mirror of https://github.com/go-gitea/gitea.git synced 2026-06-10 03:43:16 +02:00

Go to file

fix(deps): update npm dependencies (#38029 )

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@primer/octicons](https://primer.style/octicons)
([source](https://redirect.github.com/primer/octicons)) | [`19.27.0` →
`19.28.0`](https://renovatebot.com/diffs/npm/@primer%2focticons/19.27.0/19.28.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@primer%2focticons/19.28.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@primer%2focticons/19.27.0/19.28.0?slim=true)
|
|
[@typescript-eslint/parser](https://typescript-eslint.io/packages/parser)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser))
| [`8.60.0` →
`8.60.1`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.60.0/8.60.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@typescript-eslint%2fparser/8.60.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@typescript-eslint%2fparser/8.60.0/8.60.1?slim=true)
|
|
[@vitest/eslint-plugin](https://redirect.github.com/vitest-dev/eslint-plugin-vitest)
| [`1.6.18` →
`1.6.19`](https://renovatebot.com/diffs/npm/@vitest%2feslint-plugin/1.6.18/1.6.19)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2feslint-plugin/1.6.19?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2feslint-plugin/1.6.18/1.6.19?slim=true)
|
| [eslint](https://eslint.org)
([source](https://redirect.github.com/eslint/eslint)) | [`10.4.0` →
`10.4.1`](https://renovatebot.com/diffs/npm/eslint/10.4.0/10.4.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/eslint/10.4.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint/10.4.0/10.4.1?slim=true)
|
|
[eslint-import-resolver-typescript](https://redirect.github.com/import-js/eslint-import-resolver-typescript)
| [`4.4.4` →
`4.4.5`](https://renovatebot.com/diffs/npm/eslint-import-resolver-typescript/4.4.4/4.4.5)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/eslint-import-resolver-typescript/4.4.5?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint-import-resolver-typescript/4.4.4/4.4.5?slim=true)
|
|
[eslint-plugin-vue-scoped-css](https://future-architect.github.io/eslint-plugin-vue-scoped-css/)
([source](https://redirect.github.com/future-architect/eslint-plugin-vue-scoped-css))
| [`3.1.0` →
`3.1.1`](https://renovatebot.com/diffs/npm/eslint-plugin-vue-scoped-css/3.1.0/3.1.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/eslint-plugin-vue-scoped-css/3.1.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint-plugin-vue-scoped-css/3.1.0/3.1.1?slim=true)
|
| [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`4.1.1` →
`4.2.0`](https://renovatebot.com/diffs/npm/js-yaml/4.1.1/4.2.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/js-yaml/4.2.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/js-yaml/4.1.1/4.2.0?slim=true)
|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) |
[`11.4.0` →
`11.5.1`](https://renovatebot.com/diffs/npm/pnpm/11.4.0/11.5.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.5.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.4.0/11.5.1?slim=true)
|
|
[rolldown-license-plugin](https://redirect.github.com/silverwind/rolldown-license-plugin)
| [`3.0.8` →
`3.0.9`](https://renovatebot.com/diffs/npm/rolldown-license-plugin/3.0.8/3.0.9)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/rolldown-license-plugin/3.0.9?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/rolldown-license-plugin/3.0.8/3.0.9?slim=true)
|
|
[typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint)
([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint))
| [`8.60.0` →
`8.60.1`](https://renovatebot.com/diffs/npm/typescript-eslint/8.60.0/8.60.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/typescript-eslint/8.60.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/typescript-eslint/8.60.0/8.60.1?slim=true)
|
| [updates](https://redirect.github.com/silverwind/updates) | [`17.17.2`
→ `17.17.3`](https://renovatebot.com/diffs/npm/updates/17.17.2/17.17.3)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/updates/17.17.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/updates/17.17.2/17.17.3?slim=true)
|
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`8.0.14` →
`8.0.16`](https://renovatebot.com/diffs/npm/vite/8.0.14/8.0.16) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.0.16?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.0.14/8.0.16?slim=true)
|
| [vitest](https://vitest.dev)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest))
| [`4.1.7` →
`4.1.8`](https://renovatebot.com/diffs/npm/vitest/4.1.7/4.1.8) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.8?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.7/4.1.8?slim=true)
|
| [vue-tsc](https://redirect.github.com/vuejs/language-tools)
([source](https://redirect.github.com/vuejs/language-tools/tree/HEAD/packages/tsc))
| [`3.3.2` →
`3.3.3`](https://renovatebot.com/diffs/npm/vue-tsc/3.3.2/3.3.3) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vue-tsc/3.3.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vue-tsc/3.3.2/3.3.3?slim=true)
|

---

### Release Notes

<details>
<summary>primer/octicons (@&#8203;primer/octicons)</summary>

###
[`v19.28.0`](https://redirect.github.com/primer/octicons/blob/HEAD/CHANGELOG.md#19280)

[Compare
Source](https://redirect.github.com/primer/octicons/compare/v19.27.0...v19.28.0)

##### Minor Changes

- [#&#8203;1208](https://redirect.github.com/primer/octicons/pull/1208)
[`eddab3ff`](eddab3ff19)
Thanks [@&#8203;dylanatsmith](https://redirect.github.com/dylanatsmith)!
- Fix vscode icon: update 16px, add 24px, remove 32px and 48px

</details>

<details>
<summary>typescript-eslint/typescript-eslint
(@&#8203;typescript-eslint/parser)</summary>

###
[`v8.60.1`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8601-2026-06-01)

[Compare
Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.60.0...v8.60.1)

This was a version bump only for parser to align it with other projects,
there were no code changes.

