Commit graph

24612 commits

Author SHA1 Message Date
Renovate Bot
d01fd19c58 Update https://data.forgejo.org/actions/setup-forgejo action to v3.1.7 (forgejo) (#11559)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [https://data.forgejo.org/actions/setup-forgejo](https://code.forgejo.org/actions/setup-forgejo) | action | patch | `v3.1.6` → `v3.1.7` |

---

### Release Notes

<details>
<summary>actions/setup-forgejo (https://data.forgejo.org/actions/setup-forgejo)</summary>

### [`v3.1.7`](https://code.forgejo.org/actions/setup-forgejo/releases/tag/v3.1.7)

[Compare Source](https://code.forgejo.org/actions/setup-forgejo/compare/v3.1.6...v3.1.7)

<!--start release-notes-assistant-->

<!--URL:https://code.forgejo.org/actions/setup-forgejo-->

- other
  - [PR](https://code.forgejo.org/actions/setup-forgejo/pulls/908): <!--number 908 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9ydW5uZXIgdG8gdjEyLjcuMQ==-->Update dependency forgejo/runner to v12.7.1<!--description-->

<!--end release-notes-assistant-->

</details>

---

### Configuration

📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41Mi4wIiwidXBkYXRlZEluVmVyIjoiNDMuNTIuMCIsInRhcmdldEJyYW5jaCI6ImZvcmdlam8iLCJsYWJlbHMiOlsiZGVwZW5kZW5jeS11cGdyYWRlIiwidGVzdC9ub3QtbmVlZGVkIl19-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11559
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-08 02:52:17 +01:00
Renovate Bot
34ae2899ad Update module code.forgejo.org/forgejo/runner/v12 to v12.7.1 (forgejo) (#11562)
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [code.forgejo.org/forgejo/runner/v12](https://code.forgejo.org/forgejo/runner) | `v12.7.0` -> `v12.7.1` | ![age](https://developer.mend.io/api/mc/badges/age/go/code.forgejo.org%2fforgejo%2frunner%2fv12/v12.7.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/code.forgejo.org%2fforgejo%2frunner%2fv12/v12.7.0/v12.7.1?slim=true) |

---

### Release Notes

<details>
<summary>forgejo/runner (code.forgejo.org/forgejo/runner/v12)</summary>

### [`v12.7.1`](https://code.forgejo.org/forgejo/runner/releases/tag/v12.7.1)

[Compare Source](https://code.forgejo.org/forgejo/runner/compare/v12.7.0...v12.7.1)

- [User guide](https://forgejo.org/docs/next/user/actions/overview/)
- [Administrator guide](https://forgejo.org/docs/next/admin/actions/)
- [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions)

