect.github.com/advisories/GHSA-87f9-hvmw-gh4p)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-87f9-hvmw-gh4p)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
[CVE-2026-41150](https://nvd.nist.gov/vuln/detail/CVE-2026-41150) /
[GHSA-6m6c-36f7-fhxh](https://redirect.github.com/advisories/GHSA-6m6c-36f7-fhxh)

<details>
<summary>More information</summary>

#### Details
##### Impact

Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service
attack when rendering gantt charts, if they use the [`excludes`
attribute](https://mermaid.js.org/syntax/gantt.html?#excludes) to
exclude all dates.

Example:

```
gantt
  excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday
  DoS :2025-01-01, 1d
```

`mermaid.parse` is unaffected, unless you then call the
`ganttDb.getTasks()` (which is called when rendering a diagram).

##### Patches

This has been patched in:

-
[v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
(see
[faafb5d49106dd32c367f3882505f2dd625aa30e](faafb5d491))
-
[v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
(see
[a59ea56174712ee5430dfd5bc877cb5151f501a6](a59ea56174))

##### Workarounds

There are no workarounds available without updating to a newer version
of mermaid.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh)
-
[a59ea56174)
-
[faafb5d491)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
-
[https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
-
[https://github.com/advisories/GHSA-6m6c-36f7-fhxh](https://redirect.github.com/advisories/GHSA-6m6c-36f7-fhxh)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-6m6c-36f7-fhxh)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
[CVE-2026-41150](https://nvd.nist.gov/vuln/detail/CVE-2026-41150) /
[GHSA-6m6c-36f7-fhxh](https://redirect.github.com/advisories/GHSA-6m6c-36f7-fhxh)

<details>
<summary>More information</summary>

#### Details
##### Impact

Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service
attack when rendering gantt charts, if they use the [`excludes`
attribute](https://mermaid.js.org/syntax/gantt.html?#excludes) to
exclude all dates.

Example:

```
gantt
  excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday
  DoS :2025-01-01, 1d
```

`mermaid.parse` is unaffected, unless you then call the
`ganttDb.getTasks()` (which is called when rendering a diagram).

##### Patches

This has been patched in:

-
[v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
(see
[faafb5d49106dd32c367f3882505f2dd625aa30e](faafb5d491))
-
[v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
(see
[a59ea56174712ee5430dfd5bc877cb5151f501a6](a59ea56174))

##### Workarounds

There are no workarounds available without updating to a newer version
of mermaid.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh)
-
[a59ea56174)
-
[faafb5d491)
-
[https://github.com/mermaid-js/mermaid](https://redirect.github.com/mermaid-js/mermaid)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
-
[https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-6m6c-36f7-fhxh) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid: Improper sanitization of configuration leads to CSS
injection
[CVE-2026-41159](https://nvd.nist.gov/vuln/detail/CVE-2026-41159) /
[GHSA-87f9-hvmw-gh4p](https://redirect.github.com/advisories/GHSA-87f9-hvmw-gh4p)

<details>
<summary>More information</summary>

#### Details
##### Impact

Mermaid's default configuration allows injecting CSS that applies
outside of the Mermaid diagram via the `fontFamily`, `themeCSS`, and
`altFontFamily` configuration options.

Live demo:
[mermaid.live](https://mermaid.live/edit#pako:eNpNjktLxDAUhf9KvFBR6JS-60QQfODKlUvJ5k6TtsEmKTHFGUP-u-mI6Nmdy3fOPR56wwVQSBIvtXSUeAaD0e4ZlZxPDChhcLxFfwiEauOuLq_9Afv30ZpVczpaITS5kGox1qF2gfSeBwYhJAnThAyz-ewntI68vG5-0z3Z7e7IA9OQwmglB-rsKlJQwircLPgNZeAmocTPAi4GXGfHgOkQYwvqN2PUbzJuGSegA84f0a0LRyeeJI4W_xChubCPcbQD2pwbgHo4Aq2aKmvbqq3zoiu7pizqFE6RybN9VFfFY1HWXRVS-Dr_zLObrt7_V_gGGXZlGg)

Example code:

```
%%{init: {"fontFamily": "x;a{b} :not(&){background:green !important} c{d}"}}%%
flowchart LR
    A --> B
```

The injected CSS exploits stylis's `&` (scope reference) handling.
`:not(&)` escapes the `#mermaid-xxx` automatic scoping, applying styles
to all page elements. Global at-rules (`@font-face`, `@keyframes`,
`@counter-style`) are also injectable as stylis hoists them to top
level.

This allows page defacement and DOM attribute exfiltration via CSS
`:has()` selectors.

##### Patches

-
[v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
(see
[64769738d5b59211e1decb471ffbaca8afec51aa](64769738d5))
-
[v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
(see
[a9d9f0d8eb790349121508688cd338253fd80d76](a9d9f0d8eb))

##### Workarounds

If you can't upgrade mermaid, you can set the
[`secure`](https://mermaid.js.org/config/schema-docs/config.html#secure)
config value in the mermaid config to avoid allowing diagrams to modify
`fontFamily`, `themeCSS`, `altFontFamily`, and `themeVariables`.

Setting [`"securityLevel":
"sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)
will also prevent this.

##### Credits

Reported by @&#8203;zsxsoft on behalf of @&#8203;KeenSecurityLab

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p)
-
[64769738d5)
-
[a9d9f0d8eb)
-
[https://github.com/mermaid-js/mermaid](https://redirect.github.com/mermaid-js/mermaid)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
-
[https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-87f9-hvmw-gh4p) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid: Improper sanitization of `classDef` in state diagrams leads
to HTML injection
[CVE-2026-41149](https://nvd.nist.gov/vuln/detail/CVE-2026-41149) /
[GHSA-ghcm-xqfw-q4vr](https://redirect.github.com/advisories/GHSA-ghcm-xqfw-q4vr)

<details>
<summary>More information</summary>

#### Details
##### Impact

Under the default configuration, Mermaid state diagram's `classDef`
allow DOM injection that escapes the SVG, although `<script>` tags are
removed, preventing XSS.

##### Proof-of-concept

```
stateDiagram-v2
  classDef xss fill:red</style></svg><style>*{x:x;y:y;overflow:visible!important;contain:none!important;transform:none!important;filter:none!important;clip-path:none!important}</style><div style="x:x;y:y;color:red;font:5em/1 monospace;display:grid;place-items:center;z-index:2147483647;width:100vw;height:100vh;position:fixed;top:0;left:0;background:black">HACKED</div><svg><style>a:b
  [*] --> A:::xss
```

##### Patches

-
[v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
(see
[37ff937f1da2e19f882fd1db01235db4d01f4056](37ff937f1d))
-
[v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
(see
[4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3](4e2d512bf5))

##### Workarounds

If you can not update to a patched version, setting [`"securityLevel":
"sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)
will prevent this, by rendering the mermaid diagram in a sandboxed
`<iframe>`.

##### Credits

Thanks to @&#8203;zsxsoft from @&#8203;KeenSecurityLab for reporting
this vulnerability.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr)
-
[37ff937f1d)
-
[4e2d512bf5)
-
[https://github.com/mermaid-js/mermaid](https://redirect.github.com/mermaid-js/mermaid)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
-
[https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
-
[https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-ghcm-xqfw-q4vr) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid: Improper sanitization of `classDefs` in diagrams leads to
CSS injection
[CVE-2026-41148](https://nvd.nist.gov/vuln/detail/CVE-2026-41148) /
[GHSA-xcj9-5m2h-648r](https://redirect.github.com/advisories/GHSA-xcj9-5m2h-648r)

<details>
<summary>More information</summary>

#### Details
##### Details

The state diagram and any other diagram type that routes user-controlled
style strings through createCssStyles parser for Mermaid v11.14.0 and
earlier captures `classDef` values with an unrestricted regex:

```jison
// packages/mermaid/src/diagrams/state/parser/stateDiagram.jison:83
<CLASSDEFID>[^\n]*   { this.popState(); return 'CLASSDEF_STYLEOPTS' }
```

The value passes unsanitized through `addStyleClass()` ->
`createCssStyles()` -> `style.innerHTML` (mermaidAPI.ts:418). A `}` in
the value closes the generated CSS selector, and everything after
becomes a new CSS rule on the page.

##### PoC

```
stateDiagram-v2 
      classDef x }*{ background-image: url("http://media.giphy.com/media/SggILpMXO7Xt6/giphy.gif")}
```

Live demo:

<https://mermaid.live/edit#pako:eNpFjzFvgzAQhf-KdVNbEcBgMHhtlkqtOnSJKi8ONsYKBmRMlRTx3-skanvTfbp7996t0IxSAYPZC6_2Rmgn7O4rQ00v5nmvWnRG29OKjqI5aTcug9wZK7RiaHH9A4fO-4kliVXSiFibqbvEzWjvnHxo_fI6vR3e6cGXyX2qTcvhcYMItDMSmHeLisAqZ8UVYeUDQhx8p6ziwEIrhTtx4MNVM4nhcxztrywE0h2wVvRzoGWS_z_8rahBKvcckntgmN5OAFvhDIzUNCZZQXCR5nVaZkUEF2BVFpOcEkoxxhUuyRbB980yjStapKHqoKFlhvPtB7BFZEU>

##### Patches

This has been patched in:

-
[v11.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
(see
[e9b0f34d8d82a6260077764ee45e1d7d90957a0f](e9b0f34d8d))
-
[v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
(see
[8fead23c59166b7bab6a39eac81acebee2859102](8fead23c59))

##### Workarounds

Setting [`"securityLevel":
"sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)
will prevent this, by rendering the mermaid diagram in a sandboxed
`<iframe>`.