See [GitHub
Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.1)
for more information.

You can read about our [versioning
strategy](https://typescript-eslint.io/users/versioning) and
[releases](https://typescript-eslint.io/users/releases) on our website.

</details>

<details>
<summary>vitest-dev/eslint-plugin-vitest
(@&#8203;vitest/eslint-plugin)</summary>

###
[`v1.6.19`](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/releases/tag/v1.6.19)

[Compare
Source](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/compare/v1.6.18...v1.6.19)

*No significant changes*

#####     [View changes on
GitHub](https://redirect.github.com/vitest-dev/eslint-plugin-vitest/compare/v1.6.18...v1.6.19)

</details>

<details>
<summary>eslint/eslint (eslint)</summary>

###
[`v10.4.1`](https://redirect.github.com/eslint/eslint/releases/tag/v10.4.1)

[Compare
Source](https://redirect.github.com/eslint/eslint/compare/v10.4.0...v10.4.1)

#### Bug Fixes

-
[`e557467`](e557467db7)
fix: update `@eslint/plugin-kit` version to 0.7.2
([#&#8203;20930](https://redirect.github.com/eslint/eslint/issues/20930))
(Francesco Trotta)
-
[`d4ce898`](d4ce898796)
fix: propagate failures from delegated commands
([#&#8203;20917](https://redirect.github.com/eslint/eslint/issues/20917))
(Minh Vu)
-
[`f4f3507`](f4f3507460)
fix: prefer-arrow-callback invalid autofix with newline after `async`
([#&#8203;20916](https://redirect.github.com/eslint/eslint/issues/20916))
(kuldeep kumar)
-
[`c5bc78b`](c5bc78b37e)
fix: false positive for reference in `finally` block
([#&#8203;20655](https://redirect.github.com/eslint/eslint/issues/20655))
(Tanuj Kanti)
-
[`27538c0`](27538c01f5)
fix: add missing CodePath and CodePathSegment types
([#&#8203;20853](https://redirect.github.com/eslint/eslint/issues/20853))
(Pixel998)

#### Documentation

-
[`61b0add`](61b0add61f)
docs: remove deprecated rule from related rules of `max-params`
([#&#8203;20921](https://redirect.github.com/eslint/eslint/issues/20921))
(Tanuj Kanti)
-
[`305d5b9`](305d5b91ae)
docs: remove deprecated rules from related rules section
([#&#8203;20911](https://redirect.github.com/eslint/eslint/issues/20911))
(Tanuj Kanti)
-
[`49b0202`](49b0202d01)
docs: fix `display: none` of ad
([#&#8203;20901](https://redirect.github.com/eslint/eslint/issues/20901))
(Tanuj Kanti)
-
[`9067f94`](9067f9492e)
docs: switch build to Node.js 24
([#&#8203;20893](https://redirect.github.com/eslint/eslint/issues/20893))
(Milos Djermanovic)
-
[`c91b041`](c91b0417e3)
docs: Update README (GitHub Actions Bot)
-
[`e349265`](e349265cb3)
docs: clarify semver strings in rule deprecation objects
([#&#8203;20885](https://redirect.github.com/eslint/eslint/issues/20885))
(Milos Djermanovic)