Release Notes

***

<!--start release-notes-assistant-->

<!--URL:https://code.forgejo.org/forgejo/runner-->

- bug fixes
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1402): <!--number 1402 --><!--line 0 --><!--description Zml4OiBjb3JyZWN0IGV4YW1wbGVzL2RvY2tlci1jb21wb3NlIGZvciBgY3JlYXRlLXJ1bm5lci1maWxlYCBiZWhhdmlvdXIgY2hhbmdl-->fix: correct examples/docker-compose for `create-runner-file` behaviour change<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1393): <!--number 1393 --><!--line 0 --><!--description Zml4OiBpbXBsZW1lbnQgaWRlbXBvdGVudCBGZXRjaFRhc2sgQVBJIGNhbGxzIHRvIHJlZHVjZSByaXNrIG9mIGxvc3QgdGFza3M=-->fix: implement idempotent FetchTask API calls to reduce risk of lost tasks<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1388): <!--number 1388 --><!--line 0 --><!--description Zml4OiBhY2NlcHQgYm9vbGVhbiB3b3JrZmxvd19jYWxsIGlucHV0cyB0aGF0IGFyZSBib29sZWFucw==-->fix: accept boolean workflow\_call inputs that are booleans<!--description-->
- other
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1410): <!--number 1410 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLWdpdC9nby1naXQvdjUgdG8gdjUuMTcuMA==-->Update module github.com/go-git/go-git/v5 to v5.17.0<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1409): <!--number 1409 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvLWdpdC9nby1iaWxseS92NSB0byB2NS44LjA=-->Update module github.com/go-git/go-billy/v5 to v5.8.0<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1406): <!--number 1406 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3Zla3RyYS9tb2NrZXJ5L3YyIHRvIHYyLjUzLjY=-->Update module github.com/vektra/mockery/v2 to v2.53.6<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1400): <!--number 1400 --><!--line 0 --><!--description cmVmYWN0b3I6IGNsZWFuLXVwIGVycm9yIGhhbmRsaW5nIG9uIHRhc2sgZXhlY3V0aW9u-->refactor: clean-up error handling on task execution<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1394): <!--number 1394 --><!--line 0 --><!--description VXBkYXRlIGZvcmdlam8tcnVubmVyIHRvIHYxMi43LjA=-->Update forgejo-runner to v12.7.0<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1397): <!--number 1397 --><!--line 0 --><!--description UmV2ZXJ0ICJSZXBsYWNlIE5vZGUuanMgd2l0aCBkYXRhLmZvcmdlam8ub3JnL29jaS9ub2RlIDI0LXRyaXhpZSAoIzEzOTUpIg==-->Revert "Replace Node.js with data.forgejo.org/oci/node 24-trixie ([#&#8203;1395](https://github.com/forgejo/runner/issues/1395))"<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1395): <!--number 1395 --><!--line 0 --><!--description UmVwbGFjZSBOb2RlLmpzIHdpdGggZGF0YS5mb3JnZWpvLm9yZy9vY2kvbm9kZSAyNC10cml4aWU=-->Replace Node.js with data.forgejo.org/oci/node 24-trixie<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1396): <!--number 1396 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL2dvbGFuZ2NpL2dvbGFuZ2NpLWxpbnQvdjIvY21kL2dvbGFuZ2NpLWxpbnQgdG8gdjIuMTAuMQ==-->Update module github.com/golangci/golangci-lint/v2/cmd/golangci-lint to v2.10.1<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1386): <!--number 1386 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby1ydW5uZXItc2VydmljZS15cSB0byB2NC41Mi40-->Update dependency forgejo-runner-service-yq to v4.52.4<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1392): <!--number 1392 --><!--line 0 --><!--description VXBkYXRlIGRlcGVuZGVuY3kgZm9yZ2Vqby9yZWxlYXNlLW5vdGVzLWFzc2lzdGFudCB0byB2MS42LjA=-->Update dependency forgejo/release-notes-assistant to v1.6.0<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1389): <!--number 1389 --><!--line 0 --><!--description dGVzdDogZW5hYmxlIGRpc2FibGVkIHRlc3Rz-->test: enable disabled tests<!--description-->
  - [PR](https://code.forgejo.org/forgejo/runner/pulls/1387): <!--number 1387 --><!--line 0 --><!--description VXBkYXRlIGh0dHBzOi8vZGF0YS5mb3JnZWpvLm9yZy9hY3Rpb25zL3NldHVwLWZvcmdlam8gYWN0aW9uIHRvIHYzLjEuNg==-->Update <https://data.forgejo.org/actions/setup-forgejo> action to v3.1.6<!--description-->

<!--end release-notes-assistant-->

</details>

---

### Configuration

📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41Mi4wIiwidXBkYXRlZEluVmVyIjoiNDMuNTIuMCIsInRhcmdldEJyYW5jaCI6ImZvcmdlam8iLCJsYWJlbHMiOlsiZGVwZW5kZW5jeS11cGdyYWRlIiwidGVzdC9ub3QtbmVlZGVkIl19-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11562
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-08 02:47:21 +01:00
Έλλεν Εμίλια Άννα Zscheile
c357be8b52 chore: rename SafeHTML to TrustHTML (#11481)
Naming is less confusing this way, might not give the impression this will sanitize HTML to safe HTML.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11481
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Έλλεν Εμίλια Άννα Zscheile <fogti+devel@ytrizja.de>
Co-committed-by: Έλλεν Εμίλια Άννα Zscheile <fogti+devel@ytrizja.de>
2026-03-08 02:41:37 +01:00
Renovate Bot
4b7eb821ff Update module github.com/blevesearch/bleve/v2 to v2.5.7 (forgejo) (#11563)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11563
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-08 02:30:53 +01:00
Gusted
c738e59dca fix: modals on small viewport height (#11547)
- For small modals fomantic tried to add a `scrolling` class using a function that was not implemented, this function is now stubbed.
- There's not really a need to conditionally change the behavior of scrolling or not, we can specify `overflow-y: auto` which is more than enough to take care of this. We do add some layout changes to ensure the modal is fully scrollable.
- Refactor to nested CSS.
- Resolves forgejo/forgejo#10991

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11547
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Beowulf <beowulf@beocode.eu>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2026-03-08 00:11:31 +01:00
Robert Wolff
bff5c00b80 feat(api): more verbose error messages and swagger comments for posting issue comments (#11368)
Closes: #11364

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11368
Reviewed-by: Cyborus <cyborus@disroot.org>
Co-authored-by: Robert Wolff <mahlzahn@posteo.de>
Co-committed-by: Robert Wolff <mahlzahn@posteo.de>
2026-03-07 23:16:20 +01:00
Mathieu Fenniak
2db6210f69 feat: read, create, & delete repo-specific access tokens via API (#11504)
This PR is part of a series (#11311).