##### Impact

Enables page defacement, user tracking via `url()` callbacks, and DOM
attribute exfiltration via CSS `:has()` selectors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r)
-
[8fead23c59)
-
[e9b0f34d8d)
-
[https://github.com/mermaid-js/mermaid](https://redirect.github.com/mermaid-js/mermaid)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
-
[https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
-
[https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-xcj9-5m2h-648r) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>mermaid-js/mermaid (mermaid)</summary>

###
[`v11.15.0`](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)

[Compare
Source](https://redirect.github.com/mermaid-js/mermaid/compare/mermaid@11.14.0...mermaid@11.15.0)

##### Minor Changes

-
[#&#8203;7174](https://redirect.github.com/mermaid-js/mermaid/pull/7174)
[`0aca217`](0aca21739c)
Thanks
[@&#8203;milesspencer35](https://redirect.github.com/milesspencer35)! -
feat(sequence): Add support for decimal start and increment values in
the `autonumber` directive

-
[#&#8203;7512](https://redirect.github.com/mermaid-js/mermaid/pull/7512)
[`8e17492`](8e17492f73)
Thanks [@&#8203;aruncveli](https://redirect.github.com/aruncveli)! -
feat(flowchart): add datastore shape

In Data flow diagrams, a datastore/warehouse/file/database is used to
represent data persistence. It is denoted by a rectangle with only top
and bottom borders, and can be used in flowcharts with `A@{ shape:
datastore, label: "Datastore" }`.

-
[#&#8203;6440](https://redirect.github.com/mermaid-js/mermaid/pull/6440)
[`9ad8dde`](9ad8dde6d0)
Thanks [@&#8203;yordis](https://redirect.github.com/yordis),
[@&#8203;lgazo](https://redirect.github.com/lgazo)! - feat: add Event
Modeling diagram

-
[#&#8203;7707](https://redirect.github.com/mermaid-js/mermaid/pull/7707)
[`27db774`](27db774627)
Thanks [@&#8203;txmxthy](https://redirect.github.com/txmxthy)! -
feat(architecture): expose four fcose layout knobs for
`architecture-beta` diagrams (`nodeSeparation`,
`idealEdgeLengthMultiplier`, `edgeElasticity`, `numIter`) so authors can
tune layout density and spread overlapping siblings without changing
diagram source

-
[#&#8203;7604](https://redirect.github.com/mermaid-js/mermaid/pull/7604)
[`bf9502f`](bf9502fb60)
Thanks [@&#8203;M-a-c](https://redirect.github.com/M-a-c)! -
feat(class): add nested namespace support for class diagrams via dot
notation and syntactic nesting

If you have namespaces in class diagrams that use `.`s already and want
to render them without nesting (≤v11.14.0 behaviour), you can use set
`class.hierarchicalNamespaces=false` in your mermaid config:

  ```yaml
  config:
    class:
      hierarchicalNamespaces: false
  ```

-
[#&#8203;7272](https://redirect.github.com/mermaid-js/mermaid/pull/7272)
[`88cdd3d`](88cdd3dc0a)
Thanks [@&#8203;xinbenlv](https://redirect.github.com/xinbenlv)! -
feat(sankey): add outlined label style, configurable
nodeWidth/nodePadding, and custom node colors

##### Patch Changes

-
[#&#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737)
[`e9b0f34`](e9b0f34d8d)
Thanks
[@&#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! -
fix: prevent unbalanced CSS styles in classDefs

-
[#&#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737)
[`37ff937`](37ff937f1d)
Thanks
[@&#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! -
fix: create CSS styles using the CSSOM

  This removes some invalid CSS and normalizes some CSS formatting.

-
[#&#8203;7508](https://redirect.github.com/mermaid-js/mermaid/pull/7508)
[`bfe60cc`](bfe60cc67b)
Thanks [@&#8203;biiab](https://redirect.github.com/biiab)! -
fix(stateDiagram): `end note` now only closes a note when used on a new
line

-
[#&#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737)
[`faafb5d`](faafb5d491)
Thanks
[@&#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! -
fix(gantt): add iteration limit for `excludes` field

-
[#&#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737)
[`65f8be2`](65f8be2a42)
Thanks
[@&#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! -
fix: disallow some CSS at-rules in custom CSS

-
[#&#8203;7726](https://redirect.github.com/mermaid-js/mermaid/pull/7726)
[`1502f32`](1502f32f3c)
Thanks [@&#8203;aloisklink](https://redirect.github.com/aloisklink)! -
fix(wardley): fix unnecessary sanitization of text

-
[#&#8203;7578](https://redirect.github.com/mermaid-js/mermaid/pull/7578)
[`1f98db8`](1f98db8e32)
Thanks [@&#8203;Gaston202](https://redirect.github.com/Gaston202)! -
fix(class): self-referential class multiplicity labels no longer
rendered multiple times

Fixes
[#&#8203;7560](https://redirect.github.com/mermaid-js/mermaid/issues/7560).
Resolves an issue where cardinality labels on self-referential class
relationships were rendered three times due to edge splitting in the
dagre layout. The fix ensures that each sub-edge only carries its
relevant label positions.

-
[#&#8203;7592](https://redirect.github.com/mermaid-js/mermaid/pull/7592)
[`2343e38`](2343e38498)
Thanks [@&#8203;knsv-bot](https://redirect.github.com/knsv-bot)! -
fix(sequence): add background box behind alt/else section title labels
in sequence diagrams

-
[#&#8203;7589](https://redirect.github.com/mermaid-js/mermaid/pull/7589)
[`7fb9509`](7fb9509b8b)
Thanks [@&#8203;NYCU-Chung](https://redirect.github.com/NYCU-Chung)! -
fix(block): prevent column widths from shrinking when mixing different
column spans

-
[#&#8203;7632](https://redirect.github.com/mermaid-js/mermaid/pull/7632)
[`3f9e0f1`](3f9e0f15be)
Thanks [@&#8203;ekiauhce](https://redirect.github.com/ekiauhce)! -
fix(sequence): correct messageAlign label position for right-to-left
arrows in sequence diagrams

-
[#&#8203;7642](https://redirect.github.com/mermaid-js/mermaid/pull/7642)
[`7a8fb85`](7a8fb8532c)
Thanks [@&#8203;tractorjuice](https://redirect.github.com/tractorjuice)!
- fix(wardley): allow hyphens in unquoted component names

Multi-word names containing hyphens — e.g. `real-time processing`,
`end-user`, `on-call engineer` — now parse without quoting, bringing the
grammar in line with the OnlineWardleyMaps (OWM) convention. `A->B`
(no-space arrow) still tokenises correctly.

-
[#&#8203;7523](https://redirect.github.com/mermaid-js/mermaid/pull/7523)
[`5144ed4`](5144ed4b13)
Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)!
- fix(block): Arrow blocks in block-beta diagrams not spanning the
specified number of columns when using `:n` syntax.

-
[#&#8203;7262](https://redirect.github.com/mermaid-js/mermaid/pull/7262)
[`13d9bfa`](13d9bfa474)
Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)!
- fix(block): Ensure block diagram hexagon blocks respect column
spanning syntax

-
[#&#8203;7684](https://redirect.github.com/mermaid-js/mermaid/pull/7684)
[`e14bb88`](e14bb88bdb)
Thanks [@&#8203;aloisklink](https://redirect.github.com/aloisklink)! -
fix: loosen `uuid` dependency range to allow v14

  Mermaid does not use any of the vulnerable code in CVE-2026-41907,
  but this allows users to silence any `npm audit` alerts on it.

-
[#&#8203;7633](https://redirect.github.com/mermaid-js/mermaid/pull/7633)
[`9217c0d`](9217c0d8b2)
Thanks [@&#8203;Felix-Garci](https://redirect.github.com/Felix-Garci)! -
fix(block): add support for all arrow types in block diagrams

-
[#&#8203;7587](https://redirect.github.com/mermaid-js/mermaid/pull/7587)
[`5e7eb62`](5e7eb62e3a)
Thanks
[@&#8203;MaddyGuthridge](https://redirect.github.com/MaddyGuthridge)! -
chore: drop lodash-es in favour of es-toolkit

-
[#&#8203;7693](https://redirect.github.com/mermaid-js/mermaid/pull/7693)
[`afaf306`](afaf306238)
Thanks [@&#8203;dull-bird](https://redirect.github.com/dull-bird)! -
fix(quadrant-chart): allow CJK, emoji, Latin-1 accented characters, and
other non-ASCII text in unquoted axis/quadrant/point labels.

Previously the lexer only matched ASCII `[A-Za-z]+` for text tokens,
even though the grammar referenced `UNICODE_TEXT`. Bare Chinese,
Japanese, Korean, emoji, and accented Latin characters in labels caused
a parse error. Added a `[^\x00-\x7F]+` lexer rule to emit `UNICODE_TEXT`
and included it in the `alphaNumToken` grammar rule.

Fixes
[#&#8203;7120](https://redirect.github.com/mermaid-js/mermaid/issues/7120).