#### Chores

-
[`b0e466b`](b0e466b6ab)
test: add `data` property to invalid tests cases for rules
([#&#8203;20924](https://redirect.github.com/eslint/eslint/issues/20924))
(Tanuj Kanti)
-
[`f78838b`](f78838bc4c)
test: add CodePath type coverage
([#&#8203;20904](https://redirect.github.com/eslint/eslint/issues/20904))
(Pixel998)
-
[`1daa4bd`](1daa4bd734)
chore: update `eslint-plugin-eslint-comments` test data to latest commit
([#&#8203;20922](https://redirect.github.com/eslint/eslint/issues/20922))
(Francesco Trotta)
-
[`002942c`](002942ce98)
ci: declare contents:read on update-readme workflow
([#&#8203;20919](https://redirect.github.com/eslint/eslint/issues/20919))
(Arpit Jain)
-
[`64bca24`](64bca24e7b)
chore: update ecosystem plugins
([#&#8203;20912](https://redirect.github.com/eslint/eslint/issues/20912))
(ESLint Bot)
-
[`6d7c832`](6d7c832950)
chore: ignore fflate updates in renovate
([#&#8203;20908](https://redirect.github.com/eslint/eslint/issues/20908))
(Pixel998)
-
[`b2c8638`](b2c8638216)
ci: bump pnpm/action-setup from 6.0.7 to 6.0.8
([#&#8203;20889](https://redirect.github.com/eslint/eslint/issues/20889))
(dependabot\[bot])
-
[`a9b8d7f`](a9b8d7f74c)
chore: increase maxBuffer for ecosystem tests
([#&#8203;20881](https://redirect.github.com/eslint/eslint/issues/20881))
(sethamus)
-
[`b702ead`](b702ead5e1)
chore: update ecosystem update PR settings
([#&#8203;20884](https://redirect.github.com/eslint/eslint/issues/20884))
(Pixel998)
-
[`507f60e`](507f60e9a7)
chore: update ecosystem plugins
([#&#8203;20882](https://redirect.github.com/eslint/eslint/issues/20882))
(ESLint Bot)
-
[`92f5c5b`](92f5c5bb6b)
test: add unit test for message-count
([#&#8203;20878](https://redirect.github.com/eslint/eslint/issues/20878))
(kuldeep kumar)
-
[`df32108`](df321080af)
chore: add
[@&#8203;eslint/markdown](https://redirect.github.com/eslint/markdown)
and typescript-eslint ecosystem tests
([#&#8203;20837](https://redirect.github.com/eslint/eslint/issues/20837))
(sethamus)
-
[`327f91d`](327f91d36a)
chore: use includeIgnoreFile internally
([#&#8203;20876](https://redirect.github.com/eslint/eslint/issues/20876))
(Kirk Waiblinger)
-
[`f0dc4bd`](f0dc4bd893)
chore: pin fflate\@&#8203;0.8.2
([#&#8203;20877](https://redirect.github.com/eslint/eslint/issues/20877))
(Milos Djermanovic)
-
[`0f4bd25`](0f4bd257a6)
ci: run Discord alert for ecosystem test failures
([#&#8203;20873](https://redirect.github.com/eslint/eslint/issues/20873))
(Copilot)

</details>

<details>
<summary>import-js/eslint-import-resolver-typescript
(eslint-import-resolver-typescript)</summary>

###
[`v4.4.5`](https://redirect.github.com/import-js/eslint-import-resolver-typescript/blob/HEAD/CHANGELOG.md#445)

[Compare
Source](https://redirect.github.com/import-js/eslint-import-resolver-typescript/compare/v4.4.4...v4.4.5)

##### Patch Changes

-
[#&#8203;473](https://redirect.github.com/import-js/eslint-import-resolver-typescript/pull/473)
[`32c61ab`](32c61abccf)
Thanks [@&#8203;leey0818](https://redirect.github.com/leey0818)! - fix:
check tsconfig matching before using resolver

</details>

<details>
<summary>future-architect/eslint-plugin-vue-scoped-css
(eslint-plugin-vue-scoped-css)</summary>

###
[`v3.1.1`](https://redirect.github.com/future-architect/eslint-plugin-vue-scoped-css/blob/HEAD/CHANGELOG.md#311)

[Compare
Source](https://redirect.github.com/future-architect/eslint-plugin-vue-scoped-css/compare/v3.1.0...v3.1.1)

##### Patch Changes

- Fix false positives in `vue-scoped-css/require-selector-used-inside`
for selectors that start with ignored pseudo-classes such as
`:has(...)`.
([#&#8203;496](https://redirect.github.com/future-architect/eslint-plugin-vue-scoped-css/pull/496))

</details>

<details>
<summary>nodeca/js-yaml (js-yaml)</summary>

###
[`v4.2.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#420---2026-06-01)

[Compare
Source](https://redirect.github.com/nodeca/js-yaml/compare/4.1.1...590dbabadd172b099c07654fab2eabec8c7a07b9)

##### Added

- Added `docs/safety.md` with notes about processing untrusted YAML.
- Added `maxDepth` (100) loader option. Not a problem, but gives a
better
  exception instead of RangeError on stack overflow.
- Added `maxMergeSeqLength` (20) loader option. Not a problem after
`merge` fix,
  but an additional restriction for safety.
- Added sourcemaps to `dist/` builds.

##### Changed

- Stop resolving numbers with underscores as numeric scalars,
[#&#8203;627](https://redirect.github.com/nodeca/js-yaml/issues/627).
- Switched dev toolchains to Vite / neostandard.
- Updated demo.
- Reorganized tests.
- `dist/` files are no longer kept in the repository.