Adds support for reading and creating repo-secific access tokens through the API via the `GET /users/{username}/tokens`, `POST /users/{username}/tokens`, and `DELETE /users/{username}/tokens/{id}` APIs.

Validation rules are included to [restrict repo-specific access tokens to specific scopes](https://codeberg.org/forgejo/design/issues/50#issuecomment-11093951).

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

(can be removed for JavaScript changes)

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Features
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/11504): <!--number 11504 --><!--line 0 --><!--description cmVhZCwgY3JlYXRlLCAmIGRlbGV0ZSByZXBvLXNwZWNpZmljIGFjY2VzcyB0b2tlbnMgdmlhIEFQSQ==-->read, create, & delete repo-specific access tokens via API<!--description-->
<!--end release-notes-assistant-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11504
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2026-03-07 21:55:08 +01:00
Bram Hagens
48d2af5561 fix: skip repo avatar upload when no file is selected (#11335)
Submitting the repo avatar form without selecting a file shows a raw Go error: `Avatar.Open: open : no such file or directory.`. The existing `nil` check does not prevent this from happening.

The user avatar handler already guards against this same problem with [`form.Avatar != nil && form.Avatar.Filename != ""`](e1cecbd276/routers/web/user/setting/profile.go (L141)), I've done the same for the repo avatar handler.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11335
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Bram Hagens <bram@bramh.me>
Co-committed-by: Bram Hagens <bram@bramh.me>
2026-03-07 20:53:23 +01:00
Renovate Bot
8d330dc9c7 Update code.forgejo.org/forgejo-contrib/go-libravatar digest to add494e (forgejo) (#11486)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11486
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-07 20:03:55 +01:00
anon_ally
950cb098de feat: Add shortcut to link markdown action (#11466)
Follow forgejo/forgejo!9110 and add a shortcut to the link action, via ctrl/command + K.

Close #11353

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11466
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: anon_ally <ANON_ALLY@noreply.codeberg.org>
Co-committed-by: anon_ally <ANON_ALLY@noreply.codeberg.org>
2026-03-07 19:07:10 +01:00
sarge
ae0d0b5b09 fix: RPM registry addrepo instructions (#11478)
The provided instructions for how to add RPM package repo fail on Fedora 43:

```
Unknown argument "--add-repo" for command "config-manager". Add "--help" for more information about the arguments.
```

The [docs](https://forgejo.org/docs/latest/user/packages/rpm/#configuring-the-package-registry-using-dnf5) contain a different command, which does work.

This changes instructions to match docs.

Co-authored-by: sarge <ephemeralsarge@example.com>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11478
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: sarge <sarge@noreply.codeberg.org>
Co-committed-by: sarge <sarge@noreply.codeberg.org>
2026-03-07 19:05:29 +01:00
Renovate Bot
4d2eafdd8e Update dependency tailwindcss to v3.4.19 (forgejo) (#11545)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11545
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-07 19:04:36 +01:00
sarge
54aca2a9ed feat: Add HEAD support for debian repo files (#11489)
Add `HEAD` handlers for repo index file for debian package registry.

Resolves #11488

Co-authored-by: sarge <ephemeralsarge@example.com>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11489
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: sarge <sarge@noreply.codeberg.org>
Co-committed-by: sarge <sarge@noreply.codeberg.org>
2026-03-07 18:59:47 +01:00
Gusted
e3b219ee98 chore: skip sha256 repo for older git versions (#11542)
- Breaks testing on git versions that don't have SHA256 support.

https://codeberg.org/forgejo-integration/forgejo/actions/runs/16172/jobs/1/attempt/1#jobstep-5-2381

```
// TestLinksLogin
	"2026/03/06 06:15:20 ...ices/context/repo.go:1007:28() [E] GetBranchCommit: length 64 has no matched object format: 473a0f4c3be8a93681a267e3b1e9a7dcda1185436fe141f7749120a303721813",
```