-
[#&#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737)
[`4755553`](4755553d5f)
Thanks
[@&#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! -
fix: improve D3 types for mermaidAPI funcs

-
[#&#8203;7737](https://redirect.github.com/mermaid-js/mermaid/pull/7737)
[`6476973`](64769738d5)
Thanks
[@&#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! -
fix: handle `&` when namespacing CSS rules

-
[#&#8203;7520](https://redirect.github.com/mermaid-js/mermaid/pull/7520)
[`8c1a0c1`](8c1a0c1fd1)
Thanks
[@&#8203;RodrigojndSantos](https://redirect.github.com/RodrigojndSantos)!
- fix(stateDiagram): comments starting with one `%` are no longer
treated as comments

  Switch to using two `%%` if you want to write a comment.

- Updated dependencies
\[[`7a8fb85`](7a8fb8532c),
[`675a64c`](675a64ca0e)]:
-
[@&#8203;mermaid-js/parser](https://redirect.github.com/mermaid-js/parser)@&#8203;1.1.1

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-12 01:34:49 +02:00
Nicolas
71f3e28fe5
ci: Also lint json5 files (#37659) 2026-05-12 00:24:44 +02:00
Nicolas
de290f2121
fix(templates): avoid misleading compare message when branches lack merge base (#37651)
## Summary

When comparing branches with **no common merge base** (e.g. unrelated
histories or orphan branches), `PageIsComparePull` is false and
`CommitCount` is zero. The compare template still showed
`repo.commits.nothing_to_compare`, which in German reads like the
branches are identical—even though the flash already explains there is
no merge base.

## Changes

- **`templates/repo/diff/compare.tmpl`**: Only render the grey “nothing
to compare” segment when `CompareInfo.CompareBase` is set.

<img width="1962" height="564"
src="https://github.com/user-attachments/assets/adc3b4a0-6f03-45da-b297-e15e5ad0aa79"
/>


Fixes #37642

---------

Signed-off-by: Nicolas <bircni@icloud.com>
2026-05-11 16:28:44 +00:00
Giteabot
8cd8291ed0
fix(deps): update npm dependencies (#37647)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| @&#8203;codemirror/autocomplete | [`6.20.1` →
`6.20.2`](https://renovatebot.com/diffs/npm/@codemirror%2fautocomplete/6.20.1/6.20.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@codemirror%2fautocomplete/6.20.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@codemirror%2fautocomplete/6.20.1/6.20.2?slim=true)
|
| @&#8203;codemirror/lint | [`6.9.5` →
`6.9.6`](https://renovatebot.com/diffs/npm/@codemirror%2flint/6.9.5/6.9.6)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@codemirror%2flint/6.9.6?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@codemirror%2flint/6.9.5/6.9.6?slim=true)
|
| @&#8203;codemirror/view | [`6.41.1` →
`6.42.0`](https://renovatebot.com/diffs/npm/@codemirror%2fview/6.41.1/6.42.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@codemirror%2fview/6.42.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@codemirror%2fview/6.41.1/6.42.0?slim=true)
|
| [vue](https://vuejs.org/)
([source](https://redirect.github.com/vuejs/core)) | [`3.5.33` →
`3.5.34`](https://renovatebot.com/diffs/npm/vue/3.5.33/3.5.34) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vue/3.5.34?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vue/3.5.33/3.5.34?slim=true)
|

---

### Release Notes

<details>
<summary>vuejs/core (vue)</summary>

###
[`v3.5.34`](https://redirect.github.com/vuejs/core/blob/HEAD/CHANGELOG.md#3534-2026-05-06)

[Compare
Source](https://redirect.github.com/vuejs/core/compare/v3.5.33...v3.5.34)

##### Bug Fixes

- **compiler-sfc:** infer Vue ref wrapper types when source is
unresolvable
([#&#8203;14758](https://redirect.github.com/vuejs/core/issues/14758))
([7f46fd4](7f46fd411b)),
closes
[#&#8203;14729](https://redirect.github.com/vuejs/core/issues/14729)
- **compiler-sfc:** preserve hash hrefs on `<image>` elements
([#&#8203;14756](https://redirect.github.com/vuejs/core/issues/14756))
([090b2e3](090b2e3a51))
- **compiler-sfc:** resolve type re-exports inside declare global
([#&#8203;14766](https://redirect.github.com/vuejs/core/issues/14766))
([acfffe3](acfffe34e7))
- **reactivity:** prevent orphan effect when created in a stopped scope
([#&#8203;14778](https://redirect.github.com/vuejs/core/issues/14778))
([c8e2d4a](c8e2d4adc9)),
closes
[#&#8203;14777](https://redirect.github.com/vuejs/core/issues/14777)
- **runtime-core:** avoid symbol coercion during props validation
([#&#8203;8539](https://redirect.github.com/vuejs/core/issues/8539))
([23d4fb5](23d4fb5a6a)),
closes
[#&#8203;8487](https://redirect.github.com/vuejs/core/issues/8487)
- **suspense:** avoid DOM leak with out-in transition in v-if fragment
([#&#8203;14762](https://redirect.github.com/vuejs/core/issues/14762))
([9667e0d](9667e0d498)),
closes
[#&#8203;14761](https://redirect.github.com/vuejs/core/issues/14761)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Only on Monday (`* * * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-11 16:03:11 +00:00
wxiaoguang
2eb7b3c7da
refactor: routing info middleware (#37653)
fix #37650
2026-05-11 22:39:50 +08:00
Giteabot
7621b65403
chore(deps): update action dependencies (major) (#37638)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [bitnamilegacy/minio](https://redirect.github.com/bitnami/containers)
([source](https://redirect.github.com/bitnami/containers/tree/HEAD/bitnami/minio))
| service | major | `2021.12.29` → `2025.7.23` |
| [bitnamilegacy/minio](https://redirect.github.com/bitnami/containers)
([source](https://redirect.github.com/bitnami/containers/tree/HEAD/bitnami/minio))
| service | major | `2023.12.23` → `2025.7.23` |
| [bitnamilegacy/mysql](https://redirect.github.com/bitnami/containers)
([source](https://redirect.github.com/bitnami/containers/tree/HEAD/bitnami/mysql))
| service | major | `8.4` → `9.4` |

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Only on Monday (`* * * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-11 12:18:05 +00:00
Giteabot
510b729212
fix(deps): update go dependencies (major) (#37639)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[github.com/dlclark/regexp2](https://redirect.github.com/dlclark/regexp2)
| `v1.12.0` → `v2.0.1` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fdlclark%2fregexp2/v2.0.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fdlclark%2fregexp2/v1.12.0/v2.0.1?slim=true)
|
|
[github.com/google/go-github/v84](https://redirect.github.com/google/go-github)
| `v84.0.0` → `v85.0.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgoogle%2fgo-github%2fv84/v85.0.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgoogle%2fgo-github%2fv84/v84.0.0/v85.0.0?slim=true)
|
|
[gitlab.com/gitlab-org/api/client-go](https://gitlab.com/gitlab-org/api/client-go)
| `v1.46.0` → `v2.24.1` |
![age](https://developer.mend.io/api/mc/badges/age/go/gitlab.com%2fgitlab-org%2fapi%2fclient-go/v2.24.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/gitlab.com%2fgitlab-org%2fapi%2fclient-go/v1.46.0/v2.24.1?slim=true)
|

---

### Release Notes

<details>
<summary>dlclark/regexp2 (github.com/dlclark/regexp2)</summary>

###
[`v2.0.1`](https://redirect.github.com/dlclark/regexp2/compare/v2.0.0...v2.0.1)

[Compare
Source](https://redirect.github.com/dlclark/regexp2/compare/v2.0.0...v2.0.1)

###
[`v2.0.0`](https://redirect.github.com/dlclark/regexp2/compare/v1.12.0...v2.0.0)

[Compare
Source](https://redirect.github.com/dlclark/regexp2/compare/v1.12.0...v2.0.0)

</details>

<details>
<summary>google/go-github (github.com/google/go-github/v84)</summary>

###
[`v85.0.0`](https://redirect.github.com/google/go-github/releases/tag/v85.0.0)

[Compare
Source](https://redirect.github.com/google/go-github/compare/v84.0.0...v85.0.0)

This release contains the following breaking API changes:

- fix!: Resolve inconsistent options for `create` and `update` on custom
org role
([#&#8203;4075](https://redirect.github.com/google/go-github/issues/4075))
BREAKING CHANGE: `GetOrgRole`, `CreateCustomOrgRole`, and
`UpdateCustomOrgRole` have new params and return values.
- fix!: Change `id` from `int64` to `string` in
`ActivityService.MarkThreadDone`
([#&#8203;4056](https://redirect.github.com/google/go-github/issues/4056))
BREAKING CHANGE: `ActivityService.MarkThreadDone` accepts `string` `id`
instead of `int64`.