##### Fixed

- Fix parsing of properties on the first implicit block mapping key,
[#&#8203;62](https://redirect.github.com/nodeca/js-yaml/issues/62).
- Fix trailing whitespace handling when folding flow scalar lines,
[#&#8203;307](https://redirect.github.com/nodeca/js-yaml/issues/307).
- Reject top-level block scalars without content indentation,
[#&#8203;280](https://redirect.github.com/nodeca/js-yaml/issues/280).
- Ensure numbers survive round-trip,
[#&#8203;737](https://redirect.github.com/nodeca/js-yaml/issues/737).
- Fix test coverage for issue
[#&#8203;221](https://redirect.github.com/nodeca/js-yaml/issues/221).
- Fix flow scalar trailing whitespace folding,
[#&#8203;307](https://redirect.github.com/nodeca/js-yaml/issues/307).
- Fix digits in YAML named tag handles.

##### Security

- Fix potential DoS via quadratic complexity in merge - deduplicate
repeated
  elements (makes sense for malformed files > 10K).

</details>

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v11.5.1`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1151)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.5.0...v11.5.1)

##### Patch Changes

- Improve `pnpm audit` performance by pruning non-vulnerable lockfile
subtrees and stopping path enumeration once vulnerable findings reach
the path cap.
- Avoid crashing when the workspace state cache is partially written or
malformed.
- Set `npm_config_user_agent` for root lifecycle scripts during headless
installs.
- Preserve the `integrity` field of a remote (non-registry) tarball
dependency when its lockfile entry is rebuilt. Re-resolving such a
dependency without re-fetching it (for example via `pnpm update`, or
when another dependency changes) produced a resolution with no integrity
— URL/tarball resolvers only learn the integrity after the tarball is
downloaded — so the previously recorded integrity was dropped, making
later installs fail with `ERR_PNPM_MISSING_TARBALL_INTEGRITY`
[#&#8203;12067](https://redirect.github.com/pnpm/pnpm/issues/12067).
- Normalize a string `repository` field into the `{ type, url }` object
form when creating the publish manifest, matching npm's behavior. Some
registries (e.g. Gitea/Codeberg) reject a string `repository` with a 500
Internal Server Error during `pnpm publish`
[#&#8203;12099](https://redirect.github.com/pnpm/pnpm/issues/12099).
- Preserve compatible optional peer versions already present in the
lockfile when resolving dependencies.
- Fixed inconsistent resolution of a peer dependency that is shared
through a diamond. When a package peer-depends on both another package
and one of that package's own peer dependencies (for example
`@typescript-eslint/eslint-plugin` peer-depends on both
`@typescript-eslint/parser` and `typescript`, and
`@typescript-eslint/parser` peer-depends on `typescript`), pnpm no
longer reuses a hoisted instance of the shared peer that was resolved
against a different version
[#&#8203;12079](https://redirect.github.com/pnpm/pnpm/issues/12079).

###
[`v11.5.0`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1150)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.4.0...v11.5.0)

##### Minor Changes

- Added a new `hoistingLimits` setting for `nodeLinker: hoisted`
installs, mirroring yarn's `nmHoistingLimits`. It accepts `none` (the
default — hoist as far as possible), `workspaces` (hoist only as far as
each workspace package), or `dependencies` (hoist only up to each
workspace package's direct dependencies). Originally proposed in
[#&#8203;6468](https://redirect.github.com/pnpm/pnpm/pull/6468), closing
[#&#8203;6457](https://redirect.github.com/pnpm/pnpm/issues/6457).

- Replaced `enquirer` with `@inquirer/prompts` for all interactive
prompts. Fixes the `update -i` scrolling overflow bug where long choice
lists were clipped in the terminal
[#&#8203;6643](https://redirect.github.com/pnpm/pnpm/issues/6643).

  **User-facing changes:**

- `pnpm update -i` / `pnpm update -i --latest`: Scrolling now works
correctly when many packages are available; the new library uses
visual-line-aware pagination via `usePagination`
- `pnpm audit --fix -i`: Same scrolling fix for vulnerability selection
  - `pnpm approve-builds`: Interactive build approval prompts updated
  - `pnpm patch`: Version selection and "apply to all" prompts updated
  - `pnpm patch-remove`: Patch removal selection updated
  - `pnpm publish`: Branch confirmation prompt updated
  - `pnpm login`: Credential prompts updated
- `pnpm run` / `pnpm exec` (with `verifyDepsBeforeRun=prompt`):
Confirmation prompt updated

Vim-style `j`/`k` keys still work for up/down navigation in all
interactive prompts.

**Internal:** The `OtpEnquirer` and `LoginEnquirer` DI interfaces
changed from `{ prompt }` to `{ input }` / `{ input, password }`
respectively. Plugins or custom builds that inject their own enquirer
mock will need to update.

- Staged publishes are now recognized in the trust scale. When a package
version's registry metadata carries an `approver` field, it is treated
as the strongest trust evidence (ranked above trusted publishers and
provenance attestations), since staged publishes require 2FA publish
approvals. This prevents false-positive trust downgrade errors when
moving from a staged publish to a lower trust level
[#&#8203;11887](https://redirect.github.com/pnpm/pnpm/issues/11887).