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11542
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2026-03-07 15:58:31 +01:00
Mathieu Fenniak
eef3111cc7 chore(deps): upgrade xorm to v1.3.9-forgejo.7 (#11538)
Primarily to gain access to https://code.forgejo.org/xorm/xorm/pulls/67 & https://code.forgejo.org/xorm/xorm/pulls/66 which allows Forgejo to implement a few methods and support `optional.Option[T]` in database beans for nullable fields.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11538
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2026-03-07 15:38:53 +01:00
Renovate Bot
0beec59c01 Update dependency uint8-to-base64 to v0.2.1 (forgejo) (#11549)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11549
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-07 15:01:49 +01:00
Renovate Bot
74f8b819c2 Update dependency forgejo/release-notes-assistant to v1.6.1 (forgejo) (#11543)
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-07 15:01:41 +01:00
panc
a824a34266 fix(ui): add active background color for menu items in tippy tooltips (#11315)
Fix #11309

![image](/attachments/1067134a-e40e-4f21-82bb-fd4324080215)

Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11315
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: panc <pan0xc@foxmail.com>
Co-committed-by: panc <pan0xc@foxmail.com>
2026-03-07 05:52:32 +01:00
Andreas Ahlenstorf
3e849b4b50 fix: extend basic auth to /v2, always include WWW-Authenticate header (#11393)
Forgejo's OCI container registry did not enable basic authentication for the top-level endpoint `/v2`. Furthermore, it did not include the `WWW-Authenticate` header when returning the status code 401 as mandated by [RFC 7235](https://datatracker.ietf.org/doc/html/rfc7235#section-3.1), "Hypertext Transfer Protocol (HTTP/1.1): Authentication", section 3.1. Those deficiencies made it impossible for Apple's [container](https://github.com/apple/container) to log into Forgejo OCI container registry. This has been rectified.

The problem did not occur with most other tools because they do not include credentials when sending the initial request to `/v2`. Forgejo's reply then included `WWW-Authenticate` as expected.

Enabling basic authentication for `/v2` has the side effect that Apple's container uses username and password for all successive requests and not the bearer token. If that is a problem, it's up to Apple to change container's behaviour.

If invalid credentials are passed to `container registry login`, then container enters an infinite loop. The same happens with quay.io, but not ghcr.io (returns 403) or docker.io (returns 401 but _without_ `WWW-Authenticate`). As this is invalid behaviour on container's side, it's up to Apple to change container. Docker and Podman handle it correctly.

Login and pushing have been tested manually with Docker 29.1.3, Podman 5.7.1, and Apple's container 0.9.0.

Resolves https://codeberg.org/forgejo/forgejo/issues/11297.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

(can be removed for JavaScript changes)

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [ ] `make pr-go` before pushing

### Tests for JavaScript changes

(can be removed for Go changes)

- I added test coverage for JavaScript changes...
  - [ ] in `web_src/js/*.test.js` if it can be unit tested.
  - [ ] in `tests/e2e/*.test.e2e.js` if it requires interactions with a live Forgejo server (see also the [developer guide for JavaScript testing](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/tests/e2e/README.md#end-to-end-tests)).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

*The decision if the pull request will be shown in the release notes is up to the mergers / release team.*

The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11393
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Andreas Ahlenstorf <andreas@ahlenstorf.ch>
Co-committed-by: Andreas Ahlenstorf <andreas@ahlenstorf.ch>
2026-03-07 03:19:49 +01:00
limiting-factor
851356577c chore: do not leak global repository unit defaults (#11470)
The [test disabling the issue unit][0] took care of [reseting the disabled units][1]. However, it overlooked that calling [`LoadUnitConfig`][2] also has a [side effect on `DefaultRepoUnits`][3]. It happens when [`validateDefaultRepoUnits` has a side effect][4] on the array backing the slice, when it is [not recreated][5]. As a result the issue unit is disabled for all tests that run after this one.

The subtle side effect is harmless because it only happens in tests, the `LoadUnitConfig` is otherwise only called once. For clarity `LoadUnitConfig` is modified to clone the unit array being validated so that the returned slice is never backed by the same array as the argument.

As the global variables used for repository units should be saved and restored as a whole, a dedicated test function (`SaveUnits`) is provided to be used by both integration tests and unit tests. The test of the unit model is refactored to be a blackbox test in order to avoid an import cycle.