...and the following additional changes:

- chore: Bump version of go-github to v85.0.0
([#&#8203;4173](https://redirect.github.com/google/go-github/issues/4173))
- chore: Update `openapi_operations.yaml`
([#&#8203;4172](https://redirect.github.com/google/go-github/issues/4172))
- security: Reject cross-host redirects to prevent Authorization leak
([#&#8203;4171](https://redirect.github.com/google/go-github/issues/4171))
- chore: Improve GitHub Actions workflows lint and testing
([#&#8203;4169](https://redirect.github.com/google/go-github/issues/4169))
- chore: Switch legacy redirect handling to new pattern
([#&#8203;4161](https://redirect.github.com/google/go-github/issues/4161))
- feat: Add `CodeSecurity` to `SecurityAndAnalysis`
([#&#8203;4155](https://redirect.github.com/google/go-github/issues/4155))
- fix: Reject URL path segments containing ".." in all request methods
([#&#8203;4150](https://redirect.github.com/google/go-github/issues/4150))
- feat: Refactor repositories download contents
([#&#8203;4153](https://redirect.github.com/google/go-github/issues/4153))
- chore: Bump google.org/x/tools to v0.44.0 in /tools
([#&#8203;4168](https://redirect.github.com/google/go-github/issues/4168))
- docs: Fix broken blog post link
([#&#8203;4160](https://redirect.github.com/google/go-github/issues/4160))
- build(deps): Bump github.com/sigstore/timestamp-authority/v2 from
2.0.3 to 2.0.6 in /example
([#&#8203;4156](https://redirect.github.com/google/go-github/issues/4156))
- chore: Update openapi\_operations.yaml
([#&#8203;4157](https://redirect.github.com/google/go-github/issues/4157))
- feat: Remove Google App Engine standard support
([#&#8203;4152](https://redirect.github.com/google/go-github/issues/4152))
- feat: Add `DownloadCopilotMetrics` helper method
([#&#8203;4149](https://redirect.github.com/google/go-github/issues/4149))
- docs: Add `apiVersion` to GitHub API link
([#&#8203;4147](https://redirect.github.com/google/go-github/issues/4147))
- chore: Simplify `redundantptr` custom linter
([#&#8203;4148](https://redirect.github.com/google/go-github/issues/4148))
- docs: Deprecate old Copilot metrics endpoints closed on April 2, 2026
([#&#8203;4137](https://redirect.github.com/google/go-github/issues/4137))
- refactor: Remove redundant `github.Ptr` calls
([#&#8203;4145](https://redirect.github.com/google/go-github/issues/4145))
- fix: Add missing `User` fields
([#&#8203;4146](https://redirect.github.com/google/go-github/issues/4146))
- fix: Preserve `Marketplace.Stubbed` during client copy
([#&#8203;4144](https://redirect.github.com/google/go-github/issues/4144))
- refactor: Simplify array copying
([#&#8203;4143](https://redirect.github.com/google/go-github/issues/4143))
- build(deps): Bump golang.org/x/crypto from 0.49.0 to 0.50.0 in
/example
([#&#8203;4141](https://redirect.github.com/google/go-github/issues/4141))
- build(deps): Bump github.com/getkin/kin-openapi from 0.134.0 to
0.135.0 in /tools
([#&#8203;4142](https://redirect.github.com/google/go-github/issues/4142))
- build(deps): Bump golang.org/x/term from 0.41.0 to 0.42.0 in /example
([#&#8203;4140](https://redirect.github.com/google/go-github/issues/4140))
- build(deps): Bump golang.org/x/net from 0.52.0 to 0.53.0 in /scrape
([#&#8203;4139](https://redirect.github.com/google/go-github/issues/4139))
- build(deps): Bump go.opentelemetry.io/otel to v1.43.0
([#&#8203;4135](https://redirect.github.com/google/go-github/issues/4135))
- fix: Expand `sanitizeURL` secrets redactions
([#&#8203;4126](https://redirect.github.com/google/go-github/issues/4126))
- build(deps): Bump github.com/alecthomas/kong from 1.14.0 to 1.15.0 in
/tools
([#&#8203;4132](https://redirect.github.com/google/go-github/issues/4132))
- build(deps): Bump actions/setup-go from 6.3.0 to 6.4.0 in the actions
group
([#&#8203;4131](https://redirect.github.com/google/go-github/issues/4131))
- feat: Add support for custom names and methods that return structs
with multiple `[]*T` fields in `gen-iterators.go`
([#&#8203;4128](https://redirect.github.com/google/go-github/issues/4128))
- fix: Limit webhook payload size in `ValidatePayloadFromBody`
([#&#8203;4125](https://redirect.github.com/google/go-github/issues/4125))
- build(deps): Bump codecov/codecov-action from 5.5.3 to 6.0.0
([#&#8203;4123](https://redirect.github.com/google/go-github/issues/4123))
- fix: Synchronize `requestCount` in rate limit tests
([#&#8203;4124](https://redirect.github.com/google/go-github/issues/4124))
- chore: Simplify `generate.sh` by removing `git worktree` and using
generator-based check
([#&#8203;4120](https://redirect.github.com/google/go-github/issues/4120))
- docs: Improve comments in /examples
([#&#8203;4122](https://redirect.github.com/google/go-github/issues/4122))
- chore: Use `golangci-lint-action`; remove `newreposecretwithlibsodium`
([#&#8203;4119](https://redirect.github.com/google/go-github/issues/4119))
- feat: Add custom image endpoints for GitHub-hosted runners
([#&#8203;4101](https://redirect.github.com/google/go-github/issues/4101))
- chore: Cache custom golangci-lint binaries in GHA workflow
([#&#8203;4116](https://redirect.github.com/google/go-github/issues/4116))
- build(deps): Bump github.com/ProtonMail/go-crypto from 1.4.0 to 1.4.1
in /example
([#&#8203;4115](https://redirect.github.com/google/go-github/issues/4115))
- build(deps): Bump golang.org/x/tools from 0.29.0 to 0.43.0 in
/tools/extraneous-new
([#&#8203;4114](https://redirect.github.com/google/go-github/issues/4114))
- build(deps): Bump codecov/codecov-action from 5.5.2 to 5.5.3
([#&#8203;4112](https://redirect.github.com/google/go-github/issues/4112))
- build(deps): Bump github.com/golangci/plugin-module-register from
0.1.1 to 0.1.2 in /tools/extraneous-new
([#&#8203;4113](https://redirect.github.com/google/go-github/issues/4113))
- build(deps): Bump github.com/getkin/kin-openapi from 0.133.0 to
0.134.0 in /tools
([#&#8203;4111](https://redirect.github.com/google/go-github/issues/4111))
- build(deps): Bump github.com/PuerkitoBio/goquery from 1.11.0 to 1.12.0
in /scrape
([#&#8203;4110](https://redirect.github.com/google/go-github/issues/4110))
- chore: Upgrade deps for linters using dependabot
([#&#8203;4107](https://redirect.github.com/google/go-github/issues/4107))
- chore: Use `structfield.Settings` in `check-structfield-settings`
([#&#8203;4108](https://redirect.github.com/google/go-github/issues/4108))
- build(deps): Bump google.golang.org/grpc from 1.78.0 to 1.79.3 in
/example
([#&#8203;4109](https://redirect.github.com/google/go-github/issues/4109))
- chore: Remove unnecessary use of `new` and `&SomeStruct{}` and add new
`extraneousnew` custom linter
([#&#8203;4106](https://redirect.github.com/google/go-github/issues/4106))
- feat: Add `NetworkConfigurationID` and `HostedRunnersURL` to
enterprise runner group types
([#&#8203;4099](https://redirect.github.com/google/go-github/issues/4099))
- feat: Generate accessors for all fields
([#&#8203;4105](https://redirect.github.com/google/go-github/issues/4105))
- feat: Add `ListRunnerGroupHostedRunners` for org runner groups
([#&#8203;4100](https://redirect.github.com/google/go-github/issues/4100))
- chore: Enable `default: none` linters; remove duplicated
([#&#8203;4097](https://redirect.github.com/google/go-github/issues/4097))
- fix: Use `Cursor` pagination for `*.ListHookDeliveriesIter`
([#&#8203;4096](https://redirect.github.com/google/go-github/issues/4096))
- chore: Remove duplicated formatters
([#&#8203;4094](https://redirect.github.com/google/go-github/issues/4094))
- chore: Fix typos in comments and tests
([#&#8203;4093](https://redirect.github.com/google/go-github/issues/4093))
- chore: Fix typo in CONTRIBUTING.md
([#&#8203;4092](https://redirect.github.com/google/go-github/issues/4092))
- chore: Update openapi\_operations.yaml
([#&#8203;4091](https://redirect.github.com/google/go-github/issues/4091))
- build(deps): Bump github.com/bradleyfalzon/ghinstallation/v2 from
2.17.0 to 2.18.0 in /example
([#&#8203;4084](https://redirect.github.com/google/go-github/issues/4084))
- chore: Bump go.opentelemetry.io/otel to v1.42.0
([#&#8203;4090](https://redirect.github.com/google/go-github/issues/4090))
- build(deps): Bump golang.org/x/crypto from 0.48.0 to 0.49.0 in
/example
([#&#8203;4081](https://redirect.github.com/google/go-github/issues/4081))
- build(deps): Bump golang.org/x/sync from 0.19.0 to 0.20.0 in /tools
([#&#8203;4078](https://redirect.github.com/google/go-github/issues/4078))
- build(deps): Bump golang.org/x/net from 0.51.0 to 0.52.0 in /scrape
([#&#8203;4079](https://redirect.github.com/google/go-github/issues/4079))
- test: Add fuzz test for `ParseWebHook`
([#&#8203;4076](https://redirect.github.com/google/go-github/issues/4076))
- feat: Add enterprise budgets API
([#&#8203;4069](https://redirect.github.com/google/go-github/issues/4069))
- feat: Add list organization fine-grained permissions
([#&#8203;4072](https://redirect.github.com/google/go-github/issues/4072))
- feat: Make `script/lint.sh` output simpler to read
([#&#8203;4073](https://redirect.github.com/google/go-github/issues/4073))
- chore: Speed up linting
([#&#8203;4071](https://redirect.github.com/google/go-github/issues/4071))
- build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.41.0
in /otel
([#&#8203;4065](https://redirect.github.com/google/go-github/issues/4065))
- build(deps): Bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 in
/otel
([#&#8203;4068](https://redirect.github.com/google/go-github/issues/4068))
- build(deps): Bump
go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.40.0 to
1.41.0 in /example
([#&#8203;4062](https://redirect.github.com/google/go-github/issues/4062))
- build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.41.0
in /example
([#&#8203;4064](https://redirect.github.com/google/go-github/issues/4064))
- build(deps): Bump github.com/ProtonMail/go-crypto from 1.3.0 to 1.4.0
in /example
([#&#8203;4063](https://redirect.github.com/google/go-github/issues/4063))
- feat: Add `client_id` field to `App`
([#&#8203;4060](https://redirect.github.com/google/go-github/issues/4060))
- test: Simplify `CopilotService` tests
([#&#8203;4058](https://redirect.github.com/google/go-github/issues/4058))
- test: Fix flaky `TestDo_rateLimit_abuseRateLimitError_xRateLimitReset`
([#&#8203;4057](https://redirect.github.com/google/go-github/issues/4057))
- feat: Add support for enterprise audit log streaming API
([#&#8203;4035](https://redirect.github.com/google/go-github/issues/4035))
- feat: Add repository-level immutable releases settings
([#&#8203;4039](https://redirect.github.com/google/go-github/issues/4039))
- chore: Add `SAS` as a common initialism to `structfield`
([#&#8203;4054](https://redirect.github.com/google/go-github/issues/4054))
- fix: Fix data race on Windows
([#&#8203;4051](https://redirect.github.com/google/go-github/issues/4051))
- docs: Fix grammar in `README.md`
([#&#8203;4053](https://redirect.github.com/google/go-github/issues/4053))
- chore: Simplify form value assertions in tests
([#&#8203;4048](https://redirect.github.com/google/go-github/issues/4048))
- chore: Bump go-github from v83 to v84 in /scrape
([#&#8203;4050](https://redirect.github.com/google/go-github/issues/4050))