##### Patch Changes

- Fix pnpm hanging during peer resolution when an aliased install pulls
in transitive packages with mutual peer cycles at different depths in
the dependency tree (for example, `pnpm i nuxt@npm:nuxt-nightly@5x`).
Cycles whose members hit the `findHit` cache instead of running their
own `calculateDepPath` are now short-circuited by sibling resolutions at
the level where the cycle is detected, so the cached path promises no
longer deadlock.
[#&#8203;11999](https://redirect.github.com/pnpm/pnpm/issues/11999).
- Fix `pnpm dist-tag add` and `pnpm dist-tag rm` against npmjs.org
failing without `--otp` with `[ERR_PNPM_UNAUTHORIZED] You must be logged
in to set dist-tag … "You must provide a one-time pass. Upgrade your
client to npm@latest in order to use 2FA."`. pnpm now sends
`npm-auth-type: web` on dist-tag writes and surfaces the resulting OTP
challenge through the existing browser-based 2FA flow (the same
`withOtpHandling` helper used by `pnpm publish`), so the browser opens,
the user authenticates, and the dist-tag is set on retry. `--otp=<code>`
continues to work via the classic flow.
- Fix `minimumReleaseAgeExclude` handling in npm resolution fast paths
so excluded packages do not get pinned to stale versions. Excludes are
honored consistently during `publishedBy` metadata selection and
cache-mtime shortcuts.
- Fix the `integrity` field being dropped from the lockfile entry of a
remote (non-registry) https-tarball dependency when an unrelated package
is installed afterwards. URL/tarball resolvers do not return an
integrity (it is only known after the tarball is downloaded), so when
such a dependency was reused from the lockfile without being re-fetched,
its integrity was lost. It is now carried over from the existing
resolution. With pnpm's lockfile-integrity hardening, the missing
integrity made subsequent `--frozen-lockfile` installs fail with
`ERR_PNPM_MISSING_TARBALL_INTEGRITY`.
[#&#8203;12001](https://redirect.github.com/pnpm/pnpm/issues/12001).
- Skip dependency re-resolution when `pnpm-lock.yaml` is missing but
`node_modules/.pnpm/lock.yaml` exists and still satisfies the manifest.
`pnpm install` now reuses the materialized snapshot to regenerate
`pnpm-lock.yaml` instead of walking the registry to rebuild it from
scratch, turning the cache+node\_modules variation into a near-no-op for
users who deleted the lockfile but kept the install
[#&#8203;11993](https://redirect.github.com/pnpm/pnpm/issues/11993).

`--frozen-lockfile` still refuses to proceed when `pnpm-lock.yaml` is
absent — the regenerated lockfile must be committed, so failing loudly
is the correct behavior for CI.

</details>

<details>
<summary>silverwind/rolldown-license-plugin
(rolldown-license-plugin)</summary>

###
[`v3.0.9`](https://redirect.github.com/silverwind/rolldown-license-plugin/releases/tag/3.0.9)

[Compare
Source](https://redirect.github.com/silverwind/rolldown-license-plugin/compare/3.0.8...3.0.9)

- update deps (silverwind)
- make: collapse patch/minor/major into one rule (silverwind)
- simplify generateBundle: pair dir+raw, rename shadow, inline
single-use const (silverwind)
- make update a combination target, split out update-js (silverwind)
- add update-actions make target (silverwind)
- remove authorship attribution rule from AGENTS.md (silverwind)
- docs: use defineConfig in README usage example (silverwind)

</details>

<details>
<summary>typescript-eslint/typescript-eslint
(typescript-eslint)</summary>

###
[`v8.60.1`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/typescript-eslint/CHANGELOG.md#8601-2026-06-01)

[Compare
Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.60.0...v8.60.1)

This was a version bump only for typescript-eslint to align it with
other projects, there were no code changes.

See [GitHub
Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.60.1)
for more information.

You can read about our [versioning
strategy](https://typescript-eslint.io/users/versioning) and
[releases](https://typescript-eslint.io/users/releases) on our website.

</details>

<details>
<summary>silverwind/updates (updates)</summary>

###
[`v17.17.3`](https://redirect.github.com/silverwind/updates/releases/tag/17.17.3)

[Compare
Source](https://redirect.github.com/silverwind/updates/compare/17.17.2...17.17.3)

- fix prerelease drop in updateVersionRange and scope regex (silverwind)
- fix 1.2.x ranges, docker tag corruption, and per-file cooldown
(silverwind)
- fix go +incompatible, cargo inline-table, and prerelease selection
(silverwind)
- fix --pin range parsing, url tag deps, and -s flag docs (silverwind)
- make update a combination target, split out update-js (silverwind)
- add update-actions make target (silverwind)
- remove authorship attribution rule from AGENTS.md (silverwind)