[0]: cce5f868ce/tests/integration/repo_settings_test.go (L258)
[1]: cce5f868ce/tests/integration/repo_settings_test.go (L253)
[2]: cce5f868ce/models/unit/unit.go (L171)
[3]: cce5f868ce/models/unit/unit.go (L182)
[4]: cce5f868ce/models/unit/unit.go (L162)
[5]: cce5f868ce/models/unit/unit.go (L148)

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11470
Reviewed-by: Ellen Εμιλία Άννα Zscheile <fogti@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: limiting-factor <limiting-factor@posteo.com>
Co-committed-by: limiting-factor <limiting-factor@posteo.com>
2026-03-07 02:03:22 +01:00
Renovate Bot
c0d8c3221f Update dependency minimatch to v10.2.4 (forgejo) (#11523)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11523
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-07 00:49:57 +01:00
patdyn
df79ccf7d8 Move Container API processing logic to service (#11432)
As discussed here: https://codeberg.org/forgejo/discussions/issues/444 the container v2 API logic does need some refactoring for better maintainability.

This is a proposition on how to achieve that. My goal was to be able to write unit tests for functions like processImageManifest() which are currently only tested indirectly by TestPackageContainer() in tests/integration/api_packages_container_test.go.

A first unit test was implemented that targets ProcessManifest(). I think that test also shows what steps are needed to successfully execute the ProcessManifest() function and hopefully helps understanding that code better.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

(can be removed for JavaScript changes)

- I added test coverage for Go changes...
  - [x ] in their respective `*_test.go` for unit tests.
  - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x ] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

*The decision if the pull request will be shown in the release notes is up to the mergers / release team.*

The content of the `release-notes/<pull request number>.md` file will serve as the basis for the release notes. If the file does not exist, the title of the pull request will be used instead.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11432
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: patdyn <patdyn@noreply.codeberg.org>
Co-committed-by: patdyn <patdyn@noreply.codeberg.org>
2026-03-06 18:56:49 +01:00
Mathieu Fenniak
7fdb31c8ef chore: add more diagnostic output to dbfs Stat error (#11525)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11525
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2026-03-06 06:43:33 +01:00
Renovate Bot
b8dac67364 Update dependency go to v1.25.8 (forgejo) (#11521)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11521
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-06 03:53:06 +01:00
Renovate Bot
c929c50863 Update dependency katex to v0.16.33 (forgejo) (#11520)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11520
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-06 02:22:14 +01:00
Renovate Bot
3b0b13a882 Update dependency dayjs to v1.11.19 (forgejo) (#11519)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11519
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-06 02:21:15 +01:00
Renovate Bot
0f2f5017a0 Update CodeMirror (forgejo) (#11517)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11517
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-06 01:09:08 +01:00
Oliver Eikemeier
757eb2f267 chore: handle error types consistently (#9873)
Some error types are used inconsistently or wrong:

- `forgejo.org/modules/git.ErrNotExist` is meant to be a value error: <[modules/git/error.go#L23](https://codeberg.org/forgejo/forgejo/src/tag/v13.0.2/modules/git/error.go#L23)>

- `forgejo.org/models/repo.ErrRepoNotExist` is meant to be a value error: <[models/repo/repo.go#L750](https://codeberg.org/forgejo/forgejo/src/tag/v13.0.2/models/repo/repo.go#L750)>

- `errors.Is(logErr, &net.OpError{})` is always `false`: <[services/context/context_response.go#L188](https://codeberg.org/forgejo/forgejo/src/tag/v13.0.2/services/context/context_response.go#L188)>

- `forgejo.org/models/issues.ErrIssueContentHistoryNotExist` is used inconsistently: <[models/issues/content_history.go#L211](https://codeberg.org/forgejo/forgejo/src/tag/v13.0.2/models/issues/content_history.go#L211)>
Decided to use a value, since the structure is small and to be in line with the above errors.

These issued where found with the [errortype](https://codeberg.org/fillmore-labs/errortype) linter and add this to Makefile as part of the linter suite.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9873
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Oliver Eikemeier <eikemeier@fillmore-labs.com>
Co-committed-by: Oliver Eikemeier <eikemeier@fillmore-labs.com>
2026-03-06 00:48:06 +01:00
Renovate Bot
06f0788e00 Update module github.com/markbates/goth to v1.82.0 (forgejo) (#11450)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11450
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-05 23:42:14 +01:00
Renovate Bot
c896f480d4 Update dependency mermaid to v11.12.3 (forgejo) (#11385)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11385
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Co-committed-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
2026-03-05 21:58:26 +01:00
marijnjh
e47957e24c fix: replace reference to Monaco with CodeMirror in app.example.ini (#11507)
Just a small fix in a comment in the example config file.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11507
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: marijnjh <marijnjh@noreply.codeberg.org>
Co-committed-by: marijnjh <marijnjh@noreply.codeberg.org>
2026-03-05 21:32:13 +01:00
Renovate Bot
df9a9cc5e1 Update dependency svgo to v4.0.1 [SECURITY] (forgejo) (#11508)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11508
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-05 14:26:22 +01:00
Renovate Bot
05d98b9729 Update linters (forgejo) (#11448)
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-04 18:23:48 +01:00
Renovate Bot
1d1a5ae5e7 Update dependency @vitest/eslint-plugin to v1.6.9 (forgejo) (#11493)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11493
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-04 16:18:15 +01:00
Mathieu Fenniak
99984dac4d feat: remove admin-level permissions from repo-specific & public-only access tokens (#11468)
This PR is part of a series (#11311).