</details>

<details>
<summary>gitlab-org/api/client-go
(gitlab.com/gitlab-org/api/client-go)</summary>

###
[`v2.24.1`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.24.1)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.24.0...v2.24.1)

#### 2.24.1

##### 🐛 Bug Fixes

- fix: add FormattedText field to OrbitGraphStatus and OrbitStatus
([!2876](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2876))
by [Dmitry Gruzd](https://gitlab.com/dgruzd)

####
[2.24.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.24.0...v2.24.1)
(2026-05-05)
##### Bug Fixes

* add FormattedText field to OrbitGraphStatus and OrbitStatus
([9457ddc](9457ddc690))

###
[`v2.24.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.24.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.23.0...v2.24.0)

#### 2.24.0

##### 🚀 Features

- feat: Add search_type as attribute to search endpoints
([!2851](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2851))
by [Heidi Berry](https://gitlab.com/heidi.berry)

###
[2.24.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.23.0...v2.24.0)
(2026-05-04)
##### Features

* Add search_type as attribute to search endpoints
([4d345e9](4d345e9f76))

###
[`v2.23.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.23.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.22.0...v2.23.0)

#### 2.23.0

##### 🚀 Features

- feat: add OrbitService for Knowledge Graph endpoints
([!2870](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2870))
by [Dmitry Gruzd](https://gitlab.com/dgruzd)

##### 🔄 Other Changes

- chore(deps): update module buf.build/go/protovalidate to v1.2.0
([!2865](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2865))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)

###
[2.23.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.22.0...v2.23.0)
(2026-05-04)
##### Features

* add OrbitService for Knowledge Graph endpoints
([2ff460f](2ff460f3a8))

###
[`v2.22.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.22.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.21.0...v2.22.0)

#### 2.22.0

##### 🚀 Features

- Add package pipeline data.
([!2834](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2834))
by [Jimmy Spagnola](https://gitlab.com/jspagnola)

##### 🔄 Other Changes

- chore(deps): update module golang.org/x/text to v0.36.0
([!2874](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2874))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(deps): update golang docker tag
([!2873](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2873))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(deps): update docker docker tag to v29.4.1
([!2869](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2869))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- refactor(no-release): use HTTP status code constants
([!2868](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2868))
by [Oleksandr Redko](https://gitlab.com/alexandear)

###
[2.22.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.21.0...v2.22.0)
(2026-05-04)

###
[`v2.21.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.21.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.1...v2.21.0)

#### 2.21.0

##### 🚀 Features

- Add BulkImports API functions and tests
([!2846](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2846))
by [Kalyaan Kanugula](https://gitlab.com/kalyaan09)

##### 🔄 Other Changes

- Add missing `URLVariables` attribute to group_hooks
([!2866](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2866))
by [Mark Nessen](https://gitlab.com/mness)
- docs: fix incorrect phrase 'to that' -> 'so'
([!2861](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2861))
by [Bob Singh](https://gitlab.com/bobsingh.dev)
- docs: fix missing 'of' in contributing guide
([!2860](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2860))
by [Bob Singh](https://gitlab.com/bobsingh.dev)
- style: remove duplicated wording in Go version sentence
([!2859](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2859))
by [Bob Singh](https://gitlab.com/bobsingh.dev)

###
[2.21.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.1...v2.21.0)
(2026-04-27)

###
[`v2.20.1`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#2210-2026-04-27)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.0...v2.20.1)

#### 2.20.1

##### 🐛 Bug Fixes

- Fix potential panic in MergeRequest.UnmarshalJSON label detail loop
([!2858](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2858))
by [Zubeen](https://gitlab.com/syedzubeen)

####
[2.20.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.0...v2.20.1)
(2026-04-20)

#### 2.20.0

##### 🚀 Features

- Add missing system hook api options
([!2847](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2847))
by [Zack Knight](https://gitlab.com/zachkknowbe4)

##### 🔄 Other Changes

- chore(deps): update docker docker tag to v29.4.0
([!2854](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2854))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(deps): update module github.com/google/cel-go to v0.28.0
([!2855](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2855))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)

###
[`v2.20.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#2210-2026-04-27)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.19.0...v2.20.0)

#### 2.20.1

##### 🐛 Bug Fixes

- Fix potential panic in MergeRequest.UnmarshalJSON label detail loop
([!2858](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2858))
by [Zubeen](https://gitlab.com/syedzubeen)

####
[2.20.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.20.0...v2.20.1)
(2026-04-20)

#### 2.20.0

##### 🚀 Features

- Add missing system hook api options
([!2847](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2847))
by [Zack Knight](https://gitlab.com/zachkknowbe4)

##### 🔄 Other Changes

- chore(deps): update docker docker tag to v29.4.0
([!2854](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2854))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(deps): update module github.com/google/cel-go to v0.28.0
([!2855](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2855))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)

###
[`v2.19.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.19.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.18.0...v2.19.0)

#### 2.19.0

##### 🚀 Features

- feat: Add PackageRegistryAccessLevel to Project structs
([!2852](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2852))
by [Caleb Madara](https://gitlab.com/calebmadara58)

###
[2.19.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.18.0...v2.19.0)
(2026-04-15)
##### Features

* Add PackageRegistryAccessLevel to Project structs
([4ce63da](4ce63da952))

###
[`v2.18.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.18.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.17.0...v2.18.0)

#### 2.18.0

##### 🚀 Features

- Feat: Add support for application setting
secret_push_protection_available
([!2849](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2849))
by [Rizart Dona](https://gitlab.com/rizart_d)

##### 🔄 Other Changes

- fix: Correct Example Section in README
([!2850](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2850))
by [Jonathan Bowe](https://gitlab.com/boweflex)

###
[2.18.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.17.0...v2.18.0)
(2026-04-14)
##### Bug Fixes

* Correct Example Section in README
([c0759d9](c0759d99b2))

###
[`v2.17.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.17.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.16.0...v2.17.0)

#### 2.17.0

##### 🚀 Features

- Resolve "Add endpoint support for archiving/unarchiving groups"
([!2848](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2848))
by [Jonathan Bowe](https://gitlab.com/boweflex)

##### 🔄 Other Changes

- chore(deps): update docker docker tag to v29.3.1
([!2841](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2841))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(no-release): enable gocritic linter
([!2842](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2842))
by [Oleksandr Redko](https://gitlab.com/alexandear)
- chore(deps): update module golang.org/x/oauth2 to v0.36.0
([!2835](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2835))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(deps): update module golang.org/x/text to v0.35.0
([!2837](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2837))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)

###
[2.17.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.16.0...v2.17.0)
(2026-04-10)

###
[`v2.16.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.16.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.15.0...v2.16.0)

#### 2.16.0

##### 🚀 Features

- feat: Add PagesUniqueDomainDefaultEnabled to Settings API
([!2845](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2845))
by [Mohamed Mongy](https://gitlab.com/mohamedmongy96)

###
[2.16.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.15.0...v2.16.0)
(2026-04-04)
##### Features

* Add PagesUniqueDomainDefaultEnabled to Settings API
([d27f3af](d27f3af69a))