</details>

<details>
<summary>vitejs/vite (vite)</summary>

###
[`v8.0.16`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-8016-2026-06-01-small)

[Compare
Source](https://redirect.github.com/vitejs/vite/compare/v8.0.15...v8.0.16)

##### Bug Fixes

- **deps:** reject UNC paths for launch-editor-middleware
([#&#8203;22571](https://redirect.github.com/vitejs/vite/issues/22571))
([50b9512](50b951225b))
- reject windows alternate paths
([#&#8203;22572](https://redirect.github.com/vitejs/vite/issues/22572))
([dc245c7](dc245c71e5))

###
[`v8.0.15`](https://redirect.github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-8015-2026-06-01-small)

[Compare
Source](https://redirect.github.com/vitejs/vite/compare/v8.0.14...v8.0.15)

##### Features

- send 408 on request timeout
([#&#8203;22476](https://redirect.github.com/vitejs/vite/issues/22476))
([c85c9ee](c85c9eeb9a))
- update rolldown to 1.0.3
([#&#8203;22538](https://redirect.github.com/vitejs/vite/issues/22538))
([646dbed](646dbedd28))

##### Bug Fixes

- capitalize error messages and remove spurious space in parse error
([#&#8203;22488](https://redirect.github.com/vitejs/vite/issues/22488))
([85a0eff](85a0eff1c8))
- **deps:** update all non-major dependencies
([#&#8203;22511](https://redirect.github.com/vitejs/vite/issues/22511))
([2686d7d](2686d7d0b7))
- **dev:** fix html-proxy cache key mismatch for /@&#8203;fs/ HTML paths
([#&#8203;21762](https://redirect.github.com/vitejs/vite/issues/21762))
([47c4213](47c4213f13))
- **glob:** error on relative glob in virtual module when no files match
([#&#8203;22497](https://redirect.github.com/vitejs/vite/issues/22497))
([5c8e98f](5c8e98f8b5))
- **optimizer:** close the rolldown bundle when write() rejects
([#&#8203;22528](https://redirect.github.com/vitejs/vite/issues/22528))
([e3cfb9d](e3cfb9deec))
- **resolve:** provide onWarn for viteResolvePlugin in JS plugin
containers
([#&#8203;22509](https://redirect.github.com/vitejs/vite/issues/22509))
([40985f1](40985f1c09))

##### Miscellaneous Chores

- **deps:** update rolldown-related dependencies
([#&#8203;22566](https://redirect.github.com/vitejs/vite/issues/22566))
([3052a67](3052a67d93))

##### Code Refactoring

- correct logic in `collectAllModules` function
([#&#8203;22562](https://redirect.github.com/vitejs/vite/issues/22562))
([6978a9c](6978a9ceb9))

</details>

<details>
<summary>vitest-dev/vitest (vitest)</summary>

###
[`v4.1.8`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v4.1.8)

[Compare
Source](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8)

#####    🐞 Bug Fixes

- **browser**:
- Disable client `cdp` API when `allowWrite/allowExec: false` \[backport
to v4]  -  by [@&#8203;hi-ogawa](https://redirect.github.com/hi-ogawa)
and **Codex** in
[#&#8203;10450](https://redirect.github.com/vitest-dev/vitest/issues/10450)
[<samp>(e4067)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/e4067b3b1)
- Remove orphaned Playwright route when same module is mocked via
multiple ids \[backport to v4]  -  by
[@&#8203;toxik](https://redirect.github.com/toxik) and
[@&#8203;Zelys-DFKH](https://redirect.github.com/Zelys-DFKH) in
[#&#8203;10474](https://redirect.github.com/vitest-dev/vitest/issues/10474)
[<samp>(675b4)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/675b4343f)

#####     [View changes on
GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8)

</details>

<details>
<summary>vuejs/language-tools (vue-tsc)</summary>

###
[`v3.3.3`](https://redirect.github.com/vuejs/language-tools/blob/HEAD/CHANGELOG.md#333-2026-05-30)

[Compare
Source](https://redirect.github.com/vuejs/language-tools/compare/v3.3.2...v3.3.3)

##### vscode

- **fix:** prevent grammar scopes leakage in capitalized tags
([#&#8203;6073](https://redirect.github.com/vuejs/language-tools/issues/6073))
- Thanks to [@&#8203;KazariEX](https://redirect.github.com/KazariEX)!
- **fix:** preserve TS auto imports behavior in Vue files
([#&#8203;6072](https://redirect.github.com/vuejs/language-tools/issues/6072))
- Thanks to [@&#8203;KazariEX](https://redirect.github.com/KazariEX)!

##### workspace

- **fix:** read PR title from env in `auto-version` workflow to prevent
injection
([#&#8203;6074](https://redirect.github.com/vuejs/language-tools/issues/6074))
- Thanks to
[@&#8203;arpitjain099](https://redirect.github.com/arpitjain099)!