If the user authenticating to an API call is a Forgejo site administrator, or a Forgejo repo administrator, a wide variety of permission and ownership checks in the API are either bypassed, or are bypassable.  If a user has created an access token with restricted resources, I understand the intent of the user is to create a token which has a layer of risk reduction in the event that the token is lost/leaked to an attacker.  For this reason, it makes sense to me that restricted scope access tokens shouldn't inherit the owner's administrator access.

My intent is that repo-specific access tokens [will only be able to access specific authorization scopes](https://codeberg.org/forgejo/design/issues/50#issuecomment-11093951), probably: `repository:read`, `repository:write`, `issue:read`, `issue:write`, (`organization:read` / `user:read` maybe).  This means that *most* admin access is not intended to be affected by this because repo-specific access tokens won't have, for example, `admin:write` scope.  However, administrative access still grants elevated permissions in some areas that are relevant to these scopes, and need to be restricted:

- The `?sudo=otheruser` query parameter allows site administrators to impersonate other users in the API.
- Repository management rules are different for a site administrator, allowing them to create repos for another user, create repos in another organization, migrate a repository to an arbitrary owner, and transfer a repository to a prviate organization.
- Administrators have access to extra data through some APIs which would be in scope: the detailed configuration of branch protection rules, the some details of repository deploy keys (which repo, and which scope -- seems odd), (user:read -- user SSH keys, activity feeds of private users, user profiles of private users, user webhook configurations).
- Pull request reviews have additional perms for repo administrators, including the ability to dismiss PR reviews, delete PR reviews, and view draft PR reviews.
- Repo admins and site admins can comment on locked issues, and related to comments can edit or delete other user's comments and attachments.
- Repo admins can manage and view logged time on behalf of other users.

A handful of these permissions may make sense for repo-specific access tokens, but most of them clearly exceed the risk that would be expected from creating a limited scope access token.  I'd generally prefer to take a restrictive approach, and we can relax it if real-world use-cases come in -- users will have a workaround of creating an access token without repo-specific restrictions if they are blocked from needed access.

**Breaking:** The administration restrictions introduced in this PR affect both repo-specific access tokens, and existing public-only access tokens.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

(can be removed for JavaScript changes)

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
    - Although repo-specific access tokens are not yet exposed to end users, the breaking changes to public-only tokens will be visible to users and require release notes.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11468
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2026-03-04 16:17:41 +01:00
Renovate Bot
0dd594baca Update github.com/cloudflare/circl (indirect) to v1.6.3 [SECURITY] (forgejo) (#11492)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11492
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-04 16:16:46 +01:00
Gusted
5207594b63 chore: update license test (#11485)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11485
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
2026-03-04 16:16:12 +01:00
Michael Kriese
ad6ab32e96 chore(renovate): update config (#11490)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11490
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Michael Kriese <michael.kriese@visualon.de>
Co-committed-by: Michael Kriese <michael.kriese@visualon.de>
2026-03-04 15:20:24 +01:00
nachtjasmin
b21193ee50 chore: use signal.NotifyContext over custom implementation (#10311)
Go 1.16 added the signal.NotifyContext helper utility. `installSignals` could be further inlined in a future iteration, if needed.

When reading the [function documentation](https://pkg.go.dev/os/signal#NotifyContext), it becomes clear that this is doing the exact same thing as the old code.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/10311
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: nachtjasmin <nachtjasmin@posteo.de>
Co-committed-by: nachtjasmin <nachtjasmin@posteo.de>
2026-03-04 00:45:38 +01:00
0ko
8d6812df25 fix(ui): use overflow:auto to avoid scrollbars when they are not needed (#11469)
Closes forgejo/forgejo#11407

I looked at related Gitea discussions for when it was implemented and it looks like what to use exactly for `overflow` was not discussed, the intention was just to have overflowing content scroll, not to have irrelevant scrollbars appear at all times.