###
[`v2.15.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.15.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.14.0...v2.15.0)

#### 2.15.0

##### 🚀 Features

- feat: Add approved_at field in merge request approvals API
([!2844](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2844))
by [Mohamed Asan N](https://gitlab.com/hassyyy)

###
[2.15.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.14.0...v2.15.0)
(2026-04-04)
##### Features

* Add approved_at field in merge request approvals API
([528ac9e](528ac9ea36))

###
[`v2.14.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.14.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.13.0...v2.14.0)

#### 2.14.0

##### 🚀 Features

- feat: add support for
DisablePasswordAuthenticationForUsersWithSSOIdentities...
([!2839](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2839))
by [Lorenz Vonlanthen](https://gitlab.com/loelu)

###
[2.14.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.13.0...v2.14.0)
(2026-04-03)
##### Features

* add support for
DisablePasswordAuthenticationForUsersWithSSOIdentities...
([6b88f05](6b88f05609))

###
[`v2.13.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.13.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.12.0...v2.13.0)

#### 2.13.0

##### 🚀 Features

- feat: Added WithAuthSourceStrategy option to allow configuring
multiple token source priority
([!2815](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2815))
by [Павлов Александр](https://gitlab.com/alexpts)

###
[2.13.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.12.0...v2.13.0)
(2026-04-01)
##### Features

* Added WithAuthSourceStrategy option to allow configuring multiple
token source priority
([2261c80](2261c80c28))

###
[`v2.12.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.12.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.11.0...v2.12.0)

#### 2.12.0

##### 🚀 Features

- fix: update HostKey field name to FingerprintSHA256 for consistency
([!2840](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2840))
by [Oleksandr Redko](https://gitlab.com/alexandear)
- Add push mirror host_keys to the go client.
([!2832](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2832))
by [Jimmy Spagnola](https://gitlab.com/jspagnola)

##### 🔄 Other Changes

- Fix: improve URL validation warning logging context and correct typo
([!2830](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2830))
by [Bob Singh](https://gitlab.com/bobsingh.dev)
- chore(no-release): fix typos in comments and unexported function
([!2831](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2831))
by [Oleksandr Redko](https://gitlab.com/alexandear)

###
[2.12.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.11.0...v2.12.0)
(2026-04-01)
##### Bug Fixes

* update HostKey field name to FingerprintSHA256 for consistency
([1b7fcfb](1b7fcfb0ed))

###
[`v2.11.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.11.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.10.0...v2.11.0)

#### 2.11.0

##### 🚀 Features

- Deprecate project approval password auth, add reauth to approve
([!2825](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2825))
by [Heidi Berry](https://gitlab.com/heidi.berry)

##### 🔄 Other Changes

- Fix typo in UpdateLabel comment
([!2827](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2827))
by [Bob Singh](https://gitlab.com/bobsingh.dev)
- Fix runner comment typo
([!2828](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2828))
by [Bob Singh](https://gitlab.com/bobsingh.dev)

###
[2.11.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.10.0...v2.11.0)
(2026-03-30)

###
[`v2.10.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#1380-2026-02-19)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.9.0...v2.10.0)

##### Features

- **events:** Add missing parameters for label operations and update
documentation links
([11b9f08](11b9f08b37))
- **labels:** add missing params and edit links
([ec1b92b](ec1b92bff4))

#### 1.37.0

##### 🚀 Features

- Support system & system\_action fields for merge event attributes
([!2737](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2737))
by [Artem Mikheev](https://gitlab.com/renbou)

##### 🔄 Other Changes

- Update links of geo\_sites.go
([!2782](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2782))
by [Mohamed Mongy](https://gitlab.com/mohamedmongy96)
- chore(deps): update dependency golangci-lint to v2.10.1
([!2770](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2770))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(deps): update golangci/golangci-lint docker tag to v2.10.1
([!2771](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2771))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(deps): update golangci/golangci-lint docker tag to v2.10.0
([!2769](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2769))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(deps): update dependency golangci-lint to v2.10.0
([!2768](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2768))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)

###
[`v2.9.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#1330-2026-02-13)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.8.0...v2.9.0)

#### 1.32.0

##### 🚀 Features

- Implement endpoints for runner controller scopes
([!2758](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2758))
by [Timo Furrer](https://gitlab.com/timofurrer)

##### 🔄 Other Changes

- test(namespaces): Address test feedback to simplify the test
([!2744](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2744))
by [Patrick Rice](https://gitlab.com/PatrickRice)
- chore(deps): update golangci/golangci-lint docker tag to v2.9.0
([!2755](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2755))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(deps): update dependency golangci-lint to v2.9.0
([!2754](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2754))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)

###
[`v2.8.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#1130-2026-01-12)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.7.0...v2.8.0)

##### Features

- **groups:** add Active parameter to ListGroupProjects
([dec511a](dec511a199))

#### 1.12.0

##### 🚀 Features

- feat: add EmojiEvents field support to Project Webhooks
([!2653](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2653))
by [Yugan](https://gitlab.com/yugannkt)

##### 🔄 Other Changes

- chore(deps): update dependency golangci-lint to v2.8.0
([!2650](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2650))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- refactor(no-release): use errors.New instead of fmt.Errorf
([!2644](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2644))
by [Oleksandr Redko](https://gitlab.com/alexandear)

###
[`v2.7.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#170-2025-12-06)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.6.0...v2.7.0)

##### Features

- **users:** Add support for a user to see only one file diff per page
([e2a9e09](e2a9e09e79))

#### 1.6.0

##### 🚀 Features

- feat: add admin compliance policy settings API
([!2610](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2610))
by [Hannes Lange](https://gitlab.com/hlange4)

##### 🔄 Other Changes

- doc: fix typo
([!2603](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2603))
by [Guilhem Bonnefille](https://gitlab.com/gbonnefille)
- chore(deps): update golangci/golangci-lint docker tag to v2.7.1
([!2611](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2611))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(deps): update docker docker tag to v29.1.2
([!2609](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2609))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(deps): update golangci/golangci-lint docker tag to v2.7.0
([!2608](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2608))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)

###
[`v2.6.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#01590-2025-11-04)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.5.0...v2.6.0)

##### Features

- **integrations:** add group integration API endpoints for Jira
([09e18ee](09e18ee598))

#### 0.158.0

##### 🚀 Features

- Add support to send variables for GraphQL queries
([!2562](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2562))
by [rafasf](https://gitlab.com/rafasf)

##### 🔄 Other Changes

- chore(deps): update module cel.dev/expr to v0.25.0
([!2560](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2560))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- chore(no-release): standardize GitLab name capitalization
([!2551](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2551))
by [Zubeen](https://gitlab.com/syedzubeen)
- chore(deps): update golangci/golangci-lint docker tag to v2.6.0
([!2558](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2558))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- refactor: moved comments to interface 2
([!2557](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2557))
by [Zubeen](https://gitlab.com/syedzubeen)
- refactor: moved comments to interface
([!2556](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2556))
by [Zubeen](https://gitlab.com/syedzubeen)
- refactor(test): avoid panic in tests with goroutines
([!2553](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2553))
by [Oleksandr Redko](https://gitlab.com/alexandear)

### [`v2.5.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.5.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.4.0...v2.5.0)

#### 2.5.0

##### 🚀 Features

- feat(workitems): Implement `UpdateWorkItem()`
([!2793](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2793))
by [Carlos Corona](https://gitlab.com/ccorona2)

##### 🔄 Other Changes

- chore(deps): update dependency golangci-lint to v2.11.2
([!2810](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2810))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)
- test(no-release): replace reflect.DeepEqual with testify
([!2809](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2809))
by [Oleksandr Redko](https://gitlab.com/alexandear)
- feat: allow OAuth success callback page to self-close when possible
([!2808](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2808))
by [Case Taintor](https://gitlab.com/case.taintor)
- chore(deps): update dependency golangci-lint to v2.11.1
([!2806](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2806))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)

###
[2.5.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.4.0...v2.5.0)
(2026-03-09)
##### Features

* allow OAuth success callback page to self-close when possible
([dca2e12](dca2e12095))
* **workitems:** Implement `UpdateWorkItem()`
([b93a55e](b93a55e316))

### [`v2.4.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.4.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.3.0...v2.4.0)

#### 2.4.0

##### 🚀 Features

- Reflect latest runner controller API changes
([!2803](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2803))
by [Timo Furrer](https://gitlab.com/timofurrer)

##### 🔄 Other Changes

- chore(deps): update docker docker tag to v29.3.0
([!2804](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2804))
by [GitLab Dependency
Bot](https://gitlab.com/gitlab-dependency-update-bot)

###
[2.4.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.3.0...v2.4.0)
(2026-03-06)

### [`v2.3.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.3.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.1...v2.3.0)

#### 2.3.0

##### 🚀 Features

- feat: add new endpoint for fetching all the runner manager information
([!2802](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2802))
by [Aayush](https://gitlab.com/Aayush-Saini)

###
[2.3.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.1...v2.3.0)
(2026-03-05)
##### Features

* add new endpoint for fetching all the runner manager information
([d4755b7](d4755b7966))

###
[`v2.2.1`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#230-2026-03-05)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.0...v2.2.1)

##### Features

- add new endpoint for fetching all the runner manager information
([d4755b7](d4755b7966))