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Only on Monday (`* * * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: bircni <bircni@icloud.com>

2026-06-08 06:03:55 +00:00

.devcontainer

chore: upgrade Go version in devcontainer image to 1.26 (#37374 )

2026-04-22 21:47:59 +02:00

.github

chore(deps): update action dependencies (#38027 )

2026-06-08 07:40:35 +02:00

assets

chore(deps): upgrade zstd seekable package (#37988 )

2026-06-04 13:38:56 +00:00

build

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )

2026-05-26 15:49:31 -07:00

cmd

fix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass (#38008 )

2026-06-06 17:44:56 +02:00

contrib

ci: add shellcheck linter (#37682 )

2026-05-22 20:22:04 +00:00

custom/conf

feat(repo): split repository creation limit into user and org scopes (#37872 )

2026-05-28 19:29:32 +02:00

docker

ci: add shellcheck linter (#37682 )

2026-05-22 20:22:04 +00:00

docs

feat(actions): List workflows that were executed once but got removed from the default branch (#37835 )

2026-05-25 14:41:36 +00:00

models

fix: bound CODEOWNERS regex match time (#38011 )

2026-06-07 15:30:18 +00:00

modules

refactor(api): clarify APIError message usage and fix legacy lint error (#38012 )

2026-06-07 06:19:39 +00:00

options

[skip ci] Updated translations via Crowdin

2026-06-05 01:18:00 +00:00

public

fix(deps): update npm dependencies (#38029 )

2026-06-08 06:03:55 +00:00

routers

enhance: Adjust Workflow Graph styling (#37497 )

2026-06-07 16:45:20 +00:00

services

fix: bound CODEOWNERS regex match time (#38011 )

2026-06-07 15:30:18 +00:00

snap

ci: add shellcheck linter (#37682 )

2026-05-22 20:22:04 +00:00

templates

enhance: Adjust Workflow Graph styling (#37497 )

2026-06-07 16:45:20 +00:00

tests

fix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009 )

2026-06-06 22:07:47 +00:00

tools

fix(deps): update npm dependencies, remove nolyfill (#37968 )

2026-06-02 07:18:20 +02:00

web_src

enhance: Adjust Workflow Graph styling (#37497 )

2026-06-07 16:45:20 +00:00

.air.toml

Update JS deps, fix deprecations (#36040 )

2025-11-27 23:58:10 +00:00

.changelog.yml

Don't add useless labels which will bother changelog generation (#37267 )

2026-04-19 11:34:40 -07:00

.dockerignore

Refactor integration tests infrastructure (#37462 )

2026-04-29 16:37:38 +00:00

.editorconfig

Serve OpenAPI 3.0 spec at /openapi.v1.json (#37038 )

2026-04-29 20:47:52 +08:00

.envrc

…

.gitattributes

docs: mark openapi3 as autogenerated in attributes (#37963 )

2026-06-01 16:22:17 +00:00

.gitignore

Allow multiple projects per issue and pull requests (#36784 )

2026-04-30 22:38:05 +08:00

.golangci.yml

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )

2026-05-26 15:49:31 -07:00

.ignore

…

.mailmap

…

.markdownlint.yaml

…

.shellcheckrc

ci: add shellcheck linter (#37682 )

2026-05-22 20:22:04 +00:00

.spectral.yaml

…

.yamllint.yaml

Move jobparser from act repository to Gitea (#36699 )

2026-02-22 19:33:01 +00:00

AGENTS.md

docs: mark openapi3 as autogenerated in attributes (#37963 )

2026-06-01 16:22:17 +00:00

BSDmakefile

…

CHANGELOG-archived.md

…

CHANGELOG.md

chore: Update 1.26.2 changelog in main (#37796 )

2026-05-20 16:04:42 -07:00

CLAUDE.md

Improve timeline entries for WIP prefix changes in pull requests (#36518 )

2026-02-05 05:57:08 +00:00

CODE_OF_CONDUCT.md

Fixed minor typos in two files #HSFDPMUW (#34944 )

2025-07-06 09:27:26 -07:00

CONTRIBUTING.md

chore: Conventional adjustments (#37677 )

2026-05-17 20:21:01 +00:00

crowdin.yml

Convert locale files from ini to json format (#35489 )

2025-12-19 09:50:48 -08:00

DCO

…

Dockerfile

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )

2026-05-26 15:49:31 -07:00

Dockerfile.rootless

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )

2026-05-26 15:49:31 -07:00

eslint.config.ts

feat(editor): broaden language detection in web code editor (#37619 )

2026-05-10 04:51:46 +00:00

eslint.json.config.ts

chore: clean up "contrib" dir (#37690 )

2026-05-13 14:22:47 +00:00

flake.lock

Update Nix flake (#37425 )

2026-04-26 11:46:48 +02:00

flake.nix

refactor: use modernc sqlite driver as default (#37562 )

2026-05-06 18:57:59 +00:00

go.mod

chore(deps): upgrade zstd seekable package (#37988 )

2026-06-04 13:38:56 +00:00

go.sum

chore(deps): upgrade zstd seekable package (#37988 )