- https://github.com/go-gitea/gitea/pull/31683
- https://github.com/go-gitea/gitea/issues/31667
- https://github.com/go-gitea/gitea/pull/26561

But with `max-height` restrictions that are in place only horizontal scrollbars are ever needed on demand. Vertical ones are not needed. For this `auto` works much better than `scroll`.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11469
Reviewed-by: Beowulf <beowulf@beocode.eu>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
2026-03-04 00:36:54 +01:00
Robert Wolff
d467c2bed7 chore: update licenses and gitignores [skip ci] (#11158)
… by simply running `make generate-license` and `make generate-gitignore` (last time: 9d2fabc7d3)

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11158
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Robert Wolff <mahlzahn@posteo.de>
Co-committed-by: Robert Wolff <mahlzahn@posteo.de>
2026-03-03 21:42:13 +01:00
Renovate Bot
607f2bb8d7 Update module github.com/valyala/fastjson to v1.6.10 (forgejo) (#11477)
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [github.com/valyala/fastjson](https://github.com/valyala/fastjson) | `v1.6.7` -> `v1.6.10` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fvalyala%2ffastjson/v1.6.10?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fvalyala%2ffastjson/v1.6.7/v1.6.10?slim=true) |

---

### Release Notes

<details>
<summary>valyala/fastjson (github.com/valyala/fastjson)</summary>

### [`v1.6.10`](https://github.com/valyala/fastjson/compare/v1.6.9...v1.6.10)

[Compare Source](https://github.com/valyala/fastjson/compare/v1.6.9...v1.6.10)

### [`v1.6.9`](https://github.com/valyala/fastjson/compare/v1.6.8...v1.6.9)

[Compare Source](https://github.com/valyala/fastjson/compare/v1.6.8...v1.6.9)

### [`v1.6.8`](https://github.com/valyala/fastjson/compare/v1.6.7...v1.6.8)

[Compare Source](https://github.com/valyala/fastjson/compare/v1.6.7...v1.6.8)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjAiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjAiLCJ0YXJnZXRCcmFuY2giOiJmb3JnZWpvIiwibGFiZWxzIjpbImRlcGVuZGVuY3ktdXBncmFkZSIsInRlc3Qvbm90LW5lZWRlZCJdfQ==-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11477
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-03 21:36:25 +01:00
oliverpool
a0d6970442 fix: prevent panic on gitlab import (releases/issues) (#11282)
It is unfortunately all mixed up, because refreshing the data, means breaking the tests. And changing the code means needing fresh data.

- tests: ignore some more headers and sort the rest when dumping http responses
- code: fixed #10234 by requesting the latest issues first.
- tests: created a new repo to replace the disappeared repo, needed for the skip-numbers test
- refreshed the testdata.
- follow-up fixes to get the tests green.
- including a cherry-pick of https://github.com/go-gitea/gitea/pull/36295 and #11272

Co-authored-by: Joakim Olsson <joakim@unbound.se>
Co-authored-by: Robert Wolff <mahlzahn@posteo.de>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11282
Reviewed-by: Robert Wolff <mahlzahn@posteo.de>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Reviewed-by: patdyn <patdyn@noreply.codeberg.org>
Co-authored-by: oliverpool <git@olivier.pfad.fr>
Co-committed-by: oliverpool <git@olivier.pfad.fr>
2026-03-03 21:36:14 +01:00
Mathieu Fenniak
3d6acf5e8c ci: add semgrep detection for API code ignoring repo-specific access tokens (#11476)
This PR is part of a series (#11311).

Prevents the usage of three internal APIs in the web API code:
- `repo_model.SearchRepoOptions{}` without an `AuthorizationReducer`
- `organization.SearchTeamRepoOptions{}` without an `AuthorizationReducer`
- `access_model.GetUserRepoPermission()`, which doesn't take an `AuthorizationReducer` -- use `GetUserRepoPermissionWithReducer` instead.

A couple lingering usages are marked with `// nosemgrep: ...` as they have been inspected and considered correct as-is.

The `GetUserRepoPermission` is tested via the `.semgrep/tests` files; the other rules have been tested manually.