#### 2.2.1

##### 🐛 Bug Fixes

- fix: Add `/v2` suffix to module path.
([!2801](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2801))
by [Florian Forster](https://gitlab.com/fforster)

####
[2.2.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.0...v2.2.1)
(2026-03-04)

##### Bug Fixes

- Add `/v2` suffix to module path.
([4237f6a](4237f6aa29)),
closes
[#&#8203;2239](https://gitlab.com/gitlab-org/api/client-go/issues/2239)

#### 2.2.0

##### 🚀 Features

- feat(workitems): Implement `CreateWorkItem()`.
([!2751](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2751))
by [Florian Forster](https://gitlab.com/fforster)

###
[`v2.2.0`](https://gitlab.com/gitlab-org/api/client-go/blob/HEAD/CHANGELOG.md#230-2026-03-05)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.1.0...v2.2.0)

##### Features

- add new endpoint for fetching all the runner manager information
([d4755b7](d4755b7966))

#### 2.2.1

##### 🐛 Bug Fixes

- fix: Add `/v2` suffix to module path.
([!2801](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2801))
by [Florian Forster](https://gitlab.com/fforster)

####
[2.2.1](https://gitlab.com/gitlab-org/api/client-go/compare/v2.2.0...v2.2.1)
(2026-03-04)

##### Bug Fixes

- Add `/v2` suffix to module path.
([4237f6a](4237f6aa29)),
closes
[#&#8203;2239](https://gitlab.com/gitlab-org/api/client-go/issues/2239)

#### 2.2.0

##### 🚀 Features

- feat(workitems): Implement `CreateWorkItem()`.
([!2751](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2751))
by [Florian Forster](https://gitlab.com/fforster)

### [`v2.1.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.1.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v2.0.0...v2.1.0)

#### 2.1.0

##### 🚀 Features

- feat(workitems): Add more fields to WorkItem
([!2795](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2795))
by [Florian Forster](https://gitlab.com/fforster)

##### 🔄 Other Changes

- Implement body preserver to enable HTTP response body streaming
([!2746](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2746))
by [Timo Furrer](https://gitlab.com/timofurrer)

###
[2.1.0](https://gitlab.com/gitlab-org/api/client-go/compare/v2.0.0...v2.1.0)
(2026-03-03)
##### Features

* **workitems:** Add more fields to WorkItem
([7088f6f](7088f6f229))

### [`v2.0.0`](https://gitlab.com/gitlab-org/api/client-go/tags/v2.0.0)

[Compare
Source](https://gitlab.com/gitlab-org/api/client-go/compare/v1.46.0...v2.0.0)

#### 2.0.0

##### 💥 Breaking Changes

- Release client-go 2.0
([!2763](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2763))
by [Patrick Rice](https://gitlab.com/PatrickRice)

##### 🔄 Other Changes

- Addtl 2 0 changes
([!2796](https://gitlab.com/gitlab-org/api/client-go/-/merge_requests/2796))
by [Patrick Rice](https://gitlab.com/PatrickRice)

###
[2.0.0](https://gitlab.com/gitlab-org/api/client-go/compare/v1.46.0...v2.0.0)
(2026-03-02)

* Release client-go 2.0
([47b65ee](47b65ee907))

##### Bug Fixes

* **ci:** update gocover-cobertura to v1.4.0 for Go 1.24+ compatibility
([1d03b20](1d03b20802))
* **group_members:** using ISOTime instead of time.Time for
BillableUserMembership.ExpiresAt
([e7e58c6](e7e58c69c1))
* package protection access level variable type
([5574bbb](5574bbbf2f))
* **workitems:** Handle absent status widget in `WorkItem`.
([859fb26](859fb26f28))

##### Features

* use Nullable[int64] for label priority
([096ed09](096ed098d1))

##### BREAKING CHANGES

* Release 2.0

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Only on Monday (`* * * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-11 07:00:29 +00:00
silverwind
b29af98a36
ci(renovate): update Go import paths on major bumps (#37641)
Enable `gomodUpdateImportPaths` so Renovate rewrites import paths (e.g.
`foo/v2` → `foo/v3`) across the repo when bumping Go modules across
major versions.

---
This PR was written with the help of Claude Opus 4.7

Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: Nicolas <bircni@icloud.com>
2026-05-11 06:35:48 +00:00
Lunny Xiao
5d87a70af9
fix(packages): Add label for private and internal package and fix composor package source permission check (#37610)
- Add permission checks for Composer package source links

- Add private/internal visibility labels for packages, similar to
repository visibility labels

<img width="969" height="571" alt="image"
src="https://github.com/user-attachments/assets/8a8ec3a0-bfbd-4dd6-b45b-58eda5db1a2d"
/>

- Add a link to change package visibility

<img width="1309" height="208" alt="image"
src="https://github.com/user-attachments/assets/3fa82b23-4c63-4a5e-b3f0-d37a103231ee"
/>

- Update link package descriptions

<img width="1308" height="265" alt="image"
src="https://github.com/user-attachments/assets/2c80b50e-5ffe-4d96-aedd-aa15964c4e05"
/>

---------

Co-authored-by: Nicolas <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
2026-05-11 05:49:46 +00:00
silverwind
5dc9d621fd
refactor: replace Fomantic search module with first-party code (#37443)
- Replace fomantic `search` code with minimal first-party code
- Added a small fix to vertically align search box and search button
- Manually tested all search forms.
- Add `errorName` helper, similar to `errorMessage`.

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-11 05:25:26 +00:00
Giteabot
a603f89fce
fix(deps): update npm dependencies (#37636)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@typescript-eslint/parser](https://typescript-eslint.io/packages/parser)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser))
| [`8.59.1` →
`8.59.2`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.59.1/8.59.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@typescript-eslint%2fparser/8.59.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@typescript-eslint%2fparser/8.59.1/8.59.2?slim=true)
|
| [eslint-plugin-vue](https://eslint.vuejs.org)
([source](https://redirect.github.com/vuejs/eslint-plugin-vue)) |
[`10.9.0` →
`10.9.1`](https://renovatebot.com/diffs/npm/eslint-plugin-vue/10.9.0/10.9.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/eslint-plugin-vue/10.9.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint-plugin-vue/10.9.0/10.9.1?slim=true)
|
| [jiti](https://redirect.github.com/unjs/jiti) | [`2.6.1` →
`2.7.0`](https://renovatebot.com/diffs/npm/jiti/2.6.1/2.7.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/jiti/2.7.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/jiti/2.6.1/2.7.0?slim=true)
|
| [postcss](https://postcss.org/)
([source](https://redirect.github.com/postcss/postcss)) | [`8.5.13` →
`8.5.14`](https://renovatebot.com/diffs/npm/postcss/8.5.13/8.5.14) |
![age](https://developer.mend.io/api/mc/badges/age/npm/postcss/8.5.14?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/postcss/8.5.13/8.5.14?slim=true)
|
| [stylelint](https://stylelint.io)
([source](https://redirect.github.com/stylelint/stylelint)) | [`17.10.0`
→
`17.11.0`](https://renovatebot.com/diffs/npm/stylelint/17.10.0/17.11.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/stylelint/17.11.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/stylelint/17.10.0/17.11.0?slim=true)
|
|
[typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint))
| [`8.59.1` →
`8.59.2`](https://renovatebot.com/diffs/npm/typescript-eslint/8.59.1/8.59.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/typescript-eslint/8.59.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/typescript-eslint/8.59.1/8.59.2?slim=true)
|
| [updates](https://redirect.github.com/silverwind/updates) | [`17.16.8`
→ `17.16.9`](https://renovatebot.com/diffs/npm/updates/17.16.8/17.16.9)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/updates/17.16.9?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/updates/17.16.8/17.16.9?slim=true)
|

---

### Release Notes

<details>
<summary>typescript-eslint/typescript-eslint
(@&#8203;typescript-eslint/parser)</summary>

###
[`v8.59.2`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8592-2026-05-04)

[Compare
Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.59.1...v8.59.2)

This was a version bump only for parser to align it with other projects,
there were no code changes.

See [GitHub
Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.59.2)
for more information.

You can read about our [versioning
strategy](https://typescript-eslint.io/users/versioning) and
[releases](https://typescript-eslint.io/users/releases) on our website.