2026-06-04 13:38:56 +00:00

LICENSE

…

main_timezones.go

…

main.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )

2026-05-26 15:49:31 -07:00

MAINTAINERS

fix: use committer time where ever possible as default (#37969 )

2026-06-02 15:08:23 +08:00

Makefile

fix(deps): update npm dependencies, remove nolyfill (#37968 )

2026-06-02 07:18:20 +02:00

package.json

fix(deps): update npm dependencies (#38029 )

2026-06-08 06:03:55 +00:00

playwright.config.ts

Revert "Add WebKit to e2e test matrix (#37298 )" (#37315 )

2026-04-20 19:49:38 +00:00

pnpm-lock.yaml

fix(deps): update npm dependencies (#38029 )

2026-06-08 06:03:55 +00:00

pnpm-workspace.yaml

fix(deps): update npm dependencies, remove nolyfill (#37968 )

2026-06-02 07:18:20 +02:00

pyproject.toml

chore(deps): update dependency zizmor to v1.25.2 (#37839 )

2026-05-25 09:32:24 +00:00

README.md

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )

2026-05-26 15:49:31 -07:00

README.zh-cn.md

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )

2026-05-26 15:49:31 -07:00

README.zh-tw.md

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )

2026-05-26 15:49:31 -07:00

renovate.json5

fix(deps): update npm dependencies, remove nolyfill (#37968 )

2026-06-02 07:18:20 +02:00

SECURITY.md

Upgrade security public key (#34956 )

2025-07-05 10:11:41 -04:00

stylelint.config.ts

refactor: lint bare fill/stroke colors, add vars for git graph color series (#37543 )

2026-05-07 21:18:23 +00:00

tailwind.config.ts

Fix UI regression (#37218 )

2026-04-14 23:24:44 +08:00

tsconfig.json

Enable strict TypeScript, add errorMessage helper (#37292 )

2026-04-20 07:22:05 +00:00

types.d.ts

Remove htmx (#37224 )

2026-04-15 17:26:26 +00:00

uv.lock

chore(deps): update dependency zizmor to v1.25.2 (#37839 )

2026-05-25 09:32:24 +00:00

vite.config.ts

fix(frontend): resolve Vite assets by manifest source path (#37836 )

2026-05-28 06:14:52 +00:00

vitest.config.ts

Enable concurrent vitest execution (#36998 )

2026-03-30 16:17:16 +00:00

README.md

Gitea

繁體中文 | 简体中文

Purpose

The goal of this project is to make the easiest, fastest, and most painless way of setting up a self-hosted Git service.

As Gitea is written in Go, it works across all the platforms and architectures that are supported by Go, including Linux, macOS, and Windows on x86, amd64, ARM and PowerPC architectures. This project has been forked from Gogs since November of 2016, but a lot has changed.

For online demonstrations, you can visit demo.gitea.com.

For accessing free Gitea service (with a limited number of repositories), you can visit gitea.com.

To quickly deploy your own dedicated Gitea instance on Gitea Cloud, you can start a free trial at cloud.gitea.com.

Documentation

You can find comprehensive documentation on our official documentation website.

It includes installation, administration, usage, development, contributing guides, and more to help you get started and explore all features effectively.

If you have any suggestions or would like to contribute to it, you can visit the documentation repository

Building

From the root of the source tree, run:

TAGS="bindata" make build

The build target is split into two sub-targets:

make backend which requires Go Stable, the required version is defined in go.mod.
make frontend which requires Node.js LTS or greater and pnpm.

Internet connectivity is required to download the go and npm modules. When building from the official source tarballs which include pre-built frontend files, the frontend target will not be triggered, making it possible to build without Node.js.

More info: https://docs.gitea.com/installation/install-from-source

Using

After building, a binary file named gitea will be generated in the root of the source tree by default. To run it, use:

./gitea web

Note

If you're interested in using our APIs, we have experimental support with documentation.

Contributing

Expected workflow is: Fork -> Patch -> Push -> Pull Request

Note

YOU MUST READ THE CONTRIBUTORS GUIDE BEFORE STARTING TO WORK ON A PULL REQUEST.

If you have found a vulnerability in the project, please write privately to security@gitea.io. Thanks!

Translating

Translations are done through Crowdin. If you want to translate to a new language, ask one of the managers in the Crowdin project to add a new language there.

You can also just create an issue for adding a language or ask on Discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord. For general translation questions there is a section in the docs. Currently a bit empty, but we hope to fill it as questions pop up.

Get more information from documentation.

Official and Third-Party Projects

We provide an official go-sdk, a CLI tool called tea and an action runner for Gitea Action.

We maintain a list of Gitea-related projects at gitea/awesome-gitea, where you can discover more third-party projects, including SDKs, plugins, themes, and more.

Communication

If you have questions that are not covered by the documentation, you can get in contact with us on our Discord server or create a post in the discourse forum.