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Documentation

- [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
- [x] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11476
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2026-03-03 17:55:35 +01:00
forgejo-renovate-action
cfc8a6701a Update dependency swagger-ui-dist to v5.31.1 (forgejo) (#11374) 2026-03-03 02:33:46 +01:00
0ko
a0faae2764 fix(ui/mde): inputs in table/link insertion modals (#11341)
Fixes #11268
Fixes regression of #9614

Calling `initDisabledInputs` wasn't effective for template contents, so inputs in MDEs spawned by repo-legacy.js on comment editing were broken. Now repo-legacy.js also calls it when it spawns a new MDE.

Co-authored-by: Gusted <Gusted@noreply.codeberg.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11341
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Co-committed-by: 0ko <0ko@noreply.codeberg.org>
2026-03-02 23:32:40 +01:00
Mathieu Fenniak
6bac9e29e7 Revert "fix: ensure actions logs are transferred when a task is done (#10008)" (#11462)
This reverts commit d4951968f0, #10008.

When Forgejo cancels a job server-side, for example due to an additional push to an open PR, it immediately archives the logs from DBFS to disk due to the changes in #10008.  Then, the runner recognizes that the job status is cancelled and it attempts to flush its pending logs to Forgejo, resulting in warnings being logged:

```
forgejo-runner.log:time="2026-02-23T01:32:11+01:00" level=warning msg="uploading final logs failed, but will be retried: already_exists: log file has been archived" task_id=51
forgejo-runner.log:time="2026-02-23T01:32:11+01:00" level=warning msg="uploading final logs failed, but will be retried: already_exists: log file has been archived" task_id=51
forgejo-runner.log:time="2026-02-23T01:32:11+01:00" level=warning msg="uploading final logs failed, but will be retried: already_exists: log file has been archived" task_id=51
forgejo-runner.log:time="2026-02-23T01:32:12+01:00" level=warning msg="uploading final logs failed, but will be retried: already_exists: log file has been archived" task_id=51
forgejo-runner.log:time="2026-02-23T01:32:13+01:00" level=warning msg="uploading final logs failed, but will be retried: already_exists: log file has been archived" task_id=51
forgejo-runner.log:time="2026-02-23T01:32:14+01:00" level=warning msg="uploading final logs failed, but will be retried: already_exists: log file has been archived" task_id=51
forgejo-runner.log:time="2026-02-23T01:32:16+01:00" level=info msg="runner: received shutdown signal"
forgejo-runner.log:time="2026-02-23T01:32:16+01:00" level=info msg="runner: shutdown initiated, waiting [runner].shutdown_timeout=0s for running jobs to complete before shutting down"
forgejo-runner.log:time="2026-02-23T01:32:16+01:00" level=info msg="[poller] shutdown begin, 1 tasks currently running"
forgejo-runner.log:time="2026-02-23T01:32:16+01:00" level=info msg="forcing the jobs to shutdown"
forgejo-runner.log:time="2026-02-23T01:32:18+01:00" level=warning msg="uploading final logs failed, but will be retried: already_exists: log file has been archived" task_id=51
forgejo-runner.log:time="2026-02-23T01:32:24+01:00" level=warning msg="uploading final logs failed, but will be retried: already_exists: log file has been archived" task_id=51
```

This appears to be the cause of the `push-cancel` end-to-end test failing since #10008 was merged.  https://code.forgejo.org/forgejo/end-to-end/actions/runs/4985/jobs/8/attempt/1   The `push-cancel` test case itself seems to succeed, but then the test process aborts with `return 1`.  Doesn't reproduce locally.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11462
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net>
Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
2026-03-02 15:34:09 +01:00
Renovate Bot
ddcf37fdfe Update module golang.org/x/net to v0.51.0 [SECURITY] (forgejo) (#11447)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11447
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-02 13:56:59 +01:00
Renovate Bot
9803d002ce Update module github.com/SaveTheRbtz/zstd-seekable-format-go/pkg to v0.8.0 (forgejo) (#11451)
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11451
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
2026-03-02 13:37:56 +01:00
jaylinski
cce5f868ce chore(Dockerfile.rootless): remove legacy config file support (#11098)
This legacy support was added in version 8. We now have version 14, so this deprecated feature can be confidently removed.

See dad16cd589 for a detailed explanation.

Docs PR: https://codeberg.org/forgejo/docs/pulls/1740

Co-authored-by: Jakob Linskeseder <jakob@linskeseder.com>
Co-authored-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11098
Reviewed-by: Michael Kriese <michael.kriese@gmx.de>
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Reviewed-by: Gusted <gusted@noreply.codeberg.org>
Co-authored-by: jaylinski <jaylinski@noreply.codeberg.org>
Co-committed-by: jaylinski <jaylinski@noreply.codeberg.org>
2026-03-02 06:03:39 +01:00