</details>

<details>
<summary>vuejs/eslint-plugin-vue (eslint-plugin-vue)</summary>

###
[`v10.9.1`](https://redirect.github.com/vuejs/eslint-plugin-vue/blob/HEAD/CHANGELOG.md#1091)

[Compare
Source](https://redirect.github.com/vuejs/eslint-plugin-vue/compare/v10.9.0...v10.9.1)

##### Patch Changes

- Updated peer dependency version for
[`vue-eslint-parser`](https://redirect.github.com/vuejs/vue-eslint-parser)
to fix parsing errors in Vue SFCs
([#&#8203;3075](https://redirect.github.com/vuejs/eslint-plugin-vue/pull/3075))

</details>

<details>
<summary>unjs/jiti (jiti)</summary>

###
[`v2.7.0`](https://redirect.github.com/unjs/jiti/blob/HEAD/CHANGELOG.md#v270)

[Compare
Source](https://redirect.github.com/unjs/jiti/compare/v2.6.1...v2.7.0)

[compare
changes](https://redirect.github.com/unjs/jiti/compare/v2.6.1...v2.7.0)

##### 🚀 Enhancements

- Add explicit resource management (using/await using) support
([#&#8203;422](https://redirect.github.com/unjs/jiti/pull/422))
- Support opt-in `tsconfigPaths`
([#&#8203;427](https://redirect.github.com/unjs/jiti/pull/427))
- Support virtual modules option
([#&#8203;428](https://redirect.github.com/unjs/jiti/pull/428))
- Add `jiti/static` export
([#&#8203;430](https://redirect.github.com/unjs/jiti/pull/430))

##### 🔥 Performance

- **interopDefault:** Add caching to reduce proxy overhead by \~2x
([#&#8203;421](https://redirect.github.com/unjs/jiti/pull/421))

##### 🩹 Fixes

- **require:** Passthrough resolve options
([#&#8203;412](https://redirect.github.com/unjs/jiti/pull/412))
- **ci:** Skip `--coverage` flag for node 18
([fe264b4](https://redirect.github.com/unjs/jiti/commit/fe264b4))
- **require:** Fallback to transpilation when `tryNative` fails
([#&#8203;413](https://redirect.github.com/unjs/jiti/pull/413))
- Fallback for `ENAMETOOLONG` when evaluating esm
([#&#8203;429](https://redirect.github.com/unjs/jiti/pull/429))

##### 📦 Build

- Upgrade rspack
([55194fb](https://redirect.github.com/unjs/jiti/commit/55194fb))
- Experimental rolldown config
([8c0243f](https://redirect.github.com/unjs/jiti/commit/8c0243f))

##### 🏡 Chore

- Fix lint issues
([4045c7a](https://redirect.github.com/unjs/jiti/commit/4045c7a))
- Update deps
([e88ac44](https://redirect.github.com/unjs/jiti/commit/e88ac44))
- Update deps
([498e8d7](https://redirect.github.com/unjs/jiti/commit/498e8d7))
- Add missing prettier dep
([650bc48](https://redirect.github.com/unjs/jiti/commit/650bc48))
- Lint ([058d91a](https://redirect.github.com/unjs/jiti/commit/058d91a))
- Init agents.md
([c49c54e](https://redirect.github.com/unjs/jiti/commit/c49c54e))
- Update agents.md
([4deba16](https://redirect.github.com/unjs/jiti/commit/4deba16))
- Update deps
([08fc868](https://redirect.github.com/unjs/jiti/commit/08fc868))
- Update tsconfig
([8c7822e](https://redirect.github.com/unjs/jiti/commit/8c7822e))
- Update release script
([27fe3f2](https://redirect.github.com/unjs/jiti/commit/27fe3f2))

#####  Tests

- Ignore jsx test for bun/cjs
([3a744ca](https://redirect.github.com/unjs/jiti/commit/3a744ca))
- Update
([9ee314f](https://redirect.github.com/unjs/jiti/commit/9ee314f))

##### 🤖 CI

- Update node test matrix
([0abda72](https://redirect.github.com/unjs/jiti/commit/0abda72))

##### ❤️ Contributors

- Pooya Parsa ([@&#8203;pi0](https://redirect.github.com/pi0))
- Kricsleo ([@&#8203;kricsleo](https://redirect.github.com/kricsleo))
- Espen Hovlandsdal
([@&#8203;rexxars](https://redirect.github.com/rexxars))
- Rintaro Itokawa
([@&#8203;re-taro](https://redirect.github.com/re-taro))
- Matteo Collina
([@&#8203;mcollina](https://redirect.github.com/mcollina))

</details>

<details>
<summary>postcss/postcss (postcss)</summary>

###
[`v8.5.14`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8514)

[Compare
Source](https://redirect.github.com/postcss/postcss/compare/8.5.13...8.5.14)

- Fixed custom syntax regression (by
[@&#8203;43081j](https://redirect.github.com/43081j)).

</details>

<details>
<summary>stylelint/stylelint (stylelint)</summary>

###
[`v17.11.0`](https://redirect.github.com/stylelint/stylelint/blob/HEAD/CHANGELOG.md#17110---2026-05-05)

[Compare
Source](https://redirect.github.com/stylelint/stylelint/compare/17.10.0...17.11.0)

It adds 2 features, including a `loader` property to `referenceFiles:
{}` for when the order of appearance in the reference styles matters.

- Added: `loader` to experimental `referenceFiles: {}`
([#&#8203;9251](https://redirect.github.com/stylelint/stylelint/pull/9251))
([@&#8203;romainmenke](https://redirect.github.com/romainmenke)).
- Added: `autofixed` to the result object
([#&#8203;8771](https://redirect.github.com/stylelint/stylelint/pull/8771))
([@&#8203;Rob--W](https://redirect.github.com/Rob--W)).

</details>

<details>
<summary>typescript-eslint/typescript-eslint
(typescript-eslint)</summary>

###
[`v8.59.2`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/typescript-eslint/CHANGELOG.md#8592-2026-05-04)

[Compare
Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.59.1...v8.59.2)

This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.

See [GitHub
Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.59.2)
for more information.

You can read about our [versioning
strategy](https://typescript-eslint.io/users/versioning) and
[releases](https://typescript-eslint.io/users/releases) on our website.

</details>

<details>
<summary>silverwind/updates (updates)</summary>

###
[`v17.16.9`](https://redirect.github.com/silverwind/updates/releases/tag/17.16.9)

[Compare
Source](https://redirect.github.com/silverwind/updates/compare/17.16.8...17.16.9)

- update deps (silverwind)
- Resolve config per-file when `-f` is used
([#&#8203;136](https://redirect.github.com/silverwind/updates/issues/136))
(silverwind)
- Honor config pin in docker mode (silverwind)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Only on Monday (`* * * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-11 05:01:34 +00:00
Giteabot
e1f0f9e896
fix(deps): update module code.gitea.io/sdk/gitea to v0.25.0 (#37637)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| code.gitea.io/sdk/gitea | `v0.24.1` → `v0.25.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/code.gitea.io%2fsdk%2fgitea/v0.25.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/code.gitea.io%2fsdk%2fgitea/v0.24.1/v0.25.0?slim=true)
|

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Only on Monday (`* * * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
2026-05-11 06:11:28 +02:00
pomidorry
67f86bc3fe
feat(api): add last_sync to repository API (#37566)
This PR adds a new repository API field, `mirror_last_sync_at`, to
expose the timestamp of the last successful pull mirror sync.

Unlike `mirror_updated`, this field does not affect mirror scheduling
and is updated only after a successful pull sync. Failed sync attempts
leave the value unchanged.

What changed

- added `mirror_last_sync_at` to the repository API response
- updated pull mirror sync flow to persist the timestamp only on
successful sync
- kept `mirror_updated` behavior unchanged for queue/scheduling purposes

`mirror_updated` is currently tied to mirror queue behavior, so it
cannot safely represent the last successful sync time. The new field
makes that state explicit for API consumers without changing scheduling
semantics.

---------

Signed-off-by: pomidorry <106489913+Pomidorry@users.noreply.github.com>
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Giteabot <teabot@gitea.io>
2026-05-10 20:07:56 +00:00
TheFox0x7
c78c84c3ca
test(e2e): run playwright via container (#37300)
Enable running playwright tests on unsupported platforms as well

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-10 09:16:02 +00:00
silverwind
a61598884f
feat(editor): broaden language detection in web code editor (#37619)
Use
https://github.com/github-linguist/linguist/blob/main/lib/linguist/languages.yml
to substantially improve syntax higlighting in Codemirror. File is
generated on-demand only.

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
2026-05-10 04:51:46 +00:00
Copilot
0a3aaeafe7
refactor(log): replace log.Critical with log.Error (#37624)
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: wxiaoguang <2114189+wxiaoguang@users.noreply.github.com>
2026-05-09 16:32:49 +00:00
wxiaoguang
093c9e8ee6
fix: "run as root" check (#37622)
Remove the hacky and fragile `sed os.Getuid()` patch.
2026-05-09 17:32:30 +02:00
silverwind
ce089f498b
fix: improve actions status icons and texts (#37206)
Action runs, jobs and steps have 8 statuses but the UI only showed 5
(from the commit status api) for the latter two. Align all 8 to GitHub
as closely as possible:

  - waiting — `octicon-circle` (hollow circle), gray
  - blocked — `octicon-blocked` (slashed circle), yellow
  - running — `gitea-running` (rotating spinner), yellow
  - cancelled — `octicon-stop` (gray), was `octicon-x` (red)

Descriptions also aligned with GitHub:

  - "Has started running" → "In progress"
  - "Has been cancelled" → "Cancelled after {dur}"
  - "Has been skipped" → "Skipped"

Fixes: https://github.com/go-gitea/gitea/issues/32228

---------

Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.6) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Nicolas <bircni@icloud.com>
2026-05-09 15:24:08 +08:00
silverwind
a5d81d9ce2
perf: replace goheader linter with custom check (#37599)
Replace the [slow `goheader` linter](https://github.com/denis-tingaikin/go-header/issues/70) with a
custom check.

Local go lint time is down from 247s to 32s. 6 new files that were
previously undetected because of `//go:build ignore` are fixed. The exit
code of the make target preserves the golangci-lint exit code, if
present.

Also refactors and consolidates the linting targets.

Signed-off-by: silverwind <me@silverwind.io>
Signed-off-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Giteabot <teabot@gitea.io>
2026-05-08 23:39:35 +02:00